OpenWrt – Blame information for rev 1
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | pppd: add support for MPPE and MPPC encryption and compression protocols |
2 | |||
3 | This is a forward ported version of ppp-2.4.3-mppe-mppc-1.1.patch.gz found on |
||
4 | http://mppe-mppc.alphacron.de/ . |
||
5 | |||
6 | Signed-off-by: Jo-Philipp Wich <jo@mein.io> |
||
7 | |||
8 | --- a/include/linux/ppp-comp.h |
||
9 | +++ b/include/linux/ppp-comp.h |
||
10 | @@ -36,7 +36,7 @@ |
||
11 | */ |
||
12 | |||
13 | /* |
||
14 | - * ==FILEVERSION 20020319== |
||
15 | + * ==FILEVERSION 20020715== |
||
16 | * |
||
17 | * NOTE TO MAINTAINERS: |
||
18 | * If you modify this file at all, please set the above date. |
||
19 | @@ -201,6 +201,33 @@ struct compressor { |
||
20 | #define CI_MPPE 18 /* config option for MPPE */ |
||
21 | #define CILEN_MPPE 6 /* length of config option */ |
||
22 | |||
23 | +/* MPPE/MPPC definitions by J.D.*/ |
||
24 | +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */ |
||
25 | +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */ |
||
26 | +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */ |
||
27 | +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */ |
||
28 | +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */ |
||
29 | + |
||
30 | +/* |
||
31 | + * Definitions for Stac LZS. |
||
32 | + */ |
||
33 | + |
||
34 | +#define CI_LZS 17 /* config option for Stac LZS */ |
||
35 | +#define CILEN_LZS 5 /* length of config option */ |
||
36 | + |
||
37 | +#define LZS_OVHD 4 /* max. LZS overhead */ |
||
38 | +#define LZS_HIST_LEN 2048 /* LZS history size */ |
||
39 | +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */ |
||
40 | + |
||
41 | +#define LZS_MODE_NONE 0 |
||
42 | +#define LZS_MODE_LCB 1 |
||
43 | +#define LZS_MODE_CRC 2 |
||
44 | +#define LZS_MODE_SEQ 3 |
||
45 | +#define LZS_MODE_EXT 4 |
||
46 | + |
||
47 | +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */ |
||
48 | +#define LZS_EXT_BIT_COMP 0x20 /* bit C */ |
||
49 | + |
||
50 | /* |
||
51 | * Definitions for other, as yet unsupported, compression methods. |
||
52 | */ |
||
53 | --- a/include/net/ppp-comp.h |
||
54 | +++ b/include/net/ppp-comp.h |
||
55 | @@ -168,6 +168,33 @@ struct compressor { |
||
56 | #define CI_MPPE 18 /* config option for MPPE */ |
||
57 | #define CILEN_MPPE 6 /* length of config option */ |
||
58 | |||
59 | +/* MPPE/MPPC definitions by J.D.*/ |
||
60 | +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */ |
||
61 | +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */ |
||
62 | +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */ |
||
63 | +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */ |
||
64 | +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */ |
||
65 | + |
||
66 | +/* |
||
67 | + * Definitions for Stac LZS. |
||
68 | + */ |
||
69 | + |
||
70 | +#define CI_LZS 17 /* config option for Stac LZS */ |
||
71 | +#define CILEN_LZS 5 /* length of config option */ |
||
72 | + |
||
73 | +#define LZS_OVHD 4 /* max. LZS overhead */ |
||
74 | +#define LZS_HIST_LEN 2048 /* LZS history size */ |
||
75 | +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */ |
||
76 | + |
||
77 | +#define LZS_MODE_NONE 0 |
||
78 | +#define LZS_MODE_LCB 1 |
||
79 | +#define LZS_MODE_CRC 2 |
||
80 | +#define LZS_MODE_SEQ 3 |
||
81 | +#define LZS_MODE_EXT 4 |
||
82 | + |
||
83 | +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */ |
||
84 | +#define LZS_EXT_BIT_COMP 0x20 /* bit C */ |
||
85 | + |
||
86 | /* |
||
87 | * Definitions for other, as yet unsupported, compression methods. |
||
88 | */ |
||
89 | --- a/pppd/ccp.c |
||
90 | +++ b/pppd/ccp.c |
||
91 | @@ -62,12 +62,10 @@ static int setdeflate __P((char **)); |
||
92 | static char bsd_value[8]; |
||
93 | static char deflate_value[8]; |
||
94 | |||
95 | -/* |
||
96 | - * Option variables. |
||
97 | - */ |
||
98 | #ifdef MPPE |
||
99 | -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */ |
||
100 | -#endif |
||
101 | +static int setmppe(char **); |
||
102 | +static int setnomppe(void); |
||
103 | +#endif /* MPPE */ |
||
104 | |||
105 | static option_t ccp_option_list[] = { |
||
106 | { "noccp", o_bool, &ccp_protent.enabled_flag, |
||
107 | @@ -108,54 +106,36 @@ static option_t ccp_option_list[] = { |
||
108 | "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR, |
||
109 | &ccp_allowoptions[0].predictor_1 }, |
||
110 | |||
111 | + { "lzs", o_bool, &ccp_wantoptions[0].lzs, |
||
112 | + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO }, |
||
113 | + { "+lzs", o_bool, &ccp_wantoptions[0].lzs, |
||
114 | + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO }, |
||
115 | + { "nolzs", o_bool, &ccp_wantoptions[0].lzs, |
||
116 | + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR, |
||
117 | + &ccp_allowoptions[0].lzs }, |
||
118 | + { "-lzs", o_bool, &ccp_wantoptions[0].lzs, |
||
119 | + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR, |
||
120 | + &ccp_allowoptions[0].lzs }, |
||
121 | + |
||
122 | #ifdef MPPE |
||
123 | - /* MPPE options are symmetrical ... we only set wantoptions here */ |
||
124 | - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe, |
||
125 | - "require MPPE encryption", |
||
126 | - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 }, |
||
127 | - { "+mppe", o_bool, &ccp_wantoptions[0].mppe, |
||
128 | - "require MPPE encryption", |
||
129 | - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 }, |
||
130 | - { "nomppe", o_bool, &ccp_wantoptions[0].mppe, |
||
131 | - "don't allow MPPE encryption", OPT_PRIO }, |
||
132 | - { "-mppe", o_bool, &ccp_wantoptions[0].mppe, |
||
133 | - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO }, |
||
134 | - |
||
135 | - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */ |
||
136 | - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe, |
||
137 | - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40, |
||
138 | - &ccp_wantoptions[0].mppe }, |
||
139 | - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe, |
||
140 | - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40, |
||
141 | - &ccp_wantoptions[0].mppe }, |
||
142 | - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe, |
||
143 | - "don't allow MPPE 40-bit encryption", |
||
144 | - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe }, |
||
145 | - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe, |
||
146 | - "don't allow MPPE 40-bit encryption", |
||
147 | - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, |
||
148 | - &ccp_wantoptions[0].mppe }, |
||
149 | - |
||
150 | - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe, |
||
151 | - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128, |
||
152 | - &ccp_wantoptions[0].mppe }, |
||
153 | - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe, |
||
154 | - "require MPPE 128-bit encryption", |
||
155 | - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128, |
||
156 | - &ccp_wantoptions[0].mppe }, |
||
157 | - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe, |
||
158 | - "don't allow MPPE 128-bit encryption", |
||
159 | - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe }, |
||
160 | - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe, |
||
161 | - "don't allow MPPE 128-bit encryption", |
||
162 | - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, |
||
163 | - &ccp_wantoptions[0].mppe }, |
||
164 | - |
||
