Root/package/ppp/patches/201-mppe_mppc_1.1.patch

1--- a/include/linux/ppp-comp.h
2+++ b/include/linux/ppp-comp.h
3@@ -36,7 +36,7 @@
4  */
5 
6 /*
7- * ==FILEVERSION 20020319==
8+ * ==FILEVERSION 20020715==
9  *
10  * NOTE TO MAINTAINERS:
11  * If you modify this file at all, please set the above date.
12@@ -201,6 +201,33 @@ struct compressor {
13 #define CI_MPPE 18 /* config option for MPPE */
14 #define CILEN_MPPE 6 /* length of config option */
15 
16+/* MPPE/MPPC definitions by J.D.*/
17+#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
18+#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
19+#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
20+#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
21+#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
22+
23+/*
24+ * Definitions for Stac LZS.
25+ */
26+
27+#define CI_LZS 17 /* config option for Stac LZS */
28+#define CILEN_LZS 5 /* length of config option */
29+
30+#define LZS_OVHD 4 /* max. LZS overhead */
31+#define LZS_HIST_LEN 2048 /* LZS history size */
32+#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
33+
34+#define LZS_MODE_NONE 0
35+#define LZS_MODE_LCB 1
36+#define LZS_MODE_CRC 2
37+#define LZS_MODE_SEQ 3
38+#define LZS_MODE_EXT 4
39+
40+#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
41+#define LZS_EXT_BIT_COMP 0x20 /* bit C */
42+
43 /*
44  * Definitions for other, as yet unsupported, compression methods.
45  */
46--- a/include/net/ppp-comp.h
47+++ b/include/net/ppp-comp.h
48@@ -168,6 +168,33 @@ struct compressor {
49 #define CI_MPPE 18 /* config option for MPPE */
50 #define CILEN_MPPE 6 /* length of config option */
51 
52+/* MPPE/MPPC definitions by J.D.*/
53+#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
54+#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
55+#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
56+#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
57+#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
58+
59+/*
60+ * Definitions for Stac LZS.
61+ */
62+
63+#define CI_LZS 17 /* config option for Stac LZS */
64+#define CILEN_LZS 5 /* length of config option */
65+
66+#define LZS_OVHD 4 /* max. LZS overhead */
67+#define LZS_HIST_LEN 2048 /* LZS history size */
68+#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
69+
70+#define LZS_MODE_NONE 0
71+#define LZS_MODE_LCB 1
72+#define LZS_MODE_CRC 2
73+#define LZS_MODE_SEQ 3
74+#define LZS_MODE_EXT 4
75+
76+#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
77+#define LZS_EXT_BIT_COMP 0x20 /* bit C */
78+
79 /*
80  * Definitions for other, as yet unsupported, compression methods.
81  */
82--- a/pppd/ccp.c
83+++ b/pppd/ccp.c
84@@ -62,12 +62,10 @@ static int setdeflate __P((char **));
85 static char bsd_value[8];
86 static char deflate_value[8];
87 
88-/*
89- * Option variables.
90- */
91 #ifdef MPPE
92-bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
93-#endif
94+static int setmppe(char **);
95+static int setnomppe(void);
96+#endif /* MPPE */
97 
98 static option_t ccp_option_list[] = {
99     { "noccp", o_bool, &ccp_protent.enabled_flag,
100@@ -108,54 +106,36 @@ static option_t ccp_option_list[] = {
101       "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
102       &ccp_allowoptions[0].predictor_1 },
103 
104+ { "lzs", o_bool, &ccp_wantoptions[0].lzs,
105+ "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
106+ { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
107+ "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
108+ { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
109+ "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
110+ &ccp_allowoptions[0].lzs },
111+ { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
112+ "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
113+ &ccp_allowoptions[0].lzs },
114+
115 #ifdef MPPE
116- /* MPPE options are symmetrical ... we only set wantoptions here */
117- { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
118- "require MPPE encryption",
119- OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
120- { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
121- "require MPPE encryption",
122- OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
123- { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
124- "don't allow MPPE encryption", OPT_PRIO },
125- { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
126- "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
127-
128- /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
129- { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
130- "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
131- &ccp_wantoptions[0].mppe },
132- { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
133- "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
134- &ccp_wantoptions[0].mppe },
135- { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
136- "don't allow MPPE 40-bit encryption",
137- OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
138- { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
139- "don't allow MPPE 40-bit encryption",
140- OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
141- &ccp_wantoptions[0].mppe },
142-
143- { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
144- "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
145- &ccp_wantoptions[0].mppe },
146- { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
147- "require MPPE 128-bit encryption",
148- OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
149- &ccp_wantoptions[0].mppe },
150- { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
151- "don't allow MPPE 128-bit encryption",
152- OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
153- { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
154- "don't allow MPPE 128-bit encryption",
155- OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
156- &ccp_wantoptions[0].mppe },
157-
158- /* strange one; we always request stateless, but will we allow stateful? */
159- { "mppe-stateful", o_bool, &refuse_mppe_stateful,
160- "allow MPPE stateful mode", OPT_PRIO },
161- { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
162- "disallow MPPE stateful mode", OPT_PRIO | 1 },
163+ { "mppc", o_bool, &ccp_wantoptions[0].mppc,
164+ "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
165+ { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
166+ "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
167+ { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
168+ "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
169+ &ccp_allowoptions[0].mppc },
170+ { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
171+ "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
172+ &ccp_allowoptions[0].mppc },
173+ { "mppe", o_special, (void *)setmppe,
174+ "request MPPE encryption" },
175+ { "+mppe", o_special, (void *)setmppe,
176+ "request MPPE encryption" },
177+ { "nomppe", o_special_noarg, (void *)setnomppe,
178+ "don't allow MPPE encryption" },
179+ { "-mppe", o_special_noarg, (void *)setnomppe,
180+ "don't allow MPPE encryption" },
181 #endif /* MPPE */
182 
183     { NULL }
184@@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = {
185  */
186 #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
187                  || (opt).predictor_1 || (opt).predictor_2 \
188- || (opt).mppe)
189+ || (opt).lzs || (opt).mppc || (opt).mppe)
190 
191 /*
192  * Local state (mainly for handling reset-reqs and reset-acks).
