projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
cleanup & fix logic not to depend on dropbearkey if keys exist
[openwrt.git] / package / ppp / ppp.patch
1 diff -ruN ppp-2.4.3-orig/chat/Makefile.linux ppp-2.4.3-3/chat/Makefile.linux
2 --- ppp-2.4.3-orig/chat/Makefile.linux 2004-11-03 12:51:47.000000000 +0100
3 +++ ppp-2.4.3-3/chat/Makefile.linux 2004-12-05 17:42:43.000000000 +0100
4 @@ -25,7 +25,7 @@
5
6 install: chat
7 mkdir -p $(BINDIR)
8 - $(INSTALL) -s -c chat $(BINDIR)
9 + $(INSTALL) -c chat $(BINDIR)
10 $(INSTALL) -c -m 644 chat.8 $(MANDIR)
11
12 clean:
13 diff -ruN ppp-2.4.3-orig/include/linux/ppp-comp.h ppp-2.4.3-3/include/linux/ppp-comp.h
14 --- ppp-2.4.3-orig/include/linux/ppp-comp.h 2002-12-06 10:49:15.000000000 +0100
15 +++ ppp-2.4.3-3/include/linux/ppp-comp.h 2004-12-16 00:50:53.000000000 +0100
16 @@ -36,7 +36,7 @@
17 */
18
19 /*
20 - * ==FILEVERSION 20020319==
21 + * ==FILEVERSION 20020715==
22 *
23 * NOTE TO MAINTAINERS:
24 * If you modify this file at all, please set the above date.
25 @@ -56,10 +56,10 @@
26 */
27
28 #ifndef DO_BSD_COMPRESS
29 -#define DO_BSD_COMPRESS 1 /* by default, include BSD-Compress */
30 +#define DO_BSD_COMPRESS 0 /* by default, don't include BSD-Compress */
31 #endif
32 #ifndef DO_DEFLATE
33 -#define DO_DEFLATE 1 /* by default, include Deflate */
34 +#define DO_DEFLATE 0 /* by default, don't include Deflate */
35 #endif
36 #define DO_PREDICTOR_1 0
37 #define DO_PREDICTOR_2 0
38 @@ -86,7 +86,7 @@
39
40 /* Compress a packet */
41 int (*compress) (void *state, unsigned char *rptr,
42 - unsigned char *obuf, int isize, int osize);
43 + unsigned char *obuf, int isize, int osize);
44
45 /* Return compression statistics */
46 void (*comp_stat) (void *state, struct compstat *stats);
47 @@ -107,7 +107,7 @@
48
49 /* Decompress a packet. */
50 int (*decompress) (void *state, unsigned char *ibuf, int isize,
51 - unsigned char *obuf, int osize);
52 + unsigned char *obuf, int osize);
53
54 /* Update state for an incompressible packet received */
55 void (*incomp) (void *state, unsigned char *ibuf, int icnt);
56 @@ -288,6 +288,33 @@
57 opts |= MPPE_OPT_UNKNOWN; \
58 } while (/* CONSTCOND */ 0)
59
60 +/* MPPE/MPPC definitions by J.D.*/
61 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
62 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
63 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
64 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
65 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
66 +
67 +/*
68 + * Definitions for Stac LZS.
69 + */
70 +
71 +#define CI_LZS 17 /* config option for Stac LZS */
72 +#define CILEN_LZS 5 /* length of config option */
73 +
74 +#define LZS_OVHD 4 /* max. LZS overhead */
75 +#define LZS_HIST_LEN 2048 /* LZS history size */
76 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
77 +
78 +#define LZS_MODE_NONE 0
79 +#define LZS_MODE_LCB 1
80 +#define LZS_MODE_CRC 2
81 +#define LZS_MODE_SEQ 3
82 +#define LZS_MODE_EXT 4
83 +
84 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
85 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
86 +
87 /*
88 * Definitions for other, as yet unsupported, compression methods.
89 */
90 diff -ruN ppp-2.4.3-orig/include/net/ppp-comp.h ppp-2.4.3-3/include/net/ppp-comp.h
91 --- ppp-2.4.3-orig/include/net/ppp-comp.h 2002-12-06 10:49:15.000000000 +0100
92 +++ ppp-2.4.3-3/include/net/ppp-comp.h 2004-12-16 00:51:06.000000000 +0100
93 @@ -43,10 +43,10 @@
94 * various compression methods.
95 */
96 #ifndef DO_BSD_COMPRESS
97 -#define DO_BSD_COMPRESS 1 /* by default, include BSD-Compress */
98 +#define DO_BSD_COMPRESS 0 /* by default, don't include BSD-Compress */
99 #endif
100 #ifndef DO_DEFLATE
101 -#define DO_DEFLATE 1 /* by default, include Deflate */
102 +#define DO_DEFLATE 0 /* by default, don't include Deflate */
103 #endif
104 #define DO_PREDICTOR_1 0
105 #define DO_PREDICTOR_2 0
106 @@ -255,6 +255,33 @@
107 opts |= MPPE_OPT_UNKNOWN; \
108 } while (/* CONSTCOND */ 0)
109
110 +/* MPPE/MPPC definitions by J.D.*/
111 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
112 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
113 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
114 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
115 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
116 +
117 +/*
118 + * Definitions for Stac LZS.
119 + */
120 +
121 +#define CI_LZS 17 /* config option for Stac LZS */
122 +#define CILEN_LZS 5 /* length of config option */
123 +
124 +#define LZS_OVHD 4 /* max. LZS overhead */
125 +#define LZS_HIST_LEN 2048 /* LZS history size */
126 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
127 +
128 +#define LZS_MODE_NONE 0
129 +#define LZS_MODE_LCB 1
130 +#define LZS_MODE_CRC 2
131 +#define LZS_MODE_SEQ 3
132 +#define LZS_MODE_EXT 4
133 +
134 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
135 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
136 +
137 /*
138 * Definitions for other, as yet unsupported, compression methods.
139 */
140 diff -ruN ppp-2.4.3-orig/pppd/Makefile.linux ppp-2.4.3-3/pppd/Makefile.linux
141 --- ppp-2.4.3-orig/pppd/Makefile.linux 2004-11-13 13:02:22.000000000 +0100
142 +++ ppp-2.4.3-3/pppd/Makefile.linux 2004-12-16 04:43:41.000000000 +0100
143 @@ -48,19 +48,19 @@
144 # Uncomment the next line to include support for PPP packet filtering.
145 # This requires that the libpcap library and headers be installed
146 # and that the kernel driver support PPP packet filtering.
147 -FILTER=y
148 +#FILTER=y
149
150 # Uncomment the next line to enable multilink PPP (enabled by default)
151 # Linux distributions: Please leave multilink ENABLED in your builds
152 # of pppd!
153 -HAVE_MULTILINK=y
154 +#HAVE_MULTILINK=y
155
156 # Uncomment the next line to enable the TDB database (enabled by default.)
157 # If you enable multilink, then TDB is automatically enabled also.
158 # Linux distributions: Please leave TDB ENABLED in your builds.
159 -USE_TDB=y
160 +#USE_TDB=y
161
162 -HAS_SHADOW=y
163 +#HAS_SHADOW=y
164 #USE_PAM=y
165 #HAVE_INET6=y
166
167 @@ -77,7 +77,7 @@
168
169 INCLUDE_DIRS= -I../include
170
171 -COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP
172 +COMPILE_FLAGS= -DHAVE_PATHS_H -DHAVE_MMAP
173
174 CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS)
175
176 @@ -99,7 +99,7 @@
177 CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
178 LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto
179 TARGETS += srp-entry
180 -EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry
181 +EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
182 MANPAGES += srp-entry.8
183 EXTRACLEAN += srp-entry.o
184 NEEDDES=y
185 @@ -117,12 +117,12 @@
186 #LIBS += -lshadow $(LIBS)
187 endif
188
189 -ifneq ($(wildcard /usr/include/crypt.h),)
190 +#ifneq ($(wildcard /usr/include/crypt.h),)
191 CFLAGS += -DHAVE_CRYPT_H=1
192 -endif
193 -ifneq ($(wildcard /usr/lib/libcrypt.*),)
194 +#endif
195 +#ifneq ($(wildcard /usr/lib/libcrypt.*),)
196 LIBS += -lcrypt
197 -endif
198 +#endif
199
200 ifdef NEEDDES
201 ifndef USE_CRYPT
202 @@ -202,7 +202,7 @@
203 install: pppd
204 mkdir -p $(BINDIR) $(MANDIR)
205 $(EXTRAINSTALL)
206 - $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd
207 + $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd
208 if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \
209 chmod o-rx,u+s $(BINDIR)/pppd; fi
210 $(INSTALL) -c -m 444 pppd.8 $(MANDIR)
211 diff -ruN ppp-2.4.3-orig/pppd/ccp.c ppp-2.4.3-3/pppd/ccp.c
212 --- ppp-2.4.3-orig/pppd/ccp.c 2004-11-13 03:28:15.000000000 +0100
213 +++ ppp-2.4.3-3/pppd/ccp.c 2004-12-05 17:51:27.000000000 +0100
214 @@ -62,12 +62,10 @@
215 static char bsd_value[8];
216 static char deflate_value[8];
217
218 -/*
219 - * Option variables.
