1 /* $NetBSD: if_spppsubr.c,v 1.289 2026/06/18 09:14:58 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.289 2026/06/18 09:14:58 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/if_types.h> 76 #include <net/route.h> 77 #include <net/ppp_defs.h> 78 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/in_var.h> 82 #ifdef INET 83 #include <netinet/ip.h> 84 #include <netinet/tcp.h> 85 #endif 86 #include <net/ethertypes.h> 87 88 #ifdef INET6 89 #include <netinet6/scope6_var.h> 90 #endif 91 92 #include <net/if_sppp.h> 93 #include <net/if_spppvar.h> 94 95 #ifdef NET_MPSAFE 96 #define SPPPSUBR_MPSAFE 1 97 #endif 98 99 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 100 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 101 #define LOOPALIVECNT 3 /* loopback detection tries */ 102 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 103 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 104 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 105 106 #ifndef SPPP_KEEPALIVE_INTERVAL 107 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 108 #endif 109 110 #ifndef SPPP_NORECV_TIME 111 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 112 #endif 113 114 #ifndef SPPP_ALIVE_INTERVAL 115 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 116 #endif 117 118 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 119 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 120 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 121 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 122 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 123 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 124 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 125 126 /* 127 * Interface flags that can be set in an ifconfig command. 128 * 129 * Setting link0 will make the link passive, i.e. it will be marked 130 * as being administrative openable, but won't be opened to begin 131 * with. Incoming calls will be answered, or subsequent calls with 132 * -link1 will cause the administrative open of the LCP layer. 133 * 134 * Setting link1 will cause the link to auto-dial only as packets 135 * arrive to be sent. 136 * 137 * Setting IFF_DEBUG will syslog the option negotiation and state 138 * transitions at level kern.debug. Note: all logs consistently look 139 * like 140 * 141 * <if-name><unit>: <proto-name> <additional info...> 142 * 143 * with <if-name><unit> being something like "bppp0", and <proto-name> 144 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 145 */ 146 147 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 148 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 149 150 #define CONF_REQ 1 /* PPP configure request */ 151 #define CONF_ACK 2 /* PPP configure acknowledge */ 152 #define CONF_NAK 3 /* PPP configure negative ack */ 153 #define CONF_REJ 4 /* PPP configure reject */ 154 #define TERM_REQ 5 /* PPP terminate request */ 155 #define TERM_ACK 6 /* PPP terminate acknowledge */ 156 #define CODE_REJ 7 /* PPP code reject */ 157 #define PROTO_REJ 8 /* PPP protocol reject */ 158 #define ECHO_REQ 9 /* PPP echo request */ 159 #define ECHO_REPLY 10 /* PPP echo reply */ 160 #define DISC_REQ 11 /* PPP discard request */ 161 162 #define LCP_OPT_MRU 1 /* maximum receive unit */ 163 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 164 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 165 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 166 #define LCP_OPT_MAGIC 5 /* magic number */ 167 #define LCP_OPT_RESERVED 6 /* reserved */ 168 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 169 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 170 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 171 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 172 #define LCP_OPT_CALL_BACK 13 /* callback */ 173 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 174 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 175 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 176 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 177 178 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 179 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 180 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 181 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 182 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 183 184 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 185 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 186 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 187 188 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 189 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 190 191 #define PAP_REQ 1 /* PAP name/password request */ 192 #define PAP_ACK 2 /* PAP acknowledge */ 193 #define PAP_NAK 3 /* PAP fail */ 194 195 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 196 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 197 #define CHAP_SUCCESS 3 /* CHAP response ok */ 198 #define CHAP_FAILURE 4 /* CHAP response failed */ 199 200 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 201 202 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 203 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 204 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 205 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 206 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 207 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 208 209 #define PPP_NOPROTO 0 /* no authentication protocol */ 210 211 enum { 212 STATE_INITIAL = SPPP_STATE_INITIAL, 213 STATE_STARTING = SPPP_STATE_STARTING, 214 STATE_CLOSED = SPPP_STATE_CLOSED, 215 STATE_STOPPED = SPPP_STATE_STOPPED, 216 STATE_CLOSING = SPPP_STATE_CLOSING, 217 STATE_STOPPING = SPPP_STATE_STOPPING, 218 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 219 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 220 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 221 STATE_OPENED = SPPP_STATE_OPENED, 222 }; 223 224 enum cp_rcr_type { 225 CP_RCR_NONE = 0, /* initial value */ 226 CP_RCR_ACK, /* RCR+ */ 227 CP_RCR_NAK, /* RCR- */ 228 CP_RCR_REJ, /* RCR- */ 229 CP_RCR_DROP, /* DROP message */ 230 CP_RCR_ERR, /* internal error */ 231 }; 232 233 struct ppp_header { 234 uint8_t address; 235 uint8_t control; 236 uint16_t protocol; 237 } __packed; 238 #define PPP_HEADER_LEN sizeof (struct ppp_header) 239 240 struct lcp_header { 241 uint8_t type; 242 uint8_t ident; 243 uint16_t len; 244 } __packed; 245 #define LCP_HEADER_LEN sizeof (struct lcp_header) 246 247 struct cisco_packet { 248 uint32_t type; 249 uint32_t par1; 250 uint32_t par2; 251 uint16_t rel; 252 uint16_t time0; 253 uint16_t time1; 254 } __packed; 255 #define CISCO_PACKET_LEN 18 256 257 /* 258 * We follow the spelling and capitalization of RFC 1661 here, to make 259 * it easier comparing with the standard. Please refer to this RFC in 260 * case you can't make sense out of these abbreviation; it will also 261 * explain the semantics related to the various events and actions. 262 */ 263 struct cp { 264 u_short proto; /* PPP control protocol number */ 265 u_char protoidx; /* index into state table in struct sppp */ 266 u_char flags; 267 #define CP_LCP 0x01 /* this is the LCP */ 268 #define CP_AUTH 0x02 /* this is an authentication protocol */ 269 #define CP_NCP 0x04 /* this is a NCP */ 270 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 271 const char *name; /* name of this control protocol */ 272 /* event handlers */ 273 void (*Up)(struct sppp *, void *); 274 void (*Down)(struct sppp *, void *); 275 void (*Open)(struct sppp *, void *); 276 void (*Close)(struct sppp *, void *); 277 void (*TO)(struct sppp *, void *); 278 /* actions */ 279 void (*tlu)(struct sppp *); 280 void (*tld)(struct sppp *); 281 void (*tls)(const struct cp *, struct sppp *); 282 void (*tlf)(const struct cp *, struct sppp *); 283 void (*scr)(struct sppp *); 284 void (*screply)(const struct cp *, struct sppp *, u_char, 285 uint8_t, size_t, void *); 286 287 /* message parser */ 288 enum cp_rcr_type 289 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 290 uint8_t **, size_t *, size_t *); 291 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 292 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 293 }; 294 295 enum auth_role { 296 SPPP_AUTH_NOROLE = 0, 297 SPPP_AUTH_SERV = __BIT(0), 298 SPPP_AUTH_PEER = __BIT(1), 299 }; 300 301 static struct sppp *spppq; 302 static kmutex_t *spppq_lock = NULL; 303 static callout_t keepalive_ch; 304 static unsigned int sppp_keepalive_cnt = 0; 305 unsigned int sppp_keepalive_interval = SPPP_KEEPALIVE_INTERVAL; 306 307 pktq_rps_hash_func_t sppp_pktq_rps_hash_p; 308 309 #define SPPPQ_LOCK() if (spppq_lock) \ 310 mutex_enter(spppq_lock); 311 #define SPPPQ_UNLOCK() if (spppq_lock) \ 312 mutex_exit(spppq_lock); 313 314 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 315 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 316 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 317 #define SPPP_WQ_SET(_wk, _func, _arg) \ 318 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 319 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \ 320 if (__predict_true((_sp) != NULL)) { \ 321 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \ 322 } \ 323 addlog((_fmt), ##_args); \ 324 } while (0) 325 #define SPPP_DLOG(_sp, _fmt, _args...) do { \ 326 if (!sppp_debug_enabled(_sp)) \ 327 break; \ 328 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \ 329 } while (0) 330 331 #ifdef INET 332 #ifndef SPPPSUBR_MPSAFE 333 /* 334 * The following disgusting hack gets around the problem that IP TOS 335 * can't be set yet. We want to put "interactive" traffic on a high 336 * priority queue. To decide if traffic is interactive, we check that 337 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 338 * 339 * XXX is this really still necessary? - joerg - 340 */ 341 static u_short interactive_ports[8] = { 342 0, 513, 0, 0, 343 0, 21, 0, 23, 344 }; 345 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 346 #endif /* SPPPSUBR_MPSAFE */ 347 #endif 348 349 /* almost every function needs these */ 350 351 static bool sppp_debug_enabled(struct sppp *sp); 352 static int sppp_output(struct ifnet *, struct mbuf *, 353 const struct sockaddr *, const struct rtentry *); 354 355 static void sppp_cp_init(const struct cp *, struct sppp *); 356 static void sppp_cp_fini(const struct cp *, struct sppp *); 357 static void sppp_cp_input(const struct cp *, struct sppp *, 358 struct mbuf *); 359 static void sppp_cp_input(const struct cp *, struct sppp *, 360 struct mbuf *); 361 static void sppp_cp_send(struct sppp *, u_short, u_char, 362 u_char, u_short, void *); 363 /* static void sppp_cp_timeout(void *arg); */ 364 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 365 static struct workqueue * 366 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 367 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 368 static void sppp_wq_set(struct sppp_work *, 369 void (*)(struct sppp *, void *), void *); 370 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 371 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 372 static void sppp_cp_to_lcp(void *); 373 static void sppp_cp_to_ipcp(void *); 374 static void sppp_cp_to_ipv6cp(void *); 375 static void sppp_auth_send(const struct cp *, struct sppp *, 376 unsigned int, unsigned int, ...); 377 static int sppp_auth_role(const struct cp *, struct sppp *); 378 static void sppp_auth_to_event(struct sppp *, void *); 379 static void sppp_auth_screply(const struct cp *, struct sppp *, 380 u_char, uint8_t, size_t, void *); 381 static void sppp_up_event(struct sppp *, void *); 382 static void sppp_down_event(struct sppp *, void *); 383 static void sppp_open_event(struct sppp *, void *); 384 static void sppp_close_event(struct sppp *, void *); 385 static void sppp_to_event(struct sppp *, void *); 386 static void sppp_rcr_event(struct sppp *, void *); 387 static void sppp_rca_event(struct sppp *, void *); 388 static void sppp_rcn_event(struct sppp *, void *); 389 static void sppp_rtr_event(struct sppp *, void *); 390 static void sppp_rta_event(struct sppp *, void *); 391 static void sppp_rxj_event(struct sppp *, void *); 392 393 static void sppp_null(struct sppp *); 394 static void sppp_tls(const struct cp *, struct sppp *); 395 static void sppp_tlf(const struct cp *, struct sppp *); 396 static void sppp_screply(const struct cp *, struct sppp *, 397 u_char, uint8_t, size_t, void *); 398 static void sppp_ifdown(struct sppp *, void *); 399 400 static void sppp_lcp_init(struct sppp *); 401 static void sppp_lcp_up(struct sppp *, void *); 402 static void sppp_lcp_down(struct sppp *, void *); 403 static void sppp_lcp_open(struct sppp *, void *); 404 static enum cp_rcr_type 405 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 406 uint8_t **, size_t *, size_t *); 407 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 408 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 409 static void sppp_lcp_tlu(struct sppp *); 410 static void sppp_lcp_tld(struct sppp *); 411 static void sppp_lcp_tls(const struct cp *, struct sppp *); 412 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 413 static void sppp_lcp_scr(struct sppp *); 414 static void sppp_lcp_check_and_close(struct sppp *); 415 static int sppp_cp_check(struct sppp *, u_char); 416 static bool sppp_is_ncp_opened(struct sppp *); 417 418 static void sppp_ipcp_init(struct sppp *); 419 static void sppp_ipcp_open(struct sppp *, void *); 420 static void sppp_ipcp_close(struct sppp *, void *); 421 static enum cp_rcr_type 422 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 423 uint8_t **, size_t *, size_t *); 424 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 425 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 426 static void sppp_ipcp_tlu(struct sppp *); 427 static void sppp_ipcp_tld(struct sppp *); 428 static void sppp_ipcp_scr(struct sppp *); 429 430 static void sppp_ipv6cp_init(struct sppp *); 431 static void sppp_ipv6cp_open(struct sppp *, void *); 432 static enum cp_rcr_type 433 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 434 uint8_t **, size_t *, size_t *); 435 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 436 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 437 static void sppp_ipv6cp_tlu(struct sppp *); 438 static void sppp_ipv6cp_tld(struct sppp *); 439 static void sppp_ipv6cp_scr(struct sppp *); 440 441 static void sppp_pap_input(struct sppp *, struct mbuf *); 442 static void sppp_pap_init(struct sppp *); 443 static void sppp_pap_tlu(struct sppp *); 444 static void sppp_pap_scr(struct sppp *); 445 446 static void sppp_chap_input(struct sppp *, struct mbuf *); 447 static void sppp_chap_init(struct sppp *); 448 static void sppp_chap_open(struct sppp *, void *); 449 static void sppp_chap_tlu(struct sppp *); 450 static void sppp_chap_scr(struct sppp *); 451 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 452 453 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 454 static const char *sppp_cp_type_name(char *, size_t, u_char); 455 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 456 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 457 #ifdef INET6 458 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 459 #endif 460 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 461 static const char *sppp_phase_name(int); 462 static const char *sppp_proto_name(char *, size_t, u_short); 463 static const char *sppp_state_name(int); 464 static int sppp_params(struct sppp *, u_long, void *); 465 #ifdef INET 466 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 467 static void sppp_set_ip_addrs(struct sppp *); 468 static void sppp_clear_ip_addrs(struct sppp *); 469 #endif 470 static void sppp_keepalive(void *); 471 static void sppp_phase_network(struct sppp *); 472 static void sppp_print_bytes(const u_char *, u_short); 473 static void sppp_print_string(const char *, u_short); 474 #ifdef INET6 475 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 476 struct in6_addr *, struct in6_addr *); 477 #ifdef IPV6CP_MYIFID_DYN 478 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 479 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 480 #endif 481 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 482 #endif 483 484 static void sppp_notify_up(struct sppp *); 485 static void sppp_notify_down(struct sppp *); 486 static void sppp_notify_tls_wlocked(struct sppp *); 487 static void sppp_notify_tlf_wlocked(struct sppp *); 488 489 /* our control protocol descriptors */ 490 static const struct cp lcp = { 491 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 492 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 493 sppp_close_event, sppp_to_event, 494 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 495 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 496 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 497 }; 498 499 static const struct cp ipcp = { 500 PPP_IPCP, IDX_IPCP, 501 #ifdef INET 502 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 503 #else 504 0, 505 #endif 506 "ipcp", 507 sppp_up_event, sppp_down_event, sppp_ipcp_open, 508 sppp_ipcp_close, sppp_to_event, 509 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls, 510 sppp_tlf, sppp_ipcp_scr, sppp_screply, 511 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 512 }; 513 514 static const struct cp ipv6cp = { 515 PPP_IPV6CP, IDX_IPV6CP, 516 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 517 CP_NCP, 518 #else 519 0, 520 #endif 521 "ipv6cp", 522 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 523 sppp_close_event, sppp_to_event, 524 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls, 525 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 526 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 527 }; 528 529 static const struct cp pap = { 530 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 531 sppp_up_event, sppp_down_event, sppp_open_event, 532 sppp_close_event, sppp_auth_to_event, 533 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 534 sppp_pap_scr, sppp_auth_screply, 535 NULL, NULL, NULL 536 }; 537 538 static const struct cp chap = { 539 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 540 sppp_up_event, sppp_down_event, sppp_chap_open, 541 sppp_close_event, sppp_auth_to_event, 542 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 543 sppp_chap_scr, sppp_auth_screply, 544 NULL, NULL, NULL 545 }; 546 547 static const struct cp *cps[IDX_COUNT] = { 548 &lcp, /* IDX_LCP */ 549 &ipcp, /* IDX_IPCP */ 550 &ipv6cp, /* IDX_IPV6CP */ 551 &pap, /* IDX_PAP */ 552 &chap, /* IDX_CHAP */ 553 }; 554 555 static inline u_int 556 sppp_proto2authproto(u_short proto) 557 { 558 559 switch (proto) { 560 case PPP_PAP: 561 return SPPP_AUTHPROTO_PAP; 562 case PPP_CHAP: 563 return SPPP_AUTHPROTO_CHAP; 564 } 565 566 return SPPP_AUTHPROTO_NONE; 567 } 568 569 static inline u_short 570 sppp_authproto2proto(u_int authproto) 571 { 572 573 switch (authproto) { 574 case SPPP_AUTHPROTO_PAP: 575 return PPP_PAP; 576 case SPPP_AUTHPROTO_CHAP: 577 return PPP_CHAP; 578 } 579 580 return PPP_NOPROTO; 581 } 582 583 static inline bool 584 sppp_debug_enabled(struct sppp *sp) 585 { 586 587 if (__predict_false(sp == NULL)) 588 return false; 589 590 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0) 591 return false; 592 593 return true; 594 } 595 596 static void 597 sppp_change_phase(struct sppp *sp, int phase) 598 { 599 struct ifnet *ifp = &sp->pp_if; 600 601 KASSERT(SPPP_WLOCKED(sp)); 602 603 if (sp->pp_phase == phase) 604 return; 605 606 sp->pp_phase = phase; 607 608 if (phase == SPPP_PHASE_NETWORK) 609 if_link_state_change(ifp, LINK_STATE_UP); 610 else 611 if_link_state_change(ifp, LINK_STATE_DOWN); 612 613 SPPP_DLOG(sp, "phase %s\n", 614 sppp_phase_name(sp->pp_phase)); 615 } 616 617 /* 618 * Exported functions, comprising our interface to the lower layer. 619 */ 620 621 /* 622 * Process the received packet. 623 */ 624 void 625 sppp_input(struct ifnet *ifp, struct mbuf *m) 626 { 627 struct ppp_header *h = NULL; 628 pktqueue_t *pktq = NULL; 629 uint16_t protocol; 630 struct sppp *sp = (struct sppp *)ifp; 631 632 /* No RPS for not-IP. */ 633 pktq_rps_hash_func_t rps_hash = NULL; 634 635 if (ifp->if_flags & IFF_UP) { 636 /* Count received bytes, add hardware framing */ 637 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 638 /* Note time of last receive */ 639 sp->pp_last_receive = time_uptime; 640 } 641 642 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 643 /* Too small packet, drop it. */ 644 SPPP_DLOG(sp, "input packet is too small, " 645 "%d bytes\n", m->m_pkthdr.len); 646 goto drop; 647 } 648 649 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 650 memcpy(&protocol, mtod(m, void *), 2); 651 protocol = ntohs(protocol); 652 m_adj(m, 2); 653 } else { 654 655 /* Get PPP header. */ 656 h = mtod(m, struct ppp_header *); 657 m_adj(m, PPP_HEADER_LEN); 658 659 switch (h->address) { 660 case PPP_ALLSTATIONS: 661 if (h->control != PPP_UI) 662 goto invalid; 663 break; 664 case CISCO_MULTICAST: 665 case CISCO_UNICAST: 666 /* Don't check the control field here (RFC 1547). */ 667 SPPP_DLOG(sp, "Cisco packet in PPP mode " 668 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 669 h->address, h->control, ntohs(h->protocol)); 670 goto drop; 671 default: /* Invalid PPP packet. */ 672 invalid: 673 SPPP_DLOG(sp, "invalid input packet " 674 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 675 h->address, h->control, ntohs(h->protocol)); 676 goto drop; 677 } 678 protocol = ntohs(h->protocol); 679 } 680 681 switch (protocol) { 682 reject_protocol: 683 KASSERT(SPPP_WLOCKED(sp)); 684 685 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 686 uint16_t prot = htons(protocol); 687 688 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 689 ++sp->scp[IDX_LCP].seq, sizeof(prot), &prot); 690 } 691 SPPP_UNLOCK(sp); 692 if_statinc(ifp, if_noproto); 693 goto drop; 694 default: 695 SPPP_DLOG(sp, "invalid input protocol " 696 "<proto=0x%x>\n", protocol); 697 goto reject_protocol; 698 case PPP_LCP: 699 SPPP_LOCK(sp, RW_WRITER); 700 sppp_cp_input(&lcp, sp, m); 701 /* already m_freem(m) */ 702 SPPP_UNLOCK(sp); 703 return; 704 case PPP_PAP: 705 SPPP_LOCK(sp, RW_WRITER); 706 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 707 sppp_pap_input(sp, m); 708 } 709 SPPP_UNLOCK(sp); 710 m_freem(m); 711 return; 712 case PPP_CHAP: 713 SPPP_LOCK(sp, RW_WRITER); 714 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 715 sppp_chap_input(sp, m); 716 } 717 SPPP_UNLOCK(sp); 718 m_freem(m); 719 return; 720 #ifdef INET 721 case PPP_IPCP: 722 SPPP_LOCK(sp, RW_WRITER); 723 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 724 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet " 725 "because IPCP is disabled\n"); 726 goto reject_protocol; 727 } 728 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 729 sppp_cp_input(&ipcp, sp, m); 730 /* already m_freem(m) */ 731 } else { 732 m_freem(m); 733 } 734 SPPP_UNLOCK(sp); 735 return; 736 case PPP_IP: 737 SPPP_LOCK(sp, RW_READER); 738 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 739 sp->pp_last_activity = time_uptime; 740 pktq = ip_pktq; 741 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p); 742 } 743 SPPP_UNLOCK(sp); 744 break; 745 #endif 746 #ifdef INET6 747 case PPP_IPV6CP: 748 SPPP_LOCK(sp, RW_WRITER); 749 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 750 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet " 751 "because IPv6CP is disabled\n"); 752 goto reject_protocol; 753 } 754 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 755 sppp_cp_input(&ipv6cp, sp, m); 756 /* already m_freem(m) */ 757 } else { 758 m_freem(m); 759 } 760 SPPP_UNLOCK(sp); 761 return; 762 763 case PPP_IPV6: 764 SPPP_LOCK(sp, RW_WRITER); 765 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 766 sp->pp_last_activity = time_uptime; 767 pktq = ip6_pktq; 768 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p); 769 } 770 SPPP_UNLOCK(sp); 771 break; 772 #endif 773 } 774 775 if ((ifp->if_flags & IFF_UP) == 0 || pktq == NULL) { 776 goto drop; 777 } 778 779 /* Check queue. */ 780 const uint32_t hash = rps_hash ? pktq_rps_hash(&rps_hash, m) : 0; 781 if (__predict_false(!pktq_enqueue(pktq, m, hash))) { 782 goto drop; 783 } 784 return; 785 786 drop: 787 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 788 m_freem(m); 789 return; 790 } 791 792 /* 793 * Enqueue transmit packet. 