Commit Graph

88 Commits

Author SHA1 Message Date
Kevin Lo
29dcf726d2 Handle NULL return from crypt(3). Mostly from DragonFly 2012-02-22 06:27:20 +00:00
Dag-Erling Smørgrav
2947657928 Revert previous commit and fix OpenPAM issue properly. 2007-12-22 19:29:32 +00:00
Kip Macy
1ed67f13e4 Fix/workaround build breakage caused by PAM import
struct pam_conv takes a void * for the appdata_ptr  but is being passed
a const char * - explicitly cast away the const
2007-12-21 21:47:19 +00:00
Marcel Moolenaar
1814213e06 Fix the build on 64-bit platforms. 2004-09-06 00:07:58 +00:00
Brian Somers
057f1760a8 Make ppp WARNS=5 clean 2004-09-05 01:46:52 +00:00
Ruslan Ermilov
96fd764f25 Basic PAM authentication support. 2003-10-29 20:32:19 +00:00
Brian Somers
de59e178aa o Clean up some #includes
o Bump version number to 3.0.4
o When talking to a RADIUS server, provide a NAS-Port-Type.

  When the NAS-Port-Type is Ethernet, provide a NAS-Port value equal
  to the SESSIONID from the environment in direct mode or the
  NGM_PPPOE_SESSIONID message in other modes.  If no SESSIONID is found,
  default to the interface index in client mode or zero in server mode.

  When the NAS-Port-Type is ISDN, set the NAS-Port to the minor number
  of the physical device (ie, the N in /dev/i4brbchN).

  This makes it easier for the RADIUS server to identify the client
  WRT accounting data etc.

Prompted by:	lsz8425 <lsz8425@mail.cd.hn.cn>
2002-05-14 12:55:39 +00:00
Tatsumi Hosokawa
33b47634a8 Get tun P2P address from the local pool if RADIUS server returned
255.255.255.254 as client ipaddr.

Reviewed-By:	freebsd-net mailing list
2002-04-04 08:43:00 +00:00
Brian Somers
af1e766495 When authenticating a name containing a ``\'', attempt to autenticate
using the part after the ``\'' if the original name is not found.

This allows M$ clients to use domain\user as their authname.

Reviewed by: Ian West <ian@niw.com.au>
2002-01-08 11:24:39 +00:00
Brian Somers
30949fd4b5 o Add ipv6 support, abstracting most NCP addresses into opaque
structures (well, they're treated as opaque).

  It's now possible to manage IPv6 interface addresses and routing
  table entries and to filter IPV6 traffic whether encapsulated or
  not.

  IPV6CP support is crude for now, and hasn't been tested against
  any other implementations.

  RADIUS and IPv6 are independent of eachother for now.

  ppp.linkup/ppp.linkdown aren't currently used by IPV6CP

o Understand all protocols(5) in filter rules rather than only a select
  few.

o Allow a mask specification for the ``delete'' command.  It's now
  possible to specifically delete one of two conflicting routes.

o When creating and deleting proxy arp entries, do it for all IPv4
  interface addresses rather than doing it just for the ``current''
  peer address.

o When iface-alias isn't in effect, don't blow away manually (via ``iface
  add'') added interface addresses.

o When listening on a tcp server (diagnostic) socket, bind so that a
  tcp46 socket is created -- allowing both IPv4 and IPv6 connections.

o When displaying ICMP traffic, don't display the icmp type twice.
  When display traffic, display at least some information about unrecognised
  traffic.

o Bump version

Inspired after filtering work by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org>
2001-08-14 16:05:52 +00:00
Brian Somers
65309e5cda Convert IIJ copyrights to BSD copyrights.
Approved by: Toshiharu OHNO <tohno@sirius.ocn.ne.jp>
2001-06-13 21:52:19 +00:00
Brian Somers
5b78bdf8aa Don't allowt '#' as a comment when it's embedded in quotes:
set something "xxx yyy # zzz" aaa

