package/ppp/ppp.patch

   1 diff -ruN ppp-2.4.3-orig/chat/Makefile.linux ppp-2.4.3-3/chat/Makefile.linux
   2 --- ppp-2.4.3-orig/chat/Makefile.linux  2004-11-03 12:51:47.000000000 +0100
   3 +++ ppp-2.4.3-3/chat/Makefile.linux     2004-12-05 17:42:43.000000000 +0100
   4 @@ -25,7 +25,7 @@
   5
   6  install: chat
   7         mkdir -p $(BINDIR)
   8 -       $(INSTALL) -s -c chat $(BINDIR)
   9 +       $(INSTALL) -c chat $(BINDIR)
  10         $(INSTALL) -c -m 644 chat.8 $(MANDIR)
  11
  12  clean:
  13 diff -ruN ppp-2.4.3-orig/include/linux/ppp-comp.h ppp-2.4.3-3/include/linux/ppp-comp.h
  14 --- ppp-2.4.3-orig/include/linux/ppp-comp.h     2002-12-06 10:49:15.000000000 +0100
  15 +++ ppp-2.4.3-3/include/linux/ppp-comp.h        2004-12-16 00:50:53.000000000 +0100
  16 @@ -36,7 +36,7 @@
  17   */
  18
  19  /*
  20 - *  ==FILEVERSION 20020319==
  21 + *  ==FILEVERSION 20020715==
  22   *
  23   *  NOTE TO MAINTAINERS:
  24   *     If you modify this file at all, please set the above date.
  25 @@ -56,10 +56,10 @@
  26   */
  27
  28  #ifndef DO_BSD_COMPRESS
  29 -#define DO_BSD_COMPRESS        1       /* by default, include BSD-Compress */
  30 +#define DO_BSD_COMPRESS        0       /* by default, don't include BSD-Compress */
  31  #endif
  32  #ifndef DO_DEFLATE
  33 -#define DO_DEFLATE     1       /* by default, include Deflate */
  34 +#define DO_DEFLATE     0       /* by default, don't include Deflate */
  35  #endif
  36  #define DO_PREDICTOR_1 0
  37  #define DO_PREDICTOR_2 0
  38 @@ -86,7 +86,7 @@
  39
  40         /* Compress a packet */
  41         int     (*compress) (void *state, unsigned char *rptr,
  42 -                             unsigned char *obuf, int isize, int osize);
  43 +                            unsigned char *obuf, int isize, int osize);
  44
  45         /* Return compression statistics */
  46         void    (*comp_stat) (void *state, struct compstat *stats);
  47 @@ -107,7 +107,7 @@
  48
  49         /* Decompress a packet. */
  50         int     (*decompress) (void *state, unsigned char *ibuf, int isize,
  51 -                               unsigned char *obuf, int osize);
  52 +                              unsigned char *obuf, int osize);
  53
  54         /* Update state for an incompressible packet received */
  55         void    (*incomp) (void *state, unsigned char *ibuf, int icnt);
  56 @@ -288,6 +288,33 @@
  57             opts |= MPPE_OPT_UNKNOWN;           \
  58      } while (/* CONSTCOND */ 0)
  59
  60 +/* MPPE/MPPC definitions by J.D.*/
  61 +#define MPPE_STATELESS          MPPE_H_BIT     /* configuration bit H */
  62 +#define MPPE_40BIT              MPPE_L_BIT     /* configuration bit L */
  63 +#define MPPE_56BIT              MPPE_M_BIT     /* configuration bit M */
  64 +#define MPPE_128BIT             MPPE_S_BIT     /* configuration bit S */
  65 +#define MPPE_MPPC               MPPE_C_BIT     /* configuration bit C */
  66 +
  67 +/*
  68 + * Definitions for Stac LZS.
  69 + */
  70 +
  71 +#define CI_LZS                 17      /* config option for Stac LZS */
  72 +#define CILEN_LZS              5       /* length of config option */
  73 +
  74 +#define LZS_OVHD               4       /* max. LZS overhead */
  75 +#define LZS_HIST_LEN           2048    /* LZS history size */
  76 +#define LZS_MAX_CCOUNT         0x0FFF  /* max. coherency counter value */
  77 +
  78 +#define LZS_MODE_NONE          0
  79 +#define LZS_MODE_LCB           1
  80 +#define LZS_MODE_CRC           2
  81 +#define LZS_MODE_SEQ           3
  82 +#define LZS_MODE_EXT           4
  83 +
  84 +#define LZS_EXT_BIT_FLUSHED    0x80    /* bit A */
  85 +#define LZS_EXT_BIT_COMP       0x20    /* bit C */
  86 +
  87  /*
  88   * Definitions for other, as yet unsupported, compression methods.
  89   */
  90 diff -ruN ppp-2.4.3-orig/include/net/ppp-comp.h ppp-2.4.3-3/include/net/ppp-comp.h
  91 --- ppp-2.4.3-orig/include/net/ppp-comp.h       2002-12-06 10:49:15.000000000 +0100
  92 +++ ppp-2.4.3-3/include/net/ppp-comp.h  2004-12-16 00:51:06.000000000 +0100
  93 @@ -43,10 +43,10 @@
  94   * various compression methods.
  95   */
  96  #ifndef DO_BSD_COMPRESS
  97 -#define DO_BSD_COMPRESS        1       /* by default, include BSD-Compress */
  98 +#define DO_BSD_COMPRESS        0       /* by default, don't include BSD-Compress */
  99  #endif
 100  #ifndef DO_DEFLATE
 101 -#define DO_DEFLATE     1       /* by default, include Deflate */
 102 +#define DO_DEFLATE     0       /* by default, don't include Deflate */
 103  #endif
 104  #define DO_PREDICTOR_1 0
 105  #define DO_PREDICTOR_2 0
 106 @@ -255,6 +255,33 @@
 107             opts |= MPPE_OPT_UNKNOWN;           \
 108      } while (/* CONSTCOND */ 0)
 109
 110 +/* MPPE/MPPC definitions by J.D.*/
 111 +#define MPPE_STATELESS          MPPE_H_BIT     /* configuration bit H */
 112 +#define MPPE_40BIT              MPPE_L_BIT     /* configuration bit L */
 113 +#define MPPE_56BIT              MPPE_M_BIT     /* configuration bit M */
 114 +#define MPPE_128BIT             MPPE_S_BIT     /* configuration bit S */
 115 +#define MPPE_MPPC               MPPE_C_BIT     /* configuration bit C */
 116 +
 117 +/*
 118 + * Definitions for Stac LZS.
 119 + */
 120 +
 121 +#define CI_LZS                 17      /* config option for Stac LZS */
 122 +#define CILEN_LZS              5       /* length of config option */
 123 +
 124 +#define LZS_OVHD               4       /* max. LZS overhead */
 125 +#define LZS_HIST_LEN           2048    /* LZS history size */
 126 +#define LZS_MAX_CCOUNT         0x0FFF  /* max. coherency counter value */
 127 +
 128 +#define LZS_MODE_NONE          0
 129 +#define LZS_MODE_LCB           1
 130 +#define LZS_MODE_CRC           2
 131 +#define LZS_MODE_SEQ           3
 132 +#define LZS_MODE_EXT           4
 133 +
 134 +#define LZS_EXT_BIT_FLUSHED    0x80    /* bit A */
 135 +#define LZS_EXT_BIT_COMP       0x20    /* bit C */
 136 +
 137  /*
 138   * Definitions for other, as yet unsupported, compression methods.
 139   */
 140 diff -ruN ppp-2.4.3-orig/pppd/Makefile.linux ppp-2.4.3-3/pppd/Makefile.linux
 141 --- ppp-2.4.3-orig/pppd/Makefile.linux  2004-11-13 13:02:22.000000000 +0100
 142 +++ ppp-2.4.3-3/pppd/Makefile.linux     2004-12-16 04:43:41.000000000 +0100
 143 @@ -48,19 +48,19 @@
 144  # Uncomment the next line to include support for PPP packet filtering.
 145  # This requires that the libpcap library and headers be installed
 146  # and that the kernel driver support PPP packet filtering.
 147 -FILTER=y
 148 +#FILTER=y
 149
 150  # Uncomment the next line to enable multilink PPP (enabled by default)
 151  # Linux distributions: Please leave multilink ENABLED in your builds
 152  # of pppd!
 153 -HAVE_MULTILINK=y
 154 +#HAVE_MULTILINK=y
 155
 156  # Uncomment the next line to enable the TDB database (enabled by default.)
 157  # If you enable multilink, then TDB is automatically enabled also.
 158  # Linux distributions: Please leave TDB ENABLED in your builds.
 159 -USE_TDB=y
 160 +#USE_TDB=y
 161
 162 -HAS_SHADOW=y
 163 +#HAS_SHADOW=y
 164  #USE_PAM=y
 165  #HAVE_INET6=y
 166
 167 @@ -77,7 +77,7 @@
 168
 169  INCLUDE_DIRS= -I../include
 170
 171 -COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP
 172 +COMPILE_FLAGS= -DHAVE_PATHS_H -DHAVE_MMAP
 173
 174  CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS)
 175
 176 @@ -99,7 +99,7 @@
 177  CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
 178  LIBS   += -lsrp -L/usr/local/ssl/lib -lcrypto
 179  TARGETS        += srp-entry
 180 -EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry
 181 +EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
 182  MANPAGES += srp-entry.8
 183  EXTRACLEAN += srp-entry.o
 184  NEEDDES=y
 185 @@ -117,12 +117,12 @@
 186  #LIBS     += -lshadow $(LIBS)
 187  endif
 188
 189 -ifneq ($(wildcard /usr/include/crypt.h),)
 190 +#ifneq ($(wildcard /usr/include/crypt.h),)
 191  CFLAGS   += -DHAVE_CRYPT_H=1
 192 -endif
 193 -ifneq ($(wildcard /usr/lib/libcrypt.*),)
 194 +#endif
 195 +#ifneq ($(wildcard /usr/lib/libcrypt.*),)
 196  LIBS   += -lcrypt
 197 -endif
 198 +#endif
 199
 200  ifdef NEEDDES
 201  ifndef USE_CRYPT
 202 @@ -202,7 +202,7 @@
 203  install: pppd
 204         mkdir -p $(BINDIR) $(MANDIR)
 205         $(EXTRAINSTALL)
 206 -       $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd
 207 +       $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd
 208         if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \
 209           chmod o-rx,u+s $(BINDIR)/pppd; fi
 210         $(INSTALL) -c -m 444 pppd.8 $(MANDIR)
 211 diff -ruN ppp-2.4.3-orig/pppd/ccp.c ppp-2.4.3-3/pppd/ccp.c
 212 --- ppp-2.4.3-orig/pppd/ccp.c   2004-11-13 03:28:15.000000000 +0100
 213 +++ ppp-2.4.3-3/pppd/ccp.c      2004-12-05 17:51:27.000000000 +0100
 214 @@ -62,12 +62,10 @@
 215  static char bsd_value[8];
 216  static char deflate_value[8];
 217
 218 -/*
 219 - * Option variables.
