xref: /netbsd-src/external/bsd/ppp/dist/pppd/ccp.c (revision 4d342c046e3288fb5a1edcd33cfec48c41c80664)
1 /*	$NetBSD: ccp.c,v 1.4 2014/10/25 21:11:37 christos Exp $	*/
2 
3 /*
4  * ccp.c - PPP Compression Control Protocol.
5  *
6  * Copyright (c) 1994-2002 Paul Mackerras. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. The name(s) of the authors of this software must not be used to
16  *    endorse or promote products derived from this software without
17  *    prior written permission.
18  *
19  * 3. Redistributions of any form whatsoever must retain the following
20  *    acknowledgment:
21  *    "This product includes software developed by Paul Mackerras
22  *     <paulus@samba.org>".
23  *
24  * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
25  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
26  * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
27  * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
28  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
29  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
30  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
31  */
32 
33 #include <sys/cdefs.h>
34 #if 0
35 #define RCSID	"Id: ccp.c,v 1.50 2005/06/26 19:34:41 carlsonj Exp "
36 static const char rcsid[] = RCSID;
37 #else
38 __RCSID("$NetBSD: ccp.c,v 1.4 2014/10/25 21:11:37 christos Exp $");
39 #endif
40 
41 #include <stdlib.h>
42 #include <string.h>
43 
44 #include "pppd.h"
45 #include "fsm.h"
46 #include "ccp.h"
47 #include <net/ppp-comp.h>
48 
49 #ifdef MPPE
50 #include "chap_ms.h"	/* mppe_xxxx_key, mppe_keys_set */
51 #include "lcp.h"	/* lcp_close(), lcp_fsm */
52 #endif
53 
54 /*
55  * Unfortunately there is a bug in zlib which means that using a
56  * size of 8 (window size = 256) for Deflate compression will cause
57  * buffer overruns and kernel crashes in the deflate module.
58  * Until this is fixed we only accept sizes in the range 9 .. 15.
59  * Thanks to James Carlson for pointing this out.
60  */
61 #define DEFLATE_MIN_WORKS	9
62 
63 /*
64  * Command-line options.
65  */
66 static int setbsdcomp __P((char **));
67 static int setdeflate __P((char **));
68 static char bsd_value[8];
69 static char deflate_value[8];
70 
71 /*
72  * Option variables.
73  */
74 #ifdef MPPE
75 bool refuse_mppe_stateful = 1;		/* Allow stateful mode? */
76 #endif
77 
78 static option_t ccp_option_list[] = {
79     { "noccp", o_bool, &ccp_protent.enabled_flag,
80       "Disable CCP negotiation" },
81     { "-ccp", o_bool, &ccp_protent.enabled_flag,
82       "Disable CCP negotiation", OPT_ALIAS },
83 
84     { "bsdcomp", o_special, (void *)setbsdcomp,
85       "Request BSD-Compress packet compression",
86       OPT_PRIO | OPT_A2STRVAL | OPT_STATIC, bsd_value },
87     { "nobsdcomp", o_bool, &ccp_wantoptions[0].bsd_compress,
88       "don't allow BSD-Compress", OPT_PRIOSUB | OPT_A2CLR,
89       &ccp_allowoptions[0].bsd_compress },
90     { "-bsdcomp", o_bool, &ccp_wantoptions[0].bsd_compress,
91       "don't allow BSD-Compress", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
92       &ccp_allowoptions[0].bsd_compress },
93 
94     { "deflate", o_special, (void *)setdeflate,
95       "request Deflate compression",
96       OPT_PRIO | OPT_A2STRVAL | OPT_STATIC, deflate_value },
97     { "nodeflate", o_bool, &ccp_wantoptions[0].deflate,
98       "don't allow Deflate compression", OPT_PRIOSUB | OPT_A2CLR,
99       &ccp_allowoptions[0].deflate },
100     { "-deflate", o_bool, &ccp_wantoptions[0].deflate,
101       "don't allow Deflate compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
102       &ccp_allowoptions[0].deflate },
103 
104     { "nodeflatedraft", o_bool, &ccp_wantoptions[0].deflate_draft,
105       "don't use draft deflate #", OPT_A2COPY,
106       &ccp_allowoptions[0].deflate_draft },
107 
108     { "predictor1", o_bool, &ccp_wantoptions[0].predictor_1,
109       "request Predictor-1", OPT_PRIO | 1 },
110     { "nopredictor1", o_bool, &ccp_wantoptions[0].predictor_1,
111       "don't allow Predictor-1", OPT_PRIOSUB | OPT_A2CLR,
112       &ccp_allowoptions[0].predictor_1 },
113     { "-predictor1", o_bool, &ccp_wantoptions[0].predictor_1,
114       "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
115       &ccp_allowoptions[0].predictor_1 },
116 
117 #ifdef MPPE
118     /* MPPE options are symmetrical ... we only set wantoptions here */
119     { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
120       "require MPPE encryption",
121       OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
122     { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
123       "require MPPE encryption",
124       OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
125     { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
126       "don't allow MPPE encryption", OPT_PRIO },
127     { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
128       "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
129 
130     /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
131     { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
132       "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
133       &ccp_wantoptions[0].mppe },
134     { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
135       "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
136       &ccp_wantoptions[0].mppe },
137     { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
138       "don't allow MPPE 40-bit encryption",
139       OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
140     { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
141       "don't allow MPPE 40-bit encryption",
142       OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
143       &ccp_wantoptions[0].mppe },
144 
145     { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
146       "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
147       &ccp_wantoptions[0].mppe },
148     { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
149       "require MPPE 128-bit encryption",
150       OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
151       &ccp_wantoptions[0].mppe },
152     { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
153       "don't allow MPPE 128-bit encryption",
154       OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
155     { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
156       "don't allow MPPE 128-bit encryption",
157       OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
158       &ccp_wantoptions[0].mppe },
159 
160     /* strange one; we always request stateless, but will we allow stateful? */
161     { "mppe-stateful", o_bool, &refuse_mppe_stateful,
162       "allow MPPE stateful mode", OPT_PRIO },
163     { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
164       "disallow MPPE stateful mode", OPT_PRIO | 1 },
165 #endif /* MPPE */
166 
167     { NULL }
168 };
169 
170 /*
171  * Protocol entry points from main code.
172  */
173 static void ccp_init __P((int unit));
174 static void ccp_open __P((int unit));
175 static void ccp_close __P((int unit, char *));
176 static void ccp_lowerup __P((int unit));
177 static void ccp_lowerdown __P((int));
178 static void ccp_input __P((int unit, u_char *pkt, int len));
179 static void ccp_protrej __P((int unit));
180 static int  ccp_printpkt __P((u_char *pkt, int len,
181 			      void (*printer) __P((void *, char *, ...)),
182 			      void *arg));
183 static void ccp_datainput __P((int unit, u_char *pkt, int len));
184 
185 struct protent ccp_protent = {
186     PPP_CCP,
187     ccp_init,
188     ccp_input,
189     ccp_protrej,
190     ccp_lowerup,
191     ccp_lowerdown,
192     ccp_open,
193     ccp_close,
194     ccp_printpkt,
195     ccp_datainput,
196     1,
197     "CCP",
198     "Compressed",
199     ccp_option_list,
200     NULL,
201     NULL,
202     NULL
203 };
204 
205 fsm ccp_fsm[NUM_PPP];
206 ccp_options ccp_wantoptions[NUM_PPP];	/* what to request the peer to use */
207 ccp_options ccp_gotoptions[NUM_PPP];	/* what the peer agreed to do */
208 ccp_options ccp_allowoptions[NUM_PPP];	/* what we'll agree to do */
209 ccp_options ccp_hisoptions[NUM_PPP];	/* what we agreed to do */
210 
211 /*
212  * Callbacks for fsm code.
