Merge pull request #165 from pali/lcp

[ppp.git] / pppd / ccp.c

diff --git a/pppd/ccp.c b/pppd/ccp.c
index bbdaad66490c58da6e17f01fcc7916e517c51f46..dbc567e3c037b608b62a44039f1a66b547dd0dd5 100644 (file)
--- a/pppd/ccp.c
+++ b/pppd/ccp.c
@@ -10,16 +10,11 @@
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. The name(s) of the authors of this software must not be used to
+ * 2. The name(s) of the authors of this software must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission.
  *
- * 4. Redistributions of any form whatsoever must retain the following
+ * 3. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by Paul Mackerras
  *     <paulus@samba.org>".
@@ -33,7 +28,7 @@
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define RCSID  "$Id: ccp.c,v 1.46 2003/05/01 12:30:28 paulus Exp $"
+#define RCSID  "$Id: ccp.c,v 1.50 2005/06/26 19:34:41 carlsonj Exp $"
 
 #include <stdlib.h>
 #include <string.h>
@@ -48,7 +43,6 @@
 #include "lcp.h"       /* lcp_close(), lcp_fsm */
 #endif
 
-static const char rcsid[] = RCSID;
 
 /*
  * Unfortunately there is a bug in zlib which means that using a
@@ -214,7 +208,7 @@ static void ccp_resetci __P((fsm *));
 static int  ccp_cilen __P((fsm *));
 static void ccp_addci __P((fsm *, u_char *, int *));
 static int  ccp_ackci __P((fsm *, u_char *, int));
-static int  ccp_nakci __P((fsm *, u_char *, int));
+static int  ccp_nakci __P((fsm *, u_char *, int, int));
 static int  ccp_rejci __P((fsm *, u_char *, int));
 static int  ccp_reqci __P((fsm *, u_char *, int *, int));
 static void ccp_up __P((fsm *));
@@ -545,6 +539,9 @@ ccp_resetci(f)
     if (go->mppe) {
        ccp_options *ao = &ccp_allowoptions[f->unit];
        int auth_mschap_bits = auth_done[f->unit];
+#ifdef USE_EAPTLS
+       int auth_eap_bits = auth_done[f->unit];
+#endif
        int numbits;
 
        /*
@@ -572,8 +569,23 @@ ccp_resetci(f)
            lcp_close(f->unit, "MPPE required but not available");
            return;
        }
+
+#ifdef USE_EAPTLS
+    /*
+     * MPPE is also possible in combination with EAP-TLS.
+     * It is not possible to detect if we're doing EAP or EAP-TLS
+     * at this stage, hence we accept all forms of EAP. If TLS is
+     * not used then the MPPE keys will not be derived anyway.
+     */
+       /* Leave only the eap auth bits set */
+       auth_eap_bits &= (EAP_WITHPEER | EAP_PEER );
+
+       if ((numbits == 0) && (auth_eap_bits == 0)) {
+           error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed.");
+#else
        if (!numbits) {
            error("MPPE required, but MS-CHAP[v2] auth not performed.");
+#endif
            lcp_close(f->unit, "MPPE required but not available");
            return;
        }
@@ -681,7 +693,8 @@ ccp_cilen(f)
     ccp_options *go = &ccp_gotoptions[f->unit];
 
     return (go->bsd_compress? CILEN_BSD_COMPRESS: 0)
-       + (go->deflate? CILEN_DEFLATE: 0)
+       + (go->deflate && go->deflate_correct? CILEN_DEFLATE: 0)
+       + (go->deflate && go->deflate_draft? CILEN_DEFLATE: 0)
        + (go->predictor_1? CILEN_PREDICTOR_1: 0)
        + (go->predictor_2? CILEN_PREDICTOR_2: 0)
        + (go->mppe? CILEN_MPPE: 0);
@@ -899,10 +912,11 @@ ccp_ackci(f, p, len)
  * Returns 1 iff the nak was OK.
  */
 static int
-ccp_nakci(f, p, len)
+ccp_nakci(f, p, len, treat_as_reject)
     fsm *f;
     u_char *p;
     int len;
+    int treat_as_reject;
 {
     ccp_options *go = &ccp_gotoptions[f->unit];
     ccp_options no;            /* options we've seen already */
@@ -1163,8 +1177,11 @@ ccp_reqci(f, p, lenp, dont_nak)
                    }
                } else {
                    /* Neither are set. */
-                   newret = CONFREJ;
-                   break;
+                   /* We cannot accept this.  */
+                   newret = CONFNAK;
+                   /* Give the peer our idea of what can be used,
+                      so it can choose and confirm */
+                   ho->mppe = ao->mppe;
                }
 
                /* rebuild the opts */