165 | - /* strange one; we always request stateless, but will we allow stateful? */ |
||
166 | - { "mppe-stateful", o_bool, &refuse_mppe_stateful, |
||
167 | - "allow MPPE stateful mode", OPT_PRIO }, |
||
168 | - { "nomppe-stateful", o_bool, &refuse_mppe_stateful, |
||
169 | - "disallow MPPE stateful mode", OPT_PRIO | 1 }, |
||
170 | + { "mppc", o_bool, &ccp_wantoptions[0].mppc, |
||
171 | + "request MPPC compression", 1, &ccp_allowoptions[0].mppc }, |
||
172 | + { "+mppc", o_bool, &ccp_wantoptions[0].mppc, |
||
173 | + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS }, |
||
174 | + { "nomppc", o_bool, &ccp_wantoptions[0].mppc, |
||
175 | + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR, |
||
176 | + &ccp_allowoptions[0].mppc }, |
||
177 | + { "-mppc", o_bool, &ccp_wantoptions[0].mppc, |
||
178 | + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR, |
||
179 | + &ccp_allowoptions[0].mppc }, |
||
180 | + { "mppe", o_special, (void *)setmppe, |
||
181 | + "request MPPE encryption" }, |
||
182 | + { "+mppe", o_special, (void *)setmppe, |
||
183 | + "request MPPE encryption" }, |
||
184 | + { "nomppe", o_special_noarg, (void *)setnomppe, |
||
185 | + "don't allow MPPE encryption" }, |
||
186 | + { "-mppe", o_special_noarg, (void *)setnomppe, |
||
187 | + "don't allow MPPE encryption" }, |
||
188 | #endif /* MPPE */ |
||
189 | |||
190 | { NULL } |
||
191 | @@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = { |
||
192 | */ |
||
193 | #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \ |
||
194 | || (opt).predictor_1 || (opt).predictor_2 \ |
||
195 | - || (opt).mppe) |
||
196 | + || (opt).lzs || (opt).mppc || (opt).mppe) |
||
197 | |||
198 | /* |
||
199 | * Local state (mainly for handling reset-reqs and reset-acks). |
||
200 | @@ -344,6 +324,100 @@ setdeflate(argv) |
||
201 | return 1; |
||
202 | } |
||
203 | |||
204 | +#ifdef MPPE |
||
205 | +/* |
||
206 | + * Functions called from config options |
||
207 | + */ |
||
208 | +/* |
||
209 | + MPPE suboptions: |
||
210 | + required - require MPPE; disconnect if peer doesn't support it |
||
211 | + stateless - use stateless mode |
||
212 | + no40 - disable 40 bit keys |
||
213 | + no56 - disable 56 bit keys |
||
214 | + no128 - disable 128 bit keys |
||
215 | +*/ |
||
216 | +int setmppe(char **argv) |
||
217 | +{ |
||
218 | + int i; |
||
219 | + char *str, cmdbuf[16]; |
||
220 | + |
||
221 | + ccp_allowoptions[0].mppe = 1; |
||
222 | + ccp_allowoptions[0].mppe_40 = 1; |
||
223 | + ccp_allowoptions[0].mppe_56 = 1; |
||
224 | + ccp_allowoptions[0].mppe_128 = 1; |
||
225 | + ccp_allowoptions[0].mppe_stateless = 0; |
||
226 | + ccp_wantoptions[0].mppe = 0; |
||
227 | + |
||
228 | + str = *argv; |
||
229 | + |
||
230 | + while (1) { |
||
231 | + i = 0; |
||
232 | + memset(cmdbuf, '\0', 16); |
||
233 | + while ((i < 16) && (*str != ',') && (*str != '\0')) |
||
234 | + cmdbuf[i++] = *str++; |
||
235 | + cmdbuf[i] = '\0'; |
||
236 | + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) { |
||
237 | + ccp_allowoptions[0].mppe_40 = 0; |
||
238 | + goto next_param; |
||
239 | + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) { |
||
240 | + ccp_allowoptions[0].mppe_56 = 0; |
||
241 | + goto next_param; |
||
242 | + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) { |
||
243 | + ccp_allowoptions[0].mppe_128 = 0; |
||
244 | + goto next_param; |
||
245 | + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) { |
||
246 | + ccp_allowoptions[0].mppe_stateless = 1; |
||
247 | + goto next_param; |
||
248 | + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) { |
||
249 | + ccp_wantoptions[0].mppe = 1; |
||
250 | + goto next_param; |
||
251 | + } else { |
||
252 | + option_error("invalid parameter '%s' for mppe option", cmdbuf); |
||
253 | + return 0; |
||
254 | + } |
||
255 | + |
||
256 | + next_param: |
||
257 | + if (*str == ',') { |
||
258 | + str++; |
||
259 | + continue; |
||
260 | + } |
||
261 | + if (*str == '\0') { |
||
262 | + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 || |
||
263 | + ccp_allowoptions[0].mppe_128)) { |
||
264 | + if (ccp_wantoptions[0].mppe == 1) { |
||
265 | + option_error("You require MPPE but you have switched off " |
||
266 | + "all encryption key lengths."); |
||
267 | + return 0; |
||
268 | + } |
||
269 | + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0; |
||
270 | + ccp_wantoptions[0].mppe_stateless = |
||
271 | + ccp_allowoptions[0].mppe_stateless = 0; |
||
272 | + } else { |
||
273 | + ccp_allowoptions[0].mppe = 1; |
||
274 | + ccp_wantoptions[0].mppe_stateless = |
||
275 | + ccp_allowoptions[0].mppe_stateless; |
||
276 | + if (ccp_wantoptions[0].mppe == 1) { |
||
277 | + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40; |
||
278 | + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56; |
||
279 | + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128; |
||
280 | + } |
||
281 | + } |
||
282 | + return 1; |
||
283 | + } |
||
284 | + } |
||
285 | +} |
||
286 | + |
||
287 | +int setnomppe(void) |
||
288 | +{ |
||
289 | + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0; |
||
290 | + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0; |
||
291 | + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0; |
||
292 | + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0; |
||
293 | + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0; |
||
294 | + return 1; |
||
295 | +} |
||
296 | +#endif /* MPPE */ |
||
297 | + |
||
298 | /* |
||
299 | * ccp_init - initialize CCP. |
||
300 | */ |
||
301 | @@ -378,6 +452,30 @@ ccp_init(unit) |
||
302 | ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS; |
||
303 | |||
304 | ccp_allowoptions[0].predictor_1 = 1; |
||
305 | + |
||
306 | + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */ |
||
307 | + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ; |
||
308 | + ccp_wantoptions[0].lzs_hists = 1; |
||
309 | + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */ |
||
310 | + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ; |
||
311 | + ccp_allowoptions[0].lzs_hists = 1; |
||
312 | + |
||
313 | +#ifdef MPPE |
||
314 | + /* by default allow and request MPPC... */ |
||
315 | + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1; |
||
316 | + |
||
317 | + /* ... and allow but don't request MPPE */ |
||
318 | + ccp_allowoptions[0].mppe = 1; |
||
319 | + ccp_allowoptions[0].mppe_40 = 1; |
||
320 | + ccp_allowoptions[0].mppe_56 = 1; |
||
321 | + ccp_allowoptions[0].mppe_128 = 1; |
||
322 | + ccp_allowoptions[0].mppe_stateless = 1; |
||
323 | + ccp_wantoptions[0].mppe = 0; |
||
324 | + ccp_wantoptions[0].mppe_40 = 0; |
||
325 | + ccp_wantoptions[0].mppe_56 = 0; |
||
326 | + ccp_wantoptions[0].mppe_128 = 0; |
||
327 | + ccp_wantoptions[0].mppe_stateless = 0; |
||
328 | +#endif /* MPPE */ |
||
329 | } |
||
330 | |||
331 | /* |
||
332 | @@ -455,11 +553,11 @@ ccp_input(unit, p, len) |
||
333 | if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) { |
||
334 | notice("Compression disabled by peer."); |
||
335 | #ifdef MPPE |
||
336 | - if (ccp_gotoptions[unit].mppe) { |
||
337 | + if (ccp_wantoptions[unit].mppe) { |
||
338 | error("MPPE disabled, closing LCP"); |
||
339 | lcp_close(unit, "MPPE disabled by peer"); |
||
340 | } |
||
341 | -#endif |
||
342 | +#endif /* MPPE */ |
||
343 | } |
||
344 | |||
345 | /* |
||
346 | @@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len) |
||
347 | break; |
||
348 | /* send a reset-ack, which the transmitter will see and |
