modemmanager: allow specifying list of authentication protocols

ModemManager allows specifying which are the authentication protocols
to be used during the user/password context authentication with the
peer.

This protocol update allows users to provide a new 'allowedauth'
option in the interface configuration, which is then used in two
different places:
 * It is sent to ModemManager in the --simple-connect call so that
   modems with a network interface can perform the authentication
   using their own vendor-specific protocol.
 * If the connection is done using PPP, this list of protocols is used
   to configure the pppd call.

If the new 'allowedauth' option is not given, all auth protocols are
implicitly allowed.

Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>

diff --git a/net/modemmanager/Makefile b/net/modemmanager/Makefile
index f38e3abf8b5ddc66983774243d3b7a99c077dbd3..5092ccd5cb7e31af6957e8c1b6377152035807d5 100644 (file)
--- a/net/modemmanager/Makefile
+++ b/net/modemmanager/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=modemmanager
 PKG_VERSION:=1.12.10
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=ModemManager-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://www.freedesktop.org/software/ModemManager

diff --git a/net/modemmanager/files/modemmanager.proto b/net/modemmanager/files/modemmanager.proto
index 536073dce4d2a3337daa43c12e51d6f4e45c285b..870542417a083dbf4a84354d74df35e356c7109b 100755 (executable)
--- a/net/modemmanager/files/modemmanager.proto
+++ b/net/modemmanager/files/modemmanager.proto
@@ -116,6 +116,35 @@ modemmanager_connected_method_ppp_ipv4() {
        local ttyname="$2"
        local username="$3"
        local password="$4"
+       local allowedauth="$5"
+
+       # all auth types are allowed unless a user given list is given
+       local authopts
+       local pap=1
+       local chap=1
+       local mschap=1
+       local mschapv2=1
+       local eap=1
+
+       [ -n "$allowedauth" ] && {
+               pap=0 chap=0 mschap=0 mschapv2=0 eap=0
+               for auth in $allowedauth; do
+                       case $auth in
+                               "pap") pap=1 ;;
+                               "chap") chap=1 ;;
+                               "mschap") mschap=1 ;;
+                               "mschapv2") mschapv2=1 ;;
+                               "eap") eap=1 ;;
+                               *) ;;
+                       esac
+               done
+       }
+
+       [ $pap -eq 1 ] || append authopts "refuse-pap"
+       [ $chap -eq 1 ] || append authopts "refuse-chap"
+       [ $mschap -eq 1 ] || append authopts "refuse-mschap"
+       [ $mschapv2 -eq 1 ] || append authopts "refuse-mschap-v2"
+       [ $eap -eq 1 ] || append authopts "refuse-eap"
 
        proto_run_command "${interface}" /usr/sbin/pppd \
                "${ttyname}" \
@@ -126,6 +155,7 @@ modemmanager_connected_method_ppp_ipv4() {
                nopcomp \
                novj \
                noauth \
+               $authopts \
                ${username:+ user $username} \
                ${password:+ password $password} \
                lcp-echo-failure 5 \
@@ -308,6 +338,7 @@ proto_modemmanager_init_config() {
        no_device=1
        proto_config_add_string  device
        proto_config_add_string  apn
+       proto_config_add_string  'allowedauth:list(string)'
        proto_config_add_string  username
        proto_config_add_string  password
        proto_config_add_string  pincode
@@ -320,14 +351,14 @@ proto_modemmanager_setup() {
        local interface="$1"
 
        local modempath modemstatus bearercount bearerpath connectargs bearerstatus beareriface
-       local bearermethod_ipv4 bearermethod_ipv6
+       local bearermethod_ipv4 bearermethod_ipv6 auth cliauth
        local operatorname operatorid registration accesstech signalquality
 
-       local device apn username password pincode iptype metric
+       local device apn allowedauth username password pincode iptype metric
 
        local address prefix gateway mtu dns1 dns2
 
-       json_get_vars device apn username password pincode iptype metric
+       json_get_vars device apn allowedauth username password pincode iptype metric
 
        # validate sysfs path given in config
        [ -n "${device}" ] || {
@@ -356,9 +387,14 @@ proto_modemmanager_setup() {
        # always cleanup before attempting a new connection, just in case
        modemmanager_cleanup_connection "${modemstatus}"
 
+       # if allowedauth list given, build option string
+       for auth in $allowedauth; do
+               cliauth="${cliauth}${cliauth:+|}$auth"
+       done
+
        # setup connect args; APN mandatory (even if it may be empty)
        echo "starting connection with apn '${apn}'..."
-       connectargs="apn=${apn}${iptype:+,ip-type=${iptype}}${username:+,user=${username}}${password:+,password=${password}}${pincode:+,pin=${pincode}}"
+       connectargs="apn=${apn}${iptype:+,ip-type=${iptype}}${cliauth:+,allowed-auth=${cliauth}}${username:+,user=${username}}${password:+,password=${password}}${pincode:+,pin=${pincode}}"
        mmcli --modem="${device}" --timeout 120 --simple-connect="${connectargs}" || {
                proto_notify_error "${interface}" CONNECT_FAILED
                proto_block_restart "${interface}"
@@ -412,7 +448,7 @@ proto_modemmanager_setup() {
                        modemmanager_connected_method_static_ipv4 "${interface}" "${beareriface}" "${address}" "${prefix}" "${gateway}" "${mtu}" "${dns1}" "${dns2}" "${metric}"
                        ;;
                "ppp")
-                       modemmanager_connected_method_ppp_ipv4 "${interface}" "${beareriface}" "${username}" "${password}"
+                       modemmanager_connected_method_ppp_ipv4 "${interface}" "${beareriface}" "${username}" "${password}" "${allowedauth}"
                        ;;
                *)
                        proto_notify_error "${interface}" UNKNOWN_METHOD