1 /* 2 * ppp_mppe.c - interface MPPE to the PPP code. 3 * This version is for use with Linux kernel 2.6.14+ 4 * 5 * By Frank Cusack <fcusack@fcusack.com>. 6 * Copyright (c) 2002,2003,2004 Google, Inc. 7 * All rights reserved. 8 * 9 * License: 10 * Permission to use, copy, modify, and distribute this software and its 11 * documentation is hereby granted, provided that the above copyright 12 * notice appears in all copies. This software is provided without any 13 * warranty, express or implied. 14 * 15 * ALTERNATIVELY, provided that this notice is retained in full, this product 16 * may be distributed under the terms of the GNU General Public License (GPL), 17 * in which case the provisions of the GPL apply INSTEAD OF those given above. 18 * 19 * This program is free software; you can redistribute it and/or modify 20 * it under the terms of the GNU General Public License as published by 21 * the Free Software Foundation; either version 2 of the License, or 22 * (at your option) any later version. 23 * 24 * This program is distributed in the hope that it will be useful, 25 * but WITHOUT ANY WARRANTY; without even the implied warranty of 26 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 27 * GNU General Public License for more details. 28 * 29 * You should have received a copy of the GNU General Public License 30 * along with this program; if not, see <http://www.gnu.org/licenses/>. 31 * 32 * 33 * Changelog: 34 * 08/12/05 - Matt Domsch <Matt_Domsch@dell.com> 35 * Only need extra skb padding on transmit, not receive. 36 * 06/18/04 - Matt Domsch <Matt_Domsch@dell.com>, Oleg Makarenko <mole@quadra.ru> 37 * Use Linux kernel 2.6 arc4 and sha1 routines rather than 38 * providing our own. 39 * 2/15/04 - TS: added #include <version.h> and testing for Kernel 40 * version before using 41 * MOD_DEC_USAGE_COUNT/MOD_INC_USAGE_COUNT which are 42 * deprecated in 2.6 43 */ 44 45 #include <crypto/arc4.h> 46 #include <crypto/sha1.h> 47 #include <linux/err.h> 48 #include <linux/fips.h> 49 #include <linux/module.h> 50 #include <linux/kernel.h> 51 #include <linux/init.h> 52 #include <linux/types.h> 53 #include <linux/slab.h> 54 #include <linux/string.h> 55 #include <linux/mm.h> 56 #include <linux/ppp_defs.h> 57 #include <linux/ppp-comp.h> 58 #include <linux/unaligned.h> 59 60 #include "ppp_mppe.h" 61 62 MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>"); 63 MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support"); 64 MODULE_LICENSE("Dual BSD/GPL"); 65 MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE)); 66 MODULE_VERSION("1.0.2"); 67 68 #define SHA1_PAD_SIZE 40 69 static const u8 sha_pad1[SHA1_PAD_SIZE] = { 0 }; 70 static const u8 sha_pad2[SHA1_PAD_SIZE] = { [0 ... SHA1_PAD_SIZE - 1] = 0xF2 }; 71 72 /* 73 * State for an MPPE (de)compressor. 74 */ 75 struct ppp_mppe_state { 76 struct arc4_ctx arc4; 77 unsigned char sha1_digest[SHA1_DIGEST_SIZE]; 78 unsigned char master_key[MPPE_MAX_KEY_LEN]; 79 unsigned char session_key[MPPE_MAX_KEY_LEN]; 80 unsigned keylen; /* key length in bytes */ 81 /* NB: 128-bit == 16, 40-bit == 8! */ 82 /* If we want to support 56-bit, */ 83 /* the unit has to change to bits */ 84 unsigned char bits; /* MPPE control bits */ 85 unsigned ccount; /* 12-bit coherency count (seqno) */ 86 unsigned stateful; /* stateful mode flag */ 87 int discard; /* stateful mode packet loss flag */ 88 int sanity_errors; /* take down LCP if too many */ 89 int unit; 90 int debug; 91 struct compstat stats; 92 }; 93 94 /* struct ppp_mppe_state.bits definitions */ 95 #define MPPE_BIT_A 0x80 /* Encryption table were (re)inititalized */ 96 #define MPPE_BIT_B 0x40 /* MPPC only (not implemented) */ 97 #define MPPE_BIT_C 0x20 /* MPPC only (not implemented) */ 98 #define MPPE_BIT_D 0x10 /* This is an encrypted frame */ 99 100 #define MPPE_BIT_FLUSHED MPPE_BIT_A 101 #define MPPE_BIT_ENCRYPTED MPPE_BIT_D 102 103 #define MPPE_BITS(p) ((p)[4] & 0xf0) 104 #define MPPE_CCOUNT(p) ((((p)[4] & 0x0f) << 8) + (p)[5]) 105 #define MPPE_CCOUNT_SPACE 0x1000 /* The size of the ccount space */ 106 107 #define MPPE_OVHD 2 /* MPPE overhead/packet */ 108 #define SANITY_MAX 1600 /* Max bogon factor we will tolerate */ 109 110 /* 111 * Key Derivation, from RFC 3078, RFC 3079. 