ppp/patches/201-mppe_mppc_1.1.patch

   1 --- a/include/linux/ppp-comp.h
   2 +++ b/include/linux/ppp-comp.h
   3 @@ -36,7 +36,7 @@
   4   */
   5
   6  /*
   7 - *  ==FILEVERSION 20020319==
   8 + *  ==FILEVERSION 20020715==
   9   *
  10   *  NOTE TO MAINTAINERS:
  11   *     If you modify this file at all, please set the above date.
  12 @@ -201,6 +201,33 @@ struct compressor {
  13  #define CI_MPPE                        18      /* config option for MPPE */
  14  #define CILEN_MPPE             6       /* length of config option */
  15
  16 +/* MPPE/MPPC definitions by J.D.*/
  17 +#define MPPE_STATELESS          MPPE_H_BIT     /* configuration bit H */
  18 +#define MPPE_40BIT              MPPE_L_BIT     /* configuration bit L */
  19 +#define MPPE_56BIT              MPPE_M_BIT     /* configuration bit M */
  20 +#define MPPE_128BIT             MPPE_S_BIT     /* configuration bit S */
  21 +#define MPPE_MPPC               MPPE_C_BIT     /* configuration bit C */
  22 +
  23 +/*
  24 + * Definitions for Stac LZS.
  25 + */
  26 +
  27 +#define CI_LZS                 17      /* config option for Stac LZS */
  28 +#define CILEN_LZS              5       /* length of config option */
  29 +
  30 +#define LZS_OVHD               4       /* max. LZS overhead */
  31 +#define LZS_HIST_LEN           2048    /* LZS history size */
  32 +#define LZS_MAX_CCOUNT         0x0FFF  /* max. coherency counter value */
  33 +
  34 +#define LZS_MODE_NONE          0
  35 +#define LZS_MODE_LCB           1
  36 +#define LZS_MODE_CRC           2
  37 +#define LZS_MODE_SEQ           3
  38 +#define LZS_MODE_EXT           4
  39 +
  40 +#define LZS_EXT_BIT_FLUSHED    0x80    /* bit A */
  41 +#define LZS_EXT_BIT_COMP       0x20    /* bit C */
  42 +
  43  /*
  44   * Definitions for other, as yet unsupported, compression methods.
  45   */
  46 --- a/include/net/ppp-comp.h
  47 +++ b/include/net/ppp-comp.h
  48 @@ -168,6 +168,33 @@ struct compressor {
  49  #define CI_MPPE                        18      /* config option for MPPE */
  50  #define CILEN_MPPE             6       /* length of config option */
  51
  52 +/* MPPE/MPPC definitions by J.D.*/
  53 +#define MPPE_STATELESS          MPPE_H_BIT     /* configuration bit H */
  54 +#define MPPE_40BIT              MPPE_L_BIT     /* configuration bit L */
  55 +#define MPPE_56BIT              MPPE_M_BIT     /* configuration bit M */
  56 +#define MPPE_128BIT             MPPE_S_BIT     /* configuration bit S */
  57 +#define MPPE_MPPC               MPPE_C_BIT     /* configuration bit C */
  58 +
  59 +/*
  60 + * Definitions for Stac LZS.
  61 + */
  62 +
  63 +#define CI_LZS                 17      /* config option for Stac LZS */
  64 +#define CILEN_LZS              5       /* length of config option */
  65 +
  66 +#define LZS_OVHD               4       /* max. LZS overhead */
  67 +#define LZS_HIST_LEN           2048    /* LZS history size */
  68 +#define LZS_MAX_CCOUNT         0x0FFF  /* max. coherency counter value */
  69 +
  70 +#define LZS_MODE_NONE          0
  71 +#define LZS_MODE_LCB           1
  72 +#define LZS_MODE_CRC           2
  73 +#define LZS_MODE_SEQ           3
  74 +#define LZS_MODE_EXT           4
  75 +
  76 +#define LZS_EXT_BIT_FLUSHED    0x80    /* bit A */
  77 +#define LZS_EXT_BIT_COMP       0x20    /* bit C */
  78 +
  79  /*
  80   * Definitions for other, as yet unsupported, compression methods.
  81   */
  82 --- a/pppd/ccp.c
  83 +++ b/pppd/ccp.c
  84 @@ -62,12 +62,10 @@ static int setdeflate __P((char **));
  85  static char bsd_value[8];
  86  static char deflate_value[8];
  87
  88 -/*
  89 - * Option variables.
  90 - */
  91  #ifdef MPPE
  92 -bool refuse_mppe_stateful = 1;         /* Allow stateful mode? */
  93 -#endif
  94 +static int setmppe(char **);
  95 +static int setnomppe(void);
  96 +#endif /* MPPE */
  97
  98  static option_t ccp_option_list[] = {
  99      { "noccp", o_bool, &ccp_protent.enabled_flag,
 100 @@ -108,54 +106,36 @@ static option_t ccp_option_list[] = {
 101        "don't allow Predictor-1", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 102        &ccp_allowoptions[0].predictor_1 },
 103
 104 +    { "lzs", o_bool, &ccp_wantoptions[0].lzs,
 105 +      "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_PRIO },
 106 +    { "+lzs", o_bool, &ccp_wantoptions[0].lzs,
 107 +      "request Stac LZS", 1, &ccp_allowoptions[0].lzs, OPT_ALIAS | OPT_PRIO },
 108 +    { "nolzs", o_bool, &ccp_wantoptions[0].lzs,
 109 +      "don't allow Stac LZS", OPT_PRIOSUB | OPT_A2CLR,
 110 +      &ccp_allowoptions[0].lzs },
 111 +    { "-lzs", o_bool, &ccp_wantoptions[0].lzs,
 112 +      "don't allow Stac LZS", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 113 +      &ccp_allowoptions[0].lzs },
 114 +
 115  #ifdef MPPE
 116 -    /* MPPE options are symmetrical ... we only set wantoptions here */
 117 -    { "require-mppe", o_bool, &ccp_wantoptions[0].mppe,
 118 -      "require MPPE encryption",
 119 -      OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
 120 -    { "+mppe", o_bool, &ccp_wantoptions[0].mppe,
 121 -      "require MPPE encryption",
 122 -      OPT_ALIAS | OPT_PRIO | MPPE_OPT_40 | MPPE_OPT_128 },
 123 -    { "nomppe", o_bool, &ccp_wantoptions[0].mppe,
 124 -      "don't allow MPPE encryption", OPT_PRIO },
 125 -    { "-mppe", o_bool, &ccp_wantoptions[0].mppe,
 126 -      "don't allow MPPE encryption", OPT_ALIAS | OPT_PRIO },
 127 -
 128 -    /* We use ccp_allowoptions[0].mppe as a junk var ... it is reset later */
 129 -    { "require-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 130 -      "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
 131 -      &ccp_wantoptions[0].mppe },
 132 -    { "+mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 133 -      "require MPPE 40-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_40,
 134 -      &ccp_wantoptions[0].mppe },
 135 -    { "nomppe-40", o_bool, &ccp_allowoptions[0].mppe,
 136 -      "don't allow MPPE 40-bit encryption",
 137 -      OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40, &ccp_wantoptions[0].mppe },
 138 -    { "-mppe-40", o_bool, &ccp_allowoptions[0].mppe,
 139 -      "don't allow MPPE 40-bit encryption",
 140 -      OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_40,
 141 -      &ccp_wantoptions[0].mppe },
 142 -
 143 -    { "require-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 144 -      "require MPPE 128-bit encryption", OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
 145 -      &ccp_wantoptions[0].mppe },
 146 -    { "+mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 147 -      "require MPPE 128-bit encryption",
 148 -      OPT_ALIAS | OPT_PRIO | OPT_A2OR | MPPE_OPT_128,
 149 -      &ccp_wantoptions[0].mppe },
 150 -    { "nomppe-128", o_bool, &ccp_allowoptions[0].mppe,
 151 -      "don't allow MPPE 128-bit encryption",
 152 -      OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128, &ccp_wantoptions[0].mppe },
 153 -    { "-mppe-128", o_bool, &ccp_allowoptions[0].mppe,
 154 -      "don't allow MPPE 128-bit encryption",
 155 -      OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLRB | MPPE_OPT_128,
 156 -      &ccp_wantoptions[0].mppe },
 157 -
 158 -    /* strange one; we always request stateless, but will we allow stateful? */
 159 -    { "mppe-stateful", o_bool, &refuse_mppe_stateful,
 160 -      "allow MPPE stateful mode", OPT_PRIO },
 161 -    { "nomppe-stateful", o_bool, &refuse_mppe_stateful,
 162 -      "disallow MPPE stateful mode", OPT_PRIO | 1 },
 163 +    { "mppc", o_bool, &ccp_wantoptions[0].mppc,
 164 +      "request MPPC compression", 1, &ccp_allowoptions[0].mppc },
 165 +    { "+mppc", o_bool, &ccp_wantoptions[0].mppc,
 166 +      "request MPPC compression", 1, &ccp_allowoptions[0].mppc, OPT_ALIAS },
 167 +    { "nomppc", o_bool, &ccp_wantoptions[0].mppc,
 168 +      "don't allow MPPC compression", OPT_PRIOSUB | OPT_A2CLR,
 169 +      &ccp_allowoptions[0].mppc },
 170 +    { "-mppc", o_bool, &ccp_wantoptions[0].mppc,
 171 +      "don't allow MPPC compression", OPT_ALIAS | OPT_PRIOSUB | OPT_A2CLR,
 172 +      &ccp_allowoptions[0].mppc },
 173 +    { "mppe", o_special, (void *)setmppe,
 174 +      "request MPPE encryption" },
 175 +    { "+mppe", o_special, (void *)setmppe,
 176 +      "request MPPE encryption" },
 177 +    { "nomppe", o_special_noarg, (void *)setnomppe,
 178 +      "don't allow MPPE encryption" },
 179 +    { "-mppe", o_special_noarg, (void *)setnomppe,
 180 +      "don't allow MPPE encryption" },
 181  #endif /* MPPE */
 182
 183      { NULL }
 184 @@ -241,7 +221,7 @@ static fsm_callbacks ccp_callbacks = {
 185   */
 186  #define ANY_COMPRESS(opt)      ((opt).deflate || (opt).bsd_compress \
 187                                  || (opt).predictor_1 || (opt).predictor_2 \
 188 -                                || (opt).mppe)
 189 +                                || (opt).lzs || (opt).mppc || (opt).mppe)
 190
 191  /*
 192   * Local state (mainly for handling reset-reqs and reset-acks).
