projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
pppd: fix the exit code in case of authentication failure or other errors
[openwrt.git] / package / ppp / patches / 201-mppe_mppc_1.1.patch
1 --- a/include/linux/ppp-comp.h
2 +++ b/include/linux/ppp-comp.h
3 @@ -36,7 +36,7 @@
4 */
5
6 /*
7 - * ==FILEVERSION 20020319==
8 + * ==FILEVERSION 20020715==
9 *
10 * NOTE TO MAINTAINERS:
11 * If you modify this file at all, please set the above date.
12 @@ -201,6 +201,33 @@ struct compressor {
13 #define CI_MPPE 18 /* config option for MPPE */
14 #define CILEN_MPPE 6 /* length of config option */
15
16 +/* MPPE/MPPC definitions by J.D.*/
17 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
18 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
19 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
20 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
21 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
22 +
23 +/*
24 + * Definitions for Stac LZS.
25 + */
26 +
27 +#define CI_LZS 17 /* config option for Stac LZS */
28 +#define CILEN_LZS 5 /* length of config option */
29 +
30 +#define LZS_OVHD 4 /* max. LZS overhead */
31 +#define LZS_HIST_LEN 2048 /* LZS history size */
32 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
33 +
34 +#define LZS_MODE_NONE 0
35 +#define LZS_MODE_LCB 1
36 +#define LZS_MODE_CRC 2
37 +#define LZS_MODE_SEQ 3
38 +#define LZS_MODE_EXT 4
39 +
40 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
41 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
42 +
43 /*
44 * Definitions for other, as yet unsupported, compression methods.
45 */
46 --- a/include/net/ppp-comp.h
47 +++ b/include/net/ppp-comp.h
48 @@ -168,6 +168,33 @@ struct compressor {
49 #define CI_MPPE 18 /* config option for MPPE */
50 #define CILEN_MPPE 6 /* length of config option */
51
52 +/* MPPE/MPPC definitions by J.D.*/
53 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
54 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
55 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
56 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
57 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
58 +
59 +/*
60 + * Definitions for Stac LZS.
61 + */
62 +
63 +#define CI_LZS 17 /* config option for Stac LZS */
64 +#define CILEN_LZS 5 /* length of config option */
65 +
66 +#define LZS_OVHD 4 /* max. LZS overhead */
67 +#define LZS_HIST_LEN 2048 /* LZS history size */
68 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
69 +
70 +#define LZS_MODE_NONE 0
71 +#define LZS_MODE_LCB 1
72 +#define LZS_MODE_CRC 2
73 +#define LZS_MODE_SEQ 3
74 +#define LZS_MODE_EXT 4
75 +
76 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
77 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
78 +
79 /*
80 * Definitions for other, as yet unsupported, compression methods.
81 */
82 --- a/pppd/ccp.c
83 +++ b/pppd/ccp.c
84 @@ -62,12 +62,10 @@ static int setdeflate __P((char **));
85 static char bsd_value[8];
86 static char deflate_value[8];
87
88 -/*
89 - * Option variables.
90 - */
91 #ifdef MPPE
92 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
93 -#endif
94 +static int setmppe(char **);
95 +static int setnomppe(void);
96 +#endif /* MPPE */
97
98 static option_t ccp_option_list[] = {
99 { "noccp", o_bool, &ccp_protent.enabled_flag,
100 @@ -108,54 +106,36 @@ static option_t ccp_option_list[] = {
101 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
102 &ccp_allowoptions[0].predictor_1 },
103
104 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
105 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
106 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
107 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
108 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
109 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
110 + &ccp_allowoptions[0].lzs },
111 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
112 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
113 + &ccp_allowoptions[0].lzs },
114 +
115 #ifdef MPPE
116 - /* MPPE options are symmetrical ... we only set wantoptions here */
117 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
118 - "require MPPE encryption",
119 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
120 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
121 - "require MPPE encryption",
122 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
123 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
124 - "don't allow MPPE encryption", OPT_PRIO },
125 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
126 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
127 -
128 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
129 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
130 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
131 - &ccp_wantoptions[0].mppe },
132 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
133 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
134 - &ccp_wantoptions[0].mppe },
135 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
136 - "don't allow MPPE 40-bit encryption",
137 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
138 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
139 - "don't allow MPPE 40-bit encryption",
140 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
141 - &ccp_wantoptions[0].mppe },
142 -
143 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
144 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
145 - &ccp_wantoptions[0].mppe },
146 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
147 - "require MPPE 128-bit encryption",
148 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
149 - &ccp_wantoptions[0].mppe },
150 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
151 - "don't allow MPPE 128-bit encryption",
152 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
153 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
154 - "don't allow MPPE 128-bit encryption",
155 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
156 - &ccp_wantoptions[0].mppe },
157 -
158 - /* strange one; we always request stateless, but will we allow stateful? */
159 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
160 - "allow MPPE stateful mode", OPT_PRIO },
161 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
162 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
163 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
164 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
165 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
166 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
167 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
168 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
169 + &ccp_allowoptions[0].mppc },
170 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
171 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
172 + &ccp_allowoptions[0].mppc },
173 + { "mppe", o_special, (void *)setmppe,
174 + "request MPPE encryption" },
175 + { "+mppe", o_special, (void *)setmppe,
176 + "request MPPE encryption" },
177 + { "nomppe", o_special_noarg, (void *)setnomppe,
178 + "don't allow MPPE encryption" },
179 + { "-mppe", o_special_noarg, (void *)setnomppe,
180 + "don't allow MPPE encryption" },
181 #endif /* MPPE */
182
183 { NULL }
184 @@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = {
185 */
186 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
187 || (opt).predictor_1 || (opt).predictor_2 \
188 - || (opt).mppe)
189 + || (opt).lzs || (opt).mppc || (opt).mppe)
190
191 /*
192 * Local state (mainly for handling reset-reqs and reset-acks).
