| blob | 89fda328683e6d07593433315256865d02d4fb27 |
1 Source: http://gaute.vetsj.com/tag/mppc/
3 diff -urN ppp-2.4.4-old/include/linux/ppp-comp.h ppp-2.4.4-new/include/linux/ppp-comp.h
4 --- ppp-2.4.4-old/include/linux/ppp-comp.h 2002-12-06 10:49:15.000000000 +0100
5 +++ ppp-2.4.4-new/include/linux/ppp-comp.h 2008-03-19 20:11:28.000000000 +0100
6 @@ -36,7 +36,7 @@
7 */
9 /*
10 - * ==FILEVERSION 20020319==
11 + * ==FILEVERSION 20020715==
12 *
13 * NOTE TO MAINTAINERS:
14 * If you modify this file at all, please set the above date.
15 @@ -86,7 +86,7 @@
17 /* Compress a packet */
18 int (*compress) (void *state, unsigned char *rptr,
19 - unsigned char *obuf, int isize, int osize);
20 + unsigned char *obuf, int isize, int osize);
22 /* Return compression statistics */
23 void (*comp_stat) (void *state, struct compstat *stats);
24 @@ -107,7 +107,7 @@
26 /* Decompress a packet. */
27 int (*decompress) (void *state, unsigned char *ibuf, int isize,
28 - unsigned char *obuf, int osize);
29 + unsigned char *obuf, int osize);
31 /* Update state for an incompressible packet received */
32 void (*incomp) (void *state, unsigned char *ibuf, int icnt);
33 @@ -288,6 +288,33 @@
34 opts |= MPPE_OPT_UNKNOWN; \
35 } while (/* CONSTCOND */ 0)
37 +/* MPPE/MPPC definitions by J.D.*/
38 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
39 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
40 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
41 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
42 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
43 +
44 +/*
45 + * Definitions for Stac LZS.
46 + */
47 +
48 +#define CI_LZS 17 /* config option for Stac LZS */
49 +#define CILEN_LZS 5 /* length of config option */
50 +
51 +#define LZS_OVHD 4 /* max. LZS overhead */
52 +#define LZS_HIST_LEN 2048 /* LZS history size */
53 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
54 +
55 +#define LZS_MODE_NONE 0
56 +#define LZS_MODE_LCB 1
57 +#define LZS_MODE_CRC 2
58 +#define LZS_MODE_SEQ 3
59 +#define LZS_MODE_EXT 4
60 +
61 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
62 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
63 +
64 /*
65 * Definitions for other, as yet unsupported, compression methods.
66 */
67 diff -urN ppp-2.4.4-old/include/net/ppp-comp.h ppp-2.4.4-new/include/net/ppp-comp.h
68 --- ppp-2.4.4-old/include/net/ppp-comp.h 2002-12-06 10:49:15.000000000 +0100
69 +++ ppp-2.4.4-new/include/net/ppp-comp.h 2008-03-19 20:11:28.000000000 +0100
70 @@ -255,6 +255,33 @@
71 opts |= MPPE_OPT_UNKNOWN; \
72 } while (/* CONSTCOND */ 0)
74 +/* MPPE/MPPC definitions by J.D.*/
75 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
76 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
77 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
78 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
79 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
80 +
81 +/*
82 + * Definitions for Stac LZS.
83 + */
84 +
85 +#define CI_LZS 17 /* config option for Stac LZS */
86 +#define CILEN_LZS 5 /* length of config option */
87 +
88 +#define LZS_OVHD 4 /* max. LZS overhead */
89 +#define LZS_HIST_LEN 2048 /* LZS history size */
90 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
91 +
92 +#define LZS_MODE_NONE 0
93 +#define LZS_MODE_LCB 1
94 +#define LZS_MODE_CRC 2
95 +#define LZS_MODE_SEQ 3
96 +#define LZS_MODE_EXT 4
97 +
98 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
99 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
100 +
101 /*
102 * Definitions for other, as yet unsupported, compression methods.
103 */
104 diff -urN ppp-2.4.4-old/pppd/ccp.c ppp-2.4.4-new/pppd/ccp.c
105 --- ppp-2.4.4-old/pppd/ccp.c 2005-07-09 02:23:05.000000000 +0200
106 +++ ppp-2.4.4-new/pppd/ccp.c 2008-03-19 20:11:43.000000000 +0100
107 @@ -62,12 +62,10 @@
108 static char bsd_value[8];
109 static char deflate_value[8];
111 -/*
112 - * Option variables.
113 - */
114 #ifdef MPPE
115 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
116 -#endif
117 +static int setmppe(char **);
118 +static int setnomppe(void);
119 +#endif /* MPPE */
121 static option_t ccp_option_list[] = {
122 { "noccp", o_bool, &ccp_protent.enabled_flag,
123 @@ -108,54 +106,36 @@
124 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
125 &ccp_allowoptions[0].predictor_1 },
127 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
128 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
129 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
130 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
131 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
132 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
133 + &ccp_allowoptions[0].lzs },
134 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
135 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
136 + &ccp_allowoptions[0].lzs },
137 +
138 #ifdef MPPE
139 - /* MPPE options are symmetrical ... we only set wantoptions here */
140 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
141 - "require MPPE encryption",
142 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
143 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
144 - "require MPPE encryption",
145 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
146 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
147 - "don't allow MPPE encryption", OPT_PRIO },
148 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
149 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
150 -
151 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
152 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
153 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
154 - &ccp_wantoptions[0].mppe },
155 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
156 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
157 - &ccp_wantoptions[0].mppe },
158 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
159 - "don't allow MPPE 40-bit encryption",
160 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
161 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
162 - "don't allow MPPE 40-bit encryption",
163 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
164 - &ccp_wantoptions[0].mppe },
165 -
166 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
167 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
168 - &ccp_wantoptions[0].mppe },
169 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
170 - "require MPPE 128-bit encryption",
171 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
172 - &ccp_wantoptions[0].mppe },
173 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
174 - "don't allow MPPE 128-bit encryption",
175 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
176 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
177 - "don't allow MPPE 128-bit encryption",
178 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
179 - &ccp_wantoptions[0].mppe },
180 -
181 - /* strange one; we always request stateless, but will we allow stateful? */
182 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
183 - "allow MPPE stateful mode", OPT_PRIO },
184 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
185 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
186 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
187 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
188 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
189 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
190 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
191 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
192 + &ccp_allowoptions[0].mppc },
193 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
194 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
195 + &ccp_allowoptions[0].mppc },
196 + { "mppe", o_special, (void *)setmppe,
197 + "request MPPE encryption" },
198 + { "+mppe", o_special, (void *)setmppe,
199 + "request MPPE encryption" },
200 + { "nomppe", o_special_noarg, (void *)setnomppe,
201 + "don't allow MPPE encryption" },
202 + { "-mppe", o_special_noarg, (void *)setnomppe,
203 + "don't allow MPPE encryption" },
204 #endif /* MPPE */
206 { NULL }
207 @@ -241,7 +221,7 @@
208 */
209 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
210 || (opt).predictor_1 || (opt).predictor_2 \
211 - || (opt).mppe)
212 + || (opt).lzs || (opt).mppc || (opt).mppe)
214 /*
215 * Local state (mainly for handling reset-reqs and reset-acks).
