projects / openwrt / svn-archive / archive.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
packages: sort network related packages into package/network/
[openwrt/svn-archive/archive.git] / package / network / services / ppp / patches / 201-mppe_mppc_1.1.patch
1 pppd: add support for MPPE and MPPC encryption and compression protocols
2
3 This is a forward ported version of ppp-2.4.3-mppe-mppc-1.1.patch.gz found on
4 http://mppe-mppc.alphacron.de/ .
5
6 Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
7
8 --- a/include/linux/ppp-comp.h
9 +++ b/include/linux/ppp-comp.h
10 @@ -36,7 +36,7 @@
11 */
12
13 /*
14 - * ==FILEVERSION 20020319==
15 + * ==FILEVERSION 20020715==
16 *
17 * NOTE TO MAINTAINERS:
18 * If you modify this file at all, please set the above date.
19 @@ -201,6 +201,33 @@ struct compressor {
20 #define CI_MPPE 18 /* config option for MPPE */
21 #define CILEN_MPPE 6 /* length of config option */
22
23 +/* MPPE/MPPC definitions by J.D.*/
24 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
25 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
26 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
27 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
28 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
29 +
30 +/*
31 + * Definitions for Stac LZS.
32 + */
33 +
34 +#define CI_LZS 17 /* config option for Stac LZS */
35 +#define CILEN_LZS 5 /* length of config option */
36 +
37 +#define LZS_OVHD 4 /* max. LZS overhead */
38 +#define LZS_HIST_LEN 2048 /* LZS history size */
39 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
40 +
41 +#define LZS_MODE_NONE 0
42 +#define LZS_MODE_LCB 1
43 +#define LZS_MODE_CRC 2
44 +#define LZS_MODE_SEQ 3
45 +#define LZS_MODE_EXT 4
46 +
47 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
48 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
49 +
50 /*
51 * Definitions for other, as yet unsupported, compression methods.
52 */
53 --- a/include/net/ppp-comp.h
54 +++ b/include/net/ppp-comp.h
55 @@ -168,6 +168,33 @@ struct compressor {
56 #define CI_MPPE 18 /* config option for MPPE */
57 #define CILEN_MPPE 6 /* length of config option */
58
59 +/* MPPE/MPPC definitions by J.D.*/
60 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
61 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
62 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
63 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
64 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
65 +
66 +/*
67 + * Definitions for Stac LZS.
68 + */
69 +
70 +#define CI_LZS 17 /* config option for Stac LZS */
71 +#define CILEN_LZS 5 /* length of config option */
72 +
73 +#define LZS_OVHD 4 /* max. LZS overhead */
74 +#define LZS_HIST_LEN 2048 /* LZS history size */
75 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
76 +
77 +#define LZS_MODE_NONE 0
78 +#define LZS_MODE_LCB 1
79 +#define LZS_MODE_CRC 2
80 +#define LZS_MODE_SEQ 3
81 +#define LZS_MODE_EXT 4
82 +
83 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
84 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
85 +
86 /*
87 * Definitions for other, as yet unsupported, compression methods.
88 */
89 --- a/pppd/ccp.c
90 +++ b/pppd/ccp.c
91 @@ -62,12 +62,10 @@ static int setdeflate __P((char **));
92 static char bsd_value[8];
93 static char deflate_value[8];
94
95 -/*
96 - * Option variables.
97 - */
98 #ifdef MPPE
99 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
100 -#endif
101 +static int setmppe(char **);
102 +static int setnomppe(void);
103 +#endif /* MPPE */
104
105 static option_t ccp_option_list[] = {
106 { "noccp", o_bool, &ccp_protent.enabled_flag,
107 @@ -108,54 +106,36 @@ static option_t ccp_option_list[] = {
108 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
109 &ccp_allowoptions[0].predictor_1 },
110
111 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
112 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
113 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
114 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
115 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
116 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
117 + &ccp_allowoptions[0].lzs },
118 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
119 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
120 + &ccp_allowoptions[0].lzs },
121 +
122 #ifdef MPPE
123 - /* MPPE options are symmetrical ... we only set wantoptions here */
124 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
125 - "require MPPE encryption",
126 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
127 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
128 - "require MPPE encryption",
129 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
130 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
131 - "don't allow MPPE encryption", OPT_PRIO },
132 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
133 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
134 -
135 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
136 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
137 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
138 - &ccp_wantoptions[0].mppe },
139 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
140 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
141 - &ccp_wantoptions[0].mppe },
142 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
143 - "don't allow MPPE 40-bit encryption",
144 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
145 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
146 - "don't allow MPPE 40-bit encryption",
147 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
148 - &ccp_wantoptions[0].mppe },
149 -
150 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
151 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
152 - &ccp_wantoptions[0].mppe },
153 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
154 - "require MPPE 128-bit encryption",
155 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
156 - &ccp_wantoptions[0].mppe },
157 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
158 - "don't allow MPPE 128-bit encryption",
159 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
160 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
161 - "don't allow MPPE 128-bit encryption",
162 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
163 - &ccp_wantoptions[0].mppe },
164 -
165 - /* strange one; we always request stateless, but will we allow stateful? */
166 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
167 - "allow MPPE stateful mode", OPT_PRIO },
168 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
169 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
170 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
171 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
172 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
173 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
174 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
175 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
176 + &ccp_allowoptions[0].mppc },
177 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
178 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
179 + &ccp_allowoptions[0].mppc },
180 + { "mppe", o_special, (void *)setmppe,
181 + "request MPPE encryption" },
182 + { "+mppe", o_special, (void *)setmppe,
183 + "request MPPE encryption" },
184 + { "nomppe", o_special_noarg, (void *)setnomppe,
185 + "don't allow MPPE encryption" },
186 + { "-mppe", o_special_noarg, (void *)setnomppe,
187 + "don't allow MPPE encryption" },
188 #endif /* MPPE */
189
190 { NULL }
191 @@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = {
192 */
193 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
194 || (opt).predictor_1 || (opt).predictor_2 \
195 - || (opt).mppe)
196 + || (opt).lzs || (opt).mppc || (opt).mppe)
197
198 /*
199 * Local state (mainly for handling reset-reqs and reset-acks).