193 @@ -344,6 +324,100 @@ setdeflate(argv)
194 return 1;
195 }
196
197 +#ifdef MPPE
198 +/*
199 + * Functions called from config options
200 + */
201 +/*
202 + MPPE suboptions:
203 + required - require MPPE; disconnect if peer doesn't support it
204 + stateless - use stateless mode
205 + no40 - disable 40 bit keys
206 + no56 - disable 56 bit keys
207 + no128 - disable 128 bit keys
208 +*/
209 +int setmppe(char **argv)
210 +{
211 + int i;
212 + char *str, cmdbuf[16];
213 +
214 + ccp_allowoptions[0].mppe = 1;
215 + ccp_allowoptions[0].mppe_40 = 1;
216 + ccp_allowoptions[0].mppe_56 = 1;
217 + ccp_allowoptions[0].mppe_128 = 1;
218 + ccp_allowoptions[0].mppe_stateless = 0;
219 + ccp_wantoptions[0].mppe = 0;
220 +
221 + str = *argv;
222 +
223 + while (1) {
224 + i = 0;
225 + memset(cmdbuf, '\0', 16);
226 + while ((i < 16) && (*str != ',') && (*str != '\0'))
227 + cmdbuf[i++] = *str++;
228 + cmdbuf[i] = '\0';
229 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
230 + ccp_allowoptions[0].mppe_40 = 0;
231 + goto next_param;
232 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
233 + ccp_allowoptions[0].mppe_56 = 0;
234 + goto next_param;
235 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
236 + ccp_allowoptions[0].mppe_128 = 0;
237 + goto next_param;
238 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
239 + ccp_allowoptions[0].mppe_stateless = 1;
240 + goto next_param;
241 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
242 + ccp_wantoptions[0].mppe = 1;
243 + goto next_param;
244 + } else {
245 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
246 + return 0;
247 + }
248 +
249 + next_param:
250 + if (*str == ',') {
251 + str++;
252 + continue;
253 + }
254 + if (*str == '\0') {
255 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
256 + ccp_allowoptions[0].mppe_128)) {
257 + if (ccp_wantoptions[0].mppe == 1) {
258 + option_error("You require MPPE but you have switched off "
259 + "all encryption key lengths.");
260 + return 0;
261 + }
262 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
263 + ccp_wantoptions[0].mppe_stateless =
264 + ccp_allowoptions[0].mppe_stateless = 0;
265 + } else {
266 + ccp_allowoptions[0].mppe = 1;
267 + ccp_wantoptions[0].mppe_stateless =
268 + ccp_allowoptions[0].mppe_stateless;
269 + if (ccp_wantoptions[0].mppe == 1) {
270 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
271 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
272 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
273 + }
274 + }
275 + return 1;
276 + }
277 + }
278 +}
279 +
280 +int setnomppe(void)
281 +{
282 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
283 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
284 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
285 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
286 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
287 + return 1;
288 +}
289 +#endif /* MPPE */
290 +
291 /*
292 * ccp_init - initialize CCP.
293 */
294 @@ -378,6 +452,30 @@ ccp_init(unit)
295 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
296
297 ccp_allowoptions[0].predictor_1 = 1;
298 +
299 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
300 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
301 + ccp_wantoptions[0].lzs_hists = 1;
302 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
303 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
304 + ccp_allowoptions[0].lzs_hists = 1;
305 +
306 +#ifdef MPPE
307 + /* by default allow and request MPPC... */
308 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
309 +
310 + /* ... and allow but don't request MPPE */
311 + ccp_allowoptions[0].mppe = 1;
312 + ccp_allowoptions[0].mppe_40 = 1;
313 + ccp_allowoptions[0].mppe_56 = 1;
314 + ccp_allowoptions[0].mppe_128 = 1;
315 + ccp_allowoptions[0].mppe_stateless = 1;
316 + ccp_wantoptions[0].mppe = 0;
317 + ccp_wantoptions[0].mppe_40 = 0;
318 + ccp_wantoptions[0].mppe_56 = 0;
319 + ccp_wantoptions[0].mppe_128 = 0;
320 + ccp_wantoptions[0].mppe_stateless = 0;
321 +#endif /* MPPE */
322 }
323
324 /*
325 @@ -455,11 +553,11 @@ ccp_input(unit, p, len)
326 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
327 notice("Compression disabled by peer.");
328 #ifdef MPPE
329 - if (ccp_gotoptions[unit].mppe) {
330 + if (ccp_wantoptions[unit].mppe) {
331 error("MPPE disabled, closing LCP");
332 lcp_close(unit, "MPPE disabled by peer");
333 }
334 -#endif
335 +#endif /* MPPE */
336 }
337
338 /*
339 @@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len)
340 break;
341 /* send a reset-ack, which the transmitter will see and
342 reset its compression state. */
343 +
344 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
345 + but we do it in order to reset compressor; CCP_RESETACK is
346 + then silently discarded. See functions ppp_send_frame and
347 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
348 + confusion is caused by the fact that CCP code is splited
349 + into two parts - one part is handled by pppd, the other one
350 + is handled by kernel. */
351 +
352 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
353 break;
354
355 @@ -515,12 +622,11 @@ ccp_protrej(unit)
356 fsm_lowerdown(&ccp_fsm[unit]);
357
358 #ifdef MPPE
359 - if (ccp_gotoptions[unit].mppe) {
360 + if (ccp_wantoptions[unit].mppe) {
361 error("MPPE required but peer negotiation failed");
362 lcp_close(unit, "MPPE required but peer negotiation failed");
363 }
364 -#endif
365 -
366 +#endif /* MPPE */
367 }
368
369 /*
370 @@ -537,7 +643,7 @@ ccp_resetci(f)
371 all_rejected[f->unit] = 0;
372
373 #ifdef MPPE
374 - if (go->mppe) {
375 + if (go->mppe || go->mppc) {
376 ccp_options *ao = &ccp_allowoptions[f->unit];
377 int auth_mschap_bits = auth_done[f->unit];
378 int numbits;
379 @@ -551,80 +657,109 @@ ccp_resetci(f)
380 * NB: If MPPE is required, all other compression opts are invalid.
381 * So, we return right away if we can't do it.