216 @@ -344,6 +324,100 @@
217 return 1;
218 }
220 +#ifdef MPPE
221 +/*
222 + * Functions called from config options
223 + */
224 +/*
225 + MPPE suboptions:
226 + required - require MPPE; disconnect if peer doesn't support it
227 + stateless - use stateless mode
228 + no40 - disable 40 bit keys
229 + no56 - disable 56 bit keys
230 + no128 - disable 128 bit keys
231 +*/
232 +int setmppe(char **argv)
233 +{
234 + int i;
235 + char *str, cmdbuf[16];
236 +
237 + ccp_allowoptions[0].mppe = 1;
238 + ccp_allowoptions[0].mppe_40 = 1;
239 + ccp_allowoptions[0].mppe_56 = 1;
240 + ccp_allowoptions[0].mppe_128 = 1;
241 + ccp_allowoptions[0].mppe_stateless = 0;
242 + ccp_wantoptions[0].mppe = 0;
243 +
244 + str = *argv;
245 +
246 + while (1) {
247 + i = 0;
248 + memset(cmdbuf, '\0', 16);
249 + while ((i < 16) && (*str != ',') && (*str != '\0'))
250 + cmdbuf[i++] = *str++;
251 + cmdbuf[i] = '\0';
252 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
253 + ccp_allowoptions[0].mppe_40 = 0;
254 + goto next_param;
255 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
256 + ccp_allowoptions[0].mppe_56 = 0;
257 + goto next_param;
258 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
259 + ccp_allowoptions[0].mppe_128 = 0;
260 + goto next_param;
261 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
262 + ccp_allowoptions[0].mppe_stateless = 1;
263 + goto next_param;
264 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
265 + ccp_wantoptions[0].mppe = 1;
266 + goto next_param;
267 + } else {
268 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
269 + return 0;
270 + }
271 +
272 + next_param:
273 + if (*str == ',') {
274 + str++;
275 + continue;
276 + }
277 + if (*str == '\0') {
278 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
279 + ccp_allowoptions[0].mppe_128)) {
280 + if (ccp_wantoptions[0].mppe == 1) {
281 + option_error("You require MPPE but you have switched off "
282 + "all encryption key lengths.");
283 + return 0;
284 + }
285 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
286 + ccp_wantoptions[0].mppe_stateless =
287 + ccp_allowoptions[0].mppe_stateless = 0;
288 + } else {
289 + ccp_allowoptions[0].mppe = 1;
290 + ccp_wantoptions[0].mppe_stateless =
291 + ccp_allowoptions[0].mppe_stateless;
292 + if (ccp_wantoptions[0].mppe == 1) {
293 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
294 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
295 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
296 + }
297 + }
298 + return 1;
299 + }
300 + }
301 +}
302 +
303 +int setnomppe(void)
304 +{
305 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
306 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
307 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
308 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
309 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
310 + return 1;
311 +}
312 +#endif /* MPPE */
313 +
314 /*
315 * ccp_init - initialize CCP.
316 */
317 @@ -378,6 +452,30 @@
318 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
320 ccp_allowoptions[0].predictor_1 = 1;
321 +
322 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
323 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
324 + ccp_wantoptions[0].lzs_hists = 1;
325 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
326 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
327 + ccp_allowoptions[0].lzs_hists = 1;
328 +
329 +#ifdef MPPE
330 + /* by default allow and request MPPC... */
331 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
332 +
333 + /* ... and allow but don't request MPPE */
334 + ccp_allowoptions[0].mppe = 1;
335 + ccp_allowoptions[0].mppe_40 = 1;
336 + ccp_allowoptions[0].mppe_56 = 1;
337 + ccp_allowoptions[0].mppe_128 = 1;
338 + ccp_allowoptions[0].mppe_stateless = 1;
339 + ccp_wantoptions[0].mppe = 0;
340 + ccp_wantoptions[0].mppe_40 = 0;
341 + ccp_wantoptions[0].mppe_56 = 0;
342 + ccp_wantoptions[0].mppe_128 = 0;
343 + ccp_wantoptions[0].mppe_stateless = 0;
344 +#endif /* MPPE */
345 }
347 /*
348 @@ -455,11 +553,11 @@
349 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
350 notice("Compression disabled by peer.");
351 #ifdef MPPE
352 - if (ccp_gotoptions[unit].mppe) {
353 + if (ccp_wantoptions[unit].mppe) {
354 error("MPPE disabled, closing LCP");
355 lcp_close(unit, "MPPE disabled by peer");
356 }
357 -#endif
358 +#endif /* MPPE */
359 }
361 /*
362 @@ -487,6 +585,15 @@
363 break;
364 /* send a reset-ack, which the transmitter will see and
365 reset its compression state. */
366 +
367 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
368 + but we do it in order to reset compressor; CCP_RESETACK is
369 + then silently discarded. See functions ppp_send_frame and
370 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
371 + confusion is caused by the fact that CCP code is splited
372 + into two parts - one part is handled by pppd, the other one
373 + is handled by kernel. */
374 +
375 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
376 break;
378 @@ -515,12 +622,11 @@
379 fsm_lowerdown(&ccp_fsm[unit]);
381 #ifdef MPPE
382 - if (ccp_gotoptions[unit].mppe) {
383 + if (ccp_wantoptions[unit].mppe) {
384 error("MPPE required but peer negotiation failed");
385 lcp_close(unit, "MPPE required but peer negotiation failed");
386 }
387 -#endif
388 -
389 +#endif /* MPPE */
390 }
392 /*
393 @@ -537,7 +643,7 @@
394 all_rejected[f->unit] = 0;
396 #ifdef MPPE
397 - if (go->mppe) {
398 + if (go->mppe || go->mppc) {
399 ccp_options *ao = &ccp_allowoptions[f->unit];
400 int auth_mschap_bits = auth_done[f->unit];
401 int numbits;
402 @@ -551,80 +657,109 @@
403 * NB: If MPPE is required, all other compression opts are invalid.
404 * So, we return right away if we can't do it.
