1af7ab184SArchie Cobbs 2af7ab184SArchie Cobbs /* 3af7ab184SArchie Cobbs * ng_mppc.c 4af7ab184SArchie Cobbs * 5af7ab184SArchie Cobbs * Copyright (c) 1996-2000 Whistle Communications, Inc. 6af7ab184SArchie Cobbs * All rights reserved. 7af7ab184SArchie Cobbs * 8af7ab184SArchie Cobbs * Subject to the following obligations and disclaimer of warranty, use and 9af7ab184SArchie Cobbs * redistribution of this software, in source or object code forms, with or 10af7ab184SArchie Cobbs * without modifications are expressly permitted by Whistle Communications; 11af7ab184SArchie Cobbs * provided, however, that: 12af7ab184SArchie Cobbs * 1. Any and all reproductions of the source or object code must include the 13af7ab184SArchie Cobbs * copyright notice above and the following disclaimer of warranties; and 14af7ab184SArchie Cobbs * 2. No rights are granted, in any manner or form, to use Whistle 15af7ab184SArchie Cobbs * Communications, Inc. trademarks, including the mark "WHISTLE 16af7ab184SArchie Cobbs * COMMUNICATIONS" on advertising, endorsements, or otherwise except as 17af7ab184SArchie Cobbs * such appears in the above copyright notice or in the software. 18af7ab184SArchie Cobbs * 19af7ab184SArchie Cobbs * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND 20af7ab184SArchie Cobbs * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO 21af7ab184SArchie Cobbs * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE, 22af7ab184SArchie Cobbs * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF 23af7ab184SArchie Cobbs * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. 24af7ab184SArchie Cobbs * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY 25af7ab184SArchie Cobbs * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS 26af7ab184SArchie Cobbs * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE. 27af7ab184SArchie Cobbs * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES 28af7ab184SArchie Cobbs * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING 29af7ab184SArchie Cobbs * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 30af7ab184SArchie Cobbs * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR 31af7ab184SArchie Cobbs * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY 32af7ab184SArchie Cobbs * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33af7ab184SArchie Cobbs * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34af7ab184SArchie Cobbs * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY 35af7ab184SArchie Cobbs * OF SUCH DAMAGE. 36af7ab184SArchie Cobbs * 37cc3bbd68SJulian Elischer * Author: Archie Cobbs <archie@freebsd.org> 38af7ab184SArchie Cobbs * 39af7ab184SArchie Cobbs * $Whistle: ng_mppc.c,v 1.4 1999/11/25 00:10:12 archie Exp $ 40af7ab184SArchie Cobbs * $FreeBSD$ 41af7ab184SArchie Cobbs */ 42af7ab184SArchie Cobbs 43af7ab184SArchie Cobbs /* 44af7ab184SArchie Cobbs * Microsoft PPP compression (MPPC) and encryption (MPPE) netgraph node type. 45af7ab184SArchie Cobbs * 46af7ab184SArchie Cobbs * You must define one or both of the NETGRAPH_MPPC_COMPRESSION and/or 47af7ab184SArchie Cobbs * NETGRAPH_MPPC_ENCRYPTION options for this node type to be useful. 48af7ab184SArchie Cobbs */ 49af7ab184SArchie Cobbs 50af7ab184SArchie Cobbs #include <sys/param.h> 51af7ab184SArchie Cobbs #include <sys/systm.h> 52af7ab184SArchie Cobbs #include <sys/kernel.h> 53af7ab184SArchie Cobbs #include <sys/mbuf.h> 54af7ab184SArchie Cobbs #include <sys/malloc.h> 55af7ab184SArchie Cobbs #include <sys/errno.h> 56af7ab184SArchie Cobbs #include <sys/syslog.h> 57af7ab184SArchie Cobbs 58af7ab184SArchie Cobbs #include <netgraph/ng_message.h> 59af7ab184SArchie Cobbs #include <netgraph/netgraph.h> 60af7ab184SArchie Cobbs #include <netgraph/ng_mppc.h> 61af7ab184SArchie Cobbs 62af7ab184SArchie Cobbs #include "opt_netgraph.h" 63af7ab184SArchie Cobbs 64af7ab184SArchie Cobbs #if !defined(NETGRAPH_MPPC_COMPRESSION) && !defined(NETGRAPH_MPPC_ENCRYPTION) 65af7ab184SArchie Cobbs #error Need either NETGRAPH_MPPC_COMPRESSION or NETGRAPH_MPPC_ENCRYPTION 66af7ab184SArchie Cobbs #endif 67af7ab184SArchie Cobbs 68af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 69af7ab184SArchie Cobbs /* XXX this file doesn't exist yet, but hopefully someday it will... */ 70af7ab184SArchie Cobbs #include <net/mppc.h> 71af7ab184SArchie Cobbs #endif 72af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 73af7ab184SArchie Cobbs #include <crypto/rc4/rc4.h> 74af7ab184SArchie Cobbs #endif 75af7ab184SArchie Cobbs #include <crypto/sha1.h> 76af7ab184SArchie Cobbs 77af7ab184SArchie Cobbs /* Decompression blowup */ 78af7ab184SArchie Cobbs #define MPPC_DECOMP_BUFSIZE 8092 /* allocate buffer this big */ 79af7ab184SArchie Cobbs #define MPPC_DECOMP_SAFETY 100 /* plus this much margin */ 80af7ab184SArchie Cobbs 81af7ab184SArchie Cobbs /* MPPC/MPPE header length */ 82af7ab184SArchie Cobbs #define MPPC_HDRLEN 2 83af7ab184SArchie Cobbs 84af7ab184SArchie Cobbs /* Key length */ 85af7ab184SArchie Cobbs #define KEYLEN(b) (((b) & MPPE_128) ? 