200 @@ -344,6 +324,100 @@ setdeflate(argv)
201 return 1;
202 }
203
204 +#ifdef MPPE
205 +/*
206 + * Functions called from config options
207 + */
208 +/*
209 + MPPE suboptions:
210 + required - require MPPE; disconnect if peer doesn't support it
211 + stateless - use stateless mode
212 + no40 - disable 40 bit keys
213 + no56 - disable 56 bit keys
214 + no128 - disable 128 bit keys
215 +*/
216 +int setmppe(char **argv)
217 +{
218 + int i;
219 + char *str, cmdbuf[16];
220 +
221 + ccp_allowoptions[0].mppe = 1;
222 + ccp_allowoptions[0].mppe_40 = 1;
223 + ccp_allowoptions[0].mppe_56 = 1;
224 + ccp_allowoptions[0].mppe_128 = 1;
225 + ccp_allowoptions[0].mppe_stateless = 0;
226 + ccp_wantoptions[0].mppe = 0;
227 +
228 + str = *argv;
229 +
230 + while (1) {
231 + i = 0;
232 + memset(cmdbuf, '\0', 16);
233 + while ((i < 16) && (*str != ',') && (*str != '\0'))
234 + cmdbuf[i++] = *str++;
235 + cmdbuf[i] = '\0';
236 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
237 + ccp_allowoptions[0].mppe_40 = 0;
238 + goto next_param;
239 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
240 + ccp_allowoptions[0].mppe_56 = 0;
241 + goto next_param;
242 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
243 + ccp_allowoptions[0].mppe_128 = 0;
244 + goto next_param;
245 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
246 + ccp_allowoptions[0].mppe_stateless = 1;
247 + goto next_param;
248 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
249 + ccp_wantoptions[0].mppe = 1;
250 + goto next_param;
251 + } else {
252 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
253 + return 0;
254 + }
255 +
256 + next_param:
257 + if (*str == ',') {
258 + str++;
259 + continue;
260 + }
261 + if (*str == '\0') {
262 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
263 + ccp_allowoptions[0].mppe_128)) {
264 + if (ccp_wantoptions[0].mppe == 1) {
265 + option_error("You require MPPE but you have switched off "
266 + "all encryption key lengths.");
267 + return 0;
268 + }
269 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
270 + ccp_wantoptions[0].mppe_stateless =
271 + ccp_allowoptions[0].mppe_stateless = 0;
272 + } else {
273 + ccp_allowoptions[0].mppe = 1;
274 + ccp_wantoptions[0].mppe_stateless =
275 + ccp_allowoptions[0].mppe_stateless;
276 + if (ccp_wantoptions[0].mppe == 1) {
277 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
278 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
279 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
280 + }
281 + }
282 + return 1;
283 + }
284 + }
285 +}
286 +
287 +int setnomppe(void)
288 +{
289 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
290 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
291 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
292 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
293 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
294 + return 1;
295 +}
296 +#endif /* MPPE */
297 +
298 /*
299 * ccp_init - initialize CCP.
300 */
301 @@ -378,6 +452,30 @@ ccp_init(unit)
302 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
303
304 ccp_allowoptions[0].predictor_1 = 1;
305 +
306 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
307 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
308 + ccp_wantoptions[0].lzs_hists = 1;
309 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
310 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
311 + ccp_allowoptions[0].lzs_hists = 1;
312 +
313 +#ifdef MPPE
314 + /* by default allow and request MPPC... */
315 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
316 +
317 + /* ... and allow but don't request MPPE */
318 + ccp_allowoptions[0].mppe = 1;
319 + ccp_allowoptions[0].mppe_40 = 1;
320 + ccp_allowoptions[0].mppe_56 = 1;
321 + ccp_allowoptions[0].mppe_128 = 1;
322 + ccp_allowoptions[0].mppe_stateless = 1;
323 + ccp_wantoptions[0].mppe = 0;
324 + ccp_wantoptions[0].mppe_40 = 0;
325 + ccp_wantoptions[0].mppe_56 = 0;
326 + ccp_wantoptions[0].mppe_128 = 0;
327 + ccp_wantoptions[0].mppe_stateless = 0;
328 +#endif /* MPPE */
329 }
330
331 /*
332 @@ -455,11 +553,11 @@ ccp_input(unit, p, len)
333 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
334 notice("Compression disabled by peer.");
335 #ifdef MPPE
336 - if (ccp_gotoptions[unit].mppe) {
337 + if (ccp_wantoptions[unit].mppe) {
338 error("MPPE disabled, closing LCP");
339 lcp_close(unit, "MPPE disabled by peer");
340 }
341 -#endif
342 +#endif /* MPPE */
343 }
344
345 /*
346 @@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len)
347 break;
348 /* send a reset-ack, which the transmitter will see and
349 reset its compression state. */
350 +
351 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
352 + but we do it in order to reset compressor; CCP_RESETACK is
353 + then silently discarded. See functions ppp_send_frame and
354 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
355 + confusion is caused by the fact that CCP code is splited
356 + into two parts - one part is handled by pppd, the other one
357 + is handled by kernel. */
358 +
359 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
360 break;
361
362 @@ -515,12 +622,11 @@ ccp_protrej(unit)
363 fsm_lowerdown(&ccp_fsm[unit]);
364
365 #ifdef MPPE
366 - if (ccp_gotoptions[unit].mppe) {
367 + if (ccp_wantoptions[unit].mppe) {
368 error("MPPE required but peer negotiation failed");
369 lcp_close(unit, "MPPE required but peer negotiation failed");
370 }
371 -#endif
372 -
373 +#endif /* MPPE */
374 }
375
376 /*
377 @@ -537,7 +643,7 @@ ccp_resetci(f)
378 all_rejected[f->unit] = 0;
379
380 #ifdef MPPE
381 - if (go->mppe) {
382 + if (go->mppe || go->mppc) {
383 ccp_options *ao = &ccp_allowoptions[f->unit];
384 int auth_mschap_bits = auth_done[f->unit];
385 int numbits;
386 @@ -551,80 +657,109 @@ ccp_resetci(f)
387 * NB: If MPPE is required, all other compression opts are invalid.
388 * So, we return right away if we can't do it.
