1 pppd: add support for MPPE and MPPC encryption and compression protocols
3 This is a forward ported version of ppp-2.4.3-mppe-mppc-1.1.patch.gz found on
4 http://mppe-mppc.alphacron.de/ .
6 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
8 --- a/include/linux/ppp-comp.h
9 +++ b/include/linux/ppp-comp.h
14 - * ==FILEVERSION 20020319==
15 + * ==FILEVERSION 20020715==
17 * NOTE TO MAINTAINERS:
18 * If you modify this file at all, please set the above date.
19 @@ -201,6 +201,33 @@ struct compressor {
20 #define CI_MPPE 18 /* config option for MPPE */
21 #define CILEN_MPPE 6 /* length of config option */
23 +/* MPPE/MPPC definitions by J.D.*/
24 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
25 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
26 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
27 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
28 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
31 + * Definitions for Stac LZS.
34 +#define CI_LZS 17 /* config option for Stac LZS */
35 +#define CILEN_LZS 5 /* length of config option */
37 +#define LZS_OVHD 4 /* max. LZS overhead */
38 +#define LZS_HIST_LEN 2048 /* LZS history size */
39 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
41 +#define LZS_MODE_NONE 0
42 +#define LZS_MODE_LCB 1
43 +#define LZS_MODE_CRC 2
44 +#define LZS_MODE_SEQ 3
45 +#define LZS_MODE_EXT 4
47 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
48 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
51 * Definitions for other, as yet unsupported, compression methods.
53 --- a/include/net/ppp-comp.h
54 +++ b/include/net/ppp-comp.h
55 @@ -168,6 +168,33 @@ struct compressor {
56 #define CI_MPPE 18 /* config option for MPPE */
57 #define CILEN_MPPE 6 /* length of config option */
59 +/* MPPE/MPPC definitions by J.D.*/
60 +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
61 +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
62 +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
63 +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
64 +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
67 + * Definitions for Stac LZS.
70 +#define CI_LZS 17 /* config option for Stac LZS */
71 +#define CILEN_LZS 5 /* length of config option */
73 +#define LZS_OVHD 4 /* max. LZS overhead */
74 +#define LZS_HIST_LEN 2048 /* LZS history size */
75 +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
77 +#define LZS_MODE_NONE 0
78 +#define LZS_MODE_LCB 1
79 +#define LZS_MODE_CRC 2
80 +#define LZS_MODE_SEQ 3
81 +#define LZS_MODE_EXT 4
83 +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
84 +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
87 * Definitions for other, as yet unsupported, compression methods.
91 @@ -61,12 +61,10 @@ static int setdeflate (char **);
92 static char bsd_value[8];
93 static char deflate_value[8];
99 -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
101 +static int setmppe(char **);
102 +static int setnomppe(void);
105 static option_t ccp_option_list[] = {
106 { "noccp", o_bool, &ccp_protent.enabled_flag,
107 @@ -107,54 +105,36 @@ static option_t ccp_option_list[] = {
108 "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
109 &ccp_allowoptions[0].predictor_1 },
111 + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
112 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
113 + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
114 + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
115 + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
116 + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
117 + &ccp_allowoptions[0].lzs },
118 + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
119 + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
120 + &ccp_allowoptions[0].lzs },
123 - /* MPPE options are symmetrical ... we only set wantoptions here */
124 - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
125 - "require MPPE encryption",
126 - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
127 - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
128 - "require MPPE encryption",
129 - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
130 - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
131 - "don't allow MPPE encryption", OPT_PRIO },
132 - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
133 - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
135 - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
136 - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
137 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
138 - &ccp_wantoptions[0].mppe },
139 - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
140 - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
141 - &ccp_wantoptions[0].mppe },
142 - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
143 - "don't allow MPPE 40-bit encryption",
144 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
145 - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
146 - "don't allow MPPE 40-bit encryption",
147 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
148 - &ccp_wantoptions[0].mppe },
150 - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
151 - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
152 - &ccp_wantoptions[0].mppe },
153 - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
154 - "require MPPE 128-bit encryption",
155 - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
156 - &ccp_wantoptions[0].mppe },
157 - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
158 - "don't allow MPPE 128-bit encryption",
159 - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
160 - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
161 - "don't allow MPPE 128-bit encryption",
162 - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
163 - &ccp_wantoptions[0].mppe },
165 - /* strange one; we always request stateless, but will we allow stateful? */
166 - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
167 - "allow MPPE stateful mode", OPT_PRIO },
168 - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
169 - "disallow MPPE stateful mode", OPT_PRIO | 1 },
170 + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
171 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
172 + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
173 + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
174 + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
175 + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
176 + &ccp_allowoptions[0].mppc },
177 + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
178 + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
179 + &ccp_allowoptions[0].mppc },
180 + { "mppe", o_special, (void *)setmppe,
181 + "request MPPE encryption" },
182 + { "+mppe", o_special, (void *)setmppe,
183 + "request MPPE encryption" },
184 + { "nomppe", o_special_noarg, (void *)setnomppe,
185 + "don't allow MPPE encryption" },
186 + { "-mppe", o_special_noarg, (void *)setnomppe,
187 + "don't allow MPPE encryption" },
191 @@ -240,7 +220,7 @@ static fsm_callbacks ccp_callbacks = {
193 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
194 || (opt).predictor_1 || (opt).predictor_2 \
196 + || (opt).lzs || (opt).mppc || (opt).mppe)
199 * Local state (mainly for handling reset-reqs and reset-acks).
