2 * Copyright (c) 2000 Semen Ustimenko <semenu@FreeBSD.org>
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * $FreeBSD: src/usr.sbin/ppp/mppe.c,v 1.4.2.6 2002/09/01 02:12:29 brian Exp $
29 #include <sys/param.h>
31 #include <sys/socket.h>
32 #include <netinet/in_systm.h>
33 #include <netinet/in.h>
34 #include <netinet/ip.h>
41 #include <openssl/rc4.h>
52 #include "throughput.h"
59 #include "descriptor.h"
65 #include "slcompress.h"
76 * draft-ietf-pppext-mppe-04.txt
77 * draft-ietf-pppext-mppe-keys-02.txt
80 #define MPPE_OPT_STATELESS 0x1000000
81 #define MPPE_OPT_COMPRESSED 0x01
82 #define MPPE_OPT_40BIT 0x20
83 #define MPPE_OPT_56BIT 0x80
84 #define MPPE_OPT_128BIT 0x40
85 #define MPPE_OPT_BITMASK 0xe0
86 #define MPPE_OPT_MASK (MPPE_OPT_STATELESS | MPPE_OPT_BITMASK)
88 #define MPPE_FLUSHED 0x8000
89 #define MPPE_ENCRYPTED 0x1000
90 #define MPPE_HEADER_BITMASK 0xf000
91 #define MPPE_HEADER_FLAG 0x00ff
92 #define MPPE_HEADER_FLAGMASK 0x00ff
93 #define MPPE_HEADER_FLAGSHIFT 8
94 #define MPPE_HEADER_STATEFUL_KEYCHANGES 16
97 unsigned stateless : 1;
98 unsigned flushnext : 1;
99 unsigned flushrequired : 1;
101 unsigned keylen; /* 8 or 16 bytes */
102 int keybits; /* 40, 56 or 128 bits */
103 char sesskey[MPPE_KEY_LEN];
104 char mastkey[MPPE_KEY_LEN];
108 int MPPE_MasterKeyValid = 0;
109 int MPPE_IsServer = 0;
110 char MPPE_MasterKey[MPPE_KEY_LEN];
113 * The peer has missed a packet. Mark the next output frame to be FLUSHED
116 MPPEResetOutput(void *v)
118 struct mppe_state *mop = (struct mppe_state *)v;
121 log_Printf(LogCCP, "MPPE: Unexpected output channel reset\n");
123 log_Printf(LogCCP, "MPPE: Output channel reset\n");
127 return 0; /* Ask FSM not to ACK */
131 MPPEReduceSessionKey(struct mppe_state *mp)
133 switch(mp->keybits) {
135 mp->sesskey[2] = 0x9e;
136 mp->sesskey[1] = 0x26;
139 mp->sesskey[0] = 0xd1;
146 MPPEKeyChange(struct mppe_state *mp)
148 char InterimKey[MPPE_KEY_LEN];
151 GetNewKeyFromSHA(mp->mastkey, mp->sesskey, mp->keylen, InterimKey);
152 RC4_set_key(&RC4Key, mp->keylen, InterimKey);
153 RC4(&RC4Key, mp->keylen, InterimKey, mp->sesskey);
155 MPPEReduceSessionKey(mp);
159 MPPEOutput(void *v, struct ccp *ccp, struct link *l __unused, int pri __unused,
160 u_short *proto, struct mbuf *mp)
162 struct mppe_state *mop = (struct mppe_state *)v;
164 u_short nproto, prefix;
165 int dictinit, ilen, len;
171 log_Printf(LogDEBUG, "MPPE: Output: Proto %02x (%d bytes)\n", *proto, ilen);
172 if (*proto < 0x21 || *proto > 0xFA) {
173 log_Printf(LogDEBUG, "MPPE: Output: Not encrypting\n");
174 ccp->compout += ilen;
175 ccp->uncompout += ilen;
179 log_DumpBp(LogDEBUG, "MPPE: Output: Encrypt packet:", mp);
181 /* Get mbuf for prefixes */
182 mo = m_get(4, MB_CCPOUT);
186 prefix = MPPE_ENCRYPTED | mop->cohnum;
188 if (mop->stateless ||
189 (mop->cohnum & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG) {
191 log_Printf(LogDEBUG, "MPPEOutput: Key changed [%d]\n", mop->cohnum);
196 if (mop->stateless || mop->flushnext) {
197 prefix |= MPPE_FLUSHED;
203 /* Initialise our dictionary */
204 log_Printf(LogDEBUG, "MPPEOutput: Dictionary initialised [%d]\n",
206 RC4_set_key(&mop->rc4key, mop->keylen, mop->sesskey);
209 /* Set MPPE packet prefix */
210 ua_htons(&prefix, rp);
212 /* Save encrypted protocol number */
213 nproto = htons(*proto);
214 RC4(&mop->rc4key, 2, (char *)&nproto, rp + 2);
216 /* Encrypt main packet */
218 RC4(&mop->rc4key, ilen, rp, rp);
221 mop->cohnum &= ~MPPE_HEADER_BITMASK;
223 /* Set the protocol number */
224 *proto = ccp_Proto(ccp);
226 ccp->uncompout += ilen;
229 log_Printf(LogDEBUG, "MPPE: Output: Encrypted: Proto %02x (%d bytes)\n",
236 MPPEResetInput(void *v __unused)
238 log_Printf(LogCCP, "MPPE: Unexpected input channel ack\n");
242 MPPEInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mp)
244 struct mppe_state *mip = (struct mppe_state *)v;
247 int dictinit, flushed, ilen, len, n;
253 log_Printf(LogDEBUG, "MPPE: Input: Proto %02x (%d bytes)\n", *proto, ilen);
254 log_DumpBp(LogDEBUG, "MPPE: Input: Packet:", mp);
256 mp = mbuf_Read(mp, &prefix, 2);
257 prefix = ntohs(prefix);
258 flushed = prefix & MPPE_FLUSHED;
260 if ((prefix & MPPE_HEADER_BITMASK) != MPPE_ENCRYPTED) {
261 log_Printf(LogERROR, "MPPE: Input: Invalid packet (flags = 0x%x)\n",
262 (prefix & MPPE_HEADER_BITMASK) | flushed);
267 prefix &= ~MPPE_HEADER_BITMASK;
269 if (!flushed && mip->stateless) {
270 log_Printf(LogCCP, "MPPEInput: Packet without MPPE_FLUSHED set"
271 " in stateless mode\n");
272 flushed = MPPE_FLUSHED;
273 /* Should we really continue ? */
276 if (mip->stateless) {
277 /* Change our key for each missed packet in stateless mode */
278 while (prefix != mip->cohnum) {
279 log_Printf(LogDEBUG, "MPPEInput: Key changed [%u]\n", prefix);
282 * mip->cohnum contains what we received last time in stateless
286 mip->cohnum &= ~MPPE_HEADER_BITMASK;
292 * We can always process a flushed packet.
293 * Catch up on any outstanding key changes.
295 n = (prefix >> MPPE_HEADER_FLAGSHIFT) -
296 (mip->cohnum >> MPPE_HEADER_FLAGSHIFT);
298 n += MPPE_HEADER_STATEFUL_KEYCHANGES;
300 log_Printf(LogDEBUG, "MPPEInput: Key changed during catchup [%u]\n",
304 mip->flushrequired = 0;
305 mip->cohnum = prefix;
309 if (mip->flushrequired) {
311 * Perhaps we should be lenient if
312 * (prefix & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG
313 * The spec says that we shouldn't be though....
315 log_Printf(LogDEBUG, "MPPE: Not flushed - discarded\n");
316 fsm_Output(&ccp->fsm, CODE_RESETREQ, ccp->fsm.reqid++, NULL, 0,
322 if (prefix != mip->cohnum) {
324 * We're in stateful mode and didn't receive the expected
325 * packet. Send a reset request, but don't tell the CCP layer
326 * about it as we don't expect to receive a Reset ACK !
327 * Guess what... M$ invented this !
329 log_Printf(LogCCP, "MPPE: Input: Got seq %u, not %u\n",
330 prefix, mip->cohnum);
331 fsm_Output(&ccp->fsm, CODE_RESETREQ, ccp->fsm.reqid++, NULL, 0,
333 mip->flushrequired = 1;
338 if ((prefix & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG) {
339 log_Printf(LogDEBUG, "MPPEInput: Key changed [%u]\n", prefix);
346 * mip->cohnum contains what we expect to receive next time in stateful
350 mip->cohnum &= ~MPPE_HEADER_BITMASK;
354 log_Printf(LogDEBUG, "MPPEInput: Dictionary initialised [%u]\n", prefix);
355 RC4_set_key(&mip->rc4key, mip->keylen, mip->sesskey);
358 mp = mbuf_Read(mp, proto, 2);
359 RC4(&mip->rc4key, 2, (char *)proto, (char *)proto);
360 *proto = ntohs(*proto);
364 RC4(&mip->rc4key, len, rp, rp);
366 log_Printf(LogDEBUG, "MPPEInput: Decrypted: Proto %02x (%d bytes)\n",
368 log_DumpBp(LogDEBUG, "MPPEInput: Decrypted: Packet:", mp);
370 ccp->uncompin += len;
376 MPPEDictSetup(void *v __unused, struct ccp *ccp __unused,
377 u_short proto __unused, struct mbuf *mp __unused)
379 /* Nothing to see here */
383 MPPEDispOpts(struct fsm_opt *o)
390 ua_ntohl(o->data, &val);
392 if ((n = snprintf(buf, sizeof buf, "value 0x%08x ", (unsigned)val)) > 0)
394 if (!(val & MPPE_OPT_BITMASK)) {
395 if ((n = snprintf(buf + len, sizeof buf - len, "(0")) > 0)
399 if (val & MPPE_OPT_128BIT) {
400 if ((n = snprintf(buf + len, sizeof buf - len, "%c128", ch)) > 0)
404 if (val & MPPE_OPT_56BIT) {
405 if ((n = snprintf(buf + len, sizeof buf - len, "%c56", ch)) > 0)
409 if (val & MPPE_OPT_40BIT) {
410 if ((n = snprintf(buf + len, sizeof buf - len, "%c40", ch)) > 0)
416 if ((n = snprintf(buf + len, sizeof buf - len, " bits, state%s",
417 (val & MPPE_OPT_STATELESS) ? "less" : "ful")) > 0)
420 if (val & MPPE_OPT_COMPRESSED) {
421 if ((n = snprintf(buf + len, sizeof buf - len, ", compressed")) > 0)
425 snprintf(buf + len, sizeof buf - len, ")");
431 MPPEUsable(struct fsm *fp)
435 struct radius *r = &fp->bundle->radius;
438 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES,
439 * use that instead of our configuration value.
442 ok = r->mppe.sendkeylen && r->mppe.recvkeylen;
444 log_Printf(LogCCP, "MPPE: Not permitted by RADIUS server\n");
448 struct lcp *lcp = &fp->link->lcp;
449 ok = (lcp->want_auth == PROTO_CHAP && lcp->want_authtype == 0x81) ||
450 (lcp->his_auth == PROTO_CHAP && lcp->his_authtype == 0x81);
452 log_Printf(LogCCP, "MPPE: Not usable without CHAP81\n");
459 MPPERequired(struct fsm *fp)
463 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY,
464 * use that instead of our configuration value.
466 if (*fp->bundle->radius.cfg.file && fp->bundle->radius.mppe.policy)
467 return fp->bundle->radius.mppe.policy == MPPE_POLICY_REQUIRED ? 1 : 0;
470 return fp->link->ccp.cfg.mppe.required;
474 MPPE_ConfigVal(struct bundle *bundle __unused, const struct ccp_config *cfg)
478 val = cfg->mppe.state == MPPE_STATELESS ? MPPE_OPT_STATELESS : 0;
481 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES,
482 * use that instead of our configuration value.
484 if (*bundle->radius.cfg.file && bundle->radius.mppe.types) {
485 if (bundle->radius.mppe.types & MPPE_TYPE_40BIT)
486 val |= MPPE_OPT_40BIT;
487 if (bundle->radius.mppe.types & MPPE_TYPE_128BIT)
488 val |= MPPE_OPT_128BIT;
491 switch(cfg->mppe.keybits) {
493 val |= MPPE_OPT_128BIT;
496 val |= MPPE_OPT_56BIT;
499 val |= MPPE_OPT_40BIT;
502 val |= MPPE_OPT_128BIT | MPPE_OPT_56BIT | MPPE_OPT_40BIT;
510 * What options should we use for our first configure request
513 MPPEInitOptsOutput(struct bundle *bundle, struct fsm_opt *o,
514 const struct ccp_config *cfg)
520 if (!MPPE_MasterKeyValid) {
521 log_Printf(LogCCP, "MPPE: MasterKey is invalid,"
522 " MPPE is available only with CHAP81 authentication\n");
524 ua_htonl(&mval, o->data);
529 mval = MPPE_ConfigVal(bundle, cfg);
530 ua_htonl(&mval, o->data);
534 * Our CCP request was NAK'd with the given options
537 MPPESetOptsOutput(struct bundle *bundle, struct fsm_opt *o,
538 const struct ccp_config *cfg)
540 u_int32_t mval, peer;
542 ua_ntohl(o->data, &peer);
544 if (!MPPE_MasterKeyValid)
545 /* Treat their NAK as a REJ */
548 mval = MPPE_ConfigVal(bundle, cfg);
551 * If we haven't been configured with a specific number of keybits, allow
552 * whatever the peer asks for.
554 if (!cfg->mppe.keybits) {
555 mval &= ~MPPE_OPT_BITMASK;
556 mval |= (peer & MPPE_OPT_BITMASK);
557 if (!(mval & MPPE_OPT_BITMASK))
558 mval |= MPPE_OPT_128BIT;
561 /* Adjust our statelessness */
562 if (cfg->mppe.state == MPPE_ANYSTATE) {
563 mval &= ~MPPE_OPT_STATELESS;
564 mval |= (peer & MPPE_OPT_STATELESS);
567 ua_htonl(&mval, o->data);
573 * The peer has requested the given options
576 MPPESetOptsInput(struct bundle *bundle, struct fsm_opt *o,
577 const struct ccp_config *cfg)
579 u_int32_t mval, peer;
582 ua_ntohl(o->data, &peer);
583 if (!MPPE_MasterKeyValid) {
586 ua_htonl(&peer, o->data);
592 mval = MPPE_ConfigVal(bundle, cfg);
594 if (peer & ~MPPE_OPT_MASK)
595 /* He's asking for bits we don't know about */
598 if (peer & MPPE_OPT_STATELESS) {
599 if (cfg->mppe.state == MPPE_STATEFUL)
600 /* Peer can't have stateless */
603 /* Peer wants stateless, that's ok */
604 mval |= MPPE_OPT_STATELESS;
606 if (cfg->mppe.state == MPPE_STATELESS)
607 /* Peer must have stateless */
610 /* Peer doesn't want stateless, that's ok */
611 mval &= ~MPPE_OPT_STATELESS;
614 /* If we've got a configured number of keybits - the peer must use that */
615 if (cfg->mppe.keybits) {
616 ua_htonl(&mval, o->data);
617 return peer == mval ? res : MODE_NAK;
620 /* If a specific number of bits hasn't been requested, we'll need to NAK */
621 switch (peer & MPPE_OPT_BITMASK) {
622 case MPPE_OPT_128BIT:
630 /* Suggest the best number of bits */
631 mval &= ~MPPE_OPT_BITMASK;
632 if (peer & MPPE_OPT_128BIT)
633 mval |= MPPE_OPT_128BIT;
634 else if (peer & MPPE_OPT_56BIT)
635 mval |= MPPE_OPT_56BIT;
636 else if (peer & MPPE_OPT_40BIT)
637 mval |= MPPE_OPT_40BIT;
639 mval |= MPPE_OPT_128BIT;
640 ua_htonl(&mval, o->data);
645 static struct mppe_state *
646 MPPE_InitState(struct fsm_opt *o)
648 struct mppe_state *mp;
651 if ((mp = calloc(1, sizeof *mp)) != NULL) {
652 ua_ntohl(o->data, &val);
654 switch (val & MPPE_OPT_BITMASK) {
655 case MPPE_OPT_128BIT:
668 log_Printf(LogWARN, "Unexpected MPPE options 0x%08x\n", val);
673 mp->stateless = !!(val & MPPE_OPT_STATELESS);
680 MPPEInitInput(struct bundle *bundle __unused, struct fsm_opt *o)
682 struct mppe_state *mip;
684 if (!MPPE_MasterKeyValid) {
685 log_Printf(LogWARN, "MPPE: Cannot initialise without CHAP81\n");
689 if ((mip = MPPE_InitState(o)) == NULL) {
690 log_Printf(LogWARN, "MPPEInput: Cannot initialise - unexpected options\n");
694 log_Printf(LogDEBUG, "MPPE: InitInput: %d-bits\n", mip->keybits);
697 if (*bundle->radius.cfg.file && bundle->radius.mppe.recvkey) {
698 if (mip->keylen > bundle->radius.mppe.recvkeylen)
699 mip->keylen = bundle->radius.mppe.recvkeylen;
700 if (mip->keylen > sizeof mip->mastkey)
701 mip->keylen = sizeof mip->mastkey;
702 memcpy(mip->mastkey, bundle->radius.mppe.recvkey, mip->keylen);
705 GetAsymetricStartKey(MPPE_MasterKey, mip->mastkey, mip->keylen, 0,
708 GetNewKeyFromSHA(mip->mastkey, mip->mastkey, mip->keylen, mip->sesskey);
710 MPPEReduceSessionKey(mip);
712 log_Printf(LogCCP, "MPPE: Input channel initiated\n");
714 if (!mip->stateless) {
716 * We need to initialise our dictionary here as the first packet we
717 * receive is unlikely to have the FLUSHED bit set.
719 log_Printf(LogDEBUG, "MPPEInitInput: Dictionary initialised [%d]\n",
721 RC4_set_key(&mip->rc4key, mip->keylen, mip->sesskey);
724 * We do the first key change here as the first packet is expected
725 * to have a sequence number of 0 and we'll therefore not expect
726 * to have to change the key at that point.
728 log_Printf(LogDEBUG, "MPPEInitInput: Key changed [%d]\n", mip->cohnum);
736 MPPEInitOutput(struct bundle *bundle __unused, struct fsm_opt *o)
738 struct mppe_state *mop;
740 if (!MPPE_MasterKeyValid) {
741 log_Printf(LogWARN, "MPPE: Cannot initialise without CHAP81\n");
745 if ((mop = MPPE_InitState(o)) == NULL) {
746 log_Printf(LogWARN, "MPPEOutput: Cannot initialise - unexpected options\n");
750 log_Printf(LogDEBUG, "MPPE: InitOutput: %d-bits\n", mop->keybits);
753 if (*bundle->radius.cfg.file && bundle->radius.mppe.sendkey) {
754 if (mop->keylen > bundle->radius.mppe.sendkeylen)
755 mop->keylen = bundle->radius.mppe.sendkeylen;
756 if (mop->keylen > sizeof mop->mastkey)
757 mop->keylen = sizeof mop->mastkey;
758 memcpy(mop->mastkey, bundle->radius.mppe.sendkey, mop->keylen);
761 GetAsymetricStartKey(MPPE_MasterKey, mop->mastkey, mop->keylen, 1,
764 GetNewKeyFromSHA(mop->mastkey, mop->mastkey, mop->keylen, mop->sesskey);
766 MPPEReduceSessionKey(mop);
768 log_Printf(LogCCP, "MPPE: Output channel initiated\n");
770 if (!mop->stateless) {
772 * We need to initialise our dictionary now as the first packet we
773 * send won't have the FLUSHED bit set.
775 log_Printf(LogDEBUG, "MPPEInitOutput: Dictionary initialised [%d]\n",
777 RC4_set_key(&mop->rc4key, mop->keylen, mop->sesskey);
784 MPPETermInput(void *v)
790 MPPETermOutput(void *v)
795 const struct ccp_algorithm MPPEAlgorithm = {