[Accel-ppp-users] [PATCH 1/2] lcp: reject Authentication-Protocol option in Configure-Request packe
Status: Beta
Brought to you by:
xebd
From: Guillaume N. <g....@al...> - 2018-11-19 16:44:54
|
If we receive a Configure-Request packet, that means the peer wants us to authenticate to him. However, none of our authentication backends (PAP, CHAP and MSCHAP v1/v2) supports authenticating ourself to the peer. Therefore, the LCP negotiation completes, but we hang in the authentication phase because accel-ppp never sends any credential. We should reject the Authentication-Protocol option found in Configure-Request packets sent by the peer. This way, the peer knows that we won't authenticate to him. Then it's up to him to keep connecting without authentication from our side or to drop the connection. This doesn't change the way we request the peer to authenticate to us. That part of the negotiation is handled by Configure-Request packets that are sent by us (not those sent by the peer). In practice some PPP clients wouldn't connect with the previous behaviour, but are perfectly happy with their Authentication-Protocol option being rejected. They just resend their Configure-Request without requesting authentication from our side. Also, since the peer_auth field of struct auth_option_t is never set anymore, we can remove the conditionals in auth_recv_conf_nak() and auth_recv_conf_rej(). Signed-off-by: Guillaume Nault <g....@al...> --- accel-pppd/ppp/ppp_auth.c | 53 +-------------------------------------- 1 file changed, 1 insertion(+), 52 deletions(-) diff --git a/accel-pppd/ppp/ppp_auth.c b/accel-pppd/ppp/ppp_auth.c index 59248995..c475dadc 100644 --- a/accel-pppd/ppp/ppp_auth.c +++ b/accel-pppd/ppp/ppp_auth.c @@ -39,7 +39,6 @@ struct auth_option_t struct lcp_option_t opt; struct list_head auth_list; struct auth_data_t *auth; - struct auth_data_t *peer_auth; int started:1; }; @@ -142,57 +141,11 @@ static int auth_send_conf_req(struct ppp_lcp_t *lcp, struct lcp_option_t *opt, u static int auth_recv_conf_req(struct ppp_lcp_t *lcp, struct lcp_option_t *opt, uint8_t *ptr) { - struct auth_option_t *auth_opt = container_of(opt,typeof(*auth_opt),opt); - struct lcp_opt16_t *opt16 = (struct lcp_opt16_t*)ptr; - struct auth_data_t *d; - int r; - - if (auth_opt->started) { - if (!auth_opt->auth) - return LCP_OPT_REJ; - - if (!ptr || ntohs(opt16->val) != auth_opt->auth->proto) - return LCP_OPT_NAK; - - return LCP_OPT_ACK; - } - - if (list_empty(&auth_opt->auth_list)) - return LCP_OPT_REJ; - - if (!ptr) - return LCP_OPT_ACK; - - - list_for_each_entry(d, &auth_opt->auth_list, entry) { - if (d->proto == ntohs(opt16->val)) { - r = d->h->recv_conf_req(lcp->ppp, d, (uint8_t*)(opt16 + 1)); - if (r == LCP_OPT_FAIL) - return LCP_OPT_FAIL; - if (r == LCP_OPT_REJ) - break; - auth_opt->peer_auth = d; - return r; - } - } - - list_for_each_entry(d, &auth_opt->auth_list, entry) { - if (d->state != LCP_OPT_NAK) { - auth_opt->peer_auth = d; - return LCP_OPT_NAK; - } - } - - log_ppp_error("cann't negotiate authentication type\n"); - return LCP_OPT_FAIL; + return LCP_OPT_REJ; } static int auth_recv_conf_ack(struct ppp_lcp_t *lcp, struct lcp_option_t *opt, uint8_t *ptr) { - struct auth_option_t *auth_opt = container_of(opt, typeof(*auth_opt), opt); - - auth_opt->peer_auth = NULL; - return 0; } @@ -206,8 +159,6 @@ static int auth_recv_conf_nak(struct ppp_lcp_t *lcp, struct lcp_option_t *opt, u return -1; } auth_opt->auth->state = LCP_OPT_NAK; - if (auth_opt->peer_auth) - auth_opt->auth = auth_opt->peer_auth; list_for_each_entry(d, &auth_opt->auth_list, entry) { if (d->state != LCP_OPT_NAK) @@ -229,8 +180,6 @@ static int auth_recv_conf_rej(struct ppp_lcp_t *lcp, struct lcp_option_t *opt, u } auth_opt->auth->state = LCP_OPT_NAK; - if (auth_opt->peer_auth) - auth_opt->auth = auth_opt->peer_auth; list_for_each_entry(d, &auth_opt->auth_list, entry) { if (d->state != LCP_OPT_NAK) -- 2.19.1 |