summaryrefslogtreecommitdiffstats
path: root/usr.sbin/ppp/auth.c
Commit message (Collapse)AuthorAgeFilesLines
* Handle NULL return from crypt(3). Mostly from DragonFlykevlo2012-02-221-1/+3
|
* Revert previous commit and fix OpenPAM issue properly.des2007-12-221-6/+6
|
* Fix/workaround build breakage caused by PAM importkmacy2007-12-211-1/+1
| | | | | struct pam_conv takes a void * for the appdata_ptr but is being passed a const char * - explicitly cast away the const
* Fix the build on 64-bit platforms.marcel2004-09-061-4/+4
|
* Make ppp WARNS=5 cleanbrian2004-09-051-11/+9
|
* Basic PAM authentication support.ru2003-10-291-0/+48
|
* o Clean up some #includesbrian2002-05-141-1/+0
| | | | | | | | | | | | | | | | | | o Bump version number to 3.0.4 o When talking to a RADIUS server, provide a NAS-Port-Type. When the NAS-Port-Type is Ethernet, provide a NAS-Port value equal to the SESSIONID from the environment in direct mode or the NGM_PPPOE_SESSIONID message in other modes. If no SESSIONID is found, default to the interface index in client mode or zero in server mode. When the NAS-Port-Type is ISDN, set the NAS-Port to the minor number of the physical device (ie, the N in /dev/i4brbchN). This makes it easier for the RADIUS server to identify the client WRT accounting data etc. Prompted by: lsz8425 <lsz8425@mail.cd.hn.cn>
* Get tun P2P address from the local pool if RADIUS server returnedhosokawa2002-04-041-1/+2
| | | | | | 255.255.255.254 as client ipaddr. Reviewed-By: freebsd-net mailing list
* When authenticating a name containing a ``\'', attempt to autenticatebrian2002-01-081-9/+50
| | | | | | | | using the part after the ``\'' if the original name is not found. This allows M$ clients to use domain\user as their authname. Reviewed by: Ian West <ian@niw.com.au>
* o Add ipv6 support, abstracting most NCP addresses into opaquebrian2001-08-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structures (well, they're treated as opaque). It's now possible to manage IPv6 interface addresses and routing table entries and to filter IPV6 traffic whether encapsulated or not. IPV6CP support is crude for now, and hasn't been tested against any other implementations. RADIUS and IPv6 are independent of eachother for now. ppp.linkup/ppp.linkdown aren't currently used by IPV6CP o Understand all protocols(5) in filter rules rather than only a select few. o Allow a mask specification for the ``delete'' command. It's now possible to specifically delete one of two conflicting routes. o When creating and deleting proxy arp entries, do it for all IPv4 interface addresses rather than doing it just for the ``current'' peer address. o When iface-alias isn't in effect, don't blow away manually (via ``iface add'') added interface addresses. o When listening on a tcp server (diagnostic) socket, bind so that a tcp46 socket is created -- allowing both IPv4 and IPv6 connections. o When displaying ICMP traffic, don't display the icmp type twice. When display traffic, display at least some information about unrecognised traffic. o Bump version Inspired after filtering work by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org>
* Convert IIJ copyrights to BSD copyrights.brian2001-06-131-19/+25
| | | | Approved by: Toshiharu OHNO <tohno@sirius.ocn.ne.jp>
* Don't allowt '#' as a comment when it's embedded in quotes:brian1999-12-271-4/+4
| | | | | | | | set something "xxx yyy # zzz" aaa shouldn't be interpreted as set something "xxx yyy" aaa
* Don't munge ``set dial|login|logout|hangup'' arguments beforebrian1999-12-221-4/+4
| | | | ExpandString() has a chance to do its own substitutions.
* Notice and warn about unterminated quoted strings in commands.brian1999-12-201-8/+20
| | | | The entire command is ignored if the syntax is invalid...