220 - */
221 #ifdef MPPE
222 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
223 -#endif
224 +static int setmppe(char **);
225 +static int setnomppe(void);
226 +#endif /* MPPE */
227
228 static option_t ccp_option_list[] = {
229 { "noccp", o_bool, &ccp_protent.enabled_flag,
230 @@ -108,54 +106,36 @@
231 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
232 &ccp_allowoptions[0].predictor_1 },
233
234 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
235 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
236 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
237 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
238 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
239 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
240 + &ccp_allowoptions[0].lzs },
241 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
242 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
243 + &ccp_allowoptions[0].lzs },
244 +
245 #ifdef MPPE
246 - /* MPPE options are symmetrical ... we only set wantoptions here */
247 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
248 - "require MPPE encryption",
249 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
250 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
251 - "require MPPE encryption",
252 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
253 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
254 - "don't allow MPPE encryption", OPT_PRIO },
255 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
256 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
257 -
258 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
259 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
260 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
261 - &ccp_wantoptions[0].mppe },
262 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
263 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
264 - &ccp_wantoptions[0].mppe },
265 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
266 - "don't allow MPPE 40-bit encryption",
267 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
268 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
269 - "don't allow MPPE 40-bit encryption",
270 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
271 - &ccp_wantoptions[0].mppe },
272 -
273 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
274 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
275 - &ccp_wantoptions[0].mppe },
276 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
277 - "require MPPE 128-bit encryption",
278 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
279 - &ccp_wantoptions[0].mppe },
280 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
281 - "don't allow MPPE 128-bit encryption",
282 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
283 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
284 - "don't allow MPPE 128-bit encryption",
285 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
286 - &ccp_wantoptions[0].mppe },
287 -
288 - /* strange one; we always request stateless, but will we allow stateful? */
289 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
290 - "allow MPPE stateful mode", OPT_PRIO },
291 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
292 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
293 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
294 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
295 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
296 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
297 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
298 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
299 + &ccp_allowoptions[0].mppc },
300 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
301 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
302 + &ccp_allowoptions[0].mppc },
303 + { "mppe", o_special, (void *)setmppe,
304 + "request MPPE encryption" },
305 + { "+mppe", o_special, (void *)setmppe,
306 + "request MPPE encryption" },
307 + { "nomppe", o_special_noarg, (void *)setnomppe,
308 + "don't allow MPPE encryption" },
309 + { "-mppe", o_special_noarg, (void *)setnomppe,
310 + "don't allow MPPE encryption" },
311 #endif /* MPPE */
312
313 { NULL }
314 @@ -241,7 +221,7 @@
315 */
316 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
317 || (opt).predictor_1 || (opt).predictor_2 \
318 - || (opt).mppe)
319 + || (opt).lzs || (opt).mppc || (opt).mppe)
320
321 /*
322 * Local state (mainly for handling reset-reqs and reset-acks).
323 @@ -344,6 +324,100 @@
324 return 1;
325 }
326
327 +#ifdef MPPE
328 +/*
329 + * Functions called from config options
330 + */
331 +/*
332 + MPPE suboptions:
333 + required - require MPPE; disconnect if peer doesn't support it
334 + stateless - use stateless mode
335 + no40 - disable 40 bit keys
336 + no56 - disable 56 bit keys
337 + no128 - disable 128 bit keys
338 +*/
339 +int setmppe(char **argv)
340 +{
341 + int i;
342 + char *str, cmdbuf[16];
343 +
344 + ccp_allowoptions[0].mppe = 1;
345 + ccp_allowoptions[0].mppe_40 = 1;
346 + ccp_allowoptions[0].mppe_56 = 1;
347 + ccp_allowoptions[0].mppe_128 = 1;
348 + ccp_allowoptions[0].mppe_stateless = 0;
349 + ccp_wantoptions[0].mppe = 0;
350 +
351 + str = *argv;
352 +
353 + while (1) {
354 + i = 0;
355 + memset(cmdbuf, '\0', 16);
356 + while ((i < 16) && (*str != ',') && (*str != '\0'))
357 + cmdbuf[i++] = *str++;
358 + cmdbuf[i] = '\0';
359 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
360 + ccp_allowoptions[0].mppe_40 = 0;
361 + goto next_param;
362 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
363 + ccp_allowoptions[0].mppe_56 = 0;
364 + goto next_param;
365 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
366 + ccp_allowoptions[0].mppe_128 = 0;
367 + goto next_param;
368 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
369 + ccp_allowoptions[0].mppe_stateless = 1;
370 + goto next_param;
371 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
372 + ccp_wantoptions[0].mppe = 1;
373 + goto next_param;
374 + } else {
375 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
376 + return 0;
377 + }
378 +
379 + next_param:
380 + if (*str == ',') {
381 + str++;
382 + continue;
383 + }
384 + if (*str == '\0') {
385 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
386 + ccp_allowoptions[0].mppe_128)) {
387 + if (ccp_wantoptions[0].mppe == 1) {
388 + option_error("You require MPPE but you have switched off "
389 + "all encryption key lengths.");
390 + return 0;
391 + }
392 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
393 + ccp_wantoptions[0].mppe_stateless =
394 + ccp_allowoptions[0].mppe_stateless = 0;
395 + } else {
396 + ccp_allowoptions[0].mppe = 1;
397 + ccp_wantoptions[0].mppe_stateless =
398 + ccp_allowoptions[0].mppe_stateless;
399 + if (ccp_wantoptions[0].mppe == 1) {
400 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
401 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
402 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
403 + }
404 + }
405 + return 1;
406 + }
407 + }
408 +}
409 +
410 +int setnomppe(void)
411 +{
412 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
413 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
414 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
415 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
416 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
417 + return 1;
418 +}
419 +#endif /* MPPE */
420 +
421 /*
422 * ccp_init - initialize CCP.
423 */
424 @@ -378,6 +452,30 @@
425 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
426
427 ccp_allowoptions[0].predictor_1 = 1;
428 +
429 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
430 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
431 + ccp_wantoptions[0].lzs_hists = 1;
432 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
433 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
434 + ccp_allowoptions[0].lzs_hists = 1;
435 +
436 +#ifdef MPPE
437 + /* by default allow and request MPPC... */
438 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
439 +
440 + /* ... and allow but don't request MPPE */
441 + ccp_allowoptions[0].mppe = 1;
442 + ccp_allowoptions[0].mppe_40 = 1;
443 + ccp_allowoptions[0].mppe_56 = 1;
444 + ccp_allowoptions[0].mppe_128 = 1;
445 + ccp_allowoptions[0].mppe_stateless = 1;
446 + ccp_wantoptions[0].mppe = 0;
447 + ccp_wantoptions[0].mppe_40 = 0;
448 + ccp_wantoptions[0].mppe_56 = 0;
449 + ccp_wantoptions[0].mppe_128 = 0;
450 + ccp_wantoptions[0].mppe_stateless = 0;
451 +#endif /* MPPE */
452 }
453
454 /*
455 @@ -455,11 +553,11 @@
456 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
457 notice("Compression disabled by peer.");
458 #ifdef MPPE
459 - if (ccp_gotoptions[unit].mppe) {
460 + if (ccp_wantoptions[unit].mppe) {
461 error("MPPE disabled, closing LCP");
462 lcp_close(unit, "MPPE disabled by peer");
463 }
464 -#endif
465 +#endif /* MPPE */
466 }
467
468 /*
469 @@ -487,6 +585,15 @@
470 break;
471 /* send a reset-ack, which the transmitter will see and
472 reset its compression state. */
473 +
474 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
475 + but we do it in order to reset compressor; CCP_RESETACK is
476 + then silently discarded. See functions ppp_send_frame and
477 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
478 + confusion is caused by the fact that CCP code is splited
479 + into two parts - one part is handled by pppd, the other one
480 + is handled by kernel. */
481 +
482 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
483 break;
484
485 @@ -515,12 +622,11 @@
486 fsm_lowerdown(&ccp_fsm[unit]);
487
488 #ifdef MPPE
489 - if (ccp_gotoptions[unit].mppe) {
490 + if (ccp_wantoptions[unit].mppe) {
491 error("MPPE required but peer negotiation failed");
492 lcp_close(unit, "MPPE required but peer negotiation failed");
493 }
494 -#endif
495 -
496 +#endif /* MPPE */
497 }
498
499 /*
500 @@ -537,7 +643,7 @@
501 all_rejected[f->unit] = 0;
502
503 #ifdef MPPE
504 - if (go->mppe) {
505 + if (go->mppe || go->mppc) {
506 ccp_options *ao = &ccp_allowoptions[f->unit];
507 int auth_mschap_bits = auth_done[f->unit];
508 int numbits;
509 @@ -551,80 +657,109 @@
510 * NB: If MPPE is required, all other compression opts are invalid.