193@@ -344,6 +324,100 @@ setdeflate(argv)
194     return 1;
195 }
196 
197+#ifdef MPPE
198+/*
199+ * Functions called from config options
200+ */
201+/*
202+ MPPE suboptions:
203+ required - require MPPE; disconnect if peer doesn't support it
204+ stateless - use stateless mode
205+ no40 - disable 40 bit keys
206+ no56 - disable 56 bit keys
207+ no128 - disable 128 bit keys
208+*/
209+int setmppe(char **argv)
210+{
211+ int i;
212+ char *str, cmdbuf[16];
213+
214+ ccp_allowoptions[0].mppe = 1;
215+ ccp_allowoptions[0].mppe_40 = 1;
216+ ccp_allowoptions[0].mppe_56 = 1;
217+ ccp_allowoptions[0].mppe_128 = 1;
218+ ccp_allowoptions[0].mppe_stateless = 0;
219+ ccp_wantoptions[0].mppe = 0;
220+
221+ str = *argv;
222+
223+ while (1) {
224+ i = 0;
225+ memset(cmdbuf, '\0', 16);
226+ while ((i < 16) && (*str != ',') && (*str != '\0'))
227+ cmdbuf[i++] = *str++;
228+ cmdbuf[i] = '\0';
229+ if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
230+ ccp_allowoptions[0].mppe_40 = 0;
231+ goto next_param;
232+ } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
233+ ccp_allowoptions[0].mppe_56 = 0;
234+ goto next_param;
235+ } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
236+ ccp_allowoptions[0].mppe_128 = 0;
237+ goto next_param;
238+ } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
239+ ccp_allowoptions[0].mppe_stateless = 1;
240+ goto next_param;
241+ } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
242+ ccp_wantoptions[0].mppe = 1;
243+ goto next_param;
244+ } else {
245+ option_error("invalid parameter '%s' for mppe option", cmdbuf);
246+ return 0;
247+ }
248+
249+ next_param:
250+ if (*str == ',') {
251+ str++;
252+ continue;
253+ }
254+ if (*str == '\0') {
255+ if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
256+ ccp_allowoptions[0].mppe_128)) {
257+ if (ccp_wantoptions[0].mppe == 1) {
258+ option_error("You require MPPE but you have switched off "
259+ "all encryption key lengths.");
260+ return 0;
261+ }
262+ ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
263+ ccp_wantoptions[0].mppe_stateless =
264+ ccp_allowoptions[0].mppe_stateless = 0;
265+ } else {
266+ ccp_allowoptions[0].mppe = 1;
267+ ccp_wantoptions[0].mppe_stateless =
268+ ccp_allowoptions[0].mppe_stateless;
269+ if (ccp_wantoptions[0].mppe == 1) {
270+ ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
271+ ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
272+ ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
273+ }
274+ }
275+ return 1;
276+ }
277+ }
278+}
279+
280+int setnomppe(void)
281+{
282+ ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
283+ ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
284+ ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
285+ ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
286+ ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
287+ return 1;
288+}
289+#endif /* MPPE */
290+
291 /*
292  * ccp_init - initialize CCP.
293  */
294@@ -378,6 +452,30 @@ ccp_init(unit)
295     ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
296 
297     ccp_allowoptions[0].predictor_1 = 1;
298+
299+ ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
300+ ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
301+ ccp_wantoptions[0].lzs_hists = 1;
302+ ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
303+ ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
304+ ccp_allowoptions[0].lzs_hists = 1;
305+
306+#ifdef MPPE
307+ /* by default allow and request MPPC... */
308+ ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
309+
310+ /* ... and allow but don't request MPPE */
311+ ccp_allowoptions[0].mppe = 1;
312+ ccp_allowoptions[0].mppe_40 = 1;
313+ ccp_allowoptions[0].mppe_56 = 1;
314+ ccp_allowoptions[0].mppe_128 = 1;
315+ ccp_allowoptions[0].mppe_stateless = 1;
316+ ccp_wantoptions[0].mppe = 0;
317+ ccp_wantoptions[0].mppe_40 = 0;
318+ ccp_wantoptions[0].mppe_56 = 0;
319+ ccp_wantoptions[0].mppe_128 = 0;
320+ ccp_wantoptions[0].mppe_stateless = 0;
321+#endif /* MPPE */
322 }
323 
324 /*
325@@ -455,11 +553,11 @@ ccp_input(unit, p, len)
326     if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
327     notice("Compression disabled by peer.");
328 #ifdef MPPE
329- if (ccp_gotoptions[unit].mppe) {
330+ if (ccp_wantoptions[unit].mppe) {
331         error("MPPE disabled, closing LCP");
332         lcp_close(unit, "MPPE disabled by peer");
333     }
334-#endif
335+#endif /* MPPE */
336     }
337 
338     /*
339@@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len)
340         break;
341     /* send a reset-ack, which the transmitter will see and
342        reset its compression state. */
343+
344+ /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
345+ but we do it in order to reset compressor; CCP_RESETACK is
346+ then silently discarded. See functions ppp_send_frame and
347+ ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
348+ confusion is caused by the fact that CCP code is splited
349+ into two parts - one part is handled by pppd, the other one
350+ is handled by kernel. */
351+
352     fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
353     break;
354 
355@@ -515,12 +622,11 @@ ccp_protrej(unit)
356     fsm_lowerdown(&ccp_fsm[unit]);
357 
358 #ifdef MPPE
359- if (ccp_gotoptions[unit].mppe) {
360+ if (ccp_wantoptions[unit].mppe) {
361     error("MPPE required but peer negotiation failed");
362     lcp_close(unit, "MPPE required but peer negotiation failed");
363     }
364-#endif
365-
366+#endif /* MPPE */
367 }
368 
369 /*
370@@ -537,7 +643,7 @@ ccp_resetci(f)
371     all_rejected[f->unit] = 0;
372 
373 #ifdef MPPE
374- if (go->mppe) {
375+ if (go->mppe || go->mppc) {
376     ccp_options *ao = &ccp_allowoptions[f->unit];
377     int auth_mschap_bits = auth_done[f->unit];
378     int numbits;
379@@ -551,80 +657,109 @@ ccp_resetci(f)
380      * NB: If MPPE is required, all other compression opts are invalid.
381      * So, we return right away if we can't do it.
