projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fix potential rootfs owner/group mismatch (tgz root only, patch from #4562)
[openwrt.git] / package / ppp / patches / 201-mppe_mppc_1.1.patch
1 Index: ppp-2.4.3/include/linux/ppp-comp.h
2 ===================================================================
3 --- ppp-2.4.3.orig/include/linux/ppp-comp.h 2007-06-04 13:22:08.143617264 +0200
4 +++ ppp-2.4.3/include/linux/ppp-comp.h 2007-06-04 13:22:12.031026288 +0200
5 @@ -36,7 +36,7 @@
6 */
7
8 /*
9 - * ==FILEVERSION 20020319==
10 + * ==FILEVERSION 20020715==
11 *
12 * NOTE TO MAINTAINERS:
13 * If you modify this file at all, please set the above date.
14 @@ -86,7 +86,7 @@
15
16 /* Compress a packet */
17 int (*compress) (void *state, unsigned char *rptr,
18 - unsigned char *obuf, int isize, int osize);
19 + unsigned char *obuf, int isize, int osize);
20
21 /* Return compression statistics */
22 void (*comp_stat) (void *state, struct compstat *stats);
23 @@ -107,7 +107,7 @@
24
25 /* Decompress a packet. */
26 int (*decompress) (void *state, unsigned char *ibuf, int isize,
27 - unsigned char *obuf, int osize);
28 + unsigned char *obuf, int osize);
29
30 /* Update state for an incompressible packet received */
31 void (*incomp) (void *state, unsigned char *ibuf, int icnt);
32 @@ -288,6 +288,33 @@
33 opts |= MPPE_OPT_UNKNOWN; \
34 } while (/* CONSTCOND */ 0)
35
36 +/* MPPE/MPPC definitions by J.D.*/
37 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
38 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
39 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
40 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
41 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
42 +
43 +/*
44 + * Definitions for Stac LZS.
45 + */
46 +
47 +#define CI_LZS 17 /* config option for Stac LZS */
48 +#define CILEN_LZS 5 /* length of config option */
49 +
50 +#define LZS_OVHD 4 /* max. LZS overhead */
51 +#define LZS_HIST_LEN 2048 /* LZS history size */
52 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
53 +
54 +#define LZS_MODE_NONE 0
55 +#define LZS_MODE_LCB 1
56 +#define LZS_MODE_CRC 2
57 +#define LZS_MODE_SEQ 3
58 +#define LZS_MODE_EXT 4
59 +
60 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
61 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
62 +
63 /*
64 * Definitions for other, as yet unsupported, compression methods.
65 */
66 Index: ppp-2.4.3/include/net/ppp-comp.h
67 ===================================================================
68 --- ppp-2.4.3.orig/include/net/ppp-comp.h 2007-06-04 13:22:08.150616200 +0200
69 +++ ppp-2.4.3/include/net/ppp-comp.h 2007-06-04 13:22:12.031026288 +0200
70 @@ -255,6 +255,33 @@
71 opts |= MPPE_OPT_UNKNOWN; \
72 } while (/* CONSTCOND */ 0)
73
74 +/* MPPE/MPPC definitions by J.D.*/
75 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
76 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
77 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
78 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
79 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
80 +
81 +/*
82 + * Definitions for Stac LZS.
83 + */
84 +
85 +#define CI_LZS 17 /* config option for Stac LZS */
86 +#define CILEN_LZS 5 /* length of config option */
87 +
88 +#define LZS_OVHD 4 /* max. LZS overhead */
89 +#define LZS_HIST_LEN 2048 /* LZS history size */
90 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
91 +
92 +#define LZS_MODE_NONE 0
93 +#define LZS_MODE_LCB 1
94 +#define LZS_MODE_CRC 2
95 +#define LZS_MODE_SEQ 3
96 +#define LZS_MODE_EXT 4
97 +
98 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
99 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
100 +
101 /*
102 * Definitions for other, as yet unsupported, compression methods.
103 */
104 Index: ppp-2.4.3/pppd/ccp.c
105 ===================================================================
106 --- ppp-2.4.3.orig/pppd/ccp.c 2007-06-04 13:22:08.157615136 +0200
107 +++ ppp-2.4.3/pppd/ccp.c 2007-06-04 13:22:12.033025984 +0200
108 @@ -62,12 +62,10 @@
109 static char bsd_value[8];
110 static char deflate_value[8];
111
112 -/*
113 - * Option variables.
114 - */
115 #ifdef MPPE
116 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
117 -#endif
118 +static int setmppe(char **);
119 +static int setnomppe(void);
120 +#endif /* MPPE */
121
122 static option_t ccp_option_list[] = {
123 { "noccp", o_bool, &ccp_protent.enabled_flag,
124 @@ -108,54 +106,36 @@
125 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
126 &ccp_allowoptions[0].predictor_1 },
127
128 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
129 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
130 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
131 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
132 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
133 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
134 + &ccp_allowoptions[0].lzs },
135 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
136 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
137 + &ccp_allowoptions[0].lzs },
138 +
139 #ifdef MPPE
140 - /* MPPE options are symmetrical ... we only set wantoptions here */
141 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
142 - "require MPPE encryption",
143 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
144 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
145 - "require MPPE encryption",
146 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
147 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
148 - "don't allow MPPE encryption", OPT_PRIO },
149 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
150 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
151 -
152 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
153 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
154 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
155 - &ccp_wantoptions[0].mppe },
156 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
157 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
158 - &ccp_wantoptions[0].mppe },
159 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
160 - "don't allow MPPE 40-bit encryption",
161 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
162 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
163 - "don't allow MPPE 40-bit encryption",
164 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
165 - &ccp_wantoptions[0].mppe },
166 -
167 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
168 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
169 - &ccp_wantoptions[0].mppe },
170 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
171 - "require MPPE 128-bit encryption",
172 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
173 - &ccp_wantoptions[0].mppe },
174 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
175 - "don't allow MPPE 128-bit encryption",
176 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
177 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
178 - "don't allow MPPE 128-bit encryption",
179 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
180 - &ccp_wantoptions[0].mppe },
181 -
182 - /* strange one; we always request stateless, but will we allow stateful? */
183 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
184 - "allow MPPE stateful mode", OPT_PRIO },
185 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
186 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
187 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
188 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
189 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
190 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
191 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
192 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
193 + &ccp_allowoptions[0].mppc },
194 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
195 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
196 + &ccp_allowoptions[0].mppc },
197 + { "mppe", o_special, (void *)setmppe,
198 + "request MPPE encryption" },
199 + { "+mppe", o_special, (void *)setmppe,
200 + "request MPPE encryption" },
201 + { "nomppe", o_special_noarg, (void *)setnomppe,
202 + "don't allow MPPE encryption" },
203 + { "-mppe", o_special_noarg, (void *)setnomppe,
204 + "don't allow MPPE encryption" },
205 #endif /* MPPE */
206
207 { NULL }
208 @@ -241,7 +221,7 @@
209 */
210 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
211 || (opt).predictor_1 || (opt).predictor_2 \
212 - || (opt).mppe)
213 + || (opt).lzs || (opt).mppc || (opt).mppe)
214
215 /*
216 * Local state (mainly for handling reset-reqs and reset-acks).
