обязательное шифрование в mpd5

[bmth]

Как в mpd5 потребовать от клиентов обязательное шифрование? Настройка "set bundle yes crypt-reqd" не помогает - клиенты все равно могут подключаться без шифрования =(

конфиг такой:

Код: Выделить всё

pptp_server: 
        set ippool add pool1 172.16.0.60 172.16.0.79 

        create bundle template B 
        set iface enable proxy-arp 
        set iface idle 1800 
        set iface enable tcpmssfix 
        set ipcp yes vjcomp 
        set ipcp ranges 172.16.0.50/32 ippool pool1 
        set ipcp dns 172.16.0.50 
        set bundle enable compression 
        set ccp yes mppc 
        set mppc no e40 
        set mppc no e56 
        set mppc yes e128 
        set mppc yes stateless 
        set bundle yes crypt-reqd 

        create link template L pptp 
        set link action bundle B 
        set link enable multilink 
        set link yes acfcomp protocomp 
        set link no pap chap 
        set link enable chap-msv2 
        set link keep-alive 10 60 
        set link mtu 1460 

        set pptp self 172.16.0.50 
        set link enable incoming

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Гость]

приведите лог соединения
когда на клиенте по вашему отключено шифрование
а mpd поднимает точка точку без шифрования

[bmth]

ключевая строка:

Код: Выделить всё

mpd: [B-1] CCP: Protocol mppc disabled as useless for this setup

полный лог:

Код: Выделить всё

mpd: Multi-link PPP daemon for FreeBSD
mpd:  
mpd: process 4975 started, version 5.2 (root@vpn.local 21:05  6-Dec-2008)
mpd: PPTP: waiting for connection on 172.16.0.50 1723
mpd: [L-1] Accepting PPTP connection
mpd: [L-1] Link: OPEN event
mpd: [L-1] LCP: Open event
mpd: [L-1] LCP: state change Initial --> Starting
mpd: [L-1] LCP: LayerStart
mpd: [L-1] PPTP: attaching to peer's outgoing call
mpd: [L-1] Link: UP event
mpd: [L-1] LCP: Up event
mpd: [L-1] LCP: state change Starting --> Req-Sent
mpd: [L-1] LCP: SendConfigReq #1
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM fc0623e6
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1]   MP MRRU 2048
mpd: [L-1]   MP SHORTSEQ
mpd: [L-1]   ENDPOINTDISC [802.1] 00 14 23 bb bf ee
mpd: [L-1] LCP: rec'd Configure Request #0 (Req-Sent)
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 79a60d5e
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1]   CALLBACK 6
mpd: [L-1] LCP: SendConfigRej #0
mpd: [L-1]   CALLBACK 6
mpd: [L-1] LCP: rec'd Configure Request #1 (Req-Sent)
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 79a60d5e
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1] LCP: SendConfigAck #1
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 79a60d5e
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1] LCP: state change Req-Sent --> Ack-Sent
mpd: [L-1] LCP: SendConfigReq #2
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM fc0623e6
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1]   MP MRRU 2048
mpd: [L-1]   MP SHORTSEQ
mpd: [L-1]   ENDPOINTDISC [802.1] 00 14 23 bb bf ee
mpd: [L-1] LCP: rec'd Configure Reject #2 (Ack-Sent)
mpd: [L-1]   MP MRRU 2048
mpd: [L-1]   MP SHORTSEQ
mpd: [L-1]   ENDPOINTDISC [802.1] 00 14 23 bb bf ee
mpd: [L-1] LCP: SendConfigReq #3
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM fc0623e8
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1] LCP: rec'd Configure Ack #3 (Ack-Sent)
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM fc0623e8
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1] LCP: state change Ack-Sent --> Opened
mpd: [L-1] LCP: auth: peer wants nothing, I want CHAP
mpd: [L-1] CHAP: sending CHALLENGE #1 len: 21
mpd: [L-1] LCP: LayerUp
mpd: [L-1] LCP: rec'd Ident #2 (Opened)
mpd: [L-1]   MESG: MSRASV5.20
mpd: [L-1] LCP: rec'd Ident #3 (Opened)
mpd: [L-1]   MESG: MSRAS-0-NB-HP
mpd: [L-1] CHAP: rec'd RESPONSE #1 len: 58
mpd: [L-1]   Name: "bmth"
mpd: [L-1] AUTH: Trying INTERNAL
mpd: [L-1] AUTH: INTERNAL returned: undefined
mpd: [L-1] CHAP: Auth return status: undefined
mpd: [L-1] CHAP: Response is valid
mpd: [L-1] CHAP: Reply message: S=689FE65A59ECF16691E1B351A75E07BEBFE7BE67
mpd: [L-1] CHAP: sending SUCCESS #1 len: 46
mpd: [L-1] LCP: authorization successful
mpd: [L-1] Link: Matched action 'bundle "B" ""'
mpd: [L-1] Creating new bundle using template "B".
mpd: [B-1] Bundle: Interface ng0 created
mpd: [L-1] Link: Join bundle "B-1"
mpd: [B-1] Bundle: Status update: up 1 link, total bandwidth 64000 bps
mpd: [B-1] IPCP: Open event
mpd: [B-1] IPCP: state change Initial --> Starting
mpd: [B-1] IPCP: LayerStart
mpd: [B-1] CCP: Open event
mpd: [B-1] CCP: state change Initial --> Starting
mpd: [B-1] CCP: LayerStart
mpd: [B-1] IPCP: Up event
mpd: [B-1] IPCP: state change Starting --> Req-Sent
mpd: [B-1] IPCP: SendConfigReq #1
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [B-1]   COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
mpd: [B-1] CCP: Up event
mpd: [B-1] CCP: Protocol mppc disabled as useless for this setup
mpd: [B-1] CCP: state change Starting --> Req-Sent
mpd: [B-1] CCP: SendConfigReq #1
mpd: [L-1] rec'd unexpected protocol IPV6CP, rejecting
mpd: [B-1] IPCP: rec'd Configure Request #5 (Req-Sent)
mpd: [B-1]   IPADDR 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.2
mpd: [B-1]   PRIDNS 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.50
mpd: [B-1]   PRINBNS 0.0.0.0
mpd: [B-1]   SECDNS 0.0.0.0
mpd: [B-1]   SECNBNS 0.0.0.0
mpd: [B-1] IPCP: SendConfigRej #5
mpd: [B-1]   PRINBNS 0.0.0.0
mpd: [B-1]   SECDNS 0.0.0.0
mpd: [B-1]   SECNBNS 0.0.0.0
mpd: [B-1] IPCP: rec'd Configure Reject #1 (Req-Sent)
mpd: [B-1]   COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
mpd: [B-1] IPCP: SendConfigReq #2
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [L-1] LCP: rec'd Protocol Reject #6 (Opened)
mpd: [L-1] LCP: protocol CCP was rejected
mpd: [B-1] CCP: protocol was rejected by peer
mpd: [B-1] CCP: state change Req-Sent --> Stopped
mpd: [B-1] CCP: LayerFinish
mpd: [B-1] IPCP: rec'd Configure Request #7 (Req-Sent)
mpd: [B-1]   IPADDR 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.2
mpd: [B-1]   PRIDNS 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.50
mpd: [B-1] IPCP: SendConfigNak #7
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: rec'd Configure Ack #2 (Req-Sent)
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [B-1] IPCP: state change Req-Sent --> Ack-Rcvd
mpd: [B-1] IPCP: rec'd Configure Request #8 (Ack-Rcvd)
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]     172.16.0.2 is OK
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: SendConfigAck #8
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: state change Ack-Rcvd --> Opened
mpd: [B-1] IPCP: LayerUp
mpd: [B-1]   172.16.0.50 -> 172.16.0.2
mpd: [B-1] IFACE: Up event

[Гость]

set link enable multilink

отключите и покажите еще раз лог

[bmth]