382      */
383+ if (ccp_wantoptions[f->unit].mppe) {
384+ /* Leave only the mschap auth bits set */
385+ auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
386+ CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
387+ /* Count the mschap auths */
388+ auth_mschap_bits >>= CHAP_MS_SHIFT;
389+ numbits = 0;
390+ do {
391+ numbits += auth_mschap_bits & 1;
392+ auth_mschap_bits >>= 1;
393+ } while (auth_mschap_bits);
394+ if (numbits > 1) {
395+ error("MPPE required, but auth done in both directions.");
396+ lcp_close(f->unit, "MPPE required but not available");
397+ return;
398+ }
399+ if (!numbits) {
400+ error("MPPE required, but MS-CHAP[v2] auth not performed.");
401+ lcp_close(f->unit, "MPPE required but not available");
402+ return;
403+ }
404 
405- /* Leave only the mschap auth bits set */
406- auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
407- CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
408- /* Count the mschap auths */
409- auth_mschap_bits >>= CHAP_MS_SHIFT;
410- numbits = 0;
411- do {
412- numbits += auth_mschap_bits & 1;
413- auth_mschap_bits >>= 1;
414- } while (auth_mschap_bits);
415- if (numbits > 1) {
416- error("MPPE required, but auth done in both directions.");
417- lcp_close(f->unit, "MPPE required but not available");
418- return;
419- }
420- if (!numbits) {
421- error("MPPE required, but MS-CHAP[v2] auth not performed.");
422- lcp_close(f->unit, "MPPE required but not available");
423- return;
424- }
425-
426- /* A plugin (eg radius) may not have obtained key material. */
427- if (!mppe_keys_set) {
428- error("MPPE required, but keys are not available. "
429- "Possible plugin problem?");
430- lcp_close(f->unit, "MPPE required but not available");
431- return;
432- }
433-
434- /* LM auth not supported for MPPE */
435- if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
436- /* This might be noise */
437- if (go->mppe & MPPE_OPT_40) {
438- notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
439- go->mppe &= ~MPPE_OPT_40;
440- ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
441+ /* A plugin (eg radius) may not have obtained key material. */
442+ if (!mppe_keys_set) {
443+ error("MPPE required, but keys are not available. "
444+ "Possible plugin problem?");
445+ lcp_close(f->unit, "MPPE required but not available");
446+ return;
447         }
448     }
449 
450- /* Last check: can we actually negotiate something? */
451- if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
452- /* Could be misconfig, could be 40-bit disabled above. */
453- error("MPPE required, but both 40-bit and 128-bit disabled.");
454- lcp_close(f->unit, "MPPE required but not available");
455- return;
456+ /*
457+ * Check whether the kernel knows about the various
458+ * compression methods we might request. Key material
459+ * unimportant here.
460+ */
461+ if (go->mppc) {
462+ opt_buf[0] = CI_MPPE;
463+ opt_buf[1] = CILEN_MPPE;
464+ opt_buf[2] = 0;
465+ opt_buf[3] = 0;
466+ opt_buf[4] = 0;
467+ opt_buf[5] = MPPE_MPPC;
468+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
469+ go->mppc = 0;
470+ }
471+ if (go->mppe_40) {
472+ opt_buf[0] = CI_MPPE;
473+ opt_buf[1] = CILEN_MPPE;
474+ opt_buf[2] = MPPE_STATELESS;
475+ opt_buf[3] = 0;
476+ opt_buf[4] = 0;
477+ opt_buf[5] = MPPE_40BIT;
478+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
479+ go->mppe_40 = 0;
480+ }
481+ if (go->mppe_56) {
482+ opt_buf[0] = CI_MPPE;
483+ opt_buf[1] = CILEN_MPPE;
484+ opt_buf[2] = MPPE_STATELESS;
485+ opt_buf[3] = 0;
486+ opt_buf[4] = 0;
487+ opt_buf[5] = MPPE_56BIT;
488+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
489+ go->mppe_56 = 0;
490+ }
491+ if (go->mppe_128) {
492+ opt_buf[0] = CI_MPPE;
493+ opt_buf[1] = CILEN_MPPE;
494+ opt_buf[2] = MPPE_STATELESS;
495+ opt_buf[3] = 0;
496+ opt_buf[4] = 0;
497+ opt_buf[5] = MPPE_128BIT;
498+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
499+ go->mppe_128 = 0;
500+ }
501+ if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
502+ if (ccp_wantoptions[f->unit].mppe) {
503+ error("MPPE required, but kernel has no support.");
504+ lcp_close(f->unit, "MPPE required but not available");
505+ }
506+ go->mppe = go->mppe_stateless = 0;
507+ } else {
508+ /* MPPE is not compatible with other compression types */
509+ if (ccp_wantoptions[f->unit].mppe) {
510+ ao->bsd_compress = go->bsd_compress = 0;
511+ ao->predictor_1 = go->predictor_1 = 0;
512+ ao->predictor_2 = go->predictor_2 = 0;
513+ ao->deflate = go->deflate = 0;
514+ ao->lzs = go->lzs = 0;
515+ }
516     }
517-
518- /* sync options */
519- ao->mppe = go->mppe;
520- /* MPPE is not compatible with other compression types */
521- ao->bsd_compress = go->bsd_compress = 0;
522- ao->predictor_1 = go->predictor_1 = 0;
523- ao->predictor_2 = go->predictor_2 = 0;
524- ao->deflate = go->deflate = 0;
525     }
526 #endif /* MPPE */
527-
528- /*
529- * Check whether the kernel knows about the various
530- * compression methods we might request.
531- */
532-#ifdef MPPE
533- if (go->mppe) {
534- opt_buf[0] = CI_MPPE;
535- opt_buf[1] = CILEN_MPPE;
536- MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
537- /* Key material unimportant here. */
538- if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
539- error("MPPE required, but kernel has no support.");
540- lcp_close(f->unit, "MPPE required but not available");
541- }
542+ if (go->lzs) {
543+ opt_buf[0] = CI_LZS;
544+ opt_buf[1] = CILEN_LZS;
545+ opt_buf[2] = go->lzs_hists >> 8;
546+ opt_buf[3] = go->lzs_hists & 0xff;
547+ opt_buf[4] = LZS_MODE_SEQ;
548+ if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
549+ go->lzs = 0;
550     }
551-#endif
552     if (go->bsd_compress) {
553     opt_buf[0] = CI_BSD_COMPRESS;
554     opt_buf[1] = CILEN_BSD_COMPRESS;
555@@ -679,7 +814,8 @@ ccp_cilen(f)
556     + (go->deflate? CILEN_DEFLATE: 0)
557     + (go->predictor_1? CILEN_PREDICTOR_1: 0)
558     + (go->predictor_2? CILEN_PREDICTOR_2: 0)
559- + (go->mppe? CILEN_MPPE: 0);
560+ + (go->lzs? CILEN_LZS: 0)
561+ + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
562 }
563 
564 /*
565@@ -693,6 +829,8 @@ ccp_addci(f, p, lenp)
566 {
567     int res;
568     ccp_options *go = &ccp_gotoptions[f->unit];
569+ ccp_options *ao = &ccp_allowoptions[f->unit];
570+ ccp_options *wo = &ccp_wantoptions[f->unit];
571     u_char *p0 = p;
572 
573     /*
574@@ -701,22 +839,43 @@ ccp_addci(f, p, lenp)
575      * in case it gets Acked.