217 @@ -344,6 +324,100 @@
218 return 1;
219 }
220
221 +#ifdef MPPE
222 +/*
223 + * Functions called from config options
224 + */
225 +/*
226 + MPPE suboptions:
227 + required - require MPPE; disconnect if peer doesn't support it
228 + stateless - use stateless mode
229 + no40 - disable 40 bit keys
230 + no56 - disable 56 bit keys
231 + no128 - disable 128 bit keys
232 +*/
233 +int setmppe(char **argv)
234 +{
235 + int i;
236 + char *str, cmdbuf[16];
237 +
238 + ccp_allowoptions[0].mppe = 1;
239 + ccp_allowoptions[0].mppe_40 = 1;
240 + ccp_allowoptions[0].mppe_56 = 1;
241 + ccp_allowoptions[0].mppe_128 = 1;
242 + ccp_allowoptions[0].mppe_stateless = 0;
243 + ccp_wantoptions[0].mppe = 0;
244 +
245 + str = *argv;
246 +
247 + while (1) {
248 + i = 0;
249 + memset(cmdbuf, '\0', 16);
250 + while ((i < 16) && (*str != ',') && (*str != '\0'))
251 + cmdbuf[i++] = *str++;
252 + cmdbuf[i] = '\0';
253 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
254 + ccp_allowoptions[0].mppe_40 = 0;
255 + goto next_param;
256 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
257 + ccp_allowoptions[0].mppe_56 = 0;
258 + goto next_param;
259 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
260 + ccp_allowoptions[0].mppe_128 = 0;
261 + goto next_param;
262 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
263 + ccp_allowoptions[0].mppe_stateless = 1;
264 + goto next_param;
265 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
266 + ccp_wantoptions[0].mppe = 1;
267 + goto next_param;
268 + } else {
269 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
270 + return 0;
271 + }
272 +
273 + next_param:
274 + if (*str == ',') {
275 + str++;
276 + continue;
277 + }
278 + if (*str == '\0') {
279 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
280 + ccp_allowoptions[0].mppe_128)) {
281 + if (ccp_wantoptions[0].mppe == 1) {
282 + option_error("You require MPPE but you have switched off "
283 + "all encryption key lengths.");
284 + return 0;
285 + }
286 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
287 + ccp_wantoptions[0].mppe_stateless =
288 + ccp_allowoptions[0].mppe_stateless = 0;
289 + } else {
290 + ccp_allowoptions[0].mppe = 1;
291 + ccp_wantoptions[0].mppe_stateless =
292 + ccp_allowoptions[0].mppe_stateless;
293 + if (ccp_wantoptions[0].mppe == 1) {
294 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
295 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
296 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
297 + }
298 + }
299 + return 1;
300 + }
301 + }
302 +}
303 +
304 +int setnomppe(void)
305 +{
306 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
307 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
308 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
309 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
310 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
311 + return 1;
312 +}
313 +#endif /* MPPE */
314 +
315 /*
316 * ccp_init - initialize CCP.
317 */
318 @@ -378,6 +452,30 @@
319 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
320
321 ccp_allowoptions[0].predictor_1 = 1;
322 +
323 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
324 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
325 + ccp_wantoptions[0].lzs_hists = 1;
326 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
327 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
328 + ccp_allowoptions[0].lzs_hists = 1;
329 +
330 +#ifdef MPPE
331 + /* by default allow and request MPPC... */
332 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
333 +
334 + /* ... and allow but don't request MPPE */
335 + ccp_allowoptions[0].mppe = 1;
336 + ccp_allowoptions[0].mppe_40 = 1;
337 + ccp_allowoptions[0].mppe_56 = 1;
338 + ccp_allowoptions[0].mppe_128 = 1;
339 + ccp_allowoptions[0].mppe_stateless = 1;
340 + ccp_wantoptions[0].mppe = 0;
341 + ccp_wantoptions[0].mppe_40 = 0;
342 + ccp_wantoptions[0].mppe_56 = 0;
343 + ccp_wantoptions[0].mppe_128 = 0;
344 + ccp_wantoptions[0].mppe_stateless = 0;
345 +#endif /* MPPE */
346 }
347
348 /*
349 @@ -455,11 +553,11 @@
350 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
351 notice("Compression disabled by peer.");
352 #ifdef MPPE
353 - if (ccp_gotoptions[unit].mppe) {
354 + if (ccp_wantoptions[unit].mppe) {
355 error("MPPE disabled, closing LCP");
356 lcp_close(unit, "MPPE disabled by peer");
357 }
358 -#endif
359 +#endif /* MPPE */
360 }
361
362 /*
363 @@ -487,6 +585,15 @@
364 break;
365 /* send a reset-ack, which the transmitter will see and
366 reset its compression state. */
367 +
368 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
369 + but we do it in order to reset compressor; CCP_RESETACK is
370 + then silently discarded. See functions ppp_send_frame and
371 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
372 + confusion is caused by the fact that CCP code is splited
373 + into two parts - one part is handled by pppd, the other one
374 + is handled by kernel. */
375 +
376 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
377 break;
378
379 @@ -515,12 +622,11 @@
380 fsm_lowerdown(&ccp_fsm[unit]);
381
382 #ifdef MPPE
383 - if (ccp_gotoptions[unit].mppe) {
384 + if (ccp_wantoptions[unit].mppe) {
385 error("MPPE required but peer negotiation failed");
386 lcp_close(unit, "MPPE required but peer negotiation failed");
387 }
388 -#endif
389 -
390 +#endif /* MPPE */
391 }
392
393 /*
394 @@ -537,7 +643,7 @@
395 all_rejected[f->unit] = 0;
396
397 #ifdef MPPE
398 - if (go->mppe) {
399 + if (go->mppe || go->mppc) {
400 ccp_options *ao = &ccp_allowoptions[f->unit];
401 int auth_mschap_bits = auth_done[f->unit];
402 int numbits;
403 @@ -551,80 +657,109 @@
404 * NB: If MPPE is required, all other compression opts are invalid.
405 * So, we return right away if we can't do it.