200 @@ -341,6 +321,100 @@ setdeflate(char **argv)
206 + * Functions called from config options
210 + required - require MPPE; disconnect if peer doesn't support it
211 + stateless - use stateless mode
212 + no40 - disable 40 bit keys
213 + no56 - disable 56 bit keys
214 + no128 - disable 128 bit keys
216 +int setmppe(char **argv)
219 + char *str, cmdbuf[16];
221 + ccp_allowoptions[0].mppe = 1;
222 + ccp_allowoptions[0].mppe_40 = 1;
223 + ccp_allowoptions[0].mppe_56 = 1;
224 + ccp_allowoptions[0].mppe_128 = 1;
225 + ccp_allowoptions[0].mppe_stateless = 0;
226 + ccp_wantoptions[0].mppe = 0;
232 + memset(cmdbuf, '\0', 16);
233 + while ((i < 16) && (*str != ',') && (*str != '\0'))
234 + cmdbuf[i++] = *str++;
236 + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
237 + ccp_allowoptions[0].mppe_40 = 0;
239 + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
240 + ccp_allowoptions[0].mppe_56 = 0;
242 + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
243 + ccp_allowoptions[0].mppe_128 = 0;
245 + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
246 + ccp_allowoptions[0].mppe_stateless = 1;
248 + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
249 + ccp_wantoptions[0].mppe = 1;
252 + option_error("invalid parameter '%s' for mppe option", cmdbuf);
261 + if (*str == '\0') {
262 + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
263 + ccp_allowoptions[0].mppe_128)) {
264 + if (ccp_wantoptions[0].mppe == 1) {
265 + option_error("You require MPPE but you have switched off "
266 + "all encryption key lengths.");
269 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
270 + ccp_wantoptions[0].mppe_stateless =
271 + ccp_allowoptions[0].mppe_stateless = 0;
273 + ccp_allowoptions[0].mppe = 1;
274 + ccp_wantoptions[0].mppe_stateless =
275 + ccp_allowoptions[0].mppe_stateless;
276 + if (ccp_wantoptions[0].mppe == 1) {
277 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
278 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
279 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
289 + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
290 + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
291 + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
292 + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
293 + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
299 * ccp_init - initialize CCP.
301 @@ -374,6 +448,30 @@ ccp_init(int unit)
302 ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
304 ccp_allowoptions[0].predictor_1 = 1;
306 + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
307 + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
308 + ccp_wantoptions[0].lzs_hists = 1;
309 + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
310 + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
311 + ccp_allowoptions[0].lzs_hists = 1;
314 + /* by default allow and request MPPC... */
315 + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
317 + /* ... and allow but don't request MPPE */
318 + ccp_allowoptions[0].mppe = 1;
319 + ccp_allowoptions[0].mppe_40 = 1;
320 + ccp_allowoptions[0].mppe_56 = 1;
321 + ccp_allowoptions[0].mppe_128 = 1;
322 + ccp_allowoptions[0].mppe_stateless = 1;
323 + ccp_wantoptions[0].mppe = 0;
324 + ccp_wantoptions[0].mppe_40 = 0;
325 + ccp_wantoptions[0].mppe_56 = 0;
326 + ccp_wantoptions[0].mppe_128 = 0;
327 + ccp_wantoptions[0].mppe_stateless = 0;
332 @@ -443,11 +541,11 @@ ccp_input(int unit, u_char *p, int len)
333 if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
334 notice("Compression disabled by peer.");
336 - if (ccp_gotoptions[unit].mppe) {
337 + if (ccp_wantoptions[unit].mppe) {
338 error("MPPE disabled, closing LCP");
339 lcp_close(unit, "MPPE disabled by peer");
346 @@ -471,6 +569,15 @@ ccp_extcode(fsm *f, int code, int id, u_
348 /* send a reset-ack, which the transmitter will see and
349 reset its compression state. */
351 + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
352 + but we do it in order to reset compressor; CCP_RESETACK is
353 + then silently discarded. See functions ppp_send_frame and
354 + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
355 + confusion is caused by the fact that CCP code is splited
356 + into two parts - one part is handled by pppd, the other one
357 + is handled by kernel. */
359 fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
362 @@ -498,12 +605,11 @@ ccp_protrej(int unit)
363 fsm_lowerdown(&ccp_fsm[unit]);
366 - if (ccp_gotoptions[unit].mppe) {
367 + if (ccp_wantoptions[unit].mppe) {
368 error("MPPE required but peer negotiation failed");
369 lcp_close(unit, "MPPE required but peer negotiation failed");
377 @@ -519,7 +625,7 @@ ccp_resetci(fsm *f)
378 all_rejected[f->unit] = 0;
382 + if (go->mppe || go->mppc) {
383 ccp_options *ao = &ccp_allowoptions[f->unit];
384 int auth_mschap_bits = auth_done[f->unit];
386 @@ -536,95 +642,124 @@ ccp_resetci(fsm *f)
387 * NB: If MPPE is required, all other compression opts are invalid.