794 */ 795 static int 796 sppp_output(struct ifnet *ifp, struct mbuf *m, 797 const struct sockaddr *dst, const struct rtentry *rt) 798 { 799 struct sppp *sp = (struct sppp *) ifp; 800 struct ppp_header *h = NULL; 801 #ifndef SPPPSUBR_MPSAFE 802 struct ifqueue *ifq = NULL; /* XXX */ 803 #endif 804 int error = 0; 805 uint16_t protocol; 806 size_t pktlen; 807 808 sp->pp_last_activity = time_uptime; 809 810 if ((ifp->if_flags & IFF_UP) == 0 || 811 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 812 m_freem(m); 813 if_statinc(ifp, if_oerrors); 814 return (ENETDOWN); 815 } 816 817 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 818 /* ignore packets that have no enabled NCP */ 819 SPPP_LOCK(sp, RW_READER); 820 if ((dst->sa_family == AF_INET && 821 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 822 (dst->sa_family == AF_INET6 && 823 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 824 SPPP_UNLOCK(sp); 825 826 m_freem(m); 827 if_statinc(ifp, if_oerrors); 828 return (ENETDOWN); 829 } 830 SPPP_UNLOCK(sp); 831 /* 832 * Interface is not yet running, but auto-dial. Need 833 * to start LCP for it. 834 */ 835 ifp->if_flags |= IFF_RUNNING; 836 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 837 } 838 839 /* 840 * If the queueing discipline needs packet classification, 841 * do it before prepending link headers. 842 */ 843 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 844 845 #ifdef INET 846 if (dst->sa_family == AF_INET) { 847 struct ip *ip = NULL; 848 #ifndef SPPPSUBR_MPSAFE 849 struct tcphdr *th = NULL; 850 #endif 851 852 if (m->m_len >= sizeof(struct ip)) { 853 ip = mtod(m, struct ip *); 854 #ifndef SPPPSUBR_MPSAFE 855 if (ip->ip_p == IPPROTO_TCP && 856 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 857 sizeof(struct tcphdr)) { 858 th = (struct tcphdr *) 859 ((char *)ip + (ip->ip_hl << 2)); 860 } 861 #endif 862 } else 863 ip = NULL; 864 865 /* 866 * When using dynamic local IP address assignment by using 867 * 0.0.0.0 as a local address, the first TCP session will 868 * not connect because the local TCP checksum is computed 869 * using 0.0.0.0 which will later become our real IP address 870 * so the TCP checksum computed at the remote end will 871 * become invalid. So we 872 * - don't let packets with src ip addr 0 thru 873 * - we flag TCP packets with src ip 0 as an error 874 */ 875 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 876 uint8_t proto = ip->ip_p; 877 878 m_freem(m); 879 if (proto == IPPROTO_TCP) 880 return (EADDRNOTAVAIL); 881 else 882 return (0); 883 } 884 885 #ifndef SPPPSUBR_MPSAFE 886 /* 887 * Put low delay, telnet, rlogin and ftp control packets 888 * in front of the queue. 889 */ 890 if (!IF_QFULL(&sp->pp_fastq) && 891 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 892 (th && (INTERACTIVE(ntohs(th->th_sport)) || 893 INTERACTIVE(ntohs(th->th_dport)))))) 894 ifq = &sp->pp_fastq; 895 #endif /* !SPPPSUBR_MPSAFE */ 896 } 897 #endif 898 899 #ifdef INET6 900 if (dst->sa_family == AF_INET6) { 901 /* XXX do something tricky here? */ 902 } 903 #endif 904 905 if (!ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 906 /* 907 * Prepend general data packet PPP header. For now, IP only. 908 */ 909 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 910 if (! m) { 911 SPPP_DLOG(sp, "no memory for transmit header\n"); 912 if_statinc(ifp, if_oerrors); 913 return (ENOBUFS); 914 } 915 /* 916 * May want to check size of packet 917 * (albeit due to the implementation it's always enough) 918 */ 919 h = mtod(m, struct ppp_header *); 920 h->address = PPP_ALLSTATIONS; /* broadcast address */ 921 h->control = PPP_UI; /* Unnumbered Info */ 922 } 923 924 switch (dst->sa_family) { 925 #ifdef INET 926 case AF_INET: /* Internet Protocol */ 927 /* 928 * Don't choke with an ENETDOWN early. It's 929 * possible that we just started dialing out, 930 * so don't drop the packet immediately. If 931 * we notice that we run out of buffer space 932 * below, we will however remember that we are 933 * not ready to carry IP packets, and return 934 * ENETDOWN, as opposed to ENOBUFS. 935 */ 936 protocol = htons(PPP_IP); 937 SPPP_LOCK(sp, RW_READER); 938 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 939 if (ifp->if_flags & IFF_AUTO) { 940 error = ENETDOWN; 941 } else { 942 SPPP_UNLOCK(sp); 943 944 m_freem(m); 945 if_statinc(ifp, if_oerrors); 946 return (ENETDOWN); 947 } 948 } 949 SPPP_UNLOCK(sp); 950 break; 951 #endif 952 #ifdef INET6 953 case AF_INET6: /* Internet Protocol version 6 */ 954 /* 955 * Don't choke with an ENETDOWN early. It's 956 * possible that we just started dialing out, 957 * so don't drop the packet immediately. If 958 * we notice that we run out of buffer space 959 * below, we will however remember that we are 960 * not ready to carry IP packets, and return 961 * ENETDOWN, as opposed to ENOBUFS. 962 */ 963 protocol = htons(PPP_IPV6); 964 SPPP_LOCK(sp, RW_READER); 965 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 966 if (ifp->if_flags & IFF_AUTO) { 967 error = ENETDOWN; 968 } else { 969 SPPP_UNLOCK(sp); 970 971 m_freem(m); 972 if_statinc(ifp, if_oerrors); 973 return (ENETDOWN); 974 } 975 } 976 SPPP_UNLOCK(sp); 977 break; 978 #endif 979 default: 980 m_freem(m); 981 if_statinc(ifp, if_oerrors); 982 return (EAFNOSUPPORT); 983 } 984 985 if (error == ENETDOWN) { 986 IF_DROP(&ifp->if_snd); 987 m_freem(m); 988 return error; 989 } 990 991 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 992 M_PREPEND(m, 2, M_DONTWAIT); 993 if (m == NULL) { 994 SPPP_DLOG(sp, "no memory for transmit header\n"); 995 if_statinc(ifp, if_oerrors); 996 return (ENOBUFS); 997 } 998 *mtod(m, uint16_t *) = protocol; 999 } else { 1000 h->protocol = protocol; 1001 } 1002 1003 pktlen = m->m_pkthdr.len; 1004 #ifdef SPPPSUBR_MPSAFE 1005 error = if_transmit_lock(ifp, m); 1006 if (error == 0) 1007 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1008 #else /* !SPPPSUBR_MPSAFE */ 1009 error = ifq_enqueue2(ifp, ifq, m); 1010 1011 if (error == 0) { 1012 /* 1013 * Count output packets and bytes. 1014 * The packet length includes header + additional hardware 1015 * framing according to RFC 1333. 1016 */ 1017 if (!(ifp->if_flags & IFF_OACTIVE)) { 1018 if_start_lock(ifp); 1019 } 1020 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1021 } 1022 #endif /* !SPPPSUBR_MPSAFE */ 1023 return error; 1024 } 1025 1026 void 1027 sppp_attach(struct ifnet *ifp) 1028 { 1029 struct sppp *sp = (struct sppp *) ifp; 1030 char xnamebuf[MAXCOMLEN]; 1031 1032 /* Initialize keepalive handler. */ 1033 if (! spppq) { 1034 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1035 callout_setfunc(&keepalive_ch, sppp_keepalive, NULL); 1036 callout_schedule(&keepalive_ch, hz * sppp_keepalive_interval); 1037 } 1038 1039 if (! spppq_lock) 1040 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1041 1042 sp->pp_if.if_type = IFT_PPP; 1043 sp->pp_if.if_output = sppp_output; 1044 IFQ_SET_MAXLEN(&sp->pp_fastq, 32); 1045 IFQ_LOCK_INIT(&sp->pp_fastq); 1046 IFQ_SET_MAXLEN(&sp->pp_cpq, 20); 1047 sp->pp_loopcnt = 0; 1048 sp->pp_alivecnt = 0; 1049 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1050 sp->pp_last_activity = 0; 1051 sp->pp_last_receive = 0; 1052 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1053 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1054 sp->pp_idle_timeout = 0; 1055 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1056 sp->pp_phase = SPPP_PHASE_DEAD; 1057 sp->pp_up = sppp_notify_up; 1058 sp->pp_down = sppp_notify_down; 1059 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1060 #ifdef SPPP_IFDOWN_RECONNECT 1061 sp->pp_flags |= PP_LOOPBACK_IFDOWN | PP_KEEPALIVE_IFDOWN; 1062 #endif 1063 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1064 memset(sp->scp, 0, sizeof(sp->scp)); 1065 rw_init(&sp->pp_lock); 1066 1067 if_alloc_sadl(ifp); 1068 1069 /* Lets not beat about the bush, we know we're down. */ 1070 if_link_state_change(ifp, LINK_STATE_DOWN); 1071 1072 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1073 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1074 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1075 1076 memset(&sp->myauth, 0, sizeof sp->myauth); 1077 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1078 SPPP_LOCK(sp, RW_WRITER); 1079 sppp_lcp_init(sp); 1080 sppp_ipcp_init(sp); 1081 sppp_ipv6cp_init(sp); 1082 sppp_pap_init(sp); 1083 sppp_chap_init(sp); 1084 SPPP_UNLOCK(sp); 1085 1086 SPPPQ_LOCK(); 1087 /* Insert new entry into the keepalive list. */ 1088 sp->pp_next = spppq; 1089 spppq = sp; 1090 SPPPQ_UNLOCK(); 1091 } 1092 1093 void 1094 sppp_detach(struct ifnet *ifp) 1095 { 1096 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1097 1098 /* Remove the entry from the keepalive list. */ 1099 SPPPQ_LOCK(); 1100 for (q = &spppq; (p = *q); q = &p->pp_next) 1101 if (p == sp) { 1102 *q = p->pp_next; 1103 break; 1104 } 1105 SPPPQ_UNLOCK(); 1106 1107 if (! spppq) { 1108 /* Stop keepalive handler. */ 1109 callout_stop(&keepalive_ch); 1110 mutex_obj_free(spppq_lock); 1111 spppq_lock = NULL; 1112 } 1113 1114 sppp_cp_fini(&lcp, sp); 1115 sppp_cp_fini(&ipcp, sp); 1116 sppp_cp_fini(&pap, sp); 1117 sppp_cp_fini(&chap, sp); 1118 #ifdef INET6 1119 sppp_cp_fini(&ipv6cp, sp); 1120 #endif 1121 sppp_wq_destroy(sp, sp->wq_cp); 1122 1123 /* free authentication info */ 1124 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1125 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1126 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1127 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1128 1129 IFQ_LOCK_DESTROY(&sp->pp_fastq); 1130 rw_destroy(&sp->pp_lock); 1131 } 1132 1133 /* 1134 * Flush the interface output queue. 1135 */ 1136 void 1137 sppp_flush(struct ifnet *ifp) 1138 { 1139 struct sppp *sp = (struct sppp *) ifp; 1140 1141 SPPP_LOCK(sp, RW_WRITER); 1142 IFQ_PURGE(&sp->pp_if.if_snd); 1143 IF_PURGE(&sp->pp_fastq); 1144 IF_PURGE(&sp->pp_cpq); 1145 SPPP_UNLOCK(sp); 1146 } 1147 1148 /* 1149 * Check if the output queue is empty. 1150 */ 1151 int 1152 sppp_isempty(struct ifnet *ifp) 1153 { 1154 struct sppp *sp = (struct sppp *) ifp; 1155 int empty; 1156 1157 SPPP_LOCK(sp, RW_READER); 1158 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1159 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1160 SPPP_UNLOCK(sp); 1161 return (empty); 1162 } 1163 1164 /* 1165 * Get next packet to send. 1166 */ 1167 struct mbuf * 1168 sppp_dequeue(struct ifnet *ifp) 1169 { 1170 struct sppp *sp = (struct sppp *) ifp; 1171 struct mbuf *m; 1172 1173 SPPP_LOCK(sp, RW_WRITER); 1174 /* 1175 * Process only the control protocol queue until we have at 1176 * least one NCP opened. 1177 */ 1178 IF_DEQUEUE(&sp->pp_cpq, m); 1179 if (m == NULL && sppp_is_ncp_opened(sp)) { 1180 IF_DEQUEUE(&sp->pp_fastq, m); 1181 if (m == NULL) 1182 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1183 } 1184 SPPP_UNLOCK(sp); 1185 return m; 1186 } 1187 1188 /* 1189 * Process an ioctl request. Called on low priority level. 1190 */ 1191 int 1192 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1193 { 1194 struct lwp *l = curlwp; /* XXX */ 1195 struct ifreq *ifr = (struct ifreq *) data; 1196 struct ifaddr *ifa = (struct ifaddr *) data; 1197 struct sppp *sp = (struct sppp *) ifp; 1198 int error=0, going_up, going_down; 1199 u_short newmode; 1200 u_long lcp_mru; 1201 1202 switch (cmd) { 1203 case SIOCINITIFADDR: 1204 ifa->ifa_rtrequest = p2p_rtrequest; 1205 break; 1206 1207 case SIOCSIFFLAGS: 1208 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1209 break; 1210 1211 SPPP_LOCK(sp, RW_WRITER); 1212 going_up = ifp->if_flags & IFF_UP && 1213 (ifp->if_flags & IFF_RUNNING) == 0; 1214 going_down = (ifp->if_flags & IFF_UP) == 0 && 1215 ifp->if_flags & IFF_RUNNING; 1216 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1217 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1218 /* sanity */ 1219 newmode = IFF_PASSIVE; 1220 ifp->if_flags &= ~IFF_AUTO; 1221 } 1222 1223 if (going_up || going_down) { 1224 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1225 } 1226 if (going_up) { 1227 /* Always-on connection */ 1228 if (newmode != IFF_AUTO) { 1229 ifp->if_flags |= IFF_RUNNING; 1230 sppp_wq_add(sp->wq_cp, 1231 &sp->scp[IDX_LCP].work_open); 1232 } 1233 } else if (going_down) { 1234 SPPP_UNLOCK(sp); 1235 sppp_flush(ifp); 1236 SPPP_LOCK(sp, RW_WRITER); 1237 1238 ifp->if_flags &= ~IFF_RUNNING; 1239 } 1240 SPPP_UNLOCK(sp); 1241 break; 1242 1243 case SIOCSIFMTU: 1244 if (ifr->ifr_mtu < PPP_MINMRU || 1245 ifr->ifr_mtu > PP_MTU) { 1246 error = EINVAL; 1247 break; 1248 } 1249 1250 error = ifioctl_common(ifp, cmd, data); 1251 if (error == ENETRESET) 1252 error = 0; 1253 1254 SPPP_LOCK(sp, RW_WRITER); 1255 lcp_mru = sp->lcp.mru; 1256 if (ifp->if_mtu < PP_MTU) { 1257 sp->lcp.mru = ifp->if_mtu; 1258 } else { 1259 sp->lcp.mru = PP_MTU; 1260 } 1261 if (lcp_mru != sp->lcp.mru) 1262 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1263 1264 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1265 ifp->if_mtu > sp->lcp.their_mru) { 1266 sp->pp_saved_mtu = ifp->if_mtu; 1267 ifp->if_mtu = sp->lcp.their_mru; 1268 1269 SPPP_DLOG(sp, "setting MTU " 1270 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 1271 sp->pp_saved_mtu, ifp->if_mtu); 1272 } 1273 SPPP_UNLOCK(sp); 1274 break; 1275 1276 case SIOCGIFMTU: 1277 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1278 error = 0; 1279 break; 1280 case SIOCADDMULTI: 1281 case SIOCDELMULTI: 1282 break; 1283 1284 case SPPPSETAUTHCFG: 1285 case SPPPSETLCPCFG: 1286 case SPPPSETNCPCFG: 1287 case SPPPSETIDLETO: 1288 case SPPPSETAUTHFAILURE: 1289 case SPPPSETDNSOPTS: 1290 case SPPPSETKEEPALIVE: 1291 #if defined(COMPAT_50) || defined(MODULAR) 1292 case __SPPPSETIDLETO50: 1293 case __SPPPSETKEEPALIVE50: 1294 #endif /* COMPAT_50 || MODULAR */ 1295 error = kauth_authorize_network(l->l_cred, 1296 KAUTH_NETWORK_INTERFACE, 1297 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1298 NULL); 1299 if (error) 1300 break; 1301 error = sppp_params(sp, cmd, data); 1302 break; 1303 1304 case SPPPGETAUTHCFG: 1305 case SPPPGETLCPCFG: 1306 case SPPPGETNCPCFG: 1307 case SPPPGETAUTHFAILURES: 1308 error = kauth_authorize_network(l->l_cred, 1309 KAUTH_NETWORK_INTERFACE, 1310 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1311 NULL); 1312 if (error) 1313 break; 1314 error = sppp_params(sp, cmd, data); 1315 break; 1316 1317 case SPPPGETSTATUS: 1318 case SPPPGETSTATUSNCP: 1319 case SPPPGETIDLETO: 1320 case SPPPGETDNSOPTS: 1321 case SPPPGETDNSADDRS: 1322 case SPPPGETKEEPALIVE: 1323 #if defined(COMPAT_50) || defined(MODULAR) 1324 case __SPPPGETIDLETO50: 1325 case __SPPPGETKEEPALIVE50: 1326 #endif /* COMPAT_50 || MODULAR */ 1327 case SPPPGETLCPSTATUS: 1328 case SPPPGETIPCPSTATUS: 1329 case SPPPGETIPV6CPSTATUS: 1330 error = sppp_params(sp, cmd, data); 1331 break; 1332 1333 default: 1334 error = ifioctl_common(ifp, cmd, data); 1335 break; 1336 } 1337 return (error); 1338 } 1339 1340 /* 1341 * PPP protocol implementation. 1342 */ 1343 1344 /* 1345 * Send PPP control protocol packet. 1346 */ 1347 static void 1348 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1349 u_char ident, u_short len, void *data) 1350 { 1351 struct ifnet *ifp = &sp->pp_if; 1352 struct lcp_header *lh; 1353 struct mbuf *m; 1354 size_t pkthdrlen; 1355 1356 KASSERT(SPPP_WLOCKED(sp)); 1357 1358 pkthdrlen = ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING) ? 1359 2 : PPP_HEADER_LEN; 1360 1361 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1362 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1363 MGETHDR(m, M_DONTWAIT, MT_DATA); 1364 if (! m) { 1365 return; 1366 } 1367 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1368 m_reset_rcvif(m); 1369 1370 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 1371 *mtod(m, uint16_t *) = htons(proto); 1372 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1373 } else { 1374 struct ppp_header *h; 1375 h = mtod(m, struct ppp_header *); 1376 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1377 h->control = PPP_UI; /* Unnumbered Info */ 1378 h->protocol = htons(proto); /* Link Control Protocol */ 1379 lh = (struct lcp_header *)(h + 1); 1380 } 1381 lh->type = type; 1382 lh->ident = ident; 1383 lh->len = htons(LCP_HEADER_LEN + len); 1384 if (len) 1385 memcpy(lh + 1, data, len); 1386 1387 if (sppp_debug_enabled(sp)) { 1388 char pbuf[SPPP_PROTO_NAMELEN]; 1389 char tbuf[SPPP_CPTYPE_NAMELEN]; 1390 const char *pname, *cpname; 1391 1392 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1393 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1394 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 1395 pname, cpname, lh->ident, ntohs(lh->len)); 1396 if (len) 1397 sppp_print_bytes((u_char *)(lh + 1), len); 1398 addlog(">\n"); 1399 } 1400 if (IF_QFULL(&sp->pp_cpq)) { 1401 IF_DROP(&sp->pp_fastq); 1402 IF_DROP(&ifp->if_snd); 1403 m_freem(m); 1404 return; 1405 } 1406 1407 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1408 IF_ENQUEUE(&sp->pp_cpq, m); 1409 1410 if (! (ifp->if_flags & IFF_OACTIVE)) { 1411 SPPP_UNLOCK(sp); 1412 if_start_lock(ifp); 1413 SPPP_LOCK(sp, RW_WRITER); 1414 } 1415 } 1416 1417 static void 1418 sppp_cp_to_lcp(void *xsp) 1419 { 1420 struct sppp *sp = xsp; 1421 1422 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1423 } 1424 1425 static void 1426 sppp_cp_to_ipcp(void *xsp) 1427 { 1428 struct sppp *sp = xsp; 1429 1430 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1431 } 1432 1433 static void 1434 sppp_cp_to_ipv6cp(void *xsp) 1435 { 1436 struct sppp *sp = xsp; 1437 1438 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1439 } 1440 1441 static void 1442 sppp_cp_to_pap(void *xsp) 1443 { 1444 struct sppp *sp = xsp; 1445 1446 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1447 } 1448 1449 static void 1450 sppp_cp_to_chap(void *xsp) 1451 { 1452 struct sppp *sp = xsp; 1453 1454 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1455 } 1456 1457 static void 1458 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1459 { 1460 struct sppp_cp *scp; 1461 typedef void (*sppp_co_cb_t)(void *); 1462 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1463 [IDX_LCP] = sppp_cp_to_lcp, 1464 [IDX_IPCP] = sppp_cp_to_ipcp, 1465 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1466 [IDX_PAP] = sppp_cp_to_pap, 1467 [IDX_CHAP] = sppp_cp_to_chap, 1468 }; 1469 1470 scp = &sp->scp[cp->protoidx]; 1471 scp->state = STATE_INITIAL; 1472 scp->fail_counter = 0; 1473 scp->seq = 0; 1474 scp->rseq = 0; 1475 1476 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1477 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1478 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1479 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1480 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1481 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1482 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1483 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1484 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1485 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1486 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1487 1488 callout_init(&scp->ch, CALLOUT_MPSAFE); 1489 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1490 } 1491 1492 static void 1493 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1494 { 1495 struct sppp_cp *scp; 1496 scp = &sp->scp[cp->protoidx]; 1497 1498 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1499 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1500 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1501 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1502 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1503 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1504 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1505 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1506 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1507 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1508 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1509 1510 callout_halt(&scp->ch, NULL); 1511 callout_destroy(&scp->ch); 1512 1513 m_freem(scp->mbuf_confreq); 1514 scp->mbuf_confreq = NULL; 1515 m_freem(scp->mbuf_confnak); 1516 scp->mbuf_confnak = NULL; 1517 } 1518 1519 /* 1520 * Handle incoming PPP control protocol packets. 