Home | History | Annotate | Download | only in pppd
      1 /*
      2  * eap.c - Extensible Authentication Protocol for PPP (RFC 2284)
      3  *
      4  * Copyright (c) 2001 by Sun Microsystems, Inc.
      5  * All rights reserved.
      6  *
      7  * Non-exclusive rights to redistribute, modify, translate, and use
      8  * this software in source and binary forms, in whole or in part, is
      9  * hereby granted, provided that the above copyright notice is
     10  * duplicated in any source form, and that neither the name of the
     11  * copyright holder nor the author is used to endorse or promote
     12  * products derived from this software.
     13  *
     14  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
     15  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
     16  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
     17  *
     18  * Original version by James Carlson
     19  *
     20  * This implementation of EAP supports MD5-Challenge and SRP-SHA1
     21  * authentication styles.  Note that support of MD5-Challenge is a
     22  * requirement of RFC 2284, and that it's essentially just a
     23  * reimplementation of regular RFC 1994 CHAP using EAP messages.
     24  *
     25  * As an authenticator ("server"), there are multiple phases for each
     26  * style.  In the first phase of each style, the unauthenticated peer
     27  * name is queried using the EAP Identity request type.  If the
     28  * "remotename" option is used, then this phase is skipped, because
     29  * the peer's name is presumed to be known.
     30  *
     31  * For MD5-Challenge, there are two phases, and the second phase
     32  * consists of sending the challenge itself and handling the
     33  * associated response.
     34  *
     35  * For SRP-SHA1, there are four phases.  The second sends 's', 'N',
     36  * and 'g'.  The reply contains 'A'.  The third sends 'B', and the
     37  * reply contains 'M1'.  The forth sends the 'M2' value.
     38  *
     39  * As an authenticatee ("client"), there's just a single phase --
     40  * responding to the queries generated by the peer.  EAP is an
     41  * authenticator-driven protocol.
     42  *
     43  * Based on draft-ietf-pppext-eap-srp-03.txt.
     44  */
     45 
     46 #define RCSID	"$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $"
     47 
     48 /*
     49  * TODO:
     50  */
     51 
     52 #include <stdio.h>
     53 #include <stdlib.h>
     54 #include <string.h>
     55 #include <unistd.h>
     56 #include <pwd.h>
     57 #include <sys/types.h>
     58 #include <sys/stat.h>
     59 #include <fcntl.h>
     60 #include <assert.h>
     61 #include <errno.h>
     62 
     63 #include "pppd.h"
     64 #include "pathnames.h"
     65 #include "md5.h"
     66 #include "eap.h"
     67 
     68 #ifdef USE_SRP
     69 #include <t_pwd.h>
     70 #include <t_server.h>
     71 #include <t_client.h>
     72 #include "pppcrypt.h"
     73 #endif /* USE_SRP */
     74 
     75 #ifndef SHA_DIGESTSIZE
     76 #define	SHA_DIGESTSIZE 20
     77 #endif
     78 
     79 static const char rcsid[] = RCSID;
     80 
     81 eap_state eap_states[NUM_PPP];		/* EAP state; one for each unit */
     82 #ifdef USE_SRP
     83 static char *pn_secret = NULL;		/* Pseudonym generating secret */
     84 #endif
     85 
     86 /*
     87  * Command-line options.
     88  */
     89 static option_t eap_option_list[] = {
     90     { "eap-restart", o_int, &eap_states[0].es_server.ea_timeout,
     91       "Set retransmit timeout for EAP Requests (server)" },
     92     { "eap-max-sreq", o_int, &eap_states[0].es_server.ea_maxrequests,
     93       "Set max number of EAP Requests sent (server)" },
     94     { "eap-timeout", o_int, &eap_states[0].es_client.ea_timeout,
     95       "Set time limit for peer EAP authentication" },
     96     { "eap-max-rreq", o_int, &eap_states[0].es_client.ea_maxrequests,
     97       "Set max number of EAP Requests allows (client)" },
     98     { "eap-interval", o_int, &eap_states[0].es_rechallenge,
     99       "Set interval for EAP rechallenge" },
    100 #ifdef USE_SRP
    101     { "srp-interval", o_int, &eap_states[0].es_lwrechallenge,
    102       "Set interval for SRP lightweight rechallenge" },
    103     { "srp-pn-secret", o_string, &pn_secret,
    104       "Long term pseudonym generation secret" },
    105     { "srp-use-pseudonym", o_bool, &eap_states[0].es_usepseudo,
    106       "Use pseudonym if offered one by server", 1 },
    107 #endif
    108     { NULL }
    109 };
    110 
    111 /*
    112  * Protocol entry points.
    113  */
    114 static void eap_init __P((int unit));
    115 static void eap_input __P((int unit, u_char *inp, int inlen));
    116 static void eap_protrej __P((int unit));
    117 static void eap_lowerup __P((int unit));
    118 static void eap_lowerdown __P((int unit));
    119 static int  eap_printpkt __P((u_char *inp, int inlen,
    120     void (*)(void *arg, char *fmt, ...), void *arg));
    121 
    122 struct protent eap_protent = {
    123 	PPP_EAP,		/* protocol number */
    124 	eap_init,		/* initialization procedure */
    125 	eap_input,		/* process a received packet */
    126 	eap_protrej,		/* process a received protocol-reject */
    127 	eap_lowerup,		/* lower layer has gone up */
    128 	eap_lowerdown,		/* lower layer has gone down */
    129 	NULL,			/* open the protocol */
    130 	NULL,			/* close the protocol */
    131 	eap_printpkt,		/* print a packet in readable form */
    132 	NULL,			/* process a received data packet */
    133 	1,			/* protocol enabled */
    134 	"EAP",			/* text name of protocol */
    135 	NULL,			/* text name of corresponding data protocol */
    136 	eap_option_list,	/* list of command-line options */
    137 	NULL,			/* check requested options; assign defaults */
    138 	NULL,			/* configure interface for demand-dial */
    139 	NULL			/* say whether to bring up link for this pkt */
    140 };
    141 
    142 /*
    143  * A well-known 2048 bit modulus.
    144  */
    145 static const u_char wkmodulus[] = {
    146 	0xAC, 0x6B, 0xDB, 0x41, 0x32, 0x4A, 0x9A, 0x9B,
    147 	0xF1, 0x66, 0xDE, 0x5E, 0x13, 0x89, 0x58, 0x2F,
    148 	0xAF, 0x72, 0xB6, 0x65, 0x19, 0x87, 0xEE, 0x07,
    149 	0xFC, 0x31, 0x92, 0x94, 0x3D, 0xB5, 0x60, 0x50,
    150 	0xA3, 0x73, 0x29, 0xCB, 0xB4, 0xA0, 0x99, 0xED,
    151 	0x81, 0x93, 0xE0, 0x75, 0x77, 0x67, 0xA1, 0x3D,
    152 	0xD5, 0x23, 0x12, 0xAB, 0x4B, 0x03, 0x31, 0x0D,
    153 	0xCD, 0x7F, 0x48, 0xA9, 0xDA, 0x04, 0xFD, 0x50,
    154 	0xE8, 0x08, 0x39, 0x69, 0xED, 0xB7, 0x67, 0xB0,
    155 	0xCF, 0x60, 0x95, 0x17, 0x9A, 0x16, 0x3A, 0xB3,
    156 	0x66, 0x1A, 0x05, 0xFB, 0xD5, 0xFA, 0xAA, 0xE8,
    157 	0x29, 0x18, 0xA9, 0x96, 0x2F, 0x0B, 0x93, 0xB8,
    158 	0x55, 0xF9, 0x79, 0x93, 0xEC, 0x97, 0x5E, 0xEA,
    159 	0xA8, 0x0D, 0x74, 0x0A, 0xDB, 0xF4, 0xFF, 0x74,
    160 	0x73, 0x59, 0xD0, 0x41, 0xD5, 0xC3, 0x3E, 0xA7,
    161 	0x1D, 0x28, 0x1E, 0x44, 0x6B, 0x14, 0x77, 0x3B,
    162 	0xCA, 0x97, 0xB4, 0x3A, 0x23, 0xFB, 0x80, 0x16,
    163 	0x76, 0xBD, 0x20, 0x7A, 0x43, 0x6C, 0x64, 0x81,
    164 	0xF1, 0xD2, 0xB9, 0x07, 0x87, 0x17, 0x46, 0x1A,
    165 	0x5B, 0x9D, 0x32, 0xE6, 0x88, 0xF8, 0x77, 0x48,
    166 	0x54, 0x45, 0x23, 0xB5, 0x24, 0xB0, 0xD5, 0x7D,
    167 	0x5E, 0xA7, 0x7A, 0x27, 0x75, 0xD2, 0xEC, 0xFA,
    168 	0x03, 0x2C, 0xFB, 0xDB, 0xF5, 0x2F, 0xB3, 0x78,
    169 	0x61, 0x60, 0x27, 0x90, 0x04, 0xE5, 0x7A, 0xE6,
    170 	0xAF, 0x87, 0x4E, 0x73, 0x03, 0xCE, 0x53, 0x29,
    171 	0x9C, 0xCC, 0x04, 0x1C, 0x7B, 0xC3, 0x08, 0xD8,
    172 	0x2A, 0x56, 0x98, 0xF3, 0xA8, 0xD0, 0xC3, 0x82,
    173 	0x71, 0xAE, 0x35, 0xF8, 0xE9, 0xDB, 0xFB, 0xB6,
    174 	0x94, 0xB5, 0xC8, 0x03, 0xD8, 0x9F, 0x7A, 0xE4,
    175 	0x35, 0xDE, 0x23, 0x6D, 0x52, 0x5F, 0x54, 0x75,
    176 	0x9B, 0x65, 0xE3, 0x72, 0xFC, 0xD6, 0x8E, 0xF2,
    177 	0x0F, 0xA7, 0x11, 0x1F, 0x9E, 0x4A, 0xFF, 0x73
    178 };
    179 
    180 /* Local forward declarations. */
    181 static void eap_server_timeout __P((void *arg));
    182 
    183 /*
    184  * Convert EAP state code to printable string for debug.
    185  */
    186 static const char *
    187 eap_state_name(esc)
    188 enum eap_state_code esc;
    189 {
    190 	static const char *state_names[] = { EAP_STATES };
    191 
    192 	return (state_names[(int)esc]);
    193 }
    194 
    195 /*
    196  * eap_init - Initialize state for an EAP user.  This is currently
    197  * called once by main() during start-up.
    198  */
    199 static void
    200 eap_init(unit)
    201 int unit;
    202 {
    203 	eap_state *esp = &eap_states[unit];
    204 
    205 	BZERO(esp, sizeof (*esp));
    206 	esp->es_unit = unit;
    207 	esp->es_server.ea_timeout = EAP_DEFTIMEOUT;
    208 	esp->es_server.ea_maxrequests = EAP_DEFTRANSMITS;
    209 	esp->es_server.ea_id = (u_char)(drand48() * 0x100);
    210 	esp->es_client.ea_timeout = EAP_DEFREQTIME;
    211 	esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ;
    212 }
    213 
    214 /*
    215  * eap_client_timeout - Give up waiting for the peer to send any
    216  * Request messages.
    217  */
    218 static void
    219 eap_client_timeout(arg)
    220 void *arg;
    221 {
    222 	eap_state *esp = (eap_state *) arg;
    223 
    224 	if (!eap_client_active(esp))
    225 		return;
    226 
    227 	error("EAP: timeout waiting for Request from peer");
    228 	auth_withpeer_fail(esp->es_unit, PPP_EAP);
    229 	esp->es_client.ea_state = eapBadAuth;
    230 }
    231 
    232 /*
    233  * eap_authwithpeer - Authenticate to our peer (behave as client).
    234  *
    235  * Start client state and wait for requests.  This is called only
    236  * after eap_lowerup.
    237  */
    238 void
    239 eap_authwithpeer(unit, localname)
    240 int unit;
    241 char *localname;
    242 {
    243 	eap_state *esp = &eap_states[unit];
    244 
    245 	/* Save the peer name we're given */
    246 	esp->es_client.ea_name = localname;
    247 	esp->es_client.ea_namelen = strlen(localname);
    248 
    249 	esp->es_client.ea_state = eapListen;
    250 
    251 	/*
    252 	 * Start a timer so that if the other end just goes
    253 	 * silent, we don't sit here waiting forever.
