201-mppe_mppc_1.1.patch 46 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495
  1. pppd: add support for MPPE and MPPC encryption and compression protocols
  2. This is a forward ported version of ppp-2.4.3-mppe-mppc-1.1.patch.gz found on
  3. http://mppe-mppc.alphacron.de/ .
  4. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  5. --- a/include/linux/ppp-comp.h
  6. +++ b/include/linux/ppp-comp.h
  7. @@ -36,7 +36,7 @@
  8. */
  9. /*
  10. - * ==FILEVERSION 20020319==
  11. + * ==FILEVERSION 20020715==
  12. *
  13. * NOTE TO MAINTAINERS:
  14. * If you modify this file at all, please set the above date.
  15. @@ -201,6 +201,33 @@ struct compressor {
  16. #define CI_MPPE 18 /* config option for MPPE */
  17. #define CILEN_MPPE 6 /* length of config option */
  18. +/* MPPE/MPPC definitions by J.D.*/
  19. +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
  20. +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
  21. +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
  22. +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
  23. +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
  24. +
  25. +/*
  26. + * Definitions for Stac LZS.
  27. + */
  28. +
  29. +#define CI_LZS 17 /* config option for Stac LZS */
  30. +#define CILEN_LZS 5 /* length of config option */
  31. +
  32. +#define LZS_OVHD 4 /* max. LZS overhead */
  33. +#define LZS_HIST_LEN 2048 /* LZS history size */
  34. +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
  35. +
  36. +#define LZS_MODE_NONE 0
  37. +#define LZS_MODE_LCB 1
  38. +#define LZS_MODE_CRC 2
  39. +#define LZS_MODE_SEQ 3
  40. +#define LZS_MODE_EXT 4
  41. +
  42. +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
  43. +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
  44. +
  45. /*
  46. * Definitions for other, as yet unsupported, compression methods.
  47. */
  48. --- a/include/net/ppp-comp.h
  49. +++ b/include/net/ppp-comp.h
  50. @@ -168,6 +168,33 @@ struct compressor {
  51. #define CI_MPPE 18 /* config option for MPPE */
  52. #define CILEN_MPPE 6 /* length of config option */
  53. +/* MPPE/MPPC definitions by J.D.*/
  54. +#define MPPE_STATELESS MPPE_H_BIT /* configuration bit H */
  55. +#define MPPE_40BIT MPPE_L_BIT /* configuration bit L */
  56. +#define MPPE_56BIT MPPE_M_BIT /* configuration bit M */
  57. +#define MPPE_128BIT MPPE_S_BIT /* configuration bit S */
  58. +#define MPPE_MPPC MPPE_C_BIT /* configuration bit C */
  59. +
  60. +/*
  61. + * Definitions for Stac LZS.
  62. + */
  63. +
  64. +#define CI_LZS 17 /* config option for Stac LZS */
  65. +#define CILEN_LZS 5 /* length of config option */
  66. +
  67. +#define LZS_OVHD 4 /* max. LZS overhead */
  68. +#define LZS_HIST_LEN 2048 /* LZS history size */
  69. +#define LZS_MAX_CCOUNT 0x0FFF /* max. coherency counter value */
  70. +
  71. +#define LZS_MODE_NONE 0
  72. +#define LZS_MODE_LCB 1
  73. +#define LZS_MODE_CRC 2
  74. +#define LZS_MODE_SEQ 3
  75. +#define LZS_MODE_EXT 4
  76. +
  77. +#define LZS_EXT_BIT_FLUSHED 0x80 /* bit A */
  78. +#define LZS_EXT_BIT_COMP 0x20 /* bit C */
  79. +
  80. /*
  81. * Definitions for other, as yet unsupported, compression methods.
  82. */
  83. --- a/pppd/ccp.c
  84. +++ b/pppd/ccp.c
  85. @@ -62,12 +62,10 @@ static int setdeflate __P((char **));
  86. static char bsd_value[8];
  87. static char deflate_value[8];
  88. -/*
  89. - * Option variables.
  90. - */
  91. #ifdef MPPE
  92. -bool refuse_mppe_stateful = 1; /* Allow stateful mode? */
  93. -#endif
  94. +static int setmppe(char **);
  95. +static int setnomppe(void);
  96. +#endif /* MPPE */
  97. static option_t ccp_option_list[] = {
  98. { "noccp", o_bool, &ccp_protent.enabled_flag,
  99. @@ -108,54 +106,36 @@ static option_t ccp_option_list[] = {
  100. "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
  101. &ccp_allowoptions[0].predictor_1 },
  102. + { "lzs", o_bool, &ccp_wantoptions[0].lzs,
  103. + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
  104. + { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
  105. + "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
  106. + { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
  107. + "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
  108. + &ccp_allowoptions[0].lzs },
  109. + { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
  110. + "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
  111. + &ccp_allowoptions[0].lzs },
  112. +
  113. #ifdef MPPE
  114. - /* MPPE options are symmetrical ... we only set wantoptions here */
  115. - { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
  116. - "require MPPE encryption",
  117. - OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
  118. - { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
  119. - "require MPPE encryption",
  120. - OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
  121. - { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
  122. - "don't allow MPPE encryption", OPT_PRIO },
  123. - { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
  124. - "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
  125. -
  126. - /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
  127. - { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
  128. - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
  129. - &ccp_wantoptions[0].mppe },
  130. - { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
  131. - "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
  132. - &ccp_wantoptions[0].mppe },
  133. - { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
  134. - "don't allow MPPE 40-bit encryption",
  135. - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
  136. - { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
  137. - "don't allow MPPE 40-bit encryption",
  138. - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
  139. - &ccp_wantoptions[0].mppe },
  140. -
  141. - { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
  142. - "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
  143. - &ccp_wantoptions[0].mppe },
  144. - { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
  145. - "require MPPE 128-bit encryption",
  146. - OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
  147. - &ccp_wantoptions[0].mppe },
  148. - { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
  149. - "don't allow MPPE 128-bit encryption",
  150. - OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
  151. - { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
  152. - "don't allow MPPE 128-bit encryption",
  153. - OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
  154. - &ccp_wantoptions[0].mppe },
  155. -
  156. - /* strange one; we always request stateless, but will we allow stateful? */
  157. - { "mppe-stateful", o_bool, &refuse_mppe_stateful,
  158. - "allow MPPE stateful mode", OPT_PRIO },
  159. - { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
  160. - "disallow MPPE stateful mode", OPT_PRIO | 1 },
  161. + { "mppc", o_bool, &ccp_wantoptions[0].mppc,
  162. + "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
  163. + { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
  164. + "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
  165. + { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
  166. + "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
  167. + &ccp_allowoptions[0].mppc },
  168. + { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
  169. + "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
  170. + &ccp_allowoptions[0].mppc },
  171. + { "mppe", o_special, (void *)setmppe,
  172. + "request MPPE encryption" },
  173. + { "+mppe", o_special, (void *)setmppe,
  174. + "request MPPE encryption" },
  175. + { "nomppe", o_special_noarg, (void *)setnomppe,
  176. + "don't allow MPPE encryption" },
  177. + { "-mppe", o_special_noarg, (void *)setnomppe,
  178. + "don't allow MPPE encryption" },
  179. #endif /* MPPE */
  180. { NULL }
  181. @@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = {
  182. */
  183. #define ANY_COMPRESS(opt) ((opt).deflate || (opt).bsd_compress \
  184. || (opt).predictor_1 || (opt).predictor_2 \
  185. - || (opt).mppe)
  186. + || (opt).lzs || (opt).mppc || (opt).mppe)
  187. /*
  188. * Local state (mainly for handling reset-reqs and reset-acks).
