2 * ppp_mppe.c - interface MPPE to the PPP code.
3 * This version is for use with Linux kernel 2.6.14+
5 * By Frank Cusack <fcusack@fcusack.com>.
6 * Copyright (c) 2002,2003,2004 Google, Inc.
10 * Permission to use, copy, modify, and distribute this software and its
11 * documentation is hereby granted, provided that the above copyright
12 * notice appears in all copies. This software is provided without any
13 * warranty, express or implied.
15 * ALTERNATIVELY, provided that this notice is retained in full, this product
16 * may be distributed under the terms of the GNU General Public License (GPL),
17 * in which case the provisions of the GPL apply INSTEAD OF those given above.
19 * This program is free software; you can redistribute it and/or modify
20 * it under the terms of the GNU General Public License as published by
21 * the Free Software Foundation; either version 2 of the License, or
22 * (at your option) any later version.
24 * This program is distributed in the hope that it will be useful,
25 * but WITHOUT ANY WARRANTY; without even the implied warranty of
26 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27 * GNU General Public License for more details.
29 * You should have received a copy of the GNU General Public License
30 * along with this program; if not, see <http://www.gnu.org/licenses/>.
34 * 08/12/05 - Matt Domsch <Matt_Domsch@dell.com>
35 * Only need extra skb padding on transmit, not receive.
36 * 06/18/04 - Matt Domsch <Matt_Domsch@dell.com>, Oleg Makarenko <mole@quadra.ru>
37 * Use Linux kernel 2.6 arc4 and sha1 routines rather than
39 * 2/15/04 - TS: added #include <version.h> and testing for Kernel
40 * version before using
41 * MOD_DEC_USAGE_COUNT/MOD_INC_USAGE_COUNT which are
45 #include <crypto/arc4.h>
46 #include <crypto/hash.h>
47 #include <linux/err.h>
48 #include <linux/fips.h>
49 #include <linux/module.h>
50 #include <linux/kernel.h>
51 #include <linux/init.h>
52 #include <linux/types.h>
53 #include <linux/slab.h>
54 #include <linux/string.h>
56 #include <linux/ppp_defs.h>
57 #include <linux/ppp-comp.h>
58 #include <linux/scatterlist.h>
59 #include <asm/unaligned.h>
63 MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>");
64 MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support");
65 MODULE_LICENSE("Dual BSD/GPL");
66 MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE));
67 MODULE_SOFTDEP("pre: arc4");
68 MODULE_VERSION("1.0.2");
70 #define SHA1_PAD_SIZE 40
73 * kernel crypto API needs its arguments to be in kmalloc'd memory, not in the module
74 * static data area. That means sha_pad needs to be kmalloc'd.
78 unsigned char sha_pad1[SHA1_PAD_SIZE];
79 unsigned char sha_pad2[SHA1_PAD_SIZE];
81 static struct sha_pad *sha_pad;
83 static inline void sha_pad_init(struct sha_pad *shapad)
85 memset(shapad->sha_pad1, 0x00, sizeof(shapad->sha_pad1));
86 memset(shapad->sha_pad2, 0xF2, sizeof(shapad->sha_pad2));
90 * State for an MPPE (de)compressor.