16 : 8) 86af7ab184SArchie Cobbs 87af7ab184SArchie Cobbs /* What sequence number jump is too far */ 88af7ab184SArchie Cobbs #define MPPC_INSANE_JUMP 256 89af7ab184SArchie Cobbs 90af7ab184SArchie Cobbs /* MPPC packet header bits */ 91af7ab184SArchie Cobbs #define MPPC_FLAG_FLUSHED 0x8000 /* xmitter reset state */ 92af7ab184SArchie Cobbs #define MPPC_FLAG_RESTART 0x4000 /* compress history restart */ 93af7ab184SArchie Cobbs #define MPPC_FLAG_COMPRESSED 0x2000 /* packet is compresed */ 94af7ab184SArchie Cobbs #define MPPC_FLAG_ENCRYPTED 0x1000 /* packet is encrypted */ 95af7ab184SArchie Cobbs #define MPPC_CCOUNT_MASK 0x0fff /* sequence number mask */ 96af7ab184SArchie Cobbs 97af7ab184SArchie Cobbs #define MPPE_UPDATE_MASK 0xff /* coherency count when we're */ 98af7ab184SArchie Cobbs #define MPPE_UPDATE_FLAG 0xff /* supposed to update key */ 99af7ab184SArchie Cobbs 100af7ab184SArchie Cobbs #define MPPC_COMP_OK 0x05 101af7ab184SArchie Cobbs #define MPPC_DECOMP_OK 0x05 102af7ab184SArchie Cobbs 103af7ab184SArchie Cobbs /* Per direction info */ 104af7ab184SArchie Cobbs struct ng_mppc_dir { 105af7ab184SArchie Cobbs struct ng_mppc_config cfg; /* configuration */ 106af7ab184SArchie Cobbs hook_p hook; /* netgraph hook */ 107af7ab184SArchie Cobbs u_int16_t cc:12; /* coherency count */ 108af7ab184SArchie Cobbs u_char flushed; /* clean history (xmit only) */ 109af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 110af7ab184SArchie Cobbs u_char *history; /* compression history */ 111af7ab184SArchie Cobbs #endif 112af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 113af7ab184SArchie Cobbs u_char key[MPPE_KEY_LEN]; /* session key */ 114af7ab184SArchie Cobbs struct rc4_state rc4; /* rc4 state */ 115af7ab184SArchie Cobbs #endif 116af7ab184SArchie Cobbs }; 117af7ab184SArchie Cobbs 118af7ab184SArchie Cobbs /* Node private data */ 119af7ab184SArchie Cobbs struct ng_mppc_private { 120af7ab184SArchie Cobbs struct ng_mppc_dir xmit; /* compress/encrypt config */ 121af7ab184SArchie Cobbs struct ng_mppc_dir recv; /* decompress/decrypt config */ 122af7ab184SArchie Cobbs char *ctrlpath; /* path to controlling node */ 123af7ab184SArchie Cobbs }; 124af7ab184SArchie Cobbs typedef struct ng_mppc_private *priv_p; 125af7ab184SArchie Cobbs 126af7ab184SArchie Cobbs /* Netgraph node methods */ 127af7ab184SArchie Cobbs static ng_constructor_t ng_mppc_constructor; 128af7ab184SArchie Cobbs static ng_rcvmsg_t ng_mppc_rcvmsg; 129af7ab184SArchie Cobbs static ng_shutdown_t ng_mppc_rmnode; 130af7ab184SArchie Cobbs static ng_newhook_t ng_mppc_newhook; 131af7ab184SArchie Cobbs static ng_rcvdata_t ng_mppc_rcvdata; 132af7ab184SArchie Cobbs static ng_disconnect_t ng_mppc_disconnect; 133af7ab184SArchie Cobbs 134af7ab184SArchie Cobbs /* Helper functions */ 135af7ab184SArchie Cobbs static int ng_mppc_compress(node_p node, 136af7ab184SArchie Cobbs struct mbuf *m, struct mbuf **resultp); 137af7ab184SArchie Cobbs static int ng_mppc_decompress(node_p node, 138af7ab184SArchie Cobbs struct mbuf *m, struct mbuf **resultp); 139af7ab184SArchie Cobbs static void ng_mppc_getkey(const u_char *h, u_char *h2, int len); 140af7ab184SArchie Cobbs static void ng_mppc_updatekey(u_int32_t bits, 141af7ab184SArchie Cobbs u_char *key0, u_char *key, struct rc4_state *rc4); 142af7ab184SArchie Cobbs static void ng_mppc_reset_req(node_p node); 143af7ab184SArchie Cobbs 144af7ab184SArchie Cobbs /* Node type descriptor */ 145af7ab184SArchie Cobbs static struct ng_type ng_mppc_typestruct = { 146af7ab184SArchie Cobbs NG_VERSION, 147af7ab184SArchie Cobbs NG_MPPC_NODE_TYPE, 148af7ab184SArchie Cobbs NULL, 149af7ab184SArchie Cobbs ng_mppc_constructor, 150af7ab184SArchie Cobbs ng_mppc_rcvmsg, 151af7ab184SArchie Cobbs ng_mppc_rmnode, 152af7ab184SArchie Cobbs ng_mppc_newhook, 153af7ab184SArchie Cobbs NULL, 154af7ab184SArchie Cobbs NULL, 155af7ab184SArchie Cobbs ng_mppc_rcvdata, 156af7ab184SArchie Cobbs ng_mppc_rcvdata, 157af7ab184SArchie Cobbs ng_mppc_disconnect, 158af7ab184SArchie Cobbs NULL 159af7ab184SArchie Cobbs }; 160af7ab184SArchie Cobbs NETGRAPH_INIT(mppc, &ng_mppc_typestruct); 161af7ab184SArchie Cobbs 162af7ab184SArchie Cobbs /* Fixed bit pattern to weaken keysize down to 40 bits */ 163af7ab184SArchie Cobbs static const u_char ng_mppe_weakenkey[3] = { 0xd1, 0x26, 0x9e }; 164af7ab184SArchie Cobbs 165af7ab184SArchie Cobbs #define ERROUT(x) do { error = (x); goto done; } while (0) 166af7ab184SArchie Cobbs 167af7ab184SArchie Cobbs /************************************************************************ 168af7ab184SArchie Cobbs NETGRAPH NODE STUFF 169af7ab184SArchie Cobbs ************************************************************************/ 170af7ab184SArchie Cobbs 171af7ab184SArchie Cobbs /* 172af7ab184SArchie Cobbs * Node type constructor 173af7ab184SArchie Cobbs */ 174af7ab184SArchie Cobbs static int 175af7ab184SArchie Cobbs ng_mppc_constructor(node_p *nodep) 176af7ab184SArchie Cobbs { 