  189. @@ -344,6 +324,100 @@ setdeflate(argv)
  190. return 1;
  191. }
  192. +#ifdef MPPE
  193. +/*
  194. + * Functions called from config options
  195. + */
  196. +/*
  197. + MPPE suboptions:
  198. + required - require MPPE; disconnect if peer doesn't support it
  199. + stateless - use stateless mode
  200. + no40 - disable 40 bit keys
  201. + no56 - disable 56 bit keys
  202. + no128 - disable 128 bit keys
  203. +*/
  204. +int setmppe(char **argv)
  205. +{
  206. + int i;
  207. + char *str, cmdbuf[16];
  208. +
  209. + ccp_allowoptions[0].mppe = 1;
  210. + ccp_allowoptions[0].mppe_40 = 1;
  211. + ccp_allowoptions[0].mppe_56 = 1;
  212. + ccp_allowoptions[0].mppe_128 = 1;
  213. + ccp_allowoptions[0].mppe_stateless = 0;
  214. + ccp_wantoptions[0].mppe = 0;
  215. +
  216. + str = *argv;
  217. +
  218. + while (1) {
  219. + i = 0;
  220. + memset(cmdbuf, '\0', 16);
  221. + while ((i < 16) && (*str != ',') && (*str != '\0'))
  222. + cmdbuf[i++] = *str++;
  223. + cmdbuf[i] = '\0';
  224. + if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
  225. + ccp_allowoptions[0].mppe_40 = 0;
  226. + goto next_param;
  227. + } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
  228. + ccp_allowoptions[0].mppe_56 = 0;
  229. + goto next_param;
  230. + } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
  231. + ccp_allowoptions[0].mppe_128 = 0;
  232. + goto next_param;
  233. + } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
  234. + ccp_allowoptions[0].mppe_stateless = 1;
  235. + goto next_param;
  236. + } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
  237. + ccp_wantoptions[0].mppe = 1;
  238. + goto next_param;
  239. + } else {
  240. + option_error("invalid parameter '%s' for mppe option", cmdbuf);
  241. + return 0;
  242. + }
  243. +
  244. + next_param:
  245. + if (*str == ',') {
  246. + str++;
  247. + continue;
  248. + }
  249. + if (*str == '\0') {
  250. + if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
  251. + ccp_allowoptions[0].mppe_128)) {
  252. + if (ccp_wantoptions[0].mppe == 1) {
  253. + option_error("You require MPPE but you have switched off "
  254. + "all encryption key lengths.");
  255. + return 0;
  256. + }
  257. + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
  258. + ccp_wantoptions[0].mppe_stateless =
  259. + ccp_allowoptions[0].mppe_stateless = 0;
  260. + } else {
  261. + ccp_allowoptions[0].mppe = 1;
  262. + ccp_wantoptions[0].mppe_stateless =
  263. + ccp_allowoptions[0].mppe_stateless;
  264. + if (ccp_wantoptions[0].mppe == 1) {
  265. + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
  266. + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
  267. + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
  268. + }
  269. + }
  270. + return 1;
  271. + }
  272. + }
  273. +}
  274. +
  275. +int setnomppe(void)
  276. +{
  277. + ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
  278. + ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
  279. + ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
  280. + ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
  281. + ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
  282. + return 1;
  283. +}
  284. +#endif /* MPPE */
  285. +
  286. /*
  287. * ccp_init - initialize CCP.
  288. */
  289. @@ -378,6 +452,30 @@ ccp_init(unit)
  290. ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
  291. ccp_allowoptions[0].predictor_1 = 1;
  292. +
  293. + ccp_wantoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
  294. + ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
  295. + ccp_wantoptions[0].lzs_hists = 1;
  296. + ccp_allowoptions[0].lzs = 0; /* Stac LZS - will be enabled in the future */
  297. + ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
  298. + ccp_allowoptions[0].lzs_hists = 1;
  299. +
  300. +#ifdef MPPE
  301. + /* by default allow and request MPPC... */
  302. + ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
  303. +
  304. + /* ... and allow but don't request MPPE */
  305. + ccp_allowoptions[0].mppe = 1;
  306. + ccp_allowoptions[0].mppe_40 = 1;
  307. + ccp_allowoptions[0].mppe_56 = 1;
  308. + ccp_allowoptions[0].mppe_128 = 1;
  309. + ccp_allowoptions[0].mppe_stateless = 1;
  310. + ccp_wantoptions[0].mppe = 0;
  311. + ccp_wantoptions[0].mppe_40 = 0;
  312. + ccp_wantoptions[0].mppe_56 = 0;
  313. + ccp_wantoptions[0].mppe_128 = 0;
  314. + ccp_wantoptions[0].mppe_stateless = 0;
  315. +#endif /* MPPE */
  316. }
  317. /*
  318. @@ -455,11 +553,11 @@ ccp_input(unit, p, len)
  319. if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
  320. notice("Compression disabled by peer.");
  321. #ifdef MPPE
  322. - if (ccp_gotoptions[unit].mppe) {
  323. + if (ccp_wantoptions[unit].mppe) {
  324. error("MPPE disabled, closing LCP");
  325. lcp_close(unit, "MPPE disabled by peer");
  326. }
  327. -#endif
  328. +#endif /* MPPE */
  329. }
  330. /*
  331. @@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len)
  332. break;
  333. /* send a reset-ack, which the transmitter will see and
  334. reset its compression state. */
  335. +
  336. + /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
  337. + but we do it in order to reset compressor; CCP_RESETACK is
  338. + then silently discarded. See functions ppp_send_frame and
  339. + ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
  340. + confusion is caused by the fact that CCP code is splited
  341. + into two parts - one part is handled by pppd, the other one
  342. + is handled by kernel. */
  343. +
  344. fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
  345. break;
  346. @@ -515,12 +622,11 @@ ccp_protrej(unit)
  347. fsm_lowerdown(&ccp_fsm[unit]);
  348. #ifdef MPPE
  349. - if (ccp_gotoptions[unit].mppe) {
  350. + if (ccp_wantoptions[unit].mppe) {
  351. error("MPPE required but peer negotiation failed");
  352. lcp_close(unit, "MPPE required but peer negotiation failed");
  353. }
  354. -#endif
  355. -
  356. +#endif /* MPPE */
  357. }
  358. /*
  359. @@ -537,7 +643,7 @@ ccp_resetci(f)
  360. all_rejected[f->unit] = 0;
  361. #ifdef MPPE
  362. - if (go->mppe) {
  363. + if (go->mppe || go->mppc) {
  364. ccp_options *ao = &ccp_allowoptions[f->unit];
  365. int auth_mschap_bits = auth_done[f->unit];
  366. int numbits;
  367. @@ -551,80 +657,109 @@ ccp_resetci(f)
  368. * NB: If MPPE is required, all other compression opts are invalid.
  369. * So, we return right away if we can't do it.
