]>
Commit | Line | Data |
---|---|---|
b3f9b92a MD |
1 | /* |
2 | * ppp_mppe.c - interface MPPE to the PPP code. | |
3 | * This version is for use with Linux kernel 2.6.14+ | |
4 | * | |
5 | * By Frank Cusack <fcusack@fcusack.com>. | |
6 | * Copyright (c) 2002,2003,2004 Google, Inc. | |
7 | * All rights reserved. | |
8 | * | |
9 | * License: | |
10 | * Permission to use, copy, modify, and distribute this software and its | |
11 | * documentation is hereby granted, provided that the above copyright | |
12 | * notice appears in all copies. This software is provided without any | |
13 | * warranty, express or implied. | |
14 | * | |
15 | * ALTERNATIVELY, provided that this notice is retained in full, this product | |
16 | * may be distributed under the terms of the GNU General Public License (GPL), | |
17 | * in which case the provisions of the GPL apply INSTEAD OF those given above. | |
18 | * | |
19 | * This program is free software; you can redistribute it and/or modify | |
20 | * it under the terms of the GNU General Public License as published by | |
21 | * the Free Software Foundation; either version 2 of the License, or | |
22 | * (at your option) any later version. | |
23 | * | |
24 | * This program is distributed in the hope that it will be useful, | |
25 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
26 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
27 | * GNU General Public License for more details. | |
28 | * | |
29 | * You should have received a copy of the GNU General Public License | |
30 | * along with this program; if not, write to the Free Software | |
31 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
32 | * | |
33 | * | |
34 | * Changelog: | |
35 | * 08/12/05 - Matt Domsch <Matt_Domsch@dell.com> | |
36 | * Only need extra skb padding on transmit, not receive. | |
37 | * 06/18/04 - Matt Domsch <Matt_Domsch@dell.com>, Oleg Makarenko <mole@quadra.ru> | |
38 | * Use Linux kernel 2.6 arc4 and sha1 routines rather than | |
39 | * providing our own. | |
40 | * 2/15/04 - TS: added #include <version.h> and testing for Kernel | |
41 | * version before using | |
42 | * MOD_DEC_USAGE_COUNT/MOD_INC_USAGE_COUNT which are | |
43 | * deprecated in 2.6 | |
44 | */ | |
45 | ||
f12cc209 | 46 | #include <linux/err.h> |
b3f9b92a MD |
47 | #include <linux/module.h> |
48 | #include <linux/kernel.h> | |
49 | #include <linux/version.h> | |
50 | #include <linux/init.h> | |
51 | #include <linux/types.h> | |
52 | #include <linux/slab.h> | |
53 | #include <linux/string.h> | |
54 | #include <linux/crypto.h> | |
55 | #include <linux/mm.h> | |
56 | #include <linux/ppp_defs.h> | |
57 | #include <linux/ppp-comp.h> | |
58 | #include <asm/scatterlist.h> | |
59 | ||
60 | #include "ppp_mppe.h" | |
61 | ||
62 | MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>"); | |
63 | MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support"); | |
64 | MODULE_LICENSE("Dual BSD/GPL"); | |
65 | MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE)); | |
66 | MODULE_VERSION("1.0.2"); | |
67 | ||
68 | static void | |
69 | setup_sg(struct scatterlist *sg, const void *address, unsigned int length) | |
70 | { | |
71 | sg[0].page = virt_to_page(address); | |
72 | sg[0].offset = offset_in_page(address); | |
73 | sg[0].length = length; | |
74 | } | |
75 | ||
76 | #define SHA1_PAD_SIZE 40 | |
77 | ||
78 | /* | |
