2 * auth.c - PPP authentication and phase control.
4 * Copyright (c) 1993-2002 Paul Mackerras. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. The name(s) of the authors of this software must not be used to
14 * endorse or promote products derived from this software without
15 * prior written permission.
17 * 3. Redistributions of any form whatsoever must retain the following
19 * "This product includes software developed by Paul Mackerras
20 * <paulus@samba.org>".
22 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
23 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
24 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
25 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
26 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
27 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
28 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 * Derived from main.c, which is:
32 * Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in
43 * the documentation and/or other materials provided with the
46 * 3. The name "Carnegie Mellon University" must not be used to
47 * endorse or promote products derived from this software without
48 * prior written permission. For permission or any legal
49 * details, please contact
50 * Office of Technology Transfer
51 * Carnegie Mellon University
53 * Pittsburgh, PA 15213-3890
54 * (412) 268-4387, fax: (412) 268-7395
55 * tech-transfer@andrew.cmu.edu
57 * 4. Redistributions of any form whatsoever must retain the following
59 * "This product includes software developed by Computing Services
60 * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
62 * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
63 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
64 * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
65 * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
66 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
67 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
68 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
71 #define RCSID "$Id: auth.c,v 1.117 2008/07/01 12:27:56 paulus Exp $"
81 #include <sys/types.h>
83 #include <sys/socket.h>
86 #if defined(_PATH_LASTLOG) && defined(__linux__)
91 #include <netinet/in.h>
92 #include <arpa/inet.h>
98 #define PW_PPP PW_LOGIN
110 #include "chap-new.h"
115 #include "pathnames.h"
118 static const char rcsid
[] = RCSID
;
120 /* Bits in scan_authfile return value */
121 #define NONWILD_SERVER 1
122 #define NONWILD_CLIENT 2
124 #define ISWILD(word) (word[0] == '*' && word[1] == 0)
126 /* The name by which the peer authenticated itself to us. */
127 char peer_authname
[MAXNAMELEN
];
129 /* Records which authentication operations haven't completed yet. */
130 static int auth_pending
[NUM_PPP
];
132 /* Records which authentication operations have been completed. */
133 int auth_done
[NUM_PPP
];
135 /* List of addresses which the peer may use. */
136 static struct permitted_ip
*addresses
[NUM_PPP
];
138 /* Wordlist giving addresses which the peer may use
139 without authenticating itself. */
140 static struct wordlist
*noauth_addrs
;
142 /* Remote telephone number, if available */
143 char remote_number
[MAXNAMELEN
];
145 /* Wordlist giving remote telephone numbers which may connect. */
146 static struct wordlist
*permitted_numbers
;
148 /* Extra options to apply, from the secrets file entry for the peer. */
149 static struct wordlist
*extra_options
;
151 /* Number of network protocols which we have opened. */
152 static int num_np_open
;
154 /* Number of network protocols which have come up. */
155 static int num_np_up
;
157 /* Set if we got the contents of passwd[] from the pap-secrets file. */
158 static int passwd_from_file
;
160 /* Set if we require authentication only because we have a default route. */
161 static bool default_auth
;
163 /* Hook to enable a plugin to control the idle time limit */
164 int (*idle_time_hook
) __P((struct ppp_idle
*)) = NULL
;
166 /* Hook for a plugin to say whether we can possibly authenticate any peer */
167 int (*pap_check_hook
) __P((void)) = NULL
;
169 /* Hook for a plugin to check the PAP user and password */
170 int (*pap_auth_hook
) __P((char *user
, char *passwd
, char **msgp
,
171 struct wordlist
**paddrs
,
172 struct wordlist
**popts
)) = NULL
;
174 /* Hook for a plugin to know about the PAP user logout */
175 void (*pap_logout_hook
) __P((void)) = NULL
;
177 /* Hook for a plugin to get the PAP password for authenticating us */
178 int (*pap_passwd_hook
) __P((char *user
, char *passwd
)) = NULL
;
180 /* Hook for a plugin to say if we can possibly authenticate a peer using CHAP */
181 int (*chap_check_hook
) __P((void)) = NULL
;
183 /* Hook for a plugin to get the CHAP password for authenticating us */
184 int (*chap_passwd_hook
) __P((char *user
, char *passwd
)) = NULL
;
186 /* Hook for a plugin to say whether it is OK if the peer
187 refuses to authenticate. */
188 int (*null_auth_hook
) __P((struct wordlist
**paddrs
,
189 struct wordlist
**popts
)) = NULL
;
191 int (*allowed_address_hook
) __P((u_int32_t addr
)) = NULL
;
193 #ifdef HAVE_MULTILINK
194 /* Hook for plugin to hear when an interface joins a multilink bundle */
195 void (*multilink_join_hook
) __P((void)) = NULL
;
198 /* A notifier for when the peer has authenticated itself,
199 and we are proceeding to the network phase. */
200 struct notifier
*auth_up_notifier
= NULL
;
202 /* A notifier for when the link goes down. */
203 struct notifier
*link_down_notifier
= NULL
;
206 * This is used to ensure that we don't start an auth-up/down
207 * script while one is already running.
214 static enum script_state auth_state
= s_down
;
215 static enum script_state auth_script_state
= s_down
;
216 static pid_t auth_script_pid
= 0;
221 bool uselogin
= 0; /* Use /etc/passwd for checking PAP */
222 bool session_mgmt
= 0; /* Do session management (login records) */
223 bool cryptpap
= 0; /* Passwords in pap-secrets are encrypted */
224 bool refuse_pap
= 0; /* Don't wanna auth. ourselves with PAP */
225 bool refuse_chap
= 0; /* Don't wanna auth. ourselves with CHAP */
226 bool refuse_eap
= 0; /* Don't wanna auth. ourselves with EAP */
228 bool refuse_mschap
= 0; /* Don't wanna auth. ourselves with MS-CHAP */
229 bool refuse_mschap_v2
= 0; /* Don't wanna auth. ourselves with MS-CHAPv2 */
230 bool ms_ignore_domain
= 0;
232 bool refuse_mschap
= 1; /* Don't wanna auth. ourselves with MS-CHAP */
233 bool refuse_mschap_v2
= 1; /* Don't wanna auth. ourselves with MS-CHAPv2 */
235 bool usehostname
= 0; /* Use hostname for our_name */
236 bool auth_required
= 0; /* Always require authentication from peer */
237 bool allow_any_ip
= 0; /* Allow peer to use any IP address */
238 bool explicit_remote
= 0; /* User specified explicit remote name */
239 bool explicit_user
= 0; /* Set if "user" option supplied */
240 bool explicit_passwd
= 0; /* Set if "password" option supplied */
241 char remote_name
[MAXNAMELEN
]; /* Peer's name for authentication */
243 static char *uafname
; /* name of most recent +ua file */
245 extern char *crypt
__P((const char *, const char *));
247 /* Prototypes for procedures local to this file. */
249 static void network_phase
__P((int));
250 static void check_idle
__P((void *));
251 static void connect_time_expired
__P((void *));
252 static int null_login
__P((int));
253 static int get_pap_passwd
__P((char *));
254 static int have_pap_secret
__P((int *));
255 static int have_chap_secret
__P((char *, char *, int, int *));
256 static int have_srp_secret
__P((char *client
, char *server
, int need_ip
,
258 static int ip_addr_check
__P((u_int32_t
, struct permitted_ip
*));
259 static int scan_authfile
__P((FILE *, char *, char *, char *,
260 struct wordlist
**, struct wordlist
**,
262 static void free_wordlist
__P((struct wordlist
*));
263 static void auth_script
__P((char *));
264 static void auth_script_done
__P((void *));
265 static void set_allowed_addrs
__P((int, struct wordlist
*, struct wordlist
*));
266 static int some_ip_ok
__P((struct wordlist
*));
267 static int setupapfile
__P((char **));
268 static int privgroup
__P((char **));
269 static int set_noauth_addr
__P((char **));
270 static int set_permitted_number
__P((char **));
271 static void check_access
__P((FILE *, char *));
272 static int wordlist_count
__P((struct wordlist
*));
275 static void check_maxoctets
__P((void *));
279 * Authentication-related options.