  370. */
  371. + if (ccp_wantoptions[f->unit].mppe) {
  372. + /* Leave only the mschap auth bits set */
  373. + auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
  374. + CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
  375. + /* Count the mschap auths */
  376. + auth_mschap_bits >>= CHAP_MS_SHIFT;
  377. + numbits = 0;
  378. + do {
  379. + numbits += auth_mschap_bits & 1;
  380. + auth_mschap_bits >>= 1;
  381. + } while (auth_mschap_bits);
  382. + if (numbits > 1) {
  383. + error("MPPE required, but auth done in both directions.");
  384. + lcp_close(f->unit, "MPPE required but not available");
  385. + return;
  386. + }
  387. + if (!numbits) {
  388. + error("MPPE required, but MS-CHAP[v2] auth not performed.");
  389. + lcp_close(f->unit, "MPPE required but not available");
  390. + return;
  391. + }
  392. - /* Leave only the mschap auth bits set */
  393. - auth_mschap_bits &= (CHAP_MS_WITHPEER | CHAP_MS_PEER |
  394. - CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
  395. - /* Count the mschap auths */
  396. - auth_mschap_bits >>= CHAP_MS_SHIFT;
  397. - numbits = 0;
  398. - do {
  399. - numbits += auth_mschap_bits & 1;
  400. - auth_mschap_bits >>= 1;
  401. - } while (auth_mschap_bits);
  402. - if (numbits > 1) {
  403. - error("MPPE required, but auth done in both directions.");
  404. - lcp_close(f->unit, "MPPE required but not available");
  405. - return;
  406. - }
  407. - if (!numbits) {
  408. - error("MPPE required, but MS-CHAP[v2] auth not performed.");
  409. - lcp_close(f->unit, "MPPE required but not available");
  410. - return;
  411. - }
  412. -
  413. - /* A plugin (eg radius) may not have obtained key material. */
  414. - if (!mppe_keys_set) {
  415. - error("MPPE required, but keys are not available. "
  416. - "Possible plugin problem?");
  417. - lcp_close(f->unit, "MPPE required but not available");
  418. - return;
  419. - }
  420. -
  421. - /* LM auth not supported for MPPE */
  422. - if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
  423. - /* This might be noise */
  424. - if (go->mppe & MPPE_OPT_40) {
  425. - notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
  426. - go->mppe &= ~MPPE_OPT_40;
  427. - ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
  428. + /* A plugin (eg radius) may not have obtained key material. */
  429. + if (!mppe_keys_set) {
  430. + error("MPPE required, but keys are not available. "
  431. + "Possible plugin problem?");
  432. + lcp_close(f->unit, "MPPE required but not available");
  433. + return;
  434. }
  435. }
  436. - /* Last check: can we actually negotiate something? */
  437. - if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
  438. - /* Could be misconfig, could be 40-bit disabled above. */
  439. - error("MPPE required, but both 40-bit and 128-bit disabled.");
  440. - lcp_close(f->unit, "MPPE required but not available");
  441. - return;
  442. + /*
  443. + * Check whether the kernel knows about the various
  444. + * compression methods we might request. Key material
  445. + * unimportant here.
  446. + */
  447. + if (go->mppc) {
  448. + opt_buf[0] = CI_MPPE;
  449. + opt_buf[1] = CILEN_MPPE;
  450. + opt_buf[2] = 0;
  451. + opt_buf[3] = 0;
  452. + opt_buf[4] = 0;
  453. + opt_buf[5] = MPPE_MPPC;
  454. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
  455. + go->mppc = 0;
  456. + }
  457. + if (go->mppe_40) {
  458. + opt_buf[0] = CI_MPPE;
  459. + opt_buf[1] = CILEN_MPPE;
  460. + opt_buf[2] = MPPE_STATELESS;
  461. + opt_buf[3] = 0;
  462. + opt_buf[4] = 0;
  463. + opt_buf[5] = MPPE_40BIT;
  464. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
  465. + go->mppe_40 = 0;
  466. + }
  467. + if (go->mppe_56) {
  468. + opt_buf[0] = CI_MPPE;
  469. + opt_buf[1] = CILEN_MPPE;
  470. + opt_buf[2] = MPPE_STATELESS;
  471. + opt_buf[3] = 0;
  472. + opt_buf[4] = 0;
  473. + opt_buf[5] = MPPE_56BIT;
  474. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
  475. + go->mppe_56 = 0;
  476. + }
  477. + if (go->mppe_128) {
  478. + opt_buf[0] = CI_MPPE;
  479. + opt_buf[1] = CILEN_MPPE;
  480. + opt_buf[2] = MPPE_STATELESS;
  481. + opt_buf[3] = 0;
  482. + opt_buf[4] = 0;
  483. + opt_buf[5] = MPPE_128BIT;
  484. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
  485. + go->mppe_128 = 0;
  486. + }
  487. + if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
  488. + if (ccp_wantoptions[f->unit].mppe) {
  489. + error("MPPE required, but kernel has no support.");
  490. + lcp_close(f->unit, "MPPE required but not available");
  491. + }
  492. + go->mppe = go->mppe_stateless = 0;
  493. + } else {
  494. + /* MPPE is not compatible with other compression types */
  495. + if (ccp_wantoptions[f->unit].mppe) {
  496. + ao->bsd_compress = go->bsd_compress = 0;
  497. + ao->predictor_1 = go->predictor_1 = 0;
  498. + ao->predictor_2 = go->predictor_2 = 0;
  499. + ao->deflate = go->deflate = 0;
  500. + ao->lzs = go->lzs = 0;
  501. + }
  502. }
  503. -
  504. - /* sync options */
  505. - ao->mppe = go->mppe;
  506. - /* MPPE is not compatible with other compression types */
  507. - ao->bsd_compress = go->bsd_compress = 0;
  508. - ao->predictor_1 = go->predictor_1 = 0;
  509. - ao->predictor_2 = go->predictor_2 = 0;
  510. - ao->deflate = go->deflate = 0;
  511. }
  512. #endif /* MPPE */
  513. -
  514. - /*
  515. - * Check whether the kernel knows about the various
  516. - * compression methods we might request.
  517. - */
  518. -#ifdef MPPE
  519. - if (go->mppe) {
  520. - opt_buf[0] = CI_MPPE;
  521. - opt_buf[1] = CILEN_MPPE;
  522. - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
  523. - /* Key material unimportant here. */
  524. - if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
  525. - error("MPPE required, but kernel has no support.");
  526. - lcp_close(f->unit, "MPPE required but not available");
  527. - }
  528. + if (go->lzs) {
  529. + opt_buf[0] = CI_LZS;
  530. + opt_buf[1] = CILEN_LZS;
  531. + opt_buf[2] = go->lzs_hists >> 8;
  532. + opt_buf[3] = go->lzs_hists & 0xff;
  533. + opt_buf[4] = LZS_MODE_SEQ;
  534. + if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
  535. + go->lzs = 0;
  536. }
  537. -#endif
  538. if (go->bsd_compress) {
  539. opt_buf[0] = CI_BSD_COMPRESS;
  540. opt_buf[1] = CILEN_BSD_COMPRESS;
  541. @@ -679,7 +814,8 @@ ccp_cilen(f)
  542. + (go->deflate? CILEN_DEFLATE: 0)
  543. + (go->predictor_1? CILEN_PREDICTOR_1: 0)
  544. + (go->predictor_2? CILEN_PREDICTOR_2: 0)
  545. - + (go->mppe? CILEN_MPPE: 0);
  546. + + (go->lzs? CILEN_LZS: 0)
  547. + + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
  548. }
  549. /*
  550. @@ -693,6 +829,8 @@ ccp_addci(f, p, lenp)
  551. {
  552. int res;
  553. ccp_options *go = &ccp_gotoptions[f->unit];
  554. + ccp_options *ao = &ccp_allowoptions[f->unit];
  555. + ccp_options *wo = &ccp_wantoptions[f->unit];
  556. u_char *p0 = p;
  557. /*
  558. @@ -701,22 +839,43 @@ ccp_addci(f, p, lenp)
  559. * in case it gets Acked.