112 * Equivalent to Get_Key() for MS-CHAP as described in RFC 3079. 113 */ 114 static void get_new_key_from_sha(struct ppp_mppe_state * state) 115 { 116 struct sha1_ctx ctx; 117 118 sha1_init(&ctx); 119 sha1_update(&ctx, state->master_key, state->keylen); 120 sha1_update(&ctx, sha_pad1, sizeof(sha_pad1)); 121 sha1_update(&ctx, state->session_key, state->keylen); 122 sha1_update(&ctx, sha_pad2, sizeof(sha_pad2)); 123 sha1_final(&ctx, state->sha1_digest); 124 } 125 126 /* 127 * Perform the MPPE rekey algorithm, from RFC 3078, sec. 7.3. 128 * Well, not what's written there, but rather what they meant. 129 */ 130 static void mppe_rekey(struct ppp_mppe_state * state, int initial_key) 131 { 132 get_new_key_from_sha(state); 133 if (!initial_key) { 134 arc4_setkey(&state->arc4, state->sha1_digest, state->keylen); 135 arc4_crypt(&state->arc4, state->session_key, state->sha1_digest, 136 state->keylen); 137 } else { 138 memcpy(state->session_key, state->sha1_digest, state->keylen); 139 } 140 if (state->keylen == 8) { 141 /* See RFC 3078 */ 142 state->session_key[0] = 0xd1; 143 state->session_key[1] = 0x26; 144 state->session_key[2] = 0x9e; 145 } 146 arc4_setkey(&state->arc4, state->session_key, state->keylen); 147 } 148 149 /* 150 * Allocate space for a (de)compressor. 151 */ 152 static void *mppe_alloc(unsigned char *options, int optlen) 153 { 154 struct ppp_mppe_state *state; 155 156 if (optlen != CILEN_MPPE + sizeof(state->master_key) || 157 options[0] != CI_MPPE || options[1] != CILEN_MPPE || 158 fips_enabled) 159 return NULL; 160 161 state = kzalloc(sizeof(*state), GFP_KERNEL); 162 if (state == NULL) 163 return NULL; 164 165 /* Save keys. */ 166 memcpy(state->master_key, &options[CILEN_MPPE], 167 sizeof(state->master_key)); 168 memcpy(state->session_key, state->master_key, 169 sizeof(state->master_key)); 170 171 /* 172 * We defer initial key generation until mppe_init(), as mppe_alloc() 173 * is called frequently during negotiation. 174 */ 175 176 return (void *)state; 177 } 178 179 /* 180 * Deallocate space for a (de)compressor. 181 */ 182 static void mppe_free(void *arg) 183 { 184 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 185 186 kfree_sensitive(state); 187 } 188 189 /* 190 * Initialize (de)compressor state. 191 */ 192 static int 193 mppe_init(void *arg, unsigned char *options, int optlen, int unit, int debug, 194 const char *debugstr) 195 { 196 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 197 unsigned char mppe_opts; 198 199 if (optlen != CILEN_MPPE || 200 options[0] != CI_MPPE || options[1] != CILEN_MPPE) 201 return 0; 202 203 MPPE_CI_TO_OPTS(&options[2], mppe_opts); 204 if (mppe_opts & MPPE_OPT_128) 205 state->keylen = 16; 206 else if (mppe_opts & MPPE_OPT_40) 207 state->keylen = 8; 208 else { 209 printk(KERN_WARNING "%s[%d]: unknown key length\n", debugstr, 210 unit); 211 return 0; 212 } 213 if (mppe_opts & MPPE_OPT_STATEFUL) 214 state->stateful = 1; 215 216 /* Generate the initial session key. */ 217 mppe_rekey(state, 1); 218 219 if (debug) { 220 printk(KERN_DEBUG "%s[%d]: initialized with %d-bit %s mode\n", 221 debugstr, unit, (state->keylen == 16) ? 