388 * So, we return right away if we can't do it.
391 - /* Leave only the mschap auth bits set */
392 - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
393 - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
394 - /* Count the mschap auths */
395 - auth_mschap_bits >>= CHAP_MS_SHIFT;
398 - numbits += auth_mschap_bits & 1;
399 - auth_mschap_bits >>= 1;
400 - } while (auth_mschap_bits);
402 - error("MPPE required, but auth done in both directions.");
403 - lcp_close(f->unit, "MPPE required but not available");
406 + if (ccp_wantoptions[f->unit].mppe) {
407 + /* Leave only the mschap auth bits set */
408 + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
409 + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
410 + /* Count the mschap auths */
411 + auth_mschap_bits >>= CHAP_MS_SHIFT;
414 + numbits += auth_mschap_bits & 1;
415 + auth_mschap_bits >>= 1;
416 + } while (auth_mschap_bits);
418 + error("MPPE required, but auth done in both directions.");
419 + lcp_close(f->unit, "MPPE required but not available");
425 - * MPPE is also possible in combination with EAP-TLS.
426 - * It is not possible to detect if we're doing EAP or EAP-TLS
427 - * at this stage, hence we accept all forms of EAP. If TLS is
428 - * not used then the MPPE keys will not be derived anyway.
430 - /* Leave only the eap auth bits set */
431 - auth_eap_bits &= (EAP_WITHPEER | EAP_PEER );
433 + * MPPE is also possible in combination with EAP-TLS.
434 + * It is not possible to detect if we're doing EAP or EAP-TLS
435 + * at this stage, hence we accept all forms of EAP. If TLS is
436 + * not used then the MPPE keys will not be derived anyway.
438 + /* Leave only the eap auth bits set */
439 + auth_eap_bits &= (EAP_WITHPEER | EAP_PEER );
441 - if ((numbits == 0) && (auth_eap_bits == 0)) {
442 - error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed.");
443 + if ((numbits == 0) && (auth_eap_bits == 0)) {
444 + error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed.");
447 - error("MPPE required, but MS-CHAP[v2] auth not performed.");
449 + error("MPPE required, but MS-CHAP[v2] auth not performed.");
451 - lcp_close(f->unit, "MPPE required but not available");
454 + lcp_close(f->unit, "MPPE required but not available");
458 - /* A plugin (eg radius) may not have obtained key material. */
459 - if (!mppe_keys_set) {
460 - error("MPPE required, but keys are not available. "
461 - "Possible plugin problem?");
462 - lcp_close(f->unit, "MPPE required but not available");
466 - /* LM auth not supported for MPPE */
467 - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
468 - /* This might be noise */
469 - if (go->mppe & MPPE_OPT_40) {
470 - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
471 - go->mppe &= ~MPPE_OPT_40;
472 - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
473 + /* A plugin (eg radius) may not have obtained key material. */
474 + if (!mppe_keys_set) {
475 + error("MPPE required, but keys are not available. "
476 + "Possible plugin problem?");
477 + lcp_close(f->unit, "MPPE required but not available");
482 - /* Last check: can we actually negotiate something? */
483 - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
484 - /* Could be misconfig, could be 40-bit disabled above. */
485 - error("MPPE required, but both 40-bit and 128-bit disabled.");
486 - lcp_close(f->unit, "MPPE required but not available");
489 + * Check whether the kernel knows about the various
490 + * compression methods we might request. Key material
491 + * unimportant here.
494 + opt_buf[0] = CI_MPPE;
495 + opt_buf[1] = CILEN_MPPE;
499 + opt_buf[5] = MPPE_MPPC;
500 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
504 + opt_buf[0] = CI_MPPE;
505 + opt_buf[1] = CILEN_MPPE;
506 + opt_buf[2] = MPPE_STATELESS;
509 + opt_buf[5] = MPPE_40BIT;
510 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
514 + opt_buf[0] = CI_MPPE;
515 + opt_buf[1] = CILEN_MPPE;
516 + opt_buf[2] = MPPE_STATELESS;
519 + opt_buf[5] = MPPE_56BIT;
520 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
523 + if (go->mppe_128) {
524 + opt_buf[0] = CI_MPPE;
525 + opt_buf[1] = CILEN_MPPE;
526 + opt_buf[2] = MPPE_STATELESS;
529 + opt_buf[5] = MPPE_128BIT;
530 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
533 + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
534 + if (ccp_wantoptions[f->unit].mppe) {
535 + error("MPPE required, but kernel has no support.");
536 + lcp_close(f->unit, "MPPE required but not available");
538 + go->mppe = go->mppe_stateless = 0;
540 + /* MPPE is not compatible with other compression types */
541 + if (ccp_wantoptions[f->unit].mppe) {
542 + ao->bsd_compress = go->bsd_compress = 0;
543 + ao->predictor_1 = go->predictor_1 = 0;
544 + ao->predictor_2 = go->predictor_2 = 0;
545 + ao->deflate = go->deflate = 0;
546 + ao->lzs = go->lzs = 0;
551 - ao->mppe = go->mppe;
552 - /* MPPE is not compatible with other compression types */
553 - ao->bsd_compress = go->bsd_compress = 0;
554 - ao->predictor_1 = go->predictor_1 = 0;
555 - ao->predictor_2 = go->predictor_2 = 0;
556 - ao->deflate = go->deflate = 0;
561 - * Check whether the kernel knows about the various
562 - * compression methods we might request.