389 */
390 + if (ccp_wantoptions[f->unit].mppe) {
391 + /* Leave only the mschap auth bits set */
392 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
393 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
394 + /* Count the mschap auths */
395 + auth_mschap_bits >>= CHAP_MS_SHIFT;
396 + numbits = 0;
397 + do {
398 + numbits += auth_mschap_bits & 1;
399 + auth_mschap_bits >>= 1;
400 + } while (auth_mschap_bits);
401 + if (numbits > 1) {
402 + error("MPPE required, but auth done in both directions.");
403 + lcp_close(f->unit, "MPPE required but not available");
404 + return;
405 + }
406 + if (!numbits) {
407 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
408 + lcp_close(f->unit, "MPPE required but not available");
409 + return;
410 + }
411
412 - /* Leave only the mschap auth bits set */
413 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
414 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
415 - /* Count the mschap auths */
416 - auth_mschap_bits >>= CHAP_MS_SHIFT;
417 - numbits = 0;
418 - do {
419 - numbits += auth_mschap_bits & 1;
420 - auth_mschap_bits >>= 1;
421 - } while (auth_mschap_bits);
422 - if (numbits > 1) {
423 - error("MPPE required, but auth done in both directions.");
424 - lcp_close(f->unit, "MPPE required but not available");
425 - return;
426 - }
427 - if (!numbits) {
428 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
429 - lcp_close(f->unit, "MPPE required but not available");
430 - return;
431 - }
432 -
433 - /* A plugin (eg radius) may not have obtained key material. */
434 - if (!mppe_keys_set) {
435 - error("MPPE required, but keys are not available. "
436 - "Possible plugin problem?");
437 - lcp_close(f->unit, "MPPE required but not available");
438 - return;
439 - }
440 -
441 - /* LM auth not supported for MPPE */
442 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
443 - /* This might be noise */
444 - if (go->mppe & MPPE_OPT_40) {
445 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
446 - go->mppe &= ~MPPE_OPT_40;
447 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
448 + /* A plugin (eg radius) may not have obtained key material. */
449 + if (!mppe_keys_set) {
450 + error("MPPE required, but keys are not available. "
451 + "Possible plugin problem?");
452 + lcp_close(f->unit, "MPPE required but not available");
453 + return;
454 }
455 }
456
457 - /* Last check: can we actually negotiate something? */
458 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
459 - /* Could be misconfig, could be 40-bit disabled above. */
460 - error("MPPE required, but both 40-bit and 128-bit disabled.");
461 - lcp_close(f->unit, "MPPE required but not available");
462 - return;
463 + /*
464 + * Check whether the kernel knows about the various
465 + * compression methods we might request. Key material
466 + * unimportant here.
467 + */
468 + if (go->mppc) {
469 + opt_buf[0] = CI_MPPE;
470 + opt_buf[1] = CILEN_MPPE;
471 + opt_buf[2] = 0;
472 + opt_buf[3] = 0;
473 + opt_buf[4] = 0;
474 + opt_buf[5] = MPPE_MPPC;
475 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
476 + go->mppc = 0;
477 + }
478 + if (go->mppe_40) {
479 + opt_buf[0] = CI_MPPE;
480 + opt_buf[1] = CILEN_MPPE;
481 + opt_buf[2] = MPPE_STATELESS;
482 + opt_buf[3] = 0;
483 + opt_buf[4] = 0;
484 + opt_buf[5] = MPPE_40BIT;
485 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
486 + go->mppe_40 = 0;
487 + }
488 + if (go->mppe_56) {
489 + opt_buf[0] = CI_MPPE;
490 + opt_buf[1] = CILEN_MPPE;
491 + opt_buf[2] = MPPE_STATELESS;
492 + opt_buf[3] = 0;
493 + opt_buf[4] = 0;
494 + opt_buf[5] = MPPE_56BIT;
495 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
496 + go->mppe_56 = 0;
497 + }
498 + if (go->mppe_128) {
499 + opt_buf[0] = CI_MPPE;
500 + opt_buf[1] = CILEN_MPPE;
501 + opt_buf[2] = MPPE_STATELESS;
502 + opt_buf[3] = 0;
503 + opt_buf[4] = 0;
504 + opt_buf[5] = MPPE_128BIT;
505 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
506 + go->mppe_128 = 0;
507 + }
508 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
509 + if (ccp_wantoptions[f->unit].mppe) {
510 + error("MPPE required, but kernel has no support.");
511 + lcp_close(f->unit, "MPPE required but not available");
512 + }
513 + go->mppe = go->mppe_stateless = 0;
514 + } else {
515 + /* MPPE is not compatible with other compression types */
516 + if (ccp_wantoptions[f->unit].mppe) {
517 + ao->bsd_compress = go->bsd_compress = 0;
518 + ao->predictor_1 = go->predictor_1 = 0;
519 + ao->predictor_2 = go->predictor_2 = 0;
520 + ao->deflate = go->deflate = 0;
521 + ao->lzs = go->lzs = 0;
522 + }
523 }
524 -
525 - /* sync options */
526 - ao->mppe = go->mppe;
527 - /* MPPE is not compatible with other compression types */
528 - ao->bsd_compress = go->bsd_compress = 0;
529 - ao->predictor_1 = go->predictor_1 = 0;
530 - ao->predictor_2 = go->predictor_2 = 0;
531 - ao->deflate = go->deflate = 0;
532 }
533 #endif /* MPPE */
534 -
535 - /*
536 - * Check whether the kernel knows about the various
537 - * compression methods we might request.
538 - */
539 -#ifdef MPPE
540 - if (go->mppe) {
541 - opt_buf[0] = CI_MPPE;
542 - opt_buf[1] = CILEN_MPPE;
543 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
544 - /* Key material unimportant here. */
545 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
546 - error("MPPE required, but kernel has no support.");
547 - lcp_close(f->unit, "MPPE required but not available");
548 - }
549 + if (go->lzs) {
550 + opt_buf[0] = CI_LZS;
551 + opt_buf[1] = CILEN_LZS;
552 + opt_buf[2] = go->lzs_hists >> 8;
553 + opt_buf[3] = go->lzs_hists & 0xff;
554 + opt_buf[4] = LZS_MODE_SEQ;
555 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
556 + go->lzs = 0;
557 }
558 -#endif
559 if (go->bsd_compress) {
560 opt_buf[0] = CI_BSD_COMPRESS;
561 opt_buf[1] = CILEN_BSD_COMPRESS;
562 @@ -679,7 +814,8 @@ ccp_cilen(f)
563 + (go->deflate? CILEN_DEFLATE: 0)
564 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
565 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
566 - + (go->mppe? CILEN_MPPE: 0);
567 + + (go->lzs? CILEN_LZS: 0)
568 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
569 }
570
571 /*
572 @@ -693,6 +829,8 @@ ccp_addci(f, p, lenp)
573 {
574 int res;
575 ccp_options *go = &ccp_gotoptions[f->unit];
576 + ccp_options *ao = &ccp_allowoptions[f->unit];
577 + ccp_options *wo = &ccp_wantoptions[f->unit];
578 u_char *p0 = p;
579
580 /*
581 @@ -701,22 +839,43 @@ ccp_addci(f, p, lenp)
582 * in case it gets Acked.