213  */
214 static void ccp_resetci __P((fsm *));
215 static int  ccp_cilen __P((fsm *));
216 static void ccp_addci __P((fsm *, u_char *, int *));
217 static int  ccp_ackci __P((fsm *, u_char *, int));
218 static int  ccp_nakci __P((fsm *, u_char *, int, int));
219 static int  ccp_rejci __P((fsm *, u_char *, int));
220 static int  ccp_reqci __P((fsm *, u_char *, int *, int));
221 static void ccp_up __P((fsm *));
222 static void ccp_down __P((fsm *));
223 static int  ccp_extcode __P((fsm *, int, int, u_char *, int));
224 static void ccp_rack_timeout __P((void *));
225 static char *method_name __P((ccp_options *, ccp_options *));
226 
227 static fsm_callbacks ccp_callbacks = {
228     ccp_resetci,
229     ccp_cilen,
230     ccp_addci,
231     ccp_ackci,
232     ccp_nakci,
233     ccp_rejci,
234     ccp_reqci,
235     ccp_up,
236     ccp_down,
237     NULL,
238     NULL,
239     NULL,
240     NULL,
241     ccp_extcode,
242     "CCP"
243 };
244 
245 /*
246  * Do we want / did we get any compression?
247  */
248 #define ANY_COMPRESS(opt)	((opt).deflate || (opt).bsd_compress \
249 				 || (opt).predictor_1 || (opt).predictor_2 \
250 				 || (opt).mppe)
251 
252 /*
253  * Local state (mainly for handling reset-reqs and reset-acks).
254  */
255 static int ccp_localstate[NUM_PPP];
256 #define RACK_PENDING	1	/* waiting for reset-ack */
257 #define RREQ_REPEAT	2	/* send another reset-req if no reset-ack */
258 
259 #define RACKTIMEOUT	1	/* second */
260 
261 static int all_rejected[NUM_PPP];	/* we rejected all peer's options */
262 
263 /*
264  * Option parsing.
265  */
266 static int
267 setbsdcomp(argv)
268     char **argv;
269 {
270     int rbits, abits;
271     char *str, *endp;
272 
273     str = *argv;
274     abits = rbits = strtol(str, &endp, 0);
275     if (endp != str && *endp == ',') {
276 	str = endp + 1;
277 	abits = strtol(str, &endp, 0);
278     }
279     if (*endp != 0 || endp == str) {
280 	option_error("invalid parameter '%s' for bsdcomp option", *argv);
281 	return 0;
282     }
283     if ((rbits != 0 && (rbits < BSD_MIN_BITS || rbits > BSD_MAX_BITS))
284 	|| (abits != 0 && (abits < BSD_MIN_BITS || abits > BSD_MAX_BITS))) {
285 	option_error("bsdcomp option values must be 0 or %d .. %d",
286 		     BSD_MIN_BITS, BSD_MAX_BITS);
287 	return 0;
288     }
289     if (rbits > 0) {
290 	ccp_wantoptions[0].bsd_compress = 1;
291 	ccp_wantoptions[0].bsd_bits = rbits;
292     } else
293 	ccp_wantoptions[0].bsd_compress = 0;
294     if (abits > 0) {
295 	ccp_allowoptions[0].bsd_compress = 1;
296 	ccp_allowoptions[0].bsd_bits = abits;
297     } else
298 	ccp_allowoptions[0].bsd_compress = 0;
299     slprintf(bsd_value, sizeof(bsd_value),
300 	     rbits == abits? "%d": "%d,%d", rbits, abits);
301 
302     return 1;
303 }
304 
305 static int
306 setdeflate(argv)
307     char **argv;
308 {
309     int rbits, abits;
310     char *str, *endp;
311 
312     str = *argv;
313     abits = rbits = strtol(str, &endp, 0);
314     if (endp != str && *endp == ',') {
315 	str = endp + 1;
316 	abits = strtol(str, &endp, 0);
317     }
318     if (*endp != 0 || endp == str) {
319 	option_error("invalid parameter '%s' for deflate option", *argv);
320 	return 0;
321     }
322     if ((rbits != 0 && (rbits < DEFLATE_MIN_SIZE || rbits > DEFLATE_MAX_SIZE))
323 	|| (abits != 0 && (abits < DEFLATE_MIN_SIZE
324 			  || abits > DEFLATE_MAX_SIZE))) {
325 	option_error("deflate option values must be 0 or %d .. %d",
326 		     DEFLATE_MIN_SIZE, DEFLATE_MAX_SIZE);
327 	return 0;
328     }
329     if (rbits == DEFLATE_MIN_SIZE || abits == DEFLATE_MIN_SIZE) {
330 	if (rbits == DEFLATE_MIN_SIZE)
331 	    rbits = DEFLATE_MIN_WORKS;
332 	if (abits == DEFLATE_MIN_SIZE)
333 	    abits = DEFLATE_MIN_WORKS;
334 	warn("deflate option value of %d changed to %d to avoid zlib bug",
335 	     DEFLATE_MIN_SIZE, DEFLATE_MIN_WORKS);
336     }
337     if (rbits > 0) {
338 	ccp_wantoptions[0].deflate = 1;
339 	ccp_wantoptions[0].deflate_size = rbits;
340     } else
341 	ccp_wantoptions[0].deflate = 0;
342     if (abits > 0) {
343 	ccp_allowoptions[0].deflate = 1;
344 	ccp_allowoptions[0].deflate_size = abits;
345     } else
346 	ccp_allowoptions[0].deflate = 0;
347     slprintf(deflate_value, sizeof(deflate_value),
348 	     rbits == abits? "%d": "%d,%d", rbits, abits);
349 
350     return 1;
351 }
352 
353 /*
354  * ccp_init - initialize CCP.
355  */
356 static void
357 ccp_init(unit)
358     int unit;
359 {
360     fsm *f = &ccp_fsm[unit];
361 
362     f->unit = unit;
363     f->protocol = PPP_CCP;
364     f->callbacks = &ccp_callbacks;
365     fsm_init(f);
366 
367     memset(&ccp_wantoptions[unit],  0, sizeof(ccp_options));
368     memset(&ccp_gotoptions[unit],   0, sizeof(ccp_options));
369     memset(&ccp_allowoptions[unit], 0, sizeof(ccp_options));
370     memset(&ccp_hisoptions[unit],   0, sizeof(ccp_options));
371 
372     ccp_wantoptions[0].deflate = 1;
373     ccp_wantoptions[0].deflate_size = DEFLATE_MAX_SIZE;
374     ccp_wantoptions[0].deflate_correct = 1;
375     ccp_wantoptions[0].deflate_draft = 1;
376     ccp_allowoptions[0].deflate = 1;
377     ccp_allowoptions[0].deflate_size = DEFLATE_MAX_SIZE;
378     ccp_allowoptions[0].deflate_correct = 1;
379     ccp_allowoptions[0].deflate_draft = 1;
380 
381     ccp_wantoptions[0].bsd_compress = 1;
382     ccp_wantoptions[0].bsd_bits = BSD_MAX_BITS;
383     ccp_allowoptions[0].bsd_compress = 1;
384     ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
385 
386     ccp_allowoptions[0].predictor_1 = 1;
387 }
388 
389 /*
390  * ccp_open - CCP is allowed to come up.
391  */
392 static void
393 ccp_open(unit)
394     int unit;
395 {
396     fsm *f = &ccp_fsm[unit];
397 
398     if (f->state != OPENED)
399 	ccp_flags_set(unit, 1, 0);
400 
401     /*
402      * Find out which compressors the kernel supports before
403      * deciding whether to open in silent mode.
404      */
405     ccp_resetci(f);
406     if (!ANY_COMPRESS(ccp_gotoptions[unit]))
407 	f->flags |= OPT_SILENT;
408 
409     fsm_open(f);
410 }
411 
412 /*
413  * ccp_close - Terminate CCP.
414  */
415 static void
416 ccp_close(unit, reason)
417     int unit;
418     char *reason;
419 {
420     ccp_flags_set(unit, 0, 0);
421     fsm_close(&ccp_fsm[unit], reason);
422 }
423 
424 /*
425  * ccp_lowerup - we may now transmit CCP packets.
