2 * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org>
3 * based on work by Toshiharu OHNO <tony-o@iij.ad.jp>
4 * Internet Initiative Japan, Inc (IIJ)
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * $FreeBSD: src/usr.sbin/ppp/chap.c,v 1.61.2.7 2002/09/01 02:12:23 brian Exp $
29 * $DragonFly: src/usr.sbin/ppp/chap.c,v 1.2 2003/06/17 04:30:00 dillon Exp $
32 #include <sys/param.h>
33 #include <netinet/in.h>
34 #include <netinet/in_systm.h>
35 #include <netinet/ip.h>
36 #include <sys/socket.h>
66 #include "throughput.h"
67 #include "descriptor.h"
70 #include "slcompress.h"
94 static const char * const chapcodes[] = {
95 "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE"
97 #define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1)
100 ChapOutput(struct physical *physical, u_int code, u_int id,
101 const u_char *ptr, int count, const char *text)
107 plen = sizeof(struct fsmheader) + count;
110 lh.length = htons(plen);
111 bp = m_get(plen, MB_CHAPOUT);
112 memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
114 memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count);
115 log_DumpBp(LogDEBUG, "ChapOutput", bp);
117 log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]);
119 log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text);
120 link_PushPacket(&physical->link, bp, physical->dl->bundle,
121 LINK_QUEUES(&physical->link) - 1, PROTO_CHAP);
125 chap_BuildAnswer(char *name, char *key, u_char id, char *challenge, u_char type
127 , char *peerchallenge, char *authresponse, int lanman
131 char *result, *digest;
139 char expkey[AUTHLEN << 2];
143 if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL)
146 digest = result; /* the response */
147 *digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */
148 memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen);
150 memset(digest + 24, '\0', 25);
151 mschap_LANMan(digest, challenge + 1, key); /* LANMan response */
153 memset(digest, '\0', 25);
156 for (f = 0; f < klen; f++) {
157 expkey[2*f] = key[f];
158 expkey[2*f+1] = '\0';
162 * expkey = | k\0e\0y\0 |
165 MD4Init(&MD4context);
166 MD4Update(&MD4context, expkey, klen << 1);
167 MD4Final(digest, &MD4context);
170 * ---- -------- ---------------- ------- ------
171 * result = | 49 | LANMan | 16 byte digest | 9 * ? | name |
172 * ---- -------- ---------------- ------- ------
174 mschap_NT(digest, challenge + 1);
177 * ---- -------- ------------- ----- ------
178 * | | struct MS_ChapResponse24 | |
179 * result = | 49 | LANMan | NT digest | 0/1 | name |
180 * ---- -------- ------------- ----- ------
181 * where only one of LANMan & NT digest are set.
183 } else if (type == 0x81) {
184 char expkey[AUTHLEN << 2];
185 char pwdhash[CHAP81_HASH_LEN];
186 char pwdhashhash[CHAP81_HASH_LEN];
190 if ((result = malloc(1 + nlen + CHAP81_RESPONSE_LEN)) == NULL)
193 memset(result, 0, 1 + nlen + CHAP81_RESPONSE_LEN);
196 *digest++ = CHAP81_RESPONSE_LEN; /* value size */
198 /* Copy our challenge */
199 memcpy(digest, peerchallenge + 1, CHAP81_CHALLENGE_LEN);
201 /* Expand password to Unicode XXX */
202 for (f = 0; f < klen; f++) {
203 expkey[2*f] = key[f];
204 expkey[2*f+1] = '\0';
207 ntresponse = digest + CHAP81_NTRESPONSE_OFF;
209 /* Get some needed hashes */
210 NtPasswordHash(expkey, klen * 2, pwdhash);
211 HashNtPasswordHash(pwdhash, pwdhashhash);
213 /* Generate NTRESPONSE to respond on challenge call */
214 GenerateNTResponse(challenge + 1, peerchallenge + 1, name, nlen,
215 expkey, klen * 2, ntresponse);
217 /* Generate MPPE MASTERKEY */
218 GetMasterKey(pwdhashhash, ntresponse, MPPE_MasterKey); /* XXX Global ! */
220 /* Generate AUTHRESPONSE to verify on auth success */
221 GenerateAuthenticatorResponse(expkey, klen * 2, ntresponse,