583 */
584 #ifdef MPPE
585 - if (go->mppe) {
586 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
587 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
588
589 - p[0] = opt_buf[0] = CI_MPPE;
590 - p[1] = opt_buf[1] = CILEN_MPPE;
591 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
592 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
593 + p[0] = CI_MPPE;
594 + p[1] = CILEN_MPPE;
595 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
596 + p[3] = 0;
597 + p[4] = 0;
598 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
599 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
600 +
601 + BCOPY(p, opt_buf, CILEN_MPPE);
602 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
603 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
604 - if (res > 0)
605 + if (res > 0) {
606 p += CILEN_MPPE;
607 - else
608 + } else {
609 /* This shouldn't happen, we've already tested it! */
610 - lcp_close(f->unit, "MPPE required but not available in kernel");
611 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
612 + go->mppe_stateless = go->mppc = 0;
613 + if (ccp_wantoptions[f->unit].mppe)
614 + lcp_close(f->unit, "MPPE required but not available in kernel");
615 + }
616 + }
617 +#endif /* MPPE */
618 + if (go->lzs) {
619 + p[0] = CI_LZS;
620 + p[1] = CILEN_LZS;
621 + p[2] = go->lzs_hists >> 8;
622 + p[3] = go->lzs_hists & 0xff;
623 + p[4] = LZS_MODE_SEQ;
624 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
625 + if (res > 0) {
626 + p += CILEN_LZS;
627 + } else
628 + go->lzs = 0;
629 }
630 -#endif
631 if (go->deflate) {
632 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
633 p[1] = CILEN_DEFLATE;
634 @@ -802,7 +961,7 @@ ccp_addci(f, p, lenp)
635
636 /*
637 * ccp_ackci - process a received configure-ack, and return
638 - * 1 iff the packet was OK.
639 + * 1 if the packet was OK.
640 */
641 static int
642 ccp_ackci(f, p, len)
643 @@ -811,24 +970,44 @@ ccp_ackci(f, p, len)
644 int len;
645 {
646 ccp_options *go = &ccp_gotoptions[f->unit];
647 + ccp_options *ao = &ccp_allowoptions[f->unit];
648 + ccp_options *wo = &ccp_wantoptions[f->unit];
649 u_char *p0 = p;
650
651 #ifdef MPPE
652 - if (go->mppe) {
653 - u_char opt_buf[CILEN_MPPE];
654 -
655 - opt_buf[0] = CI_MPPE;
656 - opt_buf[1] = CILEN_MPPE;
657 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
658 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
659 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
660 + if (len < CILEN_MPPE
661 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
662 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
663 + || p[3] != 0
664 + || p[4] != 0
665 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
666 + (go->mppc ? MPPE_MPPC : 0))
667 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
668 + (go->mppc ? MPPE_MPPC : 0))
669 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
670 + (go->mppc ? MPPE_MPPC : 0))))
671 return 0;
672 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
673 + go->mppe = 1;
674 p += CILEN_MPPE;
675 len -= CILEN_MPPE;
676 + /* Cope with first/fast ack */
677 + if (p == p0 && len == 0)
678 + return 1;
679 + }
680 +#endif /* MPPE */
681 + if (go->lzs) {
682 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
683 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
684 + || p[4] != LZS_MODE_SEQ)
685 + return 0;
686 + p += CILEN_LZS;
687 + len -= CILEN_LZS;
688 /* XXX Cope with first/fast ack */
689 - if (len == 0)
690 + if (p == p0 && len == 0)
691 return 1;
692 }
693 -#endif
694 if (go->deflate) {
695 if (len < CILEN_DEFLATE
696 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
697 @@ -901,6 +1080,8 @@ ccp_nakci(f, p, len, treat_as_reject)
698 int treat_as_reject;
699 {
700 ccp_options *go = &ccp_gotoptions[f->unit];
701 + ccp_options *ao = &ccp_allowoptions[f->unit];
702 + ccp_options *wo = &ccp_wantoptions[f->unit];
703 ccp_options no; /* options we've seen already */
704 ccp_options try; /* options to ask for next time */
705
706 @@ -908,28 +1089,100 @@ ccp_nakci(f, p, len, treat_as_reject)
707 try = *go;
708
709 #ifdef MPPE
710 - if (go->mppe && len >= CILEN_MPPE
711 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
712 - no.mppe = 1;
713 - /*
714 - * Peer wants us to use a different strength or other setting.
715 - * Fail if we aren't willing to use his suggestion.