426  */
427 static void
428 ccp_lowerup(unit)
429     int unit;
430 {
431     fsm_lowerup(&ccp_fsm[unit]);
432 }
433 
434 /*
435  * ccp_lowerdown - we may not transmit CCP packets.
436  */
437 static void
438 ccp_lowerdown(unit)
439     int unit;
440 {
441     fsm_lowerdown(&ccp_fsm[unit]);
442 }
443 
444 /*
445  * ccp_input - process a received CCP packet.
446  */
447 static void
448 ccp_input(unit, p, len)
449     int unit;
450     u_char *p;
451     int len;
452 {
453     fsm *f = &ccp_fsm[unit];
454     int oldstate;
455 
456     /*
457      * Check for a terminate-request so we can print a message.
458      */
459     oldstate = f->state;
460     fsm_input(f, p, len);
461     if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
462 	notice("Compression disabled by peer.");
463 #ifdef MPPE
464 	if (ccp_gotoptions[unit].mppe) {
465 	    error("MPPE disabled, closing LCP");
466 	    lcp_close(unit, "MPPE disabled by peer");
467 	}
468 #endif
469     }
470 
471     /*
472      * If we get a terminate-ack and we're not asking for compression,
473      * close CCP.
474      */
475     if (oldstate == REQSENT && p[0] == TERMACK
476 	&& !ANY_COMPRESS(ccp_gotoptions[unit]))
477 	ccp_close(unit, "No compression negotiated");
478 }
479 
480 /*
481  * Handle a CCP-specific code.
482  */
483 static int
484 ccp_extcode(f, code, id, p, len)
485     fsm *f;
486     int code, id;
487     u_char *p;
488     int len;
489 {
490     switch (code) {
491     case CCP_RESETREQ:
492 	if (f->state != OPENED)
493 	    break;
494 	/* send a reset-ack, which the transmitter will see and
495 	   reset its compression state. */
496 	fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
497 	break;
498 
499     case CCP_RESETACK:
500 	if (ccp_localstate[f->unit] & RACK_PENDING && id == f->reqid) {
501 	    ccp_localstate[f->unit] &= ~(RACK_PENDING | RREQ_REPEAT);
502 	    UNTIMEOUT(ccp_rack_timeout, f);
503 	}
504 	break;
505 
506     default:
507 	return 0;
508     }
509 
510     return 1;
511 }
512 
513 /*
514  * ccp_protrej - peer doesn't talk CCP.
515  */
516 static void
517 ccp_protrej(unit)
518     int unit;
519 {
520     ccp_flags_set(unit, 0, 0);
521     fsm_lowerdown(&ccp_fsm[unit]);
522 
523 #ifdef MPPE
524     if (ccp_gotoptions[unit].mppe) {
525 	error("MPPE required but peer negotiation failed");
526 	lcp_close(unit, "MPPE required but peer negotiation failed");
527     }
528 #endif
529 
530 }
531 
532 /*
533  * ccp_resetci - initialize at start of negotiation.
534  */
535 static void
536 ccp_resetci(f)
537     fsm *f;
538 {
539     ccp_options *go = &ccp_gotoptions[f->unit];
540     u_char opt_buf[CCP_MAX_OPTION_LENGTH];
541 
542     *go = ccp_wantoptions[f->unit];
543     all_rejected[f->unit] = 0;
544 
545 #ifdef MPPE
546     if (go->mppe) {
547 	ccp_options *ao = &ccp_allowoptions[f->unit];
548 	int auth_mschap_bits = auth_done[f->unit];
549 	int numbits;
550 
551 	/*
552 	 * Start with a basic sanity check: mschap[v2] auth must be in
553 	 * exactly one direction.  RFC 3079 says that the keys are
554 	 * 'derived from the credentials of the peer that initiated the call',
555 	 * however the PPP protocol doesn't have such a concept, and pppd
556 	 * cannot get this info externally.  Instead we do the best we can.
557 	 * NB: If MPPE is required, all other compression opts are invalid.
558 	 *     So, we return right away if we can't do it.
559 	 */
560 
561 	/* Leave only the mschap auth bits set */
562 	auth_mschap_bits &= (CHAP_MS_WITHPEER  | CHAP_MS_PEER |
563 			     CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
564 	/* Count the mschap auths */
565 	auth_mschap_bits >>= CHAP_MS_SHIFT;
566 	numbits = 0;
567 	do {
568 	    numbits += auth_mschap_bits & 1;
569 	    auth_mschap_bits >>= 1;
570 	} while (auth_mschap_bits);
571 	if (numbits > 1) {
572 	    error("MPPE required, but auth done in both directions.");
573 	    lcp_close(f->unit, "MPPE required but not available");
574 	    return;
575 	}
576 	if (!numbits) {
577 	    error("MPPE required, but MS-CHAP[v2] auth not performed.");
578 	    lcp_close(f->unit, "MPPE required but not available");
579 	    return;
580 	}
581 
582 	/* A plugin (eg radius) may not have obtained key material. */
583 	if (!mppe_keys_set) {
584 	    error("MPPE required, but keys are not available.  "
585 		  "Possible plugin problem?");
586 	    lcp_close(f->unit, "MPPE required but not available");
587 	    return;
588 	}
589 
590 	/* LM auth not supported for MPPE */
591 	if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
592 	    /* This might be noise */
593 	    if (go->mppe & MPPE_OPT_40) {
594 		notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
595 		go->mppe &= ~MPPE_OPT_40;
596 		ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
597 	    }
598 	}
599 
600 	/* Last check: can we actually negotiate something? */
601 	if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
602 	    /* Could be misconfig, could be 40-bit disabled above. */
603 	    error("MPPE required, but both 40-bit and 128-bit disabled.");
604 	    lcp_close(f->unit, "MPPE required but not available");
605 	    return;
606 	}
607 
608 	/* sync options */
609 	ao->mppe = go->mppe;
610 	/* MPPE is not compatible with other compression types */
611 	ao->bsd_compress = go->bsd_compress = 0;
612 	ao->predictor_1  = go->predictor_1  = 0;
613 	ao->predictor_2  = go->predictor_2  = 0;
614 	ao->deflate      = go->deflate      = 0;
615     }
616 #endif /* MPPE */
617 
618     /*
619      * Check whether the kernel knows about the various
620      * compression methods we might request.
621      */
622 #ifdef MPPE
623     if (go->mppe) {
624 	opt_buf[0] = CI_MPPE;
625 	opt_buf[1] = CILEN_MPPE;
626 	MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
627 	/* Key material unimportant here. */
628 	if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
629 	    error("MPPE required, but kernel has no support.");
630 	    lcp_close(f->unit, "MPPE required but not available");
631 	}
632     }
633 #endif
634     if (go->bsd_compress) {
635 	opt_buf[0] = CI_BSD_COMPRESS;
636 	opt_buf[1] = CILEN_BSD_COMPRESS;
637 	opt_buf[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION, BSD_MIN_BITS);
638 	if (ccp_test(f->unit, opt_buf, CILEN_BSD_COMPRESS, 0) <= 0)
639 	    go->bsd_compress = 0;
640     }
641     if (go->deflate) {
642 	if (go->deflate_correct) {
643 	    opt_buf[0] = CI_DEFLATE;
644 	    opt_buf[1] = CILEN_DEFLATE;
645 	    opt_buf[2] = DEFLATE_MAKE_OPT(DEFLATE_MIN_WORKS);
646 	    opt_buf[3] = DEFLATE_CHK_SEQUENCE;
647 	    if (ccp_test(f->unit, opt_buf, CILEN_DEFLATE, 0) <= 0)
648 		go->deflate_correct = 0;
649 	}
650 	if (go->deflate_draft) {
651 	    opt_buf[0] = CI_DEFLATE_DRAFT;
652 	    opt_buf[1] = CILEN_DEFLATE;
653 	    opt_buf[2] = DEFLATE_MAKE_OPT(DEFLATE_MIN_WORKS);
654 	    opt_buf[3] = DEFLATE_CHK_SEQUENCE;
655 	    if (ccp_test(f->unit, opt_buf, CILEN_DEFLATE, 0) <= 0)
656 		go->deflate_draft = 0;
657 	}
658 	if (!go->deflate_correct && !go->deflate_draft)
659 	    go->deflate = 0;
660     }
661     if (go->predictor_1) {
662 	opt_buf[0] = CI_PREDICTOR_1;
663 	opt_buf[1] = CILEN_PREDICTOR_1;
664 	if (ccp_test(f->unit, opt_buf, CILEN_PREDICTOR_1, 0) <= 0)
665 	    go->predictor_1 = 0;
666     }
667     if (go->predictor_2) {
668 	opt_buf[0] = CI_PREDICTOR_2;
669 	opt_buf[1] = CILEN_PREDICTOR_2;
670 	if (ccp_test(f->unit, opt_buf, CILEN_PREDICTOR_2, 0) <= 0)
671 	    go->predictor_2 = 0;
672     }
673 }
674 
675 /*
676  * ccp_cilen - Return total length of our configuration info.
