[9fans] nfactotum: mschap fix

[Yaroslav]

Forwarding it to the list so people don't bother to debug themselves.
It's tested with cifs and a local change which enables upas/fs to do
IMAP with NTLM auth.

---------- Forwarded message ----------
From: Yaroslav <***@gmail.com>
Date: 2012/3/30
Subject: Re: [9fans] SSHv2

what's the basis for this claim?  it might be broken, since we don't use it
much, but it's not missing.

Yes, sorry, I've meant it's broken; details follow.

try pulling a new copy.
- erik

There are phases mismatch between factotum's chapconv() and libauth's
auth_respond(). I've checked plan9port - it has identical problem.
Patch which fixes it follows:

term% diff -c /n/sources/contrib/quanstro/root/sys/src/cmd/auth/factotum/chap.c
/sys/src/cmd/auth/factotum/chap.c
/n/sources/contrib/quanstro/root/sys/src/cmd/auth/factotum/chap.c:120,125
- /sys/src/cmd/auth/factotum/chap.c:120,126

       ret = -1;
       chal = nil;
+       res = nil;
       k = nil;
       attr = c->attr;

/n/sources/contrib/quanstro/root/sys/src/cmd/auth/factotum/chap.c:153,166
- /sys/src/cmd/auth/factotum/chap.c:154,163
       c->state = "read challenge";
       if((nchal = convreadm(c, (char**)(void*)&chal)) < 0)
               goto out;
-       if(astype == AuthMSchap && nchal != MSchallen)
-       c->state = "write user";
       if((user = strfindattr(k->attr, "user")) == nil){
               werrstr("key has no user (cannot happen?)");
               goto out;
       }
-       if(convprint(c, "%s", user) < 0)
-               goto out;

       c->state = "write response";
       if((pw = strfindattr(k->privattr, "!password")) == nil){

[erik quanstrom]

Post by Yaroslav
/n/sources/contrib/quanstro/root/sys/src/cmd/auth/factotum/chap.c:153,166
- /sys/src/cmd/auth/factotum/chap.c:154,163
       c->state = "read challenge";
       if((nchal = convreadm(c, (char**)(void*)&chal)) < 0)
               goto out;
-       if(astype == AuthMSchap && nchal != MSchallen)
-       c->state = "write user";
       if((user = strfindattr(k->attr, "user")) == nil){
               werrstr("key has no user (cannot happen?)");
               goto out;
       }
-       if(convprint(c, "%s", user) < 0)
-               goto out;

surely you need to use the "user" attribute. if you don't please send
a copy of chap that doesn't give compiler warnings.

- erik

[yaroslav]

Post by erik quanstrom
surely you need to use the "user" attribute. if you don't please send
a copy of chap that doesn't give compiler warnings.

The user attribute is available at the end of CR protocol, upon 'attr'
rpc request.

The attached chap.c compiles cleanly here.

- yk

[Lucio De Re]

Post by Yaroslav
-       if(astype == AuthMSchap && nchal != MSchallen)
-       c->state = "write user";

Who slipped up with the indentation? I hope it was not intentional.

++L