1 /* $NetBSD: if_spppsubr.c,v 1.308 2026/07/28 07:10:42 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.308 2026/07/28 07:10:42 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #include "opt_sppp_filter.h" 53 #endif 54 55 #include <sys/param.h> 56 #include <sys/proc.h> 57 #include <sys/systm.h> 58 #include <sys/kernel.h> 59 #include <sys/sockio.h> 60 #include <sys/socket.h> 61 #include <sys/syslog.h> 62 #include <sys/malloc.h> 63 #include <sys/mbuf.h> 64 #include <sys/callout.h> 65 #include <sys/md5.h> 66 #include <sys/inttypes.h> 67 #include <sys/kauth.h> 68 #include <sys/cprng.h> 69 #include <sys/module.h> 70 #include <sys/workqueue.h> 71 #include <sys/atomic.h> 72 #include <sys/compat_stub.h> 73 #include <sys/cpu.h> 74 #include <sys/once.h> 75 #ifdef SPPP_FILTER 76 #include <sys/pserialize.h> 77 #include <sys/psref.h> 78 #endif 79 80 #include <net/if.h> 81 #include <net/if_types.h> 82 #include <net/route.h> 83 #include <net/ppp_defs.h> 84 85 #include <netinet/in.h> 86 #include <netinet/in_systm.h> 87 #include <netinet/in_var.h> 88 #ifdef INET 89 #include <netinet/ip.h> 90 #include <netinet/tcp.h> 91 #endif 92 #include <net/ethertypes.h> 93 94 #ifdef INET6 95 #include <netinet6/scope6_var.h> 96 #endif 97 98 #include <net/if_sppp.h> 99 #include <net/if_spppvar.h> 100 101 #ifdef NET_MPSAFE 102 #define SPPPSUBR_MPSAFE 1 103 #endif 104 105 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 106 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 107 #define LOOPALIVECNT 3 /* loopback detection tries */ 108 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 109 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 110 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 111 112 #ifndef SPPP_KEEPALIVE_INTERVAL 113 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 114 #endif 115 116 #ifndef SPPP_NORECV_TIME 117 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 118 #endif 119 120 #ifndef SPPP_ALIVE_INTERVAL 121 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 122 #endif 123 124 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 125 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 126 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 127 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 128 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 129 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 130 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 131 132 /* 133 * Interface flags that can be set in an ifconfig command. 134 * 135 * Setting link0 will make the link passive, i.e. it will be marked 136 * as being administrative openable, but won't be opened to begin 137 * with. Incoming calls will be answered, or subsequent calls with 138 * -link1 will cause the administrative open of the LCP layer. 139 * 140 * Setting link1 will cause the link to auto-dial only as packets 141 * arrive to be sent. 142 * 143 * Setting IFF_DEBUG will syslog the option negotiation and state 144 * transitions at level kern.debug. Note: all logs consistently look 145 * like 146 * 147 * <if-name><unit>: <proto-name> <additional info...> 148 * 149 * with <if-name><unit> being something like "bppp0", and <proto-name> 150 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 151 */ 152 153 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 154 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 155 156 #define CONF_REQ 1 /* PPP configure request */ 157 #define CONF_ACK 2 /* PPP configure acknowledge */ 158 #define CONF_NAK 3 /* PPP configure negative ack */ 159 #define CONF_REJ 4 /* PPP configure reject */ 160 #define TERM_REQ 5 /* PPP terminate request */ 161 #define TERM_ACK 6 /* PPP terminate acknowledge */ 162 #define CODE_REJ 7 /* PPP code reject */ 163 #define PROTO_REJ 8 /* PPP protocol reject */ 164 #define ECHO_REQ 9 /* PPP echo request */ 165 #define ECHO_REPLY 10 /* PPP echo reply */ 166 #define DISC_REQ 11 /* PPP discard request */ 167 168 #define LCP_OPT_MRU 1 /* maximum receive unit */ 169 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 170 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 171 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 172 #define LCP_OPT_MAGIC 5 /* magic number */ 173 #define LCP_OPT_RESERVED 6 /* reserved */ 174 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 175 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 176 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 177 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 178 #define LCP_OPT_CALL_BACK 13 /* callback */ 179 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 180 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 181 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 182 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 183 184 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 185 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 186 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 187 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 188 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 189 190 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 191 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 192 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 193 194 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 195 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 196 197 #define PAP_REQ 1 /* PAP name/password request */ 198 #define PAP_ACK 2 /* PAP acknowledge */ 199 #define PAP_NAK 3 /* PAP fail */ 200 201 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 202 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 203 #define CHAP_SUCCESS 3 /* CHAP response ok */ 204 #define CHAP_FAILURE 4 /* CHAP response failed */ 205 206 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 207 208 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 209 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 210 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 211 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 212 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 213 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 214 215 #define PPP_NOPROTO 0 /* no authentication protocol */ 216 217 enum { 218 STATE_INITIAL = SPPP_STATE_INITIAL, 219 STATE_STARTING = SPPP_STATE_STARTING, 220 STATE_CLOSED = SPPP_STATE_CLOSED, 221 STATE_STOPPED = SPPP_STATE_STOPPED, 222 STATE_CLOSING = SPPP_STATE_CLOSING, 223 STATE_STOPPING = SPPP_STATE_STOPPING, 224 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 225 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 226 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 227 STATE_OPENED = SPPP_STATE_OPENED, 228 }; 229 230 enum cp_rcr_type { 231 CP_RCR_NONE = 0, /* initial value */ 232 CP_RCR_ACK, /* RCR+ */ 233 CP_RCR_NAK, /* RCR- */ 234 CP_RCR_REJ, /* RCR- */ 235 CP_RCR_DROP, /* DROP message */ 236 CP_RCR_ERR, /* internal error */ 237 }; 238 239 struct ppp_header { 240 uint8_t address; 241 uint8_t control; 242 uint16_t protocol; 243 } __packed; 244 #define PPP_HEADER_LEN sizeof (struct ppp_header) 245 246 struct lcp_header { 247 uint8_t type; 248 uint8_t ident; 249 uint16_t len; 250 } __packed; 251 #define LCP_HEADER_LEN sizeof (struct lcp_header) 252 253 struct cisco_packet { 254 uint32_t type; 255 uint32_t par1; 256 uint32_t par2; 257 uint16_t rel; 258 uint16_t time0; 259 uint16_t time1; 260 } __packed; 261 #define CISCO_PACKET_LEN 18 262 263 /* 264 * We follow the spelling and capitalization of RFC 1661 here, to make 265 * it easier comparing with the standard. Please refer to this RFC in 266 * case you can't make sense out of these abbreviation; it will also 267 * explain the semantics related to the various events and actions. 