 220 - */
 221  #ifdef MPPE
 222 -bool refuse_mppe_stateful = 1;         /* Allow stateful mode? */
 223 -#endif
 224 +static int setmppe(char **);
 225 +static int setnomppe(void);
 226 +#endif /* MPPE */
 227
 228  static option_t ccp_option_list[] = {
 229      { "noccp", o_bool, &ccp_protent.enabled_flag,
 230 @@ -108,54 +106,36 @@
 231        "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 232        &ccp_allowoptions[0].predictor_1 },
 233
 234 +    { "lzs", o_bool, &ccp_wantoptions[0].lzs,
 235 +      "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
 236 +    { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
 237 +      "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
 238 +    { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
 239 +      "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
 240 +      &ccp_allowoptions[0].lzs },
 241 +    { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
 242 +      "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 243 +      &ccp_allowoptions[0].lzs },
 244 +
 245  #ifdef MPPE
 246 -    /* MPPE options are symmetrical ... we only set wantoptions here */
 247 -    { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
 248 -      "require MPPE encryption",
 249 -      OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
 250 -    { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
 251 -      "require MPPE encryption",
 252 -      OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
 253 -    { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
 254 -      "don't allow MPPE encryption", OPT_PRIO },
 255 -    { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
 256 -      "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
 257 -
 258 -    /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
 259 -    { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 260 -      "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
 261 -      &ccp_wantoptions[0].mppe },
 262 -    { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 263 -      "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
 264 -      &ccp_wantoptions[0].mppe },
 265 -    { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
 266 -      "don't allow MPPE 40-bit encryption",
 267 -      OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
 268 -    { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 269 -      "don't allow MPPE 40-bit encryption",
 270 -      OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
 271 -      &ccp_wantoptions[0].mppe },
 272 -
 273 -    { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 274 -      "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
 275 -      &ccp_wantoptions[0].mppe },
 276 -    { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 277 -      "require MPPE 128-bit encryption",
 278 -      OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
 279 -      &ccp_wantoptions[0].mppe },
 280 -    { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
 281 -      "don't allow MPPE 128-bit encryption",
 282 -      OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
 283 -    { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 284 -      "don't allow MPPE 128-bit encryption",
 285 -      OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
 286 -      &ccp_wantoptions[0].mppe },
 287 -
 288 -    /* strange one; we always request stateless, but will we allow stateful? */
 289 -    { "mppe-stateful", o_bool, &refuse_mppe_stateful,
 290 -      "allow MPPE stateful mode", OPT_PRIO },
 291 -    { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
 292 -      "disallow MPPE stateful mode", OPT_PRIO | 1 },
 293 +    { "mppc", o_bool, &ccp_wantoptions[0].mppc,
 294 +      "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
 295 +    { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
 296 +      "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
 297 +    { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
 298 +      "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
 299 +      &ccp_allowoptions[0].mppc },
 300 +    { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
 301 +      "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 302 +      &ccp_allowoptions[0].mppc },
 303 +    { "mppe", o_special, (void *)setmppe,
 304 +      "request MPPE encryption" },
 305 +    { "+mppe", o_special, (void *)setmppe,
 306 +      "request MPPE encryption" },
 307 +    { "nomppe", o_special_noarg, (void *)setnomppe,
 308 +      "don't allow MPPE encryption" },
 309 +    { "-mppe", o_special_noarg, (void *)setnomppe,
 310 +      "don't allow MPPE encryption" },
 311  #endif /* MPPE */
 312
 313      { NULL }
 314 @@ -241,7 +221,7 @@
 315   */
 316  #define ANY_COMPRESS(opt)      ((opt).deflate || (opt).bsd_compress \
 317                                  || (opt).predictor_1 || (opt).predictor_2 \
 318 -                                || (opt).mppe)
 319 +                                || (opt).lzs || (opt).mppc || (opt).mppe)
 320
 321  /*
 322   * Local state (mainly for handling reset-reqs and reset-acks).
 323 @@ -344,6 +324,100 @@
 324      return 1;
 325  }
 326
 327 +#ifdef MPPE
 328 +/*
 329 + * Functions called from config options
 330 + */
 331 +/*
 332 +   MPPE suboptions:
 333 +       required - require MPPE; disconnect if peer doesn't support it
 334 +       stateless - use stateless mode
 335 +       no40 - disable 40 bit keys
 336 +       no56 - disable 56 bit keys
 337 +       no128 - disable 128 bit keys
 338 +*/
 339 +int setmppe(char **argv)
 340 +{
 341 +    int i;
 342 +    char *str, cmdbuf[16];
 343 +
 344 +    ccp_allowoptions[0].mppe = 1;
 345 +    ccp_allowoptions[0].mppe_40 = 1;
 346 +    ccp_allowoptions[0].mppe_56 = 1;
 347 +    ccp_allowoptions[0].mppe_128 = 1;
 348 +    ccp_allowoptions[0].mppe_stateless = 0;
 349 +    ccp_wantoptions[0].mppe = 0;
 350 +
 351 +    str = *argv;
 352 +
 353 +    while (1) {
 354 +       i = 0;
 355 +       memset(cmdbuf, '\0', 16);
 356 +       while ((i < 16) && (*str != ',') && (*str != '\0'))
 357 +           cmdbuf[i++] = *str++;
 358 +       cmdbuf[i] = '\0';
 359 +       if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
 360 +           ccp_allowoptions[0].mppe_40 = 0;
 361 +           goto next_param;
 362 +       } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
 363 +           ccp_allowoptions[0].mppe_56 = 0;
 364 +           goto next_param;
 365 +       } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
 366 +           ccp_allowoptions[0].mppe_128 = 0;
 367 +           goto next_param;
 368 +       } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
 369 +           ccp_allowoptions[0].mppe_stateless = 1;
 370 +           goto next_param;
 371 +       } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
 372 +           ccp_wantoptions[0].mppe = 1;
 373 +           goto next_param;
 374 +       } else {
 375 +           option_error("invalid parameter '%s' for mppe option", cmdbuf);
 376 +           return 0;
 377 +       }
 378 +
 379 +    next_param:
 380 +       if (*str == ',') {
 381 +           str++;
 382 +           continue;
 383 +       }
 384 +       if (*str == '\0') {
 385 +           if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
 386 +                 ccp_allowoptions[0].mppe_128)) {
 387 +               if (ccp_wantoptions[0].mppe == 1) {
 388 +                   option_error("You require MPPE but you have switched off "
 389 +                                "all encryption key lengths.");
 390 +                   return 0;
 391 +               }
 392 +               ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
 393 +               ccp_wantoptions[0].mppe_stateless =
 394 +                   ccp_allowoptions[0].mppe_stateless = 0;
 395 +           } else {
 396 +               ccp_allowoptions[0].mppe = 1;
 397 +               ccp_wantoptions[0].mppe_stateless =
 398 +                   ccp_allowoptions[0].mppe_stateless;
 399 +               if (ccp_wantoptions[0].mppe == 1) {
 400 +                   ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
 401 +                   ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
 402 +                   ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
 403 +               }
 404 +           }
 405 +           return 1;
 406 +       }
 407 +    }
 408 +}
 409 +
 410 +int setnomppe(void)
 411 +{
 412 +    ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
 413 +    ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
 414 +    ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
 415 +    ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
 416 +    ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
 417 +    return 1;
 418 +}
 419 +#endif /* MPPE */
 420 +
 421  /*
 422   * ccp_init - initialize CCP.