222 peerchallenge + 1, challenge + 1, name, nlen,
225 authresponse[CHAP81_AUTHRESPONSE_LEN] = 0;
227 memcpy(digest + CHAP81_RESPONSE_LEN, name, nlen);
230 if ((result = malloc(nlen + 17)) != NULL) {
231 /* Normal MD5 stuff */
235 *digest++ = 16; /* value size */
237 MD5Init(&MD5context);
238 MD5Update(&MD5context, &id, 1);
239 MD5Update(&MD5context, key, klen);
240 MD5Update(&MD5context, challenge + 1, *challenge);
241 MD5Final(digest, &MD5context);
243 memcpy(digest + 16, name, nlen);
245 * ---- -------- ------
246 * result = | 16 | digest | name |
247 * ---- -------- ------
255 chap_StartChild(struct chap *chap, char *prog, const char *name)
257 char *argv[MAXARGS], *nargv[MAXARGS];
262 if (chap->child.fd != -1) {
263 log_Printf(LogWARN, "Chap: %s: Program already running\n", prog);
267 if (pipe(in) == -1) {
268 log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno));
272 if (pipe(out) == -1) {
273 log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno));
280 switch ((chap->child.pid = fork())) {
282 log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno));
293 if ((argc = command_Interpret(prog, strlen(prog), argv)) <= 0) {
295 log_Printf(LogWARN, "CHAP: Invalid command syntax\n");
303 if (out[1] == STDIN_FILENO)
304 out[1] = dup(out[1]);
305 dup2(in[0], STDIN_FILENO);
306 dup2(out[1], STDOUT_FILENO);
307 close(STDERR_FILENO);
308 if (open(_PATH_DEVNULL, O_RDWR) != STDERR_FILENO) {
309 log_Printf(LogALERT, "Chap: Failed to open %s: %s\n",
310 _PATH_DEVNULL, strerror(errno));
313 for (fd = getdtablesize(); fd > STDERR_FILENO; fd--)
314 fcntl(fd, F_SETFD, 1);
316 setuid(ID0realuid());
318 command_Expand(nargv, argc, (char const *const *)argv,
319 chap->auth.physical->dl->bundle, 0, pid);
320 execvp(nargv[0], nargv);
321 printf("exec() of %s failed: %s\n", nargv[0], strerror(errno));
327 chap->child.fd = out[0];
328 chap->child.buf.len = 0;
329 write(in[1], chap->auth.in.name, strlen(chap->auth.in.name));
330 write(in[1], "\n", 1);
331 write(in[1], chap->challenge.peer + 1, *chap->challenge.peer);
332 write(in[1], "\n", 1);
333 write(in[1], name, strlen(name));
334 write(in[1], "\n", 1);
341 chap_Cleanup(struct chap *chap, int sig)
343 if (chap->child.pid) {
346 close(chap->child.fd);
349 kill(chap->child.pid, SIGTERM);
351 chap->child.buf.len = 0;
353 if (wait(&status) == -1)
354 log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno));
355 else if (WIFSIGNALED(status))
356 log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status));
357 else if (WIFEXITED(status) && WEXITSTATUS(status))
358 log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status));
360 *chap->challenge.local = *chap->challenge.peer = '\0';
367 chap_Respond(struct chap *chap, char *name, char *key, u_char type
375 ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer, type
377 , chap->challenge.local, chap->authresponse, lm
382 ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id,
383 ans, *ans + 1 + strlen(name), name);
385 chap->NTRespSent = !lm;
386 MPPE_IsServer = 0; /* XXX Global ! */
390 ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id,
391 "Out of memory!", 14, NULL);
395 chap_UpdateSet(struct fdescriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n)
397 struct chap *chap = descriptor2chap(d);
399 if (r && chap && chap->child.fd != -1) {
400 FD_SET(chap->child.fd, r);
401 if (*n < chap->child.fd + 1)
402 *n = chap->child.fd + 1;
403 log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd);
411 chap_IsSet(struct fdescriptor *d, const fd_set *fdset)
413 struct chap *chap = descriptor2chap(d);
415 return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset);
419 chap_Read(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset)
421 struct chap *chap = descriptor2chap(d);