268 */ 269 struct cp { 270 u_short proto; /* PPP control protocol number */ 271 u_char protoidx; /* index into state table in struct sppp */ 272 u_char flags; 273 #define CP_LCP 0x01 /* this is the LCP */ 274 #define CP_AUTH 0x02 /* this is an authentication protocol */ 275 #define CP_NCP 0x04 /* this is a NCP */ 276 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 277 const char *name; /* name of this control protocol */ 278 /* event handlers */ 279 void (*Up)(struct sppp *, void *); 280 void (*Down)(struct sppp *, void *); 281 void (*Open)(struct sppp *, void *); 282 void (*Close)(struct sppp *, void *); 283 void (*TO)(struct sppp *, void *); 284 /* actions */ 285 void (*tlu)(struct sppp *); 286 void (*tld)(struct sppp *); 287 void (*tls)(const struct cp *, struct sppp *); 288 void (*tlf)(const struct cp *, struct sppp *); 289 void (*scr)(struct sppp *); 290 void (*screply)(const struct cp *, struct sppp *, u_char, 291 uint8_t, size_t, void *); 292 293 /* message parser */ 294 enum cp_rcr_type 295 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 296 uint8_t **, size_t *, size_t *); 297 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 298 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 299 }; 300 301 enum auth_role { 302 SPPP_AUTH_NOROLE = 0, 303 SPPP_AUTH_SERV = __BIT(0), 304 SPPP_AUTH_PEER = __BIT(1), 305 }; 306 307 static struct sppp *spppq; 308 static kmutex_t *spppq_lock = NULL; 309 static callout_t keepalive_ch; 310 static unsigned int sppp_keepalive_cnt = 0; 311 unsigned int sppp_keepalive_interval __read_mostly 312 = SPPP_KEEPALIVE_INTERVAL; 313 314 pktq_rps_hash_func_t sppp_pktq_rps_hash_p; 315 #ifdef SPPP_FILTER 316 static struct psref_class *sppp_psref_class __read_mostly = NULL; 317 #endif 318 319 #define SPPPQ_LOCK() if (spppq_lock) \ 320 mutex_enter(spppq_lock); 321 #define SPPPQ_UNLOCK() if (spppq_lock) \ 322 mutex_exit(spppq_lock); 323 324 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 325 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 326 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 327 #define SPPP_WQ_SET(_wk, _func, _arg) \ 328 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 329 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \ 330 if (__predict_true((_sp) != NULL)) { \ 331 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \ 332 } \ 333 addlog((_fmt), ##_args); \ 334 } while (0) 335 #define SPPP_DLOG(_sp, _fmt, _args...) do { \ 336 if (!sppp_debug_enabled(_sp)) \ 337 break; \ 338 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \ 339 } while (0) 340 341 #ifdef INET 342 #ifndef SPPPSUBR_MPSAFE 343 /* 344 * The following disgusting hack gets around the problem that IP TOS 345 * can't be set yet. We want to put "interactive" traffic on a high 346 * priority queue. To decide if traffic is interactive, we check that 347 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 348 * 349 * XXX is this really still necessary? - joerg - 350 */ 351 static u_short interactive_ports[8] = { 352 0, 513, 0, 0, 353 0, 21, 0, 23, 354 }; 355 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 356 #endif /* SPPPSUBR_MPSAFE */ 357 #endif 358 359 /* almost every function needs these */ 360 361 static bool sppp_debug_enabled(struct sppp *sp); 362 static int sppp_output(struct ifnet *, struct mbuf *, 363 const struct sockaddr *, const struct rtentry *); 364 365 static void sppp_cp_init(const struct cp *, struct sppp *); 366 static void sppp_cp_fini(const struct cp *, struct sppp *); 367 static void sppp_cp_input(const struct cp *, struct sppp *, 368 struct mbuf *); 369 static void sppp_cp_send(struct sppp *, u_short, u_char, 370 u_char, u_short, void *); 371 /* static void sppp_cp_timeout(void *arg); */ 372 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 373 static struct workqueue * 374 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 375 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 376 static void sppp_wq_set(struct sppp_work *, 377 void (*)(struct sppp *, void *), void *); 378 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 379 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 380 static void sppp_cp_to_lcp(void *); 381 static void sppp_cp_to_ipcp(void *); 382 static void sppp_cp_to_ipv6cp(void *); 383 static void sppp_auth_send(const struct cp *, struct sppp *, 384 unsigned int, unsigned int, ...); 385 static int sppp_auth_role(const struct cp *, struct sppp *); 386 static void sppp_auth_to_event(struct sppp *, void *); 387 static void sppp_auth_screply(const struct cp *, struct sppp *, 388 u_char, uint8_t, size_t, void *); 389 static void sppp_up_event(struct sppp *, void *); 390 static void sppp_down_event(struct sppp *, void *); 391 static void sppp_open_event(struct sppp *, void *); 392 static void sppp_close_event(struct sppp *, void *); 393 static void sppp_to_event(struct sppp *, void *); 394 static void sppp_rcr_event(struct sppp *, void *); 395 static void sppp_rca_event(struct sppp *, void *); 396 static void sppp_rcn_event(struct sppp *, void *); 397 static void sppp_rtr_event(struct sppp *, void *); 398 static void sppp_rta_event(struct sppp *, void *); 399 static void sppp_rxj_event(struct sppp *, void *); 400 401 static void sppp_null(struct sppp *); 402 static void sppp_tls(const struct cp *, struct sppp *); 403 static void sppp_tlf(const struct cp *, struct sppp *); 404 static void sppp_screply(const struct cp *, struct sppp *, 405 u_char, uint8_t, size_t, void *); 406 static void sppp_ifdown(struct sppp *, void *); 407 408 static void sppp_lcp_init(struct sppp *); 409 static void sppp_lcp_up(struct sppp *, void *); 410 static void sppp_lcp_down(struct sppp *, void *); 411 static void sppp_lcp_open(struct sppp *, void *); 412 static enum cp_rcr_type 413 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 414 uint8_t **, size_t *, size_t *); 415 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 416 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 417 static void sppp_lcp_tlu(struct sppp *); 418 static void sppp_lcp_tld(struct sppp *); 419 static void sppp_lcp_tls(const struct cp *, struct sppp *); 420 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 421 static void sppp_lcp_scr(struct sppp *); 422 static void sppp_lcp_check_and_close(struct sppp *); 423 static int sppp_cp_check(struct sppp *, u_char); 424 static bool sppp_is_ncp_opened(struct sppp *); 425 426 static void sppp_ipcp_init(struct sppp *); 427 static void sppp_ipcp_open(struct sppp *, void *); 428 static void sppp_ipcp_close(struct sppp *, void *); 429 static enum cp_rcr_type 430 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 431 uint8_t **, size_t *, size_t *); 432 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 433 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 434 static void sppp_ipcp_tlu(struct sppp *); 435 static void sppp_ipcp_tld(struct sppp *); 436 static void sppp_ipcp_scr(struct sppp *); 437 438 static void sppp_ipv6cp_init(struct sppp *); 439 static void sppp_ipv6cp_open(struct sppp *, void *); 440 static enum cp_rcr_type 441 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 442 uint8_t **, size_t *, size_t *); 443 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 444 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 445 static void sppp_ipv6cp_tlu(struct sppp *); 446 static void sppp_ipv6cp_tld(struct sppp *); 447 static void