||
349 | reset its compression state. */ |
||
350 | + |
||
351 | + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK, |
||
352 | + but we do it in order to reset compressor; CCP_RESETACK is |
||
353 | + then silently discarded. See functions ppp_send_frame and |
||
354 | + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the |
||
355 | + confusion is caused by the fact that CCP code is splited |
||
356 | + into two parts - one part is handled by pppd, the other one |
||
357 | + is handled by kernel. */ |
||
358 | + |
||
359 | fsm_sdata(f, CCP_RESETACK, id, NULL, 0); |
||
360 | break; |
||
361 | |||
362 | @@ -515,12 +622,11 @@ ccp_protrej(unit) |
||
363 | fsm_lowerdown(&ccp_fsm[unit]); |
||
364 | |||
365 | #ifdef MPPE |
||
366 | - if (ccp_gotoptions[unit].mppe) { |
||
367 | + if (ccp_wantoptions[unit].mppe) { |
||
368 | error("MPPE required but peer negotiation failed"); |
||
369 | lcp_close(unit, "MPPE required but peer negotiation failed"); |
||
370 | } |
||
371 | -#endif |
||
372 | - |
||
373 | +#endif /* MPPE */ |
||
374 | } |
||
375 | |||
376 | /* |
||
377 | @@ -537,7 +643,7 @@ ccp_resetci(f) |
||
378 | all_rejected[f->unit] = 0; |
||
379 | |||
380 | #ifdef MPPE |
||
381 | - if (go->mppe) { |
||
382 | + if (go->mppe || go->mppc) { |
||
383 | ccp_options *ao = &ccp_allowoptions[f->unit]; |
||
384 | int auth_mschap_bits = auth_done[f->unit]; |
||
385 | int numbits; |
||
386 | @@ -551,80 +657,109 @@ ccp_resetci(f) |
||
387 | * NB: If MPPE is required, all other compression opts are invalid. |
||
388 | * So, we return right away if we can't do it. |
||
389 | */ |
||
390 | + if (ccp_wantoptions[f->unit].mppe) { |
||
391 | + /* Leave only the mschap auth bits set */ |
||
392 | + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER | |
||
393 | + CHAP_MS2_WITHPEER | CHAP_MS2_PEER); |
||
394 | + /* Count the mschap auths */ |
||
395 | + auth_mschap_bits >>= CHAP_MS_SHIFT; |
||
396 | + numbits = 0; |
||
397 | + do { |
||
398 | + numbits += auth_mschap_bits & 1; |
||
399 | + auth_mschap_bits >>= 1; |
||
400 | + } while (auth_mschap_bits); |
||
401 | + if (numbits > 1) { |
||
402 | + error("MPPE required, but auth done in both directions."); |
||
403 | + lcp_close(f->unit, "MPPE required but not available"); |
||
404 | + return; |
||
405 | + } |
||
406 | + if (!numbits) { |
||
407 | + error("MPPE required, but MS-CHAP[v2] auth not performed."); |
||
408 | + lcp_close(f->unit, "MPPE required but not available"); |
||
409 | + return; |
||
410 | + } |
||
411 | |||
412 | - /* Leave only the mschap auth bits set */ |
||
413 | - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER | |
||
414 | - CHAP_MS2_WITHPEER | CHAP_MS2_PEER); |
||
415 | - /* Count the mschap auths */ |
||
416 | - auth_mschap_bits >>= CHAP_MS_SHIFT; |
||
417 | - numbits = 0; |
||
418 | - do { |
||
419 | - numbits += auth_mschap_bits & 1; |
||
420 | - auth_mschap_bits >>= 1; |
||
421 | - } while (auth_mschap_bits); |
||
422 | - if (numbits > 1) { |
||
423 | - error("MPPE required, but auth done in both directions."); |
||
424 | - lcp_close(f->unit, "MPPE required but not available"); |
||
425 | - return; |
||
426 | - } |
||
427 | - if (!numbits) { |
||
428 | - error("MPPE required, but MS-CHAP[v2] auth not performed."); |
||
429 | - lcp_close(f->unit, "MPPE required but not available"); |
||
430 | - return; |
||
431 | - } |
||
432 | - |
||
433 | - /* A plugin (eg radius) may not have obtained key material. */ |
||
434 | - if (!mppe_keys_set) { |
||
435 | - error("MPPE required, but keys are not available. " |
||
436 | - "Possible plugin problem?"); |
||
437 | - lcp_close(f->unit, "MPPE required but not available"); |
||
438 | - return; |
||
439 | - } |
||
440 | - |
||
441 | - /* LM auth not supported for MPPE */ |
||
442 | - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) { |
||
443 | - /* This might be noise */ |
||
444 | - if (go->mppe & MPPE_OPT_40) { |
||
445 | - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported"); |
||
446 | - go->mppe &= ~MPPE_OPT_40; |
||
447 | - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40; |
||
448 | + /* A plugin (eg radius) may not have obtained key material. */ |
||
449 | + if (!mppe_keys_set) { |
||
450 | + error("MPPE required, but keys are not available. " |
||
451 | + "Possible plugin problem?"); |
||
452 | + lcp_close(f->unit, "MPPE required but not available"); |
||
453 | + return; |
||
454 | } |
||
455 | } |
||
456 | |||
457 | - /* Last check: can we actually negotiate something? */ |
||
458 | - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) { |
||
459 | - /* Could be misconfig, could be 40-bit disabled above. */ |
||
460 | - error("MPPE required, but both 40-bit and 128-bit disabled."); |
||
461 | - lcp_close(f->unit, "MPPE required but not available"); |
||
462 | - return; |
||
463 | + /* |
||
464 | + * Check whether the kernel knows about the various |
||
465 | + * compression methods we might request. Key material |
||
466 | + * unimportant here. |
||
467 | + */ |
||
468 | + if (go->mppc) { |
||
469 | + opt_buf[0] = CI_MPPE; |
||
470 | + opt_buf[1] = CILEN_MPPE; |
||
471 | + opt_buf[2] = 0; |
||
472 | + opt_buf[3] = 0; |
||
473 | + opt_buf[4] = 0; |
||
474 | + opt_buf[5] = MPPE_MPPC; |
||
475 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0) |
||
476 | + go->mppc = 0; |
||
477 | + } |
||
478 | + if (go->mppe_40) { |
||
479 | + opt_buf[0] = CI_MPPE; |
||
480 | + opt_buf[1] = CILEN_MPPE; |
||
481 | + opt_buf[2] = MPPE_STATELESS; |
||
482 | + opt_buf[3] = 0; |
||
483 | + opt_buf[4] = 0; |
||
484 | + opt_buf[5] = MPPE_40BIT; |
||
485 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) |
||
486 | + go->mppe_40 = 0; |
||
487 | + } |
||
488 | + if (go->mppe_56) { |
||
489 | + opt_buf[0] = CI_MPPE; |
||
490 | + opt_buf[1] = CILEN_MPPE; |
||
491 | + opt_buf[2] = MPPE_STATELESS; |
||
492 | + opt_buf[3] = 0; |
||
493 | + opt_buf[4] = 0; |
||
494 | + opt_buf[5] = MPPE_56BIT; |
||
495 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) |
||
496 | + go->mppe_56 = 0; |
||
497 | + } |
||
498 | + if (go->mppe_128) { |
||
499 | + opt_buf[0] = CI_MPPE; |
||
500 | + opt_buf[1] = CILEN_MPPE; |
||
501 | + opt_buf[2] = MPPE_STATELESS; |
||
502 | + opt_buf[3] = 0; |
||
503 | + opt_buf[4] = 0; |
||
504 | + opt_buf[5] = MPPE_128BIT; |
||
505 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) |
||
506 | + go->mppe_128 = 0; |
||
507 | + } |
||
508 | + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) { |
||
509 | + if (ccp_wantoptions[f->unit].mppe) { |
||
510 | + error("MPPE required, but kernel has no support."); |
||
511 | + lcp_close(f->unit, "MPPE required but not available"); |
||
512 | + } |
||
513 | + go->mppe = go->mppe_stateless = 0; |
||
514 | + } else { |
||
515 | + /* MPPE is not compatible with other compression types */ |
||
516 | + if (ccp_wantoptions[f->unit].mppe) { |
||
517 | + ao->bsd_compress = go->bsd_compress = 0; |
||
518 | + ao->predictor_1 = go->predictor_1 = 0; |
||
519 | + ao->predictor_2 = go->predictor_2 = 0; |
||
520 | + ao->deflate = go->deflate = 0; |
||
521 | + ao->lzs = go->lzs = 0; |
||
522 | + } |
||
523 | } |
||
524 | - |
||
525 | - /* sync options */ |
||
526 | - ao->mppe = go->mppe; |
||
527 | - /* MPPE is not compatible with other compression types */ |
||
528 | - ao->bsd_compress = go->bsd_compress = 0; |
||
529 | - ao->predictor_1 = go->predictor_1 = 0; |
||
