2 * ppp_mppe.c - interface MPPE to the PPP code.
3 * This version is for use with Linux kernel 2.6.14+
5 * By Frank Cusack <fcusack@fcusack.com>.
6 * Copyright (c) 2002,2003,2004 Google, Inc.
10 * Permission to use, copy, modify, and distribute this software and its
11 * documentation is hereby granted, provided that the above copyright
12 * notice appears in all copies. This software is provided without any
13 * warranty, express or implied.
15 * ALTERNATIVELY, provided that this notice is retained in full, this product
16 * may be distributed under the terms of the GNU General Public License (GPL),
17 * in which case the provisions of the GPL apply INSTEAD OF those given above.
19 * This program is free software; you can redistribute it and/or modify
20 * it under the terms of the GNU General Public License as published by
21 * the Free Software Foundation; either version 2 of the License, or
22 * (at your option) any later version.
24 * This program is distributed in the hope that it will be useful,
25 * but WITHOUT ANY WARRANTY; without even the implied warranty of
26 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27 * GNU General Public License for more details.
29 * You should have received a copy of the GNU General Public License
30 * along with this program; if not, see <http://www.gnu.org/licenses/>.
34 * 08/12/05 - Matt Domsch <Matt_Domsch@dell.com>
35 * Only need extra skb padding on transmit, not receive.
36 * 06/18/04 - Matt Domsch <Matt_Domsch@dell.com>, Oleg Makarenko <mole@quadra.ru>
37 * Use Linux kernel 2.6 arc4 and sha1 routines rather than
39 * 2/15/04 - TS: added #include <version.h> and testing for Kernel
40 * version before using
41 * MOD_DEC_USAGE_COUNT/MOD_INC_USAGE_COUNT which are
45 #include <linux/err.h>
46 #include <linux/module.h>
47 #include <linux/kernel.h>
48 #include <linux/init.h>
49 #include <linux/types.h>
50 #include <linux/slab.h>
51 #include <linux/string.h>
52 #include <linux/crypto.h>
54 #include <linux/ppp_defs.h>
55 #include <linux/ppp-comp.h>
56 #include <linux/scatterlist.h>
57 #include <asm/unaligned.h>
61 MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>");
62 MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support");
63 MODULE_LICENSE("Dual BSD/GPL");
64 MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE));
65 MODULE_SOFTDEP("pre: arc4");
66 MODULE_VERSION("1.0.2");
69 setup_sg(struct scatterlist *sg, const void *address, unsigned int length)
71 sg_set_buf(sg, address, length);
75 #define SHA1_PAD_SIZE 40
78 * kernel crypto API needs its arguments to be in kmalloc'd memory, not in the module
79 * static data area. That means sha_pad needs to be kmalloc'd.
83 unsigned char sha_pad1[SHA1_PAD_SIZE];
84 unsigned char sha_pad2[SHA1_PAD_SIZE];
86 static struct sha_pad *sha_pad;
88 static inline void sha_pad_init(struct sha_pad *shapad)
90 memset(shapad->sha_pad1, 0x00, sizeof(shapad->sha_pad1));
91 memset(shapad->sha_pad2, 0xF2, sizeof(shapad->sha_pad2));
95 * State for an MPPE (de)compressor.
97 struct ppp_mppe_state {
98 struct crypto_blkcipher *arc4;
99 struct crypto_hash *sha1;
100 unsigned char *sha1_digest;
101 unsigned char master_key[MPPE_MAX_KEY_LEN];
102 unsigned char session_key[MPPE_MAX_KEY_LEN];
103 unsigned keylen; /* key length in bytes */
104 /* NB: 128-bit == 16, 40-bit == 8! */
105 /* If we want to support 56-bit, */
106 /* the unit has to change to bits */
107 unsigned char bits; /* MPPE control bits */
108 unsigned ccount; /* 12-bit coherency count (seqno) */
109 unsigned stateful; /* stateful mode flag */
110 int discard; /* stateful mode packet loss flag */
111 int sanity_errors; /* take down LCP if too many */
114 struct compstat stats;
117 /* struct ppp_mppe_state.bits definitions */
118 #define MPPE_BIT_A 0x80 /* Encryption table were (re)inititalized */
119 #define MPPE_BIT_B 0x40 /* MPPC only (not implemented) */
120 #define MPPE_BIT_C 0x20 /* MPPC only (not implemented) */
121 #define MPPE_BIT_D 0x10 /* This is an encrypted frame */
123 #define MPPE_BIT_FLUSHED MPPE_BIT_A
124 #define MPPE_BIT_ENCRYPTED MPPE_BIT_D
126 #define MPPE_BITS(p) ((p)[4] & 0xf0)
127 #define MPPE_CCOUNT(p) ((((p)[4] & 0x0f) << 8) + (p)[5])
128 #define MPPE_CCOUNT_SPACE 0x1000 /* The size of the ccount space */
130 #define MPPE_OVHD 2 /* MPPE overhead/packet */
131 #define SANITY_MAX 1600 /* Max bogon factor we will tolerate */
134 * Key Derivation, from RFC 3078, RFC 3079.