sppp_ipv6cp_scr(struct sppp *); 448 449 static void sppp_pap_input(struct sppp *, struct mbuf *); 450 static void sppp_pap_init(struct sppp *); 451 static void sppp_pap_tlu(struct sppp *); 452 static void sppp_pap_scr(struct sppp *); 453 454 static void sppp_chap_input(struct sppp *, struct mbuf *); 455 static void sppp_chap_init(struct sppp *); 456 static void sppp_chap_open(struct sppp *, void *); 457 static void sppp_chap_tlu(struct sppp *); 458 static void sppp_chap_scr(struct sppp *); 459 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 460 461 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 462 static const char *sppp_cp_type_name(char *, size_t, u_char); 463 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 464 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 465 #ifdef INET6 466 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 467 #endif 468 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 469 static const char *sppp_phase_name(int); 470 static const char *sppp_proto_name(char *, size_t, u_short); 471 static const char *sppp_state_name(int); 472 static int sppp_params(struct sppp *, u_long, void *); 473 #ifdef INET 474 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 475 static void sppp_set_ip_addrs(struct sppp *); 476 static void sppp_clear_ip_addrs(struct sppp *); 477 #endif 478 static void sppp_keepalive(void *); 479 static void sppp_phase_network(struct sppp *); 480 static void sppp_print_bytes(const u_char *, u_short); 481 static void sppp_print_string(const char *, u_short); 482 #ifdef INET6 483 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 484 struct in6_addr *, struct in6_addr *); 485 #ifdef IPV6CP_MYIFID_DYN 486 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 487 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 488 #endif 489 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 490 #endif 491 492 static void sppp_notify_up(struct sppp *); 493 static void sppp_notify_down(struct sppp *); 494 static void sppp_notify_tls_wlocked(struct sppp *); 495 static void sppp_notify_tlf_wlocked(struct sppp *); 496 497 #ifdef SPPP_FILTER 498 static void sppp_update_last_activity(struct sppp *, struct mbuf *, 499 struct sppp_bpf **); 500 static int sppp_set_filter(struct sppp *, struct bpf_program *, 501 struct sppp_bpf **); 502 #endif 503 504 /* our control protocol descriptors */ 505 static const struct cp lcp = { 506 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 507 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 508 sppp_close_event, sppp_to_event, 509 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 510 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 511 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 512 }; 513 514 static const struct cp ipcp = { 515 PPP_IPCP, IDX_IPCP, 516 #ifdef INET 517 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 518 #else 519 0, 520 #endif 521 "ipcp", 522 sppp_up_event, sppp_down_event, sppp_ipcp_open, 523 sppp_ipcp_close, sppp_to_event, 524 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls, 525 sppp_tlf, sppp_ipcp_scr, sppp_screply, 526 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 527 }; 528 529 static const struct cp ipv6cp = { 530 PPP_IPV6CP, IDX_IPV6CP, 531 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 532 CP_NCP, 533 #else 534 0, 535 #endif 536 "ipv6cp", 537 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 538 sppp_close_event, sppp_to_event, 539 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls, 540 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 541 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 542 }; 543 544 static const struct cp pap = { 545 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 546 sppp_up_event, sppp_down_event, sppp_open_event, 547 sppp_close_event, sppp_auth_to_event, 548 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 549 sppp_pap_scr, sppp_auth_screply, 550 NULL, NULL, NULL 551 }; 552 553 static const struct cp chap = { 554 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 555 sppp_up_event, sppp_down_event, sppp_chap_open, 556 sppp_close_event, sppp_auth_to_event, 557 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 558 sppp_chap_scr, sppp_auth_screply, 559 NULL, NULL, NULL 560 }; 561 562 static const struct cp *cps[IDX_COUNT] = { 563 &lcp, /* IDX_LCP */ 564 &ipcp, /* IDX_IPCP */ 565 &ipv6cp, /* IDX_IPV6CP */ 566 &pap, /* IDX_PAP */ 567 &chap, /* IDX_CHAP */ 568 }; 569 570 static int 571 spppinit(void) 572 { 573 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 574 575 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 576 callout_setfunc(&keepalive_ch, sppp_keepalive, NULL); 577 578 #ifdef SPPP_FILTER 579 sppp_psref_class = psref_class_create("sppp_psref", IPL_SOFTNET); 580 #endif 581 return 0; 582 } 583 584 static inline u_int 585 sppp_proto2authproto(u_short proto) 586 { 587 588 switch (proto) { 589 case PPP_PAP: 590 return SPPP_AUTHPROTO_PAP; 591 case PPP_CHAP: 592 return SPPP_AUTHPROTO_CHAP; 593 } 594 595 return SPPP_AUTHPROTO_NONE; 596 } 597 598 static inline u_short 599 sppp_authproto2proto(u_int authproto) 600 { 601 602 switch (authproto) { 603 case SPPP_AUTHPROTO_PAP: 604 return PPP_PAP; 605 case SPPP_AUTHPROTO_CHAP: 606 return PPP_CHAP; 607 } 608 609 return PPP_NOPROTO; 610 } 611 612 static inline bool 613 sppp_debug_enabled(struct sppp *sp) 614 { 615 616 if (__predict_false(sp == NULL)) 617 return false; 618 619 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0) 620 return false; 621 622 return true; 623 } 624 625 static inline void 626 sppp_connect(struct sppp *sp) 627 { 628 KASSERT(SPPP_WLOCKED(sp)); 629 630 sp->pp_if.if_flags |= IFF_RUNNING; 631 atomic_store_relaxed(&sp->pp_connecting, true); 632 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 633 } 634 635 static inline void 636 sppp_disconnect(struct sppp *sp) 637 { 638 KASSERT(SPPP_WLOCKED(sp)); 639 640 sp->pp_if.if_flags &= ~IFF_RUNNING; 641 atomic_store_relaxed(&sp->pp_connecting, false); 642 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 643 } 644 645 static void 646 sppp_change_phase(struct sppp *sp, int phase) 647 { 648 struct ifnet *ifp = &sp->pp_if; 649 650 KASSERT(SPPP_WLOCKED(sp)); 651 652 if (sp->pp_phase == phase) 653 return; 654 655 sp->pp_phase = phase; 656 657 if (phase == SPPP_PHASE_NETWORK) 658 if_link_state_change(ifp, LINK_STATE_UP); 659 else 660 if_link_state_change(ifp, LINK_STATE_DOWN); 661 662 SPPP_DLOG(sp, "phase %s\n", 663 sppp_phase_name(sp->pp_phase)); 664 } 665 666 /* 667 * Exported functions, comprising our interface to the lower layer. 668 */ 669 670 /* 671 * Process the received packet. 