 193 @@ -344,6 +324,100 @@ setdeflate(argv)
 194      return 1;
 195  }
 196
 197 +#ifdef MPPE
 198 +/*
 199 + * Functions called from config options
 200 + */
 201 +/*
 202 +   MPPE suboptions:
 203 +       required - require MPPE; disconnect if peer doesn't support it
 204 +       stateless - use stateless mode
 205 +       no40 - disable 40 bit keys
 206 +       no56 - disable 56 bit keys
 207 +       no128 - disable 128 bit keys
 208 +*/
 209 +int setmppe(char **argv)
 210 +{
 211 +    int i;
 212 +    char *str, cmdbuf[16];
 213 +
 214 +    ccp_allowoptions[0].mppe = 1;
 215 +    ccp_allowoptions[0].mppe_40 = 1;
 216 +    ccp_allowoptions[0].mppe_56 = 1;
 217 +    ccp_allowoptions[0].mppe_128 = 1;
 218 +    ccp_allowoptions[0].mppe_stateless = 0;
 219 +    ccp_wantoptions[0].mppe = 0;
 220 +
 221 +    str = *argv;
 222 +
 223 +    while (1) {
 224 +       i = 0;
 225 +       memset(cmdbuf, '\0', 16);
 226 +       while ((i < 16) && (*str != ',') && (*str != '\0'))
 227 +           cmdbuf[i++] = *str++;
 228 +       cmdbuf[i] = '\0';
 229 +       if (!strncasecmp(cmdbuf, "no40", strlen("no40"))) {
 230 +           ccp_allowoptions[0].mppe_40 = 0;
 231 +           goto next_param;
 232 +       } else if (!strncasecmp(cmdbuf, "no56", strlen("no56"))) {
 233 +           ccp_allowoptions[0].mppe_56 = 0;
 234 +           goto next_param;
 235 +       } else if (!strncasecmp(cmdbuf, "no128", strlen("no128"))) {
 236 +           ccp_allowoptions[0].mppe_128 = 0;
 237 +           goto next_param;
 238 +       } else if (!strncasecmp(cmdbuf, "stateless", strlen("stateless"))) {
 239 +           ccp_allowoptions[0].mppe_stateless = 1;
 240 +           goto next_param;
 241 +       } else if (!strncasecmp(cmdbuf, "required", strlen("required"))) {
 242 +           ccp_wantoptions[0].mppe = 1;
 243 +           goto next_param;
 244 +       } else {
 245 +           option_error("invalid parameter '%s' for mppe option", cmdbuf);
 246 +           return 0;
 247 +       }
 248 +
 249 +    next_param:
 250 +       if (*str == ',') {
 251 +           str++;
 252 +           continue;
 253 +       }
 254 +       if (*str == '\0') {
 255 +           if (!(ccp_allowoptions[0].mppe_40 || ccp_allowoptions[0].mppe_56 ||
 256 +                 ccp_allowoptions[0].mppe_128)) {
 257 +               if (ccp_wantoptions[0].mppe == 1) {
 258 +                   option_error("You require MPPE but you have switched off "
 259 +                                "all encryption key lengths.");
 260 +                   return 0;
 261 +               }
 262 +               ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
 263 +               ccp_wantoptions[0].mppe_stateless =
 264 +                   ccp_allowoptions[0].mppe_stateless = 0;
 265 +           } else {
 266 +               ccp_allowoptions[0].mppe = 1;
 267 +               ccp_wantoptions[0].mppe_stateless =
 268 +                   ccp_allowoptions[0].mppe_stateless;
 269 +               if (ccp_wantoptions[0].mppe == 1) {
 270 +                   ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40;
 271 +                   ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56;
 272 +                   ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128;
 273 +               }
 274 +           }
 275 +           return 1;
 276 +       }
 277 +    }
 278 +}
 279 +
 280 +int setnomppe(void)
 281 +{
 282 +    ccp_wantoptions[0].mppe = ccp_allowoptions[0].mppe = 0;
 283 +    ccp_wantoptions[0].mppe_40 = ccp_allowoptions[0].mppe_40 = 0;
 284 +    ccp_wantoptions[0].mppe_56 = ccp_allowoptions[0].mppe_56 = 0;
 285 +    ccp_wantoptions[0].mppe_128 = ccp_allowoptions[0].mppe_128 = 0;
 286 +    ccp_wantoptions[0].mppe_stateless = ccp_allowoptions[0].mppe_stateless = 0;
 287 +    return 1;
 288 +}
 289 +#endif /* MPPE */
 290 +
 291  /*
 292   * ccp_init - initialize CCP.
 293   */
 294 @@ -378,6 +452,30 @@ ccp_init(unit)
 295      ccp_allowoptions[0].bsd_bits = BSD_MAX_BITS;
 296
 297      ccp_allowoptions[0].predictor_1 = 1;
 298 +
 299 +    ccp_wantoptions[0].lzs = 0; /* Stac LZS  - will be enabled in the future */
 300 +    ccp_wantoptions[0].lzs_mode = LZS_MODE_SEQ;
 301 +    ccp_wantoptions[0].lzs_hists = 1;
 302 +    ccp_allowoptions[0].lzs = 0; /* Stac LZS  - will be enabled in the future */
 303 +    ccp_allowoptions[0].lzs_mode = LZS_MODE_SEQ;
 304 +    ccp_allowoptions[0].lzs_hists = 1;
 305 +
 306 +#ifdef MPPE
 307 +    /* by default allow and request MPPC... */
 308 +    ccp_wantoptions[0].mppc = ccp_allowoptions[0].mppc = 1;
 309 +
 310 +    /* ... and allow but don't request MPPE */
 311 +    ccp_allowoptions[0].mppe = 1;
 312 +    ccp_allowoptions[0].mppe_40 = 1;
 313 +    ccp_allowoptions[0].mppe_56 = 1;
 314 +    ccp_allowoptions[0].mppe_128 = 1;
 315 +    ccp_allowoptions[0].mppe_stateless = 1;
 316 +    ccp_wantoptions[0].mppe = 0;
 317 +    ccp_wantoptions[0].mppe_40 = 0;
 318 +    ccp_wantoptions[0].mppe_56 = 0;
 319 +    ccp_wantoptions[0].mppe_128 = 0;
 320 +    ccp_wantoptions[0].mppe_stateless = 0;
 321 +#endif /* MPPE */
 322  }
 323
 324  /*
 325 @@ -455,11 +553,11 @@ ccp_input(unit, p, len)
 326      if (oldstate == OPENED && p[0] == TERMREQ && f->state != OPENED) {
 327         notice("Compression disabled by peer.");
 328  #ifdef MPPE
 329 -       if (ccp_gotoptions[unit].mppe) {
 330 +       if (ccp_wantoptions[unit].mppe) {
 331             error("MPPE disabled, closing LCP");
 332             lcp_close(unit, "MPPE disabled by peer");
 333         }
 334 -#endif
 335 +#endif /* MPPE */
 336      }
 337
 338      /*
 339 @@ -487,6 +585,15 @@ ccp_extcode(f, code, id, p, len)
 340             break;
 341         /* send a reset-ack, which the transmitter will see and
 342            reset its compression state. */
 343 +
 344 +       /* In case of MPPE/MPPC or LZS we shouldn't send CCP_RESETACK,
 345 +          but we do it in order to reset compressor; CCP_RESETACK is
 346 +          then silently discarded. See functions ppp_send_frame and
 347 +          ppp_ccp_peek in ppp_generic.c (Linux only !!!). All the
 348 +          confusion is caused by the fact that CCP code is splited
 349 +          into two parts - one part is handled by pppd, the other one
 350 +          is handled by kernel. */
 351 +
 352         fsm_sdata(f, CCP_RESETACK, id, NULL, 0);
 353         break;
 354
 355 @@ -515,12 +622,11 @@ ccp_protrej(unit)
 356      fsm_lowerdown(&ccp_fsm[unit]);
 357
 358  #ifdef MPPE
 359 -    if (ccp_gotoptions[unit].mppe) {
 360 +    if (ccp_wantoptions[unit].mppe) {
 361         error("MPPE required but peer negotiation failed");
 362         lcp_close(unit, "MPPE required but peer negotiation failed");
 363      }
 364 -#endif
 365 -
 366 +#endif /* MPPE */
 367  }
 368
 369  /*
 370 @@ -537,7 +643,7 @@ ccp_resetci(f)
 371      all_rejected[f->unit] = 0;
 372
 373  #ifdef MPPE
 374 -    if (go->mppe) {
 375 +    if (go->mppe || go->mppc) {
 376         ccp_options *ao = &ccp_allowoptions[f->unit];
 377         int auth_mschap_bits = auth_done[f->unit];
 378         int numbits;
 379 @@ -551,80 +657,109 @@ ccp_resetci(f)
 380          * NB: If MPPE is required, all other compression opts are invalid.