716 - */
717 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
718 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
719 - error("Refusing MPPE stateful mode offered by peer");
720 - try.mppe = 0;
721 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
722 - /* Peer must have set options we didn't request (suggest) */
723 - try.mppe = 0;
724 - }
725 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
726 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
727
728 - if (!try.mppe) {
729 - error("MPPE required but peer negotiation failed");
730 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
731 + if (go->mppc) {
732 + no.mppc = 1;
733 + if (!(p[5] & MPPE_MPPC))
734 + try.mppc = 0;
735 + }
736 +
737 + if (go->mppe)
738 + no.mppe = 1;
739 + if (go->mppe_40)
740 + no.mppe_40 = 1;
741 + if (go->mppe_56)
742 + no.mppe_56 = 1;
743 + if (go->mppe_128)
744 + no.mppe_128 = 1;
745 + if (go->mppe_stateless)
746 + no.mppe_stateless = 1;
747 +
748 + if (ao->mppe_40) {
749 + if ((p[5] & MPPE_40BIT))
750 + try.mppe_40 = 1;
751 + else
752 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
753 + }
754 + if (ao->mppe_56) {
755 + if ((p[5] & MPPE_56BIT))
756 + try.mppe_56 = 1;
757 + else
758 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
759 + }
760 + if (ao->mppe_128) {
761 + if ((p[5] & MPPE_128BIT))
762 + try.mppe_128 = 1;
763 + else
764 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
765 + }
766 +
767 + if (ao->mppe_stateless) {
768 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
769 + try.mppe_stateless = 1;
770 + else
771 + try.mppe_stateless = 0;
772 + }
773 +
774 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
775 + try.mppe = try.mppe_stateless = 0;
776 + if (wo->mppe) {
777 + /* we require encryption, but peer doesn't support it
778 + so we close connection */
779 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
780 + wo->mppe_56 = wo->mppe_128 = 0;
781 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
782 + "key length");
783 + }
784 + }
785 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
786 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
787 + /* cannot negotiate key length */
788 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
789 + wo->mppe_56 = wo->mppe_128 = 0;
790 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
791 }
792 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
793 + try.mppe_40 = try.mppe_56 = 0;
794 + else
795 + if (try.mppe_56 && try.mppe_128)
796 + try.mppe_56 = 0;
797 + else
798 + if (try.mppe_40 && try.mppe_128)
799 + try.mppe_40 = 0;
800 + else
801 + if (try.mppe_40 && try.mppe_56)
802 + try.mppe_40 = 0;
803 +
804 + p += CILEN_MPPE;
805 + len -= CILEN_MPPE;
806 }
807 #endif /* MPPE */
808 +
809 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
810 + no.lzs = 1;
811 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
812 + p[4] != LZS_MODE_EXT))
813 + try.lzs = 0;
814 + else {
815 + try.lzs_mode = p[4];
816 + try.lzs_hists = (p[2] << 8) | p[3];
817 + }
818 + p += CILEN_LZS;
819 + len -= CILEN_LZS;
820 + }
821 +
822 if (go->deflate && len >= CILEN_DEFLATE
823 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
824 && p[1] == CILEN_DEFLATE) {
825 @@ -1002,14 +1255,50 @@ ccp_rejci(f, p, len)
826 return -1;
827
828 #ifdef MPPE
829 - if (go->mppe && len >= CILEN_MPPE
830 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
831 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
832 - error("MPPE required but peer refused");
833 - lcp_close(f->unit, "MPPE required but peer refused");
834 + ccp_options *wo = &ccp_wantoptions[f->unit];
835 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
836 + p[3] != 0 ||
837 + p[4] != 0 ||
838 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
839 + (go->mppe_56 ? MPPE_56BIT : 0) |
840 + (go->mppe_128 ? MPPE_128BIT : 0) |
841 + (go->mppc ? MPPE_MPPC : 0)))
842 + return 0;
843 + if (go->mppc)
844 + try.mppc = 0;
845 + if (go->mppe) {
846 + try.mppe = 0;
847 + if (go->mppe_40)
848 + try.mppe_40 = 0;
849 + if (go->mppe_56)
850 + try.mppe_56 = 0;
851 + if (go->mppe_128)
852 + try.mppe_128 = 0;
853 + if (go->mppe_stateless)
854 + try.mppe_stateless = 0;
855 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
856 + try.mppe = try.mppe_stateless = 0;
857 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
858 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
859 + wo->mppe_56 = wo->mppe_128 = 0;
860 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
861 + "key length");
862 + }
863 + }
864 p += CILEN_MPPE;
865 len -= CILEN_MPPE;
866 }
867 -#endif
868 +#endif /* MPPE */
869 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
870 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
871 + || p[4] != go->lzs_mode)
872 + return 0;
873 + try.lzs = 0;
874 + p += CILEN_LZS;
875 + len -= CILEN_LZS;
876 + }
877 if (go->deflate_correct && len >= CILEN_DEFLATE
878 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
879 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
880 @@ -1073,14 +1362,15 @@ ccp_reqci(f, p, lenp, dont_nak)
881 int dont_nak;
882 {
883 int ret, newret, res;
884 - u_char *p0, *retp;
885 + u_char *p0, *retp, p2, p5;
886 int len, clen, type, nb;
887 ccp_options *ho = &ccp_hisoptions[f->unit];
888 ccp_options *ao = &ccp_allowoptions[f->unit];
889 + ccp_options *wo = &ccp_wantoptions[f->unit];
890 #ifdef MPPE
891 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
892 - /* CI_MPPE, or due to other options? */
893 -#endif
894 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
895 +/* int mtu; */
896 +#endif /* MPPE */
897
898 ret = CONFACK;
899 retp = p0 = p;
900 @@ -1103,106 +1393,302 @@ ccp_reqci(f, p, lenp, dont_nak)
901 switch (type) {
902 #ifdef MPPE
903 case CI_MPPE:
904 - if (!ao->mppe || clen != CILEN_MPPE) {
905 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
906 newret = CONFREJ;
907 break;
908 }
909 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
910 -
911 - /* Nak if anything unsupported or unknown are set. */
912 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
913 - newret = CONFNAK;
914 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
915 - }
916 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
917 + p2 = p[2];
918 + p5 = p[5];
919 + /* not sure what they want, tell 'em what we got */
920 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
921 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
922 + MPPE_MPPC)) != 0 || p[5] == 0) ||
923 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
924 newret = CONFNAK;
925 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
926 - }
927 -
928 - /* Check state opt */
929 - if (ho->mppe & MPPE_OPT_STATEFUL) {
930 - /*
931 - * We can Nak and request stateless, but it's a
932 - * lot easier to just assume the peer will request
933 - * it if he can do it; stateful mode is bad over
934 - * the Internet -- which is where we expect MPPE.