shouldn't be interpreted as

  set something "xxx yyy" aaa
1999-12-27 11:43:31 +00:00
Brian Somers
abab7303b5 Don't munge ``set dial|login|logout|hangup'' arguments before
ExpandString() has a chance to do its own substitutions.
1999-12-22 21:48:12 +00:00
Brian Somers
c39aa54ec8 Notice and warn about unterminated quoted strings in commands.
The entire command is ignored if the syntax is invalid...
1999-12-20 20:30:02 +00:00
Brian Somers
26af0ae966 Cosmetic: Make struct mbuf more like kernel mbufs. 1999-12-20 20:29:47 +00:00
Peter Wemm
97d92980a9 $Id$ -> $FreeBSD$ 1999-08-28 01:35:59 +00:00
Brian Somers
c506ecd549 Don't drop the last character from lines in ppp.secret unless it's '\n'. 1999-06-08 20:11:53 +00:00
Brian Somers
5d9e610366 o Redesign the layering mechanism and make the aliasing code part of
the layering.

  We now ``stack'' layers as soon as we open the device (when we figure
  out what we're dealing with).  A static set of `dispatch' routines are
  also declared for dealing with incoming packets after they've been
  `pulled' up through the stacked layers.

  Physical devices are now assigned handlers based on the device type
  when they're opened.  For the moment there are three device types;
  ttys, execs and tcps.

o Increment version number to 2.2
o Make an entry in [uw]tmp for non-tty -direct invocations (after
  pap/chap authentication).
o Make throughput counters quad_t's
o Account for the absolute number of mbuf malloc()s and free()s in
  ``show mem''.
o ``show modem'' becomes ``show physical''.
1999-05-08 11:07:56 +00:00
Brian Somers
eb2d27cfc3 Avoid a few warnings on the alpha 1999-03-31 14:21:46 +00:00
Brian Somers
479508cf28 Allow control over the number of ConfigREQ & TermREQ attempts
that are made in each of the FSMs (LCP, CCP & IPCP) and the
number of REQs/Challenges for PAP/CHAP by accepting more arguments
in the ``set {c,ip,l}cpretry'' and ``set {ch,p}apretry'' commands.

Change the non-convergence thresholds to 3 times the number of configured
REQ tries (rather than the previous fixed ``10'').  We now notice
repeated NAKs and REJs rather than just REQs.

Don't suggest that CHAP 0x05 isn't supported when it's not configured.

Fix some bugs that expose themselves with smaller numbers of retries:
o Handle instantaneous disconnects (set device /dev/null) correctly
  by stopping all fsm timers in fsm2initial.
o Don't forget to uu_unlock() devices that are files but are not
  ttys (set device /dev/zero).

Fix a *HORRENDOUS* bug in RFC1661 (already fixed for an Open event in state
``Closed''):
  According to the state transition table, a RCR+ or RCR- received in
  the ``Stopped'' state are supposed to InitRestartCounter, SendConfigReq
  and SendConfig{Ack,Nak}.  However, in ``Stopped'', we haven't yet
  done a TLS (or the last thing we did is a TLF).  We must therefore
  do the TLS at this point !

  This was never noticed before because LCP and CCP used not use
  LayerStart() for anything interesting, and IPCP tends to go into
  Stopped then get a Down because of an LCP RTR rather than getting a
  RCR again.
1999-02-26 21:28:14 +00:00
Brian Somers
b7ff18add2 Handle empty PAP & CHAP packets (containing only an FSM header).
Some CHAP implementations send no welcome message with their
SUCCESS/FAILURE packets.  This was being mis-identified as
a truncated packet by the new authentication code :-(
1999-02-20 01:12:45 +00:00
Brian Somers
b31a24cad8 Be a little more verbose about dodgy looking authentication
packets before dropping them in the bit-bucket.
1999-02-19 10:48:42 +00:00
Brian Somers
5e31549897 Fully support both NT and LANMan CHAP type 0x80 as both
authenticator and authenticatee.
1999-02-18 00:52:15 +00:00
Brian Somers
f0cdd9c021 Decouple pap & chap output routines from the corresponding
input routines and take advantage of the new init/continue
interface in libradius.  This allows a timely response on
other links in an MP setup while RADIUS requests are in
progress as well as the ability to handle other data from
the peer in parallel.  It should also make the future addition
of PAM support trivial.

While I'm in there, validate pap & chap header IDs if
``idcheck'' is enabled (the default) for other FSM packet
types.