 381          *     So, we return right away if we can't do it.
 382          */
 383 +       if (ccp_wantoptions[f->unit].mppe) {
 384 +           /* Leave only the mschap auth bits set */
 385 +           auth_mschap_bits &= (CHAP_MS_WITHPEER  | CHAP_MS_PEER |
 386 +                                CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
 387 +           /* Count the mschap auths */
 388 +           auth_mschap_bits >>= CHAP_MS_SHIFT;
 389 +           numbits = 0;
 390 +           do {
 391 +               numbits += auth_mschap_bits & 1;
 392 +               auth_mschap_bits >>= 1;
 393 +           } while (auth_mschap_bits);
 394 +           if (numbits > 1) {
 395 +               error("MPPE required, but auth done in both directions.");
 396 +               lcp_close(f->unit, "MPPE required but not available");
 397 +               return;
 398 +           }
 399 +           if (!numbits) {
 400 +               error("MPPE required, but MS-CHAP[v2] auth not performed.");
 401 +               lcp_close(f->unit, "MPPE required but not available");
 402 +               return;
 403 +           }
 404
 405 -       /* Leave only the mschap auth bits set */
 406 -       auth_mschap_bits &= (CHAP_MS_WITHPEER  | CHAP_MS_PEER |
 407 -                            CHAP_MS2_WITHPEER | CHAP_MS2_PEER);
 408 -       /* Count the mschap auths */
 409 -       auth_mschap_bits >>= CHAP_MS_SHIFT;
 410 -       numbits = 0;
 411 -       do {
 412 -           numbits += auth_mschap_bits & 1;
 413 -           auth_mschap_bits >>= 1;
 414 -       } while (auth_mschap_bits);
 415 -       if (numbits > 1) {
 416 -           error("MPPE required, but auth done in both directions.");
 417 -           lcp_close(f->unit, "MPPE required but not available");
 418 -           return;
 419 -       }
 420 -       if (!numbits) {
 421 -           error("MPPE required, but MS-CHAP[v2] auth not performed.");
 422 -           lcp_close(f->unit, "MPPE required but not available");
 423 -           return;
 424 -       }
 425 -
 426 -       /* A plugin (eg radius) may not have obtained key material. */
 427 -       if (!mppe_keys_set) {
 428 -           error("MPPE required, but keys are not available.  "
 429 -                 "Possible plugin problem?");
 430 -           lcp_close(f->unit, "MPPE required but not available");
 431 -           return;
 432 -       }
 433 -
 434 -       /* LM auth not supported for MPPE */
 435 -       if (auth_done[f->unit] & (CHAP_MS_WITHPEER | CHAP_MS_PEER)) {
 436 -           /* This might be noise */
 437 -           if (go->mppe & MPPE_OPT_40) {
 438 -               notice("Disabling 40-bit MPPE; MS-CHAP LM not supported");
 439 -               go->mppe &= ~MPPE_OPT_40;
 440 -               ccp_wantoptions[f->unit].mppe &= ~MPPE_OPT_40;
 441 +           /* A plugin (eg radius) may not have obtained key material. */
 442 +           if (!mppe_keys_set) {
 443 +               error("MPPE required, but keys are not available.  "
 444 +                     "Possible plugin problem?");
 445 +               lcp_close(f->unit, "MPPE required but not available");
 446 +               return;
 447             }
 448         }
 449
 450 -       /* Last check: can we actually negotiate something? */
 451 -       if (!(go->mppe & (MPPE_OPT_40 | MPPE_OPT_128))) {
 452 -           /* Could be misconfig, could be 40-bit disabled above. */
 453 -           error("MPPE required, but both 40-bit and 128-bit disabled.");
 454 -           lcp_close(f->unit, "MPPE required but not available");
 455 -           return;
 456 +       /*
 457 +        * Check whether the kernel knows about the various
 458 +        * compression methods we might request. Key material
 459 +        * unimportant here.
 460 +        */
 461 +       if (go->mppc) {
 462 +           opt_buf[0] = CI_MPPE;
 463 +           opt_buf[1] = CILEN_MPPE;
 464 +           opt_buf[2] = 0;
 465 +           opt_buf[3] = 0;
 466 +           opt_buf[4] = 0;
 467 +           opt_buf[5] = MPPE_MPPC;
 468 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 0) <= 0)
 469 +               go->mppc = 0;
 470 +       }
 471 +       if (go->mppe_40) {
 472 +           opt_buf[0] = CI_MPPE;
 473 +           opt_buf[1] = CILEN_MPPE;
 474 +           opt_buf[2] = MPPE_STATELESS;
 475 +           opt_buf[3] = 0;
 476 +           opt_buf[4] = 0;
 477 +           opt_buf[5] = MPPE_40BIT;
 478 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 479 +               go->mppe_40 = 0;
 480 +       }
 481 +       if (go->mppe_56) {
 482 +           opt_buf[0] = CI_MPPE;
 483 +           opt_buf[1] = CILEN_MPPE;
 484 +           opt_buf[2] = MPPE_STATELESS;
 485 +           opt_buf[3] = 0;
 486 +           opt_buf[4] = 0;
 487 +           opt_buf[5] = MPPE_56BIT;
 488 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 489 +               go->mppe_56 = 0;
 490 +       }
 491 +       if (go->mppe_128) {
 492 +           opt_buf[0] = CI_MPPE;
 493 +           opt_buf[1] = CILEN_MPPE;
 494 +           opt_buf[2] = MPPE_STATELESS;
 495 +           opt_buf[3] = 0;
 496 +           opt_buf[4] = 0;
 497 +           opt_buf[5] = MPPE_128BIT;
 498 +           if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0)
 499 +               go->mppe_128 = 0;
 500 +       }
 501 +       if (!go->mppe_40 && !go->mppe_56 && !go->mppe_128) {
 502 +           if (ccp_wantoptions[f->unit].mppe) {
 503 +               error("MPPE required, but kernel has no support.");
 504 +               lcp_close(f->unit, "MPPE required but not available");
 505 +           }
 506 +           go->mppe = go->mppe_stateless = 0;
 507 +       } else {
 508 +           /* MPPE is not compatible with other compression types */
 509 +           if (ccp_wantoptions[f->unit].mppe) {
 510 +               ao->bsd_compress = go->bsd_compress = 0;
 511 +               ao->predictor_1  = go->predictor_1  = 0;
 512 +               ao->predictor_2  = go->predictor_2  = 0;
 513 +               ao->deflate      = go->deflate      = 0;
 514 +               ao->lzs          = go->lzs          = 0;
 515 +           }
 516         }
 517 -
 518 -       /* sync options */
 519 -       ao->mppe = go->mppe;
 520 -       /* MPPE is not compatible with other compression types */
 521 -       ao->bsd_compress = go->bsd_compress = 0;
 522 -       ao->predictor_1  = go->predictor_1  = 0;
 523 -       ao->predictor_2  = go->predictor_2  = 0;
 524 -       ao->deflate      = go->deflate      = 0;
 525      }
 526  #endif /* MPPE */
 527 -
 528 -    /*
 529 -     * Check whether the kernel knows about the various
 530 -     * compression methods we might request.