405 */
406 + if (ccp_wantoptions[f->unit].mppe) {
407 + /* Leave only the mschap auth bits set */
408 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
409 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
410 + /* Count the mschap auths */
411 + auth_mschap_bits >>= CHAP_MS_SHIFT;
412 + numbits = 0;
413 + do {
414 + numbits += auth_mschap_bits & 1;
415 + auth_mschap_bits >>= 1;
416 + } while (auth_mschap_bits);
417 + if (numbits > 1) {
418 + error("MPPE required, but auth done in both directions.");
419 + lcp_close(f->unit, "MPPE required but not available");
420 + return;
421 + }
422 + if (!numbits) {
423 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
424 + lcp_close(f->unit, "MPPE required but not available");
425 + return;
426 + }
428 - /* Leave only the mschap auth bits set */
429 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
430 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
431 - /* Count the mschap auths */
432 - auth_mschap_bits >>= CHAP_MS_SHIFT;
433 - numbits = 0;
434 - do {
435 - numbits += auth_mschap_bits & 1;
436 - auth_mschap_bits >>= 1;
437 - } while (auth_mschap_bits);
438 - if (numbits > 1) {
439 - error("MPPE required, but auth done in both directions.");
440 - lcp_close(f->unit, "MPPE required but not available");
441 - return;
442 - }
443 - if (!numbits) {
444 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
445 - lcp_close(f->unit, "MPPE required but not available");
446 - return;
447 - }
448 -
449 - /* A plugin (eg radius) may not have obtained key material. */
450 - if (!mppe_keys_set) {
451 - error("MPPE required, but keys are not available. "
452 - "Possible plugin problem?");
453 - lcp_close(f->unit, "MPPE required but not available");
454 - return;
455 - }
456 -
457 - /* LM auth not supported for MPPE */
458 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
459 - /* This might be noise */
460 - if (go->mppe & MPPE_OPT_40) {
461 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
462 - go->mppe &= ~MPPE_OPT_40;
463 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
464 + /* A plugin (eg radius) may not have obtained key material. */
465 + if (!mppe_keys_set) {
466 + error("MPPE required, but keys are not available. "
467 + "Possible plugin problem?");
468 + lcp_close(f->unit, "MPPE required but not available");
469 + return;
470 }
471 }
473 - /* Last check: can we actually negotiate something? */
474 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
475 - /* Could be misconfig, could be 40-bit disabled above. */
476 - error("MPPE required, but both 40-bit and 128-bit disabled.");
477 - lcp_close(f->unit, "MPPE required but not available");
478 - return;
479 + /*
480 + * Check whether the kernel knows about the various
481 + * compression methods we might request. Key material
482 + * unimportant here.
483 + */
484 + if (go->mppc) {
485 + opt_buf[0] = CI_MPPE;
486 + opt_buf[1] = CILEN_MPPE;
487 + opt_buf[2] = 0;
488 + opt_buf[3] = 0;
489 + opt_buf[4] = 0;
490 + opt_buf[5] = MPPE_MPPC;
491 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
492 + go->mppc = 0;
493 + }
494 + if (go->mppe_40) {
495 + opt_buf[0] = CI_MPPE;
496 + opt_buf[1] = CILEN_MPPE;
497 + opt_buf[2] = MPPE_STATELESS;
498 + opt_buf[3] = 0;
499 + opt_buf[4] = 0;
500 + opt_buf[5] = MPPE_40BIT;
501 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
502 + go->mppe_40 = 0;
503 + }
504 + if (go->mppe_56) {
505 + opt_buf[0] = CI_MPPE;
506 + opt_buf[1] = CILEN_MPPE;
507 + opt_buf[2] = MPPE_STATELESS;
508 + opt_buf[3] = 0;
509 + opt_buf[4] = 0;
510 + opt_buf[5] = MPPE_56BIT;
511 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
512 + go->mppe_56 = 0;
513 + }
514 + if (go->mppe_128) {
515 + opt_buf[0] = CI_MPPE;
516 + opt_buf[1] = CILEN_MPPE;
517 + opt_buf[2] = MPPE_STATELESS;
518 + opt_buf[3] = 0;
519 + opt_buf[4] = 0;
520 + opt_buf[5] = MPPE_128BIT;
521 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
522 + go->mppe_128 = 0;
523 + }
524 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
525 + if (ccp_wantoptions[f->unit].mppe) {
526 + error("MPPE required, but kernel has no support.");
527 + lcp_close(f->unit, "MPPE required but not available");
528 + }
529 + go->mppe = go->mppe_stateless = 0;
530 + } else {
531 + /* MPPE is not compatible with other compression types */
532 + if (ccp_wantoptions[f->unit].mppe) {
533 + ao->bsd_compress = go->bsd_compress = 0;
534 + ao->predictor_1 = go->predictor_1 = 0;
535 + ao->predictor_2 = go->predictor_2 = 0;
536 + ao->deflate = go->deflate = 0;
537 + ao->lzs = go->lzs = 0;
538 + }
539 }
540 -
541 - /* sync options */
542 - ao->mppe = go->mppe;
543 - /* MPPE is not compatible with other compression types */
544 - ao->bsd_compress = go->bsd_compress = 0;
545 - ao->predictor_1 = go->predictor_1 = 0;
546 - ao->predictor_2 = go->predictor_2 = 0;
547 - ao->deflate = go->deflate = 0;
548 }
549 #endif /* MPPE */
550 -
551 - /*
552 - * Check whether the kernel knows about the various
553 - * compression methods we might request.
554 - */
555 -#ifdef MPPE
556 - if (go->mppe) {
557 - opt_buf[0] = CI_MPPE;
558 - opt_buf[1] = CILEN_MPPE;
559 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
560 - /* Key material unimportant here. */
561 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
562 - error("MPPE required, but kernel has no support.");
563 - lcp_close(f->unit, "MPPE required but not available");
564 - }
565 + if (go->lzs) {
566 + opt_buf[0] = CI_LZS;
567 + opt_buf[1] = CILEN_LZS;
568 + opt_buf[2] = go->lzs_hists >> 8;
569 + opt_buf[3] = go->lzs_hists & 0xff;
570 + opt_buf[4] = LZS_MODE_SEQ;
571 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
572 + go->lzs = 0;
573 }
574 -#endif
575 if (go->bsd_compress) {
576 opt_buf[0] = CI_BSD_COMPRESS;
577 opt_buf[1] = CILEN_BSD_COMPRESS;
578 @@ -679,7 +814,8 @@
579 + (go->deflate? CILEN_DEFLATE: 0)
580 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
581 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
582 - + (go->mppe? CILEN_MPPE: 0);
583 + + (go->lzs? CILEN_LZS: 0)
584 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
585 }
587 /*
588 @@ -693,6 +829,8 @@
589 {
590 int res;
591 ccp_options *go = &ccp_gotoptions[f->unit];
592 + ccp_options *ao = &ccp_allowoptions[f->unit];
593 + ccp_options *wo = &ccp_wantoptions[f->unit];
594 u_char *p0 = p;
596 /*
597 @@ -701,22 +839,43 @@
598 * in case it gets Acked.