511 * So, we return right away if we can't do it.
512 */
513 + if (ccp_wantoptions[f->unit].mppe) {
514 + /* Leave only the mschap auth bits set */
515 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
516 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
517 + /* Count the mschap auths */
518 + auth_mschap_bits >>= CHAP_MS_SHIFT;
519 + numbits = 0;
520 + do {
521 + numbits += auth_mschap_bits & 1;
522 + auth_mschap_bits >>= 1;
523 + } while (auth_mschap_bits);
524 + if (numbits > 1) {
525 + error("MPPE required, but auth done in both directions.");
526 + lcp_close(f->unit, "MPPE required but not available");
527 + return;
528 + }
529 + if (!numbits) {
530 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
531 + lcp_close(f->unit, "MPPE required but not available");
532 + return;
533 + }
534
535 - /* Leave only the mschap auth bits set */
536 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
537 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
538 - /* Count the mschap auths */
539 - auth_mschap_bits >>= CHAP_MS_SHIFT;
540 - numbits = 0;
541 - do {
542 - numbits += auth_mschap_bits & 1;
543 - auth_mschap_bits >>= 1;
544 - } while (auth_mschap_bits);
545 - if (numbits > 1) {
546 - error("MPPE required, but auth done in both directions.");
547 - lcp_close(f->unit, "MPPE required but not available");
548 - return;
549 - }
550 - if (!numbits) {
551 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
552 - lcp_close(f->unit, "MPPE required but not available");
553 - return;
554 - }
555 -
556 - /* A plugin (eg radius) may not have obtained key material. */
557 - if (!mppe_keys_set) {
558 - error("MPPE required, but keys are not available. "
559 - "Possible plugin problem?");
560 - lcp_close(f->unit, "MPPE required but not available");
561 - return;
562 - }
563 -
564 - /* LM auth not supported for MPPE */
565 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
566 - /* This might be noise */
567 - if (go->mppe & MPPE_OPT_40) {
568 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
569 - go->mppe &= ~MPPE_OPT_40;
570 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
571 + /* A plugin (eg radius) may not have obtained key material. */
572 + if (!mppe_keys_set) {
573 + error("MPPE required, but keys are not available. "
574 + "Possible plugin problem?");
575 + lcp_close(f->unit, "MPPE required but not available");
576 + return;
577 }
578 }
579
580 - /* Last check: can we actually negotiate something? */
581 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
582 - /* Could be misconfig, could be 40-bit disabled above. */
583 - error("MPPE required, but both 40-bit and 128-bit disabled.");
584 - lcp_close(f->unit, "MPPE required but not available");
585 - return;
586 + /*
587 + * Check whether the kernel knows about the various
588 + * compression methods we might request. Key material
589 + * unimportant here.
590 + */
591 + if (go->mppc) {
592 + opt_buf[0] = CI_MPPE;
593 + opt_buf[1] = CILEN_MPPE;
594 + opt_buf[2] = 0;
595 + opt_buf[3] = 0;
596 + opt_buf[4] = 0;
597 + opt_buf[5] = MPPE_MPPC;
598 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
599 + go->mppc = 0;
600 + }
601 + if (go->mppe_40) {
602 + opt_buf[0] = CI_MPPE;
603 + opt_buf[1] = CILEN_MPPE;
604 + opt_buf[2] = MPPE_STATELESS;
605 + opt_buf[3] = 0;
606 + opt_buf[4] = 0;
607 + opt_buf[5] = MPPE_40BIT;
608 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
609 + go->mppe_40 = 0;
610 + }
611 + if (go->mppe_56) {
612 + opt_buf[0] = CI_MPPE;
613 + opt_buf[1] = CILEN_MPPE;
614 + opt_buf[2] = MPPE_STATELESS;
615 + opt_buf[3] = 0;
616 + opt_buf[4] = 0;
617 + opt_buf[5] = MPPE_56BIT;
618 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
619 + go->mppe_56 = 0;
620 + }
621 + if (go->mppe_128) {
622 + opt_buf[0] = CI_MPPE;
623 + opt_buf[1] = CILEN_MPPE;
624 + opt_buf[2] = MPPE_STATELESS;
625 + opt_buf[3] = 0;
626 + opt_buf[4] = 0;
627 + opt_buf[5] = MPPE_128BIT;
628 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
629 + go->mppe_128 = 0;
630 + }
631 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
632 + if (ccp_wantoptions[f->unit].mppe) {
633 + error("MPPE required, but kernel has no support.");
634 + lcp_close(f->unit, "MPPE required but not available");
635 + }
636 + go->mppe = go->mppe_stateless = 0;
637 + } else {
638 + /* MPPE is not compatible with other compression types */
639 + if (ccp_wantoptions[f->unit].mppe) {
640 + ao->bsd_compress = go->bsd_compress = 0;
641 + ao->predictor_1 = go->predictor_1 = 0;
642 + ao->predictor_2 = go->predictor_2 = 0;
643 + ao->deflate = go->deflate = 0;
644 + ao->lzs = go->lzs = 0;
645 + }
646 }
647 -
648 - /* sync options */
649 - ao->mppe = go->mppe;
650 - /* MPPE is not compatible with other compression types */
651 - ao->bsd_compress = go->bsd_compress = 0;
652 - ao->predictor_1 = go->predictor_1 = 0;
653 - ao->predictor_2 = go->predictor_2 = 0;
654 - ao->deflate = go->deflate = 0;
655 }
656 #endif /* MPPE */
657 -
658 - /*
659 - * Check whether the kernel knows about the various
660 - * compression methods we might request.
661 - */
662 -#ifdef MPPE
663 - if (go->mppe) {
664 - opt_buf[0] = CI_MPPE;
665 - opt_buf[1] = CILEN_MPPE;
666 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
667 - /* Key material unimportant here. */
668 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
669 - error("MPPE required, but kernel has no support.");
670 - lcp_close(f->unit, "MPPE required but not available");
671 - }
672 + if (go->lzs) {
673 + opt_buf[0] = CI_LZS;
674 + opt_buf[1] = CILEN_LZS;
675 + opt_buf[2] = go->lzs_hists >> 8;
676 + opt_buf[3] = go->lzs_hists & 0xff;
677 + opt_buf[4] = LZS_MODE_SEQ;
678 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
679 + go->lzs = 0;
680 }
681 -#endif
682 if (go->bsd_compress) {
683 opt_buf[0] = CI_BSD_COMPRESS;
684 opt_buf[1] = CILEN_BSD_COMPRESS;
685 @@ -679,7 +814,8 @@
686 + (go->deflate? CILEN_DEFLATE: 0)
687 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
688 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
689 - + (go->mppe? CILEN_MPPE: 0);
690 + + (go->lzs? CILEN_LZS: 0)
691 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
692 }
693
694 /*
695 @@ -693,6 +829,8 @@
696 {
697 int res;
698 ccp_options *go = &ccp_gotoptions[f->unit];
699 + ccp_options *ao = &ccp_allowoptions[f->unit];
700 + ccp_options *wo = &ccp_wantoptions[f->unit];
701 u_char *p0 = p;
702
703 /*
704 @@ -701,22 +839,43 @@
705 * in case it gets Acked.
706 */
707 #ifdef MPPE
708 - if (go->mppe) {
709 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
710 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
711
712 - p[0] = opt_buf[0] = CI_MPPE;
713 - p[1] = opt_buf[1] = CILEN_MPPE;
714 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
715 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
716 + p[0] = CI_MPPE;
717 + p[1] = CILEN_MPPE;
718 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
719 + p[3] = 0;
720 + p[4] = 0;
721 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
722 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
723 +
724 + BCOPY(p, opt_buf, CILEN_MPPE);
725 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
726 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
727 - if (res > 0)
728 + if (res > 0) {
729 p += CILEN_MPPE;
730 - else
731 + } else {
732 /* This shouldn't happen, we've already tested it! */
733 - lcp_close(f->unit, "MPPE required but not available in kernel");
734 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
735 + go->mppe_stateless = go->mppc = 0;
736 + if (ccp_wantoptions[f->unit].mppe)
737 + lcp_close(f->unit, "MPPE required but not available in kernel");
738 + }
739 + }
740 +#endif /* MPPE */
741 + if (go->lzs) {
742 + p[0] = CI_LZS;
743 + p[1] = CILEN_LZS;
744 + p[2] = go->lzs_hists >> 8;
745 + p[3] = go->lzs_hists & 0xff;
746 + p[4] = LZS_MODE_SEQ;
747 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
748 + if (res > 0) {
749 + p += CILEN_LZS;
750 + } else
751 + go->lzs = 0;
752 }
753 -#endif
754 if (go->deflate) {
755 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
756 p[1] = CILEN_DEFLATE;
757 @@ -802,7 +961,7 @@
758
759 /*
760 * ccp_ackci - process a received configure-ack, and return
761 - * 1 iff the packet was OK.