79 | * kernel crypto API needs its arguments to be in kmalloc'd memory, not in the module | |
80 | * static data area. That means sha_pad needs to be kmalloc'd. | |
81 | */ | |
82 | ||
83 | struct sha_pad { | |
84 | unsigned char sha_pad1[SHA1_PAD_SIZE]; | |
85 | unsigned char sha_pad2[SHA1_PAD_SIZE]; | |
86 | }; | |
87 | static struct sha_pad *sha_pad; | |
88 | ||
89 | static inline void sha_pad_init(struct sha_pad *shapad) | |
90 | { | |
91 | memset(shapad->sha_pad1, 0x00, sizeof(shapad->sha_pad1)); | |
92 | memset(shapad->sha_pad2, 0xF2, sizeof(shapad->sha_pad2)); | |
93 | } | |
94 | ||
95 | /* | |
96 | * State for an MPPE (de)compressor. | |
97 | */ | |
98 | struct ppp_mppe_state { | |
f12cc209 | 99 | struct crypto_blkcipher *arc4; |
b3f9b92a MD |
100 | struct crypto_tfm *sha1; |
101 | unsigned char *sha1_digest; | |
102 | unsigned char master_key[MPPE_MAX_KEY_LEN]; | |
103 | unsigned char session_key[MPPE_MAX_KEY_LEN]; | |
104 | unsigned keylen; /* key length in bytes */ | |
105 | /* NB: 128-bit == 16, 40-bit == 8! */ | |
106 | /* If we want to support 56-bit, */ | |
107 | /* the unit has to change to bits */ | |
108 | unsigned char bits; /* MPPE control bits */ | |
109 | unsigned ccount; /* 12-bit coherency count (seqno) */ | |
110 | unsigned stateful; /* stateful mode flag */ | |
111 | int discard; /* stateful mode packet loss flag */ | |
112 | int sanity_errors; /* take down LCP if too many */ | |
113 | int unit; | |
114 | int debug; | |
115 | struct compstat stats; | |
116 | }; | |
117 | ||
118 | /* struct ppp_mppe_state.bits definitions */ | |
119 | #define MPPE_BIT_A 0x80 /* Encryption table were (re)inititalized */ | |
120 | #define MPPE_BIT_B 0x40 /* MPPC only (not implemented) */ | |
121 | #define MPPE_BIT_C 0x20 /* MPPC only (not implemented) */ | |
122 | #define MPPE_BIT_D 0x10 /* This is an encrypted frame */ | |
123 | ||
124 | #define MPPE_BIT_FLUSHED MPPE_BIT_A | |
125 | #define MPPE_BIT_ENCRYPTED MPPE_BIT_D | |
126 | ||
127 | #define MPPE_BITS(p) ((p)[4] & 0xf0) | |
128 | #define MPPE_CCOUNT(p) ((((p)[4] & 0x0f) << 8) + (p)[5]) | |
129 | #define MPPE_CCOUNT_SPACE 0x1000 /* The size of the ccount space */ | |
130 | ||
131 | #define MPPE_OVHD 2 /* MPPE overhead/packet */ | |
132 | #define SANITY_MAX 1600 /* Max bogon factor we will tolerate */ | |
133 | ||
134 | /* | |
135 | * Key Derivation, from RFC 3078, RFC 3079. | |
136 | * Equivalent to Get_Key() for MS-CHAP as described in RFC 3079. | |
137 | */ | |
138 | static void get_new_key_from_sha(struct ppp_mppe_state * state, unsigned char *InterimKey) | |
139 | { | |
140 | struct scatterlist sg[4]; | |
141 | ||
142 | setup_sg(&sg[0], state->master_key, state->keylen); | |
143 | setup_sg(&sg[1], sha_pad->sha_pad1, sizeof(sha_pad->sha_pad1)); | |
144 | setup_sg(&sg[2], state->session_key, state->keylen); | |
145 | setup_sg(&sg[3], sha_pad->sha_pad2, sizeof(sha_pad->sha_pad2)); | |
146 | ||
147 | crypto_digest_digest (state->sha1, sg, 4, state->sha1_digest); | |
148 | ||
149 | memcpy(InterimKey, state->sha1_digest, state->keylen); | |
150 | } | |
151 | ||
152 | /* | |
153 | * Perform the MPPE rekey algorithm, from RFC 3078, sec. 7.3. | |
154 | * Well, not what's written there, but rather what they meant. | |
155 | */ | |
156 | static void mppe_rekey(struct ppp_mppe_state * state, int initial_key) | |
157 | { | |
158 | unsigned char InterimKey[MPPE_MAX_KEY_LEN]; | |