Код: Выделить всё

mpd: Multi-link PPP daemon for FreeBSD
mpd:  
mpd: process 7138 started, version 5.2 (root@vpn.local 21:05  6-Dec-2008)
mpd: PPTP: waiting for connection on 172.16.0.50 1723
mpd: [L-1] Accepting PPTP connection
mpd: [L-1] Link: OPEN event
mpd: [L-1] LCP: Open event
mpd: [L-1] LCP: state change Initial --> Starting
mpd: [L-1] LCP: LayerStart
mpd: [L-1] PPTP: attaching to peer's outgoing call
mpd: [L-1] Link: UP event
mpd: [L-1] LCP: Up event
mpd: [L-1] LCP: state change Starting --> Req-Sent
mpd: [L-1] LCP: SendConfigReq #1
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM ed37c4f6
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1] LCP: rec'd Configure Request #0 (Req-Sent)
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 40af5c66
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1]   CALLBACK 6
mpd: [L-1] LCP: SendConfigRej #0
mpd: [L-1]   CALLBACK 6
mpd: [L-1] LCP: rec'd Configure Request #1 (Req-Sent)
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 40af5c66
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1] LCP: SendConfigAck #1
mpd: [L-1]   MRU 1400
mpd: [L-1]   MAGICNUM 40af5c66
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   ACFCOMP
mpd: [L-1] LCP: state change Req-Sent --> Ack-Sent
mpd: [L-1] LCP: SendConfigReq #2
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM ed37c4f6
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1] LCP: rec'd Configure Ack #2 (Ack-Sent)
mpd: [L-1]   ACFCOMP
mpd: [L-1]   PROTOCOMP
mpd: [L-1]   MRU 1500
mpd: [L-1]   MAGICNUM ed37c4f6
mpd: [L-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L-1] LCP: state change Ack-Sent --> Opened
mpd: [L-1] LCP: auth: peer wants nothing, I want CHAP
mpd: [L-1] CHAP: sending CHALLENGE #1 len: 21
mpd: [L-1] LCP: LayerUp
mpd: [L-1] LCP: rec'd Ident #2 (Opened)
mpd: [L-1]   MESG: MSRASV5.20
mpd: [L-1] LCP: rec'd Ident #3 (Opened)
mpd: [L-1]   MESG: MSRAS-0-NB-HP
mpd: [L-1] CHAP: rec'd RESPONSE #1 len: 58
mpd: [L-1]   Name: "bmth"
mpd: [L-1] AUTH: Trying INTERNAL
mpd: [L-1] AUTH: INTERNAL returned: undefined
mpd: [L-1] CHAP: Auth return status: undefined
mpd: [L-1] CHAP: Response is valid
mpd: [L-1] CHAP: Reply message: S=C62D99F5714E945079F4A73F584555342BC80E2B
mpd: [L-1] CHAP: sending SUCCESS #1 len: 46
mpd: [L-1] LCP: authorization successful
mpd: [L-1] Link: Matched action 'bundle "B" ""'
mpd: [L-1] Creating new bundle using template "B".
mpd: [B-1] Bundle: Interface ng0 created
mpd: [L-1] Link: Join bundle "B-1"
mpd: [B-1] Bundle: Status update: up 1 link, total bandwidth 64000 bps
mpd: [B-1] IPCP: Open event
mpd: [B-1] IPCP: state change Initial --> Starting
mpd: [B-1] IPCP: LayerStart
mpd: [B-1] CCP: Open event
mpd: [B-1] CCP: state change Initial --> Starting
mpd: [B-1] CCP: LayerStart
mpd: [B-1] IPCP: Up event
mpd: [B-1] IPCP: state change Starting --> Req-Sent
mpd: [B-1] IPCP: SendConfigReq #1
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [B-1]   COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
mpd: [B-1] CCP: Up event
mpd: [B-1] CCP: Protocol mppc disabled as useless for this setup
mpd: [B-1] CCP: state change Starting --> Req-Sent
mpd: [B-1] CCP: SendConfigReq #1
mpd: [L-1] rec'd unexpected protocol IPV6CP, rejecting
mpd: [B-1] IPCP: rec'd Configure Request #5 (Req-Sent)
mpd: [B-1]   IPADDR 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.2
mpd: [B-1]   PRIDNS 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.50
mpd: [B-1]   PRINBNS 0.0.0.0
mpd: [B-1]   SECDNS 0.0.0.0
mpd: [B-1]   SECNBNS 0.0.0.0
mpd: [B-1] IPCP: SendConfigRej #5
mpd: [B-1]   PRINBNS 0.0.0.0
mpd: [B-1]   SECDNS 0.0.0.0
mpd: [B-1]   SECNBNS 0.0.0.0
mpd: [B-1] IPCP: rec'd Configure Reject #1 (Req-Sent)
mpd: [B-1]   COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
mpd: [B-1] IPCP: SendConfigReq #2
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [L-1] LCP: rec'd Protocol Reject #6 (Opened)
mpd: [L-1] LCP: protocol CCP was rejected
mpd: [B-1] CCP: protocol was rejected by peer
mpd: [B-1] CCP: state change Req-Sent --> Stopped
mpd: [B-1] CCP: LayerFinish
mpd: [B-1] IPCP: rec'd Configure Request #7 (Req-Sent)
mpd: [B-1]   IPADDR 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.2
mpd: [B-1]   PRIDNS 0.0.0.0
mpd: [B-1]     NAKing with 172.16.0.50
mpd: [B-1] IPCP: SendConfigNak #7
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: rec'd Configure Ack #2 (Req-Sent)
mpd: [B-1]   IPADDR 172.16.0.50
mpd: [B-1] IPCP: state change Req-Sent --> Ack-Rcvd
mpd: [B-1] IPCP: rec'd Configure Request #8 (Ack-Rcvd)
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]     172.16.0.2 is OK
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: SendConfigAck #8
mpd: [B-1]   IPADDR 172.16.0.2
mpd: [B-1]   PRIDNS 172.16.0.50
mpd: [B-1] IPCP: state change Ack-Rcvd --> Opened
mpd: [B-1] IPCP: LayerUp
mpd: [B-1]   172.16.0.50 -> 172.16.0.2
mpd: [B-1] IFACE: Up event

[bmth]

ни у кого никаких идей нету? неужели один я пытаюсь настроить шифрованный доступ к локалке?

[Гость]

у всех оно по умолчанию работает

[zingel]

IMO problem is encryption related. It looks like due to some reason
sides got out of sync. It could happen due to incomplete memory errors
handling withing ng_mppc node. I have made a patch to improve it. Patch
is for 8-CURRENT, but I think it should apply to 6-STABLE without
significant problems.

Write me please about results.

--
Alexander Motin

--- ng_mppc.c.prev 2007-05-18 18:28:01.000000000 +0300
+++ ng_mppc.c 2008-10-26 19:17:38.000000000 +0200
@@ -492,17 +492,18 @@ ng_mppc_compress(node_p node, struct mbu
/* Work with contiguous regions of memory. */
inlen = m->m_pkthdr.len;
inbuf = malloc(inlen, M_NETGRAPH_MPPC, M_NOWAIT);
- if (inbuf == NULL) {
- m_freem(m);
- return (ENOMEM);
- }
+ if (inbuf == NULL)
+ goto err1;
m_copydata(m, 0, inlen, (caddr_t)inbuf);

outlen = MPPC_MAX_BLOWUP(inlen);
outbuf = malloc(outlen, M_NETGRAPH_MPPC, M_NOWAIT);
if (outbuf == NULL) {
- m_freem(m);
free(inbuf, M_NETGRAPH_MPPC);
+err1:
+ m_freem(m);
+ MPPC_InitCompressionHistory(d->history);
+ d->flushed = 1;
return (ENOMEM);
}

@@ -538,8 +539,13 @@ ng_mppc_compress(node_p node, struct mbu
free(outbuf, M_NETGRAPH_MPPC);

/* Check m_devget() result. */
- if (m == NULL)
+ if (m == NULL) {
+ if (!d->flushed) {
+ MPPC_InitCompressionHistory(d->history);
+ d->flushed = 1;
+ }
return (ENOMEM);
+ }
}
#endif