530 | - ao->predictor_2 = go->predictor_2 = 0; |
||
531 | - ao->deflate = go->deflate = 0; |
||
532 | } |
||
533 | #endif /* MPPE */ |
||
534 | - |
||
535 | - /* |
||
536 | - * Check whether the kernel knows about the various |
||
537 | - * compression methods we might request. |
||
538 | - */ |
||
539 | -#ifdef MPPE |
||
540 | - if (go->mppe) { |
||
541 | - opt_buf[0] = CI_MPPE; |
||
542 | - opt_buf[1] = CILEN_MPPE; |
||
543 | - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); |
||
544 | - /* Key material unimportant here. */ |
||
545 | - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) { |
||
546 | - error("MPPE required, but kernel has no support."); |
||
547 | - lcp_close(f->unit, "MPPE required but not available"); |
||
548 | - } |
||
549 | + if (go->lzs) { |
||
550 | + opt_buf[0] = CI_LZS; |
||
551 | + opt_buf[1] = CILEN_LZS; |
||
552 | + opt_buf[2] = go->lzs_hists >> 8; |
||
553 | + opt_buf[3] = go->lzs_hists & 0xff; |
||
554 | + opt_buf[4] = LZS_MODE_SEQ; |
||
555 | + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0) |
||
556 | + go->lzs = 0; |
||
557 | } |
||
558 | -#endif |
||
559 | if (go->bsd_compress) { |
||
560 | opt_buf[0] = CI_BSD_COMPRESS; |
||
561 | opt_buf[1] = CILEN_BSD_COMPRESS; |
||
562 | @@ -680,7 +815,8 @@ ccp_cilen(f) |
||
563 | + (go->deflate && go->deflate_draft? CILEN_DEFLATE: 0) |
||
564 | + (go->predictor_1? CILEN_PREDICTOR_1: 0) |
||
565 | + (go->predictor_2? CILEN_PREDICTOR_2: 0) |
||
566 | - + (go->mppe? CILEN_MPPE: 0); |
||
567 | + + (go->lzs? CILEN_LZS: 0) |
||
568 | + + ((go->mppe || go->mppc)? CILEN_MPPE: 0); |
||
569 | } |
||
570 | |||
571 | /* |
||
572 | @@ -694,6 +830,8 @@ ccp_addci(f, p, lenp) |
||
573 | { |
||
574 | int res; |
||
575 | ccp_options *go = &ccp_gotoptions[f->unit]; |
||
576 | + ccp_options *ao = &ccp_allowoptions[f->unit]; |
||
577 | + ccp_options *wo = &ccp_wantoptions[f->unit]; |
||
578 | u_char *p0 = p; |
||
579 | |||
580 | /* |
||
581 | @@ -702,22 +840,43 @@ ccp_addci(f, p, lenp) |
||
582 | * in case it gets Acked. |
||
583 | */ |
||
584 | #ifdef MPPE |
||
585 | - if (go->mppe) { |
||
586 | + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) { |
||
587 | u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN]; |
||
588 | |||
589 | - p[0] = opt_buf[0] = CI_MPPE; |
||
590 | - p[1] = opt_buf[1] = CILEN_MPPE; |
||
591 | - MPPE_OPTS_TO_CI(go->mppe, &p[2]); |
||
592 | - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); |
||
593 | + p[0] = CI_MPPE; |
||
594 | + p[1] = CILEN_MPPE; |
||
595 | + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0); |
||
596 | + p[3] = 0; |
||
597 | + p[4] = 0; |
||
598 | + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) | |
||
599 | + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0); |
||
600 | + |
||
601 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
602 | BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); |
||
603 | res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0); |
||
604 | - if (res > 0) |
||
605 | + if (res > 0) { |
||
606 | p += CILEN_MPPE; |
||
607 | - else |
||
608 | + } else { |
||
609 | /* This shouldn't happen, we've already tested it! */ |
||
610 | - lcp_close(f->unit, "MPPE required but not available in kernel"); |
||
611 | + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 = |
||
612 | + go->mppe_stateless = go->mppc = 0; |
||
613 | + if (ccp_wantoptions[f->unit].mppe) |
||
614 | + lcp_close(f->unit, "MPPE required but not available in kernel"); |
||
615 | + } |
||
616 | + } |
||
617 | +#endif /* MPPE */ |
||
618 | + if (go->lzs) { |
||
619 | + p[0] = CI_LZS; |
||
620 | + p[1] = CILEN_LZS; |
||
621 | + p[2] = go->lzs_hists >> 8; |
||
622 | + p[3] = go->lzs_hists & 0xff; |
||
623 | + p[4] = LZS_MODE_SEQ; |
||
624 | + res = ccp_test(f->unit, p, CILEN_LZS, 0); |
||
625 | + if (res > 0) { |
||
626 | + p += CILEN_LZS; |
||
627 | + } else |
||
628 | + go->lzs = 0; |
||
629 | } |
||
630 | -#endif |
||
631 | if (go->deflate) { |
||
632 | p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT; |
||
633 | p[1] = CILEN_DEFLATE; |
||
634 | @@ -803,7 +962,7 @@ ccp_addci(f, p, lenp) |
||
635 | |||
636 | /* |
||
637 | * ccp_ackci - process a received configure-ack, and return |
||
638 | - * 1 iff the packet was OK. |
||
639 | + * 1 if the packet was OK. |
||
640 | */ |
||
641 | static int |
||
642 | ccp_ackci(f, p, len) |
||
643 | @@ -812,24 +971,44 @@ ccp_ackci(f, p, len) |
||
644 | int len; |
||
645 | { |
||
646 | ccp_options *go = &ccp_gotoptions[f->unit]; |
||
647 | + ccp_options *ao = &ccp_allowoptions[f->unit]; |
||
648 | + ccp_options *wo = &ccp_wantoptions[f->unit]; |
||
649 | u_char *p0 = p; |
||
650 | |||
651 | #ifdef MPPE |
||
652 | - if (go->mppe) { |
||
653 | - u_char opt_buf[CILEN_MPPE]; |
||
654 | - |
||
655 | - opt_buf[0] = CI_MPPE; |
||
656 | - opt_buf[1] = CILEN_MPPE; |
||
657 | - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); |
||
658 | - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE)) |
||
659 | + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) { |
||
660 | + if (len < CILEN_MPPE |
||
661 | + || p[1] != CILEN_MPPE || p[0] != CI_MPPE |
||
662 | + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) |
||
663 | + || p[3] != 0 |
||
664 | + || p[4] != 0 |
||
665 | + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) | |
||
666 | + (go->mppc ? MPPE_MPPC : 0)) |
||
667 | + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) | |
||
668 | + (go->mppc ? MPPE_MPPC : 0)) |
||
669 | + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) | |
||
670 | + (go->mppc ? MPPE_MPPC : 0)))) |
||
671 | return 0; |
||
672 | + if (go->mppe_40 || go->mppe_56 || go->mppe_128) |
||
673 | + go->mppe = 1; |
||
674 | p += CILEN_MPPE; |
||
675 | len -= CILEN_MPPE; |
||
676 | + /* Cope with first/fast ack */ |
||
677 | + if (p == p0 && len == 0) |
||
678 | + return 1; |
||
679 | + } |
||
680 | +#endif /* MPPE */ |
||
681 | + if (go->lzs) { |
||
682 | + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS |
||
683 | + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff) |
||
684 | + || p[4] != LZS_MODE_SEQ) |
||
685 | + return 0; |
||
686 | + p += CILEN_LZS; |
||
687 | + len -= CILEN_LZS; |
||
688 | /* XXX Cope with first/fast ack */ |
||
689 | - if (len == 0) |
||
690 | + if (p == p0 && len == 0) |
||
691 | return 1; |
||
692 | } |
||
693 | -#endif |
||
694 | if (go->deflate) { |
||
695 | if (len < CILEN_DEFLATE |
||
696 | || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT) |
||
697 | @@ -902,6 +1081,8 @@ ccp_nakci(f, p, len, treat_as_reject) |
||
698 | int treat_as_reject; |
||
699 | { |
||
700 | ccp_options *go = &ccp_gotoptions[f->unit]; |
||
701 | + ccp_options *ao = &ccp_allowoptions[f->unit]; |
||
702 | + ccp_options *wo = &ccp_wantoptions[f->unit]; |
||
703 | ccp_options no; /* options we've seen already */ |
||
704 | ccp_options try; /* options to ask for next time */ |
||
705 | |||
706 | @@ -909,28 +1090,100 @@ ccp_nakci(f, p, len, treat_as_reject) |
||
707 | try = *go; |
||
708 | |||
709 | #ifdef MPPE |
||
710 | - if (go->mppe && len >= CILEN_MPPE |
||
711 | - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) { |
||
712 | - no.mppe = 1; |
||
713 | - /* |
||
714 | - * Peer wants us to use a different strength or other setting. |
||
715 | - * Fail if we aren't willing to use his suggestion. |
||
716 | - */ |
||
717 | - MPPE_CI_TO_OPTS(&p[2], try.mppe); |
||
718 | - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) { |
