pppd/chap-new.c

   1 /*
   2  * chap-new.c - New CHAP implementation.
   3  *
   4  * Copyright (c) 2003 Paul Mackerras. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. The name(s) of the authors of this software must not be used to
  14  *    endorse or promote products derived from this software without
  15  *    prior written permission.
  16  *
  17  * 3. Redistributions of any form whatsoever must retain the following
  18  *    acknowledgment:
  19  *    "This product includes software developed by Paul Mackerras
  20  *     <paulus@samba.org>".
  21  *
  22  * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
  23  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  24  * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
  25  * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  26  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
  27  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
  28  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  29  */
  30
  31 #define RCSID   "$Id: chap-new.c,v 1.9 2007/06/19 02:08:35 carlsonj Exp $"
  32
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include "pppd.h"
  36 #include "session.h"
  37 #include "chap-new.h"
  38 #include "chap-md5.h"
  39
  40 #ifdef CHAPMS
  41 #include "chap_ms.h"
  42 #define MDTYPE_ALL (MDTYPE_MICROSOFT_V2 | MDTYPE_MICROSOFT | MDTYPE_MD5)
  43 #else
  44 #define MDTYPE_ALL (MDTYPE_MD5)
  45 #endif
  46
  47 int chap_mdtype_all = MDTYPE_ALL;
  48
  49 /* Hook for a plugin to validate CHAP challenge */
  50 int (*chap_verify_hook)(char *name, char *ourname, int id,
  51                         struct chap_digest_type *digest,
  52                         unsigned char *challenge, unsigned char *response,
  53                         char *message, int message_space) = NULL;
  54
  55 /*
  56  * Option variables.
  57  */
  58 int chap_timeout_time = 3;
  59 int chap_max_transmits = 10;
  60 int chap_rechallenge_time = 0;
  61
  62 /*
  63  * Command-line options.
  64  */
  65 static option_t chap_option_list[] = {
  66         { "chap-restart", o_int, &chap_timeout_time,
  67           "Set timeout for CHAP", OPT_PRIO },
  68         { "chap-max-challenge", o_int, &chap_max_transmits,
  69           "Set max #xmits for challenge", OPT_PRIO },
  70         { "chap-interval", o_int, &chap_rechallenge_time,
  71           "Set interval for rechallenge", OPT_PRIO },
  72         { NULL }
  73 };
  74
  75 /*
  76  * Internal state.
  77  */
  78 static struct chap_client_state {
  79         int flags;
  80         char *name;
  81         struct chap_digest_type *digest;
  82         unsigned char priv[64];         /* private area for digest's use */
  83 } client;
  84
  85 /*
  86  * These limits apply to challenge and response packets we send.
  87  * The +4 is the +1 that we actually need rounded up.
  88  */
  89 #define CHAL_MAX_PKTLEN (PPP_HDRLEN + CHAP_HDRLEN + 4 + MAX_CHALLENGE_LEN + MAXNAMELEN)
  90 #define RESP_MAX_PKTLEN (PPP_HDRLEN + CHAP_HDRLEN + 4 + MAX_RESPONSE_LEN + MAXNAMELEN)
  91
  92 static struct chap_server_state {
  93         int flags;
  94         int id;
  95         char *name;
  96         struct chap_digest_type *digest;
  97         int challenge_xmits;
  98         int challenge_pktlen;
  99         unsigned char challenge[CHAL_MAX_PKTLEN];
 100         char message[256];
 101 } server;
 102
 103 /* Values for flags in chap_client_state and chap_server_state */
 104 #define LOWERUP                 1
 105 #define AUTH_STARTED            2
 106 #define AUTH_DONE               4
 107 #define AUTH_FAILED             8
 108 #define TIMEOUT_PENDING         0x10
 109 #define CHALLENGE_VALID         0x20
 110
 111 /*
 112  * Prototypes.
