1 /* 2 * chap-new.c - New CHAP implementation. 3 * 4 * Copyright (c) 2003 Paul Mackerras. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. The name(s) of the authors of this software must not be used to 14 * endorse or promote products derived from this software without 15 * prior written permission. 16 * 17 * 3. Redistributions of any form whatsoever must retain the following 18 * acknowledgment: 19 * "This product includes software developed by Paul Mackerras 20 * <paulus@samba.org>". 21 * 22 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO 23 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 24 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY 25 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 26 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN 27 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING 28 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 29 */ 30 31 #include "netif/ppp/ppp_opts.h" 32 #if PPP_SUPPORT && CHAP_SUPPORT /* don't build if not configured for use in lwipopts.h */ 33 34 #ifndef CHAP_H 35 #define CHAP_H 36 37 #include "ppp.h" 38 39 #ifdef __cplusplus 40 extern "C" { 41 #endif 42 43 /* 44 * CHAP packets begin with a standard header with code, id, len (2 bytes). 45 */ 46 #define CHAP_HDRLEN 4 47 48 /* 49 * Values for the code field. 50 */ 51 #define CHAP_CHALLENGE 1 52 #define CHAP_RESPONSE 2 53 #define CHAP_SUCCESS 3 54 #define CHAP_FAILURE 4 55 56 /* 57 * CHAP digest codes. 58 */ 59 #define CHAP_MD5 5 60 #if MSCHAP_SUPPORT 61 #define CHAP_MICROSOFT 0x80 62 #define CHAP_MICROSOFT_V2 0x81 63 #endif /* MSCHAP_SUPPORT */ 64 65 /* 66 * Semi-arbitrary limits on challenge and response fields. 67 */ 68 #define MAX_CHALLENGE_LEN 64 69 #define MAX_RESPONSE_LEN 64 70 71 /* 72 * These limits apply to challenge and response packets we send. 73 * The +4 is the +1 that we actually need rounded up. 74 */ 75 #define CHAL_MAX_PKTLEN (PPP_HDRLEN + CHAP_HDRLEN + 4 + MAX_CHALLENGE_LEN + MAXNAMELEN) 76 #define RESP_MAX_PKTLEN (PPP_HDRLEN + CHAP_HDRLEN + 4 + MAX_RESPONSE_LEN + MAXNAMELEN) 77 78 /* bitmask of supported algorithms */ 79 #if MSCHAP_SUPPORT 80 #define MDTYPE_MICROSOFT_V2 0x1 81 #define MDTYPE_MICROSOFT 0x2 82 #endif /* MSCHAP_SUPPORT */ 83 #define MDTYPE_MD5 0x4 84 #define MDTYPE_NONE 0 85 86 #if MSCHAP_SUPPORT 87 /* Return the digest alg. ID for the most preferred digest type. */ 88 #define CHAP_DIGEST(mdtype) \ 89 ((mdtype) & MDTYPE_MD5)? CHAP_MD5: \ 90 ((mdtype) & MDTYPE_MICROSOFT_V2)? CHAP_MICROSOFT_V2: \ 91 ((mdtype) & MDTYPE_MICROSOFT)? CHAP_MICROSOFT: \ 92 0 93 #else /* !MSCHAP_SUPPORT */ 94 #define CHAP_DIGEST(mdtype) \ 95 ((mdtype) & MDTYPE_MD5)? CHAP_MD5: \ 96 0 97 #endif /* MSCHAP_SUPPORT */ 98 99 /* Return the bit flag (lsb set) for our most preferred digest type. */ 100 #define CHAP_MDTYPE(mdtype) ((mdtype) ^ ((mdtype) - 1)) & (mdtype) 101 102 /* Return the bit flag for a given digest algorithm ID. */ 103 #if MSCHAP_SUPPORT 104 #define CHAP_MDTYPE_D(digest) \ 105 ((digest) == CHAP_MICROSOFT_V2)? MDTYPE_MICROSOFT_V2: \ 106 ((digest) == CHAP_MICROSOFT)? MDTYPE_MICROSOFT: \ 107 ((digest) == CHAP_MD5)? MDTYPE_MD5: \ 108 0 109 #else /* !MSCHAP_SUPPORT */ 110 #define CHAP_MDTYPE_D(digest) \ 111 ((digest) == CHAP_MD5)? MDTYPE_MD5: \ 112 0 113 #endif /* MSCHAP_SUPPORT */ 114 115 /* Can we do the requested digest? */ 116 #if MSCHAP_SUPPORT 117 #define CHAP_CANDIGEST(mdtype, digest) \ 118 ((digest) == CHAP_MICROSOFT_V2)? (mdtype) & MDTYPE_MICROSOFT_V2: \ 119 ((digest) == CHAP_MICROSOFT)? (mdtype) & MDTYPE_MICROSOFT: \ 120 ((digest) == CHAP_MD5)? (mdtype) & MDTYPE_MD5: \ 121 0 122 #else /* !MSCHAP_SUPPORT */ 123 #define CHAP_CANDIGEST(mdtype, digest) \ 124 ((digest) == CHAP_MD5)? (mdtype) & MDTYPE_MD5: \ 125 0 126 #endif /* MSCHAP_SUPPORT */ 127 128 /* 129 * The code for each digest type has to supply one of these. 130 */ 131 struct chap_digest_type { 132 int code; 133 134 #if PPP_SERVER 135 /* 136 * Note: challenge and response arguments below are formatted as 137 * a length byte followed by the actual challenge/response data. 138 */ 139 void (*generate_challenge)(ppp_pcb *pcb, unsigned char *challenge); 140 int (*verify_response)(ppp_pcb *pcb, int id, const char *name, 141 const unsigned char *secret, int secret_len, 142 const unsigned char *challenge, const unsigned char *response, 143 char *message, int message_space); 144 #endif /* PPP_SERVER */ 145 void (*make_response)(ppp_pcb *pcb, unsigned char *response, int id, const char *our_name, 146 const unsigned char *challenge, const char *secret, int secret_len, 147 unsigned char *priv); 148 int (*check_success)(ppp_pcb *pcb, unsigned char *pkt, int len, unsigned char *priv); 149 void (*handle_failure)(ppp_pcb *pcb, unsigned char *pkt, int len); 150 }; 151 152 /* 153 * Each interface is described by chap structure. 154 */ 155 #if CHAP_SUPPORT 156 typedef struct chap_client_state { 157 u8_t flags; 158 const char *name; 159 const struct chap_digest_type *digest; 160 unsigned char priv[64]; /* private area for digest's use */ 161 } chap_client_state; 162 163 #if PPP_SERVER 164 typedef struct chap_server_state { 165 u8_t flags; 166 u8_t id; 167 const char *name; 168 const struct chap_digest_type *digest; 169 int challenge_xmits; 170 int challenge_pktlen; 171 unsigned char challenge[CHAL_MAX_PKTLEN]; 172 } chap_server_state; 173 #endif /* PPP_SERVER */ 174 #endif /* CHAP_SUPPORT */ 175 176 #if 0 /* UNUSED */ 177 /* Hook for a plugin to validate CHAP challenge */ 178 extern int (*chap_verify_hook)(char *name, char *ourname, int id, 179 const struct chap_digest_type *digest, 180 unsigned char *challenge, unsigned char *response, 181 char *message, int message_space); 182 #endif /* UNUSED */ 183 184 #if PPP_SERVER 185 /* Called by authentication code to start authenticating the peer. */ 186 extern void chap_auth_peer(ppp_pcb *pcb, const char *our_name, int digest_code); 187 #endif /* PPP_SERVER */ 188 189 /* Called by auth. code to start authenticating us to the peer. */ 190 extern void chap_auth_with_peer(ppp_pcb *pcb, const char *our_name, int digest_code); 191 192 /* Represents the CHAP protocol to the main pppd code */ 193 extern const struct protent chap_protent; 194 195 #ifdef __cplusplus 196 } 197 #endif 198 199 #endif /* CHAP_H */ 200 #endif /* PPP_SUPPORT && CHAP_SUPPORT */ 201