||
719 | - error("Refusing MPPE stateful mode offered by peer"); |
||
720 | - try.mppe = 0; |
||
721 | - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) { |
||
722 | - /* Peer must have set options we didn't request (suggest) */ |
||
723 | - try.mppe = 0; |
||
724 | - } |
||
725 | + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) && |
||
726 | + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) { |
||
727 | |||
728 | - if (!try.mppe) { |
||
729 | - error("MPPE required but peer negotiation failed"); |
||
730 | - lcp_close(f->unit, "MPPE required but peer negotiation failed"); |
||
731 | + if (go->mppc) { |
||
732 | + no.mppc = 1; |
||
733 | + if (!(p[5] & MPPE_MPPC)) |
||
734 | + try.mppc = 0; |
||
735 | + } |
||
736 | + |
||
737 | + if (go->mppe) |
||
738 | + no.mppe = 1; |
||
739 | + if (go->mppe_40) |
||
740 | + no.mppe_40 = 1; |
||
741 | + if (go->mppe_56) |
||
742 | + no.mppe_56 = 1; |
||
743 | + if (go->mppe_128) |
||
744 | + no.mppe_128 = 1; |
||
745 | + if (go->mppe_stateless) |
||
746 | + no.mppe_stateless = 1; |
||
747 | + |
||
748 | + if (ao->mppe_40) { |
||
749 | + if ((p[5] & MPPE_40BIT)) |
||
750 | + try.mppe_40 = 1; |
||
751 | + else |
||
752 | + try.mppe_40 = (p[5] == 0) ? 1 : 0; |
||
753 | + } |
||
754 | + if (ao->mppe_56) { |
||
755 | + if ((p[5] & MPPE_56BIT)) |
||
756 | + try.mppe_56 = 1; |
||
757 | + else |
||
758 | + try.mppe_56 = (p[5] == 0) ? 1 : 0; |
||
759 | + } |
||
760 | + if (ao->mppe_128) { |
||
761 | + if ((p[5] & MPPE_128BIT)) |
||
762 | + try.mppe_128 = 1; |
||
763 | + else |
||
764 | + try.mppe_128 = (p[5] == 0) ? 1 : 0; |
||
765 | + } |
||
766 | + |
||
767 | + if (ao->mppe_stateless) { |
||
768 | + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless) |
||
769 | + try.mppe_stateless = 1; |
||
770 | + else |
||
771 | + try.mppe_stateless = 0; |
||
772 | + } |
||
773 | + |
||
774 | + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) { |
||
775 | + try.mppe = try.mppe_stateless = 0; |
||
776 | + if (wo->mppe) { |
||
777 | + /* we require encryption, but peer doesn't support it |
||
778 | + so we close connection */ |
||
779 | + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 = |
||
780 | + wo->mppe_56 = wo->mppe_128 = 0; |
||
781 | + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE " |
||
782 | + "key length"); |
||
783 | + } |
||
784 | + } |
||
785 | + if (wo->mppe && (wo->mppe_40 != try.mppe_40) && |
||
786 | + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) { |
||
787 | + /* cannot negotiate key length */ |
||
788 | + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 = |
||
789 | + wo->mppe_56 = wo->mppe_128 = 0; |
||
790 | + lcp_close(f->unit, "Cannot negotiate MPPE key length"); |
||
791 | } |
||
792 | + if (try.mppe_40 && try.mppe_56 && try.mppe_128) |
||
793 | + try.mppe_40 = try.mppe_56 = 0; |
||
794 | + else |
||
795 | + if (try.mppe_56 && try.mppe_128) |
||
796 | + try.mppe_56 = 0; |
||
797 | + else |
||
798 | + if (try.mppe_40 && try.mppe_128) |
||
799 | + try.mppe_40 = 0; |
||
800 | + else |
||
801 | + if (try.mppe_40 && try.mppe_56) |
||
802 | + try.mppe_40 = 0; |
||
803 | + |
||
804 | + p += CILEN_MPPE; |
||
805 | + len -= CILEN_MPPE; |
||
806 | } |
||
807 | #endif /* MPPE */ |
||
808 | + |
||
809 | + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) { |
||
810 | + no.lzs = 1; |
||
811 | + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ && |
||
812 | + p[4] != LZS_MODE_EXT)) |
||
813 | + try.lzs = 0; |
||
814 | + else { |
||
815 | + try.lzs_mode = p[4]; |
||
816 | + try.lzs_hists = (p[2] << 8) | p[3]; |
||
817 | + } |
||
818 | + p += CILEN_LZS; |
||
819 | + len -= CILEN_LZS; |
||
820 | + } |
||
821 | + |
||
822 | if (go->deflate && len >= CILEN_DEFLATE |
||
823 | && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT) |
||
824 | && p[1] == CILEN_DEFLATE) { |
||
825 | @@ -1003,14 +1256,50 @@ ccp_rejci(f, p, len) |
||
826 | return -1; |
||
827 | |||
828 | #ifdef MPPE |
||
829 | - if (go->mppe && len >= CILEN_MPPE |
||
830 | + if ((go->mppe || go->mppc) && len >= CILEN_MPPE |
||
831 | && p[0] == CI_MPPE && p[1] == CILEN_MPPE) { |
||
832 | - error("MPPE required but peer refused"); |
||
833 | - lcp_close(f->unit, "MPPE required but peer refused"); |
||
834 | + ccp_options *wo = &ccp_wantoptions[f->unit]; |
||
835 | + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) || |
||
836 | + p[3] != 0 || |
||
837 | + p[4] != 0 || |
||
838 | + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) | |
||
839 | + (go->mppe_56 ? MPPE_56BIT : 0) | |
||
840 | + (go->mppe_128 ? MPPE_128BIT : 0) | |
||
841 | + (go->mppc ? MPPE_MPPC : 0))) |
||
842 | + return 0; |
||
843 | + if (go->mppc) |
||
844 | + try.mppc = 0; |
||
845 | + if (go->mppe) { |
||
846 | + try.mppe = 0; |
||
847 | + if (go->mppe_40) |
||
848 | + try.mppe_40 = 0; |
||
849 | + if (go->mppe_56) |
||
850 | + try.mppe_56 = 0; |
||
851 | + if (go->mppe_128) |
||
852 | + try.mppe_128 = 0; |
||
853 | + if (go->mppe_stateless) |
||
854 | + try.mppe_stateless = 0; |
||
855 | + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) |
||
856 | + try.mppe = try.mppe_stateless = 0; |
||
857 | + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */ |
||
858 | + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 = |
||
859 | + wo->mppe_56 = wo->mppe_128 = 0; |
||
860 | + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE " |
||
861 | + "key length"); |
||
862 | + } |
||
863 | + } |
||
864 | p += CILEN_MPPE; |
||
865 | len -= CILEN_MPPE; |
||
866 | } |
||
867 | -#endif |
||
868 | +#endif /* MPPE */ |
||
869 | + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) { |
||
870 | + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff) |
||
871 | + || p[4] != go->lzs_mode) |
||
872 | + return 0; |
||
873 | + try.lzs = 0; |
||
874 | + p += CILEN_LZS; |
||
875 | + len -= CILEN_LZS; |
||
876 | + } |
||
877 | if (go->deflate_correct && len >= CILEN_DEFLATE |
||
878 | && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) { |
||
879 | if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size) |
||
880 | @@ -1074,14 +1363,15 @@ ccp_reqci(f, p, lenp, dont_nak) |
||
881 | int dont_nak; |
||
882 | { |
||
883 | int ret, newret, res; |
||
884 | - u_char *p0, *retp; |
||
885 | + u_char *p0, *retp, p2, p5; |
||
886 | int len, clen, type, nb; |
||
887 | ccp_options *ho = &ccp_hisoptions[f->unit]; |
||
888 | ccp_options *ao = &ccp_allowoptions[f->unit]; |
||
889 | + ccp_options *wo = &ccp_wantoptions[f->unit]; |
||
890 | #ifdef MPPE |
||
891 | - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */ |
||
892 | - /* CI_MPPE, or due to other options? */ |
||
893 | -#endif |
||
894 | + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN]; |
||
895 | +/* int mtu; */ |
||
896 | +#endif /* MPPE */ |
||
897 | |||
898 | ret = CONFACK; |
||
899 | retp = p0 = p; |
||
900 | @@ -1104,106 +1394,302 @@ ccp_reqci(f, p, lenp, dont_nak) |
||
901 | switch (type) { |
||
902 | #ifdef MPPE |
||
903 | case CI_MPPE: |
||
904 | - if (!ao->mppe || clen != CILEN_MPPE) { |
||
905 | + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) { |
||
906 | newret = CONFREJ; |
||
907 | break; |
||
908 | } |
||
909 | - MPPE_CI_TO_OPTS(&p[2], ho->mppe); |
||
910 | - |
||
911 | - /* Nak if anything unsupported or unknown are set. */ |
||
912 | - if (ho->mppe & MPPE_OPT_UNSUPPORTED) { |
||
913 | - newret = CONFNAK; |
||
914 | - ho->mppe &= ~MPPE_OPT_UNSUPPORTED; |