576      */
577 #ifdef MPPE
578- if (go->mppe) {
579+ if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
580     u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
581 
582- p[0] = opt_buf[0] = CI_MPPE;
583- p[1] = opt_buf[1] = CILEN_MPPE;
584- MPPE_OPTS_TO_CI(go->mppe, &p[2]);
585- MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
586+ p[0] = CI_MPPE;
587+ p[1] = CILEN_MPPE;
588+ p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
589+ p[3] = 0;
590+ p[4] = 0;
591+ p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
592+ (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
593+
594+ BCOPY(p, opt_buf, CILEN_MPPE);
595     BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
596     res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
597- if (res > 0)
598+ if (res > 0) {
599         p += CILEN_MPPE;
600- else
601+ } else {
602         /* This shouldn't happen, we've already tested it! */
603- lcp_close(f->unit, "MPPE required but not available in kernel");
604+ go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
605+ go->mppe_stateless = go->mppc = 0;
606+ if (ccp_wantoptions[f->unit].mppe)
607+ lcp_close(f->unit, "MPPE required but not available in kernel");
608+ }
609+ }
610+#endif /* MPPE */
611+ if (go->lzs) {
612+ p[0] = CI_LZS;
613+ p[1] = CILEN_LZS;
614+ p[2] = go->lzs_hists >> 8;
615+ p[3] = go->lzs_hists & 0xff;
616+ p[4] = LZS_MODE_SEQ;
617+ res = ccp_test(f->unit, p, CILEN_LZS, 0);
618+ if (res > 0) {
619+ p += CILEN_LZS;
620+ } else
621+ go->lzs = 0;
622     }
623-#endif
624     if (go->deflate) {
625     p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
626     p[1] = CILEN_DEFLATE;
627@@ -802,7 +961,7 @@ ccp_addci(f, p, lenp)
628 
629 /*
630  * ccp_ackci - process a received configure-ack, and return
631- * 1 iff the packet was OK.
632+ * 1 if the packet was OK.
633  */
634 static int
635 ccp_ackci(f, p, len)
636@@ -811,24 +970,44 @@ ccp_ackci(f, p, len)
637     int len;
638 {
639     ccp_options *go = &ccp_gotoptions[f->unit];
640+ ccp_options *ao = &ccp_allowoptions[f->unit];
641+ ccp_options *wo = &ccp_wantoptions[f->unit];
642     u_char *p0 = p;
643 
644 #ifdef MPPE
645- if (go->mppe) {
646- u_char opt_buf[CILEN_MPPE];
647-
648- opt_buf[0] = CI_MPPE;
649- opt_buf[1] = CILEN_MPPE;
650- MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
651- if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
652+ if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
653+ if (len < CILEN_MPPE
654+ || p[1] != CILEN_MPPE || p[0] != CI_MPPE
655+ || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
656+ || p[3] != 0
657+ || p[4] != 0
658+ || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
659+ (go->mppc ? MPPE_MPPC : 0))
660+ && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
661+ (go->mppc ? MPPE_MPPC : 0))
662+ && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
663+ (go->mppc ? MPPE_MPPC : 0))))
664         return 0;
665+ if (go->mppe_40 || go->mppe_56 || go->mppe_128)
666+ go->mppe = 1;
667     p += CILEN_MPPE;
668     len -= CILEN_MPPE;
669+ /* Cope with first/fast ack */
670+ if (p == p0 && len == 0)
671+ return 1;
672+ }
673+#endif /* MPPE */
674+ if (go->lzs) {
675+ if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
676+ || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
677+ || p[4] != LZS_MODE_SEQ)
678+ return 0;
679+ p += CILEN_LZS;
680+ len -= CILEN_LZS;
681     /* XXX Cope with first/fast ack */
682- if (len == 0)
683+ if (p == p0 && len == 0)
684         return 1;
685     }
686-#endif
687     if (go->deflate) {
688     if (len < CILEN_DEFLATE
689         || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
690@@ -901,6 +1080,8 @@ ccp_nakci(f, p, len, treat_as_reject)
691     int treat_as_reject;
692 {
693     ccp_options *go = &ccp_gotoptions[f->unit];
694+ ccp_options *ao = &ccp_allowoptions[f->unit];
695+ ccp_options *wo = &ccp_wantoptions[f->unit];
696     ccp_options no; /* options we've seen already */
697     ccp_options try; /* options to ask for next time */
698 
699@@ -908,28 +1089,100 @@ ccp_nakci(f, p, len, treat_as_reject)
700     try = *go;
701 
702 #ifdef MPPE
703- if (go->mppe && len >= CILEN_MPPE
704- && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
705- no.mppe = 1;
706- /*
707- * Peer wants us to use a different strength or other setting.
708- * Fail if we aren't willing to use his suggestion.
709- */
710- MPPE_CI_TO_OPTS(&p[2], try.mppe);
711- if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
712- error("Refusing MPPE stateful mode offered by peer");
713- try.mppe = 0;
714- } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
715- /* Peer must have set options we didn't request (suggest) */
716- try.mppe = 0;
717- }
718+ if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
719+ len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
720 
721- if (!try.mppe) {
722- error("MPPE required but peer negotiation failed");
723- lcp_close(f->unit, "MPPE required but peer negotiation failed");
724+ if (go->mppc) {
725+ no.mppc = 1;
726+ if (!(p[5] & MPPE_MPPC))
727+ try.mppc = 0;
728+ }
729+
730+ if (go->mppe)
731+ no.mppe = 1;
732+ if (go->mppe_40)
733+ no.mppe_40 = 1;
734+ if (go->mppe_56)
735+ no.mppe_56 = 1;
736+ if (go->mppe_128)
737+ no.mppe_128 = 1;
738+ if (go->mppe_stateless)
739+ no.mppe_stateless = 1;
740+
741+ if (ao->mppe_40) {
742+ if ((p[5] & MPPE_40BIT))
743+ try.mppe_40 = 1;
744+ else
745+ try.mppe_40 = (p[5] == 0) ? 1 : 0;
746+ }
747+ if (ao->mppe_56) {
748+ if ((p[5] & MPPE_56BIT))
749+ try.mppe_56 = 1;
750+ else
751+ try.mppe_56 = (p[5] == 0) ? 1 : 0;
752+ }
753+ if (ao->mppe_128) {