566 - opt_buf[0] = CI_MPPE;
567 - opt_buf[1] = CILEN_MPPE;
568 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
569 - /* Key material unimportant here. */
570 - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
571 - error("MPPE required, but kernel has no support.");
572 - lcp_close(f->unit, "MPPE required but not available");
575 + opt_buf[0] = CI_LZS;
576 + opt_buf[1] = CILEN_LZS;
577 + opt_buf[2] = go->lzs_hists >> 8;
578 + opt_buf[3] = go->lzs_hists & 0xff;
579 + opt_buf[4] = LZS_MODE_SEQ;
580 + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
584 if (go->bsd_compress) {
585 opt_buf[0] = CI_BSD_COMPRESS;
586 opt_buf[1] = CILEN_BSD_COMPRESS;
587 @@ -679,7 +814,8 @@ static int
588 + (go->deflate && go->deflate_draft? CILEN_DEFLATE: 0)
589 + (go->predictor_1? CILEN_PREDICTOR_1: 0)
590 + (go->predictor_2? CILEN_PREDICTOR_2: 0)
591 - + (go->mppe? CILEN_MPPE: 0);
592 + + (go->lzs? CILEN_LZS: 0)
593 + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
597 @@ -690,6 +826,8 @@ static void
600 ccp_options *go = &ccp_gotoptions[f->unit];
601 + ccp_options *ao = &ccp_allowoptions[f->unit];
602 + ccp_options *wo = &ccp_wantoptions[f->unit];
606 @@ -698,22 +836,43 @@ static void
607 * in case it gets Acked.
611 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
612 u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
614 - p[0] = opt_buf[0] = CI_MPPE;
615 - p[1] = opt_buf[1] = CILEN_MPPE;
616 - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
617 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
620 + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
623 + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
624 + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
626 + BCOPY(p, opt_buf, CILEN_MPPE);
627 BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
628 res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
634 /* This shouldn't happen, we've already tested it! */
635 - lcp_close(f->unit, "MPPE required but not available in kernel");
636 + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
637 + go->mppe_stateless = go->mppc = 0;
638 + if (ccp_wantoptions[f->unit].mppe)
639 + lcp_close(f->unit, "MPPE required but not available in kernel");
646 + p[2] = go->lzs_hists >> 8;
647 + p[3] = go->lzs_hists & 0xff;
648 + p[4] = LZS_MODE_SEQ;
649 + res = ccp_test(f->unit, p, CILEN_LZS, 0);
657 p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
658 p[1] = CILEN_DEFLATE;
659 @@ -799,30 +958,50 @@ static void
662 * ccp_ackci - process a received configure-ack, and return
663 - * 1 iff the packet was OK.
664 + * 1 if the packet was OK.
667 ccp_ackci(fsm *f, u_char *p, int len)
669 ccp_options *go = &ccp_gotoptions[f->unit];
670 + ccp_options *ao = &ccp_allowoptions[f->unit];
671 + ccp_options *wo = &ccp_wantoptions[f->unit];
676 - u_char opt_buf[CILEN_MPPE];
678 - opt_buf[0] = CI_MPPE;
679 - opt_buf[1] = CILEN_MPPE;
680 - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
681 - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
682 + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
683 + if (len < CILEN_MPPE
684 + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
685 + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
688 + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
689 + (go->mppc ? MPPE_MPPC : 0))
690 + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
691 + (go->mppc ? MPPE_MPPC : 0))
692 + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
693 + (go->mppc ? MPPE_MPPC : 0))))
695 + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
699 + /* Cope with first/fast ack */
700 + if (p == p0 && len == 0)
705 + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
706 + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
707 + || p[4] != LZS_MODE_SEQ)
711 /* XXX Cope with first/fast ack */
713 + if (p == p0 && len == 0)
718 if (len < CILEN_DEFLATE
719 || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
720 @@ -891,6 +1070,8 @@ static int
721 ccp_nakci(fsm *f, u_char *p, int len, int treat_as_reject)
723 ccp_options *go = &ccp_gotoptions[f->unit];
724 + ccp_options *ao = &ccp_allowoptions[f->unit];
725 + ccp_options *wo = &ccp_wantoptions[f->unit];
726 ccp_options no; /* options we've seen already */
727 ccp_options try; /* options to ask for next time */
729 @@ -898,28 +1079,100 @@ static int
733 - if (go->mppe && len >= CILEN_MPPE
734 - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
737 - * Peer wants us to use a different strength or other setting.