 113  */
 114 static void chap_init(int unit);
 115 static void chap_lowerup(int unit);
 116 static void chap_lowerdown(int unit);
 117 static void chap_timeout(void *arg);
 118 static void chap_generate_challenge(struct chap_server_state *ss);
 119 static void chap_handle_response(struct chap_server_state *ss, int code,
 120                 unsigned char *pkt, int len);
 121 static int chap_verify_response(char *name, char *ourname, int id,
 122                 struct chap_digest_type *digest,
 123                 unsigned char *challenge, unsigned char *response,
 124                 char *message, int message_space);
 125 static void chap_respond(struct chap_client_state *cs, int id,
 126                 unsigned char *pkt, int len);
 127 static void chap_handle_status(struct chap_client_state *cs, int code, int id,
 128                 unsigned char *pkt, int len);
 129 static void chap_protrej(int unit);
 130 static void chap_input(int unit, unsigned char *pkt, int pktlen);
 131 static int chap_print_pkt(unsigned char *p, int plen,
 132                 void (*printer) __P((void *, char *, ...)), void *arg);
 133
 134 /* List of digest types that we know about */
 135 static struct chap_digest_type *chap_digests;
 136
 137 /*
 138  * chap_init - reset to initial state.
 139  */
 140 static void
 141 chap_init(int unit)
 142 {
 143         memset(&client, 0, sizeof(client));
 144         memset(&server, 0, sizeof(server));
 145
 146         chap_md5_init();
 147 #ifdef CHAPMS
 148         chapms_init();
 149 #endif
 150 }
 151
 152 /*
 153  * Add a new digest type to the list.
 154  */
 155 void
 156 chap_register_digest(struct chap_digest_type *dp)
 157 {
 158         dp->next = chap_digests;
 159         chap_digests = dp;
 160 }
 161
 162 /*
 163  * chap_lowerup - we can start doing stuff now.
 164  */
 165 static void
 166 chap_lowerup(int unit)
 167 {
 168         struct chap_client_state *cs = &client;
 169         struct chap_server_state *ss = &server;
 170
 171         cs->flags |= LOWERUP;
 172         ss->flags |= LOWERUP;
 173         if (ss->flags & AUTH_STARTED)
 174                 chap_timeout(ss);
 175 }
 176
 177 static void
 178 chap_lowerdown(int unit)
 179 {
 180         struct chap_client_state *cs = &client;
 181         struct chap_server_state *ss = &server;
 182
 183         cs->flags = 0;
 184         if (ss->flags & TIMEOUT_PENDING)
 185                 UNTIMEOUT(chap_timeout, ss);
 186         ss->flags = 0;
 187 }
 188
 189 /*
 190  * chap_auth_peer - Start authenticating the peer.
 191  * If the lower layer is already up, we start sending challenges,
 192  * otherwise we wait for the lower layer to come up.
 193  */
 194 void
 195 chap_auth_peer(int unit, char *our_name, int digest_code)
 196 {
 197         struct chap_server_state *ss = &server;
 198         struct chap_digest_type *dp;
 199
 200         if (ss->flags & AUTH_STARTED) {
 201                 error("CHAP: peer authentication already started!");
 202                 return;
 203         }
 204         for (dp = chap_digests; dp != NULL; dp = dp->next)
 205                 if (dp->code == digest_code)
 206                         break;
 207         if (dp == NULL)
 208                 fatal("CHAP digest 0x%x requested but not available",
 209                       digest_code);
 210
 211         ss->digest = dp;
 212         ss->name = our_name;
 213         /* Start with a random ID value */
 214         ss->id = (unsigned char)(drand48() * 256);
 215         ss->flags |= AUTH_STARTED;
 216         if (ss->flags & LOWERUP)
 217                 chap_timeout(ss);
 218 }
 219
 220 /*
 221  * chap_auth_with_peer - Prepare to authenticate ourselves to the peer.
 222  * There isn't much to do until we receive a challenge.
 223  */
 224 void
 225 chap_auth_with_peer(int unit, char *our_name, int digest_code)
 226 {
 227         struct chap_client_state *cs = &client;
 228         struct chap_digest_type *dp;
 229
 230         if (cs->flags & AUTH_STARTED) {
 231                 error("CHAP: authentication with peer already started!");
 232                 return;
 233         }
 234         for (dp = chap_digests; dp != NULL; dp = dp->next)
 235                 if (dp->code == digest_code)
 236                         break;
 237         if (dp == NULL)
 238                 fatal("CHAP digest 0x%x requested but not available",
 239                       digest_code);
 240
 241         cs->digest = dp;
 242         cs->name = our_name;
 243         cs->flags |= AUTH_STARTED;
 244 }
 245
 246 /*
 247  * chap_timeout - It's time to send another challenge to the peer.