677  */
678 static int
679 ccp_cilen(f)
680     fsm *f;
681 {
682     ccp_options *go = &ccp_gotoptions[f->unit];
683 
684     return (go->bsd_compress? CILEN_BSD_COMPRESS: 0)
685 	+ (go->deflate? CILEN_DEFLATE: 0)
686 	+ (go->predictor_1? CILEN_PREDICTOR_1: 0)
687 	+ (go->predictor_2? CILEN_PREDICTOR_2: 0)
688 	+ (go->mppe? CILEN_MPPE: 0);
689 }
690 
691 /*
692  * ccp_addci - put our requests in a packet.
693  */
694 static void
695 ccp_addci(f, p, lenp)
696     fsm *f;
697     u_char *p;
698     int *lenp;
699 {
700     int res;
701     ccp_options *go = &ccp_gotoptions[f->unit];
702     u_char *p0 = p;
703 
704     /*
705      * Add the compression types that we can receive, in decreasing
706      * preference order.  Get the kernel to allocate the first one
707      * in case it gets Acked.
708      */
709 #ifdef MPPE
710     if (go->mppe) {
711 	u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
712 
713 	p[0] = opt_buf[0] = CI_MPPE;
714 	p[1] = opt_buf[1] = CILEN_MPPE;
715 	MPPE_OPTS_TO_CI(go->mppe, &p[2]);
716 	MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
717 	BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
718 	res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
719 	if (res > 0)
720 	    p += CILEN_MPPE;
721 	else
722 	    /* This shouldn't happen, we've already tested it! */
723 	    lcp_close(f->unit, "MPPE required but not available in kernel");
724     }
725 #endif
726     if (go->deflate) {
727 	p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
728 	p[1] = CILEN_DEFLATE;
729 	p[2] = DEFLATE_MAKE_OPT(go->deflate_size);
730 	p[3] = DEFLATE_CHK_SEQUENCE;
731 	if (p != p0) {
732 	    p += CILEN_DEFLATE;
733 	} else {
734 	    for (;;) {
735 		if (go->deflate_size < DEFLATE_MIN_WORKS) {
736 		    go->deflate = 0;
737 		    break;
738 		}
739 		res = ccp_test(f->unit, p, CILEN_DEFLATE, 0);
740 		if (res > 0) {
741 		    p += CILEN_DEFLATE;
742 		    break;
743 		} else if (res < 0) {
744 		    go->deflate = 0;
745 		    break;
746 		}
747 		--go->deflate_size;
748 		p[2] = DEFLATE_MAKE_OPT(go->deflate_size);
749 	    }
750 	}
751 	if (p != p0 && go->deflate_correct && go->deflate_draft) {
752 	    p[0] = CI_DEFLATE_DRAFT;
753 	    p[1] = CILEN_DEFLATE;
754 	    p[2] = p[2 - CILEN_DEFLATE];
755 	    p[3] = DEFLATE_CHK_SEQUENCE;
756 	    p += CILEN_DEFLATE;
757 	}
758     }
759     if (go->bsd_compress) {
760 	p[0] = CI_BSD_COMPRESS;
761 	p[1] = CILEN_BSD_COMPRESS;
762 	p[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION, go->bsd_bits);
763 	if (p != p0) {
764 	    p += CILEN_BSD_COMPRESS;	/* not the first option */
765 	} else {
766 	    for (;;) {
767 		if (go->bsd_bits < BSD_MIN_BITS) {
768 		    go->bsd_compress = 0;
769 		    break;
770 		}
771 		res = ccp_test(f->unit, p, CILEN_BSD_COMPRESS, 0);
772 		if (res > 0) {
773 		    p += CILEN_BSD_COMPRESS;
774 		    break;
775 		} else if (res < 0) {
776 		    go->bsd_compress = 0;
777 		    break;
778 		}
779 		--go->bsd_bits;
780 		p[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION, go->bsd_bits);
781 	    }
782 	}
783     }
784     /* XXX Should Predictor 2 be preferable to Predictor 1? */
785     if (go->predictor_1) {
786 	p[0] = CI_PREDICTOR_1;
787 	p[1] = CILEN_PREDICTOR_1;
788 	if (p == p0 && ccp_test(f->unit, p, CILEN_PREDICTOR_1, 0) <= 0) {
789 	    go->predictor_1 = 0;
790 	} else {
791 	    p += CILEN_PREDICTOR_1;
792 	}
793     }
794     if (go->predictor_2) {
795 	p[0] = CI_PREDICTOR_2;
796 	p[1] = CILEN_PREDICTOR_2;
797 	if (p == p0 && ccp_test(f->unit, p, CILEN_PREDICTOR_2, 0) <= 0) {
798 	    go->predictor_2 = 0;
799 	} else {
800 	    p += CILEN_PREDICTOR_2;
801 	}
802     }
803 
804     go->method = (p > p0)? p0[0]: -1;
805 
806     *lenp = p - p0;
807 }
808 
809 /*
810  * ccp_ackci - process a received configure-ack, and return
811  * 1 iff the packet was OK.
812  */
813 static int
814 ccp_ackci(f, p, len)
815     fsm *f;
816     u_char *p;
817     int len;
818 {
819     ccp_options *go = &ccp_gotoptions[f->unit];
820     u_char *p0 = p;
821 
822 #ifdef MPPE
823     if (go->mppe) {
824 	u_char opt_buf[CILEN_MPPE];
825 
826 	opt_buf[0] = CI_MPPE;
827 	opt_buf[1] = CILEN_MPPE;
828 	MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
829 	if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
830 	    return 0;
831 	p += CILEN_MPPE;
832 	len -= CILEN_MPPE;
833 	/* XXX Cope with first/fast ack */
834 	if (len == 0)
835 	    return 1;
836     }
837 #endif
838     if (go->deflate) {
839 	if (len < CILEN_DEFLATE
840 	    || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
841 	    || p[1] != CILEN_DEFLATE
842 	    || p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
843 	    || p[3] != DEFLATE_CHK_SEQUENCE)
844 	    return 0;
845 	p += CILEN_DEFLATE;
846 	len -= CILEN_DEFLATE;
847 	/* XXX Cope with first/fast ack */
848 	if (len == 0)
849 	    return 1;
850 	if (go->deflate_correct && go->deflate_draft) {
851 	    if (len < CILEN_DEFLATE
852 		|| p[0] != CI_DEFLATE_DRAFT
853 		|| p[1] != CILEN_DEFLATE
854 		|| p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
855 		|| p[3] != DEFLATE_CHK_SEQUENCE)
856 		return 0;
857 	    p += CILEN_DEFLATE;
858 	    len -= CILEN_DEFLATE;
859 	}
860     }
861     if (go->bsd_compress) {
862 	if (len < CILEN_BSD_COMPRESS
863 	    || p[0] != CI_BSD_COMPRESS || p[1] != CILEN_BSD_COMPRESS
864 	    || p[2] != BSD_MAKE_OPT(BSD_CURRENT_VERSION, go->bsd_bits))
865 	    return 0;
866 	p += CILEN_BSD_COMPRESS;
867 	len -= CILEN_BSD_COMPRESS;
868 	/* XXX Cope with first/fast ack */
869 	if (p == p0 && len == 0)
870 	    return 1;
871     }
872     if (go->predictor_1) {
873 	if (len < CILEN_PREDICTOR_1
874 	    || p[0] != CI_PREDICTOR_1 || p[1] != CILEN_PREDICTOR_1)
875 	    return 0;
876 	p += CILEN_PREDICTOR_1;
877 	len -= CILEN_PREDICTOR_1;
878 	/* XXX Cope with first/fast ack */
879 	if (p == p0 && len == 0)
880 	    return 1;
881     }
882     if (go->predictor_2) {
883 	if (len < CILEN_PREDICTOR_2
884 	    || p[0] != CI_PREDICTOR_2 || p[1] != CILEN_PREDICTOR_2)
885 	    return 0;
886 	p += CILEN_PREDICTOR_2;
887 	len -= CILEN_PREDICTOR_2;
888 	/* XXX Cope with first/fast ack */
889 	if (p == p0 && len == 0)
890 	    return 1;
891     }
892 
893     if (len != 0)
894 	return 0;
895     return 1;
896 }
897 
898 /*
899  * ccp_nakci - process received configure-nak.
