/****************************************************************************** pap.c - Network Password Authentication Protocol program file.** Copyright (c) 2003 by Marc Boucher, Services Informatiques (MBSI) inc.* portions Copyright (c) 1997 by Global Election Systems Inc.** The authors hereby grant permission to use, copy, modify, distribute,* and license this software and its documentation for any purpose, provided* that existing copyright notices are retained in all copies and that this* notice and the following disclaimer are included verbatim in any * distributions. No written agreement, license, or royalty fee is required* for any of the authorized uses.** THIS SOFTWARE IS PROVIDED BY THE CONTRIBUTORS *AS IS* AND ANY EXPRESS OR* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.******************************************************************************** REVISION HISTORY** 03-01-01 Marc Boucher <marc@mbsi.ca>*   Ported to lwIP.* 97-12-12 Guy Lancaster <lancasterg@acm.org>, Global Election Systems Inc.*	Original.*****************************************************************************//* * upap.c - User/Password Authentication Protocol. * * Copyright (c) 1989 Carnegie Mellon University. * All rights reserved. * * Redistribution and use in source and binary forms are permitted * provided that the above copyright notice and this paragraph are * duplicated in all such forms and that any documentation, * advertising materials, and other materials related to such * distribution and use acknowledge that the software was developed * by Carnegie Mellon University.  The name of the * University may not be used to endorse or promote products derived * from this software without specific prior written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. */#include "ppp.h"#include "auth.h"#include "pap.h"#include "pppdebug.h"#if PAP_SUPPORT > 0/***********************************//*** LOCAL FUNCTION DECLARATIONS ***//***********************************//* * Protocol entry points. */static void upap_init (int);static void upap_lowerup (int);static void upap_lowerdown (int);static void upap_input (int, u_char *, int);static void upap_protrej (int);static void upap_timeout (void *);static void upap_reqtimeout (void *);static void upap_rauthreq (upap_state *, u_char *, int, int);static void upap_rauthack (upap_state *, u_char *, int, int);static void upap_rauthnak (upap_state *, u_char *, int, int);static void upap_sauthreq (upap_state *);static void upap_sresp (upap_state *, u_char, u_char, char *, int);/******************************//*** PUBLIC DATA STRUCTURES ***//******************************/struct protent pap_protent = {    PPP_PAP,    upap_init,    upap_input,    upap_protrej,    upap_lowerup,    upap_lowerdown,    NULL,    NULL,#if 0    upap_printpkt,    NULL,#endif    1,    "PAP",#if 0    NULL,    NULL,    NULL#endif};upap_state upap[NUM_PPP];		/* UPAP state; one for each unit *//***********************************//*** PUBLIC FUNCTION DEFINITIONS ***//***********************************//* *  Set the default login name and password for the pap sessions */void upap_setloginpasswd(int unit, const char *luser, const char *lpassword){	upap_state *u = &upap[unit];		/* Save the username and