 248  * This could be either a retransmission of a previous challenge,
 249  * or a new challenge to start re-authentication.
 250  */
 251 static void
 252 chap_timeout(void *arg)
 253 {
 254         struct chap_server_state *ss = arg;
 255
 256         ss->flags &= ~TIMEOUT_PENDING;
 257         if ((ss->flags & CHALLENGE_VALID) == 0) {
 258                 ss->challenge_xmits = 0;
 259                 chap_generate_challenge(ss);
 260                 ss->flags |= CHALLENGE_VALID;
 261         } else if (ss->challenge_xmits >= chap_max_transmits) {
 262                 ss->flags &= ~CHALLENGE_VALID;
 263                 ss->flags |= AUTH_DONE | AUTH_FAILED;
 264                 auth_peer_fail(0, PPP_CHAP);
 265                 return;
 266         }
 267
 268         output(0, ss->challenge, ss->challenge_pktlen);
 269         ++ss->challenge_xmits;
 270         ss->flags |= TIMEOUT_PENDING;
 271         TIMEOUT(chap_timeout, arg, chap_timeout_time);
 272 }
 273
 274 /*
 275  * chap_generate_challenge - generate a challenge string and format
 276  * the challenge packet in ss->challenge_pkt.
 277  */
 278 static void
 279 chap_generate_challenge(struct chap_server_state *ss)
 280 {
 281         int clen = 1, nlen, len;
 282         unsigned char *p;
 283
 284         p = ss->challenge;
 285         MAKEHEADER(p, PPP_CHAP);
 286         p += CHAP_HDRLEN;
 287         ss->digest->generate_challenge(p);
 288         clen = *p;
 289         nlen = strlen(ss->name);
 290         memcpy(p + 1 + clen, ss->name, nlen);
 291
 292         len = CHAP_HDRLEN + 1 + clen + nlen;
 293         ss->challenge_pktlen = PPP_HDRLEN + len;
 294
 295         p = ss->challenge + PPP_HDRLEN;
 296         p[0] = CHAP_CHALLENGE;
 297         p[1] = ++ss->id;
 298         p[2] = len >> 8;
 299         p[3] = len;
 300 }
 301
 302 /*
 303  * chap_handle_response - check the response to our challenge.
 304  */
 305 static void
 306 chap_handle_response(struct chap_server_state *ss, int id,
 307                      unsigned char *pkt, int len)
 308 {
 309         int response_len, ok, mlen;
 310         unsigned char *response, *p;
 311         char *name = NULL;      /* initialized to shut gcc up */
 312         int (*verifier)(char *, char *, int, struct chap_digest_type *,
 313                 unsigned char *, unsigned char *, char *, int);
 314         char rname[MAXNAMELEN+1];
 315
 316         if ((ss->flags & LOWERUP) == 0)
 317                 return;
 318         if (id != ss->challenge[PPP_HDRLEN+1] || len < 2)
 319                 return;
 320         if (ss->flags & CHALLENGE_VALID) {
 321                 response = pkt;
 322                 GETCHAR(response_len, pkt);
 323                 len -= response_len + 1;        /* length of name */
 324                 name = (char *)pkt + response_len;
 325                 if (len < 0)
 326                         return;
 327
 328                 if (ss->flags & TIMEOUT_PENDING) {
 329                         ss->flags &= ~TIMEOUT_PENDING;
 330                         UNTIMEOUT(chap_timeout, ss);
 331                 }
 332
 333                 if (explicit_remote) {
 334                         name = remote_name;
 335                 } else {
 336                         /* Null terminate and clean remote name. */
 337                         slprintf(rname, sizeof(rname), "%.*v", len, name);
 338                         name = rname;
 339                 }
 340
 341                 if (chap_verify_hook)
 342                         verifier = chap_verify_hook;
 343                 else
 344                         verifier = chap_verify_response;
 345                 ok = (*verifier)(name, ss->name, id, ss->digest,
 346                                  ss->challenge + PPP_HDRLEN + CHAP_HDRLEN,
 347                                  response, ss->message, sizeof(ss->message));