 531 -     */
 532 -#ifdef MPPE
 533 -    if (go->mppe) {
 534 -       opt_buf[0] = CI_MPPE;
 535 -       opt_buf[1] = CILEN_MPPE;
 536 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 537 -       /* Key material unimportant here. */
 538 -       if (ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0) <= 0) {
 539 -           error("MPPE required, but kernel has no support.");
 540 -           lcp_close(f->unit, "MPPE required but not available");
 541 -       }
 542 +    if (go->lzs) {
 543 +       opt_buf[0] = CI_LZS;
 544 +       opt_buf[1] = CILEN_LZS;
 545 +       opt_buf[2] = go->lzs_hists >> 8;
 546 +       opt_buf[3] = go->lzs_hists & 0xff;
 547 +       opt_buf[4] = LZS_MODE_SEQ;
 548 +       if (ccp_test(f->unit, opt_buf, CILEN_LZS, 0) <= 0)
 549 +           go->lzs = 0;
 550      }
 551 -#endif
 552      if (go->bsd_compress) {
 553         opt_buf[0] = CI_BSD_COMPRESS;
 554         opt_buf[1] = CILEN_BSD_COMPRESS;
 555 @@ -679,7 +814,8 @@ ccp_cilen(f)
 556         + (go->deflate? CILEN_DEFLATE: 0)
 557         + (go->predictor_1? CILEN_PREDICTOR_1: 0)
 558         + (go->predictor_2? CILEN_PREDICTOR_2: 0)
 559 -       + (go->mppe? CILEN_MPPE: 0);
 560 +       + (go->lzs? CILEN_LZS: 0)
 561 +       + ((go->mppe || go->mppc)? CILEN_MPPE: 0);
 562  }
 563
 564  /*
 565 @@ -693,6 +829,8 @@ ccp_addci(f, p, lenp)
 566  {
 567      int res;
 568      ccp_options *go = &ccp_gotoptions[f->unit];
 569 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 570 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 571      u_char *p0 = p;
 572
 573      /*
 574 @@ -701,22 +839,43 @@ ccp_addci(f, p, lenp)
 575       * in case it gets Acked.
 576       */
 577  #ifdef MPPE
 578 -    if (go->mppe) {
 579 +    if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
 580         u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
 581
 582 -       p[0] = opt_buf[0] = CI_MPPE;
 583 -       p[1] = opt_buf[1] = CILEN_MPPE;
 584 -       MPPE_OPTS_TO_CI(go->mppe, &p[2]);
 585 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 586 +       p[0] = CI_MPPE;
 587 +       p[1] = CILEN_MPPE;
 588 +       p[2] = (go->mppe_stateless ? MPPE_STATELESS : 0);
 589 +       p[3] = 0;
 590 +       p[4] = 0;
 591 +       p[5] = (go->mppe_40 ? MPPE_40BIT : 0) | (go->mppe_56 ? MPPE_56BIT : 0) |
 592 +           (go->mppe_128 ? MPPE_128BIT : 0) | (go->mppc ? MPPE_MPPC : 0);
 593 +
 594 +       BCOPY(p, opt_buf, CILEN_MPPE);
 595         BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN);
 596         res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0);
 597 -       if (res > 0)
 598 +       if (res > 0) {
 599             p += CILEN_MPPE;
 600 -       else
 601 +       } else {
 602             /* This shouldn't happen, we've already tested it! */
 603 -           lcp_close(f->unit, "MPPE required but not available in kernel");
 604 +           go->mppe = go->mppe_40 = go->mppe_56 = go->mppe_128 =
 605 +               go->mppe_stateless = go->mppc = 0;
 606 +           if (ccp_wantoptions[f->unit].mppe)
 607 +               lcp_close(f->unit, "MPPE required but not available in kernel");
 608 +       }
 609 +    }
 610 +#endif /* MPPE */
 611 +    if (go->lzs) {
 612 +       p[0] = CI_LZS;
 613 +       p[1] = CILEN_LZS;
 614 +       p[2] = go->lzs_hists >> 8;
 615 +       p[3] = go->lzs_hists & 0xff;
 616 +       p[4] = LZS_MODE_SEQ;
 617 +       res = ccp_test(f->unit, p, CILEN_LZS, 0);
 618 +       if (res > 0) {
 619 +           p += CILEN_LZS;
 620 +       } else
 621 +           go->lzs = 0;
 622      }
 623 -#endif
 624      if (go->deflate) {
 625         p[0] = go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT;
 626         p[1] = CILEN_DEFLATE;
 627 @@ -802,7 +961,7 @@ ccp_addci(f, p, lenp)
 628
 629  /*
 630   * ccp_ackci - process a received configure-ack, and return
 631 - * 1 iff the packet was OK.
 632 + * 1 if the packet was OK.
 633   */
 634  static int
 635  ccp_ackci(f, p, len)
 636 @@ -811,24 +970,44 @@ ccp_ackci(f, p, len)
 637      int len;
 638  {
 639      ccp_options *go = &ccp_gotoptions[f->unit];
 640 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 641 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 642      u_char *p0 = p;
 643
 644  #ifdef MPPE
 645 -    if (go->mppe) {
 646 -       u_char opt_buf[CILEN_MPPE];
 647 -
 648 -       opt_buf[0] = CI_MPPE;
 649 -       opt_buf[1] = CILEN_MPPE;
 650 -       MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]);
 651 -       if (len < CILEN_MPPE || memcmp(opt_buf, p, CILEN_MPPE))
 652 +    if (go->mppe || go->mppc || (!wo->mppe && ao->mppe)) {
 653 +       if (len < CILEN_MPPE
 654 +           || p[1] != CILEN_MPPE || p[0] != CI_MPPE
 655 +           || p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0)
 656 +           || p[3] != 0
 657 +           || p[4] != 0
 658 +           || (p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
 659 +                        (go->mppc ? MPPE_MPPC : 0))
 660 +               && p[5] != ((go->mppe_56 ? MPPE_56BIT : 0) |
 661 +                           (go->mppc ? MPPE_MPPC : 0))
 662 +               && p[5] != ((go->mppe_128 ? MPPE_128BIT : 0) |
 663 +                           (go->mppc ? MPPE_MPPC : 0))))
 664             return 0;
 665 +       if (go->mppe_40 || go->mppe_56 || go->mppe_128)
 666 +           go->mppe = 1;
 667         p += CILEN_MPPE;
 668         len -= CILEN_MPPE;
 669 +       /* Cope with first/fast ack */
 670 +       if (p == p0 && len == 0)
 671 +           return 1;
 672 +    }
 673 +#endif /* MPPE */
 674 +    if (go->lzs) {
 675 +       if (len < CILEN_LZS || p[0] != CI_LZS || p[1] != CILEN_LZS
 676 +           || p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
 677 +           || p[4] != LZS_MODE_SEQ)
 678 +           return 0;
 679 +       p += CILEN_LZS;
 680 +       len -= CILEN_LZS;
 681         /* XXX Cope with first/fast ack */
 682 -       if (len == 0)
 683 +       if (p == p0 && len == 0)
 684             return 1;
 685      }
 686 -#endif
 687      if (go->deflate) {
 688         if (len < CILEN_DEFLATE
 689             || p[0] != (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
 690 @@ -901,6 +1080,8 @@ ccp_nakci(f, p, len, treat_as_reject)
 691      int treat_as_reject;
 692  {
 693      ccp_options *go = &ccp_gotoptions[f->unit];
 694 +    ccp_options *ao = &ccp_allowoptions[f->unit];
 695 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 696      ccp_options no;            /* options we've seen already */
 697      ccp_options try;           /* options to ask for next time */
 698
 699 @@ -908,28 +1089,100 @@ ccp_nakci(f, p, len, treat_as_reject)
 700      try = *go;
 701
 702  #ifdef MPPE
 703 -    if (go->mppe && len >= CILEN_MPPE
 704 -       && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 705 -       no.mppe = 1;
 706 -       /*
 707 -        * Peer wants us to use a different strength or other setting.
 708 -        * Fail if we aren't willing to use his suggestion.