177af7ab184SArchie Cobbs priv_p priv; 178af7ab184SArchie Cobbs int error; 179af7ab184SArchie Cobbs 180af7ab184SArchie Cobbs /* Allocate private structure */ 18165b9a0daSArchie Cobbs MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH, M_NOWAIT); 182af7ab184SArchie Cobbs if (priv == NULL) 183af7ab184SArchie Cobbs return (ENOMEM); 184af7ab184SArchie Cobbs bzero(priv, sizeof(*priv)); 185af7ab184SArchie Cobbs 186af7ab184SArchie Cobbs /* Call generic node constructor */ 187af7ab184SArchie Cobbs if ((error = ng_make_node_common(&ng_mppc_typestruct, nodep))) { 188af7ab184SArchie Cobbs FREE(priv, M_NETGRAPH); 189af7ab184SArchie Cobbs return (error); 190af7ab184SArchie Cobbs } 191af7ab184SArchie Cobbs (*nodep)->private = priv; 192af7ab184SArchie Cobbs 193af7ab184SArchie Cobbs /* Done */ 194af7ab184SArchie Cobbs return (0); 195af7ab184SArchie Cobbs } 196af7ab184SArchie Cobbs 197af7ab184SArchie Cobbs /* 198af7ab184SArchie Cobbs * Give our OK for a hook to be added 199af7ab184SArchie Cobbs */ 200af7ab184SArchie Cobbs static int 201af7ab184SArchie Cobbs ng_mppc_newhook(node_p node, hook_p hook, const char *name) 202af7ab184SArchie Cobbs { 203af7ab184SArchie Cobbs const priv_p priv = node->private; 204af7ab184SArchie Cobbs hook_p *hookPtr; 205af7ab184SArchie Cobbs 206af7ab184SArchie Cobbs /* Check hook name */ 207af7ab184SArchie Cobbs if (strcmp(name, NG_MPPC_HOOK_COMP) == 0) 208af7ab184SArchie Cobbs hookPtr = &priv->xmit.hook; 209af7ab184SArchie Cobbs else if (strcmp(name, NG_MPPC_HOOK_DECOMP) == 0) 210af7ab184SArchie Cobbs hookPtr = &priv->recv.hook; 211af7ab184SArchie Cobbs else 212af7ab184SArchie Cobbs return (EINVAL); 213af7ab184SArchie Cobbs 214af7ab184SArchie Cobbs /* See if already connected */ 215af7ab184SArchie Cobbs if (*hookPtr != NULL) 216af7ab184SArchie Cobbs return (EISCONN); 217af7ab184SArchie Cobbs 218af7ab184SArchie Cobbs /* OK */ 219af7ab184SArchie Cobbs *hookPtr = hook; 220af7ab184SArchie Cobbs return (0); 221af7ab184SArchie Cobbs } 222af7ab184SArchie Cobbs 223af7ab184SArchie Cobbs /* 224af7ab184SArchie Cobbs * Receive a control message 225af7ab184SArchie Cobbs */ 226af7ab184SArchie Cobbs static int 227af7ab184SArchie Cobbs ng_mppc_rcvmsg(node_p node, struct ng_mesg *msg, 228a4ec03cfSJulian Elischer const char *raddr, struct ng_mesg **rptr, hook_p lasthook) 229af7ab184SArchie Cobbs { 230af7ab184SArchie Cobbs const priv_p priv = node->private; 231af7ab184SArchie Cobbs struct ng_mesg *resp = NULL; 232af7ab184SArchie Cobbs int error = 0; 233af7ab184SArchie Cobbs 234af7ab184SArchie Cobbs switch (msg->header.typecookie) { 235af7ab184SArchie Cobbs case NGM_MPPC_COOKIE: 236af7ab184SArchie Cobbs switch (msg->header.cmd) { 237af7ab184SArchie Cobbs case NGM_MPPC_CONFIG_COMP: 238af7ab184SArchie Cobbs case NGM_MPPC_CONFIG_DECOMP: 239af7ab184SArchie Cobbs { 240af7ab184SArchie Cobbs struct ng_mppc_config *const cfg 241af7ab184SArchie Cobbs = (struct ng_mppc_config *)msg->data; 242af7ab184SArchie Cobbs const int isComp = 243af7ab184SArchie Cobbs msg->header.cmd == NGM_MPPC_CONFIG_COMP; 244af7ab184SArchie Cobbs struct ng_mppc_dir *const d = isComp ? 245af7ab184SArchie Cobbs &priv->xmit : &priv->recv; 246af7ab184SArchie Cobbs 247af7ab184SArchie Cobbs /* Check configuration */ 248af7ab184SArchie Cobbs if (msg->header.arglen != sizeof(*cfg)) 249af7ab184SArchie Cobbs ERROUT(EINVAL); 250af7ab184SArchie Cobbs if (cfg->enable) { 251af7ab184SArchie Cobbs if ((cfg->bits & ~MPPC_VALID_BITS) != 0) 252af7ab184SArchie Cobbs ERROUT(EINVAL); 253af7ab184SArchie Cobbs #ifndef NETGRAPH_MPPC_COMPRESSION 254af7ab184SArchie Cobbs if ((cfg->bits & MPPC_BIT) != 0) 255af7ab184SArchie Cobbs ERROUT(EPROTONOSUPPORT); 256af7ab184SArchie Cobbs #endif 257af7ab184SArchie Cobbs #ifndef NETGRAPH_MPPC_ENCRYPTION 258af7ab184SArchie Cobbs if ((cfg->bits & MPPE_BITS) != 0) 259af7ab184SArchie Cobbs ERROUT(EPROTONOSUPPORT); 260af7ab184SArchie Cobbs #endif 261af7ab184SArchie Cobbs } else 262af7ab184SArchie Cobbs cfg->bits = 0; 263af7ab184SArchie Cobbs 264af7ab184SArchie Cobbs /* Save return address so we can send reset-req's */ 265af7ab184SArchie Cobbs if (priv->ctrlpath != NULL) { 266af7ab184SArchie Cobbs FREE(priv->ctrlpath, M_NETGRAPH); 267af7ab184SArchie Cobbs priv->ctrlpath = NULL; 268af7ab184SArchie Cobbs } 269af7ab184SArchie Cobbs if (!isComp && raddr != NULL) { 270af7ab184SArchie Cobbs MALLOC(priv->ctrlpath, char *, 271af7ab184SArchie Cobbs strlen(raddr) + 1, M_NETGRAPH, M_NOWAIT); 272af7ab184SArchie Cobbs if (priv->ctrlpath == NULL) 273af7ab184SArchie Cobbs ERROUT(ENOMEM); 274af7ab184SArchie Cobbs strcpy(priv->ctrlpath, raddr); 275af7ab184SArchie Cobbs } 276af7ab184SArchie Cobbs 277af7ab184SArchie Cobbs /* Configuration is OK, reset to it */ 278af7ab184SArchie Cobbs d->cfg = *cfg; 279af7ab184SArchie Cobbs 280af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 281af7ab184SArchie Cobbs /* Initialize state buffers for compression */ 282af7ab184SArchie Cobbs if (d->history != NULL) { 283af7ab184SArchie