    254 	 */
    255 	if (esp->es_client.ea_timeout > 0)
    256 		TIMEOUT(eap_client_timeout, (void *)esp,
    257 		    esp->es_client.ea_timeout);
    258 }
    259 
    260 /*
    261  * Format a standard EAP Failure message and send it to the peer.
    262  * (Server operation)
    263  */
    264 static void
    265 eap_send_failure(esp)
    266 eap_state *esp;
    267 {
    268 	u_char *outp;
    269 
    270 	outp = outpacket_buf;
    271 
    272 	MAKEHEADER(outp, PPP_EAP);
    273 
    274 	PUTCHAR(EAP_FAILURE, outp);
    275 	esp->es_server.ea_id++;
    276 	PUTCHAR(esp->es_server.ea_id, outp);
    277 	PUTSHORT(EAP_HEADERLEN, outp);
    278 
    279 	output(esp->es_unit, outpacket_buf, EAP_HEADERLEN + PPP_HDRLEN);
    280 
    281 	esp->es_server.ea_state = eapBadAuth;
    282 	auth_peer_fail(esp->es_unit, PPP_EAP);
    283 }
    284 
    285 /*
    286  * Format a standard EAP Success message and send it to the peer.
    287  * (Server operation)
    288  */
    289 static void
    290 eap_send_success(esp)
    291 eap_state *esp;
    292 {
    293 	u_char *outp;
    294 
    295 	outp = outpacket_buf;
    296 
    297 	MAKEHEADER(outp, PPP_EAP);
    298 
    299 	PUTCHAR(EAP_SUCCESS, outp);
    300 	esp->es_server.ea_id++;
    301 	PUTCHAR(esp->es_server.ea_id, outp);
    302 	PUTSHORT(EAP_HEADERLEN, outp);
    303 
    304 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + EAP_HEADERLEN);
    305 
    306 	auth_peer_success(esp->es_unit, PPP_EAP, 0,
    307 	    esp->es_server.ea_peer, esp->es_server.ea_peerlen);
    308 }
    309 
    310 #ifdef USE_SRP
    311 /*
    312  * Set DES key according to pseudonym-generating secret and current
    313  * date.
    314  */
    315 static bool
    316 pncrypt_setkey(int timeoffs)
    317 {
    318 	struct tm *tp;
    319 	char tbuf[9];
    320 	SHA1_CTX ctxt;
    321 	u_char dig[SHA_DIGESTSIZE];
    322 	time_t reftime;
    323 
    324 	if (pn_secret == NULL)
    325 		return (0);
    326 	reftime = time(NULL) + timeoffs;
    327 	tp = localtime(&reftime);
    328 	SHA1Init(&ctxt);
    329 	SHA1Update(&ctxt, pn_secret, strlen(pn_secret));
    330 	strftime(tbuf, sizeof (tbuf), "%Y%m%d", tp);
    331 	SHA1Update(&ctxt, tbuf, strlen(tbuf));
    332 	SHA1Final(dig, &ctxt);
    333 	return (DesSetkey(dig));
    334 }
    335 
    336 static char base64[] =
    337 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    338 
    339 struct b64state {
    340 	u_int32_t bs_bits;
    341 	int bs_offs;
    342 };
    343 
    344 static int
    345 b64enc(bs, inp, inlen, outp)
    346 struct b64state *bs;
    347 u_char *inp;
    348 int inlen;
    349 u_char *outp;
    350 {
    351 	int outlen = 0;
    352 
    353 	while (inlen > 0) {
    354 		bs->bs_bits = (bs->bs_bits << 8) | *inp++;
    355 		inlen--;
    356 		bs->bs_offs += 8;
    357 		if (bs->bs_offs >= 24) {
    358 			*outp++ = base64[(bs->bs_bits >> 18) & 0x3F];
    359 			*outp++ = base64[(bs->bs_bits >> 12) & 0x3F];
    360 			*outp++ = base64[(bs->bs_bits >> 6) & 0x3F];
    361 			*outp++ = base64[bs->bs_bits & 0x3F];
    362 			outlen += 4;
    363 			bs->bs_offs = 0;
    364 			bs->bs_bits = 0;
    365 		}
    366 	}
    367 	return (outlen);
    368 }
    369 
    370 static int
    371 b64flush(bs, outp)
    372 struct b64state *bs;
    373 u_char *outp;
    374 {
    375 	int outlen = 0;
    376 
    377 	if (bs->bs_offs == 8) {
    378 		*outp++ = base64[(bs->bs_bits >> 2) & 0x3F];
    379 		*outp++ = base64[(bs->bs_bits << 4) & 0x3F];
    380 		outlen = 2;
    381 	} else if (bs->bs_offs == 16) {
    382 		*outp++ = base64[(bs->bs_bits >> 10) & 0x3F];
    383 		*outp++ = base64[(bs->bs_bits >> 4) & 0x3F];
    384 		*outp++ = base64[(bs->bs_bits << 2) & 0x3F];
    385 		outlen = 3;
    386 	}
    387 	bs->bs_offs = 0;
    388 	bs->bs_bits = 0;
    389 	return (outlen);
    390 }
    391 
    392 static int
    393 b64dec(bs, inp, inlen, outp)
    394 struct b64state *bs;
    395 u_char *inp;
    396 int inlen;
    397 u_char *outp;
    398 {
    399 	int outlen = 0;
    400 	char *cp;
    401 
    402 	while (inlen > 0) {
    403 		if ((cp = strchr(base64, *inp++)) == NULL)
    404 			break;
    405 		bs->bs_bits = (bs->bs_bits << 6) | (cp - base64);
    406 		inlen--;
    407 		bs->bs_offs += 6;
    408 		if (bs->bs_offs >= 8) {
    409 			*outp++ = bs->bs_bits >> (bs->bs_offs - 8);
    410 			outlen++;
    411 			bs->bs_offs -= 8;
    412 		}
    413 	}
    414 	return (outlen);
    415 }
    416 #endif /* USE_SRP */
    417 
    418 /*
    419  * Assume that current waiting server state is complete and figure
    420  * next state to use based on available authentication data.  'status'
    421  * indicates if there was an error in handling the last query.  It is
    422  * 0 for success and non-zero for failure.
    423  */
    424 static void
    425 eap_figure_next_state(esp, status)
    426 eap_state *esp;
    427 int status;
    428 {
    429 #ifdef USE_SRP
    430 	unsigned char secbuf[MAXWORDLEN], clear[8], *sp, *dp;
    431 	struct t_pw tpw;
    432 	struct t_confent *tce, mytce;
    433 	char *cp, *cp2;
    434 	struct t_server *ts;
    435 	int id, i, plen, toffs;
    436 	u_char vals[2];
    437 	struct b64state bs;
    438 #endif /* USE_SRP */
    439 
    440 	esp->es_server.ea_timeout = esp->es_savedtime;
    441 	switch (esp->es_server.ea_state) {
    442 	case eapBadAuth:
    443 		return;
    444 
    445 	case eapIdentify:
    446 #ifdef USE_SRP
    447 		/* Discard any previous session. */
    448 		ts = (struct t_server *)esp->es_server.ea_session;
    449 		if (ts != NULL) {
    450 			t_serverclose(ts);
    451 			esp->es_server.ea_session = NULL;
    452 			esp->es_server.ea_skey = NULL;
    453 		}
    454 #endif /* USE_SRP */
    455 		if (status != 0) {
    456 			esp->es_server.ea_state = eapBadAuth;
    457 			break;
    458 		}
    459 #ifdef USE_SRP
    460 		/* If we've got a pseudonym, try to decode to real name. */
    461 		if (esp->es_server.ea_peerlen > SRP_PSEUDO_LEN &&
    462 		    strncmp(esp->es_server.ea_peer, SRP_PSEUDO_ID,
    463 			SRP_PSEUDO_LEN) == 0 &&
    464 		    (esp->es_server.ea_peerlen - SRP_PSEUDO_LEN) * 3 / 4 <
    465 		    sizeof (secbuf)) {
    466 			BZERO(&bs, sizeof (bs));
    467 			plen = b64dec(&bs,
    468 			    esp->es_server.ea_peer + SRP_PSEUDO_LEN,
    469 			    esp->es_server.ea_peerlen - SRP_PSEUDO_LEN,
    470 			    secbuf);
    471 			toffs = 0;
    472 			for (i = 0; i < 5; i++) {
    473 				pncrypt_setkey(toffs);
    474 				toffs -= 86400;
    475 				if (!DesDecrypt(secbuf, clear)) {
    476 					dbglog("no DES here; cannot decode "
    477 					    "pseudonym");
    478 					return;
    479 				}
    480 				id = *(unsigned char *)clear;
    481 				if (id + 1 <= plen && id + 9 > plen)
    482 					break;
    483 			}
    484 			if (plen % 8 == 0 && i < 5) {
    485 				/*
    486 				 * Note that this is always shorter than the
    487 				 * original stored string, so there's no need
    488 				 * to realloc.
    489 				 */
    490 				if ((i = plen = *(unsigned char *)clear) > 7)
    491 					i = 7;
    492 				esp->es_server.ea_peerlen = plen;
    493 				dp = (unsigned char *)esp->es_server.ea_peer;
    494 				BCOPY(clear + 1, dp, i);
    495 				plen -= i;
    496 				dp += i;
    497 				sp = secbuf + 8;
    498 				while (plen > 0) {
    499 					(void) DesDecrypt(sp, dp);
    500 					sp += 8;
    501 					dp += 8;
    502 					plen -= 8;
    503 				}
    504 				esp->es_server.ea_peer[
    505 					esp->es_server.ea_peerlen] = '\0';
    506 				dbglog("decoded pseudonym to \"%.*q\"",
    507 				    esp->es_server.ea_peerlen,
    508 				    esp->es_server.ea_peer);
    509 			} else {
    510 				dbglog("failed to decode real name");
    511 				/* Stay in eapIdentfy state; requery */
    512 				break;
    513 			}
    514 		}
    515 		/* Look up user in secrets database. */
    516 		if (get_srp_secret(esp->es_unit, esp->es_server.ea_peer,
    517 		    esp->es_server.ea_name, (char *)secbuf, 1) != 0) {
    518 			/* Set up default in case SRP entry is bad */
    519 			esp->es_server.ea_state = eapMD5Chall;
    520 			/* Get t_confent based on index in srp-secrets */
    521 			id = strtol((char *)secbuf, &cp, 10);
    522 			if (*cp++ != ':' || id < 0)
    523 				break;
    524 			if (id == 0) {
    525 				mytce.index = 0;
    526 				mytce.modulus.data = (u_char *)wkmodulus;
    527 				mytce.modulus.len = sizeof (wkmodulus);
    528 				mytce.generator.data = (u_char *)"\002";
    529 				mytce.generator.len = 1;
    530 				tce = &mytce;
    531 			} else if ((tce = gettcid(id)) != NULL) {
    532 				/*
    533 				 * Client will have to verify this modulus/
    534 				 * generator combination, and that will take
    535 				 * a while.  Lengthen the timeout here.