281 option_t auth_options
[] = {
282 { "auth", o_bool
, &auth_required
,
283 "Require authentication from peer", OPT_PRIO
| 1 },
284 { "noauth", o_bool
, &auth_required
,
285 "Don't require peer to authenticate", OPT_PRIOSUB
| OPT_PRIV
,
287 { "require-pap", o_bool
, &lcp_wantoptions
[0].neg_upap
,
288 "Require PAP authentication from peer",
289 OPT_PRIOSUB
| 1, &auth_required
},
290 { "+pap", o_bool
, &lcp_wantoptions
[0].neg_upap
,
291 "Require PAP authentication from peer",
292 OPT_ALIAS
| OPT_PRIOSUB
| 1, &auth_required
},
293 { "require-chap", o_bool
, &auth_required
,
294 "Require CHAP authentication from peer",
295 OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MD5
,
296 &lcp_wantoptions
[0].chap_mdtype
},
297 { "+chap", o_bool
, &auth_required
,
298 "Require CHAP authentication from peer",
299 OPT_ALIAS
| OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MD5
,
300 &lcp_wantoptions
[0].chap_mdtype
},
301 { "chap-secrets", o_string
, &chapseccustom
,
302 "Specify custom chap-secrets file", OPT_PRIO
},
304 { "require-mschap", o_bool
, &auth_required
,
305 "Require MS-CHAP authentication from peer",
306 OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MICROSOFT
,
307 &lcp_wantoptions
[0].chap_mdtype
},
308 { "+mschap", o_bool
, &auth_required
,
309 "Require MS-CHAP authentication from peer",
310 OPT_ALIAS
| OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MICROSOFT
,
311 &lcp_wantoptions
[0].chap_mdtype
},
312 { "require-mschap-v2", o_bool
, &auth_required
,
313 "Require MS-CHAPv2 authentication from peer",
314 OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MICROSOFT_V2
,
315 &lcp_wantoptions
[0].chap_mdtype
},
316 { "+mschap-v2", o_bool
, &auth_required
,
317 "Require MS-CHAPv2 authentication from peer",
318 OPT_ALIAS
| OPT_PRIOSUB
| OPT_A2OR
| MDTYPE_MICROSOFT_V2
,
319 &lcp_wantoptions
[0].chap_mdtype
},
320 { "ms-ignore-domain", o_bool
, &ms_ignore_domain
,
321 "Ignore any MS domain prefix in the username", 1 },
325 { "refuse-pap", o_bool
, &refuse_pap
,
326 "Don't agree to auth to peer with PAP", 1 },
327 { "-pap", o_bool
, &refuse_pap
,
328 "Don't allow PAP authentication with peer", OPT_ALIAS
| 1 },
329 { "refuse-chap", o_bool
, &refuse_chap
,
330 "Don't agree to auth to peer with CHAP",
331 OPT_A2CLRB
| MDTYPE_MD5
,
332 &lcp_allowoptions
[0].chap_mdtype
},
333 { "-chap", o_bool
, &refuse_chap
,
334 "Don't allow CHAP authentication with peer",
335 OPT_ALIAS
| OPT_A2CLRB
| MDTYPE_MD5
,
336 &lcp_allowoptions
[0].chap_mdtype
},
338 { "refuse-mschap", o_bool
, &refuse_mschap
,
339 "Don't agree to auth to peer with MS-CHAP",
340 OPT_A2CLRB
| MDTYPE_MICROSOFT
,
341 &lcp_allowoptions
[0].chap_mdtype
},
342 { "-mschap", o_bool
, &refuse_mschap
,
343 "Don't allow MS-CHAP authentication with peer",
344 OPT_ALIAS
| OPT_A2CLRB
| MDTYPE_MICROSOFT
,
345 &lcp_allowoptions
[0].chap_mdtype
},
346 { "refuse-mschap-v2", o_bool
, &refuse_mschap_v2
,
347 "Don't agree to auth to peer with MS-CHAPv2",
348 OPT_A2CLRB
| MDTYPE_MICROSOFT_V2
,
349 &lcp_allowoptions
[0].chap_mdtype
},
350 { "-mschap-v2", o_bool
, &refuse_mschap_v2
,
351 "Don't allow MS-CHAPv2 authentication with peer",
352 OPT_ALIAS
| OPT_A2CLRB
| MDTYPE_MICROSOFT_V2
,
353 &lcp_allowoptions
[0].chap_mdtype
},
356 { "require-eap", o_bool
, &lcp_wantoptions
[0].neg_eap
,
357 "Require EAP authentication from peer", OPT_PRIOSUB
| 1,
359 { "refuse-eap", o_bool
, &refuse_eap
,
360 "Don't agree to authenticate to peer with EAP", 1 },
362 { "name", o_string
, our_name
,
363 "Set local name for authentication",
364 OPT_PRIO
| OPT_PRIV
| OPT_STATIC
, NULL
, MAXNAMELEN
},
366 { "+ua", o_special
, (void *)setupapfile
,
367 "Get PAP user and password from file",
368 OPT_PRIO
| OPT_A2STRVAL
, &uafname
},
370 { "user", o_string
, user
,
371 "Set name for auth with peer", OPT_PRIO
| OPT_STATIC
,
372 &explicit_user
, MAXNAMELEN
},
374 { "password", o_string
, passwd
,
375 "Password for authenticating us to the peer",
376 OPT_PRIO
| OPT_STATIC
| OPT_HIDE
,
377 &explicit_passwd
, MAXSECRETLEN
},
379 { "usehostname", o_bool
, &usehostname
,
380 "Must use hostname for authentication", 1 },
382 { "remotename", o_string
, remote_name
,
383 "Set remote name for authentication", OPT_PRIO
| OPT_STATIC
,
384 &explicit_remote
, MAXNAMELEN
},
386 { "login", o_bool
, &uselogin
,
387 "Use system password database for PAP", OPT_A2COPY
| 1 ,
389 { "enable-session", o_bool
, &session_mgmt
,
390 "Enable session accounting for remote peers", OPT_PRIV
| 1 },
392 { "papcrypt", o_bool
, &cryptpap
,
393 "PAP passwords are encrypted", 1 },
395 { "privgroup", o_special
, (void *)privgroup
,
396 "Allow group members to use privileged options", OPT_PRIV
| OPT_A2LIST
},
398 { "allow-ip", o_special
, (void *)set_noauth_addr
,
399 "Set IP address(es) which can be used without authentication",
400 OPT_PRIV
| OPT_A2LIST
},
402 { "remotenumber", o_string
, remote_number
,
403 "Set remote telephone number for authentication", OPT_PRIO
| OPT_STATIC
,
406 { "allow-number", o_special
, (void *)set_permitted_number
,
407 "Set telephone number(s) which are allowed to connect",
408 OPT_PRIV
| OPT_A2LIST
},
414 * setupapfile - specifies UPAP info for authenticating with peer.