  560. */
  561. #ifdef MPPE
  562. - if (go->mppe) {
  563. + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
  564. u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
  565. - p[0] = opt_buf[0] = CI_MPPE;
  566. - p[1] = opt_buf[1] = CILEN_MPPE;
  567. - MPPE_OPTS_TO_CI(go->mppe, &p[2]);
  568. - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
  569. + p[0] = CI_MPPE;
  570. + p[1] = CILEN_MPPE;
  571. + p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
  572. + p[3] = 0;
  573. + p[4] = 0;
  574. + p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
  575. + (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
  576. +
  577. + BCOPY(p, opt_buf, CILEN_MPPE);
  578. BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
  579. res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
  580. - if (res > 0)
  581. + if (res > 0) {
  582. p += CILEN_MPPE;
  583. - else
  584. + } else {
  585. /* This shouldn't happen, we've already tested it! */
  586. - lcp_close(f->unit, "MPPE required but not available in kernel");
  587. + go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
  588. + go->mppe_stateless = go->mppc = 0;
  589. + if (ccp_wantoptions[f->unit].mppe)
  590. + lcp_close(f->unit, "MPPE required but not available in kernel");
  591. + }
  592. + }
  593. +#endif /* MPPE */
  594. + if (go->lzs) {
  595. + p[0] = CI_LZS;
  596. + p[1] = CILEN_LZS;
  597. + p[2] = go->lzs_hists >> 8;
  598. + p[3] = go->lzs_hists & 0xff;
  599. + p[4] = LZS_MODE_SEQ;
  600. + res = ccp_test(f->unit, p, CILEN_LZS, 0);
  601. + if (res > 0) {
  602. + p += CILEN_LZS;
  603. + } else
  604. + go->lzs = 0;
  605. }
  606. -#endif
  607. if (go->deflate) {
  608. p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
  609. p[1] = CILEN_DEFLATE;
  610. @@ -802,7 +961,7 @@ ccp_addci(f, p, lenp)
  611. /*
  612. * ccp_ackci - process a received configure-ack, and return
  613. - * 1 iff the packet was OK.
  614. + * 1 if the packet was OK.
  615. */
  616. static int
  617. ccp_ackci(f, p, len)
  618. @@ -811,24 +970,44 @@ ccp_ackci(f, p, len)
  619. int len;
  620. {
  621. ccp_options *go = &ccp_gotoptions[f->unit];
  622. + ccp_options *ao = &ccp_allowoptions[f->unit];
  623. + ccp_options *wo = &ccp_wantoptions[f->unit];
  624. u_char *p0 = p;
  625. #ifdef MPPE
  626. - if (go->mppe) {
  627. - u_char opt_buf[CILEN_MPPE];
  628. -
  629. - opt_buf[0] = CI_MPPE;
  630. - opt_buf[1] = CILEN_MPPE;
  631. - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
  632. - if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
  633. + if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
  634. + if (len < CILEN_MPPE
  635. + || p[1] != CILEN_MPPE || p[0] != CI_MPPE
  636. + || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
  637. + || p[3] != 0
  638. + || p[4] != 0
  639. + || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
  640. + (go->mppc ? MPPE_MPPC : 0))
  641. + && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
  642. + (go->mppc ? MPPE_MPPC : 0))
  643. + && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
  644. + (go->mppc ? MPPE_MPPC : 0))))
  645. return 0;
  646. + if (go->mppe_40 || go->mppe_56 || go->mppe_128)
  647. + go->mppe = 1;
  648. p += CILEN_MPPE;
  649. len -= CILEN_MPPE;
  650. + /* Cope with first/fast ack */
  651. + if (p == p0 && len == 0)
  652. + return 1;
  653. + }
  654. +#endif /* MPPE */
  655. + if (go->lzs) {
  656. + if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
  657. + || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
  658. + || p[4] != LZS_MODE_SEQ)
  659. + return 0;
  660. + p += CILEN_LZS;
  661. + len -= CILEN_LZS;
  662. /* XXX Cope with first/fast ack */
  663. - if (len == 0)
  664. + if (p == p0 && len == 0)
  665. return 1;
  666. }
  667. -#endif
  668. if (go->deflate) {
  669. if (len < CILEN_DEFLATE
  670. || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
  671. @@ -901,6 +1080,8 @@ ccp_nakci(f, p, len, treat_as_reject)
  672. int treat_as_reject;
  673. {
  674. ccp_options *go = &ccp_gotoptions[f->unit];
  675. + ccp_options *ao = &ccp_allowoptions[f->unit];
  676. + ccp_options *wo = &ccp_wantoptions[f->unit];
  677. ccp_options no; /* options we've seen already */
  678. ccp_options try; /* options to ask for next time */
  679. @@ -908,28 +1089,100 @@ ccp_nakci(f, p, len, treat_as_reject)
  680. try = *go;
  681. #ifdef MPPE
  682. - if (go->mppe && len >= CILEN_MPPE
  683. - && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
  684. - no.mppe = 1;
  685. - /*
  686. - * Peer wants us to use a different strength or other setting.
  687. - * Fail if we aren't willing to use his suggestion.