382 */
383 + if (ccp_wantoptions[f->unit].mppe) {
384 + /* Leave only the mschap auth bits set */
385 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
386 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
387 + /* Count the mschap auths */
388 + auth_mschap_bits >>= CHAP_MS_SHIFT;
389 + numbits = 0;
390 + do {
391 + numbits += auth_mschap_bits & 1;
392 + auth_mschap_bits >>= 1;
393 + } while (auth_mschap_bits);
394 + if (numbits > 1) {
395 + error("MPPE required, but auth done in both directions.");
396 + lcp_close(f->unit, "MPPE required but not available");
397 + return;
398 + }
399 + if (!numbits) {
400 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
401 + lcp_close(f->unit, "MPPE required but not available");
402 + return;
403 + }
404
405 - /* Leave only the mschap auth bits set */
406 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
407 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
408 - /* Count the mschap auths */
409 - auth_mschap_bits >>= CHAP_MS_SHIFT;
410 - numbits = 0;
411 - do {
412 - numbits += auth_mschap_bits & 1;
413 - auth_mschap_bits >>= 1;
414 - } while (auth_mschap_bits);
415 - if (numbits > 1) {
416 - error("MPPE required, but auth done in both directions.");
417 - lcp_close(f->unit, "MPPE required but not available");
418 - return;
419 - }
420 - if (!numbits) {
421 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
422 - lcp_close(f->unit, "MPPE required but not available");
423 - return;
424 - }
425 -
426 - /* A plugin (eg radius) may not have obtained key material. */
427 - if (!mppe_keys_set) {
428 - error("MPPE required, but keys are not available. "
429 - "Possible plugin problem?");
430 - lcp_close(f->unit, "MPPE required but not available");
431 - return;
432 - }
433 -
434 - /* LM auth not supported for MPPE */
435 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
436 - /* This might be noise */
437 - if (go->mppe & MPPE_OPT_40) {
438 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
439 - go->mppe &= ~MPPE_OPT_40;
440 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
441 + /* A plugin (eg radius) may not have obtained key material. */
442 + if (!mppe_keys_set) {
443 + error("MPPE required, but keys are not available. "
444 + "Possible plugin problem?");
445 + lcp_close(f->unit, "MPPE required but not available");
446 + return;
447 }
448 }
449
450 - /* Last check: can we actually negotiate something? */
451 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
452 - /* Could be misconfig, could be 40-bit disabled above. */
453 - error("MPPE required, but both 40-bit and 128-bit disabled.");
454 - lcp_close(f->unit, "MPPE required but not available");
455 - return;
456 + /*
457 + * Check whether the kernel knows about the various
458 + * compression methods we might request. Key material
459 + * unimportant here.
460 + */
461 + if (go->mppc) {
462 + opt_buf[0] = CI_MPPE;
463 + opt_buf[1] = CILEN_MPPE;
464 + opt_buf[2] = 0;
465 + opt_buf[3] = 0;
466 + opt_buf[4] = 0;
467 + opt_buf[5] = MPPE_MPPC;
468 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
469 + go->mppc = 0;
470 + }
471 + if (go->mppe_40) {
472 + opt_buf[0] = CI_MPPE;
473 + opt_buf[1] = CILEN_MPPE;
474 + opt_buf[2] = MPPE_STATELESS;
475 + opt_buf[3] = 0;
476 + opt_buf[4] = 0;
477 + opt_buf[5] = MPPE_40BIT;
478 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
479 + go->mppe_40 = 0;
480 + }
481 + if (go->mppe_56) {
482 + opt_buf[0] = CI_MPPE;
483 + opt_buf[1] = CILEN_MPPE;
484 + opt_buf[2] = MPPE_STATELESS;
485 + opt_buf[3] = 0;
486 + opt_buf[4] = 0;
487 + opt_buf[5] = MPPE_56BIT;
488 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
489 + go->mppe_56 = 0;
490 + }
491 + if (go->mppe_128) {
492 + opt_buf[0] = CI_MPPE;
493 + opt_buf[1] = CILEN_MPPE;
494 + opt_buf[2] = MPPE_STATELESS;
495 + opt_buf[3] = 0;
496 + opt_buf[4] = 0;
497 + opt_buf[5] = MPPE_128BIT;
498 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
499 + go->mppe_128 = 0;
500 + }
501 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
502 + if (ccp_wantoptions[f->unit].mppe) {
503 + error("MPPE required, but kernel has no support.");
504 + lcp_close(f->unit, "MPPE required but not available");
505 + }
506 + go->mppe = go->mppe_stateless = 0;
507 + } else {
508 + /* MPPE is not compatible with other compression types */
509 + if (ccp_wantoptions[f->unit].mppe) {
510 + ao->bsd_compress = go->bsd_compress = 0;
511 + ao->predictor_1 = go->predictor_1 = 0;
512 + ao->predictor_2 = go->predictor_2 = 0;
513 + ao->deflate = go->deflate = 0;
514 + ao->lzs = go->lzs = 0;
515 + }
516 }
517 -
518 - /* sync options */
519 - ao->mppe = go->mppe;
520 - /* MPPE is not compatible with other compression types */
521 - ao->bsd_compress = go->bsd_compress = 0;
522 - ao->predictor_1 = go->predictor_1 = 0;
523 - ao->predictor_2 = go->predictor_2 = 0;
524 - ao->deflate = go->deflate = 0;
525 }
526 #endif /* MPPE */
527 -
528 - /*
529 - * Check whether the kernel knows about the various
530 - * compression methods we might request.
531 - */
532 -#ifdef MPPE
533 - if (go->mppe) {
534 - opt_buf[0] = CI_MPPE;
535 - opt_buf[1] = CILEN_MPPE;
536 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
537 - /* Key material unimportant here. */
538 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
539 - error("MPPE required, but kernel has no support.");
540 - lcp_close(f->unit, "MPPE required but not available");
541 - }
542 + if (go->lzs) {
543 + opt_buf[0] = CI_LZS;
544 + opt_buf[1] = CILEN_LZS;
545 + opt_buf[2] = go->lzs_hists >> 8;
546 + opt_buf[3] = go->lzs_hists & 0xff;
547 + opt_buf[4] = LZS_MODE_SEQ;
548 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
549 + go->lzs = 0;
550 }
551 -#endif
552 if (go->bsd_compress) {
553 opt_buf[0] = CI_BSD_COMPRESS;
554 opt_buf[1] = CILEN_BSD_COMPRESS;
555 @@ -679,7 +814,8 @@ ccp_cilen(f)
556 + (go->deflate? CILEN_DEFLATE: 0)
557 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
558 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
559 - + (go->mppe? CILEN_MPPE: 0);
560 + + (go->lzs? CILEN_LZS: 0)
561 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
562 }
563
564 /*
565 @@ -693,6 +829,8 @@ ccp_addci(f, p, lenp)
566 {
567 int res;
568 ccp_options *go = &ccp_gotoptions[f->unit];
569 + ccp_options *ao = &ccp_allowoptions[f->unit];
570 + ccp_options *wo = &ccp_wantoptions[f->unit];
571 u_char *p0 = p;
572
573 /*
574 @@ -701,22 +839,43 @@ ccp_addci(f, p, lenp)
575 * in case it gets Acked.