423 char u
[MAXNAMELEN
], p
[MAXSECRETLEN
];
426 lcp_allowoptions
[0].neg_upap
= 1;
428 /* open user info file */
429 fname
= strdup(*argv
);
431 novm("+ua file name");
433 if (seteuid(getuid()) == -1) {
434 option_error("unable to reset uid before opening %s: %m", fname
);
437 ufile
= fopen(fname
, "r");
438 if (seteuid(euid
) == -1)
439 fatal("unable to regain privileges: %m");
441 option_error("unable to open user login data file %s", fname
);
444 check_access(ufile
, fname
);
448 if (fgets(u
, MAXNAMELEN
- 1, ufile
) == NULL
449 || fgets(p
, MAXSECRETLEN
- 1, ufile
) == NULL
) {
451 option_error("unable to read user login data file %s", fname
);
456 /* get rid of newlines */
458 if (l
> 0 && u
[l
-1] == '\n')
461 if (l
> 0 && p
[l
-1] == '\n')
464 if (override_value("user", option_priority
, fname
)) {
465 strlcpy(user
, u
, sizeof(user
));
468 if (override_value("passwd", option_priority
, fname
)) {
469 strlcpy(passwd
, p
, sizeof(passwd
));
478 * privgroup - allow members of the group to have privileged access.
489 option_error("group %s is unknown", *argv
);
492 for (i
= 0; i
< ngroups
; ++i
) {
493 if (groups
[i
] == g
->gr_gid
) {
503 * set_noauth_addr - set address(es) that can be used without authentication.
504 * Equivalent to specifying an entry like `"" * "" addr' in pap-secrets.
507 set_noauth_addr(argv
)
511 int l
= strlen(addr
) + 1;
514 wp
= (struct wordlist
*) malloc(sizeof(struct wordlist
) + l
);
516 novm("allow-ip argument");
517 wp
->word
= (char *) (wp
+ 1);
518 wp
->next
= noauth_addrs
;
519 BCOPY(addr
, wp
->word
, l
);
526 * set_permitted_number - set remote telephone number(s) that may connect.
529 set_permitted_number(argv
)
532 char *number
= *argv
;
533 int l
= strlen(number
) + 1;
536 wp
= (struct wordlist
*) malloc(sizeof(struct wordlist
) + l
);
538 novm("allow-number argument");
539 wp
->word
= (char *) (wp
+ 1);
540 wp
->next
= permitted_numbers
;
541 BCOPY(number
, wp
->word
, l
);
542 permitted_numbers
= wp
;
548 * An Open on LCP has requested a change from Dead to Establish phase.
557 * Bring the link up to the point of being able to do ppp.
559 void start_link(unit
)
564 /* we are called via link_terminated, must be ignored */
565 if (phase
== PHASE_DISCONNECT
)
567 status
= EXIT_NEGOTIATION_FAILED
;
568 new_phase(PHASE_SERIALCONN
);
571 devfd
= the_channel
->connect();
572 msg
= "Connect script failed";
576 /* set up the serial device as a ppp interface */
578 * N.B. we used to do tdb_writelock/tdb_writeunlock around this
579 * (from establish_ppp to set_ifunit). However, we won't be
580 * doing the set_ifunit in multilink mode, which is the only time
581 * we need the atomicity that the tdb_writelock/tdb_writeunlock
582 * gives us. Thus we don't need the tdb_writelock/tdb_writeunlock.
584 fd_ppp
= the_channel
->establish_ppp(devfd
);
585 msg
= "ppp establishment failed";
587 status
= EXIT_FATAL_ERROR
;
591 if (!demand
&& ifunit
>= 0)
595 * Start opening the connection and wait for
596 * incoming events (reply, timeout, etc.).
599 notice("Connect: %s <--> %s", ifname
, ppp_devnam
);
601 notice("Starting negotiation on %s", ppp_devnam
);
604 new_phase(PHASE_ESTABLISH
);
610 new_phase(PHASE_DISCONNECT
);
611 if (the_channel
->disconnect
)
612 the_channel
->disconnect();
615 new_phase(PHASE_DEAD
);
616 if (the_channel
->cleanup
)
617 (*the_channel
->cleanup
)();
621 * LCP has terminated the link; go to the Dead phase and take the
622 * physical layer down.
625 link_terminated(unit
)
628 if (phase
== PHASE_DEAD
|| phase
== PHASE_MASTER
)
630 new_phase(PHASE_DISCONNECT
);
632 if (pap_logout_hook
) {
637 if (!doing_multilink
) {
638 notice("Connection terminated.");
641 notice("Link terminated.");
644 * Delete pid files before disestablishing ppp. Otherwise it
645 * can happen that another pppd gets the same unit and then
646 * we delete its pid file.
648 if (!doing_multilink
&& !demand
)
652 * If we may want to bring the link up again, transfer
653 * the ppp unit back to the loopback. Set the
654 * real serial device back to its normal mode of operation.
659 the_channel
->disestablish_ppp(devfd
);
666 if (!doing_multilink
&& !demand
)
667 script_unsetenv("IFNAME");
670 * Run disconnector script, if requested.
671 * XXX we may not be able to do this if the line has hung up!
673 if (devfd
>= 0 && the_channel
->disconnect
) {
674 the_channel
->disconnect();
677 /* not only disconnect, cleanup should also be called to close the devices */
678 if (the_channel
->cleanup
)
679 (*the_channel
->cleanup
)();
681 if (doing_multilink
&& multilink_master
) {
682 if (!bundle_terminating
)
683 new_phase(PHASE_MASTER
);
685 mp_bundle_terminated();
687 new_phase(PHASE_DEAD
);
691 * LCP has gone down; it will either die or try to re-establish.
697 if (auth_state
!= s_down
) {
698 notify(link_down_notifier
, 0);
700 if (auth_script_state
== s_up
&& auth_script_pid
== 0) {
701 update_link_stats(unit
);
702 auth_script_state
= s_down
;
703 auth_script(_PATH_AUTHDOWN
);
706 if (!doing_multilink
) {
707 upper_layers_down(unit
);
708 if (phase
!= PHASE_DEAD
&& phase
!= PHASE_MASTER
)
709 new_phase(PHASE_ESTABLISH
);
711 /* XXX if doing_multilink, should do something to stop
712 network-layer traffic on the link */
715 void upper_layers_down(int unit
)
718 struct protent
*protp
;
720 for (i
= 0; (protp
= protocols
[i
]) != NULL
; ++i
) {
721 if (!protp
->enabled_flag
)
723 if (protp
->protocol
!= PPP_LCP
&& protp
->lowerdown
!= NULL
)
724 (*protp
->lowerdown
)(unit
);
725 if (protp
->protocol
< 0xC000 && protp
->close
!= NULL
)
726 (*protp
->close
)(unit
, "LCP down");
733 * The link is established.
734 * Proceed to the Dead, Authenticate or Network phase as appropriate.
737 link_established(unit
)
741 lcp_options
*wo
= &lcp_wantoptions
[unit
];
742 lcp_options
*go
= &lcp_gotoptions
[unit
];
743 lcp_options
*ho
= &lcp_hisoptions
[unit
];
745 struct protent
*protp
;
748 * Tell higher-level protocols that LCP is up.