 709 -        */
 710 -       MPPE_CI_TO_OPTS(&p[2], try.mppe);
 711 -       if ((try.mppe & MPPE_OPT_STATEFUL) && refuse_mppe_stateful) {
 712 -           error("Refusing MPPE stateful mode offered by peer");
 713 -           try.mppe = 0;
 714 -       } else if (((go->mppe | MPPE_OPT_STATEFUL) & try.mppe) != try.mppe) {
 715 -           /* Peer must have set options we didn't request (suggest) */
 716 -           try.mppe = 0;
 717 -       }
 718 +    if ((go->mppe || go->mppc || (!wo->mppe && ao->mppe)) &&
 719 +       len >= CILEN_MPPE && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 720
 721 -       if (!try.mppe) {
 722 -           error("MPPE required but peer negotiation failed");
 723 -           lcp_close(f->unit, "MPPE required but peer negotiation failed");
 724 +       if (go->mppc) {
 725 +           no.mppc = 1;
 726 +           if (!(p[5] & MPPE_MPPC))
 727 +               try.mppc = 0;
 728 +       }
 729 +
 730 +       if (go->mppe)
 731 +           no.mppe = 1;
 732 +       if (go->mppe_40)
 733 +           no.mppe_40 = 1;
 734 +       if (go->mppe_56)
 735 +           no.mppe_56 = 1;
 736 +       if (go->mppe_128)
 737 +           no.mppe_128 = 1;
 738 +       if (go->mppe_stateless)
 739 +           no.mppe_stateless = 1;
 740 +
 741 +       if (ao->mppe_40) {
 742 +           if ((p[5] & MPPE_40BIT))
 743 +               try.mppe_40 = 1;
 744 +           else
 745 +               try.mppe_40 = (p[5] == 0) ? 1 : 0;
 746 +       }
 747 +       if (ao->mppe_56) {
 748 +           if ((p[5] & MPPE_56BIT))
 749 +               try.mppe_56 = 1;
 750 +           else
 751 +               try.mppe_56 = (p[5] == 0) ? 1 : 0;
 752 +       }
 753 +       if (ao->mppe_128) {
 754 +           if ((p[5] & MPPE_128BIT))
 755 +               try.mppe_128 = 1;
 756 +           else
 757 +               try.mppe_128 = (p[5] == 0) ? 1 : 0;
 758 +       }
 759 +
 760 +       if (ao->mppe_stateless) {
 761 +           if ((p[2] & MPPE_STATELESS) || wo->mppe_stateless)
 762 +               try.mppe_stateless = 1;
 763 +           else
 764 +               try.mppe_stateless = 0;
 765 +       }
 766 +
 767 +       if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128) {
 768 +           try.mppe = try.mppe_stateless = 0;
 769 +           if (wo->mppe) {
 770 +               /* we require encryption, but peer doesn't support it
 771 +                  so we close connection */
 772 +               wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 773 +                   wo->mppe_56 = wo->mppe_128 = 0;
 774 +               lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
 775 +                         "key length");
 776 +           }
 777 +        }
 778 +       if (wo->mppe && (wo->mppe_40 != try.mppe_40) &&
 779 +           (wo->mppe_56 != try.mppe_56) && (wo->mppe_128 != try.mppe_128)) {
 780 +           /* cannot negotiate key length */
 781 +           wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 782 +               wo->mppe_56 = wo->mppe_128 = 0;
 783 +           lcp_close(f->unit, "Cannot negotiate MPPE key length");
 784         }
 785 +       if (try.mppe_40 && try.mppe_56 && try.mppe_128)
 786 +           try.mppe_40 = try.mppe_56 = 0;
 787 +       else
 788 +           if (try.mppe_56 && try.mppe_128)
 789 +               try.mppe_56 = 0;
 790 +           else
 791 +               if (try.mppe_40 && try.mppe_128)
 792 +                   try.mppe_40 = 0;
 793 +               else
 794 +                   if (try.mppe_40 && try.mppe_56)
 795 +                       try.mppe_40 = 0;
 796 +
 797 +       p += CILEN_MPPE;
 798 +       len -= CILEN_MPPE;
 799      }
 800  #endif /* MPPE */
 801 +
 802 +    if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
 803 +       no.lzs = 1;
 804 +       if (((p[2]<<8)|p[3]) > 1 || (p[4] != LZS_MODE_SEQ &&
 805 +                                    p[4] != LZS_MODE_EXT))
 806 +           try.lzs = 0;
 807 +       else {
 808 +           try.lzs_mode = p[4];
 809 +           try.lzs_hists = (p[2] << 8) | p[3];
 810 +       }
 811 +       p += CILEN_LZS;
 812 +       len -= CILEN_LZS;
 813 +    }
 814 +
 815      if (go->deflate && len >= CILEN_DEFLATE
 816         && p[0] == (go->deflate_correct? CI_DEFLATE: CI_DEFLATE_DRAFT)
 817         && p[1] == CILEN_DEFLATE) {
 818 @@ -1002,14 +1255,50 @@ ccp_rejci(f, p, len)
 819         return -1;
 820
 821  #ifdef MPPE
 822 -    if (go->mppe && len >= CILEN_MPPE
 823 +    if ((go->mppe || go->mppc) && len >= CILEN_MPPE
 824         && p[0] == CI_MPPE && p[1] == CILEN_MPPE) {
 825 -       error("MPPE required but peer refused");
 826 -       lcp_close(f->unit, "MPPE required but peer refused");
 827 +       ccp_options *wo = &ccp_wantoptions[f->unit];
 828 +       if (p[2] != (go->mppe_stateless ? MPPE_STATELESS : 0) ||
 829 +           p[3] != 0 ||
 830 +           p[4] != 0 ||
 831 +           p[5] != ((go->mppe_40 ? MPPE_40BIT : 0) |
 832 +                    (go->mppe_56 ? MPPE_56BIT : 0) |
 833 +                    (go->mppe_128 ? MPPE_128BIT : 0) |
 834 +                    (go->mppc ? MPPE_MPPC : 0)))
 835 +           return 0;
 836 +       if (go->mppc)
 837 +           try.mppc = 0;
 838 +       if (go->mppe) {
 839 +           try.mppe = 0;
 840 +           if (go->mppe_40)
 841 +               try.mppe_40 = 0;
 842 +           if (go->mppe_56)
 843 +               try.mppe_56 = 0;
 844 +           if (go->mppe_128)
 845 +               try.mppe_128 = 0;
 846 +           if (go->mppe_stateless)
 847 +               try.mppe_stateless = 0;
 848 +           if (!try.mppe_56 && !try.mppe_40 && !try.mppe_128)
 849 +               try.mppe = try.mppe_stateless = 0;
 850 +           if (wo->mppe) { /* we want MPPE but cannot negotiate key length */
 851 +               wo->mppc = wo->mppe = wo->mppe_stateless = wo->mppe_40 =
 852 +                   wo->mppe_56 = wo->mppe_128 = 0;
 853 +               lcp_close(f->unit, "MPPE required but cannot negotiate MPPE "
 854 +                         "key length");
 855 +           }
 856 +       }
 857         p += CILEN_MPPE;
 858         len -= CILEN_MPPE;
 859      }
 860 -#endif
 861 +#endif /* MPPE */
 862 +    if (go->lzs && len >= CILEN_LZS && p[0] == CI_LZS && p[1] == CILEN_LZS) {
 863 +       if (p[2] != go->lzs_hists>>8 || p[3] != (go->lzs_hists&0xff)
 864 +           || p[4] != go->lzs_mode)
 865 +           return 0;
 866 +       try.lzs = 0;
 867 +       p += CILEN_LZS;
 868 +       len -= CILEN_LZS;
 869 +    }
 870      if (go->deflate_correct && len >= CILEN_DEFLATE
 871         && p[0] == CI_DEFLATE && p[1] == CILEN_DEFLATE) {
 872         if (p[2] != DEFLATE_MAKE_OPT(go->deflate_size)
 873 @@ -1073,14 +1362,15 @@ ccp_reqci(f, p, lenp, dont_nak)
 874      int dont_nak;
 875  {
 876      int ret, newret, res;
 877 -    u_char *p0, *retp;
 878 +    u_char *p0, *retp, p2, p5;
 879      int len, clen, type, nb;
 880      ccp_options *ho = &ccp_hisoptions[f->unit];
 881      ccp_options *ao = &ccp_allowoptions[f->unit];
 882 +    ccp_options *wo = &ccp_wantoptions[f->unit];
 883  #ifdef MPPE
 884 -    bool rej_for_ci_mppe = 1;  /* Are we rejecting based on a bad/missing */
 885 -                               /* CI_MPPE, or due to other options?       */
 886 -#endif
 887 +    u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
 888 +/*     int mtu; */
 889 +#endif /* MPPE */
 890
 891      ret = CONFACK;
 892      retp = p0 = p;
 893 @@ -1103,106 +1393,302 @@ ccp_reqci(f, p, lenp, dont_nak)
 894             switch (type) {
 895  #ifdef MPPE
 896             case CI_MPPE:
 897 -               if (!ao->mppe || clen != CILEN_MPPE) {
 898 +               if ((!ao->mppc && !ao->mppe) || clen != CILEN_MPPE) {
 899                     newret = CONFREJ;
 900                     break;
 901                 }
 902 -               MPPE_CI_TO_OPTS(&p[2], ho->mppe);
 903 -
 904 -               /* Nak if anything unsupported or unknown are set. */
 905 -               if (ho->mppe & MPPE_OPT_UNSUPPORTED) {
 906 -                   newret = CONFNAK;
 907 -                   ho->mppe &= ~MPPE_OPT_UNSUPPORTED;
 908 -               }
 909 -               if (ho->mppe & MPPE_OPT_UNKNOWN) {
 910 +               p2 = p[2];
 911 +               p5 = p[5];
 912 +               /* not sure what they want, tell 'em what we got */
 913 +               if (((p[2] & ~MPPE_STATELESS) != 0 || p[3] != 0 || p[4] != 0 ||
 914 +                    (p[5] & ~(MPPE_40BIT | MPPE_56BIT | MPPE_128BIT |
 915 +                              MPPE_MPPC)) != 0 || p[5] == 0) ||
 916 +                   (p[2] == 0 && p[3] == 0 && p[4] == 0 &&  p[5] == 0)) {
 917                     newret = CONFNAK;
 918 -                   ho->mppe &= ~MPPE_OPT_UNKNOWN;
 919 -               }
 920 -
 921 -               /* Check state opt */
 922 -               if (ho->mppe & MPPE_OPT_STATEFUL) {
 923 -                   /*
 924 -                    * We can Nak and request stateless, but it's a
 925 -                    * lot easier to just assume the peer will request
 926 -                    * it if he can do it; stateful mode is bad over
 927 -                    * the Internet -- which is where we expect MPPE.