  688. - */
  689. - MPPE_CI_TO_OPTS(&p[2], try.mppe);
  690. - if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
  691. - error("Refusing MPPE stateful mode offered by peer");
  692. - try.mppe = 0;
  693. - } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
  694. - /* Peer must have set options we didn't request (suggest) */
  695. - try.mppe = 0;
  696. - }
  697. + if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
  698. + len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
  699. - if (!try.mppe) {
  700. - error("MPPE required but peer negotiation failed");
  701. - lcp_close(f->unit, "MPPE required but peer negotiation failed");
  702. + if (go->mppc) {
  703. + no.mppc = 1;
  704. + if (!(p[5] & MPPE_MPPC))
  705. + try.mppc = 0;
  706. + }
  707. +
  708. + if (go->mppe)
  709. + no.mppe = 1;
  710. + if (go->mppe_40)
  711. + no.mppe_40 = 1;
  712. + if (go->mppe_56)
  713. + no.mppe_56 = 1;
  714. + if (go->mppe_128)
  715. + no.mppe_128 = 1;
  716. + if (go->mppe_stateless)
  717. + no.mppe_stateless = 1;
  718. +
  719. + if (ao->mppe_40) {
  720. + if ((p[5] & MPPE_40BIT))
  721. + try.mppe_40 = 1;
  722. + else
  723. + try.mppe_40 = (p[5] == 0) ? 1 : 0;
  724. + }
  725. + if (ao->mppe_56) {
  726. + if ((p[5] & MPPE_56BIT))
  727. + try.mppe_56 = 1;
  728. + else
  729. + try.mppe_56 = (p[5] == 0) ? 1 : 0;
  730. + }
  731. + if (ao->mppe_128) {
  732. + if ((p[5] & MPPE_128BIT))
  733. + try.mppe_128 = 1;
  734. + else
  735. + try.mppe_128 = (p[5] == 0) ? 1 : 0;
  736. + }
  737. +
  738. + if (ao->mppe_stateless) {
  739. + if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
  740. + try.mppe_stateless = 1;
  741. + else
  742. + try.mppe_stateless = 0;
  743. + }
  744. +
  745. + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
  746. + try.mppe = try.mppe_stateless = 0;
  747. + if (wo->mppe) {
  748. + /* we require encryption, but peer doesn't support it
  749. + so we close connection */
  750. + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
  751. + wo->mppe_56 = wo->mppe_128 = 0;
  752. + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
  753. + "key length");
  754. + }
  755. + }
  756. + if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
  757. + (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
  758. + /* cannot negotiate key length */
  759. + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
  760. + wo->mppe_56 = wo->mppe_128 = 0;
  761. + lcp_close(f->unit, "Cannot negotiate MPPE key length");
  762. }
  763. + if (try.mppe_40 && try.mppe_56 && try.mppe_128)
  764. + try.mppe_40 = try.mppe_56 = 0;
  765. + else
  766. + if (try.mppe_56 && try.mppe_128)
  767. + try.mppe_56 = 0;
  768. + else
  769. + if (try.mppe_40 && try.mppe_128)
  770. + try.mppe_40 = 0;
  771. + else
  772. + if (try.mppe_40 && try.mppe_56)
  773. + try.mppe_40 = 0;
  774. +
  775. + p += CILEN_MPPE;
  776. + len -= CILEN_MPPE;
  777. }
  778. #endif /* MPPE */
  779. +
  780. + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
  781. + no.lzs = 1;
  782. + if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
  783. + p[4] != LZS_MODE_EXT))
  784. + try.lzs = 0;
  785. + else {
  786. + try.lzs_mode = p[4];
  787. + try.lzs_hists = (p[2] << 8) | p[3];
  788. + }
  789. + p += CILEN_LZS;
  790. + len -= CILEN_LZS;
  791. + }
  792. +
  793. if (go->deflate && len >= CILEN_DEFLATE
  794. && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
  795. && p[1] == CILEN_DEFLATE) {
  796. @@ -1002,14 +1255,50 @@ ccp_rejci(f, p, len)
  797. return -1;
  798. #ifdef MPPE
  799. - if (go->mppe && len >= CILEN_MPPE
  800. + if ((go->mppe || go->mppc) && len >= CILEN_MPPE
  801. && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
  802. - error("MPPE required but peer refused");
  803. - lcp_close(f->unit, "MPPE required but peer refused");
  804. + ccp_options *wo = &ccp_wantoptions[f->unit];
  805. + if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
  806. + p[3] != 0 ||
  807. + p[4] != 0 ||
  808. + p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
  809. + (go->mppe_56 ? MPPE_56BIT : 0) |
  810. + (go->mppe_128 ? MPPE_128BIT : 0) |
  811. + (go->mppc ? MPPE_MPPC : 0)))
  812. + return 0;
  813. + if (go->mppc)
  814. + try.mppc = 0;
  815. + if (go->mppe) {
  816. + try.mppe = 0;
  817. + if (go->mppe_40)
  818. + try.mppe_40 = 0;
  819. + if (go->mppe_56)
  820. + try.mppe_56 = 0;
  821. + if (go->mppe_128)
  822. + try.mppe_128 = 0;
  823. + if (go->mppe_stateless)
  824. + try.mppe_stateless = 0;
  825. + if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
  826. + try.mppe = try.mppe_stateless = 0;
  827. + if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
  828. + wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
  829. + wo->mppe_56 = wo->mppe_128 = 0;
  830. + lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
  831. + "key length");
  832. + }
  833. + }
  834. p += CILEN_MPPE;
  835. len -= CILEN_MPPE;
  836. }
  837. -#endif
  838. +#endif /* MPPE */
  839. + if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
  840. + if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
  841. + || p[4] != go->lzs_mode)
  842. + return 0;
  843. + try.lzs = 0;
  844. + p += CILEN_LZS;
  845. + len -= CILEN_LZS;
  846. + }
  847. if (go->deflate_correct && len >= CILEN_DEFLATE
  848. && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
  849. if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
  850. @@ -1073,14 +1362,15 @@ ccp_reqci(f, p, lenp, dont_nak)
  851. int dont_nak;
  852. {
  853. int ret, newret, res;
  854. - u_char *p0, *retp;
  855. + u_char *p0, *retp, p2, p5;
  856. int len, clen, type, nb;
  857. ccp_options *ho = &ccp_hisoptions[f->unit];
  858. ccp_options *ao = &ccp_allowoptions[f->unit];
  859. + ccp_options *wo = &ccp_wantoptions[f->unit];
  860. #ifdef MPPE
  861. - bool rej_for_ci_mppe = 1; /* Are we rejecting based on a bad/missing */
  862. - /* CI_MPPE, or due to other options? */
  863. -#endif
  864. + u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
  865. +/* int mtu; */
  866. +#endif /* MPPE */
  867. ret = CONFACK;
  868. retp = p0 = p;
  869. @@ -1103,106 +1393,302 @@ ccp_reqci(f, p, lenp, dont_nak)
  870. switch (type) {
  871. #ifdef MPPE
  872. case CI_MPPE:
  873. - if (!ao->mppe || clen != CILEN_MPPE) {
  874. + if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
  875. newret = CONFREJ;
  876. break;
  877. }
  878. - MPPE_CI_TO_OPTS(&p[2], ho->mppe);
  879. -
  880. - /* Nak if anything unsupported or unknown are set. */
  881. - if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
  882. - newret = CONFNAK;
  883. - ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
  884. - }
  885. - if (ho->mppe & MPPE_OPT_UNKNOWN) {
  886. + p2 = p[2];
  887. + p5 = p[5];
  888. + /* not sure what they want, tell 'em what we got */
  889. + if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
  890. + (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
  891. + MPPE_MPPC)) != 0 || p[5] == 0) ||
  892. + (p[2] == 0 && p[3] == 0 && p[4] == 0 && p[5] == 0)) {
  893. newret = CONFNAK;
  894. - ho->mppe &= ~MPPE_OPT_UNKNOWN;
  895. - }
  896. -
  897. - /* Check state opt */
  898. - if (ho->mppe & MPPE_OPT_STATEFUL) {
  899. - /*
  900. - * We can Nak and request stateless, but it's a
  901. - * lot easier to just assume the peer will request
  902. - * it if he can do it; stateful mode is bad over
  903. - * the Internet -- which is where we expect MPPE.
