Adds the option mppe-optional to pppd.
This fixes a "bug" of OSX to be able to connect with mppe (and not unencrypted
only) when its set as option in pptpd. Also allow mppc only connections. And
use mppe by default if set optionally on the client, instead of not using it by
default then. ("mppe-optional" in combination with "mppe required" instead of
"mppe" only)
Signed-off-by: Alexander Stadler <sa.maillists at univie.ac.at>
------
diff -urN a/pppd/auth.c b/pppd/auth.c
--- a/pppd/auth.c 2009-05-04 16:41:01.000000000 +0200
+++ b/pppd/auth.c 2009-05-04 16:42:46.000000000 +0200
@@ -885,7 +885,7 @@
*/
ecp_required = ecp_gotoptions[unit].required;
mppe_required = ccp_gotoptions[unit].mppe;
- if (!ecp_required && !mppe_required)
+ if (!ecp_required && (!mppe_required || allow_mppe_fallback))
continue_networks(unit);
}
diff -urN a/pppd/ccp.c b/pppd/ccp.c
--- a/pppd/ccp.c 2009-05-04 16:41:13.000000000 +0200
+++ b/pppd/ccp.c 2009-05-04 16:37:32.000000000 +0200
@@ -136,6 +136,8 @@
"don't allow MPPE encryption" },
{ "-mppe", o_special_noarg, (void *)setnomppe,
"don't allow MPPE encryption" },
+ { "mppe-optional", o_bool, &allow_mppe_fallback,
+ "allow falling back to unencrypted connection mode", OPT_PRIO | 1 },
#endif /* MPPE */
{ NULL }
@@ -623,8 +625,13 @@
#ifdef MPPE
if (ccp_wantoptions[unit].mppe) {
- error("MPPE required but peer negotiation failed");
- lcp_close(unit, "MPPE required but peer negotiation failed");
+ if(!allow_mppe_fallback) {
+ error("MPPE required but peer negotiation failed");
+ lcp_close(unit, "MPPE required but peer negotiation failed");
+ } else {
+ error("MPPE required but peer negotiation failed. "
+ "Falling back and disabling MPPE");
+ }
}
#endif /* MPPE */
}
@@ -669,22 +676,41 @@
auth_mschap_bits >>= 1;
} while (auth_mschap_bits);
if (numbits > 1) {
- error("MPPE required, but auth done in both directions.");
- lcp_close(f->unit, "MPPE required but not available");
- return;
+ if(!allow_mppe_fallback) {
+ error("MPPE required, but auth done in both directions.");
+ lcp_close(f->unit, "MPPE required but not available");
+ return;
+ } else {
+ go->mppe = 0;
+ error("MPPE required, but auth done in both directions. "
+ "Falling back and disabling MPPE");
+ }
}
if (!numbits) {
- error("MPPE required, but MS-CHAP[v2] auth not performed.");
- lcp_close(f->unit, "MPPE required but not available");
- return;
+ if(!allow_mppe_fallback) {
+ error("MPPE required, but MS-CHAP[v2] auth not performed.");
+ lcp_close(f->unit, "MPPE required but not available");
+ return;
+ } else {
+ go->mppe = 0;
+ error("MPPE required, but MS-CHAP[v2] auth not performed. "
+ "Falling back and disabling MPPE");
+ }
}
/* A plugin (eg radius) may not have obtained key material. */
if (!mppe_keys_set) {
- error("MPPE required, but keys are not available. "
- "Possible plugin problem?");
- lcp_close(f->unit, "MPPE required but not available");
- return;
+ if(!allow_mppe_fallback) {
+ error("MPPE required, but keys are not available. "
+ "Possible plugin problem?");
+ lcp_close(f->unit, "MPPE required but not available");
+ return;
+ } else {
+ go->mppe = 0;
+ error("MPPE required, but keys are not available. "
+ "Possible plugin problem? "
+ "Falling back and disabling MPPE");
+ }
}
}
@@ -1142,8 +1168,14 @@
so we close connection */
wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
wo->mppe_56 = wo->mppe_128 = 0;
- lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
- "key length");
+ if(!allow_mppe_fallback) {
+ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE
"
+ "key length");
+ } else {
+ try.mppe = 0;
+ error("MPPE required but cannot negotioage MPPE key length.
"
+ "Falling back and disabling MPPE");
+ }
}
}
if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
@@ -1283,8 +1315,14 @@
if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
wo->mppe_56 = wo->mppe_128 = 0;
- lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
- "key length");
+ if(!allow_mppe_fallback) {
+ lcp_close(f->unit, "MPPE required but cannot negotiate MPPE
"
+ "key length");
+ } else {
+ try.mppe = 0;
+ error("MPPE required but cannot negotioage MPPE key length.
"
+ "Falling back and disabling MPPE");
+ }
}
}
p += CILEN_MPPE;
diff -urN a/pppd/ccp.h b/pppd/ccp.h
--- a/pppd/ccp.h 2009-05-04 16:41:13.000000000 +0200
+++ b/pppd/ccp.h 2009-05-04 16:42:46.000000000 +0200
@@ -51,6 +51,8 @@
short method; /* code for chosen compression method */
} ccp_options;
+bool allow_mppe_fallback;
+
extern fsm ccp_fsm[];
extern ccp_options ccp_wantoptions[];
extern ccp_options ccp_gotoptions[];
diff -urN a/pppd/pppd.8 b/pppd/pppd.8
--- a/pppd/pppd.8 2009-05-04 16:41:13.000000000 +0200
+++ b/pppd/pppd.8 2009-05-04 16:42:46.000000000 +0200
@@ -804,6 +804,9 @@
.B nomppe
Disables MPPE (Microsoft Point to Point Encryption).
.TP
+.B mppe\-optional
+Makes MPPE optional, allowing both MPPE and non-MPPE clients
+.TP
.B nompshortseq
Disables the use of short (12-bit) sequence numbers in the PPP
multilink protocol, forcing the use of 24-bit sequence numbers. This
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