135 * Equivalent to Get_Key() for MS-CHAP as described in RFC 3079.
137 static void get_new_key_from_sha(struct ppp_mppe_state * state)
139 struct hash_desc desc;
140 struct scatterlist sg[4];
143 sg_init_table(sg, 4);
145 nbytes = setup_sg(&sg[0], state->master_key, state->keylen);
146 nbytes += setup_sg(&sg[1], sha_pad->sha_pad1,
147 sizeof(sha_pad->sha_pad1));
148 nbytes += setup_sg(&sg[2], state->session_key, state->keylen);
149 nbytes += setup_sg(&sg[3], sha_pad->sha_pad2,
150 sizeof(sha_pad->sha_pad2));
152 desc.tfm = state->sha1;
155 crypto_hash_digest(&desc, sg, nbytes, state->sha1_digest);
159 * Perform the MPPE rekey algorithm, from RFC 3078, sec. 7.3.
160 * Well, not what's written there, but rather what they meant.
162 static void mppe_rekey(struct ppp_mppe_state * state, int initial_key)
164 struct scatterlist sg_in[1], sg_out[1];
165 struct blkcipher_desc desc = { .tfm = state->arc4 };
167 get_new_key_from_sha(state);
169 crypto_blkcipher_setkey(state->arc4, state->sha1_digest,
171 sg_init_table(sg_in, 1);
172 sg_init_table(sg_out, 1);
173 setup_sg(sg_in, state->sha1_digest, state->keylen);
174 setup_sg(sg_out, state->session_key, state->keylen);
175 if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
176 state->keylen) != 0) {
177 printk(KERN_WARNING "mppe_rekey: cipher_encrypt failed\n");
180 memcpy(state->session_key, state->sha1_digest, state->keylen);
182 if (state->keylen == 8) {
184 state->session_key[0] = 0xd1;
185 state->session_key[1] = 0x26;
186 state->session_key[2] = 0x9e;
188 crypto_blkcipher_setkey(state->arc4, state->session_key, state->keylen);
192 * Allocate space for a (de)compressor.
194 static void *mppe_alloc(unsigned char *options, int optlen)
196 struct ppp_mppe_state *state;
197 unsigned int digestsize;
199 if (optlen != CILEN_MPPE + sizeof(state->master_key) ||
200 options[0] != CI_MPPE || options[1] != CILEN_MPPE)
203 state = kzalloc(sizeof(*state), GFP_KERNEL);
208 state->arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
209 if (IS_ERR(state->arc4)) {
214 state->sha1 = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC);
215 if (IS_ERR(state->sha1)) {
220 digestsize = crypto_hash_digestsize(state->sha1);
221 if (digestsize < MPPE_MAX_KEY_LEN)
224 state->sha1_digest = kmalloc(digestsize, GFP_KERNEL);
225 if (!state->sha1_digest)
229 memcpy(state->master_key, &options[CILEN_MPPE],
230 sizeof(state->master_key));
231 memcpy(state->session_key, state->master_key,
232 sizeof(state->master_key));
235 * We defer initial key generation until mppe_init(), as mppe_alloc()
236 * is called frequently during negotiation.
239 return (void *)state;
242 if (state->sha1_digest)
243 kfree(state->sha1_digest);
245 crypto_free_hash(state->sha1);
247 crypto_free_blkcipher(state->arc4);
254 * Deallocate space for a (de)compressor.
256 static void mppe_free(void *arg)
258 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
260 if (state->sha1_digest)
261 kfree(state->sha1_digest);
263 crypto_free_hash(state->sha1);
265 crypto_free_blkcipher(state->arc4);
271 * Initialize (de)compressor state.