738 - * Fail if we aren't willing to use his suggestion.
740 - MPPE_CI_TO_OPTS(&p[2], try.mppe);
741 - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
742 - error("Refusing MPPE stateful mode offered by peer");
744 - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
745 - /* Peer must have set options we didn't request (suggest) */
748 + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
749 + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
752 - error("MPPE required but peer negotiation failed");
753 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
756 + if (!(p[5] & MPPE_MPPC))
768 + if (go->mppe_stateless)
769 + no.mppe_stateless = 1;
772 + if ((p[5] & MPPE_40BIT))
775 + try.mppe_40 = (p[5] == 0) ? 1 : 0;
778 + if ((p[5] & MPPE_56BIT))
781 + try.mppe_56 = (p[5] == 0) ? 1 : 0;
783 + if (ao->mppe_128) {
784 + if ((p[5] & MPPE_128BIT))
787 + try.mppe_128 = (p[5] == 0) ? 1 : 0;
790 + if (ao->mppe_stateless) {
791 + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
792 + try.mppe_stateless = 1;
794 + try.mppe_stateless = 0;
797 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
798 + try.mppe = try.mppe_stateless = 0;
800 + /* we require encryption, but peer doesn't support it
801 + so we close connection */
802 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
803 + wo->mppe_56 = wo->mppe_128 = 0;
804 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
808 + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
809 + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
810 + /* cannot negotiate key length */
811 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
812 + wo->mppe_56 = wo->mppe_128 = 0;
813 + lcp_close(f->unit, "Cannot negotiate MPPE key length");
815 + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
816 + try.mppe_40 = try.mppe_56 = 0;
818 + if (try.mppe_56 && try.mppe_128)
821 + if (try.mppe_40 && try.mppe_128)
824 + if (try.mppe_40 && try.mppe_56)
832 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
834 + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
835 + p[4] != LZS_MODE_EXT))
838 + try.lzs_mode = p[4];
839 + try.lzs_hists = (p[2] << 8) | p[3];
845 if (go->deflate && len >= CILEN_DEFLATE
846 && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
847 && p[1] == CILEN_DEFLATE) {
848 @@ -989,14 +1242,50 @@ ccp_rejci(fsm *f, u_char *p, int len)
852 - if (go->mppe && len >= CILEN_MPPE
853 + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
854 && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
855 - error("MPPE required but peer refused");
856 - lcp_close(f->unit, "MPPE required but peer refused");
857 + ccp_options *wo = &ccp_wantoptions[f->unit];
858 + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
861 + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
862 + (go->mppe_56 ? MPPE_56BIT : 0) |
863 + (go->mppe_128 ? MPPE_128BIT : 0) |
864 + (go->mppc ? MPPE_MPPC : 0)))
876 + if (go->mppe_stateless)
877 + try.mppe_stateless = 0;
878 + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
879 + try.mppe = try.mppe_stateless = 0;
880 + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
881 + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
882 + wo->mppe_56 = wo->mppe_128 = 0;
883 + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
892 + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
893 + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
894 + || p[4] != go->lzs_mode)
900 if (go->deflate_correct && len >= CILEN_DEFLATE
901 && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
902 if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
903 @@ -1056,14 +1345,15 @@ static int
904 ccp_reqci(fsm *f, u_char *p, int *lenp, int dont_nak)
906 int ret, newret, res;
908 + u_char *p0, *retp, p2, p5;
909 int len, clen, type, nb;
910 ccp_options *ho = &ccp_hisoptions[f->unit];
911 ccp_options *ao = &ccp_allowoptions[f->unit];
912 + ccp_options *wo = &ccp_wantoptions[f->unit];
914 - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
915 - /* CI_MPPE, or due to other options? */
917 + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
923 @@ -1086,106 +1376,302 @@ ccp_reqci(fsm *f, u_char *p, int *lenp,
927 - if (!ao->mppe || clen != CILEN_MPPE) {
928 + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
932 - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
934 - /* Nak if anything unsupported or unknown are set. */
935 - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
938 + /* not sure what they want, tell 'em what we got */
939 + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
940 + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
941 + MPPE_MPPC)) != 0 || p[5] == 0) ||
942 + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
944 - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
946 - if (ho->mppe & MPPE_OPT_UNKNOWN) {
948 - ho->mppe &= ~MPPE_OPT_UNKNOWN;
951 - /* Check state opt */
952 - if (ho->mppe & MPPE_OPT_STATEFUL) {
954 - * We can Nak and request stateless, but it's a
955 - * lot easier to just assume the peer will request
956 - * it if he can do it; stateful mode is bad over
957 - * the Internet -- which is where we expect MPPE.