599 */
600 #ifdef MPPE
601 - if (go->mppe) {
602 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
603 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
605 - p[0] = opt_buf[0] = CI_MPPE;
606 - p[1] = opt_buf[1] = CILEN_MPPE;
607 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
608 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
609 + p[0] = CI_MPPE;
610 + p[1] = CILEN_MPPE;
611 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
612 + p[3] = 0;
613 + p[4] = 0;
614 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
615 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
616 +
617 + BCOPY(p, opt_buf, CILEN_MPPE);
618 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
619 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
620 - if (res > 0)
621 + if (res > 0) {
622 p += CILEN_MPPE;
623 - else
624 + } else {
625 /* This shouldn't happen, we've already tested it! */
626 - lcp_close(f->unit, "MPPE required but not available in kernel");
627 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
628 + go->mppe_stateless = go->mppc = 0;
629 + if (ccp_wantoptions[f->unit].mppe)
630 + lcp_close(f->unit, "MPPE required but not available in kernel");
631 + }
632 + }
633 +#endif /* MPPE */
634 + if (go->lzs) {
635 + p[0] = CI_LZS;
636 + p[1] = CILEN_LZS;
637 + p[2] = go->lzs_hists >> 8;
638 + p[3] = go->lzs_hists & 0xff;
639 + p[4] = LZS_MODE_SEQ;
640 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
641 + if (res > 0) {
642 + p += CILEN_LZS;
643 + } else
644 + go->lzs = 0;
645 }
646 -#endif
647 if (go->deflate) {
648 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
649 p[1] = CILEN_DEFLATE;
650 @@ -802,7 +961,7 @@
652 /*
653 * ccp_ackci - process a received configure-ack, and return
654 - * 1 iff the packet was OK.
655 + * 1 if the packet was OK.
656 */
657 static int
658 ccp_ackci(f, p, len)
659 @@ -811,24 +970,44 @@
660 int len;
661 {
662 ccp_options *go = &ccp_gotoptions[f->unit];
663 + ccp_options *ao = &ccp_allowoptions[f->unit];
664 + ccp_options *wo = &ccp_wantoptions[f->unit];
665 u_char *p0 = p;
667 #ifdef MPPE
668 - if (go->mppe) {
669 - u_char opt_buf[CILEN_MPPE];
670 -
671 - opt_buf[0] = CI_MPPE;
672 - opt_buf[1] = CILEN_MPPE;
673 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
674 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
675 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
676 + if (len < CILEN_MPPE
677 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
678 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
679 + || p[3] != 0
680 + || p[4] != 0
681 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
682 + (go->mppc ? MPPE_MPPC : 0))
683 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
684 + (go->mppc ? MPPE_MPPC : 0))
685 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
686 + (go->mppc ? MPPE_MPPC : 0))))
687 return 0;
688 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
689 + go->mppe = 1;
690 p += CILEN_MPPE;
691 len -= CILEN_MPPE;
692 + /* Cope with first/fast ack */
693 + if (p == p0 && len == 0)
694 + return 1;
695 + }
696 +#endif /* MPPE */
697 + if (go->lzs) {
698 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
699 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
700 + || p[4] != LZS_MODE_SEQ)
701 + return 0;
702 + p += CILEN_LZS;
703 + len -= CILEN_LZS;
704 /* XXX Cope with first/fast ack */
705 - if (len == 0)
706 + if (p == p0 && len == 0)
707 return 1;
708 }
709 -#endif
710 if (go->deflate) {
711 if (len < CILEN_DEFLATE
712 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
713 @@ -891,7 +1070,7 @@
715 /*
716 * ccp_nakci - process received configure-nak.
717 - * Returns 1 iff the nak was OK.
718 + * Returns 1 if the nak was OK.
719 */
720 static int
721 ccp_nakci(f, p, len, treat_as_reject)
722 @@ -901,6 +1080,8 @@
723 int treat_as_reject;
724 {
725 ccp_options *go = &ccp_gotoptions[f->unit];
726 + ccp_options *ao = &ccp_allowoptions[f->unit];
727 + ccp_options *wo = &ccp_wantoptions[f->unit];
728 ccp_options no; /* options we've seen already */
729 ccp_options try; /* options to ask for next time */
731 @@ -908,28 +1089,100 @@
732 try = *go;
734 #ifdef MPPE
735 - if (go->mppe && len >= CILEN_MPPE
736 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
737 - no.mppe = 1;
738 - /*
739 - * Peer wants us to use a different strength or other setting.
740 - * Fail if we aren't willing to use his suggestion.
741 - */
742 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
743 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
744 - error("Refusing MPPE stateful mode offered by peer");
745 - try.mppe = 0;
746 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
747 - /* Peer must have set options we didn't request (suggest) */
748 - try.mppe = 0;
749 - }
750 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
751 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
753 - if (!try.mppe) {
754 - error("MPPE required but peer negotiation failed");
755 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
756 + if (go->mppc) {
757 + no.mppc = 1;
758 + if (!(p[5] & MPPE_MPPC))
759 + try.mppc = 0;
760 + }
761 +
762 + if (go->mppe)
763 + no.mppe = 1;
764 + if (go->mppe_40)
765 + no.mppe_40 = 1;
766 + if (go->mppe_56)
767 + no.mppe_56 = 1;
768 + if (go->mppe_128)
769 + no.mppe_128 = 1;
770 + if (go->mppe_stateless)
771 + no.mppe_stateless = 1;
772 +
773 + if (ao->mppe_40) {
774 + if ((p[5] & MPPE_40BIT))
775 + try.mppe_40 = 1;
776 + else
777 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
778 + }
779 + if (ao->mppe_56) {
780 + if ((p[5] & MPPE_56BIT))
781 + try.mppe_56 = 1;
782 + else
783 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
784 + }
785 + if (ao->mppe_128) {
786 + if ((p[5] & MPPE_128BIT))
787 + try.mppe_128 = 1;
788 + else
789 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
790 + }
791 +
792 + if (ao->mppe_stateless) {
793 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
794 + try.mppe_stateless = 1;
795 + else
796 + try.mppe_stateless = 0;
797 + }
798 +
799 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
800 + try.mppe = try.mppe_stateless = 0;
801 + if (wo->mppe) {
802 + /* we require encryption, but peer doesn't support it
803 + so we close connection */
804 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
805 + wo->mppe_56 = wo->mppe_128 = 0;
806 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