762 + * 1 if the packet was OK.
763 */
764 static int
765 ccp_ackci(f, p, len)
766 @@ -811,24 +970,44 @@
767 int len;
768 {
769 ccp_options *go = &ccp_gotoptions[f->unit];
770 + ccp_options *ao = &ccp_allowoptions[f->unit];
771 + ccp_options *wo = &ccp_wantoptions[f->unit];
772 u_char *p0 = p;
773
774 #ifdef MPPE
775 - if (go->mppe) {
776 - u_char opt_buf[CILEN_MPPE];
777 -
778 - opt_buf[0] = CI_MPPE;
779 - opt_buf[1] = CILEN_MPPE;
780 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
781 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
782 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
783 + if (len < CILEN_MPPE
784 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
785 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
786 + || p[3] != 0
787 + || p[4] != 0
788 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
789 + (go->mppc ? MPPE_MPPC : 0))
790 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
791 + (go->mppc ? MPPE_MPPC : 0))
792 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
793 + (go->mppc ? MPPE_MPPC : 0))))
794 return 0;
795 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
796 + go->mppe = 1;
797 p += CILEN_MPPE;
798 len -= CILEN_MPPE;
799 + /* Cope with first/fast ack */
800 + if (p == p0 && len == 0)
801 + return 1;
802 + }
803 +#endif /* MPPE */
804 + if (go->lzs) {
805 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
806 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
807 + || p[4] != LZS_MODE_SEQ)
808 + return 0;
809 + p += CILEN_LZS;
810 + len -= CILEN_LZS;
811 /* XXX Cope with first/fast ack */
812 - if (len == 0)
813 + if (p == p0 && len == 0)
814 return 1;
815 }
816 -#endif
817 if (go->deflate) {
818 if (len < CILEN_DEFLATE
819 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
820 @@ -891,7 +1070,7 @@
821
822 /*
823 * ccp_nakci - process received configure-nak.
824 - * Returns 1 iff the nak was OK.
825 + * Returns 1 if the nak was OK.
826 */
827 static int
828 ccp_nakci(f, p, len, treat_as_reject)
829 @@ -900,6 +1079,8 @@
830 int len;
831 {
832 ccp_options *go = &ccp_gotoptions[f->unit];
833 + ccp_options *ao = &ccp_allowoptions[f->unit];
834 + ccp_options *wo = &ccp_wantoptions[f->unit];
835 ccp_options no; /* options we've seen already */
836 ccp_options try; /* options to ask for next time */
837
838 @@ -907,28 +1088,100 @@
839 try = *go;
840
841 #ifdef MPPE
842 - if (go->mppe && len >= CILEN_MPPE
843 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
844 - no.mppe = 1;
845 - /*
846 - * Peer wants us to use a different strength or other setting.
847 - * Fail if we aren't willing to use his suggestion.
848 - */
849 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
850 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
851 - error("Refusing MPPE stateful mode offered by peer");
852 - try.mppe = 0;
853 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
854 - /* Peer must have set options we didn't request (suggest) */
855 - try.mppe = 0;
856 - }
857 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
858 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
859
860 - if (!try.mppe) {
861 - error("MPPE required but peer negotiation failed");
862 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
863 + if (go->mppc) {
864 + no.mppc = 1;
865 + if (!(p[5] & MPPE_MPPC))
866 + try.mppc = 0;
867 + }
868 +
869 + if (go->mppe)
870 + no.mppe = 1;
871 + if (go->mppe_40)
872 + no.mppe_40 = 1;
873 + if (go->mppe_56)
874 + no.mppe_56 = 1;
875 + if (go->mppe_128)
876 + no.mppe_128 = 1;
877 + if (go->mppe_stateless)
878 + no.mppe_stateless = 1;
879 +
880 + if (ao->mppe_40) {
881 + if ((p[5] & MPPE_40BIT))
882 + try.mppe_40 = 1;
883 + else
884 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
885 + }
886 + if (ao->mppe_56) {
887 + if ((p[5] & MPPE_56BIT))
888 + try.mppe_56 = 1;
889 + else
890 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
891 + }
892 + if (ao->mppe_128) {
893 + if ((p[5] & MPPE_128BIT))
894 + try.mppe_128 = 1;
895 + else
896 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
897 + }
898 +
899 + if (ao->mppe_stateless) {
900 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
901 + try.mppe_stateless = 1;
902 + else
903 + try.mppe_stateless = 0;
904 + }
905 +
906 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
907 + try.mppe = try.mppe_stateless = 0;
908 + if (wo->mppe) {
909 + /* we require encryption, but peer doesn't support it
910 + so we close connection */
911 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
912 + wo->mppe_56 = wo->mppe_128 = 0;
913 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
914 + "key length");
915 + }
916 + }
917 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
918 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
919 + /* cannot negotiate key length */
920 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
921 + wo->mppe_56 = wo->mppe_128 = 0;
922 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
923 }
924 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
925 + try.mppe_40 = try.mppe_56 = 0;
926 + else
927 + if (try.mppe_56 && try.mppe_128)
928 + try.mppe_56 = 0;
929 + else
930 + if (try.mppe_40 && try.mppe_128)
931 + try.mppe_40 = 0;
932 + else
933 + if (try.mppe_40 && try.mppe_56)
934 + try.mppe_40 = 0;
935 +
936 + p += CILEN_MPPE;
937 + len -= CILEN_MPPE;
938 }
939 #endif /* MPPE */
940 +
941 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
942 + no.lzs = 1;
943 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
944 + p[4] != LZS_MODE_EXT))
945 + try.lzs = 0;
946 + else {
947 + try.lzs_mode = p[4];
948 + try.lzs_hists = (p[2] << 8) | p[3];
949 + }
950 + p += CILEN_LZS;
951 + len -= CILEN_LZS;
952 + }
953 +
954 if (go->deflate && len >= CILEN_DEFLATE
955 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
956 && p[1] == CILEN_DEFLATE) {
957 @@ -1001,14 +1254,50 @@
958 return -1;
959
960 #ifdef MPPE
961 - if (go->mppe && len >= CILEN_MPPE
962 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
963 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
964 - error("MPPE required but peer refused");
965 - lcp_close(f->unit, "MPPE required but peer refused");
966 + ccp_options *wo = &ccp_wantoptions[f->unit];
967 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
968 + p[3] != 0 ||
969 + p[4] != 0 ||
970 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
971 + (go->mppe_56 ? MPPE_56BIT : 0) |
972 + (go->mppe_128 ? MPPE_128BIT : 0) |
973 + (go->mppc ? MPPE_MPPC : 0)))
974 + return 0;
975 + if (go->mppc)
976 + try.mppc = 0;
977 + if (go->mppe) {
978 + try.mppe = 0;
979 + if (go->mppe_40)
980 + try.mppe_40 = 0;
981 + if (go->mppe_56)
982 + try.mppe_56 = 0;
983 + if (go->mppe_128)
984 + try.mppe_128 = 0;
985 + if (go->mppe_stateless)
986 + try.mppe_stateless = 0;
987 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
988 + try.mppe = try.mppe_stateless = 0;
989 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
990 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
991 + wo->mppe_56 = wo->mppe_128 = 0;
992 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
993 + "key length");
994 + }
995 + }
996 p += CILEN_MPPE;
997 len -= CILEN_MPPE;
998 }
999 -#endif
1000 +#endif /* MPPE */
1001 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
1002 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
1003 + || p[4] != go->lzs_mode)
1004 + return 0;
1005 + try.lzs = 0;
1006 + p += CILEN_LZS;
1007 + len -= CILEN_LZS;
1008 + }
1009 if (go->deflate_correct && len >= CILEN_DEFLATE
1010 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
1011 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
1012 @@ -1072,14 +1361,15 @@
1013 int dont_nak;
1014 {
1015 int ret, newret, res;
1016 - u_char *p0, *retp;
1017 + u_char *p0, *retp, p2, p5;
1018 int len, clen, type, nb;
1019 ccp_options *ho = &ccp_hisoptions[f->unit];
1020 ccp_options *ao = &ccp_allowoptions[f->unit];
1021 + ccp_options *wo = &ccp_wantoptions[f->unit];
1022 #ifdef MPPE
1023 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
1024 - /* CI_MPPE, or due to other options? */
1025 -#endif
1026 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1027 +/* int mtu; */
1028 +#endif /* MPPE */
1029
1030 ret = CONFACK;
1031 retp = p0 = p;
1032 @@ -1102,103 +1392,305 @@
1033 switch (type) {
1034 #ifdef MPPE
1035 case CI_MPPE:
1036 - if (!ao->mppe || clen != CILEN_MPPE) {
1037 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
1038 newret = CONFREJ;
1039 break;
1040 }
1041 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
1042
1043 - /* Nak if anything unsupported or unknown are set. */
1044 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
1045 - newret = CONFNAK;
1046 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
1047 - }
1048 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
1049 + p2 = p[2];
1050 + p5 = p[5];
1051 + /* not sure what they want, tell 'em what we got */
1052 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
1053 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
1054 + MPPE_MPPC)) != 0 || p[5] == 0) ||
1055 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
1056 newret = CONFNAK;
1057 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
1058 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
1059 + p[3] = 0;
1060 + p[4] = 0;
1061 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
1062 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1063 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1064 + (wo->mppc ? MPPE_MPPC : 0);
1065 + break;
1066 }
1067
1068 - /* Check state opt */
1069 - if (ho->mppe & MPPE_OPT_STATEFUL) {
1070 - /*
1071 - * We can Nak and request stateless, but it's a
1072 - * lot easier to just assume the peer will request
1073 - * it if he can do it; stateful mode is bad over
1074 - * the Internet -- which is where we expect MPPE.