92 struct ppp_mppe_state {
94 struct shash_desc *sha1;
95 unsigned char *sha1_digest;
96 unsigned char master_key[MPPE_MAX_KEY_LEN];
97 unsigned char session_key[MPPE_MAX_KEY_LEN];
98 unsigned keylen; /* key length in bytes */
99 /* NB: 128-bit == 16, 40-bit == 8! */
100 /* If we want to support 56-bit, */
101 /* the unit has to change to bits */
102 unsigned char bits; /* MPPE control bits */
103 unsigned ccount; /* 12-bit coherency count (seqno) */
104 unsigned stateful; /* stateful mode flag */
105 int discard; /* stateful mode packet loss flag */
106 int sanity_errors; /* take down LCP if too many */
109 struct compstat stats;
112 /* struct ppp_mppe_state.bits definitions */
113 #define MPPE_BIT_A 0x80 /* Encryption table were (re)inititalized */
114 #define MPPE_BIT_B 0x40 /* MPPC only (not implemented) */
115 #define MPPE_BIT_C 0x20 /* MPPC only (not implemented) */
116 #define MPPE_BIT_D 0x10 /* This is an encrypted frame */
118 #define MPPE_BIT_FLUSHED MPPE_BIT_A
119 #define MPPE_BIT_ENCRYPTED MPPE_BIT_D
121 #define MPPE_BITS(p) ((p)[4] & 0xf0)
122 #define MPPE_CCOUNT(p) ((((p)[4] & 0x0f) << 8) + (p)[5])
123 #define MPPE_CCOUNT_SPACE 0x1000 /* The size of the ccount space */
125 #define MPPE_OVHD 2 /* MPPE overhead/packet */
126 #define SANITY_MAX 1600 /* Max bogon factor we will tolerate */
129 * Key Derivation, from RFC 3078, RFC 3079.
130 * Equivalent to Get_Key() for MS-CHAP as described in RFC 3079.
132 static void get_new_key_from_sha(struct ppp_mppe_state * state)
134 crypto_shash_init(state->sha1);
135 crypto_shash_update(state->sha1, state->master_key,
137 crypto_shash_update(state->sha1, sha_pad->sha_pad1,
138 sizeof(sha_pad->sha_pad1));
139 crypto_shash_update(state->sha1, state->session_key,
141 crypto_shash_update(state->sha1, sha_pad->sha_pad2,
142 sizeof(sha_pad->sha_pad2));
143 crypto_shash_final(state->sha1, state->sha1_digest);
147 * Perform the MPPE rekey algorithm, from RFC 3078, sec. 7.3.
148 * Well, not what's written there, but rather what they meant.
150 static void mppe_rekey(struct ppp_mppe_state * state, int initial_key)
152 get_new_key_from_sha(state);
154 arc4_setkey(&state->arc4, state->sha1_digest, state->keylen);
155 arc4_crypt(&state->arc4, state->session_key, state->sha1_digest,
158 memcpy(state->session_key, state->sha1_digest, state->keylen);
160 if (state->keylen == 8) {
162 state->session_key[0] = 0xd1;
163 state->session_key[1] = 0x26;
164 state->session_key[2] = 0x9e;
166 arc4_setkey(&state->arc4, state->session_key, state->keylen);
170 * Allocate space for a (de)compressor.
172 static void *mppe_alloc(unsigned char *options, int optlen)
174 struct ppp_mppe_state *state;
175 struct crypto_shash *shash;
176 unsigned int digestsize;
178 if (optlen != CILEN_MPPE + sizeof(state->master_key) ||
179 options[0] != CI_MPPE || options[1] != CILEN_MPPE ||
183 state = kzalloc(sizeof(*state), GFP_KERNEL);
188 shash = crypto_alloc_shash("sha1", 0, 0);
192 state->sha1 = kmalloc(sizeof(*state->sha1) +
193 crypto_shash_descsize(shash),
196 crypto_free_shash(shash);
199 state->sha1->tfm = shash;
201 digestsize = crypto_shash_digestsize(shash);
202 if (digestsize < MPPE_MAX_KEY_LEN)
205 state->sha1_digest = kmalloc(digestsize, GFP_KERNEL);
206 if (!state->sha1_digest)
210 memcpy(state->master_key, &options[CILEN_MPPE],
211 sizeof(state->master_key));
212 memcpy(state->session_key, state->master_key,
213 sizeof(state->master_key));
216 * We defer initial key generation until mppe_init(), as mppe_alloc()
217 * is called frequently during negotiation.
220 return (void *)state;
223 kfree(state->sha1_digest);
225 crypto_free_shash(state->sha1->tfm);
234 * Deallocate space for a (de)compressor.
236 static void mppe_free(void *arg)
238 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
240 kfree(state->sha1_digest);
241 crypto_free_shash(state->sha1->tfm);
248 * Initialize (de)compressor state.