807 + "key length");
808 + }
809 + }
810 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
811 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
812 + /* cannot negotiate key length */
813 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
814 + wo->mppe_56 = wo->mppe_128 = 0;
815 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
816 }
817 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
818 + try.mppe_40 = try.mppe_56 = 0;
819 + else
820 + if (try.mppe_56 && try.mppe_128)
821 + try.mppe_56 = 0;
822 + else
823 + if (try.mppe_40 && try.mppe_128)
824 + try.mppe_40 = 0;
825 + else
826 + if (try.mppe_40 && try.mppe_56)
827 + try.mppe_40 = 0;
828 +
829 + p += CILEN_MPPE;
830 + len -= CILEN_MPPE;
831 }
832 #endif /* MPPE */
833 +
834 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
835 + no.lzs = 1;
836 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
837 + p[4] != LZS_MODE_EXT))
838 + try.lzs = 0;
839 + else {
840 + try.lzs_mode = p[4];
841 + try.lzs_hists = (p[2] << 8) | p[3];
842 + }
843 + p += CILEN_LZS;
844 + len -= CILEN_LZS;
845 + }
846 +
847 if (go->deflate && len >= CILEN_DEFLATE
848 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
849 && p[1] == CILEN_DEFLATE) {
850 @@ -1002,14 +1255,50 @@
851 return -1;
853 #ifdef MPPE
854 - if (go->mppe && len >= CILEN_MPPE
855 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
856 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
857 - error("MPPE required but peer refused");
858 - lcp_close(f->unit, "MPPE required but peer refused");
859 + ccp_options *wo = &ccp_wantoptions[f->unit];
860 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
861 + p[3] != 0 ||
862 + p[4] != 0 ||
863 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
864 + (go->mppe_56 ? MPPE_56BIT : 0) |
865 + (go->mppe_128 ? MPPE_128BIT : 0) |
866 + (go->mppc ? MPPE_MPPC : 0)))
867 + return 0;
868 + if (go->mppc)
869 + try.mppc = 0;
870 + if (go->mppe) {
871 + try.mppe = 0;
872 + if (go->mppe_40)
873 + try.mppe_40 = 0;
874 + if (go->mppe_56)
875 + try.mppe_56 = 0;
876 + if (go->mppe_128)
877 + try.mppe_128 = 0;
878 + if (go->mppe_stateless)
879 + try.mppe_stateless = 0;
880 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
881 + try.mppe = try.mppe_stateless = 0;
882 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
883 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
884 + wo->mppe_56 = wo->mppe_128 = 0;
885 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
886 + "key length");
887 + }
888 + }
889 p += CILEN_MPPE;
890 len -= CILEN_MPPE;
891 }
892 -#endif
893 +#endif /* MPPE */
894 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
895 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
896 + || p[4] != go->lzs_mode)
897 + return 0;
898 + try.lzs = 0;
899 + p += CILEN_LZS;
900 + len -= CILEN_LZS;
901 + }
902 if (go->deflate_correct && len >= CILEN_DEFLATE
903 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
904 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
905 @@ -1073,14 +1362,15 @@
906 int dont_nak;
907 {
908 int ret, newret, res;
909 - u_char *p0, *retp;
910 + u_char *p0, *retp, p2, p5;
911 int len, clen, type, nb;
912 ccp_options *ho = &ccp_hisoptions[f->unit];
913 ccp_options *ao = &ccp_allowoptions[f->unit];
914 + ccp_options *wo = &ccp_wantoptions[f->unit];
915 #ifdef MPPE
916 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
917 - /* CI_MPPE, or due to other options? */
918 -#endif
919 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
920 +/* int mtu; */
921 +#endif /* MPPE */
923 ret = CONFACK;
924 retp = p0 = p;
925 @@ -1103,106 +1393,276 @@
926 switch (type) {
927 #ifdef MPPE
928 case CI_MPPE:
929 - if (!ao->mppe || clen != CILEN_MPPE) {
930 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
931 newret = CONFREJ;
932 break;
933 }
934 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
936 - /* Nak if anything unsupported or unknown are set. */
937 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
938 + p2 = p[2];
939 + p5 = p[5];
940 + /* not sure what they want, tell 'em what we got */
941 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
942 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
943 + MPPE_MPPC)) != 0 || p[5] == 0) ||
944 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
945 newret = CONFNAK;
946 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
947 - }
948 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
949 - newret = CONFNAK;
950 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
951 - }
952 -
953 - /* Check state opt */
954 - if (ho->mppe & MPPE_OPT_STATEFUL) {
955 - /*
956 - * We can Nak and request stateless, but it's a
957 - * lot easier to just assume the peer will request
958 - * it if he can do it; stateful mode is bad over
959 - * the Internet -- which is where we expect MPPE.
960 - */
961 - if (refuse_mppe_stateful) {
962 - error("Refusing MPPE stateful mode offered by peer");
963 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
964 + p[3] = 0;
965 + p[4] = 0;
966 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
967 + (wo->mppe_56 ? MPPE_56BIT : 0) |
968 + (wo->mppe_128 ? MPPE_128BIT : 0) |
969 + (wo->mppc ? MPPE_MPPC : 0);
970 + break;
971 + }
972 +
973 + if ((p[5] & MPPE_MPPC)) {
974 + if (ao->mppc) {
975 + ho->mppc = 1;
976 + BCOPY(p, opt_buf, CILEN_MPPE);
977 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
978 + opt_buf[5] = MPPE_MPPC;
979 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
980 + ho->mppc = 0;
981 + p[5] &= ~MPPE_MPPC;
982 + newret = CONFNAK;
983 + }
984 + } else {
985 newret = CONFREJ;
986 - break;
987 - }
988 + if (wo->mppe || ao->mppe) {
989 + p[5] &= ~MPPE_MPPC;
990 + newret = CONFNAK;
991 + }
992 + }
993 + }
994 +
995 + if (ao->mppe)
996 + ho->mppe = 1;
997 +
998 + if ((p[2] & MPPE_STATELESS)) {
999 + if (ao->mppe_stateless) {
1000 + if (wo->mppe_stateless)
1001 + ho->mppe_stateless = 1;
1002 + else {
1003 + newret = CONFNAK;
1004 + if (!dont_nak)
1005 + p[2] &= ~MPPE_STATELESS;
1006 + }
1007 + } else {
1008 + newret = CONFNAK;
1009 + if (!dont_nak)
1010 + p[2] &= ~MPPE_STATELESS;
1011 + }
1012 + } else {
1013 + if (wo->mppe_stateless && !dont_nak) {
1014 + wo->mppe_stateless = 0;
1015 + newret = CONFNAK;
1016 + p[2] |= MPPE_STATELESS;
1017 + }
1018 }
1020 - /* Find out which of {S,L} are set. */