274 mppe_init(void *arg, unsigned char *options, int optlen, int unit, int debug,
275 const char *debugstr)
277 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
278 unsigned char mppe_opts;
280 if (optlen != CILEN_MPPE ||
281 options[0] != CI_MPPE || options[1] != CILEN_MPPE)
284 MPPE_CI_TO_OPTS(&options[2], mppe_opts);
285 if (mppe_opts & MPPE_OPT_128)
287 else if (mppe_opts & MPPE_OPT_40)
290 printk(KERN_WARNING "%s[%d]: unknown key length\n", debugstr,
294 if (mppe_opts & MPPE_OPT_STATEFUL)
297 /* Generate the initial session key. */
298 mppe_rekey(state, 1);
302 char mkey[sizeof(state->master_key) * 2 + 1];
303 char skey[sizeof(state->session_key) * 2 + 1];
305 printk(KERN_DEBUG "%s[%d]: initialized with %d-bit %s mode\n",
306 debugstr, unit, (state->keylen == 16) ? 128 : 40,
307 (state->stateful) ? "stateful" : "stateless");
309 for (i = 0; i < sizeof(state->master_key); i++)
310 sprintf(mkey + i * 2, "%02x", state->master_key[i]);
311 for (i = 0; i < sizeof(state->session_key); i++)
312 sprintf(skey + i * 2, "%02x", state->session_key[i]);
314 "%s[%d]: keys: master: %s initial session: %s\n",
315 debugstr, unit, mkey, skey);
319 * Initialize the coherency count. The initial value is not specified
320 * in RFC 3078, but we can make a reasonable assumption that it will
321 * start at 0. Setting it to the max here makes the comp/decomp code
322 * do the right thing (determined through experiment).
324 state->ccount = MPPE_CCOUNT_SPACE - 1;
327 * Note that even though we have initialized the key table, we don't
328 * set the FLUSHED bit. This is contrary to RFC 3078, sec. 3.1.
330 state->bits = MPPE_BIT_ENCRYPTED;
333 state->debug = debug;
339 mppe_comp_init(void *arg, unsigned char *options, int optlen, int unit,
340 int hdrlen, int debug)
343 return mppe_init(arg, options, optlen, unit, debug, "mppe_comp_init");
347 * We received a CCP Reset-Request (actually, we are sending a Reset-Ack),
348 * tell the compressor to rekey. Note that we MUST NOT rekey for
349 * every CCP Reset-Request; we only rekey on the next xmit packet.
350 * We might get multiple CCP Reset-Requests if our CCP Reset-Ack is lost.
351 * So, rekeying for every CCP Reset-Request is broken as the peer will not
352 * know how many times we've rekeyed. (If we rekey and THEN get another
353 * CCP Reset-Request, we must rekey again.)
355 static void mppe_comp_reset(void *arg)
357 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
359 state->bits |= MPPE_BIT_FLUSHED;
363 * Compress (encrypt) a packet.
364 * It's strange to call this a compressor, since the output is always
365 * MPPE_OVHD + 2 bytes larger than the input.
368 mppe_compress(void *arg, unsigned char *ibuf, unsigned char *obuf,
369 int isize, int osize)
371 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
372 struct blkcipher_desc desc = { .tfm = state->arc4 };
374 struct scatterlist sg_in[1], sg_out[1];
377 * Check that the protocol is in the range we handle.
379 proto = PPP_PROTOCOL(ibuf);
380 if (proto < 0x0021 || proto > 0x00fa)
383 /* Make sure we have enough room to generate an encrypted packet. */
384 if (osize < isize + MPPE_OVHD + 2) {
385 /* Drop the packet if we should encrypt it, but can't. */
386 printk(KERN_DEBUG "mppe_compress[%d]: osize too small! "
387 "(have: %d need: %d)\n", state->unit,
388 osize, osize + MPPE_OVHD + 2);
392 osize = isize + MPPE_OVHD + 2;
395 * Copy over the PPP header and set control bits.
397 obuf[0] = PPP_ADDRESS(ibuf);
398 obuf[1] = PPP_CONTROL(ibuf);
399 put_unaligned_be16(PPP_COMP, obuf + 2);
402 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
403 if (state->debug >= 7)
404 printk(KERN_DEBUG "mppe_compress[%d]: ccount %d\n", state->unit,
406 put_unaligned_be16(state->ccount, obuf);
408 if (!state->stateful || /* stateless mode */
409 ((state->ccount & 0xff) == 0xff) || /* "flag" packet */
410 (state->bits & MPPE_BIT_FLUSHED)) { /* CCP Reset-Request */
412 if (state->debug && state->stateful)
413 printk(KERN_DEBUG "mppe_compress[%d]: rekeying\n",
415 mppe_rekey(state, 0);
416 state->bits |= MPPE_BIT_FLUSHED;
418 obuf[0] |= state->bits;
419 state->bits &= ~MPPE_BIT_FLUSHED; /* reset for next xmit */
422 ibuf += 2; /* skip to proto field */
426 sg_init_table(sg_in, 1);
427 sg_init_table(sg_out, 1);
428 setup_sg(sg_in, ibuf, isize);
429 setup_sg(sg_out, obuf, osize);
430 if (crypto_blkcipher_encrypt(&desc, sg_out, sg_in, isize) != 0) {
431 printk(KERN_DEBUG "crypto_cypher_encrypt failed\n");
435 state->stats.unc_bytes += isize;
436 state->stats.unc_packets++;
437 state->stats.comp_bytes += osize;
438 state->stats.comp_packets++;
444 * Since every frame grows by MPPE_OVHD + 2 bytes, this is always going
445 * to look bad ... and the longer the link is up the worse it will get.