  904. - */
  905. - if (refuse_mppe_stateful) {
  906. - error("Refusing MPPE stateful mode offered by peer");
  907. - newret = CONFREJ;
  908. - break;
  909. + p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
  910. + p[3] = 0;
  911. + p[4] = 0;
  912. + p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
  913. + (wo->mppe_56 ? MPPE_56BIT : 0) |
  914. + (wo->mppe_128 ? MPPE_128BIT : 0) |
  915. + (wo->mppc ? MPPE_MPPC : 0);
  916. + break;
  917. + }
  918. +
  919. + if ((p[5] & MPPE_MPPC)) {
  920. + if (ao->mppc) {
  921. + ho->mppc = 1;
  922. + BCOPY(p, opt_buf, CILEN_MPPE);
  923. + opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
  924. + opt_buf[5] = MPPE_MPPC;
  925. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
  926. + ho->mppc = 0;
  927. + p[5] &= ~MPPE_MPPC;
  928. + newret = CONFNAK;
  929. + }
  930. + } else {
  931. + newret = CONFREJ;
  932. + if (wo->mppe || ao->mppe) {
  933. + p[5] &= ~MPPE_MPPC;
  934. + newret = CONFNAK;
  935. + }
  936. }
  937. }
  938. -
  939. - /* Find out which of {S,L} are set. */
  940. - if ((ho->mppe & MPPE_OPT_128)
  941. - && (ho->mppe & MPPE_OPT_40)) {
  942. - /* Both are set, negotiate the strongest. */
  943. - newret = CONFNAK;
  944. - if (ao->mppe & MPPE_OPT_128)
  945. - ho->mppe &= ~MPPE_OPT_40;
  946. - else if (ao->mppe & MPPE_OPT_40)
  947. - ho->mppe &= ~MPPE_OPT_128;
  948. - else {
  949. - newret = CONFREJ;
  950. - break;
  951. - }
  952. - } else if (ho->mppe & MPPE_OPT_128) {
  953. - if (!(ao->mppe & MPPE_OPT_128)) {
  954. - newret = CONFREJ;
  955. - break;
  956. - }
  957. - } else if (ho->mppe & MPPE_OPT_40) {
  958. - if (!(ao->mppe & MPPE_OPT_40)) {
  959. - newret = CONFREJ;
  960. - break;
  961. - }
  962. + if (ao->mppe)
  963. + ho->mppe = 1;
  964. +
  965. + if ((p[2] & MPPE_STATELESS)) {
  966. + if (ao->mppe_stateless) {
  967. + if (wo->mppe_stateless)
  968. + ho->mppe_stateless = 1;
  969. + else {
  970. + newret = CONFNAK;
  971. + if (!dont_nak)
  972. + p[2] &= ~MPPE_STATELESS;
  973. + }
  974. + } else {
  975. + newret = CONFNAK;
  976. + if (!dont_nak)
  977. + p[2] &= ~MPPE_STATELESS;
  978. + }
  979. + } else {
  980. + if (wo->mppe_stateless && !dont_nak) {
  981. + wo->mppe_stateless = 0;
  982. + newret = CONFNAK;
  983. + p[2] |= MPPE_STATELESS;
  984. + }
  985. + }
  986. +
  987. + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
  988. + newret = CONFNAK;
  989. + if (ao->mppe_128) {
  990. + ho->mppe_128 = 1;
  991. + p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
  992. + BCOPY(p, opt_buf, CILEN_MPPE);
  993. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  994. + MPPE_MAX_KEY_LEN);
  995. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  996. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  997. + ho->mppe_128 = 0;
  998. + p[5] |= (MPPE_40BIT|MPPE_56BIT);
  999. + p[5] &= ~MPPE_128BIT;
  1000. + goto check_mppe_56_40;
  1001. + }
  1002. + goto check_mppe;
  1003. + }
  1004. + p[5] &= ~MPPE_128BIT;
  1005. + goto check_mppe_56_40;
  1006. + }
  1007. + if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
  1008. + newret = CONFNAK;
  1009. + if (ao->mppe_128) {
  1010. + ho->mppe_128 = 1;
  1011. + p[5] &= ~MPPE_56BIT;
  1012. + BCOPY(p, opt_buf, CILEN_MPPE);
  1013. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1014. + MPPE_MAX_KEY_LEN);
  1015. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1016. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1017. + ho->mppe_128 = 0;
  1018. + p[5] |= MPPE_56BIT;
  1019. + p[5] &= ~MPPE_128BIT;
  1020. + goto check_mppe_56;
  1021. + }
  1022. + goto check_mppe;
  1023. + }
  1024. + p[5] &= ~MPPE_128BIT;
  1025. + goto check_mppe_56;
  1026. + }
  1027. + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
  1028. + newret = CONFNAK;
  1029. + if (ao->mppe_128) {
  1030. + ho->mppe_128 = 1;
  1031. + p[5] &= ~MPPE_40BIT;
  1032. + BCOPY(p, opt_buf, CILEN_MPPE);
  1033. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1034. + MPPE_MAX_KEY_LEN);
  1035. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1036. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1037. + ho->mppe_128 = 0;
  1038. + p[5] |= MPPE_40BIT;
  1039. + p[5] &= ~MPPE_128BIT;
  1040. + goto check_mppe_40;
  1041. + }
  1042. + goto check_mppe;
  1043. + }
  1044. + p[5] &= ~MPPE_128BIT;
  1045. + goto check_mppe_40;
  1046. + }
  1047. + if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
  1048. + if (ao->mppe_128) {
  1049. + ho->mppe_128 = 1;
  1050. + BCOPY(p, opt_buf, CILEN_MPPE);
  1051. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1052. + MPPE_MAX_KEY_LEN);
  1053. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1054. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1055. + ho->mppe_128 = 0;
  1056. + p[5] &= ~MPPE_128BIT;
  1057. + newret = CONFNAK;
  1058. + }
  1059. + goto check_mppe;
  1060. + }
  1061. + p[5] &= ~MPPE_128BIT;
  1062. + newret = CONFNAK;
  1063. + goto check_mppe;
  1064. + }
  1065. + check_mppe_56_40:
  1066. + if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
  1067. + newret = CONFNAK;
  1068. + if (ao->mppe_56) {
  1069. + ho->mppe_56 = 1;
  1070. + p[5] &= ~MPPE_40BIT;
  1071. + BCOPY(p, opt_buf, CILEN_MPPE);
  1072. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1073. + MPPE_MAX_KEY_LEN);
  1074. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1075. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1076. + ho->mppe_56 = 0;
  1077. + p[5] |= MPPE_40BIT;
  1078. + p[5] &= ~MPPE_56BIT;
  1079. + newret = CONFNAK;
  1080. + goto check_mppe_40;
  1081. + }
  1082. + goto check_mppe;
  1083. + }
  1084. + p[5] &= ~MPPE_56BIT;
  1085. + goto check_mppe_40;
  1086. + }
  1087. + check_mppe_56:
  1088. + if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
  1089. + if (ao->mppe_56) {
  1090. + ho->mppe_56 = 1;
  1091. + BCOPY(p, opt_buf, CILEN_MPPE);
  1092. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1093. + MPPE_MAX_KEY_LEN);
  1094. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1095. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1096. + ho->mppe_56 = 0;
  1097. + p[5] &= ~MPPE_56BIT;
  1098. + newret = CONFNAK;
  1099. + }
  1100. + goto check_mppe;
  1101. + }
  1102. + p[5] &= ~MPPE_56BIT;
  1103. + newret = CONFNAK;
  1104. + goto check_mppe;
  1105. + }
  1106. + check_mppe_40:
  1107. + if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
  1108. + if (ao->mppe_40) {
  1109. + ho->mppe_40 = 1;
  1110. + BCOPY(p, opt_buf, CILEN_MPPE);
  1111. + BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1112. + MPPE_MAX_KEY_LEN);
  1113. + if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
  1114. + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1115. + ho->mppe_40 = 0;
  1116. + p[5] &= ~MPPE_40BIT;
  1117. + newret = CONFNAK;
  1118. + }
  1119. + goto check_mppe;
  1120. + }
  1121. + p[5] &= ~MPPE_40BIT;
  1122. + }
  1123. +
  1124. + check_mppe:
  1125. + if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
  1126. + if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
  1127. + newret = CONFNAK;
  1128. + p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
  1129. + p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
  1130. + (wo->mppe_56 ? MPPE_56BIT : 0) |
  1131. + (wo->mppe_128 ? MPPE_128BIT : 0) |
  1132. + (wo->mppc ? MPPE_MPPC : 0);
  1133. + } else {
  1134. + ho->mppe = ho->mppe_stateless = 0;
  1135. + }
  1136. } else {
  1137. - /* Neither are set. */
  1138. - /* We cannot accept this. */
  1139. - newret = CONFNAK;
  1140. - /* Give the peer our idea of what can be used,
  1141. - so it can choose and confirm */
  1142. - ho->mppe = ao->mppe;
  1143. - }
  1144. -
  1145. - /* rebuild the opts */
  1146. - MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
  1147. - if (newret == CONFACK) {
  1148. - u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
  1149. - int mtu;
  1150. -
  1151. - BCOPY(p, opt_buf, CILEN_MPPE);
  1152. - BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
  1153. - MPPE_MAX_KEY_LEN);
  1154. - if (ccp_test(f->unit, opt_buf,
  1155. - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
  1156. - /* This shouldn't happen, we've already tested it! */
  1157. - error("MPPE required, but kernel has no support.");
  1158. - lcp_close(f->unit, "MPPE required but not available");
  1159. - newret = CONFREJ;
  1160. - break;
  1161. - }
  1162. - /*
  1163. - * We need to decrease the interface MTU by MPPE_PAD
  1164. - * because MPPE frames **grow**. The kernel [must]
  1165. - * allocate MPPE_PAD extra bytes in xmit buffers.