900  * Returns 1 iff the nak was OK.
901  */
902 static int
903 ccp_nakci(f, p, len, treat_as_reject)
904     fsm *f;
905     u_char *p;
906     int len;
907     int treat_as_reject;
908 {
909     ccp_options *go = &ccp_gotoptions[f->unit];
910     ccp_options no;		/* options we've seen already */
911     ccp_options try;		/* options to ask for next time */
912 
913     memset(&no, 0, sizeof(no));
914     try = *go;
915 
916 #ifdef MPPE
917     if (go->mppe && len >= CILEN_MPPE
918 	&& p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
919 	no.mppe = 1;
920 	/*
921 	 * Peer wants us to use a different strength or other setting.
922 	 * Fail if we aren't willing to use his suggestion.
923 	 */
924 	MPPE_CI_TO_OPTS(&p[2], try.mppe);
925 	if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
926 	    error("Refusing MPPE stateful mode offered by peer");
927 	    try.mppe = 0;
928 	} else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
929 	    /* Peer must have set options we didn't request (suggest) */
930 	    try.mppe = 0;
931 	}
932 
933 	if (!try.mppe) {
934 	    error("MPPE required but peer negotiation failed");
935 	    lcp_close(f->unit, "MPPE required but peer negotiation failed");
936 	}
937     }
938 #endif /* MPPE */
939     if (go->deflate && len >= CILEN_DEFLATE
940 	&& p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
941 	&& p[1] == CILEN_DEFLATE) {
942 	no.deflate = 1;
943 	/*
944 	 * Peer wants us to use a different code size or something.
945 	 * Stop asking for Deflate if we don't understand his suggestion.
946 	 */
947 	if (DEFLATE_METHOD(p[2]) != DEFLATE_METHOD_VAL
948 	    || DEFLATE_SIZE(p[2]) < DEFLATE_MIN_WORKS
949 	    || p[3] != DEFLATE_CHK_SEQUENCE)
950 	    try.deflate = 0;
951 	else if (DEFLATE_SIZE(p[2]) < go->deflate_size)
952 	    try.deflate_size = DEFLATE_SIZE(p[2]);
953 	p += CILEN_DEFLATE;
954 	len -= CILEN_DEFLATE;
955 	if (go->deflate_correct && go->deflate_draft
956 	    && len >= CILEN_DEFLATE && p[0] == CI_DEFLATE_DRAFT
957 	    && p[1] == CILEN_DEFLATE) {
958 	    p += CILEN_DEFLATE;
959 	    len -= CILEN_DEFLATE;
960 	}
961     }
962 
963     if (go->bsd_compress && len >= CILEN_BSD_COMPRESS
964 	&& p[0] == CI_BSD_COMPRESS && p[1] == CILEN_BSD_COMPRESS) {
965 	no.bsd_compress = 1;
966 	/*
967 	 * Peer wants us to use a different number of bits
968 	 * or a different version.
969 	 */
970 	if (BSD_VERSION(p[2]) != BSD_CURRENT_VERSION)
971 	    try.bsd_compress = 0;
972 	else if (BSD_NBITS(p[2]) < go->bsd_bits)
973 	    try.bsd_bits = BSD_NBITS(p[2]);
974 	p += CILEN_BSD_COMPRESS;
975 	len -= CILEN_BSD_COMPRESS;
976     }
977 
978     /*
979      * Predictor-1 and 2 have no options, so they can't be Naked.
980      *
981      * There may be remaining options but we ignore them.
982      */
983 
984     if (f->state != OPENED)
985 	*go = try;
986     return 1;
987 }
988 
989 /*
990  * ccp_rejci - reject some of our suggested compression methods.
991  */
992 static int
993 ccp_rejci(f, p, len)
994     fsm *f;
995     u_char *p;
996     int len;
997 {
998     ccp_options *go = &ccp_gotoptions[f->unit];
999     ccp_options try;		/* options to request next time */
1000 
1001     try = *go;
1002 
1003     /*
1004      * Cope with empty configure-rejects by ceasing to send
1005      * configure-requests.
1006      */
1007     if (len == 0 && all_rejected[f->unit])
1008 	return -1;
1009 
1010 #ifdef MPPE
1011     if (go->mppe && len >= CILEN_MPPE
1012 	&& p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
1013 	error("MPPE required but peer refused");
1014 	lcp_close(f->unit, "MPPE required but peer refused");
1015 	p += CILEN_MPPE;
1016 	len -= CILEN_MPPE;
1017     }
1018 #endif
1019     if (go->deflate_correct && len >= CILEN_DEFLATE
1020 	&& p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
1021 	if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
1022 	    || p[3] != DEFLATE_CHK_SEQUENCE)
1023 	    return 0;		/* Rej is bad */
1024 	try.deflate_correct = 0;
1025 	p += CILEN_DEFLATE;
1026 	len -= CILEN_DEFLATE;
1027     }
1028     if (go->deflate_draft && len >= CILEN_DEFLATE
1029 	&& p[0] == CI_DEFLATE_DRAFT && p[1] == CILEN_DEFLATE) {
1030 	if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
1031 	    || p[3] != DEFLATE_CHK_SEQUENCE)
1032 	    return 0;		/* Rej is bad */
1033 	try.deflate_draft = 0;
1034 	p += CILEN_DEFLATE;
1035 	len -= CILEN_DEFLATE;
1036     }
1037     if (!try.deflate_correct && !try.deflate_draft)
1038 	try.deflate = 0;
1039     if (go->bsd_compress && len >= CILEN_BSD_COMPRESS
1040 	&& p[0] == CI_BSD_COMPRESS && p[1] == CILEN_BSD_COMPRESS) {
1041 	if (p[2] != BSD_MAKE_OPT(BSD_CURRENT_VERSION, go->bsd_bits))
1042 	    return 0;
1043 	try.bsd_compress = 0;
1044 	p += CILEN_BSD_COMPRESS;
1045 	len -= CILEN_BSD_COMPRESS;
1046     }
1047     if (go->predictor_1 && len >= CILEN_PREDICTOR_1
1048 	&& p[0] == CI_PREDICTOR_1 && p[1] == CILEN_PREDICTOR_1) {
1049 	try.predictor_1 = 0;
1050 	p += CILEN_PREDICTOR_1;
1051 	len -= CILEN_PREDICTOR_1;
1052     }
1053     if (go->predictor_2 && len >= CILEN_PREDICTOR_2
1054 	&& p[0] == CI_PREDICTOR_2 && p[1] == CILEN_PREDICTOR_2) {
1055 	try.predictor_2 = 0;
1056 	p += CILEN_PREDICTOR_2;
1057 	len -= CILEN_PREDICTOR_2;
1058     }
1059 
1060     if (len != 0)
1061 	return 0;
1062 
1063     if (f->state != OPENED)
1064 	*go = try;
1065 
1066     return 1;
1067 }
1068 
1069 /*
1070  * ccp_reqci - processed a received configure-request.