||
915 | - } |
||
916 | - if (ho->mppe & MPPE_OPT_UNKNOWN) { |
||
917 | + p2 = p[2]; |
||
918 | + p5 = p[5]; |
||
919 | + /* not sure what they want, tell 'em what we got */ |
||
920 | + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 || |
||
921 | + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT | |
||
922 | + MPPE_MPPC)) != 0 || p[5] == 0) || |
||
923 | + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) { |
||
924 | newret = CONFNAK; |
||
925 | - ho->mppe &= ~MPPE_OPT_UNKNOWN; |
||
926 | - } |
||
927 | - |
||
928 | - /* Check state opt */ |
||
929 | - if (ho->mppe & MPPE_OPT_STATEFUL) { |
||
930 | - /* |
||
931 | - * We can Nak and request stateless, but it's a |
||
932 | - * lot easier to just assume the peer will request |
||
933 | - * it if he can do it; stateful mode is bad over |
||
934 | - * the Internet -- which is where we expect MPPE. |
||
935 | - */ |
||
936 | - if (refuse_mppe_stateful) { |
||
937 | - error("Refusing MPPE stateful mode offered by peer"); |
||
938 | - newret = CONFREJ; |
||
939 | - break; |
||
940 | + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0); |
||
941 | + p[3] = 0; |
||
942 | + p[4] = 0; |
||
943 | + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) | |
||
944 | + (wo->mppe_56 ? MPPE_56BIT : 0) | |
||
945 | + (wo->mppe_128 ? MPPE_128BIT : 0) | |
||
946 | + (wo->mppc ? MPPE_MPPC : 0); |
||
947 | + break; |
||
948 | + } |
||
949 | + |
||
950 | + if ((p[5] & MPPE_MPPC)) { |
||
951 | + if (ao->mppc) { |
||
952 | + ho->mppc = 1; |
||
953 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
954 | + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0; |
||
955 | + opt_buf[5] = MPPE_MPPC; |
||
956 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) { |
||
957 | + ho->mppc = 0; |
||
958 | + p[5] &= ~MPPE_MPPC; |
||
959 | + newret = CONFNAK; |
||
960 | + } |
||
961 | + } else { |
||
962 | + newret = CONFREJ; |
||
963 | + if (wo->mppe || ao->mppe) { |
||
964 | + p[5] &= ~MPPE_MPPC; |
||
965 | + newret = CONFNAK; |
||
966 | + } |
||
967 | } |
||
968 | } |
||
969 | - |
||
970 | - /* Find out which of {S,L} are set. */ |
||
971 | - if ((ho->mppe & MPPE_OPT_128) |
||
972 | - && (ho->mppe & MPPE_OPT_40)) { |
||
973 | - /* Both are set, negotiate the strongest. */ |
||
974 | - newret = CONFNAK; |
||
975 | - if (ao->mppe & MPPE_OPT_128) |
||
976 | - ho->mppe &= ~MPPE_OPT_40; |
||
977 | - else if (ao->mppe & MPPE_OPT_40) |
||
978 | - ho->mppe &= ~MPPE_OPT_128; |
||
979 | - else { |
||
980 | - newret = CONFREJ; |
||
981 | - break; |
||
982 | - } |
||
983 | - } else if (ho->mppe & MPPE_OPT_128) { |
||
984 | - if (!(ao->mppe & MPPE_OPT_128)) { |
||
985 | - newret = CONFREJ; |
||
986 | - break; |
||
987 | - } |
||
988 | - } else if (ho->mppe & MPPE_OPT_40) { |
||
989 | - if (!(ao->mppe & MPPE_OPT_40)) { |
||
990 | - newret = CONFREJ; |
||
991 | - break; |
||
992 | - } |
||
993 | + if (ao->mppe) |
||
994 | + ho->mppe = 1; |
||
995 | + |
||
996 | + if ((p[2] & MPPE_STATELESS)) { |
||
997 | + if (ao->mppe_stateless) { |
||
998 | + if (wo->mppe_stateless) |
||
999 | + ho->mppe_stateless = 1; |
||
1000 | + else { |
||
1001 | + newret = CONFNAK; |
||
1002 | + if (!dont_nak) |
||
1003 | + p[2] &= ~MPPE_STATELESS; |
||
1004 | + } |
||
1005 | + } else { |
||
1006 | + newret = CONFNAK; |
||
1007 | + if (!dont_nak) |
||
1008 | + p[2] &= ~MPPE_STATELESS; |
||
1009 | + } |
||
1010 | + } else { |
||
1011 | + if (wo->mppe_stateless && !dont_nak) { |
||
1012 | + wo->mppe_stateless = 0; |
||
1013 | + newret = CONFNAK; |
||
1014 | + p[2] |= MPPE_STATELESS; |
||
1015 | + } |
||
1016 | + } |
||
1017 | + |
||
1018 | + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) { |
||
1019 | + newret = CONFNAK; |
||
1020 | + if (ao->mppe_128) { |
||
1021 | + ho->mppe_128 = 1; |
||
1022 | + p[5] &= ~(MPPE_40BIT|MPPE_56BIT); |
||
1023 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1024 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1025 | + MPPE_MAX_KEY_LEN); |
||
1026 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1027 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1028 | + ho->mppe_128 = 0; |
||
1029 | + p[5] |= (MPPE_40BIT|MPPE_56BIT); |
||
1030 | + p[5] &= ~MPPE_128BIT; |
||
1031 | + goto check_mppe_56_40; |
||
1032 | + } |
||
1033 | + goto check_mppe; |
||
1034 | + } |
||
1035 | + p[5] &= ~MPPE_128BIT; |
||
1036 | + goto check_mppe_56_40; |
||
1037 | + } |
||
1038 | + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) { |
||
1039 | + newret = CONFNAK; |
||
1040 | + if (ao->mppe_128) { |
||
1041 | + ho->mppe_128 = 1; |
||
1042 | + p[5] &= ~MPPE_56BIT; |
||
1043 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1044 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1045 | + MPPE_MAX_KEY_LEN); |
||
1046 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1047 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1048 | + ho->mppe_128 = 0; |
||
1049 | + p[5] |= MPPE_56BIT; |
||
1050 | + p[5] &= ~MPPE_128BIT; |
||
1051 | + goto check_mppe_56; |
||
1052 | + } |
||
1053 | + goto check_mppe; |
||
1054 | + } |
||
1055 | + p[5] &= ~MPPE_128BIT; |
||
1056 | + goto check_mppe_56; |
||
1057 | + } |
||
1058 | + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) { |
||
1059 | + newret = CONFNAK; |
||
1060 | + if (ao->mppe_128) { |
||
1061 | + ho->mppe_128 = 1; |
||
1062 | + p[5] &= ~MPPE_40BIT; |
||
1063 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1064 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1065 | + MPPE_MAX_KEY_LEN); |
||
1066 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1067 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1068 | + ho->mppe_128 = 0; |
||
1069 | + p[5] |= MPPE_40BIT; |
||
1070 | + p[5] &= ~MPPE_128BIT; |
||
1071 | + goto check_mppe_40; |
||
1072 | + } |
||
1073 | + goto check_mppe; |
||
1074 | + } |
||
1075 | + p[5] &= ~MPPE_128BIT; |
||
1076 | + goto check_mppe_40; |
||
1077 | + } |
||
1078 | + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) { |
||
1079 | + if (ao->mppe_128) { |
||
1080 | + ho->mppe_128 = 1; |
||
1081 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1082 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1083 | + MPPE_MAX_KEY_LEN); |
||
1084 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1085 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1086 | + ho->mppe_128 = 0; |
||
1087 | + p[5] &= ~MPPE_128BIT; |
||
1088 | + newret = CONFNAK; |
||
1089 | + } |
||
1090 | + goto check_mppe; |
||
1091 | + } |
||
1092 | + p[5] &= ~MPPE_128BIT; |
||
1093 | + newret = CONFNAK; |
||
1094 | + goto check_mppe; |
||
1095 | + } |
||
1096 | + check_mppe_56_40: |
||
1097 | + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) { |
||
1098 | + newret = CONFNAK; |
||
1099 | + if (ao->mppe_56) { |
||
1100 | + ho->mppe_56 = 1; |
||
1101 | + p[5] &= ~MPPE_40BIT; |
||
1102 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1103 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1104 | + MPPE_MAX_KEY_LEN); |
||
1105 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1106 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1107 | + ho->mppe_56 = 0; |
||
1108 | + p[5] |= MPPE_40BIT; |
||
1109 | + p[5] &= ~MPPE_56BIT; |
||
1110 | + newret = CONFNAK; |
||
1111 | + goto check_mppe_40; |
||
1112 | + } |
||
1113 | + goto check_mppe; |
||
1114 | + } |
||
1115 | + p[5] &= ~MPPE_56BIT; |
||
1116 | + goto check_mppe_40; |
||
1117 | + } |
||
1118 | + check_mppe_56: |