1075 - */
1076 - if (refuse_mppe_stateful) {
1077 - error("Refusing MPPE stateful mode offered by peer");
1078 + if ((p[5] & MPPE_MPPC)) {
1079 + if (ao->mppc) {
1080 + ho->mppc = 1;
1081 + BCOPY(p, opt_buf, CILEN_MPPE);
1082 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
1083 + opt_buf[5] = MPPE_MPPC;
1084 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
1085 + ho->mppc = 0;
1086 + p[5] &= ~MPPE_MPPC;
1087 + newret = CONFNAK;
1088 + }
1089 + } else {
1090 newret = CONFREJ;
1091 - break;
1092 + if (wo->mppe || ao->mppe) {
1093 + p[5] &= ~MPPE_MPPC;
1094 + newret = CONFNAK;
1095 + }
1096 + }
1097 + }
1098 +
1099 + if (ao->mppe)
1100 + ho->mppe = 1;
1101 +
1102 + if ((p[2] & MPPE_STATELESS)) {
1103 + if (ao->mppe_stateless) {
1104 + if (wo->mppe_stateless)
1105 + ho->mppe_stateless = 1;
1106 + else {
1107 + newret = CONFNAK;
1108 + if (!dont_nak)
1109 + p[2] &= ~MPPE_STATELESS;
1110 + }
1111 + } else {
1112 + newret = CONFNAK;
1113 + if (!dont_nak)
1114 + p[2] &= ~MPPE_STATELESS;
1115 + }
1116 + } else {
1117 + if (wo->mppe_stateless && !dont_nak) {
1118 + wo->mppe_stateless = 0;
1119 + newret = CONFNAK;
1120 + p[2] |= MPPE_STATELESS;
1121 }
1122 }
1123
1124 - /* Find out which of {S,L} are set. */
1125 - if ((ho->mppe & MPPE_OPT_128)
1126 - && (ho->mppe & MPPE_OPT_40)) {
1127 - /* Both are set, negotiate the strongest. */
1128 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1129 newret = CONFNAK;
1130 - if (ao->mppe & MPPE_OPT_128)
1131 - ho->mppe &= ~MPPE_OPT_40;
1132 - else if (ao->mppe & MPPE_OPT_40)
1133 - ho->mppe &= ~MPPE_OPT_128;
1134 - else {
1135 - newret = CONFREJ;
1136 - break;
1137 + if (ao->mppe_128) {
1138 + ho->mppe_128 = 1;
1139 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1140 + BCOPY(p, opt_buf, CILEN_MPPE);
1141 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1142 + MPPE_MAX_KEY_LEN);
1143 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1144 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1145 + ho->mppe_128 = 0;
1146 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1147 + p[5] &= ~MPPE_128BIT;
1148 + goto check_mppe_56_40;
1149 + }
1150 + goto check_mppe;
1151 }
1152 - } else if (ho->mppe & MPPE_OPT_128) {
1153 - if (!(ao->mppe & MPPE_OPT_128)) {
1154 - newret = CONFREJ;
1155 - break;
1156 + p[5] &= ~MPPE_128BIT;
1157 + goto check_mppe_56_40;
1158 + }
1159 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1160 + newret = CONFNAK;
1161 + if (ao->mppe_128) {
1162 + ho->mppe_128 = 1;
1163 + p[5] &= ~MPPE_56BIT;
1164 + BCOPY(p, opt_buf, CILEN_MPPE);
1165 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1166 + MPPE_MAX_KEY_LEN);
1167 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1168 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1169 + ho->mppe_128 = 0;
1170 + p[5] |= MPPE_56BIT;
1171 + p[5] &= ~MPPE_128BIT;
1172 + goto check_mppe_56;
1173 + }
1174 + goto check_mppe;
1175 }
1176 - } else if (ho->mppe & MPPE_OPT_40) {
1177 - if (!(ao->mppe & MPPE_OPT_40)) {
1178 - newret = CONFREJ;
1179 - break;
1180 + p[5] &= ~MPPE_128BIT;
1181 + goto check_mppe_56;
1182 + }
1183 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1184 + newret = CONFNAK;
1185 + if (ao->mppe_128) {
1186 + ho->mppe_128 = 1;
1187 + p[5] &= ~MPPE_40BIT;
1188 + BCOPY(p, opt_buf, CILEN_MPPE);
1189 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1190 + MPPE_MAX_KEY_LEN);
1191 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1192 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1193 + ho->mppe_128 = 0;
1194 + p[5] |= MPPE_40BIT;
1195 + p[5] &= ~MPPE_128BIT;
1196 + goto check_mppe_40;
1197 + }
1198 + goto check_mppe;
1199 + }
1200 + p[5] &= ~MPPE_128BIT;
1201 + goto check_mppe_40;
1202 + }
1203 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1204 + if (ao->mppe_128) {
1205 + ho->mppe_128 = 1;
1206 + BCOPY(p, opt_buf, CILEN_MPPE);
1207 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1208 + MPPE_MAX_KEY_LEN);
1209 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1210 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1211 + ho->mppe_128 = 0;
1212 + p[5] &= ~MPPE_128BIT;
1213 + newret = CONFNAK;
1214 + }
1215 + goto check_mppe;
1216 + }
1217 + p[5] &= ~MPPE_128BIT;
1218 + newret = CONFNAK;
1219 + goto check_mppe;
1220 + }
1221 + check_mppe_56_40:
1222 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1223 + newret = CONFNAK;
1224 + if (ao->mppe_56) {
1225 + ho->mppe_56 = 1;
1226 + p[5] &= ~MPPE_40BIT;
1227 + BCOPY(p, opt_buf, CILEN_MPPE);
1228 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1229 + MPPE_MAX_KEY_LEN);
1230 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1231 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1232 + ho->mppe_56 = 0;
1233 + p[5] |= MPPE_40BIT;
1234 + p[5] &= ~MPPE_56BIT;
1235 + newret = CONFNAK;
1236 + goto check_mppe_40;
1237 + }
1238 + goto check_mppe;
1239 + }
1240 + p[5] &= ~MPPE_56BIT;
1241 + goto check_mppe_40;
1242 + }
1243 + check_mppe_56:
1244 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1245 + if (ao->mppe_56) {
1246 + ho->mppe_56 = 1;
1247 + BCOPY(p, opt_buf, CILEN_MPPE);
1248 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1249 + MPPE_MAX_KEY_LEN);
1250 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1251 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1252 + ho->mppe_56 = 0;
1253 + p[5] &= ~MPPE_56BIT;
1254 + newret = CONFNAK;
1255 + }
1256 + goto check_mppe;
1257 + }
1258 + p[5] &= ~MPPE_56BIT;
1259 + newret = CONFNAK;
1260 + goto check_mppe;
1261 + }
1262 + check_mppe_40:
1263 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1264 + if (ao->mppe_40) {
1265 + ho->mppe_40 = 1;
1266 + BCOPY(p, opt_buf, CILEN_MPPE);
1267 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1268 + MPPE_MAX_KEY_LEN);
1269 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1270 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1271 + ho->mppe_40 = 0;
1272 + p[5] &= ~MPPE_40BIT;
1273 + newret = CONFNAK;
1274 + }
1275 + goto check_mppe;
1276 + }
1277 + p[5] &= ~MPPE_40BIT;
1278 + }
1279 +
1280 + check_mppe:
1281 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1282 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1283 + newret = CONFNAK;
1284 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1285 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1286 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1287 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1288 + (wo->mppc ? MPPE_MPPC : 0);
1289 + } else {
1290 + ho->mppe = ho->mppe_stateless = 0;
1291 }
1292 } else {
1293 - /* Neither are set. */
1294 + /* MPPE is not compatible with other compression types */
1295 + if (wo->mppe) {
1296 + ao->bsd_compress = 0;
1297 + ao->predictor_1 = 0;
1298 + ao->predictor_2 = 0;
1299 + ao->deflate = 0;
1300 + ao->lzs = 0;
1301 + }
1302 + }
1303 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1304 + p[2] = p2;
1305 + p[5] = p5;
1306 newret = CONFREJ;
1307 break;
1308 }
1309
1310 - /* rebuild the opts */
1311 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1312 - if (newret == CONFACK) {
1313 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1314 - int mtu;
1315 -
1316 - BCOPY(p, opt_buf, CILEN_MPPE);
1317 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1318 - MPPE_MAX_KEY_LEN);
1319 - if (ccp_test(f->unit, opt_buf,
1320 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1321 - /* This shouldn't happen, we've already tested it! */
1322 - error("MPPE required, but kernel has no support.");
1323 - lcp_close(f->unit, "MPPE required but not available");
1324 - newret = CONFREJ;
1325 - break;
1326 - }
1327 - /*
1328 - * We need to decrease the interface MTU by MPPE_PAD
1329 - * because MPPE frames **grow**. The kernel [must]
1330 - * allocate MPPE_PAD extra bytes in xmit buffers.