NOTE: This involved integrating the generation of chap
      challenges and the validation of chap responses
      (and commenting what's going on in those routines).
      I currently have no way of testing ppps ability
      to respond to M$Chap CHALLENGEs correctly, so if
      someone could do the honours, it'd be much
      appreciated (it *looks* ok!).

Sponsored by: Internet Business Solutions Ltd., Switzerland
1999-02-06 02:54:47 +00:00
Brian Somers
aceaed9283 Reimplement the previous fix (no response to PAP requests)
at the authentication layer rather than at the PAP layer
so that it also applies to CHAP (no response to CHAP
challenges).
1999-02-02 09:35:17 +00:00
Brian Somers
8db502bbfd If we receive no answer from the server when sending PAP
requests, give up (don't sit there indefinitely).
1999-02-01 13:42:25 +00:00
Brian Somers
972a1bcf5d Initial RADIUS support (using libradius). See the man page for
details.  Compiling with -DNORADIUS (the default for `release')
removes support.

TODO: The functionality in libradius::rad_send_request() needs
      to be supplied as a set of routines so that ppp doesn't
      have to wait indefinitely for the radius server(s).  Instead,
      we need to get a descriptor back, select() on the descriptor,
      and ask libradius to service it when necessary.
      For now, ppp blocks SIGALRM while in rad_send_request(), so
      it misses PAP/CHAP retries & timeouts if they occur.

      Only PAP is functional.  When CHAP is attempted, libradius
      complains that no User-Password has been specified... rfc2138
      says that it *mustn't* be used for CHAP :-(

Sponsored by: Internet Business Solutions Ltd., Switzerland
1999-01-28 01:56:34 +00:00
Brian Somers
2ff64793ad Don't return stack-based data. This may have caused
server-side CHAP authentication problems in the past :-/
1998-12-17 00:28:12 +00:00
Brian Somers
5a72b6eda3 Put the IP buffer queues into struct ipcp.
Forgotten by: me
1998-08-26 17:39:37 +00:00
Brian Somers
92b0955883 o Support callback types NONE, E.164, AUTH and CBCP.
(see the new ``set callback'' and ``set cbcp'' commands)
o Add a ``cbcp'' log level and mbuf type.
o Don't dump core when \T is given in ``set login'' or
  ``set hangup''.
o Allow ``*'' and blanks as placeholders in ppp.secret and
  allow a fifth field for specifying auth/cbcp dialback
  parameters.
o Remove a few extraneous #includes
o Define the default number of REQs (restart counter) in defs.h
  rather than hardcoding ``5'' all over the place.
o Fix a few man page inconsistencies.
1998-08-07 18:42:51 +00:00
Brian Somers
501f548011 Add missing braces - without them, the IP & label were mis-selected
from ppp.secret.
Problem reported by: Dom Mitchell <dom@phmit.demon.co.uk>
1998-07-19 21:07:24 +00:00
Brian Somers
d93d3a9c32 o De-staticise things that don't need to be static.
o Bring the static ``ttystate'' into struct prompt so that
  the tilde context is per prompt and not global.
o Comment the remaining static variables so that it's
  clear why they're static.
o Add some XXX comments suggesting that our interface list
  and our hostname should be re-generated after a signal
  (say SIGUSR1) so that a machine with PCCARDs has a chance.
1998-06-15 19:06:58 +00:00
Brian Somers
d91d286164 MFMP: Make ppp multilink capable.
See the file README.changes, and re-read the man page.
1998-05-21 21:49:08 +00:00
Brian Somers
dd7e261079 Cosmetic: Make our external function names consistent. 1998-05-01 19:26:12 +00:00
Brian Somers
1fa665f5b3 o Add the link name to modem diagnostics.
o Create struct mpserver as part of struct mp.
  mpserver creates a unix-domain socket based on the
  peers auth name and endpoint discriminator.  If it
  already exists, ppp will ``pass the link'' over to
  the owner of the socket, joining it into the bundle
  of another ppp invocation, otherwise ppp waits for
  other invocations to pass it links through this
  socket.
  The final piece of code will be the code that flattens
  our datalink info and passes it down this channel
  (not yet implemented).
1998-04-28 01:25:46 +00:00
Brian Somers
643f49047e o Defer setting up pap/chap based IP numbers & labels until after
we've determined if we're going to join another ppp invocation.
o Make ``show link'' show all link details, and ``show links''
  just give a list of links and their current status.
o Show our current label in ``show bundle''.
o Allow link cloning and removal as soon as our MRRU is set.
o Make ``show lcp'' require context as nothing will ever change
  in our MP LCP (it's auto-configured as per rfc1990).
o Initialise our LQM owner in hdlc_Init().
o Store our endpoint discriminator and authentication name at both
  the datalink and multilink level and compare them when we've
  finished AUTHENTICATE phase and before entering NETWORK phase.
  If they don't match, close the link again.
  Display the information in the appropriate ``show'' command.
o Initialise datalink::phone and datalink::fsmp.object properly
  when we're cloning the link.
o Show which link we're passing LQRs on in our diagnostics.
o Reject endpoint discriminator REQs at the logical multilink
  level.
o Remove the rest of our CARRIER and LINK logging setup.
1998-04-24 19:16:15 +00:00
Brian Somers
49052c9523 Negotiate MRRU, SHORTSEQ and ENDDISC. ENDDISC doesn't imply
multilink ('cos I've seen my ISP REQ it without multilink).

