kern/51464: chap authenticator of pppoe does not work

[s-yamaguchi%iij.ad.jp@localhost]

>Number:         51464
>Category:       kern
>Synopsis:       chap authenticator of pppoe does not work
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 09 09:40:01 +0000 2016
>Originator:     Shoichi YAMAGUCHI
>Release:        7.99.33
>Organization:
>Environment:
NetBSD s-ymgch-NetBSD-current 7.99.33 NetBSD 7.99.33 (NETMPSAFE) #6: Fri Jul 22 15:38:03 JST 2016  s-yamaguchi@s-ymgch-NetBSD-current:/src/netbsd-src_host/work.host/obj/sys/arch/amd64/compile/NETMPSAFE amd64
>Description:
Chap authenticator uses hisauthproto, hisauthname and hisauthsecret to authenticate remote host. But PPPoE interface does not send challenge message to a remote host even if the parameters is configured.
Because Chap authenticator checks myauth.proto that is used for peer configuration.
>How-To-Repeat:
Two hosts are used to repeat the problem

(1) Setup PPPoE server as chap authenticator
server% ifconfig pppoe0 create
server% ifconfig pppoe0 inet 10.3.3.1 10.3.3.3 down
server% ifconfig pppoe0 link0
server% pppoectl -e wm0 pppoe0
server% pppoectl pppoe0 hisauthproto=chap 'hisauthname=foobar%baz.com@localhost' 'hisauthsecret=oink' myauthproto=none
server% ifconfig pppoe0 up

(2) Start tcpdump
server% tcpdump -i wm0 -n

(3) Setup PPPoE client
client% ifconfig pppoe0 create
client% ifconfig pppoe0 inet 0.0.0.0 0.0.0.1 down
client% pppoectl -e wm0 pppoe0
client% pppoectl pppoe0 myauthproto=chap 'myauthname=foobar%baz.com@localhost' 'myauthsecret=oink' hisauthproto=none
client% ifconfig pppoe0

(4) wait a minute, server does not send the packet
>Fix:
Please apply following patch
=======================================
index 88bec9f..e808124 100644
--- sys/net/if_spppsubr.c
+++ sys/net/if_spppsubr.c
@@ -4054,20 +4054,20 @@ sppp_chap_input(struct sppp *sp, struct mbuf *m)
                        sppp_print_bytes(value, value_len);
                        addlog(">\n");
                }
-               if (value_len != sizeof(sp->myauth.challenge)) {
+               if (value_len != sizeof(sp->hisauth.challenge)) {
                        if (debug)
                                log(LOG_DEBUG,
                                    "%s: chap bad hash value length: "
                                    "%d bytes, should be %ld\n",
                                    ifp->if_xname, value_len,
-                                   (long) sizeof(sp->myauth.challenge));
+                                   (long) sizeof(sp->hisauth.challenge));
                        goto chap_failure;
                }

                MD5Init(&ctx);
                MD5Update(&ctx, &h->ident, 1);
                MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len);
-               MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge));
+               MD5Update(&ctx, sp->hisauth.challenge, sizeof(sp->hisauth.challenge));
                MD5Final(digest, &ctx);

 #define FAILMSG "Failed..."
@@ -4130,7 +4130,7 @@ sppp_chap_init(struct sppp *sp)
 static void
 sppp_chap_open(struct sppp *sp)
 {
-       if (sp->myauth.proto == PPP_CHAP &&
+       if (sp->hisauth.proto == PPP_CHAP &&
            (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
                /* we are authenticator for CHAP, start it */
                chap.scr(sp);
@@ -4265,24 +4265,22 @@ sppp_chap_scr(struct sppp *sp)
        uint32_t *ch;
        u_char clen = 4 * sizeof(uint32_t);

-       if (sp->myauth.name == NULL) {
+       if (sp->hisauth.name == NULL) {
            /* can't do anything useful */
-           printf("%s: chap starting without my name being set\n",
+           printf("%s: chap starting without his name being set\n",
                sp->pp_if.if_xname);
            return;
        }

        /* Compute random challenge. */
-       ch = (uint32_t *)sp->myauth.challenge;
+       ch = (uint32_t *)sp->hisauth.challenge;
        cprng_strong(kern_cprng, ch, clen, 0);

        sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];

        sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
                       sizeof clen, (const char *)&clen,
-                      sizeof(sp->myauth.challenge), sp->myauth.challenge,
-                      sp->myauth.name_len,
-                      sp->myauth.name,
+                      sizeof(sp->hisauth.challenge), sp->hisauth.challenge,
                       0);
 }