406 */
407 + if (ccp_wantoptions[f->unit].mppe) {
408 + /* Leave only the mschap auth bits set */
409 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
410 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
411 + /* Count the mschap auths */
412 + auth_mschap_bits >>= CHAP_MS_SHIFT;
413 + numbits = 0;
414 + do {
415 + numbits += auth_mschap_bits & 1;
416 + auth_mschap_bits >>= 1;
417 + } while (auth_mschap_bits);
418 + if (numbits > 1) {
419 + error("MPPE required, but auth done in both directions.");
420 + lcp_close(f->unit, "MPPE required but not available");
421 + return;
422 + }
423 + if (!numbits) {
424 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
425 + lcp_close(f->unit, "MPPE required but not available");
426 + return;
427 + }
428
429 - /* Leave only the mschap auth bits set */
430 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
431 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
432 - /* Count the mschap auths */
433 - auth_mschap_bits >>= CHAP_MS_SHIFT;
434 - numbits = 0;
435 - do {
436 - numbits += auth_mschap_bits & 1;
437 - auth_mschap_bits >>= 1;
438 - } while (auth_mschap_bits);
439 - if (numbits > 1) {
440 - error("MPPE required, but auth done in both directions.");
441 - lcp_close(f->unit, "MPPE required but not available");
442 - return;
443 - }
444 - if (!numbits) {
445 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
446 - lcp_close(f->unit, "MPPE required but not available");
447 - return;
448 - }
449 -
450 - /* A plugin (eg radius) may not have obtained key material. */
451 - if (!mppe_keys_set) {
452 - error("MPPE required, but keys are not available. "
453 - "Possible plugin problem?");
454 - lcp_close(f->unit, "MPPE required but not available");
455 - return;
456 - }
457 -
458 - /* LM auth not supported for MPPE */
459 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
460 - /* This might be noise */
461 - if (go->mppe & MPPE_OPT_40) {
462 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
463 - go->mppe &= ~MPPE_OPT_40;
464 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
465 + /* A plugin (eg radius) may not have obtained key material. */
466 + if (!mppe_keys_set) {
467 + error("MPPE required, but keys are not available. "
468 + "Possible plugin problem?");
469 + lcp_close(f->unit, "MPPE required but not available");
470 + return;
471 }
472 }
473
474 - /* Last check: can we actually negotiate something? */
475 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
476 - /* Could be misconfig, could be 40-bit disabled above. */
477 - error("MPPE required, but both 40-bit and 128-bit disabled.");
478 - lcp_close(f->unit, "MPPE required but not available");
479 - return;
480 + /*
481 + * Check whether the kernel knows about the various
482 + * compression methods we might request. Key material
483 + * unimportant here.
484 + */
485 + if (go->mppc) {
486 + opt_buf[0] = CI_MPPE;
487 + opt_buf[1] = CILEN_MPPE;
488 + opt_buf[2] = 0;
489 + opt_buf[3] = 0;
490 + opt_buf[4] = 0;
491 + opt_buf[5] = MPPE_MPPC;
492 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
493 + go->mppc = 0;
494 + }
495 + if (go->mppe_40) {
496 + opt_buf[0] = CI_MPPE;
497 + opt_buf[1] = CILEN_MPPE;
498 + opt_buf[2] = MPPE_STATELESS;
499 + opt_buf[3] = 0;
500 + opt_buf[4] = 0;
501 + opt_buf[5] = MPPE_40BIT;
502 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
503 + go->mppe_40 = 0;
504 + }
505 + if (go->mppe_56) {
506 + opt_buf[0] = CI_MPPE;
507 + opt_buf[1] = CILEN_MPPE;
508 + opt_buf[2] = MPPE_STATELESS;
509 + opt_buf[3] = 0;
510 + opt_buf[4] = 0;
511 + opt_buf[5] = MPPE_56BIT;
512 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
513 + go->mppe_56 = 0;
514 + }
515 + if (go->mppe_128) {
516 + opt_buf[0] = CI_MPPE;
517 + opt_buf[1] = CILEN_MPPE;
518 + opt_buf[2] = MPPE_STATELESS;
519 + opt_buf[3] = 0;
520 + opt_buf[4] = 0;
521 + opt_buf[5] = MPPE_128BIT;
522 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
523 + go->mppe_128 = 0;
524 + }
525 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
526 + if (ccp_wantoptions[f->unit].mppe) {
527 + error("MPPE required, but kernel has no support.");
528 + lcp_close(f->unit, "MPPE required but not available");
529 + }
530 + go->mppe = go->mppe_stateless = 0;
531 + } else {
532 + /* MPPE is not compatible with other compression types */
533 + if (ccp_wantoptions[f->unit].mppe) {
534 + ao->bsd_compress = go->bsd_compress = 0;
535 + ao->predictor_1 = go->predictor_1 = 0;
536 + ao->predictor_2 = go->predictor_2 = 0;
537 + ao->deflate = go->deflate = 0;
538 + ao->lzs = go->lzs = 0;
539 + }
540 }
541 -
542 - /* sync options */
543 - ao->mppe = go->mppe;
544 - /* MPPE is not compatible with other compression types */
545 - ao->bsd_compress = go->bsd_compress = 0;
546 - ao->predictor_1 = go->predictor_1 = 0;
547 - ao->predictor_2 = go->predictor_2 = 0;
548 - ao->deflate = go->deflate = 0;
549 }
550 #endif /* MPPE */
551 -
552 - /*
553 - * Check whether the kernel knows about the various
554 - * compression methods we might request.
555 - */
556 -#ifdef MPPE
557 - if (go->mppe) {
558 - opt_buf[0] = CI_MPPE;
559 - opt_buf[1] = CILEN_MPPE;
560 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
561 - /* Key material unimportant here. */
562 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
563 - error("MPPE required, but kernel has no support.");
564 - lcp_close(f->unit, "MPPE required but not available");
565 - }
566 + if (go->lzs) {
567 + opt_buf[0] = CI_LZS;
568 + opt_buf[1] = CILEN_LZS;
569 + opt_buf[2] = go->lzs_hists >> 8;
570 + opt_buf[3] = go->lzs_hists & 0xff;
571 + opt_buf[4] = LZS_MODE_SEQ;
572 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
573 + go->lzs = 0;
574 }
575 -#endif
576 if (go->bsd_compress) {
577 opt_buf[0] = CI_BSD_COMPRESS;
578 opt_buf[1] = CILEN_BSD_COMPRESS;
579 @@ -679,7 +814,8 @@
580 + (go->deflate? CILEN_DEFLATE: 0)
581 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
582 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
583 - + (go->mppe? CILEN_MPPE: 0);
584 + + (go->lzs? CILEN_LZS: 0)
585 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
586 }
587
588 /*
589 @@ -693,6 +829,8 @@
590 {
591 int res;
592 ccp_options *go = &ccp_gotoptions[f->unit];
593 + ccp_options *ao = &ccp_allowoptions[f->unit];
594 + ccp_options *wo = &ccp_wantoptions[f->unit];
595 u_char *p0 = p;
596
597 /*
598 @@ -701,22 +839,43 @@
599 * in case it gets Acked.