||
1119 | + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) { |
||
1120 | + if (ao->mppe_56) { |
||
1121 | + ho->mppe_56 = 1; |
||
1122 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1123 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1124 | + MPPE_MAX_KEY_LEN); |
||
1125 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1126 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1127 | + ho->mppe_56 = 0; |
||
1128 | + p[5] &= ~MPPE_56BIT; |
||
1129 | + newret = CONFNAK; |
||
1130 | + } |
||
1131 | + goto check_mppe; |
||
1132 | + } |
||
1133 | + p[5] &= ~MPPE_56BIT; |
||
1134 | + newret = CONFNAK; |
||
1135 | + goto check_mppe; |
||
1136 | + } |
||
1137 | + check_mppe_40: |
||
1138 | + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) { |
||
1139 | + if (ao->mppe_40) { |
||
1140 | + ho->mppe_40 = 1; |
||
1141 | + BCOPY(p, opt_buf, CILEN_MPPE); |
||
1142 | + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1143 | + MPPE_MAX_KEY_LEN); |
||
1144 | + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + |
||
1145 | + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1146 | + ho->mppe_40 = 0; |
||
1147 | + p[5] &= ~MPPE_40BIT; |
||
1148 | + newret = CONFNAK; |
||
1149 | + } |
||
1150 | + goto check_mppe; |
||
1151 | + } |
||
1152 | + p[5] &= ~MPPE_40BIT; |
||
1153 | + } |
||
1154 | + |
||
1155 | + check_mppe: |
||
1156 | + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) { |
||
1157 | + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) { |
||
1158 | + newret = CONFNAK; |
||
1159 | + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0); |
||
1160 | + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) | |
||
1161 | + (wo->mppe_56 ? MPPE_56BIT : 0) | |
||
1162 | + (wo->mppe_128 ? MPPE_128BIT : 0) | |
||
1163 | + (wo->mppc ? MPPE_MPPC : 0); |
||
1164 | + } else { |
||
1165 | + ho->mppe = ho->mppe_stateless = 0; |
||
1166 | + } |
||
1167 | } else { |
||
1168 | - /* Neither are set. */ |
||
1169 | - /* We cannot accept this. */ |
||
1170 | - newret = CONFNAK; |
||
1171 | - /* Give the peer our idea of what can be used, |
||
1172 | - so it can choose and confirm */ |
||
1173 | - ho->mppe = ao->mppe; |
||
1174 | - } |
||
1175 | - |
||
1176 | - /* rebuild the opts */ |
||
1177 | - MPPE_OPTS_TO_CI(ho->mppe, &p[2]); |
||
1178 | - if (newret == CONFACK) { |
||
1179 | - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN]; |
||
1180 | - int mtu; |
||
1181 | - |
||
1182 | - BCOPY(p, opt_buf, CILEN_MPPE); |
||
1183 | - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], |
||
1184 | - MPPE_MAX_KEY_LEN); |
||
1185 | - if (ccp_test(f->unit, opt_buf, |
||
1186 | - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) { |
||
1187 | - /* This shouldn't happen, we've already tested it! */ |
||
1188 | - error("MPPE required, but kernel has no support."); |
||
1189 | - lcp_close(f->unit, "MPPE required but not available"); |
||
1190 | - newret = CONFREJ; |
||
1191 | - break; |
||
1192 | - } |
||
1193 | - /* |
||
1194 | - * We need to decrease the interface MTU by MPPE_PAD |
||
1195 | - * because MPPE frames **grow**. The kernel [must] |
||
1196 | - * allocate MPPE_PAD extra bytes in xmit buffers. |
||
1197 | - */ |
||
1198 | - mtu = netif_get_mtu(f->unit); |
||
1199 | - if (mtu) |
||
1200 | - netif_set_mtu(f->unit, mtu - MPPE_PAD); |
||
1201 | - else |
||
1202 | - newret = CONFREJ; |
||
1203 | - } |
||
1204 | - |
||
1205 | - /* |
||
1206 | - * We have accepted MPPE or are willing to negotiate |
||
1207 | - * MPPE parameters. A CONFREJ is due to subsequent |
||
1208 | - * (non-MPPE) processing. |
||
1209 | - */ |
||
1210 | - rej_for_ci_mppe = 0; |
||
1211 | - break; |
||
1212 | -#endif /* MPPE */ |
||
1213 | + /* MPPE is not compatible with other compression types */ |
||
1214 | + if (wo->mppe) { |
||
1215 | + ao->bsd_compress = 0; |
||
1216 | + ao->predictor_1 = 0; |
||
1217 | + ao->predictor_2 = 0; |
||
1218 | + ao->deflate = 0; |
||
1219 | + ao->lzs = 0; |
||
1220 | + } |
||
1221 | + } |
||
1222 | + if ((!ho->mppc || !ao->mppc) && !ho->mppe) { |
||
1223 | + p[2] = p2; |
||
1224 | + p[5] = p5; |
||
1225 | + newret = CONFREJ; |
||
1226 | + break; |
||
1227 | + } |
||
1228 | + |
||
1229 | + /* |
||
1230 | + * I have commented the code below because according to RFC1547 |
||
1231 | + * MTU is only information for higher level protocols about |
||
1232 | + * "the maximum allowable length for a packet (q.v.) transmitted |
||
1233 | + * over a point-to-point link without incurring network layer |
||
1234 | + * fragmentation." Of course a PPP implementation should be able |
||
1235 | + * to handle overhead added by MPPE - in our case apropriate code |
||
1236 | + * is located in drivers/net/ppp_generic.c in the kernel sources. |
||
1237 | + * |
||
1238 | + * According to RFC1661: |
||
1239 | + * - when negotiated MRU is less than 1500 octets, a PPP |
||
1240 | + * implementation must still be able to receive at least 1500 |
||
1241 | + * octets, |
||
1242 | + * - when PFC is negotiated, a PPP implementation is still |
||
1243 | + * required to receive frames with uncompressed protocol field. |
||
1244 | + * |
||
1245 | + * So why not to handle MPPE overhead without changing MTU value? |
||
1246 | + * I am sure that RFC3078, unfortunately silently, assumes that. |
||
1247 | + */ |
||
1248 | + |
||
1249 | + /* |
||
1250 | + * We need to decrease the interface MTU by MPPE_PAD |
||
1251 | + * because MPPE frames **grow**. The kernel [must] |
||
1252 | + * allocate MPPE_PAD extra bytes in xmit buffers. |
||
1253 | + */ |
||
1254 | + /* |
||
1255 | + mtu = netif_get_mtu(f->unit); |
||
1256 | + if (mtu) { |
||
1257 | + netif_set_mtu(f->unit, mtu - MPPE_PAD); |
||
1258 | + } else { |
||
1259 | + newret = CONFREJ; |
||
1260 | + if (ccp_wantoptions[f->unit].mppe) { |
||
1261 | + error("Cannot adjust MTU needed by MPPE."); |
||
1262 | + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE."); |
||
1263 | + } |
||
1264 | + } |
||
1265 | + */ |
||
1266 | + break; |
||
1267 | + #endif /* MPPE */ |
||
1268 | + |
||
1269 | + case CI_LZS: |
||
1270 | + if (!ao->lzs || clen != CILEN_LZS) { |
||
1271 | + newret = CONFREJ; |
||
1272 | + break; |
||
1273 | + } |
||
1274 | + |
||
1275 | + ho->lzs = 1; |
||
1276 | + ho->lzs_hists = (p[2] << 8) | p[3]; |
||
1277 | + ho->lzs_mode = p[4]; |
||
1278 | + if ((ho->lzs_hists != ao->lzs_hists) || |
||
1279 | + (ho->lzs_mode != ao->lzs_mode)) { |
||
1280 | + newret = CONFNAK; |
||
1281 | + if (!dont_nak) { |
||
1282 | + p[2] = ao->lzs_hists >> 8; |
||
1283 | + p[3] = ao->lzs_hists & 0xff; |
||
1284 | + p[4] = ao->lzs_mode; |
||
1285 | + } else |
||
1286 | + break; |
||
1287 | + } |
||
1288 | + |
||
1289 | + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) { |
||
1290 | + newret = CONFREJ; |
||
1291 | + } |
||
1292 | + break; |
||
1293 | case CI_DEFLATE: |
||
1294 | case CI_DEFLATE_DRAFT: |
||
1295 | if (!ao->deflate || clen != CILEN_DEFLATE |
||
1296 | @@ -1345,12 +1831,6 @@ ccp_reqci(f, p, lenp, dont_nak) |
||
1297 | else |
||
1298 | *lenp = retp - p0; |
||
1299 | } |
||
1300 | -#ifdef MPPE |
||
1301 | - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) { |
||
1302 | - error("MPPE required but peer negotiation failed"); |
||
1303 | - lcp_close(f->unit, "MPPE required but peer negotiation failed"); |
||
1304 | - } |
||
1305 | -#endif |
||
1306 | return ret; |
||
1307 | } |
||
1308 | |||
1309 | @@ -1372,24 +1852,35 @@ method_name(opt, opt2) |