1021 - if ((ho->mppe & MPPE_OPT_128)
1022 - && (ho->mppe & MPPE_OPT_40)) {
1023 - /* Both are set, negotiate the strongest. */
1024 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1025 newret = CONFNAK;
1026 - if (ao->mppe & MPPE_OPT_128)
1027 - ho->mppe &= ~MPPE_OPT_40;
1028 - else if (ao->mppe & MPPE_OPT_40)
1029 - ho->mppe &= ~MPPE_OPT_128;
1030 - else {
1031 - newret = CONFREJ;
1032 - break;
1033 + if (ao->mppe_128) {
1034 + ho->mppe_128 = 1;
1035 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1036 + BCOPY(p, opt_buf, CILEN_MPPE);
1037 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1038 + MPPE_MAX_KEY_LEN);
1039 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1040 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1041 + ho->mppe_128 = 0;
1042 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1043 + p[5] &= ~MPPE_128BIT;
1044 + goto check_mppe_56_40;
1045 + }
1046 + goto check_mppe;
1047 }
1048 - } else if (ho->mppe & MPPE_OPT_128) {
1049 - if (!(ao->mppe & MPPE_OPT_128)) {
1050 - newret = CONFREJ;
1051 - break;
1052 + p[5] &= ~MPPE_128BIT;
1053 + goto check_mppe_56_40;
1054 + }
1055 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1056 + newret = CONFNAK;
1057 + if (ao->mppe_128) {
1058 + ho->mppe_128 = 1;
1059 + p[5] &= ~MPPE_56BIT;
1060 + BCOPY(p, opt_buf, CILEN_MPPE);
1061 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1062 + MPPE_MAX_KEY_LEN);
1063 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1064 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1065 + ho->mppe_128 = 0;
1066 + p[5] |= MPPE_56BIT;
1067 + p[5] &= ~MPPE_128BIT;
1068 + goto check_mppe_56;
1069 + }
1070 + goto check_mppe;
1071 }
1072 - } else if (ho->mppe & MPPE_OPT_40) {
1073 - if (!(ao->mppe & MPPE_OPT_40)) {
1074 - newret = CONFREJ;
1075 - break;
1076 + p[5] &= ~MPPE_128BIT;
1077 + goto check_mppe_56;
1078 + }
1079 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1080 + newret = CONFNAK;
1081 + if (ao->mppe_128) {
1082 + ho->mppe_128 = 1;
1083 + p[5] &= ~MPPE_40BIT;
1084 + BCOPY(p, opt_buf, CILEN_MPPE);
1085 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1086 + MPPE_MAX_KEY_LEN);
1087 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1088 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1089 + ho->mppe_128 = 0;
1090 + p[5] |= MPPE_40BIT;
1091 + p[5] &= ~MPPE_128BIT;
1092 + goto check_mppe_40;
1093 + }
1094 + goto check_mppe;
1095 + }
1096 + p[5] &= ~MPPE_128BIT;
1097 + goto check_mppe_40;
1098 + }
1099 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1100 + if (ao->mppe_128) {
1101 + ho->mppe_128 = 1;
1102 + BCOPY(p, opt_buf, CILEN_MPPE);
1103 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1104 + MPPE_MAX_KEY_LEN);
1105 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1106 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1107 + ho->mppe_128 = 0;
1108 + p[5] &= ~MPPE_128BIT;
1109 + newret = CONFNAK;
1110 + }
1111 + goto check_mppe;
1112 + }
1113 + p[5] &= ~MPPE_128BIT;
1114 + newret = CONFNAK;
1115 + goto check_mppe;
1116 + }
1117 + check_mppe_56_40:
1118 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1119 + newret = CONFNAK;
1120 + if (ao->mppe_56) {
1121 + ho->mppe_56 = 1;
1122 + p[5] &= ~MPPE_40BIT;
1123 + BCOPY(p, opt_buf, CILEN_MPPE);
1124 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1125 + MPPE_MAX_KEY_LEN);
1126 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1127 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1128 + ho->mppe_56 = 0;
1129 + p[5] |= MPPE_40BIT;
1130 + p[5] &= ~MPPE_56BIT;
1131 + newret = CONFNAK;
1132 + goto check_mppe_40;
1133 + }
1134 + goto check_mppe;
1135 + }
1136 + p[5] &= ~MPPE_56BIT;
1137 + goto check_mppe_40;
1138 + }
1139 + check_mppe_56:
1140 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1141 + if (ao->mppe_56) {
1142 + ho->mppe_56 = 1;
1143 + BCOPY(p, opt_buf, CILEN_MPPE);
1144 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1145 + MPPE_MAX_KEY_LEN);
1146 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1147 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1148 + ho->mppe_56 = 0;
1149 + p[5] &= ~MPPE_56BIT;
1150 + newret = CONFNAK;
1151 + }
1152 + goto check_mppe;
1153 + }
1154 + p[5] &= ~MPPE_56BIT;
1155 + newret = CONFNAK;
1156 + goto check_mppe;
1157 + }
1158 + check_mppe_40:
1159 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1160 + if (ao->mppe_40) {
1161 + ho->mppe_40 = 1;
1162 + BCOPY(p, opt_buf, CILEN_MPPE);
1163 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1164 + MPPE_MAX_KEY_LEN);
1165 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1166 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1167 + ho->mppe_40 = 0;
1168 + p[5] &= ~MPPE_40BIT;
1169 + newret = CONFNAK;
1170 + }
1171 + goto check_mppe;
1172 + }
1173 + p[5] &= ~MPPE_40BIT;
1174 + }
1175 +
1176 + check_mppe:
1177 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1178 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1179 + newret = CONFNAK;
1180 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1181 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1182 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1183 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1184 + (wo->mppc ? MPPE_MPPC : 0);
1185 + } else {
1186 + ho->mppe = ho->mppe_stateless = 0;
1187 }
1188 } else {
1189 - /* Neither are set. */
1190 - /* We cannot accept this. */
1191 - newret = CONFNAK;
1192 - /* Give the peer our idea of what can be used,
1193 - so it can choose and confirm */
1194 - ho->mppe = ao->mppe;
1195 - }
1196 -
1197 - /* rebuild the opts */
1198 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1199 - if (newret == CONFACK) {
1200 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1201 - int mtu;
1202 -
1203 - BCOPY(p, opt_buf, CILEN_MPPE);
1204 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1205 - MPPE_MAX_KEY_LEN);
1206 - if (ccp_test(f->unit, opt_buf,
1207 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1208 - /* This shouldn't happen, we've already tested it! */
1209 - error("MPPE required, but kernel has no support.");
1210 - lcp_close(f->unit, "MPPE required but not available");
1211 - newret = CONFREJ;
1212 - break;
1213 - }
1214 - /*
1215 - * We need to decrease the interface MTU by MPPE_PAD
1216 - * because MPPE frames **grow**. The kernel [must]
1217 - * allocate MPPE_PAD extra bytes in xmit buffers.