 423   */
 424 @@ -378,6 +452,30 @@
 425      ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
 426
 427      ccp_allowoptions[0].predictor_1 = 1;
 428 +
 429 +    ccp_wantoptions[0].lzs = 0; /* Stac LZS  - will be enabled in the future */
 430 +    ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
 431 +    ccp_wantoptions[0].lzs_hists = 1;
 432 +    ccp_allowoptions[0].lzs = 0; /* Stac LZS  - will be enabled in the future */
 433 +    ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
 434 +    ccp_allowoptions[0].lzs_hists = 1;
 435 +
 436 +#ifdef MPPE
 437 +    /* by default allow and request MPPC... */
 438 +    ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
 439 +
 440 +    /* ... and allow but don't request MPPE */
 441 +    ccp_allowoptions[0].mppe = 1;
 442 +    ccp_allowoptions[0].mppe_40 = 1;
 443 +    ccp_allowoptions[0].mppe_56 = 1;
 444 +    ccp_allowoptions[0].mppe_128 = 1;
 445 +    ccp_allowoptions[0].mppe_stateless = 1;
 446 +    ccp_wantoptions[0].mppe = 0;
 447 +    ccp_wantoptions[0].mppe_40 = 0;
 448 +    ccp_wantoptions[0].mppe_56 = 0;
 449 +    ccp_wantoptions[0].mppe_128 = 0;
 450 +    ccp_wantoptions[0].mppe_stateless = 0;
 451 +#endif /* MPPE */
 452  }
 453
 454  /*
 455 @@ -455,11 +553,11 @@
 456      if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
 457         notice("Compression disabled by peer.");
 458  #ifdef MPPE
 459 -       if (ccp_gotoptions[unit].mppe) {
 460 +       if (ccp_wantoptions[unit].mppe) {
 461             error("MPPE disabled, closing LCP");
 462             lcp_close(unit, "MPPE disabled by peer");
 463         }
 464 -#endif
 465 +#endif /* MPPE */
 466      }
 467
 468      /*
 469 @@ -487,6 +585,15 @@
 470             break;
 471         /* send a reset-ack, which the transmitter will see and
 472            reset its compression state. */
 473 +
 474 +       /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
 475 +          but we do it in order to reset compressor; CCP_RESETACK is
 476 +          then silently discarded. See functions ppp_send_frame and
 477 +          ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
 478 +          confusion is caused by the fact that CCP code is splited
 479 +          into two parts - one part is handled by pppd, the other one
 480 +          is handled by kernel. */
 481 +
 482         fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
 483         break;
 484
 485 @@ -515,12 +622,11 @@
 486      fsm_lowerdown(&ccp_fsm[unit]);
 487
 488  #ifdef MPPE
 489 -    if (ccp_gotoptions[unit].mppe) {
 490 +    if (ccp_wantoptions[unit].mppe) {
 491         error("MPPE required but peer negotiation failed");
 492         lcp_close(unit, "MPPE required but peer negotiation failed");
 493      }
 494 -#endif
 495 -
 496 +#endif /* MPPE */
 497  }
 498
 499  /*
 500 @@ -537,7 +643,7 @@
 501      all_rejected[f->unit] = 0;
 502
 503  #ifdef MPPE
 504 -    if (go->mppe) {
 505 +    if (go->mppe || go->mppc) {
 506         ccp_options *ao = &ccp_allowoptions[f->unit];
 507         int auth_mschap_bits = auth_done[f->unit];
 508         int numbits;
 509 @@ -551,80 +657,109 @@
 510          * NB: If MPPE is required, all other compression opts are invalid.
 511          *     So, we return right away if we can't do it.
 512          */
 513 +       if (ccp_wantoptions[f->unit].mppe) {
 514 +           /* Leave only the mschap auth bits set */
 515 +           auth_mschap_bits &= (CHAP_MS_WITHPEER  | CHAP_MS_PEER |
 516 +                                CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
 517 +           /* Count the mschap auths */
 518 +           auth_mschap_bits >>= CHAP_MS_SHIFT;
 519 +           numbits = 0;
 520 +           do {
 521 +               numbits += auth_mschap_bits & 1;
 522 +               auth_mschap_bits >>= 1;
 523 +           } while (auth_mschap_bits);
 524 +           if (numbits > 1) {
 525 +               error("MPPE required, but auth done in both directions.");
 526 +               lcp_close(f->unit, "MPPE required but not available");
 527 +               return;
 528 +           }
 529 +           if (!numbits) {
 530 +               error("MPPE required, but MS-CHAP[v2] auth not performed.");
 531 +               lcp_close(f->unit, "MPPE required but not available");
 532 +               return;
 533 +           }
 534
 535 -       /* Leave only the mschap auth bits set */
 536 -       auth_mschap_bits &= (CHAP_MS_WITHPEER  | CHAP_MS_PEER |
 537 -                            CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
 538 -       /* Count the mschap auths */
 539 -       auth_mschap_bits >>= CHAP_MS_SHIFT;
 540 -       numbits = 0;
 541 -       do {
 542 -           numbits += auth_mschap_bits & 1;
 543 -           auth_mschap_bits >>= 1;
 544 -       } while (auth_mschap_bits);
 545 -       if (numbits > 1) {
 546 -           error("MPPE required, but auth done in both directions.");
 547 -           lcp_close(f->unit, "MPPE required but not available");
 548 -           return;
 549 -       }
 550 -       if (!numbits) {
 551 -           error("MPPE required, but MS-CHAP[v2] auth not performed.");
 552 -           lcp_close(f->unit, "MPPE required but not available");
 553 -           return;
 554 -       }
 555 -
 556 -       /* A plugin (eg radius) may not have obtained key material. */
 557 -       if (!mppe_keys_set) {
 558 -           error("MPPE required, but keys are not available.  "
 559 -                 "Possible plugin problem?");
 560 -           lcp_close(f->unit, "MPPE required but not available");
 561 -           return;
 562 -       }
 563 -
 564 -       /* LM auth not supported for MPPE */
 565 -       if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
 566 -           /* This might be noise */
 567 -           if (go->mppe & MPPE_OPT_40) {
 568 -               notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
 569 -               go->mppe &= ~MPPE_OPT_40;
 570 -               ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
 571 +           /* A plugin (eg radius) may not have obtained key material. */
 572 +           if (!mppe_keys_set) {
 573 +               error("MPPE required, but keys are not available.  "
 574 +                     "Possible plugin problem?");
 575 +               lcp_close(f->unit, "MPPE required but not available");
 576 +               return;
 577             }
 578         }
 579
 580 -       /* Last check: can we actually negotiate something? */
 581 -       if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
 582 -           /* Could be misconfig, could be 40-bit disabled above. */
 583 -           error("MPPE required, but both 40-bit and 128-bit disabled.");
 584 -           lcp_close(f->unit, "MPPE required but not available");
 585 -           return;
 586 +       /*
 587 +        * Check whether the kernel knows about the various
 588 +        * compression methods we might request. Key material
 589 +        * unimportant here.
 590 +        */
 591 +       if (go->mppc) {
 592 +           opt_buf[0] = CI_MPPE;
 593 +           opt_buf[1] = CILEN_MPPE;
 594 +           opt_buf[2] = 0;
 595 +           opt_buf[3] = 0;
 596 +           opt_buf[4] = 0;
 597 +           opt_buf[5] = MPPE_MPPC;
 598 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
 599 +               go->mppc = 0;
 600 +       }
 601 +       if (go->mppe_40) {
 602 +           opt_buf[0] = CI_MPPE;
 603 +           opt_buf[1] = CILEN_MPPE;
 604 +           opt_buf[2] = MPPE_STATELESS;
 605 +           opt_buf[3] = 0;
 606 +           opt_buf[4] = 0;
 607 +           opt_buf[5] = MPPE_40BIT;
 608 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 609 +               go->mppe_40 = 0;
 610 +       }
 611 +       if (go->mppe_56) {
 612 +           opt_buf[0] = CI_MPPE;
 613 +           opt_buf[1] = CILEN_MPPE;
 614 +           opt_buf[2] = MPPE_STATELESS;
 615 +           opt_buf[3] = 0;
 616 +           opt_buf[4] = 0;
 617 +           opt_buf[5] = MPPE_56BIT;
 618 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 619 +               go->mppe_56 = 0;
 620 +       }
 621 +       if (go->mppe_128) {
 622 +           opt_buf[0] = CI_MPPE;
 623 +           opt_buf[1] = CILEN_MPPE;
 624 +           opt_buf[2] = MPPE_STATELESS;
 625 +           opt_buf[3] = 0;
 626 +           opt_buf[4] = 0;
 627 +           opt_buf[5] = MPPE_128BIT;
 628 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 629 +               go->mppe_128 = 0;
 630 +       }
 631 +       if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
 632 +           if (ccp_wantoptions[f->unit].mppe) {
 633 +               error("MPPE required, but kernel has no support.");
 634 +               lcp_close(f->unit, "MPPE required but not available");
 635 +           }
 636 +           go->mppe = go->mppe_stateless = 0;
 637 +       } else {
 638 +           /* MPPE is not compatible with other compression types */
 639 +           if (ccp_wantoptions[f->unit].mppe) {
 640 +               ao->bsd_compress = go->bsd_compress = 0;
 641 +               ao->predictor_1  = go->predictor_1  = 0;
 642 +               ao->predictor_2  = go->predictor_2  = 0;
 643 +               ao->deflate      = go->deflate      = 0;
 644 +               ao->lzs          = go->lzs          = 0;
 645 +           }
 646         }
 647 -
 648 -       /* sync options */
 649 -       ao->mppe = go->mppe;
 650 -       /* MPPE is not compatible with other compression types */
 651 -       ao->bsd_compress = go->bsd_compress = 0;
 652 -       ao->predictor_1  = go->predictor_1  = 0;
 653 -       ao->predictor_2  = go->predictor_2  = 0;
 654 -       ao->deflate      = go->deflate      = 0;
 655      }
 656  #endif /* MPPE */
 657 -
 658 -    /*
 659 -     * Check whether the kernel knows about the various
 660 -     * compression methods we might request.
 661 -     */
 662 -#ifdef MPPE
 663 -    if (go->mppe) {
 664 -       opt_buf[0] = CI_MPPE;
 665 -       opt_buf[1] = CILEN_MPPE;
 666 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 667 -       /* Key material unimportant here. */
 668 -       if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
 669 -           error("MPPE required, but kernel has no support.");
 670 -           lcp_close(f->unit, "MPPE required but not available");
 671 -       }
 672 +    if (go->lzs) {
 673 +       opt_buf[0] = CI_LZS;
 674 +       opt_buf[1] = CILEN_LZS;
 675 +       opt_buf[2] = go->lzs_hists >> 8;
 676 +       opt_buf[3] = go->lzs_hists & 0xff;
 677 +       opt_buf[4] = LZS_MODE_SEQ;
 678 +       if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
 679 +           go->lzs = 0;
 680      }
 681 -#endif
 682      if (go->bsd_compress) {
 683         opt_buf[0] = CI_BSD_COMPRESS;
 684         opt_buf[1] = CILEN_BSD_COMPRESS;
 685 @@ -679,7 +814,8 @@
 686         + (go->deflate? CILEN_DEFLATE: 0)
 687         + (go->predictor_1? CILEN_PREDICTOR_1: 0)
 688         + (go->predictor_2? CILEN_PREDICTOR_2: 0)
 689 -       + (go->mppe? CILEN_MPPE: 0);
 690 +       + (go->lzs? CILEN_LZS: 0)
 691 +       + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
 692  }
 693
 694  /*
 695 @@ -693,6 +829,8 @@
 696  {
 697      int res;
 698      ccp_options *go = &ccp_gotoptions[f->unit];
 699 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 700 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 701      u_char *p0 = p;
 702
 703      /*
 704 @@ -701,22 +839,43 @@
 705       * in case it gets Acked.