600 */
601 #ifdef MPPE
602 - if (go->mppe) {
603 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
604 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
605
606 - p[0] = opt_buf[0] = CI_MPPE;
607 - p[1] = opt_buf[1] = CILEN_MPPE;
608 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
609 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
610 + p[0] = CI_MPPE;
611 + p[1] = CILEN_MPPE;
612 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
613 + p[3] = 0;
614 + p[4] = 0;
615 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
616 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
617 +
618 + BCOPY(p, opt_buf, CILEN_MPPE);
619 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
620 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
621 - if (res > 0)
622 + if (res > 0) {
623 p += CILEN_MPPE;
624 - else
625 + } else {
626 /* This shouldn't happen, we've already tested it! */
627 - lcp_close(f->unit, "MPPE required but not available in kernel");
628 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
629 + go->mppe_stateless = go->mppc = 0;
630 + if (ccp_wantoptions[f->unit].mppe)
631 + lcp_close(f->unit, "MPPE required but not available in kernel");
632 + }
633 + }
634 +#endif /* MPPE */
635 + if (go->lzs) {
636 + p[0] = CI_LZS;
637 + p[1] = CILEN_LZS;
638 + p[2] = go->lzs_hists >> 8;
639 + p[3] = go->lzs_hists & 0xff;
640 + p[4] = LZS_MODE_SEQ;
641 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
642 + if (res > 0) {
643 + p += CILEN_LZS;
644 + } else
645 + go->lzs = 0;
646 }
647 -#endif
648 if (go->deflate) {
649 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
650 p[1] = CILEN_DEFLATE;
651 @@ -802,7 +961,7 @@
652
653 /*
654 * ccp_ackci - process a received configure-ack, and return
655 - * 1 iff the packet was OK.
656 + * 1 if the packet was OK.
657 */
658 static int
659 ccp_ackci(f, p, len)
660 @@ -811,24 +970,44 @@
661 int len;
662 {
663 ccp_options *go = &ccp_gotoptions[f->unit];
664 + ccp_options *ao = &ccp_allowoptions[f->unit];
665 + ccp_options *wo = &ccp_wantoptions[f->unit];
666 u_char *p0 = p;
667
668 #ifdef MPPE
669 - if (go->mppe) {
670 - u_char opt_buf[CILEN_MPPE];
671 -
672 - opt_buf[0] = CI_MPPE;
673 - opt_buf[1] = CILEN_MPPE;
674 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
675 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
676 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
677 + if (len < CILEN_MPPE
678 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
679 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
680 + || p[3] != 0
681 + || p[4] != 0
682 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
683 + (go->mppc ? MPPE_MPPC : 0))
684 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
685 + (go->mppc ? MPPE_MPPC : 0))
686 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
687 + (go->mppc ? MPPE_MPPC : 0))))
688 return 0;
689 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
690 + go->mppe = 1;
691 p += CILEN_MPPE;
692 len -= CILEN_MPPE;
693 + /* Cope with first/fast ack */
694 + if (p == p0 && len == 0)
695 + return 1;
696 + }
697 +#endif /* MPPE */
698 + if (go->lzs) {
699 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
700 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
701 + || p[4] != LZS_MODE_SEQ)
702 + return 0;
703 + p += CILEN_LZS;
704 + len -= CILEN_LZS;
705 /* XXX Cope with first/fast ack */
706 - if (len == 0)
707 + if (p == p0 && len == 0)
708 return 1;
709 }
710 -#endif
711 if (go->deflate) {
712 if (len < CILEN_DEFLATE
713 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
714 @@ -891,7 +1070,7 @@
715
716 /*
717 * ccp_nakci - process received configure-nak.
718 - * Returns 1 iff the nak was OK.
719 + * Returns 1 if the nak was OK.
720 */
721 static int
722 ccp_nakci(f, p, len, treat_as_reject)
723 @@ -900,6 +1079,8 @@
724 int len;
725 {
726 ccp_options *go = &ccp_gotoptions[f->unit];
727 + ccp_options *ao = &ccp_allowoptions[f->unit];
728 + ccp_options *wo = &ccp_wantoptions[f->unit];
729 ccp_options no; /* options we've seen already */
730 ccp_options try; /* options to ask for next time */
731
732 @@ -907,28 +1088,100 @@
733 try = *go;
734
735 #ifdef MPPE
736 - if (go->mppe && len >= CILEN_MPPE
737 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
738 - no.mppe = 1;
739 - /*
740 - * Peer wants us to use a different strength or other setting.
741 - * Fail if we aren't willing to use his suggestion.
742 - */
743 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
744 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
745 - error("Refusing MPPE stateful mode offered by peer");
746 - try.mppe = 0;
747 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
748 - /* Peer must have set options we didn't request (suggest) */
749 - try.mppe = 0;
750 - }
751 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
752 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
753
754 - if (!try.mppe) {
755 - error("MPPE required but peer negotiation failed");
756 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
757 + if (go->mppc) {
758 + no.mppc = 1;
759 + if (!(p[5] & MPPE_MPPC))
760 + try.mppc = 0;
761 + }
762 +
763 + if (go->mppe)
764 + no.mppe = 1;
765 + if (go->mppe_40)
766 + no.mppe_40 = 1;
767 + if (go->mppe_56)
768 + no.mppe_56 = 1;
769 + if (go->mppe_128)
770 + no.mppe_128 = 1;
771 + if (go->mppe_stateless)
772 + no.mppe_stateless = 1;
773 +
774 + if (ao->mppe_40) {
775 + if ((p[5] & MPPE_40BIT))
776 + try.mppe_40 = 1;
777 + else
778 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
779 + }
780 + if (ao->mppe_56) {
781 + if ((p[5] & MPPE_56BIT))
782 + try.mppe_56 = 1;
783 + else
784 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
785 + }
786 + if (ao->mppe_128) {
787 + if ((p[5] & MPPE_128BIT))
788 + try.mppe_128 = 1;
789 + else
790 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
791 + }
792 +
793 + if (ao->mppe_stateless) {
794 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
795 + try.mppe_stateless = 1;
796 + else
797 + try.mppe_stateless = 0;
798 + }
799 +
800 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
801 + try.mppe = try.mppe_stateless = 0;
802 + if (wo->mppe) {
803 + /* we require encryption, but peer doesn't support it
804 + so we close connection */
805 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
806 + wo->mppe_56 = wo->mppe_128 = 0;
807 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
808 + "key length");
809 + }
810 + }
811 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
812 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
813 + /* cannot negotiate key length */
814 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
815 + wo->mppe_56 = wo->mppe_128 = 0;
816 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
817 }
