ppp: backport security fixes
[openwrt/staging/mkresin.git] / package / network / services / ppp / patches / 106-debian_stripMSdomain.patch
1 pppd: Implement option to strip domain part from MS CHAP response
2
3 This patch implements a new boolean option "chapms-strip-domain" which
4 strips the leading domain part of the username in a received MS Chap
5 response.
6
7 When the option is set, all leading chars up to and including the last
8 backslash in the username are stripped. The option defaults to false.
9
10 The patch originated from the Debian project.
11
12 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
13
14 --- a/pppd/chap-new.c
15 +++ b/pppd/chap-new.c
16 @@ -58,6 +58,7 @@ int (*chap_verify_hook)(char *name, char
17 int chap_timeout_time = 3;
18 int chap_max_transmits = 10;
19 int chap_rechallenge_time = 0;
20 +int chapms_strip_domain = 0;
21
22 /*
23 * Command-line options.
24 @@ -69,6 +70,8 @@ static option_t chap_option_list[] = {
25 "Set max #xmits for challenge", OPT_PRIO },
26 { "chap-interval", o_int, &chap_rechallenge_time,
27 "Set interval for rechallenge", OPT_PRIO },
28 + { "chapms-strip-domain", o_bool, &chapms_strip_domain,
29 + "Strip the domain prefix before the Username", 1 },
30 { NULL }
31 };
32
33 @@ -336,6 +339,14 @@ chap_handle_response(struct chap_server_
34 /* Null terminate and clean remote name. */
35 slprintf(rname, sizeof(rname), "%.*v", len, name);
36 name = rname;
37 +
38 + /* strip the MS domain name */
39 + if (chapms_strip_domain && strrchr(rname, '\\')) {
40 + char tmp[MAXNAMELEN+1];
41 +
42 + strcpy(tmp, strrchr(rname, '\\') + 1);
43 + strcpy(rname, tmp);
44 + }
45 }
46
47 if (chap_verify_hook)