128 : 40, 222 (state->stateful) ? "stateful" : "stateless"); 223 printk(KERN_DEBUG 224 "%s[%d]: keys: master: %*phN initial session: %*phN\n", 225 debugstr, unit, 226 (int)sizeof(state->master_key), state->master_key, 227 (int)sizeof(state->session_key), state->session_key); 228 } 229 230 /* 231 * Initialize the coherency count. The initial value is not specified 232 * in RFC 3078, but we can make a reasonable assumption that it will 233 * start at 0. Setting it to the max here makes the comp/decomp code 234 * do the right thing (determined through experiment). 235 */ 236 state->ccount = MPPE_CCOUNT_SPACE - 1; 237 238 /* 239 * Note that even though we have initialized the key table, we don't 240 * set the FLUSHED bit. This is contrary to RFC 3078, sec. 3.1. 241 */ 242 state->bits = MPPE_BIT_ENCRYPTED; 243 244 state->unit = unit; 245 state->debug = debug; 246 247 return 1; 248 } 249 250 static int 251 mppe_comp_init(void *arg, unsigned char *options, int optlen, int unit, 252 int hdrlen, int debug) 253 { 254 /* ARGSUSED */ 255 return mppe_init(arg, options, optlen, unit, debug, "mppe_comp_init"); 256 } 257 258 /* 259 * We received a CCP Reset-Request (actually, we are sending a Reset-Ack), 260 * tell the compressor to rekey. Note that we MUST NOT rekey for 261 * every CCP Reset-Request; we only rekey on the next xmit packet. 262 * We might get multiple CCP Reset-Requests if our CCP Reset-Ack is lost. 263 * So, rekeying for every CCP Reset-Request is broken as the peer will not 264 * know how many times we've rekeyed. (If we rekey and THEN get another 265 * CCP Reset-Request, we must rekey again.) 266 */ 267 static void mppe_comp_reset(void *arg) 268 { 269 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 270 271 state->bits |= MPPE_BIT_FLUSHED; 272 } 273 274 /* 275 * Compress (encrypt) a packet. 276 * It's strange to call this a compressor, since the output is always 277 * MPPE_OVHD + 2 bytes larger than the input. 278 */ 279 static int 280 mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf, 281 int isize, int osize) 282 { 283 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 284 int proto; 285 286 /* 287 * Check that the protocol is in the range we handle. 288 */ 289 proto = PPP_PROTOCOL(ibuf); 290 if (proto < 0x0021 || proto > 0x00fa) 291 return 0; 292 293 /* Make sure we have enough room to generate an encrypted packet. */ 294 if (osize < isize + MPPE_OVHD + 2) { 295 /* Drop the packet if we should encrypt it, but can't. */ 296 printk(KERN_DEBUG "mppe_compress[%d]: osize too small! " 297 "(have: %d need: %d)\n", state->unit, 298 osize, osize + MPPE_OVHD + 2); 299 return -1; 300 } 301 302 osize = isize + MPPE_OVHD + 2; 303 304 /* 305 * Copy over the PPP header and set control bits. 306 */ 307 obuf[0] = PPP_ADDRESS(ibuf); 308 obuf[1] = PPP_CONTROL(ibuf); 309 put_unaligned_be16(PPP_COMP, obuf + 2); 310 obuf += PPP_HDRLEN; 311 312 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; 313 if (state->debug >= 7) 314 printk(KERN_DEBUG "mppe_compress[%d]: ccount %d\n", state->unit, 315 state->ccount); 316 put_unaligned_be16(state->ccount, obuf); 317 318 if (!state->stateful || /* stateless mode */ 319 ((state->ccount & 0xff) == 0xff) || /* "flag" packet */ 320 (state->bits & MPPE_BIT_FLUSHED)) { /* CCP Reset-Request */ 321 /* We must rekey */ 322 if (state->debug && state->stateful) 323 printk(KERN_DEBUG "mppe_compress[%d]: rekeying\n", 324 state->unit); 325 mppe_rekey(state, 0); 326 state->bits |= MPPE_BIT_FLUSHED; 327 } 328 obuf[0] |= state->bits; 329 state->bits &= ~MPPE_BIT_FLUSHED; /* reset for next xmit */ 330 331 obuf += MPPE_OVHD; 332 ibuf += 2; /* skip to proto field */ 333 isize -= 2; 334 335 arc4_crypt(&state->arc4, obuf, ibuf, isize); 336 337 state->stats.unc_bytes += isize; 338 state->stats.unc_packets++; 339 state->stats.comp_bytes += osize; 340 state->stats.comp_packets++; 341 342 return osize; 343 } 344 345 /* 346 * Since every frame grows by MPPE_OVHD + 2 bytes, this is always going 347 * to