818 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
819 + try.mppe_40 = try.mppe_56 = 0;
820 + else
821 + if (try.mppe_56 && try.mppe_128)
822 + try.mppe_56 = 0;
823 + else
824 + if (try.mppe_40 && try.mppe_128)
825 + try.mppe_40 = 0;
826 + else
827 + if (try.mppe_40 && try.mppe_56)
828 + try.mppe_40 = 0;
829 +
830 + p += CILEN_MPPE;
831 + len -= CILEN_MPPE;
832 }
833 #endif /* MPPE */
834 +
835 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
836 + no.lzs = 1;
837 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
838 + p[4] != LZS_MODE_EXT))
839 + try.lzs = 0;
840 + else {
841 + try.lzs_mode = p[4];
842 + try.lzs_hists = (p[2] << 8) | p[3];
843 + }
844 + p += CILEN_LZS;
845 + len -= CILEN_LZS;
846 + }
847 +
848 if (go->deflate && len >= CILEN_DEFLATE
849 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
850 && p[1] == CILEN_DEFLATE) {
851 @@ -1001,14 +1254,50 @@
852 return -1;
853
854 #ifdef MPPE
855 - if (go->mppe && len >= CILEN_MPPE
856 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
857 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
858 - error("MPPE required but peer refused");
859 - lcp_close(f->unit, "MPPE required but peer refused");
860 + ccp_options *wo = &ccp_wantoptions[f->unit];
861 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
862 + p[3] != 0 ||
863 + p[4] != 0 ||
864 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
865 + (go->mppe_56 ? MPPE_56BIT : 0) |
866 + (go->mppe_128 ? MPPE_128BIT : 0) |
867 + (go->mppc ? MPPE_MPPC : 0)))
868 + return 0;
869 + if (go->mppc)
870 + try.mppc = 0;
871 + if (go->mppe) {
872 + try.mppe = 0;
873 + if (go->mppe_40)
874 + try.mppe_40 = 0;
875 + if (go->mppe_56)
876 + try.mppe_56 = 0;
877 + if (go->mppe_128)
878 + try.mppe_128 = 0;
879 + if (go->mppe_stateless)
880 + try.mppe_stateless = 0;
881 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
882 + try.mppe = try.mppe_stateless = 0;
883 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
884 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
885 + wo->mppe_56 = wo->mppe_128 = 0;
886 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
887 + "key length");
888 + }
889 + }
890 p += CILEN_MPPE;
891 len -= CILEN_MPPE;
892 }
893 -#endif
894 +#endif /* MPPE */
895 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
896 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
897 + || p[4] != go->lzs_mode)
898 + return 0;
899 + try.lzs = 0;
900 + p += CILEN_LZS;
901 + len -= CILEN_LZS;
902 + }
903 if (go->deflate_correct && len >= CILEN_DEFLATE
904 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
905 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
906 @@ -1072,14 +1361,15 @@
907 int dont_nak;
908 {
909 int ret, newret, res;
910 - u_char *p0, *retp;
911 + u_char *p0, *retp, p2, p5;
912 int len, clen, type, nb;
913 ccp_options *ho = &ccp_hisoptions[f->unit];
914 ccp_options *ao = &ccp_allowoptions[f->unit];
915 + ccp_options *wo = &ccp_wantoptions[f->unit];
916 #ifdef MPPE
917 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
918 - /* CI_MPPE, or due to other options? */
919 -#endif
920 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
921 +/* int mtu; */
922 +#endif /* MPPE */
923
924 ret = CONFACK;
925 retp = p0 = p;
926 @@ -1102,103 +1392,305 @@
927 switch (type) {
928 #ifdef MPPE
929 case CI_MPPE:
930 - if (!ao->mppe || clen != CILEN_MPPE) {
931 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
932 newret = CONFREJ;
933 break;
934 }
935 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
936
937 - /* Nak if anything unsupported or unknown are set. */
938 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
939 - newret = CONFNAK;
940 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
941 - }
942 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
943 + p2 = p[2];
944 + p5 = p[5];
945 + /* not sure what they want, tell 'em what we got */
946 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
947 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
948 + MPPE_MPPC)) != 0 || p[5] == 0) ||
949 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
950 newret = CONFNAK;
951 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
952 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
953 + p[3] = 0;
954 + p[4] = 0;
955 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
956 + (wo->mppe_56 ? MPPE_56BIT : 0) |
957 + (wo->mppe_128 ? MPPE_128BIT : 0) |
958 + (wo->mppc ? MPPE_MPPC : 0);
959 + break;
960 }
961
962 - /* Check state opt */
963 - if (ho->mppe & MPPE_OPT_STATEFUL) {
964 - /*
965 - * We can Nak and request stateless, but it's a
966 - * lot easier to just assume the peer will request
967 - * it if he can do it; stateful mode is bad over
968 - * the Internet -- which is where we expect MPPE.
969 - */
970 - if (refuse_mppe_stateful) {
971 - error("Refusing MPPE stateful mode offered by peer");
972 + if ((p[5] & MPPE_MPPC)) {
973 + if (ao->mppc) {
974 + ho->mppc = 1;
975 + BCOPY(p, opt_buf, CILEN_MPPE);
976 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
977 + opt_buf[5] = MPPE_MPPC;
978 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
979 + ho->mppc = 0;
980 + p[5] &= ~MPPE_MPPC;
981 + newret = CONFNAK;
982 + }
983 + } else {
984 newret = CONFREJ;
985 - break;
986 + if (wo->mppe || ao->mppe) {
987 + p[5] &= ~MPPE_MPPC;
988 + newret = CONFNAK;
989 + }
990 + }
991 + }
992 +
993 + if (ao->mppe)
994 + ho->mppe = 1;
995 +
996 + if ((p[2] & MPPE_STATELESS)) {
997 + if (ao->mppe_stateless) {
998 + if (wo->mppe_stateless)
999 + ho->mppe_stateless = 1;
1000 + else {
1001 + newret = CONFNAK;
1002 + if (!dont_nak)
1003 + p[2] &= ~MPPE_STATELESS;
1004 + }
1005 + } else {
1006 + newret = CONFNAK;
1007 + if (!dont_nak)
1008 + p[2] &= ~MPPE_STATELESS;
1009 + }
1010 + } else {
1011 + if (wo->mppe_stateless && !dont_nak) {
1012 + wo->mppe_stateless = 0;
1013 + newret = CONFNAK;
1014 + p[2] |= MPPE_STATELESS;
1015 }
1016 }
1017
1018 - /* Find out which of {S,L} are set. */
1019 - if ((ho->mppe & MPPE_OPT_128)
1020 - && (ho->mppe & MPPE_OPT_40)) {
1021 - /* Both are set, negotiate the strongest. */
1022 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1023 newret = CONFNAK;
1024 - if (ao->mppe & MPPE_OPT_128)
1025 - ho->mppe &= ~MPPE_OPT_40;
1026 - else if (ao->mppe & MPPE_OPT_40)
1027 - ho->mppe &= ~MPPE_OPT_128;
1028 - else {
1029 - newret = CONFREJ;
1030 - break;
1031 + if (ao->mppe_128) {
1032 + ho->mppe_128 = 1;
1033 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1034 + BCOPY(p, opt_buf, CILEN_MPPE);
1035 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1036 + MPPE_MAX_KEY_LEN);
1037 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1038 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1039 + ho->mppe_128 = 0;