    536 				 */
    537 				if (esp->es_server.ea_timeout > 0 &&
    538 				    esp->es_server.ea_timeout < 30)
    539 					esp->es_server.ea_timeout = 30;
    540 			} else {
    541 				break;
    542 			}
    543 			if ((cp2 = strchr(cp, ':')) == NULL)
    544 				break;
    545 			*cp2++ = '\0';
    546 			tpw.pebuf.name = esp->es_server.ea_peer;
    547 			tpw.pebuf.password.len = t_fromb64((char *)tpw.pwbuf,
    548 			    cp);
    549 			tpw.pebuf.password.data = tpw.pwbuf;
    550 			tpw.pebuf.salt.len = t_fromb64((char *)tpw.saltbuf,
    551 			    cp2);
    552 			tpw.pebuf.salt.data = tpw.saltbuf;
    553 			if ((ts = t_serveropenraw(&tpw.pebuf, tce)) == NULL)
    554 				break;
    555 			esp->es_server.ea_session = (void *)ts;
    556 			esp->es_server.ea_state = eapSRP1;
    557 			vals[0] = esp->es_server.ea_id + 1;
    558 			vals[1] = EAPT_SRP;
    559 			t_serveraddexdata(ts, vals, 2);
    560 			/* Generate B; must call before t_servergetkey() */
    561 			t_servergenexp(ts);
    562 			break;
    563 		}
    564 #endif /* USE_SRP */
    565 		esp->es_server.ea_state = eapMD5Chall;
    566 		break;
    567 
    568 	case eapSRP1:
    569 #ifdef USE_SRP
    570 		ts = (struct t_server *)esp->es_server.ea_session;
    571 		if (ts != NULL && status != 0) {
    572 			t_serverclose(ts);
    573 			esp->es_server.ea_session = NULL;
    574 			esp->es_server.ea_skey = NULL;
    575 		}
    576 #endif /* USE_SRP */
    577 		if (status == 1) {
    578 			esp->es_server.ea_state = eapMD5Chall;
    579 		} else if (status != 0 || esp->es_server.ea_session == NULL) {
    580 			esp->es_server.ea_state = eapBadAuth;
    581 		} else {
    582 			esp->es_server.ea_state = eapSRP2;
    583 		}
    584 		break;
    585 
    586 	case eapSRP2:
    587 #ifdef USE_SRP
    588 		ts = (struct t_server *)esp->es_server.ea_session;
    589 		if (ts != NULL && status != 0) {
    590 			t_serverclose(ts);
    591 			esp->es_server.ea_session = NULL;
    592 			esp->es_server.ea_skey = NULL;
    593 		}
    594 #endif /* USE_SRP */
    595 		if (status != 0 || esp->es_server.ea_session == NULL) {
    596 			esp->es_server.ea_state = eapBadAuth;
    597 		} else {
    598 			esp->es_server.ea_state = eapSRP3;
    599 		}
    600 		break;
    601 
    602 	case eapSRP3:
    603 	case eapSRP4:
    604 #ifdef USE_SRP
    605 		ts = (struct t_server *)esp->es_server.ea_session;
    606 		if (ts != NULL && status != 0) {
    607 			t_serverclose(ts);
    608 			esp->es_server.ea_session = NULL;
    609 			esp->es_server.ea_skey = NULL;
    610 		}
    611 #endif /* USE_SRP */
    612 		if (status != 0 || esp->es_server.ea_session == NULL) {
    613 			esp->es_server.ea_state = eapBadAuth;
    614 		} else {
    615 			esp->es_server.ea_state = eapOpen;
    616 		}
    617 		break;
    618 
    619 	case eapMD5Chall:
    620 		if (status != 0) {
    621 			esp->es_server.ea_state = eapBadAuth;
    622 		} else {
    623 			esp->es_server.ea_state = eapOpen;
    624 		}
    625 		break;
    626 
    627 	default:
    628 		esp->es_server.ea_state = eapBadAuth;
    629 		break;
    630 	}
    631 	if (esp->es_server.ea_state == eapBadAuth)
    632 		eap_send_failure(esp);
    633 }
    634 
    635 /*
    636  * Format an EAP Request message and send it to the peer.  Message
    637  * type depends on current state.  (Server operation)
    638  */
    639 static void
    640 eap_send_request(esp)
    641 eap_state *esp;
    642 {
    643 	u_char *outp;
    644 	u_char *lenloc;
    645 	u_char *ptr;
    646 	int outlen;
    647 	int challen;
    648 	char *str;
    649 #ifdef USE_SRP
    650 	struct t_server *ts;
    651 	u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp;
    652 	int i, j;
    653 	struct b64state b64;
    654 	SHA1_CTX ctxt;
    655 #endif /* USE_SRP */
    656 
    657 	/* Handle both initial auth and restart */
    658 	if (esp->es_server.ea_state < eapIdentify &&
    659 	    esp->es_server.ea_state != eapInitial) {
    660 		esp->es_server.ea_state = eapIdentify;
    661 		if (explicit_remote) {
    662 			/*
    663 			 * If we already know the peer's
    664 			 * unauthenticated name, then there's no
    665 			 * reason to ask.  Go to next state instead.
    666 			 */
    667 			esp->es_server.ea_peer = remote_name;
    668 			esp->es_server.ea_peerlen = strlen(remote_name);
    669 			eap_figure_next_state(esp, 0);
    670 		}
    671 	}
    672 
    673 	if (esp->es_server.ea_maxrequests > 0 &&
    674 	    esp->es_server.ea_requests >= esp->es_server.ea_maxrequests) {
    675 		if (esp->es_server.ea_responses > 0)
    676 			error("EAP: too many Requests sent");
    677 		else
    678 			error("EAP: no response to Requests");
    679 		eap_send_failure(esp);
    680 		return;
    681 	}
    682 
    683 	outp = outpacket_buf;
    684 
    685 	MAKEHEADER(outp, PPP_EAP);
    686 
    687 	PUTCHAR(EAP_REQUEST, outp);
    688 	PUTCHAR(esp->es_server.ea_id, outp);
    689 	lenloc = outp;
    690 	INCPTR(2, outp);
    691 
    692 	switch (esp->es_server.ea_state) {
    693 	case eapIdentify:
    694 		PUTCHAR(EAPT_IDENTITY, outp);
    695 		str = "Name";
    696 		challen = strlen(str);
    697 		BCOPY(str, outp, challen);
    698 		INCPTR(challen, outp);
    699 		break;
    700 
    701 	case eapMD5Chall:
    702 		PUTCHAR(EAPT_MD5CHAP, outp);
    703 		/*
    704 		 * pick a random challenge length between
    705 		 * MIN_CHALLENGE_LENGTH and MAX_CHALLENGE_LENGTH
    706 		 */
    707 		challen = (drand48() *
    708 		    (MAX_CHALLENGE_LENGTH - MIN_CHALLENGE_LENGTH)) +
    709 			    MIN_CHALLENGE_LENGTH;
    710 		PUTCHAR(challen, outp);
    711 		esp->es_challen = challen;
    712 		ptr = esp->es_challenge;
    713 		while (--challen >= 0)
    714 			*ptr++ = (u_char) (drand48() * 0x100);
    715 		BCOPY(esp->es_challenge, outp, esp->es_challen);
    716 		INCPTR(esp->es_challen, outp);
    717 		BCOPY(esp->es_server.ea_name, outp, esp->es_server.ea_namelen);
    718 		INCPTR(esp->es_server.ea_namelen, outp);
    719 		break;
    720 
    721 #ifdef USE_SRP
    722 	case eapSRP1:
    723 		PUTCHAR(EAPT_SRP, outp);
    724 		PUTCHAR(EAPSRP_CHALLENGE, outp);
    725 
    726 		PUTCHAR(esp->es_server.ea_namelen, outp);
    727 		BCOPY(esp->es_server.ea_name, outp, esp->es_server.ea_namelen);
    728 		INCPTR(esp->es_server.ea_namelen, outp);
    729 
    730 		ts = (struct t_server *)esp->es_server.ea_session;
    731 		assert(ts != NULL);
    732 		PUTCHAR(ts->s.len, outp);
    733 		BCOPY(ts->s.data, outp, ts->s.len);
    734 		INCPTR(ts->s.len, outp);
    735 
    736 		if (ts->g.len == 1 && ts->g.data[0] == 2) {
    737 			PUTCHAR(0, outp);
    738 		} else {
    739 			PUTCHAR(ts->g.len, outp);
    740 			BCOPY(ts->g.data, outp, ts->g.len);
    741 			INCPTR(ts->g.len, outp);
    742 		}
    743 
    744 		if (ts->n.len != sizeof (wkmodulus) ||
    745 		    BCMP(ts->n.data, wkmodulus, sizeof (wkmodulus)) != 0) {
    746 			BCOPY(ts->n.data, outp, ts->n.len);
    747 			INCPTR(ts->n.len, outp);
    748 		}
    749 		break;
    750 
    751 	case eapSRP2:
    752 		PUTCHAR(EAPT_SRP, outp);
    753 		PUTCHAR(EAPSRP_SKEY, outp);
    754 
    755 		ts = (struct t_server *)esp->es_server.ea_session;
    756 		assert(ts != NULL);
    757 		BCOPY(ts->B.data, outp, ts->B.len);
    758 		INCPTR(ts->B.len, outp);
    759 		break;
    760 
    761 	case eapSRP3:
    762 		PUTCHAR(EAPT_SRP, outp);
    763 		PUTCHAR(EAPSRP_SVALIDATOR, outp);
    764 		PUTLONG(SRPVAL_EBIT, outp);
    765 		ts = (struct t_server *)esp->es_server.ea_session;
    766 		assert(ts != NULL);
    767 		BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE);
    768 		INCPTR(SHA_DIGESTSIZE, outp);
    769 
    770 		if (pncrypt_setkey(0)) {
    771 			/* Generate pseudonym */
    772 			optr = outp;
    773 			cp = (unsigned char *)esp->es_server.ea_peer;
    774 			if ((j = i = esp->es_server.ea_peerlen) > 7)
    775 				j = 7;
    776 			clear[0] = i;
    777 			BCOPY(cp, clear + 1, j);
    778 			i -= j;
    779 			cp += j;
    780 			if (!DesEncrypt(clear, cipher)) {
    781 				dbglog("no DES here; not generating pseudonym");
    782 				break;
    783 			}
    784 			BZERO(&b64, sizeof (b64));
    785 			outp++;		/* space for pseudonym length */
    786 			outp += b64enc(&b64, cipher, 8, outp);
    787 			while (i >= 8) {
    788 				(void) DesEncrypt(cp, cipher);
    789 				outp += b64enc(&b64, cipher, 8, outp);
    790 				cp += 8;
    791 				i -= 8;
    792 			}
    793 			if (i > 0) {
    794 				BCOPY(cp, clear, i);
    795 				cp += i;
    796 				while (i < 8) {
    797 					*cp++ = drand48() * 0x100;
    798 					i++;
    799 				}
    800 				(void) DesEncrypt(clear, cipher);
    801 				outp += b64enc(&b64, cipher, 8, outp);
    802 			}
    803 			outp += b64flush(&b64, outp);
    804 
    805 			/* Set length and pad out to next 20 octet boundary */
    806 			i = outp - optr - 1;
    807 			*optr = i;
    808 			i %= SHA_DIGESTSIZE;
    809 			if (i != 0) {
    810 				while (i < SHA_DIGESTSIZE) {
    811 					*outp++ = drand48() * 0x100;
    812 					i++;
    813 				}
    814 			}
    815 
    816 			/* Obscure the pseudonym with SHA1 hash */
    817 			SHA1Init(&ctxt);
    818 			SHA1Update(&ctxt, &esp->es_server.ea_id, 1);
    819 			SHA1Update(&ctxt, esp->es_server.ea_skey,
    820 			    SESSION_KEY_LEN);
    821 			SHA1Update(&ctxt, esp->es_server.ea_peer,
    822 			    esp->es_server.ea_peerlen);
    823 			while (optr < outp) {
    824 				SHA1Final(dig, &ctxt);
    825 				cp = dig;
    826 				while (cp < dig + SHA_DIGESTSIZE)
    827 					*optr++ ^= *cp++;
    828 				SHA1Init(&ctxt);
    829 				SHA1Update(&ctxt, &esp->es_server.ea_id, 1);
    830 				SHA1Update(&ctxt, esp->es_server.ea_skey,
    831 				    SESSION_KEY_LEN);
    832 				SHA1Update(&ctxt, optr - SHA_DIGESTSIZE,
    833 				    SHA_DIGESTSIZE);
    834 			}
    835 		}
    836 		break;
    837 
    838 	case eapSRP4:
    839 		PUTCHAR(EAPT_SRP, outp);
    840 		PUTCHAR(EAPSRP_LWRECHALLENGE, outp);
    841 		challen = MIN_CHALLENGE_LENGTH +
    842 		    ((MAX_CHALLENGE_LENGTH - MIN_CHALLENGE_LENGTH) * drand48());
    843 		esp->es_challen = challen;
    844 		ptr = esp->es_challenge;
    845 		while (--challen >= 0)
    846 			*ptr++ = drand48() * 0x100;
    847 		BCOPY(esp->es_challenge, outp, esp->es_challen);
    848 		INCPTR(esp->es_challen, outp);
    849 		break;
    850 #endif /* USE_SRP */
    851 
    852 	default:
    853 		return;
    854 	}
    855 
    856 	outlen = (outp - outpacket_buf) - PPP_HDRLEN;
    857 	PUTSHORT(outlen, lenloc);
    858 
    859 	output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN);
    860 
    861 	esp->es_server.ea_requests++;
    862 
    863 	if (esp->es_server.ea_timeout > 0)
    864 		TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout);
    865 }
    866 
    867 /*
    868  * eap_authpeer - Authenticate our peer (behave as server).