251 mppe_init(void *arg, unsigned char *options, int optlen, int unit, int debug,
252 const char *debugstr)
254 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
255 unsigned char mppe_opts;
257 if (optlen != CILEN_MPPE ||
258 options[0] != CI_MPPE || options[1] != CILEN_MPPE)
261 MPPE_CI_TO_OPTS(&options[2], mppe_opts);
262 if (mppe_opts & MPPE_OPT_128)
264 else if (mppe_opts & MPPE_OPT_40)
267 printk(KERN_WARNING "%s[%d]: unknown key length\n", debugstr,
271 if (mppe_opts & MPPE_OPT_STATEFUL)
274 /* Generate the initial session key. */
275 mppe_rekey(state, 1);
278 printk(KERN_DEBUG "%s[%d]: initialized with %d-bit %s mode\n",
279 debugstr, unit, (state->keylen == 16) ? 128 : 40,
280 (state->stateful) ? "stateful" : "stateless");
282 "%s[%d]: keys: master: %*phN initial session: %*phN\n",
284 (int)sizeof(state->master_key), state->master_key,
285 (int)sizeof(state->session_key), state->session_key);
289 * Initialize the coherency count. The initial value is not specified
290 * in RFC 3078, but we can make a reasonable assumption that it will
291 * start at 0. Setting it to the max here makes the comp/decomp code
292 * do the right thing (determined through experiment).
294 state->ccount = MPPE_CCOUNT_SPACE - 1;
297 * Note that even though we have initialized the key table, we don't
298 * set the FLUSHED bit. This is contrary to RFC 3078, sec. 3.1.
300 state->bits = MPPE_BIT_ENCRYPTED;
303 state->debug = debug;
309 mppe_comp_init(void *arg, unsigned char *options, int optlen, int unit,
310 int hdrlen, int debug)
313 return mppe_init(arg, options, optlen, unit, debug, "mppe_comp_init");
317 * We received a CCP Reset-Request (actually, we are sending a Reset-Ack),
318 * tell the compressor to rekey. Note that we MUST NOT rekey for
319 * every CCP Reset-Request; we only rekey on the next xmit packet.
320 * We might get multiple CCP Reset-Requests if our CCP Reset-Ack is lost.
321 * So, rekeying for every CCP Reset-Request is broken as the peer will not
322 * know how many times we've rekeyed. (If we rekey and THEN get another
323 * CCP Reset-Request, we must rekey again.)
325 static void mppe_comp_reset(void *arg)
327 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
329 state->bits |= MPPE_BIT_FLUSHED;
333 * Compress (encrypt) a packet.
334 * It's strange to call this a compressor, since the output is always
335 * MPPE_OVHD + 2 bytes larger than the input.
338 mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf,
339 int isize, int osize)
341 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
345 * Check that the protocol is in the range we handle.
347 proto = PPP_PROTOCOL(ibuf);
348 if (proto < 0x0021 || proto > 0x00fa)
351 /* Make sure we have enough room to generate an encrypted packet. */
352 if (osize < isize + MPPE_OVHD + 2) {
353 /* Drop the packet if we should encrypt it, but can't. */
354 printk(KERN_DEBUG "mppe_compress[%d]: osize too small! "
355 "(have: %d need: %d)\n", state->unit,
356 osize, osize + MPPE_OVHD + 2);
360 osize = isize + MPPE_OVHD + 2;
363 * Copy over the PPP header and set control bits.