 928 -                    */
 929 -                  if (refuse_mppe_stateful) {
 930 -                       error("Refusing MPPE stateful mode offered by peer");
 931 -                       newret = CONFREJ;
 932 -                       break;
 933 +                   p[2] = (wo->mppe_stateless ? MPPE_STATELESS : 0);
 934 +                   p[3] = 0;
 935 +                   p[4] = 0;
 936 +                   p[5] = (wo->mppe_40 ? MPPE_40BIT : 0) |
 937 +                       (wo->mppe_56 ? MPPE_56BIT : 0) |
 938 +                       (wo->mppe_128 ? MPPE_128BIT : 0) |
 939 +                       (wo->mppc ? MPPE_MPPC : 0);
 940 +                   break;
 941 +               }
 942 +
 943 +               if ((p[5] & MPPE_MPPC)) {
 944 +                   if (ao->mppc) {
 945 +                       ho->mppc = 1;
 946 +                       BCOPY(p, opt_buf, CILEN_MPPE);
 947 +                       opt_buf[2] = opt_buf[3] = opt_buf[4] = 0;
 948 +                       opt_buf[5] = MPPE_MPPC;
 949 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE, 1) <= 0) {
 950 +                           ho->mppc = 0;
 951 +                           p[5] &= ~MPPE_MPPC;
 952 +                           newret = CONFNAK;
 953 +                       }
 954 +                   } else {
 955 +                     newret = CONFREJ;
 956 +                       if (wo->mppe || ao->mppe) {
 957 +                           p[5] &= ~MPPE_MPPC;
 958 +                           newret = CONFNAK;
 959 +                       }
 960                     }
 961                 }
 962 -
 963 -               /* Find out which of {S,L} are set. */
 964 -               if ((ho->mppe & MPPE_OPT_128)
 965 -                    && (ho->mppe & MPPE_OPT_40)) {
 966 -                   /* Both are set, negotiate the strongest. */
 967 -                   newret = CONFNAK;
 968 -                   if (ao->mppe & MPPE_OPT_128)
 969 -                       ho->mppe &= ~MPPE_OPT_40;
 970 -                   else if (ao->mppe & MPPE_OPT_40)
 971 -                       ho->mppe &= ~MPPE_OPT_128;
 972 -                   else {
 973 -                       newret = CONFREJ;
 974 -                       break;
 975 -                   }
 976 -               } else if (ho->mppe & MPPE_OPT_128) {
 977 -                   if (!(ao->mppe & MPPE_OPT_128)) {
 978 -                       newret = CONFREJ;
 979 -                       break;
 980 -                   }
 981 -               } else if (ho->mppe & MPPE_OPT_40) {
 982 -                   if (!(ao->mppe & MPPE_OPT_40)) {
 983 -                       newret = CONFREJ;
 984 -                       break;
 985 -                   }
 986 +               if (ao->mppe)
 987 +                   ho->mppe = 1;
 988 +
 989 +               if ((p[2] & MPPE_STATELESS)) {
 990 +                   if (ao->mppe_stateless) {
 991 +                       if (wo->mppe_stateless)
 992 +                           ho->mppe_stateless = 1;
 993 +                       else {
 994 +                           newret = CONFNAK;
 995 +                           if (!dont_nak)
 996 +                               p[2] &= ~MPPE_STATELESS;
 997 +                       }
 998 +                   } else {
 999 +                       newret = CONFNAK;
1000 +                       if (!dont_nak)
1001 +                           p[2] &= ~MPPE_STATELESS;
1002 +                   }
1003 +               } else {
1004 +                   if (wo->mppe_stateless && !dont_nak) {
1005 +                       wo->mppe_stateless = 0;
1006 +                       newret = CONFNAK;
1007 +                       p[2] |= MPPE_STATELESS;
1008 +                   }
1009 +               }
1010 +
1011 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT|MPPE_128BIT)) {
1012 +                   newret = CONFNAK;
1013 +                   if (ao->mppe_128) {
1014 +                       ho->mppe_128 = 1;
1015 +                       p[5] &= ~(MPPE_40BIT|MPPE_56BIT);
1016 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1017 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1018 +                             MPPE_MAX_KEY_LEN);
1019 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1020 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1021 +                           ho->mppe_128 = 0;
1022 +                           p[5] |= (MPPE_40BIT|MPPE_56BIT);
1023 +                           p[5] &= ~MPPE_128BIT;
1024 +                           goto check_mppe_56_40;
1025 +                       }
1026 +                       goto check_mppe;
1027 +                   }
1028 +                   p[5] &= ~MPPE_128BIT;
1029 +                   goto check_mppe_56_40;
1030 +               }
1031 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_56BIT|MPPE_128BIT)) {
1032 +                   newret = CONFNAK;
1033 +                   if (ao->mppe_128) {
1034 +                       ho->mppe_128 = 1;
1035 +                       p[5] &= ~MPPE_56BIT;
1036 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1037 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1038 +                             MPPE_MAX_KEY_LEN);
1039 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1040 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1041 +                           ho->mppe_128 = 0;
1042 +                           p[5] |= MPPE_56BIT;
1043 +                           p[5] &= ~MPPE_128BIT;
1044 +                           goto check_mppe_56;
1045 +                       }
1046 +                       goto check_mppe;
1047 +                   }
1048 +                   p[5] &= ~MPPE_128BIT;
1049 +                   goto check_mppe_56;
1050 +               }
1051 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_128BIT)) {
1052 +                   newret = CONFNAK;
1053 +                   if (ao->mppe_128) {
1054 +                       ho->mppe_128 = 1;
1055 +                       p[5] &= ~MPPE_40BIT;
1056 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1057 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1058 +                             MPPE_MAX_KEY_LEN);
1059 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1060 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1061 +                           ho->mppe_128 = 0;
1062 +                           p[5] |= MPPE_40BIT;
1063 +                           p[5] &= ~MPPE_128BIT;
1064 +                           goto check_mppe_40;
1065 +                       }
1066 +                       goto check_mppe;
1067 +                   }
1068 +                   p[5] &= ~MPPE_128BIT;
1069 +                   goto check_mppe_40;
1070 +               }
1071 +               if ((p[5] & ~MPPE_MPPC) == MPPE_128BIT) {
1072 +                   if (ao->mppe_128) {
1073 +                       ho->mppe_128 = 1;
1074 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1075 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1076 +                             MPPE_MAX_KEY_LEN);
1077 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1078 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1079 +                           ho->mppe_128 = 0;
1080 +                           p[5] &= ~MPPE_128BIT;
1081 +                           newret = CONFNAK;
1082 +                       }
1083 +                       goto check_mppe;
1084 +                   }
1085 +                   p[5] &= ~MPPE_128BIT;
1086 +                   newret = CONFNAK;
1087 +                   goto check_mppe;
1088 +               }
1089 +           check_mppe_56_40:
1090 +               if ((p[5] & ~MPPE_MPPC) == (MPPE_40BIT|MPPE_56BIT)) {
1091 +                   newret = CONFNAK;
1092 +                   if (ao->mppe_56) {
1093 +                       ho->mppe_56 = 1;
1094 +                       p[5] &= ~MPPE_40BIT;
1095 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1096 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1097 +                             MPPE_MAX_KEY_LEN);
1098 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1099 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1100 +                           ho->mppe_56 = 0;
1101 +                           p[5] |= MPPE_40BIT;
1102 +                           p[5] &= ~MPPE_56BIT;
1103 +                           newret = CONFNAK;
1104 +                           goto check_mppe_40;
1105 +                       }
1106 +                       goto check_mppe;
1107 +                   }
1108 +                   p[5] &= ~MPPE_56BIT;