1218 - */
1219 - mtu = netif_get_mtu(f->unit);
1220 - if (mtu)
1221 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1222 - else
1223 - newret = CONFREJ;
1224 + /* MPPE is not compatible with other compression types */
1225 + if (wo->mppe) {
1226 + ao->bsd_compress = 0;
1227 + ao->predictor_1 = 0;
1228 + ao->predictor_2 = 0;
1229 + ao->deflate = 0;
1230 + ao->lzs = 0;
1231 + }
1232 + }
1233 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1234 + p[2] = p2;
1235 + p[5] = p5;
1236 + /* gaute: using code supposed to be here according to mppc patch */
1237 + newret = CONFREJ;
1238 +
1239 + break;
1240 }
1242 +
1243 +
1244 /*
1245 - * We have accepted MPPE or are willing to negotiate
1246 - * MPPE parameters. A CONFREJ is due to subsequent
1247 - * (non-MPPE) processing.
1248 + lots of comments..
1249 */
1250 - rej_for_ci_mppe = 0;
1251 +
1252 break;
1253 #endif /* MPPE */
1254 +
1255 + case CI_LZS:
1256 + if (!ao->lzs || clen != CILEN_LZS) {
1257 + newret = CONFREJ;
1258 + break;
1259 + }
1260 +
1261 + ho->lzs = 1;
1262 + ho->lzs_hists = (p[2] << 8) | p[3];
1263 + ho->lzs_mode = p[4];
1264 + if ((ho->lzs_hists != ao->lzs_hists) ||
1265 + (ho->lzs_mode != ao->lzs_mode)) {
1266 + newret = CONFNAK;
1267 + if (!dont_nak) {
1268 + p[2] = ao->lzs_hists >> 8;
1269 + p[3] = ao->lzs_hists & 0xff;
1270 + p[4] = ao->lzs_mode;
1271 + } else
1272 + break;
1273 + }
1274 +
1275 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1276 + newret = CONFREJ;
1277 + }
1278 + break;
1279 +
1280 case CI_DEFLATE:
1281 case CI_DEFLATE_DRAFT:
1282 if (!ao->deflate || clen != CILEN_DEFLATE
1283 @@ -1344,12 +1804,6 @@
1284 else
1285 *lenp = retp - p0;
1286 }
1287 -#ifdef MPPE
1288 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1289 - error("MPPE required but peer negotiation failed");
1290 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1291 - }
1292 -#endif
1293 return ret;
1294 }
1296 @@ -1371,24 +1825,35 @@
1297 char *p = result;
1298 char *q = result + sizeof(result); /* 1 past result */
1300 - slprintf(p, q - p, "MPPE ");
1301 - p += 5;
1302 - if (opt->mppe & MPPE_OPT_128) {
1303 - slprintf(p, q - p, "128-bit ");
1304 - p += 8;
1305 - }
1306 - if (opt->mppe & MPPE_OPT_40) {
1307 - slprintf(p, q - p, "40-bit ");
1308 - p += 7;
1309 - }
1310 - if (opt->mppe & MPPE_OPT_STATEFUL)
1311 - slprintf(p, q - p, "stateful");
1312 - else
1313 - slprintf(p, q - p, "stateless");
1314 -
1315 + if (opt->mppe) {
1316 + if (opt->mppc) {
1317 + slprintf(p, q - p, "MPPC/MPPE ");
1318 + p += 10;
1319 + } else {
1320 + slprintf(p, q - p, "MPPE ");
1321 + p += 5;
1322 + }
1323 + if (opt->mppe_128) {
1324 + slprintf(p, q - p, "128-bit ");
1325 + p += 8;
1326 + } else if (opt->mppe_56) {
1327 + slprintf(p, q - p, "56-bit ");
1328 + p += 7;
1329 + } else if (opt->mppe_40) {
1330 + slprintf(p, q - p, "40-bit ");
1331 + p += 7;
1332 + }
1333 + if (opt->mppe_stateless)
1334 + slprintf(p, q - p, "stateless");
1335 + else
1336 + slprintf(p, q - p, "stateful");
1337 + } else if (opt->mppc)
1338 + slprintf(p, q - p, "MPPC");
1339 break;
1340 }
1341 -#endif
1342 +#endif /* MPPE */
1343 + case CI_LZS:
1344 + return "Stac LZS";
1345 case CI_DEFLATE:
1346 case CI_DEFLATE_DRAFT:
1347 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1348 @@ -1444,12 +1909,12 @@
1349 } else if (ANY_COMPRESS(*ho))
1350 notice("%s transmit compression enabled", method_name(ho, NULL));
1351 #ifdef MPPE
1352 - if (go->mppe) {
1353 + if (go->mppe || go->mppc) {
1354 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1355 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1356 continue_networks(f->unit); /* Bring up IP et al */
1357 }
1358 -#endif
1359 +#endif /* MPPE */
1360 }
1362 /*
1363 @@ -1472,7 +1937,7 @@
1364 lcp_close(f->unit, "MPPE disabled");
1365 }
1366 }
1367 -#endif
1368 +#endif /* MPPE */
1369 }
1371 /*
1372 @@ -1532,24 +1997,28 @@
1373 #ifdef MPPE
1374 case CI_MPPE:
1375 if (optlen >= CILEN_MPPE) {
1376 - u_char mppe_opts;
1377 -
1378 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1379 - printer(arg, "mppe %s %s %s %s %s %s%s",
1380 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1381 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1382 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1383 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1384 + printer(arg, "mppe %s %s %s %s %s %s",
1385 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1386 + (p[5] & MPPE_56BIT)? "+M": "-M",
1387 + (p[5] & MPPE_128BIT)? "+S": "-S",
1388 + (p[5] & MPPE_40BIT)? "+L": "-L",
1389 (p[5] & MPPE_D_BIT)? "+D": "-D",
1390 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1391 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1392 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1393 + (p[5] & MPPE_MPPC)? "+C": "-C");
1394 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1395 + MPPE_D_BIT | MPPE_MPPC)) ||
1396 + (p[2] & ~MPPE_STATELESS))
1397 printer(arg, " (%.2x %.2x %.2x %.2x)",
1398 p[2], p[3], p[4], p[5]);
1399 p += CILEN_MPPE;
1400 }
1401 break;
1402 -#endif
1403 +#endif /* MPPE */
1404 + case CI_LZS:
1405 + if (optlen >= CILEN_LZS) {
1406 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1407 + p += CILEN_LZS;
1408 + }
1409 + break;
1410 case CI_DEFLATE:
1411 case CI_DEFLATE_DRAFT:
1412 if (optlen >= CILEN_DEFLATE) {
1413 @@ -1635,6 +2104,7 @@
1414 error("Lost compression sync: disabling compression");
1415 ccp_close(unit, "Lost compression sync");
1416 #ifdef MPPE
1417 + /* My module dosn't need this. J.D., 2003-07-06 */
1418 /*
1419 * If we were doing MPPE, we must also take the link down.