959 - if (refuse_mppe_stateful) {
960 - error("Refusing MPPE stateful mode offered by peer");
963 + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
966 + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
967 + (wo->mppe_56 ? MPPE_56BIT : 0) |
968 + (wo->mppe_128 ? MPPE_128BIT : 0) |
969 + (wo->mppc ? MPPE_MPPC : 0);
973 + if ((p[5] & MPPE_MPPC)) {
976 + BCOPY(p, opt_buf, CILEN_MPPE);
977 + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
978 + opt_buf[5] = MPPE_MPPC;
979 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
981 + p[5] &= ~MPPE_MPPC;
986 + if (wo->mppe || ao->mppe) {
987 + p[5] &= ~MPPE_MPPC;
993 - /* Find out which of {S,L} are set. */
994 - if ((ho->mppe & MPPE_OPT_128)
995 - && (ho->mppe & MPPE_OPT_40)) {
996 - /* Both are set, negotiate the strongest. */
998 - if (ao->mppe & MPPE_OPT_128)
999 - ho->mppe &= ~MPPE_OPT_40;
1000 - else if (ao->mppe & MPPE_OPT_40)
1001 - ho->mppe &= ~MPPE_OPT_128;
1006 - } else if (ho->mppe & MPPE_OPT_128) {
1007 - if (!(ao->mppe & MPPE_OPT_128)) {
1011 - } else if (ho->mppe & MPPE_OPT_40) {
1012 - if (!(ao->mppe & MPPE_OPT_40)) {
1019 + if ((p[2] & MPPE_STATELESS)) {
1020 + if (ao->mppe_stateless) {
1021 + if (wo->mppe_stateless)
1022 + ho->mppe_stateless = 1;
1026 + p[2] &= ~MPPE_STATELESS;
1031 + p[2] &= ~MPPE_STATELESS;
1034 + if (wo->mppe_stateless && !dont_nak) {
1035 + wo->mppe_stateless = 0;
1037 + p[2] |= MPPE_STATELESS;
1041 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1043 + if (ao->mppe_128) {
1045 + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1046 + BCOPY(p, opt_buf, CILEN_MPPE);
1047 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1048 + MPPE_MAX_KEY_LEN);
1049 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1050 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1052 + p[5] |= (MPPE_40BIT|MPPE_56BIT);
1053 + p[5] &= ~MPPE_128BIT;
1054 + goto check_mppe_56_40;
1058 + p[5] &= ~MPPE_128BIT;
1059 + goto check_mppe_56_40;
1061 + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1063 + if (ao->mppe_128) {
1065 + p[5] &= ~MPPE_56BIT;
1066 + BCOPY(p, opt_buf, CILEN_MPPE);
1067 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1068 + MPPE_MAX_KEY_LEN);
1069 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1070 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1072 + p[5] |= MPPE_56BIT;
1073 + p[5] &= ~MPPE_128BIT;
1074 + goto check_mppe_56;
1078 + p[5] &= ~MPPE_128BIT;
1079 + goto check_mppe_56;
1081 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1083 + if (ao->mppe_128) {
1085 + p[5] &= ~MPPE_40BIT;
1086 + BCOPY(p, opt_buf, CILEN_MPPE);
1087 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1088 + MPPE_MAX_KEY_LEN);
1089 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1090 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1092 + p[5] |= MPPE_40BIT;
1093 + p[5] &= ~MPPE_128BIT;
1094 + goto check_mppe_40;
1098 + p[5] &= ~MPPE_128BIT;
1099 + goto check_mppe_40;
1101 + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1102 + if (ao->mppe_128) {
1104 + BCOPY(p, opt_buf, CILEN_MPPE);
1105 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1106 + MPPE_MAX_KEY_LEN);
1107 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1108 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1110 + p[5] &= ~MPPE_128BIT;
1115 + p[5] &= ~MPPE_128BIT;
1120 + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1122 + if (ao->mppe_56) {
1124 + p[5] &= ~MPPE_40BIT;
1125 + BCOPY(p, opt_buf, CILEN_MPPE);
1126 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1127 + MPPE_MAX_KEY_LEN);
1128 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1129 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1131 + p[5] |= MPPE_40BIT;
1132 + p[5] &= ~MPPE_56BIT;
1134 + goto check_mppe_40;
1138 + p[5] &= ~MPPE_56BIT;
1139 + goto check_mppe_40;
1142 + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1143 + if (ao->mppe_56) {
1145 + BCOPY(p, opt_buf, CILEN_MPPE);
1146 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1147 + MPPE_MAX_KEY_LEN);
1148 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1149 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1151 + p[5] &= ~MPPE_56BIT;
1156 + p[5] &= ~MPPE_56BIT;
1161 + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1162 + if (ao->mppe_40) {
1164 + BCOPY(p, opt_buf, CILEN_MPPE);
1165 + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1166 + MPPE_MAX_KEY_LEN);
1167 + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1168 + MPPE_MAX_KEY_LEN, 1) <= 0) {
1170 + p[5] &= ~MPPE_40BIT;
1175 + p[5] &= ~MPPE_40BIT;
1179 + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1180 + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1182 + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1183 + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1184 + (wo->mppe_56 ? MPPE_56BIT : 0) |
1185 + (wo->mppe_128 ? MPPE_128BIT : 0) |
1186 + (wo->mppc ? MPPE_MPPC : 0);
1188 + ho->mppe = ho->mppe_stateless = 0;
1191 - /* Neither are set. */
1192 - /* We cannot accept this. */
1194 - /* Give the peer our idea of what can be used,
1195 - so it can choose and confirm */
1196 - ho->mppe = ao->mppe;
1199 - /* rebuild the opts */
1200 - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1201 - if (newret == CONFACK) {
1202 - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1205 - BCOPY(p, opt_buf, CILEN_MPPE);
1206 - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1207 - MPPE_MAX_KEY_LEN);
1208 - if (ccp_test(f->unit, opt_buf,
1209 - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1210 - /* This shouldn't happen, we've already tested it! */
1211 - error("MPPE required, but kernel has no support.");
1212 - lcp_close(f->unit, "MPPE required but not available");
1217 - * We need to decrease the interface MTU by MPPE_PAD
1218 - * because MPPE frames **grow**. The kernel [must]
1219 - * allocate MPPE_PAD extra bytes in xmit buffers.