750 if (!doing_multilink
) {
751 for (i
= 0; (protp
= protocols
[i
]) != NULL
; ++i
)
752 if (protp
->protocol
!= PPP_LCP
&& protp
->enabled_flag
753 && protp
->lowerup
!= NULL
)
754 (*protp
->lowerup
)(unit
);
757 if (!auth_required
&& noauth_addrs
!= NULL
)
758 set_allowed_addrs(unit
, NULL
, NULL
);
760 if (auth_required
&& !(go
->neg_upap
|| go
->neg_chap
|| go
->neg_eap
)) {
762 * We wanted the peer to authenticate itself, and it refused:
763 * if we have some address(es) it can use without auth, fine,
764 * otherwise treat it as though it authenticated with PAP using
765 * a username of "" and a password of "". If that's not OK,
768 if (noauth_addrs
!= NULL
) {
769 set_allowed_addrs(unit
, NULL
, NULL
);
770 } else if (!wo
->neg_upap
|| uselogin
|| !null_login(unit
)) {
771 warn("peer refused to authenticate: terminating link");
772 status
= EXIT_PEER_AUTH_FAILED
;
773 lcp_close(unit
, "peer refused to authenticate");
778 new_phase(PHASE_AUTHENTICATE
);
781 eap_authpeer(unit
, our_name
);
783 } else if (go
->neg_chap
) {
784 chap_auth_peer(unit
, our_name
, CHAP_DIGEST(go
->chap_mdtype
));
786 } else if (go
->neg_upap
) {
791 eap_authwithpeer(unit
, user
);
792 auth
|= EAP_WITHPEER
;
793 } else if (ho
->neg_chap
) {
794 chap_auth_with_peer(unit
, user
, CHAP_DIGEST(ho
->chap_mdtype
));
795 auth
|= CHAP_WITHPEER
;
796 } else if (ho
->neg_upap
) {
797 /* If a blank password was explicitly given as an option, trust
798 the user and don't try to look up one. */
799 if (passwd
[0] == 0 && !explicit_passwd
) {
800 passwd_from_file
= 1;
801 if (!get_pap_passwd(passwd
))
802 error("No secret found for PAP login");
804 upap_authwithpeer(unit
, user
, passwd
);
805 auth
|= PAP_WITHPEER
;
807 auth_pending
[unit
] = auth
;
815 * Proceed to the network phase.
821 lcp_options
*go
= &lcp_gotoptions
[unit
];
823 /* Log calling number. */
825 notice("peer from calling number %q authorized", remote_number
);
828 * If the peer had to authenticate, run the auth-up script now.
830 if (go
->neg_chap
|| go
->neg_upap
|| go
->neg_eap
) {
831 notify(auth_up_notifier
, 0);
833 if (auth_script_state
== s_down
&& auth_script_pid
== 0) {
834 auth_script_state
= s_up
;
835 auth_script(_PATH_AUTHUP
);
841 * If we negotiated callback, do it now.
844 new_phase(PHASE_CALLBACK
);
845 (*cbcp_protent
.open
)(unit
);
851 * Process extra options from the secrets file
854 options_from_list(extra_options
, 1);
855 free_wordlist(extra_options
);
858 start_networks(unit
);
866 struct protent
*protp
;
867 int ecp_required
, mppe_required
;
869 new_phase(PHASE_NETWORK
);
871 #ifdef HAVE_MULTILINK
873 if (mp_join_bundle()) {
874 if (multilink_join_hook
)
875 (*multilink_join_hook
)();
876 if (updetach
&& !nodetach
)
881 #endif /* HAVE_MULTILINK */
885 set_filters(&pass_filter
, &active_filter
);
887 /* Start CCP and ECP */
888 for (i
= 0; (protp
= protocols
[i
]) != NULL
; ++i
)
889 if ((protp
->protocol
== PPP_ECP
|| protp
->protocol
== PPP_CCP
)
890 && protp
->enabled_flag
&& protp
->open
!= NULL
)
894 * Bring up other network protocols iff encryption is not required.
896 ecp_required
= ecp_gotoptions
[unit
].required
;
897 mppe_required
= ccp_gotoptions
[unit
].mppe
;
898 if (!ecp_required
&& !mppe_required
)
899 continue_networks(unit
);
903 continue_networks(unit
)
907 struct protent
*protp
;
910 * Start the "real" network protocols.
912 for (i
= 0; (protp
= protocols
[i
]) != NULL
; ++i
)
913 if (protp
->protocol
< 0xC000
914 && protp
->protocol
!= PPP_CCP
&& protp
->protocol
!= PPP_ECP
915 && protp
->enabled_flag
&& protp
->open
!= NULL
) {
920 if (num_np_open
== 0)
922 lcp_close(0, "No network protocols running");
926 * The peer has failed to authenticate himself using `protocol'.
929 auth_peer_fail(unit
, protocol
)
933 * Authentication failure: take the link down
935 status
= EXIT_PEER_AUTH_FAILED
;
936 lcp_close(unit
, "Authentication failed");
940 * The peer has been successfully authenticated using `protocol'.
943 auth_peer_success(unit
, protocol
, prot_flavor
, name
, namelen
)
944 int unit
, protocol
, prot_flavor
;
953 switch (prot_flavor
) {
955 bit
|= CHAP_MD5_PEER
;
961 case CHAP_MICROSOFT_V2
:
962 bit
|= CHAP_MS2_PEER
;
974 warn("auth_peer_success: unknown protocol %x", protocol
);
979 * Save the authenticated name of the peer for later.
981 if (namelen
> sizeof(peer_authname
) - 1)
982 namelen
= sizeof(peer_authname
) - 1;
983 BCOPY(name
, peer_authname
, namelen
);
984 peer_authname
[namelen
] = 0;
985 script_setenv("PEERNAME", peer_authname
, 0);
987 /* Save the authentication method for later. */
988 auth_done
[unit
] |= bit
;
991 * If there is no more authentication still to be done,
992 * proceed to the network (or callback) phase.
994 if ((auth_pending
[unit
] &= ~bit
) == 0)
999 * We have failed to authenticate ourselves to the peer using `protocol'.
1002 auth_withpeer_fail(unit
, protocol
)
1005 if (passwd_from_file
)
1006 BZERO(passwd
, MAXSECRETLEN
);
1008 * We've failed to authenticate ourselves to our peer.
1009 * Some servers keep sending CHAP challenges, but there
1010 * is no point in persisting without any way to get updated
1011 * authentication secrets.
1013 status
= EXIT_AUTH_TOPEER_FAILED
;
1014 lcp_close(unit
, "Failed to authenticate ourselves to peer");
1018 * We have successfully authenticated ourselves with the peer using `protocol'.
1021 auth_withpeer_success(unit
, protocol
, prot_flavor
)
1022 int unit
, protocol
, prot_flavor
;
1025 const char *prot
= "";
1029 bit
= CHAP_WITHPEER
;
1031 switch (prot_flavor
) {
1033 bit
|= CHAP_MD5_WITHPEER
;
1036 case CHAP_MICROSOFT
:
1037 bit
|= CHAP_MS_WITHPEER
;
1039 case CHAP_MICROSOFT_V2
:
1040 bit
|= CHAP_MS2_WITHPEER
;
1046 if (passwd_from_file
)
1047 BZERO(passwd
, MAXSECRETLEN
);
1056 warn("auth_withpeer_success: unknown protocol %x", protocol
);
1060 notice("%s authentication succeeded", prot
);
1062 /* Save the authentication method for later. */
1063 auth_done
[unit
] |= bit
;
1066 * If there is no more authentication still being done,
1067 * proceed to the network (or callback) phase.
1069 if ((auth_pending
[unit
] &= ~bit
) == 0)
1070 network_phase(unit
);
1075 * np_up - a network protocol has come up.
1083 if (num_np_up
== 0) {
1085 * At this point we consider that the link has come up successfully.
1089 new_phase(PHASE_RUNNING
);
1091 if (idle_time_hook
!= 0)
1092 tlim
= (*idle_time_hook
)(NULL
);
1094 tlim
= idle_time_limit
;
1096 TIMEOUT(check_idle
, NULL
, tlim
);
1099 * Set a timeout to close the connection once the maximum
1100 * connect time has expired.