754+ if ((p[5] & MPPE_128BIT))
755+ try.mppe_128 = 1;
756+ else
757+ try.mppe_128 = (p[5] == 0) ? 1 : 0;
758+ }
759+
760+ if (ao->mppe_stateless) {
761+ if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
762+ try.mppe_stateless = 1;
763+ else
764+ try.mppe_stateless = 0;
765+ }
766+
767+ if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
768+ try.mppe = try.mppe_stateless = 0;
769+ if (wo->mppe) {
770+ /* we require encryption, but peer doesn't support it
771+ so we close connection */
772+ wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
773+ wo->mppe_56 = wo->mppe_128 = 0;
774+ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
775+ "key length");
776+ }
777+ }
778+ if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
779+ (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
780+ /* cannot negotiate key length */
781+ wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
782+ wo->mppe_56 = wo->mppe_128 = 0;
783+ lcp_close(f->unit, "Cannot negotiate MPPE key length");
784     }
785+ if (try.mppe_40 && try.mppe_56 && try.mppe_128)
786+ try.mppe_40 = try.mppe_56 = 0;
787+ else
788+ if (try.mppe_56 && try.mppe_128)
789+ try.mppe_56 = 0;
790+ else
791+ if (try.mppe_40 && try.mppe_128)
792+ try.mppe_40 = 0;
793+ else
794+ if (try.mppe_40 && try.mppe_56)
795+ try.mppe_40 = 0;
796+
797+ p += CILEN_MPPE;
798+ len -= CILEN_MPPE;
799     }
800 #endif /* MPPE */
801+
802+ if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
803+ no.lzs = 1;
804+ if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
805+ p[4] != LZS_MODE_EXT))
806+ try.lzs = 0;
807+ else {
808+ try.lzs_mode = p[4];
809+ try.lzs_hists = (p[2] << 8) | p[3];
810+ }
811+ p += CILEN_LZS;
812+ len -= CILEN_LZS;
813+ }
814+
815     if (go->deflate && len >= CILEN_DEFLATE
816     && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
817     && p[1] == CILEN_DEFLATE) {
818@@ -1002,14 +1255,50 @@ ccp_rejci(f, p, len)
819     return -1;
820 
821 #ifdef MPPE
822- if (go->mppe && len >= CILEN_MPPE
823+ if ((go->mppe || go->mppc) && len >= CILEN_MPPE
824     && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
825- error("MPPE required but peer refused");
826- lcp_close(f->unit, "MPPE required but peer refused");
827+ ccp_options *wo = &ccp_wantoptions[f->unit];
828+ if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
829+ p[3] != 0 ||
830+ p[4] != 0 ||
831+ p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
832+ (go->mppe_56 ? MPPE_56BIT : 0) |
833+ (go->mppe_128 ? MPPE_128BIT : 0) |
834+ (go->mppc ? MPPE_MPPC : 0)))
835+ return 0;
836+ if (go->mppc)
837+ try.mppc = 0;
838+ if (go->mppe) {
839+ try.mppe = 0;
840+ if (go->mppe_40)
841+ try.mppe_40 = 0;
842+ if (go->mppe_56)
843+ try.mppe_56 = 0;
844+ if (go->mppe_128)
845+ try.mppe_128 = 0;
846+ if (go->mppe_stateless)
847+ try.mppe_stateless = 0;
848+ if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
849+ try.mppe = try.mppe_stateless = 0;
850+ if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
851+ wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
852+ wo->mppe_56 = wo->mppe_128 = 0;
853+ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
854+ "key length");
855+ }
856+ }
857     p += CILEN_MPPE;
858     len -= CILEN_MPPE;
859     }
860-#endif
861+#endif /* MPPE */
862+ if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
863+ if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
864+ || p[4] != go->lzs_mode)
865+ return 0;
866+ try.lzs = 0;
867+ p += CILEN_LZS;
868+ len -= CILEN_LZS;
869+ }
870     if (go->deflate_correct && len >= CILEN_DEFLATE
871     && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
872     if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
873@@ -1073,14 +1362,15 @@ ccp_reqci(f, p, lenp, dont_nak)
874     int dont_nak;
875 {
876     int ret, newret, res;
877- u_char *p0, *retp;
878+ u_char *p0, *retp, p2, p5;
879     int len, clen, type, nb;
880     ccp_options *ho = &ccp_hisoptions[f->unit];
881     ccp_options *ao = &ccp_allowoptions[f->unit];
882+ ccp_options *wo = &ccp_wantoptions[f->unit];
883 #ifdef MPPE
884- bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
885- /* CI_MPPE, or due to other options? */
886-#endif
887+ u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
888+/* int mtu; */
889+#endif /* MPPE */
890 
891     ret = CONFACK;
892     retp = p0 = p;
893@@ -1103,106 +1393,302 @@ ccp_reqci(f, p, lenp, dont_nak)
894         switch (type) {
895 #ifdef MPPE
896         case CI_MPPE:
897- if (!ao->mppe || clen != CILEN_MPPE) {
898+ if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
899             newret = CONFREJ;
900             break;
901         }
902- MPPE_CI_TO_OPTS(&p[2], ho->mppe);
903-
904- /* Nak if anything unsupported or unknown are set. */
905- if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
906- newret = CONFNAK;
907- ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
908- }
909- if (ho->mppe & MPPE_OPT_UNKNOWN) {
910+ p2 = p[2];
911+ p5 = p[5];
912+ /* not sure what they want, tell 'em what we got */
913+ if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
914+ (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
915+ MPPE_MPPC)) != 0 || p[5] == 0) ||
916+ (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
917             newret = CONFNAK;
918- ho->mppe &= ~MPPE_OPT_UNKNOWN;
919- }
920-
921- /* Check state opt */
922- if (ho->mppe & MPPE_OPT_STATEFUL) {
923- /*
924- * We can Nak and request stateless, but it's a
925- * lot easier to just assume the peer will request
926- * it if he can do it; stateful mode is bad over
927- * the Internet -- which is where we expect MPPE.