1521 */ 1522 static void 1523 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1524 { 1525 const bool debug = sppp_debug_enabled(sp); 1526 struct ifnet *ifp = &sp->pp_if; 1527 struct sppp_cp *scp = &sp->scp[cp->protoidx]; 1528 struct lcp_header *h; 1529 int printlen, len = m->m_pkthdr.len; 1530 u_char *p; 1531 uint32_t u32; 1532 char tbuf[SPPP_CPTYPE_NAMELEN]; 1533 const char *cpname; 1534 1535 KASSERT(SPPP_WLOCKED(sp)); 1536 1537 if (len < 4) { 1538 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n", 1539 cp->name, len); 1540 goto out; 1541 } 1542 h = mtod(m, struct lcp_header *); 1543 if (debug) { 1544 printlen = ntohs(h->len); 1545 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1546 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d", 1547 cp->name, sppp_state_name(scp->state), 1548 cpname, h->ident, printlen); 1549 if (len < printlen) 1550 printlen = len; 1551 if (printlen > 4) 1552 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1553 addlog(">\n"); 1554 } 1555 if (len > ntohs(h->len)) 1556 len = ntohs(h->len); 1557 p = (u_char *)(h + 1); 1558 switch (h->type) { 1559 case CONF_REQ: 1560 if (len < 4) { 1561 SPPP_DLOG(sp,"%s invalid conf-req length %d\n", 1562 cp->name, len); 1563 if_statinc(ifp, if_ierrors); 1564 break; 1565 } 1566 1567 scp->rcr_type = CP_RCR_NONE; 1568 scp->rconfid = h->ident; 1569 m_freem(scp->mbuf_confreq); 1570 scp->mbuf_confreq = m; 1571 m = NULL; 1572 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1573 break; 1574 case CONF_ACK: 1575 if (h->ident != scp->confid) { 1576 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1577 cp->name, h->ident, scp->confid); 1578 if_statinc(ifp, if_ierrors); 1579 break; 1580 } 1581 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1582 break; 1583 case CONF_NAK: 1584 case CONF_REJ: 1585 if (h->ident != scp->confid) { 1586 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1587 cp->name, h->ident, scp->confid); 1588 if_statinc(ifp, if_ierrors); 1589 break; 1590 } 1591 1592 m_freem(scp->mbuf_confnak); 1593 scp->mbuf_confnak = m; 1594 m = NULL; 1595 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1596 break; 1597 case TERM_REQ: 1598 scp->rseq = h->ident; 1599 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1600 break; 1601 case TERM_ACK: 1602 if (h->ident != scp->confid && 1603 h->ident != scp->seq) { 1604 SPPP_DLOG(sp, "%s id mismatch " 1605 "0x%x != 0x%x and 0x%x != %0lx\n", 1606 cp->name, h->ident, scp->confid, 1607 h->ident, scp->seq); 1608 if_statinc(ifp, if_ierrors); 1609 break; 1610 } 1611 1612 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1613 break; 1614 case CODE_REJ: 1615 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1616 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1617 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, " 1618 "danger will robinson\n", cp->name, cpname); 1619 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1620 break; 1621 case PROTO_REJ: 1622 { 1623 int catastrophic; 1624 const struct cp *upper; 1625 int i; 1626 uint16_t proto; 1627 1628 catastrophic = 0; 1629 upper = NULL; 1630 proto = p[0] << 8 | p[1]; 1631 for (i = 0; i < IDX_COUNT; i++) { 1632 if (cps[i]->proto == proto) { 1633 upper = cps[i]; 1634 break; 1635 } 1636 } 1637 if (upper == NULL) 1638 catastrophic++; 1639 1640 if (debug) { 1641 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1642 SPPP_LOG(sp, LOG_INFO, 1643 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1644 cp->name, catastrophic ? '-' : '+', 1645 cpname, proto, upper ? upper->name : "unknown", 1646 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1647 } 1648 1649 /* 1650 * if we got RXJ+ against conf-req, the peer does not implement 1651 * this particular protocol type. terminate the protocol. 1652 */ 1653 if (upper && !catastrophic) { 1654 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1655 sppp_wq_add(sp->wq_cp, 1656 &sp->scp[upper->protoidx].work_close); 1657 break; 1658 } 1659 } 1660 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1661 break; 1662 } 1663 case DISC_REQ: 1664 if (cp->proto != PPP_LCP) 1665 goto illegal; 1666 /* Discard the packet. */ 1667 break; 1668 case ECHO_REQ: 1669 if (cp->proto != PPP_LCP) 1670 goto illegal; 1671 if (scp->state != STATE_OPENED) { 1672 SPPP_DLOG(sp, "lcp echo req but lcp closed\n"); 1673 if_statinc(ifp, if_ierrors); 1674 break; 1675 } 1676 if (len < 8) { 1677 SPPP_DLOG(sp, "invalid lcp echo request " 1678 "packet length: %d bytes\n", len); 1679 break; 1680 } 1681 memcpy(&u32, h + 1, sizeof u32); 1682 if (ntohl(u32) == sp->lcp.magic) { 1683 /* Line loopback mode detected. */ 1684 SPPP_DLOG(sp, "loopback\n"); 1685 1686 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 1687 /* Shut down the PPP link. */ 1688 sppp_wq_add(sp->wq_cp, 1689 &sp->work_ifdown); 1690 } else { 1691 /* Reset the PPP link. */ 1692 sppp_wq_add(sp->wq_cp, 1693 &sp->scp[IDX_LCP].work_close); 1694 sppp_wq_add(sp->wq_cp, 1695 &sp->scp[IDX_LCP].work_open); 1696 } 1697 break; 1698 } 1699 u32 = htonl(sp->lcp.magic); 1700 memcpy(h + 1, &u32, sizeof u32); 1701 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n"); 1702 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1703 h + 1); 1704 break; 1705 case ECHO_REPLY: 1706 if (cp->proto != PPP_LCP) 1707 goto illegal; 1708 if (h->ident != sp->lcp.echoid) { 1709 if_statinc(ifp, if_ierrors); 1710 break; 1711 } 1712 if (len < 8) { 1713 SPPP_DLOG(sp, "lcp invalid echo reply " 1714 "packet length: %d bytes\n", len); 1715 break; 1716 } 1717 SPPP_DLOG(sp, "lcp got echo rep\n"); 1718 memcpy(&u32, h + 1, sizeof u32); 1719 if (ntohl(u32) != sp->lcp.magic) 1720 sp->pp_alivecnt = 0; 1721 break; 1722 default: 1723 /* Unknown packet type -- send Code-Reject packet. */ 1724 illegal: 1725 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n", 1726 cp->name, h->type); 1727 sppp_cp_send(sp, cp->proto, CODE_REJ, 1728 ++scp->seq, m->m_pkthdr.len, h); 1729 if_statinc(ifp, if_ierrors); 1730 } 1731 1732 out: 1733 m_freem(m); 1734 } 1735 1736 /* 1737 * The generic part of all Up/Down/Open/Close/TO event handlers. 1738 * Basically, the state transition handling in the automaton. 1739 */ 1740 static void 1741 sppp_up_event(struct sppp *sp, void *xcp) 1742 { 1743 const struct cp *cp = xcp; 1744 1745 KASSERT(SPPP_WLOCKED(sp)); 1746 KASSERT(!cpu_softintr_p()); 1747 1748 if ((cp->flags & CP_AUTH) != 0 && 1749 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1750 return; 1751 1752 SPPP_DLOG(sp, "%s up(%s)\n", cp->name, 1753 sppp_state_name(sp->scp[cp->protoidx].state)); 1754 1755 switch (sp->scp[cp->protoidx].state) { 1756 case STATE_INITIAL: 1757 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1758 break; 1759 case STATE_STARTING: 1760 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1761 (cp->scr)(sp); 1762 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1763 break; 1764 default: 1765 SPPP_LOG(sp, LOG_DEBUG, 1766 "%s illegal up in state %s\n", cp->name, 1767 sppp_state_name(sp->scp[cp->protoidx].state)); 1768 } 1769 } 1770 1771 static void 1772 sppp_down_event(struct sppp *sp, void *xcp) 1773 { 1774 const struct cp *cp = xcp; 1775 1776 KASSERT(SPPP_WLOCKED(sp)); 1777 KASSERT(!cpu_softintr_p()); 1778 1779 if ((cp->flags & CP_AUTH) != 0 && 1780 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1781 return; 1782 1783 SPPP_DLOG(sp, "%s down(%s)\n", cp->name, 1784 sppp_state_name(sp->scp[cp->protoidx].state)); 1785 1786 switch (sp->scp[cp->protoidx].state) { 1787 case STATE_CLOSED: 1788 case STATE_CLOSING: 1789 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1790 break; 1791 case STATE_STOPPED: 1792 (cp->tls)(cp, sp); 1793 /* fall through */ 1794 case STATE_STOPPING: 1795 case STATE_REQ_SENT: 1796 case STATE_ACK_RCVD: 1797 case STATE_ACK_SENT: 1798 sppp_cp_change_state(cp, sp, STATE_STARTING); 1799 break; 1800 case STATE_OPENED: 1801 (cp->tld)(sp); 1802 sppp_cp_change_state(cp, sp, STATE_STARTING); 1803 break; 1804 default: 1805 /* 1806 * a down event may be caused regardless 1807 * of state just in LCP case. 1808 */ 1809 if (cp->proto == PPP_LCP) 1810 break; 1811 1812 SPPP_LOG(sp, LOG_DEBUG, 1813 "%s illegal down in state %s\n", cp->name, 1814 sppp_state_name(sp->scp[cp->protoidx].state)); 1815 } 1816 } 1817 1818 static void 1819 sppp_open_event(struct sppp *sp, void *xcp) 1820 { 1821 const struct cp *cp = xcp; 1822 1823 KASSERT(SPPP_WLOCKED(sp)); 1824 KASSERT(!cpu_softintr_p()); 1825 1826 if ((cp->flags & CP_AUTH) != 0 && 1827 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1828 return; 1829 1830 SPPP_DLOG(sp, "%s open(%s)\n", cp->name, 1831 sppp_state_name(sp->scp[cp->protoidx].state)); 1832 1833 switch (sp->scp[cp->protoidx].state) { 1834 case STATE_INITIAL: 1835 sppp_cp_change_state(cp, sp, STATE_STARTING); 1836 (cp->tls)(cp, sp); 1837 break; 1838 case STATE_STARTING: 1839 break; 1840 case STATE_CLOSED: 1841 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1842 sp->lcp.protos |= (1 << cp->protoidx); 1843 (cp->scr)(sp); 1844 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1845 break; 1846 case STATE_STOPPED: 1847 case STATE_STOPPING: 1848 case STATE_REQ_SENT: 1849 case STATE_ACK_RCVD: 1850 case STATE_ACK_SENT: 1851 case STATE_OPENED: 1852 break; 1853 case STATE_CLOSING: 1854 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1855 break; 1856 } 1857 } 1858 1859 static void 1860 sppp_close_event(struct sppp *sp, void *xcp) 1861 { 1862 const struct cp *cp = xcp; 1863 1864 KASSERT(SPPP_WLOCKED(sp)); 1865 KASSERT(!cpu_softintr_p()); 1866 1867 if ((cp->flags & CP_AUTH) != 0 && 1868 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1869 return; 1870 1871 SPPP_DLOG(sp, "%s close(%s)\n", cp->name, 1872 sppp_state_name(sp->scp[cp->protoidx].state)); 1873 1874 switch (sp->scp[cp->protoidx].state) { 1875 case STATE_INITIAL: 1876 case STATE_CLOSED: 1877 case STATE_CLOSING: 1878 break; 1879 case STATE_STARTING: 1880 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1881 (cp->tlf)(cp, sp); 1882 break; 1883 case STATE_STOPPED: 1884 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1885 break; 1886 case STATE_STOPPING: 1887 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1888 break; 1889 case STATE_OPENED: 1890 (cp->tld)(sp); 1891 /* fall through */ 1892 case STATE_REQ_SENT: 1893 case STATE_ACK_RCVD: 1894 case STATE_ACK_SENT: 1895 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 1896 if ((cp->flags & CP_AUTH) == 0) { 1897 sppp_cp_send(sp, cp->proto, TERM_REQ, 1898 ++sp->scp[cp->protoidx].seq, 0, 0); 1899 } 1900 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1901 break; 1902 } 1903 } 1904 1905 static void 1906 sppp_to_event(struct sppp *sp, void *xcp) 1907 { 1908 const struct cp *cp = xcp; 1909 1910 KASSERT(SPPP_WLOCKED(sp)); 1911 KASSERT(!cpu_softintr_p()); 1912 1913 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name, 1914 sppp_state_name(sp->scp[cp->protoidx].state), 1915 sp->scp[cp->protoidx].rst_counter); 1916 1917 if (--sp->scp[cp->protoidx].rst_counter < 0) 1918 /* TO- event */ 1919 switch (sp->scp[cp->protoidx].state) { 1920 case STATE_CLOSING: 1921 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1922 (cp->tlf)(cp, sp); 1923 break; 1924 case STATE_STOPPING: 1925 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1926 (cp->tlf)(cp, sp); 1927 break; 1928 case STATE_REQ_SENT: 1929 case STATE_ACK_RCVD: 1930 case STATE_ACK_SENT: 1931 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1932 (cp->tlf)(cp, sp); 1933 break; 1934 } 1935 else 1936 /* TO+ event */ 1937 switch (sp->scp[cp->protoidx].state) { 1938 case STATE_CLOSING: 1939 case STATE_STOPPING: 1940 if ((cp->flags & CP_AUTH) == 0) { 1941 sppp_cp_send(sp, cp->proto, TERM_REQ, 1942 ++sp->scp[cp->protoidx].seq, 0, 0); 1943 } 1944 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 1945 break; 1946 case STATE_REQ_SENT: 1947 case STATE_ACK_RCVD: 1948 (cp->scr)(sp); 1949 /* sppp_cp_change_state() will restart the timer */ 1950 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1951 break; 1952 case STATE_ACK_SENT: 1953 (cp->scr)(sp); 1954 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 1955 break; 1956 } 1957 } 1958 static void 1959 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 1960 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 1961 { 1962 struct ifnet *ifp = &sp->pp_if; 1963 u_char ctype; 1964 1965 if (type == CP_RCR_ERR) { 1966 /* parse error, shut down */ 1967 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1968 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 1969 } else if (type == CP_RCR_ACK) { 1970 /* RCR+ event */ 1971 ctype = CONF_ACK; 1972 switch (sp->scp[cp->protoidx].state) { 1973 case STATE_OPENED: 1974 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1975 cp->tld(sp); 1976 cp->scr(sp); 1977 cp->screply(cp, sp, ctype, ident, msglen, msg); 1978 break; 1979 case STATE_REQ_SENT: 1980 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1981 /* fall through */ 1982 case STATE_ACK_SENT: 1983 cp->screply(cp, sp, ctype, ident, msglen, msg); 1984 break; 1985 case STATE_STOPPED: 1986 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1987 cp->scr(sp); 1988 cp->screply(cp, sp, ctype, ident, msglen, msg); 1989 break; 1990 case STATE_ACK_RCVD: 1991 sppp_cp_change_state(cp, sp, STATE_OPENED); 1992 SPPP_DLOG(sp, "%s tlu\n", cp->name); 1993 cp->tlu(sp); 1994 cp->screply(cp, sp, ctype, ident, msglen, msg); 1995 break; 1996 case STATE_CLOSING: 1997 case STATE_STOPPING: 1998 break; 1999 case STATE_CLOSED: 2000 if ((cp->flags & CP_AUTH) == 0) { 2001 sppp_cp_send(sp, cp->proto, TERM_ACK, 2002 ident, 0, 0); 2003 } 2004 break; 2005 default: 2006 SPPP_LOG(sp, LOG_DEBUG, 2007 "%s illegal RCR+ in state %s\n", cp->name, 2008 sppp_state_name(sp->scp[cp->protoidx].state)); 2009 if_statinc(ifp, if_ierrors); 2010 } 2011 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2012 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2013 /* RCR- event */ 2014 switch (sp->scp[cp->protoidx].state) { 2015 case STATE_OPENED: 2016 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2017 cp->tld(sp); 2018 cp->scr(sp); 2019 cp->screply(cp, sp, ctype, ident, msglen, msg); 2020 break; 2021 case STATE_ACK_SENT: 2022 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2023 /* fall through */ 2024 case STATE_REQ_SENT: 2025 cp->screply(cp, sp, ctype, ident, msglen, msg); 2026 break; 2027 case STATE_STOPPED: 2028 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2029 cp->scr(sp); 2030 cp->screply(cp, sp, ctype, ident, msglen, msg); 2031 break; 2032 case STATE_ACK_RCVD: 2033 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2034 cp->screply(cp, sp, ctype, ident, msglen, msg); 2035 break; 2036 case STATE_CLOSING: 2037 case STATE_STOPPING: 2038 break; 2039 case STATE_CLOSED: 2040 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2041 if ((cp->flags & CP_AUTH) == 0) { 2042 sppp_cp_send(sp, cp->proto, TERM_ACK, 2043 ident, 0, 0); 2044 } 2045 break; 2046 default: 2047 SPPP_LOG(sp, LOG_DEBUG, 2048 "%s illegal RCR- in state %s\n", cp->name, 2049 sppp_state_name(sp->scp[cp->protoidx].state)); 2050 if_statinc(ifp, if_ierrors); 2051 } 2052 } 2053 } 2054 2055 static void 2056 sppp_rcr_event(struct sppp *sp, void *xcp) 2057 { 2058 const struct cp *cp = xcp; 2059 struct sppp_cp *scp; 2060 struct lcp_header *h; 2061 struct mbuf *m; 2062 enum cp_rcr_type type; 2063 size_t len; 2064 uint8_t *buf; 2065 size_t blen, rlen; 2066 uint8_t ident; 2067 2068 KASSERT(!cpu_softintr_p()); 2069 2070 scp = &sp->scp[cp->protoidx]; 2071 2072 if (cp->parse_confreq != NULL) { 2073 m = scp->mbuf_confreq; 2074 if (m == NULL) 2075 return; 2076 scp->mbuf_confreq = NULL; 2077 2078 h = mtod(m, struct lcp_header *); 2079 if (h->type != CONF_REQ) { 2080 m_freem(m); 2081 return; 2082 } 2083 2084 ident = h->ident; 2085 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2086 2087 type = (cp->parse_confreq)(sp, h, len, 2088 &buf, &blen, &rlen); 2089 m_freem(m); 2090 } else { 2091 /* mbuf_cofreq is already parsed and freed */ 2092 type = scp->rcr_type; 2093 ident = scp->rconfid; 2094 buf = NULL; 2095 blen = rlen = 0; 2096 } 2097 2098 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2099 2100 if (buf != NULL) 2101 kmem_free(buf, blen); 2102 } 2103 2104 static void 2105 sppp_rca_event(struct sppp *sp, void *xcp) 2106 { 2107 struct ifnet *ifp = &sp->pp_if; 2108 const struct cp *cp = xcp; 2109 2110 KASSERT(!cpu_softintr_p()); 2111 2112 switch (sp->scp[cp->protoidx].state) { 2113 case STATE_CLOSED: 2114 case STATE_STOPPED: 2115 if ((cp->flags & CP_AUTH) == 0) { 2116 sppp_cp_send(sp, cp->proto, TERM_ACK, 2117 sp->scp[cp->protoidx].rconfid, 0, 0); 2118 } 2119 break; 2120 case STATE_CLOSING: 2121 case STATE_STOPPING: 2122 break; 2123 case STATE_REQ_SENT: 2124 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2125 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2126 break; 2127 case STATE_OPENED: 2128 (cp->tld)(sp); 2129 /* fall through */ 2130 case STATE_ACK_RCVD: 2131 (cp->scr)(sp); 2132 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2133 break; 2134 case STATE_ACK_SENT: 2135 sppp_cp_change_state(cp, sp, STATE_OPENED); 2136 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2137 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2138 (cp->tlu)(sp); 2139 break; 2140 default: 2141 SPPP_LOG(sp, LOG_DEBUG, 2142 "%s illegal RCA in state %s\n", cp->name, 2143 sppp_state_name(sp->scp[cp->protoidx].state)); 2144 if_statinc(ifp, if_ierrors); 2145 } 2146 } 2147 2148 static void 2149 sppp_rcn_event(struct sppp *sp, void *xcp) 2150 { 2151 const struct cp *cp = xcp; 2152 struct sppp_cp *scp; 2153 struct lcp_header *h; 2154 struct mbuf *m; 2155 struct ifnet *ifp = &sp->pp_if; 2156 size_t len; 2157 2158 KASSERT(!cpu_softintr_p()); 2159 2160 scp = &sp->scp[cp->protoidx]; 2161 m = scp->mbuf_confnak; 2162 if (m == NULL) 2163 return; 2164 scp->mbuf_confnak = NULL; 2165 2166 h = mtod(m, struct lcp_header *); 2167 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2168 2169 switch (h->type) { 2170 case CONF_NAK: 2171 (cp->parse_confnak)(sp, h, len); 2172 break; 2173 case CONF_REJ: 2174 (cp->parse_confrej)(sp, h, len); 2175 break; 2176 default: 2177 m_freem(m); 2178 return; 2179 } 2180 2181 m_freem(m); 2182 2183 switch (scp->state) { 2184 case STATE_CLOSED: 2185 case STATE_STOPPED: 2186 if ((cp->flags & CP_AUTH) == 0) { 2187 sppp_cp_send(sp, cp->proto, TERM_ACK, 2188 scp->rconfid, 0, 0); 2189 } 2190 break; 2191 case STATE_REQ_SENT: 2192 case STATE_ACK_SENT: 2193 scp->rst_counter = sp->lcp.max_configure; 2194 (cp->scr)(sp); 2195 break; 2196 case STATE_OPENED: 2197 (cp->tld)(sp); 2198 /* fall through */ 2199 case STATE_ACK_RCVD: 2200 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2201 (cp->scr)(sp); 2202 break; 2203 case STATE_CLOSING: 2204 case STATE_STOPPING: 2205 break; 2206 default: 2207 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n", 2208 cp->name, sppp_state_name(scp->state)); 2209 if_statinc(ifp, if_ierrors); 2210 } 2211 } 2212 2213 static void 2214 sppp_rtr_event(struct sppp *sp, void *xcp) 2215 { 2216 struct ifnet *ifp = &sp->pp_if; 2217 const struct cp *cp = xcp; 2218 2219 KASSERT(!cpu_softintr_p()); 2220 2221 switch (sp->scp[cp->protoidx].state) { 2222 case STATE_ACK_RCVD: 2223 case STATE_ACK_SENT: 2224 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2225 break; 2226 case STATE_CLOSED: 2227 case STATE_STOPPED: 2228 case STATE_CLOSING: 2229 case STATE_STOPPING: 2230 case STATE_REQ_SENT: 2231 break; 2232 case STATE_OPENED: 2233 (cp->tld)(sp); 2234 sp->scp[cp->protoidx].rst_counter = 0; 2235 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2236 break; 2237 default: 2238 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n", 2239 cp->name, 2240 sppp_state_name(sp->scp[cp->protoidx].state)); 2241 if_statinc(ifp, if_ierrors); 2242 return; 2243 } 2244 2245 /* Send Terminate-Ack packet. */ 2246 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name); 2247 if ((cp->flags & CP_AUTH) == 0) { 2248 sppp_cp_send(sp, cp->proto, TERM_ACK, 2249 sp->scp[cp->protoidx].rseq, 0, 0); 2250 } 2251 } 2252 2253 static void 2254 sppp_rta_event(struct sppp *sp, void *xcp) 2255 { 2256 const struct cp *cp = xcp; 2257 struct ifnet *ifp = &sp->pp_if; 2258 2259 KASSERT(!cpu_softintr_p()); 2260 2261 switch (sp->scp[cp->protoidx].state) { 2262 case STATE_CLOSED: 2263 case STATE_STOPPED: 2264 case STATE_REQ_SENT: 2265 case STATE_ACK_SENT: 2266 break; 2267 case STATE_CLOSING: 2268 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2269 (cp->tlf)(cp, sp); 2270 break; 2271 case STATE_STOPPING: 2272 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2273 (cp->tlf)(cp, sp); 2274 break; 2275 case STATE_ACK_RCVD: 2276 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2277 break; 2278 case STATE_OPENED: 2279 (cp->tld)(sp); 2280 (cp->scr)(sp); 2281 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2282 break; 2283 default: 2284 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n", 2285 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2286 if_statinc(ifp, if_ierrors); 2287 } 2288 } 2289 2290 static void 2291 sppp_rxj_event(struct sppp *sp, void *xcp) 2292 { 2293 const struct cp *cp = xcp; 2294 struct ifnet *ifp = &sp->pp_if; 2295 2296 KASSERT(!cpu_softintr_p()); 2297 2298 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2299 switch (sp->scp[cp->protoidx].state) { 2300 case STATE_CLOSED: 2301 case STATE_STOPPED: 2302 case STATE_REQ_SENT: 2303 case STATE_ACK_SENT: 2304 case STATE_CLOSING: 2305 case STATE_STOPPING: 2306 case STATE_OPENED: 2307 break; 2308 case STATE_ACK_RCVD: 2309 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2310 break; 2311 default: 2312 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n", 2313 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2314 if_statinc(ifp, if_ierrors); 2315 } 2316 } 2317 2318 /* 2319 * Change the state of a control protocol in the state automaton. 2320 * Takes care of starting/stopping the restart timer. 