935 - */
936 - if (refuse_mppe_stateful) {
937 - error("Refusing MPPE stateful mode offered by peer");
938 - newret = CONFREJ;
939 - break;
940 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
941 + p[3] = 0;
942 + p[4] = 0;
943 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
944 + (wo->mppe_56 ? MPPE_56BIT : 0) |
945 + (wo->mppe_128 ? MPPE_128BIT : 0) |
946 + (wo->mppc ? MPPE_MPPC : 0);
947 + break;
948 + }
949 +
950 + if ((p[5] & MPPE_MPPC)) {
951 + if (ao->mppc) {
952 + ho->mppc = 1;
953 + BCOPY(p, opt_buf, CILEN_MPPE);
954 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
955 + opt_buf[5] = MPPE_MPPC;
956 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
957 + ho->mppc = 0;
958 + p[5] &= ~MPPE_MPPC;
959 + newret = CONFNAK;
960 + }
961 + } else {
962 + newret = CONFREJ;
963 + if (wo->mppe || ao->mppe) {
964 + p[5] &= ~MPPE_MPPC;
965 + newret = CONFNAK;
966 + }
967 }
968 }
969 -
970 - /* Find out which of {S,L} are set. */
971 - if ((ho->mppe & MPPE_OPT_128)
972 - && (ho->mppe & MPPE_OPT_40)) {
973 - /* Both are set, negotiate the strongest. */
974 - newret = CONFNAK;
975 - if (ao->mppe & MPPE_OPT_128)
976 - ho->mppe &= ~MPPE_OPT_40;
977 - else if (ao->mppe & MPPE_OPT_40)
978 - ho->mppe &= ~MPPE_OPT_128;
979 - else {
980 - newret = CONFREJ;
981 - break;
982 - }
983 - } else if (ho->mppe & MPPE_OPT_128) {
984 - if (!(ao->mppe & MPPE_OPT_128)) {
985 - newret = CONFREJ;
986 - break;
987 - }
988 - } else if (ho->mppe & MPPE_OPT_40) {
989 - if (!(ao->mppe & MPPE_OPT_40)) {
990 - newret = CONFREJ;
991 - break;
992 - }
993 + if (ao->mppe)
994 + ho->mppe = 1;
995 +
996 + if ((p[2] & MPPE_STATELESS)) {
997 + if (ao->mppe_stateless) {
998 + if (wo->mppe_stateless)
999 + ho->mppe_stateless = 1;
1000 + else {
1001 + newret = CONFNAK;
1002 + if (!dont_nak)
1003 + p[2] &= ~MPPE_STATELESS;
1004 + }
1005 + } else {
1006 + newret = CONFNAK;
1007 + if (!dont_nak)
1008 + p[2] &= ~MPPE_STATELESS;
1009 + }
1010 + } else {
1011 + if (wo->mppe_stateless && !dont_nak) {
1012 + wo->mppe_stateless = 0;
1013 + newret = CONFNAK;
1014 + p[2] |= MPPE_STATELESS;
1015 + }
1016 + }
1017 +
1018 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1019 + newret = CONFNAK;
1020 + if (ao->mppe_128) {
1021 + ho->mppe_128 = 1;
1022 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1023 + BCOPY(p, opt_buf, CILEN_MPPE);
1024 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1025 + MPPE_MAX_KEY_LEN);
1026 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1027 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1028 + ho->mppe_128 = 0;
1029 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1030 + p[5] &= ~MPPE_128BIT;
1031 + goto check_mppe_56_40;
1032 + }
1033 + goto check_mppe;
1034 + }
1035 + p[5] &= ~MPPE_128BIT;
1036 + goto check_mppe_56_40;
1037 + }
1038 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1039 + newret = CONFNAK;
1040 + if (ao->mppe_128) {
1041 + ho->mppe_128 = 1;
1042 + p[5] &= ~MPPE_56BIT;
1043 + BCOPY(p, opt_buf, CILEN_MPPE);
1044 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1045 + MPPE_MAX_KEY_LEN);
1046 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1047 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1048 + ho->mppe_128 = 0;
1049 + p[5] |= MPPE_56BIT;
1050 + p[5] &= ~MPPE_128BIT;
1051 + goto check_mppe_56;
1052 + }
1053 + goto check_mppe;
1054 + }
1055 + p[5] &= ~MPPE_128BIT;
1056 + goto check_mppe_56;
1057 + }
1058 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1059 + newret = CONFNAK;
1060 + if (ao->mppe_128) {
1061 + ho->mppe_128 = 1;
1062 + p[5] &= ~MPPE_40BIT;
1063 + BCOPY(p, opt_buf, CILEN_MPPE);
1064 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1065 + MPPE_MAX_KEY_LEN);
1066 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1067 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1068 + ho->mppe_128 = 0;
1069 + p[5] |= MPPE_40BIT;
1070 + p[5] &= ~MPPE_128BIT;
1071 + goto check_mppe_40;
1072 + }
1073 + goto check_mppe;
1074 + }
1075 + p[5] &= ~MPPE_128BIT;
1076 + goto check_mppe_40;
1077 + }
1078 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1079 + if (ao->mppe_128) {
1080 + ho->mppe_128 = 1;
1081 + BCOPY(p, opt_buf, CILEN_MPPE);
1082 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1083 + MPPE_MAX_KEY_LEN);
1084 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1085 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1086 + ho->mppe_128 = 0;
1087 + p[5] &= ~MPPE_128BIT;
1088 + newret = CONFNAK;
1089 + }
1090 + goto check_mppe;
1091 + }
1092 + p[5] &= ~MPPE_128BIT;
1093 + newret = CONFNAK;
1094 + goto check_mppe;
1095 + }
1096 + check_mppe_56_40:
1097 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1098 + newret = CONFNAK;
1099 + if (ao->mppe_56) {
1100 + ho->mppe_56 = 1;
1101 + p[5] &= ~MPPE_40BIT;
1102 + BCOPY(p, opt_buf, CILEN_MPPE);
1103 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1104 + MPPE_MAX_KEY_LEN);
1105 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1106 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1107 + ho->mppe_56 = 0;
1108 + p[5] |= MPPE_40BIT;
1109 + p[5] &= ~MPPE_56BIT;
1110 + newret = CONFNAK;
1111 + goto check_mppe_40;
1112 + }
1113 + goto check_mppe;
1114 + }
1115 + p[5] &= ~MPPE_56BIT;
1116 + goto check_mppe_40;
1117 + }
1118 + check_mppe_56:
1119 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1120 + if (ao->mppe_56) {
1121 + ho->mppe_56 = 1;
1122 + BCOPY(p, opt_buf, CILEN_MPPE);
1123 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1124 + MPPE_MAX_KEY_LEN);
1125 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1126 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1127 + ho->mppe_56 = 0;
1128 + p[5] &= ~MPPE_56BIT;
1129 + newret = CONFNAK;
1130 + }
1131 + goto check_mppe;
1132 + }
1133 + p[5] &= ~MPPE_56BIT;
1134 + newret = CONFNAK;
1135 + goto check_mppe;
1136 + }
1137 + check_mppe_40:
1138 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1139 + if (ao->mppe_40) {
1140 + ho->mppe_40 = 1;
1141 + BCOPY(p, opt_buf, CILEN_MPPE);
1142 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1143 + MPPE_MAX_KEY_LEN);
1144 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1145 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1146 + ho->mppe_40 = 0;
1147 + p[5] &= ~MPPE_40BIT;
1148 + newret = CONFNAK;
1149 + }
1150 + goto check_mppe;
1151 + }
1152 + p[5] &= ~MPPE_40BIT;
1153 + }
1154 +
1155 + check_mppe:
1156 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1157 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1158 + newret = CONFNAK;
1159 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1160 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1161 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1162 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1163 + (wo->mppc ? MPPE_MPPC : 0);
1164 + } else {
1165 + ho->mppe = ho->mppe_stateless = 0;
1166 + }
1167 } else {
1168 - /* Neither are set. */
1169 - /* We cannot accept this. */
1170 - newret = CONFNAK;
1171 - /* Give the peer our idea of what can be used,
1172 - so it can choose and confirm */
1173 - ho->mppe = ao->mppe;
1174 - }
1175 -
1176 - /* rebuild the opts */
1177 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1178 - if (newret == CONFACK) {
1179 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1180 - int mtu;
1181 -
1182 - BCOPY(p, opt_buf, CILEN_MPPE);
1183 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1184 - MPPE_MAX_KEY_LEN);
1185 - if (ccp_test(f->unit, opt_buf,
1186 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1187 - /* This shouldn't happen, we've already tested it! */
1188 - error("MPPE required, but kernel has no support.");
1189 - lcp_close(f->unit, "MPPE required but not available");
1190 - newret = CONFREJ;
1191 - break;
1192 - }
1193 - /*
1194 - * We need to decrease the interface MTU by MPPE_PAD
1195 - * because MPPE frames **grow**. The kernel [must]
1196 - * allocate MPPE_PAD extra bytes in xmit buffers.
