moved auth.c to use new rad_chap_encode function

	miscellaneous moves of #define's, and additional comments.

diff --git a/src/include/libradius.h b/src/include/libradius.h
index 18f48f4..52ecfc3 100644 (file)
--- a/src/include/libradius.h
+++ b/src/include/libradius.h
@@ -22,6 +22,7 @@ typedef unsigned int u_int;
 #endif
 
 #define AUTH_VECTOR_LEN                16
+#define CHAP_VALUE_LENGTH       16
 #define MAX_STRING_LEN         254     /* RFC2138: string 0-253 octets */
 
 #define PW_AUTH_UDP_PORT                1645

diff --git a/src/include/radiusd.h b/src/include/radiusd.h
index 3fe52d4..c0ed870 100644 (file)
--- a/src/include/radiusd.h
+++ b/src/include/radiusd.h
@@ -11,8 +11,6 @@
 #include "conf.h"
 #include "missing.h"
 
-#define CHAP_VALUE_LENGTH               16
-
 typedef struct auth_req {
        RADIUS_PACKET           *packet;
        RADIUS_PACKET           *proxy;

diff --git a/src/lib/radius.c b/src/lib/radius.c
index d63a9b1..2941618 100644 (file)
--- a/src/lib/radius.c
+++ b/src/lib/radius.c
@@ -191,7 +191,7 @@ int rad_send(RADIUS_PACKET *packet, const char *secret)
                        } else if (reply->attribute == PW_CHAP_PASSWORD) {
                          rad_chap_encode(packet, reply->strvalue, packet->id,
                                          reply);
-                         reply->length = 1 + AUTH_VECTOR_LEN;
+                         reply->length = 1 + CHAP_VALUE_LENGTH;
                        } 
                      }
                      
@@ -814,6 +814,10 @@ int rad_pwdecode(char *passwd, int pwlen, const char *secret, const char *vector
 
 /*
  *     Encode a CHAP password
+ *
+ *     FIXME: might not work with Ascend because
+ *     we use vp->length, and Ascend gear likes
+ *     to send an extra '\0' in the string!
  */
 int rad_chap_encode(RADIUS_PACKET *packet, char *output, int id, VALUE_PAIR *password)
 {
@@ -829,6 +833,13 @@ int rad_chap_encode(RADIUS_PACKET *packet, char *output, int id, VALUE_PAIR *pas
                return -1;
        }
 
+       /*
+        *      Note that the password VP can be EITHER
+        *      a Password attribute (from a check-item list),
+        *      or a CHAP-Password attribute (the client asking
+        *      the library to encode it).
+        */
+
        i = 0;
        ptr = string;
        *ptr++ = id;

diff --git a/src/main/auth.c b/src/main/auth.c
index d106513..a17fa4c 100644 (file)
--- a/src/main/auth.c
+++ b/src/main/auth.c
@@ -208,42 +208,18 @@ static int rad_check_password(REQUEST *request,
                         *      CHAP - calculate MD5 sum over CHAP-ID,
                         *      plain-text password and the Chap-Challenge.
                         *      Compare to Chap-Response (strvalue + 1).
-                        *
-                        *      FIXME: might not work with Ascend because
-                        *      we use vp->length, and Ascend gear likes
-                        *      to send an extra '\0' in the string!
                         */
                        if (password_pair == NULL) {
                                result= -1;
                                break;
                        }
-                       i = 0;
-                       ptr = string;
-                       *ptr++ = *auth_item->strvalue;
-                       i++;
-                       memcpy(ptr, password_pair->strvalue,
-                               password_pair->length);
-                       ptr += password_pair->length;
-                       i += password_pair->length;
-                       /*
-                        *      Use Chap-Challenge pair if present,
-                        *      Request-Authenticator otherwise.
-                        */
-                       if ((tmp = pairfind(request->packet->vps,
-                           PW_CHAP_CHALLENGE)) != NULL) {
-                               memcpy(ptr, tmp->strvalue, tmp->length);
-                               i += tmp->length;
-                       } else {
-                               memcpy(ptr, request->packet->vector,
-                                       AUTH_VECTOR_LEN);
-                               i += AUTH_VECTOR_LEN;
-                       }
-                       librad_md5_calc(chap_digest, string, i);
+                       rad_chap_encode(request->packet, string,
+                                       *auth_item->strvalue, password_pair);
 
                        /*
                         *      Compare them
                         */
-                       if (memcmp(chap_digest, auth_item->strvalue + 1,
+                       if (memcmp(string + 1, auth_item->strvalue + 1,
                                        CHAP_VALUE_LENGTH) != 0)
                                result = -1;
                        break;