424 got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len,
425 sizeof chap->child.buf.ptr - chap->child.buf.len - 1);
427 log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno));
428 chap_Cleanup(chap, SIGTERM);
429 } else if (got == 0) {
430 log_Printf(LogWARN, "Chap: Read: Child terminated connection\n");
431 chap_Cleanup(chap, SIGTERM);
433 char *name, *key, *end;
435 chap->child.buf.len += got;
436 chap->child.buf.ptr[chap->child.buf.len] = '\0';
437 name = chap->child.buf.ptr;
438 name += strspn(name, " \t");
439 if ((key = strchr(name, '\n')) == NULL)
442 end = strchr(++key, '\n');
445 if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) {
446 log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n");
447 chap_Cleanup(chap, SIGTERM);
451 int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 &&
452 ((chap->NTRespSent &&
453 IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) ||
454 !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt));
457 while (end >= name && strchr(" \t\r\n", *end))
460 while (end >= name && strchr(" \t\r\n", *end))
462 key += strspn(key, " \t");
464 chap_Respond(chap, name, key, chap->auth.physical->link.lcp.his_authtype
469 chap_Cleanup(chap, 0);
475 chap_Write(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset)
477 /* We never want to write here ! */
478 log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n");
483 chap_ChallengeInit(struct authinfo *authp)
485 struct chap *chap = auth2chap(authp);
489 len = strlen(authp->physical->dl->bundle->cfg.auth.name);
491 if (!*chap->challenge.local) {
493 cp = chap->challenge.local;
496 if (*authp->physical->dl->bundle->radius.cfg.file) {
497 /* For radius, our challenge is 16 readable NUL terminated bytes :*/
499 for (i = 0; i < 16; i++)
500 *cp++ = (random() % 10) + '0';
505 if (authp->physical->link.lcp.want_authtype == 0x80)
506 *cp++ = 8; /* MS does 8 byte callenges :-/ */
507 else if (authp->physical->link.lcp.want_authtype == 0x81)
508 *cp++ = 16; /* MS-CHAP-V2 does 16 bytes challenges */
511 *cp++ = random() % (CHAPCHALLENGELEN-16) + 16;
512 for (i = 0; i < *chap->challenge.local; i++)
513 *cp++ = random() & 0xff;
515 memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len);
520 chap_Challenge(struct authinfo *authp)
522 struct chap *chap = auth2chap(authp);
525 log_Printf(LogDEBUG, "CHAP%02X: Challenge\n",
526 authp->physical->link.lcp.want_authtype);
528 len = strlen(authp->physical->dl->bundle->cfg.auth.name);
530 /* Generate new local challenge value */
531 if (!*chap->challenge.local)
532 chap_ChallengeInit(authp);
535 if (authp->physical->link.lcp.want_authtype == 0x81)
536 ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id,
537 chap->challenge.local, 1 + *chap->challenge.local, NULL);
540 ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id,
541 chap->challenge.local, 1 + *chap->challenge.local + len, NULL);
545 chap_Success(struct authinfo *authp)
547 struct bundle *bundle = authp->physical->dl->bundle;
550 datalink_GotAuthname(authp->physical->dl, authp->in.name);
552 if (authp->physical->link.lcp.want_authtype == 0x81) {
554 if (*bundle->radius.cfg.file && bundle->radius.msrepstr)
555 msg = bundle->radius.msrepstr;
558 msg = auth2chap(authp)->authresponse;
559 MPPE_MasterKeyValid = 1; /* XXX Global ! */
563 if (*bundle->radius.cfg.file && bundle->radius.repstr)
564 msg = bundle->radius.repstr;
569 ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, msg, strlen(msg),
572 authp->physical->link.lcp.auth_ineed = 0;
573 if (Enabled(bundle, OPT_UTMP))
574 physical_Login(authp->physical, authp->in.name);
576 if (authp->physical->link.lcp.auth_iwait == 0)
578 * Either I didn't need to authenticate, or I've already been
579 * told that I got the answer right.