1040 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1041 + p[5] &= ~MPPE_128BIT;
1042 + goto check_mppe_56_40;
1043 + }
1044 + goto check_mppe;
1045 }
1046 - } else if (ho->mppe & MPPE_OPT_128) {
1047 - if (!(ao->mppe & MPPE_OPT_128)) {
1048 - newret = CONFREJ;
1049 - break;
1050 + p[5] &= ~MPPE_128BIT;
1051 + goto check_mppe_56_40;
1052 + }
1053 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1054 + newret = CONFNAK;
1055 + if (ao->mppe_128) {
1056 + ho->mppe_128 = 1;
1057 + p[5] &= ~MPPE_56BIT;
1058 + BCOPY(p, opt_buf, CILEN_MPPE);
1059 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1060 + MPPE_MAX_KEY_LEN);
1061 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1062 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1063 + ho->mppe_128 = 0;
1064 + p[5] |= MPPE_56BIT;
1065 + p[5] &= ~MPPE_128BIT;
1066 + goto check_mppe_56;
1067 + }
1068 + goto check_mppe;
1069 }
1070 - } else if (ho->mppe & MPPE_OPT_40) {
1071 - if (!(ao->mppe & MPPE_OPT_40)) {
1072 - newret = CONFREJ;
1073 - break;
1074 + p[5] &= ~MPPE_128BIT;
1075 + goto check_mppe_56;
1076 + }
1077 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1078 + newret = CONFNAK;
1079 + if (ao->mppe_128) {
1080 + ho->mppe_128 = 1;
1081 + p[5] &= ~MPPE_40BIT;
1082 + BCOPY(p, opt_buf, CILEN_MPPE);
1083 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1084 + MPPE_MAX_KEY_LEN);
1085 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1086 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1087 + ho->mppe_128 = 0;
1088 + p[5] |= MPPE_40BIT;
1089 + p[5] &= ~MPPE_128BIT;
1090 + goto check_mppe_40;
1091 + }
1092 + goto check_mppe;
1093 + }
1094 + p[5] &= ~MPPE_128BIT;
1095 + goto check_mppe_40;
1096 + }
1097 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1098 + if (ao->mppe_128) {
1099 + ho->mppe_128 = 1;
1100 + BCOPY(p, opt_buf, CILEN_MPPE);
1101 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1102 + MPPE_MAX_KEY_LEN);
1103 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1104 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1105 + ho->mppe_128 = 0;
1106 + p[5] &= ~MPPE_128BIT;
1107 + newret = CONFNAK;
1108 + }
1109 + goto check_mppe;
1110 + }
1111 + p[5] &= ~MPPE_128BIT;
1112 + newret = CONFNAK;
1113 + goto check_mppe;
1114 + }
1115 + check_mppe_56_40:
1116 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1117 + newret = CONFNAK;
1118 + if (ao->mppe_56) {
1119 + ho->mppe_56 = 1;
1120 + p[5] &= ~MPPE_40BIT;
1121 + BCOPY(p, opt_buf, CILEN_MPPE);
1122 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1123 + MPPE_MAX_KEY_LEN);
1124 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1125 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1126 + ho->mppe_56 = 0;
1127 + p[5] |= MPPE_40BIT;
1128 + p[5] &= ~MPPE_56BIT;
1129 + newret = CONFNAK;
1130 + goto check_mppe_40;
1131 + }
1132 + goto check_mppe;
1133 + }
1134 + p[5] &= ~MPPE_56BIT;
1135 + goto check_mppe_40;
1136 + }
1137 + check_mppe_56:
1138 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1139 + if (ao->mppe_56) {
1140 + ho->mppe_56 = 1;
1141 + BCOPY(p, opt_buf, CILEN_MPPE);
1142 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1143 + MPPE_MAX_KEY_LEN);
1144 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1145 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1146 + ho->mppe_56 = 0;
1147 + p[5] &= ~MPPE_56BIT;
1148 + newret = CONFNAK;
1149 + }
1150 + goto check_mppe;
1151 + }
1152 + p[5] &= ~MPPE_56BIT;
1153 + newret = CONFNAK;
1154 + goto check_mppe;
1155 + }
1156 + check_mppe_40:
1157 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1158 + if (ao->mppe_40) {
1159 + ho->mppe_40 = 1;
1160 + BCOPY(p, opt_buf, CILEN_MPPE);
1161 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1162 + MPPE_MAX_KEY_LEN);
1163 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1164 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1165 + ho->mppe_40 = 0;
1166 + p[5] &= ~MPPE_40BIT;
1167 + newret = CONFNAK;
1168 + }
1169 + goto check_mppe;
1170 + }
1171 + p[5] &= ~MPPE_40BIT;
1172 + }
1173 +
1174 + check_mppe:
1175 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1176 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1177 + newret = CONFNAK;
1178 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1179 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1180 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1181 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1182 + (wo->mppc ? MPPE_MPPC : 0);
1183 + } else {
1184 + ho->mppe = ho->mppe_stateless = 0;
1185 }
1186 } else {
1187 - /* Neither are set. */
1188 + /* MPPE is not compatible with other compression types */
1189 + if (wo->mppe) {
1190 + ao->bsd_compress = 0;
1191 + ao->predictor_1 = 0;
1192 + ao->predictor_2 = 0;
1193 + ao->deflate = 0;
1194 + ao->lzs = 0;
1195 + }
1196 + }
1197 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1198 + p[2] = p2;
1199 + p[5] = p5;
1200 newret = CONFREJ;
1201 break;
1202 }
1203
1204 - /* rebuild the opts */
1205 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1206 - if (newret == CONFACK) {
1207 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1208 - int mtu;
1209 -
1210 - BCOPY(p, opt_buf, CILEN_MPPE);
1211 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1212 - MPPE_MAX_KEY_LEN);
1213 - if (ccp_test(f->unit, opt_buf,
1214 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1215 - /* This shouldn't happen, we've already tested it! */
1216 - error("MPPE required, but kernel has no support.");
1217 - lcp_close(f->unit, "MPPE required but not available");
1218 - newret = CONFREJ;
1219 - break;
1220 - }
1221 - /*
1222 - * We need to decrease the interface MTU by MPPE_PAD
1223 - * because MPPE frames **grow**. The kernel [must]
1224 - * allocate MPPE_PAD extra bytes in xmit buffers.
1225 - */
1226 - mtu = netif_get_mtu(f->unit);
1227 - if (mtu)
1228 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1229 - else
1230 - newret = CONFREJ;
1231 - }
1232 + /*
1233 + * I have commented the code below because according to RFC1547
1234 + * MTU is only information for higher level protocols about
1235 + * "the maximum allowable length for a packet (q.v.) transmitted
1236 + * over a point-to-point link without incurring network layer
1237 + * fragmentation." Of course a PPP implementation should be able
1238 + * to handle overhead added by MPPE - in our case apropriate code
1239 + * is located in drivers/net/ppp_generic.c in the kernel sources.
1240 + *
1241 + * According to RFC1661:
1242 + * - when negotiated MRU is less than 1500 octets, a PPP
1243 + * implementation must still be able to receive at least 1500
1244 + * octets,
1245 + * - when PFC is negotiated, a PPP implementation is still
1246 + * required to receive frames with uncompressed protocol field.