1331 - */
1332 - mtu = netif_get_mtu(f->unit);
1333 - if (mtu)
1334 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1335 - else
1336 - newret = CONFREJ;
1337 - }
1338 + /*
1339 + * I have commented the code below because according to RFC1547
1340 + * MTU is only information for higher level protocols about
1341 + * "the maximum allowable length for a packet (q.v.) transmitted
1342 + * over a point-to-point link without incurring network layer
1343 + * fragmentation." Of course a PPP implementation should be able
1344 + * to handle overhead added by MPPE - in our case apropriate code
1345 + * is located in drivers/net/ppp_generic.c in the kernel sources.
1346 + *
1347 + * According to RFC1661:
1348 + * - when negotiated MRU is less than 1500 octets, a PPP
1349 + * implementation must still be able to receive at least 1500
1350 + * octets,
1351 + * - when PFC is negotiated, a PPP implementation is still
1352 + * required to receive frames with uncompressed protocol field.
1353 + *
1354 + * So why not to handle MPPE overhead without changing MTU value?
1355 + * I am sure that RFC3078, unfortunately silently, assumes that.
1356 + */
1357
1358 /*
1359 - * We have accepted MPPE or are willing to negotiate
1360 - * MPPE parameters. A CONFREJ is due to subsequent
1361 - * (non-MPPE) processing.
1362 + * We need to decrease the interface MTU by MPPE_PAD
1363 + * because MPPE frames **grow**. The kernel [must]
1364 + * allocate MPPE_PAD extra bytes in xmit buffers.
1365 */
1366 - rej_for_ci_mppe = 0;
1367 +/*
1368 + mtu = netif_get_mtu(f->unit);
1369 + if (mtu) {
1370 + netif_set_mtu(f->unit, mtu - MPPE_PAD);
1371 + } else {
1372 + newret = CONFREJ;
1373 + if (ccp_wantoptions[f->unit].mppe) {
1374 + error("Cannot adjust MTU needed by MPPE.");
1375 + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1376 + }
1377 + }
1378 +*/
1379 break;
1380 #endif /* MPPE */
1381 +
1382 + case CI_LZS:
1383 + if (!ao->lzs || clen != CILEN_LZS) {
1384 + newret = CONFREJ;
1385 + break;
1386 + }
1387 +
1388 + ho->lzs = 1;
1389 + ho->lzs_hists = (p[2] << 8) | p[3];
1390 + ho->lzs_mode = p[4];
1391 + if ((ho->lzs_hists != ao->lzs_hists) ||
1392 + (ho->lzs_mode != ao->lzs_mode)) {
1393 + newret = CONFNAK;
1394 + if (!dont_nak) {
1395 + p[2] = ao->lzs_hists >> 8;
1396 + p[3] = ao->lzs_hists & 0xff;
1397 + p[4] = ao->lzs_mode;
1398 + } else
1399 + break;
1400 + }
1401 +
1402 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1403 + newret = CONFREJ;
1404 + }
1405 + break;
1406 +
1407 case CI_DEFLATE:
1408 case CI_DEFLATE_DRAFT:
1409 if (!ao->deflate || clen != CILEN_DEFLATE
1410 @@ -1340,12 +1832,6 @@
1411 else
1412 *lenp = retp - p0;
1413 }
1414 -#ifdef MPPE
1415 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1416 - error("MPPE required but peer negotiation failed");
1417 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1418 - }
1419 -#endif
1420 return ret;
1421 }
1422
1423 @@ -1367,24 +1853,35 @@
1424 char *p = result;
1425 char *q = result + sizeof(result); /* 1 past result */
1426
1427 - slprintf(p, q - p, "MPPE ");
1428 - p += 5;
1429 - if (opt->mppe & MPPE_OPT_128) {
1430 - slprintf(p, q - p, "128-bit ");
1431 - p += 8;
1432 - }
1433 - if (opt->mppe & MPPE_OPT_40) {
1434 - slprintf(p, q - p, "40-bit ");
1435 - p += 7;
1436 - }
1437 - if (opt->mppe & MPPE_OPT_STATEFUL)
1438 - slprintf(p, q - p, "stateful");
1439 - else
1440 - slprintf(p, q - p, "stateless");
1441 -
1442 + if (opt->mppe) {
1443 + if (opt->mppc) {
1444 + slprintf(p, q - p, "MPPC/MPPE ");
1445 + p += 10;
1446 + } else {
1447 + slprintf(p, q - p, "MPPE ");
1448 + p += 5;
1449 + }
1450 + if (opt->mppe_128) {
1451 + slprintf(p, q - p, "128-bit ");
1452 + p += 8;
1453 + } else if (opt->mppe_56) {
1454 + slprintf(p, q - p, "56-bit ");
1455 + p += 7;
1456 + } else if (opt->mppe_40) {
1457 + slprintf(p, q - p, "40-bit ");
1458 + p += 7;
1459 + }
1460 + if (opt->mppe_stateless)
1461 + slprintf(p, q - p, "stateless");
1462 + else
1463 + slprintf(p, q - p, "stateful");
1464 + } else if (opt->mppc)
1465 + slprintf(p, q - p, "MPPC");
1466 break;
1467 }
1468 -#endif
1469 +#endif /* MPPE */
1470 + case CI_LZS:
1471 + return "Stac LZS";
1472 case CI_DEFLATE:
1473 case CI_DEFLATE_DRAFT:
1474 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1475 @@ -1440,12 +1937,12 @@
1476 } else if (ANY_COMPRESS(*ho))
1477 notice("%s transmit compression enabled", method_name(ho, NULL));
1478 #ifdef MPPE
1479 - if (go->mppe) {
1480 + if (go->mppe || go->mppc) {
1481 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1482 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1483 continue_networks(f->unit); /* Bring up IP et al */
1484 }
1485 -#endif
1486 +#endif /* MPPE */
1487 }
1488
1489 /*
1490 @@ -1468,7 +1965,7 @@
1491 lcp_close(f->unit, "MPPE disabled");
1492 }
1493 }
1494 -#endif
1495 +#endif /* MPPE */
1496 }
1497
1498 /*
1499 @@ -1528,24 +2025,28 @@
1500 #ifdef MPPE
1501 case CI_MPPE:
1502 if (optlen >= CILEN_MPPE) {
1503 - u_char mppe_opts;
1504 -
1505 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1506 - printer(arg, "mppe %s %s %s %s %s %s%s",
1507 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1508 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1509 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1510 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1511 + printer(arg, "mppe %s %s %s %s %s %s",
1512 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1513 + (p[5] & MPPE_56BIT)? "+M": "-M",
1514 + (p[5] & MPPE_128BIT)? "+S": "-S",
1515 + (p[5] & MPPE_40BIT)? "+L": "-L",
1516 (p[5] & MPPE_D_BIT)? "+D": "-D",
1517 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1518 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1519 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1520 + (p[5] & MPPE_MPPC)? "+C": "-C");
1521 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1522 + MPPE_D_BIT | MPPE_MPPC)) ||
1523 + (p[2] & ~MPPE_STATELESS))
1524 printer(arg, " (%.2x %.2x %.2x %.2x)",
1525 p[2], p[3], p[4], p[5]);
1526 p += CILEN_MPPE;
1527 }
1528 break;
1529 -#endif
1530 +#endif /* MPPE */
1531 + case CI_LZS:
1532 + if (optlen >= CILEN_LZS) {
1533 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1534 + p += CILEN_LZS;
1535 + }
1536 + break;
1537 case CI_DEFLATE:
1538 case CI_DEFLATE_DRAFT:
1539 if (optlen >= CILEN_DEFLATE) {
1540 @@ -1631,6 +2132,7 @@
1541 error("Lost compression sync: disabling compression");
1542 ccp_close(unit, "Lost compression sync");
1543 #ifdef MPPE
1544 + /* My module dosn't need this. J.D., 2003-07-06 */
1545 /*
1546 * If we were doing MPPE, we must also take the link down.