581 datalink_AuthOk(authp->physical->dl);
585 chap_Failure(struct authinfo *authp)
588 char buf[1024], *ptr;
593 struct bundle *bundle = authp->physical->link.lcp.fsm.bundle;
594 if (*bundle->radius.cfg.file && bundle->radius.errstr)
595 msg = bundle->radius.errstr;
599 if (authp->physical->link.lcp.want_authtype == 0x80) {
600 sprintf(buf, "E=691 R=1 M=Invalid!");
602 } else if (authp->physical->link.lcp.want_authtype == 0x81) {
606 ptr += sprintf(buf, "E=691 R=0 C=");
608 ptr += sprintf(ptr, "%02X", *(auth2chap(authp)->challenge.local+1+i));
610 sprintf(ptr, " V=3 M=Invalid!");
616 ChapOutput(authp->physical, CHAP_FAILURE, authp->id, msg, strlen(msg) + 1,
618 datalink_AuthNotOk(authp->physical->dl);
622 chap_Cmp(u_char type, char *myans, int mylen, char *hisans, int hislen
631 else if (type == 0x80) {
632 int off = lm ? 0 : 24;
634 if (memcmp(myans + off, hisans + off, 24))
638 else if (memcmp(myans, hisans, mylen))
646 chap_HaveAnotherGo(struct chap *chap)
648 if (++chap->peertries < 3) {
649 /* Give the peer another shot */
650 *chap->challenge.local = '\0';
651 chap_Challenge(&chap->auth);
660 chap_Init(struct chap *chap, struct physical *p)
662 chap->desc.type = CHAP_DESCRIPTOR;
663 chap->desc.UpdateSet = chap_UpdateSet;
664 chap->desc.IsSet = chap_IsSet;
665 chap->desc.Read = chap_Read;
666 chap->desc.Write = chap_Write;
669 auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure);
670 *chap->challenge.local = *chap->challenge.peer = '\0';
672 chap->NTRespSent = 0;
678 chap_ReInit(struct chap *chap)
680 chap_Cleanup(chap, SIGTERM);
684 chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
686 struct physical *p = link2physical(l);
687 struct chap *chap = &p->dl->chap;
688 char *name, *key, *ans;
696 log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n");
701 if (bundle_Phase(bundle) != PHASE_NETWORK &&
702 bundle_Phase(bundle) != PHASE_AUTHENTICATE) {
703 log_Printf(LogPHASE, "Unexpected chap input - dropped !\n");
708 m_settype(bp, MB_CHAPIN);
709 if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL &&
710 ntohs(chap->auth.in.hdr.length) == 0)
711 log_Printf(LogWARN, "Chap Input: Truncated header !\n");
712 else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE)
713 log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n",
714 chap->auth.in.hdr.code);
719 if (chap->auth.in.hdr.code != CHAP_CHALLENGE &&
720 chap->auth.id != chap->auth.in.hdr.id &&
721 Enabled(bundle, OPT_IDCHECK)) {
722 /* Wrong conversation dude ! */
723 log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n",
724 chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id,
729 chap->auth.id = chap->auth.in.hdr.id; /* We respond with this id */
734 switch (chap->auth.in.hdr.code) {
736 bp = mbuf_Read(bp, &alen, 1);
739 log_Printf(LogERROR, "Chap Input: Truncated challenge !\n");
743 *chap->challenge.peer = alen;
744 bp = mbuf_Read(bp, chap->challenge.peer + 1, alen);
745 bp = auth_ReadName(&chap->auth, bp, len);
747 lanman = p->link.lcp.his_authtype == 0x80 &&
748 ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) ||
749 !IsAccepted(p->link.lcp.cfg.chap80nt));
751 /* Generate local challenge value */
752 chap_ChallengeInit(&chap->auth);
757 auth_StopTimer(&chap->auth);
758 bp = mbuf_Read(bp, &alen, 1);
761 log_Printf(LogERROR, "Chap Input: Truncated response !\n");
765 if ((ans = malloc(alen + 1)) == NULL) {
766 log_Printf(LogERROR, "Chap Input: Out of memory !\n");
770 *ans = chap->auth.id;
771 bp = mbuf_Read(bp, ans + 1, alen);
772 bp = auth_ReadName(&chap->auth, bp, len);
774 lanman = p->link.lcp.want_authtype == 0x80 &&
775 alen == 49 && ans[alen] == 0;
781 /* chap->auth.in.name is already set up at CHALLENGE time */
782 if ((ans = malloc(len + 1)) == NULL) {
783 log_Printf(LogERROR, "Chap Input: Out of memory !\n");
787 bp = mbuf_Read(bp, ans, len);
792 switch (chap->auth.in.hdr.code) {
795 if (*chap->auth.in.name)
796 log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n",
797 chapcodes[chap->auth.in.hdr.code], alen,
800 lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ?