 706       */
 707  #ifdef MPPE
 708 -    if (go->mppe) {
 709 +    if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
 710         u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
 711
 712 -       p[0] = opt_buf[0] = CI_MPPE;
 713 -       p[1] = opt_buf[1] = CILEN_MPPE;
 714 -       MPPE_OPTS_TO_CI(go->mppe, &p[2]);
 715 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 716 +       p[0] = CI_MPPE;
 717 +       p[1] = CILEN_MPPE;
 718 +       p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
 719 +       p[3] = 0;
 720 +       p[4] = 0;
 721 +       p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
 722 +           (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
 723 +
 724 +       BCOPY(p, opt_buf, CILEN_MPPE);
 725         BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
 726         res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
 727 -       if (res > 0)
 728 +       if (res > 0) {
 729             p += CILEN_MPPE;
 730 -       else
 731 +       } else {
 732             /* This shouldn't happen, we've already tested it! */
 733 -           lcp_close(f->unit, "MPPE required but not available in kernel");
 734 +           go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
 735 +               go->mppe_stateless = go->mppc = 0;
 736 +           if (ccp_wantoptions[f->unit].mppe)
 737 +               lcp_close(f->unit, "MPPE required but not available in kernel");
 738 +       }
 739 +    }
 740 +#endif /* MPPE */
 741 +    if (go->lzs) {
 742 +       p[0] = CI_LZS;
 743 +       p[1] = CILEN_LZS;
 744 +       p[2] = go->lzs_hists >> 8;
 745 +       p[3] = go->lzs_hists & 0xff;
 746 +       p[4] = LZS_MODE_SEQ;
 747 +       res = ccp_test(f->unit, p, CILEN_LZS, 0);
 748 +       if (res > 0) {
 749 +           p += CILEN_LZS;
 750 +       } else
 751 +           go->lzs = 0;
 752      }
 753 -#endif
 754      if (go->deflate) {
 755         p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
 756         p[1] = CILEN_DEFLATE;
 757 @@ -802,7 +961,7 @@
 758
 759  /*
 760   * ccp_ackci - process a received configure-ack, and return
 761 - * 1 iff the packet was OK.
 762 + * 1 if the packet was OK.
 763   */
 764  static int
 765  ccp_ackci(f, p, len)
 766 @@ -811,24 +970,44 @@
 767      int len;
 768  {
 769      ccp_options *go = &ccp_gotoptions[f->unit];
 770 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 771 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 772      u_char *p0 = p;
 773
 774  #ifdef MPPE
 775 -    if (go->mppe) {
 776 -       u_char opt_buf[CILEN_MPPE];
 777 -
 778 -       opt_buf[0] = CI_MPPE;
 779 -       opt_buf[1] = CILEN_MPPE;
 780 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 781 -       if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
 782 +    if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
 783 +       if (len < CILEN_MPPE
 784 +           || p[1] != CILEN_MPPE || p[0] != CI_MPPE
 785 +           || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
 786 +           || p[3] != 0
 787 +           || p[4] != 0
 788 +           || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
 789 +                        (go->mppc ? MPPE_MPPC : 0))
 790 +               && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
 791 +                           (go->mppc ? MPPE_MPPC : 0))
 792 +               && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
 793 +                           (go->mppc ? MPPE_MPPC : 0))))
 794             return 0;
 795 +       if (go->mppe_40 || go->mppe_56 || go->mppe_128)
 796 +           go->mppe = 1;
 797         p += CILEN_MPPE;
 798         len -= CILEN_MPPE;
 799 +       /* Cope with first/fast ack */
 800 +       if (p == p0 && len == 0)
 801 +           return 1;
 802 +    }
 803 +#endif /* MPPE */
 804 +    if (go->lzs) {
 805 +       if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
 806 +           || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
 807 +           || p[4] != LZS_MODE_SEQ)
 808 +           return 0;
 809 +       p += CILEN_LZS;
 810 +       len -= CILEN_LZS;
 811         /* XXX Cope with first/fast ack */
 812 -       if (len == 0)
 813 +       if (p == p0 && len == 0)
 814             return 1;
 815      }
 816 -#endif
 817      if (go->deflate) {
 818         if (len < CILEN_DEFLATE
 819             || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
 820 @@ -891,7 +1070,7 @@
 821
 822  /*
 823   * ccp_nakci - process received configure-nak.
 824 - * Returns 1 iff the nak was OK.
 825 + * Returns 1 if the nak was OK.
 826   */
 827  static int
 828  ccp_nakci(f, p, len, treat_as_reject)
 829 @@ -900,6 +1079,8 @@
 830      int len;
 831  {
 832      ccp_options *go = &ccp_gotoptions[f->unit];
 833 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 834 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 835      ccp_options no;            /* options we've seen already */
 836      ccp_options try;           /* options to ask for next time */
 837
 838 @@ -907,28 +1088,100 @@
 839      try = *go;
 840
 841  #ifdef MPPE
 842 -    if (go->mppe && len >= CILEN_MPPE
 843 -       && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 844 -       no.mppe = 1;
 845 -       /*
 846 -        * Peer wants us to use a different strength or other setting.
 847 -        * Fail if we aren't willing to use his suggestion.
 848 -        */
 849 -       MPPE_CI_TO_OPTS(&p[2], try.mppe);
 850 -       if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
 851 -           error("Refusing MPPE stateful mode offered by peer");
 852 -           try.mppe = 0;
 853 -       } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
 854 -           /* Peer must have set options we didn't request (suggest) */
 855 -           try.mppe = 0;
 856 -       }
 857 +    if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
 858 +       len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 859
 860 -       if (!try.mppe) {
 861 -           error("MPPE required but peer negotiation failed");
 862 -           lcp_close(f->unit, "MPPE required but peer negotiation failed");
 863 +       if (go->mppc) {
 864 +           no.mppc = 1;
 865 +           if (!(p[5] & MPPE_MPPC))
 866 +               try.mppc = 0;
 867 +       }
 868 +
 869 +       if (go->mppe)
 870 +           no.mppe = 1;
 871 +       if (go->mppe_40)
 872 +           no.mppe_40 = 1;
 873 +       if (go->mppe_56)
 874 +           no.mppe_56 = 1;
 875 +       if (go->mppe_128)
 876 +           no.mppe_128 = 1;
 877 +       if (go->mppe_stateless)
 878 +           no.mppe_stateless = 1;
 879 +
 880 +       if (ao->mppe_40) {
 881 +           if ((p[5] & MPPE_40BIT))
 882 +               try.mppe_40 = 1;
 883 +           else
 884 +               try.mppe_40 = (p[5] == 0) ? 1 : 0;
 885 +       }
 886 +       if (ao->mppe_56) {
 887 +           if ((p[5] & MPPE_56BIT))
 888 +               try.mppe_56 = 1;
 889 +           else
 890 +               try.mppe_56 = (p[5] == 0) ? 1 : 0;
 891 +       }
 892 +       if (ao->mppe_128) {
 893 +           if ((p[5] & MPPE_128BIT))
 894 +               try.mppe_128 = 1;
 895 +           else
 896 +               try.mppe_128 = (p[5] == 0) ? 1 : 0;
 897 +       }
 898 +
 899 +       if (ao->mppe_stateless) {
 900 +           if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
 901 +               try.mppe_stateless = 1;
 902 +           else
 903 +               try.mppe_stateless = 0;
 904 +       }
 905 +
 906 +       if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
 907 +           try.mppe = try.mppe_stateless = 0;
 908 +           if (wo->mppe) {
 909 +               /* we require encryption, but peer doesn't support it
 910 +                  so we close connection */
 911 +               wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 912 +                   wo->mppe_56 = wo->mppe_128 = 0;
 913 +               lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
 914 +                         "key length");
 915 +           }
 916 +        }
 917 +       if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
 918 +           (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
 919 +           /* cannot negotiate key length */
 920 +           wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 921 +               wo->mppe_56 = wo->mppe_128 = 0;
 922 +           lcp_close(f->unit, "Cannot negotiate MPPE key length");
 923         }
 924 +       if (try.mppe_40 && try.mppe_56 && try.mppe_128)
 925 +           try.mppe_40 = try.mppe_56 = 0;
 926 +       else
 927 +           if (try.mppe_56 && try.mppe_128)
 928 +               try.mppe_56 = 0;
 929 +           else
 930 +               if (try.mppe_40 && try.mppe_128)
 931 +                   try.mppe_40 = 0;
 932 +               else
 933 +                   if (try.mppe_40 && try.mppe_56)
 934 +                       try.mppe_40 = 0;
 935 +
 936 +       p += CILEN_MPPE;
 937 +       len -= CILEN_MPPE;
 938      }
 939  #endif /* MPPE */
 940 +
 941 +    if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
 942 +       no.lzs = 1;
 943 +       if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
 944 +                                    p[4] != LZS_MODE_EXT))
 945 +           try.lzs = 0;
 946 +       else {
 947 +           try.lzs_mode = p[4];
 948 +           try.lzs_hists = (p[2] << 8) | p[3];
 949 +       }
 950 +       p += CILEN_LZS;
 951 +       len -= CILEN_LZS;
 952 +    }
 953 +
 954      if (go->deflate && len >= CILEN_DEFLATE
 955         && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
 956         && p[1] == CILEN_DEFLATE) {
 957 @@ -1001,14 +1254,50 @@
 958         return -1;
 959
 960  #ifdef MPPE
 961 -    if (go->mppe && len >= CILEN_MPPE
 962 +    if ((go->mppe || go->mppc) && len >= CILEN_MPPE
 963         && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 964 -       error("MPPE required but peer refused");
 965 -       lcp_close(f->unit, "MPPE required but peer refused");
 966 +       ccp_options *wo = &ccp_wantoptions[f->unit];
 967 +       if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
 968 +           p[3] != 0 ||
 969 +           p[4] != 0 ||
 970 +           p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
 971 +                    (go->mppe_56 ? MPPE_56BIT : 0) |
 972 +                    (go->mppe_128 ? MPPE_128BIT : 0) |
 973 +                    (go->mppc ? MPPE_MPPC : 0)))
 974 +           return 0;
 975 +       if (go->mppc)
 976 +           try.mppc = 0;
 977 +       if (go->mppe) {
 978 +           try.mppe = 0;
 979 +           if (go->mppe_40)
 980 +               try.mppe_40 = 0;
 981 +           if (go->mppe_56)
 982 +               try.mppe_56 = 0;
 983 +           if (go->mppe_128)
 984 +               try.mppe_128 = 0;
 985 +           if (go->mppe_stateless)
 986 +               try.mppe_stateless = 0;
 987 +           if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
 988 +               try.mppe = try.mppe_stateless = 0;
 989 +           if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
 990 +               wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 991 +                   wo->mppe_56 = wo->mppe_128 = 0;
 992 +               lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
 993 +                         "key length");
 994 +           }
 995 +       }
 996         p += CILEN_MPPE;
 997         len -= CILEN_MPPE;
 998      }
 999 -#endif
1000 +#endif /* MPPE */
1001 +    if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
1002 +       if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
1003 +           || p[4] != go->lzs_mode)
1004 +           return 0;
1005 +       try.lzs = 0;
1006 +       p += CILEN_LZS;
1007 +       len -= CILEN_LZS;
1008 +    }
1009      if (go->deflate_correct && len >= CILEN_DEFLATE
1010         && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
1011         if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
1012 @@ -1072,14 +1361,15 @@
1013      int dont_nak;
1014  {
1015      int ret, newret, res;