1547 */
1548 @@ -1638,9 +2140,18 @@
1549 error("Too many MPPE errors, closing LCP");
1550 lcp_close(unit, "Too many MPPE errors");
1551 }
1552 -#endif
1553 +#endif /* MPPE */
1554 } else {
1555 /*
1556 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1557 + * and don't wait for CCP_RESETACK
1558 + */
1559 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1560 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1561 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1562 + return;
1563 + }
1564 + /*
1565 * Send a reset-request to reset the peer's compressor.
1566 * We don't do that if we are still waiting for an
1567 * acknowledgement to a previous reset-request.
1568 @@ -1671,4 +2182,3 @@
1569 } else
1570 ccp_localstate[f->unit] &= ~RACK_PENDING;
1571 }
1572 -
1573 diff -ruN ppp-2.4.3-orig/pppd/ccp.h ppp-2.4.3-3/pppd/ccp.h
1574 --- ppp-2.4.3-orig/pppd/ccp.h 2004-11-04 11:02:26.000000000 +0100
1575 +++ ppp-2.4.3-3/pppd/ccp.h 2004-12-05 17:51:27.000000000 +0100
1576 @@ -37,9 +37,17 @@
1577 bool predictor_2; /* do Predictor-2? */
1578 bool deflate_correct; /* use correct code for deflate? */
1579 bool deflate_draft; /* use draft RFC code for deflate? */
1580 + bool lzs; /* do Stac LZS? */
1581 + bool mppc; /* do MPPC? */
1582 bool mppe; /* do MPPE? */
1583 + bool mppe_40; /* allow 40 bit encryption? */
1584 + bool mppe_56; /* allow 56 bit encryption? */
1585 + bool mppe_128; /* allow 128 bit encryption? */
1586 + bool mppe_stateless; /* allow stateless encryption */
1587 u_short bsd_bits; /* # bits/code for BSD Compress */
1588 u_short deflate_size; /* lg(window size) for Deflate */
1589 + u_short lzs_mode; /* LZS check mode */
1590 + u_short lzs_hists; /* number of LZS histories */
1591 short method; /* code for chosen compression method */
1592 } ccp_options;
1593
1594 diff -ruN ppp-2.4.3-orig/pppd/chap_ms.c ppp-2.4.3-3/pppd/chap_ms.c
1595 --- ppp-2.4.3-orig/pppd/chap_ms.c 2004-11-12 10:57:43.000000000 +0100
1596 +++ ppp-2.4.3-3/pppd/chap_ms.c 2004-12-05 17:51:27.000000000 +0100
1597 @@ -895,13 +895,17 @@
1598 /*
1599 * Disable undesirable encryption types. Note that we don't ENABLE
1600 * any encryption types, to avoid overriding manual configuration.
1601 + *
1602 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1603 */
1604 switch(types) {
1605 case MPPE_ENC_TYPES_RC4_40:
1606 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1607 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1608 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1609 break;
1610 case MPPE_ENC_TYPES_RC4_128:
1611 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1612 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1613 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1614 break;
1615 default:
1616 break;
1617 diff -ruN ppp-2.4.3-orig/pppd/plugins/Makefile.linux ppp-2.4.3-3/pppd/plugins/Makefile.linux
1618 --- ppp-2.4.3-orig/pppd/plugins/Makefile.linux 2004-11-14 08:57:35.000000000 +0100
1619 +++ ppp-2.4.3-3/pppd/plugins/Makefile.linux 2004-12-05 17:03:59.000000000 +0100
1620 @@ -9,7 +9,7 @@
1621 MANDIR = $(DESTDIR)/share/man/man8
1622 LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION)
1623
1624 -SUBDIRS := rp-pppoe pppoatm radius
1625 +SUBDIRS := rp-pppoe radius
1626 # Uncomment the next line to include the radius authentication plugin
1627 # SUBDIRS += radius
1628 PLUGINS := minconn.so passprompt.so passwordfd.so winbind.so
1629 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/Makefile.linux ppp-2.4.3-3/pppd/plugins/radius/Makefile.linux
1630 --- ppp-2.4.3-orig/pppd/plugins/radius/Makefile.linux 2004-11-14 08:02:31.000000000 +0100
1631 +++ ppp-2.4.3-3/pppd/plugins/radius/Makefile.linux 2004-12-05 17:43:17.000000000 +0100
1632 @@ -12,7 +12,8 @@
1633 INSTALL = install
1634
1635 PLUGIN=radius.so radattr.so radrealms.so
1636 -CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
1637 +COPTS = -O2
1638 +CFLAGS=-I. -I../.. -I../../../include $(COPTS) -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
1639
1640 # Uncomment the next line to include support for Microsoft's
1641 # MS-CHAP authentication protocol.
1642 @@ -36,9 +37,9 @@
1643
1644 install: all
1645 $(INSTALL) -d -m 755 $(LIBDIR)
1646 - $(INSTALL) -s -c -m 755 radius.so $(LIBDIR)
1647 - $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR)
1648 - $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR)
1649 + $(INSTALL) -c -m 755 radius.so $(LIBDIR)
1650 + $(INSTALL) -c -m 755 radattr.so $(LIBDIR)
1651 + $(INSTALL) -c -m 755 radrealms.so $(LIBDIR)
1652 $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR)
1653 $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR)
1654
1655 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/config.c ppp-2.4.3-3/pppd/plugins/radius/config.c
1656 --- ppp-2.4.3-orig/pppd/plugins/radius/config.c 2004-11-14 08:26:26.000000000 +0100
1657 +++ ppp-2.4.3-3/pppd/plugins/radius/config.c 2004-12-16 04:03:46.000000000 +0100
1658 @@ -369,31 +369,37 @@
1659 }
1660 #endif
1661
1662 +#if 0
1663 if (rc_conf_int("login_tries") <= 0)
1664 {
1665 error("%s: login_tries <= 0 is illegal", filename);
1666 return (-1);
1667 }
1668 +#endif
1669 if (rc_conf_str("seqfile") == NULL)
1670 {
1671 error("%s: seqfile not specified", filename);
1672 return (-1);
1673 }
1674 +#if 0
1675 if (rc_conf_int("login_timeout") <= 0)
1676 {
1677 error("%s: login_timeout <= 0 is illegal", filename);
1678 return (-1);
1679 }
1680 +#endif
1681 if (rc_conf_str("mapfile") == NULL)
1682 {
1683 error("%s: mapfile not specified", filename);
1684 return (-1);
1685 }
1686 +#if 0
1687 if (rc_conf_str("nologin") == NULL)
1688 {
1689 error("%s: nologin not specified", filename);
1690 return (-1);
1691 }
1692 +#endif
1693
1694 return 0;
1695 }
1696 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/options.h ppp-2.4.3-3/pppd/plugins/radius/options.h
1697 --- ppp-2.4.3-orig/pppd/plugins/radius/options.h 2004-11-14 08:26:26.000000000 +0100
1698 +++ ppp-2.4.3-3/pppd/plugins/radius/options.h 2004-12-16 04:09:16.000000000 +0100
1699 @@ -31,24 +31,21 @@
1700 static SERVER acctserver = {0};
1701 static SERVER authserver = {0};
1702
1703 -int default_tries = 4;
1704 -int default_timeout = 60;
1705 -
1706 static OPTION config_options[] = {
1707 /* internally used options */
1708 {"config_file", OT_STR, ST_UNDEF, NULL},
1709 /* General options */
1710 {"auth_order", OT_AUO, ST_UNDEF, NULL},
1711 -{"login_tries", OT_INT, ST_UNDEF, &default_tries},
1712 -{"login_timeout", OT_INT, ST_UNDEF, &default_timeout},
1713 -{"nologin", OT_STR, ST_UNDEF, "/etc/nologin"},
1714 -{"issue", OT_STR, ST_UNDEF, "/etc/radiusclient/issue"},