672 */ 673 void 674 sppp_input(struct ifnet *ifp, struct mbuf *m) 675 { 676 struct ppp_header *h = NULL; 677 pktqueue_t *pktq = NULL; 678 uint16_t protocol; 679 struct sppp *sp = (struct sppp *)ifp; 680 681 /* No RPS for not-IP. */ 682 pktq_rps_hash_func_t rps_hash = NULL; 683 684 if (ifp->if_flags & IFF_UP) { 685 /* Count received bytes, add hardware framing */ 686 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 687 /* Note time of last receive */ 688 atomic_store_relaxed(&sp->pp_last_receive, time_uptime32); 689 } 690 691 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 692 /* Too small packet, drop it. */ 693 SPPP_DLOG(sp, "input packet is too small, " 694 "%d bytes\n", m->m_pkthdr.len); 695 goto error; 696 } 697 698 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 699 memcpy(&protocol, mtod(m, void *), 2); 700 protocol = ntohs(protocol); 701 m_adj(m, 2); 702 } else { 703 704 /* Get PPP header. */ 705 h = mtod(m, struct ppp_header *); 706 m_adj(m, PPP_HEADER_LEN); 707 708 switch (h->address) { 709 case PPP_ALLSTATIONS: 710 if (h->control != PPP_UI) 711 goto invalid; 712 break; 713 case CISCO_MULTICAST: 714 case CISCO_UNICAST: 715 /* Don't check the control field here (RFC 1547). */ 716 SPPP_DLOG(sp, "Cisco packet in PPP mode " 717 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 718 h->address, h->control, ntohs(h->protocol)); 719 goto drop; 720 default: /* Invalid PPP packet. */ 721 invalid: 722 SPPP_DLOG(sp, "invalid input packet " 723 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 724 h->address, h->control, ntohs(h->protocol)); 725 goto drop; 726 } 727 protocol = ntohs(h->protocol); 728 } 729 730 switch (protocol) { 731 reject_protocol: 732 KASSERT(SPPP_WLOCKED(sp)); 733 734 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 735 uint16_t prot = htons(protocol); 736 737 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 738 ++sp->scp[IDX_LCP].seq, sizeof(prot), &prot); 739 } 740 SPPP_UNLOCK(sp); 741 goto noproto; 742 default: 743 SPPP_DLOG(sp, "invalid input protocol " 744 "<proto=0x%x>\n", protocol); 745 goto reject_protocol; 746 case PPP_LCP: 747 SPPP_LOCK(sp, RW_WRITER); 748 sppp_cp_input(&lcp, sp, m); 749 /* already m_freem(m) */ 750 SPPP_UNLOCK(sp); 751 return; 752 case PPP_PAP: 753 SPPP_LOCK(sp, RW_WRITER); 754 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 755 sppp_pap_input(sp, m); 756 } else { 757 SPPP_UNLOCK(sp); 758 goto drop; 759 } 760 SPPP_UNLOCK(sp); 761 m_freem(m); 762 return; 763 case PPP_CHAP: 764 SPPP_LOCK(sp, RW_WRITER); 765 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 766 sppp_chap_input(sp, m); 767 } else { 768 SPPP_UNLOCK(sp); 769 goto drop; 770 } 771 SPPP_UNLOCK(sp); 772 m_freem(m); 773 return; 774 #ifdef INET 775 case PPP_IPCP: 776 SPPP_LOCK(sp, RW_WRITER); 777 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 778 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet " 779 "because IPCP is disabled\n"); 780 goto reject_protocol; 781 } 782 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 783 sppp_cp_input(&ipcp, sp, m); 784 /* already m_freem(m) */ 785 } else { 786 SPPP_UNLOCK(sp); 787 goto drop; 788 } 789 SPPP_UNLOCK(sp); 790 return; 791 case PPP_IP: 792 SPPP_LOCK(sp, RW_READER); 793 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 794 pktq = ip_pktq; 795 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p); 796 } 797 SPPP_UNLOCK(sp); 798 break; 799 #endif 800 #ifdef INET6 801 case PPP_IPV6CP: 802 SPPP_LOCK(sp, RW_WRITER); 803 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 804 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet " 805 "because IPv6CP is disabled\n"); 806 goto reject_protocol; 807 } 808 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 809 sppp_cp_input(&ipv6cp, sp, m); 810 /* already m_freem(m) */ 811 } else { 812 SPPP_UNLOCK(sp); 813 goto drop; 814 } 815 SPPP_UNLOCK(sp); 816 return; 817 818 case PPP_IPV6: 819 SPPP_LOCK(sp, RW_READER); 820 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 821 pktq = ip6_pktq; 822 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p); 823 } 824 SPPP_UNLOCK(sp); 825 break; 826 #endif 827 } 828 829 if ((ifp->if_flags & IFF_UP) == 0 || pktq == NULL) { 830 goto drop; 831 } 832 833 #ifdef SPPP_FILTER 834 sppp_update_last_activity(sp, m, &sp->pp_active_filt_in); 835 #else 836 atomic_store_relaxed(&sp->pp_last_activity, time_uptime32); 837 #endif 838 839 /* Check queue. */ 840 const uint32_t hash = rps_hash ? pktq_rps_hash(&rps_hash, m) : 0; 841 if (__predict_false(!pktq_enqueue(pktq, m, hash))) { 842 goto drop; 843 } 844 return; 845 846 drop: 847 if_statinc(ifp, if_iqdrops); 848 m_freem(m); 849 return; 850 851 error: 852 if_statinc(ifp, if_ierrors); 853 m_freem(m); 854 return; 855 856 noproto: 857 if_statinc(ifp, if_noproto); 858 m_freem(m); 859 return; 860 } 861 862 /* 863 * Enqueue transmit packet. 864 */ 865 static int 866 sppp_output(struct ifnet *ifp, struct mbuf *m, 867 const struct sockaddr *dst, const struct rtentry *rt) 868 { 869 struct sppp *sp = (struct sppp *) ifp; 870 struct ppp_header *h = NULL; 871 #ifndef SPPPSUBR_MPSAFE 872 struct ifqueue *ifq = NULL; /* XXX */ 873 #endif 874 int error = 0; 875 uint16_t protocol; 876 size_t pktlen; 877 878 #ifdef SPPP_FILTER 879 sppp_update_last_activity(sp, m, &sp->pp_active_filt_out); 880 #else 881 atomic_store_relaxed(&sp->pp_last_activity, time_uptime32); 882 #endif 883 884 if ((ifp->if_flags & IFF_UP) == 0) { 885 m_freem(m); 886 if_statinc(ifp, if_oerrors); 887 return (ENETDOWN); 888 } 889 890 if (!sppp_is_connecting(ifp)) { 891 SPPP_LOCK(sp, RW_WRITER); 892 if (!sp->pp_ondemand) { 893 SPPP_UNLOCK(sp); 894 m_freem(m); 895 if_statinc(ifp, if_oerrors); 896 return (ENETDOWN); 897 } else { 898 /* ignore packets that have no enabled NCP */ 899 if ((dst->sa_family == AF_INET && 900 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 901 (dst->sa_family == AF_INET6 && 902 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 903 SPPP_UNLOCK(sp); 904 905 m_freem(m); 906 if_statinc(ifp, if_oerrors); 907 return (ENETDOWN); 908 } 909 #ifdef SPPP_FILTER 910 if (sp->pp_dial_filt.bf_insns != NULL && 911 bpf_filter(sp->pp_dial_filt.bf_insns, 912 (u_char *)m, m_length(m), 0) == 0) { 913 SPPP_UNLOCK(sp); 914 915 SPPP_DLOG(sp, 916 "%s filtered by pass filter, dropped\n", 917 __func__); 918 IF_DROP(&ifp->if_snd); 919 m_freem(m); 920 return 0; 921 } 922 #endif 923 /* 924 * Interface is not yet running, but auto-dial. Need 925 * to start LCP for it. 926 * Re-check sp->pp_connecting 927 * under lock (Double-Checked Locking) 928 */ 929 if (!sp->pp_connecting) 930 sppp_connect(sp); 931 } 932 SPPP_UNLOCK(sp); 933 } 934 935 /* 936 * If the queueing discipline needs packet classification, 937 * do it before prepending link headers. 938 */ 939 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 940 941 #ifdef INET 942 if (dst->sa_family == AF_INET) { 943 struct ip *ip = NULL; 944 #ifndef SPPPSUBR_MPSAFE 945 struct tcphdr *th = NULL; 946 #endif 947 948 if (m->m_len >= sizeof(struct ip)) { 949 ip = mtod(m, struct ip *); 950 #ifndef SPPPSUBR_MPSAFE 951 if (ip->ip_p == IPPROTO_TCP && 952 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 953 sizeof(struct tcphdr)) { 954 th = (struct tcphdr *) 955 ((char *)ip + (ip->ip_hl << 2)); 956 } 957 #endif 958 } else 959 ip = NULL; 960 961 /* 962 * When using dynamic local IP address assignment by using 963 * 0.0.0.0 as a local address, the first TCP session will 964 * not connect because the local TCP checksum is computed 965 * using 0.0.0.0 which will later become our real IP address 966 * so the TCP checksum computed at the remote end will 967 * become invalid. So we 968 * - don't let packets with src ip addr 0 thru 969 * - we flag TCP packets with src ip 0 as an error 970 */ 971 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 972 uint8_t proto = ip->ip_p; 973 974 m_freem(m); 975 if (proto == IPPROTO_TCP) 976 return (EADDRNOTAVAIL); 977 else 978 return (0); 979 } 980 981 #ifndef SPPPSUBR_MPSAFE 982 /* 983 * Put low delay, telnet, rlogin and ftp control packets 984 * in front of the queue. 985 */ 986 if (!IF_QFULL(&sp->pp_fastq) && 987 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 988 (th && (INTERACTIVE(ntohs(th->th_sport)) || 989 INTERACTIVE(ntohs(th->th_dport)))))) 990 ifq = &sp->pp_fastq; 991 #endif /* !SPPPSUBR_MPSAFE */ 992 } 993 #endif 994 995 #ifdef INET6 996 if (dst->sa_family == AF_INET6) { 997 /* XXX do something tricky here? */ 998 } 999 #endif 1000 1001 if (!ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 1002 /* 1003 * Prepend general data packet PPP header. For now, IP only. 1004 */ 1005 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 1006 if (! m) { 1007 SPPP_DLOG(sp, "no memory for transmit header\n"); 1008 if_statinc(ifp, if_oerrors); 1009 return (ENOBUFS); 1010 } 1011 /* 1012 * May want to check size of packet 1013 * (albeit due to the implementation it's always enough) 1014 */ 1015 h = mtod(m, struct ppp_header *); 1016 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1017 h->control = PPP_UI; /* Unnumbered Info */ 1018 } 1019 1020 switch (dst->sa_family) { 1021 #ifdef INET 1022 case AF_INET: /* Internet Protocol */ 1023 /* 1024 * Don't choke with an ENETDOWN early. It's 1025 * possible that we just started dialing out, 1026 * so don't drop the packet immediately. If 1027 * we notice that we run out of buffer space 1028 * below, we will however remember that we are 1029 * not ready to carry IP packets, and return 1030 * ENETDOWN, as opposed to ENOBUFS. 1031 */ 1032 protocol = htons(PPP_IP); 1033 SPPP_LOCK(sp, RW_READER); 1034 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 1035 if (ifp->if_flags & IFF_AUTO) { 1036 error = ENETDOWN; 1037 } else { 1038 SPPP_UNLOCK(sp); 1039 1040 m_freem(m); 1041 if_statinc(ifp, if_oerrors); 1042 return (ENETDOWN); 1043 } 1044 } 1045 SPPP_UNLOCK(sp); 1046 break; 1047 #endif 1048 #ifdef INET6 1049 case AF_INET6: /* Internet Protocol version 6 */ 1050 /* 1051 * Don't choke with an ENETDOWN early. It's 1052 * possible that we just started dialing out, 1053 * so don't drop the packet immediately. If 1054 * we notice that we run out of buffer space 1055 * below, we will however remember that we are 1056 * not ready to carry IP packets, and return 1057 * ENETDOWN, as opposed to ENOBUFS. 1058 */ 1059 protocol = htons(PPP_IPV6); 1060 SPPP_LOCK(sp, RW_READER); 1061 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 1062 if (ifp->if_flags & IFF_AUTO) { 1063 error = ENETDOWN; 1064 } else { 1065 SPPP_UNLOCK(sp); 1066 1067 m_freem(m); 1068 if_statinc(ifp, if_oerrors); 1069 return (ENETDOWN); 1070 } 1071 } 1072 SPPP_UNLOCK(sp); 1073 break; 1074 #endif 1075 default: 1076 m_freem(m); 1077 if_statinc(ifp, if_oerrors); 1078 return (EAFNOSUPPORT); 1079 } 1080 1081 if (error == ENETDOWN) { 1082 IF_DROP(&ifp->if_snd); 1083 m_freem(m); 1084 return error; 1085 } 1086 1087 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 1088 M_PREPEND(m, 2, M_DONTWAIT); 1089 if (m == NULL) { 1090 SPPP_DLOG(sp, "no memory for transmit header\n"); 1091 if_statinc(ifp, if_oerrors); 1092 return (ENOBUFS); 1093 } 1094 *mtod(m, uint16_t *) = protocol; 1095 } else { 1096 h->protocol = protocol; 1097 } 1098 1099 pktlen = m->m_pkthdr.len; 1100 #ifdef SPPPSUBR_MPSAFE 1101 error = if_transmit_lock(ifp, m); 1102 if (error == 0) 1103 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1104 #else /* !SPPPSUBR_MPSAFE */ 1105 error = ifq_enqueue2(ifp, ifq, m); 1106 1107 if (error == 0) { 1108 /* 1109 * Count output packets and bytes. 1110 * The packet length includes header + additional hardware 1111 * framing according to RFC 1333. 1112 */ 1113 if (!(ifp->if_flags & IFF_OACTIVE)) { 1114 if_start_lock(ifp); 1115 } 1116 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1117 } 1118 #endif /* !SPPPSUBR_MPSAFE */ 1119 return error; 1120 } 1121 1122 static int 1123 sppp_sysctl_flags(SYSCTLFN_ARGS) 1124 { 1125 struct sppp *sp = rnode->sysctl_data; 1126 const char *s = rnode->sysctl_name; 1127 struct sysctlnode node; 1128 int err, val; 1129 u_int flag; 1130 1131 if (strcmp(s, "ifdown") == 0) { 1132 flag = PP_IFDOWN; 1133 } else { 1134 return EINVAL; 1135 } 1136 1137 SPPP_LOCK(sp, RW_READER); 1138 val = (sp->pp_flags & flag) ? 1 : 0; 1139 SPPP_UNLOCK(sp); 1140 1141 node = *rnode; 1142 node.sysctl_data = &val; 1143 1144 err = sysctl_lookup(SYSCTLFN_CALL(&node)); 1145 if (err || newp == NULL) 1146 return err; 1147 1148 SPPP_LOCK(sp, RW_WRITER); 1149 if (val == 1) { 1150 sp->pp_flags |= flag; 1151 } else { 1152 sp->pp_flags &= ~flag; 1153 } 1154 SPPP_UNLOCK(sp); 1155 1156 return 0; 1157 } 1158 1159 static void 1160 sppp_sysctl_setup(struct sppp *sp) 1161 { 1162 struct sysctllog **clog = &sp->pp_sysctl_log; 1163 const struct sysctlnode *rnode = NULL, *cnode = NULL; 1164 int err; 1165 1166 err = sysctl_createv(clog, 0, NULL, &rnode, 1167 CTLFLAG_PERMANENT, 1168 CTLTYPE_NODE, "sppp", 1169 SYSCTL_DESCR("Synchronous Point-to-Point Protocol controls"), 1170 NULL, 0, NULL, 0, 1171 CTL_NET, CTL_CREATE, CTL_EOL); 1172 if (err != 0) 1173 goto bad; 1174 1175 err = sysctl_createv(clog, 0, &rnode, &rnode, 1176 CTLFLAG_PERMANENT, 1177 CTLTYPE_NODE, sp->pp_if.if_xname, 1178 SYSCTL_DESCR("Interface controls"), 1179 NULL, 0, NULL, 0, 1180 CTL_CREATE, CTL_EOL); 1181 if (err != 0) 1182 goto bad; 1183 1184 err = sysctl_createv(clog, 0, &rnode, &cnode, 1185 CTLFLAG_PERMANENT | CTLFLAG_READWRITE, 1186 CTLTYPE_BOOL, "ifdown", 1187 SYSCTL_DESCR("Down interface on no echo reply and loopback detected"), 1188 sppp_sysctl_flags, 0, (void *)sp, 0, 1189 CTL_CREATE, CTL_EOL); 1190 if (err != 0) 1191 goto bad; 1192 1193 return; 1194 bad: 1195 sysctl_teardown(&sp->pp_sysctl_log); 1196 SPPP_LOG(sp, LOG_WARNING, 1197 "could not attach sysctl nodes for sppp\n"); 1198 return; 1199 } 1200 1201 void 1202 sppp_attach(struct ifnet *ifp) 1203 { 1204 static ONCE_DECL(control); 1205 struct sppp *sp = (struct sppp *) ifp; 1206 char xnamebuf[MAXCOMLEN]; 1207 1208 RUN_ONCE(&control, spppinit); 1209 1210 sp->pp_if.if_type = IFT_PPP; 1211 sp->pp_if.if_output = sppp_output; 1212 IFQ_SET_MAXLEN(&sp->pp_fastq, 32); 1213 IFQ_LOCK_INIT(&sp->pp_fastq); 1214 IFQ_SET_MAXLEN(&sp->pp_cpq, 20); 1215 sp->pp_loopcnt = 0; 1216 sp->pp_alivecnt = 0; 1217 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1218 sp->pp_last_activity = 0; 1219 sp->pp_last_receive = 0; 1220 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1221 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1222 sp->pp_idle_timeout = 0; 1223 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1224 sp->pp_phase = SPPP_PHASE_DEAD; 1225 sp->pp_up = sppp_notify_up; 1226 sp->pp_down = sppp_notify_down; 1227 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1228 #ifdef SPPP_IFDOWN_RECONNECT 1229 sp->pp_flags |= PP_IFDOWN; 1230 #endif 1231 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1232 memset(sp->scp, 0, sizeof(sp->scp)); 1233 rw_init(&sp->pp_lock); 1234 #ifdef SPPP_FILTER 1235 sp->pp_psz = pserialize_create(); 1236 #endif 1237 sppp_sysctl_setup(sp); 1238 1239 if_alloc_sadl(ifp); 1240 1241 /* Lets not beat about the bush, we know we're down. */ 1242 if_link_state_change(ifp, LINK_STATE_DOWN); 1243 1244 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1245 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1246 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1247 1248 memset(&sp->myauth, 0, sizeof sp->myauth); 1249 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1250 SPPP_LOCK(sp, RW_WRITER); 1251 sppp_lcp_init(sp); 1252 sppp_ipcp_init(sp); 1253 sppp_ipv6cp_init(sp); 1254 sppp_pap_init(sp); 1255 sppp_chap_init(sp); 1256 SPPP_UNLOCK(sp); 1257 1258 SPPPQ_LOCK(); 1259 if (spppq == NULL) 1260 callout_schedule(&keepalive_ch, hz * sppp_keepalive_interval); 1261 /* Insert new entry into the keepalive list. */ 1262 sp->pp_next = spppq; 1263 spppq = sp; 1264 SPPPQ_UNLOCK(); 1265 } 1266 1267 void 1268 sppp_detach(struct ifnet *ifp) 1269 { 1270 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1271 1272 /* Remove the entry from