159 | struct scatterlist sg_in[1], sg_out[1]; | |
f12cc209 | 160 | struct blkcipher_desc desc = { .tfm = state->arc4 }; |
b3f9b92a MD |
161 | |
162 | get_new_key_from_sha(state, InterimKey); | |
163 | if (!initial_key) { | |
f12cc209 | 164 | crypto_blkcipher_setkey(state->arc4, InterimKey, state->keylen); |
b3f9b92a MD |
165 | setup_sg(sg_in, InterimKey, state->keylen); |
166 | setup_sg(sg_out, state->session_key, state->keylen); | |
f12cc209 HX |
167 | if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in, |
168 | state->keylen) != 0) { | |
b3f9b92a MD |
169 | printk(KERN_WARNING "mppe_rekey: cipher_encrypt failed\n"); |
170 | } | |
171 | } else { | |
172 | memcpy(state->session_key, InterimKey, state->keylen); | |
173 | } | |
174 | if (state->keylen == 8) { | |
175 | /* See RFC 3078 */ | |
176 | state->session_key[0] = 0xd1; | |
177 | state->session_key[1] = 0x26; | |
178 | state->session_key[2] = 0x9e; | |
179 | } | |
f12cc209 | 180 | crypto_blkcipher_setkey(state->arc4, state->session_key, state->keylen); |
b3f9b92a MD |
181 | } |
182 | ||
183 | /* | |
184 | * Allocate space for a (de)compressor. | |
185 | */ | |
186 | static void *mppe_alloc(unsigned char *options, int optlen) | |
187 | { | |
188 | struct ppp_mppe_state *state; | |
189 | unsigned int digestsize; | |
190 | ||
191 | if (optlen != CILEN_MPPE + sizeof(state->master_key) | |
192 | || options[0] != CI_MPPE || options[1] != CILEN_MPPE) | |
193 | goto out; | |
194 | ||
195 | state = (struct ppp_mppe_state *) kmalloc(sizeof(*state), GFP_KERNEL); | |
196 | if (state == NULL) | |
197 | goto out; | |
198 | ||
199 | memset(state, 0, sizeof(*state)); | |
200 | ||
f12cc209 HX |
201 | state->arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC); |
202 | if (IS_ERR(state->arc4)) { | |
203 | state->arc4 = NULL; | |
b3f9b92a | 204 | goto out_free; |
f12cc209 | 205 | } |
b3f9b92a MD |
206 | |
207 | state->sha1 = crypto_alloc_tfm("sha1", 0); | |
208 | if (!state->sha1) | |
209 | goto out_free; | |
210 | ||
211 | digestsize = crypto_tfm_alg_digestsize(state->sha1); | |
212 | if (digestsize < MPPE_MAX_KEY_LEN) | |
213 | goto out_free; | |
214 | ||
215 | state->sha1_digest = kmalloc(digestsize, GFP_KERNEL); | |
216 | if (!state->sha1_digest) | |
217 | goto out_free; | |
218 | ||
219 | /* Save keys. */ | |
220 | memcpy(state->master_key, &options[CILEN_MPPE], | |
221 | sizeof(state->master_key)); | |
222 | memcpy(state->session_key, state->master_key, | |
223 | sizeof(state->master_key)); | |
224 | ||
225 | /* | |
226 | * We defer initial key generation until mppe_init(), as mppe_alloc() | |
227 | * is called frequently during negotiation. | |
228 | */ | |
229 | ||
230 | return (void *)state; | |
231 | ||
232 | out_free: | |
233 | if (state->sha1_digest) | |
234 | kfree(state->sha1_digest); | |
235 | if (state->sha1) | |
236 | crypto_free_tfm(state->sha1); | |
237 | if (state->arc4) | |
f12cc209 | 238 | crypto_free_blkcipher(state->arc4); |
b3f9b92a MD |
239 | kfree(state); |
240 | out: | |
241 | return NULL; | |
242 | } | |
243 | ||
244 | /* | |
245 | * Deallocate space for a (de)compressor. | |
246 | */ | |
247 | static void mppe_free(void *arg) | |
248 | { | |
249 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
250 | if (state) { | |
251 | if (state->sha1_digest) | |
252 | kfree(state->sha1_digest); | |
253 | if (state->sha1) | |
254 | crypto_free_tfm(state->sha1); | |