    869  *
    870  * Start server state and send first request.  This is called only
    871  * after eap_lowerup.
    872  */
    873 void
    874 eap_authpeer(unit, localname)
    875 int unit;
    876 char *localname;
    877 {
    878 	eap_state *esp = &eap_states[unit];
    879 
    880 	/* Save the name we're given. */
    881 	esp->es_server.ea_name = localname;
    882 	esp->es_server.ea_namelen = strlen(localname);
    883 
    884 	esp->es_savedtime = esp->es_server.ea_timeout;
    885 
    886 	/* Lower layer up yet? */
    887 	if (esp->es_server.ea_state == eapInitial ||
    888 	    esp->es_server.ea_state == eapPending) {
    889 		esp->es_server.ea_state = eapPending;
    890 		return;
    891 	}
    892 
    893 	esp->es_server.ea_state = eapPending;
    894 
    895 	/* ID number not updated here intentionally; hashed into M1 */
    896 	eap_send_request(esp);
    897 }
    898 
    899 /*
    900  * eap_server_timeout - Retransmission timer for sending Requests
    901  * expired.
    902  */
    903 static void
    904 eap_server_timeout(arg)
    905 void *arg;
    906 {
    907 	eap_state *esp = (eap_state *) arg;
    908 
    909 	if (!eap_server_active(esp))
    910 		return;
    911 
    912 	/* EAP ID number must not change on timeout. */
    913 	eap_send_request(esp);
    914 }
    915 
    916 /*
    917  * When it's time to send rechallenge the peer, this timeout is
    918  * called.  Once the rechallenge is successful, the response handler
    919  * will restart the timer.  If it fails, then the link is dropped.
    920  */
    921 static void
    922 eap_rechallenge(arg)
    923 void *arg;
    924 {
    925 	eap_state *esp = (eap_state *)arg;
    926 
    927 	if (esp->es_server.ea_state != eapOpen &&
    928 	    esp->es_server.ea_state != eapSRP4)
    929 		return;
    930 
    931 	esp->es_server.ea_requests = 0;
    932 	esp->es_server.ea_state = eapIdentify;
    933 	eap_figure_next_state(esp, 0);
    934 	esp->es_server.ea_id++;
    935 	eap_send_request(esp);
    936 }
    937 
    938 static void
    939 srp_lwrechallenge(arg)
    940 void *arg;
    941 {
    942 	eap_state *esp = (eap_state *)arg;
    943 
    944 	if (esp->es_server.ea_state != eapOpen ||
    945 	    esp->es_server.ea_type != EAPT_SRP)
    946 		return;
    947 
    948 	esp->es_server.ea_requests = 0;
    949 	esp->es_server.ea_state = eapSRP4;
    950 	esp->es_server.ea_id++;
    951 	eap_send_request(esp);
    952 }
    953 
    954 /*
    955  * eap_lowerup - The lower layer is now up.
    956  *
    957  * This is called before either eap_authpeer or eap_authwithpeer.  See
    958  * link_established() in auth.c.  All that's necessary here is to
    959  * return to closed state so that those two routines will do the right
    960  * thing.
    961  */
    962 static void
    963 eap_lowerup(unit)
    964 int unit;
    965 {
    966 	eap_state *esp = &eap_states[unit];
    967 
    968 	/* Discard any (possibly authenticated) peer name. */
    969 	if (esp->es_server.ea_peer != NULL &&
    970 	    esp->es_server.ea_peer != remote_name)
    971 		free(esp->es_server.ea_peer);
    972 	esp->es_server.ea_peer = NULL;
    973 	if (esp->es_client.ea_peer != NULL)
    974 		free(esp->es_client.ea_peer);
    975 	esp->es_client.ea_peer = NULL;
    976 
    977 	esp->es_client.ea_state = eapClosed;
    978 	esp->es_server.ea_state = eapClosed;
    979 }
    980 
    981 /*
    982  * eap_lowerdown - The lower layer is now down.
    983  *
    984  * Cancel all timeouts and return to initial state.
    985  */
    986 static void
    987 eap_lowerdown(unit)
    988 int unit;
    989 {
    990 	eap_state *esp = &eap_states[unit];
    991 
    992 	if (eap_client_active(esp) && esp->es_client.ea_timeout > 0) {
    993 		UNTIMEOUT(eap_client_timeout, (void *)esp);
    994 	}
    995 	if (eap_server_active(esp)) {
    996 		if (esp->es_server.ea_timeout > 0) {
    997 			UNTIMEOUT(eap_server_timeout, (void *)esp);
    998 		}
    999 	} else {
   1000 		if ((esp->es_server.ea_state == eapOpen ||
   1001 		    esp->es_server.ea_state == eapSRP4) &&
   1002 		    esp->es_rechallenge > 0) {
   1003 			UNTIMEOUT(eap_rechallenge, (void *)esp);
   1004 		}
   1005 		if (esp->es_server.ea_state == eapOpen &&
   1006 		    esp->es_lwrechallenge > 0) {
   1007 			UNTIMEOUT(srp_lwrechallenge, (void *)esp);
   1008 		}
   1009 	}
   1010 
   1011 	esp->es_client.ea_state = esp->es_server.ea_state = eapInitial;
   1012 	esp->es_client.ea_requests = esp->es_server.ea_requests = 0;
   1013 }
   1014 
   1015 /*
   1016  * eap_protrej - Peer doesn't speak this protocol.
   1017  *
   1018  * This shouldn't happen.  If it does, it represents authentication
   1019  * failure.
   1020  */
   1021 static void
   1022 eap_protrej(unit)
   1023 int unit;
   1024 {
   1025 	eap_state *esp = &eap_states[unit];
   1026 
   1027 	if (eap_client_active(esp)) {
   1028 		error("EAP authentication failed due to Protocol-Reject");
   1029 		auth_withpeer_fail(unit, PPP_EAP);
   1030 	}
   1031 	if (eap_server_active(esp)) {
   1032 		error("EAP authentication of peer failed on Protocol-Reject");
   1033 		auth_peer_fail(unit, PPP_EAP);
   1034 	}
   1035 	eap_lowerdown(unit);
   1036 }
   1037 
   1038 /*
   1039  * Format and send a regular EAP Response message.
   1040  */
   1041 static void
   1042 eap_send_response(esp, id, typenum, str, lenstr)
   1043 eap_state *esp;
   1044 u_char id;
   1045 u_char typenum;
   1046 u_char *str;
   1047 int lenstr;
   1048 {
   1049 	u_char *outp;
   1050 	int msglen;
   1051 
   1052 	outp = outpacket_buf;
   1053 
   1054 	MAKEHEADER(outp, PPP_EAP);
   1055 
   1056 	PUTCHAR(EAP_RESPONSE, outp);
   1057 	PUTCHAR(id, outp);
   1058 	esp->es_client.ea_id = id;
   1059 	msglen = EAP_HEADERLEN + sizeof (u_char) + lenstr;
   1060 	PUTSHORT(msglen, outp);
   1061 	PUTCHAR(typenum, outp);
   1062 	if (lenstr > 0) {
   1063 		BCOPY(str, outp, lenstr);
   1064 	}
   1065 
   1066 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen);
   1067 }
   1068 
   1069 /*
   1070  * Format and send an MD5-Challenge EAP Response message.
   1071  */
   1072 static void
   1073 eap_chap_response(esp, id, hash, name, namelen)
   1074 eap_state *esp;
   1075 u_char id;
   1076 u_char *hash;
   1077 char *name;
   1078 int namelen;
   1079 {
   1080 	u_char *outp;
   1081 	int msglen;
   1082 
   1083 	outp = outpacket_buf;
   1084 
   1085 	MAKEHEADER(outp, PPP_EAP);
   1086 
   1087 	PUTCHAR(EAP_RESPONSE, outp);
   1088 	PUTCHAR(id, outp);
   1089 	esp->es_client.ea_id = id;
   1090 	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + MD5_SIGNATURE_SIZE +
   1091 	    namelen;
   1092 	PUTSHORT(msglen, outp);
   1093 	PUTCHAR(EAPT_MD5CHAP, outp);
   1094 	PUTCHAR(MD5_SIGNATURE_SIZE, outp);
   1095 	BCOPY(hash, outp, MD5_SIGNATURE_SIZE);
   1096 	INCPTR(MD5_SIGNATURE_SIZE, outp);
   1097 	if (namelen > 0) {
   1098 		BCOPY(name, outp, namelen);
   1099 	}
   1100 
   1101 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen);
   1102 }
   1103 
   1104 #ifdef USE_SRP
   1105 /*
   1106  * Format and send a SRP EAP Response message.
   1107  */
   1108 static void
   1109 eap_srp_response(esp, id, subtypenum, str, lenstr)
   1110 eap_state *esp;
   1111 u_char id;
   1112 u_char subtypenum;
   1113 u_char *str;
   1114 int lenstr;
   1115 {
   1116 	u_char *outp;
   1117 	int msglen;
   1118 
   1119 	outp = outpacket_buf;
   1120 
   1121 	MAKEHEADER(outp, PPP_EAP);
   1122 
   1123 	PUTCHAR(EAP_RESPONSE, outp);
   1124 	PUTCHAR(id, outp);
   1125 	esp->es_client.ea_id = id;
   1126 	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + lenstr;
   1127 	PUTSHORT(msglen, outp);
   1128 	PUTCHAR(EAPT_SRP, outp);
   1129 	PUTCHAR(subtypenum, outp);
   1130 	if (lenstr > 0) {
   1131 		BCOPY(str, outp, lenstr);
   1132 	}
   1133 
   1134 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen);
   1135 }
   1136 
   1137 /*
   1138  * Format and send a SRP EAP Client Validator Response message.