the keepalive list. */ 1273 SPPPQ_LOCK(); 1274 for (q = &spppq; (p = *q); q = &p->pp_next) 1275 if (p == sp) { 1276 *q = p->pp_next; 1277 break; 1278 } 1279 1280 if (spppq == NULL) 1281 callout_stop(&keepalive_ch); 1282 SPPPQ_UNLOCK(); 1283 1284 sysctl_teardown(&sp->pp_sysctl_log); 1285 sppp_cp_fini(&lcp, sp); 1286 sppp_cp_fini(&ipcp, sp); 1287 sppp_cp_fini(&pap, sp); 1288 sppp_cp_fini(&chap, sp); 1289 #ifdef INET6 1290 sppp_cp_fini(&ipv6cp, sp); 1291 #endif 1292 sppp_wq_destroy(sp, sp->wq_cp); 1293 1294 /* free authentication info */ 1295 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1296 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1297 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1298 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1299 1300 IFQ_LOCK_DESTROY(&sp->pp_fastq); 1301 #ifdef SPPP_FILTER 1302 { 1303 struct bpf_program bp_zero = { .bf_insns = NULL, .bf_len = 0}; 1304 struct bpf_program *bpp = &sp->pp_dial_filt; 1305 if (bpp->bf_insns != NULL) 1306 kmem_free(bpp->bf_insns, 1307 sizeof(bpp->bf_insns[0]) * bpp->bf_len); 1308 *bpp = bp_zero; 1309 sppp_set_filter(sp, &bp_zero, &sp->pp_active_filt_in); 1310 sppp_set_filter(sp, &bp_zero, &sp->pp_active_filt_out); 1311 } 1312 1313 pserialize_destroy(sp->pp_psz); 1314 #endif 1315 rw_destroy(&sp->pp_lock); 1316 } 1317 1318 /* 1319 * Flush the interface output queue. 1320 */ 1321 void 1322 sppp_flush(struct ifnet *ifp) 1323 { 1324 struct sppp *sp = (struct sppp *) ifp; 1325 1326 SPPP_LOCK(sp, RW_WRITER); 1327 IFQ_PURGE(&sp->pp_if.if_snd); 1328 IF_PURGE(&sp->pp_fastq); 1329 IF_PURGE(&sp->pp_cpq); 1330 SPPP_UNLOCK(sp); 1331 } 1332 1333 /* 1334 * Check if the output queue is empty. 1335 */ 1336 int 1337 sppp_isempty(struct ifnet *ifp) 1338 { 1339 struct sppp *sp = (struct sppp *) ifp; 1340 int empty; 1341 1342 SPPP_LOCK(sp, RW_READER); 1343 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1344 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1345 SPPP_UNLOCK(sp); 1346 return (empty); 1347 } 1348 1349 /* 1350 * Get next packet to send. 1351 */ 1352 struct mbuf * 1353 sppp_dequeue(struct ifnet *ifp) 1354 { 1355 struct sppp *sp = (struct sppp *) ifp; 1356 struct mbuf *m; 1357 1358 SPPP_LOCK(sp, RW_WRITER); 1359 /* 1360 * Process only the control protocol queue until we have at 1361 * least one NCP opened. 1362 */ 1363 IF_DEQUEUE(&sp->pp_cpq, m); 1364 if (m == NULL && sppp_is_ncp_opened(sp)) { 1365 IF_DEQUEUE(&sp->pp_fastq, m); 1366 if (m == NULL) 1367 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1368 } 1369 SPPP_UNLOCK(sp); 1370 return m; 1371 } 1372 1373 void 1374 sppp_abort_connect(struct ifnet *ifp) 1375 { 1376 struct sppp *sp = (struct sppp *)ifp; 1377 1378 SPPP_LOCK(sp, RW_WRITER); 1379 if (sp->pp_ondemand) { 1380 if (sp->pp_connecting) 1381 sppp_disconnect(sp); 1382 } else { 1383 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1384 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 1385 } 1386 SPPP_UNLOCK(sp); 1387 } 1388 1389 /* 1390 * Process an ioctl request. Called on low priority level. 1391 */ 1392 int 1393 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1394 { 1395 struct lwp *l = curlwp; /* XXX */ 1396 struct ifreq *ifr = (struct ifreq *) data; 1397 struct ifaddr *ifa = (struct ifaddr *) data; 1398 #ifdef SPPP_FILTER 1399 struct spppfilter *sf = (struct spppfilter *)data; 1400 struct bpf_program *nbp = &sf->bf; 1401 #endif 1402 struct sppp *sp = (struct sppp *) ifp; 1403 int error=0, going_up, going_down; 1404 u_long lcp_mru; 1405 1406 switch (cmd) { 1407 case SIOCINITIFADDR: 1408 ifa->ifa_rtrequest = p2p_rtrequest; 1409 break; 1410 1411 case SIOCSIFFLAGS: 1412 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1413 break; 1414 1415 SPPP_LOCK(sp, RW_WRITER); 1416 going_up = 1417 (ifp->if_flags & IFF_UP) && !sp->pp_connecting; 1418 going_down = 1419 ((ifp->if_flags & IFF_UP) == 0) && sp->pp_connecting; 1420 if ((ifp->if_flags & IFF_AUTO) && 1421 (ifp->if_flags & IFF_PASSIVE)) { 1422 ifp->if_flags &= ~IFF_AUTO; 1423 } 1424 1425 atomic_store_relaxed(&sp->pp_ondemand, 1426 (ifp->if_flags & IFF_AUTO) ? true : false); 1427 1428 if (going_up || going_down) { 1429 sppp_disconnect(sp); 1430 } 1431 if (going_up) { 1432 /* Always-on connection */ 1433 if (!sp->pp_ondemand) 1434 sppp_connect(sp); 1435 } else if (going_down) { 1436 SPPP_UNLOCK(sp); 1437 sppp_flush(ifp); 1438 SPPP_LOCK(sp, RW_WRITER); 1439 } 1440 SPPP_UNLOCK(sp); 1441 break; 1442 1443 case SIOCSIFMTU: 1444 if (ifr->ifr_mtu < PPP_MINMRU || 1445 ifr->ifr_mtu > PP_MTU) { 1446 error = EINVAL; 1447 break; 1448 } 1449 1450 error = ifioctl_common(ifp, cmd, data); 1451 if (error == ENETRESET) 1452 error = 0; 1453 1454 SPPP_LOCK(sp, RW_WRITER); 1455 lcp_mru = sp->lcp.mru; 1456 if (ifp->if_mtu < PP_MTU) { 1457 sp->lcp.mru = ifp->if_mtu; 1458 } else { 1459 sp->lcp.mru = PP_MTU; 1460 } 1461 if (lcp_mru != sp->lcp.mru) 1462 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1463 1464 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1465 ifp->if_mtu > sp->lcp.their_mru) { 1466 sp->pp_saved_mtu = ifp->if_mtu; 1467 ifp->if_mtu = sp->lcp.their_mru; 1468 1469 SPPP_DLOG(sp, "setting MTU " 1470 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 1471 sp->pp_saved_mtu, ifp->if_mtu); 1472 } 1473 SPPP_UNLOCK(sp); 1474 break; 1475 1476 case SIOCGIFMTU: 1477 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1478 error = 0; 1479 break; 1480 case SIOCADDMULTI: 1481 case SIOCDELMULTI: 1482 break; 1483 1484 case SPPPSETAUTHCFG: 1485 case SPPPSETLCPCFG: 1486 case SPPPSETNCPCFG: 1487 case SPPPSETIDLETO: 1488 case SPPPSETAUTHFAILURE: 1489 case SPPPSETDNSOPTS: 1490 case SPPPSETKEEPALIVE: 1491 #if defined(COMPAT_50) || defined(MODULAR) 1492 case __SPPPSETIDLETO50: 1493 case __SPPPSETKEEPALIVE50: 1494 #endif /* COMPAT_50 || MODULAR */ 1495 error = kauth_authorize_network(l->l_cred, 1496 KAUTH_NETWORK_INTERFACE, 1497 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1498 NULL); 1499 if (error) 1500 break; 1501 error = sppp_params(sp, cmd, data); 1502 break; 1503 1504 case SPPPGETAUTHCFG: 1505 case SPPPGETLCPCFG: 1506 case SPPPGETNCPCFG: 1507 case SPPPGETAUTHFAILURES: 1508 error = kauth_authorize_network(l->l_cred, 1509 KAUTH_NETWORK_INTERFACE, 1510 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1511 NULL); 1512 if (error) 1513 break; 1514 error = sppp_params(sp, cmd, data); 1515 break; 1516 1517 case SPPPGETSTATUS: 1518 case SPPPGETSTATUSNCP: 1519 case SPPPGETIDLETO: 1520 case SPPPGETDNSOPTS: 1521 case SPPPGETDNSADDRS: 1522 case SPPPGETKEEPALIVE: 1523 #if defined(COMPAT_50) || defined(MODULAR) 1524 case __SPPPGETIDLETO50: 1525 case __SPPPGETKEEPALIVE50: 1526 #endif /* COMPAT_50 || MODULAR */ 1527 case SPPPGETLCPSTATUS: 1528 case SPPPGETIPCPSTATUS: 1529 case SPPPGETIPV6CPSTATUS: 1530 error = sppp_params(sp, cmd, data); 1531 break; 1532 1533 #ifdef SPPP_FILTER 1534 case SPPPIOCSDIALFILT: { 1535 /* sp->pp_dial_filt is protected by pp_lock (SPP_LOCK()) */ 1536 struct bpf_program *bp = &sp->pp_dial_filt; 1537 1538 if (nbp->bf_len > BPF_MAXINSNS) 1539 return EINVAL; 1540 1541 SPPP_LOCK(sp, RW_WRITER); 1542 if (bp->bf_insns != NULL) { 1543 kmem_free(bp->bf_insns, 1544 sizeof(bp->bf_insns[0]) * bp->bf_len); 1545 bp->bf_insns = NULL; 1546 bp->bf_len = 0; 1547 } 1548 1549 if (nbp->bf_len != 0) { 1550 struct bpf_insn *newcode; 1551 size_t newsize = sizeof(newcode[0]) * nbp->bf_len; 1552 1553 newcode = kmem_alloc(newsize, KM_SLEEP); 1554 error = copyin((void *)nbp->bf_insns, 1555 (void *)newcode, newsize); 1556 if (error != 0) { 1557 SPPP_UNLOCK(sp); 1558 kmem_free(newcode, newsize); 1559 return error; 1560 } 1561 1562 if (!bpf_validate(newcode, nbp->bf_len)) { 1563 SPPP_UNLOCK(sp); 1564 kmem_free(newcode, newsize); 1565 return EINVAL; 1566 } 1567 1568 bp->bf_insns = newcode; 1569 bp->bf_len = nbp->bf_len; 1570 } 1571 SPPP_UNLOCK(sp); 1572 break; 1573 } 1574 case SPPPIOCSIACTIVE: 1575 /* sp->pp_active_filt_in is protected by pserialize & psref */ 1576 error = sppp_set_filter(sp, nbp, &sp->pp_active_filt_in); 1577 break; 1578 case SPPPIOCSOACTIVE: 1579 /* sp->pp_active_filt_out is protected by pserialize & psref */ 1580 error = sppp_set_filter(sp, nbp, &sp->pp_active_filt_out); 1581 break; 1582 #endif 1583 1584 default: 1585 error = ifioctl_common(ifp, cmd, data); 1586 break; 1587 } 1588 return (error); 1589 } 1590 1591 /* 1592 * PPP protocol implementation. 