look bad ... and the longer the link is up the worse it will get. 348 */ 349 static void mppe_comp_stats(void *arg, struct compstat *stats) 350 { 351 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 352 353 *stats = state->stats; 354 } 355 356 static int 357 mppe_decomp_init(void *arg, unsigned char *options, int optlen, int unit, 358 int hdrlen, int mru, int debug) 359 { 360 /* ARGSUSED */ 361 return mppe_init(arg, options, optlen, unit, debug, "mppe_decomp_init"); 362 } 363 364 /* 365 * We received a CCP Reset-Ack. Just ignore it. 366 */ 367 static void mppe_decomp_reset(void *arg) 368 { 369 /* ARGSUSED */ 370 return; 371 } 372 373 /* 374 * Decompress (decrypt) an MPPE packet. 375 */ 376 static int 377 mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf, 378 int osize) 379 { 380 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 381 unsigned ccount; 382 int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED; 383 384 if (isize <= PPP_HDRLEN + MPPE_OVHD) { 385 if (state->debug) 386 printk(KERN_DEBUG 387 "mppe_decompress[%d]: short pkt (%d)\n", 388 state->unit, isize); 389 return DECOMP_ERROR; 390 } 391 392 /* 393 * Make sure we have enough room to decrypt the packet. 394 * Note that for our test we only subtract 1 byte whereas in 395 * mppe_compress() we added 2 bytes (+MPPE_OVHD); 396 * this is to account for possible PFC. 397 */ 398 if (osize < isize - MPPE_OVHD - 1) { 399 printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! " 400 "(have: %d need: %d)\n", state->unit, 401 osize, isize - MPPE_OVHD - 1); 402 return DECOMP_ERROR; 403 } 404 osize = isize - MPPE_OVHD - 2; /* assume no PFC */ 405 406 ccount = MPPE_CCOUNT(ibuf); 407 if (state->debug >= 7) 408 printk(KERN_DEBUG "mppe_decompress[%d]: ccount %d\n", 409 state->unit, ccount); 410 411 /* sanity checks -- terminate with extreme prejudice */ 412 if (!(MPPE_BITS(ibuf) & MPPE_BIT_ENCRYPTED)) { 413 printk(KERN_DEBUG 414 "mppe_decompress[%d]: ENCRYPTED bit not set!\n", 415 state->unit); 416 state->sanity_errors += 100; 417 goto sanity_error; 418 } 419 if (!state->stateful && !flushed) { 420 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in " 421 "stateless mode!\n", state->unit); 422 state->sanity_errors += 100; 423 goto sanity_error; 424 } 425 if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) { 426 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on " 427 "flag packet!\n", state->unit); 428 state->sanity_errors += 100; 429 goto sanity_error; 430 } 431 432 /* 433 * Check the coherency count. 434 */ 435 436 if (!state->stateful) { 437 /* Discard late packet */ 438 if ((ccount - state->ccount) % MPPE_CCOUNT_SPACE 439 > MPPE_CCOUNT_SPACE / 2) { 440 state->sanity_errors++; 441 goto sanity_error; 442 } 443 444 /* RFC 3078, sec 8.1. Rekey for every packet. */ 445 while (state->ccount != ccount) { 446 mppe_rekey(state, 0); 447 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; 448 } 449 } else { 450 /* RFC 3078, sec 8.2. */ 451 if (!state->discard) { 452 /* normal state */ 453 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE; 454 if (ccount != state->ccount) { 455 /* 456 * (ccount > state->ccount) 457 * Packet loss detected, enter the discard state. 458 * Signal the peer to rekey (by sending a CCP Reset-Request). 459 */ 460 state->discard = 1; 461 return DECOMP_ERROR; 462 } 463 } else { 464 /* discard state */ 465 if (!flushed) { 466 /* ccp.c will be silent (no additional CCP Reset-Requests). */ 467 return DECOMP_ERROR; 468 } else { 469 /* Rekey for every missed "flag" packet. */ 470 while ((ccount & ~0xff) != 471 (state->ccount & ~0xff)) { 472 mppe_rekey(state, 0); 473 state->ccount = 474 (state->ccount + 475 256) % MPPE_CCOUNT_SPACE; 476 } 477 478 /* reset */ 479 state->discard = 0; 480 state->ccount = ccount; 481 /* 482 * Another problem with RFC 3078 here. It implies that the 483 * peer need not send a Reset-Ack packet. But RFC 1962 484 * requires it. Hopefully, M$ does send a Reset-Ack; even 485 * though it isn't required for MPPE synchronization, it is 486 * required to reset CCP state. 