1221 - mtu = netif_get_mtu(f->unit);
1223 - netif_set_mtu(f->unit, mtu - MPPE_PAD);
1229 - * We have accepted MPPE or are willing to negotiate
1230 - * MPPE parameters. A CONFREJ is due to subsequent
1231 - * (non-MPPE) processing.
1233 - rej_for_ci_mppe = 0;
1236 + /* MPPE is not compatible with other compression types */
1238 + ao->bsd_compress = 0;
1239 + ao->predictor_1 = 0;
1240 + ao->predictor_2 = 0;
1245 + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1253 + * I have commented the code below because according to RFC1547
1254 + * MTU is only information for higher level protocols about
1255 + * "the maximum allowable length for a packet (q.v.) transmitted
1256 + * over a point-to-point link without incurring network layer
1257 + * fragmentation." Of course a PPP implementation should be able
1258 + * to handle overhead added by MPPE - in our case apropriate code
1259 + * is located in drivers/net/ppp_generic.c in the kernel sources.
1261 + * According to RFC1661:
1262 + * - when negotiated MRU is less than 1500 octets, a PPP
1263 + * implementation must still be able to receive at least 1500
1265 + * - when PFC is negotiated, a PPP implementation is still
1266 + * required to receive frames with uncompressed protocol field.
1268 + * So why not to handle MPPE overhead without changing MTU value?
1269 + * I am sure that RFC3078, unfortunately silently, assumes that.
1273 + * We need to decrease the interface MTU by MPPE_PAD
1274 + * because MPPE frames **grow**. The kernel [must]
1275 + * allocate MPPE_PAD extra bytes in xmit buffers.
1278 + mtu = netif_get_mtu(f->unit);
1280 + netif_set_mtu(f->unit, mtu - MPPE_PAD);
1283 + if (ccp_wantoptions[f->unit].mppe) {
1284 + error("Cannot adjust MTU needed by MPPE.");
1285 + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1293 + if (!ao->lzs || clen != CILEN_LZS) {
1299 + ho->lzs_hists = (p[2] << 8) | p[3];
1300 + ho->lzs_mode = p[4];
1301 + if ((ho->lzs_hists != ao->lzs_hists) ||
1302 + (ho->lzs_mode != ao->lzs_mode)) {
1305 + p[2] = ao->lzs_hists >> 8;
1306 + p[3] = ao->lzs_hists & 0xff;
1307 + p[4] = ao->lzs_mode;
1312 + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1317 case CI_DEFLATE_DRAFT:
1318 if (!ao->deflate || clen != CILEN_DEFLATE
1319 @@ -1327,12 +1813,6 @@ ccp_reqci(fsm *f, u_char *p, int *lenp,
1324 - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1325 - error("MPPE required but peer negotiation failed");
1326 - lcp_close(f->unit, "MPPE required but peer negotiation failed");
1332 @@ -1353,24 +1833,35 @@ method_name(ccp_options *opt, ccp_option
1334 char *q = result + sizeof(result); /* 1 past result */
1336 - slprintf(p, q - p, "MPPE ");
1338 - if (opt->mppe & MPPE_OPT_128) {
1339 - slprintf(p, q - p, "128-bit ");
1342 - if (opt->mppe & MPPE_OPT_40) {
1343 - slprintf(p, q - p, "40-bit ");
1346 - if (opt->mppe & MPPE_OPT_STATEFUL)
1347 - slprintf(p, q - p, "stateful");
1349 - slprintf(p, q - p, "stateless");
1353 + slprintf(p, q - p, "MPPC/MPPE ");
1356 + slprintf(p, q - p, "MPPE ");
1359 + if (opt->mppe_128) {
1360 + slprintf(p, q - p, "128-bit ");
1362 + } else if (opt->mppe_56) {
1363 + slprintf(p, q - p, "56-bit ");
1365 + } else if (opt->mppe_40) {
1366 + slprintf(p, q - p, "40-bit ");
1369 + if (opt->mppe_stateless)
1370 + slprintf(p, q - p, "stateless");
1372 + slprintf(p, q - p, "stateful");
1373 + } else if (opt->mppc)
1374 + slprintf(p, q - p, "MPPC");
1380 + return "Stac LZS";
1382 case CI_DEFLATE_DRAFT:
1383 if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1384 @@ -1425,12 +1916,12 @@ ccp_up(fsm *f)
1385 } else if (ANY_COMPRESS(*ho))
1386 notice("%s transmit compression enabled", method_name(ho, NULL));
1389 + if (go->mppe || go->mppc) {
1390 BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1391 BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1392 continue_networks(f->unit); /* Bring up IP et al */