Setting MRRU is ifdef'd out until it's debugged and we can
merge -direct links with other running programs.

Fix MTU setting.
1998-04-23 03:23:03 +00:00
Brian Somers
e3c70ce931 Tidy up the use of struct pppTimer. 1998-04-19 15:24:50 +00:00
Brian Somers
1342caed9c o Move the accept/deny/disable/enable globals either to the
bundle (non-negotiated vars) or to their respective IPCP,
  LCP or CCP.
o Enable rolling throughput statistics by default.
o Remove the `display' command.  These values now appear in
  `show bundle', `show ipcp', `show ccp' and `show lcp'.
o Initialise auth name & key at bundle create time (oops).
o Rename pppd-deflate (the id-24 hack) to deflate24.
o Don't send both a REJ and a NAK to an IPCP or LCP REQ.
  Favour the REJ (already done at the CCP level).
o Recurse in datalink_UpdateSet() when we change state, otherwise
  we end up setting no descriptors and getting jammed in the
  imminent select() instead of doing the dial/login/hangup.
o Display our CHAP encryption method despite being built with DES.
o Display VJ as not negotiated in ``show ipcp'' when necessary.
1998-04-16 00:26:21 +00:00
Brian Somers
2764b86afd o Move alias function pointers into loadalias.c
o Move Var*Version into command.c
o Remove struct pppVars (and there was much rejoicing) !
o Forward-decl some structs in .h files to avoid include
  ordering requirements and remove a few more redundant
  #includes.
1998-04-07 00:54:26 +00:00
Brian Somers
d24f017be8 Remove unused includes. 1998-04-06 09:12:38 +00:00
Brian Somers
b6217683dc Deglobalise `struct prompt':
o Our diagnostic socket has its password set in the `set socket'
    line only (not in ppp.secret).
  o Passwords are per server socket (*VarAuthKey are gone)
  o Authority is per prompt (VarLocalAuth is gone).
  o Local logging is per prompt.
  o Add a `show who' command to see who's connected.  No identd
    routine - just a `where the connection came from' display.
  o SIGUSR1 is disabled for now - we have no way of choosing a
    password for the socket created :-(

Prompts are attached as a list of `struct descriptor's in
struct bundle, and serviced under the bundles descriptor
service routines.  Ultimately, everything should be done
like this.

Cosmetic:
  o alphabeticalise SRCS in Makefile.
  o Add a few comments in command.h

