abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2026-08-09 17:13:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merged from DEVEL into main tree.

Browse Source
This commit is contained in:
likewise
2003-11-14 13:17:23 +00:00
parent bdfdc2bb83
commit e4a6d199fe
45 changed files with 2329 additions and 850 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/netif/ppp/auth.c
View File

@@ -194,7 +194,7 @@ void link_terminated(int unit)
if (logged_in)
logout();
lcp_phase[unit] = PHASE_DEAD;
ppp_trace(LOG_NOTICE, "Connection terminated.\n");
AUTHDEBUG((LOG_NOTICE, "Connection terminated.\n"));
pppMainWakeup(unit);
}
@@ -257,7 +257,7 @@ void link_established(int unit)
* of "" and a password of "". If that's not OK, boot it out.
*/
if (!wo->neg_upap || !null_login(unit)) {
ppp_trace(LOG_WARNING, "peer refused to authenticate\n");
AUTHDEBUG((LOG_WARNING, "peer refused to authenticate\n"));
lcp_close(unit, "peer refused to authenticate");
return;
}
@@ -294,7 +294,7 @@ void link_established(int unit)
if (ppp_settings.passwd[0] == 0) {
passwd_from_file = 1;
if (!get_pap_passwd(unit, ppp_settings.user, ppp_settings.passwd))
ppp_trace(LOG_ERR, "No secret found for PAP login\n");
AUTHDEBUG((LOG_ERR, "No secret found for PAP login\n"));
}
upap_authwithpeer(unit, ppp_settings.user, ppp_settings.passwd);
auth |= PAP_WITHPEER;
@@ -337,8 +337,8 @@ void auth_peer_success(int unit, u16_t protocol, char *name, int namelen)
pbit = PAP_PEER;
break;
default:
ppp_trace(LOG_WARNING, "auth_peer_success: unknown protocol %x\n",
protocol);
AUTHDEBUG((LOG_WARNING, "auth_peer_success: unknown protocol %x\n",
protocol));
return;
}
@@ -400,8 +400,8 @@ void auth_withpeer_success(int unit, u16_t protocol)
pbit = PAP_WITHPEER;
break;
default:
ppp_trace(LOG_WARNING, "auth_peer_success: unknown protocol %x\n",
protocol);
AUTHDEBUG((LOG_WARNING, "auth_peer_success: unknown protocol %x\n",
protocol));
pbit = 0;
}
@@ -541,7 +541,7 @@ int check_passwd(
* On 10'th, drop the connection.
*/
if (attempts++ >= 10) {
ppp_trace(LOG_WARNING, "%d LOGIN FAILURES BY %s\n", attempts, user);
AUTHDEBUG((LOG_WARNING, "%d LOGIN FAILURES BY %s\n", attempts, user));
/*ppp_panic("Excess Bad Logins");*/
}
if (attempts > 3) {
@@ -616,7 +616,7 @@ int get_secret(
len = strlen(ppp_settings.passwd);
if (len > MAXSECRETLEN) {
ppp_trace(LOG_ERR, "Secret for %s on %s is too long\n", client, server);
AUTHDEBUG((LOG_ERR, "Secret for %s on %s is too long\n", client, server));
len = MAXSECRETLEN;
}
BCOPY(ppp_settings.passwd, secret, len);
@@ -640,7 +640,7 @@ int get_secret(
len = strlen(secbuf);
if (len > MAXSECRETLEN) {
ppp_trace(LOG_ERR, "Secret for %s on %s is too long\n", client, server);
AUTHDEBUG((LOG_ERR, "Secret for %s on %s is too long\n", client, server));
len = MAXSECRETLEN;
}
BCOPY(secbuf, secret, len);
@@ -753,7 +753,7 @@ static void check_idle(void *arg)
itime = LWIP_MIN(idle.xmit_idle, idle.recv_idle);
if (itime >= ppp_settings.idle_time_limit) {
/* link is idle: shut it down. */
ppp_trace(LOG_INFO, "Terminating connection due to lack of activity.\n");
AUTHDEBUG((LOG_INFO, "Terminating connection due to lack of activity.\n"));
lcp_close(0, "Link inactive");
} else {
TIMEOUT(check_idle, NULL, ppp_settings.idle_time_limit - itime);
@@ -767,7 +767,7 @@ static void connect_time_expired(void *arg)
{
(void)arg;
ppp_trace(LOG_INFO, "Connect time expired\n");
AUTHDEBUG((LOG_INFO, "Connect time expired\n"));
lcp_close(0, "Connect time expired"); /* Close connection */
}