Cobbs FREE(d->history, M_NETGRAPH); 284af7ab184SArchie Cobbs d->history = NULL; 285af7ab184SArchie Cobbs } 286af7ab184SArchie Cobbs if ((cfg->bits & MPPC_BIT) != 0) { 287af7ab184SArchie Cobbs MALLOC(d->history, u_char *, 288af7ab184SArchie Cobbs isComp ? MPPC_SizeOfCompressionHistory() : 289af7ab184SArchie Cobbs MPPC_SizeOfDecompressionHistory(), 290af7ab184SArchie Cobbs M_NETGRAPH, M_NOWAIT); 291af7ab184SArchie Cobbs if (d->history == NULL) 292af7ab184SArchie Cobbs ERROUT(ENOMEM); 293af7ab184SArchie Cobbs if (isComp) 294af7ab184SArchie Cobbs MPPC_InitCompressionHistory(d->history); 295af7ab184SArchie Cobbs else { 296af7ab184SArchie Cobbs MPPC_InitDecompressionHistory( 297af7ab184SArchie Cobbs d->history); 298af7ab184SArchie Cobbs } 299af7ab184SArchie Cobbs } 300af7ab184SArchie Cobbs #endif 301af7ab184SArchie Cobbs 302af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 303af7ab184SArchie Cobbs /* Generate initial session keys for encryption */ 304af7ab184SArchie Cobbs if ((cfg->bits & MPPE_BITS) != 0) { 305af7ab184SArchie Cobbs const int keylen = KEYLEN(cfg->bits); 306af7ab184SArchie Cobbs 307af7ab184SArchie Cobbs bcopy(cfg->startkey, d->key, keylen); 308af7ab184SArchie Cobbs ng_mppc_getkey(cfg->startkey, d->key, keylen); 309af7ab184SArchie Cobbs if ((cfg->bits & MPPE_128) == 0) { 310af7ab184SArchie Cobbs bcopy(&ng_mppe_weakenkey, d->key, 311af7ab184SArchie Cobbs sizeof(ng_mppe_weakenkey)); 312af7ab184SArchie Cobbs } 313af7ab184SArchie Cobbs rc4_init(&d->rc4, d->key, keylen); 314af7ab184SArchie Cobbs } 315af7ab184SArchie Cobbs #endif 316af7ab184SArchie Cobbs 317af7ab184SArchie Cobbs /* Initialize other state */ 318af7ab184SArchie Cobbs d->cc = 0; 319af7ab184SArchie Cobbs d->flushed = 0; 320af7ab184SArchie Cobbs break; 321af7ab184SArchie Cobbs } 322af7ab184SArchie Cobbs 323af7ab184SArchie Cobbs case NGM_MPPC_RESETREQ: 324af7ab184SArchie Cobbs ng_mppc_reset_req(node); 325af7ab184SArchie Cobbs break; 326af7ab184SArchie Cobbs 327af7ab184SArchie Cobbs default: 328af7ab184SArchie Cobbs error = EINVAL; 329af7ab184SArchie Cobbs break; 330af7ab184SArchie Cobbs } 331af7ab184SArchie Cobbs break; 332af7ab184SArchie Cobbs default: 333af7ab184SArchie Cobbs error = EINVAL; 334af7ab184SArchie Cobbs break; 335af7ab184SArchie Cobbs } 336af7ab184SArchie Cobbs if (rptr) 337af7ab184SArchie Cobbs *rptr = resp; 338af7ab184SArchie Cobbs else if (resp) 339af7ab184SArchie Cobbs FREE(resp, M_NETGRAPH); 340af7ab184SArchie Cobbs 341af7ab184SArchie Cobbs done: 342af7ab184SArchie Cobbs FREE(msg, M_NETGRAPH); 343af7ab184SArchie Cobbs return (error); 344af7ab184SArchie Cobbs } 345af7ab184SArchie Cobbs 346af7ab184SArchie Cobbs /* 347af7ab184SArchie Cobbs * Receive incoming data on our hook. 348af7ab184SArchie Cobbs */ 349af7ab184SArchie Cobbs static int 350a4ec03cfSJulian Elischer ng_mppc_rcvdata(hook_p hook, struct mbuf *m, meta_p meta, 351a4ec03cfSJulian Elischer struct mbuf **ret_m, meta_p *ret_meta) 352af7ab184SArchie Cobbs { 353af7ab184SArchie Cobbs const node_p node = hook->node; 354af7ab184SArchie Cobbs const priv_p priv = node->private; 355af7ab184SArchie Cobbs struct mbuf *out; 356af7ab184SArchie Cobbs int error; 357af7ab184SArchie Cobbs 358af7ab184SArchie Cobbs /* Compress and/or encrypt */ 359af7ab184SArchie Cobbs if (hook == priv->xmit.hook) { 360af7ab184SArchie Cobbs if (!priv->xmit.cfg.enable) { 361af7ab184SArchie Cobbs NG_FREE_DATA(m, meta); 362af7ab184SArchie Cobbs return (ENXIO); 363af7ab184SArchie Cobbs } 364af7ab184SArchie Cobbs if ((error = ng_mppc_compress(node, m, &out)) != 0) { 365af7ab184SArchie Cobbs NG_FREE_DATA(m, meta); 366af7ab184SArchie Cobbs return(error); 367af7ab184SArchie Cobbs } 368af7ab184SArchie Cobbs m_freem(m); 369af7ab184SArchie Cobbs NG_SEND_DATA(error, priv->xmit.hook, out, meta); 370af7ab184SArchie Cobbs return (error); 371af7ab184SArchie Cobbs } 372af7ab184SArchie Cobbs 373af7ab184SArchie Cobbs /* Decompress and/or decrypt */ 374af7ab184SArchie Cobbs if (hook == priv->recv.hook) { 375af7ab184SArchie Cobbs if (!priv->recv.cfg.enable) { 376af7ab184SArchie Cobbs NG_FREE_DATA(m, meta); 377af7ab184SArchie Cobbs return (ENXIO); 378af7ab184SArchie Cobbs } 379af7ab184SArchie Cobbs if ((error = ng_mppc_decompress(node, m, &out)) != 0) { 380af7ab184SArchie Cobbs NG_FREE_DATA(m, meta); 381af7ab184SArchie Cobbs if (error == EINVAL && priv->ctrlpath != NULL) { 382af7ab184SArchie Cobbs struct ng_mesg *msg; 383af7ab184SArchie Cobbs 384af7ab184SArchie Cobbs /* Need to send a reset-request */ 385af7ab184SArchie Cobbs NG_MKMESSAGE(msg, NGM_MPPC_COOKIE, 386af7ab184SArchie Cobbs NGM_MPPC_RESETREQ, 0, M_NOWAIT); 387af7ab184SArchie Cobbs if (msg == NULL) 388af7ab184SArchie Cobbs return (error); 389af7ab184SArchie Cobbs ng_send_msg(node, msg, priv->ctrlpath, NULL); 390af7ab184SArchie Cobbs } 391af7ab184SArchie Cobbs return (error); 392af7ab184SArchie Cobbs } 393af7ab184SArchie Cobbs m_freem(m); 394af7ab184SArchie Cobbs NG_SEND_DATA(error, priv->recv.hook, out, meta); 