* Cosmetic: Make struct mbuf more like kernel mbufs.brian1999-12-201-4/+4
|
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Don't drop the last character from lines in ppp.secret unless it's '\n'.brian1999-06-081-3/+5
|
* o Redesign the layering mechanism and make the aliasing code part ofbrian1999-05-081-2/+3
| | | | | | | | | | | | | | | | | | | | | the layering. We now ``stack'' layers as soon as we open the device (when we figure out what we're dealing with). A static set of `dispatch' routines are also declared for dealing with incoming packets after they've been `pulled' up through the stacked layers. Physical devices are now assigned handlers based on the device type when they're opened. For the moment there are three device types; ttys, execs and tcps. o Increment version number to 2.2 o Make an entry in [uw]tmp for non-tty -direct invocations (after pap/chap authentication). o Make throughput counters quad_t's o Account for the absolute number of mbuf malloc()s and free()s in ``show mem''. o ``show modem'' becomes ``show physical''.
* Avoid a few warnings on the alphabrian1999-03-311-2/+2
|
* Allow control over the number of ConfigREQ & TermREQ attemptsbrian1999-02-261-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that are made in each of the FSMs (LCP, CCP & IPCP) and the number of REQs/Challenges for PAP/CHAP by accepting more arguments in the ``set {c,ip,l}cpretry'' and ``set {ch,p}apretry'' commands. Change the non-convergence thresholds to 3 times the number of configured REQ tries (rather than the previous fixed ``10''). We now notice repeated NAKs and REJs rather than just REQs. Don't suggest that CHAP 0x05 isn't supported when it's not configured. Fix some bugs that expose themselves with smaller numbers of retries: o Handle instantaneous disconnects (set device /dev/null) correctly by stopping all fsm timers in fsm2initial. o Don't forget to uu_unlock() devices that are files but are not ttys (set device /dev/zero). Fix a *HORRENDOUS* bug in RFC1661 (already fixed for an Open event in state ``Closed''): According to the state transition table, a RCR+ or RCR- received in the ``Stopped'' state are supposed to InitRestartCounter, SendConfigReq and SendConfig{Ack,Nak}. However, in ``Stopped'', we haven't yet done a TLS (or the last thing we did is a TLF). We must therefore do the TLS at this point ! This was never noticed before because LCP and CCP used not use LayerStart() for anything interesting, and IPCP tends to go into Stopped then get a Down because of an LCP RTR rather than getting a RCR again.
* Handle empty PAP & CHAP packets (containing only an FSM header).brian1999-02-201-2/+5
| | | | | | Some CHAP implementations send no welcome message with their SUCCESS/FAILURE packets. This was being mis-identified as a truncated packet by the new authentication code :-(
* Be a little more verbose about dodgy looking authenticationbrian1999-02-191-4/+9
| | | | packets before dropping them in the bit-bucket.
* Fully support both NT and LANMan CHAP type 0x80 as bothbrian1999-02-181-3/+6
| | | | authenticator and authenticatee.
* Decouple pap & chap output routines from the correspondingbrian1999-02-061-17/+52
| | | | | | | | | | | | | | | | | | | | | | | input routines and take advantage of the new init/continue interface in libradius. This allows a timely response on other links in an MP setup while RADIUS requests are in progress as well as the ability to handle other data from the peer in parallel. It should also make the future addition of PAM support trivial. While I'm in there, validate pap & chap header IDs if ``idcheck'' is enabled (the default) for other FSM packet types. NOTE: This involved integrating the generation of chap challenges and the validation of chap responses (and commenting what's going on in those routines). I currently have no way of testing ppps ability to respond to M$Chap CHALLENGEs correctly, so if someone could do the honours, it'd be much appreciated (it *looks* ok!). Sponsored by: Internet Business Solutions Ltd., Switzerland
* Reimplement the previous fix (no response to PAP requests)brian1999-02-021-6/+13
| | | | | | at the authentication layer rather than at the PAP layer so that it also applies to CHAP (no response to CHAP challenges).
* If we receive no answer from the server when sending PAPbrian1999-02-011-4/+7
| | | | requests, give up (don't sit there indefinitely).