576 */
577 #ifdef MPPE
578 - if (go->mppe) {
579 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
580 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
581
582 - p[0] = opt_buf[0] = CI_MPPE;
583 - p[1] = opt_buf[1] = CILEN_MPPE;
584 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
585 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
586 + p[0] = CI_MPPE;
587 + p[1] = CILEN_MPPE;
588 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
589 + p[3] = 0;
590 + p[4] = 0;
591 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
592 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
593 +
594 + BCOPY(p, opt_buf, CILEN_MPPE);
595 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
596 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
597 - if (res > 0)
598 + if (res > 0) {
599 p += CILEN_MPPE;
600 - else
601 + } else {
602 /* This shouldn't happen, we've already tested it! */
603 - lcp_close(f->unit, "MPPE required but not available in kernel");
604 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
605 + go->mppe_stateless = go->mppc = 0;
606 + if (ccp_wantoptions[f->unit].mppe)
607 + lcp_close(f->unit, "MPPE required but not available in kernel");
608 + }
609 + }
610 +#endif /* MPPE */
611 + if (go->lzs) {
612 + p[0] = CI_LZS;
613 + p[1] = CILEN_LZS;
614 + p[2] = go->lzs_hists >> 8;
615 + p[3] = go->lzs_hists & 0xff;
616 + p[4] = LZS_MODE_SEQ;
617 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
618 + if (res > 0) {
619 + p += CILEN_LZS;
620 + } else
621 + go->lzs = 0;
622 }
623 -#endif
624 if (go->deflate) {
625 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
626 p[1] = CILEN_DEFLATE;
627 @@ -802,7 +961,7 @@ ccp_addci(f, p, lenp)
628
629 /*
630 * ccp_ackci - process a received configure-ack, and return
631 - * 1 iff the packet was OK.
632 + * 1 if the packet was OK.
633 */
634 static int
635 ccp_ackci(f, p, len)
636 @@ -811,24 +970,44 @@ ccp_ackci(f, p, len)
637 int len;
638 {
639 ccp_options *go = &ccp_gotoptions[f->unit];
640 + ccp_options *ao = &ccp_allowoptions[f->unit];
641 + ccp_options *wo = &ccp_wantoptions[f->unit];
642 u_char *p0 = p;
643
644 #ifdef MPPE
645 - if (go->mppe) {
646 - u_char opt_buf[CILEN_MPPE];
647 -
648 - opt_buf[0] = CI_MPPE;
649 - opt_buf[1] = CILEN_MPPE;
650 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
651 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
652 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
653 + if (len < CILEN_MPPE
654 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
655 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
656 + || p[3] != 0
657 + || p[4] != 0
658 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
659 + (go->mppc ? MPPE_MPPC : 0))
660 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
661 + (go->mppc ? MPPE_MPPC : 0))
662 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
663 + (go->mppc ? MPPE_MPPC : 0))))
664 return 0;
665 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
666 + go->mppe = 1;
667 p += CILEN_MPPE;
668 len -= CILEN_MPPE;
669 + /* Cope with first/fast ack */
670 + if (p == p0 && len == 0)
671 + return 1;
672 + }
673 +#endif /* MPPE */
674 + if (go->lzs) {
675 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
676 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
677 + || p[4] != LZS_MODE_SEQ)
678 + return 0;
679 + p += CILEN_LZS;
680 + len -= CILEN_LZS;
681 /* XXX Cope with first/fast ack */
682 - if (len == 0)
683 + if (p == p0 && len == 0)
684 return 1;
685 }
686 -#endif
687 if (go->deflate) {
688 if (len < CILEN_DEFLATE
689 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
690 @@ -901,6 +1080,8 @@ ccp_nakci(f, p, len, treat_as_reject)
691 int treat_as_reject;
692 {
693 ccp_options *go = &ccp_gotoptions[f->unit];
694 + ccp_options *ao = &ccp_allowoptions[f->unit];
695 + ccp_options *wo = &ccp_wantoptions[f->unit];
696 ccp_options no; /* options we've seen already */
697 ccp_options try; /* options to ask for next time */
698
699 @@ -908,28 +1089,100 @@ ccp_nakci(f, p, len, treat_as_reject)
700 try = *go;
701
702 #ifdef MPPE
703 - if (go->mppe && len >= CILEN_MPPE
704 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
705 - no.mppe = 1;
706 - /*
707 - * Peer wants us to use a different strength or other setting.
708 - * Fail if we aren't willing to use his suggestion.