   1139  */
   1140 static void
   1141 eap_srpval_response(esp, id, flags, str)
   1142 eap_state *esp;
   1143 u_char id;
   1144 u_int32_t flags;
   1145 u_char *str;
   1146 {
   1147 	u_char *outp;
   1148 	int msglen;
   1149 
   1150 	outp = outpacket_buf;
   1151 
   1152 	MAKEHEADER(outp, PPP_EAP);
   1153 
   1154 	PUTCHAR(EAP_RESPONSE, outp);
   1155 	PUTCHAR(id, outp);
   1156 	esp->es_client.ea_id = id;
   1157 	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) +
   1158 	    SHA_DIGESTSIZE;
   1159 	PUTSHORT(msglen, outp);
   1160 	PUTCHAR(EAPT_SRP, outp);
   1161 	PUTCHAR(EAPSRP_CVALIDATOR, outp);
   1162 	PUTLONG(flags, outp);
   1163 	BCOPY(str, outp, SHA_DIGESTSIZE);
   1164 
   1165 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen);
   1166 }
   1167 #endif /* USE_SRP */
   1168 
   1169 static void
   1170 eap_send_nak(esp, id, type)
   1171 eap_state *esp;
   1172 u_char id;
   1173 u_char type;
   1174 {
   1175 	u_char *outp;
   1176 	int msglen;
   1177 
   1178 	outp = outpacket_buf;
   1179 
   1180 	MAKEHEADER(outp, PPP_EAP);
   1181 
   1182 	PUTCHAR(EAP_RESPONSE, outp);
   1183 	PUTCHAR(id, outp);
   1184 	esp->es_client.ea_id = id;
   1185 	msglen = EAP_HEADERLEN + 2 * sizeof (u_char);
   1186 	PUTSHORT(msglen, outp);
   1187 	PUTCHAR(EAPT_NAK, outp);
   1188 	PUTCHAR(type, outp);
   1189 
   1190 	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen);
   1191 }
   1192 
   1193 #ifdef USE_SRP
   1194 static char *
   1195 name_of_pn_file()
   1196 {
   1197 	char *user, *path, *file;
   1198 	struct passwd *pw;
   1199 	size_t pl;
   1200 	static bool pnlogged = 0;
   1201 
   1202 	pw = getpwuid(getuid());
   1203 	if (pw == NULL || (user = pw->pw_dir) == NULL || user[0] == 0) {
   1204 		errno = EINVAL;
   1205 		return (NULL);
   1206 	}
   1207 	file = _PATH_PSEUDONYM;
   1208 	pl = strlen(user) + strlen(file) + 2;
   1209 	path = malloc(pl);
   1210 	if (path == NULL)
   1211 		return (NULL);
   1212 	(void) slprintf(path, pl, "%s/%s", user, file);
   1213 	if (!pnlogged) {
   1214 		dbglog("pseudonym file: %s", path);
   1215 		pnlogged = 1;
   1216 	}
   1217 	return (path);
   1218 }
   1219 
   1220 static int
   1221 open_pn_file(modebits)
   1222 mode_t modebits;
   1223 {
   1224 	char *path;
   1225 	int fd, err;
   1226 
   1227 	if ((path = name_of_pn_file()) == NULL)
   1228 		return (-1);
   1229 	fd = open(path, modebits, S_IRUSR | S_IWUSR);
   1230 	err = errno;
   1231 	free(path);
   1232 	errno = err;
   1233 	return (fd);
   1234 }
   1235 
   1236 static void
   1237 remove_pn_file()
   1238 {
   1239 	char *path;
   1240 
   1241 	if ((path = name_of_pn_file()) != NULL) {
   1242 		(void) unlink(path);
   1243 		(void) free(path);
   1244 	}
   1245 }
   1246 
   1247 static void
   1248 write_pseudonym(esp, inp, len, id)
   1249 eap_state *esp;
   1250 u_char *inp;
   1251 int len, id;
   1252 {
   1253 	u_char val;
   1254 	u_char *datp, *digp;
   1255 	SHA1_CTX ctxt;
   1256 	u_char dig[SHA_DIGESTSIZE];
   1257 	int dsize, fd, olen = len;
   1258 
   1259 	/*
   1260 	 * Do the decoding by working backwards.  This eliminates the need
   1261 	 * to save the decoded output in a separate buffer.
   1262 	 */
   1263 	val = id;
   1264 	while (len > 0) {
   1265 		if ((dsize = len % SHA_DIGESTSIZE) == 0)
   1266 			dsize = SHA_DIGESTSIZE;
   1267 		len -= dsize;
   1268 		datp = inp + len;
   1269 		SHA1Init(&ctxt);
   1270 		SHA1Update(&ctxt, &val, 1);
   1271 		SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN);
   1272 		if (len > 0) {
   1273 			SHA1Update(&ctxt, datp, SHA_DIGESTSIZE);
   1274 		} else {
   1275 			SHA1Update(&ctxt, esp->es_client.ea_name,
   1276 			    esp->es_client.ea_namelen);
   1277 		}
   1278 		SHA1Final(dig, &ctxt);
   1279 		for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++)
   1280 			*datp++ ^= *digp;
   1281 	}
   1282 
   1283 	/* Now check that the result is sane */
   1284 	if (olen <= 0 || *inp + 1 > olen) {
   1285 		dbglog("EAP: decoded pseudonym is unusable <%.*B>", olen, inp);
   1286 		return;
   1287 	}
   1288 
   1289 	/* Save it away */
   1290 	fd = open_pn_file(O_WRONLY | O_CREAT | O_TRUNC);
   1291 	if (fd < 0) {
   1292 		dbglog("EAP: error saving pseudonym: %m");
   1293 		return;
   1294 	}
   1295 	len = write(fd, inp + 1, *inp);
   1296 	if (close(fd) != -1 && len == *inp) {
   1297 		dbglog("EAP: saved pseudonym");
   1298 		esp->es_usedpseudo = 0;
   1299 	} else {
   1300 		dbglog("EAP: failed to save pseudonym");
   1301 		remove_pn_file();
   1302 	}
   1303 }
   1304 #endif /* USE_SRP */
   1305 
   1306 /*
   1307  * eap_request - Receive EAP Request message (client mode).
   1308  */
   1309 static void
   1310 eap_request(esp, inp, id, len)
   1311 eap_state *esp;
   1312 u_char *inp;
   1313 int id;
   1314 int len;
   1315 {
   1316 	u_char typenum;
   1317 	u_char vallen;
   1318 	int secret_len;
   1319 	char secret[MAXWORDLEN];
   1320 	char rhostname[256];
   1321 	MD5_CTX mdContext;
   1322 	u_char hash[MD5_SIGNATURE_SIZE];
   1323 #ifdef USE_SRP
   1324 	struct t_client *tc;
   1325 	struct t_num sval, gval, Nval, *Ap, Bval;
   1326 	u_char vals[2];
   1327 	SHA1_CTX ctxt;
   1328 	u_char dig[SHA_DIGESTSIZE];
   1329 	int fd;
   1330 #endif /* USE_SRP */
   1331 
   1332 	/*
   1333 	 * Note: we update es_client.ea_id *only if* a Response
   1334 	 * message is being generated.  Otherwise, we leave it the
   1335 	 * same for duplicate detection purposes.
   1336 	 */
   1337 
   1338 	esp->es_client.ea_requests++;
   1339 	if (esp->es_client.ea_maxrequests != 0 &&
   1340 	    esp->es_client.ea_requests > esp->es_client.ea_maxrequests) {
   1341 		info("EAP: received too many Request messages");
   1342 		if (esp->es_client.ea_timeout > 0) {
   1343 			UNTIMEOUT(eap_client_timeout, (void *)esp);
   1344 		}
   1345 		auth_withpeer_fail(esp->es_unit, PPP_EAP);
   1346 		return;
   1347 	}
   1348 
   1349 	if (len <= 0) {
   1350 		error("EAP: empty Request message discarded");
   1351 		return;
   1352 	}
   1353 
   1354 	GETCHAR(typenum, inp);
   1355 	len--;
   1356 
   1357 	switch (typenum) {
   1358 	case EAPT_IDENTITY:
   1359 		if (len > 0)
   1360 			info("EAP: Identity prompt \"%.*q\"", len, inp);
   1361 #ifdef USE_SRP
   1362 		if (esp->es_usepseudo &&
   1363 		    (esp->es_usedpseudo == 0 ||
   1364 			(esp->es_usedpseudo == 1 &&
   1365 			    id == esp->es_client.ea_id))) {
   1366 			esp->es_usedpseudo = 1;
   1367 			/* Try to get a pseudonym */
   1368 			if ((fd = open_pn_file(O_RDONLY)) >= 0) {
   1369 				strcpy(rhostname, SRP_PSEUDO_ID);
   1370 				len = read(fd, rhostname + SRP_PSEUDO_LEN,
   1371 				    sizeof (rhostname) - SRP_PSEUDO_LEN);
   1372 				/* XXX NAI unsupported */
   1373 				if (len > 0) {
   1374 					eap_send_response(esp, id, typenum,
   1375 					    rhostname, len + SRP_PSEUDO_LEN);
   1376 				}
   1377 				(void) close(fd);
   1378 				if (len > 0)
   1379 					break;
   1380 			}
   1381 		}
   1382 		/* Stop using pseudonym now. */
   1383 		if (esp->es_usepseudo && esp->es_usedpseudo != 2) {
   1384 			remove_pn_file();
   1385 			esp->es_usedpseudo = 2;
   1386 		}
   1387 #endif /* USE_SRP */
   1388 		eap_send_response(esp, id, typenum, esp->es_client.ea_name,
   1389 		    esp->es_client.ea_namelen);
   1390 		break;
   1391 
   1392 	case EAPT_NOTIFICATION:
   1393 		if (len > 0)
   1394 			info("EAP: Notification \"%.*q\"", len, inp);
   1395 		eap_send_response(esp, id, typenum, NULL, 0);
   1396 		break;
   1397 
   1398 	case EAPT_NAK:
   1399 		/*
   1400 		 * Avoid the temptation to send Response Nak in reply
   1401 		 * to Request Nak here.  It can only lead to trouble.
   1402 		 */
   1403 		warn("EAP: unexpected Nak in Request; ignored");
   1404 		/* Return because we're waiting for something real. */
   1405 		return;
   1406 
   1407 	case EAPT_MD5CHAP:
   1408 		if (len < 1) {
   1409 			error("EAP: received MD5-Challenge with no data");
   1410 			/* Bogus request; wait for something real. */
   1411 			return;
   1412 		}
   1413 		GETCHAR(vallen, inp);
   1414 		len--;
   1415 		if (vallen < 8 || vallen > len) {
   1416 			error("EAP: MD5-Challenge with bad length %d (8..%d)",
   1417 			    vallen, len);
   1418 			/* Try something better. */
   1419 			eap_send_nak(esp, id, EAPT_SRP);
   1420 			break;
   1421 		}
   1422 
   1423 		/* Not so likely to happen. */
   1424 		if (vallen >= len + sizeof (rhostname)) {
   1425 			dbglog("EAP: trimming really long peer name down");
   1426 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
   1427 			rhostname[sizeof (rhostname) - 1] = '\0';
   1428 		} else {
   1429 			BCOPY(inp + vallen, rhostname, len - vallen);
   1430 			rhostname[len - vallen] = '\0';
   1431 		}
   1432 
   1433 		/* In case the remote doesn't give us his name. */
   1434 		if (explicit_remote ||
   1435 		    (remote_name[0] != '\0' && vallen == len))
   1436 			strlcpy(rhostname, remote_name, sizeof (rhostname));
   1437 
   1438 		/*
   1439 		 * Get the secret for authenticating ourselves with
   1440 		 * the specified host.
   1441 		 */
   1442 		if (!get_secret(esp->es_unit, esp->es_client.ea_name,
   1443 		    rhostname, secret, &secret_len, 0)) {
   1444 			dbglog("EAP: no MD5 secret for auth to %q", rhostname);
   1445 			eap_send_nak(esp, id, EAPT_SRP);
   1446 			break;
   1447 		}
   1448 		MD5_Init(&mdContext);
   1449 		typenum = id;
   1450 		MD5_Update(&mdContext, &typenum, 1);
   1451 		MD5_Update(&mdContext, secret, secret_len);
   1452 		BZERO(secret, sizeof (secret));
   1453 		MD5_Update(&mdContext, inp, vallen);
   1454 		MD5_Final(hash, &mdContext);
   1455 		eap_chap_response(esp, id, hash, esp->es_client.ea_name,
   1456 		    esp->es_client.ea_namelen);
   1457 		break;
   1458 
   1459 #ifdef USE_SRP
   1460 	case EAPT_SRP:
   1461 		if (len < 1) {
   1462 			error("EAP: received empty SRP Request");
   1463 			/* Bogus request; wait for something real. */
   1464 			return;
   1465 		}
   1466 
   1467 		/* Get subtype */
   1468 		GETCHAR(vallen, inp);
   1469 		len--;
   1470 		switch (vallen) {
   1471 		case EAPSRP_CHALLENGE:
   1472 			tc = NULL;
   1473 			if (esp->es_client.ea_session != NULL) {
   1474 				tc = (struct t_client *)esp->es_client.
   1475 				    ea_session;
   1476 				/*
   1477 				 * If this is a new challenge, then start
   1478 				 * over with a new client session context.
   1479 				 * Otherwise, just resend last response.
   1480 				 */
   1481 				if (id != esp->es_client.ea_id) {
   1482 					t_clientclose(tc);
   1483 					esp->es_client.ea_session = NULL;
   1484 					tc = NULL;
   1485 				}
   1486 			}
   1487 			/* No session key just yet */
   1488 			esp->es_client.ea_skey = NULL;
   1489 			if (tc == NULL) {
   1490 				GETCHAR(vallen, inp);
   1491 				len--;
   1492 				if (vallen >= len) {
   1493 					error("EAP: badly-formed SRP Challenge"
   1494 					    " (name)");
   1495 					/* Ignore badly-formed messages */
   1496 					return;
   1497 				}
   1498 				BCOPY(inp, rhostname, vallen);
   1499 				rhostname[vallen] = '\0';
   1500 				INCPTR(vallen, inp);
   1501 				len -= vallen;
   1502 
   1503 				/*
   1504 				 * In case the remote doesn't give us his name,
   1505 				 * use configured name.