255 | if (state->arc4) | |
f12cc209 | 256 | crypto_free_blkcipher(state->arc4); |
b3f9b92a MD |
257 | kfree(state); |
258 | } | |
259 | } | |
260 | ||
261 | /* | |
262 | * Initialize (de)compressor state. | |
263 | */ | |
264 | static int | |
265 | mppe_init(void *arg, unsigned char *options, int optlen, int unit, int debug, | |
266 | const char *debugstr) | |
267 | { | |
268 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
269 | unsigned char mppe_opts; | |
270 | ||
271 | if (optlen != CILEN_MPPE | |
272 | || options[0] != CI_MPPE || options[1] != CILEN_MPPE) | |
273 | return 0; | |
274 | ||
275 | MPPE_CI_TO_OPTS(&options[2], mppe_opts); | |
276 | if (mppe_opts & MPPE_OPT_128) | |
277 | state->keylen = 16; | |
278 | else if (mppe_opts & MPPE_OPT_40) | |
279 | state->keylen = 8; | |
280 | else { | |
281 | printk(KERN_WARNING "%s[%d]: unknown key length\n", debugstr, | |
282 | unit); | |
283 | return 0; | |
284 | } | |
285 | if (mppe_opts & MPPE_OPT_STATEFUL) | |
286 | state->stateful = 1; | |
287 | ||
288 | /* Generate the initial session key. */ | |
289 | mppe_rekey(state, 1); | |
290 | ||
291 | if (debug) { | |
292 | int i; | |
293 | char mkey[sizeof(state->master_key) * 2 + 1]; | |
294 | char skey[sizeof(state->session_key) * 2 + 1]; | |
295 | ||
296 | printk(KERN_DEBUG "%s[%d]: initialized with %d-bit %s mode\n", | |
297 | debugstr, unit, (state->keylen == 16) ? 128 : 40, | |
298 | (state->stateful) ? "stateful" : "stateless"); | |
299 | ||
300 | for (i = 0; i < sizeof(state->master_key); i++) | |
301 | sprintf(mkey + i * 2, "%02x", state->master_key[i]); | |
302 | for (i = 0; i < sizeof(state->session_key); i++) | |
303 | sprintf(skey + i * 2, "%02x", state->session_key[i]); | |
304 | printk(KERN_DEBUG | |
305 | "%s[%d]: keys: master: %s initial session: %s\n", | |
306 | debugstr, unit, mkey, skey); | |
307 | } | |
308 | ||
309 | /* | |
310 | * Initialize the coherency count. The initial value is not specified | |
311 | * in RFC 3078, but we can make a reasonable assumption that it will | |
312 | * start at 0. Setting it to the max here makes the comp/decomp code | |
313 | * do the right thing (determined through experiment). | |
314 | */ | |
315 | state->ccount = MPPE_CCOUNT_SPACE - 1; | |
316 | ||
317 | /* | |
318 | * Note that even though we have initialized the key table, we don't | |
319 | * set the FLUSHED bit. This is contrary to RFC 3078, sec. 3.1. | |
320 | */ | |
321 | state->bits = MPPE_BIT_ENCRYPTED; | |
322 | ||
323 | state->unit = unit; | |
324 | state->debug = debug; | |
325 | ||
326 | return 1; | |
327 | } | |
328 | ||
329 | static int | |
330 | mppe_comp_init(void *arg, unsigned char *options, int optlen, int unit, | |
331 | int hdrlen, int debug) | |
332 | { | |
333 | /* ARGSUSED */ | |
334 | return mppe_init(arg, options, optlen, unit, debug, "mppe_comp_init"); | |
335 | } | |
336 | ||
337 | /* | |
338 | * We received a CCP Reset-Request (actually, we are sending a Reset-Ack), | |
339 | * tell the compressor to rekey. Note that we MUST NOT rekey for | |
340 | * every CCP Reset-Request; we only rekey on the next xmit packet. | |
341 | * We might get multiple CCP Reset-Requests if our CCP Reset-Ack is lost. | |
342 | * So, rekeying for every CCP Reset-Request is broken as the peer will not | |
343 | * know how many times we've rekeyed. (If we rekey and THEN get another | |
