1 /* 2 * chap-md5.c - New CHAP/MD5 implementation. 3 * 4 * Copyright (c) 2003 Paul Mackerras. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. The name(s) of the authors of this software must not be used to 14 * endorse or promote products derived from this software without 15 * prior written permission. 16 * 17 * 3. Redistributions of any form whatsoever must retain the following 18 * acknowledgment: 19 * "This product includes software developed by Paul Mackerras 20 * <paulus@samba.org>". 21 * 22 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO 23 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 24 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY 25 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 26 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN 27 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING 28 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 29 */ 30 31 #include "netif/ppp/ppp_opts.h" 32 #if PPP_SUPPORT && CHAP_SUPPORT /* don't build if not configured for use in lwipopts.h */ 33 34 #if 0 /* UNUSED */ 35 #include <stdlib.h> 36 #include <string.h> 37 #endif /* UNUSED */ 38 39 #include "netif/ppp/ppp_impl.h" 40 41 #include "netif/ppp/chap-new.h" 42 #include "netif/ppp/chap-md5.h" 43 #include "netif/ppp/magic.h" 44 #include "netif/ppp/pppcrypt.h" 45 46 #define MD5_HASH_SIZE 16 47 #define MD5_MIN_CHALLENGE 17 48 #define MD5_MAX_CHALLENGE 24 49 #define MD5_MIN_MAX_POWER_OF_TWO_CHALLENGE 3 /* 2^3-1 = 7, 17+7 = 24 */ 50 51 #if PPP_SERVER 52 static void chap_md5_generate_challenge(ppp_pcb *pcb, unsigned char *cp) { 53 int clen; 54 LWIP_UNUSED_ARG(pcb); 55 56 clen = MD5_MIN_CHALLENGE + magic_pow(MD5_MIN_MAX_POWER_OF_TWO_CHALLENGE); 57 *cp++ = clen; 58 magic_random_bytes(cp, clen); 59 } 60 61 static int chap_md5_verify_response(ppp_pcb *pcb, int id, const char *name, 62 const unsigned char *secret, int secret_len, 63 const unsigned char *challenge, const unsigned char *response, 64 char *message, int message_space) { 65 lwip_md5_context ctx; 66 unsigned char idbyte = id; 67 unsigned char hash[MD5_HASH_SIZE]; 68 int challenge_len, response_len; 69 LWIP_UNUSED_ARG(name); 70 LWIP_UNUSED_ARG(pcb); 71 72 challenge_len = *challenge++; 73 response_len = *response++; 74 if (response_len == MD5_HASH_SIZE) { 75 /* Generate hash of ID, secret, challenge */ 76 lwip_md5_init(&ctx); 77 lwip_md5_starts(&ctx); 78 lwip_md5_update(&ctx, &idbyte, 1); 79 lwip_md5_update(&ctx, secret, secret_len); 80 lwip_md5_update(&ctx, challenge, challenge_len); 81 lwip_md5_finish(&ctx, hash); 82 lwip_md5_free(&ctx); 83 84 /* Test if our hash matches the peer's response */ 85 if (memcmp(hash, response, MD5_HASH_SIZE) == 0) { 86 ppp_slprintf(message, message_space, "Access granted"); 87 return 1; 88 } 89 } 90 ppp_slprintf(message, message_space, "Access denied"); 91 return 0; 92 } 93 #endif /* PPP_SERVER */ 94 95 static void chap_md5_make_response(ppp_pcb *pcb, unsigned char *response, int id, const char *our_name, 96 const unsigned char *challenge, const char *secret, int secret_len, 97 unsigned char *private_) { 98 lwip_md5_context ctx; 99 unsigned char idbyte = id; 100 int challenge_len = *challenge++; 101 LWIP_UNUSED_ARG(our_name); 102 LWIP_UNUSED_ARG(private_); 103 LWIP_UNUSED_ARG(pcb); 104 105 lwip_md5_init(&ctx); 106 lwip_md5_starts(&ctx); 107 lwip_md5_update(&ctx, &idbyte, 1); 108 lwip_md5_update(&ctx, (const u_char *)secret, secret_len); 109 lwip_md5_update(&ctx, challenge, challenge_len); 110 lwip_md5_finish(&ctx, &response[1]); 111 lwip_md5_free(&ctx); 112 response[0] = MD5_HASH_SIZE; 113 } 114 115 const struct chap_digest_type md5_digest = { 116 CHAP_MD5, /* code */ 117 #if PPP_SERVER 118 chap_md5_generate_challenge, 119 chap_md5_verify_response, 120 #endif /* PPP_SERVER */ 121 chap_md5_make_response, 122 NULL, /* check_success */ 123 NULL, /* handle_failure */ 124 }; 125 126 #endif /* PPP_SUPPORT && CHAP_SUPPORT */ 127