   1506 				 */
   1507 				if (explicit_remote ||
   1508 				    (remote_name[0] != '\0' && vallen == 0)) {
   1509 					strlcpy(rhostname, remote_name,
   1510 					    sizeof (rhostname));
   1511 				}
   1512 
   1513 				if (esp->es_client.ea_peer != NULL)
   1514 					free(esp->es_client.ea_peer);
   1515 				esp->es_client.ea_peer = strdup(rhostname);
   1516 				esp->es_client.ea_peerlen = strlen(rhostname);
   1517 
   1518 				GETCHAR(vallen, inp);
   1519 				len--;
   1520 				if (vallen >= len) {
   1521 					error("EAP: badly-formed SRP Challenge"
   1522 					    " (s)");
   1523 					/* Ignore badly-formed messages */
   1524 					return;
   1525 				}
   1526 				sval.data = inp;
   1527 				sval.len = vallen;
   1528 				INCPTR(vallen, inp);
   1529 				len -= vallen;
   1530 
   1531 				GETCHAR(vallen, inp);
   1532 				len--;
   1533 				if (vallen > len) {
   1534 					error("EAP: badly-formed SRP Challenge"
   1535 					    " (g)");
   1536 					/* Ignore badly-formed messages */
   1537 					return;
   1538 				}
   1539 				/* If no generator present, then use value 2 */
   1540 				if (vallen == 0) {
   1541 					gval.data = (u_char *)"\002";
   1542 					gval.len = 1;
   1543 				} else {
   1544 					gval.data = inp;
   1545 					gval.len = vallen;
   1546 				}
   1547 				INCPTR(vallen, inp);
   1548 				len -= vallen;
   1549 
   1550 				/*
   1551 				 * If no modulus present, then use well-known
   1552 				 * value.
   1553 				 */
   1554 				if (len == 0) {
   1555 					Nval.data = (u_char *)wkmodulus;
   1556 					Nval.len = sizeof (wkmodulus);
   1557 				} else {
   1558 					Nval.data = inp;
   1559 					Nval.len = len;
   1560 				}
   1561 				tc = t_clientopen(esp->es_client.ea_name,
   1562 				    &Nval, &gval, &sval);
   1563 				if (tc == NULL) {
   1564 					eap_send_nak(esp, id, EAPT_MD5CHAP);
   1565 					break;
   1566 				}
   1567 				esp->es_client.ea_session = (void *)tc;
   1568 
   1569 				/* Add Challenge ID & type to verifier */
   1570 				vals[0] = id;
   1571 				vals[1] = EAPT_SRP;
   1572 				t_clientaddexdata(tc, vals, 2);
   1573 			}
   1574 			Ap = t_clientgenexp(tc);
   1575 			eap_srp_response(esp, id, EAPSRP_CKEY, Ap->data,
   1576 			    Ap->len);
   1577 			break;
   1578 
   1579 		case EAPSRP_SKEY:
   1580 			tc = (struct t_client *)esp->es_client.ea_session;
   1581 			if (tc == NULL) {
   1582 				warn("EAP: peer sent Subtype 2 without 1");
   1583 				eap_send_nak(esp, id, EAPT_MD5CHAP);
   1584 				break;
   1585 			}
   1586 			if (esp->es_client.ea_skey != NULL) {
   1587 				/*
   1588 				 * ID number should not change here.  Warn
   1589 				 * if it does (but otherwise ignore).
   1590 				 */
   1591 				if (id != esp->es_client.ea_id) {
   1592 					warn("EAP: ID changed from %d to %d "
   1593 					    "in SRP Subtype 2 rexmit",
   1594 					    esp->es_client.ea_id, id);
   1595 				}
   1596 			} else {
   1597 				if (get_srp_secret(esp->es_unit,
   1598 				    esp->es_client.ea_name,
   1599 				    esp->es_client.ea_peer, secret, 0) == 0) {
   1600 					/*
   1601 					 * Can't work with this peer because
   1602 					 * the secret is missing.  Just give
   1603 					 * up.
   1604 					 */
   1605 					eap_send_nak(esp, id, EAPT_MD5CHAP);
   1606 					break;
   1607 				}
   1608 				Bval.data = inp;
   1609 				Bval.len = len;
   1610 				t_clientpasswd(tc, secret);
   1611 				BZERO(secret, sizeof (secret));
   1612 				esp->es_client.ea_skey =
   1613 				    t_clientgetkey(tc, &Bval);
   1614 				if (esp->es_client.ea_skey == NULL) {
   1615 					/* Server is rogue; stop now */
   1616 					error("EAP: SRP server is rogue");
   1617 					goto client_failure;
   1618 				}
   1619 			}
   1620 			eap_srpval_response(esp, id, SRPVAL_EBIT,
   1621 			    t_clientresponse(tc));
   1622 			break;
   1623 
   1624 		case EAPSRP_SVALIDATOR:
   1625 			tc = (struct t_client *)esp->es_client.ea_session;
   1626 			if (tc == NULL || esp->es_client.ea_skey == NULL) {
   1627 				warn("EAP: peer sent Subtype 3 without 1/2");
   1628 				eap_send_nak(esp, id, EAPT_MD5CHAP);
   1629 				break;
   1630 			}
   1631 			/*
   1632 			 * If we're already open, then this ought to be a
   1633 			 * duplicate.  Otherwise, check that the server is
   1634 			 * who we think it is.
   1635 			 */
   1636 			if (esp->es_client.ea_state == eapOpen) {
   1637 				if (id != esp->es_client.ea_id) {
   1638 					warn("EAP: ID changed from %d to %d "
   1639 					    "in SRP Subtype 3 rexmit",
   1640 					    esp->es_client.ea_id, id);
   1641 				}
   1642 			} else {
   1643 				len -= sizeof (u_int32_t) + SHA_DIGESTSIZE;
   1644 				if (len < 0 || t_clientverify(tc, inp +
   1645 					sizeof (u_int32_t)) != 0) {
   1646 					error("EAP: SRP server verification "
   1647 					    "failed");
   1648 					goto client_failure;
   1649 				}
   1650 				GETLONG(esp->es_client.ea_keyflags, inp);
   1651 				/* Save pseudonym if user wants it. */
   1652 				if (len > 0 && esp->es_usepseudo) {
   1653 					INCPTR(SHA_DIGESTSIZE, inp);
   1654 					write_pseudonym(esp, inp, len, id);
   1655 				}
   1656 			}
   1657 			/*
   1658 			 * We've verified our peer.  We're now mostly done,
   1659 			 * except for waiting on the regular EAP Success
   1660 			 * message.
   1661 			 */
   1662 			eap_srp_response(esp, id, EAPSRP_ACK, NULL, 0);
   1663 			break;
   1664 
   1665 		case EAPSRP_LWRECHALLENGE:
   1666 			if (len < 4) {
   1667 				warn("EAP: malformed Lightweight rechallenge");
   1668 				return;
   1669 			}
   1670 			SHA1Init(&ctxt);
   1671 			vals[0] = id;
   1672 			SHA1Update(&ctxt, vals, 1);
   1673 			SHA1Update(&ctxt, esp->es_client.ea_skey,
   1674 			    SESSION_KEY_LEN);
   1675 			SHA1Update(&ctxt, inp, len);
   1676 			SHA1Update(&ctxt, esp->es_client.ea_name,
   1677 			    esp->es_client.ea_namelen);
   1678 			SHA1Final(dig, &ctxt);
   1679 			eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig,
   1680 			    SHA_DIGESTSIZE);
   1681 			break;
   1682 
   1683 		default:
   1684 			error("EAP: unknown SRP Subtype %d", vallen);
   1685 			eap_send_nak(esp, id, EAPT_MD5CHAP);
   1686 			break;
   1687 		}
   1688 		break;
   1689 #endif /* USE_SRP */
   1690 
   1691 	default:
   1692 		info("EAP: unknown authentication type %d; Naking", typenum);
   1693 		eap_send_nak(esp, id, EAPT_SRP);
   1694 		break;
   1695 	}
   1696 
   1697 	if (esp->es_client.ea_timeout > 0) {
   1698 		UNTIMEOUT(eap_client_timeout, (void *)esp);
   1699 		TIMEOUT(eap_client_timeout, (void *)esp,
   1700 		    esp->es_client.ea_timeout);
   1701 	}
   1702 	return;
   1703 
   1704 #ifdef USE_SRP
   1705 client_failure:
   1706 	esp->es_client.ea_state = eapBadAuth;
   1707 	if (esp->es_client.ea_timeout > 0) {
   1708 		UNTIMEOUT(eap_client_timeout, (void *)esp);
   1709 	}
   1710 	esp->es_client.ea_session = NULL;
   1711 	t_clientclose(tc);
   1712 	auth_withpeer_fail(esp->es_unit, PPP_EAP);
   1713 #endif /* USE_SRP */
   1714 }
   1715 
   1716 /*
   1717  * eap_response - Receive EAP Response message (server mode).
   1718  */
   1719 static void
   1720 eap_response(esp, inp, id, len)
   1721 eap_state *esp;
   1722 u_char *inp;
   1723 int id;
   1724 int len;
   1725 {
   1726 	u_char typenum;
   1727 	u_char vallen;
   1728 	int secret_len;
   1729 	char secret[MAXSECRETLEN];
   1730 	char rhostname[256];
   1731 	MD5_CTX mdContext;
   1732 	u_char hash[MD5_SIGNATURE_SIZE];
   1733 #ifdef USE_SRP
   1734 	struct t_server *ts;
   1735 	struct t_num A;
   1736 	SHA1_CTX ctxt;
   1737 	u_char dig[SHA_DIGESTSIZE];
   1738 #endif /* USE_SRP */
   1739 
   1740 	if (esp->es_server.ea_id != id) {
   1741 		dbglog("EAP: discarding Response %d; expected ID %d", id,
   1742 		    esp->es_server.ea_id);
   1743 		return;
   1744 	}
   1745 
   1746 	esp->es_server.ea_responses++;
   1747 
   1748 	if (len <= 0) {
   1749 		error("EAP: empty Response message discarded");
   1750 		return;
   1751 	}
   1752 
   1753 	GETCHAR(typenum, inp);
   1754 	len--;
   1755 
   1756 	switch (typenum) {
   1757 	case EAPT_IDENTITY:
   1758 		if (esp->es_server.ea_state != eapIdentify) {
   1759 			dbglog("EAP discarding unwanted Identify \"%.q\"", len,
   1760 			    inp);
   1761 			break;
   1762 		}
   1763 		info("EAP: unauthenticated peer name \"%.*q\"", len, inp);
   1764 		if (esp->es_server.ea_peer != NULL &&
   1765 		    esp->es_server.ea_peer != remote_name)
   1766 			free(esp->es_server.ea_peer);
   1767 		esp->es_server.ea_peer = malloc(len + 1);
   1768 		if (esp->es_server.ea_peer == NULL) {
   1769 			esp->es_server.ea_peerlen = 0;
   1770 			eap_figure_next_state(esp, 1);
   1771 			break;
   1772 		}
   1773 		BCOPY(inp, esp->es_server.ea_peer, len);
   1774 		esp->es_server.ea_peer[len] = '\0';
   1775 		esp->es_server.ea_peerlen = len;
   1776 		eap_figure_next_state(esp, 0);
   1777 		break;
   1778 
   1779 	case EAPT_NOTIFICATION:
   1780 		dbglog("EAP unexpected Notification; response discarded");
   1781 		break;
   1782 
   1783 	case EAPT_NAK:
   1784 		if (len < 1) {
   1785 			info("EAP: Nak Response with no suggested protocol");
   1786 			eap_figure_next_state(esp, 1);
   1787 			break;
   1788 		}
   1789 
   1790 		GETCHAR(vallen, inp);
   1791 		len--;
   1792 
   1793 		if (!explicit_remote && esp->es_server.ea_state == eapIdentify){
   1794 			/* Peer cannot Nak Identify Request */
   1795 			eap_figure_next_state(esp, 1);
   1796 			break;
   1797 		}
   1798 
   1799 		switch (vallen) {
   1800 		case EAPT_SRP:
   1801 			/* Run through SRP validator selection again. */
   1802 			esp->es_server.ea_state = eapIdentify;
   1803 			eap_figure_next_state(esp, 0);
   1804 			break;
   1805 
   1806 		case EAPT_MD5CHAP:
   1807 			esp->es_server.ea_state = eapMD5Chall;
   1808 			break;
   1809 
   1810 		default:
   1811 			dbglog("EAP: peer requesting unknown Type %d", vallen);
   1812 			switch (esp->es_server.ea_state) {
   1813 			case eapSRP1:
   1814 			case eapSRP2:
   1815 			case eapSRP3:
   1816 				esp->es_server.ea_state = eapMD5Chall;
   1817 				break;
   1818 			case eapMD5Chall:
   1819 			case eapSRP4:
   1820 				esp->es_server.ea_state = eapIdentify;
   1821 				eap_figure_next_state(esp, 0);
   1822 				break;
   1823 			default:
   1824 				break;
   1825 			}
   1826 			break;
   1827 		}
   1828 		break;
   1829 
   1830 	case EAPT_MD5CHAP:
   1831 		if (esp->es_server.ea_state != eapMD5Chall) {
   1832 			error("EAP: unexpected MD5-Response");
   1833 			eap_figure_next_state(esp, 1);
   1834 			break;
   1835 		}
   1836 		if (len < 1) {
   1837 			error("EAP: received MD5-Response with no data");
   1838 			eap_figure_next_state(esp, 1);
   1839 			break;
   1840 		}
   1841 		GETCHAR(vallen, inp);
   1842 		len--;
   1843 		if (vallen != 16 || vallen > len) {
   1844 			error("EAP: MD5-Response with bad length %d", vallen);
   1845 			eap_figure_next_state(esp, 1);
   1846 			break;
   1847 		}
   1848 
   1849 		/* Not so likely to happen. */
   1850 		if (vallen >= len + sizeof (rhostname)) {
   1851 			dbglog("EAP: trimming really long peer name down");
   1852 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
   1853 			rhostname[sizeof (rhostname) - 1] = '\0';
   1854 		} else {
   1855 			BCOPY(inp + vallen, rhostname, len - vallen);
   1856 			rhostname[len - vallen] = '\0';
   1857 		}
   1858 
   1859 		/* In case the remote doesn't give us his name. */
   1860 		if (explicit_remote ||
   1861 		    (remote_name[0] != '\0' && vallen == len))
   1862 			strlcpy(rhostname, remote_name, sizeof (rhostname));
   1863 
   1864 		/*
   1865 		 * Get the secret for authenticating the specified
   1866 		 * host.