344 | * CCP Reset-Request, we must rekey again.) | |
345 | */ | |
346 | static void mppe_comp_reset(void *arg) | |
347 | { | |
348 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
349 | ||
350 | state->bits |= MPPE_BIT_FLUSHED; | |
351 | } | |
352 | ||
353 | /* | |
354 | * Compress (encrypt) a packet. | |
355 | * It's strange to call this a compressor, since the output is always | |
356 | * MPPE_OVHD + 2 bytes larger than the input. | |
357 | */ | |
358 | static int | |
359 | mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf, | |
360 | int isize, int osize) | |
361 | { | |
362 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
f12cc209 | 363 | struct blkcipher_desc desc = { .tfm = state->arc4 }; |
b3f9b92a MD |
364 | int proto; |
365 | struct scatterlist sg_in[1], sg_out[1]; | |
366 | ||
367 | /* | |
368 | * Check that the protocol is in the range we handle. | |
369 | */ | |
370 | proto = PPP_PROTOCOL(ibuf); | |
371 | if (proto < 0x0021 || proto > 0x00fa) | |
372 | return 0; | |
373 | ||
374 | /* Make sure we have enough room to generate an encrypted packet. */ | |
375 | if (osize < isize + MPPE_OVHD + 2) { | |
376 | /* Drop the packet if we should encrypt it, but can't. */ | |
377 | printk(KERN_DEBUG "mppe_compress[%d]: osize too small! " | |
378 | "(have: %d need: %d)\n", state->unit, | |
379 | osize, osize + MPPE_OVHD + 2); | |
380 | return -1; | |
381 | } | |
382 | ||
383 | osize = isize + MPPE_OVHD + 2; | |
384 | ||
385 | /* | |
386 | * Copy over the PPP header and set control bits. | |
387 | */ | |
388 | obuf[0] = PPP_ADDRESS(ibuf); | |
389 | obuf[1] = PPP_CONTROL(ibuf); | |
390 | obuf[2] = PPP_COMP >> 8; /* isize + MPPE_OVHD + 1 */ | |
391 | obuf[3] = PPP_COMP; /* isize + MPPE_OVHD + 2 */ | |
392 | obuf += PPP_HDRLEN; | |
393 | ||
394 | state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; | |
395 | if (state->debug >= 7) | |
396 | printk(KERN_DEBUG "mppe_compress[%d]: ccount %d\n", state->unit, | |
397 | state->ccount); | |
398 | obuf[0] = state->ccount >> 8; | |
399 | obuf[1] = state->ccount & 0xff; | |
400 | ||
401 | if (!state->stateful || /* stateless mode */ | |
402 | ((state->ccount & 0xff) == 0xff) || /* "flag" packet */ | |
403 | (state->bits & MPPE_BIT_FLUSHED)) { /* CCP Reset-Request */ | |
404 | /* We must rekey */ | |
405 | if (state->debug && state->stateful) | |
406 | printk(KERN_DEBUG "mppe_compress[%d]: rekeying\n", | |
407 | state->unit); | |
408 | mppe_rekey(state, 0); | |
409 | state->bits |= MPPE_BIT_FLUSHED; | |
410 | } | |
411 | obuf[0] |= state->bits; | |
412 | state->bits &= ~MPPE_BIT_FLUSHED; /* reset for next xmit */ | |
413 | ||
414 | obuf += MPPE_OVHD; | |
415 | ibuf += 2; /* skip to proto field */ | |
416 | isize -= 2; | |
417 | ||
418 | /* Encrypt packet */ | |
419 | setup_sg(sg_in, ibuf, isize); | |
420 | setup_sg(sg_out, obuf, osize); | |
f12cc209 | 421 | if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in, isize) != 0) { |
b3f9b92a MD |
422 | printk(KERN_DEBUG "crypto_cypher_encrypt failed\n"); |
423 | return -1; | |
424 | } | |
425 | ||
426 | state->stats.unc_bytes += isize; | |
427 | state->stats.unc_packets++; | |
428 | state->stats.comp_bytes += osize; | |
429 | state->stats.comp_packets++; | |
430 | ||
431 | return osize; | |
432 | } | |
433 | ||
434 | /* | |
435 | * Since every frame grows by MPPE_OVHD + 2 bytes, this is always going | |