1197 - */
1198 - mtu = netif_get_mtu(f->unit);
1199 - if (mtu)
1200 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1201 - else
1202 - newret = CONFREJ;
1203 - }
1204 -
1205 - /*
1206 - * We have accepted MPPE or are willing to negotiate
1207 - * MPPE parameters. A CONFREJ is due to subsequent
1208 - * (non-MPPE) processing.
1209 - */
1210 - rej_for_ci_mppe = 0;
1211 - break;
1212 -#endif /* MPPE */
1213 + /* MPPE is not compatible with other compression types */
1214 + if (wo->mppe) {
1215 + ao->bsd_compress = 0;
1216 + ao->predictor_1 = 0;
1217 + ao->predictor_2 = 0;
1218 + ao->deflate = 0;
1219 + ao->lzs = 0;
1220 + }
1221 + }
1222 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1223 + p[2] = p2;
1224 + p[5] = p5;
1225 + newret = CONFREJ;
1226 + break;
1227 + }
1228 +
1229 + /*
1230 + * I have commented the code below because according to RFC1547
1231 + * MTU is only information for higher level protocols about
1232 + * "the maximum allowable length for a packet (q.v.) transmitted
1233 + * over a point-to-point link without incurring network layer
1234 + * fragmentation." Of course a PPP implementation should be able
1235 + * to handle overhead added by MPPE - in our case apropriate code
1236 + * is located in drivers/net/ppp_generic.c in the kernel sources.
1237 + *
1238 + * According to RFC1661:
1239 + * - when negotiated MRU is less than 1500 octets, a PPP
1240 + * implementation must still be able to receive at least 1500
1241 + * octets,
1242 + * - when PFC is negotiated, a PPP implementation is still
1243 + * required to receive frames with uncompressed protocol field.
1244 + *
1245 + * So why not to handle MPPE overhead without changing MTU value?
1246 + * I am sure that RFC3078, unfortunately silently, assumes that.
1247 + */
1248 +
1249 + /*
1250 + * We need to decrease the interface MTU by MPPE_PAD
1251 + * because MPPE frames **grow**. The kernel [must]
1252 + * allocate MPPE_PAD extra bytes in xmit buffers.
1253 + */
1254 + /*
1255 + mtu = netif_get_mtu(f->unit);
1256 + if (mtu) {
1257 + netif_set_mtu(f->unit, mtu - MPPE_PAD);
1258 + } else {
1259 + newret = CONFREJ;
1260 + if (ccp_wantoptions[f->unit].mppe) {
1261 + error("Cannot adjust MTU needed by MPPE.");
1262 + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1263 + }
1264 + }
1265 + */
1266 + break;
1267 + #endif /* MPPE */
1268 +
1269 + case CI_LZS:
1270 + if (!ao->lzs || clen != CILEN_LZS) {
1271 + newret = CONFREJ;
1272 + break;
1273 + }
1274 +
1275 + ho->lzs = 1;
1276 + ho->lzs_hists = (p[2] << 8) | p[3];
1277 + ho->lzs_mode = p[4];
1278 + if ((ho->lzs_hists != ao->lzs_hists) ||
1279 + (ho->lzs_mode != ao->lzs_mode)) {
1280 + newret = CONFNAK;
1281 + if (!dont_nak) {
1282 + p[2] = ao->lzs_hists >> 8;
1283 + p[3] = ao->lzs_hists & 0xff;
1284 + p[4] = ao->lzs_mode;
1285 + } else
1286 + break;
1287 + }
1288 +
1289 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1290 + newret = CONFREJ;
1291 + }
1292 + break;
1293 case CI_DEFLATE:
1294 case CI_DEFLATE_DRAFT:
1295 if (!ao->deflate || clen != CILEN_DEFLATE
1296 @@ -1344,12 +1830,6 @@ ccp_reqci(f, p, lenp, dont_nak)
1297 else
1298 *lenp = retp - p0;
1299 }
1300 -#ifdef MPPE
1301 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1302 - error("MPPE required but peer negotiation failed");
1303 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1304 - }
1305 -#endif
1306 return ret;
1307 }
1308
1309 @@ -1371,24 +1851,35 @@ method_name(opt, opt2)
1310 char *p = result;
1311 char *q = result + sizeof(result); /* 1 past result */
1312
1313 - slprintf(p, q - p, "MPPE ");
1314 - p += 5;
1315 - if (opt->mppe & MPPE_OPT_128) {
1316 - slprintf(p, q - p, "128-bit ");
1317 - p += 8;
1318 - }
1319 - if (opt->mppe & MPPE_OPT_40) {
1320 - slprintf(p, q - p, "40-bit ");
1321 - p += 7;
1322 - }
1323 - if (opt->mppe & MPPE_OPT_STATEFUL)
1324 - slprintf(p, q - p, "stateful");
1325 - else
1326 - slprintf(p, q - p, "stateless");
1327 -
1328 + if (opt->mppe) {
1329 + if (opt->mppc) {
1330 + slprintf(p, q - p, "MPPC/MPPE ");
1331 + p += 10;
1332 + } else {
1333 + slprintf(p, q - p, "MPPE ");
1334 + p += 5;
1335 + }
1336 + if (opt->mppe_128) {
1337 + slprintf(p, q - p, "128-bit ");
1338 + p += 8;
1339 + } else if (opt->mppe_56) {
1340 + slprintf(p, q - p, "56-bit ");
1341 + p += 7;
1342 + } else if (opt->mppe_40) {
1343 + slprintf(p, q - p, "40-bit ");
1344 + p += 7;
1345 + }
1346 + if (opt->mppe_stateless)
1347 + slprintf(p, q - p, "stateless");
1348 + else
1349 + slprintf(p, q - p, "stateful");
1350 + } else if (opt->mppc)
1351 + slprintf(p, q - p, "MPPC");
1352 break;
1353 }
1354 -#endif
1355 +#endif /* MPPE */
1356 + case CI_LZS:
1357 + return "Stac LZS";
1358 case CI_DEFLATE:
1359 case CI_DEFLATE_DRAFT:
1360 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1361 @@ -1444,12 +1935,12 @@ ccp_up(f)