||
1310 | char *p = result; |
||
1311 | char *q = result + sizeof(result); /* 1 past result */ |
||
1312 | |||
1313 | - slprintf(p, q - p, "MPPE "); |
||
1314 | - p += 5; |
||
1315 | - if (opt->mppe & MPPE_OPT_128) { |
||
1316 | - slprintf(p, q - p, "128-bit "); |
||
1317 | - p += 8; |
||
1318 | - } |
||
1319 | - if (opt->mppe & MPPE_OPT_40) { |
||
1320 | - slprintf(p, q - p, "40-bit "); |
||
1321 | - p += 7; |
||
1322 | - } |
||
1323 | - if (opt->mppe & MPPE_OPT_STATEFUL) |
||
1324 | - slprintf(p, q - p, "stateful"); |
||
1325 | - else |
||
1326 | - slprintf(p, q - p, "stateless"); |
||
1327 | - |
||
1328 | + if (opt->mppe) { |
||
1329 | + if (opt->mppc) { |
||
1330 | + slprintf(p, q - p, "MPPC/MPPE "); |
||
1331 | + p += 10; |
||
1332 | + } else { |
||
1333 | + slprintf(p, q - p, "MPPE "); |
||
1334 | + p += 5; |
||
1335 | + } |
||
1336 | + if (opt->mppe_128) { |
||
1337 | + slprintf(p, q - p, "128-bit "); |
||
1338 | + p += 8; |
||
1339 | + } else if (opt->mppe_56) { |
||
1340 | + slprintf(p, q - p, "56-bit "); |
||
1341 | + p += 7; |
||
1342 | + } else if (opt->mppe_40) { |
||
1343 | + slprintf(p, q - p, "40-bit "); |
||
1344 | + p += 7; |
||
1345 | + } |
||
1346 | + if (opt->mppe_stateless) |
||
1347 | + slprintf(p, q - p, "stateless"); |
||
1348 | + else |
||
1349 | + slprintf(p, q - p, "stateful"); |
||
1350 | + } else if (opt->mppc) |
||
1351 | + slprintf(p, q - p, "MPPC"); |
||
1352 | break; |
||
1353 | } |
||
1354 | -#endif |
||
1355 | +#endif /* MPPE */ |
||
1356 | + case CI_LZS: |
||
1357 | + return "Stac LZS"; |
||
1358 | case CI_DEFLATE: |
||
1359 | case CI_DEFLATE_DRAFT: |
||
1360 | if (opt2 != NULL && opt2->deflate_size != opt->deflate_size) |
||
1361 | @@ -1445,12 +1936,12 @@ ccp_up(f) |
||
1362 | } else if (ANY_COMPRESS(*ho)) |
||
1363 | notice("%s transmit compression enabled", method_name(ho, NULL)); |
||
1364 | #ifdef MPPE |
||
1365 | - if (go->mppe) { |
||
1366 | + if (go->mppe || go->mppc) { |
||
1367 | BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN); |
||
1368 | BZERO(mppe_send_key, MPPE_MAX_KEY_LEN); |
||
1369 | continue_networks(f->unit); /* Bring up IP et al */ |
||
1370 | } |
||
1371 | -#endif |
||
1372 | +#endif /* MPPE */ |
||
1373 | } |
||
1374 | |||
1375 | /* |
||
1376 | @@ -1473,7 +1964,7 @@ ccp_down(f) |
||
1377 | lcp_close(f->unit, "MPPE disabled"); |
||
1378 | } |
||
1379 | } |
||
1380 | -#endif |
||
1381 | +#endif /* MPPE */ |
||
1382 | } |
||
1383 | |||
1384 | /* |
||
1385 | @@ -1533,24 +2024,28 @@ ccp_printpkt(p, plen, printer, arg) |
||
1386 | #ifdef MPPE |
||
1387 | case CI_MPPE: |
||
1388 | if (optlen >= CILEN_MPPE) { |
||
1389 | - u_char mppe_opts; |
||
1390 | - |
||
1391 | - MPPE_CI_TO_OPTS(&p[2], mppe_opts); |
||
1392 | - printer(arg, "mppe %s %s %s %s %s %s%s", |
||
1393 | - (p[2] & MPPE_H_BIT)? "+H": "-H", |
||
1394 | - (p[5] & MPPE_M_BIT)? "+M": "-M", |
||
1395 | - (p[5] & MPPE_S_BIT)? "+S": "-S", |
||
1396 | - (p[5] & MPPE_L_BIT)? "+L": "-L", |
||
1397 | + printer(arg, "mppe %s %s %s %s %s %s", |
||
1398 | + (p[2] & MPPE_STATELESS)? "+H": "-H", |
||
1399 | + (p[5] & MPPE_56BIT)? "+M": "-M", |
||
1400 | + (p[5] & MPPE_128BIT)? "+S": "-S", |
||
1401 | + (p[5] & MPPE_40BIT)? "+L": "-L", |
||
1402 | (p[5] & MPPE_D_BIT)? "+D": "-D", |
||
1403 | - (p[5] & MPPE_C_BIT)? "+C": "-C", |
||
1404 | - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": ""); |
||
1405 | - if (mppe_opts & MPPE_OPT_UNKNOWN) |
||
1406 | + (p[5] & MPPE_MPPC)? "+C": "-C"); |
||
1407 | + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT | |
||
1408 | + MPPE_D_BIT | MPPE_MPPC)) || |
||
1409 | + (p[2] & ~MPPE_STATELESS)) |
||
1410 | printer(arg, " (%.2x %.2x %.2x %.2x)", |
||
1411 | p[2], p[3], p[4], p[5]); |
||
1412 | p += CILEN_MPPE; |
||
1413 | } |
||
1414 | break; |
||
1415 | -#endif |
||
1416 | +#endif /* MPPE */ |
||
1417 | + case CI_LZS: |
||
1418 | + if (optlen >= CILEN_LZS) { |
||
1419 | + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]); |
||
1420 | + p += CILEN_LZS; |
||
1421 | + } |
||
1422 | + break; |
||
1423 | case CI_DEFLATE: |
||
1424 | case CI_DEFLATE_DRAFT: |
||
1425 | if (optlen >= CILEN_DEFLATE) { |
||
1426 | @@ -1636,6 +2131,7 @@ ccp_datainput(unit, pkt, len) |
||
1427 | error("Lost compression sync: disabling compression"); |
||
1428 | ccp_close(unit, "Lost compression sync"); |
||
1429 | #ifdef MPPE |
||
1430 | + /* My module dosn't need this. J.D., 2003-07-06 */ |
||
1431 | /* |
||
1432 | * If we were doing MPPE, we must also take the link down. |
||
1433 | */ |
||
1434 | @@ -1643,9 +2139,18 @@ ccp_datainput(unit, pkt, len) |
||
1435 | error("Too many MPPE errors, closing LCP"); |
||
1436 | lcp_close(unit, "Too many MPPE errors"); |
||
1437 | } |
||
1438 | -#endif |
||
1439 | +#endif /* MPPE */ |
||
1440 | } else { |
||
1441 | /* |
||
1442 | + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ |
||
1443 | + * and don't wait for CCP_RESETACK |
||
1444 | + */ |
||
1445 | + if ((ccp_gotoptions[f->unit].method == CI_LZS) || |
||
1446 | + (ccp_gotoptions[f->unit].method == CI_MPPE)) { |
||
1447 | + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0); |
||
1448 | + return; |
||
1449 | + } |
||
1450 | + /* |
||
1451 | * Send a reset-request to reset the peer's compressor. |
||
1452 | * We don't do that if we are still waiting for an |
||
1453 | * acknowledgement to a previous reset-request. |
||
1454 | --- a/pppd/ccp.h |
||
1455 | +++ b/pppd/ccp.h |
||
1456 | @@ -37,9 +37,17 @@ typedef struct ccp_options { |
||
1457 | bool predictor_2; /* do Predictor-2? */ |
||
1458 | bool deflate_correct; /* use correct code for deflate? */ |
||
1459 | bool deflate_draft; /* use draft RFC code for deflate? */ |
||
1460 | + bool lzs; /* do Stac LZS? */ |
||
1461 | + bool mppc; /* do MPPC? */ |
||
1462 | u_char mppe; /* MPPE bitfield */ |
||
1463 | + bool mppe_40; /* allow 40 bit encryption? */ |
||
1464 | + bool mppe_56; /* allow 56 bit encryption? */ |
||
1465 | + bool mppe_128; /* allow 128 bit encryption? */ |
||
1466 | + bool mppe_stateless; /* allow stateless encryption */ |
||
1467 | u_short bsd_bits; /* # bits/code for BSD Compress */ |
||
1468 | u_short deflate_size; /* lg(window size) for Deflate */ |
||
1469 | + u_short lzs_mode; /* LZS check mode */ |
||
1470 | + u_short lzs_hists; /* number of LZS histories */ |
||
1471 | short method; /* code for chosen compression method */ |
||
1472 | } ccp_options; |
||
1473 | |||
1474 | --- a/pppd/chap_ms.c |
||
1475 | +++ b/pppd/chap_ms.c |
||
1476 | @@ -963,13 +963,17 @@ set_mppe_enc_types(int policy, int types |
||
1477 | /* |
||
1478 | * Disable undesirable encryption types. Note that we don't ENABLE |
||
1479 | * any encryption types, to avoid overriding manual configuration. |
||
1480 | + * |
||
1481 | + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548) |
||
1482 | */ |
||
1483 | switch(types) { |
||
1484 | case MPPE_ENC_TYPES_RC4_40: |
||
1485 | - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ |
||
1486 | + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */ |
||
1487 | + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */ |
||
1488 | break; |
||
1489 | case MPPE_ENC_TYPES_RC4_128: |
||
1490 | - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ |
||
1491 | + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */ |
||
1492 | + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */ |
||
1493 | break; |
||
1494 | default: |
||
1495 | break; |