diff options
author | brian <brian@FreeBSD.org> | 2002-06-28 08:46:21 +0000 |
---|---|---|
committer | brian <brian@FreeBSD.org> | 2002-06-28 08:46:21 +0000 |
commit | fa2f229525e767f4666c53a4ba23e8bf0f66eaf8 (patch) | |
tree | 03d9a58902b76553697af736afd575225d629a05 /usr.sbin/ppp | |
parent | e59e6780966168318252b0d87143ce7fb0aea691 (diff) | |
download | FreeBSD-src-fa2f229525e767f4666c53a4ba23e8bf0f66eaf8.zip FreeBSD-src-fa2f229525e767f4666c53a4ba23e8bf0f66eaf8.tar.gz |
When a RADIUS server is being used, don't use MPPE unless the RADIUS
server says it's ok.
Diffstat (limited to 'usr.sbin/ppp')
-rw-r--r-- | usr.sbin/ppp/mppe.c | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/usr.sbin/ppp/mppe.c b/usr.sbin/ppp/mppe.c index f3d8254..2d55ee4 100644 --- a/usr.sbin/ppp/mppe.c +++ b/usr.sbin/ppp/mppe.c @@ -427,14 +427,27 @@ MPPEDispOpts(struct fsm_opt *o) static int MPPEUsable(struct fsm *fp) { - struct lcp *lcp; int ok; +#ifndef NORADIUS + struct radius *r = &fp->bundle->radius; - lcp = &fp->link->lcp; - ok = (lcp->want_auth == PROTO_CHAP && lcp->want_authtype == 0x81) || - (lcp->his_auth == PROTO_CHAP && lcp->his_authtype == 0x81); - if (!ok) - log_Printf(LogCCP, "MPPE: Not usable without CHAP81\n"); + /* + * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES, + * use that instead of our configuration value. + */ + if (*r->cfg.file) { + ok = r->mppe.sendkeylen && r->mppe.recvkeylen; + if (!ok) + log_Printf(LogCCP, "MPPE: Not permitted by RADIUS server\n"); + } else +#endif + { + struct lcp *lcp = &fp->link->lcp; + ok = (lcp->want_auth == PROTO_CHAP && lcp->want_authtype == 0x81) || + (lcp->his_auth == PROTO_CHAP && lcp->his_authtype == 0x81); + if (!ok) + log_Printf(LogCCP, "MPPE: Not usable without CHAP81\n"); + } return ok; } |