1109 +                   goto check_mppe_40;
1110 +               }
1111 +           check_mppe_56:
1112 +               if ((p[5] & ~MPPE_MPPC) == MPPE_56BIT) {
1113 +                   if (ao->mppe_56) {
1114 +                       ho->mppe_56 = 1;
1115 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1116 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1117 +                             MPPE_MAX_KEY_LEN);
1118 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1119 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1120 +                           ho->mppe_56 = 0;
1121 +                           p[5] &= ~MPPE_56BIT;
1122 +                           newret = CONFNAK;
1123 +                       }
1124 +                       goto check_mppe;
1125 +                   }
1126 +                   p[5] &= ~MPPE_56BIT;
1127 +                   newret = CONFNAK;
1128 +                   goto check_mppe;
1129 +               }
1130 +           check_mppe_40:
1131 +               if ((p[5] & ~MPPE_MPPC) == MPPE_40BIT) {
1132 +                   if (ao->mppe_40) {
1133 +                       ho->mppe_40 = 1;
1134 +                       BCOPY(p, opt_buf, CILEN_MPPE);
1135 +                       BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1136 +                             MPPE_MAX_KEY_LEN);
1137 +                       if (ccp_test(f->unit, opt_buf, CILEN_MPPE +
1138 +                                    MPPE_MAX_KEY_LEN, 1) <= 0) {
1139 +                           ho->mppe_40 = 0;
1140 +                           p[5] &= ~MPPE_40BIT;
1141 +                           newret = CONFNAK;
1142 +                       }
1143 +                       goto check_mppe;
1144 +                   }
1145 +                   p[5] &= ~MPPE_40BIT;
1146 +               }
1147 +
1148 +           check_mppe:
1149 +               if (!ho->mppe_40 && !ho->mppe_56 && !ho->mppe_128) {
1150 +                   if (wo->mppe_40 || wo->mppe_56 || wo->mppe_128) {
1151 +                       newret = CONFNAK;
1152 +                       p[2] |= (wo->mppe_stateless ? MPPE_STATELESS : 0);
1153 +                       p[5] |= (wo->mppe_40 ? MPPE_40BIT : 0) |
1154 +                           (wo->mppe_56 ? MPPE_56BIT : 0) |
1155 +                           (wo->mppe_128 ? MPPE_128BIT : 0) |
1156 +                           (wo->mppc ? MPPE_MPPC : 0);
1157 +                   } else {
1158 +                       ho->mppe = ho->mppe_stateless = 0;
1159 +                   }
1160                 } else {
1161 -                   /* Neither are set. */
1162 -                   /* We cannot accept this.  */
1163 -                   newret = CONFNAK;
1164 -                   /* Give the peer our idea of what can be used,
1165 -                      so it can choose and confirm */
1166 -                   ho->mppe = ao->mppe;
1167 -               }
1168 -
1169 -               /* rebuild the opts */
1170 -               MPPE_OPTS_TO_CI(ho->mppe, &p[2]);
1171 -               if (newret == CONFACK) {
1172 -                   u_char opt_buf[CILEN_MPPE + MPPE_MAX_KEY_LEN];
1173 -                   int mtu;
1174 -
1175 -                   BCOPY(p, opt_buf, CILEN_MPPE);
1176 -                   BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE],
1177 -                         MPPE_MAX_KEY_LEN);
1178 -                   if (ccp_test(f->unit, opt_buf,
1179 -                                CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) {
1180 -                       /* This shouldn't happen, we've already tested it! */
1181 -                       error("MPPE required, but kernel has no support.");
1182 -                       lcp_close(f->unit, "MPPE required but not available");
1183 -                       newret = CONFREJ;
1184 -                       break;
1185 -                   }
1186 -                   /*
1187 -                    * We need to decrease the interface MTU by MPPE_PAD
1188 -                    * because MPPE frames **grow**.  The kernel [must]
1189 -                    * allocate MPPE_PAD extra bytes in xmit buffers.
1190 -                    */
1191 -                   mtu = netif_get_mtu(f->unit);
1192 -                   if (mtu)
1193 -                       netif_set_mtu(f->unit, mtu - MPPE_PAD);
1194 -                   else
1195 -                       newret = CONFREJ;
1196 -               }
1197 -
1198 -               /*
1199 -                * We have accepted MPPE or are willing to negotiate
1200 -                * MPPE parameters.  A CONFREJ is due to subsequent
1201 -                * (non-MPPE) processing.
1202 -                */
1203 -               rej_for_ci_mppe = 0;
1204 -               break;
1205 -#endif /* MPPE */
1206 +                   /* MPPE is not compatible with other compression types */
1207 +                   if (wo->mppe) {
1208 +                       ao->bsd_compress = 0;
1209 +                       ao->predictor_1 = 0;
1210 +                       ao->predictor_2 = 0;
1211 +                       ao->deflate = 0;
1212 +                       ao->lzs = 0;
1213 +                   }
1214 +               }
1215 +               if ((!ho->mppc || !ao->mppc) && !ho->mppe) {
1216 +                   p[2] = p2;
1217 +                   p[5] = p5;
1218 +                   newret = CONFREJ;
1219 +                   break;
1220 +               }
1221 +
1222 +               /*
1223 +                * I have commented the code below because according to RFC1547
1224 +                * MTU is only information for higher level protocols about
1225 +                * "the maximum allowable length for a packet (q.v.) transmitted
1226 +                * over a point-to-point link without incurring network layer
1227 +                * fragmentation." Of course a PPP implementation should be able
1228 +                * to handle overhead added by MPPE - in our case apropriate code
1229 +                * is located in drivers/net/ppp_generic.c in the kernel sources.
1230 +                *
1231 +                * According to RFC1661:
1232 +                * - when negotiated MRU is less than 1500 octets, a PPP
1233 +                *   implementation must still be able to receive at least 1500
1234 +                *   octets,
1235 +                * - when PFC is negotiated, a PPP implementation is still
1236 +                *   required to receive frames with uncompressed protocol field.
1237 +                *
1238 +                * So why not to handle MPPE overhead without changing MTU value?
1239 +                * I am sure that RFC3078, unfortunately silently, assumes that.
1240 +                */
1241 +
1242 +               /*
1243 +                * We need to decrease the interface MTU by MPPE_PAD
1244 +                * because MPPE frames **grow**.  The kernel [must]
1245 +                * allocate MPPE_PAD extra bytes in xmit buffers.
1246 +                */
1247 + /*
1248 +               mtu = netif_get_mtu(f->unit);
1249 +               if (mtu) {
1250 +                   netif_set_mtu(f->unit, mtu - MPPE_PAD);
1251 +               } else {
1252 +                   newret = CONFREJ;
1253 +                   if (ccp_wantoptions[f->unit].mppe) {
1254 +                       error("Cannot adjust MTU needed by MPPE.");
1255 +                       lcp_close(f->unit, "Cannot adjust MTU needed by MPPE.");
1256 +                   }
1257 +               }
1258 + */
1259 +               break;
1260 +  #endif /* MPPE */
1261 +
1262 +           case CI_LZS:
1263 +               if (!ao->lzs || clen != CILEN_LZS) {
1264 +                   newret = CONFREJ;
1265 +                   break;
1266 +               }
1267 +
1268 +               ho->lzs = 1;
1269 +               ho->lzs_hists = (p[2] << 8) | p[3];
1270 +               ho->lzs_mode = p[4];
1271 +       if ((ho->lzs_hists != ao->lzs_hists) ||
1272 +                   (ho->lzs_mode != ao->lzs_mode)) {
1273 +                   newret = CONFNAK;
1274 +                   if (!dont_nak) {
1275 +                       p[2] = ao->lzs_hists >> 8;
1276 +                       p[3] = ao->lzs_hists & 0xff;
1277 +                       p[4] = ao->lzs_mode;
1278 +           } else
1279 +                       break;
1280 +               }
1281 +
1282 +               if (p == p0 && ccp_test(f->unit, p, CILEN_LZS, 1) <= 0) {
1283 +                   newret = CONFREJ;
1284 +               }
1285 +               break;
1286             case CI_DEFLATE:
1287             case CI_DEFLATE_DRAFT:
1288                 if (!ao->deflate || clen != CILEN_DEFLATE