436 | * to look bad ... and the longer the link is up the worse it will get. | |
437 | */ | |
438 | static void mppe_comp_stats(void *arg, struct compstat *stats) | |
439 | { | |
440 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
441 | ||
442 | *stats = state->stats; | |
443 | } | |
444 | ||
445 | static int | |
446 | mppe_decomp_init(void *arg, unsigned char *options, int optlen, int unit, | |
447 | int hdrlen, int mru, int debug) | |
448 | { | |
449 | /* ARGSUSED */ | |
450 | return mppe_init(arg, options, optlen, unit, debug, "mppe_decomp_init"); | |
451 | } | |
452 | ||
453 | /* | |
454 | * We received a CCP Reset-Ack. Just ignore it. | |
455 | */ | |
456 | static void mppe_decomp_reset(void *arg) | |
457 | { | |
458 | /* ARGSUSED */ | |
459 | return; | |
460 | } | |
461 | ||
462 | /* | |
463 | * Decompress (decrypt) an MPPE packet. | |
464 | */ | |
465 | static int | |
466 | mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf, | |
467 | int osize) | |
468 | { | |
469 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
f12cc209 | 470 | struct blkcipher_desc desc = { .tfm = state->arc4 }; |
b3f9b92a MD |
471 | unsigned ccount; |
472 | int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED; | |
473 | int sanity = 0; | |
474 | struct scatterlist sg_in[1], sg_out[1]; | |
475 | ||
476 | if (isize <= PPP_HDRLEN + MPPE_OVHD) { | |
477 | if (state->debug) | |
478 | printk(KERN_DEBUG | |
479 | "mppe_decompress[%d]: short pkt (%d)\n", | |
480 | state->unit, isize); | |
481 | return DECOMP_ERROR; | |
482 | } | |
483 | ||
484 | /* | |
485 | * Make sure we have enough room to decrypt the packet. | |
486 | * Note that for our test we only subtract 1 byte whereas in | |
487 | * mppe_compress() we added 2 bytes (+MPPE_OVHD); | |
488 | * this is to account for possible PFC. | |
489 | */ | |
490 | if (osize < isize - MPPE_OVHD - 1) { | |
491 | printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! " | |
492 | "(have: %d need: %d)\n", state->unit, | |
493 | osize, isize - MPPE_OVHD - 1); | |
494 | return DECOMP_ERROR; | |
495 | } | |
496 | osize = isize - MPPE_OVHD - 2; /* assume no PFC */ | |
497 | ||
498 | ccount = MPPE_CCOUNT(ibuf); | |
499 | if (state->debug >= 7) | |
500 | printk(KERN_DEBUG "mppe_decompress[%d]: ccount %d\n", | |
501 | state->unit, ccount); | |
502 | ||
503 | /* sanity checks -- terminate with extreme prejudice */ | |
504 | if (!(MPPE_BITS(ibuf) & MPPE_BIT_ENCRYPTED)) { | |
505 | printk(KERN_DEBUG | |
506 | "mppe_decompress[%d]: ENCRYPTED bit not set!\n", | |
507 | state->unit); | |
508 | state->sanity_errors += 100; | |
509 | sanity = 1; | |
510 | } | |
511 | if (!state->stateful && !flushed) { | |
512 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in " | |
513 | "stateless mode!\n", state->unit); | |
514 | state->sanity_errors += 100; | |
515 | sanity = 1; | |
516 | } | |
517 | if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) { | |
518 | printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on " | |
519 | "flag packet!\n", state->unit); | |
520 | state->sanity_errors += 100; | |
521 | sanity = 1; | |
522 | } | |
523 | ||
524 | if (sanity) { | |
525 | if (state->sanity_errors < SANITY_MAX) | |
526 | return DECOMP_ERROR; | |
527 | else | |
528 | /* | |
529 | * Take LCP down if the peer is sending too many bogons. | |
530 | * We don't want to do this for a single or just a few | |