2321 */ 2322 void 2323 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2324 { 2325 2326 KASSERT(SPPP_WLOCKED(sp)); 2327 2328 sp->scp[cp->protoidx].state = newstate; 2329 callout_stop(&sp->scp[cp->protoidx].ch); 2330 switch (newstate) { 2331 case STATE_INITIAL: 2332 case STATE_STARTING: 2333 case STATE_CLOSED: 2334 case STATE_STOPPED: 2335 case STATE_OPENED: 2336 break; 2337 case STATE_CLOSING: 2338 case STATE_STOPPING: 2339 case STATE_REQ_SENT: 2340 case STATE_ACK_RCVD: 2341 case STATE_ACK_SENT: 2342 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2343 break; 2344 } 2345 } 2346 2347 /* 2348 *--------------------------------------------------------------------------* 2349 * * 2350 * The LCP implementation. * 2351 * * 2352 *--------------------------------------------------------------------------* 2353 */ 2354 static void 2355 sppp_lcp_init(struct sppp *sp) 2356 { 2357 2358 KASSERT(SPPP_WLOCKED(sp)); 2359 2360 sppp_cp_init(&lcp, sp); 2361 2362 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2363 sp->lcp.magic = 0; 2364 sp->lcp.protos = 0; 2365 sp->lcp.max_terminate = 2; 2366 sp->lcp.max_configure = 10; 2367 sp->lcp.max_failure = 10; 2368 sp->lcp.lower_running = false; 2369 2370 /* 2371 * Initialize counters and timeout values. Note that we don't 2372 * use the 3 seconds suggested in RFC 1661 since we are likely 2373 * running on a fast link. XXX We should probably implement 2374 * the exponential backoff option. Note that these values are 2375 * relevant for all control protocols, not just LCP only. 2376 */ 2377 sp->lcp.timeout = 1 * hz; 2378 } 2379 2380 static void 2381 sppp_lcp_up(struct sppp *sp, void *xcp) 2382 { 2383 struct ifnet *ifp = &sp->pp_if; 2384 const struct cp *cp = xcp; 2385 int pidx; 2386 2387 KASSERT(SPPP_WLOCKED(sp)); 2388 2389 pidx = cp->protoidx; 2390 /* Initialize activity timestamp: opening a connection is an activity */ 2391 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2392 2393 /* 2394 * If this interface is passive or dial-on-demand, and we are 2395 * still in Initial state, it means we've got an incoming 2396 * call. Activate the interface. 2397 */ 2398 if (ifp->if_flags & IFF_AUTO) { 2399 ifp->if_flags |= IFF_RUNNING; 2400 if (sp->scp[pidx].state == STATE_INITIAL) { 2401 SPPP_DLOG(sp, "Up event (incoming call)\n"); 2402 sp->pp_flags |= PP_CALLIN; 2403 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2404 } else { 2405 SPPP_DLOG(sp, "Up event\n"); 2406 } 2407 } 2408 2409 sppp_up_event(sp, xcp); 2410 } 2411 2412 static void 2413 sppp_lcp_down(struct sppp *sp, void *xcp) 2414 { 2415 const struct cp *cp = xcp; 2416 struct ifnet *ifp = &sp->pp_if; 2417 int pidx = cp->protoidx; 2418 2419 KASSERT(SPPP_WLOCKED(sp)); 2420 KASSERT(!cpu_softintr_p()); 2421 2422 sppp_down_event(sp, xcp); 2423 2424 switch (sp->scp[pidx].state) { 2425 case STATE_STARTING: 2426 /* 2427 * Req-Sent/Ack-Sent/Ack-Rcvd -> Starting: 2428 * This transition requires an extra TLS action. 2429 * * sequence of events/actions: 2430 * 1. Closing -> Closed : Triggers TLF action. 2431 * 2. Closed -> Req-Sent : Occurs on Open event. 2432 * 3. Req-Sent -> Ack-Sent...: (Optional state progression) 2433 * 4. Req-Sent/Ack-Sent/Ack-Rcvd -> Starting: 2434 * - Triggered by a Down event caused by the previous TLF action. 2435 * - This specific transition does NOT trigger another TLS action. 2436 */ 2437 cp->tls(cp, sp); 2438 break; 2439 case STATE_INITIAL: 2440 /* 2441 * Closing -> Initial: 2442 * A Down event in the Closing state triggers a transition to 2443 * Initial state without a TLF action. Since the lower layer 2444 * will attempt to reconnect, we explicitly stop it here. 2445 */ 2446 cp->tlf(cp, sp); 2447 break; 2448 } 2449 2450 SPPP_DLOG(sp, "Down event (carrier loss)\n"); 2451 2452 if (ifp->if_flags & IFF_AUTO) { 2453 sp->pp_flags &= ~PP_CALLIN; 2454 if (sp->scp[pidx].state != STATE_INITIAL) 2455 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2456 ifp->if_flags &= ~IFF_RUNNING; 2457 } 2458 2459 sp->scp[pidx].fail_counter = 0; 2460 } 2461 2462 static void 2463 sppp_lcp_open(struct sppp *sp, void *xcp) 2464 { 2465 2466 KASSERT(SPPP_WLOCKED(sp)); 2467 KASSERT(!cpu_softintr_p()); 2468 2469 sp->scp[IDX_LCP].fail_counter = 0; 2470 2471 if (sp->pp_if.if_mtu < PP_MTU) { 2472 sp->lcp.mru = sp->pp_if.if_mtu; 2473 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2474 } else { 2475 sp->lcp.mru = PP_MTU; 2476 } 2477 sp->lcp.their_mru = PP_MTU; 2478 2479 /* 2480 * If we are authenticator, negotiate LCP_AUTH 2481 */ 2482 if (sp->hisauth.proto != PPP_NOPROTO) 2483 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2484 else 2485 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2486 sp->pp_flags &= ~PP_NEEDAUTH; 2487 sppp_open_event(sp, xcp); 2488 } 2489 2490 /* 2491 * Analyze a configure request. Return true if it was agreeable, and 2492 * caused action sca, false if it has been rejected or nak'ed, and 2493 * caused action scn. (The return value is used to make the state 2494 * transition decision in the state automaton.) 2495 */ 2496 static enum cp_rcr_type 2497 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2498 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2499 { 2500 const bool debug = sppp_debug_enabled(sp); 2501 u_char *buf, *r, *p, l, blen; 2502 enum cp_rcr_type type; 2503 int len, rlen; 2504 uint32_t nmagic; 2505 u_short authproto; 2506 char lbuf[SPPP_LCPOPT_NAMELEN]; 2507 2508 KASSERT(SPPP_WLOCKED(sp)); 2509 2510 if (origlen < sizeof(*h)) 2511 return CP_RCR_DROP; 2512 2513 origlen -= sizeof(*h); 2514 type = CP_RCR_NONE; 2515 type = 0; 2516 2517 if (origlen <= 0) 2518 return CP_RCR_DROP; 2519 else 2520 blen = origlen; 2521 2522 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2523 if (buf == NULL) 2524 return CP_RCR_DROP; 2525 2526 if (debug) 2527 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:"); 2528 2529 /* pass 1: check for things that need to be rejected */ 2530 p = (void *)(h + 1); 2531 r = buf; 2532 rlen = 0; 2533 for (len = origlen; len > 1; len-= l, p += l) { 2534 l = p[1]; 2535 if (l == 0) 2536 break; 2537 2538 /* Sanity check option length */ 2539 if (l > len) { 2540 /* 2541 * Malicious option - drop immediately. 2542 * XXX Maybe we should just RXJ it? 2543 */ 2544 if (debug) 2545 addlog("\n"); 2546 2547 SPPP_LOG(sp, LOG_DEBUG, 2548 "received malicious LCP option 0x%02x, " 2549 "length 0x%02x, (len: 0x%02x) dropping.\n", 2550 p[0], l, len); 2551 type = CP_RCR_ERR; 2552 goto end; 2553 } 2554 if (debug) 2555 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2556 switch (p[0]) { 2557 case LCP_OPT_MAGIC: 2558 /* Magic number. */ 2559 /* fall through, both are same length */ 2560 case LCP_OPT_ASYNC_MAP: 2561 /* Async control character map. */ 2562 if (len >= 6 || l == 6) 2563 continue; 2564 if (debug) 2565 addlog(" [invalid]"); 2566 break; 2567 case LCP_OPT_MP_EID: 2568 if (len >= l && l >= 3) { 2569 switch (p[2]) { 2570 case 0: if (l==3+ 0) continue;break; 2571 case 2: if (l==3+ 4) continue;break; 2572 case 3: if (l==3+ 6) continue;break; 2573 case 6: if (l==3+16) continue;break; 2574 case 1: /* FALLTHROUGH */ 2575 case 4: if (l<=3+20) continue;break; 2576 case 5: if (l<=3+15) continue;break; 2577 /* XXX should it be default: continue;? */ 2578 } 2579 } 2580 if (debug) 2581 addlog(" [invalid class %d len %d]", p[2], l); 2582 break; 2583 case LCP_OPT_MP_SSNHF: 2584 if (len >= 2 && l == 2) { 2585 if (debug) 2586 addlog(" [rej]"); 2587 break; 2588 } 2589 if (debug) 2590 addlog(" [invalid]"); 2591 break; 2592 case LCP_OPT_MP_MRRU: 2593 /* Multilink maximum received reconstructed unit */ 2594 /* should be fall through, both are same length */ 2595 /* FALLTHROUGH */ 2596 case LCP_OPT_MRU: 2597 /* Maximum receive unit. */ 2598 if (len >= 4 && l == 4) 2599 continue; 2600 if (debug) 2601 addlog(" [invalid]"); 2602 break; 2603 case LCP_OPT_AUTH_PROTO: 2604 if (len < 4) { 2605 if (debug) 2606 addlog(" [invalid]"); 2607 break; 2608 } 2609 authproto = (p[2] << 8) + p[3]; 2610 if (authproto == PPP_CHAP && l != 5) { 2611 if (debug) 2612 addlog(" [invalid chap len]"); 2613 break; 2614 } 2615 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2616 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2617 sp->myauth.proto = authproto; 2618 } 2619 if (sp->myauth.proto == PPP_NOPROTO) { 2620 /* we are not configured to do auth */ 2621 if (debug) 2622 addlog(" [not configured]"); 2623 break; 2624 } 2625 /* 2626 * Remote want us to authenticate, remember this, 2627 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2628 * up. 2629 */ 2630 sp->pp_flags |= PP_NEEDAUTH; 2631 continue; 2632 default: 2633 /* Others not supported. */ 2634 if (debug) 2635 addlog(" [rej]"); 2636 break; 2637 } 2638 if (rlen + l > blen) { 2639 if (debug) 2640 addlog(" [overflow]"); 2641 continue; 2642 } 2643 /* Add the option to rejected list. */ 2644 memcpy(r, p, l); 2645 r += l; 2646 rlen += l; 2647 } 2648 2649 if (rlen > 0) { 2650 type = CP_RCR_REJ; 2651 goto end; 2652 } 2653 2654 if (debug) 2655 addlog("\n"); 2656 2657 /* 2658 * pass 2: check for option values that are unacceptable and 2659 * thus require to be nak'ed. 2660 */ 2661 if (debug) 2662 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:"); 2663 2664 p = (void *)(h + 1); 2665 r = buf; 2666 rlen = 0; 2667 for (len = origlen; len > 0; len -= l, p += l) { 2668 l = p[1]; 2669 if (l == 0) 2670 break; 2671 2672 if (debug) 2673 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2674 switch (p[0]) { 2675 case LCP_OPT_MAGIC: 2676 /* Magic number -- extract. */ 2677 nmagic = (uint32_t)p[2] << 24 | 2678 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2679 if (nmagic != sp->lcp.magic) { 2680 if (debug) 2681 addlog(" 0x%x", nmagic); 2682 continue; 2683 } 2684 /* 2685 * Local and remote magics equal -- loopback? 2686 */ 2687 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2688 SPPP_DLOG(sp, "loopback\n"); 2689 sp->pp_loopcnt = 0; 2690 2691 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 2692 sppp_wq_add(sp->wq_cp, 2693 &sp->work_ifdown); 2694 } else { 2695 sppp_wq_add(sp->wq_cp, 2696 &sp->scp[IDX_LCP].work_close); 2697 sppp_wq_add(sp->wq_cp, 2698 &sp->scp[IDX_LCP].work_open); 2699 } 2700 } else { 2701 if (debug) 2702 addlog(" [glitch]"); 2703 ++sp->pp_loopcnt; 2704 } 2705 /* 2706 * We negate our magic here, and NAK it. If 2707 * we see it later in an NAK packet, we 2708 * suggest a new one. 2709 */ 2710 nmagic = ~sp->lcp.magic; 2711 /* Gonna NAK it. */ 2712 p[2] = nmagic >> 24; 2713 p[3] = nmagic >> 16; 2714 p[4] = nmagic >> 8; 2715 p[5] = nmagic; 2716 break; 2717 2718 case LCP_OPT_ASYNC_MAP: 2719 /* 2720 * Async control character map -- just ignore it. 2721 * 2722 * Quote from RFC 1662, chapter 6: 2723 * To enable this functionality, synchronous PPP 2724 * implementations MUST always respond to the 2725 * Async-Control-Character-Map Configuration 2726 * Option with the LCP Configure-Ack. However, 2727 * acceptance of the Configuration Option does 2728 * not imply that the synchronous implementation 2729 * will do any ACCM mapping. Instead, all such 2730 * octet mapping will be performed by the 2731 * asynchronous-to-synchronous converter. 2732 */ 2733 continue; 2734 2735 case LCP_OPT_MRU: 2736 /* 2737 * Maximum receive unit. Always agreeable, 2738 * but ignored by now. 2739 */ 2740 sp->lcp.their_mru = p[2] * 256 + p[3]; 2741 if (debug) 2742 addlog(" %ld", sp->lcp.their_mru); 2743 continue; 2744 2745 case LCP_OPT_AUTH_PROTO: 2746 authproto = (p[2] << 8) + p[3]; 2747 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2748 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2749 sp->myauth.proto = authproto; 2750 } 2751 if (sp->myauth.proto == authproto) { 2752 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 2753 continue; 2754 } 2755 if (debug) 2756 addlog(" [chap without MD5]"); 2757 } else { 2758 if (debug) { 2759 char pbuf1[SPPP_PROTO_NAMELEN]; 2760 char pbuf2[SPPP_PROTO_NAMELEN]; 2761 const char *pname1, *pname2; 2762 2763 pname1 = sppp_proto_name(pbuf1, 2764 sizeof(pbuf1), sp->myauth.proto); 2765 pname2 = sppp_proto_name(pbuf2, 2766 sizeof(pbuf2), authproto); 2767 addlog(" [mine %s != his %s]", 2768 pname1, pname2); 2769 } 2770 } 2771 /* not agreed, nak */ 2772 if (sp->myauth.proto == PPP_CHAP) { 2773 l = 5; 2774 } else { 2775 l = 4; 2776 } 2777 2778 if (rlen + l > blen) { 2779 if (debug) 2780 addlog(" [overflow]"); 2781 continue; 2782 } 2783 2784 r[0] = LCP_OPT_AUTH_PROTO; 2785 r[1] = l; 2786 r[2] = sp->myauth.proto >> 8; 2787 r[3] = sp->myauth.proto & 0xff; 2788 if (sp->myauth.proto == PPP_CHAP) 2789 r[4] = CHAP_MD5; 2790 rlen += l; 2791 r += l; 2792 continue; 2793 case LCP_OPT_MP_EID: 2794 /* 2795 * Endpoint identification. 2796 * Always agreeable, 2797 * but ignored by now. 2798 */ 2799 if (debug) { 2800 addlog(" type %d", p[2]); 2801 sppp_print_bytes(p+3, p[1]-3); 2802 } 2803 continue; 2804 case LCP_OPT_MP_MRRU: 2805 /* 2806 * Maximum received reconstructed unit. 2807 * Always agreeable, 2808 * but ignored by now. 2809 */ 2810 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2811 if (debug) 2812 addlog(" %ld", sp->lcp.their_mrru); 2813 continue; 2814 } 2815 if (rlen + l > blen) { 2816 if (debug) 2817 addlog(" [overflow]"); 2818 continue; 2819 } 2820 /* Add the option to nak'ed list. */ 2821 memcpy(r, p, l); 2822 r += l; 2823 rlen += l; 2824 } 2825 2826 if (rlen > 0) { 2827 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2828 if (debug) 2829 addlog(" max_failure (%d) exceeded, ", 2830 sp->lcp.max_failure); 2831 type = CP_RCR_REJ; 2832 } else { 2833 type = CP_RCR_NAK; 2834 } 2835 } else { 2836 type = CP_RCR_ACK; 2837 rlen = origlen; 2838 memcpy(r, h + 1, rlen); 2839 sp->scp[IDX_LCP].fail_counter = 0; 2840 sp->pp_loopcnt = 0; 2841 } 2842 2843 end: 2844 if (debug) 2845 addlog("\n"); 2846 2847 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 2848 if (buf != NULL) 2849 kmem_intr_free(buf, blen); 2850 } else { 2851 *msgbuf = buf; 2852 *buflen = blen; 2853 *msglen = rlen; 2854 } 2855 2856 return type; 2857 } 2858 2859 /* 2860 * Analyze the LCP Configure-Reject option list, and adjust our 2861 * negotiation. 2862 */ 2863 static void 2864 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 2865 { 2866 const bool debug = sppp_debug_enabled(sp); 2867 u_char *p, l; 2868 2869 KASSERT(SPPP_WLOCKED(sp)); 2870 2871 if (len <= sizeof(*h)) 2872 return; 2873 2874 len -= sizeof(*h); 2875 2876 if (debug) 2877 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:"); 2878 2879 p = (void *)(h + 1); 2880 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2881 /* Sanity check option length */ 2882 if (l > len) { 2883 /* 2884 * Malicious option - drop immediately. 2885 * XXX Maybe we should just RXJ it? 2886 */ 2887 if (debug) 2888 addlog("\n"); 2889 2890 SPPP_LOG(sp, LOG_DEBUG, 2891 "received malicious LCP option, dropping.\n"); 2892 goto end; 2893 } 2894 if (debug) { 2895 char lbuf[SPPP_LCPOPT_NAMELEN]; 2896 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2897 } 2898 switch (p[0]) { 2899 case LCP_OPT_MAGIC: 2900 /* Magic number -- can't use it, use 0 */ 2901 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2902 sp->lcp.magic = 0; 2903 break; 2904 case LCP_OPT_MRU: 2905 /* 2906 * We try to negotiate a lower MRU if the underlying 2907 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2908 * peer rejects this lower rate, fallback to the 2909 * default. 2910 */ 2911 if (!debug) { 2912 SPPP_LOG(sp, LOG_INFO, 2913 "peer rejected our MRU of " 2914 "%ld bytes. Defaulting to %d bytes\n", 2915 sp->lcp.mru, PP_MTU); 2916 } 2917 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2918 sp->lcp.mru = PP_MTU; 2919 break; 2920 case LCP_OPT_AUTH_PROTO: 2921 /* 2922 * Peer doesn't want to authenticate himself, 2923 * deny unless this is a dialout call, and 2924 * SPPP_AUTHFLAG_NOCALLOUT is set. 2925 */ 2926 if ((sp->pp_flags & PP_CALLIN) == 0 && 2927 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2928 if (debug) { 2929 addlog(" [don't insist on auth " 2930 "for callout]"); 2931 } 2932 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2933 break; 2934 } 2935 if (debug) 2936 addlog("[access denied]\n"); 2937 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2938 break; 2939 } 2940 } 2941 if (debug) 2942 addlog("\n"); 2943 end: 2944 return; 2945 } 2946 2947 /* 2948 * Analyze the LCP Configure-NAK option list, and adjust our 2949 * negotiation. 2950 */ 2951 static void 2952 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 2953 { 2954 const bool debug = sppp_debug_enabled(sp); 2955 u_char *p, l; 2956 uint32_t magic; 2957 2958 KASSERT(SPPP_WLOCKED(sp)); 2959 2960 if (len <= sizeof(*h)) 2961 return; 2962 2963 len -= sizeof(*h); 2964 2965 if (debug) 2966 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:"); 2967 2968 p = (void *)(h + 1); 2969 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2970 /* Sanity check option length */ 2971 if (l > len) { 2972 /* 2973 * Malicious option - drop immediately. 2974 * XXX Maybe we should just RXJ it? 2975 */ 2976 if (debug) 2977 addlog("\n"); 2978 2979 SPPP_LOG(sp, LOG_DEBUG, 2980 "received malicious LCP option, dropping.\n"); 2981 goto end; 2982 } 2983 if (debug) { 2984 char lbuf[SPPP_LCPOPT_NAMELEN]; 2985 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 2986 } 2987 switch (p[0]) { 2988 case LCP_OPT_MAGIC: 2989 /* Magic number -- renegotiate */ 2990 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 2991 len >= 6 && l == 6) { 2992 magic = (uint32_t)p[2] << 24 | 2993 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2994 /* 2995 * If the remote magic is our negated one, 2996 * this looks like a loopback problem. 2997 * Suggest a new magic to make sure. 2998 */ 2999 if (magic == ~sp->lcp.magic) { 3000 if (debug) 3001 addlog(" magic glitch"); 3002 sp->lcp.magic = cprng_fast32(); 3003 } else { 3004 sp->lcp.magic = magic; 3005 if (debug) 3006 addlog(" %d", magic); 3007 } 3008 } 3009 break; 3010 case LCP_OPT_MRU: 3011 /* 3012 * Peer wants to advise us to negotiate an MRU. 3013 * Agree on it if it's reasonable, or use 3014 * default otherwise. 3015 */ 3016 if (len >= 4 && l == 4) { 3017 u_int mru = p[2] * 256 + p[3]; 3018 if (debug) 3019 addlog(" %d", mru); 3020 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3021 mru = sp->pp_if.if_mtu; 3022 sp->lcp.mru = mru; 3023 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3024 } 3025 break; 3026 case LCP_OPT_AUTH_PROTO: 3027 /* 3028 * Peer doesn't like our authentication method, 3029 * deny. 3030 */ 3031 if (debug) 3032 addlog("[access denied]\n"); 3033 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3034 break; 3035 } 3036 } 3037 if (debug) 3038 addlog("\n"); 3039 end: 3040 return; 3041 } 3042 3043 static void 3044 sppp_lcp_tlu(struct sppp *sp) 3045 { 3046 struct ifnet *ifp = &sp->pp_if; 3047 struct sppp_cp *scp; 3048 int i; 3049 3050 KASSERT(SPPP_WLOCKED(sp)); 3051 3052 /* unlock for IFNET_LOCK */ 3053 SPPP_UNLOCK(sp); 3054 3055 IFNET_LOCK(ifp); 3056 SPPP_LOCK(sp, RW_WRITER); 3057 if (ifp->if_mtu > sp->lcp.their_mru) { 3058 sp->pp_saved_mtu = ifp->if_mtu; 3059 ifp->if_mtu = sp->lcp.their_mru; 3060 SPPP_DLOG(sp, "setting MTU " 3061 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3062 sp->pp_saved_mtu, ifp->if_mtu); 3063 } 3064 SPPP_UNLOCK(sp); 3065 IFNET_UNLOCK(ifp); 3066 3067 SPPP_LOCK(sp, RW_WRITER); 3068 3069 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3070 (sp->pp_flags & PP_NEEDAUTH) != 0) 3071 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3072 else 3073 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3074 3075 for (i = 0; i < IDX_COUNT; i++) { 3076 scp = &sp->scp[(cps[i])->protoidx]; 3077 3078 if (((cps[i])->flags & CP_LCP) == 0) 3079 sppp_wq_add(sp->wq_cp, &scp->work_up); 3080 3081 /* 3082 * Open all authentication protocols. This is even required 3083 * if we already proceeded to network phase, since it might be 3084 * that remote wants us to authenticate, so we might have to 3085 * send a PAP request. Undesired authentication protocols 3086 * don't do anything when they get an Open event. 3087 */ 3088 if ((cps[i])->flags & CP_AUTH) 3089 sppp_wq_add(sp->wq_cp, &scp->work_open); 3090 3091 /* Open all NCPs. */ 3092 if (sp->pp_phase == SPPP_PHASE_NETWORK && 3093 ((cps[i])->flags & CP_NCP) != 0) { 3094 sppp_wq_add(sp->wq_cp, &scp->work_open); 3095 } 3096 } 3097 } 3098 3099 static void 3100 sppp_lcp_tld(struct sppp *sp) 3101 { 3102 struct ifnet *ifp; 3103 struct sppp_cp *scp; 3104 int i, phase; 3105 3106 KASSERT(SPPP_WLOCKED(sp)); 3107 3108 phase = sp->pp_phase; 3109 3110 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3111 3112 if (sp->pp_saved_mtu > 0) { 3113 ifp = &sp->pp_if; 3114 3115 SPPP_UNLOCK(sp); 3116 IFNET_LOCK(ifp); 3117 SPPP_LOCK(sp, RW_WRITER); 3118 3119 SPPP_DLOG(sp, "setting MTU " 3120 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3121 ifp->if_mtu, sp->pp_saved_mtu); 3122 3123 ifp->if_mtu = sp->pp_saved_mtu; 3124 sp->pp_saved_mtu = 0; 3125 IFNET_UNLOCK(ifp); 3126 } 3127 3128 /* 3129 * Take upper layers down. We send the Down event first and 3130 * the Close second to prevent the upper layers from sending 3131 * ``a flurry of terminate-request packets'', as the RFC 3132 * describes it. 3133 */ 3134 for (i = 0; i < IDX_COUNT; i++) { 3135 scp = &sp->scp[(cps[i])->protoidx]; 3136 3137 if (((cps[i])->flags & CP_LCP) == 0) 3138 sppp_wq_add(sp->wq_cp, &scp->work_down); 3139 3140 if ((cps[i])->flags & CP_AUTH) { 3141 sppp_wq_add(sp->wq_cp, &scp->work_close); 3142 } 3143 3144 /* Close all NCPs. */ 3145 if (phase == SPPP_PHASE_NETWORK && 3146 ((cps[i])->flags & CP_NCP) != 0) { 3147 sppp_wq_add(sp->wq_cp, &scp->work_close); 3148 } 3149 } 3150 } 3151 3152 static void 3153 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3154 { 3155 3156 KASSERT(SPPP_WLOCKED(sp)); 3157 3158 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3159 3160 /* Notify lower layer if desired. */ 3161 if (!sp->lcp.lower_running) { 3162 sp->lcp.lower_running = true; 3163 sppp_notify_tls_wlocked(sp); 3164 } 3165 } 3166 3167 static void 3168 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3169 { 3170 3171 KASSERT(SPPP_WLOCKED(sp)); 3172 3173 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3174 3175 /* Notify lower layer if desired. */ 3176 if (sp->lcp.lower_running) { 3177 sp->lcp.lower_running = false; 3178 sppp_notify_tlf_wlocked(sp); 3179 } 3180 } 3181 3182 static void 3183 sppp_lcp_scr(struct sppp *sp) 3184 { 3185 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3186 int i = 0; 3187 u_short authproto; 3188 3189 KASSERT(SPPP_WLOCKED(sp)); 3190 3191 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3192 if (! sp->lcp.magic) 3193 sp->lcp.magic = cprng_fast32(); 3194 opt[i++] = LCP_OPT_MAGIC; 3195 opt[i++] = 6; 3196 opt[i++] = sp->lcp.magic >> 24; 3197 opt[i++] = sp->lcp.magic >> 16; 3198 opt[i++] = sp->lcp.magic >> 8; 3199 opt[i++] = sp->lcp.magic; 3200 } 3201 3202 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3203 opt[i++] = LCP_OPT_MRU; 3204 opt[i++] = 4; 3205 opt[i++] = sp->lcp.mru >> 8; 3206 opt[i++] = sp->lcp.mru; 3207 } 3208 3209 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3210 authproto = sp->hisauth.proto; 3211 opt[i++] = LCP_OPT_AUTH_PROTO; 3212 opt[i++] = authproto == PPP_CHAP? 5: 4; 3213 opt[i++] = authproto >> 8; 3214 opt[i++] = authproto; 3215 if (authproto == PPP_CHAP) 3216 opt[i++] = CHAP_MD5; 3217 } 3218 3219 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3220 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3221 } 3222 3223 /* 3224 * Check the open NCPs, return true if at least one NCP is open. 3225 */ 3226 3227 static int 3228 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3229 { 3230 int i, mask; 3231 3232 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3233 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3234 return 1; 3235 return 0; 3236 } 3237 3238 /* 3239 * Check the opened NCPs, return true if at least one NCP is opened. 