1103 TIMEOUT(connect_time_expired
, 0, maxconnect
);
1107 TIMEOUT(check_maxoctets
, NULL
, maxoctets_timeout
);
1111 * Detach now, if the updetach option was given.
1113 if (updetach
&& !nodetach
)
1120 * np_down - a network protocol has gone down.
1123 np_down(unit
, proto
)
1126 if (--num_np_up
== 0) {
1127 UNTIMEOUT(check_idle
, NULL
);
1128 UNTIMEOUT(connect_time_expired
, NULL
);
1130 UNTIMEOUT(check_maxoctets
, NULL
);
1132 new_phase(PHASE_NETWORK
);
1137 * np_finished - a network protocol has finished using the link.
1140 np_finished(unit
, proto
)
1143 if (--num_np_open
<= 0) {
1144 /* no further use for the link: shut up shop. */
1145 lcp_close(0, "No network protocols running");
1151 check_maxoctets(arg
)
1156 update_link_stats(ifunit
);
1159 switch(maxoctets_dir
) {
1160 case PPP_OCTETS_DIRECTION_IN
:
1161 used
= link_stats
.bytes_in
;
1163 case PPP_OCTETS_DIRECTION_OUT
:
1164 used
= link_stats
.bytes_out
;
1166 case PPP_OCTETS_DIRECTION_MAXOVERAL
:
1167 case PPP_OCTETS_DIRECTION_MAXSESSION
:
1168 used
= (link_stats
.bytes_in
> link_stats
.bytes_out
) ? link_stats
.bytes_in
: link_stats
.bytes_out
;
1171 used
= link_stats
.bytes_in
+link_stats
.bytes_out
;
1174 if (used
> maxoctets
) {
1175 notice("Traffic limit reached. Limit: %u Used: %u", maxoctets
, used
);
1176 status
= EXIT_TRAFFIC_LIMIT
;
1177 lcp_close(0, "Traffic limit");
1180 TIMEOUT(check_maxoctets
, NULL
, maxoctets_timeout
);
1186 * check_idle - check whether the link has been idle for long
1187 * enough that we can shut it down.
1193 struct ppp_idle idle
;
1197 if (!get_idle_time(0, &idle
))
1199 if (idle_time_hook
!= 0) {
1200 tlim
= idle_time_hook(&idle
);
1202 /* JYWeng 20031216: replace itime with idle.xmit_idle for only outgoing traffic is counted*/
1204 itime
= idle
.xmit_idle
;
1206 itime
= MIN(idle
.xmit_idle
, idle
.recv_idle
);
1207 tlim
= idle_time_limit
- itime
;
1210 /* link is idle: shut it down. */
1211 notice("Terminating connection due to lack of activity.");
1212 status
= EXIT_IDLE_TIMEOUT
;
1213 lcp_close(0, "Link inactive");
1216 TIMEOUT(check_idle
, NULL
, tlim
);
1221 * connect_time_expired - log a message and close the connection.
1224 connect_time_expired(arg
)
1227 info("Connect time expired");
1228 status
= EXIT_CONNECT_TIME
;
1229 lcp_close(0, "Connect time expired"); /* Close connection */
1233 * auth_check_options - called to check authentication options.
1236 auth_check_options()
1238 lcp_options
*wo
= &lcp_wantoptions
[0];
1242 /* Default our_name to hostname, and user to our_name */
1243 if (our_name
[0] == 0 || usehostname
)
1244 strlcpy(our_name
, hostname
, sizeof(our_name
));
1245 /* If a blank username was explicitly given as an option, trust
1246 the user and don't use our_name */
1247 if (user
[0] == 0 && !explicit_user
)
1248 strlcpy(user
, our_name
, sizeof(user
));
1251 * If we have a default route, require the peer to authenticate
1252 * unless the noauth option was given or the real user is root.
1254 if (!auth_required
&& !allow_any_ip
&& have_route_to(0) && !privileged
) {
1259 /* If we selected any CHAP flavors, we should probably negotiate it. :-) */
1260 if (wo
->chap_mdtype
)
1263 /* If authentication is required, ask peer for CHAP, PAP, or EAP. */
1264 if (auth_required
) {
1266 if (!wo
->neg_chap
&& !wo
->neg_upap
&& !wo
->neg_eap
) {
1267 wo
->neg_chap
= chap_mdtype_all
!= MDTYPE_NONE
;
1268 wo
->chap_mdtype
= chap_mdtype_all
;
1274 wo
->chap_mdtype
= MDTYPE_NONE
;
1280 * Check whether we have appropriate secrets to use
1281 * to authenticate the peer. Note that EAP can authenticate by way
1282 * of a CHAP-like exchanges as well as SRP.
1285 can_auth
= wo
->neg_upap
&& (uselogin
|| have_pap_secret(&lacks_ip
));
1286 if (!can_auth
&& (wo
->neg_chap
|| wo
->neg_eap
)) {
1287 can_auth
= have_chap_secret((explicit_remote
? remote_name
: NULL
),
1288 our_name
, 1, &lacks_ip
);
1290 if (!can_auth
&& wo
->neg_eap
) {
1291 can_auth
= have_srp_secret((explicit_remote
? remote_name
: NULL
),
1292 our_name
, 1, &lacks_ip
);
1295 if (auth_required
&& !can_auth
&& noauth_addrs
== NULL
) {
1298 "By default the remote system is required to authenticate itself");
1300 "(because this system has a default route to the internet)");
1301 } else if (explicit_remote
)
1303 "The remote system (%s) is required to authenticate itself",
1307 "The remote system is required to authenticate itself");
1309 "but I couldn't find any suitable secret (password) for it to use to do so.");
1312 "(None of the available passwords would let it use an IP address.)");
1318 * Early check for remote number authorization.
1320 if (!auth_number()) {
1321 warn("calling number %q is not authorized", remote_number
);
1322 exit(EXIT_CNID_AUTH_FAILED
);
1327 * auth_reset - called when LCP is starting negotiations to recheck
1328 * authentication options, i.e. whether we have appropriate secrets
1329 * to use for authenticating ourselves and/or the peer.
1335 lcp_options
*go
= &lcp_gotoptions
[unit
];
1336 lcp_options
*ao
= &lcp_allowoptions
[unit
];
1340 ao
->neg_upap
= !refuse_pap
&& (passwd
[0] != 0 || get_pap_passwd(NULL
));
1341 ao
->neg_chap
= (!refuse_chap
|| !refuse_mschap
|| !refuse_mschap_v2
)
1342 && (passwd
[0] != 0 ||
1343 (hadchap
= have_chap_secret(user
, (explicit_remote
? remote_name
:
1345 ao
->neg_eap
= !refuse_eap
&& (
1347 (hadchap
== 1 || (hadchap
== -1 && have_chap_secret(user
,
1348 (explicit_remote
? remote_name
: NULL
), 0, NULL
))) ||
1349 have_srp_secret(user
, (explicit_remote
? remote_name
: NULL
), 0, NULL
));
1352 if (go
->neg_upap
&& !uselogin
&& !have_pap_secret(NULL
))
1355 if (!(hadchap
= have_chap_secret((explicit_remote
? remote_name
: NULL
),
1356 our_name
, 1, NULL
)))
1360 (hadchap
== 0 || (hadchap
== -1 &&
1361 !have_chap_secret((explicit_remote
? remote_name
: NULL
), our_name
,
1363 !have_srp_secret((explicit_remote
? remote_name
: NULL
), our_name
, 1,
1370 * check_passwd - Check the user name and passwd against the PAP secrets
1371 * file. If requested, also check against the system password database,
1372 * and login the user if OK.
