With the introduction to ppp-2.4.9; a new feature to enable EAP-MSCHAPv2 was added. To reproduce:
1) Install network-manager-sstp (pptp should work too) 2) Create a new connection to a SSTP server using Network-Manager-Applet 3) Connect
Connection failed, when you look closer the following output occur in the logs.
nm-sstp[1490800] <info> pppd started with pid 1490814 Plugin /usr/lib/pppd/2.4.9/nm-sstp-pppd-plugin.so loaded. using channel 67 Using interface ppp0 Connect: ppp0 <--> /dev/pts/9 sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x85e48268> <pcomp> <accomp>] rcvd [LCP ConfReq id=0x0 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <callback CBCP> <mrru 1614> <endpoint [local:16.dc.45.82.30.e9.47.0c.80.5a.0a.57.b3.35.62.a4.00.00.00.00]>] sent [LCP ConfRej id=0x0 <callback CBCP> <mrru 1614>] rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x85e48268> <pcomp> <accomp>] rcvd [LCP ConfReq id=0x1 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <endpoint [local:16.dc.45.82.30.e9.47.0c.80.5a.0a.57.b3.35.62.a4.00.00.00.00]>] sent [LCP ConfAck id=0x1 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <endpoint [local:16.dc.45.82.30.e9.47.0c.80.5a.0a.57.b3.35.62.a4.00.00.00.00]>] sent [LCP EchoReq id=0x0 magic=0x85e48268] rcvd [EAP Request id=0x0 Identity <No message>] sent [EAP Response id=0x0 Identity <Name "test">] rcvd [LCP EchoRep id=0x0 magic=0x17a85875] rcvd [EAP Request id=0x1 MSCHAPv2 Challenge <33a45382fe483ab9d4aa52d1316c3517>, <Name "WIN-SUA9KBMR6PA">] added response cache entry 0 sent [EAP Response id=0x1 MSCHAPv2 Response <fe3b418ccfe18d2c32b84ed05ad66a8a0000000000000000bbba30f1778327a72222078b11c7792f2cc6903b235c3f1600>, <Name "SSTP">] rcvd [EAP Request id=0x2 MSCHAPv2 Failure <Message "E=691 R=1 C=055D8FD22591786CA5AE9EC8798FFD4E V=3">...] MS-CHAP authentication failed: E=691 Authentication failure sent [EAP Response id=0x2 MSCHAPv2 Failure] rcvd [LCP TermReq id=0x5 17 a8 58 75 00 3c cd 74 00 00 03 2c] LCP terminated by peer (^WM-(Xu^@<M-Mt^@^@^C,) sent [LCP TermAck id=0x5] Script /sbin/sstpc 172.16.0.253 --cert-warn --tls-ext --nolaunchpppd --log-level 5 --ipparam nm-sstp-service-1490800 --uuid 3d925cb0-6329-4582-9f56-83cd86a6eaf5 finished (pid 1490817), status = 0xff Modem hangup
Notice the username which is supposed to be "SSTP-TEST\\test" only shows up in the MSCHAPv2 response as "SSTP". The length of the name got truncated (I believe to the same length as the EAP-IDENTITY response, which in this case was 4 characters).
Patch is attached.
With the introduction to ppp-2.4.9; a new feature to enable EAP-MSCHAPv2 was added. To reproduce:
1) Install network- manager- sstp (pptp should work too) Manager- Applet
2) Create a new connection to a SSTP server using Network-
3) Connect
Connection failed, when you look closer the following output occur in the logs.
nm-sstp[1490800] <info> pppd started with pid 1490814 pppd/2. 4.9/nm- sstp-pppd- plugin. so loaded. 16.dc.45. 82.30.e9. 47.0c.80. 5a.0a.57. b3.35.62. a4.00.00. 00.00]> ] 16.dc.45. 82.30.e9. 47.0c.80. 5a.0a.57. b3.35.62. a4.00.00. 00.00]> ] 16.dc.45. 82.30.e9. 47.0c.80. 5a.0a.57. b3.35.62. a4.00.00. 00.00]> ] b9d4aa52d1316c3 517>, <Name "WIN-SUA9KBMR6PA">] 2c32b84ed05ad66 a8a000000000000 0000bbba30f1778 327a72222078b11 c7792f2cc6903b2 35c3f1600> , <Name "SSTP">] 86CA5AE9EC8798F FD4E V=3">...] @<M-Mt^ @^@^C,) service- 1490800 --uuid 3d925cb0- 6329-4582- 9f56-83cd86a6ea f5 finished (pid 1490817), status = 0xff
Plugin /usr/lib/
using channel 67
Using interface ppp0
Connect: ppp0 <--> /dev/pts/9
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x85e48268> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x0 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <callback CBCP> <mrru 1614> <endpoint [local:
sent [LCP ConfRej id=0x0 <callback CBCP> <mrru 1614>]
rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x85e48268> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x1 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <endpoint [local:
sent [LCP ConfAck id=0x1 <mru 4091> <auth eap> <magic 0x17a85875> <pcomp> <accomp> <endpoint [local:
sent [LCP EchoReq id=0x0 magic=0x85e48268]
rcvd [EAP Request id=0x0 Identity <No message>]
sent [EAP Response id=0x0 Identity <Name "test">]
rcvd [LCP EchoRep id=0x0 magic=0x17a85875]
rcvd [EAP Request id=0x1 MSCHAPv2 Challenge <33a45382fe483a
added response cache entry 0
sent [EAP Response id=0x1 MSCHAPv2 Response <fe3b418ccfe18d
rcvd [EAP Request id=0x2 MSCHAPv2 Failure <Message "E=691 R=1 C=055D8FD225917
MS-CHAP authentication failed: E=691 Authentication failure
sent [EAP Response id=0x2 MSCHAPv2 Failure]
rcvd [LCP TermReq id=0x5 17 a8 58 75 00 3c cd 74 00 00 03 2c]
LCP terminated by peer (^WM-(Xu^
sent [LCP TermAck id=0x5]
Script /sbin/sstpc 172.16.0.253 --cert-warn --tls-ext --nolaunchpppd --log-level 5 --ipparam nm-sstp-
Modem hangup
Notice the username which is supposed to be "SSTP-TEST\\test" only shows up in the MSCHAPv2 response as "SSTP". The length of the name got truncated (I believe to the same length as the EAP-IDENTITY response, which in this case was 4 characters).
Patch is attached.