1071  * Returns CONFACK, CONFNAK or CONFREJ and the packet modified
1072  * appropriately.
1073  */
1074 static int
1075 ccp_reqci(f, p, lenp, dont_nak)
1076     fsm *f;
1077     u_char *p;
1078     int *lenp;
1079     int dont_nak;
1080 {
1081     int ret, newret, res;
1082     u_char *p0, *retp;
1083     int len, clen, type, nb;
1084     ccp_options *ho = &ccp_hisoptions[f->unit];
1085     ccp_options *ao = &ccp_allowoptions[f->unit];
1086 #ifdef MPPE
1087     bool rej_for_ci_mppe = 1;	/* Are we rejecting based on a bad/missing */
1088 				/* CI_MPPE, or due to other options?       */
1089 #endif
1090 
1091     ret = CONFACK;
1092     retp = p0 = p;
1093     len = *lenp;
1094 
1095     memset(ho, 0, sizeof(ccp_options));
1096     ho->method = (len > 0)? p[0]: -1;
1097 
1098     while (len > 0) {
1099 	newret = CONFACK;
1100 	if (len < 2 || p[1] < 2 || p[1] > len) {
1101 	    /* length is bad */
1102 	    clen = len;
1103 	    newret = CONFREJ;
1104 
1105 	} else {
1106 	    type = p[0];
1107 	    clen = p[1];
1108 
1109 	    switch (type) {
1110 #ifdef MPPE
1111 	    case CI_MPPE:
1112 		if (!ao->mppe || clen != CILEN_MPPE) {
1113 		    newret = CONFREJ;
1114 		    break;
1115 		}
1116 		MPPE_CI_TO_OPTS(&p[2], ho->mppe);
1117 
1118 		/* Nak if anything unsupported or unknown are set. */
1119 		if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
1120 		    newret = CONFNAK;
1121 		    ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
1122 		}
1123 		if (ho->mppe & MPPE_OPT_UNKNOWN) {
1124 		    newret = CONFNAK;
1125 		    ho->mppe &= ~MPPE_OPT_UNKNOWN;
1126 		}
1127 
1128 		/* Check state opt */
1129 		if (ho->mppe & MPPE_OPT_STATEFUL) {
1130 		    /*
1131 		     * We can Nak and request stateless, but it's a
1132 		     * lot easier to just assume the peer will request
1133 		     * it if he can do it; stateful mode is bad over
1134 		     * the Internet -- which is where we expect MPPE.
1135 		     */
1136 		   if (refuse_mppe_stateful) {
1137 			error("Refusing MPPE stateful mode offered by peer");
1138 			newret = CONFREJ;
1139 			break;
1140 		    }
1141 		}
1142 
1143 		/* Find out which of {S,L} are set. */
1144 		if ((ho->mppe & MPPE_OPT_128)
1145 		     && (ho->mppe & MPPE_OPT_40)) {
1146 		    /* Both are set, negotiate the strongest. */
1147 		    newret = CONFNAK;
1148 		    if (ao->mppe & MPPE_OPT_128)
1149 			ho->mppe &= ~MPPE_OPT_40;
1150 		    else if (ao->mppe & MPPE_OPT_40)
1151 			ho->mppe &= ~MPPE_OPT_128;
1152 		    else {
1153 			newret = CONFREJ;
1154 			break;
1155 		    }
1156 		} else if (ho->mppe & MPPE_OPT_128) {
1157 		    if (!(ao->mppe & MPPE_OPT_128)) {
1158 			newret = CONFREJ;
1159 			break;
1160 		    }
1161 		} else if (ho->mppe & MPPE_OPT_40) {
1162 		    if (!(ao->mppe & MPPE_OPT_40)) {
1163 			newret = CONFREJ;
1164 			break;
1165 		    }
1166 		} else {
1167 		    /* Neither are set. */
1168 		    /* We cannot accept this.  */
1169 		    newret = CONFNAK;
1170 		    /* Give the peer our idea of what can be used,
1171 		       so it can choose and confirm */
1172 		    ho->mppe = ao->mppe;
1173 		}
1174 
1175 		/* rebuild the opts */
1176 		MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1177 		if (newret == CONFACK) {
1178 		    u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1179 		    int mtu;
1180 
1181 		    BCOPY(p, opt_buf, CILEN_MPPE);
1182 		    BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1183 			  MPPE_MAX_KEY_LEN);
1184 		    if (ccp_test(f->unit, opt_buf,
1185 				 CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1186 			/* This shouldn't happen, we've already tested it! */
1187 			error("MPPE required, but kernel has no support.");
1188 			lcp_close(f->unit, "MPPE required but not available");
1189 			newret = CONFREJ;
1190 			break;
1191 		    }
1192 		    /*
1193 		     * We need to decrease the interface MTU by MPPE_PAD
1194 		     * because MPPE frames **grow**.  The kernel [must]
1195 		     * allocate MPPE_PAD extra bytes in xmit buffers.
1196 		     */
1197 		    mtu = netif_get_mtu(f->unit);
1198 		    if (mtu)
1199 			netif_set_mtu(f->unit, mtu - MPPE_PAD);
1200 		    else
1201 			newret = CONFREJ;
1202 		}
1203 
1204 		/*
1205 		 * We have accepted MPPE or are willing to negotiate
1206 		 * MPPE parameters.  A CONFREJ is due to subsequent
1207 		 * (non-MPPE) processing.
1208 		 */
1209 		rej_for_ci_mppe = 0;
1210 		break;
1211 #endif /* MPPE */
1212 	    case CI_DEFLATE:
1213 	    case CI_DEFLATE_DRAFT:
1214 		if (!ao->deflate || clen != CILEN_DEFLATE
1215 		    || (!ao->deflate_correct && type == CI_DEFLATE)
1216 		    || (!ao->deflate_draft && type == CI_DEFLATE_DRAFT)) {
1217 		    newret = CONFREJ;
1218 		    break;
1219 		}
1220 
1221 		ho->deflate = 1;
1222 		ho->deflate_size = nb = DEFLATE_SIZE(p[2]);
1223 		if (DEFLATE_METHOD(p[2]) != DEFLATE_METHOD_VAL
1224 		    || p[3] != DEFLATE_CHK_SEQUENCE
1225 		    || nb > ao->deflate_size || nb < DEFLATE_MIN_WORKS) {
1226 		    newret = CONFNAK;
1227 		    if (!dont_nak) {
1228 			p[2] = DEFLATE_MAKE_OPT(ao->deflate_size);
1229 			p[3] = DEFLATE_CHK_SEQUENCE;
1230 			/* fall through to test this #bits below */
1231 		    } else
1232 			break;
1233 		}
1234 
1235 		/*
1236 		 * Check whether we can do Deflate with the window
1237 		 * size they want.  If the window is too big, reduce
1238 		 * it until the kernel can cope and nak with that.
1239 		 * We only check this for the first option.
1240 		 */
1241 		if (p == p0) {
1242 		    for (;;) {
1243 			res = ccp_test(f->unit, p, CILEN_DEFLATE, 1);
1244 			if (res > 0)
1245 			    break;		/* it's OK now */
1246 			if (res < 0 || nb == DEFLATE_MIN_WORKS || dont_nak) {
1247 			    newret = CONFREJ;
1248 			    p[2] = DEFLATE_MAKE_OPT(ho->deflate_size);
1249 			    break;
1250 			}
1251 			newret = CONFNAK;
1252 			--nb;
1253 			p[2] = DEFLATE_MAKE_OPT(nb);
1254 		    }
1255 		}
1256 		break;
1257 
1258 	    case CI_BSD_COMPRESS:
1259 		if (!ao->bsd_compress || clen != CILEN_BSD_COMPRESS) {
1260 		    newret = CONFREJ;
1261 		    break;
1262 		}
1263 
1264 		ho->bsd_compress = 1;
1265 		ho->bsd_bits = nb = BSD_NBITS(p[2]);
1266 		if (BSD_VERSION(p[2]) != BSD_CURRENT_VERSION
1267 		    || nb > ao->bsd_bits || nb < BSD_MIN_BITS) {
1268 		    newret = CONFNAK;
1269 		    if (!dont_nak) {
1270 			p[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION, ao->bsd_bits);
1271 			/* fall through to test this #bits below */
1272 		    } else
1273 			break;
1274 		}
1275 
1276 		/*
1277 		 * Check whether we can do BSD-Compress with the code
1278 		 * size they want.  If the code size is too big, reduce
1279 		 * it until the kernel can cope and nak with that.
1280 		 * We only check this for the first option.
1281 		 */
1282 		if (p == p0) {
1283 		    for (;;) {
1284 			res = ccp_test(f->unit, p, CILEN_BSD_COMPRESS, 1);
1285 			if (res > 0)
1286 			    break;
1287 			if (res < 0 || nb == BSD_MIN_BITS || dont_nak) {
1288 			    newret = CONFREJ;
1289 			    p[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION,
1290 						ho->bsd_bits);
1291 			    break;
1292 			}
1293 			newret = CONFNAK;
1294 			--nb;
1295 			p[2] = BSD_MAKE_OPT(BSD_CURRENT_VERSION, nb);
1296 		    }
1297 		}
1298 		break;
1299 
1300 	    case CI_PREDICTOR_1:
1301 		if (!ao->predictor_1 || clen != CILEN_PREDICTOR_1) {
1302 		    newret = CONFREJ;
1303 		    break;
1304 		}
1305 
1306 		ho->predictor_1 = 1;
1307 		if (p == p0
1308 		    && ccp_test(f->unit, p, CILEN_PREDICTOR_1, 1) <= 0) {
1309 		    newret = CONFREJ;
1310 		}
1311 		break;
1312 
1313 	    case CI_PREDICTOR_2:
1314 		if (!ao->predictor_2 || clen != CILEN_PREDICTOR_2) {
1315 		    newret = CONFREJ;
1316 		    break;
1317 		}
1318 
1319 		ho->predictor_2 = 1;
1320 		if (p == p0
1321 		    && ccp_test(f->unit, p, CILEN_PREDICTOR_2, 1) <= 0) {
1322 		    newret = CONFREJ;
1323 		}
1324 		break;
1325 
1326 	    default:
1327 		newret = CONFREJ;
1328 	    }
1329 	}
1330 
1331 	if (newret == CONFNAK && dont_nak)
1332 	    newret = CONFREJ;
1333 	if (!(newret == CONFACK || (newret == CONFNAK && ret == CONFREJ))) {
1334 	    /* we're returning this option */
1335 	    if (newret == CONFREJ && ret == CONFNAK)
1336 		retp = p0;
1337 	    ret = newret;
1338 	    if (p != retp)
1339 		BCOPY(p, retp, clen);
1340 	    retp += clen;
1341 	}
1342 
1343 	p += clen;
1344 	len -= clen;
1345     }
1346 
1347     if (ret != CONFACK) {
1348 	if (ret == CONFREJ && *lenp == retp - p0)
1349 	    all_rejected[f->unit] = 1;
1350 	else
1351 	    *lenp = retp - p0;
1352     }
1353 #ifdef MPPE
1354     if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1355 	error("MPPE required but peer negotiation failed");
1356 	lcp_close(f->unit, "MPPE required but peer negotiation failed");
1357     }
1358 #endif
1359     return ret;
1360 }
1361 
1362 /*
1363  * Make a string name for a compression method (or 2).
1364  */
1365 static char *
1366 method_name(opt, opt2)
1367     ccp_options *opt, *opt2;
1368 {
1369     static char result[64];
1370 
1371     if (!ANY_COMPRESS(*opt))
1372 	return "(none)";
1373     switch (opt->method) {
1374 #ifdef MPPE
1375     case CI_MPPE:
1376     {
1377 	char *p = result;
1378 	char *q = result + sizeof(result); /* 1 past result */
1379 
1380 	slprintf(p, q - p, "MPPE ");
1381 	p += 5;
1382 	if (opt->mppe & MPPE_OPT_128) {
1383 	    slprintf(p, q - p, "128-bit ");
1384 	    p += 8;
1385 	}
1386 	if (opt->mppe & MPPE_OPT_40) {
1387 	    slprintf(p, q - p, "40-bit ");
1388 	    p += 7;
1389 	}
1390 	if (opt->mppe & MPPE_OPT_STATEFUL)
1391 	    slprintf(p, q - p, "stateful");
1392 	else
1393 	    slprintf(p, q - p, "stateless");
1394 
1395 	break;
1396     }
1397 #endif
1398     case CI_DEFLATE:
1399     case CI_DEFLATE_DRAFT:
1400 	if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1401 	    slprintf(result, sizeof(result), "Deflate%s (%d/%d)",
1402 		     (opt->method == CI_DEFLATE_DRAFT? "(old#)": ""),
1403 		     opt->deflate_size, opt2->deflate_size);
1404 	else
1405 	    slprintf(result, sizeof(result), "Deflate%s (%d)",
1406 		     (opt->method == CI_DEFLATE_DRAFT? "(old#)": ""),
1407 		     opt->deflate_size);
1408 	break;
1409     case CI_BSD_COMPRESS:
1410 	if (opt2 != NULL && opt2->bsd_bits != opt->bsd_bits)
1411 	    slprintf(result, sizeof(result), "BSD-Compress (%d/%d)",
1412 		     opt->bsd_bits, opt2->bsd_bits);
1413 	else
1414 	    slprintf(result, sizeof(result), "BSD-Compress (%d)",
1415 		     opt->bsd_bits);
1416 	break;
1417     case CI_PREDICTOR_1:
1418 	return "Predictor 1";
1419     case CI_PREDICTOR_2:
1420 	return "Predictor 2";
1421     default:
1422 	slprintf(result, sizeof(result), "Method %d", opt->method);
1423     }
1424     return result;
1425 }
1426 
1427 /*
1428  * CCP has come up - inform the kernel driver and log a message.
1429  */
1430 static void
1431 ccp_up(f)
1432     fsm *f;
1433 {
1434     ccp_options *go = &ccp_gotoptions[f->unit];
1435     ccp_options *ho = &ccp_hisoptions[f->unit];
1436     char method1[64];
1437 
1438     ccp_flags_set(f->unit, 1, 1);
1439     if (ANY_COMPRESS(*go)) {
1440 	if (ANY_COMPRESS(*ho)) {
1441 	    if (go->method == ho->method) {
1442 		notice("%s compression enabled", method_name(go, ho));
1443 	    } else {
1444 		strlcpy(method1, method_name(go, NULL), sizeof(method1));
1445 		notice("%s / %s compression enabled",
1446 		       method1, method_name(ho, NULL));
1447 	    }
1448 	} else
1449 	    notice("%s receive compression enabled", method_name(go, NULL));
1450     } else if (ANY_COMPRESS(*ho))
1451 	notice("%s transmit compression enabled", method_name(ho, NULL));
1452 #ifdef MPPE
1453     if (go->mppe) {
1454 	BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1455 	BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1456 	continue_networks(f->unit);		/* Bring up IP et al */
1457     }
1458 #endif
1459 }
1460 
1461 /*
1462  * CCP has gone down - inform the kernel driver.
1463  */
1464 static void
1465 ccp_down(f)
1466     fsm *f;
1467 {
1468     if (ccp_localstate[f->unit] & RACK_PENDING)
1469 	UNTIMEOUT(ccp_rack_timeout, f);
1470     ccp_localstate[f->unit] = 0;
1471     ccp_flags_set(f->unit, 1, 0);
1472 #ifdef MPPE
1473     if (ccp_gotoptions[f->unit].mppe) {
1474 	ccp_gotoptions[f->unit].mppe = 0;
1475 	if (lcp_fsm[f->unit].state == OPENED) {
1476 	    /* If LCP is not already going down, make sure it does. */
1477 	    error("MPPE disabled");
1478 	    lcp_close(f->unit, "MPPE disabled");
1479 	}
1480     }
1481 #endif
1482 }
1483 
1484 /*
1485  * Print the contents of a CCP packet.