password we're given */	u->us_user = luser;	u->us_userlen = strlen(luser);	u->us_passwd = lpassword;	u->us_passwdlen = strlen(lpassword);}/* * upap_authwithpeer - Authenticate us with our peer (start client). * * Set new state and send authenticate's. */void upap_authwithpeer(int unit, char *user, char *password){	upap_state *u = &upap[unit];		UPAPDEBUG((LOG_INFO, "upap_authwithpeer: %d user=%s password=%s s=%d\n",				unit, user, password, u->us_clientstate));		upap_setloginpasswd(unit, user, password);	u->us_transmits = 0;		/* Lower layer up yet? */	if (u->us_clientstate == UPAPCS_INITIAL ||			u->us_clientstate == UPAPCS_PENDING) {		u->us_clientstate = UPAPCS_PENDING;		return;	}		upap_sauthreq(u);			/* Start protocol */}/* * upap_authpeer - Authenticate our peer (start server). * * Set new state. */void upap_authpeer(int unit){	upap_state *u = &upap[unit];		/* Lower layer up yet? */	if (u->us_serverstate == UPAPSS_INITIAL ||			u->us_serverstate == UPAPSS_PENDING) {		u->us_serverstate = UPAPSS_PENDING;		return;	}		u->us_serverstate = UPAPSS_LISTEN;	if (u->us_reqtimeout > 0)		TIMEOUT(upap_reqtimeout, u, u->us_reqtimeout);}/**********************************//*** LOCAL FUNCTION DEFINITIONS ***//**********************************//* * upap_init - Initialize a UPAP unit. */static void upap_init(int unit){	upap_state *u = &upap[unit];	UPAPDEBUG((LOG_INFO, "upap_init: %d\n", unit));		u->us_unit = unit;	u->us_user = NULL;	u->us_userlen = 0;	u->us_passwd = NULL;	u->us_passwdlen = 0;	u->us_clientstate = UPAPCS_INITIAL;	u->us_serverstate = UPAPSS_INITIAL;	u->us_id = 0;	u->us_timeouttime = UPAP_DEFTIMEOUT;	u->us_maxtransmits = 10;	u->us_reqtimeout = UPAP_DEFREQTIME;}/* * upap_timeout - Retransmission timer for sending auth-reqs expired. */static void upap_timeout(void *arg){	upap_state *u = (upap_state *) arg;		UPAPDEBUG((LOG_INFO, "upap_timeout: %d timeout %d expired s=%d\n", 				u->us_unit, u->us_timeouttime, u->us_clientstate));		if (u->us_clientstate != UPAPCS_AUTHREQ)		return;		if (u->us_transmits >= u->us_maxtransmits) {		/* give up in disgust */		UPAPDEBUG((LOG_ERR, "No response to PAP authenticate-requests\n"));		u->us_clientstate = UPAPCS_BADAUTH;		auth_withpeer_fail(u->us_unit, PPP_PAP);		return;	}		upap_sauthreq(u);		/* Send Authenticate-Request */}/* * upap_reqtimeout - Give up waiting for the peer to send an auth-req. */static void upap_reqtimeout(void *arg){	upap_state *u = (upap_state *) arg;		if (u->us_serverstate != UPAPSS_LISTEN)		return;			/* huh?? */		auth_peer_fail(u->us_unit, PPP_PAP);	u->us_serverstate = UPAPSS_BADAUTH;}/* * upap_lowerup - The lower layer is up. * * Start authenticating if pending. */static void upap_lowerup(int unit){	upap_state *u = &upap[unit];		UPAPDEBUG((LOG_INFO, "upap_lowerup: %d s=%d\n", unit, u->us_clientstate));		if (u->us_clientstate == UPAPCS_INITIAL)		u->us_clientstate = UPAPCS_CLOSED;	else if (u->us_clientstate == UPAPCS_PENDING) {		upap_sauthreq(u);	/* send an auth-request */	}		if (u->us_serverstate == UPAPSS_INITIAL)		u->us_serverstate = UPAPSS_CLOSED;	else if (u->us_serverstate == UPAPSS_PENDING) {		u->us_serverstate = UPAPSS_LISTEN;		if (u->us_reqtimeout > 0)			TIMEOUT(upap_reqtimeout, u, u->us_reqtimeout);	}}/* * upap_lowerdown - The lower layer is