   1867 		 */
   1868 		if (!get_secret(esp->es_unit, rhostname,
   1869 		    esp->es_server.ea_name, secret, &secret_len, 1)) {
   1870 			dbglog("EAP: no MD5 secret for auth of %q", rhostname);
   1871 			eap_send_failure(esp);
   1872 			break;
   1873 		}
   1874 		MD5_Init(&mdContext);
   1875 		MD5_Update(&mdContext, &esp->es_server.ea_id, 1);
   1876 		MD5_Update(&mdContext, secret, secret_len);
   1877 		BZERO(secret, sizeof (secret));
   1878 		MD5_Update(&mdContext, esp->es_challenge, esp->es_challen);
   1879 		MD5_Final(hash, &mdContext);
   1880 		if (BCMP(hash, inp, MD5_SIGNATURE_SIZE) != 0) {
   1881 			eap_send_failure(esp);
   1882 			break;
   1883 		}
   1884 		esp->es_server.ea_type = EAPT_MD5CHAP;
   1885 		eap_send_success(esp);
   1886 		eap_figure_next_state(esp, 0);
   1887 		if (esp->es_rechallenge != 0)
   1888 			TIMEOUT(eap_rechallenge, esp, esp->es_rechallenge);
   1889 		break;
   1890 
   1891 #ifdef USE_SRP
   1892 	case EAPT_SRP:
   1893 		if (len < 1) {
   1894 			error("EAP: empty SRP Response");
   1895 			eap_figure_next_state(esp, 1);
   1896 			break;
   1897 		}
   1898 		GETCHAR(typenum, inp);
   1899 		len--;
   1900 		switch (typenum) {
   1901 		case EAPSRP_CKEY:
   1902 			if (esp->es_server.ea_state != eapSRP1) {
   1903 				error("EAP: unexpected SRP Subtype 1 Response");
   1904 				eap_figure_next_state(esp, 1);
   1905 				break;
   1906 			}
   1907 			A.data = inp;
   1908 			A.len = len;
   1909 			ts = (struct t_server *)esp->es_server.ea_session;
   1910 			assert(ts != NULL);
   1911 			esp->es_server.ea_skey = t_servergetkey(ts, &A);
   1912 			if (esp->es_server.ea_skey == NULL) {
   1913 				/* Client's A value is bogus; terminate now */
   1914 				error("EAP: bogus A value from client");
   1915 				eap_send_failure(esp);
   1916 			} else {
   1917 				eap_figure_next_state(esp, 0);
   1918 			}
   1919 			break;
   1920 
   1921 		case EAPSRP_CVALIDATOR:
   1922 			if (esp->es_server.ea_state != eapSRP2) {
   1923 				error("EAP: unexpected SRP Subtype 2 Response");
   1924 				eap_figure_next_state(esp, 1);
   1925 				break;
   1926 			}
   1927 			if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) {
   1928 				error("EAP: M1 length %d < %d", len,
   1929 				    sizeof (u_int32_t) + SHA_DIGESTSIZE);
   1930 				eap_figure_next_state(esp, 1);
   1931 				break;
   1932 			}
   1933 			GETLONG(esp->es_server.ea_keyflags, inp);
   1934 			ts = (struct t_server *)esp->es_server.ea_session;
   1935 			assert(ts != NULL);
   1936 			if (t_serververify(ts, inp)) {
   1937 				info("EAP: unable to validate client identity");
   1938 				eap_send_failure(esp);
   1939 				break;
   1940 			}
   1941 			eap_figure_next_state(esp, 0);
   1942 			break;
   1943 
   1944 		case EAPSRP_ACK:
   1945 			if (esp->es_server.ea_state != eapSRP3) {
   1946 				error("EAP: unexpected SRP Subtype 3 Response");
   1947 				eap_send_failure(esp);
   1948 				break;
   1949 			}
   1950 			esp->es_server.ea_type = EAPT_SRP;
   1951 			eap_send_success(esp);
   1952 			eap_figure_next_state(esp, 0);
   1953 			if (esp->es_rechallenge != 0)
   1954 				TIMEOUT(eap_rechallenge, esp,
   1955 				    esp->es_rechallenge);
   1956 			if (esp->es_lwrechallenge != 0)
   1957 				TIMEOUT(srp_lwrechallenge, esp,
   1958 				    esp->es_lwrechallenge);
   1959 			break;
   1960 
   1961 		case EAPSRP_LWRECHALLENGE:
   1962 			if (esp->es_server.ea_state != eapSRP4) {
   1963 				info("EAP: unexpected SRP Subtype 4 Response");
   1964 				return;
   1965 			}
   1966 			if (len != SHA_DIGESTSIZE) {
   1967 				error("EAP: bad Lightweight rechallenge "
   1968 				    "response");
   1969 				return;
   1970 			}
   1971 			SHA1Init(&ctxt);
   1972 			vallen = id;
   1973 			SHA1Update(&ctxt, &vallen, 1);
   1974 			SHA1Update(&ctxt, esp->es_server.ea_skey,
   1975 			    SESSION_KEY_LEN);
   1976 			SHA1Update(&ctxt, esp->es_challenge, esp->es_challen);
   1977 			SHA1Update(&ctxt, esp->es_server.ea_peer,
   1978 			    esp->es_server.ea_peerlen);
   1979 			SHA1Final(dig, &ctxt);
   1980 			if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) {
   1981 				error("EAP: failed Lightweight rechallenge");
   1982 				eap_send_failure(esp);
   1983 				break;
   1984 			}
   1985 			esp->es_server.ea_state = eapOpen;
   1986 			if (esp->es_lwrechallenge != 0)
   1987 				TIMEOUT(srp_lwrechallenge, esp,
   1988 				    esp->es_lwrechallenge);
   1989 			break;
   1990 		}
   1991 		break;
   1992 #endif /* USE_SRP */
   1993 
   1994 	default:
   1995 		/* This can't happen. */
   1996 		error("EAP: unknown Response type %d; ignored", typenum);
   1997 		return;
   1998 	}
   1999 
   2000 	if (esp->es_server.ea_timeout > 0) {
   2001 		UNTIMEOUT(eap_server_timeout, (void *)esp);
   2002 	}
   2003 
   2004 	if (esp->es_server.ea_state != eapBadAuth &&
   2005 	    esp->es_server.ea_state != eapOpen) {
   2006 		esp->es_server.ea_id++;
   2007 		eap_send_request(esp);
   2008 	}
   2009 }
   2010 
   2011 /*
   2012  * eap_success - Receive EAP Success message (client mode).
   2013  */
   2014 static void
   2015 eap_success(esp, inp, id, len)
   2016 eap_state *esp;
   2017 u_char *inp;
   2018 int id;
   2019 int len;
   2020 {
   2021 	if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) {
   2022 		dbglog("EAP unexpected success message in state %s (%d)",
   2023 		    eap_state_name(esp->es_client.ea_state),
   2024 		    esp->es_client.ea_state);
   2025 		return;
   2026 	}
   2027 
   2028 	if (esp->es_client.ea_timeout > 0) {
   2029 		UNTIMEOUT(eap_client_timeout, (void *)esp);
   2030 	}
   2031 
   2032 	if (len > 0) {
   2033 		/* This is odd.  The spec doesn't allow for this. */
   2034 		PRINTMSG(inp, len);
   2035 	}
   2036 
   2037 	esp->es_client.ea_state = eapOpen;
   2038 	auth_withpeer_success(esp->es_unit, PPP_EAP, 0);
   2039 }
   2040 
   2041 /*
   2042  * eap_failure - Receive EAP Failure message (client mode).
   2043  */
   2044 static void
   2045 eap_failure(esp, inp, id, len)
   2046 eap_state *esp;
   2047 u_char *inp;
   2048 int id;
   2049 int len;
   2050 {
   2051 	if (!eap_client_active(esp)) {
   2052 		dbglog("EAP unexpected failure message in state %s (%d)",
   2053 		    eap_state_name(esp->es_client.ea_state),
   2054 		    esp->es_client.ea_state);
   2055 	}
   2056 
   2057 	if (esp->es_client.ea_timeout > 0) {
   2058 		UNTIMEOUT(eap_client_timeout, (void *)esp);
   2059 	}
   2060 
   2061 	if (len > 0) {
   2062 		/* This is odd.  The spec doesn't allow for this. */
   2063 		PRINTMSG(inp, len);
   2064 	}
   2065 
   2066 	esp->es_client.ea_state = eapBadAuth;
   2067 
   2068 	error("EAP: peer reports authentication failure");
   2069 	auth_withpeer_fail(esp->es_unit, PPP_EAP);
   2070 }
   2071 
   2072 /*
   2073  * eap_input - Handle received EAP message.
   2074  */
   2075 static void
   2076 eap_input(unit, inp, inlen)
   2077 int unit;
   2078 u_char *inp;
   2079 int inlen;
   2080 {
   2081 	eap_state *esp = &eap_states[unit];
   2082 	u_char code, id;
   2083 	int len;
   2084 
   2085 	/*
   2086 	 * Parse header (code, id and length).  If packet too short,
   2087 	 * drop it.