395af7ab184SArchie Cobbs return (error); 396af7ab184SArchie Cobbs } 397af7ab184SArchie Cobbs 398af7ab184SArchie Cobbs /* Oops */ 399af7ab184SArchie Cobbs panic("%s: unknown hook", __FUNCTION__); 400af7ab184SArchie Cobbs } 401af7ab184SArchie Cobbs 402af7ab184SArchie Cobbs /* 403af7ab184SArchie Cobbs * Destroy node 404af7ab184SArchie Cobbs */ 405af7ab184SArchie Cobbs static int 406af7ab184SArchie Cobbs ng_mppc_rmnode(node_p node) 407af7ab184SArchie Cobbs { 408af7ab184SArchie Cobbs const priv_p priv = node->private; 409af7ab184SArchie Cobbs 410af7ab184SArchie Cobbs /* Take down netgraph node */ 411af7ab184SArchie Cobbs node->flags |= NG_INVALID; 412af7ab184SArchie Cobbs ng_cutlinks(node); 413af7ab184SArchie Cobbs ng_unname(node); 414af7ab184SArchie Cobbs if (priv->ctrlpath != NULL) 415af7ab184SArchie Cobbs FREE(priv->ctrlpath, M_NETGRAPH); 416af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 417af7ab184SArchie Cobbs if (priv->xmit.history != NULL) 418af7ab184SArchie Cobbs FREE(priv->xmit.history, M_NETGRAPH); 419af7ab184SArchie Cobbs if (priv->recv.history != NULL) 420af7ab184SArchie Cobbs FREE(priv->recv.history, M_NETGRAPH); 421af7ab184SArchie Cobbs #endif 422af7ab184SArchie Cobbs bzero(priv, sizeof(*priv)); 423af7ab184SArchie Cobbs FREE(priv, M_NETGRAPH); 424af7ab184SArchie Cobbs node->private = NULL; 425af7ab184SArchie Cobbs ng_unref(node); /* let the node escape */ 426af7ab184SArchie Cobbs return (0); 427af7ab184SArchie Cobbs } 428af7ab184SArchie Cobbs 429af7ab184SArchie Cobbs /* 430af7ab184SArchie Cobbs * Hook disconnection 431af7ab184SArchie Cobbs */ 432af7ab184SArchie Cobbs static int 433af7ab184SArchie Cobbs ng_mppc_disconnect(hook_p hook) 434af7ab184SArchie Cobbs { 435af7ab184SArchie Cobbs const node_p node = hook->node; 436af7ab184SArchie Cobbs const priv_p priv = node->private; 437af7ab184SArchie Cobbs 438af7ab184SArchie Cobbs /* Zero out hook pointer */ 439af7ab184SArchie Cobbs if (hook == priv->xmit.hook) 440af7ab184SArchie Cobbs priv->xmit.hook = NULL; 441af7ab184SArchie Cobbs if (hook == priv->recv.hook) 442af7ab184SArchie Cobbs priv->recv.hook = NULL; 443af7ab184SArchie Cobbs 444af7ab184SArchie Cobbs /* Go away if no longer connected */ 445af7ab184SArchie Cobbs if (node->numhooks == 0) 446af7ab184SArchie Cobbs ng_rmnode(node); 447af7ab184SArchie Cobbs return (0); 448af7ab184SArchie Cobbs } 449af7ab184SArchie Cobbs 450af7ab184SArchie Cobbs /************************************************************************ 451af7ab184SArchie Cobbs HELPER STUFF 452af7ab184SArchie Cobbs ************************************************************************/ 453af7ab184SArchie Cobbs 454af7ab184SArchie Cobbs /* 455af7ab184SArchie Cobbs * Compress/encrypt a packet and put the result in a new mbuf at *resultp. 456af7ab184SArchie Cobbs * The original mbuf is not free'd. 457af7ab184SArchie Cobbs */ 458af7ab184SArchie Cobbs static int 459af7ab184SArchie Cobbs ng_mppc_compress(node_p node, struct mbuf *m, struct mbuf **resultp) 460af7ab184SArchie Cobbs { 461af7ab184SArchie Cobbs const priv_p priv = node->private; 462af7ab184SArchie Cobbs struct ng_mppc_dir *const d = &priv->xmit; 463af7ab184SArchie Cobbs u_char *inbuf, *outbuf; 464af7ab184SArchie Cobbs int outlen, inlen; 465af7ab184SArchie Cobbs u_int16_t header; 466af7ab184SArchie Cobbs 467af7ab184SArchie Cobbs /* Initialize */ 468af7ab184SArchie Cobbs *resultp = NULL; 469af7ab184SArchie Cobbs header = d->cc; 470af7ab184SArchie Cobbs if (d->flushed) { 471af7ab184SArchie Cobbs header |= MPPC_FLAG_FLUSHED; 472af7ab184SArchie Cobbs d->flushed = 0; 473af7ab184SArchie Cobbs } 474af7ab184SArchie Cobbs 475af7ab184SArchie Cobbs /* Work with contiguous regions of memory */ 476af7ab184SArchie Cobbs inlen = m->m_pkthdr.len; 477af7ab184SArchie Cobbs MALLOC(inbuf, u_char *, inlen, M_NETGRAPH, M_NOWAIT); 478af7ab184SArchie Cobbs if (inbuf == NULL) 479af7ab184SArchie Cobbs return (ENOMEM); 480af7ab184SArchie Cobbs m_copydata(m, 0, inlen, (caddr_t)inbuf); 481af7ab184SArchie Cobbs if ((d->cfg.bits & MPPC_BIT) != 0) 482af7ab184SArchie Cobbs outlen = MPPC_MAX_BLOWUP(inlen); 483af7ab184SArchie Cobbs else 484af7ab184SArchie Cobbs outlen = MPPC_HDRLEN + inlen; 485840f7127SArchie Cobbs MALLOC(outbuf, u_char *, outlen, M_NETGRAPH, M_NOWAIT); 486af7ab184SArchie Cobbs if (outbuf == NULL) { 487af7ab184SArchie Cobbs FREE(inbuf, M_NETGRAPH); 488af7ab184SArchie Cobbs return (ENOMEM); 489af7ab184SArchie Cobbs } 490af7ab184SArchie Cobbs 491af7ab184SArchie Cobbs /* Compress "inbuf" into "outbuf" (if compression enabled) */ 492af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 493af7ab184SArchie Cobbs if ((d->cfg.bits & MPPC_BIT) != 0) { 494af7ab184SArchie Cobbs u_short flags = MPPC_MANDATORY_COMPRESS_FLAGS; 495af7ab184SArchie Cobbs u_char *source, *dest; 496af7ab184SArchie Cobbs u_long sourceCnt, destCnt; 497af7ab184SArchie Cobbs int rtn; 498af7ab184SArchie Cobbs 499af7ab184SArchie Cobbs /* Prepare to compress */ 500af7ab184SArchie Cobbs