365 obuf[0] = PPP_ADDRESS(ibuf);
366 obuf[1] = PPP_CONTROL(ibuf);
367 put_unaligned_be16(PPP_COMP, obuf + 2);
370 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
371 if (state->debug >= 7)
372 printk(KERN_DEBUG "mppe_compress[%d]: ccount %d\n", state->unit,
374 put_unaligned_be16(state->ccount, obuf);
376 if (!state->stateful || /* stateless mode */
377 ((state->ccount & 0xff) == 0xff) || /* "flag" packet */
378 (state->bits & MPPE_BIT_FLUSHED)) { /* CCP Reset-Request */
380 if (state->debug && state->stateful)
381 printk(KERN_DEBUG "mppe_compress[%d]: rekeying\n",
383 mppe_rekey(state, 0);
384 state->bits |= MPPE_BIT_FLUSHED;
386 obuf[0] |= state->bits;
387 state->bits &= ~MPPE_BIT_FLUSHED; /* reset for next xmit */
390 ibuf += 2; /* skip to proto field */
393 arc4_crypt(&state->arc4, obuf, ibuf, isize);
395 state->stats.unc_bytes += isize;
396 state->stats.unc_packets++;
397 state->stats.comp_bytes += osize;
398 state->stats.comp_packets++;
404 * Since every frame grows by MPPE_OVHD + 2 bytes, this is always going
405 * to look bad ... and the longer the link is up the worse it will get.
407 static void mppe_comp_stats(void *arg, struct compstat *stats)
409 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
411 *stats = state->stats;
415 mppe_decomp_init(void *arg, unsigned char *options, int optlen, int unit,
416 int hdrlen, int mru, int debug)
419 return mppe_init(arg, options, optlen, unit, debug, "mppe_decomp_init");
423 * We received a CCP Reset-Ack. Just ignore it.
425 static void mppe_decomp_reset(void *arg)
432 * Decompress (decrypt) an MPPE packet.
435 mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
438 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
440 int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED;
442 if (isize <= PPP_HDRLEN + MPPE_OVHD) {
445 "mppe_decompress[%d]: short pkt (%d)\n",
451 * Make sure we have enough room to decrypt the packet.
452 * Note that for our test we only subtract 1 byte whereas in
453 * mppe_compress() we added 2 bytes (+MPPE_OVHD);
454 * this is to account for possible PFC.
456 if (osize < isize - MPPE_OVHD - 1) {
457 printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! "
458 "(have: %d need: %d)\n", state->unit,
459 osize, isize - MPPE_OVHD - 1);
462 osize = isize - MPPE_OVHD - 2; /* assume no PFC */
464 ccount = MPPE_CCOUNT(ibuf);
465 if (state->debug >= 7)
466 printk(KERN_DEBUG "mppe_decompress[%d]: ccount %d\n",
467 state->unit, ccount);
469 /* sanity checks -- terminate with extreme prejudice */
470 if (!(MPPE_BITS(ibuf) & MPPE_BIT_ENCRYPTED)) {
472 "mppe_decompress[%d]: ENCRYPTED bit not set!\n",
474 state->sanity_errors += 100;
477 if (!state->stateful && !flushed) {
478 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in "
479 "stateless mode!\n", state->unit);
480 state->sanity_errors += 100;
483 if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) {
484 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on "
485 "flag packet!\n", state->unit);
486 state->sanity_errors += 100;
491 * Check the coherency count.
494 if (!state->stateful) {
495 /* Discard late packet */
496 if ((ccount - state->ccount) % MPPE_CCOUNT_SPACE
497 > MPPE_CCOUNT_SPACE / 2) {
498 state->sanity_errors++;
502 /* RFC 3078, sec 8.1. Rekey for every packet. */
503 while (state->ccount != ccount) {
504 mppe_rekey(state, 0);
505 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
508 /* RFC 3078, sec 8.2. */
509 if (!state->discard) {
511 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
512 if (ccount != state->ccount) {
514 * (ccount > state->ccount)
515 * Packet loss detected, enter the discard state.
516 * Signal the peer to rekey (by sending a CCP Reset-Request).
524 /* ccp.c will be silent (no additional CCP Reset-Requests). */
527 /* Rekey for every missed "flag" packet. */
528 while ((ccount & ~0xff) !=
529 (state->ccount & ~0xff)) {
530 mppe_rekey(state, 0);
533 256) % MPPE_CCOUNT_SPACE;
538 state->ccount = ccount;
540 * Another problem with RFC 3078 here. It implies that the
541 * peer need not send a Reset-Ack packet. But RFC 1962
542 * requires it. Hopefully, M$ does send a Reset-Ack; even
543 * though it isn't required for MPPE synchronization, it is
544 * required to reset CCP state.