68
src/netif/ppp/ppp.c
View File

@@ -307,7 +307,7 @@ void pppInit(void)
(*protp->init)(i);
}
#ifdef LINK_STATS
#if LINK_STATS
/* Clear the statistics. */
memset(&lwip_stats.link, 0, sizeof(lwip_stats.link));
#endif
@@ -326,6 +326,29 @@ void pppSetAuth(enum pppAuthType authType, const char *user, const char *passwd)
#endif
ppp_settings.refuse_chap = 1;
break;
case PPPAUTHTYPE_ANY:
/* Warning: Using PPPAUTHTYPE_ANY might have security consequences.
* RFC 1994 says:
*
* In practice, within or associated with each PPP server, there is a
* database which associates "user" names with authentication
* information ("secrets"). It is not anticipated that a particular
* named user would be authenticated by multiple methods. This would
* make the user vulnerable to attacks which negotiate the least secure
* method from among a set (such as PAP rather than CHAP). If the same
* secret was used, PAP would reveal the secret to be used later with
* CHAP.
*
* Instead, for each user name there should be an indication of exactly
* one method used to authenticate that user name. If a user needs to
* make use of different authentication methods under different
* circumstances, then distinct user names SHOULD be employed, each of
* which identifies exactly one authentication method.
*
*/
ppp_settings.refuse_pap = 0;
ppp_settings.refuse_chap = 0;
break;
case PPPAUTHTYPE_PAP:
ppp_settings.refuse_pap = 0;
ppp_settings.refuse_chap = 1;
@@ -459,7 +482,7 @@ static void nPut(PPPControl *pc, struct pbuf *nb)
if((c = sio_write(pc->fd, b->payload, b->len)) != b->len) {
PPPDEBUG((LOG_WARNING,
"PPP nPut: incomplete sio_write(%d,, %u) = %d\n", pc->fd, b->len, c));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.err++;
#endif /* LINK_STATS */
pc->lastXMit = 0; /* prepend PPP_FLAG to next packet */
@@ -468,7 +491,7 @@ static void nPut(PPPControl *pc, struct pbuf *nb)
}
pbuf_free(nb);
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.xmit++;
#endif /* LINK_STATS */
}
@@ -492,7 +515,7 @@ static struct pbuf *pppAppend(u_char c, struct pbuf *nb, ext_accm *outACCM)
if (tb) {
nb->next = tb;
}
#ifdef LINK_STATS
#if LINK_STATS
else {
lwip_stats.link.memerr++;
}
@@ -529,7 +552,7 @@ static err_t pppifOutput(struct netif *netif, struct pbuf *pb, struct ip_addr *i
if (pd < 0 || pd >= NUM_PPP || !pc->openFlag || !pb) {
PPPDEBUG((LOG_WARNING, "pppifOutput[%d]: bad parms prot=%d pb=%p\n",
pd, protocol, pb));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.opterr++;
lwip_stats.link.drop++;
#endif
@@ -539,7 +562,7 @@ static err_t pppifOutput(struct netif *netif, struct pbuf *pb, struct ip_addr *i
/* Check that the link is up. */
if (lcp_phase[pd] == PHASE_DEAD) {
PPPDEBUG((LOG_ERR, "pppifOutput[%d]: link not up\n", pd));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.rterr++;
lwip_stats.link.drop++;
#endif
@@ -550,7 +573,7 @@ static err_t pppifOutput(struct netif *netif, struct pbuf *pb, struct ip_addr *i
headMB = pbuf_alloc(PBUF_RAW, 0, PBUF_POOL);
if (headMB == NULL) {
PPPDEBUG((LOG_WARNING, "pppifOutput[%d]: first alloc fail\n", pd));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.memerr++;
lwip_stats.link.drop++;
#endif /* LINK_STATS */
@@ -577,7 +600,7 @@ static err_t pppifOutput(struct netif *netif, struct pbuf *pb, struct ip_addr *i
break;
default:
PPPDEBUG((LOG_WARNING, "pppifOutput[%d]: bad IP packet\n", pd));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.proterr++;
lwip_stats.link.drop++;
#endif
@@ -639,7 +662,7 @@ static err_t pppifOutput(struct netif *netif, struct pbuf *pb, struct ip_addr *i
"pppifOutput[%d]: Alloc err - dropping proto=%d\n",
pd, protocol));
pbuf_free(headMB);
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.memerr++;
lwip_stats.link.drop++;
#endif
@@ -728,7 +751,7 @@ int pppWrite(int pd, const u_char *s, int n)
struct pbuf *headMB = NULL, *tailMB;
headMB = pbuf_alloc(PBUF_RAW, 0, PBUF_POOL);
if (headMB == NULL) {
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.memerr++;
lwip_stats.link.proterr++;
#endif /* LINK_STATS */
@@ -768,7 +791,7 @@ int pppWrite(int pd, const u_char *s, int n)
"pppWrite[%d]: Alloc err - dropping pbuf len=%d\n", pd, headMB->len));
/* "pppWrite[%d]: Alloc err - dropping %d:%.*H", pd, headMB->len, LWIP_MIN(headMB->len * 2, 40), headMB->payload)); */
pbuf_free(headMB);
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.memerr++;
lwip_stats.link.proterr++;
#endif /* LINK_STATS */
@@ -1275,7 +1298,7 @@ static void pppInput(void *arg)
pbuf_header(nb, -(int)sizeof(struct pppInputHeader));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.recv++;
#endif /* LINK_STATS */
@@ -1365,7 +1388,7 @@ static void pppInput(void *arg)
}
drop:
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.drop++;
#endif
@@ -1395,7 +1418,7 @@ static void pppDrop(PPPControl *pc)
vj_uncompress_err(&pc->vjComp);
#endif
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.drop++;
#endif /* LINK_STATS */
}
@@ -1433,7 +1456,7 @@ static void pppInProc(int pd, u_char *s, int l)
PPPDEBUG((LOG_WARNING,
"pppInProc[%d]: Dropping incomplete packet %d\n",
pd, pc->inState));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.lenerr++;
#endif
pppDrop(pc);
@@ -1443,7 +1466,7 @@ static void pppInProc(int pd, u_char *s, int l)
PPPDEBUG((LOG_INFO,
"pppInProc[%d]: Dropping bad fcs 0x%04X proto=0x%04X\n",
pd, pc->inFCS, pc->inProtocol));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.chkerr++;
#endif
pppDrop(pc);
@@ -1457,14 +1480,12 @@ static void pppInProc(int pd, u_char *s, int l)
pc->inTail->tot_len = pc->inTail->len;
if (pc->inTail != pc->inHead) {
pbuf_chain(pc->inHead, pc->inTail);
pbuf_free(pc->inTail);
pbuf_cat(pc->inHead, pc->inTail);
}
} else {
pc->inTail->tot_len = pc->inTail->len;
if (pc->inTail != pc->inHead) {
pbuf_chain(pc->inHead, pc->inTail);
pbuf_free(pc->inTail);
pbuf_cat(pc->inHead, pc->inTail);
}
pbuf_realloc(pc->inHead, pc->inHead->tot_len - 2);
@@ -1475,7 +1496,7 @@ static void pppInProc(int pd, u_char *s, int l)
PPPDEBUG((LOG_ERR,
"pppInProc[%d]: tcpip_callback() failed, dropping packet\n", pd));
pbuf_free(pc->inHead);
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.drop++;
#endif
}
@@ -1560,8 +1581,7 @@ static void pppInProc(int pd, u_char *s, int l)
if(pc->inTail) {
pc->inTail->tot_len = pc->inTail->len;
if (pc->inTail != pc->inHead) {
pbuf_chain(pc->inHead, pc->inTail);
pbuf_free(pc->inTail);
pbuf_cat(pc->inHead, pc->inTail);
}
}
/* If we haven't started a packet, we need a packet header. */
@@ -1571,7 +1591,7 @@ static void pppInProc(int pd, u_char *s, int l)
* higher layers deal with it. Continue processing
* the received pbuf chain in case a new packet starts. */
PPPDEBUG((LOG_ERR, "pppInProc[%d]: NO FREE MBUFS!\n", pd));
#ifdef LINK_STATS
#if LINK_STATS
lwip_stats.link.memerr++;
#endif /* LINK_STATS */
pppDrop(pc);