1247 + *
1248 + * So why not to handle MPPE overhead without changing MTU value?
1249 + * I am sure that RFC3078, unfortunately silently, assumes that.
1250 + */
1251
1252 /*
1253 - * We have accepted MPPE or are willing to negotiate
1254 - * MPPE parameters. A CONFREJ is due to subsequent
1255 - * (non-MPPE) processing.
1256 + * We need to decrease the interface MTU by MPPE_PAD
1257 + * because MPPE frames **grow**. The kernel [must]
1258 + * allocate MPPE_PAD extra bytes in xmit buffers.
1259 */
1260 - rej_for_ci_mppe = 0;
1261 +/*
1262 + mtu = netif_get_mtu(f->unit);
1263 + if (mtu) {
1264 + netif_set_mtu(f->unit, mtu - MPPE_PAD);
1265 + } else {
1266 + newret = CONFREJ;
1267 + if (ccp_wantoptions[f->unit].mppe) {
1268 + error("Cannot adjust MTU needed by MPPE.");
1269 + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1270 + }
1271 + }
1272 +*/
1273 break;
1274 #endif /* MPPE */
1275 +
1276 + case CI_LZS:
1277 + if (!ao->lzs || clen != CILEN_LZS) {
1278 + newret = CONFREJ;
1279 + break;
1280 + }
1281 +
1282 + ho->lzs = 1;
1283 + ho->lzs_hists = (p[2] << 8) | p[3];
1284 + ho->lzs_mode = p[4];
1285 + if ((ho->lzs_hists != ao->lzs_hists) ||
1286 + (ho->lzs_mode != ao->lzs_mode)) {
1287 + newret = CONFNAK;
1288 + if (!dont_nak) {
1289 + p[2] = ao->lzs_hists >> 8;
1290 + p[3] = ao->lzs_hists & 0xff;
1291 + p[4] = ao->lzs_mode;
1292 + } else
1293 + break;
1294 + }
1295 +
1296 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1297 + newret = CONFREJ;
1298 + }
1299 + break;
1300 +
1301 case CI_DEFLATE:
1302 case CI_DEFLATE_DRAFT:
1303 if (!ao->deflate || clen != CILEN_DEFLATE
1304 @@ -1340,12 +1832,6 @@
1305 else
1306 *lenp = retp - p0;
1307 }
1308 -#ifdef MPPE
1309 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1310 - error("MPPE required but peer negotiation failed");
1311 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1312 - }
1313 -#endif
1314 return ret;
1315 }
1316
1317 @@ -1367,24 +1853,35 @@
1318 char *p = result;
1319 char *q = result + sizeof(result); /* 1 past result */
1320
1321 - slprintf(p, q - p, "MPPE ");
1322 - p += 5;
1323 - if (opt->mppe & MPPE_OPT_128) {
1324 - slprintf(p, q - p, "128-bit ");
1325 - p += 8;
1326 - }
1327 - if (opt->mppe & MPPE_OPT_40) {
1328 - slprintf(p, q - p, "40-bit ");
1329 - p += 7;
1330 - }
1331 - if (opt->mppe & MPPE_OPT_STATEFUL)
1332 - slprintf(p, q - p, "stateful");
1333 - else
1334 - slprintf(p, q - p, "stateless");
1335 -
1336 + if (opt->mppe) {
1337 + if (opt->mppc) {
1338 + slprintf(p, q - p, "MPPC/MPPE ");
1339 + p += 10;
1340 + } else {
1341 + slprintf(p, q - p, "MPPE ");
1342 + p += 5;
1343 + }
1344 + if (opt->mppe_128) {
1345 + slprintf(p, q - p, "128-bit ");
1346 + p += 8;
1347 + } else if (opt->mppe_56) {
1348 + slprintf(p, q - p, "56-bit ");
1349 + p += 7;
1350 + } else if (opt->mppe_40) {
1351 + slprintf(p, q - p, "40-bit ");
1352 + p += 7;
1353 + }
1354 + if (opt->mppe_stateless)
1355 + slprintf(p, q - p, "stateless");
1356 + else
1357 + slprintf(p, q - p, "stateful");
1358 + } else if (opt->mppc)
1359 + slprintf(p, q - p, "MPPC");
1360 break;
1361 }
1362 -#endif
1363 +#endif /* MPPE */
1364 + case CI_LZS:
1365 + return "Stac LZS";
1366 case CI_DEFLATE:
1367 case CI_DEFLATE_DRAFT:
1368 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1369 @@ -1440,12 +1937,12 @@
1370 } else if (ANY_COMPRESS(*ho))
1371 notice("%s transmit compression enabled", method_name(ho, NULL));
1372 #ifdef MPPE
1373 - if (go->mppe) {
1374 + if (go->mppe || go->mppc) {
1375 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1376 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1377 continue_networks(f->unit); /* Bring up IP et al */
1378 }
1379 -#endif
1380 +#endif /* MPPE */
1381 }
1382
1383 /*
1384 @@ -1468,7 +1965,7 @@
1385 lcp_close(f->unit, "MPPE disabled");
1386 }
1387 }
1388 -#endif
1389 +#endif /* MPPE */
1390 }
1391
1392 /*
1393 @@ -1528,24 +2025,28 @@
1394 #ifdef MPPE
1395 case CI_MPPE:
1396 if (optlen >= CILEN_MPPE) {
1397 - u_char mppe_opts;
1398 -
1399 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1400 - printer(arg, "mppe %s %s %s %s %s %s%s",
1401 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1402 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1403 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1404 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1405 + printer(arg, "mppe %s %s %s %s %s %s",
1406 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1407 + (p[5] & MPPE_56BIT)? "+M": "-M",
1408 + (p[5] & MPPE_128BIT)? "+S": "-S",
1409 + (p[5] & MPPE_40BIT)? "+L": "-L",
1410 (p[5] & MPPE_D_BIT)? "+D": "-D",
1411 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1412 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1413 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1414 + (p[5] & MPPE_MPPC)? "+C": "-C");
1415 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1416 + MPPE_D_BIT | MPPE_MPPC)) ||
1417 + (p[2] & ~MPPE_STATELESS))
1418 printer(arg, " (%.2x %.2x %.2x %.2x)",
1419 p[2], p[3], p[4], p[5]);
1420 p += CILEN_MPPE;
1421 }
1422 break;
1423 -#endif
1424 +#endif /* MPPE */
1425 + case CI_LZS:
1426 + if (optlen >= CILEN_LZS) {
1427 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1428 + p += CILEN_LZS;
1429 + }
1430 + break;
1431 case CI_DEFLATE:
1432 case CI_DEFLATE_DRAFT:
1433 if (optlen >= CILEN_DEFLATE) {
1434 @@ -1631,6 +2132,7 @@
1435 error("Lost compression sync: disabling compression");
1436 ccp_close(unit, "Lost compression sync");
1437 #ifdef MPPE
1438 + /* My module dosn't need this. J.D., 2003-07-06 */
1439 /*
1440 * If we were doing MPPE, we must also take the link down.