 348                 if (!ok || !auth_number()) {
 349                         ss->flags |= AUTH_FAILED;
 350                         warn("Peer %q failed CHAP authentication", name);
 351                 }
 352         } else if ((ss->flags & AUTH_DONE) == 0)
 353                 return;
 354
 355         /* send the response */
 356         p = outpacket_buf;
 357         MAKEHEADER(p, PPP_CHAP);
 358         mlen = strlen(ss->message);
 359         len = CHAP_HDRLEN + mlen;
 360         p[0] = (ss->flags & AUTH_FAILED)? CHAP_FAILURE: CHAP_SUCCESS;
 361         p[1] = id;
 362         p[2] = len >> 8;
 363         p[3] = len;
 364         if (mlen > 0)
 365                 memcpy(p + CHAP_HDRLEN, ss->message, mlen);
 366         output(0, outpacket_buf, PPP_HDRLEN + len);
 367
 368         if (ss->flags & CHALLENGE_VALID) {
 369                 ss->flags &= ~CHALLENGE_VALID;
 370                 if (!(ss->flags & AUTH_DONE) && !(ss->flags & AUTH_FAILED)) {
 371                     /*
 372                      * Auth is OK, so now we need to check session restrictions
 373                      * to ensure everything is OK, but only if we used a
 374                      * plugin, and only if we're configured to check.  This
 375                      * allows us to do PAM checks on PPP servers that
 376                      * authenticate against ActiveDirectory, and use AD for
 377                      * account info (like when using Winbind integrated with
 378                      * PAM).
 379                      */
 380                     if (session_mgmt &&
 381                         session_check(name, NULL, devnam, NULL) == 0) {
 382                         ss->flags |= AUTH_FAILED;
 383                         warn("Peer %q failed CHAP Session verification", name);
 384                     }
 385                 }
 386                 if (ss->flags & AUTH_FAILED) {
 387                         auth_peer_fail(0, PPP_CHAP);
 388                 } else {
 389                         if ((ss->flags & AUTH_DONE) == 0)
 390                                 auth_peer_success(0, PPP_CHAP,
 391                                                   ss->digest->code,
 392                                                   name, strlen(name));
 393                         if (chap_rechallenge_time) {
 394                                 ss->flags |= TIMEOUT_PENDING;
 395                                 TIMEOUT(chap_timeout, ss,
 396                                         chap_rechallenge_time);
 397                         }
 398                 }
 399                 ss->flags |= AUTH_DONE;
 400         }
 401 }
 402
 403 /*
 404  * chap_verify_response - check whether the peer's response matches
 405  * what we think it should be.  Returns 1 if it does (authentication
 406  * succeeded), or 0 if it doesn't.
 407  */
 408 static int
 409 chap_verify_response(char *name, char *ourname, int id,
 410                      struct chap_digest_type *digest,
 411                      unsigned char *challenge, unsigned char *response,
 412                      char *message, int message_space)
 413 {
 414         int ok;
 415         unsigned char secret[MAXSECRETLEN];
 416         int secret_len;
 417
 418         /* Get the secret that the peer is supposed to know */
 419         if (!get_secret(0, name, ourname, (char *)secret, &secret_len, 1)) {
 420                 error("No CHAP secret found for authenticating %q", name);
 421                 return 0;
 422         }
 423
 424         ok = digest->verify_response(id, name, secret, secret_len, challenge,
 425                                      response, message, message_space);
 426         memset(secret, 0, sizeof(secret));
 427
 428         return ok;
 429 }
 430
 431 /*
 432  * chap_respond - Generate and send a response to a challenge.