1016 -    u_char *p0, *retp;
1017 +    u_char *p0, *retp, p2, p5;
1018      int len, clen, type, nb;
1019      ccp_options *ho = &ccp_hisoptions[f->unit];
1020      ccp_options *ao = &ccp_allowoptions[f->unit];
1021 +    ccp_options *wo = &ccp_wantoptions[f->unit];
1022  #ifdef MPPE
1023 -    bool rej_for_ci_mppe = 1;  /* Are we rejecting based on a bad/missing */
1024 -                               /* CI_MPPE, or due to other options?       */
1025 -#endif
1026 +    u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1027 +/*     int mtu; */
1028 +#endif /* MPPE */
1029
1030      ret = CONFACK;
1031      retp = p0 = p;
1032 @@ -1102,103 +1392,305 @@
1033             switch (type) {
1034  #ifdef MPPE
1035             case CI_MPPE:
1036 -               if (!ao->mppe || clen != CILEN_MPPE) {
1037 +               if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
1038                     newret = CONFREJ;
1039                     break;
1040                 }
1041 -               MPPE_CI_TO_OPTS(&p[2], ho->mppe);
1042
1043 -               /* Nak if anything unsupported or unknown are set. */
1044 -               if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
1045 -                   newret = CONFNAK;
1046 -                   ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
1047 -               }
1048 -               if (ho->mppe & MPPE_OPT_UNKNOWN) {
1049 +               p2 = p[2];
1050 +               p5 = p[5];
1051 +               /* not sure what they want, tell 'em what we got */
1052 +               if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
1053 +                    (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
1054 +                              MPPE_MPPC)) != 0 || p[5] == 0) ||
1055 +                   (p[2] == 0 && p[3] == 0 && p[4] == 0 &&  p[5] == 0)) {
1056                     newret = CONFNAK;
1057 -                   ho->mppe &= ~MPPE_OPT_UNKNOWN;
1058 +                   p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
1059 +                   p[3] = 0;
1060 +                   p[4] = 0;
1061 +                   p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
1062 +                       (wo->mppe_56 ? MPPE_56BIT : 0) |
1063 +                       (wo->mppe_128 ? MPPE_128BIT : 0) |
1064 +                       (wo->mppc ? MPPE_MPPC : 0);
1065 +                   break;
1066                 }
1067
1068 -               /* Check state opt */
1069 -               if (ho->mppe & MPPE_OPT_STATEFUL) {
1070 -                   /*
1071 -                    * We can Nak and request stateless, but it's a
1072 -                    * lot easier to just assume the peer will request
1073 -                    * it if he can do it; stateful mode is bad over
1074 -                    * the Internet -- which is where we expect MPPE.
1075 -                    */
1076 -                  if (refuse_mppe_stateful) {
1077 -                       error("Refusing MPPE stateful mode offered by peer");
1078 +               if ((p[5] & MPPE_MPPC)) {
1079 +                   if (ao->mppc) {
1080 +                       ho->mppc = 1;
1081 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1082 +                       opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
1083 +                       opt_buf[5] = MPPE_MPPC;
1084 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
1085 +                           ho->mppc = 0;
1086 +                           p[5] &= ~MPPE_MPPC;
1087 +                           newret = CONFNAK;
1088 +                       }
1089 +                   } else {
1090                         newret = CONFREJ;
1091 -                       break;
1092 +                       if (wo->mppe || ao->mppe) {
1093 +                           p[5] &= ~MPPE_MPPC;
1094 +                           newret = CONFNAK;
1095 +                       }
1096 +                   }
1097 +               }
1098 +
1099 +               if (ao->mppe)
1100 +                   ho->mppe = 1;
1101 +
1102 +               if ((p[2] & MPPE_STATELESS)) {
1103 +                   if (ao->mppe_stateless) {
1104 +                       if (wo->mppe_stateless)
1105 +                           ho->mppe_stateless = 1;
1106 +                       else {
1107 +                           newret = CONFNAK;
1108 +                           if (!dont_nak)
1109 +                               p[2] &= ~MPPE_STATELESS;
1110 +                       }
1111 +                   } else {
1112 +                       newret = CONFNAK;
1113 +                       if (!dont_nak)
1114 +                           p[2] &= ~MPPE_STATELESS;
1115 +                   }
1116 +               } else {
1117 +                   if (wo->mppe_stateless && !dont_nak) {
1118 +                       wo->mppe_stateless = 0;
1119 +                       newret = CONFNAK;
1120 +                       p[2] |= MPPE_STATELESS;
1121                     }
1122                 }
1123
1124 -               /* Find out which of {S,L} are set. */
1125 -               if ((ho->mppe & MPPE_OPT_128)
1126 -                    && (ho->mppe & MPPE_OPT_40)) {
1127 -                   /* Both are set, negotiate the strongest. */
1128 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1129                     newret = CONFNAK;
1130 -                   if (ao->mppe & MPPE_OPT_128)
1131 -                       ho->mppe &= ~MPPE_OPT_40;
1132 -                   else if (ao->mppe & MPPE_OPT_40)
1133 -                       ho->mppe &= ~MPPE_OPT_128;
1134 -                   else {
1135 -                       newret = CONFREJ;
1136 -                       break;
1137 +                   if (ao->mppe_128) {
1138 +                       ho->mppe_128 = 1;
1139 +                       p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1140 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1141 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1142 +                             MPPE_MAX_KEY_LEN);
1143 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1144 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1145 +                           ho->mppe_128 = 0;
1146 +                           p[5] |= (MPPE_40BIT|MPPE_56BIT);
1147 +                           p[5] &= ~MPPE_128BIT;
1148 +                           goto check_mppe_56_40;
1149 +                       }
1150 +                       goto check_mppe;
1151                     }
1152 -               } else if (ho->mppe & MPPE_OPT_128) {
1153 -                   if (!(ao->mppe & MPPE_OPT_128)) {
1154 -                       newret = CONFREJ;
1155 -                       break;
1156 +                   p[5] &= ~MPPE_128BIT;
1157 +                   goto check_mppe_56_40;
1158 +               }
1159 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1160 +                   newret = CONFNAK;
1161 +                   if (ao->mppe_128) {
1162 +                       ho->mppe_128 = 1;
1163 +                       p[5] &= ~MPPE_56BIT;
1164 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1165 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1166 +                             MPPE_MAX_KEY_LEN);
1167 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1168 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1169 +                           ho->mppe_128 = 0;
1170 +                           p[5] |= MPPE_56BIT;
1171 +                           p[5] &= ~MPPE_128BIT;
1172 +                           goto check_mppe_56;
1173 +                       }
1174 +                       goto check_mppe;
1175                     }
1176 -               } else if (ho->mppe & MPPE_OPT_40) {
1177 -                   if (!(ao->mppe & MPPE_OPT_40)) {
1178 -                       newret = CONFREJ;
1179 -                       break;
1180 +                   p[5] &= ~MPPE_128BIT;
1181 +                   goto check_mppe_56;
1182 +               }
1183 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1184 +                   newret = CONFNAK;
1185 +                   if (ao->mppe_128) {
1186 +                       ho->mppe_128 = 1;
1187 +                       p[5] &= ~MPPE_40BIT;
1188 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1189 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1190 +                             MPPE_MAX_KEY_LEN);
1191 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1192 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1193 +                           ho->mppe_128 = 0;
1194 +                           p[5] |= MPPE_40BIT;
1195 +                           p[5] &= ~MPPE_128BIT;
1196 +                           goto check_mppe_40;
1197 +                       }
1198 +                       goto check_mppe;
1199 +                   }
1200 +                   p[5] &= ~MPPE_128BIT;
1201 +                   goto check_mppe_40;
1202 +               }
1203 +               if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1204 +                   if (ao->mppe_128) {
1205 +                       ho->mppe_128 = 1;
1206 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1207 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1208 +                             MPPE_MAX_KEY_LEN);
1209 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1210 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1211 +                           ho->mppe_128 = 0;
1212 +                           p[5] &= ~MPPE_128BIT;
1213 +                           newret = CONFNAK;
1214 +                       }
1215 +                       goto check_mppe;
1216 +                   }
1217 +                   p[5] &= ~MPPE_128BIT;
1218 +                   newret = CONFNAK;
1219 +                   goto check_mppe;
1220 +               }
1221 +           check_mppe_56_40:
1222 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1223 +                   newret = CONFNAK;
1224 +                   if (ao->mppe_56) {
1225 +                       ho->mppe_56 = 1;
1226 +                       p[5] &= ~MPPE_40BIT;
1227 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1228 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1229 +                             MPPE_MAX_KEY_LEN);
1230 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1231 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1232 +                           ho->mppe_56 = 0;
1233 +                           p[5] |= MPPE_40BIT;
1234 +                           p[5] &= ~MPPE_56BIT;
1235 +                           newret = CONFNAK;
1236 +                           goto check_mppe_40;
1237 +                       }
1238 +                       goto check_mppe;
1239 +                   }
1240 +                   p[5] &= ~MPPE_56BIT;
1241 +                   goto check_mppe_40;
1242 +               }
1243 +           check_mppe_56:
1244 +               if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1245 +                   if (ao->mppe_56) {
1246 +                       ho->mppe_56 = 1;
1247 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1248 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1249 +                             MPPE_MAX_KEY_LEN);
1250 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1251 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1252 +                           ho->mppe_56 = 0;
1253 +                           p[5] &= ~MPPE_56BIT;
1254 +                           newret = CONFNAK;
1255 +                       }
1256 +                       goto check_mppe;
1257 +                   }
1258 +                   p[5] &= ~MPPE_56BIT;
1259 +                   newret = CONFNAK;
1260 +                   goto check_mppe;
1261 +               }
1262 +           check_mppe_40:
1263 +               if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1264 +                   if (ao->mppe_40) {
1265 +                       ho->mppe_40 = 1;
1266 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1267 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1268 +                             MPPE_MAX_KEY_LEN);