3240 */ 3241 static bool 3242 sppp_is_ncp_opened(struct sppp *sp) 3243 { 3244 int i, mask; 3245 3246 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3247 if (((cps[i])->flags & CP_NCP) && (sp->scp[i].state == STATE_OPENED)) 3248 return true; 3249 return false; 3250 } 3251 3252 /* 3253 * Re-check the open NCPs and see if we should terminate the link. 3254 * Called by the NCPs during their tlf action handling. 3255 */ 3256 static void 3257 sppp_lcp_check_and_close(struct sppp *sp) 3258 { 3259 3260 KASSERT(SPPP_WLOCKED(sp)); 3261 3262 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3263 /* don't bother, we are already going down */ 3264 return; 3265 } 3266 3267 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3268 sppp_cp_check(sp, CP_AUTH)) 3269 return; 3270 3271 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3272 sppp_cp_check(sp, CP_NCP)) 3273 return; 3274 3275 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3276 3277 if (sp->pp_max_auth_fail != 0 && 3278 sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3279 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, " 3280 "not retrying again\n", sp->pp_auth_failures); 3281 3282 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 3283 } else { 3284 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3285 } 3286 } 3287 3288 /* 3289 *--------------------------------------------------------------------------* 3290 * * 3291 * The IPCP implementation. * 3292 * * 3293 *--------------------------------------------------------------------------* 3294 */ 3295 3296 static void 3297 sppp_ipcp_init(struct sppp *sp) 3298 { 3299 3300 KASSERT(SPPP_WLOCKED(sp)); 3301 3302 sppp_cp_init(&ipcp, sp); 3303 3304 sp->ipcp.opts = 0; 3305 sp->ipcp.flags = 0; 3306 } 3307 3308 static void 3309 sppp_ipcp_open(struct sppp *sp, void *xcp) 3310 { 3311 uint32_t myaddr, hisaddr; 3312 3313 KASSERT(SPPP_WLOCKED(sp)); 3314 KASSERT(!cpu_softintr_p()); 3315 3316 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3317 return; 3318 3319 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3320 sp->ipcp.req_myaddr = 0; 3321 sp->ipcp.req_hisaddr = 0; 3322 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3323 3324 #ifdef INET 3325 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3326 #else 3327 myaddr = hisaddr = 0; 3328 #endif 3329 /* 3330 * If we don't have his address, this probably means our 3331 * interface doesn't want to talk IP at all. (This could 3332 * be the case if somebody wants to speak only IPX, for 3333 * example.) Don't open IPCP in this case. 3334 */ 3335 if (hisaddr == 0) { 3336 /* XXX this message should go away */ 3337 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n"); 3338 return; 3339 } 3340 3341 if (myaddr == 0) { 3342 /* 3343 * I don't have an assigned address, so i need to 3344 * negotiate my address. 3345 */ 3346 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3347 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3348 } 3349 if (hisaddr == 1) { 3350 /* 3351 * XXX - remove this hack! 3352 * remote has no valid address, we need to get one assigned. 3353 */ 3354 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3355 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3356 } 3357 3358 if (sp->query_dns & 1) { 3359 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3360 } else { 3361 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3362 } 3363 3364 if (sp->query_dns & 2) { 3365 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3366 } else { 3367 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3368 } 3369 sppp_open_event(sp, xcp); 3370 } 3371 3372 static void 3373 sppp_ipcp_close(struct sppp *sp, void *xcp) 3374 { 3375 3376 KASSERT(SPPP_WLOCKED(sp)); 3377 KASSERT(!cpu_softintr_p()); 3378 3379 sppp_close_event(sp, xcp); 3380 3381 #ifdef INET 3382 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3383 /* 3384 * Some address was dynamic, clear it again. 3385 */ 3386 sppp_clear_ip_addrs(sp); 3387 } 3388 #endif 3389 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3390 } 3391 3392 /* 3393 * Analyze a configure request. Return true if it was agreeable, and 3394 * caused action sca, false if it has been rejected or nak'ed, and 3395 * caused action scn. (The return value is used to make the state 3396 * transition decision in the state automaton.) 3397 */ 3398 static enum cp_rcr_type 3399 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3400 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3401 { 3402 const bool debug = sppp_debug_enabled(sp); 3403 u_char *buf, *r, *p, l, blen; 3404 enum cp_rcr_type type; 3405 int rlen, len; 3406 uint32_t hisaddr, desiredaddr; 3407 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3408 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3409 const char *dq; 3410 3411 KASSERT(SPPP_WLOCKED(sp)); 3412 3413 type = CP_RCR_NONE; 3414 origlen -= sizeof(*h); 3415 3416 if (origlen < 0) 3417 return CP_RCR_DROP; 3418 3419 /* 3420 * Make sure to allocate a buf that can at least hold a 3421 * conf-nak with an `address' option. We might need it below. 3422 */ 3423 blen = MAX(6, origlen); 3424 3425 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3426 if (buf == NULL) 3427 return CP_RCR_DROP; 3428 3429 /* pass 1: see if we can recognize them */ 3430 if (debug) 3431 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:"); 3432 p = (void *)(h + 1); 3433 r = buf; 3434 rlen = 0; 3435 for (len = origlen; len > 1; len -= l, p += l) { 3436 l = p[1]; 3437 if (l == 0) 3438 break; 3439 3440 /* Sanity check option length */ 3441 if (l > len) { 3442 /* XXX should we just RXJ? */ 3443 if (debug) 3444 addlog("\n"); 3445 3446 SPPP_LOG(sp, LOG_DEBUG, 3447 " malicious IPCP option received, dropping\n"); 3448 type = CP_RCR_ERR; 3449 goto end; 3450 } 3451 if (debug) { 3452 addlog(" %s", 3453 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3454 } 3455 switch (p[0]) { 3456 #ifdef notyet 3457 case IPCP_OPT_COMPRESSION: 3458 if (len >= 6 && l >= 6) { 3459 /* correctly formed compress option */ 3460 continue; 3461 } 3462 if (debug) 3463 addlog(" [invalid]"); 3464 break; 3465 #endif 3466 case IPCP_OPT_ADDRESS: 3467 if (len >= 6 && l == 6) { 3468 /* correctly formed address option */ 3469 continue; 3470 } 3471 if (debug) 3472 addlog(" [invalid]"); 3473 break; 3474 default: 3475 /* Others not supported. */ 3476 if (debug) 3477 addlog(" [rej]"); 3478 break; 3479 } 3480 /* Add the option to rejected list. */ 3481 if (rlen + l > blen) { 3482 if (debug) 3483 addlog(" [overflow]"); 3484 continue; 3485 } 3486 memcpy(r, p, l); 3487 r += l; 3488 rlen += l; 3489 } 3490 3491 if (rlen > 0) { 3492 type = CP_RCR_REJ; 3493 goto end; 3494 } 3495 3496 if (debug) 3497 addlog("\n"); 3498 3499 /* pass 2: parse option values */ 3500 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3501 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3502 else 3503 #ifdef INET 3504 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3505 #else 3506 hisaddr = 0; 3507 #endif 3508 if (debug) 3509 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:"); 3510 p = (void *)(h + 1); 3511 r = buf; 3512 rlen = 0; 3513 for (len = origlen; len > 1; len -= l, p += l) { 3514 l = p[1]; 3515 if (l == 0) 3516 break; 3517 3518 if (debug) { 3519 addlog(" %s", 3520 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3521 } 3522 switch (p[0]) { 3523 #ifdef notyet 3524 case IPCP_OPT_COMPRESSION: 3525 continue; 3526 #endif 3527 case IPCP_OPT_ADDRESS: 3528 desiredaddr = p[2] << 24 | p[3] << 16 | 3529 p[4] << 8 | p[5]; 3530 if (desiredaddr == hisaddr || 3531 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3532 /* 3533 * Peer's address is same as our value, 3534 * this is agreeable. Gonna conf-ack 3535 * it. 3536 */ 3537 if (debug) { 3538 dq = sppp_dotted_quad(dqbuf, 3539 sizeof(dqbuf), hisaddr); 3540 addlog(" %s [ack]", dq); 3541 } 3542 /* record that we've seen it already */ 3543 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3544 sp->ipcp.req_hisaddr = desiredaddr; 3545 hisaddr = desiredaddr; 3546 continue; 3547 } 3548 /* 3549 * The address wasn't agreeable. This is either 3550 * he sent us 0.0.0.0, asking to assign him an 3551 * address, or he send us another address not 3552 * matching our value. Either case, we gonna 3553 * conf-nak it with our value. 3554 */ 3555 if (debug) { 3556 if (desiredaddr == 0) { 3557 addlog(" [addr requested]"); 3558 } else { 3559 dq = sppp_dotted_quad(dqbuf, 3560 sizeof(dqbuf), desiredaddr); 3561 addlog(" %s [not agreed]", dq); 3562 } 3563 } 3564 3565 p[2] = hisaddr >> 24; 3566 p[3] = hisaddr >> 16; 3567 p[4] = hisaddr >> 8; 3568 p[5] = hisaddr; 3569 break; 3570 } 3571 if (rlen + l > blen) { 3572 if (debug) 3573 addlog(" [overflow]"); 3574 continue; 3575 } 3576 /* Add the option to nak'ed list. */ 3577 memcpy(r, p, l); 3578 r += l; 3579 rlen += l; 3580 } 3581 3582 if (rlen > 0) { 3583 type = CP_RCR_NAK; 3584 } else { 3585 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3586 /* 3587 * If we are about to conf-ack the request, but haven't seen 3588 * his address so far, gonna conf-nak it instead, with the 3589 * `address' option present and our idea of his address being 3590 * filled in there, to request negotiation of both addresses. 3591 * 3592 * XXX This can result in an endless req - nak loop if peer 3593 * doesn't want to send us his address. Q: What should we do 3594 * about it? XXX A: implement the max-failure counter. 3595 */ 3596 buf[0] = IPCP_OPT_ADDRESS; 3597 buf[1] = 6; 3598 buf[2] = hisaddr >> 24; 3599 buf[3] = hisaddr >> 16; 3600 buf[4] = hisaddr >> 8; 3601 buf[5] = hisaddr; 3602 rlen = 6; 3603 if (debug) 3604 addlog(" still need hisaddr"); 3605 type = CP_RCR_NAK; 3606 } else { 3607 type = CP_RCR_ACK; 3608 rlen = origlen; 3609 memcpy(r, h + 1, rlen); 3610 } 3611 } 3612 3613 end: 3614 if (debug) 3615 addlog("\n"); 3616 3617 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3618 if (buf != NULL) 3619 kmem_intr_free(buf, blen); 3620 } else { 3621 *msgbuf = buf; 3622 *buflen = blen; 3623 *msglen = rlen; 3624 } 3625 3626 return type; 3627 } 3628 3629 /* 3630 * Analyze the IPCP Configure-Reject option list, and adjust our 3631 * negotiation. 3632 */ 3633 static void 3634 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3635 { 3636 const bool debug = sppp_debug_enabled(sp); 3637 u_char *p, l; 3638 3639 KASSERT(SPPP_WLOCKED(sp)); 3640 3641 if (len <= sizeof(*h)) 3642 return; 3643 3644 len -= sizeof(*h); 3645 3646 if (debug) 3647 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:"); 3648 3649 p = (void *)(h + 1); 3650 for (; len > 1; len -= l, p += l) { 3651 l = p[1]; 3652 if (l == 0) 3653 break; 3654 3655 /* Sanity check option length */ 3656 if (l > len) { 3657 /* XXX should we just RXJ? */ 3658 if (debug) 3659 addlog("\n"); 3660 SPPP_LOG(sp, LOG_DEBUG, 3661 "malicious IPCP option received, dropping\n"); 3662 goto end; 3663 } 3664 if (debug) { 3665 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3666 addlog(" %s", 3667 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3668 } 3669 switch (p[0]) { 3670 case IPCP_OPT_ADDRESS: 3671 /* 3672 * Peer doesn't grok address option. This is 3673 * bad. XXX Should we better give up here? 3674 */ 3675 if (!debug) { 3676 SPPP_LOG(sp, LOG_ERR, 3677 "IPCP address option rejected\n"); 3678 } 3679 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3680 break; 3681 #ifdef notyet 3682 case IPCP_OPT_COMPRESS: 3683 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3684 break; 3685 #endif 3686 case IPCP_OPT_PRIMDNS: 3687 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3688 break; 3689 3690 case IPCP_OPT_SECDNS: 3691 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3692 break; 3693 } 3694 } 3695 if (debug) 3696 addlog("\n"); 3697 end: 3698 return; 3699 } 3700 3701 /* 3702 * Analyze the IPCP Configure-NAK option list, and adjust our 3703 * negotiation. 3704 */ 3705 static void 3706 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3707 { 3708 const bool debug = sppp_debug_enabled(sp); 3709 u_char *p, l; 3710 uint32_t wantaddr; 3711 3712 KASSERT(SPPP_WLOCKED(sp)); 3713 3714 len -= sizeof(*h); 3715 3716 if (debug) 3717 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:"); 3718 3719 p = (void *)(h + 1); 3720 for (; len > 1; len -= l, p += l) { 3721 l = p[1]; 3722 if (l == 0) 3723 break; 3724 3725 /* Sanity check option length */ 3726 if (l > len) { 3727 /* XXX should we just RXJ? */ 3728 if (debug) 3729 addlog("\n"); 3730 SPPP_LOG(sp, LOG_DEBUG, 3731 "malicious IPCP option received, dropping\n"); 3732 return; 3733 } 3734 if (debug) { 3735 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3736 addlog(" %s", 3737 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3738 } 3739 switch (*p) { 3740 case IPCP_OPT_ADDRESS: 3741 /* 3742 * Peer doesn't like our local IP address. See 3743 * if we can do something for him. We'll drop 3744 * him our address then. 3745 */ 3746 if (len >= 6 && l == 6) { 3747 wantaddr = p[2] << 24 | p[3] << 16 | 3748 p[4] << 8 | p[5]; 3749 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3750 if (debug) { 3751 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3752 const char *dq; 3753 3754 dq = sppp_dotted_quad(dqbuf, 3755 sizeof(dqbuf), wantaddr); 3756 addlog(" [wantaddr %s]", dq); 3757 } 3758 /* 3759 * When doing dynamic address assignment, 3760 * we accept his offer. Otherwise, we 3761 * ignore it and thus continue to negotiate 3762 * our already existing value. 3763 */ 3764 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3765 if (ntohl(wantaddr) != INADDR_ANY) { 3766 if (debug) 3767 addlog(" [agree]"); 3768 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3769 sp->ipcp.req_myaddr = wantaddr; 3770 } else { 3771 if (debug) 3772 addlog(" [not agreed]"); 3773 } 3774 } 3775 } 3776 break; 3777 3778 case IPCP_OPT_PRIMDNS: 3779 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 3780 len >= 6 && l == 6) { 3781 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3782 p[4] << 8 | p[5]; 3783 } 3784 break; 3785 3786 case IPCP_OPT_SECDNS: 3787 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 3788 len >= 6 && l == 6) { 3789 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3790 p[4] << 8 | p[5]; 3791 } 3792 break; 3793 #ifdef notyet 3794 case IPCP_OPT_COMPRESS: 3795 /* 3796 * Peer wants different compression parameters. 3797 */ 3798 break; 3799 #endif 3800 } 3801 } 3802 if (debug) 3803 addlog("\n"); 3804 } 3805 3806 /* 3807 * rt_ifmsg requires sppp to be unlocked as it will attempt to lock it again. 3808 * unlocking sppp is safe here because this logic runs in a single thread, 3809 * the workqueue, so concurrent state transitions are excluded on that basis; 3810 * other tlu functions already release and re-acquire the lock already, 3811 * which is only for coordination with threads _other_ than the workqueue 3812 * thread which doesn't change the state. 3813 */ 3814 static void 3815 sppp_rt_ifmsg(struct sppp *sp) 3816 { 3817 struct ifnet *ifp = &sp->pp_if; 3818 3819 KASSERT(SPPP_WLOCKED(sp)); 3820 3821 SPPP_UNLOCK(sp); 3822 rt_ifmsg(ifp); 3823 SPPP_LOCK(sp, RW_WRITER); 3824 } 3825 3826 static void 3827 sppp_ipcp_tlu(struct sppp *sp) 3828 { 3829 #ifdef INET 3830 3831 KASSERT(SPPP_WLOCKED(sp)); 3832 3833 SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n"); 3834 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 3835 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 3836 SPPP_LOG(sp, LOG_WARNING, 3837 "no IP address, closing IPCP\n"); 3838 sppp_wq_add(sp->wq_cp, 3839 &sp->scp[IDX_IPCP].work_close); 3840 } else { 3841 /* we are up. Set addresses and notify anyone interested */ 3842 sppp_set_ip_addrs(sp); 3843 sppp_rt_ifmsg(sp); 3844 } 3845 #endif 3846 } 3847 3848 static void 3849 sppp_ipcp_tld(struct sppp *sp) 3850 { 3851 #ifdef INET 3852 3853 SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n"); 3854 sppp_rt_ifmsg(sp); 3855 #endif 3856 } 3857 3858 static void 3859 sppp_ipcp_scr(struct sppp *sp) 3860 { 3861 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3862 #ifdef INET 3863 uint32_t ouraddr; 3864 #endif 3865 int i = 0; 3866 3867 KASSERT(SPPP_WLOCKED(sp)); 3868 3869 #ifdef notyet 3870 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 3871 opt[i++] = IPCP_OPT_COMPRESSION; 3872 opt[i++] = 6; 3873 opt[i++] = 0; /* VJ header compression */ 3874 opt[i++] = 0x2d; /* VJ header compression */ 3875 opt[i++] = max_slot_id; 3876 opt[i++] = comp_slot_id; 3877 } 3878 #endif 3879 3880 #ifdef INET 3881 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 3882 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 3883 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3884 } else { 3885 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3886 } 3887 opt[i++] = IPCP_OPT_ADDRESS; 3888 opt[i++] = 6; 3889 opt[i++] = ouraddr >> 24; 3890 opt[i++] = ouraddr >> 16; 3891 opt[i++] = ouraddr >> 8; 3892 opt[i++] = ouraddr; 3893 } 3894 #endif 3895 3896 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 3897 opt[i++] = IPCP_OPT_PRIMDNS; 3898 opt[i++] = 6; 3899 opt[i++] = sp->dns_addrs[0] >> 24; 3900 opt[i++] = sp->dns_addrs[0] >> 16; 3901 opt[i++] = sp->dns_addrs[0] >> 8; 3902 opt[i++] = sp->dns_addrs[0]; 3903 } 3904 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 3905 opt[i++] = IPCP_OPT_SECDNS; 3906 opt[i++] = 6; 3907 opt[i++] = sp->dns_addrs[1] >> 24; 3908 opt[i++] = sp->dns_addrs[1] >> 16; 3909 opt[i++] = sp->dns_addrs[1] >> 8; 3910 opt[i++] = sp->dns_addrs[1]; 3911 } 3912 3913 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 3914 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 3915 } 3916 3917 /* 3918 *--------------------------------------------------------------------------* 3919 * * 3920 * The IPv6CP implementation. * 3921 * * 3922 *--------------------------------------------------------------------------* 3923 */ 3924 3925 #ifdef INET6 3926 static void 3927 sppp_ipv6cp_init(struct sppp *sp) 3928 { 3929 3930 KASSERT(SPPP_WLOCKED(sp)); 3931 3932 sppp_cp_init(&ipv6cp, sp); 3933 3934 sp->ipv6cp.opts = 0; 3935 sp->ipv6cp.flags = 0; 3936 } 3937 3938 static void 3939 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 3940 { 3941 struct in6_addr myaddr, hisaddr; 3942 3943 KASSERT(SPPP_WLOCKED(sp)); 3944 KASSERT(!cpu_softintr_p()); 3945 3946 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 3947 return; 3948 3949 #ifdef IPV6CP_MYIFID_DYN 3950 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3951 #else 3952 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3953 #endif 3954 3955 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3956 /* 3957 * If we don't have our address, this probably means our 3958 * interface doesn't want to talk IPv6 at all. (This could 3959 * be the case if somebody wants to speak only IPX, for 3960 * example.) Don't open IPv6CP in this case. 3961 */ 3962 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3963 /* XXX this message should go away */ 3964 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n"); 3965 return; 3966 } 3967 3968 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3969 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 3970 sppp_open_event(sp, xcp); 3971 } 3972 3973 /* 3974 * Analyze a configure request. Return true if it was agreeable, and 3975 * caused action sca, false if it has been rejected or nak'ed, and 3976 * caused action scn. (The return value is used to make the state 3977 * transition decision in the state automaton.) 3978 */ 3979 static enum cp_rcr_type 3980 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3981 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3982 { 3983 const bool debug = sppp_debug_enabled(sp); 3984 u_char *buf, *r, *p, l, blen; 3985 int rlen, len; 3986 struct in6_addr myaddr, desiredaddr, suggestaddr; 3987 enum cp_rcr_type type; 3988 int ifidcount; 3989 int collision, nohisaddr; 3990 char ip6buf[INET6_ADDRSTRLEN]; 3991 char tbuf[SPPP_CPTYPE_NAMELEN]; 3992 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 3993 const char *cpname; 3994 3995 KASSERT(SPPP_WLOCKED(sp)); 3996 3997 type = CP_RCR_NONE; 3998 origlen -= sizeof(*h); 3999 4000 if (origlen < 0) 4001 return CP_RCR_DROP; 4002 4003 /* 4004 * Make sure to allocate a buf that can at least hold a 4005 * conf-nak with an `address' option. We might need it below. 