709 - */
710 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
711 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
712 - error("Refusing MPPE stateful mode offered by peer");
713 - try.mppe = 0;
714 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
715 - /* Peer must have set options we didn't request (suggest) */
716 - try.mppe = 0;
717 - }
718 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
719 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
720
721 - if (!try.mppe) {
722 - error("MPPE required but peer negotiation failed");
723 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
724 + if (go->mppc) {
725 + no.mppc = 1;
726 + if (!(p[5] & MPPE_MPPC))
727 + try.mppc = 0;
728 + }
729 +
730 + if (go->mppe)
731 + no.mppe = 1;
732 + if (go->mppe_40)
733 + no.mppe_40 = 1;
734 + if (go->mppe_56)
735 + no.mppe_56 = 1;
736 + if (go->mppe_128)
737 + no.mppe_128 = 1;
738 + if (go->mppe_stateless)
739 + no.mppe_stateless = 1;
740 +
741 + if (ao->mppe_40) {
742 + if ((p[5] & MPPE_40BIT))
743 + try.mppe_40 = 1;
744 + else
745 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
746 + }
747 + if (ao->mppe_56) {
748 + if ((p[5] & MPPE_56BIT))
749 + try.mppe_56 = 1;
750 + else
751 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
752 + }
753 + if (ao->mppe_128) {
754 + if ((p[5] & MPPE_128BIT))
755 + try.mppe_128 = 1;
756 + else
757 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
758 + }
759 +
760 + if (ao->mppe_stateless) {
761 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
762 + try.mppe_stateless = 1;
763 + else
764 + try.mppe_stateless = 0;
765 + }
766 +
767 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
768 + try.mppe = try.mppe_stateless = 0;
769 + if (wo->mppe) {
770 + /* we require encryption, but peer doesn't support it
771 + so we close connection */
772 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
773 + wo->mppe_56 = wo->mppe_128 = 0;
774 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
775 + "key length");
776 + }
777 + }
778 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
779 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
780 + /* cannot negotiate key length */
781 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
782 + wo->mppe_56 = wo->mppe_128 = 0;
783 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
784 }
785 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
786 + try.mppe_40 = try.mppe_56 = 0;
787 + else
788 + if (try.mppe_56 && try.mppe_128)
789 + try.mppe_56 = 0;
790 + else
791 + if (try.mppe_40 && try.mppe_128)
792 + try.mppe_40 = 0;
793 + else
794 + if (try.mppe_40 && try.mppe_56)
795 + try.mppe_40 = 0;
796 +
797 + p += CILEN_MPPE;
798 + len -= CILEN_MPPE;
799 }
800 #endif /* MPPE */
801 +
802 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
803 + no.lzs = 1;
804 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
805 + p[4] != LZS_MODE_EXT))
806 + try.lzs = 0;
807 + else {
808 + try.lzs_mode = p[4];
809 + try.lzs_hists = (p[2] << 8) | p[3];
810 + }
811 + p += CILEN_LZS;
812 + len -= CILEN_LZS;
813 + }
814 +
815 if (go->deflate && len >= CILEN_DEFLATE
816 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
817 && p[1] == CILEN_DEFLATE) {
818 @@ -1002,14 +1255,50 @@ ccp_rejci(f, p, len)
819 return -1;
820
821 #ifdef MPPE
822 - if (go->mppe && len >= CILEN_MPPE
823 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
824 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
825 - error("MPPE required but peer refused");
826 - lcp_close(f->unit, "MPPE required but peer refused");
827 + ccp_options *wo = &ccp_wantoptions[f->unit];
828 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
829 + p[3] != 0 ||
830 + p[4] != 0 ||
831 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
832 + (go->mppe_56 ? MPPE_56BIT : 0) |
833 + (go->mppe_128 ? MPPE_128BIT : 0) |
834 + (go->mppc ? MPPE_MPPC : 0)))
835 + return 0;
836 + if (go->mppc)
837 + try.mppc = 0;
838 + if (go->mppe) {
839 + try.mppe = 0;
840 + if (go->mppe_40)
841 + try.mppe_40 = 0;
842 + if (go->mppe_56)
843 + try.mppe_56 = 0;
844 + if (go->mppe_128)
845 + try.mppe_128 = 0;
846 + if (go->mppe_stateless)
847 + try.mppe_stateless = 0;
848 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
849 + try.mppe = try.mppe_stateless = 0;
850 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
851 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
852 + wo->mppe_56 = wo->mppe_128 = 0;
853 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
854 + "key length");
855 + }
856 + }
857 p += CILEN_MPPE;
858 len -= CILEN_MPPE;
859 }
860 -#endif
861 +#endif /* MPPE */
862 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
863 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
864 + || p[4] != go->lzs_mode)
865 + return 0;
866 + try.lzs = 0;
867 + p += CILEN_LZS;
868 + len -= CILEN_LZS;
869 + }
870 if (go->deflate_correct && len >= CILEN_DEFLATE
871 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
872 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
873 @@ -1073,14 +1362,15 @@ ccp_reqci(f, p, lenp, dont_nak)
874 int dont_nak;
875 {
876 int ret, newret, res;
877 - u_char *p0, *retp;
878 + u_char *p0, *retp, p2, p5;
879 int len, clen, type, nb;
880 ccp_options *ho = &ccp_hisoptions[f->unit];
881 ccp_options *ao = &ccp_allowoptions[f->unit];
882 + ccp_options *wo = &ccp_wantoptions[f->unit];
883 #ifdef MPPE
884 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
885 - /* CI_MPPE, or due to other options? */
886 -#endif
887 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
888 +/* int mtu; */
889 +#endif /* MPPE */
890
891 ret = CONFACK;
892 retp = p0 = p;
893 @@ -1103,106 +1393,302 @@ ccp_reqci(f, p, lenp, dont_nak)
894 switch (type) {
895 #ifdef MPPE
896 case CI_MPPE:
897 - if (!ao->mppe || clen != CILEN_MPPE) {
898 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
899 newret = CONFREJ;
900 break;
901 }
902 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
903 -
904 - /* Nak if anything unsupported or unknown are set. */
905 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
906 - newret = CONFNAK;
907 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
908 - }
909 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
910 + p2 = p[2];
911 + p5 = p[5];
912 + /* not sure what they want, tell 'em what we got */
913 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
914 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
915 + MPPE_MPPC)) != 0 || p[5] == 0) ||
916 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
917 newret = CONFNAK;
918 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
919 - }
920 -
921 - /* Check state opt */
922 - if (ho->mppe & MPPE_OPT_STATEFUL) {
923 - /*
924 - * We can Nak and request stateless, but it's a
925 - * lot easier to just assume the peer will request
926 - * it if he can do it; stateful mode is bad over
927 - * the Internet -- which is where we expect MPPE.