25
src/netif/ppp/ppp.h
View File

@@ -208,8 +208,11 @@ enum NPmode {
#define BCMP(s0, s1, l) memcmp((u_char *)(s0), (u_char *)(s1), (l))
#define BCOPY(s, d, l) memcpy((d), (s), (l))
#define BZERO(s, n) memset(s, 0, n)
#if PPP_DEBUG
#define PRINTMSG(m, l) { m[l] = '\0'; ppp_trace(LOG_INFO, "Remote message: %s\n", m); }
#else
#define PRINTMSG(m, l)
#endif
/*
* MAKEHEADER - Add PPP Header fields to a packet.
@@ -340,8 +343,28 @@ extern struct protent *ppp_protocols[];/* Table of pointers to supported protoco
/* Initialize the PPP subsystem. */
void pppInit(void);
/* Warning: Using PPPAUTHTYPE_ANY might have security consequences.
* RFC 1994 says:
*
* In practice, within or associated with each PPP server, there is a
* database which associates "user" names with authentication
* information ("secrets"). It is not anticipated that a particular
* named user would be authenticated by multiple methods. This would
* make the user vulnerable to attacks which negotiate the least secure
* method from among a set (such as PAP rather than CHAP). If the same
* secret was used, PAP would reveal the secret to be used later with
* CHAP.
*
* Instead, for each user name there should be an indication of exactly
* one method used to authenticate that user name. If a user needs to
* make use of different authentication methods under different
* circumstances, then distinct user names SHOULD be employed, each of
* which identifies exactly one authentication method.
*
*/
enum pppAuthType {
PPPAUTHTYPE_NONE,
PPPAUTHTYPE_ANY,
PPPAUTHTYPE_PAP,
PPPAUTHTYPE_CHAP
};