1399 @@ -1452,7 +1943,7 @@ ccp_down(fsm *f)
1400 lcp_close(f->unit, "MPPE disabled");
1408 @@ -1509,24 +2000,28 @@ ccp_printpkt(u_char *p, int plen,
1411 if (optlen >= CILEN_MPPE) {
1414 - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1415 - printer(arg, "mppe %s %s %s %s %s %s%s",
1416 - (p[2] & MPPE_H_BIT)? "+H": "-H",
1417 - (p[5] & MPPE_M_BIT)? "+M": "-M",
1418 - (p[5] & MPPE_S_BIT)? "+S": "-S",
1419 - (p[5] & MPPE_L_BIT)? "+L": "-L",
1420 + printer(arg, "mppe %s %s %s %s %s %s",
1421 + (p[2] & MPPE_STATELESS)? "+H": "-H",
1422 + (p[5] & MPPE_56BIT)? "+M": "-M",
1423 + (p[5] & MPPE_128BIT)? "+S": "-S",
1424 + (p[5] & MPPE_40BIT)? "+L": "-L",
1425 (p[5] & MPPE_D_BIT)? "+D": "-D",
1426 - (p[5] & MPPE_C_BIT)? "+C": "-C",
1427 - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1428 - if (mppe_opts & MPPE_OPT_UNKNOWN)
1429 + (p[5] & MPPE_MPPC)? "+C": "-C");
1430 + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1431 + MPPE_D_BIT | MPPE_MPPC)) ||
1432 + (p[2] & ~MPPE_STATELESS))
1433 printer(arg, " (%.2x %.2x %.2x %.2x)",
1434 p[2], p[3], p[4], p[5]);
1441 + if (optlen >= CILEN_LZS) {
1442 + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1447 case CI_DEFLATE_DRAFT:
1448 if (optlen >= CILEN_DEFLATE) {
1449 @@ -1609,6 +2104,7 @@ ccp_datainput(int unit, u_char *pkt, int
1450 error("Lost compression sync: disabling compression");
1451 ccp_close(unit, "Lost compression sync");
1453 + /* My module dosn't need this. J.D., 2003-07-06 */
1455 * If we were doing MPPE, we must also take the link down.
1457 @@ -1616,9 +2112,18 @@ ccp_datainput(int unit, u_char *pkt, int
1458 error("Too many MPPE errors, closing LCP");
1459 lcp_close(unit, "Too many MPPE errors");
1465 + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1466 + * and don't wait for CCP_RESETACK
1468 + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1469 + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1470 + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1474 * Send a reset-request to reset the peer's compressor.
1475 * We don't do that if we are still waiting for an
1476 * acknowledgement to a previous reset-request.
1479 @@ -37,9 +37,17 @@ typedef struct ccp_options {
1480 bool predictor_2; /* do Predictor-2? */
1481 bool deflate_correct; /* use correct code for deflate? */
1482 bool deflate_draft; /* use draft RFC code for deflate? */
1483 + bool lzs; /* do Stac LZS? */
1484 + bool mppc; /* do MPPC? */
1485 u_char mppe; /* MPPE bitfield */
1486 + bool mppe_40; /* allow 40 bit encryption? */
1487 + bool mppe_56; /* allow 56 bit encryption? */
1488 + bool mppe_128; /* allow 128 bit encryption? */
1489 + bool mppe_stateless; /* allow stateless encryption */
1490 u_short bsd_bits; /* # bits/code for BSD Compress */
1491 u_short deflate_size; /* lg(window size) for Deflate */
1492 + u_short lzs_mode; /* LZS check mode */
1493 + u_short lzs_hists; /* number of LZS histories */
1494 short method; /* code for chosen compression method */
1497 --- a/pppd/chap_ms.c
1498 +++ b/pppd/chap_ms.c
1499 @@ -964,13 +964,17 @@ set_mppe_enc_types(int policy, int types
1501 * Disable undesirable encryption types. Note that we don't ENABLE
1502 * any encryption types, to avoid overriding manual configuration.
1504 + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1507 case MPPE_ENC_TYPES_RC4_40:
1508 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1509 + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1510 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1512 case MPPE_ENC_TYPES_RC4_128:
1513 - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1514 + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1515 + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */