2 * Copyright (c) 2000 Semen Ustimenko <semenu@FreeBSD.org>
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * $FreeBSD: src/usr.sbin/ppp/mppe.c,v 1.4.2.6 2002/09/01 02:12:29 brian Exp $
29 #include <sys/param.h>
31 #include <sys/socket.h>
32 #include <netinet/in_systm.h>
33 #include <netinet/in.h>
34 #include <netinet/ip.h>
41 #include <openssl/rc4.h>
52 #include "throughput.h"
59 #include "descriptor.h"
65 #include "slcompress.h"
76 * draft-ietf-pppext-mppe-04.txt
77 * draft-ietf-pppext-mppe-keys-02.txt
80 #define MPPE_OPT_STATELESS 0x1000000
81 #define MPPE_OPT_COMPRESSED 0x01
82 #define MPPE_OPT_40BIT 0x20
83 #define MPPE_OPT_56BIT 0x80
84 #define MPPE_OPT_128BIT 0x40
85 #define MPPE_OPT_BITMASK 0xe0
86 #define MPPE_OPT_MASK (MPPE_OPT_STATELESS | MPPE_OPT_BITMASK)
88 #define MPPE_FLUSHED 0x8000
89 #define MPPE_ENCRYPTED 0x1000
90 #define MPPE_HEADER_BITMASK 0xf000
91 #define MPPE_HEADER_FLAG 0x00ff
92 #define MPPE_HEADER_FLAGMASK 0x00ff
93 #define MPPE_HEADER_FLAGSHIFT 8
94 #define MPPE_HEADER_STATEFUL_KEYCHANGES 16
97 unsigned stateless : 1;
98 unsigned flushnext : 1;
99 unsigned flushrequired : 1;
101 unsigned keylen; /* 8 or 16 bytes */
102 int keybits; /* 40, 56 or 128 bits */
103 char sesskey[MPPE_KEY_LEN];
104 char mastkey[MPPE_KEY_LEN];
108 int MPPE_MasterKeyValid = 0;
109 int MPPE_IsServer = 0;
110 char MPPE_MasterKey[MPPE_KEY_LEN];
113 * The peer has missed a packet. Mark the next output frame to be FLUSHED
116 MPPEResetOutput(void *v)
118 struct mppe_state *mop = (struct mppe_state *)v;
121 log_Printf(LogCCP, "MPPE: Unexpected output channel reset\n");
123 log_Printf(LogCCP, "MPPE: Output channel reset\n");
127 return 0; /* Ask FSM not to ACK */
131 MPPEReduceSessionKey(struct mppe_state *mp)
133 switch(mp->keybits) {
135 mp->sesskey[2] = 0x9e;
136 mp->sesskey[1] = 0x26;
138 mp->sesskey[0] = 0xd1;
145 MPPEKeyChange(struct mppe_state *mp)
147 char InterimKey[MPPE_KEY_LEN];
150 GetNewKeyFromSHA(mp->mastkey, mp->sesskey, mp->keylen, InterimKey);
151 RC4_set_key(&RC4Key, mp->keylen, InterimKey);
152 RC4(&RC4Key, mp->keylen, InterimKey, mp->sesskey);
154 MPPEReduceSessionKey(mp);
158 MPPEOutput(void *v, struct ccp *ccp, struct link *l __unused, int pri __unused,
159 u_short *proto, struct mbuf *mp)
161 struct mppe_state *mop = (struct mppe_state *)v;
163 u_short nproto, prefix;
164 int dictinit, ilen, len;
170 log_Printf(LogDEBUG, "MPPE: Output: Proto %02x (%d bytes)\n", *proto, ilen);
171 if (*proto < 0x21 || *proto > 0xFA) {
172 log_Printf(LogDEBUG, "MPPE: Output: Not encrypting\n");
173 ccp->compout += ilen;
174 ccp->uncompout += ilen;
178 log_DumpBp(LogDEBUG, "MPPE: Output: Encrypt packet:", mp);
180 /* Get mbuf for prefixes */
181 mo = m_get(4, MB_CCPOUT);
185 prefix = MPPE_ENCRYPTED | mop->cohnum;
187 if (mop->stateless ||
188 (mop->cohnum & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG) {
190 log_Printf(LogDEBUG, "MPPEOutput: Key changed [%d]\n", mop->cohnum);
195 if (mop->stateless || mop->flushnext) {
196 prefix |= MPPE_FLUSHED;
202 /* Initialise our dictionary */
203 log_Printf(LogDEBUG, "MPPEOutput: Dictionary initialised [%d]\n",
205 RC4_set_key(&mop->rc4key, mop->keylen, mop->sesskey);
208 /* Set MPPE packet prefix */
209 ua_htons(&prefix, rp);
211 /* Save encrypted protocol number */
212 nproto = htons(*proto);
213 RC4(&mop->rc4key, 2, (char *)&nproto, rp + 2);
215 /* Encrypt main packet */
217 RC4(&mop->rc4key, ilen, rp, rp);
220 mop->cohnum &= ~MPPE_HEADER_BITMASK;
222 /* Set the protocol number */
223 *proto = ccp_Proto(ccp);
225 ccp->uncompout += ilen;
228 log_Printf(LogDEBUG, "MPPE: Output: Encrypted: Proto %02x (%d bytes)\n",
235 MPPEResetInput(void *v __unused)
237 log_Printf(LogCCP, "MPPE: Unexpected input channel ack\n");
241 MPPEInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mp)
243 struct mppe_state *mip = (struct mppe_state *)v;
246 int dictinit, flushed, ilen, len, n;
252 log_Printf(LogDEBUG, "MPPE: Input: Proto %02x (%d bytes)\n", *proto, ilen);
253 log_DumpBp(LogDEBUG, "MPPE: Input: Packet:", mp);
255 mp = mbuf_Read(mp, &prefix, 2);
256 prefix = ntohs(prefix);
257 flushed = prefix & MPPE_FLUSHED;
259 if ((prefix & MPPE_HEADER_BITMASK) != MPPE_ENCRYPTED) {
260 log_Printf(LogERROR, "MPPE: Input: Invalid packet (flags = 0x%x)\n",
261 (prefix & MPPE_HEADER_BITMASK) | flushed);
266 prefix &= ~MPPE_HEADER_BITMASK;
268 if (!flushed && mip->stateless) {
269 log_Printf(LogCCP, "MPPEInput: Packet without MPPE_FLUSHED set"
270 " in stateless mode\n");
271 flushed = MPPE_FLUSHED;
272 /* Should we really continue ? */
275 if (mip->stateless) {
276 /* Change our key for each missed packet in stateless mode */
277 while (prefix != mip->cohnum) {
278 log_Printf(LogDEBUG, "MPPEInput: Key changed [%u]\n", prefix);
281 * mip->cohnum contains what we received last time in stateless
285 mip->cohnum &= ~MPPE_HEADER_BITMASK;
291 * We can always process a flushed packet.
292 * Catch up on any outstanding key changes.
294 n = (prefix >> MPPE_HEADER_FLAGSHIFT) -
295 (mip->cohnum >> MPPE_HEADER_FLAGSHIFT);
297 n += MPPE_HEADER_STATEFUL_KEYCHANGES;
299 log_Printf(LogDEBUG, "MPPEInput: Key changed during catchup [%u]\n",
303 mip->flushrequired = 0;
304 mip->cohnum = prefix;
308 if (mip->flushrequired) {
310 * Perhaps we should be lenient if
311 * (prefix & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG
312 * The spec says that we shouldn't be though....
314 log_Printf(LogDEBUG, "MPPE: Not flushed - discarded\n");
315 fsm_Output(&ccp->fsm, CODE_RESETREQ, ccp->fsm.reqid++, NULL, 0,
321 if (prefix != mip->cohnum) {
323 * We're in stateful mode and didn't receive the expected
324 * packet. Send a reset request, but don't tell the CCP layer
325 * about it as we don't expect to receive a Reset ACK !
326 * Guess what... M$ invented this !
328 log_Printf(LogCCP, "MPPE: Input: Got seq %u, not %u\n",
329 prefix, mip->cohnum);
330 fsm_Output(&ccp->fsm, CODE_RESETREQ, ccp->fsm.reqid++, NULL, 0,
332 mip->flushrequired = 1;
337 if ((prefix & MPPE_HEADER_FLAGMASK) == MPPE_HEADER_FLAG) {
338 log_Printf(LogDEBUG, "MPPEInput: Key changed [%u]\n", prefix);
345 * mip->cohnum contains what we expect to receive next time in stateful
349 mip->cohnum &= ~MPPE_HEADER_BITMASK;
353 log_Printf(LogDEBUG, "MPPEInput: Dictionary initialised [%u]\n", prefix);
354 RC4_set_key(&mip->rc4key, mip->keylen, mip->sesskey);
357 mp = mbuf_Read(mp, proto, 2);
358 RC4(&mip->rc4key, 2, (char *)proto, (char *)proto);
359 *proto = ntohs(*proto);
363 RC4(&mip->rc4key, len, rp, rp);
365 log_Printf(LogDEBUG, "MPPEInput: Decrypted: Proto %02x (%d bytes)\n",
367 log_DumpBp(LogDEBUG, "MPPEInput: Decrypted: Packet:", mp);
369 ccp->uncompin += len;
375 MPPEDictSetup(void *v __unused, struct ccp *ccp __unused,
376 u_short proto __unused, struct mbuf *mp __unused)
378 /* Nothing to see here */
382 MPPEDispOpts(struct fsm_opt *o)
389 ua_ntohl(o->data, &val);
391 if ((n = snprintf(buf, sizeof buf, "value 0x%08x ", (unsigned)val)) > 0)
393 if (!(val & MPPE_OPT_BITMASK)) {
394 if ((n = snprintf(buf + len, sizeof buf - len, "(0")) > 0)
398 if (val & MPPE_OPT_128BIT) {
399 if ((n = snprintf(buf + len, sizeof buf - len, "%c128", ch)) > 0)
403 if (val & MPPE_OPT_56BIT) {
404 if ((n = snprintf(buf + len, sizeof buf - len, "%c56", ch)) > 0)
408 if (val & MPPE_OPT_40BIT) {
409 if ((n = snprintf(buf + len, sizeof buf - len, "%c40", ch)) > 0)
415 if ((n = snprintf(buf + len, sizeof buf - len, " bits, state%s",
416 (val & MPPE_OPT_STATELESS) ? "less" : "ful")) > 0)
419 if (val & MPPE_OPT_COMPRESSED) {
420 if ((n = snprintf(buf + len, sizeof buf - len, ", compressed")) > 0)
424 snprintf(buf + len, sizeof buf - len, ")");
430 MPPEUsable(struct fsm *fp)
434 struct radius *r = &fp->bundle->radius;
437 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES,
438 * use that instead of our configuration value.
441 ok = r->mppe.sendkeylen && r->mppe.recvkeylen;
443 log_Printf(LogCCP, "MPPE: Not permitted by RADIUS server\n");
447 struct lcp *lcp = &fp->link->lcp;
448 ok = (lcp->want_auth == PROTO_CHAP && lcp->want_authtype == 0x81) ||
449 (lcp->his_auth == PROTO_CHAP && lcp->his_authtype == 0x81);
451 log_Printf(LogCCP, "MPPE: Not usable without CHAP81\n");
458 MPPERequired(struct fsm *fp)
462 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY,
463 * use that instead of our configuration value.
465 if (*fp->bundle->radius.cfg.file && fp->bundle->radius.mppe.policy)
466 return fp->bundle->radius.mppe.policy == MPPE_POLICY_REQUIRED ? 1 : 0;
469 return fp->link->ccp.cfg.mppe.required;
473 MPPE_ConfigVal(struct bundle *bundle, const struct ccp_config *cfg)
477 val = cfg->mppe.state == MPPE_STATELESS ? MPPE_OPT_STATELESS : 0;
480 * If the radius server gave us RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES,
481 * use that instead of our configuration value.
483 if (*bundle->radius.cfg.file && bundle->radius.mppe.types) {
484 if (bundle->radius.mppe.types & MPPE_TYPE_40BIT)
485 val |= MPPE_OPT_40BIT;
486 if (bundle->radius.mppe.types & MPPE_TYPE_128BIT)
487 val |= MPPE_OPT_128BIT;
490 switch(cfg->mppe.keybits) {
492 val |= MPPE_OPT_128BIT;
495 val |= MPPE_OPT_56BIT;
498 val |= MPPE_OPT_40BIT;
501 val |= MPPE_OPT_128BIT | MPPE_OPT_56BIT | MPPE_OPT_40BIT;
509 * What options should we use for our first configure request
512 MPPEInitOptsOutput(struct bundle *bundle, struct fsm_opt *o,
513 const struct ccp_config *cfg)
519 if (!MPPE_MasterKeyValid) {
520 log_Printf(LogCCP, "MPPE: MasterKey is invalid,"
521 " MPPE is available only with CHAP81 authentication\n");
523 ua_htonl(&mval, o->data);
528 mval = MPPE_ConfigVal(bundle, cfg);
529 ua_htonl(&mval, o->data);
533 * Our CCP request was NAK'd with the given options
536 MPPESetOptsOutput(struct bundle *bundle, struct fsm_opt *o,
537 const struct ccp_config *cfg)
539 u_int32_t mval, peer;
541 ua_ntohl(o->data, &peer);
543 if (!MPPE_MasterKeyValid)
544 /* Treat their NAK as a REJ */
547 mval = MPPE_ConfigVal(bundle, cfg);
550 * If we haven't been configured with a specific number of keybits, allow
551 * whatever the peer asks for.
553 if (!cfg->mppe.keybits) {
554 mval &= ~MPPE_OPT_BITMASK;
555 mval |= (peer & MPPE_OPT_BITMASK);
556 if (!(mval & MPPE_OPT_BITMASK))
557 mval |= MPPE_OPT_128BIT;
560 /* Adjust our statelessness */
561 if (cfg->mppe.state == MPPE_ANYSTATE) {
562 mval &= ~MPPE_OPT_STATELESS;
563 mval |= (peer & MPPE_OPT_STATELESS);
566 ua_htonl(&mval, o->data);
572 * The peer has requested the given options
575 MPPESetOptsInput(struct bundle *bundle, struct fsm_opt *o,
576 const struct ccp_config *cfg)
578 u_int32_t mval, peer;
581 ua_ntohl(o->data, &peer);
582 if (!MPPE_MasterKeyValid) {
585 ua_htonl(&peer, o->data);
591 mval = MPPE_ConfigVal(bundle, cfg);
593 if (peer & ~MPPE_OPT_MASK)
594 /* He's asking for bits we don't know about */
597 if (peer & MPPE_OPT_STATELESS) {
598 if (cfg->mppe.state == MPPE_STATEFUL)
599 /* Peer can't have stateless */
602 /* Peer wants stateless, that's ok */
603 mval |= MPPE_OPT_STATELESS;
605 if (cfg->mppe.state == MPPE_STATELESS)
606 /* Peer must have stateless */
609 /* Peer doesn't want stateless, that's ok */
610 mval &= ~MPPE_OPT_STATELESS;
613 /* If we've got a configured number of keybits - the peer must use that */
614 if (cfg->mppe.keybits) {
615 ua_htonl(&mval, o->data);
616 return peer == mval ? res : MODE_NAK;
619 /* If a specific number of bits hasn't been requested, we'll need to NAK */
620 switch (peer & MPPE_OPT_BITMASK) {
621 case MPPE_OPT_128BIT:
629 /* Suggest the best number of bits */
630 mval &= ~MPPE_OPT_BITMASK;
631 if (peer & MPPE_OPT_128BIT)
632 mval |= MPPE_OPT_128BIT;
633 else if (peer & MPPE_OPT_56BIT)
634 mval |= MPPE_OPT_56BIT;
635 else if (peer & MPPE_OPT_40BIT)
636 mval |= MPPE_OPT_40BIT;
638 mval |= MPPE_OPT_128BIT;
639 ua_htonl(&mval, o->data);
644 static struct mppe_state *
645 MPPE_InitState(struct fsm_opt *o)
647 struct mppe_state *mp;
650 if ((mp = calloc(1, sizeof *mp)) != NULL) {
651 ua_ntohl(o->data, &val);
653 switch (val & MPPE_OPT_BITMASK) {
654 case MPPE_OPT_128BIT:
667 log_Printf(LogWARN, "Unexpected MPPE options 0x%08x\n", val);
672 mp->stateless = !!(val & MPPE_OPT_STATELESS);
679 MPPEInitInput(struct bundle *bundle, struct fsm_opt *o)
681 struct mppe_state *mip;
683 if (!MPPE_MasterKeyValid) {
684 log_Printf(LogWARN, "MPPE: Cannot initialise without CHAP81\n");
688 if ((mip = MPPE_InitState(o)) == NULL) {
689 log_Printf(LogWARN, "MPPEInput: Cannot initialise - unexpected options\n");
693 log_Printf(LogDEBUG, "MPPE: InitInput: %d-bits\n", mip->keybits);
696 if (*bundle->radius.cfg.file && bundle->radius.mppe.recvkey) {
697 if (mip->keylen > bundle->radius.mppe.recvkeylen)
698 mip->keylen = bundle->radius.mppe.recvkeylen;
699 if (mip->keylen > sizeof mip->mastkey)
700 mip->keylen = sizeof mip->mastkey;
701 memcpy(mip->mastkey, bundle->radius.mppe.recvkey, mip->keylen);
704 GetAsymetricStartKey(MPPE_MasterKey, mip->mastkey, mip->keylen, 0,
707 GetNewKeyFromSHA(mip->mastkey, mip->mastkey, mip->keylen, mip->sesskey);
709 MPPEReduceSessionKey(mip);
711 log_Printf(LogCCP, "MPPE: Input channel initiated\n");
713 if (!mip->stateless) {
715 * We need to initialise our dictionary here as the first packet we
716 * receive is unlikely to have the FLUSHED bit set.
718 log_Printf(LogDEBUG, "MPPEInitInput: Dictionary initialised [%d]\n",
720 RC4_set_key(&mip->rc4key, mip->keylen, mip->sesskey);
723 * We do the first key change here as the first packet is expected
724 * to have a sequence number of 0 and we'll therefore not expect
725 * to have to change the key at that point.
727 log_Printf(LogDEBUG, "MPPEInitInput: Key changed [%d]\n", mip->cohnum);
735 MPPEInitOutput(struct bundle *bundle, struct fsm_opt *o)
737 struct mppe_state *mop;
739 if (!MPPE_MasterKeyValid) {
740 log_Printf(LogWARN, "MPPE: Cannot initialise without CHAP81\n");
744 if ((mop = MPPE_InitState(o)) == NULL) {
745 log_Printf(LogWARN, "MPPEOutput: Cannot initialise - unexpected options\n");
749 log_Printf(LogDEBUG, "MPPE: InitOutput: %d-bits\n", mop->keybits);
752 if (*bundle->radius.cfg.file && bundle->radius.mppe.sendkey) {
753 if (mop->keylen > bundle->radius.mppe.sendkeylen)
754 mop->keylen = bundle->radius.mppe.sendkeylen;
755 if (mop->keylen > sizeof mop->mastkey)
756 mop->keylen = sizeof mop->mastkey;
757 memcpy(mop->mastkey, bundle->radius.mppe.sendkey, mop->keylen);
760 GetAsymetricStartKey(MPPE_MasterKey, mop->mastkey, mop->keylen, 1,
763 GetNewKeyFromSHA(mop->mastkey, mop->mastkey, mop->keylen, mop->sesskey);
765 MPPEReduceSessionKey(mop);
767 log_Printf(LogCCP, "MPPE: Output channel initiated\n");
769 if (!mop->stateless) {
771 * We need to initialise our dictionary now as the first packet we
772 * send won't have the FLUSHED bit set.
774 log_Printf(LogDEBUG, "MPPEInitOutput: Dictionary initialised [%d]\n",
776 RC4_set_key(&mop->rc4key, mop->keylen, mop->sesskey);
783 MPPETermInput(void *v)
789 MPPETermOutput(void *v)
794 const struct ccp_algorithm MPPEAlgorithm = {