1375 * UPAP_AUTHNAK: Authentication failed.
1376 * UPAP_AUTHACK: Authentication succeeded.
1377 * In either case, msg points to an appropriate message.
1380 check_passwd(unit
, auser
, userlen
, apasswd
, passwdlen
, msg
)
1391 struct wordlist
*addrs
= NULL
, *opts
= NULL
;
1392 char passwd
[256], user
[256];
1393 char secret
[MAXWORDLEN
];
1394 static int attempts
= 0;
1397 * Make copies of apasswd and auser, then null-terminate them.
1398 * If there are unprintable characters in the password, make
1401 slprintf(passwd
, sizeof(passwd
), "%.*v", passwdlen
, apasswd
);
1402 slprintf(user
, sizeof(user
), "%.*v", userlen
, auser
);
1406 * Check if a plugin wants to handle this.
1408 if (pap_auth_hook
) {
1409 ret
= (*pap_auth_hook
)(user
, passwd
, msg
, &addrs
, &opts
);
1411 /* note: set_allowed_addrs() saves opts (but not addrs):
1414 set_allowed_addrs(unit
, addrs
, opts
);
1416 free_wordlist(opts
);
1418 free_wordlist(addrs
);
1419 BZERO(passwd
, sizeof(passwd
));
1420 return ret
? UPAP_AUTHACK
: UPAP_AUTHNAK
;
1425 * Open the file of pap secrets and scan for a suitable secret
1426 * for authenticating this user.
1428 filename
= _PATH_UPAPFILE
;
1429 addrs
= opts
= NULL
;
1431 f
= fopen(filename
, "r");
1433 error("Can't open PAP password file %s: %m", filename
);
1436 check_access(f
, filename
);
1437 if (scan_authfile(f
, user
, our_name
, secret
, &addrs
, &opts
, filename
, 0) < 0) {
1438 warn("no PAP secret found for %s", user
);
1441 * If the secret is "@login", it means to check
1442 * the password against the login database.
1444 int login_secret
= strcmp(secret
, "@login") == 0;
1446 if (uselogin
|| login_secret
) {
1447 /* login option or secret is @login */
1448 if (session_full(user
, passwd
, devnam
, msg
) == 0) {
1451 } else if (session_mgmt
) {
1452 if (session_check(user
, NULL
, devnam
, NULL
) == 0) {
1453 warn("Peer %q failed PAP Session verification", user
);
1457 if (secret
[0] != 0 && !login_secret
) {
1458 /* password given in pap-secrets - must match */
1459 if ((cryptpap
|| strcmp(passwd
, secret
) != 0)
1460 && strcmp(crypt(passwd
, secret
), secret
) != 0)
1467 if (ret
== UPAP_AUTHNAK
) {
1469 *msg
= "Login incorrect";
1471 * XXX can we ever get here more than once??
1472 * Frustrate passwd stealer programs.
1473 * Allow 10 tries, but start backing off after 3 (stolen from login).
1474 * On 10'th, drop the connection.
1476 if (attempts
++ >= 10) {
1477 warn("%d LOGIN FAILURES ON %s, %s", attempts
, devnam
, user
);
1478 lcp_close(unit
, "login failed");
1481 sleep((u_int
) (attempts
- 3) * 5);
1483 free_wordlist(opts
);
1486 attempts
= 0; /* Reset count */
1489 set_allowed_addrs(unit
, addrs
, opts
);
1493 free_wordlist(addrs
);
1494 BZERO(passwd
, sizeof(passwd
));
1495 BZERO(secret
, sizeof(secret
));
1501 * null_login - Check if a username of "" and a password of "" are
1502 * acceptable, and iff so, set the list of acceptable IP addresses
1512 struct wordlist
*addrs
, *opts
;
1513 char secret
[MAXWORDLEN
];
1516 * Check if a plugin wants to handle this.
1520 ret
= (*null_auth_hook
)(&addrs
, &opts
);
1523 * Open the file of pap secrets and scan for a suitable secret.
1526 filename
= _PATH_UPAPFILE
;
1528 f
= fopen(filename
, "r");
1531 check_access(f
, filename
);
1533 i
= scan_authfile(f
, "", our_name
, secret
, &addrs
, &opts
, filename
, 0);
1534 ret
= i
>= 0 && secret
[0] == 0;
1535 BZERO(secret
, sizeof(secret
));
1540 set_allowed_addrs(unit
, addrs
, opts
);
1542 free_wordlist(opts
);
1544 free_wordlist(addrs
);
1551 * get_pap_passwd - get a password for authenticating ourselves with
1552 * our peer using PAP. Returns 1 on success, 0 if no suitable password
1554 * Assumes passwd points to MAXSECRETLEN bytes of space (if non-null).
1557 get_pap_passwd(passwd
)
1563 char secret
[MAXWORDLEN
];
1566 * Check whether a plugin wants to supply this.
1568 if (pap_passwd_hook
) {
1569 ret
= (*pap_passwd_hook
)(user
, passwd
);
1574 filename
= _PATH_UPAPFILE
;
1575 f
= fopen(filename
, "r");
1578 check_access(f
, filename
);
1579 ret
= scan_authfile(f
, user
,
1580 (remote_name
[0]? remote_name
: NULL
),
1581 secret
, NULL
, NULL
, filename
, 0);
1586 strlcpy(passwd
, secret
, MAXSECRETLEN
);
1587 BZERO(secret
, sizeof(secret
));
1593 * have_pap_secret - check whether we have a PAP file with any
1594 * secrets that we could possibly use for authenticating the peer.
1597 have_pap_secret(lacks_ipp
)
1603 struct wordlist
*addrs
;
1605 /* let the plugin decide, if there is one */
1606 if (pap_check_hook
) {
1607 ret
= (*pap_check_hook
)();
1612 filename
= _PATH_UPAPFILE
;
1613 f
= fopen(filename
, "r");
1617 ret
= scan_authfile(f
, (explicit_remote
? remote_name
: NULL
), our_name
,
1618 NULL
, &addrs
, NULL
, filename
, 0);
1620 if (ret
>= 0 && !some_ip_ok(addrs
)) {
1626 free_wordlist(addrs
);
1633 * have_chap_secret - check whether we have a CHAP file with a
1634 * secret that we could possibly use for authenticating `client'
1635 * on `server'. Either can be the null string, meaning we don't
1636 * know the identity yet.
1639 have_chap_secret(client
, server
, need_ip
, lacks_ipp
)
1648 struct wordlist
*addrs
;
1650 if (chap_check_hook
) {
1651 ret
= (*chap_check_hook
)();
1657 filename
= chapseccustom
? chapseccustom
: _PATH_CHAPFILE
;
1658 f
= fopen(filename
, "r");
1662 if (client
!= NULL
&& client
[0] == 0)
1664 else if (server
!= NULL
&& server
[0] == 0)
1667 ret
= scan_authfile(f
, client
, server
, NULL
, &addrs
, NULL
, filename
, 0);
1669 if (ret
>= 0 && need_ip
&& !some_ip_ok(addrs
)) {
1675 free_wordlist(addrs
);
1682 * have_srp_secret - check whether we have a SRP file with a
1683 * secret that we could possibly use for authenticating `client'
1684 * on `server'. Either can be the null string, meaning we don't
1685 * know the identity yet.