1715 +{"login_tries", OT_INT, ST_UNDEF, NULL},
1716 +{"login_timeout", OT_INT, ST_UNDEF, NULL},
1717 +{"nologin", OT_STR, ST_UNDEF, NULL},
1718 +{"issue", OT_STR, ST_UNDEF, NULL},
1719 /* RADIUS specific options */
1720 {"authserver", OT_SRV, ST_UNDEF, &authserver},
1721 {"acctserver", OT_SRV, ST_UNDEF, &acctserver},
1722 {"servers", OT_STR, ST_UNDEF, NULL},
1723 {"dictionary", OT_STR, ST_UNDEF, NULL},
1724 -{"login_radius", OT_STR, ST_UNDEF, "/usr/sbin/login.radius"},
1725 +{"login_radius", OT_STR, ST_UNDEF, NULL},
1726 {"seqfile", OT_STR, ST_UNDEF, NULL},
1727 {"mapfile", OT_STR, ST_UNDEF, NULL},
1728 {"default_realm", OT_STR, ST_UNDEF, NULL},
1729 diff -ruN ppp-2.4.3-orig/pppd/plugins/rp-pppoe/Makefile.linux ppp-2.4.3-3/pppd/plugins/rp-pppoe/Makefile.linux
1730 --- ppp-2.4.3-orig/pppd/plugins/rp-pppoe/Makefile.linux 2004-11-14 08:58:37.000000000 +0100
1731 +++ ppp-2.4.3-3/pppd/plugins/rp-pppoe/Makefile.linux 2004-12-05 17:43:23.000000000 +0100
1732 @@ -39,9 +39,9 @@
1733
1734 install: all
1735 $(INSTALL) -d -m 755 $(LIBDIR)
1736 - $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR)
1737 + $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR)
1738 $(INSTALL) -d -m 755 $(BINDIR)
1739 - $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR)
1740 + $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR)
1741
1742 clean:
1743 rm -f *.o *.so
1744 diff -ruN ppp-2.4.3-orig/pppd/plugins/rp-pppoe/plugin.c ppp-2.4.3-3/pppd/plugins/rp-pppoe/plugin.c
1745 --- ppp-2.4.3-orig/pppd/plugins/rp-pppoe/plugin.c 2004-11-04 11:07:37.000000000 +0100
1746 +++ ppp-2.4.3-3/pppd/plugins/rp-pppoe/plugin.c 2004-12-16 01:07:22.000000000 +0100
1747 @@ -286,7 +286,7 @@
1748 /* Strip off "nic-" */
1749 cmd += 4;
1750 } else if (strlen(cmd) < 4
1751 - || (strncmp(cmd, "eth", 3) && strncmp(cmd, "nas", 3)
1752 + || (strncmp(cmd, "eth", 3) && strncmp(cmd, "nas", 3) && strncmp(cmd, "vlan", 4)
1753 && strncmp(cmd, "tap", 3) && strncmp(cmd, "br", 2))) {
1754 return 0;
1755 }
1756 diff -ruN ppp-2.4.3-orig/pppd/pppd.8 ppp-2.4.3-3/pppd/pppd.8
1757 --- ppp-2.4.3-orig/pppd/pppd.8 2004-11-13 13:22:49.000000000 +0100
1758 +++ ppp-2.4.3-3/pppd/pppd.8 2004-12-05 17:51:27.000000000 +0100
1759 @@ -622,9 +622,29 @@
1760 Enables the use of PPP multilink; this is an alias for the `multilink'
1761 option. This option is currently only available under Linux.
1762 .TP
1763 -.B mppe\-stateful
1764 -Allow MPPE to use stateful mode. Stateless mode is still attempted first.
1765 -The default is to disallow stateful mode.
1766 +.B mppc
1767 +Enables MPPC (Microsoft Point to Point Compression). This is the default.
1768 +.TP
1769 +.B mppe \fIsubopt1[,subopt2[,subopt3[..]]]
1770 +Modify MPPE (Microsoft Point to Point Encryption) parameters. In order
1771 +for MPPE to successfully come up, you must have authenticated with either
1772 +MS-CHAP or MS-CHAPv2. By default MPPE is optional, it means that pppd will
1773 +not propose MPPE to the peer, but will negotiate MPPE if peer wants that.
1774 +You can change this using \fIrequired\fR suboption.
1775 +This option is presently only supported under Linux, and only if your
1776 +kernel has been configured to include MPPE support.
1777 +.IP
1778 +MPPE suboptions:
1779 +.br
1780 +\fIrequired\fR - require MPPE; disconnect if peer doesn't support it,
1781 +.br
1782 +\fIstateless\fR - try to negotiate stateless mode; default is stateful,
1783 +.br
1784 +\fIno40\fR - disable 40 bit keys,
1785 +.br
1786 +\fIno56\fR - disable 56 bit keys,
1787 +.br
1788 +\fIno128\fR - disable 128 bit keys
1789 .TP
1790 .B mpshortseq
1791 Enables the use of short (12-bit) sequence numbers in multilink
1792 @@ -757,17 +777,11 @@
1793 Disables the use of PPP multilink. This option is currently only
1794 available under Linux.
1795 .TP
1796 -.B nomppe
1797 -Disables MPPE (Microsoft Point to Point Encryption). This is the default.
1798 -.TP
1799 -.B nomppe\-40
1800 -Disable 40-bit encryption with MPPE.
1801 +.B nomppc
1802 +Disables MPPC (Microsoft Point to Point Compression).
1803 .TP
1804 -.B nomppe\-128
1805 -Disable 128-bit encryption with MPPE.
1806 -.TP
1807 -.B nomppe\-stateful
1808 -Disable MPPE stateful mode. This is the default.
1809 +.B nomppe
1810 +Disables MPPE (Microsoft Point to Point Encryption).
1811 .TP
1812 .B nompshortseq
1813 Disables the use of short (12-bit) sequence numbers in the PPP
1814 @@ -948,19 +962,6 @@
1815 Require the peer to authenticate itself using CHAP [Challenge
1816 Handshake Authentication Protocol] authentication.
1817 .TP
1818 -.B require\-mppe
1819 -Require the use of MPPE (Microsoft Point to Point Encryption). This
1820 -option disables all other compression types. This option enables
1821 -both 40-bit and 128-bit encryption. In order for MPPE to successfully
1822 -come up, you must have authenticated with either MS\-CHAP or MS\-CHAPv2.
1823 -This option is presently only supported under Linux, and only if your
1824 -kernel has been configured to include MPPE support.
1825 -.TP
1826 -.B require\-mppe\-40
1827 -Require the use of MPPE, with 40-bit encryption.
1828 -.TP
1829 -.B require\-mppe\-128
1830 -Require the use of MPPE, with 128-bit encryption.
1831 .TP
1832 .B require\-mschap
1833 Require the peer to authenticate itself using MS\-CHAP [Microsoft Challenge
1834 diff -ruN ppp-2.4.3-orig/pppdump/Makefile.linux ppp-2.4.3-3/pppdump/Makefile.linux
1835 --- ppp-2.4.3-orig/pppdump/Makefile.linux 2004-10-31 02:36:52.000000000 +0200
1836 +++ ppp-2.4.3-3/pppdump/Makefile.linux 2004-12-05 17:50:34.000000000 +0100
1837 @@ -2,7 +2,8 @@
1838 BINDIR = $(DESTDIR)/sbin
1839 MANDIR = $(DESTDIR)/share/man/man8
1840
1841 -CFLAGS= -O -I../include/net
1842 +COPTS = -O
1843 +CFLAGS= $(COPTS) -I../include/net
1844 OBJS = pppdump.o bsd-comp.o deflate.o zlib.o
1845
1846 INSTALL= install
1847 @@ -17,5 +18,5 @@
1848
1849 install:
1850 mkdir -p $(BINDIR) $(MANDIR)
1851 - $(INSTALL) -s -c pppdump $(BINDIR)
1852 + $(INSTALL) -c pppdump $(BINDIR)
1853 $(INSTALL) -c -m 444 pppdump.8 $(MANDIR)
1854 diff -ruN ppp-2.4.3-orig/pppstats/Makefile.linux ppp-2.4.3-3/pppstats/Makefile.linux
1855 --- ppp-2.4.3-orig/pppstats/Makefile.linux 2004-10-31 23:09:03.000000000 +0100
1856 +++ ppp-2.4.3-3/pppstats/Makefile.linux 2004-12-05 17:43:38.000000000 +0100
1857 @@ -22,7 +22,7 @@
1858
1859 install: pppstats
1860 -mkdir -p $(MANDIR)
1861 - $(INSTALL) -s -c pppstats $(BINDIR)
1862 + $(INSTALL) -c pppstats $(BINDIR)
1863 $(INSTALL) -c -m 444 pppstats.8 $(MANDIR)
1864
1865 pppstats: $(PPPSTATSRCS)
Personal OpenWRT clone
This page took 0.116184 seconds and 5 git commands to generate.