531 | * instances since it could just be due to packet corruption. | |
532 | */ | |
533 | return DECOMP_FATALERROR; | |
534 | } | |
535 | ||
536 | /* | |
537 | * Check the coherency count. | |
538 | */ | |
539 | ||
540 | if (!state->stateful) { | |
541 | /* RFC 3078, sec 8.1. Rekey for every packet. */ | |
542 | while (state->ccount != ccount) { | |
543 | mppe_rekey(state, 0); | |
544 | state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; | |
545 | } | |
546 | } else { | |
547 | /* RFC 3078, sec 8.2. */ | |
548 | if (!state->discard) { | |
549 | /* normal state */ | |
550 | state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; | |
551 | if (ccount != state->ccount) { | |
552 | /* | |
553 | * (ccount > state->ccount) | |
554 | * Packet loss detected, enter the discard state. | |
555 | * Signal the peer to rekey (by sending a CCP Reset-Request). | |
556 | */ | |
557 | state->discard = 1; | |
558 | return DECOMP_ERROR; | |
559 | } | |
560 | } else { | |
561 | /* discard state */ | |
562 | if (!flushed) { | |
563 | /* ccp.c will be silent (no additional CCP Reset-Requests). */ | |
564 | return DECOMP_ERROR; | |
565 | } else { | |
566 | /* Rekey for every missed "flag" packet. */ | |
567 | while ((ccount & ~0xff) != | |
568 | (state->ccount & ~0xff)) { | |
569 | mppe_rekey(state, 0); | |
570 | state->ccount = | |
571 | (state->ccount + | |
572 | 256) % MPPE_CCOUNT_SPACE; | |
573 | } | |
574 | ||
575 | /* reset */ | |
576 | state->discard = 0; | |
577 | state->ccount = ccount; | |
578 | /* | |
579 | * Another problem with RFC 3078 here. It implies that the | |
580 | * peer need not send a Reset-Ack packet. But RFC 1962 | |
581 | * requires it. Hopefully, M$ does send a Reset-Ack; even | |
582 | * though it isn't required for MPPE synchronization, it is | |
583 | * required to reset CCP state. | |
584 | */ | |
585 | } | |
586 | } | |
587 | if (flushed) | |
588 | mppe_rekey(state, 0); | |
589 | } | |
590 | ||
591 | /* | |
592 | * Fill in the first part of the PPP header. The protocol field | |
593 | * comes from the decrypted data. | |
594 | */ | |
595 | obuf[0] = PPP_ADDRESS(ibuf); /* +1 */ | |
596 | obuf[1] = PPP_CONTROL(ibuf); /* +1 */ | |
597 | obuf += 2; | |
598 | ibuf += PPP_HDRLEN + MPPE_OVHD; | |
599 | isize -= PPP_HDRLEN + MPPE_OVHD; /* -6 */ | |
600 | /* net osize: isize-4 */ | |
601 | ||
602 | /* | |
603 | * Decrypt the first byte in order to check if it is | |
604 | * a compressed or uncompressed protocol field. | |
605 | */ | |
606 | setup_sg(sg_in, ibuf, 1); | |
607 | setup_sg(sg_out, obuf, 1); | |
f12cc209 | 608 | if (crypto_blkcipher_decrypt(&desc, sg_out, sg_in, 1) != 0) { |
b3f9b92a MD |
609 | printk(KERN_DEBUG "crypto_cypher_decrypt failed\n"); |
610 | return DECOMP_ERROR; | |
611 | } | |
612 | ||
613 | /* | |
614 | * Do PFC decompression. | |
615 | * This would be nicer if we were given the actual sk_buff | |
616 | * instead of a char *. | |
617 | */ | |
618 | if ((obuf[0] & 0x01) != 0) { | |
619 | obuf[1] = obuf[0]; | |
620 | obuf[0] = 0; | |
621 | obuf++; | |
622 | osize++; | |
623 | } | |
624 | ||
625 | /* And finally, decrypt the rest of the packet. */ | |
626 | setup_sg(sg_in, ibuf + 1, isize - 1); | |
627 | setup_sg(sg_out, obuf + 1, osize - 1); | |
f12cc209 | 628 | if (crypto_blkcipher_decrypt(&desc, sg_out, sg_in, isize - 1)) { |
b3f9b92a MD |
629 | printk(KERN_DEBUG "crypto_cypher_decrypt failed\n"); |