447 static void mppe_comp_stats(void *arg, struct compstat *stats)
449 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
451 *stats = state->stats;
455 mppe_decomp_init(void *arg, unsigned char *options, int optlen, int unit,
456 int hdrlen, int mru, int debug)
459 return mppe_init(arg, options, optlen, unit, debug, "mppe_decomp_init");
463 * We received a CCP Reset-Ack. Just ignore it.
465 static void mppe_decomp_reset(void *arg)
472 * Decompress (decrypt) an MPPE packet.
475 mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
478 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
479 struct blkcipher_desc desc = { .tfm = state->arc4 };
481 int flushed = MPPE_BITS(ibuf) & MPPE_BIT_FLUSHED;
482 struct scatterlist sg_in[1], sg_out[1];
484 if (isize <= PPP_HDRLEN + MPPE_OVHD) {
487 "mppe_decompress[%d]: short pkt (%d)\n",
493 * Make sure we have enough room to decrypt the packet.
494 * Note that for our test we only subtract 1 byte whereas in
495 * mppe_compress() we added 2 bytes (+MPPE_OVHD);
496 * this is to account for possible PFC.
498 if (osize < isize - MPPE_OVHD - 1) {
499 printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! "
500 "(have: %d need: %d)\n", state->unit,
501 osize, isize - MPPE_OVHD - 1);
504 osize = isize - MPPE_OVHD - 2; /* assume no PFC */
506 ccount = MPPE_CCOUNT(ibuf);
507 if (state->debug >= 7)
508 printk(KERN_DEBUG "mppe_decompress[%d]: ccount %d\n",
509 state->unit, ccount);
511 /* sanity checks -- terminate with extreme prejudice */
512 if (!(MPPE_BITS(ibuf) & MPPE_BIT_ENCRYPTED)) {
514 "mppe_decompress[%d]: ENCRYPTED bit not set!\n",
516 state->sanity_errors += 100;
519 if (!state->stateful && !flushed) {
520 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set in "
521 "stateless mode!\n", state->unit);
522 state->sanity_errors += 100;
525 if (state->stateful && ((ccount & 0xff) == 0xff) && !flushed) {
526 printk(KERN_DEBUG "mppe_decompress[%d]: FLUSHED bit not set on "
527 "flag packet!\n", state->unit);
528 state->sanity_errors += 100;
533 * Check the coherency count.
536 if (!state->stateful) {
537 /* Discard late packet */
538 if ((ccount - state->ccount) % MPPE_CCOUNT_SPACE
539 > MPPE_CCOUNT_SPACE / 2) {
540 state->sanity_errors++;
544 /* RFC 3078, sec 8.1. Rekey for every packet. */
545 while (state->ccount != ccount) {
546 mppe_rekey(state, 0);
547 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
550 /* RFC 3078, sec 8.2. */
551 if (!state->discard) {
553 state->ccount = (state->ccount + 1) % MPPE_CCOUNT_SPACE;
554 if (ccount != state->ccount) {
556 * (ccount > state->ccount)
557 * Packet loss detected, enter the discard state.
558 * Signal the peer to rekey (by sending a CCP Reset-Request).
566 /* ccp.c will be silent (no additional CCP Reset-Requests). */
569 /* Rekey for every missed "flag" packet. */
570 while ((ccount & ~0xff) !=
571 (state->ccount & ~0xff)) {
572 mppe_rekey(state, 0);
575 256) % MPPE_CCOUNT_SPACE;
580 state->ccount = ccount;
582 * Another problem with RFC 3078 here. It implies that the
583 * peer need not send a Reset-Ack packet. But RFC 1962
584 * requires it. Hopefully, M$ does send a Reset-Ack; even
585 * though it isn't required for MPPE synchronization, it is
586 * required to reset CCP state.