1688 have_srp_secret(client
, server
, need_ip
, lacks_ipp
)
1697 struct wordlist
*addrs
;
1699 filename
= _PATH_SRPFILE
;
1700 f
= fopen(filename
, "r");
1704 if (client
!= NULL
&& client
[0] == 0)
1706 else if (server
!= NULL
&& server
[0] == 0)
1709 ret
= scan_authfile(f
, client
, server
, NULL
, &addrs
, NULL
, filename
, 0);
1711 if (ret
>= 0 && need_ip
&& !some_ip_ok(addrs
)) {
1717 free_wordlist(addrs
);
1724 * get_secret - open the CHAP secret file and return the secret
1725 * for authenticating the given client on the given server.
1726 * (We could be either client or server).
1729 get_secret(unit
, client
, server
, secret
, secret_len
, am_server
)
1740 struct wordlist
*addrs
, *opts
;
1741 char secbuf
[MAXWORDLEN
];
1743 if (!am_server
&& passwd
[0] != 0) {
1744 strlcpy(secbuf
, passwd
, sizeof(secbuf
));
1745 } else if (!am_server
&& chap_passwd_hook
) {
1746 if ( (*chap_passwd_hook
)(client
, secbuf
) < 0) {
1747 error("Unable to obtain CHAP password for %s on %s from plugin",
1752 filename
= chapseccustom
? chapseccustom
: _PATH_CHAPFILE
;
1756 f
= fopen(filename
, "r");
1758 error("Can't open chap secret file %s: %m", filename
);
1761 check_access(f
, filename
);
1763 ret
= scan_authfile(f
, client
, server
, secbuf
, &addrs
, &opts
, filename
, 0);
1769 set_allowed_addrs(unit
, addrs
, opts
);
1771 free_wordlist(opts
);
1773 free_wordlist(addrs
);
1776 len
= strlen(secbuf
);
1777 if (len
> MAXSECRETLEN
) {
1778 error("Secret for %s on %s is too long", client
, server
);
1781 BCOPY(secbuf
, secret
, len
);
1782 BZERO(secbuf
, sizeof(secbuf
));
1790 * get_srp_secret - open the SRP secret file and return the secret
1791 * for authenticating the given client on the given server.
1792 * (We could be either client or server).
1795 get_srp_secret(unit
, client
, server
, secret
, am_server
)
1805 struct wordlist
*addrs
, *opts
;
1807 if (!am_server
&& passwd
[0] != '\0') {
1808 strlcpy(secret
, passwd
, MAXWORDLEN
);
1810 filename
= _PATH_SRPFILE
;
1813 fp
= fopen(filename
, "r");
1815 error("Can't open srp secret file %s: %m", filename
);
1818 check_access(fp
, filename
);
1821 ret
= scan_authfile(fp
, client
, server
, secret
, &addrs
, &opts
,
1822 filename
, am_server
);
1828 set_allowed_addrs(unit
, addrs
, opts
);
1829 else if (opts
!= NULL
)
1830 free_wordlist(opts
);
1832 free_wordlist(addrs
);
1839 * set_allowed_addrs() - set the list of allowed addresses.
1840 * Also looks for `--' indicating options to apply for this peer
1841 * and leaves the following words in extra_options.
1844 set_allowed_addrs(unit
, addrs
, opts
)
1846 struct wordlist
*addrs
;
1847 struct wordlist
*opts
;
1850 struct wordlist
*ap
, **plink
;
1851 struct permitted_ip
*ip
;
1852 char *ptr_word
, *ptr_mask
;
1855 u_int32_t a
, mask
, ah
, offset
;
1856 struct ipcp_options
*wo
= &ipcp_wantoptions
[unit
];
1857 u_int32_t suggested_ip
= 0;
1859 if (addresses
[unit
] != NULL
)
1860 free(addresses
[unit
]);
1861 addresses
[unit
] = NULL
;
1862 if (extra_options
!= NULL
)
1863 free_wordlist(extra_options
);
1864 extra_options
= opts
;
1867 * Count the number of IP addresses given.
1869 n
= wordlist_count(addrs
) + wordlist_count(noauth_addrs
);
1872 ip
= (struct permitted_ip
*) malloc((n
+ 1) * sizeof(struct permitted_ip
));
1876 /* temporarily append the noauth_addrs list to addrs */
1877 for (plink
= &addrs
; *plink
!= NULL
; plink
= &(*plink
)->next
)
1879 *plink
= noauth_addrs
;
1882 for (ap
= addrs
; ap
!= NULL
; ap
= ap
->next
) {
1883 /* "-" means no addresses authorized, "*" means any address allowed */
1884 ptr_word
= ap
->word
;
1885 if (strcmp(ptr_word
, "-") == 0)
1887 if (strcmp(ptr_word
, "*") == 0) {
1889 ip
[n
].base
= ip
[n
].mask
= 0;
1895 if (*ptr_word
== '!') {
1900 mask
= ~ (u_int32_t
) 0;
1902 ptr_mask
= strchr (ptr_word
, '/');
1903 if (ptr_mask
!= NULL
) {
1907 bit_count
= (int) strtol (ptr_mask
+1, &endp
, 10);
1908 if (bit_count
<= 0 || bit_count
> 32) {
1909 warn("invalid address length %v in auth. address list",
1913 bit_count
= 32 - bit_count
; /* # bits in host part */
1915 offset
= ifunit
+ 1;
1919 warn("invalid address length syntax: %v", ptr_mask
+1);
1926 hp
= gethostbyname(ptr_word
);
1927 if (hp
!= NULL
&& hp
->h_addrtype
== AF_INET
) {
1928 a
= *(u_int32_t
*)hp
->h_addr
;
1930 np
= getnetbyname (ptr_word
);
1931 if (np
!= NULL
&& np
->n_addrtype
== AF_INET
) {
1932 a
= htonl ((u_int32_t
)np
->n_net
);
1933 if (ptr_mask
== NULL
) {
1934 /* calculate appropriate mask for net */
1937 mask
= IN_CLASSA_NET
;
1938 else if (IN_CLASSB(ah
))
1939 mask
= IN_CLASSB_NET
;
1940 else if (IN_CLASSC(ah
))
1941 mask
= IN_CLASSC_NET
;
1944 a
= inet_addr (ptr_word
);
1948 if (ptr_mask
!= NULL
)
1951 if (a
== (u_int32_t
)-1L) {
1952 warn("unknown host %s in auth. address list", ap
->word
);
1956 if (offset
>= ~mask
) {
1957 warn("interface unit %d too large for subnet %v",
1961 a
= htonl((ntohl(a
) & mask
) + offset
);
1962 mask
= ~(u_int32_t
)0;
1964 ip
[n
].mask
= htonl(mask
);
1965 ip
[n
].base
= a
& ip
[n
].mask
;
1967 if (~mask
== 0 && suggested_ip
== 0)
1972 ip
[n
].permit
= 0; /* make the last entry forbid all addresses */
1973 ip
[n
].base
= 0; /* to terminate the list */
1976 addresses
[unit
] = ip
;
1979 * If the address given for the peer isn't authorized, or if
1980 * the user hasn't given one, AND there is an authorized address
1981 * which is a single host, then use that if we find one.
1983 if (suggested_ip
!= 0
1984 && (wo
->hisaddr
== 0 || !auth_ip_addr(unit
, wo
->hisaddr
))) {
1985 wo
->hisaddr
= suggested_ip
;
1987 * Do we insist on this address? No, if there are other
1988 * addresses authorized than the suggested one.
1991 wo
->accept_remote
= 1;
1996 * auth_ip_addr - check whether the peer is authorized to use
1997 * a given IP address. Returns 1 if authorized, 0 otherwise.