928- */
929- if (refuse_mppe_stateful) {
930- error("Refusing MPPE stateful mode offered by peer");
931- newret = CONFREJ;
932- break;
933+ p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
934+ p[3] = 0;
935+ p[4] = 0;
936+ p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
937+ (wo->mppe_56 ? MPPE_56BIT : 0) |
938+ (wo->mppe_128 ? MPPE_128BIT : 0) |
939+ (wo->mppc ? MPPE_MPPC : 0);
940+ break;
941+ }
942+
943+ if ((p[5] & MPPE_MPPC)) {
944+ if (ao->mppc) {
945+ ho->mppc = 1;
946+ BCOPY(p, opt_buf, CILEN_MPPE);
947+ opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
948+ opt_buf[5] = MPPE_MPPC;
949+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
950+ ho->mppc = 0;
951+ p[5] &= ~MPPE_MPPC;
952+ newret = CONFNAK;
953+ }
954+ } else {
955+ newret = CONFREJ;
956+ if (wo->mppe || ao->mppe) {
957+ p[5] &= ~MPPE_MPPC;
958+ newret = CONFNAK;
959+ }
960             }
961         }
962-
963- /* Find out which of {S,L} are set. */
964- if ((ho->mppe & MPPE_OPT_128)
965- && (ho->mppe & MPPE_OPT_40)) {
966- /* Both are set, negotiate the strongest. */
967- newret = CONFNAK;
968- if (ao->mppe & MPPE_OPT_128)
969- ho->mppe &= ~MPPE_OPT_40;
970- else if (ao->mppe & MPPE_OPT_40)
971- ho->mppe &= ~MPPE_OPT_128;
972- else {
973- newret = CONFREJ;
974- break;
975- }
976- } else if (ho->mppe & MPPE_OPT_128) {
977- if (!(ao->mppe & MPPE_OPT_128)) {
978- newret = CONFREJ;
979- break;
980- }
981- } else if (ho->mppe & MPPE_OPT_40) {
982- if (!(ao->mppe & MPPE_OPT_40)) {
983- newret = CONFREJ;
984- break;
985- }
986+ if (ao->mppe)
987+ ho->mppe = 1;
988+
989+ if ((p[2] & MPPE_STATELESS)) {
990+ if (ao->mppe_stateless) {
991+ if (wo->mppe_stateless)
992+ ho->mppe_stateless = 1;
993+ else {
994+ newret = CONFNAK;
995+ if (!dont_nak)
996+ p[2] &= ~MPPE_STATELESS;
997+ }
998+ } else {
999+ newret = CONFNAK;
1000+ if (!dont_nak)
1001+ p[2] &= ~MPPE_STATELESS;
1002+ }
1003+ } else {
1004+ if (wo->mppe_stateless && !dont_nak) {
1005+ wo->mppe_stateless = 0;
1006+ newret = CONFNAK;
1007+ p[2] |= MPPE_STATELESS;
1008+ }
1009+ }
1010+
1011+ if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1012+ newret = CONFNAK;
1013+ if (ao->mppe_128) {
1014+ ho->mppe_128 = 1;
1015+ p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1016+ BCOPY(p, opt_buf, CILEN_MPPE);
1017+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1018+ MPPE_MAX_KEY_LEN);
1019+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1020+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1021+ ho->mppe_128 = 0;
1022+ p[5] |= (MPPE_40BIT|MPPE_56BIT);
1023+ p[5] &= ~MPPE_128BIT;
1024+ goto check_mppe_56_40;
1025+ }
1026+ goto check_mppe;
1027+ }
1028+ p[5] &= ~MPPE_128BIT;
1029+ goto check_mppe_56_40;
1030+ }
1031+ if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1032+ newret = CONFNAK;
1033+ if (ao->mppe_128) {
1034+ ho->mppe_128 = 1;
1035+ p[5] &= ~MPPE_56BIT;
1036+ BCOPY(p, opt_buf, CILEN_MPPE);
1037+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1038+ MPPE_MAX_KEY_LEN);
1039+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1040+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1041+ ho->mppe_128 = 0;
1042+ p[5] |= MPPE_56BIT;
1043+ p[5] &= ~MPPE_128BIT;
1044+ goto check_mppe_56;
1045+ }
1046+ goto check_mppe;
1047+ }
1048+ p[5] &= ~MPPE_128BIT;
1049+ goto check_mppe_56;
1050+ }
1051+ if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1052+ newret = CONFNAK;
1053+ if (ao->mppe_128) {
1054+ ho->mppe_128 = 1;
1055+ p[5] &= ~MPPE_40BIT;
1056+ BCOPY(p, opt_buf, CILEN_MPPE);
1057+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1058+ MPPE_MAX_KEY_LEN);
1059+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1060+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1061+ ho->mppe_128 = 0;
1062+ p[5] |= MPPE_40BIT;
1063+ p[5] &= ~MPPE_128BIT;
1064+ goto check_mppe_40;
1065+ }
1066+ goto check_mppe;
1067+ }
1068+ p[5] &= ~MPPE_128BIT;
1069+ goto check_mppe_40;
1070+ }
1071+ if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1072+ if (ao->mppe_128) {
1073+ ho->mppe_128 = 1;
1074+ BCOPY(p, opt_buf, CILEN_MPPE);
1075+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1076+ MPPE_MAX_KEY_LEN);
1077+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1078+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1079+ ho->mppe_128 = 0;
1080+ p[5] &= ~MPPE_128BIT;
1081+ newret = CONFNAK;
1082+ }
1083+ goto check_mppe;
1084+ }
1085+ p[5] &= ~MPPE_128BIT;
1086+ newret = CONFNAK;
1087+ goto check_mppe;
1088+ }
1089+ check_mppe_56_40:
1090+ if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1091+ newret = CONFNAK;
1092+ if (ao->mppe_56) {
1093+ ho->mppe_56 = 1;
1094+ p[5] &= ~MPPE_40BIT;
1095+ BCOPY(p, opt_buf, CILEN_MPPE);
1096+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1097+ MPPE_MAX_KEY_LEN);
1098+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1099+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1100+ ho->mppe_56 = 0;
1101+ p[5] |= MPPE_40BIT;
1102+ p[5] &= ~MPPE_56BIT;
1103+ newret = CONFNAK;
1104+ goto check_mppe_40;
1105+ }
1106+ goto check_mppe;
1107+ }
1108+ p[5] &= ~MPPE_56BIT;
1109+ goto check_mppe_40;
1110+ }
1111+ check_mppe_56:
1112+ if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1113+ if (ao->mppe_56) {
1114+ ho->mppe_56 = 1;
1115+ BCOPY(p, opt_buf, CILEN_MPPE);
1116+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1117+ MPPE_MAX_KEY_LEN);
1118+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1119+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1120+ ho->mppe_56 = 0;
1121+ p[5] &= ~MPPE_56BIT;
1122+ newret = CONFNAK;
1123+ }
1124+ goto check_mppe;
1125+ }
1126+ p[5] &= ~MPPE_56BIT;
1127+ newret = CONFNAK;
1128+ goto check_mppe;
1129+ }
1130+ check_mppe_40:
1131+ if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1132+ if (ao->mppe_40) {
1133+ ho->mppe_40 = 1;
1134+ BCOPY(p, opt_buf, CILEN_MPPE);
1135+ BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1136+ MPPE_MAX_KEY_LEN);
1137+ if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1138+ MPPE_MAX_KEY_LEN, 1) <= 0) {
1139+ ho->mppe_40 = 0;
1140+ p[5] &= ~MPPE_40BIT;
1141+ newret = CONFNAK;
1142+ }
1143+ goto check_mppe;
1144+ }
1145+ p[5] &= ~MPPE_40BIT;
1146+ }
1147+
1148+ check_mppe:
1149+ if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1150+ if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1151+ newret = CONFNAK;
1152+ p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1153+ p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1154+ (wo->mppe_56 ? MPPE_56BIT : 0) |
1155+ (wo->mppe_128 ? MPPE_128BIT : 0) |
1156+ (wo->mppc ? MPPE_MPPC : 0);
1157+ } else {
1158+ ho->mppe = ho->mppe_stateless = 0;
1159+ }
1160         } else {
1161- /* Neither are set. */
1162- /* We cannot accept this. */
1163- newret = CONFNAK;
1164- /* Give the peer our idea of what can be used,
1165- so it can choose and confirm */
1166- ho->mppe = ao->mppe;
1167- }
1168-
1169- /* rebuild the opts */
1170- MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1171- if (newret == CONFACK) {
1172- u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1173- int mtu;
1174-
1175- BCOPY(p, opt_buf, CILEN_MPPE);
1176- BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1177- MPPE_MAX_KEY_LEN);
1178- if (ccp_test(f->unit, opt_buf,
1179- CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1180- /* This shouldn't happen, we've already tested it! */
1181- error("MPPE required, but kernel has no support.");
1182- lcp_close(f->unit, "MPPE required but not available");
1183- newret = CONFREJ;
1184- break;
1185- }
1186- /*
1187- * We need to decrease the interface MTU by MPPE_PAD
1188- * because MPPE frames **grow**. The kernel [must]
1189- * allocate MPPE_PAD extra bytes in xmit buffers.