@@ -551,6 +557,18 @@ ng_mppc_compress(node_p node, struct mbu
/* Set header bits */
header |= MPPC_FLAG_ENCRYPTED;

+ /* We must own the mbuf chain exclusively to modify it. */
+ m = m_unshare(m, M_DONTWAIT);
+ if (m == NULL) {
+ if (!d->flushed) {
+#ifdef NETGRAPH_MPPC_COMPRESSION
+ MPPC_InitCompressionHistory(d->history);
+#endif
+ d->flushed = 1;
+ }
+ return (ENOMEM);
+ }
+
/* Update key if it's time */
if ((d->cfg.bits & MPPE_STATELESS) != 0
|| (d->cc & MPPE_UPDATE_MASK) == MPPE_UPDATE_FLAG) {
@@ -562,11 +580,6 @@ ng_mppc_compress(node_p node, struct mbu
rc4_init(&d->rc4, d->key, KEYLEN(d->cfg.bits));
}

- /* We must own the mbuf chain exclusively to modify it. */
- m = m_unshare(m, M_DONTWAIT);
- if (m == NULL)
- return (ENOMEM);
-
/* Encrypt packet */
m1 = m;
while (m1) {

[paradox]

та не у него другая проблема

[zingel]

у него не срабатывает как я понял crypt-reqd? или чего

[paradox]

как я понял
он неможет сделать отбой клиенту у которого не стоит шифрование
либо принудительно заставить его включить его

вообще както замысловато

[zingel]

у него наверное есть 2 канал которые идут через 1 кривой гейт и клиенты не шифруясь попадают на первый, вместо второго

[paradox]

>bmth
у тебя какая то загадочная ситуация
такое чувство что на клиенте принудительно включено подлючаться без шифрования

думать надо
смотреть что там на клиенте не так

вообще на винде обычно по умолчанию влючаеться шифрование

[bmth]

что значит "у него"? неприлично обсуждать собеседника!!! )))

да, у меня на клиенте принудительно отключено шифрование, и, по соображениям безопасности, я хочу чтобы mpd пинал таких клиентов.
да, я понимаю, что шифрование в современных версиях винды по умолчанию включено.

http://mpd.sourceforge.net/doc5/mpd22.html#22 :

Код: Выделить всё

crypt-reqd

Require encryption. When encryption support is compiled into mpd, this option causes mpd to drop the link if encryption cannot be succesfully negotiated in both directions. This means in effect, ``use encryption or don't connect at all''

The default is disable.

[hizel]

эээ, а собственно
encryption включать не надо?

плюс вы на ядро наложили патчи для mppc?
в виндозе если шифруем то и ужимаем

Note: In PPP, encryption should be handled by the ECP rather than CCP. However, Microsoft combined both compression and encryption into their ``compression'' algorithm (MPPC), which is confusing.

[paradox]

попробуй поменять на

set bundle enable crypt-reqd

[hizel]

лучше для надёжности

Код: Выделить всё

set bundle yes crypt-reqd

[paradox]

set bundle enable compression

я бы сдесь вообще ноу поставил
ведь патчи от мава не добавляли в ядро

[bmth]

Я пробовал и "set bundle yes crypt-reqd", и "set bundle enable crypt-reqd".
И само шифрование у меня работает.
А про патчи на ядро, или на mpd я ничего не знаю. Фряха 7.0, шифрование mmpe там включено по умолчанию.
Mpd я ставил их из портов, так что я думаю что нужные патчи у меня есть.

[hizel]

вы подключаетесь windows-ом
если да, посмотрите свойства соединения
без mppc оно врет, что никакого шифрования нет :"(

[bmth]

подключился, посмотрел, проверил. винда говорит, что шифрования нет. может она, конечно, и врет, но в логах mpd тоже значится mpd:

Код: Выделить всё

[B-1] CCP: Protocol mppc disabled as useless for this setup

[paradox]

mppc это компрессия а не шифрование