1593 */ 1594 1595 /* 1596 * Send PPP control protocol packet. 1597 */ 1598 static void 1599 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1600 u_char ident, u_short len, void *data) 1601 { 1602 struct ifnet *ifp = &sp->pp_if; 1603 struct lcp_header *lh; 1604 struct mbuf *m; 1605 size_t pkthdrlen; 1606 1607 KASSERT(SPPP_WLOCKED(sp)); 1608 1609 pkthdrlen = ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING) ? 1610 2 : PPP_HEADER_LEN; 1611 1612 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1613 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1614 MGETHDR(m, M_DONTWAIT, MT_DATA); 1615 if (! m) { 1616 return; 1617 } 1618 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1619 m_reset_rcvif(m); 1620 1621 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 1622 *mtod(m, uint16_t *) = htons(proto); 1623 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1624 } else { 1625 struct ppp_header *h; 1626 h = mtod(m, struct ppp_header *); 1627 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1628 h->control = PPP_UI; /* Unnumbered Info */ 1629 h->protocol = htons(proto); /* Link Control Protocol */ 1630 lh = (struct lcp_header *)(h + 1); 1631 } 1632 lh->type = type; 1633 lh->ident = ident; 1634 lh->len = htons(LCP_HEADER_LEN + len); 1635 if (len) 1636 memcpy(lh + 1, data, len); 1637 1638 if (sppp_debug_enabled(sp)) { 1639 char pbuf[SPPP_PROTO_NAMELEN]; 1640 char tbuf[SPPP_CPTYPE_NAMELEN]; 1641 const char *pname, *cpname; 1642 1643 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1644 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1645 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 1646 pname, cpname, lh->ident, ntohs(lh->len)); 1647 if (len) 1648 sppp_print_bytes((u_char *)(lh + 1), len); 1649 addlog(">\n"); 1650 } 1651 if (IF_QFULL(&sp->pp_cpq)) { 1652 IF_DROP(&sp->pp_fastq); 1653 IF_DROP(&ifp->if_snd); 1654 m_freem(m); 1655 return; 1656 } 1657 1658 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1659 IF_ENQUEUE(&sp->pp_cpq, m); 1660 1661 if (! (ifp->if_flags & IFF_OACTIVE)) { 1662 SPPP_UNLOCK(sp); 1663 if_start_lock(ifp); 1664 SPPP_LOCK(sp, RW_WRITER); 1665 } 1666 } 1667 1668 static void 1669 sppp_cp_to_lcp(void *xsp) 1670 { 1671 struct sppp *sp = xsp; 1672 1673 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1674 } 1675 1676 static void 1677 sppp_cp_to_ipcp(void *xsp) 1678 { 1679 struct sppp *sp = xsp; 1680 1681 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1682 } 1683 1684 static void 1685 sppp_cp_to_ipv6cp(void *xsp) 1686 { 1687 struct sppp *sp = xsp; 1688 1689 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1690 } 1691 1692 static void 1693 sppp_cp_to_pap(void *xsp) 1694 { 1695 struct sppp *sp = xsp; 1696 1697 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1698 } 1699 1700 static void 1701 sppp_cp_to_chap(void *xsp) 1702 { 1703 struct sppp *sp = xsp; 1704 1705 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1706 } 1707 1708 static void 1709 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1710 { 1711 struct sppp_cp *scp; 1712 typedef void (*sppp_co_cb_t)(void *); 1713 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1714 [IDX_LCP] = sppp_cp_to_lcp, 1715 [IDX_IPCP] = sppp_cp_to_ipcp, 1716 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1717 [IDX_PAP] = sppp_cp_to_pap, 1718 [IDX_CHAP] = sppp_cp_to_chap, 1719 }; 1720 1721 scp = &sp->scp[cp->protoidx]; 1722 scp->state = STATE_INITIAL; 1723 scp->fail_counter = 0; 1724 scp->seq = 0; 1725 scp->rseq = 0; 1726 1727 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1728 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1729 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1730 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1731 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1732 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1733 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1734 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1735 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1736 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1737 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1738 1739 callout_init(&scp->ch, CALLOUT_MPSAFE); 1740 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1741 } 1742 1743 static void 1744 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1745 { 1746 struct sppp_cp *scp; 1747 scp = &sp->scp[cp->protoidx]; 1748 1749 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1750 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1751 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1752 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1753 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1754 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1755 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1756 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1757 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1758 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1759 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1760 1761 callout_halt(&scp->ch, NULL); 1762 callout_destroy(&scp->ch); 1763 1764 m_freem(scp->mbuf_confreq); 1765 scp->mbuf_confreq = NULL; 1766 m_freem(scp->mbuf_confnak); 1767 scp->mbuf_confnak = NULL; 1768 } 1769 1770 /* 1771 * Handle incoming PPP control protocol packets. 1772 */ 1773 static void 1774 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1775 { 1776 const bool debug = sppp_debug_enabled(sp); 1777 struct ifnet *ifp = &sp->pp_if; 1778 struct sppp_cp *scp = &sp->scp[cp->protoidx]; 1779 struct lcp_header *h; 1780 int printlen, len = m->m_pkthdr.len; 1781 u_char *p; 1782 uint32_t u32; 1783 char tbuf[SPPP_CPTYPE_NAMELEN]; 1784 const char *cpname; 1785 1786 KASSERT(SPPP_WLOCKED(sp)); 1787 1788 if (len < 4) { 1789 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n", 1790 cp->name, len); 1791 goto out; 1792 } 1793 h = mtod(m, struct lcp_header *); 1794 if (debug) { 1795 printlen = ntohs(h->len); 1796 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1797 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d", 1798 cp->name, sppp_state_name(scp->state), 1799 cpname, h->ident, printlen); 1800 if (len < printlen) 1801 printlen = len; 1802 if (printlen > 4) 1803 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1804 addlog(">\n"); 1805 } 1806 if (len > ntohs(h->len)) 1807 len = ntohs(h->len); 1808 p = (u_char *)(h + 1); 1809 switch (h->type) { 1810 case CONF_REQ: 1811 if (len < 4) { 1812 SPPP_DLOG(sp,"%s invalid conf-req length %d\n", 1813 cp->name, len); 1814 if_statinc(ifp, if_ierrors); 1815 break; 1816 } 1817 1818 scp->rcr_type = CP_RCR_NONE; 1819 scp->rconfid = h->ident; 1820 m_freem(scp->mbuf_confreq); 1821 scp->mbuf_confreq = m; 1822 m = NULL; 1823 