source = inbuf; 501af7ab184SArchie Cobbs sourceCnt = inlen; 502af7ab184SArchie Cobbs dest = outbuf + MPPC_HDRLEN; 503af7ab184SArchie Cobbs destCnt = outlen - MPPC_HDRLEN; 504af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) == 0) 505af7ab184SArchie Cobbs flags |= MPPC_SAVE_HISTORY; 506af7ab184SArchie Cobbs 507af7ab184SArchie Cobbs /* Compress */ 508af7ab184SArchie Cobbs rtn = MPPC_Compress(&source, &dest, &sourceCnt, 509af7ab184SArchie Cobbs &destCnt, d->history, flags, 0); 510af7ab184SArchie Cobbs 511af7ab184SArchie Cobbs /* Check return value */ 512af7ab184SArchie Cobbs KASSERT(rtn != MPPC_INVALID, ("%s: invalid", __FUNCTION__)); 513af7ab184SArchie Cobbs if ((rtn & MPPC_EXPANDED) == 0 514af7ab184SArchie Cobbs && (rtn & MPPC_COMP_OK) == MPPC_COMP_OK) { 515af7ab184SArchie Cobbs outlen -= destCnt; 516af7ab184SArchie Cobbs header |= MPPC_FLAG_COMPRESSED; 517af7ab184SArchie Cobbs if ((rtn & MPPC_RESTART_HISTORY) != 0) 518af7ab184SArchie Cobbs header |= MPPC_FLAG_RESTART; 519af7ab184SArchie Cobbs } 520af7ab184SArchie Cobbs d->flushed = (rtn & MPPC_EXPANDED) != 0 521af7ab184SArchie Cobbs || (flags & MPPC_SAVE_HISTORY) == 0; 522af7ab184SArchie Cobbs } 523af7ab184SArchie Cobbs #endif 524af7ab184SArchie Cobbs 525af7ab184SArchie Cobbs /* If we did not compress this packet, copy it to output buffer */ 526af7ab184SArchie Cobbs if ((header & MPPC_FLAG_COMPRESSED) == 0) { 527af7ab184SArchie Cobbs bcopy(inbuf, outbuf + MPPC_HDRLEN, inlen); 528af7ab184SArchie Cobbs outlen = MPPC_HDRLEN + inlen; 529af7ab184SArchie Cobbs } 530af7ab184SArchie Cobbs FREE(inbuf, M_NETGRAPH); 531af7ab184SArchie Cobbs 532af7ab184SArchie Cobbs /* Always set the flushed bit in stateless mode */ 533af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) != 0) 534af7ab184SArchie Cobbs header |= MPPC_FLAG_FLUSHED; 535af7ab184SArchie Cobbs 536af7ab184SArchie Cobbs /* Now encrypt packet (if encryption enabled) */ 537af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 538af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_BITS) != 0) { 539af7ab184SArchie Cobbs 540af7ab184SArchie Cobbs /* Set header bits; need to reset key if we say we did */ 541af7ab184SArchie Cobbs header |= MPPC_FLAG_ENCRYPTED; 542af7ab184SArchie Cobbs if ((header & MPPC_FLAG_FLUSHED) != 0) 543af7ab184SArchie Cobbs rc4_init(&d->rc4, d->key, KEYLEN(d->cfg.bits)); 544af7ab184SArchie Cobbs 545af7ab184SArchie Cobbs /* Update key if it's time */ 546af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) != 0 547af7ab184SArchie Cobbs || (d->cc & MPPE_UPDATE_MASK) == MPPE_UPDATE_FLAG) { 548af7ab184SArchie Cobbs ng_mppc_updatekey(d->cfg.bits, 549af7ab184SArchie Cobbs d->cfg.startkey, d->key, &d->rc4); 550af7ab184SArchie Cobbs } 551af7ab184SArchie Cobbs 552af7ab184SArchie Cobbs /* Encrypt packet */ 553af7ab184SArchie Cobbs rc4_crypt(&d->rc4, outbuf + MPPC_HDRLEN, 554af7ab184SArchie Cobbs outbuf + MPPC_HDRLEN, outlen - MPPC_HDRLEN); 555af7ab184SArchie Cobbs } 556af7ab184SArchie Cobbs #endif 557af7ab184SArchie Cobbs 558af7ab184SArchie Cobbs /* Update sequence number */ 559af7ab184SArchie Cobbs d->cc++; 560af7ab184SArchie Cobbs 561af7ab184SArchie Cobbs /* Install header */ 562af7ab184SArchie Cobbs *((u_int16_t *)outbuf) = htons(header); 563af7ab184SArchie Cobbs 564af7ab184SArchie Cobbs /* Return packet in an mbuf */ 565af7ab184SArchie Cobbs *resultp = m_devget((caddr_t)outbuf, outlen, 0, NULL, NULL); 566af7ab184SArchie Cobbs FREE(outbuf, M_NETGRAPH); 567af7ab184SArchie Cobbs return (*resultp == NULL ? ENOBUFS : 0); 568af7ab184SArchie Cobbs } 569af7ab184SArchie Cobbs 570af7ab184SArchie Cobbs /* 571af7ab184SArchie Cobbs * Decompress/decrypt packet and put the result in a new mbuf at *resultp. 572af7ab184SArchie Cobbs * The original mbuf is not free'd. 573af7ab184SArchie Cobbs */ 574af7ab184SArchie Cobbs static int 575af7ab184SArchie Cobbs ng_mppc_decompress(node_p node, struct mbuf *m, struct mbuf **resultp) 576af7ab184SArchie Cobbs { 577af7ab184SArchie Cobbs const priv_p priv = node->private; 578af7ab184SArchie Cobbs struct ng_mppc_dir *const d = &priv->recv; 579af7ab184SArchie Cobbs u_int16_t header, cc, numLost; 580af7ab184SArchie Cobbs u_char *buf; 581af7ab184SArchie Cobbs int len; 582af7ab184SArchie Cobbs 583af7ab184SArchie Cobbs /* Pull off header */ 584af7ab184SArchie Cobbs if (m->m_pkthdr.len < MPPC_HDRLEN) 585af7ab184SArchie Cobbs return (EINVAL); 586af7ab184SArchie Cobbs m_copydata(m, 0, MPPC_HDRLEN, (caddr_t)&header); 587af7ab184SArchie Cobbs NTOHS(header); 588af7ab184SArchie Cobbs cc = (header & MPPC_CCOUNT_MASK); 589af7ab184SArchie Cobbs 590af7ab184SArchie Cobbs /* Copy payload into a contiguous region of memory */ 591af7ab184SArchie Cobbs len = m->m_pkthdr.len - MPPC_HDRLEN; 592af7ab184SArchie Cobbs MALLOC(buf, u_char *, len, M_NETGRAPH, M_NOWAIT); 593af7ab184SArchie Cobbs if (buf == NULL) 594af7ab184SArchie Cobbs return (ENOMEM); 595af7ab184SArchie Cobbs m_copydata(m, MPPC_HDRLEN, len, (caddr_t)buf); 596af7ab184SArchie