Creates the patchfile which adds the option mppe-optional to pppd (File
911-pppd-mppe-optional-new.patch, which I send as standalone in 2/2).
This fixes a "bug" of OSX to be able to connect with mppe (and not unencrypted
only) when its set as option in pptpd. Also allow mppc only connections. And
use mppe by default if set optionally on the client, instead of not using it by
default then. ("mppe-optional" in combination with "mppe required" instead of
"mppe" only)
Signed-off-by: Alexander Stadler <sa.maillists at univie.ac.at>
------
diff -urN a/8.09/package/ppp/patches/911-pppd-mppe-optional-new.patch
b/8.09/package/ppp/patches/911-pppd-mppe-optional-new.patch
--- a/8.09/package/ppp/patches/911-pppd-mppe-optional-new.patch 1970-01-01
01:00:00.000000000 +0100
+++ b/8.09/package/ppp/patches/911-pppd-mppe-optional-new.patch 2009-05-04
17:58:34.000000000 +0200
@@ -0,0 +1,151 @@
+diff -urN a/pppd/auth.c b/pppd/auth.c
+--- a/pppd/auth.c 2009-05-04 16:41:01.000000000 +0200
++++ b/pppd/auth.c 2009-05-04 16:42:46.000000000 +0200
+@@ -885,7 +885,7 @@
+ */
+ ecp_required = ecp_gotoptions[unit].required;
+ mppe_required = ccp_gotoptions[unit].mppe;
+- if (!ecp_required && !mppe_required)
++ if (!ecp_required && (!mppe_required || allow_mppe_fallback))
+ continue_networks(unit);
+ }
+
+diff -urN a/pppd/ccp.c b/pppd/ccp.c
+--- a/pppd/ccp.c 2009-05-04 16:41:13.000000000 +0200
++++ b/pppd/ccp.c 2009-05-04 16:37:32.000000000 +0200
+@@ -136,6 +136,8 @@
+ "don't allow MPPE encryption" },
+ { "-mppe", o_special_noarg, (void *)setnomppe,
+ "don't allow MPPE encryption" },
++ { "mppe-optional", o_bool, &allow_mppe_fallback,
++ "allow falling back to unencrypted connection mode", OPT_PRIO | 1 },
+ #endif /* MPPE */
+
+ { NULL }
+@@ -623,8 +625,13 @@
+
+ #ifdef MPPE
+ if (ccp_wantoptions[unit].mppe) {
+- error("MPPE required but peer negotiation failed");
+- lcp_close(unit, "MPPE required but peer negotiation failed");
++ if(!allow_mppe_fallback) {
++ error("MPPE required but peer negotiation failed");
++ lcp_close(unit, "MPPE required but peer negotiation failed");
++ } else {
++ error("MPPE required but peer negotiation failed. "
++ "Falling back and disabling MPPE");
++ }
+ }
+ #endif /* MPPE */
+ }
+@@ -669,22 +676,41 @@
+ auth_mschap_bits >>= 1;
+ } while (auth_mschap_bits);
+ if (numbits > 1) {
+- error("MPPE required, but auth done in both directions.");
+- lcp_close(f->unit, "MPPE required but not available");
+- return;
++ if(!allow_mppe_fallback) {
++ error("MPPE required, but auth done in both directions.");
++ lcp_close(f->unit, "MPPE required but not available");
++ return;
++ } else {
++ go->mppe = 0;
++ error("MPPE required, but auth done in both directions. "
++ "Falling back and disabling MPPE");
++ }
+ }
+ if (!numbits) {
+- error("MPPE required, but MS-CHAP[v2] auth not performed.");
+- lcp_close(f->unit, "MPPE required but not available");
+- return;
++ if(!allow_mppe_fallback) {
++ error("MPPE required, but MS-CHAP[v2] auth not performed.");
++ lcp_close(f->unit, "MPPE required but not available");
++ return;
++ } else {
++ go->mppe = 0;
++ error("MPPE required, but MS-CHAP[v2] auth not performed. "
++ "Falling back and disabling MPPE");
++ }
+ }
+
+ /* A plugin (eg radius) may not have obtained key material. */
+ if (!mppe_keys_set) {
+- error("MPPE required, but keys are not available. "
+- "Possible plugin problem?");
+- lcp_close(f->unit, "MPPE required but not available");
+- return;
++ if(!allow_mppe_fallback) {
++ error("MPPE required, but keys are not available. "
++ "Possible plugin problem?");
++ lcp_close(f->unit, "MPPE required but not available");
++ return;
++ } else {
++ go->mppe = 0;
++ error("MPPE required, but keys are not available. "
++ "Possible plugin problem? "
++ "Falling back and disabling MPPE");
++ }
+ }
+ }
+
+@@ -1142,8 +1168,14 @@
+ so we close connection */
+ wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
+ wo->mppe_56 = wo->mppe_128 = 0;
+- lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
+- "key length");
++ if(!allow_mppe_fallback) {
++ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE
"
++ "key length");
++ } else {
++ try.mppe = 0;
++ error("MPPE required but cannot negotioage MPPE key length.
"
++ "Falling back and disabling MPPE");
++ }
+ }
+ }
+ if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
+@@ -1283,8 +1315,14 @@
+ if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
+ wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
+ wo->mppe_56 = wo->mppe_128 = 0;
+- lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
+- "key length");
++ if(!allow_mppe_fallback) {
++ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE
"
++ "key length");
++ } else {
++ try.mppe = 0;
++ error("MPPE required but cannot negotioage MPPE key length.
"
++ "Falling back and disabling MPPE");
++ }
+ }
+ }
+ p += CILEN_MPPE;
+diff -urN a/pppd/ccp.h b/pppd/ccp.h
+--- a/pppd/ccp.h 2009-05-04 16:41:13.000000000 +0200
++++ b/pppd/ccp.h 2009-05-04 16:42:46.000000000 +0200
+@@ -51,6 +51,8 @@
+ short method; /* code for chosen compression method */
+ } ccp_options;
+
++bool allow_mppe_fallback;
++
+ extern fsm ccp_fsm[];
+ extern ccp_options ccp_wantoptions[];
+ extern ccp_options ccp_gotoptions[];
+diff -urN a/pppd/pppd.8 b/pppd/pppd.8
+--- a/pppd/pppd.8 2009-05-04 16:41:13.000000000 +0200
++++ b/pppd/pppd.8 2009-05-04 16:42:46.000000000 +0200
+@@ -804,6 +804,9 @@
+ .B nomppe
+ Disables MPPE (Microsoft Point to Point Encryption).
+ .TP
++.B mppe\-optional
++Makes MPPE optional, allowing both MPPE and non-MPPE clients
++.TP
+ .B nompshortseq
+ Disables the use of short (12-bit) sequence numbers in the PPP
+ multilink protocol, forcing the use of 24-bit sequence numbers. This
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