1190- */
1191- mtu = netif_get_mtu(f->unit);
1192- if (mtu)
1193- netif_set_mtu(f->unit, mtu - MPPE_PAD);
1194- else
1195- newret = CONFREJ;
1196- }
1197-
1198- /*
1199- * We have accepted MPPE or are willing to negotiate
1200- * MPPE parameters. A CONFREJ is due to subsequent
1201- * (non-MPPE) processing.
1202- */
1203- rej_for_ci_mppe = 0;
1204- break;
1205-#endif /* MPPE */
1206+ /* MPPE is not compatible with other compression types */
1207+ if (wo->mppe) {
1208+ ao->bsd_compress = 0;
1209+ ao->predictor_1 = 0;
1210+ ao->predictor_2 = 0;
1211+ ao->deflate = 0;
1212+ ao->lzs = 0;
1213+ }
1214+ }
1215+ if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1216+ p[2] = p2;
1217+ p[5] = p5;
1218+ newret = CONFREJ;
1219+ break;
1220+ }
1221+
1222+ /*
1223+ * I have commented the code below because according to RFC1547
1224+ * MTU is only information for higher level protocols about
1225+ * "the maximum allowable length for a packet (q.v.) transmitted
1226+ * over a point-to-point link without incurring network layer
1227+ * fragmentation." Of course a PPP implementation should be able
1228+ * to handle overhead added by MPPE - in our case apropriate code
1229+ * is located in drivers/net/ppp_generic.c in the kernel sources.
1230+ *
1231+ * According to RFC1661:
1232+ * - when negotiated MRU is less than 1500 octets, a PPP
1233+ * implementation must still be able to receive at least 1500
1234+ * octets,
1235+ * - when PFC is negotiated, a PPP implementation is still
1236+ * required to receive frames with uncompressed protocol field.
1237+ *
1238+ * So why not to handle MPPE overhead without changing MTU value?
1239+ * I am sure that RFC3078, unfortunately silently, assumes that.
1240+ */
1241+
1242+ /*
1243+ * We need to decrease the interface MTU by MPPE_PAD
1244+ * because MPPE frames **grow**. The kernel [must]
1245+ * allocate MPPE_PAD extra bytes in xmit buffers.
1246+ */
1247+ /*
1248+ mtu = netif_get_mtu(f->unit);
1249+ if (mtu) {
1250+ netif_set_mtu(f->unit, mtu - MPPE_PAD);
1251+ } else {
1252+ newret = CONFREJ;
1253+ if (ccp_wantoptions[f->unit].mppe) {
1254+ error("Cannot adjust MTU needed by MPPE.");
1255+ lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1256+ }
1257+ }
1258+ */
1259+ break;
1260+ #endif /* MPPE */
1261+
1262+ case CI_LZS:
1263+ if (!ao->lzs || clen != CILEN_LZS) {
1264+ newret = CONFREJ;
1265+ break;
1266+ }
1267+
1268+ ho->lzs = 1;
1269+ ho->lzs_hists = (p[2] << 8) | p[3];
1270+ ho->lzs_mode = p[4];
1271+ if ((ho->lzs_hists != ao->lzs_hists) ||
1272+ (ho->lzs_mode != ao->lzs_mode)) {
1273+ newret = CONFNAK;
1274+ if (!dont_nak) {
1275+ p[2] = ao->lzs_hists >> 8;
1276+ p[3] = ao->lzs_hists & 0xff;
1277+ p[4] = ao->lzs_mode;
1278+ } else
1279+ break;
1280+ }
1281+
1282+ if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1283+ newret = CONFREJ;
1284+ }
1285+ break;
1286         case CI_DEFLATE:
1287         case CI_DEFLATE_DRAFT:
1288         if (!ao->deflate || clen != CILEN_DEFLATE
1289@@ -1344,12 +1830,6 @@ ccp_reqci(f, p, lenp, dont_nak)
1290     else
1291         *lenp = retp - p0;
1292     }
1293-#ifdef MPPE
1294- if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1295- error("MPPE required but peer negotiation failed");
1296- lcp_close(f->unit, "MPPE required but peer negotiation failed");
1297- }
1298-#endif
1299     return ret;
1300 }
1301 
1302@@ -1371,24 +1851,35 @@ method_name(opt, opt2)
1303     char *p = result;
1304     char *q = result + sizeof(result); /* 1 past result */
1305 
1306- slprintf(p, q - p, "MPPE ");
1307- p += 5;
1308- if (opt->mppe & MPPE_OPT_128) {
1309- slprintf(p, q - p, "128-bit ");
1310- p += 8;
1311- }
1312- if (opt->mppe & MPPE_OPT_40) {
1313- slprintf(p, q - p, "40-bit ");
1314- p += 7;
1315- }
1316- if (opt->mppe & MPPE_OPT_STATEFUL)
1317- slprintf(p, q - p, "stateful");
1318- else
1319- slprintf(p, q - p, "stateless");
1320-
1321+ if (opt->mppe) {
1322+ if (opt->mppc) {
1323+ slprintf(p, q - p, "MPPC/MPPE ");
1324+ p += 10;
1325+ } else {
1326+ slprintf(p, q - p, "MPPE ");
1327+ p += 5;
1328+ }
1329+ if (opt->mppe_128) {
1330+ slprintf(p, q - p, "128-bit ");
1331+ p += 8;
1332+ } else if (opt->mppe_56) {
1333+ slprintf(p, q - p, "56-bit ");
1334+ p += 7;
1335+ } else if (opt->mppe_40) {
1336+ slprintf(p, q - p, "40-bit ");
1337+ p += 7;
1338+ }
1339+ if (opt->mppe_stateless)
1340+ slprintf(p, q - p, "stateless");
1341+ else
1342+ slprintf(p, q - p, "stateful");
1343+ } else if (opt->mppc)
1344+ slprintf(p, q - p, "MPPC");
1345     break;
1346     }
1347-#endif
1348+#endif /* MPPE */
1349+ case CI_LZS:
1350+ return "Stac LZS";
1351     case CI_DEFLATE:
1352     case CI_DEFLATE_DRAFT:
1353     if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1354@@ -1444,12 +1935,12 @@ ccp_up(f)
1355     } else if (ANY_COMPRESS(*ho))
1356     notice("%s transmit compression enabled", method_name(ho, NULL));
1357 #ifdef MPPE
1358- if (go->mppe) {
1359+ if (go->mppe || go->mppc) {