TODO: Start checking that we don't overflow the descriptor sets
      in select() now that we can have any number of descriptors.
1998-04-03 19:26:02 +00:00
Brian Somers
cd9647a100 o Move default MRU, MTU, ACCMAP and OPENMODE config values into
struct lcp and display them in `show lcp'.
o Remove `show mru' and `show mtu' and make the data part of
  `show lcp'.  Also merge `set m[tr]u' and `set openmode'
  implementations into the SetVariable function.
o `set timeout' only accepts the idle timer value as an argument.
o Move our lqr period into struct lcp, and create a `set lqrperiod'
  command.  Display it in `show lcp'.
o Remove VarRetryTimeout, and implement it at the LCP, PAP, CHAP,
  CCP and IPCP levels, creating individual `set XXXretry' commands
  for each.  They must be separate because they have different
  context requirements in multilink mode.
o Display default config values in `show ccp'.
o Tart the man page up a bit (wrt PPP/TCP, compression and LQR) and
  explain the new commands.
1998-04-03 19:24:07 +00:00
Brian Somers
3b0f8d2ed6 o Move struct lcp and struct ccp into struct link.
o Remove bundle2lcp(), bundle2ccp() and bundle2link().
  They're too resource-hungry and we have `owner pointers'
  to do their job.
o Make our FSM understand LCPs that are always ST_OPENED
  (with a minimum code that != 1).
o Send FSM code rejects for invalid codes.
o Make our bundle fsm_parent deal with multiple links.
o Make timer diagnostics pretty and allow access via ~t
  in `term' mode (not just when logging debug) and
  `show timers'.  Only show timers every second in debug
  mode, otherwise we get too many diagnostics to be useful
  (we probably still do).  Also, don't restrict ~m in term
  mode to depend on debug logging.
o Rationalise our bundles' phases.
o Create struct mp (multilink protocol).  This is both an
  NCP and a type of struct link.  It feeds off other NCPs
  for output, passing fragmented packets into the queues
  of available datalinks.  It also gets PROTO_MP input,
  reassembles the fragments into ppp frames, and passes
  them back to the HDLC layer that the fragments were passed
  from.
  ** It's not yet possible to enter multilink mode :-( **
o Add `set weight' (requires context) for deciding on a links
  weighting in multilink mode.  Weighting is simplistic (and
  probably badly implemented) for now.
o Remove the function pointers in struct link.  They ended up
  only applying to physical links.
o Configure our tun device with an MTU equal to the MRU from
  struct mp's LCP and a speed equal to the sum of our link
  speeds.
o `show {lcp,ccp,proto}' and `set deflate' now have optional
  context and use ChooseLink() to decide on which `struct link'
  to use.  This allows behaviour as before when in non-multilink
  mode, and allows access to the MP logical link in multilink
  mode.
o Ignore reconnect and redial values when in -direct mode and
  when cleaning up.  Always redial when in -ddial or -dedicated
  mode (unless cleaning up).
o Tell our links to `staydown' when we close them due to a signal.
o Remove remaining `#ifdef SIGALRM's (ppp doesn't function without
  alarms).
o Don't bother strdup()ing our physical link name.
o Various other cosmetic changes.
1998-04-03 19:21:56 +00:00
Brian Somers
eaa4df37f4 Move VJ compression state and stats into struct ipcp. 1998-03-16 22:54:35 +00:00
Brian Somers
5ca5389af4 Move filter sets into struct bundle. 1998-03-16 22:52:54 +00:00
Brian Somers
5828db6d2d Move the IPCP into struct bundle. 1998-03-13 21:07:46 +00:00
Brian Somers
c4c4aaacea Add extraneous braces to stiffle warnings from gcc-2.8 1998-03-13 01:36:10 +00:00
Brian Somers
879ed6fa82 De-staticise LQR information
Increment OutPackets for any packet - not just LQRs

MFC:
  o Fix a few comment typos.
  o Fix ``set timeout'' usage message and documentation.
  o Change ifOutPackets, ifOutOctets and ifOutLQRs to `u_int32_t's
    so that they wrap correctly.
  o Put the LQR in network byte order using the correct struct size
    (sizeof u_int32_t, not sizeof u_long).
  o Wrap LQR ECHO counters correctly.
  o Don't increment OutLQR count if the last LQR hasn't been replied
    to.
  o Initialise last received LQR in StartLqm.
  o Don't start the LQR timer if we're `disabled' and `accepted'.
  o Generate LQR responses when both sides are using a timer and
    we're not going to send our next LQR before the peers max timeout.
1998-03-13 00:44:26 +00:00
Brian Somers
d501527213 o Allow "*" in the password field in ppp.secret (forcing a
getpwnam() lookup).
o Don't use chat_ExpandString on the password field in ppp.secret.
  It's still possible to quote the string for embedded spaces.
o Don't allow multiple entries with the same name in ppp.secret.
1998-03-09 19:25:35 +00:00