1269 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1270 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1271 +                           ho->mppe_40 = 0;
1272 +                           p[5] &= ~MPPE_40BIT;
1273 +                           newret = CONFNAK;
1274 +                       }
1275 +                       goto check_mppe;
1276 +                   }
1277 +                   p[5] &= ~MPPE_40BIT;
1278 +               }
1279 +
1280 +           check_mppe:
1281 +               if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1282 +                   if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1283 +                       newret = CONFNAK;
1284 +                       p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1285 +                       p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1286 +                           (wo->mppe_56 ? MPPE_56BIT : 0) |
1287 +                           (wo->mppe_128 ? MPPE_128BIT : 0) |
1288 +                           (wo->mppc ? MPPE_MPPC : 0);
1289 +                   } else {
1290 +                       ho->mppe = ho->mppe_stateless = 0;
1291                     }
1292                 } else {
1293 -                   /* Neither are set. */
1294 +                   /* MPPE is not compatible with other compression types */
1295 +                   if (wo->mppe) {
1296 +                       ao->bsd_compress = 0;
1297 +                       ao->predictor_1 = 0;
1298 +                       ao->predictor_2 = 0;
1299 +                       ao->deflate = 0;
1300 +                       ao->lzs = 0;
1301 +                   }
1302 +               }
1303 +               if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1304 +                   p[2] = p2;
1305 +                   p[5] = p5;
1306                     newret = CONFREJ;
1307                     break;
1308                 }
1309
1310 -               /* rebuild the opts */
1311 -               MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1312 -               if (newret == CONFACK) {
1313 -                   u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1314 -                   int mtu;
1315 -
1316 -                   BCOPY(p, opt_buf, CILEN_MPPE);
1317 -                   BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1318 -                         MPPE_MAX_KEY_LEN);
1319 -                   if (ccp_test(f->unit, opt_buf,
1320 -                                CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1321 -                       /* This shouldn't happen, we've already tested it! */
1322 -                       error("MPPE required, but kernel has no support.");
1323 -                       lcp_close(f->unit, "MPPE required but not available");
1324 -                       newret = CONFREJ;
1325 -                       break;
1326 -                   }
1327 -                   /*
1328 -                    * We need to decrease the interface MTU by MPPE_PAD
1329 -                    * because MPPE frames **grow**.  The kernel [must]
1330 -                    * allocate MPPE_PAD extra bytes in xmit buffers.
1331 -                    */
1332 -                   mtu = netif_get_mtu(f->unit);
1333 -                   if (mtu)
1334 -                       netif_set_mtu(f->unit, mtu - MPPE_PAD);
1335 -                   else
1336 -                       newret = CONFREJ;
1337 -               }
1338 +               /*
1339 +                * I have commented the code below because according to RFC1547
1340 +                * MTU is only information for higher level protocols about
1341 +                * "the maximum allowable length for a packet (q.v.) transmitted
1342 +                * over a point-to-point link without incurring network layer
1343 +                * fragmentation." Of course a PPP implementation should be able
1344 +                * to handle overhead added by MPPE - in our case apropriate code
1345 +                * is located in drivers/net/ppp_generic.c in the kernel sources.
1346 +                *
1347 +                * According to RFC1661:
1348 +                * - when negotiated MRU is less than 1500 octets, a PPP
1349 +                *   implementation must still be able to receive at least 1500
1350 +                *   octets,
1351 +                * - when PFC is negotiated, a PPP implementation is still
1352 +                *   required to receive frames with uncompressed protocol field.
1353 +                *
1354 +                * So why not to handle MPPE overhead without changing MTU value?
1355 +                * I am sure that RFC3078, unfortunately silently, assumes that.
1356 +                */
1357
1358                 /*
1359 -                * We have accepted MPPE or are willing to negotiate
1360 -                * MPPE parameters.  A CONFREJ is due to subsequent
1361 -                * (non-MPPE) processing.
1362 +                * We need to decrease the interface MTU by MPPE_PAD
1363 +                * because MPPE frames **grow**.  The kernel [must]
1364 +                * allocate MPPE_PAD extra bytes in xmit buffers.
1365                  */
1366 -               rej_for_ci_mppe = 0;
1367 +/*
1368 +               mtu = netif_get_mtu(f->unit);
1369 +               if (mtu) {
1370 +                   netif_set_mtu(f->unit, mtu - MPPE_PAD);
1371 +               } else {
1372 +                   newret = CONFREJ;
1373 +                   if (ccp_wantoptions[f->unit].mppe) {
1374 +                       error("Cannot adjust MTU needed by MPPE.");
1375 +                       lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1376 +                   }
1377 +               }
1378 +*/
1379                 break;
1380  #endif /* MPPE */
1381 +
1382 +           case CI_LZS:
1383 +               if (!ao->lzs || clen != CILEN_LZS) {
1384 +                   newret = CONFREJ;
1385 +                   break;
1386 +               }
1387 +
1388 +               ho->lzs = 1;
1389 +               ho->lzs_hists = (p[2] << 8) | p[3];
1390 +               ho->lzs_mode = p[4];
1391 +               if ((ho->lzs_hists != ao->lzs_hists) ||
1392 +                   (ho->lzs_mode != ao->lzs_mode)) {
1393 +                   newret = CONFNAK;
1394 +                   if (!dont_nak) {
1395 +                       p[2] = ao->lzs_hists >> 8;
1396 +                       p[3] = ao->lzs_hists & 0xff;
1397 +                       p[4] = ao->lzs_mode;
1398 +                   } else
1399 +                       break;
1400 +               }
1401 +
1402 +               if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1403 +                   newret = CONFREJ;
1404 +               }
1405 +               break;
1406 +
1407             case CI_DEFLATE:
1408             case CI_DEFLATE_DRAFT:
1409                 if (!ao->deflate || clen != CILEN_DEFLATE
1410 @@ -1340,12 +1832,6 @@
1411         else
1412             *lenp = retp - p0;
1413      }
1414 -#ifdef MPPE
1415 -    if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1416 -       error("MPPE required but peer negotiation failed");
1417 -       lcp_close(f->unit, "MPPE required but peer negotiation failed");
1418 -    }
1419 -#endif
1420      return ret;
1421  }
1422
1423 @@ -1367,24 +1853,35 @@
1424         char *p = result;
1425         char *q = result + sizeof(result); /* 1 past result */
1426
1427 -       slprintf(p, q - p, "MPPE ");
1428 -       p += 5;
1429 -       if (opt->mppe & MPPE_OPT_128) {
1430 -           slprintf(p, q - p, "128-bit ");
1431 -           p += 8;
1432 -       }
1433 -       if (opt->mppe & MPPE_OPT_40) {
1434 -           slprintf(p, q - p, "40-bit ");
1435 -           p += 7;
1436 -       }
1437 -       if (opt->mppe & MPPE_OPT_STATEFUL)
1438 -           slprintf(p, q - p, "stateful");
1439 -       else
1440 -           slprintf(p, q - p, "stateless");
1441 -
1442 +       if (opt->mppe) {
1443 +           if (opt->mppc) {
1444 +               slprintf(p, q - p, "MPPC/MPPE ");
1445 +               p += 10;
1446 +           } else {
1447 +               slprintf(p, q - p, "MPPE ");
1448 +               p += 5;
1449 +           }
1450 +           if (opt->mppe_128) {
1451 +               slprintf(p, q - p, "128-bit ");
1452 +               p += 8;
1453 +           } else if (opt->mppe_56) {
1454 +               slprintf(p, q - p, "56-bit ");
1455 +               p += 7;
1456 +           } else if (opt->mppe_40) {
1457 +               slprintf(p, q - p, "40-bit ");
1458 +               p += 7;
1459 +           }
1460 +           if (opt->mppe_stateless)
1461 +               slprintf(p, q - p, "stateless");
1462 +           else
1463 +               slprintf(p, q - p, "stateful");
1464 +       } else if (opt->mppc)
1465 +           slprintf(p, q - p, "MPPC");
1466         break;
1467      }
1468 -#endif
1469 +#endif /* MPPE */
1470 +    case CI_LZS:
1471 +       return "Stac LZS";
1472      case CI_DEFLATE:
1473      case CI_DEFLATE_DRAFT:
1474         if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1475 @@ -1440,12 +1937,12 @@
1476      } else if (ANY_COMPRESS(*ho))
1477         notice("%s transmit compression enabled", method_name(ho, NULL));
1478  #ifdef MPPE
1479 -    if (go->mppe) {
1480 +    if (go->mppe || go->mppc) {
1481         BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1482         BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1483         continue_networks(f->unit);             /* Bring up IP et al */
1484      }
1485 -#endif
1486 +#endif /* MPPE */
1487  }
1488
1489  /*
1490 @@ -1468,7 +1965,7 @@
1491             lcp_close(f->unit, "MPPE disabled");
1492         }
1493      }
1494 -#endif
1495 +#endif /* MPPE */
1496  }
1497
1498  /*
1499 @@ -1528,24 +2025,28 @@
1500  #ifdef MPPE
1501             case CI_MPPE:
1502                 if (optlen >= CILEN_MPPE) {
1503 -                   u_char mppe_opts;
1504 -
1505 -                   MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1506 -                   printer(arg, "mppe %s %s %s %s %s %s%s",
1507 -                           (p[2] & MPPE_H_BIT)? "+H": "-H",
1508 -                           (p[5] & MPPE_M_BIT)? "+M": "-M",
1509 -                           (p[5] & MPPE_S_BIT)? "+S": "-S",
1510 -                           (p[5] & MPPE_L_BIT)? "+L": "-L",
1511 +                   printer(arg, "mppe %s %s %s %s %s %s",
1512 +                           (p[2] & MPPE_STATELESS)? "+H": "-H",
1513 +                           (p[5] & MPPE_56BIT)? "+M": "-M",
1514 +                           (p[5] & MPPE_128BIT)? "+S": "-S",
1515 +                           (p[5] & MPPE_40BIT)? "+L": "-L",
1516                             (p[5] & MPPE_D_BIT)? "+D": "-D",
1517 -                           (p[5] & MPPE_C_BIT)? "+C": "-C",
1518 -                           (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1519 -                   if (mppe_opts & MPPE_OPT_UNKNOWN)
1520 +                           (p[5] & MPPE_MPPC)? "+C": "-C");
1521 +                   if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1522 +                                 MPPE_D_BIT | MPPE_MPPC)) ||
1523 +                       (p[2] & ~MPPE_STATELESS))
1524                         printer(arg, " (%.2x %.2x %.2x %.2x)",
1525                                 p[2], p[3], p[4], p[5]);
1526                     p += CILEN_MPPE;
1527                 }
1528                 break;
1529 -#endif
1530 +#endif /* MPPE */
1531 +           case CI_LZS:
1532 +               if (optlen >= CILEN_LZS) {
1533 +                   printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1534 +                   p += CILEN_LZS;
1535 +               }
1536 +               break;
1537             case CI_DEFLATE:
1538             case CI_DEFLATE_DRAFT:
1539                 if (optlen >= CILEN_DEFLATE) {
1540 @@ -1631,6 +2132,7 @@
1541             error("Lost compression sync: disabling compression");
1542             ccp_close(unit, "Lost compression sync");
1543  #ifdef MPPE
1544 +           /* My module dosn't need this. J.D., 2003-07-06 */
1545             /*
1546              * If we were doing MPPE, we must also take the link down.