 433  */
 434 static void
 435 chap_respond(struct chap_client_state *cs, int id,
 436              unsigned char *pkt, int len)
 437 {
 438         int clen, nlen;
 439         int secret_len;
 440         unsigned char *p;
 441         unsigned char response[RESP_MAX_PKTLEN];
 442         char rname[MAXNAMELEN+1];
 443         char secret[MAXSECRETLEN+1];
 444
 445         if ((cs->flags & (LOWERUP | AUTH_STARTED)) != (LOWERUP | AUTH_STARTED))
 446                 return;         /* not ready */
 447         if (len < 2 || len < pkt[0] + 1)
 448                 return;         /* too short */
 449         clen = pkt[0];
 450         nlen = len - (clen + 1);
 451
 452         /* Null terminate and clean remote name. */
 453         slprintf(rname, sizeof(rname), "%.*v", nlen, pkt + clen + 1);
 454
 455         /* Microsoft doesn't send their name back in the PPP packet */
 456         if (explicit_remote || (remote_name[0] != 0 && rname[0] == 0))
 457                 strlcpy(rname, remote_name, sizeof(rname));
 458
 459         /* get secret for authenticating ourselves with the specified host */
 460         if (!get_secret(0, cs->name, rname, secret, &secret_len, 0)) {
 461                 secret_len = 0; /* assume null secret if can't find one */
 462                 warn("No CHAP secret found for authenticating us to %q", rname);
 463         }
 464
 465         p = response;
 466         MAKEHEADER(p, PPP_CHAP);
 467         p += CHAP_HDRLEN;
 468
 469         cs->digest->make_response(p, id, cs->name, pkt,
 470                                   secret, secret_len, cs->priv);
 471         memset(secret, 0, secret_len);
 472
 473         clen = *p;
 474         nlen = strlen(cs->name);
 475         memcpy(p + clen + 1, cs->name, nlen);
 476
 477         p = response + PPP_HDRLEN;
 478         len = CHAP_HDRLEN + clen + 1 + nlen;
 479         p[0] = CHAP_RESPONSE;
 480         p[1] = id;
 481         p[2] = len >> 8;
 482         p[3] = len;
 483
 484         output(0, response, PPP_HDRLEN + len);
 485 }
 486
 487 static void
 488 chap_handle_status(struct chap_client_state *cs, int code, int id,
 489                    unsigned char *pkt, int len)
 490 {
 491         const char *msg = NULL;
 492
 493         if ((cs->flags & (AUTH_DONE|AUTH_STARTED|LOWERUP))
 494             != (AUTH_STARTED|LOWERUP))
 495                 return;
 496         cs->flags |= AUTH_DONE;
 497
 498         if (code == CHAP_SUCCESS) {
 499                 /* used for MS-CHAP v2 mutual auth, yuck */
 500                 if (cs->digest->check_success != NULL) {
 501                         if (!(*cs->digest->check_success)(pkt, len, cs->priv))
 502                                 code = CHAP_FAILURE;
 503                 } else
 504                         msg = "CHAP authentication succeeded";
 505         } else {
 506                 if (cs->digest->handle_failure != NULL)
 507                         (*cs->digest->handle_failure)(pkt, len);
 508                 else
 509                         msg = "CHAP authentication failed";
 510         }
 511         if (msg) {
 512                 if (len > 0)
 513                         info("%s: %.*v", msg, len, pkt);
 514                 else
 515                         info("%s", msg);
 516         }
 517         if (code == CHAP_SUCCESS)
 518                 auth_withpeer_success(0, PPP_CHAP, cs->digest->code);
 519         else {
 520                 cs->flags |= AUTH_FAILED;
 521                 error("CHAP authentication failed");
 522                 auth_withpeer_fail(0, PPP_CHAP);
 523         }
 524 }
 525
 526 static void
 527 chap_input(int unit, unsigned char *pkt, int pktlen)
 528 {
 529         struct chap_client_state *cs = &client;
 530         struct chap_server_state *ss = &server;
 531         unsigned char code, id;
 532         int len;
 533
 534         if (pktlen < CHAP_HDRLEN)
 535                 return;
 536         GETCHAR(code, pkt);
 537         GETCHAR(id, pkt);
 538         GETSHORT(len, pkt);