* Initial RADIUS support (using libradius). See the man page forbrian1999-01-281-23/+52
| | | | | | | | | | | | | | | | | | | details. Compiling with -DNORADIUS (the default for `release') removes support. TODO: The functionality in libradius::rad_send_request() needs to be supplied as a set of routines so that ppp doesn't have to wait indefinitely for the radius server(s). Instead, we need to get a descriptor back, select() on the descriptor, and ask libradius to service it when necessary. For now, ppp blocks SIGALRM while in rad_send_request(), so it misses PAP/CHAP retries & timeouts if they occur. Only PAP is functional. When CHAP is attempted, libradius complains that no User-Password has been specified... rfc2138 says that it *mustn't* be used for CHAP :-( Sponsored by: Internet Business Solutions Ltd., Switzerland
* Don't return stack-based data. This may have causedbrian1998-12-171-2/+2
| | | | server-side CHAP authentication problems in the past :-/
* Put the IP buffer queues into struct ipcp.brian1998-08-261-3/+3
| | | | Forgotten by: me
* o Support callback types NONE, E.164, AUTH and CBCP.brian1998-08-071-4/+38
| | | | | | | | | | | | | | (see the new ``set callback'' and ``set cbcp'' commands) o Add a ``cbcp'' log level and mbuf type. o Don't dump core when \T is given in ``set login'' or ``set hangup''. o Allow ``*'' and blanks as placeholders in ppp.secret and allow a fifth field for specifying auth/cbcp dialback parameters. o Remove a few extraneous #includes o Define the default number of REQs (restart counter) in defs.h rather than hardcoding ``5'' all over the place. o Fix a few man page inconsistencies.
* Add missing braces - without them, the IP & label were mis-selectedbrian1998-07-191-7/+4
| | | | | from ppp.secret. Problem reported by: Dom Mitchell <dom@phmit.demon.co.uk>
* o De-staticise things that don't need to be static.brian1998-06-151-2/+2
| | | | | | | | | | o Bring the static ``ttystate'' into struct prompt so that the tilde context is per prompt and not global. o Comment the remaining static variables so that it's clear why they're static. o Add some XXX comments suggesting that our interface list and our hostname should be re-generated after a signal (say SIGUSR1) so that a machine with PCCARDs has a chance.
* MFMP: Make ppp multilink capable.brian1998-05-211-110/+145
| | | | See the file README.changes, and re-read the man page.
* Add extraneous braces to stiffle warnings from gcc-2.8brian1998-03-131-2/+3
|
* Remove unused #includes.brian1998-01-211-6/+1
| | | | | | Make various bits static. Remove unused variables. Submitted by: eivind
* o Allow the use of HISADDR as the first arg to "add".brian1998-01-051-22/+16
| | | | | | | | | | | | | | o Allow a forth argument in ppp.secret, specifying a new label. This gives control over which section of ppp.link{up,down} is used based on the authenticated user. o Support random address ranges in ppp.secret (not just in ppp.conf). o Add a AUTHENTICATING INCOMING CONNECTIONS section to the man page. o Add a bit more about DEFLATE in the man page. o Fix the incorrect "you must specify a password in interactive mode" bit of the manual. o Space things in the man page consistently. o Be more precice about where you can use MYADDR, HISADDR and INTERFACE in the "add" command documentation.
* Cosmetic (style):brian1997-12-241-11/+11
| | | | | | | sizeof(var) -> sizeof var sizeof type -> sizeof(type) Suggested by: J Wunsch <j@uriah.heep.sax.de>
* Fix prototypes.brian1997-11-221-8/+9
| | | | | | | | | | | | | | Remove extraneous decls. Add ``const'' to several places. Allow ``make NOALIAS=1'' to remove IP aliasing. Merge with OpenBSD - only the Makefiles vary. We can now survive a compile with -Wall -Wbad-function-cast -Wcast-align -Wcast-qual -Winline -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wredundant-decls -Wshadow -Wstrict-prototypes -Wwrite-strings -Wchar-subscripts (although the Makefile just contains -Wall).