1547              */
1548 @@ -1638,9 +2140,18 @@
1549                 error("Too many MPPE errors, closing LCP");
1550                 lcp_close(unit, "Too many MPPE errors");
1551             }
1552 -#endif
1553 +#endif /* MPPE */
1554         } else {
1555             /*
1556 +            * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1557 +            * and don't wait for CCP_RESETACK
1558 +            */
1559 +           if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1560 +               (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1561 +               fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1562 +               return;
1563 +           }
1564 +           /*
1565              * Send a reset-request to reset the peer's compressor.
1566              * We don't do that if we are still waiting for an
1567              * acknowledgement to a previous reset-request.
1568 @@ -1671,4 +2182,3 @@
1569      } else
1570         ccp_localstate[f->unit] &= ~RACK_PENDING;
1571  }
1572 -
1573 diff -ruN ppp-2.4.3-orig/pppd/ccp.h ppp-2.4.3-3/pppd/ccp.h
1574 --- ppp-2.4.3-orig/pppd/ccp.h   2004-11-04 11:02:26.000000000 +0100
1575 +++ ppp-2.4.3-3/pppd/ccp.h      2004-12-05 17:51:27.000000000 +0100
1576 @@ -37,9 +37,17 @@
1577      bool predictor_2;          /* do Predictor-2? */
1578      bool deflate_correct;      /* use correct code for deflate? */
1579      bool deflate_draft;                /* use draft RFC code for deflate? */
1580 +    bool lzs;                  /* do Stac LZS? */
1581 +    bool mppc;                 /* do MPPC? */
1582      bool mppe;                 /* do MPPE? */
1583 +    bool mppe_40;              /* allow 40 bit encryption? */
1584 +    bool mppe_56;              /* allow 56 bit encryption? */
1585 +    bool mppe_128;             /* allow 128 bit encryption? */
1586 +    bool mppe_stateless;       /* allow stateless encryption */
1587      u_short bsd_bits;          /* # bits/code for BSD Compress */
1588      u_short deflate_size;      /* lg(window size) for Deflate */
1589 +    u_short lzs_mode;          /* LZS check mode */
1590 +    u_short lzs_hists;         /* number of LZS histories */
1591      short method;              /* code for chosen compression method */
1592  } ccp_options;
1593
1594 diff -ruN ppp-2.4.3-orig/pppd/chap_ms.c ppp-2.4.3-3/pppd/chap_ms.c
1595 --- ppp-2.4.3-orig/pppd/chap_ms.c       2004-11-12 10:57:43.000000000 +0100
1596 +++ ppp-2.4.3-3/pppd/chap_ms.c  2004-12-05 17:51:27.000000000 +0100
1597 @@ -895,13 +895,17 @@
1598      /*
1599       * Disable undesirable encryption types.  Note that we don't ENABLE
1600       * any encryption types, to avoid overriding manual configuration.
1601 +     *
1602 +     * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1603       */
1604      switch(types) {
1605         case MPPE_ENC_TYPES_RC4_40:
1606 -           ccp_wantoptions[0].mppe &= ~MPPE_OPT_128;   /* disable 128-bit */
1607 +           ccp_wantoptions[0].mppe_128 = 0;    /* disable 128-bit */
1608 +           ccp_wantoptions[0].mppe_56 = 0;     /* disable 56-bit */
1609             break;
1610         case MPPE_ENC_TYPES_RC4_128:
1611 -           ccp_wantoptions[0].mppe &= ~MPPE_OPT_40;    /* disable 40-bit */
1612 +           ccp_wantoptions[0].mppe_56 = 0;     /* disable 56-bit */
1613 +           ccp_wantoptions[0].mppe_40 = 0;     /* disable 40-bit */
1614             break;
1615         default:
1616             break;
1617 diff -ruN ppp-2.4.3-orig/pppd/plugins/Makefile.linux ppp-2.4.3-3/pppd/plugins/Makefile.linux
1618 --- ppp-2.4.3-orig/pppd/plugins/Makefile.linux  2004-11-14 08:57:35.000000000 +0100
1619 +++ ppp-2.4.3-3/pppd/plugins/Makefile.linux     2004-12-05 17:03:59.000000000 +0100
1620 @@ -9,7 +9,7 @@
1621  MANDIR = $(DESTDIR)/share/man/man8
1622  LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION)
1623
1624 -SUBDIRS := rp-pppoe pppoatm radius
1625 +SUBDIRS := rp-pppoe radius
1626  # Uncomment the next line to include the radius authentication plugin
1627  # SUBDIRS += radius
1628  PLUGINS := minconn.so passprompt.so passwordfd.so winbind.so
1629 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/Makefile.linux ppp-2.4.3-3/pppd/plugins/radius/Makefile.linux
1630 --- ppp-2.4.3-orig/pppd/plugins/radius/Makefile.linux   2004-11-14 08:02:31.000000000 +0100
1631 +++ ppp-2.4.3-3/pppd/plugins/radius/Makefile.linux      2004-12-05 17:43:17.000000000 +0100
1632 @@ -12,7 +12,8 @@
1633  INSTALL        = install
1634
1635  PLUGIN=radius.so radattr.so radrealms.so
1636 -CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
1637 +COPTS = -O2
1638 +CFLAGS=-I. -I../.. -I../../../include $(COPTS) -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
1639
1640  # Uncomment the next line to include support for Microsoft's
1641  # MS-CHAP authentication protocol.