928 - */
929 - if (refuse_mppe_stateful) {
930 - error("Refusing MPPE stateful mode offered by peer");
931 - newret = CONFREJ;
932 - break;
933 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
934 + p[3] = 0;
935 + p[4] = 0;
936 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
937 + (wo->mppe_56 ? MPPE_56BIT : 0) |
938 + (wo->mppe_128 ? MPPE_128BIT : 0) |
939 + (wo->mppc ? MPPE_MPPC : 0);
940 + break;
941 + }
942 +
943 + if ((p[5] & MPPE_MPPC)) {
944 + if (ao->mppc) {
945 + ho->mppc = 1;
946 + BCOPY(p, opt_buf, CILEN_MPPE);
947 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
948 + opt_buf[5] = MPPE_MPPC;
949 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
950 + ho->mppc = 0;
951 + p[5] &= ~MPPE_MPPC;
952 + newret = CONFNAK;
953 + }
954 + } else {
955 + newret = CONFREJ;
956 + if (wo->mppe || ao->mppe) {
957 + p[5] &= ~MPPE_MPPC;
958 + newret = CONFNAK;
959 + }
960 }
961 }
962 -
963 - /* Find out which of {S,L} are set. */
964 - if ((ho->mppe & MPPE_OPT_128)
965 - && (ho->mppe & MPPE_OPT_40)) {
966 - /* Both are set, negotiate the strongest. */
967 - newret = CONFNAK;
968 - if (ao->mppe & MPPE_OPT_128)
969 - ho->mppe &= ~MPPE_OPT_40;
970 - else if (ao->mppe & MPPE_OPT_40)
971 - ho->mppe &= ~MPPE_OPT_128;
972 - else {
973 - newret = CONFREJ;
974 - break;
975 - }
976 - } else if (ho->mppe & MPPE_OPT_128) {
977 - if (!(ao->mppe & MPPE_OPT_128)) {
978 - newret = CONFREJ;
979 - break;
980 - }
981 - } else if (ho->mppe & MPPE_OPT_40) {
982 - if (!(ao->mppe & MPPE_OPT_40)) {
983 - newret = CONFREJ;
984 - break;
985 - }
986 + if (ao->mppe)
987 + ho->mppe = 1;
988 +
989 + if ((p[2] & MPPE_STATELESS)) {
990 + if (ao->mppe_stateless) {
991 + if (wo->mppe_stateless)
992 + ho->mppe_stateless = 1;
993 + else {
994 + newret = CONFNAK;
995 + if (!dont_nak)
996 + p[2] &= ~MPPE_STATELESS;
997 + }
998 + } else {
999 + newret = CONFNAK;
1000 + if (!dont_nak)
1001 + p[2] &= ~MPPE_STATELESS;
1002 + }
1003 + } else {
1004 + if (wo->mppe_stateless && !dont_nak) {
1005 + wo->mppe_stateless = 0;
1006 + newret = CONFNAK;
1007 + p[2] |= MPPE_STATELESS;
1008 + }
1009 + }
1010 +
1011 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1012 + newret = CONFNAK;
1013 + if (ao->mppe_128) {
1014 + ho->mppe_128 = 1;
1015 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1016 + BCOPY(p, opt_buf, CILEN_MPPE);
1017 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1018 + MPPE_MAX_KEY_LEN);
1019 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1020 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1021 + ho->mppe_128 = 0;
1022 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1023 + p[5] &= ~MPPE_128BIT;
1024 + goto check_mppe_56_40;
1025 + }
1026 + goto check_mppe;
1027 + }
1028 + p[5] &= ~MPPE_128BIT;
1029 + goto check_mppe_56_40;
1030 + }
1031 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1032 + newret = CONFNAK;
1033 + if (ao->mppe_128) {
1034 + ho->mppe_128 = 1;
1035 + p[5] &= ~MPPE_56BIT;
1036 + BCOPY(p, opt_buf, CILEN_MPPE);
1037 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1038 + MPPE_MAX_KEY_LEN);
1039 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1040 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1041 + ho->mppe_128 = 0;
1042 + p[5] |= MPPE_56BIT;
1043 + p[5] &= ~MPPE_128BIT;
1044 + goto check_mppe_56;
1045 + }
1046 + goto check_mppe;
1047 + }
1048 + p[5] &= ~MPPE_128BIT;
1049 + goto check_mppe_56;
1050 + }
1051 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1052 + newret = CONFNAK;
1053 + if (ao->mppe_128) {
1054 + ho->mppe_128 = 1;
1055 + p[5] &= ~MPPE_40BIT;
1056 + BCOPY(p, opt_buf, CILEN_MPPE);
1057 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1058 + MPPE_MAX_KEY_LEN);
1059 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1060 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1061 + ho->mppe_128 = 0;
1062 + p[5] |= MPPE_40BIT;
1063 + p[5] &= ~MPPE_128BIT;
1064 + goto check_mppe_40;
1065 + }
1066 + goto check_mppe;
1067 + }
1068 + p[5] &= ~MPPE_128BIT;
1069 + goto check_mppe_40;
1070 + }
1071 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1072 + if (ao->mppe_128) {
1073 + ho->mppe_128 = 1;
1074 + BCOPY(p, opt_buf, CILEN_MPPE);
1075 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1076 + MPPE_MAX_KEY_LEN);
1077 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1078 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1079 + ho->mppe_128 = 0;
1080 + p[5] &= ~MPPE_128BIT;
1081 + newret = CONFNAK;
1082 + }
1083 + goto check_mppe;
1084 + }
1085 + p[5] &= ~MPPE_128BIT;
1086 + newret = CONFNAK;
1087 + goto check_mppe;
1088 + }
1089 + check_mppe_56_40:
1090 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1091 + newret = CONFNAK;
1092 + if (ao->mppe_56) {
1093 + ho->mppe_56 = 1;
1094 + p[5] &= ~MPPE_40BIT;
1095 + BCOPY(p, opt_buf, CILEN_MPPE);
1096 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1097 + MPPE_MAX_KEY_LEN);
1098 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1099 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1100 + ho->mppe_56 = 0;
1101 + p[5] |= MPPE_40BIT;
1102 + p[5] &= ~MPPE_56BIT;
1103 + newret = CONFNAK;
1104 + goto check_mppe_40;
1105 + }
1106 + goto check_mppe;
1107 + }
1108 + p[5] &= ~MPPE_56BIT;
1109 + goto check_mppe_40;
1110 + }
1111 + check_mppe_56:
1112 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1113 + if (ao->mppe_56) {
1114 + ho->mppe_56 = 1;
1115 + BCOPY(p, opt_buf, CILEN_MPPE);
1116 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1117 + MPPE_MAX_KEY_LEN);
1118 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1119 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1120 + ho->mppe_56 = 0;
1121 + p[5] &= ~MPPE_56BIT;
1122 + newret = CONFNAK;
1123 + }
1124 + goto check_mppe;
1125 + }
1126 + p[5] &= ~MPPE_56BIT;
1127 + newret = CONFNAK;
1128 + goto check_mppe;
1129 + }
1130 + check_mppe_40:
1131 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1132 + if (ao->mppe_40) {
1133 + ho->mppe_40 = 1;
1134 + BCOPY(p, opt_buf, CILEN_MPPE);
1135 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1136 + MPPE_MAX_KEY_LEN);
1137 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1138 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1139 + ho->mppe_40 = 0;
1140 + p[5] &= ~MPPE_40BIT;
1141 + newret = CONFNAK;
1142 + }
1143 + goto check_mppe;
1144 + }
1145 + p[5] &= ~MPPE_40BIT;
1146 + }
1147 +
1148 + check_mppe:
1149 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1150 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1151 + newret = CONFNAK;
1152 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1153 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1154 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1155 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1156 + (wo->mppc ? MPPE_MPPC : 0);
1157 + } else {
1158 + ho->mppe = ho->mppe_stateless = 0;
1159 + }
1160 } else {
1161 - /* Neither are set. */
1162 - /* We cannot accept this. */
1163 - newret = CONFNAK;
1164 - /* Give the peer our idea of what can be used,
1165 - so it can choose and confirm */
1166 - ho->mppe = ao->mppe;
1167 - }
1168 -
1169 - /* rebuild the opts */
1170 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1171 - if (newret == CONFACK) {
1172 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1173 - int mtu;
1174 -
1175 - BCOPY(p, opt_buf, CILEN_MPPE);
1176 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1177 - MPPE_MAX_KEY_LEN);
1178 - if (ccp_test(f->unit, opt_buf,
1179 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1180 - /* This shouldn't happen, we've already tested it! */
1181 - error("MPPE required, but kernel has no support.");
1182 - lcp_close(f->unit, "MPPE required but not available");
1183 - newret = CONFREJ;
1184 - break;
1185 - }
1186 - /*
1187 - * We need to decrease the interface MTU by MPPE_PAD
1188 - * because MPPE frames **grow**. The kernel [must]
1189 - * allocate MPPE_PAD extra bytes in xmit buffers.