4006 */ 4007 blen = MAX(6, origlen); 4008 4009 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4010 if (buf == NULL) 4011 return CP_RCR_DROP; 4012 4013 /* pass 1: see if we can recognize them */ 4014 if (debug) 4015 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:"); 4016 p = (void *)(h + 1); 4017 r = buf; 4018 rlen = 0; 4019 ifidcount = 0; 4020 for (len = origlen; len > 1; len -= l, p += l) { 4021 l = p[1]; 4022 if (l == 0) 4023 break; 4024 4025 /* Sanity check option length */ 4026 if (l > len) { 4027 /* XXX just RXJ? */ 4028 if (debug) 4029 addlog("\n"); 4030 SPPP_LOG(sp, LOG_DEBUG, 4031 "received malicious IPCPv6 option, " 4032 "dropping\n"); 4033 type = CP_RCR_ERR; 4034 goto end; 4035 } 4036 if (debug) { 4037 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4038 sizeof(ipv6buf),*p)); 4039 } 4040 switch (p[0]) { 4041 case IPV6CP_OPT_IFID: 4042 if (len >= 10 && l == 10 && ifidcount == 0) { 4043 /* correctly formed address option */ 4044 ifidcount++; 4045 continue; 4046 } 4047 if (debug) 4048 addlog(" [invalid]"); 4049 break; 4050 #ifdef notyet 4051 case IPV6CP_OPT_COMPRESSION: 4052 if (len >= 4 && l >= 4) { 4053 /* correctly formed compress option */ 4054 continue; 4055 } 4056 if (debug) 4057 addlog(" [invalid]"); 4058 break; 4059 #endif 4060 default: 4061 /* Others not supported. */ 4062 if (debug) 4063 addlog(" [rej]"); 4064 break; 4065 } 4066 if (rlen + l > blen) { 4067 if (debug) 4068 addlog(" [overflow]"); 4069 continue; 4070 } 4071 /* Add the option to rejected list. */ 4072 memcpy(r, p, l); 4073 r += l; 4074 rlen += l; 4075 } 4076 4077 if (rlen > 0) { 4078 type = CP_RCR_REJ; 4079 goto end; 4080 } 4081 4082 if (debug) 4083 addlog("\n"); 4084 4085 /* pass 2: parse option values */ 4086 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4087 if (debug) 4088 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:"); 4089 p = (void *)(h + 1); 4090 r = buf; 4091 rlen = 0; 4092 type = CP_RCR_ACK; 4093 for (len = origlen; len > 1; len -= l, p += l) { 4094 l = p[1]; 4095 if (l == 0) 4096 break; 4097 4098 if (debug) { 4099 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4100 sizeof(ipv6buf), *p)); 4101 } 4102 switch (p[0]) { 4103 #ifdef notyet 4104 case IPV6CP_OPT_COMPRESSION: 4105 continue; 4106 #endif 4107 case IPV6CP_OPT_IFID: 4108 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4109 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4110 collision = (memcmp(&desiredaddr.s6_addr[8], 4111 &myaddr.s6_addr[8], 8) == 0); 4112 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4113 4114 desiredaddr.s6_addr16[0] = htons(0xfe80); 4115 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4116 4117 if (!collision && !nohisaddr) { 4118 /* no collision, hisaddr known - Conf-Ack */ 4119 type = CP_RCR_ACK; 4120 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4121 sizeof(sp->ipv6cp.my_ifid)); 4122 memcpy(sp->ipv6cp.his_ifid, 4123 &desiredaddr.s6_addr[8], 4124 sizeof(sp->ipv6cp.my_ifid)); 4125 4126 if (debug) { 4127 cpname = sppp_cp_type_name(tbuf, 4128 sizeof(tbuf), CONF_ACK); 4129 addlog(" %s [%s]", 4130 IN6_PRINT(ip6buf, &desiredaddr), 4131 cpname); 4132 } 4133 continue; 4134 } 4135 4136 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4137 if (collision && nohisaddr) { 4138 /* collision, hisaddr unknown - Conf-Rej */ 4139 type = CP_RCR_REJ; 4140 memset(&p[2], 0, 8); 4141 } else { 4142 /* 4143 * - no collision, hisaddr unknown, or 4144 * - collision, hisaddr known 4145 * Conf-Nak, suggest hisaddr 4146 */ 4147 type = CP_RCR_NAK; 4148 sppp_suggest_ip6_addr(sp, &suggestaddr); 4149 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4150 } 4151 if (debug) { 4152 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4153 4154 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4155 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4156 cpname); 4157 } 4158 break; 4159 } 4160 if (rlen + l > blen) { 4161 if (debug) 4162 addlog(" [overflow]"); 4163 continue; 4164 } 4165 /* Add the option to nak'ed list. */ 4166 memcpy(r, p, l); 4167 r += l; 4168 rlen += l; 4169 } 4170 4171 if (rlen > 0) { 4172 if (type != CP_RCR_ACK) { 4173 if (debug) { 4174 int ctype ; 4175 ctype = type == CP_RCR_REJ ? 4176 CONF_REJ : CONF_NAK; 4177 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4178 addlog(" send %s suggest %s\n", 4179 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4180 } 4181 } 4182 #ifdef notdef 4183 if (type == CP_RCR_ACK) 4184 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4185 #endif 4186 } else { 4187 if (type == CP_RCR_ACK) { 4188 rlen = origlen; 4189 memcpy(r, h + 1, rlen); 4190 } 4191 } 4192 end: 4193 if (debug) 4194 addlog("\n"); 4195 4196 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4197 if (buf != NULL) 4198 kmem_intr_free(buf, blen); 4199 } else { 4200 *msgbuf = buf; 4201 *buflen = blen; 4202 *msglen = rlen; 4203 } 4204 4205 return type; 4206 } 4207 4208 /* 4209 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4210 * negotiation. 4211 */ 4212 static void 4213 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4214 { 4215 const bool debug = sppp_debug_enabled(sp); 4216 u_char *p, l; 4217 4218 KASSERT(SPPP_WLOCKED(sp)); 4219 4220 if (len <= sizeof(*h)) 4221 return; 4222 4223 len -= sizeof(*h); 4224 4225 if (debug) 4226 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:"); 4227 4228 p = (void *)(h + 1); 4229 for (; len > 1; len -= l, p += l) { 4230 l = p[1]; 4231 if (l == 0) 4232 break; 4233 4234 if (l > len) { 4235 /* XXX just RXJ? */ 4236 if (debug) 4237 addlog("\n"); 4238 SPPP_LOG(sp, LOG_DEBUG, 4239 "received malicious IPCPv6 option, " 4240 "dropping\n"); 4241 goto end; 4242 } 4243 if (debug) { 4244 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4245 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4246 sizeof(ipv6buf), *p)); 4247 } 4248 switch (p[0]) { 4249 case IPV6CP_OPT_IFID: 4250 /* 4251 * Peer doesn't grok address option. This is 4252 * bad. XXX Should we better give up here? 4253 */ 4254 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4255 break; 4256 #ifdef notyet 4257 case IPV6CP_OPT_COMPRESS: 4258 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4259 break; 4260 #endif 4261 } 4262 } 4263 if (debug) 4264 addlog("\n"); 4265 end: 4266 return; 4267 } 4268 4269 /* 4270 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4271 * negotiation. 4272 */ 4273 static void 4274 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4275 { 4276 const bool debug = sppp_debug_enabled(sp); 4277 u_char *p, l; 4278 struct in6_addr suggestaddr; 4279 char ip6buf[INET6_ADDRSTRLEN]; 4280 4281 KASSERT(SPPP_WLOCKED(sp)); 4282 4283 if (len <= sizeof(*h)) 4284 return; 4285 4286 len -= sizeof(*h); 4287 4288 if (debug) 4289 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:"); 4290 4291 p = (void *)(h + 1); 4292 for (; len > 1; len -= l, p += l) { 4293 l = p[1]; 4294 if (l == 0) 4295 break; 4296 4297 if (l > len) { 4298 /* XXX just RXJ? */ 4299 if (debug) 4300 addlog("\n"); 4301 SPPP_LOG(sp, LOG_DEBUG, 4302 "received malicious IPCPv6 option, " 4303 "dropping\n"); 4304 goto end; 4305 } 4306 if (debug) { 4307 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4308 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4309 sizeof(ipv6buf), *p)); 4310 } 4311 switch (p[0]) { 4312 case IPV6CP_OPT_IFID: 4313 /* 4314 * Peer doesn't like our local ifid. See 4315 * if we can do something for him. We'll drop 4316 * him our address then. 4317 */ 4318 if (len < 10 || l != 10) 4319 break; 4320 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4321 suggestaddr.s6_addr16[0] = htons(0xfe80); 4322 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4323 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4324 4325 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4326 if (debug) 4327 addlog(" [suggestaddr %s]", 4328 IN6_PRINT(ip6buf, &suggestaddr)); 4329 #ifdef IPV6CP_MYIFID_DYN 4330 /* 4331 * When doing dynamic address assignment, 4332 * we accept his offer. 4333 */ 4334 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4335 struct in6_addr lastsuggest; 4336 /* 4337 * If <suggested myaddr from peer> equals to 4338 * <hisaddr we have suggested last time>, 4339 * we have a collision. generate new random 4340 * ifid. 4341 */ 4342 sppp_suggest_ip6_addr(&lastsuggest); 4343 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4344 lastsuggest)) { 4345 if (debug) 4346 addlog(" [random]"); 4347 sppp_gen_ip6_addr(sp, &suggestaddr); 4348 } 4349 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4350 if (debug) 4351 addlog(" [agree]"); 4352 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4353 } 4354 #else 4355 /* 4356 * Since we do not do dynamic address assignment, 4357 * we ignore it and thus continue to negotiate 4358 * our already existing value. This can possibly 4359 * go into infinite request-reject loop. 4360 * 4361 * This is not likely because we normally use 4362 * ifid based on MAC-address. 4363 * If you have no ethernet card on the node, too bad. 4364 * XXX should we use fail_counter? 4365 */ 4366 #endif 4367 break; 4368 #ifdef notyet 4369 case IPV6CP_OPT_COMPRESS: 4370 /* 4371 * Peer wants different compression parameters. 4372 */ 4373 break; 4374 #endif 4375 } 4376 } 4377 if (debug) 4378 addlog("\n"); 4379 end: 4380 return; 4381 } 4382 4383 static void 4384 sppp_ipv6cp_tlu(struct sppp *sp) 4385 { 4386 4387 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n"); 4388 sppp_rt_ifmsg(sp); 4389 } 4390 4391 static void 4392 sppp_ipv6cp_tld(struct sppp *sp) 4393 { 4394 4395 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n"); 4396 sppp_rt_ifmsg(sp); 4397 } 4398 4399 static void 4400 sppp_ipv6cp_scr(struct sppp *sp) 4401 { 4402 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4403 struct in6_addr ouraddr; 4404 int i = 0; 4405 4406 KASSERT(SPPP_WLOCKED(sp)); 4407 4408 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4409 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4410 4411 opt[i++] = IPV6CP_OPT_IFID; 4412 opt[i++] = 10; 4413 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4414 i += 8; 4415 } 4416 4417 #ifdef notyet 4418 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4419 opt[i++] = IPV6CP_OPT_COMPRESSION; 4420 opt[i++] = 4; 4421 opt[i++] = 0; /* TBD */ 4422 opt[i++] = 0; /* TBD */ 4423 /* variable length data may follow */ 4424 } 4425 #endif 4426 4427 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4428 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4429 } 4430 #else /*INET6*/ 4431 static void 4432 sppp_ipv6cp_init(struct sppp *sp) 4433 { 4434 4435 KASSERT(SPPP_WLOCKED(sp)); 4436 } 4437 4438 static void 4439 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4440 { 4441 4442 KASSERT(SPPP_WLOCKED(sp)); 4443 } 4444 4445 static enum cp_rcr_type 4446 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4447 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4448 { 4449 4450 KASSERT(SPPP_WLOCKED(sp)); 4451 return 0; 4452 } 4453 4454 static void 4455 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4456 int len) 4457 { 4458 4459 KASSERT(SPPP_WLOCKED(sp)); 4460 } 4461 4462 static void 4463 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4464 int len) 4465 { 4466 4467 KASSERT(SPPP_WLOCKED(sp)); 4468 } 4469 4470 static void 4471 sppp_ipv6cp_tlu(struct sppp *sp) 4472 { 4473 4474 KASSERT(SPPP_WLOCKED(sp)); 4475 } 4476 4477 static void 4478 sppp_ipv6cp_tld(struct sppp *sp) 4479 { 4480 4481 KASSERT(SPPP_WLOCKED(sp)); 4482 } 4483 4484 static void 4485 sppp_ipv6cp_scr(struct sppp *sp) 4486 { 4487 4488 KASSERT(SPPP_WLOCKED(sp)); 4489 } 4490 #endif /*INET6*/ 4491 4492 /* 4493 *--------------------------------------------------------------------------* 4494 * * 4495 * The CHAP implementation. * 4496 * * 4497 *--------------------------------------------------------------------------* 4498 */ 4499 /* 4500 * The authentication protocols is implemented on the state machine for 4501 * control protocols. And it uses following actions and events. 4502 * 4503 * Actions: 4504 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4505 * - sca: send CHAP_SUCCESS 4506 * - scn: send CHAP_FAILURE and shutdown lcp 4507 * Events: 4508 * - RCR+: receive CHAP_RESPONSE containing correct digest 4509 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4510 * - RCA: receive CHAP_SUCCESS 4511 * - RCN: (this event is unused) 4512 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4513 * - TO-: this layer finish 4514 */ 4515 4516 /* 4517 * Handle incoming CHAP packets. 4518 */ 4519 void 4520 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4521 { 4522 const bool debug = sppp_debug_enabled(sp); 4523 struct ifnet *ifp = &sp->pp_if; 4524 struct lcp_header *h; 4525 int len = m->m_pkthdr.len; 4526 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4527 int value_len, name_len; 4528 MD5_CTX ctx; 4529 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4530 const char *authname; 4531 4532 KASSERT(SPPP_WLOCKED(sp)); 4533 4534 if (len < 4) { 4535 SPPP_DLOG(sp, "chap invalid packet length: " 4536 "%d bytes\n", len); 4537 return; 4538 } 4539 h = mtod(m, struct lcp_header *); 4540 if (len > ntohs(h->len)) 4541 len = ntohs(h->len); 4542 4543 switch (h->type) { 4544 /* challenge, failure and success are his authproto */ 4545 case CHAP_CHALLENGE: 4546 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4547 /* can't do anything useful */ 4548 sp->pp_auth_failures++; 4549 SPPP_DLOG(sp, "chap input " 4550 "without my name and my secret being set\n"); 4551 break; 4552 } 4553 value = 1 + (u_char *)(h + 1); 4554 value_len = value[-1]; 4555 name = value + value_len; 4556 name_len = len - value_len - 5; 4557 if (name_len < 0) { 4558 if (debug) { 4559 authname = sppp_auth_type_name(abuf, 4560 sizeof(abuf), PPP_CHAP, h->type); 4561 SPPP_LOG(sp, LOG_DEBUG, 4562 "chap corrupted challenge " 4563 "<%s id=0x%x len=%d", 4564 authname, h->ident, ntohs(h->len)); 4565 if (len > 4) 4566 sppp_print_bytes((u_char *)(h + 1), 4567 len - 4); 4568 addlog(">\n"); 4569 } 4570 break; 4571 } 4572 4573 if (debug) { 4574 authname = sppp_auth_type_name(abuf, 4575 sizeof(abuf), PPP_CHAP, h->type); 4576 SPPP_LOG(sp, LOG_DEBUG, 4577 "chap input <%s id=0x%x len=%d name=", 4578 authname, h->ident, ntohs(h->len)); 4579 sppp_print_string((char *) name, name_len); 4580 addlog(" value-size=%d value=", value_len); 4581 sppp_print_bytes(value, value_len); 4582 addlog(">\n"); 4583 } 4584 4585 /* Compute reply value. */ 4586 MD5Init(&ctx); 4587 MD5Update(&ctx, &h->ident, 1); 4588 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4589 MD5Update(&ctx, value, value_len); 4590 MD5Final(sp->chap.digest, &ctx); 4591 sp->chap.digest_len = sizeof(sp->chap.digest); 4592 sp->scp[IDX_CHAP].rconfid = h->ident; 4593 4594 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4595 break; 4596 4597 case CHAP_SUCCESS: 4598 if (debug) { 4599 SPPP_LOG(sp, LOG_DEBUG, "chap success"); 4600 if (len > 4) { 4601 addlog(": "); 4602 sppp_print_string((char *)(h + 1), len - 4); 4603 } 4604 addlog("\n"); 4605 } 4606 4607 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4608 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4609 chap.name, h->ident, 4610 sp->scp[IDX_CHAP].rconfid); 4611 if_statinc(ifp, if_ierrors); 4612 break; 4613 } 4614 4615 if (sp->chap.digest_len == 0) { 4616 SPPP_DLOG(sp, "receive CHAP success" 4617 " without challenge\n"); 4618 if_statinc(ifp, if_ierrors); 4619 break; 4620 } 4621 4622 sp->pp_auth_failures = 0; 4623 sp->pp_flags &= ~PP_NEEDAUTH; 4624 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4625 sp->chap.digest_len = 0; 4626 4627 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4628 /* 4629 * we are not authenticator for CHAP, 4630 * generate a dummy RCR+ event without CHAP_RESPONSE 4631 */ 4632 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4633 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4634 } 4635 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4636 break; 4637 4638 case CHAP_FAILURE: 4639 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4640 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4641 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid); 4642 if_statinc(ifp, if_ierrors); 4643 break; 4644 } 4645 4646 if (sp->chap.digest_len == 0) { 4647 SPPP_DLOG(sp, "receive CHAP failure " 4648 "without challenge\n"); 4649 if_statinc(ifp, if_ierrors); 4650 break; 4651 } 4652 4653 sp->pp_auth_failures++; 4654 SPPP_LOG(sp, LOG_INFO, "chap failure"); 4655 if (debug) { 4656 if (len > 4) { 4657 addlog(": "); 4658 sppp_print_string((char *)(h + 1), len - 4); 4659 } 4660 } 4661 addlog("\n"); 4662 4663 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4664 sp->chap.digest_len = 0; 4665 /* 4666 * await LCP shutdown by authenticator, 4667 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4668 */ 4669 break; 4670 4671 /* response is my authproto */ 4672 case CHAP_RESPONSE: 4673 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4674 /* can't do anything useful */ 4675 SPPP_DLOG(sp, "chap response " 4676 "without his name and his secret being set\n"); 4677 break; 4678 } 4679 value = 1 + (u_char *)(h + 1); 4680 value_len = value[-1]; 4681 name = value + value_len; 4682 name_len = len - value_len - 5; 4683 if (name_len < 0) { 4684 if (debug) { 4685 authname = sppp_auth_type_name(abuf, 4686 sizeof(abuf), PPP_CHAP, h->type); 4687 SPPP_LOG(sp, LOG_DEBUG, 4688 "chap corrupted response " 4689 "<%s id=0x%x len=%d", 4690 authname, h->ident, ntohs(h->len)); 4691 if (len > 4) 4692 sppp_print_bytes((u_char *)(h + 1), 4693 len - 4); 4694 addlog(">\n"); 4695 } 4696 break; 4697 } 4698 if (h->ident != sp->scp[IDX_CHAP].confid) { 4699 SPPP_DLOG(sp, "chap dropping response for old ID " 4700 "(got %d, expected %d)\n", 4701 h->ident, sp->scp[IDX_CHAP].confid); 4702 break; 4703 } else { 4704 sp->scp[IDX_CHAP].rconfid = h->ident; 4705 } 4706 4707 if (sp->hisauth.name != NULL && 4708 (name_len != sp->hisauth.name_len 4709 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4710 SPPP_LOG(sp, LOG_INFO, 4711 "chap response, his name "); 4712 sppp_print_string(name, name_len); 4713 addlog(" != expected "); 4714 sppp_print_string(sp->hisauth.name, 4715 sp->hisauth.name_len); 4716 addlog("\n"); 4717 4718 /* generate RCR- event */ 4719 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4720 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4721 break; 4722 } 4723 4724 if (debug) { 4725 authname = sppp_auth_type_name(abuf, 4726 sizeof(abuf), PPP_CHAP, h->type); 4727 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) " 4728 "<%s id=0x%x len=%d name=", 4729 sppp_state_name(sp->scp[IDX_CHAP].state), 4730 authname, h->ident, ntohs(h->len)); 4731 sppp_print_string((char *)name, name_len); 4732 addlog(" value-size=%d value=", value_len); 4733 sppp_print_bytes(value, value_len); 4734 addlog(">\n"); 4735 } 4736 4737 if (value_len == sizeof(sp->chap.challenge) && 4738 value_len == sizeof(sp->chap.digest)) { 4739 MD5Init(&ctx); 4740 MD5Update(&ctx, &h->ident, 1); 4741 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4742 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4743 MD5Final(digest, &ctx); 4744 4745 if (memcmp(digest, value, value_len) == 0) { 4746 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4747 } else { 4748 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4749 } 4750 } else { 4751 if (debug) { 4752 SPPP_LOG(sp, LOG_DEBUG, 4753 "chap bad hash value length: " 4754 "%d bytes, should be %zu\n", 4755 value_len, sizeof(sp->chap.challenge)); 4756 } 4757 4758 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4759 } 4760 4761 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4762 4763 /* generate a dummy RCA event */ 4764 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4765 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4766 sp->chap.rechallenging)) { 4767 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4768 } 4769 break; 4770 4771 default: 4772 /* Unknown CHAP packet type -- ignore. */ 4773 if (debug) { 4774 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) " 4775 "<0x%x id=0x%xh len=%d", 4776 sppp_state_name(sp->scp[IDX_CHAP].state), 4777 h->type, h->ident, ntohs(h->len)); 4778 if (len > 4) 4779 sppp_print_bytes((u_char *)(h + 1), len - 4); 4780 addlog(">\n"); 4781 } 4782 break; 4783 4784 } 4785 } 4786 4787 static void 4788 sppp_chap_init(struct sppp *sp) 4789 { 4790 4791 KASSERT(SPPP_WLOCKED(sp)); 4792 4793 sppp_cp_init(&chap, sp); 4794 4795 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4796 sppp_chap_rcv_challenge_event, &chap); 4797 } 4798 4799 static void 4800 sppp_chap_open(struct sppp *sp, void *xcp) 4801 { 4802 4803 KASSERT(SPPP_WLOCKED(sp)); 4804 4805 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4806 sp->chap.digest_len = 0; 4807 sp->chap.rechallenging = false; 4808 sp->chap.response_rcvd = false; 4809 sppp_open_event(sp, xcp); 4810 } 4811 4812 static void 4813 sppp_chap_tlu(struct sppp *sp) 4814 { 4815 int i; 4816 4817 KASSERT(SPPP_WLOCKED(sp)); 4818 4819 i = 0; 4820 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4821 sp->pp_auth_failures = 0; 4822 4823 SPPP_LOG(sp, LOG_DEBUG, "chap %s", 4824 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4825 4826 /* 4827 * Some broken CHAP implementations (Conware CoNet, firmware 4828 * 4.0.?) don't want to re-authenticate their CHAP once the 4829 * initial challenge-response exchange has taken place. 4830 * Provide for an option to avoid rechallenges. 4831 */ 4832 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4833 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4834 /* 4835 * Compute the re-challenge timeout. This will yield 4836 * a number between 300 and 810 seconds. 4837 */ 4838 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4839 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4840 4841 if (sppp_debug_enabled(sp)) { 4842 addlog(", next rechallenge in %d seconds", i); 4843 } 4844 } 4845 4846 addlog("\n"); 4847 4848 /* 4849 * If we are already in phase network, we are done here. This 4850 * is the case if this is a dummy tlu event after a re-challenge. 