Cobbs 597af7ab184SArchie Cobbs /* Check for insane jumps in sequence numbering (D.O.S. attack) */ 598af7ab184SArchie Cobbs numLost = ((cc - d->cc) & MPPC_CCOUNT_MASK); 599af7ab184SArchie Cobbs if (numLost >= MPPC_INSANE_JUMP) { 600af7ab184SArchie Cobbs log(LOG_ERR, "%s: insane jump %d", __FUNCTION__, numLost); 601af7ab184SArchie Cobbs priv->recv.cfg.enable = 0; 602af7ab184SArchie Cobbs goto failed; 603af7ab184SArchie Cobbs } 604af7ab184SArchie Cobbs 605af7ab184SArchie Cobbs /* If flushed bit set, we can always handle packet */ 606af7ab184SArchie Cobbs if ((header & MPPC_FLAG_FLUSHED) != 0) { 607af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 608af7ab184SArchie Cobbs if (d->history != NULL) 609af7ab184SArchie Cobbs MPPC_InitDecompressionHistory(d->history); 610af7ab184SArchie Cobbs #endif 611af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 612af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_BITS) != 0) { 613af7ab184SArchie Cobbs 614af7ab184SArchie Cobbs /* Resync as necessary, skipping lost packets */ 615af7ab184SArchie Cobbs while (d->cc != cc) { 616af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) 617af7ab184SArchie Cobbs || (d->cc & MPPE_UPDATE_MASK) 618af7ab184SArchie Cobbs == MPPE_UPDATE_FLAG) { 619af7ab184SArchie Cobbs ng_mppc_updatekey(d->cfg.bits, 620af7ab184SArchie Cobbs d->cfg.startkey, d->key, &d->rc4); 621af7ab184SArchie Cobbs } 622af7ab184SArchie Cobbs d->cc++; 623af7ab184SArchie Cobbs } 624af7ab184SArchie Cobbs 625af7ab184SArchie Cobbs /* Reset key (except in stateless mode, see below) */ 626af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) == 0) 627af7ab184SArchie Cobbs rc4_init(&d->rc4, d->key, KEYLEN(d->cfg.bits)); 628af7ab184SArchie Cobbs } 629af7ab184SArchie Cobbs #endif 630af7ab184SArchie Cobbs d->cc = cc; /* skip over lost seq numbers */ 631af7ab184SArchie Cobbs numLost = 0; /* act like no packets were lost */ 632af7ab184SArchie Cobbs } 633af7ab184SArchie Cobbs 634af7ab184SArchie Cobbs /* Can't decode non-sequential packets without a flushed bit */ 635af7ab184SArchie Cobbs if (numLost != 0) 636af7ab184SArchie Cobbs goto failed; 637af7ab184SArchie Cobbs 638af7ab184SArchie Cobbs /* Decrypt packet */ 639af7ab184SArchie Cobbs if ((header & MPPC_FLAG_ENCRYPTED) != 0) { 640af7ab184SArchie Cobbs 641af7ab184SArchie Cobbs /* Are we not expecting encryption? */ 642af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_BITS) == 0) { 643af7ab184SArchie Cobbs log(LOG_ERR, "%s: rec'd unexpectedly %s packet", 644af7ab184SArchie Cobbs __FUNCTION__, "encrypted"); 645af7ab184SArchie Cobbs goto failed; 646af7ab184SArchie Cobbs } 647af7ab184SArchie Cobbs 648af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 649af7ab184SArchie Cobbs /* Update key if it's time (always in stateless mode) */ 650af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) != 0 651af7ab184SArchie Cobbs || (d->cc & MPPE_UPDATE_MASK) == MPPE_UPDATE_FLAG) { 652af7ab184SArchie Cobbs ng_mppc_updatekey(d->cfg.bits, 653af7ab184SArchie Cobbs d->cfg.startkey, d->key, &d->rc4); 654af7ab184SArchie Cobbs } 655af7ab184SArchie Cobbs 656af7ab184SArchie Cobbs /* Decrypt packet */ 657af7ab184SArchie Cobbs rc4_crypt(&d->rc4, buf, buf, len); 658af7ab184SArchie Cobbs #endif 659af7ab184SArchie Cobbs } else { 660af7ab184SArchie Cobbs 661af7ab184SArchie Cobbs /* Are we expecting encryption? */ 662af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_BITS) != 0) { 663af7ab184SArchie Cobbs log(LOG_ERR, "%s: rec'd unexpectedly %s packet", 664af7ab184SArchie Cobbs __FUNCTION__, "unencrypted"); 665af7ab184SArchie Cobbs goto failed; 666af7ab184SArchie Cobbs } 667af7ab184SArchie Cobbs } 668af7ab184SArchie Cobbs 669af7ab184SArchie Cobbs /* Update coherency count for next time (12 bit arithmetic) */ 670af7ab184SArchie Cobbs d->cc++; 671af7ab184SArchie Cobbs 672af7ab184SArchie Cobbs /* Check for unexpected compressed packet */ 673af7ab184SArchie Cobbs if ((header & MPPC_FLAG_COMPRESSED) != 0 674af7ab184SArchie Cobbs && (d->cfg.bits & MPPC_BIT) == 0) { 675af7ab184SArchie Cobbs log(LOG_ERR, "%s: rec'd unexpectedly %s packet", 676af7ab184SArchie Cobbs __FUNCTION__, "compressed"); 677af7ab184SArchie Cobbs failed: 678af7ab184SArchie Cobbs FREE(buf, M_NETGRAPH); 679af7ab184SArchie Cobbs return (EINVAL); 680af7ab184SArchie Cobbs } 681af7ab184SArchie Cobbs 682af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 683af7ab184SArchie Cobbs /* Decompress packet */ 684af7ab184SArchie Cobbs if ((header & MPPC_FLAG_COMPRESSED) != 0) { 685af7ab184SArchie Cobbs int flags = MPPC_MANDATORY_DECOMPRESS_FLAGS; 686af7ab184SArchie Cobbs u_char *decompbuf, *source, *dest; 687af7ab184SArchie Cobbs u_long sourceCnt, destCnt; 688af7ab184SArchie Cobbs int decomplen, rtn; 689af7ab184SArchie Cobbs 690af7ab184SArchie Cobbs /* Allocate a buffer for decompressed data */ 691af7ab184SArchie Cobbs MALLOC(decompbuf, u_char *, MPPC_DECOMP_BUFSIZE 692af7ab184SArchie Cobbs + MPPC_DECOMP_SAFETY, M_NETGRAPH, M_NOWAIT); 