1486  */
1487 static char *ccp_codenames[] = {
1488     "ConfReq", "ConfAck", "ConfNak", "ConfRej",
1489     "TermReq", "TermAck", "CodeRej",
1490     NULL, NULL, NULL, NULL, NULL, NULL,
1491     "ResetReq", "ResetAck",
1492 };
1493 
1494 static int
1495 ccp_printpkt(p, plen, printer, arg)
1496     u_char *p;
1497     int plen;
1498     void (*printer) __P((void *, char *, ...));
1499     void *arg;
1500 {
1501     u_char *p0, *optend;
1502     int code, id, len;
1503     int optlen;
1504 
1505     p0 = p;
1506     if (plen < HEADERLEN)
1507 	return 0;
1508     code = p[0];
1509     id = p[1];
1510     len = (p[2] << 8) + p[3];
1511     if (len < HEADERLEN || len > plen)
1512 	return 0;
1513 
1514     if (code >= 1 && code <= sizeof(ccp_codenames) / sizeof(char *)
1515 	&& ccp_codenames[code-1] != NULL)
1516 	printer(arg, " %s", ccp_codenames[code-1]);
1517     else
1518 	printer(arg, " code=0x%x", code);
1519     printer(arg, " id=0x%x", id);
1520     len -= HEADERLEN;
1521     p += HEADERLEN;
1522 
1523     switch (code) {
1524     case CONFREQ:
1525     case CONFACK:
1526     case CONFNAK:
1527     case CONFREJ:
1528 	/* print list of possible compression methods */
1529 	while (len >= 2) {
1530 	    code = p[0];
1531 	    optlen = p[1];
1532 	    if (optlen < 2 || optlen > len)
1533 		break;
1534 	    printer(arg, " <");
1535 	    len -= optlen;
1536 	    optend = p + optlen;
1537 	    switch (code) {
1538 #ifdef MPPE
1539 	    case CI_MPPE:
1540 		if (optlen >= CILEN_MPPE) {
1541 		    u_char mppe_opts;
1542 
1543 		    MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1544 		    printer(arg, "mppe %s %s %s %s %s %s%s",
1545 			    (p[2] & MPPE_H_BIT)? "+H": "-H",
1546 			    (p[5] & MPPE_M_BIT)? "+M": "-M",
1547 			    (p[5] & MPPE_S_BIT)? "+S": "-S",
1548 			    (p[5] & MPPE_L_BIT)? "+L": "-L",
1549 			    (p[5] & MPPE_D_BIT)? "+D": "-D",
1550 			    (p[5] & MPPE_C_BIT)? "+C": "-C",
1551 			    (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1552 		    if (mppe_opts & MPPE_OPT_UNKNOWN)
1553 			printer(arg, " (%.2x %.2x %.2x %.2x)",
1554 				p[2], p[3], p[4], p[5]);
1555 		    p += CILEN_MPPE;
1556 		}
1557 		break;
1558 #endif
1559 	    case CI_DEFLATE:
1560 	    case CI_DEFLATE_DRAFT:
1561 		if (optlen >= CILEN_DEFLATE) {
1562 		    printer(arg, "deflate%s %d",
1563 			    (code == CI_DEFLATE_DRAFT? "(old#)": ""),
1564 			    DEFLATE_SIZE(p[2]));
1565 		    if (DEFLATE_METHOD(p[2]) != DEFLATE_METHOD_VAL)
1566 			printer(arg, " method %d", DEFLATE_METHOD(p[2]));
1567 		    if (p[3] != DEFLATE_CHK_SEQUENCE)
1568 			printer(arg, " check %d", p[3]);
1569 		    p += CILEN_DEFLATE;
1570 		}
1571 		break;
1572 	    case CI_BSD_COMPRESS:
1573 		if (optlen >= CILEN_BSD_COMPRESS) {
1574 		    printer(arg, "bsd v%d %d", BSD_VERSION(p[2]),
1575 			    BSD_NBITS(p[2]));
1576 		    p += CILEN_BSD_COMPRESS;
1577 		}
1578 		break;
1579 	    case CI_PREDICTOR_1:
1580 		if (optlen >= CILEN_PREDICTOR_1) {
1581 		    printer(arg, "predictor 1");
1582 		    p += CILEN_PREDICTOR_1;
1583 		}
1584 		break;
1585 	    case CI_PREDICTOR_2:
1586 		if (optlen >= CILEN_PREDICTOR_2) {
1587 		    printer(arg, "predictor 2");
1588 		    p += CILEN_PREDICTOR_2;
1589 		}
1590 		break;
1591 	    }
1592 	    while (p < optend)
1593 		printer(arg, " %.2x", *p++);
1594 	    printer(arg, ">");
1595 	}
1596 	break;
1597 
1598     case TERMACK:
1599     case TERMREQ:
1600 	if (len > 0 && *p >= ' ' && *p < 0x7f) {
1601 	    print_string((char *)p, len, printer, arg);
1602 	    p += len;
1603 	    len = 0;
1604 	}
1605 	break;
1606     }
1607 
1608     /* dump out the rest of the packet in hex */
1609     while (--len >= 0)
1610 	printer(arg, " %.2x", *p++);
1611 
1612     return p - p0;
1613 }
1614 
1615 /*
1616  * We have received a packet that the decompressor failed to
1617  * decompress.  Here we would expect to issue a reset-request, but
1618  * Motorola has a patent on resetting the compressor as a result of
1619  * detecting an error in the decompressed data after decompression.
1620  * (See US patent 5,130,993; international patent publication number
1621  * WO 91/10289; Australian patent 73296/91.)
1622  *
1623  * So we ask the kernel whether the error was detected after
1624  * decompression; if it was, we take CCP down, thus disabling
1625  * compression :-(, otherwise we issue the reset-request.
1626  */
1627 static void
1628 ccp_datainput(unit, pkt, len)
1629     int unit;
1630     u_char *pkt;
1631     int len;
1632 {
1633     fsm *f;
1634 
1635     f = &ccp_fsm[unit];
1636     if (f->state == OPENED) {
1637 	if (ccp_fatal_error(unit)) {
1638 	    /*
1639 	     * Disable compression by taking CCP down.
1640 	     */
1641 	    error("Lost compression sync: disabling compression");
1642 	    ccp_close(unit, "Lost compression sync");
1643 #ifdef MPPE
1644 	    /*
1645 	     * If we were doing MPPE, we must also take the link down.
1646 	     */
1647 	    if (ccp_gotoptions[unit].mppe) {
1648 		error("Too many MPPE errors, closing LCP");
1649 		lcp_close(unit, "Too many MPPE errors");
1650 	    }
1651 #endif
1652 	} else {
1653 	    /*
1654 	     * Send a reset-request to reset the peer's compressor.
1655 	     * We don't do that if we are still waiting for an
1656 	     * acknowledgement to a previous reset-request.
1657 	     */
1658 	    if (!(ccp_localstate[f->unit] & RACK_PENDING)) {
1659 		fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1660 		TIMEOUT(ccp_rack_timeout, f, RACKTIMEOUT);
1661 		ccp_localstate[f->unit] |= RACK_PENDING;
1662 	    } else
1663 		ccp_localstate[f->unit] |= RREQ_REPEAT;
1664 	}
1665     }
1666 }
1667 
1668 /*
1669  * Timeout waiting for reset-ack.
1670  */
1671 static void
1672 ccp_rack_timeout(arg)
1673     void *arg;
1674 {
1675     fsm *f = arg;
1676 
1677     if (f->state == OPENED && ccp_localstate[f->unit] & RREQ_REPEAT) {
1678 	fsm_sdata(f, CCP_RESETREQ, f->reqid, NULL, 0);
1679 	TIMEOUT(ccp_rack_timeout, f, RACKTIMEOUT);
1680 	ccp_localstate[f->unit] &= ~RREQ_REPEAT;
1681     } else
1682 	ccp_localstate[f->unit] &= ~RACK_PENDING;
1683 }
1684 
1685