805 log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n",
806 chapcodes[chap->auth.in.hdr.code], alen,
808 lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ?
817 log_Printf(LogPHASE, "Chap Input: %s (%s)\n",
818 chapcodes[chap->auth.in.hdr.code], ans);
820 log_Printf(LogPHASE, "Chap Input: %s\n",
821 chapcodes[chap->auth.in.hdr.code]);
825 switch (chap->auth.in.hdr.code) {
827 if (*bundle->cfg.auth.key == '!' && bundle->cfg.auth.key[1] != '!')
828 chap_StartChild(chap, bundle->cfg.auth.key + 1,
829 bundle->cfg.auth.name);
831 chap_Respond(chap, bundle->cfg.auth.name, bundle->cfg.auth.key +
832 (*bundle->cfg.auth.key == '!' ? 1 : 0),
833 p->link.lcp.his_authtype
841 name = chap->auth.in.name;
844 if (p->link.lcp.want_authtype == 0x81) {
845 struct MSCHAPv2_resp *resp = (struct MSCHAPv2_resp *)(ans + 1);
847 chap->challenge.peer[0] = sizeof resp->PeerChallenge;
848 memcpy(chap->challenge.peer + 1, resp->PeerChallenge,
849 sizeof resp->PeerChallenge);
854 if (*bundle->radius.cfg.file) {
855 if (!radius_Authenticate(&bundle->radius, &chap->auth,
856 chap->auth.in.name, ans, alen + 1,
857 chap->challenge.local + 1,
858 *chap->challenge.local))
859 chap_Failure(&chap->auth);
863 if (p->link.lcp.want_authtype == 0x81 && ans[alen] != '\0' &&
864 alen == sizeof(struct MSCHAPv2_resp)) {
865 struct MSCHAPv2_resp *resp = (struct MSCHAPv2_resp *)(ans + 1);
867 log_Printf(LogWARN, "%s: Compensating for corrupt (Win98/WinME?) "
868 "CHAP81 RESPONSE\n", l->name);
869 resp->Flags = '\0'; /* rfc2759 says it *MUST* be zero */
871 key = auth_GetSecret(bundle, name, nlen, p);
874 if (p->link.lcp.want_authtype == 0x80 &&
875 lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) {
876 log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n");
877 if (chap_HaveAnotherGo(chap))
880 } else if (p->link.lcp.want_authtype == 0x80 &&
881 !lanman && !IsEnabled(p->link.lcp.cfg.chap80nt)) {
882 log_Printf(LogPHASE, "Auth failure: mschap not enabled\n");
883 if (chap_HaveAnotherGo(chap))
886 } else if (p->link.lcp.want_authtype == 0x81 &&
887 !IsEnabled(p->link.lcp.cfg.chap81)) {
888 log_Printf(LogPHASE, "Auth failure: CHAP81 not enabled\n");
893 char *myans = chap_BuildAnswer(name, key, chap->auth.id,
894 chap->challenge.local,
895 p->link.lcp.want_authtype
897 , chap->challenge.peer,
898 chap->authresponse, lanman);
899 MPPE_IsServer = 1; /* XXX Global ! */
906 if (!chap_Cmp(p->link.lcp.want_authtype, myans + 1, *myans,
919 chap_Success(&chap->auth);
921 chap_Failure(&chap->auth);
927 if (p->link.lcp.auth_iwait == PROTO_CHAP) {
928 p->link.lcp.auth_iwait = 0;
929 if (p->link.lcp.auth_ineed == 0) {
931 if (p->link.lcp.his_authtype == 0x81) {
932 if (strncasecmp(ans, chap->authresponse, 42)) {
933 datalink_AuthNotOk(p->dl);
934 log_Printf(LogWARN, "CHAP81: AuthenticatorResponse: (%.42s)"
935 " != ans: (%.42s)\n", chap->authresponse, ans);
938 /* Successful login */
939 MPPE_MasterKeyValid = 1; /* XXX Global ! */
940 datalink_AuthOk(p->dl);
945 * We've succeeded in our ``login''
946 * If we're not expecting the peer to authenticate (or he already
947 * has), proceed to network phase.
949 datalink_AuthOk(p->dl);
955 datalink_AuthNotOk(p->dl);