1642 @@ -36,9 +37,9 @@
1643
1644  install: all
1645         $(INSTALL) -d -m 755 $(LIBDIR)
1646 -       $(INSTALL) -s -c -m 755 radius.so $(LIBDIR)
1647 -       $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR)
1648 -       $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR)
1649 +       $(INSTALL) -c -m 755 radius.so $(LIBDIR)
1650 +       $(INSTALL) -c -m 755 radattr.so $(LIBDIR)
1651 +       $(INSTALL) -c -m 755 radrealms.so $(LIBDIR)
1652         $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR)
1653         $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR)
1654
1655 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/config.c ppp-2.4.3-3/pppd/plugins/radius/config.c
1656 --- ppp-2.4.3-orig/pppd/plugins/radius/config.c 2004-11-14 08:26:26.000000000 +0100
1657 +++ ppp-2.4.3-3/pppd/plugins/radius/config.c    2004-12-16 04:03:46.000000000 +0100
1658 @@ -369,31 +369,37 @@
1659         }
1660  #endif
1661
1662 +#if 0
1663         if (rc_conf_int("login_tries") <= 0)
1664         {
1665                 error("%s: login_tries <= 0 is illegal", filename);
1666                 return (-1);
1667         }
1668 +#endif
1669         if (rc_conf_str("seqfile") == NULL)
1670         {
1671                 error("%s: seqfile not specified", filename);
1672                 return (-1);
1673         }
1674 +#if 0
1675         if (rc_conf_int("login_timeout") <= 0)
1676         {
1677                 error("%s: login_timeout <= 0 is illegal", filename);
1678                 return (-1);
1679         }
1680 +#endif
1681         if (rc_conf_str("mapfile") == NULL)
1682         {
1683                 error("%s: mapfile not specified", filename);
1684                 return (-1);
1685         }
1686 +#if 0
1687         if (rc_conf_str("nologin") == NULL)
1688         {
1689                 error("%s: nologin not specified", filename);
1690                 return (-1);
1691         }
1692 +#endif
1693
1694         return 0;
1695  }
1696 diff -ruN ppp-2.4.3-orig/pppd/plugins/radius/options.h ppp-2.4.3-3/pppd/plugins/radius/options.h
1697 --- ppp-2.4.3-orig/pppd/plugins/radius/options.h        2004-11-14 08:26:26.000000000 +0100
1698 +++ ppp-2.4.3-3/pppd/plugins/radius/options.h   2004-12-16 04:09:16.000000000 +0100
1699 @@ -31,24 +31,21 @@
1700  static SERVER acctserver = {0};
1701  static SERVER authserver = {0};
1702
1703 -int default_tries = 4;
1704 -int default_timeout = 60;
1705 -
1706  static OPTION config_options[] = {
1707  /* internally used options */
1708  {"config_file",                OT_STR, ST_UNDEF, NULL},
1709  /* General options */
1710  {"auth_order",         OT_AUO, ST_UNDEF, NULL},
1711 -{"login_tries",                OT_INT, ST_UNDEF, &default_tries},
1712 -{"login_timeout",      OT_INT, ST_UNDEF, &default_timeout},
1713 -{"nologin",            OT_STR, ST_UNDEF, "/etc/nologin"},
1714 -{"issue",              OT_STR, ST_UNDEF, "/etc/radiusclient/issue"},
1715 +{"login_tries",                OT_INT, ST_UNDEF, NULL},
1716 +{"login_timeout",      OT_INT, ST_UNDEF, NULL},
1717 +{"nologin",            OT_STR, ST_UNDEF, NULL},
1718 +{"issue",              OT_STR, ST_UNDEF, NULL},
1719  /* RADIUS specific options */
1720  {"authserver",         OT_SRV, ST_UNDEF, &authserver},
1721  {"acctserver",         OT_SRV, ST_UNDEF, &acctserver},
1722  {"servers",            OT_STR, ST_UNDEF, NULL},
1723  {"dictionary",         OT_STR, ST_UNDEF, NULL},
1724 -{"login_radius",       OT_STR, ST_UNDEF, "/usr/sbin/login.radius"},
1725 +{"login_radius",       OT_STR, ST_UNDEF, NULL},
1726  {"seqfile",            OT_STR, ST_UNDEF, NULL},
1727  {"mapfile",            OT_STR, ST_UNDEF, NULL},
1728  {"default_realm",      OT_STR, ST_UNDEF, NULL},
1729 diff -ruN ppp-2.4.3-orig/pppd/plugins/rp-pppoe/Makefile.linux ppp-2.4.3-3/pppd/plugins/rp-pppoe/Makefile.linux
1730 --- ppp-2.4.3-orig/pppd/plugins/rp-pppoe/Makefile.linux 2004-11-14 08:58:37.000000000 +0100
1731 +++ ppp-2.4.3-3/pppd/plugins/rp-pppoe/Makefile.linux    2004-12-05 17:43:23.000000000 +0100
1732 @@ -39,9 +39,9 @@
1733
1734  install: all
1735         $(INSTALL) -d -m 755 $(LIBDIR)
1736 -       $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR)
1737 +       $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR)
1738         $(INSTALL) -d -m 755 $(BINDIR)
1739 -       $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR)
1740 +       $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR)
1741
1742  clean:
1743         rm -f *.o *.so
1744 diff -ruN ppp-2.4.3-orig/pppd/plugins/rp-pppoe/plugin.c ppp-2.4.3-3/pppd/plugins/rp-pppoe/plugin.c
1745 --- ppp-2.4.3-orig/pppd/plugins/rp-pppoe/plugin.c       2004-11-04 11:07:37.000000000 +0100
1746 +++ ppp-2.4.3-3/pppd/plugins/rp-pppoe/plugin.c  2004-12-16 01:07:22.000000000 +0100
1747 @@ -286,7 +286,7 @@
1748         /* Strip off "nic-" */
1749         cmd += 4;
1750      } else if (strlen(cmd) < 4
1751 -              || (strncmp(cmd, "eth", 3) && strncmp(cmd, "nas", 3)
1752 +              || (strncmp(cmd, "eth", 3) && strncmp(cmd, "nas", 3) && strncmp(cmd, "vlan", 4)
1753                    && strncmp(cmd, "tap", 3) && strncmp(cmd, "br", 2))) {
1754         return 0;
1755      }
1756 diff -ruN ppp-2.4.3-orig/pppd/pppd.8 ppp-2.4.3-3/pppd/pppd.8
1757 --- ppp-2.4.3-orig/pppd/pppd.8  2004-11-13 13:22:49.000000000 +0100
1758 +++ ppp-2.4.3-3/pppd/pppd.8     2004-12-05 17:51:27.000000000 +0100
1759 @@ -622,9 +622,29 @@
1760  Enables the use of PPP multilink; this is an alias for the `multilink'
1761  option.  This option is currently only available under Linux.
1762  .TP
1763 -.B mppe\-stateful
1764 -Allow MPPE to use stateful mode.  Stateless mode is still attempted first.
1765 -The default is to disallow stateful mode.
1766 +.B mppc
1767 +Enables MPPC (Microsoft Point to Point Compression).  This is the default.
1768 +.TP
1769 +.B mppe \fIsubopt1[,subopt2[,subopt3[..]]]
1770 +Modify MPPE (Microsoft Point to Point Encryption) parameters. In order
1771 +for MPPE to successfully come up, you must have authenticated with either
1772 +MS-CHAP or MS-CHAPv2. By default MPPE is optional, it means that pppd will
1773 +not propose MPPE to the peer, but will negotiate MPPE if peer wants that.
1774 +You can change this using \fIrequired\fR suboption.
1775 +This option is presently only supported under Linux, and only if your
1776 +kernel has been configured to include MPPE support.
1777 +.IP
1778 +MPPE suboptions:
1779 +.br
1780 +\fIrequired\fR - require MPPE; disconnect if peer doesn't support it,
1781 +.br
1782 +\fIstateless\fR - try to negotiate stateless mode; default is stateful,
1783 +.br
1784 +\fIno40\fR - disable 40 bit keys,
1785 +.br
1786 +\fIno56\fR - disable 56 bit keys,
1787 +.br
1788 +\fIno128\fR - disable 128 bit keys
1789  .TP
1790  .B mpshortseq
1791  Enables the use of short (12-bit) sequence numbers in multilink
1792 @@ -757,17 +777,11 @@
1793  Disables the use of PPP multilink.  This option is currently only
1794  available under Linux.
1795  .TP
1796 -.B nomppe
1797 -Disables MPPE (Microsoft Point to Point Encryption).  This is the default.
1798 -.TP
1799 -.B nomppe\-40
1800 -Disable 40-bit encryption with MPPE.
1801 +.B nomppc
1802 +Disables MPPC (Microsoft Point to Point Compression).
1803  .TP
1804 -.B nomppe\-128
1805 -Disable 128-bit encryption with MPPE.
1806 -.TP
1807 -.B nomppe\-stateful
1808 -Disable MPPE stateful mode.  This is the default.
1809 +.B nomppe
1810 +Disables MPPE (Microsoft Point to Point Encryption).
1811  .TP
1812  .B nompshortseq
1813  Disables the use of short (12-bit) sequence numbers in the PPP
1814 @@ -948,19 +962,6 @@
1815  Require the peer to authenticate itself using CHAP [Challenge
1816  Handshake Authentication Protocol] authentication.
1817  .TP
1818 -.B require\-mppe
1819 -Require the use of MPPE (Microsoft Point to Point Encryption).  This
1820 -option disables all other compression types.  This option enables
1821 -both 40-bit and 128-bit encryption.  In order for MPPE to successfully
1822 -come up, you must have authenticated with either MS\-CHAP or MS\-CHAPv2.
1823 -This option is presently only supported under Linux, and only if your
1824 -kernel has been configured to include MPPE support.
1825 -.TP
1826 -.B require\-mppe\-40
1827 -Require the use of MPPE, with 40-bit encryption.
1828 -.TP
1829 -.B require\-mppe\-128
1830 -Require the use of MPPE, with 128-bit encryption.
1831  .TP
1832  .B require\-mschap
1833  Require the peer to authenticate itself using MS\-CHAP [Microsoft Challenge
1834 diff -ruN ppp-2.4.3-orig/pppdump/Makefile.linux ppp-2.4.3-3/pppdump/Makefile.linux
1835 --- ppp-2.4.3-orig/pppdump/Makefile.linux       2004-10-31 02:36:52.000000000 +0200
1836 +++ ppp-2.4.3-3/pppdump/Makefile.linux  2004-12-05 17:50:34.000000000 +0100
1837 @@ -2,7 +2,8 @@
1838  BINDIR = $(DESTDIR)/sbin
1839  MANDIR = $(DESTDIR)/share/man/man8
1840
1841 -CFLAGS= -O -I../include/net
1842 +COPTS = -O
1843 +CFLAGS= $(COPTS) -I../include/net
1844  OBJS = pppdump.o bsd-comp.o deflate.o zlib.o
1845
1846  INSTALL= install
1847 @@ -17,5 +18,5 @@
1848
1849  install:
1850         mkdir -p $(BINDIR) $(MANDIR)
1851 -       $(INSTALL) -s -c pppdump $(BINDIR)
1852 +       $(INSTALL) -c pppdump $(BINDIR)
1853         $(INSTALL) -c -m 444 pppdump.8 $(MANDIR)
1854 diff -ruN ppp-2.4.3-orig/pppstats/Makefile.linux ppp-2.4.3-3/pppstats/Makefile.linux
1855 --- ppp-2.4.3-orig/pppstats/Makefile.linux      2004-10-31 23:09:03.000000000 +0100
1856 +++ ppp-2.4.3-3/pppstats/Makefile.linux 2004-12-05 17:43:38.000000000 +0100
1857 @@ -22,7 +22,7 @@
1858
1859  install: pppstats
1860         -mkdir -p $(MANDIR)
1861 -       $(INSTALL) -s -c pppstats $(BINDIR)
1862 +       $(INSTALL) -c pppstats $(BINDIR)
1863         $(INSTALL) -c -m 444 pppstats.8 $(MANDIR)
1864
1865  pppstats: $(PPPSTATSRCS)