4851 */ 4852 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4853 sppp_phase_network(sp); 4854 } 4855 4856 static void 4857 sppp_chap_scr(struct sppp *sp) 4858 { 4859 uint32_t *ch; 4860 u_char clen, dsize; 4861 int role; 4862 4863 KASSERT(SPPP_WLOCKED(sp)); 4864 4865 role = sppp_auth_role(&chap, sp); 4866 4867 if (ISSET(role, SPPP_AUTH_SERV) && 4868 !sp->chap.response_rcvd) { 4869 /* we are authenticator for CHAP, send challenge */ 4870 ch = (uint32_t *)sp->chap.challenge; 4871 clen = sizeof(sp->chap.challenge); 4872 /* Compute random challenge. */ 4873 cprng_strong(kern_cprng, ch, clen, 0); 4874 4875 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4876 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4877 sizeof(clen), (const char *)&clen, 4878 sizeof(sp->chap.challenge), sp->chap.challenge, 4879 0); 4880 } 4881 4882 if (ISSET(role, SPPP_AUTH_PEER) && 4883 sp->chap.digest_len > 0) { 4884 /* we are peer for CHAP, send response */ 4885 dsize = sp->chap.digest_len; 4886 4887 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 4888 sizeof(dsize), (const char *)&dsize, 4889 sp->chap.digest_len, sp->chap.digest, 4890 sp->myauth.name_len, sp->myauth.name, 0); 4891 } 4892 } 4893 4894 static void 4895 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 4896 { 4897 const struct cp *cp = xcp; 4898 4899 KASSERT(!cpu_softintr_p()); 4900 4901 sp->chap.rechallenging = false; 4902 4903 switch (sp->scp[IDX_CHAP].state) { 4904 case STATE_REQ_SENT: 4905 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 4906 cp->scr(sp); 4907 break; 4908 case STATE_OPENED: 4909 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 4910 cp->scr(sp); 4911 break; 4912 } 4913 } 4914 4915 /* 4916 *--------------------------------------------------------------------------* 4917 * * 4918 * The PAP implementation. * 4919 * * 4920 *--------------------------------------------------------------------------* 4921 */ 4922 /* 4923 * PAP uses following actions and events. 4924 * Actions: 4925 * - scr: send PAP_REQ 4926 * - sca: send PAP_ACK 4927 * - scn: send PAP_NAK 4928 * Events: 4929 * - RCR+: receive PAP_REQ containing correct username and password 4930 * - RCR-: receive PAP_REQ containing wrong username and password 4931 * - RCA: receive PAP_ACK 4932 * - RCN: (this event is unused) 4933 * - TO+: re-send PAP_REQ 4934 * - TO-: this layer finish 4935 */ 4936 4937 /* 4938 * Handle incoming PAP packets. */ 4939 static void 4940 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4941 { 4942 const bool debug = sppp_debug_enabled(sp); 4943 struct ifnet *ifp = &sp->pp_if; 4944 struct lcp_header *h; 4945 int len; 4946 char *name, *secret; 4947 int name_len, secret_len; 4948 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4949 const char *authname; 4950 4951 KASSERT(SPPP_WLOCKED(sp)); 4952 /* 4953 * Malicious input might leave this uninitialized, so 4954 * init to an impossible value. 4955 */ 4956 secret_len = -1; 4957 4958 len = m->m_pkthdr.len; 4959 if (len < 5) { 4960 SPPP_DLOG(sp, "pap invalid packet length: " 4961 "%d bytes\n", len); 4962 return; 4963 } 4964 h = mtod(m, struct lcp_header *); 4965 if (len > ntohs(h->len)) 4966 len = ntohs(h->len); 4967 4968 switch (h->type) { 4969 /* PAP request is my authproto */ 4970 case PAP_REQ: 4971 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4972 /* can't do anything useful */ 4973 SPPP_DLOG(sp, "pap request" 4974 " without his name and his secret being set\n"); 4975 break; 4976 } 4977 name = 1 + (u_char *)(h + 1); 4978 name_len = name[-1]; 4979 secret = name + name_len + 1; 4980 if (name_len > len - 6 || 4981 (secret_len = secret[-1]) > len - 6 - name_len) { 4982 if (debug) { 4983 authname = sppp_auth_type_name(abuf, 4984 sizeof(abuf), PPP_PAP, h->type); 4985 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 4986 "<%s id=0x%x len=%d", 4987 authname, h->ident, ntohs(h->len)); 4988 if (len > 4) 4989 sppp_print_bytes((u_char *)(h + 1), 4990 len - 4); 4991 addlog(">\n"); 4992 } 4993 break; 4994 } 4995 if (debug) { 4996 authname = sppp_auth_type_name(abuf, 4997 sizeof(abuf), PPP_PAP, h->type); 4998 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) " 4999 "<%s id=0x%x len=%d name=", 5000 sppp_state_name(sp->scp[IDX_PAP].state), 5001 authname, h->ident, ntohs(h->len)); 5002 sppp_print_string((char *)name, name_len); 5003 addlog(" secret="); 5004 sppp_print_string((char *)secret, secret_len); 5005 addlog(">\n"); 5006 } 5007 5008 sp->scp[IDX_PAP].rconfid = h->ident; 5009 5010 if (name_len == sp->hisauth.name_len && 5011 memcmp(name, sp->hisauth.name, name_len) == 0 && 5012 secret_len == sp->hisauth.secret_len && 5013 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5014 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5015 } else { 5016 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5017 } 5018 5019 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5020 5021 /* generate a dummy RCA event */ 5022 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5023 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5024 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5025 } 5026 break; 5027 5028 /* ack and nak are his authproto */ 5029 case PAP_ACK: 5030 if (debug) { 5031 SPPP_LOG(sp, LOG_DEBUG, "pap success"); 5032 name = 1 + (u_char *)(h + 1); 5033 name_len = name[-1]; 5034 if (len > 5 && name_len < len+4) { 5035 addlog(": "); 5036 sppp_print_string(name, name_len); 5037 } 5038 addlog("\n"); 5039 } 5040 5041 if (h->ident != sp->scp[IDX_PAP].confid) { 5042 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5043 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5044 if_statinc(ifp, if_ierrors); 5045 break; 5046 } 5047 5048 sp->pp_auth_failures = 0; 5049 sp->pp_flags &= ~PP_NEEDAUTH; 5050 5051 /* we are not authenticator, generate a dummy RCR+ event */ 5052 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5053 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5054 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5055 } 5056 5057 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5058 break; 5059 5060 case PAP_NAK: 5061 if (debug) { 5062 SPPP_LOG(sp, LOG_INFO, "pap failure"); 5063 name = 1 + (u_char *)(h + 1); 5064 name_len = name[-1]; 5065 if (len > 5 && name_len < len+4) { 5066 addlog(": "); 5067 sppp_print_string(name, name_len); 5068 } 5069 addlog("\n"); 5070 } else { 5071 SPPP_LOG(sp, LOG_INFO, "pap failure\n"); 5072 } 5073 5074 if (h->ident != sp->scp[IDX_PAP].confid) { 5075 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5076 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5077 if_statinc(ifp, if_ierrors); 5078 break; 5079 } 5080 5081 sp->pp_auth_failures++; 5082 /* 5083 * await LCP shutdown by authenticator, 5084 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5085 */ 5086 break; 5087 5088 default: 5089 /* Unknown PAP packet type -- ignore. */ 5090 if (debug) { 5091 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5092 "<0x%x id=0x%x len=%d", 5093 h->type, h->ident, ntohs(h->len)); 5094 if (len > 4) 5095 sppp_print_bytes((u_char *)(h + 1), len - 4); 5096 addlog(">\n"); 5097 } 5098 break; 5099 } 5100 } 5101 5102 static void 5103 sppp_pap_init(struct sppp *sp) 5104 { 5105 5106 KASSERT(SPPP_WLOCKED(sp)); 5107 sppp_cp_init(&pap, sp); 5108 } 5109 5110 static void 5111 sppp_pap_tlu(struct sppp *sp) 5112 { 5113 5114 SPPP_DLOG(sp, "%s tlu\n", pap.name); 5115 5116 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5117 sp->pp_auth_failures = 0; 5118 5119 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5120 sppp_phase_network(sp); 5121 } 5122 5123 static void 5124 sppp_pap_scr(struct sppp *sp) 5125 { 5126 u_char idlen, pwdlen; 5127 5128 KASSERT(SPPP_WLOCKED(sp)); 5129 5130 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5131 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5132 if (sp->myauth.secret == NULL || 5133 sp->myauth.name == NULL) { 5134 SPPP_LOG(sp, LOG_DEBUG, 5135 "couldn't send PAP_REQ " 5136 "because of no name or no secret\n"); 5137 } else { 5138 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5139 pwdlen = sp->myauth.secret_len; 5140 idlen = sp->myauth.name_len; 5141 5142 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5143 sizeof idlen, (const char *)&idlen, 5144 idlen, sp->myauth.name, 5145 sizeof pwdlen, (const char *)&pwdlen, 5146 pwdlen, sp->myauth.secret, 5147 0); 5148 } 5149 } 5150 } 5151 5152 /* 5153 * Random miscellaneous functions. 5154 */ 5155 5156 /* 5157 * Send a PAP or CHAP proto packet. 5158 * 5159 * Variadic function, each of the elements for the ellipsis is of type 5160 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5161 * mlen == 0. 5162 * NOTE: never declare variadic functions with types subject to type 5163 * promotion (i.e. u_char). This is asking for big trouble depending 5164 * on the architecture you are on... 5165 */ 5166 5167 static void 5168 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5169 unsigned int type, unsigned int id, 5170 ...) 5171 { 5172 struct ifnet *ifp = &sp->pp_if; 5173 struct lcp_header *lh; 5174 struct mbuf *m; 5175 u_char *p; 5176 int len; 5177 size_t pkthdrlen; 5178 unsigned int mlen; 5179 const char *msg; 5180 va_list ap; 5181 5182 KASSERT(SPPP_WLOCKED(sp)); 5183 5184 MGETHDR(m, M_DONTWAIT, MT_DATA); 5185 if (! m) 5186 return; 5187 m_reset_rcvif(m); 5188 5189 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 5190 *mtod(m, uint16_t *) = htons(cp->proto); 5191 pkthdrlen = 2; 5192 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5193 } else { 5194 struct ppp_header *h; 5195 h = mtod(m, struct ppp_header *); 5196 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5197 h->control = PPP_UI; /* Unnumbered Info */ 5198 h->protocol = htons(cp->proto); 5199 pkthdrlen = PPP_HEADER_LEN; 5200 5201 lh = (struct lcp_header *)(h + 1); 5202 } 5203 5204 lh->type = type; 5205 lh->ident = id; 5206 p = (u_char *)(lh + 1); 5207 5208 va_start(ap, id); 5209 len = 0; 5210 5211 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5212 msg = va_arg(ap, const char *); 5213 len += mlen; 5214 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5215 va_end(ap); 5216 m_freem(m); 5217 return; 5218 } 5219 5220 memcpy(p, msg, mlen); 5221 p += mlen; 5222 } 5223 va_end(ap); 5224 5225 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5226 lh->len = htons(LCP_HEADER_LEN + len); 5227 5228 if (sppp_debug_enabled(sp)) { 5229 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5230 const char *authname; 5231 5232 authname = sppp_auth_type_name(abuf, 5233 sizeof(abuf), cp->proto, lh->type); 5234 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 5235 cp->name, authname, 5236 lh->ident, ntohs(lh->len)); 5237 if (len) 5238 sppp_print_bytes((u_char *)(lh + 1), len); 5239 addlog(">\n"); 5240 } 5241 if (IF_QFULL(&sp->pp_cpq)) { 5242 IF_DROP(&sp->pp_fastq); 5243 IF_DROP(&ifp->if_snd); 5244 m_freem(m); 5245 return; 5246 } 5247 5248 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5249 IF_ENQUEUE(&sp->pp_cpq, m); 5250 5251 if (! (ifp->if_flags & IFF_OACTIVE)) { 5252 SPPP_UNLOCK(sp); 5253 if_start_lock(ifp); 5254 SPPP_LOCK(sp, RW_WRITER); 5255 } 5256 } 5257 5258 static int 5259 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5260 { 5261 int role; 5262 5263 role = SPPP_AUTH_NOROLE; 5264 5265 if (sp->hisauth.proto == cp->proto && 5266 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5267 SET(role, SPPP_AUTH_SERV); 5268 5269 if (sp->myauth.proto == cp->proto) 5270 SET(role, SPPP_AUTH_PEER); 5271 5272 return role; 5273 } 5274 5275 static void 5276 sppp_auth_to_event(struct sppp *sp, void *xcp) 5277 { 5278 const struct cp *cp = xcp; 5279 bool override; 5280 int state; 5281 5282 KASSERT(SPPP_WLOCKED(sp)); 5283 KASSERT(!cpu_softintr_p()); 5284 5285 override = false; 5286 state = sp->scp[cp->protoidx].state; 5287 5288 if (sp->scp[cp->protoidx].rst_counter > 0) { 5289 /* override TO+ event */ 5290 switch (state) { 5291 case STATE_OPENED: 5292 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5293 override = true; 5294 sp->chap.rechallenging = true; 5295 sp->chap.response_rcvd = false; 5296 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5297 cp->scr(sp); 5298 } 5299 break; 5300 5301 case STATE_ACK_RCVD: 5302 override = true; 5303 cp->scr(sp); 5304 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5305 break; 5306 } 5307 } 5308 5309 if (override) { 5310 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", 5311 cp->name, sppp_state_name(state), 5312 sp->scp[cp->protoidx].rst_counter); 5313 sp->scp[cp->protoidx].rst_counter--; 5314 } else { 5315 sppp_to_event(sp, xcp); 5316 } 5317 } 5318 5319 static void 5320 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5321 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5322 { 5323 static const char *succmsg = "Welcome!"; 5324 static const char *failmsg = "Failed..."; 5325 const char *msg; 5326 u_char type, mlen; 5327 5328 KASSERT(SPPP_WLOCKED(sp)); 5329 5330 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5331 return; 5332 5333 if (ctype == CONF_ACK) { 5334 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5335 msg = succmsg; 5336 mlen = sizeof(succmsg) - 1; 5337 5338 sp->pp_auth_failures = 0; 5339 } else { 5340 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5341 msg = failmsg; 5342 mlen = sizeof(failmsg) - 1; 5343 5344 /* Reset LCP if auth failed */ 5345 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5346 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 5347 sp->pp_auth_failures++; 5348 } 5349 5350 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5351 } 5352 5353 /* 5354 * Send keepalive packets, every 10 seconds. 5355 */ 5356 static void 5357 sppp_keepalive(void *dummy) 5358 { 5359 struct sppp *sp; 5360 time_t now; 5361 5362 SPPPQ_LOCK(); 5363 5364 now = time_uptime; 5365 for (sp=spppq; sp; sp=sp->pp_next) { 5366 struct ifnet *ifp = NULL; 5367 5368 SPPP_LOCK(sp, RW_WRITER); 5369 ifp = &sp->pp_if; 5370 5371 /* check idle timeout */ 5372 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5373 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5374 /* idle timeout is enabled for this interface */ 5375 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5376 SPPP_DLOG(sp, "no activity for %lu seconds\n", 5377 (unsigned long)(now-sp->pp_last_activity)); 5378 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5379 SPPP_UNLOCK(sp); 5380 continue; 5381 } 5382 } 5383 5384 /* Keepalive mode disabled or channel down? */ 5385 if (! ISSET(sp->pp_dev_flags, PP_DEVF_KEEPALIVE) || 5386 ! (ifp->if_flags & IFF_RUNNING)) { 5387 SPPP_UNLOCK(sp); 5388 continue; 5389 } 5390 5391 /* No keepalive in PPP mode if LCP not opened yet. */ 5392 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5393 SPPP_UNLOCK(sp); 5394 continue; 5395 } 5396 5397 /* No echo reply, but maybe user data passed through? */ 5398 if (sp->pp_max_noreceive != 0 && 5399 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5400 sp->pp_alivecnt = 0; 5401 SPPP_UNLOCK(sp); 5402 continue; 5403 } 5404 5405 /* No echo request */ 5406 if (sp->pp_alive_interval == 0) { 5407 SPPP_UNLOCK(sp); 5408 continue; 5409 } 5410 5411 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5412 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5413 SPPP_UNLOCK(sp); 5414 continue; 5415 } 5416 5417 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5418 /* No keepalive packets got. Stop the interface. */ 5419 SPPP_LOG(sp, LOG_INFO, "LCP keepalive timed out, "); 5420 5421 sp->pp_alivecnt = 0; 5422 5423 if (sp->pp_flags & PP_KEEPALIVE_IFDOWN) { 5424 addlog("going to down the interface\n"); 5425 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5426 } else { 5427 addlog("going to restart the connection\n"); 5428 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5429 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 5430 } 5431 5432 SPPP_UNLOCK(sp); 5433 continue; 5434 } 5435 if (sp->pp_alivecnt < sp->pp_maxalive) 5436 ++sp->pp_alivecnt; 5437 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5438 int32_t nmagic = htonl(sp->lcp.magic); 5439 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5440 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5441 sp->lcp.echoid, 4, &nmagic); 5442 } 5443 5444 SPPP_UNLOCK(sp); 5445 } 5446 sppp_keepalive_cnt++; 5447 callout_schedule(&keepalive_ch, hz * sppp_keepalive_interval); 5448 5449 SPPPQ_UNLOCK(); 5450 } 5451 5452 #ifdef INET 5453 /* 5454 * Get both IP addresses. 5455 */ 5456 static void 5457 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5458 { 5459 struct ifnet *ifp = &sp->pp_if; 5460 struct ifaddr *ifa; 5461 uint32_t ssrc, ddst; 5462 int bound; 5463 struct psref psref; 5464 5465 ssrc = ddst = 0; 5466 /* 5467 * Pick the first AF_INET address from the list, 5468 * aliases don't make any sense on a p2p link anyway. 5469 */ 5470 bound = curlwp_bind(); 5471 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5472 if (ifa != NULL) { 5473 struct sockaddr_in *si = satosin(ifa->ifa_addr); 5474 struct sockaddr_in *sm = satosin(ifa->ifa_netmask); 5475 if (si->sin_addr.s_addr) { 5476 ssrc = si->sin_addr.s_addr; 5477 if (srcmask) 5478 *srcmask = ntohl(sm->sin_addr.s_addr); 5479 } 5480 5481 si = satosin(ifa->ifa_dstaddr); 5482 if (si && si->sin_addr.s_addr) 5483 ddst = si->sin_addr.s_addr; 5484 ifa_release(ifa, &psref); 5485 } 5486 curlwp_bindx(bound); 5487 5488 if (dst) *dst = ntohl(ddst); 5489 if (src) *src = ntohl(ssrc); 5490 } 5491 5492 /* 5493 * Set IP addresses. 5494 * If an address is 0, leave it the way it is. 5495 */ 5496 static void 5497 sppp_set_ip_addrs(struct sppp *sp) 5498 { 5499 struct ifnet *ifp = &sp->pp_if; 5500 struct ifaddr *ifa; 5501 struct sockaddr_in *si, *dest; 5502 uint32_t myaddr = 0, hisaddr = 0; 5503 int bound; 5504 struct psref psref; 5505 5506 KASSERT(SPPP_WLOCKED(sp)); 5507 5508 SPPP_UNLOCK(sp); 5509 IFNET_LOCK(ifp); 5510 SPPP_LOCK(sp, RW_WRITER); 5511 5512 /* 5513 * Pick the first AF_INET address from the list, 5514 * aliases don't make any sense on a p2p link anyway. 5515 */ 5516 si = dest = NULL; 5517 bound = curlwp_bind(); 5518 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5519 if (ifa != NULL) { 5520 si = satosin(ifa->ifa_addr); 5521 dest = satosin(ifa->ifa_dstaddr); 5522 } 5523 5524 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5525 myaddr = sp->ipcp.req_myaddr; 5526 else if (si != NULL) 5527 myaddr = ntohl(si->sin_addr.s_addr); 5528 5529 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5530 hisaddr = sp->ipcp.req_hisaddr; 5531 else if (dest != NULL) 5532 hisaddr = ntohl(dest->sin_addr.s_addr); 5533 5534 if (si != NULL && dest != NULL) { 5535 int error; 5536 struct sockaddr_in new_sin = *si; 5537 struct sockaddr_in new_dst = *dest; 5538 5539 if (myaddr != 0) 5540 new_sin.sin_addr.s_addr = htonl(myaddr); 5541 if (hisaddr != 0) { 5542 new_dst.sin_addr.s_addr = htonl(hisaddr); 5543 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5544 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5545 } 5546 5547 in_addrhash_remove(ifatoia(ifa)); 5548 5549 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5550 5551 in_addrhash_insert(ifatoia(ifa)); 5552 5553 if (error) { 5554 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5555 __func__, error); 5556 } else { 5557 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5558 } 5559 } 5560 if (ifa != NULL) 5561 ifa_release(ifa, &psref); 5562 curlwp_bindx(bound); 5563 5564 IFNET_UNLOCK(ifp); 5565 } 5566 5567 /* 5568 * Clear IP addresses. 5569 */ 5570 static void 5571 sppp_clear_ip_addrs(struct sppp *sp) 5572 { 5573 struct ifnet *ifp = &sp->pp_if; 5574 struct ifaddr *ifa; 5575 struct sockaddr_in *si, *dest; 5576 int bound; 5577 struct psref psref; 5578 5579 KASSERT(SPPP_WLOCKED(sp)); 5580 5581 SPPP_UNLOCK(sp); 5582 IFNET_LOCK(ifp); 5583 SPPP_LOCK(sp, RW_WRITER); 5584 5585 /* 5586 * Pick the first AF_INET address from the list, 5587 * aliases don't make any sense on a p2p link anyway. 5588 */ 5589 si = dest = NULL; 5590 bound = curlwp_bind(); 5591 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5592 if (ifa != NULL) { 5593 si = satosin(ifa->ifa_addr); 5594 dest = satosin(ifa->ifa_dstaddr); 5595 /* 5596 * ignore "0.0.0.0" which means ppp is not opened yet. 5597 */ 5598 if (si->sin_addr.s_addr == INADDR_ANY) 5599 si = NULL; 5600 } 5601 5602 if (si != NULL) { 5603 struct sockaddr_in new_sin = *si; 5604 struct sockaddr_in new_dst = *dest; 5605 int error; 5606 5607 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5608 new_sin.sin_addr.s_addr = 0; 5609 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5610 ntohl(sp->ipcp.saved_hisaddr) != 0) 5611 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5612 5613 in_addrhash_remove(ifatoia(ifa)); 5614 5615 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5616 5617 in_addrhash_insert(ifatoia(ifa)); 5618 5619 if (error) { 5620 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5621 __func__, error); 5622 } else { 5623 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5624 } 5625 } 5626 if (ifa != NULL) 5627 ifa_release(ifa, &psref); 5628 curlwp_bindx(bound); 5629 5630 IFNET_UNLOCK(ifp); 5631 } 5632 #endif 5633 5634 #ifdef INET6 5635 /* 5636 * Get both IPv6 addresses. 5637 */ 5638 static void 5639 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5640 struct in6_addr *srcmask) 5641 { 5642 struct ifnet *ifp = &sp->pp_if; 5643 struct ifaddr *ifa; 5644 struct in6_addr ssrc, ddst; 5645 int bound; 5646 struct psref psref; 5647 5648 memset(&ssrc, 0, sizeof(ssrc)); 5649 memset(&ddst, 0, sizeof(ddst)); 5650 /* 5651 * Pick the first link-local AF_INET6 address from the list, 5652 * aliases don't make any sense on a p2p link anyway. 5653 */ 5654 bound = curlwp_bind(); 5655 ifa = in6ifa_first_lladdr_psref(ifp, &psref); 5656 if (ifa != NULL) { 5657 struct sockaddr_in6 *si = satosin6(ifa->ifa_addr); 5658 struct sockaddr_in6 *sm = satosin6(ifa->ifa_netmask); 5659 if (!IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5660 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5661 if (srcmask) { 5662 memcpy(srcmask, &sm->sin6_addr, 5663 sizeof(*srcmask)); 5664 } 5665 } 5666 5667 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5668 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5669 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5670 ifa_release(ifa, &psref); 5671 } 5672 curlwp_bindx(bound); 5673 5674 if (dst) 5675 memcpy(dst, &ddst, sizeof(*dst)); 5676 if (src) 5677 memcpy(src, &ssrc, sizeof(*src)); 5678 } 5679 5680 #ifdef IPV6CP_MYIFID_DYN 5681 /* 5682 * Generate random ifid. 5683 */ 5684 static void 5685 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5686 { 5687 /* TBD */ 5688 } 5689 5690 /* 5691 * Set my IPv6 address. 