2000 auth_ip_addr(unit
, addr
)
2006 /* don't allow loopback or multicast address */
2007 if (bad_ip_adrs(addr
))
2010 if (allowed_address_hook
) {
2011 ok
= allowed_address_hook(addr
);
2012 if (ok
>= 0) return ok
;
2015 if (addresses
[unit
] != NULL
) {
2016 ok
= ip_addr_check(addr
, addresses
[unit
]);
2022 return 0; /* no addresses authorized */
2023 return allow_any_ip
|| privileged
|| !have_route_to(addr
);
2027 ip_addr_check(addr
, addrs
)
2029 struct permitted_ip
*addrs
;
2032 if ((addr
& addrs
->mask
) == addrs
->base
)
2033 return addrs
->permit
;
2037 * bad_ip_adrs - return 1 if the IP address is one we don't want
2038 * to use, such as an address in the loopback net or a multicast address.
2039 * addr is in network byte order.
2046 return (addr
>> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
2047 || IN_MULTICAST(addr
) || IN_BADCLASS(addr
);
2051 * some_ip_ok - check a wordlist to see if it authorizes any
2056 struct wordlist
*addrs
;
2058 for (; addrs
!= 0; addrs
= addrs
->next
) {
2059 if (addrs
->word
[0] == '-')
2061 if (addrs
->word
[0] != '!')
2062 return 1; /* some IP address is allowed */
2068 * auth_number - check whether the remote number is allowed to connect.
2069 * Returns 1 if authorized, 0 otherwise.
2074 struct wordlist
*wp
= permitted_numbers
;
2077 /* Allow all if no authorization list. */
2081 /* Allow if we have a match in the authorization list. */
2083 /* trailing '*' wildcard */
2084 l
= strlen(wp
->word
);
2085 if ((wp
->word
)[l
- 1] == '*')
2087 if (!strncasecmp(wp
->word
, remote_number
, l
))
2096 * check_access - complain if a secret file has too-liberal permissions.
2099 check_access(f
, filename
)
2105 if (fstat(fileno(f
), &sbuf
) < 0) {
2106 warn("cannot stat secret file %s: %m", filename
);
2107 } else if ((sbuf
.st_mode
& (S_IRWXG
| S_IRWXO
)) != 0) {
2108 warn("Warning - secret file %s has world and/or group access",
2115 * scan_authfile - Scan an authorization file for a secret suitable
2116 * for authenticating `client' on `server'. The return value is -1
2117 * if no secret is found, otherwise >= 0. The return value has
2118 * NONWILD_CLIENT set if the secret didn't have "*" for the client, and
2119 * NONWILD_SERVER set if the secret didn't have "*" for the server.
2120 * Any following words on the line up to a "--" (i.e. address authorization
2121 * info) are placed in a wordlist and returned in *addrs. Any
2122 * following words (extra options) are placed in a wordlist and
2123 * returned in *opts.
2124 * We assume secret is NULL or points to MAXWORDLEN bytes of space.
2125 * Flags are non-zero if we need two colons in the secret in order to
2129 scan_authfile(f
, client
, server
, secret
, addrs
, opts
, filename
, flags
)
2134 struct wordlist
**addrs
;
2135 struct wordlist
**opts
;
2140 int got_flag
, best_flag
;
2142 struct wordlist
*ap
, *addr_list
, *alist
, **app
;
2143 char word
[MAXWORDLEN
];
2144 char atfile
[MAXWORDLEN
];
2145 char lsecret
[MAXWORDLEN
];
2153 if (!getword(f
, word
, &newline
, filename
))
2154 return -1; /* file is empty??? */
2159 * Skip until we find a word at the start of a line.
2161 while (!newline
&& getword(f
, word
, &newline
, filename
))
2164 break; /* got to end of file */
2167 * Got a client - check if it's a match or a wildcard.
2170 if (client
!= NULL
&& strcmp(word
, client
) != 0 && !ISWILD(word
)) {
2175 got_flag
= NONWILD_CLIENT
;
2178 * Now get a server and check if it matches.
2180 if (!getword(f
, word
, &newline
, filename
))
2184 if (!ISWILD(word
)) {
2185 if (server
!= NULL
&& strcmp(word
, server
) != 0)
2187 got_flag
|= NONWILD_SERVER
;
2191 * Got some sort of a match - see if it's better than what
2194 if (got_flag
<= best_flag
)
2200 if (!getword(f
, word
, &newline
, filename
))
2206 * SRP-SHA1 authenticator should never be reading secrets from
2207 * a file. (Authenticatee may, though.)
2209 if (flags
&& ((cp
= strchr(word
, ':')) == NULL
||
2210 strchr(cp
+ 1, ':') == NULL
))
2213 if (secret
!= NULL
) {
2215 * Special syntax: @/pathname means read secret from file.
2217 if (word
[0] == '@' && word
[1] == '/') {
2218 strlcpy(atfile
, word
+1, sizeof(atfile
));
2219 if ((sf
= fopen(atfile
, "r")) == NULL
) {
2220 warn("can't open indirect secret file %s", atfile
);
2223 check_access(sf
, atfile
);
2224 if (!getword(sf
, word
, &xxx
, atfile
)) {
2225 warn("no secret in indirect secret file %s", atfile
);
2231 strlcpy(lsecret
, word
, sizeof(lsecret
));
2235 * Now read address authorization info and make a wordlist.
2239 if (!getword(f
, word
, &newline
, filename
) || newline
)
2241 ap
= (struct wordlist
*)
2242 malloc(sizeof(struct wordlist
) + strlen(word
) + 1);
2244 novm("authorized addresses");
2245 ap
->word
= (char *) (ap
+ 1);
2246 strcpy(ap
->word
, word
);
2253 * This is the best so far; remember it.
2255 best_flag
= got_flag
;
2257 free_wordlist(addr_list
);
2260 strlcpy(secret
, lsecret
, MAXWORDLEN
);
2266 /* scan for a -- word indicating the start of options */
2267 for (app
= &addr_list
; (ap
= *app
) != NULL
; app
= &ap
->next
)
2268 if (strcmp(ap
->word
, "--") == 0)
2270 /* ap = start of options */
2272 ap
= ap
->next
; /* first option */
2273 free(*app
); /* free the "--" word */
2274 *app
= NULL
; /* terminate addr list */
2278 else if (ap
!= NULL
)
2282 else if (addr_list
!= NULL
)
2283 free_wordlist(addr_list
);
2289 * wordlist_count - return the number of items in a wordlist
2293 struct wordlist
*wp
;
2297 for (n
= 0; wp
!= NULL
; wp
= wp
->next
)
2303 * free_wordlist - release memory allocated for a wordlist.
2307 struct wordlist
*wp
;
2309 struct wordlist
*next
;
2311 while (wp
!= NULL
) {
2319 * auth_script_done - called when the auth-up or auth-down script
2323 auth_script_done(arg
)
2326 auth_script_pid
= 0;
2327 switch (auth_script_state
) {
2329 if (auth_state
== s_down
) {
2330 auth_script_state
= s_down
;
2331 auth_script(_PATH_AUTHDOWN
);
2335 if (auth_state
== s_up
) {
2336 auth_script_state
= s_up
;
2337 auth_script(_PATH_AUTHUP
);
2344 * auth_script - execute a script with arguments
2345 * interface-name peer-name real-user tty speed
2357 if ((pw
= getpwuid(getuid())) != NULL
&& pw
->pw_name
!= NULL
)
2358 user_name
= pw
->pw_name
;
2360 slprintf(struid
, sizeof(struid
), "%d", getuid());
2363 slprintf(strspeed
, sizeof(strspeed
), "%d", baud_rate
);
2367 argv
[2] = peer_authname
;
2368 argv
[3] = user_name
;
2374 auth_script_pid
= run_program(script
, argv
, 0, auth_script_done
, NULL
, 0);