down. * * Cancel all timeouts. */static void upap_lowerdown(int unit){	upap_state *u = &upap[unit];		UPAPDEBUG((LOG_INFO, "upap_lowerdown: %d s=%d\n", unit, u->us_clientstate));		if (u->us_clientstate == UPAPCS_AUTHREQ)	/* Timeout pending? */		UNTIMEOUT(upap_timeout, u);		/* Cancel timeout */	if (u->us_serverstate == UPAPSS_LISTEN && u->us_reqtimeout > 0)		UNTIMEOUT(upap_reqtimeout, u);		u->us_clientstate = UPAPCS_INITIAL;	u->us_serverstate = UPAPSS_INITIAL;}/* * upap_protrej - Peer doesn't speak this protocol. * * This shouldn't happen.  In any case, pretend lower layer went down. */static void upap_protrej(int unit){	upap_state *u = &upap[unit];		if (u->us_clientstate == UPAPCS_AUTHREQ) {		UPAPDEBUG((LOG_ERR, "PAP authentication failed due to protocol-reject\n"));		auth_withpeer_fail(unit, PPP_PAP);	}	if (u->us_serverstate == UPAPSS_LISTEN) {		UPAPDEBUG((LOG_ERR, "PAP authentication of peer failed (protocol-reject)\n"));		auth_peer_fail(unit, PPP_PAP);	}	upap_lowerdown(unit);}/* * upap_input - Input UPAP packet. */static void upap_input(int unit, u_char *inpacket, int l){	upap_state *u = &upap[unit];	u_char *inp;	u_char code, id;	int len;		/*	 * Parse header (code, id and length).	 * If packet too short, drop it.	 */	inp = inpacket;	if (l < UPAP_HEADERLEN) {		UPAPDEBUG((LOG_INFO, "pap_input: rcvd short header.\n"));		return;	}	GETCHAR(code, inp);	GETCHAR(id, inp);	GETSHORT(len, inp);	if (len < UPAP_HEADERLEN) {		UPAPDEBUG((LOG_INFO, "pap_input: rcvd illegal length.\n"));		return;	}	if (len > l) {		UPAPDEBUG((LOG_INFO, "pap_input: rcvd short packet.\n"));		return;	}	len -= UPAP_HEADERLEN;		/*	 * Action depends on code.	 */	switch (code) {	case UPAP_AUTHREQ:		upap_rauthreq(u, inp, id, len);		break;		case UPAP_AUTHACK:		upap_rauthack(u, inp, id, len);		break;		case UPAP_AUTHNAK:		upap_rauthnak(u, inp, id, len);		break;		default:				/* XXX Need code reject */		break;	}}/* * upap_rauth - Receive Authenticate. */static void upap_rauthreq(	upap_state *u, 	u_char *inp, 	int id,	int len){	u_char ruserlen, rpasswdlen;	char *ruser, *rpasswd;	int retcode;	char *msg;	int msglen;		UPAPDEBUG((LOG_INFO, "pap_rauth: Rcvd id %d.\n", id));		if (u->us_serverstate < UPAPSS_LISTEN)		return;		/*	 * If we receive a duplicate authenticate-request, we are	 * supposed to return the same status as for the first request.	 */	if (u->us_serverstate == UPAPSS_OPEN) {		upap_sresp(u, UPAP_AUTHACK, id, "", 0);	/* return auth-ack */		return;	}	if (u->us_serverstate == UPAPSS_BADAUTH) {		upap_sresp(u, UPAP_AUTHNAK, id, "", 0);	/* return auth-nak */		return;	}		/*	 * Parse user/passwd.	 */	if (len < sizeof (u_char)) {		UPAPDEBUG((LOG_INFO, "pap_rauth: rcvd short packet.\n"));		return;	}	GETCHAR(ruserlen, inp);	len -= sizeof (u_char) + ruserlen + sizeof (u_char);	if (len < 0) {		UPAPDEBUG((LOG_INFO, "pap_rauth: rcvd short packet.\n"));		return;	}	ruser = (char *) inp;	INCPTR(ruserlen, inp);	GETCHAR(rpasswdlen, inp);	if (len < rpasswdlen) {		UPAPDEBUG((LOG_INFO, "pap_rauth: rcvd short packet.\n"));		return;	}	rpasswd = (char *) inp;		/*	 * Check the username and password given.	 */	retcode = check_passwd(u->us_unit, ruser, ruserlen, rpasswd,			   rpasswdlen, &msg, &msglen);	BZERO(rpasswd, rpasswdlen);		upap_sresp(u, retcode, id, msg, msglen);		if (retcode == UPAP_AUTHACK) {		u->us_serverstate = UPAPSS_OPEN;		auth_peer_success(u->us_unit, PPP_PAP, ruser, ruserlen);	} else {		u->us_serverstate = UPAPSS_BADAUTH;		auth_peer_fail(u->us_unit, PPP_PAP);	}		if (u->us_reqtimeout > 0)		UNTIMEOUT(upap_reqtimeout, u);}/* * upap_rauthack - Receive Authenticate-Ack. */static void upap_rauthack(	upap_state *u,	u_char *inp,	int id,	int len){	u_char msglen;	char *msg;		UPAPDEBUG((LOG_INFO, "pap_rauthack: Rcvd id %d s=%d\n", id, u->us_clientstate));		if (u->us_clientstate != UPAPCS_AUTHREQ) /* XXX */		return;		/*	 * Parse message.	 */	if (len < sizeof (u_char)) {		UPAPDEBUG((LOG_INFO, "pap_rauthack: rcvd short packet.\n"));		return;	}	GETCHAR(msglen, inp);	len -= sizeof (u_char);	if (len < msglen) {		UPAPDEBUG((LOG_INFO, "pap_rauthack: rcvd short packet.\n"));		return;	}	msg = (char *) inp;	PRINTMSG(msg, msglen);		u->us_clientstate = UPAPCS_OPEN;		auth_withpeer_success(u->us_unit, PPP_PAP);}/* * upap_rauthnak - Receive Authenticate-Nakk. */static void upap_rauthnak(	upap_state *u,	u_char *inp,	int id,	int len){	u_char msglen;	char *msg;		UPAPDEBUG((LOG_INFO, "pap_rauthnak: Rcvd id %d s=%d\n", id, u->us_clientstate));		if (u->us_clientstate != UPAPCS_AUTHREQ) /* XXX */		return;		/*	 * Parse message.	 */	if (len < sizeof (u_char)) {		UPAPDEBUG((LOG_INFO, "pap_rauthnak: rcvd short packet.\n"));		return;	}	GETCHAR(msglen, inp);	len -= sizeof (u_char);	if (len < msglen) {		UPAPDEBUG((LOG_INFO, "pap_rauthnak: rcvd short packet.\n"));		return;	}	msg = (char *) inp;	PRINTMSG(msg, msglen);		u->us_clientstate = UPAPCS_BADAUTH;		UPAPDEBUG((LOG_ERR, "PAP authentication failed\n"));	auth_withpeer_fail(u->us_unit, PPP_PAP);}/* * upap_sauthreq - Send an Authenticate-Request. */static void upap_sauthreq(upap_state *u){	u_char *outp;	int outlen;		outlen = UPAP_HEADERLEN + 2 * sizeof (u_char) 			+ u->us_userlen + u->us_passwdlen;	outp = outpacket_buf[u->us_unit];		MAKEHEADER(outp, PPP_PAP);		PUTCHAR(UPAP_AUTHREQ, outp);	PUTCHAR(++u->us_id, outp);	PUTSHORT(outlen, outp);	PUTCHAR(u->us_userlen, outp);	BCOPY(u->us_user, outp, u->us_userlen);	INCPTR(u->us_userlen, outp);	PUTCHAR(u->us_passwdlen, outp);	BCOPY(u->us_passwd, outp, u->us_passwdlen);		pppWrite(u->us_unit, outpacket_buf[u->us_unit], outlen + PPP_HDRLEN);		UPAPDEBUG((LOG_INFO, "pap_sauth: Sent id %d\n", u->us_id));		TIMEOUT(upap_timeout, u, u->us_timeouttime);	++u->us_transmits;	u->us_clientstate = UPAPCS_AUTHREQ;}/* * upap_sresp - Send a response (ack or nak). */static void upap_sresp(	upap_state *u,	u_char code, 	u_char id,	char *msg,	int msglen){	u_char *outp;	int outlen;		outlen = UPAP_HEADERLEN + sizeof (u_char) + msglen;	outp = outpacket_buf[u->us_unit];	MAKEHEADER(outp, PPP_PAP);		PUTCHAR(code, outp);	PUTCHAR(id, outp);	PUTSHORT(outlen, outp);	PUTCHAR(msglen, outp);	BCOPY(msg, outp, msglen);	pppWrite(u->us_unit, outpacket_buf[u->us_unit], outlen + PPP_HDRLEN);		UPAPDEBUG((LOG_INFO, "pap_sresp: Sent code %d, id %d s=%d\n", 				code, id, u->us_clientstate));}#if 0/* * upap_printpkt - print the contents of a PAP packet. */static int upap_printpkt(	u_char *p,	int plen,	void (*printer) (void *, char *, ...),	void *arg){	(void)p;	(void)plen;	(void)printer;	(void)arg;	return 0;}#endif#endif /* PAP_SUPPORT */