5692 */ 5693 static void 5694 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5695 { 5696 struct ifnet *ifp = &sp->pp_if; 5697 struct ifaddr *ifa; 5698 int bound; 5699 struct psref psref; 5700 5701 KASSERT(SPPP_WLOCKED(sp)); 5702 5703 SPPP_UNLOCK(sp); 5704 IFNET_LOCK(ifp); 5705 SPPP_LOCK(sp, RW_WRITER); 5706 5707 /* 5708 * Pick the first link-local AF_INET6 address from the list, 5709 * aliases don't make any sense on a p2p link anyway. 5710 */ 5711 bound = curlwp_bind(); 5712 ifa = in6ifa_first_lladdr_psref(ifp, &psref); 5713 if (ifa != NULL) { 5714 struct sockaddr_in6 *sin6 = satosin6(ifa->ifa_addr); 5715 struct sockaddr_in6 new_sin6 = *sin6; 5716 int error; 5717 5718 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5719 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5720 if (error) { 5721 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n", 5722 __func__, error); 5723 } else { 5724 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5725 } 5726 ifa_release(ifa, &psref); 5727 } 5728 curlwp_bindx(bound); 5729 5730 IFNET_UNLOCK(ifp); 5731 } 5732 #endif 5733 5734 /* 5735 * Suggest a candidate address to be used by peer. 5736 */ 5737 static void 5738 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5739 { 5740 struct in6_addr myaddr; 5741 struct timeval tv; 5742 5743 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5744 5745 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5746 microtime(&tv); 5747 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5748 myaddr.s6_addr[14] ^= 0xff; 5749 myaddr.s6_addr[15] ^= 0xff; 5750 } else { 5751 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5752 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5753 } 5754 if (suggest) 5755 memcpy(suggest, &myaddr, sizeof(myaddr)); 5756 } 5757 #endif /*INET6*/ 5758 5759 /* 5760 * Process ioctl requests specific to the PPP interface. 5761 * Permissions have already been checked. 5762 */ 5763 static int 5764 sppp_params(struct sppp *sp, u_long cmd, void *data) 5765 { 5766 switch (cmd) { 5767 case SPPPGETAUTHCFG: 5768 { 5769 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5770 int error; 5771 size_t len; 5772 5773 SPPP_LOCK(sp, RW_READER); 5774 5775 cfg->myauthflags = sp->myauth.flags; 5776 cfg->hisauthflags = sp->hisauth.flags; 5777 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5778 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 5779 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 5780 if (cfg->myname_length == 0) { 5781 if (sp->myauth.name != NULL) 5782 cfg->myname_length = sp->myauth.name_len + 1; 5783 } else { 5784 if (sp->myauth.name == NULL) { 5785 cfg->myname_length = 0; 5786 } else { 5787 len = sp->myauth.name_len + 1; 5788 5789 if (cfg->myname_length < len) { 5790 SPPP_UNLOCK(sp); 5791 return (ENAMETOOLONG); 5792 } 5793 error = copyout(sp->myauth.name, cfg->myname, len); 5794 if (error) { 5795 SPPP_UNLOCK(sp); 5796 return error; 5797 } 5798 } 5799 } 5800 if (cfg->hisname_length == 0) { 5801 if (sp->hisauth.name != NULL) 5802 cfg->hisname_length = sp->hisauth.name_len + 1; 5803 } else { 5804 if (sp->hisauth.name == NULL) { 5805 cfg->hisname_length = 0; 5806 } else { 5807 len = sp->hisauth.name_len + 1; 5808 5809 if (cfg->hisname_length < len) { 5810 SPPP_UNLOCK(sp); 5811 return (ENAMETOOLONG); 5812 } 5813 error = copyout(sp->hisauth.name, cfg->hisname, len); 5814 if (error) { 5815 SPPP_UNLOCK(sp); 5816 return error; 5817 } 5818 } 5819 } 5820 SPPP_UNLOCK(sp); 5821 } 5822 break; 5823 case SPPPSETAUTHCFG: 5824 { 5825 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5826 int error; 5827 5828 SPPP_LOCK(sp, RW_WRITER); 5829 5830 if (sp->myauth.name) { 5831 free(sp->myauth.name, M_DEVBUF); 5832 sp->myauth.name = NULL; 5833 } 5834 if (sp->myauth.secret) { 5835 free(sp->myauth.secret, M_DEVBUF); 5836 sp->myauth.secret = NULL; 5837 } 5838 if (sp->hisauth.name) { 5839 free(sp->hisauth.name, M_DEVBUF); 5840 sp->hisauth.name = NULL; 5841 } 5842 if (sp->hisauth.secret) { 5843 free(sp->hisauth.secret, M_DEVBUF); 5844 sp->hisauth.secret = NULL; 5845 } 5846 5847 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5848 if (cfg->hisname_length >= MCLBYTES) { 5849 SPPP_UNLOCK(sp); 5850 return (ENAMETOOLONG); 5851 } 5852 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5853 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5854 if (error) { 5855 free(sp->hisauth.name, M_DEVBUF); 5856 sp->hisauth.name = NULL; 5857 SPPP_UNLOCK(sp); 5858 return error; 5859 } 5860 sp->hisauth.name_len = cfg->hisname_length - 1; 5861 sp->hisauth.name[sp->hisauth.name_len] = 0; 5862 } 5863 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5864 if (cfg->hissecret_length >= MCLBYTES) { 5865 SPPP_UNLOCK(sp); 5866 return (ENAMETOOLONG); 5867 } 5868 sp->hisauth.secret = malloc(cfg->hissecret_length, 5869 M_DEVBUF, M_WAITOK); 5870 error = copyin(cfg->hissecret, sp->hisauth.secret, 5871 cfg->hissecret_length); 5872 if (error) { 5873 free(sp->hisauth.secret, M_DEVBUF); 5874 sp->hisauth.secret = NULL; 5875 SPPP_UNLOCK(sp); 5876 return error; 5877 } 5878 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5879 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5880 } 5881 if (cfg->myname != NULL && cfg->myname_length > 0) { 5882 if (cfg->myname_length >= MCLBYTES) { 5883 SPPP_UNLOCK(sp); 5884 return (ENAMETOOLONG); 5885 } 5886 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5887 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5888 if (error) { 5889 free(sp->myauth.name, M_DEVBUF); 5890 sp->myauth.name = NULL; 5891 SPPP_UNLOCK(sp); 5892 return error; 5893 } 5894 sp->myauth.name_len = cfg->myname_length - 1; 5895 sp->myauth.name[sp->myauth.name_len] = 0; 5896 } 5897 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5898 if (cfg->mysecret_length >= MCLBYTES) { 5899 SPPP_UNLOCK(sp); 5900 return (ENAMETOOLONG); 5901 } 5902 sp->myauth.secret = malloc(cfg->mysecret_length, 5903 M_DEVBUF, M_WAITOK); 5904 error = copyin(cfg->mysecret, sp->myauth.secret, 5905 cfg->mysecret_length); 5906 if (error) { 5907 free(sp->myauth.secret, M_DEVBUF); 5908 sp->myauth.secret = NULL; 5909 SPPP_UNLOCK(sp); 5910 return error; 5911 } 5912 sp->myauth.secret_len = cfg->mysecret_length - 1; 5913 sp->myauth.secret[sp->myauth.secret_len] = 0; 5914 } 5915 sp->myauth.flags = cfg->myauthflags; 5916 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 5917 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 5918 } 5919 sp->hisauth.flags = cfg->hisauthflags; 5920 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 5921 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 5922 } 5923 sp->pp_auth_failures = 0; 5924 if (sp->hisauth.proto != PPP_NOPROTO) 5925 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 5926 else 5927 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 5928 5929 SPPP_UNLOCK(sp); 5930 } 5931 break; 5932 case SPPPGETLCPCFG: 5933 { 5934 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5935 5936 SPPP_LOCK(sp, RW_READER); 5937 lcpp->lcp_timeout = sp->lcp.timeout; 5938 SPPP_UNLOCK(sp); 5939 } 5940 break; 5941 case SPPPSETLCPCFG: 5942 { 5943 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5944 5945 SPPP_LOCK(sp, RW_WRITER); 5946 sp->lcp.timeout = lcpp->lcp_timeout; 5947 SPPP_UNLOCK(sp); 5948 } 5949 break; 5950 case SPPPGETNCPCFG: 5951 { 5952 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 5953 5954 SPPP_LOCK(sp, RW_READER); 5955 ncpp->ncp_flags = sp->pp_ncpflags; 5956 SPPP_UNLOCK(sp); 5957 } 5958 break; 5959 case SPPPSETNCPCFG: 5960 { 5961 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 5962 5963 SPPP_LOCK(sp, RW_WRITER); 5964 sp->pp_ncpflags = ncpp->ncp_flags; 5965 SPPP_UNLOCK(sp); 5966 } 5967 break; 5968 case SPPPGETSTATUS: 5969 { 5970 struct spppstatus *status = (struct spppstatus *)data; 5971 5972 SPPP_LOCK(sp, RW_READER); 5973 status->phase = sp->pp_phase; 5974 SPPP_UNLOCK(sp); 5975 } 5976 break; 5977 case SPPPGETSTATUSNCP: 5978 { 5979 struct spppstatusncp *status = (struct spppstatusncp *)data; 5980 5981 SPPP_LOCK(sp, RW_READER); 5982 status->phase = sp->pp_phase; 5983 status->ncpup = sppp_cp_check(sp, CP_NCP); 5984 SPPP_UNLOCK(sp); 5985 } 5986 break; 5987 case SPPPGETIDLETO: 5988 { 5989 struct spppidletimeout *to = (struct spppidletimeout *)data; 5990 5991 SPPP_LOCK(sp, RW_READER); 5992 to->idle_seconds = sp->pp_idle_timeout; 5993 SPPP_UNLOCK(sp); 5994 } 5995 break; 5996 case SPPPSETIDLETO: 5997 { 5998 struct spppidletimeout *to = (struct spppidletimeout *)data; 5999 6000 SPPP_LOCK(sp, RW_WRITER); 6001 sp->pp_idle_timeout = to->idle_seconds; 6002 SPPP_UNLOCK(sp); 6003 } 6004 break; 6005 case SPPPSETAUTHFAILURE: 6006 { 6007 struct spppauthfailuresettings *afsettings = 6008 (struct spppauthfailuresettings *)data; 6009 6010 SPPP_LOCK(sp, RW_WRITER); 6011 sp->pp_max_auth_fail = afsettings->max_failures; 6012 sp->pp_auth_failures = 0; 6013 SPPP_UNLOCK(sp); 6014 } 6015 break; 6016 case SPPPGETAUTHFAILURES: 6017 { 6018 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6019 6020 SPPP_LOCK(sp, RW_READER); 6021 stats->auth_failures = sp->pp_auth_failures; 6022 stats->max_failures = sp->pp_max_auth_fail; 6023 SPPP_UNLOCK(sp); 6024 } 6025 break; 6026 case SPPPSETDNSOPTS: 6027 { 6028 struct spppdnssettings *req = (struct spppdnssettings *)data; 6029 6030 SPPP_LOCK(sp, RW_WRITER); 6031 sp->query_dns = req->query_dns & 3; 6032 SPPP_UNLOCK(sp); 6033 } 6034 break; 6035 case SPPPGETDNSOPTS: 6036 { 6037 struct spppdnssettings *req = (struct spppdnssettings *)data; 6038 6039 SPPP_LOCK(sp, RW_READER); 6040 req->query_dns = sp->query_dns; 6041 SPPP_UNLOCK(sp); 6042 } 6043 break; 6044 case SPPPGETDNSADDRS: 6045 { 6046 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6047 6048 SPPP_LOCK(sp, RW_READER); 6049 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6050 SPPP_UNLOCK(sp); 6051 } 6052 break; 6053 case SPPPGETKEEPALIVE: 6054 { 6055 struct spppkeepalivesettings *settings = 6056 (struct spppkeepalivesettings*)data; 6057 6058 SPPP_LOCK(sp, RW_READER); 6059 settings->maxalive = sp->pp_maxalive; 6060 settings->max_noreceive = sp->pp_max_noreceive; 6061 settings->alive_interval = sp->pp_alive_interval; 6062 SPPP_UNLOCK(sp); 6063 } 6064 break; 6065 case SPPPSETKEEPALIVE: 6066 { 6067 struct spppkeepalivesettings *settings = 6068 (struct spppkeepalivesettings*)data; 6069 6070 SPPP_LOCK(sp, RW_WRITER); 6071 sp->pp_maxalive = settings->maxalive; 6072 sp->pp_max_noreceive = settings->max_noreceive; 6073 sp->pp_alive_interval = settings->alive_interval; 6074 SPPP_UNLOCK(sp); 6075 } 6076 break; 6077 case SPPPGETLCPSTATUS: 6078 { 6079 struct sppplcpstatus *status = 6080 (struct sppplcpstatus *)data; 6081 6082 SPPP_LOCK(sp, RW_READER); 6083 status->state = sp->scp[IDX_LCP].state; 6084 status->opts = sp->lcp.opts; 6085 status->magic = sp->lcp.magic; 6086 status->mru = sp->lcp.mru; 6087 SPPP_UNLOCK(sp); 6088 } 6089 break; 6090 case SPPPGETIPCPSTATUS: 6091 { 6092 struct spppipcpstatus *status = 6093 (struct spppipcpstatus *)data; 6094 u_int32_t myaddr; 6095 6096 SPPP_LOCK(sp, RW_READER); 6097 status->state = sp->scp[IDX_IPCP].state; 6098 status->opts = sp->ipcp.opts; 6099 #ifdef INET 6100 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6101 #else 6102 myaddr = 0; 6103 #endif 6104 status->myaddr = ntohl(myaddr); 6105 SPPP_UNLOCK(sp); 6106 } 6107 break; 6108 case SPPPGETIPV6CPSTATUS: 6109 { 6110 struct spppipv6cpstatus *status = 6111 (struct spppipv6cpstatus *)data; 6112 6113 SPPP_LOCK(sp, RW_READER); 6114 status->state = sp->scp[IDX_IPV6CP].state; 6115 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6116 sizeof(status->my_ifid)); 6117 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6118 sizeof(status->his_ifid)); 6119 SPPP_UNLOCK(sp); 6120 } 6121 break; 6122 default: 6123 { 6124 int ret; 6125 6126 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6127 enosys(), ret); 6128 if (ret != ENOSYS) 6129 return ret; 6130 return (EINVAL); 6131 } 6132 } 6133 return (0); 6134 } 6135 6136 static void 6137 sppp_phase_network(struct sppp *sp) 6138 { 6139 int i; 6140 6141 KASSERT(SPPP_WLOCKED(sp)); 6142 6143 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6144 6145 /* Notify NCPs now. */ 6146 for (i = 0; i < IDX_COUNT; i++) 6147 if ((cps[i])->flags & CP_NCP) 6148 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6149 } 6150 6151 static const char * 6152 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6153 { 6154 6155 switch (type) { 6156 case CONF_REQ: return "conf-req"; 6157 case CONF_ACK: return "conf-ack"; 6158 case CONF_NAK: return "conf-nak"; 6159 case CONF_REJ: return "conf-rej"; 6160 case TERM_REQ: return "term-req"; 6161 case TERM_ACK: return "term-ack"; 6162 case CODE_REJ: return "code-rej"; 6163 case PROTO_REJ: return "proto-rej"; 6164 case ECHO_REQ: return "echo-req"; 6165 case ECHO_REPLY: return "echo-reply"; 6166 case DISC_REQ: return "discard-req"; 6167 } 6168 if (buf != NULL) 6169 snprintf(buf, buflen, "0x%02x", type); 6170 return buf; 6171 } 6172 6173 static const char * 6174 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6175 { 6176 const char *name; 6177 6178 switch (proto) { 6179 case PPP_CHAP: 6180 switch (type) { 6181 case CHAP_CHALLENGE: return "challenge"; 6182 case CHAP_RESPONSE: return "response"; 6183 case CHAP_SUCCESS: return "success"; 6184 case CHAP_FAILURE: return "failure"; 6185 default: name = "chap"; break; 6186 } 6187 break; 6188 6189 case PPP_PAP: 6190 switch (type) { 6191 case PAP_REQ: return "req"; 6192 case PAP_ACK: return "ack"; 6193 case PAP_NAK: return "nak"; 6194 default: name = "pap"; break; 6195 } 6196 break; 6197 6198 default: 6199 name = "bad"; 6200 break; 6201 } 6202 6203 if (buf != NULL) 6204 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6205 return buf; 6206 } 6207 6208 static const char * 6209 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6210 { 6211 6212 switch (opt) { 6213 case LCP_OPT_MRU: return "mru"; 6214 case LCP_OPT_ASYNC_MAP: return "async-map"; 6215 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6216 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6217 case LCP_OPT_MAGIC: return "magic"; 6218 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6219 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6220 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6221 case LCP_OPT_CALL_BACK: return "callback"; 6222 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6223 case LCP_OPT_MP_MRRU: return "mrru"; 6224 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6225 case LCP_OPT_MP_EID: return "mp-eid"; 6226 } 6227 if (buf != NULL) 6228 snprintf(buf, buflen, "0x%02x", opt); 6229 return buf; 6230 } 6231 6232 static const char * 6233 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6234 { 6235 6236 switch (opt) { 6237 case IPCP_OPT_ADDRESSES: return "addresses"; 6238 case IPCP_OPT_COMPRESSION: return "compression"; 6239 case IPCP_OPT_ADDRESS: return "address"; 6240 case IPCP_OPT_PRIMDNS: return "primdns"; 6241 case IPCP_OPT_SECDNS: return "secdns"; 6242 } 6243 if (buf != NULL) 6244 snprintf(buf, buflen, "0x%02x", opt); 6245 return buf; 6246 } 6247 6248 #ifdef INET6 6249 static const char * 6250 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6251 { 6252 6253 switch (opt) { 6254 case IPV6CP_OPT_IFID: return "ifid"; 6255 case IPV6CP_OPT_COMPRESSION: return "compression"; 6256 } 6257 if (buf != NULL) 6258 snprintf(buf, buflen, "0x%02x", opt); 6259 return buf; 6260 } 6261 #endif 6262 6263 static const char * 6264 sppp_state_name(int state) 6265 { 6266 6267 switch (state) { 6268 case STATE_INITIAL: return "initial"; 6269 case STATE_STARTING: return "starting"; 6270 case STATE_CLOSED: return "closed"; 6271 case STATE_STOPPED: return "stopped"; 6272 case STATE_CLOSING: return "closing"; 6273 case STATE_STOPPING: return "stopping"; 6274 case STATE_REQ_SENT: return "req-sent"; 6275 case STATE_ACK_RCVD: return "ack-rcvd"; 6276 case STATE_ACK_SENT: return "ack-sent"; 6277 case STATE_OPENED: return "opened"; 6278 } 6279 return "illegal"; 6280 } 6281 6282 static const char * 6283 sppp_phase_name(int phase) 6284 { 6285 6286 switch (phase) { 6287 case SPPP_PHASE_DEAD: return "dead"; 6288 case SPPP_PHASE_ESTABLISH: return "establish"; 6289 case SPPP_PHASE_TERMINATE: return "terminate"; 6290 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6291 case SPPP_PHASE_NETWORK: return "network"; 6292 } 6293 return "illegal"; 6294 } 6295 6296 static const char * 6297 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6298 { 6299 6300 switch (proto) { 6301 case PPP_LCP: return "lcp"; 6302 case PPP_IPCP: return "ipcp"; 6303 case PPP_PAP: return "pap"; 6304 case PPP_CHAP: return "chap"; 6305 case PPP_IPV6CP: return "ipv6cp"; 6306 } 6307 if (buf != NULL) { 6308 snprintf(buf, sizeof(buf), "0x%04x", 6309 (unsigned)proto); 6310 } 6311 return buf; 6312 } 6313 6314 static void 6315 sppp_print_bytes(const u_char *p, u_short len) 6316 { 6317 addlog(" %02x", *p++); 6318 while (--len > 0) 6319 addlog("-%02x", *p++); 6320 } 6321 6322 static void 6323 sppp_print_string(const char *p, u_short len) 6324 { 6325 u_char c; 6326 6327 while (len-- > 0) { 6328 c = *p++; 6329 /* 6330 * Print only ASCII chars directly. RFC 1994 recommends 6331 * using only them, but we don't rely on it. */ 6332 if (c < ' ' || c > '~') 6333 addlog("\\x%x", c); 6334 else 6335 addlog("%c", c); 6336 } 6337 } 6338 6339 static const char * 6340 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6341 { 6342 6343 if (buf != NULL) { 6344 snprintf(buf, buflen, "%u.%u.%u.%u", 6345 (unsigned int)((addr >> 24) & 0xff), 6346 (unsigned int)((addr >> 16) & 0xff), 6347 (unsigned int)((addr >> 8) & 0xff), 6348 (unsigned int)(addr & 0xff)); 6349 } 6350 return buf; 6351 } 6352 6353 /* a dummy, used to drop uninteresting events */ 6354 static void 6355 sppp_null(struct sppp *unused) 6356 { 6357 /* do just nothing */ 6358 } 6359 6360 static void 6361 sppp_tls(const struct cp *cp, struct sppp *sp) 6362 { 6363 6364 SPPP_DLOG(sp, "%s tls\n", cp->name); 6365 6366 /* notify lcp that is lower layer */ 6367 sp->lcp.protos |= (1 << cp->protoidx); 6368 } 6369 6370 static void 6371 sppp_tlf(const struct cp *cp, struct sppp *sp) 6372 { 6373 6374 SPPP_DLOG(sp, "%s tlf\n", cp->name); 6375 6376 /* notify lcp that is lower layer */ 6377 sp->lcp.protos &= ~(1 << cp->protoidx); 6378 6379 /* cleanup */ 6380 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6381 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6382 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6383 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6384 6385 sppp_lcp_check_and_close(sp); 6386 } 6387 6388 static void 6389 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6390 uint8_t ident, size_t msglen, void *msg) 6391 { 6392 6393 if (msglen == 0) 6394 return; 6395 6396 switch (type) { 6397 case CONF_ACK: 6398 case CONF_NAK: 6399 case CONF_REJ: 6400 break; 6401 default: 6402 return; 6403 } 6404 6405 if (sppp_debug_enabled(sp)) { 6406 char tbuf[SPPP_CPTYPE_NAMELEN]; 6407 const char *cpname; 6408 6409 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6410 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname); 6411 } 6412 6413 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6414 } 6415 6416 static void 6417 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6418 { 6419 6420 SPPP_UNLOCK(sp); 6421 if_down(&sp->pp_if); 6422 IF_PURGE(&sp->pp_cpq); 6423 SPPP_LOCK(sp, RW_WRITER); 6424 } 6425 6426 static void 6427 sppp_notify_up(struct sppp *sp) 6428 { 6429 6430 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6431 } 6432 6433 static void 6434 sppp_notify_down(struct sppp *sp) 6435 { 6436 6437 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6438 } 6439 6440 static void 6441 sppp_notify_tls_wlocked(struct sppp *sp) 6442 { 6443 6444 KASSERT(SPPP_WLOCKED(sp)); 6445 6446 if (!sp->pp_tls) 6447 return; 6448 6449 SPPP_UNLOCK(sp); 6450 sp->pp_tls(sp); 6451 SPPP_LOCK(sp, RW_WRITER); 6452 } 6453 6454 static void 6455 sppp_notify_tlf_wlocked(struct sppp *sp) 6456 { 6457 6458 KASSERT(SPPP_WLOCKED(sp)); 6459 6460 if (!sp->pp_tlf) 6461 return; 6462 6463 SPPP_UNLOCK(sp); 6464 sp->pp_tlf(sp); 6465 SPPP_LOCK(sp, RW_WRITER); 6466 } 6467 6468 static void 6469 sppp_wq_work(struct work *wk, void *xsp) 6470 { 6471 struct sppp *sp; 6472 struct sppp_work *work; 6473 6474 sp = xsp; 6475 work = container_of(wk, struct sppp_work, work); 6476 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6477 6478 SPPP_LOCK(sp, RW_WRITER); 6479 work->func(sp, work->arg); 6480 SPPP_UNLOCK(sp); 6481 } 6482 6483 static struct workqueue * 6484 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6485 { 6486 struct workqueue *wq; 6487 int error; 6488 6489 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6490 (void *)sp, prio, ipl, flags); 6491 if (error) { 6492 panic("%s: workqueue_create failed [%s, %d]\n", 6493 sp->pp_if.if_xname, xnamebuf, error); 6494 } 6495 6496 return wq; 6497 } 6498 6499 static void 6500 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6501 { 6502 6503 workqueue_destroy(wq); 6504 } 6505 6506 static void 6507 sppp_wq_set(struct sppp_work *work, 6508 void (*func)(struct sppp *, void *), void *arg) 6509 { 6510 6511 work->func = func; 6512 work->arg = arg; 6513 } 6514 6515 static void 6516 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6517 { 6518 6519 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6520 != SPPP_WK_FREE) 6521 return; 6522 6523 KASSERT(work->func != NULL); 6524 kpreempt_disable(); 6525 workqueue_enqueue(wq, &work->work, NULL); 6526 kpreempt_enable(); 6527 } 6528 static void 6529 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6530 { 6531 6532 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6533 workqueue_wait(wq, &work->work); 6534 } 6535 6536 /* 6537 * This file is large. Tell emacs to highlight it nevertheless. 6538 * 6539 * Local Variables: 6540 * hilit-auto-highlight-maxout: 120000 6541 * End: 6542 */ 6543 6544 /* 6545 * Module glue 6546 */ 6547 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6548 6549 static int 6550 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6551 { 6552 6553 switch (cmd) { 6554 case MODULE_CMD_INIT: 6555 case MODULE_CMD_FINI: 6556 return 0; 6557 case MODULE_CMD_STAT: 6558 case MODULE_CMD_AUTOUNLOAD: 6559 default: 6560 return ENOTTY; 6561 } 6562 } 6563
Indexes created Sun Jun 21 00:25:28 UTC 2026