591 mppe_rekey(state, 0);
595 * Fill in the first part of the PPP header. The protocol field
596 * comes from the decrypted data.
598 obuf[0] = PPP_ADDRESS(ibuf); /* +1 */
599 obuf[1] = PPP_CONTROL(ibuf); /* +1 */
601 ibuf += PPP_HDRLEN + MPPE_OVHD;
602 isize -= PPP_HDRLEN + MPPE_OVHD; /* -6 */
603 /* net osize: isize-4 */
606 * Decrypt the first byte in order to check if it is
607 * a compressed or uncompressed protocol field.
609 sg_init_table(sg_in, 1);
610 sg_init_table(sg_out, 1);
611 setup_sg(sg_in, ibuf, 1);
612 setup_sg(sg_out, obuf, 1);
613 if (crypto_blkcipher_decrypt(&desc, sg_out, sg_in, 1) != 0) {
614 printk(KERN_DEBUG "crypto_cypher_decrypt failed\n");
619 * Do PFC decompression.
620 * This would be nicer if we were given the actual sk_buff
621 * instead of a char *.
623 if ((obuf[0] & 0x01) != 0) {
630 /* And finally, decrypt the rest of the packet. */
631 setup_sg(sg_in, ibuf + 1, isize - 1);
632 setup_sg(sg_out, obuf + 1, osize - 1);
633 if (crypto_blkcipher_decrypt(&desc, sg_out, sg_in, isize - 1)) {
634 printk(KERN_DEBUG "crypto_cypher_decrypt failed\n");
638 state->stats.unc_bytes += osize;
639 state->stats.unc_packets++;
640 state->stats.comp_bytes += isize;
641 state->stats.comp_packets++;
643 /* good packet credit */
644 state->sanity_errors >>= 1;
649 if (state->sanity_errors < SANITY_MAX)
652 /* Take LCP down if the peer is sending too many bogons.
653 * We don't want to do this for a single or just a few
654 * instances since it could just be due to packet corruption.
656 return DECOMP_FATALERROR;
660 * Incompressible data has arrived (this should never happen!).
661 * We should probably drop the link if the protocol is in the range
662 * of what should be encrypted. At the least, we should drop this
663 * packet. (How to do this?)
665 static void mppe_incomp(void *arg, unsigned char *ibuf, int icnt)
667 struct ppp_mppe_state *state = (struct ppp_mppe_state *) arg;
670 (PPP_PROTOCOL(ibuf) >= 0x0021 && PPP_PROTOCOL(ibuf) <= 0x00fa))
672 "mppe_incomp[%d]: incompressible (unencrypted) data! "
673 "(proto %04x)\n", state->unit, PPP_PROTOCOL(ibuf));
675 state->stats.inc_bytes += icnt;
676 state->stats.inc_packets++;
677 state->stats.unc_bytes += icnt;
678 state->stats.unc_packets++;
681 /*************************************************************
682 * Module interface table
683 *************************************************************/
686 * Procedures exported to if_ppp.c.
688 static struct compressor ppp_mppe = {
689 .compress_proto = CI_MPPE,
690 .comp_alloc = mppe_alloc,
691 .comp_free = mppe_free,
692 .comp_init = mppe_comp_init,
693 .comp_reset = mppe_comp_reset,
694 .compress = mppe_compress,
695 .comp_stat = mppe_comp_stats,
696 .decomp_alloc = mppe_alloc,
697 .decomp_free = mppe_free,
698 .decomp_init = mppe_decomp_init,
699 .decomp_reset = mppe_decomp_reset,
700 .decompress = mppe_decompress,
701 .incomp = mppe_incomp,
702 .decomp_stat = mppe_comp_stats,
703 .owner = THIS_MODULE,
704 .comp_extra = MPPE_PAD,
710 * Prior to allowing load, try to load the arc4 and sha1 crypto
711 * libraries. The actual use will be allocated later, but
712 * this way the module will fail to insmod if they aren't available.
715 static int __init ppp_mppe_init(void)
718 if (!(crypto_has_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC) &&
719 crypto_has_hash("sha1", 0, CRYPTO_ALG_ASYNC)))
722 sha_pad = kmalloc(sizeof(struct sha_pad), GFP_KERNEL);
725 sha_pad_init(sha_pad);
727 answer = ppp_register_compressor(&ppp_mppe);
730 printk(KERN_INFO "PPP MPPE Compression module registered\n");
737 static void __exit ppp_mppe_cleanup(void)
739 ppp_unregister_compressor(&ppp_mppe);
743 module_init(ppp_mppe_init);
744 module_exit(ppp_mppe_cleanup);