630 | return DECOMP_ERROR; | |
631 | } | |
632 | ||
633 | state->stats.unc_bytes += osize; | |
634 | state->stats.unc_packets++; | |
635 | state->stats.comp_bytes += isize; | |
636 | state->stats.comp_packets++; | |
637 | ||
638 | /* good packet credit */ | |
639 | state->sanity_errors >>= 1; | |
640 | ||
641 | return osize; | |
642 | } | |
643 | ||
644 | /* | |
645 | * Incompressible data has arrived (this should never happen!). | |
646 | * We should probably drop the link if the protocol is in the range | |
647 | * of what should be encrypted. At the least, we should drop this | |
648 | * packet. (How to do this?) | |
649 | */ | |
650 | static void mppe_incomp(void *arg, unsigned char *ibuf, int icnt) | |
651 | { | |
652 | struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; | |
653 | ||
654 | if (state->debug && | |
655 | (PPP_PROTOCOL(ibuf) >= 0x0021 && PPP_PROTOCOL(ibuf) <= 0x00fa)) | |
656 | printk(KERN_DEBUG | |
657 | "mppe_incomp[%d]: incompressible (unencrypted) data! " | |
658 | "(proto %04x)\n", state->unit, PPP_PROTOCOL(ibuf)); | |
659 | ||
660 | state->stats.inc_bytes += icnt; | |
661 | state->stats.inc_packets++; | |
662 | state->stats.unc_bytes += icnt; | |
663 | state->stats.unc_packets++; | |
664 | } | |
665 | ||
666 | /************************************************************* | |
667 | * Module interface table | |
668 | *************************************************************/ | |
669 | ||
670 | /* | |
671 | * Procedures exported to if_ppp.c. | |
672 | */ | |
673 | static struct compressor ppp_mppe = { | |
674 | .compress_proto = CI_MPPE, | |
675 | .comp_alloc = mppe_alloc, | |
676 | .comp_free = mppe_free, | |
677 | .comp_init = mppe_comp_init, | |
678 | .comp_reset = mppe_comp_reset, | |
679 | .compress = mppe_compress, | |
680 | .comp_stat = mppe_comp_stats, | |
681 | .decomp_alloc = mppe_alloc, | |
682 | .decomp_free = mppe_free, | |
683 | .decomp_init = mppe_decomp_init, | |
684 | .decomp_reset = mppe_decomp_reset, | |
685 | .decompress = mppe_decompress, | |
686 | .incomp = mppe_incomp, | |
687 | .decomp_stat = mppe_comp_stats, | |
688 | .owner = THIS_MODULE, | |
689 | .comp_extra = MPPE_PAD, | |
690 | }; | |
691 | ||
692 | /* | |
693 | * ppp_mppe_init() | |
694 | * | |
695 | * Prior to allowing load, try to load the arc4 and sha1 crypto | |
696 | * libraries. The actual use will be allocated later, but | |
697 | * this way the module will fail to insmod if they aren't available. | |
698 | */ | |
699 | ||
700 | static int __init ppp_mppe_init(void) | |
701 | { | |
702 | int answer; | |
f12cc209 | 703 | if (!(crypto_alg_available("ecb(arc4)", 0) && |
b3f9b92a MD |
704 | crypto_alg_available("sha1", 0))) |
705 | return -ENODEV; | |
706 | ||
707 | sha_pad = kmalloc(sizeof(struct sha_pad), GFP_KERNEL); | |
708 | if (!sha_pad) | |
709 | return -ENOMEM; | |
710 | sha_pad_init(sha_pad); | |
711 | ||
712 | answer = ppp_register_compressor(&ppp_mppe); | |
713 | ||
714 | if (answer == 0) | |
715 | printk(KERN_INFO "PPP MPPE Compression module registered\n"); | |
716 | else | |
717 | kfree(sha_pad); | |
718 | ||
719 | return answer; | |
720 | } | |
721 | ||
722 | static void __exit ppp_mppe_cleanup(void) | |
723 | { | |
724 | ppp_unregister_compressor(&ppp_mppe); | |
725 | kfree(sha_pad); | |
726 | } | |
727 | ||
728 | module_init(ppp_mppe_init); | |
729 | module_exit(ppp_mppe_cleanup); |