549 mppe_rekey(state, 0);
553 * Fill in the first part of the PPP header. The protocol field
554 * comes from the decrypted data.
556 obuf[0] = PPP_ADDRESS(ibuf); /* +1 */
557 obuf[1] = PPP_CONTROL(ibuf); /* +1 */
559 ibuf += PPP_HDRLEN + MPPE_OVHD;
560 isize -= PPP_HDRLEN + MPPE_OVHD; /* -6 */
561 /* net osize: isize-4 */
564 * Decrypt the first byte in order to check if it is
565 * a compressed or uncompressed protocol field.
567 arc4_crypt(&state->arc4, obuf, ibuf, 1);
570 * Do PFC decompression.
571 * This would be nicer if we were given the actual sk_buff
572 * instead of a char *.
574 if ((obuf[0] & 0x01) != 0) {
581 /* And finally, decrypt the rest of the packet. */
582 arc4_crypt(&state->arc4, obuf + 1, ibuf + 1, isize - 1);
584 state->stats.unc_bytes += osize;
585 state->stats.unc_packets++;
586 state->stats.comp_bytes += isize;
587 state->stats.comp_packets++;
589 /* good packet credit */
590 state->sanity_errors >>= 1;
595 if (state->sanity_errors < SANITY_MAX)
598 /* Take LCP down if the peer is sending too many bogons.
599 * We don't want to do this for a single or just a few
600 * instances since it could just be due to packet corruption.
602 return DECOMP_FATALERROR;
606 * Incompressible data has arrived (this should never happen!).
607 * We should probably drop the link if the protocol is in the range
608 * of what should be encrypted. At the least, we should drop this
609 * packet. (How to do this?)
611 static void mppe_incomp(void *arg, unsigned char *ibuf, int icnt)
613 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
616 (PPP_PROTOCOL(ibuf) >= 0x0021 && PPP_PROTOCOL(ibuf) <= 0x00fa))
618 "mppe_incomp[%d]: incompressible (unencrypted) data! "
619 "(proto %04x)\n", state->unit, PPP_PROTOCOL(ibuf));
621 state->stats.inc_bytes += icnt;
622 state->stats.inc_packets++;
623 state->stats.unc_bytes += icnt;
624 state->stats.unc_packets++;
627 /*************************************************************
628 * Module interface table
629 *************************************************************/
632 * Procedures exported to if_ppp.c.
634 static struct compressor ppp_mppe = {
635 .compress_proto = CI_MPPE,
636 .comp_alloc = mppe_alloc,
637 .comp_free = mppe_free,
638 .comp_init = mppe_comp_init,
639 .comp_reset = mppe_comp_reset,
640 .compress = mppe_compress,
641 .comp_stat = mppe_comp_stats,
642 .decomp_alloc = mppe_alloc,
643 .decomp_free = mppe_free,
644 .decomp_init = mppe_decomp_init,
645 .decomp_reset = mppe_decomp_reset,
646 .decompress = mppe_decompress,
647 .incomp = mppe_incomp,
648 .decomp_stat = mppe_comp_stats,
649 .owner = THIS_MODULE,
650 .comp_extra = MPPE_PAD,
656 * Prior to allowing load, try to load the arc4 and sha1 crypto
657 * libraries. The actual use will be allocated later, but
658 * this way the module will fail to insmod if they aren't available.
661 static int __init ppp_mppe_init(void)
664 if (fips_enabled || !crypto_has_ahash("sha1", 0, CRYPTO_ALG_ASYNC))
667 sha_pad = kmalloc(sizeof(struct sha_pad), GFP_KERNEL);
670 sha_pad_init(sha_pad);
672 answer = ppp_register_compressor(&ppp_mppe);
675 printk(KERN_INFO "PPP MPPE Compression module registered\n");
682 static void __exit ppp_mppe_cleanup(void)
684 ppp_unregister_compressor(&ppp_mppe);
688 module_init(ppp_mppe_init);
689 module_exit(ppp_mppe_cleanup);