1420 */
1421 @@ -1642,9 +2112,18 @@
1422 error("Too many MPPE errors, closing LCP");
1423 lcp_close(unit, "Too many MPPE errors");
1424 }
1425 -#endif
1426 +#endif /* MPPE */
1427 } else {
1428 /*
1429 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1430 + * and don't wait for CCP_RESETACK
1431 + */
1432 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1433 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1434 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1435 + return;
1436 + }
1437 + /*
1438 * Send a reset-request to reset the peer's compressor.
1439 * We don't do that if we are still waiting for an
1440 * acknowledgement to a previous reset-request.
1441 @@ -1675,4 +2154,3 @@
1442 } else
1443 ccp_localstate[f->unit] &= ~RACK_PENDING;
1444 }
1445 -
1446 diff -urN ppp-2.4.4-old/pppd/ccp.h ppp-2.4.4-new/pppd/ccp.h
1447 --- ppp-2.4.4-old/pppd/ccp.h 2004-11-04 11:02:26.000000000 +0100
1448 +++ ppp-2.4.4-new/pppd/ccp.h 2008-03-19 20:11:28.000000000 +0100
1449 @@ -37,9 +37,17 @@
1450 bool predictor_2; /* do Predictor-2? */
1451 bool deflate_correct; /* use correct code for deflate? */
1452 bool deflate_draft; /* use draft RFC code for deflate? */
1453 + bool lzs; /* do Stac LZS? */
1454 + bool mppc; /* do MPPC? */
1455 bool mppe; /* do MPPE? */
1456 + bool mppe_40; /* allow 40 bit encryption? */
1457 + bool mppe_56; /* allow 56 bit encryption? */
1458 + bool mppe_128; /* allow 128 bit encryption? */
1459 + bool mppe_stateless; /* allow stateless encryption */
1460 u_short bsd_bits; /* # bits/code for BSD Compress */
1461 u_short deflate_size; /* lg(window size) for Deflate */
1462 + u_short lzs_mode; /* LZS check mode */
1463 + u_short lzs_hists; /* number of LZS histories */
1464 short method; /* code for chosen compression method */
1465 } ccp_options;
1467 diff -urN ppp-2.4.4-old/pppd/chap_ms.c ppp-2.4.4-new/pppd/chap_ms.c
1468 --- ppp-2.4.4-old/pppd/chap_ms.c 2006-05-21 13:56:40.000000000 +0200
1469 +++ ppp-2.4.4-new/pppd/chap_ms.c 2008-03-19 20:11:28.000000000 +0100
1470 @@ -897,13 +897,17 @@
1471 /*
1472 * Disable undesirable encryption types. Note that we don't ENABLE
1473 * any encryption types, to avoid overriding manual configuration.
1474 + *
1475 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1476 */
1477 switch(types) {
1478 case MPPE_ENC_TYPES_RC4_40:
1479 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1480 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1481 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1482 break;
1483 case MPPE_ENC_TYPES_RC4_128:
1484 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1485 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1486 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1487 break;
1488 default:
1489 break;
1490 diff -urN ppp-2.4.4-old/pppd/pppd.8 ppp-2.4.4-new/pppd/pppd.8
1491 --- ppp-2.4.4-old/pppd/pppd.8 2006-06-16 02:01:23.000000000 +0200
1492 +++ ppp-2.4.4-new/pppd/pppd.8 2008-03-19 20:11:28.000000000 +0100
1493 @@ -627,9 +627,29 @@
1494 Enables the use of PPP multilink; this is an alias for the `multilink'
1495 option. This option is currently only available under Linux.
1496 .TP
1497 -.B mppe\-stateful
1498 -Allow MPPE to use stateful mode. Stateless mode is still attempted first.
1499 -The default is to disallow stateful mode.
1500 +.B mppc
1501 +Enables MPPC (Microsoft Point to Point Compression). This is the default.
1502 +.TP
1503 +.B mppe \fIsubopt1[,subopt2[,subopt3[..]]]
1504 +Modify MPPE (Microsoft Point to Point Encryption) parameters. In order
1505 +for MPPE to successfully come up, you must have authenticated with either
1506 +MS-CHAP or MS-CHAPv2. By default MPPE is optional, it means that pppd will
1507 +not propose MPPE to the peer, but will negotiate MPPE if peer wants that.
1508 +You can change this using \fIrequired\fR suboption.
1509 +This option is presently only supported under Linux, and only if your
1510 +kernel has been configured to include MPPE support.
1511 +.IP
1512 +MPPE suboptions:
1513 +.br
1514 +\fIrequired\fR - require MPPE; disconnect if peer doesn't support it,
1515 +.br
1516 +\fIstateless\fR - try to negotiate stateless mode; default is stateful,
1517 +.br
1518 +\fIno40\fR - disable 40 bit keys,
1519 +.br
1520 +\fIno56\fR - disable 56 bit keys,
1521 +.br
1522 +\fIno128\fR - disable 128 bit keys
1523 .TP
1524 .B mpshortseq
1525 Enables the use of short (12-bit) sequence numbers in multilink
1526 @@ -767,17 +787,11 @@
1527 Disables the use of PPP multilink. This option is currently only
1528 available under Linux.
1529 .TP
1530 -.B nomppe
1531 -Disables MPPE (Microsoft Point to Point Encryption). This is the default.
1532 -.TP
1533 -.B nomppe\-40
1534 -Disable 40-bit encryption with MPPE.
1535 +.B nomppc
1536 +Disables MPPC (Microsoft Point to Point Compression).
1537 .TP
1538 -.B nomppe\-128
1539 -Disable 128-bit encryption with MPPE.
1540 -.TP
1541 -.B nomppe\-stateful
1542 -Disable MPPE stateful mode. This is the default.
1543 +.B nomppe
1544 +Disables MPPE (Microsoft Point to Point Encryption).
1545 .TP
1546 .B nompshortseq
1547 Disables the use of short (12-bit) sequence numbers in the PPP
1548 @@ -958,19 +972,6 @@
1549 Require the peer to authenticate itself using CHAP [Challenge
1550 Handshake Authentication Protocol] authentication.
1551 .TP
1552 -.B require\-mppe
1553 -Require the use of MPPE (Microsoft Point to Point Encryption). This
1554 -option disables all other compression types. This option enables
1555 -both 40-bit and 128-bit encryption. In order for MPPE to successfully
1556 -come up, you must have authenticated with either MS\-CHAP or MS\-CHAPv2.
1557 -This option is presently only supported under Linux, and only if your
1558 -kernel has been configured to include MPPE support.
1559 -.TP
1560 -.B require\-mppe\-40
1561 -Require the use of MPPE, with 40-bit encryption.
1562 -.TP
1563 -.B require\-mppe\-128
1564 -Require the use of MPPE, with 128-bit encryption.
1565 .TP
1566 .B require\-mschap
1567 Require the peer to authenticate itself using MS\-CHAP [Microsoft Challenge