  1166. - */
  1167. - mtu = netif_get_mtu(f->unit);
  1168. - if (mtu)
  1169. - netif_set_mtu(f->unit, mtu - MPPE_PAD);
  1170. - else
  1171. - newret = CONFREJ;
  1172. - }
  1173. -
  1174. - /*
  1175. - * We have accepted MPPE or are willing to negotiate
  1176. - * MPPE parameters. A CONFREJ is due to subsequent
  1177. - * (non-MPPE) processing.
  1178. - */
  1179. - rej_for_ci_mppe = 0;
  1180. - break;
  1181. -#endif /* MPPE */
  1182. + /* MPPE is not compatible with other compression types */
  1183. + if (wo->mppe) {
  1184. + ao->bsd_compress = 0;
  1185. + ao->predictor_1 = 0;
  1186. + ao->predictor_2 = 0;
  1187. + ao->deflate = 0;
  1188. + ao->lzs = 0;
  1189. + }
  1190. + }
  1191. + if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
  1192. + p[2] = p2;
  1193. + p[5] = p5;
  1194. + newret = CONFREJ;
  1195. + break;
  1196. + }
  1197. +
  1198. + /*
  1199. + * I have commented the code below because according to RFC1547
  1200. + * MTU is only information for higher level protocols about
  1201. + * "the maximum allowable length for a packet (q.v.) transmitted
  1202. + * over a point-to-point link without incurring network layer
  1203. + * fragmentation." Of course a PPP implementation should be able
  1204. + * to handle overhead added by MPPE - in our case apropriate code
  1205. + * is located in drivers/net/ppp_generic.c in the kernel sources.
  1206. + *
  1207. + * According to RFC1661:
  1208. + * - when negotiated MRU is less than 1500 octets, a PPP
  1209. + * implementation must still be able to receive at least 1500
  1210. + * octets,
  1211. + * - when PFC is negotiated, a PPP implementation is still
  1212. + * required to receive frames with uncompressed protocol field.
  1213. + *
  1214. + * So why not to handle MPPE overhead without changing MTU value?
  1215. + * I am sure that RFC3078, unfortunately silently, assumes that.
  1216. + */
  1217. +
  1218. + /*
  1219. + * We need to decrease the interface MTU by MPPE_PAD
  1220. + * because MPPE frames **grow**. The kernel [must]
  1221. + * allocate MPPE_PAD extra bytes in xmit buffers.
  1222. + */
  1223. + /*
  1224. + mtu = netif_get_mtu(f->unit);
  1225. + if (mtu) {
  1226. + netif_set_mtu(f->unit, mtu - MPPE_PAD);
  1227. + } else {
  1228. + newret = CONFREJ;
  1229. + if (ccp_wantoptions[f->unit].mppe) {
  1230. + error("Cannot adjust MTU needed by MPPE.");
  1231. + lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
  1232. + }
  1233. + }
  1234. + */
  1235. + break;
  1236. + #endif /* MPPE */
  1237. +
  1238. + case CI_LZS:
  1239. + if (!ao->lzs || clen != CILEN_LZS) {
  1240. + newret = CONFREJ;
  1241. + break;
  1242. + }
  1243. +
  1244. + ho->lzs = 1;
  1245. + ho->lzs_hists = (p[2] << 8) | p[3];
  1246. + ho->lzs_mode = p[4];
  1247. + if ((ho->lzs_hists != ao->lzs_hists) ||
  1248. + (ho->lzs_mode != ao->lzs_mode)) {
  1249. + newret = CONFNAK;
  1250. + if (!dont_nak) {
  1251. + p[2] = ao->lzs_hists >> 8;
  1252. + p[3] = ao->lzs_hists & 0xff;
  1253. + p[4] = ao->lzs_mode;
  1254. + } else
  1255. + break;
  1256. + }
  1257. +
  1258. + if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
  1259. + newret = CONFREJ;
  1260. + }
  1261. + break;
  1262. case CI_DEFLATE:
  1263. case CI_DEFLATE_DRAFT:
  1264. if (!ao->deflate || clen != CILEN_DEFLATE
  1265. @@ -1344,12 +1830,6 @@ ccp_reqci(f, p, lenp, dont_nak)
  1266. else
  1267. *lenp = retp - p0;
  1268. }
  1269. -#ifdef MPPE
  1270. - if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
  1271. - error("MPPE required but peer negotiation failed");
  1272. - lcp_close(f->unit, "MPPE required but peer negotiation failed");
  1273. - }
  1274. -#endif
  1275. return ret;
  1276. }
  1277. @@ -1371,24 +1851,35 @@ method_name(opt, opt2)
  1278. char *p = result;
  1279. char *q = result + sizeof(result); /* 1 past result */
  1280. - slprintf(p, q - p, "MPPE ");
  1281. - p += 5;
  1282. - if (opt->mppe & MPPE_OPT_128) {
  1283. - slprintf(p, q - p, "128-bit ");
  1284. - p += 8;
  1285. - }
  1286. - if (opt->mppe & MPPE_OPT_40) {
  1287. - slprintf(p, q - p, "40-bit ");
  1288. - p += 7;
  1289. - }
  1290. - if (opt->mppe & MPPE_OPT_STATEFUL)
  1291. - slprintf(p, q - p, "stateful");
  1292. - else
  1293. - slprintf(p, q - p, "stateless");
  1294. -
  1295. + if (opt->mppe) {
  1296. + if (opt->mppc) {
  1297. + slprintf(p, q - p, "MPPC/MPPE ");
  1298. + p += 10;
  1299. + } else {
  1300. + slprintf(p, q - p, "MPPE ");
  1301. + p += 5;
  1302. + }
  1303. + if (opt->mppe_128) {
  1304. + slprintf(p, q - p, "128-bit ");
  1305. + p += 8;
  1306. + } else if (opt->mppe_56) {
  1307. + slprintf(p, q - p, "56-bit ");
  1308. + p += 7;
  1309. + } else if (opt->mppe_40) {
  1310. + slprintf(p, q - p, "40-bit ");
  1311. + p += 7;
  1312. + }
  1313. + if (opt->mppe_stateless)
  1314. + slprintf(p, q - p, "stateless");
  1315. + else
  1316. + slprintf(p, q - p, "stateful");
  1317. + } else if (opt->mppc)
  1318. + slprintf(p, q - p, "MPPC");
  1319. break;
  1320. }
  1321. -#endif
  1322. +#endif /* MPPE */
  1323. + case CI_LZS:
  1324. + return "Stac LZS";
  1325. case CI_DEFLATE:
  1326. case CI_DEFLATE_DRAFT:
  1327. if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
  1328. @@ -1444,12 +1935,12 @@ ccp_up(f)
  1329. } else if (ANY_COMPRESS(*ho))
  1330. notice("%s transmit compression enabled", method_name(ho, NULL));
  1331. #ifdef MPPE
  1332. - if (go->mppe) {
  1333. + if (go->mppe || go->mppc) {
  1334. BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
  1335. BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
  1336. continue_networks(f->unit); /* Bring up IP et al */
  1337. }
  1338. -#endif
  1339. +#endif /* MPPE */
  1340. }
  1341. /*
  1342. @@ -1472,7 +1963,7 @@ ccp_down(f)
  1343. lcp_close(f->unit, "MPPE disabled");
  1344. }
  1345. }
  1346. -#endif
  1347. +#endif /* MPPE */
  1348. }
  1349. /*
  1350. @@ -1532,24 +2023,28 @@ ccp_printpkt(p, plen, printer, arg)
  1351. #ifdef MPPE
  1352. case CI_MPPE:
  1353. if (optlen >= CILEN_MPPE) {
  1354. - u_char mppe_opts;
  1355. -
  1356. - MPPE_CI_TO_OPTS(&p[2], mppe_opts);
  1357. - printer(arg, "mppe %s %s %s %s %s %s%s",
  1358. - (p[2] & MPPE_H_BIT)? "+H": "-H",
  1359. - (p[5] & MPPE_M_BIT)? "+M": "-M",
  1360. - (p[5] & MPPE_S_BIT)? "+S": "-S",
  1361. - (p[5] & MPPE_L_BIT)? "+L": "-L",
  1362. + printer(arg, "mppe %s %s %s %s %s %s",
  1363. + (p[2] & MPPE_STATELESS)? "+H": "-H",
  1364. + (p[5] & MPPE_56BIT)? "+M": "-M",
  1365. + (p[5] & MPPE_128BIT)? "+S": "-S",
  1366. + (p[5] & MPPE_40BIT)? "+L": "-L",
  1367. (p[5] & MPPE_D_BIT)? "+D": "-D",
  1368. - (p[5] & MPPE_C_BIT)? "+C": "-C",
  1369. - (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
  1370. - if (mppe_opts & MPPE_OPT_UNKNOWN)
  1371. + (p[5] & MPPE_MPPC)? "+C": "-C");
  1372. + if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
  1373. + MPPE_D_BIT | MPPE_MPPC)) ||
  1374. + (p[2] & ~MPPE_STATELESS))
  1375. printer(arg, " (%.2x %.2x %.2x %.2x)",
  1376. p[2], p[3], p[4], p[5]);
  1377. p += CILEN_MPPE;
  1378. }
  1379. break;
  1380. -#endif
  1381. +#endif /* MPPE */
  1382. + case CI_LZS:
  1383. + if (optlen >= CILEN_LZS) {
  1384. + printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
  1385. + p += CILEN_LZS;
  1386. + }
  1387. + break;
  1388. case CI_DEFLATE:
  1389. case CI_DEFLATE_DRAFT:
  1390. if (optlen >= CILEN_DEFLATE) {
  1391. @@ -1635,6 +2130,7 @@ ccp_datainput(unit, pkt, len)
  1392. error("Lost compression sync: disabling compression");
  1393. ccp_close(unit, "Lost compression sync");
  1394. #ifdef MPPE
  1395. + /* My module dosn't need this. J.D., 2003-07-06 */
  1396. /*
  1397. * If we were doing MPPE, we must also take the link down.
  1398. */
  1399. @@ -1642,9 +2138,18 @@ ccp_datainput(unit, pkt, len)
  1400. error("Too many MPPE errors, closing LCP");
  1401. lcp_close(unit, "Too many MPPE errors");
  1402. }
  1403. -#endif
  1404. +#endif /* MPPE */
  1405. } else {
  1406. /*
  1407. + * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
  1408. + * and don't wait for CCP_RESETACK
  1409. + */
  1410. + if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
  1411. + (ccp_gotoptions[f->unit].method == CI_MPPE)) {
  1412. + fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
  1413. + return;
  1414. + }
  1415. + /*
  1416. * Send a reset-request to reset the peer's compressor.
  1417. * We don't do that if we are still waiting for an
  1418. * acknowledgement to a previous reset-request.
  1419. --- a/pppd/ccp.h
  1420. +++ b/pppd/ccp.h
  1421. @@ -37,9 +37,17 @@ typedef struct ccp_options {
  1422. bool predictor_2; /* do Predictor-2? */
  1423. bool deflate_correct; /* use correct code for deflate? */
  1424. bool deflate_draft; /* use draft RFC code for deflate? */
  1425. + bool lzs; /* do Stac LZS? */
  1426. + bool mppc; /* do MPPC? */
  1427. bool mppe; /* do MPPE? */
  1428. + bool mppe_40; /* allow 40 bit encryption? */
  1429. + bool mppe_56; /* allow 56 bit encryption? */
  1430. + bool mppe_128; /* allow 128 bit encryption? */
  1431. + bool mppe_stateless; /* allow stateless encryption */
  1432. u_short bsd_bits; /* # bits/code for BSD Compress */
  1433. u_short deflate_size; /* lg(window size) for Deflate */
  1434. + u_short lzs_mode; /* LZS check mode */
  1435. + u_short lzs_hists; /* number of LZS histories */
  1436. short method; /* code for chosen compression method */
  1437. } ccp_options;
  1438. --- a/pppd/chap_ms.c
  1439. +++ b/pppd/chap_ms.c
  1440. @@ -963,13 +963,17 @@ set_mppe_enc_types(int policy, int types
  1441. /*
  1442. * Disable undesirable encryption types. Note that we don't ENABLE
  1443. * any encryption types, to avoid overriding manual configuration.
  1444. + *
  1445. + * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
  1446. */
  1447. switch(types) {
  1448. case MPPE_ENC_TYPES_RC4_40:
  1449. - ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */
  1450. + ccp_wantoptions[0].mppe_128 = 0; /* disable 128-bit */
  1451. + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
  1452. break;
  1453. case MPPE_ENC_TYPES_RC4_128:
  1454. - ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */
  1455. + ccp_wantoptions[0].mppe_56 = 0; /* disable 56-bit */
  1456. + ccp_wantoptions[0].mppe_40 = 0; /* disable 40-bit */
  1457. break;
  1458. default:
  1459. break;