 539         if (len < CHAP_HDRLEN || len > pktlen)
 540                 return;
 541         len -= CHAP_HDRLEN;
 542
 543         switch (code) {
 544         case CHAP_CHALLENGE:
 545                 chap_respond(cs, id, pkt, len);
 546                 break;
 547         case CHAP_RESPONSE:
 548                 chap_handle_response(ss, id, pkt, len);
 549                 break;
 550         case CHAP_FAILURE:
 551         case CHAP_SUCCESS:
 552                 chap_handle_status(cs, code, id, pkt, len);
 553                 break;
 554         }
 555 }
 556
 557 static void
 558 chap_protrej(int unit)
 559 {
 560         struct chap_client_state *cs = &client;
 561         struct chap_server_state *ss = &server;
 562
 563         if (ss->flags & TIMEOUT_PENDING) {
 564                 ss->flags &= ~TIMEOUT_PENDING;
 565                 UNTIMEOUT(chap_timeout, ss);
 566         }
 567         if (ss->flags & AUTH_STARTED) {
 568                 ss->flags = 0;
 569                 auth_peer_fail(0, PPP_CHAP);
 570         }
 571         if ((cs->flags & (AUTH_STARTED|AUTH_DONE)) == AUTH_STARTED) {
 572                 cs->flags &= ~AUTH_STARTED;
 573                 error("CHAP authentication failed due to protocol-reject");
 574                 auth_withpeer_fail(0, PPP_CHAP);
 575         }
 576 }
 577
 578 /*
 579  * chap_print_pkt - print the contents of a CHAP packet.
 580  */
 581 static char *chap_code_names[] = {
 582         "Challenge", "Response", "Success", "Failure"
 583 };
 584
 585 static int
 586 chap_print_pkt(unsigned char *p, int plen,
 587                void (*printer) __P((void *, char *, ...)), void *arg)
 588 {
 589         int code, id, len;
 590         int clen, nlen;
 591         unsigned char x;
 592
 593         if (plen < CHAP_HDRLEN)
 594                 return 0;
 595         GETCHAR(code, p);
 596         GETCHAR(id, p);
 597         GETSHORT(len, p);
 598         if (len < CHAP_HDRLEN || len > plen)
 599                 return 0;
 600
 601         if (code >= 1 && code <= sizeof(chap_code_names) / sizeof(char *))
 602                 printer(arg, " %s", chap_code_names[code-1]);
 603         else
 604                 printer(arg, " code=0x%x", code);
 605         printer(arg, " id=0x%x", id);
 606         len -= CHAP_HDRLEN;
 607         switch (code) {
 608         case CHAP_CHALLENGE:
 609         case CHAP_RESPONSE:
 610                 if (len < 1)
 611                         break;
 612                 clen = p[0];
 613                 if (len < clen + 1)
 614                         break;
 615                 ++p;
 616                 nlen = len - clen - 1;
 617                 printer(arg, " <");
 618                 for (; clen > 0; --clen) {
 619                         GETCHAR(x, p);
 620                         printer(arg, "%.2x", x);
 621                 }
 622                 printer(arg, ">, name = ");
 623                 print_string((char *)p, nlen, printer, arg);
 624                 break;
 625         case CHAP_FAILURE:
 626         case CHAP_SUCCESS:
 627                 printer(arg, " ");
 628                 print_string((char *)p, len, printer, arg);
 629                 break;
 630         default:
 631                 for (clen = len; clen > 0; --clen) {
 632                         GETCHAR(x, p);
 633                         printer(arg, " %.2x", x);
 634                 }
 635         }
 636
 637         return len + CHAP_HDRLEN;
 638 }
 639
 640 struct protent chap_protent = {
 641         PPP_CHAP,
 642         chap_init,
 643         chap_input,
 644         chap_protrej,
 645         chap_lowerup,
 646         chap_lowerdown,
 647         NULL,           /* open */
 648         NULL,           /* close */
 649         chap_print_pkt,
 650         NULL,           /* datainput */
 651         1,              /* enabled_flag */
 652         "CHAP",         /* name */
 653         NULL,           /* data_name */
 654         chap_option_list,
 655         NULL,           /* check_options */
 656 };