1190 - */
1191 - mtu = netif_get_mtu(f->unit);
1192 - if (mtu)
1193 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1194 - else
1195 - newret = CONFREJ;
1196 - }
1197 -
1198 - /*
1199 - * We have accepted MPPE or are willing to negotiate
1200 - * MPPE parameters. A CONFREJ is due to subsequent
1201 - * (non-MPPE) processing.
1202 - */
1203 - rej_for_ci_mppe = 0;
1204 - break;
1205 -#endif /* MPPE */
1206 + /* MPPE is not compatible with other compression types */
1207 + if (wo->mppe) {
1208 + ao->bsd_compress = 0;
1209 + ao->predictor_1 = 0;
1210 + ao->predictor_2 = 0;
1211 + ao->deflate = 0;
1212 + ao->lzs = 0;
1213 + }
1214 + }
1215 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1216 + p[2] = p2;
1217 + p[5] = p5;
1218 + newret = CONFREJ;
1219 + break;
1220 + }
1221 +
1222 + /*
1223 + * I have commented the code below because according to RFC1547
1224 + * MTU is only information for higher level protocols about
1225 + * "the maximum allowable length for a packet (q.v.) transmitted
1226 + * over a point-to-point link without incurring network layer
1227 + * fragmentation." Of course a PPP implementation should be able
1228 + * to handle overhead added by MPPE - in our case apropriate code
1229 + * is located in drivers/net/ppp_generic.c in the kernel sources.
1230 + *
1231 + * According to RFC1661:
1232 + * - when negotiated MRU is less than 1500 octets, a PPP
1233 + * implementation must still be able to receive at least 1500
1234 + * octets,
1235 + * - when PFC is negotiated, a PPP implementation is still
1236 + * required to receive frames with uncompressed protocol field.
1237 + *
1238 + * So why not to handle MPPE overhead without changing MTU value?
1239 + * I am sure that RFC3078, unfortunately silently, assumes that.
1240 + */
1241 +
1242 + /*
1243 + * We need to decrease the interface MTU by MPPE_PAD
1244 + * because MPPE frames **grow**. The kernel [must]
1245 + * allocate MPPE_PAD extra bytes in xmit buffers.
1246 + */
1247 + /*
1248 + mtu = netif_get_mtu(f->unit);
1249 + if (mtu) {
1250 + netif_set_mtu(f->unit, mtu - MPPE_PAD);
1251 + } else {
1252 + newret = CONFREJ;
1253 + if (ccp_wantoptions[f->unit].mppe) {
1254 + error("Cannot adjust MTU needed by MPPE.");
1255 + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1256 + }
1257 + }
1258 + */
1259 + break;
1260 + #endif /* MPPE */
1261 +
1262 + case CI_LZS:
1263 + if (!ao->lzs || clen != CILEN_LZS) {
1264 + newret = CONFREJ;
1265 + break;
1266 + }
1267 +
1268 + ho->lzs = 1;
1269 + ho->lzs_hists = (p[2] << 8) | p[3];
1270 + ho->lzs_mode = p[4];
1271 + if ((ho->lzs_hists != ao->lzs_hists) ||
1272 + (ho->lzs_mode != ao->lzs_mode)) {
1273 + newret = CONFNAK;
1274 + if (!dont_nak) {
1275 + p[2] = ao->lzs_hists >> 8;
1276 + p[3] = ao->lzs_hists & 0xff;
1277 + p[4] = ao->lzs_mode;
1278 + } else
1279 + break;
1280 + }
1281 +
1282 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1283 + newret = CONFREJ;
1284 + }
1285 + break;
1286 case CI_DEFLATE:
1287 case CI_DEFLATE_DRAFT:
1288 if (!ao->deflate || clen != CILEN_DEFLATE
1289 @@ -1344,12 +1830,6 @@ ccp_reqci(f, p, lenp, dont_nak)
1290 else
1291 *lenp = retp - p0;
1292 }
1293 -#ifdef MPPE
1294 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1295 - error("MPPE required but peer negotiation failed");
1296 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1297 - }
1298 -#endif
1299 return ret;
1300 }
1301
1302 @@ -1371,24 +1851,35 @@ method_name(opt, opt2)
1303 char *p = result;
1304 char *q = result + sizeof(result); /* 1 past result */
1305
1306 - slprintf(p, q - p, "MPPE ");
1307 - p += 5;
1308 - if (opt->mppe & MPPE_OPT_128) {
1309 - slprintf(p, q - p, "128-bit ");
1310 - p += 8;
1311 - }
1312 - if (opt->mppe & MPPE_OPT_40) {
1313 - slprintf(p, q - p, "40-bit ");
1314 - p += 7;
1315 - }
1316 - if (opt->mppe & MPPE_OPT_STATEFUL)
1317 - slprintf(p, q - p, "stateful");
1318 - else
1319 - slprintf(p, q - p, "stateless");
1320 -
1321 + if (opt->mppe) {
1322 + if (opt->mppc) {
1323 + slprintf(p, q - p, "MPPC/MPPE ");
1324 + p += 10;
1325 + } else {
1326 + slprintf(p, q - p, "MPPE ");
1327 + p += 5;
1328 + }
1329 + if (opt->mppe_128) {
1330 + slprintf(p, q - p, "128-bit ");
1331 + p += 8;
1332 + } else if (opt->mppe_56) {
1333 + slprintf(p, q - p, "56-bit ");
1334 + p += 7;
1335 + } else if (opt->mppe_40) {
1336 + slprintf(p, q - p, "40-bit ");
1337 + p += 7;
1338 + }
1339 + if (opt->mppe_stateless)
1340 + slprintf(p, q - p, "stateless");
1341 + else
1342 + slprintf(p, q - p, "stateful");
1343 + } else if (opt->mppc)
1344 + slprintf(p, q - p, "MPPC");
1345 break;
1346 }
1347 -#endif
1348 +#endif /* MPPE */
1349 + case CI_LZS:
1350 + return "Stac LZS";
1351 case CI_DEFLATE:
1352 case CI_DEFLATE_DRAFT:
1353 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1354 @@ -1444,12 +1935,12 @@ ccp_up(f)
1355 } else if (ANY_COMPRESS(*ho))