   2088 	 */
   2089 	if (inlen < EAP_HEADERLEN) {
   2090 		error("EAP: packet too short: %d < %d", inlen, EAP_HEADERLEN);
   2091 		return;
   2092 	}
   2093 	GETCHAR(code, inp);
   2094 	GETCHAR(id, inp);
   2095 	GETSHORT(len, inp);
   2096 	if (len < EAP_HEADERLEN || len > inlen) {
   2097 		error("EAP: packet has illegal length field %d (%d..%d)", len,
   2098 		    EAP_HEADERLEN, inlen);
   2099 		return;
   2100 	}
   2101 	len -= EAP_HEADERLEN;
   2102 
   2103 	/* Dispatch based on message code */
   2104 	switch (code) {
   2105 	case EAP_REQUEST:
   2106 		eap_request(esp, inp, id, len);
   2107 		break;
   2108 
   2109 	case EAP_RESPONSE:
   2110 		eap_response(esp, inp, id, len);
   2111 		break;
   2112 
   2113 	case EAP_SUCCESS:
   2114 		eap_success(esp, inp, id, len);
   2115 		break;
   2116 
   2117 	case EAP_FAILURE:
   2118 		eap_failure(esp, inp, id, len);
   2119 		break;
   2120 
   2121 	default:				/* XXX Need code reject */
   2122 		/* Note: it's not legal to send EAP Nak here. */
   2123 		warn("EAP: unknown code %d received", code);
   2124 		break;
   2125 	}
   2126 }
   2127 
   2128 /*
   2129  * eap_printpkt - print the contents of an EAP packet.
   2130  */
   2131 static char *eap_codenames[] = {
   2132 	"Request", "Response", "Success", "Failure"
   2133 };
   2134 
   2135 static char *eap_typenames[] = {
   2136 	"Identity", "Notification", "Nak", "MD5-Challenge",
   2137 	"OTP", "Generic-Token", NULL, NULL,
   2138 	"RSA", "DSS", "KEA", "KEA-Validate",
   2139 	"TLS", "Defender", "Windows 2000", "Arcot",
   2140 	"Cisco", "Nokia", "SRP"
   2141 };
   2142 
   2143 static int
   2144 eap_printpkt(inp, inlen, printer, arg)
   2145 u_char *inp;
   2146 int inlen;
   2147 void (*printer) __P((void *, char *, ...));
   2148 void *arg;
   2149 {
   2150 	int code, id, len, rtype, vallen;
   2151 	u_char *pstart;
   2152 	u_int32_t uval;
   2153 
   2154 	if (inlen < EAP_HEADERLEN)
   2155 		return (0);
   2156 	pstart = inp;
   2157 	GETCHAR(code, inp);
   2158 	GETCHAR(id, inp);
   2159 	GETSHORT(len, inp);
   2160 	if (len < EAP_HEADERLEN || len > inlen)
   2161 		return (0);
   2162 
   2163 	if (code >= 1 && code <= sizeof(eap_codenames) / sizeof(char *))
   2164 		printer(arg, " %s", eap_codenames[code-1]);
   2165 	else
   2166 		printer(arg, " code=0x%x", code);
   2167 	printer(arg, " id=0x%x", id);
   2168 	len -= EAP_HEADERLEN;
   2169 	switch (code) {
   2170 	case EAP_REQUEST:
   2171 		if (len < 1) {
   2172 			printer(arg, " <missing type>");
   2173 			break;
   2174 		}
   2175 		GETCHAR(rtype, inp);
   2176 		len--;
   2177 		if (rtype >= 1 &&
   2178 		    rtype <= sizeof (eap_typenames) / sizeof (char *))
   2179 			printer(arg, " %s", eap_typenames[rtype-1]);
   2180 		else
   2181 			printer(arg, " type=0x%x", rtype);
   2182 		switch (rtype) {
   2183 		case EAPT_IDENTITY:
   2184 		case EAPT_NOTIFICATION:
   2185 			if (len > 0) {
   2186 				printer(arg, " <Message ");
   2187 				print_string((char *)inp, len, printer, arg);
   2188 				printer(arg, ">");
   2189 				INCPTR(len, inp);
   2190 				len = 0;
   2191 			} else {
   2192 				printer(arg, " <No message>");
   2193 			}
   2194 			break;
   2195 
   2196 		case EAPT_MD5CHAP:
   2197 			if (len <= 0)
   2198 				break;
   2199 			GETCHAR(vallen, inp);
   2200 			len--;
   2201 			if (vallen > len)
   2202 				goto truncated;
   2203 			printer(arg, " <Value%.*B>", vallen, inp);
   2204 			INCPTR(vallen, inp);
   2205 			len -= vallen;
   2206 			if (len > 0) {
   2207 				printer(arg, " <Name ");
   2208 				print_string((char *)inp, len, printer, arg);
   2209 				printer(arg, ">");
   2210 				INCPTR(len, inp);
   2211 				len = 0;
   2212 			} else {
   2213 				printer(arg, " <No name>");
   2214 			}
   2215 			break;
   2216 
   2217 		case EAPT_SRP:
   2218 			if (len < 3)
   2219 				goto truncated;
   2220 			GETCHAR(vallen, inp);
   2221 			len--;
   2222 			printer(arg, "-%d", vallen);
   2223 			switch (vallen) {
   2224 			case EAPSRP_CHALLENGE:
   2225 				GETCHAR(vallen, inp);
   2226 				len--;
   2227 				if (vallen >= len)
   2228 					goto truncated;
   2229 				if (vallen > 0) {
   2230 					printer(arg, " <Name ");
   2231 					print_string((char *)inp, vallen, printer,
   2232 					    arg);
   2233 					printer(arg, ">");
   2234 				} else {
   2235 					printer(arg, " <No name>");
   2236 				}
   2237 				INCPTR(vallen, inp);
   2238 				len -= vallen;
   2239 				GETCHAR(vallen, inp);
   2240 				len--;
   2241 				if (vallen >= len)
   2242 					goto truncated;
   2243 				printer(arg, " <s%.*B>", vallen, inp);
   2244 				INCPTR(vallen, inp);
   2245 				len -= vallen;
   2246 				GETCHAR(vallen, inp);
   2247 				len--;
   2248 				if (vallen > len)
   2249 					goto truncated;
   2250 				if (vallen == 0) {
   2251 					printer(arg, " <Default g=2>");
   2252 				} else {
   2253 					printer(arg, " <g%.*B>", vallen, inp);
   2254 				}
   2255 				INCPTR(vallen, inp);
   2256 				len -= vallen;
   2257 				if (len == 0) {
   2258 					printer(arg, " <Default N>");
   2259 				} else {
   2260 					printer(arg, " <N%.*B>", len, inp);
   2261 					INCPTR(len, inp);
   2262 					len = 0;
   2263 				}
   2264 				break;
   2265 
   2266 			case EAPSRP_SKEY:
   2267 				printer(arg, " <B%.*B>", len, inp);
   2268 				INCPTR(len, inp);
   2269 				len = 0;
   2270 				break;
   2271 
   2272 			case EAPSRP_SVALIDATOR:
   2273 				if (len < sizeof (u_int32_t))
   2274 					break;
   2275 				GETLONG(uval, inp);
   2276 				len -= sizeof (u_int32_t);
   2277 				if (uval & SRPVAL_EBIT) {
   2278 					printer(arg, " E");
   2279 					uval &= ~SRPVAL_EBIT;
   2280 				}
   2281 				if (uval != 0) {
   2282 					printer(arg, " f<%X>", uval);
   2283 				}
   2284 				if ((vallen = len) > SHA_DIGESTSIZE)
   2285 					vallen = SHA_DIGESTSIZE;
   2286 				printer(arg, " <M2%.*B%s>", len, inp,
   2287 				    len < SHA_DIGESTSIZE ? "?" : "");
   2288 				INCPTR(vallen, inp);
   2289 				len -= vallen;
   2290 				if (len > 0) {
   2291 					printer(arg, " <PN%.*B>", len, inp);
   2292 					INCPTR(len, inp);
   2293 					len = 0;
   2294 				}
   2295 				break;
   2296 
   2297 			case EAPSRP_LWRECHALLENGE:
   2298 				printer(arg, " <Challenge%.*B>", len, inp);
   2299 				INCPTR(len, inp);
   2300 				len = 0;
   2301 				break;
   2302 			}
   2303 			break;
   2304 		}
   2305 		break;
   2306 
   2307 	case EAP_RESPONSE:
   2308 		if (len < 1)
   2309 			break;
   2310 		GETCHAR(rtype, inp);
   2311 		len--;
   2312 		if (rtype >= 1 &&
   2313 		    rtype <= sizeof (eap_typenames) / sizeof (char *))
   2314 			printer(arg, " %s", eap_typenames[rtype-1]);
   2315 		else
   2316 			printer(arg, " type=0x%x", rtype);
   2317 		switch (rtype) {
   2318 		case EAPT_IDENTITY:
   2319 			if (len > 0) {
   2320 				printer(arg, " <Name ");
   2321 				print_string((char *)inp, len, printer, arg);
   2322 				printer(arg, ">");
   2323 				INCPTR(len, inp);
   2324 				len = 0;
   2325 			}
   2326 			break;
   2327 
   2328 		case EAPT_NAK:
   2329 			if (len <= 0) {
   2330 				printer(arg, " <missing hint>");
   2331 				break;
   2332 			}
   2333 			GETCHAR(rtype, inp);
   2334 			len--;
   2335 			printer(arg, " <Suggested-type %02X", rtype);
   2336 			if (rtype >= 1 &&
   2337 			    rtype < sizeof (eap_typenames) / sizeof (char *))
   2338 				printer(arg, " (%s)", eap_typenames[rtype-1]);
   2339 			printer(arg, ">");
   2340 			break;
   2341 
   2342 		case EAPT_MD5CHAP:
   2343 			if (len <= 0) {
   2344 				printer(arg, " <missing length>");
   2345 				break;
   2346 			}
   2347 			GETCHAR(vallen, inp);
   2348 			len--;
   2349 			if (vallen > len)
   2350 				goto truncated;
   2351 			printer(arg, " <Value%.*B>", vallen, inp);
   2352 			INCPTR(vallen, inp);
   2353 			len -= vallen;
   2354 			if (len > 0) {
   2355 				printer(arg, " <Name ");
   2356 				print_string((char *)inp, len, printer, arg);
   2357 				printer(arg, ">");
   2358 				INCPTR(len, inp);
   2359 				len = 0;
   2360 			} else {
   2361 				printer(arg, " <No name>");
   2362 			}
   2363 			break;
   2364 
   2365 		case EAPT_SRP:
   2366 			if (len < 1)
   2367 				goto truncated;
   2368 			GETCHAR(vallen, inp);
   2369 			len--;
   2370 			printer(arg, "-%d", vallen);
   2371 			switch (vallen) {
   2372 			case EAPSRP_CKEY:
   2373 				printer(arg, " <A%.*B>", len, inp);
   2374 				INCPTR(len, inp);
   2375 				len = 0;
   2376 				break;
   2377 
   2378 			case EAPSRP_CVALIDATOR:
   2379 				if (len < sizeof (u_int32_t))
   2380 					break;
   2381 				GETLONG(uval, inp);
   2382 				len -= sizeof (u_int32_t);
   2383 				if (uval & SRPVAL_EBIT) {
   2384 					printer(arg, " E");
   2385 					uval &= ~SRPVAL_EBIT;
   2386 				}
   2387 				if (uval != 0) {
   2388 					printer(arg, " f<%X>", uval);
   2389 				}
   2390 				printer(arg, " <M1%.*B%s>", len, inp,
   2391 				    len == SHA_DIGESTSIZE ? "" : "?");
   2392 				INCPTR(len, inp);
   2393 				len = 0;
   2394 				break;
   2395 
   2396 			case EAPSRP_ACK:
   2397 				break;
   2398 
   2399 			case EAPSRP_LWRECHALLENGE:
   2400 				printer(arg, " <Response%.*B%s>", len, inp,
   2401 				    len == SHA_DIGESTSIZE ? "" : "?");
   2402 				if ((vallen = len) > SHA_DIGESTSIZE)
   2403 					vallen = SHA_DIGESTSIZE;
   2404 				INCPTR(vallen, inp);
   2405 				len -= vallen;
   2406 				break;
   2407 			}
   2408 			break;
   2409 		}
   2410 		break;
   2411 
   2412 	case EAP_SUCCESS:	/* No payload expected for these! */
   2413 	case EAP_FAILURE:
   2414 		break;
   2415 
   2416 	truncated:
   2417 		printer(arg, " <truncated>");
   2418 		break;
   2419 	}
   2420 
   2421 	if (len > 8)
   2422 		printer(arg, "%8B...", inp);
   2423 	else if (len > 0)
   2424 		printer(arg, "%.*B", len, inp);
   2425 	INCPTR(len, inp);
   2426 
   2427 	return (inp - pstart);
   2428 }
   2429