487 */ 488 } 489 } 490 if (flushed) 491 mppe_rekey(state, 0); 492 } 493 494 /* 495 * Fill in the first part of the PPP header. The protocol field 496 * comes from the decrypted data. 497 */ 498 obuf[0] = PPP_ADDRESS(ibuf); /* +1 */ 499 obuf[1] = PPP_CONTROL(ibuf); /* +1 */ 500 obuf += 2; 501 ibuf += PPP_HDRLEN + MPPE_OVHD; 502 isize -= PPP_HDRLEN + MPPE_OVHD; /* -6 */ 503 /* net osize: isize-4 */ 504 505 /* 506 * Decrypt the first byte in order to check if it is 507 * a compressed or uncompressed protocol field. 508 */ 509 arc4_crypt(&state->arc4, obuf, ibuf, 1); 510 511 /* 512 * Do PFC decompression. 513 * This would be nicer if we were given the actual sk_buff 514 * instead of a char *. 515 */ 516 if ((obuf[0] & 0x01) != 0) { 517 obuf[1] = obuf[0]; 518 obuf[0] = 0; 519 obuf++; 520 osize++; 521 } 522 523 /* And finally, decrypt the rest of the packet. */ 524 arc4_crypt(&state->arc4, obuf + 1, ibuf + 1, isize - 1); 525 526 state->stats.unc_bytes += osize; 527 state->stats.unc_packets++; 528 state->stats.comp_bytes += isize; 529 state->stats.comp_packets++; 530 531 /* good packet credit */ 532 state->sanity_errors >>= 1; 533 534 return osize; 535 536 sanity_error: 537 if (state->sanity_errors < SANITY_MAX) 538 return DECOMP_ERROR; 539 else 540 /* Take LCP down if the peer is sending too many bogons. 541 * We don't want to do this for a single or just a few 542 * instances since it could just be due to packet corruption. 543 */ 544 return DECOMP_FATALERROR; 545 } 546 547 /* 548 * Incompressible data has arrived (this should never happen!). 549 * We should probably drop the link if the protocol is in the range 550 * of what should be encrypted. At the least, we should drop this 551 * packet. (How to do this?) 552 */ 553 static void mppe_incomp(void *arg, unsigned char *ibuf, int icnt) 554 { 555 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg; 556 557 if (state->debug && 558 (PPP_PROTOCOL(ibuf) >= 0x0021 && PPP_PROTOCOL(ibuf) <= 0x00fa)) 559 printk(KERN_DEBUG 560 "mppe_incomp[%d]: incompressible (unencrypted) data! " 561 "(proto %04x)\n", state->unit, PPP_PROTOCOL(ibuf)); 562 563 state->stats.inc_bytes += icnt; 564 state->stats.inc_packets++; 565 state->stats.unc_bytes += icnt; 566 state->stats.unc_packets++; 567 } 568 569 /************************************************************* 570 * Module interface table 571 *************************************************************/ 572 573 /* 574 * Procedures exported to if_ppp.c. 575 */ 576 static struct compressor ppp_mppe = { 577 .compress_proto = CI_MPPE, 578 .comp_alloc = mppe_alloc, 579 .comp_free = mppe_free, 580 .comp_init = mppe_comp_init, 581 .comp_reset = mppe_comp_reset, 582 .compress = mppe_compress, 583 .comp_stat = mppe_comp_stats, 584 .decomp_alloc = mppe_alloc, 585 .decomp_free = mppe_free, 586 .decomp_init = mppe_decomp_init, 587 .decomp_reset = mppe_decomp_reset, 588 .decompress = mppe_decompress, 589 .incomp = mppe_incomp, 590 .decomp_stat = mppe_comp_stats, 591 .owner = THIS_MODULE, 592 .comp_extra = MPPE_PAD, 593 }; 594 595 static int __init ppp_mppe_init(void) 596 { 597 int answer; 598 599 if (fips_enabled) 600 return -ENODEV; 601 602 answer = ppp_register_compressor(&ppp_mppe); 603 604 if (answer == 0) 605 printk(KERN_INFO "PPP MPPE Compression module registered\n"); 606 607 return answer; 608 } 609 610 static void __exit ppp_mppe_cleanup(void) 611 { 612 ppp_unregister_compressor(&ppp_mppe); 613 } 614 615 module_init(ppp_mppe_init); 616 module_exit(ppp_mppe_cleanup); 617