* Add id strings to tun.[ch].brian1997-11-171-14/+1
| | | | Don't try to open ppp.secret if we're never going to use it.
* Finish the security improvements:brian1997-11-111-3/+3
| | | | | | | | | | | | | | | | | | | o Add "allow" command: "allow users a b c" gives access to users a, b and c. "allow modes auto" gives those users access to auto mode only. "allow users *" and "allow modes *" are accepted. No users and all modes are allowed by default. UID 0 can do anything. o Set the current label with the "load" and "dial" commands so that the call to ppp.linkdown makes sense. o Up the verison number. o Don't OR MODE_AUTO for -background and -ddial. o Don't OR MODE_INTER when we get a diagnostic connection. o Allow up to 40 args per line (was 20). o "set ifaddr" only changes the interface in AUTO mode (with other modes, it happens after IPCP negotiation). o Sort command descriptions in the man page. o Support -dedicated mode where we just talk ppp forever (no login etc).
* Don't create a diagnostic socket by default.brian1997-11-091-9/+13
| | | | | | Allow a password spec on the "set server" command line. Use SIGUSR2 to close the diagnostic socket. Some man page corrections.
* Don't ask for a password if it's specified as empty.brian1997-11-091-3/+12
|
* Increase chat script sizes to 512brian1997-11-091-4/+4
| | | | Requested by: Michael Reifenberger <root@totum.plaut.de>
* Cosmetic (no functional changes):brian1997-10-261-12/+22
| | | | | | | | | | | | | | | o Add missing $Id$s o Move extern decls from .c -> .h files o Staticize o Remove #includes from .h files o style(9)ify includes o bcopy -> memcpy bzero -> memset bcmp -> memcmp index -> strchr rindex -> strrchr o Move timeout.h -> timer.h (making it consistent w/ timer.c) o Add -Wmissing-prototypes
* Correct ppp authentication defaults in interactivebrian1997-09-091-3/+7
| | | | | | | | | mode. We don't want to be forced to type a password here :-( Pointed out by: mouth@ibm.net (John Kelly) While I'm there, don't allow a "set server" in interactive mode.
* Install as group ``network''brian1997-09-041-12/+13
| | | | | | | | | | | Insist that uid == 0 for client ppp Disallow client sockets if no password is specified Don't exit on failure to open client socket for listening Allow specification of null local password Use reasonable size (smaller) ``vector''s in auth.c Fix "passwd ..." usage message Insist on "all" as arg to "quit" (if any) Drop client socket connection before Cleanup() when "quit all"
* Make the code format more in line with style(9).brian1997-08-251-46/+41
| | | | | Update loadalias to use the new libalias api. Update to version 1.1.
* Overhaul ppp:brian1997-06-091-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | o Use syslog o Remove references to stdout/stderr (incl perror()) o Introduce VarTerm - the interactive terminal or zero o Allow "set timeout" to affect current session o Change "set debug" to "set log" o Allow "set log [+|-]flag" o Make MSEXT and PASSWDAUTH stuff the default o Move all #ifdef DEBUG stuff into the code - this shouldn't be too much overhead. It's now controlled with "set log +debug" o Add "set log command, debug, tun, warn, error, alert" o Remove cdefs.h, and assume an ansi compiler. o Improve all diagnostic output o Don't trap SIGSEGV o SIGHUP now terminates again (log files are controlled by syslog) o Call CloseModem() when changing devices o Fix parsing of third arg of "delete" I think this fixes the "magic is same" problems that some people have been experiencing. The man page is being rewritten. It'll follow soon.
* De-couple ppp from libalias. If libalias isn't there, thebrian1997-05-261-1/+2
| | | | | | | | | alias commands simply won't work. Only root may specify the location of the alias lib (otherwise, it's hard-coded). Make logprintf silently fail if LogOpen hasn't been called. Suggested by: eivind
* Tidy up the code - bounds checking, returnbrian1997-05-101-6/+12
| | | | | | value checking etc. Submitted by: eivind
OpenPOWER on IntegriCloud