1441 */
1442 @@ -1638,9 +2140,18 @@
1443 error("Too many MPPE errors, closing LCP");
1444 lcp_close(unit, "Too many MPPE errors");
1445 }
1446 -#endif
1447 +#endif /* MPPE */
1448 } else {
1449 /*
1450 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1451 + * and don't wait for CCP_RESETACK
1452 + */
1453 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1454 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1455 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1456 + return;
1457 + }
1458 + /*
1459 * Send a reset-request to reset the peer's compressor.
1460 * We don't do that if we are still waiting for an
1461 * acknowledgement to a previous reset-request.
1462 @@ -1671,4 +2182,3 @@
1463 } else
1464 ccp_localstate[f->unit] &= ~RACK_PENDING;
1465 }
1466 -
1467 Index: ppp-2.4.3/pppd/ccp.h
1468 ===================================================================
1469 --- ppp-2.4.3.orig/pppd/ccp.h 2007-06-04 13:22:08.162614376 +0200
1470 +++ ppp-2.4.3/pppd/ccp.h 2007-06-04 13:22:12.033025984 +0200
1471 @@ -37,9 +37,17 @@
1472 bool predictor_2; /* do Predictor-2? */
1473 bool deflate_correct; /* use correct code for deflate? */
1474 bool deflate_draft; /* use draft RFC code for deflate? */
1475 + bool lzs; /* do Stac LZS? */
1476 + bool mppc; /* do MPPC? */
1477 bool mppe; /* do MPPE? */
1478 + bool mppe_40; /* allow 40 bit encryption? */
1479 + bool mppe_56; /* allow 56 bit encryption? */
1480 + bool mppe_128; /* allow 128 bit encryption? */
1481 + bool mppe_stateless; /* allow stateless encryption */
1482 u_short bsd_bits; /* # bits/code for BSD Compress */
1483 u_short deflate_size; /* lg(window size) for Deflate */
1484 + u_short lzs_mode; /* LZS check mode */
1485 + u_short lzs_hists; /* number of LZS histories */
1486 short method; /* code for chosen compression method */
1487 } ccp_options;
1488
1489 Index: ppp-2.4.3/pppd/chap_ms.c
1490 ===================================================================
1491 --- ppp-2.4.3.orig/pppd/chap_ms.c 2007-06-04 13:22:08.168613464 +0200
1492 +++ ppp-2.4.3/pppd/chap_ms.c 2007-06-04 13:22:12.033025984 +0200
1493 @@ -895,13 +895,17 @@
1494 /*
1495 * Disable undesirable encryption types. Note that we don't ENABLE
1496 * any encryption types, to avoid overriding manual configuration.
1497 + *
1498 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1499 */
1500 switch(types) {
1501 case MPPE_ENC_TYPES_RC4_40:
1502 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1503 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1504 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1505 break;
1506 case MPPE_ENC_TYPES_RC4_128:
1507 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1508 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1509 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1510 break;
1511 default:
1512 break;
1513 Index: ppp-2.4.3/pppd/pppd.8
1514 ===================================================================
1515 --- ppp-2.4.3.orig/pppd/pppd.8 2007-06-04 13:22:08.175612400 +0200
1516 +++ ppp-2.4.3/pppd/pppd.8 2007-06-04 13:22:12.034025832 +0200
1517 @@ -622,9 +622,29 @@
1518 Enables the use of PPP multilink; this is an alias for the `multilink'
1519 option. This option is currently only available under Linux.
1520 .TP
1521 -.B mppe\-stateful
1522 -Allow MPPE to use stateful mode. Stateless mode is still attempted first.
1523 -The default is to disallow stateful mode.
1524 +.B mppc
1525 +Enables MPPC (Microsoft Point to Point Compression). This is the default.
1526 +.TP
1527 +.B mppe \fIsubopt1[,subopt2[,subopt3[..]]]
1528 +Modify MPPE (Microsoft Point to Point Encryption) parameters. In order
1529 +for MPPE to successfully come up, you must have authenticated with either
1530 +MS-CHAP or MS-CHAPv2. By default MPPE is optional, it means that pppd will
1531 +not propose MPPE to the peer, but will negotiate MPPE if peer wants that.
1532 +You can change this using \fIrequired\fR suboption.
1533 +This option is presently only supported under Linux, and only if your
1534 +kernel has been configured to include MPPE support.
1535 +.IP
1536 +MPPE suboptions:
1537 +.br
1538 +\fIrequired\fR - require MPPE; disconnect if peer doesn't support it,
1539 +.br
1540 +\fIstateless\fR - try to negotiate stateless mode; default is stateful,
1541 +.br
1542 +\fIno40\fR - disable 40 bit keys,
1543 +.br
1544 +\fIno56\fR - disable 56 bit keys,
1545 +.br
1546 +\fIno128\fR - disable 128 bit keys
1547 .TP
1548 .B mpshortseq
1549 Enables the use of short (12-bit) sequence numbers in multilink
1550 @@ -757,17 +777,11 @@
1551 Disables the use of PPP multilink. This option is currently only
1552 available under Linux.
1553 .TP
1554 -.B nomppe
1555 -Disables MPPE (Microsoft Point to Point Encryption). This is the default.
1556 -.TP
1557 -.B nomppe\-40
1558 -Disable 40-bit encryption with MPPE.
1559 +.B nomppc
1560 +Disables MPPC (Microsoft Point to Point Compression).
1561 .TP
1562 -.B nomppe\-128
1563 -Disable 128-bit encryption with MPPE.
1564 -.TP
1565 -.B nomppe\-stateful
1566 -Disable MPPE stateful mode. This is the default.
1567 +.B nomppe
1568 +Disables MPPE (Microsoft Point to Point Encryption).
1569 .TP
1570 .B nompshortseq
1571 Disables the use of short (12-bit) sequence numbers in the PPP
1572 @@ -948,19 +962,6 @@
1573 Require the peer to authenticate itself using CHAP [Challenge
1574 Handshake Authentication Protocol] authentication.
1575 .TP
1576 -.B require\-mppe
1577 -Require the use of MPPE (Microsoft Point to Point Encryption). This
1578 -option disables all other compression types. This option enables
1579 -both 40-bit and 128-bit encryption. In order for MPPE to successfully
1580 -come up, you must have authenticated with either MS\-CHAP or MS\-CHAPv2.
1581 -This option is presently only supported under Linux, and only if your
1582 -kernel has been configured to include MPPE support.
1583 -.TP
1584 -.B require\-mppe\-40
1585 -Require the use of MPPE, with 40-bit encryption.
1586 -.TP
1587 -.B require\-mppe\-128
1588 -Require the use of MPPE, with 128-bit encryption.
1589 .TP
1590 .B require\-mschap
1591 Require the peer to authenticate itself using MS\-CHAP [Microsoft Challenge
Personal OpenWRT clone
This page took 0.120136 seconds and 5 git commands to generate.