1360     BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1361     BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1362     continue_networks(f->unit); /* Bring up IP et al */
1363     }
1364-#endif
1365+#endif /* MPPE */
1366 }
1367 
1368 /*
1369@@ -1472,7 +1963,7 @@ ccp_down(f)
1370         lcp_close(f->unit, "MPPE disabled");
1371     }
1372     }
1373-#endif
1374+#endif /* MPPE */
1375 }
1376 
1377 /*
1378@@ -1532,24 +2023,28 @@ ccp_printpkt(p, plen, printer, arg)
1379 #ifdef MPPE
1380         case CI_MPPE:
1381         if (optlen >= CILEN_MPPE) {
1382- u_char mppe_opts;
1383-
1384- MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1385- printer(arg, "mppe %s %s %s %s %s %s%s",
1386- (p[2] & MPPE_H_BIT)? "+H": "-H",
1387- (p[5] & MPPE_M_BIT)? "+M": "-M",
1388- (p[5] & MPPE_S_BIT)? "+S": "-S",
1389- (p[5] & MPPE_L_BIT)? "+L": "-L",
1390+ printer(arg, "mppe %s %s %s %s %s %s",
1391+ (p[2] & MPPE_STATELESS)? "+H": "-H",
1392+ (p[5] & MPPE_56BIT)? "+M": "-M",
1393+ (p[5] & MPPE_128BIT)? "+S": "-S",
1394+ (p[5] & MPPE_40BIT)? "+L": "-L",
1395                 (p[5] & MPPE_D_BIT)? "+D": "-D",
1396- (p[5] & MPPE_C_BIT)? "+C": "-C",
1397- (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1398- if (mppe_opts & MPPE_OPT_UNKNOWN)
1399+ (p[5] & MPPE_MPPC)? "+C": "-C");
1400+ if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1401+ MPPE_D_BIT | MPPE_MPPC)) ||
1402+ (p[2] & ~MPPE_STATELESS))
1403             printer(arg, " (%.2x %.2x %.2x %.2x)",
1404                 p[2], p[3], p[4], p[5]);
1405             p += CILEN_MPPE;
1406         }
1407         break;
1408-#endif
1409+#endif /* MPPE */
1410+ case CI_LZS:
1411+ if (optlen >= CILEN_LZS) {
1412+ printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1413+ p += CILEN_LZS;
1414+ }
1415+ break;
1416         case CI_DEFLATE:
1417         case CI_DEFLATE_DRAFT:
1418         if (optlen >= CILEN_DEFLATE) {
1419@@ -1635,6 +2130,7 @@ ccp_datainput(unit, pkt, len)
1420         error("Lost compression sync: disabling compression");
1421         ccp_close(unit, "Lost compression sync");
1422 #ifdef MPPE
1423+ /* My module dosn't need this. J.D., 2003-07-06 */
1424         /*
1425          * If we were doing MPPE, we must also take the link down.
1426          */
1427@@ -1642,9 +2138,18 @@ ccp_datainput(unit, pkt, len)
1428         error("Too many MPPE errors, closing LCP");
1429         lcp_close(unit, "Too many MPPE errors");
1430         }
1431-#endif
1432+#endif /* MPPE */
1433     } else {
1434         /*
1435+ * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1436+ * and don't wait for CCP_RESETACK
1437+ */
1438+ if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1439+ (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1440+ fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1441+ return;
1442+ }
1443+ /*
1444          * Send a reset-request to reset the peer's compressor.
1445          * We don't do that if we are still waiting for an
1446          * acknowledgement to a previous reset-request.
1447--- a/pppd/ccp.h
1448+++ b/pppd/ccp.h
1449@@ -37,9 +37,17 @@ typedef struct ccp_options {
1450     bool predictor_2; /* do Predictor-2? */
1451     bool deflate_correct; /* use correct code for deflate? */
1452     bool deflate_draft; /* use draft RFC code for deflate? */
1453+ bool lzs; /* do Stac LZS? */
1454+ bool mppc; /* do MPPC? */
1455     bool mppe; /* do MPPE? */
1456+ bool mppe_40; /* allow 40 bit encryption? */
1457+ bool mppe_56; /* allow 56 bit encryption? */
1458+ bool mppe_128; /* allow 128 bit encryption? */
1459+ bool mppe_stateless; /* allow stateless encryption */
1460     u_short bsd_bits; /* # bits/code for BSD Compress */
1461     u_short deflate_size; /* lg(window size) for Deflate */
1462+ u_short lzs_mode; /* LZS check mode */
1463+ u_short lzs_hists; /* number of LZS histories */
1464     short method; /* code for chosen compression method */
1465 } ccp_options;
1466 
1467--- a/pppd/chap_ms.c
1468+++ b/pppd/chap_ms.c
1469@@ -898,13 +898,17 @@ set_mppe_enc_types(int policy, int types
1470     /*
1471      * Disable undesirable encryption types. Note that we don't ENABLE
1472      * any encryption types, to avoid overriding manual configuration.
1473+ *
1474+ * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1475      */
1476     switch(types) {
1477     case MPPE_ENC_TYPES_RC4_40:
1478- ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
1479+ ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
1480+ ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1481         break;
1482     case MPPE_ENC_TYPES_RC4_128:
1483- ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
1484+ ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
1485+ ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
1486         break;
1487     default:
1488         break;
1489

Archive Download this file

Branches:
backfire
history
master
release_2010-11-17
release_2010-12-14
release_2011-02-23
release_2011-05-28
release_2011-08-27
release_2011-11-13
release_2012-03-18
release_2012-04-09
release_2012-10-11
uclibc_nptl



interactive