1362 } else if (ANY_COMPRESS(*ho))
1363 notice("%s transmit compression enabled", method_name(ho, NULL));
1364 #ifdef MPPE
1365 - if (go->mppe) {
1366 + if (go->mppe || go->mppc) {
1367 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1368 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1369 continue_networks(f->unit); /* Bring up IP et al */
1370 }
1371 -#endif
1372 +#endif /* MPPE */
1373 }
1374
1375 /*
1376 @@ -1472,7 +1963,7 @@ ccp_down(f)
1377 lcp_close(f->unit, "MPPE disabled");
1378 }
1379 }
1380 -#endif
1381 +#endif /* MPPE */
1382 }
1383
1384 /*
1385 @@ -1532,24 +2023,28 @@ ccp_printpkt(p, plen, printer, arg)
1386 #ifdef MPPE
1387 case CI_MPPE:
1388 if (optlen >= CILEN_MPPE) {
1389 - u_char mppe_opts;
1390 -
1391 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1392 - printer(arg, "mppe %s %s %s %s %s %s%s",
1393 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1394 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1395 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1396 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1397 + printer(arg, "mppe %s %s %s %s %s %s",
1398 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1399 + (p[5] & MPPE_56BIT)? "+M": "-M",
1400 + (p[5] & MPPE_128BIT)? "+S": "-S",
1401 + (p[5] & MPPE_40BIT)? "+L": "-L",
1402 (p[5] & MPPE_D_BIT)? "+D": "-D",
1403 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1404 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1405 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1406 + (p[5] & MPPE_MPPC)? "+C": "-C");
1407 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1408 + MPPE_D_BIT | MPPE_MPPC)) ||
1409 + (p[2] & ~MPPE_STATELESS))
1410 printer(arg, " (%.2x %.2x %.2x %.2x)",
1411 p[2], p[3], p[4], p[5]);
1412 p += CILEN_MPPE;
1413 }
1414 break;
1415 -#endif
1416 +#endif /* MPPE */
1417 + case CI_LZS:
1418 + if (optlen >= CILEN_LZS) {
1419 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1420 + p += CILEN_LZS;
1421 + }
1422 + break;
1423 case CI_DEFLATE:
1424 case CI_DEFLATE_DRAFT:
1425 if (optlen >= CILEN_DEFLATE) {
1426 @@ -1635,6 +2130,7 @@ ccp_datainput(unit, pkt, len)
1427 error("Lost compression sync: disabling compression");
1428 ccp_close(unit, "Lost compression sync");
1429 #ifdef MPPE
1430 + /* My module dosn't need this. J.D., 2003-07-06 */
1431 /*
1432 * If we were doing MPPE, we must also take the link down.
1433 */
1434 @@ -1642,9 +2138,18 @@ ccp_datainput(unit, pkt, len)
1435 error("Too many MPPE errors, closing LCP");
1436 lcp_close(unit, "Too many MPPE errors");
1437 }
1438 -#endif
1439 +#endif /* MPPE */
1440 } else {
1441 /*
1442 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1443 + * and don't wait for CCP_RESETACK
1444 + */
1445 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1446 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1447 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1448 + return;
1449 + }
1450 + /*
1451 * Send a reset-request to reset the peer's compressor.
1452 * We don't do that if we are still waiting for an
1453 * acknowledgement to a previous reset-request.
1454 --- a/pppd/ccp.h
1455 +++ b/pppd/ccp.h
1456 @@ -37,9 +37,17 @@ typedef struct ccp_options {
1457 bool predictor_2; /* do Predictor-2? */
1458 bool deflate_correct; /* use correct code for deflate? */
1459 bool deflate_draft; /* use draft RFC code for deflate? */
1460 + bool lzs; /* do Stac LZS? */
1461 + bool mppc; /* do MPPC? */
1462 bool mppe; /* do MPPE? */
1463 + bool mppe_40; /* allow 40 bit encryption? */
1464 + bool mppe_56; /* allow 56 bit encryption? */
1465 + bool mppe_128; /* allow 128 bit encryption? */
1466 + bool mppe_stateless; /* allow stateless encryption */
1467 u_short bsd_bits; /* # bits/code for BSD Compress */
1468 u_short deflate_size; /* lg(window size) for Deflate */
1469 + u_short lzs_mode; /* LZS check mode */
1470 + u_short lzs_hists; /* number of LZS histories */
1471 short method; /* code for chosen compression method */
1472 } ccp_options;
1473
1474 --- a/pppd/chap_ms.c
1475 +++ b/pppd/chap_ms.c
1476 @@ -898,13 +898,17 @@ set_mppe_enc_types(int policy, int types
1477 /*
1478 * Disable undesirable encryption types. Note that we don't ENABLE
1479 * any encryption types, to avoid overriding manual configuration.
1480 + *
1481 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1482 */
1483 switch(types) {
1484 case MPPE_ENC_TYPES_RC4_40:
1485 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1486 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1487 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1488 break;
1489 case MPPE_ENC_TYPES_RC4_128:
1490 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1491 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1492 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1493 break;
1494 default:
1495 break;
OpenWrt SVN history