1289 @@ -1344,12 +1830,6 @@ ccp_reqci(f, p, lenp, dont_nak)
1290         else
1291             *lenp = retp - p0;
1292      }
1293 -#ifdef MPPE
1294 -    if (ret == CONFREJ && ao->mppe && rej_for_ci_mppe) {
1295 -       error("MPPE required but peer negotiation failed");
1296 -       lcp_close(f->unit, "MPPE required but peer negotiation failed");
1297 -    }
1298 -#endif
1299      return ret;
1300  }
1301
1302 @@ -1371,24 +1851,35 @@ method_name(opt, opt2)
1303         char *p = result;
1304         char *q = result + sizeof(result); /* 1 past result */
1305
1306 -       slprintf(p, q - p, "MPPE ");
1307 -       p += 5;
1308 -       if (opt->mppe & MPPE_OPT_128) {
1309 -           slprintf(p, q - p, "128-bit ");
1310 -           p += 8;
1311 -       }
1312 -       if (opt->mppe & MPPE_OPT_40) {
1313 -           slprintf(p, q - p, "40-bit ");
1314 -           p += 7;
1315 -       }
1316 -       if (opt->mppe & MPPE_OPT_STATEFUL)
1317 -           slprintf(p, q - p, "stateful");
1318 -       else
1319 -           slprintf(p, q - p, "stateless");
1320 -
1321 +       if (opt->mppe) {
1322 +           if (opt->mppc) {
1323 +               slprintf(p, q - p, "MPPC/MPPE ");
1324 +               p += 10;
1325 +           } else {
1326 +               slprintf(p, q - p, "MPPE ");
1327 +               p += 5;
1328 +           }
1329 +           if (opt->mppe_128) {
1330 +               slprintf(p, q - p, "128-bit ");
1331 +               p += 8;
1332 +           } else if (opt->mppe_56) {
1333 +               slprintf(p, q - p, "56-bit ");
1334 +               p += 7;
1335 +           } else if (opt->mppe_40) {
1336 +               slprintf(p, q - p, "40-bit ");
1337 +               p += 7;
1338 +           }
1339 +           if (opt->mppe_stateless)
1340 +               slprintf(p, q - p, "stateless");
1341 +           else
1342 +               slprintf(p, q - p, "stateful");
1343 +       } else if (opt->mppc)
1344 +           slprintf(p, q - p, "MPPC");
1345         break;
1346      }
1347 -#endif
1348 +#endif /* MPPE */
1349 +    case CI_LZS:
1350 +       return "Stac LZS";
1351      case CI_DEFLATE:
1352      case CI_DEFLATE_DRAFT:
1353         if (opt2 != NULL && opt2->deflate_size != opt->deflate_size)
1354 @@ -1444,12 +1935,12 @@ ccp_up(f)
1355      } else if (ANY_COMPRESS(*ho))
1356         notice("%s transmit compression enabled", method_name(ho, NULL));
1357  #ifdef MPPE
1358 -    if (go->mppe) {
1359 +    if (go->mppe || go->mppc) {
1360         BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN);
1361         BZERO(mppe_send_key, MPPE_MAX_KEY_LEN);
1362         continue_networks(f->unit);             /* Bring up IP et al */
1363      }
1364 -#endif
1365 +#endif /* MPPE */
1366  }
1367
1368  /*
1369 @@ -1472,7 +1963,7 @@ ccp_down(f)
1370             lcp_close(f->unit, "MPPE disabled");
1371         }
1372      }
1373 -#endif
1374 +#endif /* MPPE */
1375  }
1376
1377  /*
1378 @@ -1532,24 +2023,28 @@ ccp_printpkt(p, plen, printer, arg)
1379  #ifdef MPPE
1380             case CI_MPPE:
1381                 if (optlen >= CILEN_MPPE) {
1382 -                   u_char mppe_opts;
1383 -
1384 -                   MPPE_CI_TO_OPTS(&p[2], mppe_opts);
1385 -                   printer(arg, "mppe %s %s %s %s %s %s%s",
1386 -                           (p[2] & MPPE_H_BIT)? "+H": "-H",
1387 -                           (p[5] & MPPE_M_BIT)? "+M": "-M",
1388 -                           (p[5] & MPPE_S_BIT)? "+S": "-S",
1389 -                           (p[5] & MPPE_L_BIT)? "+L": "-L",
1390 +                   printer(arg, "mppe %s %s %s %s %s %s",
1391 +                           (p[2] & MPPE_STATELESS)? "+H": "-H",
1392 +                           (p[5] & MPPE_56BIT)? "+M": "-M",
1393 +                           (p[5] & MPPE_128BIT)? "+S": "-S",
1394 +                           (p[5] & MPPE_40BIT)? "+L": "-L",
1395                             (p[5] & MPPE_D_BIT)? "+D": "-D",
1396 -                           (p[5] & MPPE_C_BIT)? "+C": "-C",
1397 -                           (mppe_opts & MPPE_OPT_UNKNOWN)? " +U": "");
1398 -                   if (mppe_opts & MPPE_OPT_UNKNOWN)
1399 +                           (p[5] & MPPE_MPPC)? "+C": "-C");
1400 +                   if ((p[5] & ~(MPPE_56BIT | MPPE_128BIT | MPPE_40BIT |
1401 +                                 MPPE_D_BIT | MPPE_MPPC)) ||
1402 +                       (p[2] & ~MPPE_STATELESS))
1403                         printer(arg, " (%.2x %.2x %.2x %.2x)",
1404                                 p[2], p[3], p[4], p[5]);
1405                     p += CILEN_MPPE;
1406                 }
1407                 break;
1408 -#endif
1409 +#endif /* MPPE */
1410 +           case CI_LZS:
1411 +               if (optlen >= CILEN_LZS) {
1412 +                   printer(arg, "lzs %.2x %.2x %.2x", p[2], p[3], p[4]);
1413 +                   p += CILEN_LZS;
1414 +               }
1415 +               break;
1416             case CI_DEFLATE:
1417             case CI_DEFLATE_DRAFT:
1418                 if (optlen >= CILEN_DEFLATE) {
1419 @@ -1635,6 +2130,7 @@ ccp_datainput(unit, pkt, len)
1420             error("Lost compression sync: disabling compression");
1421             ccp_close(unit, "Lost compression sync");
1422  #ifdef MPPE
1423 +           /* My module dosn't need this. J.D., 2003-07-06 */
1424             /*
1425              * If we were doing MPPE, we must also take the link down.
1426              */
1427 @@ -1642,9 +2138,18 @@ ccp_datainput(unit, pkt, len)
1428                 error("Too many MPPE errors, closing LCP");
1429                 lcp_close(unit, "Too many MPPE errors");
1430             }
1431 -#endif
1432 +#endif /* MPPE */
1433         } else {
1434             /*
1435 +            * When LZS or MPPE/MPPC is negotiated we just send CCP_RESETREQ
1436 +            * and don't wait for CCP_RESETACK
1437 +            */
1438 +           if ((ccp_gotoptions[f->unit].method == CI_LZS) ||
1439 +               (ccp_gotoptions[f->unit].method == CI_MPPE)) {
1440 +               fsm_sdata(f, CCP_RESETREQ, f->reqid = ++f->id, NULL, 0);
1441 +               return;
1442 +           }
1443 +           /*
1444              * Send a reset-request to reset the peer's compressor.
1445              * We don't do that if we are still waiting for an
1446              * acknowledgement to a previous reset-request.
1447 --- a/pppd/ccp.h
1448 +++ b/pppd/ccp.h
1449 @@ -37,9 +37,17 @@ typedef struct ccp_options {
1450      bool predictor_2;          /* do Predictor-2? */
1451      bool deflate_correct;      /* use correct code for deflate? */
1452      bool deflate_draft;                /* use draft RFC code for deflate? */
1453 +    bool lzs;                  /* do Stac LZS? */
1454 +    bool mppc;                 /* do MPPC? */
1455      bool mppe;                 /* do MPPE? */
1456 +    bool mppe_40;              /* allow 40 bit encryption? */
1457 +    bool mppe_56;              /* allow 56 bit encryption? */
1458 +    bool mppe_128;             /* allow 128 bit encryption? */
1459 +    bool mppe_stateless;       /* allow stateless encryption */
1460      u_short bsd_bits;          /* # bits/code for BSD Compress */
1461      u_short deflate_size;      /* lg(window size) for Deflate */
1462 +    u_short lzs_mode;          /* LZS check mode */
1463 +    u_short lzs_hists;         /* number of LZS histories */
1464      short method;              /* code for chosen compression method */
1465  } ccp_options;
1466
1467 --- a/pppd/chap_ms.c
1468 +++ b/pppd/chap_ms.c
1469 @@ -898,13 +898,17 @@ set_mppe_enc_types(int policy, int types
1470      /*
1471       * Disable undesirable encryption types.  Note that we don't ENABLE
1472       * any encryption types, to avoid overriding manual configuration.
1473 +     *
1474 +     * It seems that 56 bit keys are unsupported in MS-RADIUS (see RFC 2548)
1475       */
1476      switch(types) {
1477         case MPPE_ENC_TYPES_RC4_40:
1478 -           ccp_wantoptions[0].mppe &= ~MPPE_OPT_128;   /* disable 128-bit */
1479 +           ccp_wantoptions[0].mppe_128 = 0;    /* disable 128-bit */
1480 +           ccp_wantoptions[0].mppe_56 = 0;     /* disable 56-bit */
1481             break;
1482         case MPPE_ENC_TYPES_RC4_128:
1483 -           ccp_wantoptions[0].mppe &= ~MPPE_OPT_40;    /* disable 40-bit */
1484 +           ccp_wantoptions[0].mppe_56 = 0;     /* disable 56-bit */
1485 +           ccp_wantoptions[0].mppe_40 = 0;     /* disable 40-bit */
1486             break;
1487         default:
1488             break;