1356 notice("%s transmit compression enabled", method_name(ho, NULL));
1357 #ifdef MPPE
1358 - if (go->mppe) {
1359 + if (go->mppe || go->mppc) {
1360 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1361 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1362 continue_networks(f->unit); /* Bring up IP et al */
1363 }
1364 -#endif
1365 +#endif /* MPPE */
1366 }
1367
1368 /*
1369 @@ -1472,7 +1963,7 @@ ccp_down(f)
1370 lcp_close(f->unit, "MPPE disabled");
1371 }
1372 }
1373 -#endif
1374 +#endif /* MPPE */
1375 }
1376
1377 /*
1378 @@ -1532,24 +2023,28 @@ ccp_printpkt(p, plen, printer, arg)
1379 #ifdef MPPE
1380 case CI_MPPE:
1381 if (optlen >= CILEN_MPPE) {
1382 - u_char mppe_opts;
1383 -
1384 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1385 - printer(arg, "mppe %s %s %s %s %s %s%s",
1386 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1387 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1388 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1389 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1390 + printer(arg, "mppe %s %s %s %s %s %s",
1391 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1392 + (p[5] & MPPE_56BIT)? "+M": "-M",
1393 + (p[5] & MPPE_128BIT)? "+S": "-S",
1394 + (p[5] & MPPE_40BIT)? "+L": "-L",
1395 (p[5] & MPPE_D_BIT)? "+D": "-D",
1396 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1397 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1398 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1399 + (p[5] & MPPE_MPPC)? "+C": "-C");
1400 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1401 + MPPE_D_BIT | MPPE_MPPC)) ||
1402 + (p[2] & ~MPPE_STATELESS))
1403 printer(arg, " (%.2x %.2x %.2x %.2x)",
1404 p[2], p[3], p[4], p[5]);
1405 p += CILEN_MPPE;
1406 }
1407 break;
1408 -#endif
1409 +#endif /* MPPE */
1410 + case CI_LZS:
1411 + if (optlen >= CILEN_LZS) {
1412 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1413 + p += CILEN_LZS;
1414 + }
1415 + break;
1416 case CI_DEFLATE:
1417 case CI_DEFLATE_DRAFT:
1418 if (optlen >= CILEN_DEFLATE) {
1419 @@ -1635,6 +2130,7 @@ ccp_datainput(unit, pkt, len)
1420 error("Lost compression sync: disabling compression");
1421 ccp_close(unit, "Lost compression sync");
1422 #ifdef MPPE
1423 + /* My module dosn't need this. J.D., 2003-07-06 */
1424 /*
1425 * If we were doing MPPE, we must also take the link down.
1426 */
1427 @@ -1642,9 +2138,18 @@ ccp_datainput(unit, pkt, len)
1428 error("Too many MPPE errors, closing LCP");
1429 lcp_close(unit, "Too many MPPE errors");
1430 }
1431 -#endif
1432 +#endif /* MPPE */
1433 } else {
1434 /*
1435 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1436 + * and don't wait for CCP_RESETACK
1437 + */
1438 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1439 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1440 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1441 + return;
1442 + }
1443 + /*
1444 * Send a reset-request to reset the peer's compressor.
1445 * We don't do that if we are still waiting for an
1446 * acknowledgement to a previous reset-request.
1447 --- a/pppd/ccp.h
1448 +++ b/pppd/ccp.h
1449 @@ -37,9 +37,17 @@ typedef struct ccp_options {
1450 bool predictor_2; /* do Predictor-2? */
1451 bool deflate_correct; /* use correct code for deflate? */
1452 bool deflate_draft; /* use draft RFC code for deflate? */
1453 + bool lzs; /* do Stac LZS? */
1454 + bool mppc; /* do MPPC? */
1455 bool mppe; /* do MPPE? */
1456 + bool mppe_40; /* allow 40 bit encryption? */
1457 + bool mppe_56; /* allow 56 bit encryption? */
1458 + bool mppe_128; /* allow 128 bit encryption? */
1459 + bool mppe_stateless; /* allow stateless encryption */
1460 u_short bsd_bits; /* # bits/code for BSD Compress */
1461 u_short deflate_size; /* lg(window size) for Deflate */
1462 + u_short lzs_mode; /* LZS check mode */
1463 + u_short lzs_hists; /* number of LZS histories */
1464 short method; /* code for chosen compression method */
1465 } ccp_options;
1466
1467 --- a/pppd/chap_ms.c
1468 +++ b/pppd/chap_ms.c
1469 @@ -898,13 +898,17 @@ set_mppe_enc_types(int policy, int types
1470 /*
1471 * Disable undesirable encryption types. Note that we don't ENABLE
1472 * any encryption types, to avoid overriding manual configuration.
1473 + *
1474 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1475 */
1476 switch(types) {
1477 case MPPE_ENC_TYPES_RC4_40:
1478 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1479 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1480 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1481 break;
1482 case MPPE_ENC_TYPES_RC4_128:
1483 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1484 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1485 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1486 break;
1487 default:
1488 break;
Personal OpenWRT clone
This page took 0.106267 seconds and 5 git commands to generate.