693af7ab184SArchie Cobbs if (decompbuf == NULL) { 694af7ab184SArchie Cobbs FREE(buf, M_NETGRAPH); 695af7ab184SArchie Cobbs return (ENOMEM); 696af7ab184SArchie Cobbs } 697af7ab184SArchie Cobbs decomplen = MPPC_DECOMP_BUFSIZE; 698af7ab184SArchie Cobbs 699af7ab184SArchie Cobbs /* Prepare to decompress */ 700af7ab184SArchie Cobbs source = buf; 701af7ab184SArchie Cobbs sourceCnt = len; 702af7ab184SArchie Cobbs dest = decompbuf; 703af7ab184SArchie Cobbs destCnt = decomplen; 704af7ab184SArchie Cobbs if ((header & MPPC_FLAG_RESTART) != 0) 705af7ab184SArchie Cobbs flags |= MPPC_RESTART_HISTORY; 706af7ab184SArchie Cobbs 707af7ab184SArchie Cobbs /* Decompress */ 708af7ab184SArchie Cobbs rtn = MPPC_Decompress(&source, &dest, 709af7ab184SArchie Cobbs &sourceCnt, &destCnt, d->history, flags); 710af7ab184SArchie Cobbs 711af7ab184SArchie Cobbs /* Check return value */ 712af7ab184SArchie Cobbs KASSERT(rtn != MPPC_INVALID, ("%s: invalid", __FUNCTION__)); 713af7ab184SArchie Cobbs if ((rtn & MPPC_DEST_EXHAUSTED) != 0 714af7ab184SArchie Cobbs || (rtn & MPPC_DECOMP_OK) != MPPC_DECOMP_OK) { 715af7ab184SArchie Cobbs log(LOG_ERR, "%s: decomp returned 0x%x", 716af7ab184SArchie Cobbs __FUNCTION__, rtn); 717af7ab184SArchie Cobbs FREE(decompbuf, M_NETGRAPH); 718af7ab184SArchie Cobbs goto failed; 719af7ab184SArchie Cobbs } 720af7ab184SArchie Cobbs 721af7ab184SArchie Cobbs /* Replace compressed data with decompressed data */ 722af7ab184SArchie Cobbs FREE(buf, M_NETGRAPH); 723af7ab184SArchie Cobbs buf = decompbuf; 724af7ab184SArchie Cobbs len = decomplen - destCnt; 725af7ab184SArchie Cobbs } 726af7ab184SArchie Cobbs #endif 727af7ab184SArchie Cobbs 728af7ab184SArchie Cobbs /* Return result in an mbuf */ 729af7ab184SArchie Cobbs *resultp = m_devget((caddr_t)buf, len, 0, NULL, NULL); 730af7ab184SArchie Cobbs FREE(buf, M_NETGRAPH); 731af7ab184SArchie Cobbs return (*resultp == NULL ? ENOBUFS : 0); 732af7ab184SArchie Cobbs } 733af7ab184SArchie Cobbs 734af7ab184SArchie Cobbs /* 735af7ab184SArchie Cobbs * The peer has sent us a CCP ResetRequest, so reset our transmit state. 736af7ab184SArchie Cobbs */ 737af7ab184SArchie Cobbs static void 738af7ab184SArchie Cobbs ng_mppc_reset_req(node_p node) 739af7ab184SArchie Cobbs { 740af7ab184SArchie Cobbs const priv_p priv = node->private; 741af7ab184SArchie Cobbs struct ng_mppc_dir *const d = &priv->xmit; 742af7ab184SArchie Cobbs 743af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_COMPRESSION 744af7ab184SArchie Cobbs if (d->history != NULL) 745af7ab184SArchie Cobbs MPPC_InitCompressionHistory(d->history); 746af7ab184SArchie Cobbs #endif 747af7ab184SArchie Cobbs #ifdef NETGRAPH_MPPC_ENCRYPTION 748af7ab184SArchie Cobbs if ((d->cfg.bits & MPPE_STATELESS) == 0) 749af7ab184SArchie Cobbs rc4_init(&d->rc4, d->key, KEYLEN(d->cfg.bits)); 750af7ab184SArchie Cobbs #endif 751af7ab184SArchie Cobbs d->flushed = 1; 752af7ab184SArchie Cobbs } 753af7ab184SArchie Cobbs 754af7ab184SArchie Cobbs /* 755af7ab184SArchie Cobbs * Generate a new encryption key 756af7ab184SArchie Cobbs */ 757af7ab184SArchie Cobbs static void 758af7ab184SArchie Cobbs ng_mppc_getkey(const u_char *h, u_char *h2, int len) 759af7ab184SArchie Cobbs { 760af7ab184SArchie Cobbs static const u_char pad1[10] = 761af7ab184SArchie Cobbs { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; 762af7ab184SArchie Cobbs static const u_char pad2[10] = 763af7ab184SArchie Cobbs { 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, }; 764af7ab184SArchie Cobbs u_char hash[20]; 765af7ab184SArchie Cobbs SHA1_CTX c; 766af7ab184SArchie Cobbs int k; 767af7ab184SArchie Cobbs 768af7ab184SArchie Cobbs bzero(&hash, sizeof(hash)); 769af7ab184SArchie Cobbs SHA1Init(&c); 770af7ab184SArchie Cobbs SHA1Update(&c, h, len); 771af7ab184SArchie Cobbs for (k = 0; k < 4; k++) 772af7ab184SArchie Cobbs SHA1Update(&c, pad1, sizeof(pad2)); 773af7ab184SArchie Cobbs SHA1Update(&c, h2, len); 774af7ab184SArchie Cobbs for (k = 0; k < 4; k++) 775af7ab184SArchie Cobbs SHA1Update(&c, pad2, sizeof(pad2)); 776af7ab184SArchie Cobbs SHA1Final(hash, &c); 777af7ab184SArchie Cobbs bcopy(hash, h2, len); 778af7ab184SArchie Cobbs } 779af7ab184SArchie Cobbs 780af7ab184SArchie Cobbs /* 781af7ab184SArchie Cobbs * Update the encryption key 782af7ab184SArchie Cobbs */ 783af7ab184SArchie Cobbs static void 784af7ab184SArchie Cobbs ng_mppc_updatekey(u_int32_t bits, 785af7ab184SArchie Cobbs u_char *key0, u_char *key, struct rc4_state *rc4) 786af7ab184SArchie Cobbs { 787af7ab184SArchie Cobbs const int keylen = KEYLEN(bits); 788af7ab184SArchie Cobbs 789af7ab184SArchie Cobbs ng_mppc_getkey(key0, key, keylen); 790af7ab184SArchie Cobbs rc4_init(rc4, key, keylen); 791af7ab184SArchie Cobbs rc4_crypt(rc4, key, key, keylen); 792af7ab184SArchie Cobbs if ((bits & MPPE_128) == 0) 793af7ab184SArchie Cobbs bcopy(&ng_mppe_weakenkey, key, sizeof(ng_mppe_weakenkey)); 794af7ab184SArchie Cobbs rc4_init(rc4, key, keylen); 795af7ab184SArchie Cobbs } 796af7ab184SArchie Cobbs 797