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1824 break; 1825 case CONF_ACK: 1826 if (h->ident != scp->confid) { 1827 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1828 cp->name, h->ident, scp->confid); 1829 if_statinc(ifp, if_ierrors); 1830 break; 1831 } 1832 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1833 break; 1834 case CONF_NAK: 1835 case CONF_REJ: 1836 if (h->ident != scp->confid) { 1837 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1838 cp->name, h->ident, scp->confid); 1839 if_statinc(ifp, if_ierrors); 1840 break; 1841 } 1842 1843 m_freem(scp->mbuf_confnak); 1844 scp->mbuf_confnak = m; 1845 m = NULL; 1846 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1847 break; 1848 case TERM_REQ: 1849 scp->rseq = h->ident; 1850 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1851 break; 1852 case TERM_ACK: 1853 if (h->ident != scp->confid && 1854 h->ident != scp->seq) { 1855 SPPP_DLOG(sp, "%s id mismatch " 1856 "0x%x != 0x%x and 0x%x != %0lx\n", 1857 cp->name, h->ident, scp->confid, 1858 h->ident, scp->seq); 1859 if_statinc(ifp, if_ierrors); 1860 break; 1861 } 1862 1863 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1864 break; 1865 case CODE_REJ: 1866 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1867 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1868 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, " 1869 "danger will robinson\n", cp->name, cpname); 1870 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1871 break; 1872 case PROTO_REJ: 1873 { 1874 int catastrophic; 1875 const struct cp *upper; 1876 int i; 1877 uint16_t proto; 1878 1879 catastrophic = 0; 1880 upper = NULL; 1881 proto = p[0] << 8 | p[1]; 1882 for (i = 0; i < IDX_COUNT; i++) { 1883 if (cps[i]->proto == proto) { 1884 upper = cps[i]; 1885 break; 1886 } 1887 } 1888 if (upper == NULL) 1889 catastrophic++; 1890 1891 if (debug) { 1892 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1893 SPPP_LOG(sp, LOG_INFO, 1894 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1895 cp->name, catastrophic ? '-' : '+', 1896 cpname, proto, upper ? upper->name : "unknown", 1897 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1898 } 1899 1900 /* 1901 * if we got RXJ+ against conf-req, the peer does not implement 1902 * this particular protocol type. terminate the protocol. 1903 */ 1904 if (upper && !catastrophic) { 1905 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1906 sppp_wq_add(sp->wq_cp, 1907 &sp->scp[upper->protoidx].work_close); 1908 break; 1909 } 1910 } 1911 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1912 break; 1913 } 1914 case DISC_REQ: 1915 if (cp->proto != PPP_LCP) 1916 goto illegal; 1917 /* Discard the packet. */ 1918 break; 1919 case ECHO_REQ: 1920 if (cp->proto != PPP_LCP) 1921 goto illegal; 1922 if (scp->state != STATE_OPENED) { 1923 SPPP_DLOG(sp, "lcp echo req but lcp closed\n"); 1924 if_statinc(ifp, if_ierrors); 1925 break; 1926 } 1927 if (len < 8) { 1928 SPPP_DLOG(sp, "invalid lcp echo request " 1929 "packet length: %d bytes\n", len); 1930 break; 1931 } 1932 memcpy(&u32, h + 1, sizeof u32); 1933 if (ntohl(u32) == sp->lcp.magic) { 1934 /* Line loopback mode detected. */ 1935 SPPP_DLOG(sp, "loopback\n"); 1936 1937 /* Shut down the PPP link. */ 1938 if (sp->pp_flags & PP_IFDOWN) 1939 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 1940 1941 /* Reset the PPP link. */ 1942 sppp_wq_add(sp->wq_cp, 1943 &sp->scp[IDX_LCP].work_close); 1944 sppp_wq_add(sp->wq_cp, 1945 &sp->scp[IDX_LCP].work_open); 1946 break; 1947 } 1948 u32 = htonl(sp->lcp.magic); 1949 memcpy(h + 1, &u32, sizeof u32); 1950 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n"); 1951 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1952 h + 1); 1953 break; 1954 case ECHO_REPLY: 1955 if (cp->proto != PPP_LCP) 1956 goto illegal; 1957 if (h->ident != sp->lcp.echoid) { 1958 if_statinc(ifp, if_ierrors); 1959 break; 1960 } 1961 if (len < 8) { 1962 SPPP_DLOG(sp, "lcp invalid echo reply " 1963 "packet length: %d bytes\n", len); 1964 break; 1965 } 1966 SPPP_DLOG(sp, "lcp got echo rep\n"); 1967 memcpy(&u32, h + 1, sizeof u32); 1968 if (ntohl(u32) != sp->lcp.magic) 1969 sp->pp_alivecnt = 0; 1970 break; 1971 default: 1972 /* Unknown packet type -- send Code-Reject packet. */ 1973 illegal: 1974 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n", 1975 cp->name, h->type); 1976 sppp_cp_send(sp, cp->proto, CODE_REJ, 1977 ++scp->seq, m->m_pkthdr.len, h); 1978 if_statinc(ifp, if_ierrors); 1979 } 1980 1981 out: 1982 m_freem(m); 1983 } 1984 1985 /* 1986 * The generic part of all Up/Down/Open/Close/TO event handlers. 1987 * Basically, the state transition handling in the automaton. 1988 */ 1989 static void 1990 sppp_up_event(struct sppp *sp, void *xcp) 1991 { 1992 const struct cp *cp = xcp; 1993 1994 KASSERT(SPPP_WLOCKED(sp)); 1995 KASSERT(!cpu_softintr_p()); 1996 1997 if ((cp->flags & CP_AUTH) != 0 && 1998 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1999 return; 2000 2001 SPPP_DLOG(sp, "%s up(%s)\n", cp->name, 2002 sppp_state_name(sp->scp[cp->protoidx].state)); 2003 2004 switch (sp->scp[cp->protoidx].state) { 2005 case STATE_INITIAL: 2006 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2007 break; 2008 case STATE_STARTING: 2009 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2010 (cp->scr)(sp); 2011 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2012 break; 2013 default: 2014 SPPP_LOG(sp, LOG_DEBUG, 2015 "%s illegal up in state %s\n", cp->name, 2016 sppp_state_name(sp->scp[cp->protoidx].state)); 2017 } 2018 } 2019 2020 static void 2021 sppp_down_event(struct sppp *sp, void *xcp) 2022 { 2023 const struct cp *cp = xcp; 2024 2025 KASSERT(SPPP_WLOCKED(sp)); 2026 KASSERT(!cpu_softintr_p()); 2027 2028 if ((cp->flags & CP_AUTH) != 0 && 2029 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2030 return; 2031 2032 SPPP_DLOG(sp, "%s down(%s)\n", cp->name, 2033 sppp_state_name(sp->scp[cp->protoidx].state)); 2034 2035 switch (sp->scp[cp->protoidx].state) { 2036 case STATE_CLOSED: 2037 case STATE_CLOSING: 2038 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2039 break; 2040 case STATE_STOPPED: 2041 (cp->tls)(cp, sp); 2042 /* fall through */ 2043 case STATE_STOPPING: 2044 case STATE_REQ_SENT: 2045 case STATE_ACK_RCVD: 2046 case STATE_ACK_SENT: 2047 sppp_cp_change_state(cp, sp, STATE_STARTING); 2048 break; 2049 case STATE_OPENED: 2050 (cp->tld)(sp); 2051 sppp_cp_change_state(cp, sp, STATE_STARTING); 2052 break; 2053 default: 2054 /* 2055 * a down event may be caused regardless 2056 * of state just in LCP case. 2057 */ 2058 if (cp->proto == PPP_LCP) 2059 break; 2060 2061 SPPP_LOG(sp, LOG_DEBUG, 2062 "%s illegal down in state %s\n", cp->name, 2063 sppp_state_name(sp->scp[cp->protoidx].state)); 2064 } 2065 } 2066 2067 static void 2068 sppp_open_event(struct sppp *sp, void *xcp) 2069 { 2070 const struct cp *cp = xcp; 2071 2072 KASSERT(SPPP_WLOCKED(sp)); 2073 KASSERT(!cpu_softintr_p()); 2074 2075 if ((cp->flags & CP_AUTH) != 0 && 2076 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2077 return; 2078 2079 SPPP_DLOG(sp, "%s open(%s)\n", cp->name, 2080 sppp_state_name(sp->scp[cp->protoidx].state)); 2081 2082 switch (sp->scp[cp->protoidx].state) { 2083 case STATE_INITIAL: 2084 sppp_cp_change_state(cp, sp, STATE_STARTING); 2085 (cp->tls)(cp, sp); 2086 break; 2087 case STATE_STARTING: 2088 break; 2089 case STATE_CLOSED: 2090 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2091 sp->lcp.protos |= (1 << cp->protoidx); 2092 (cp->scr)(sp); 2093 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2094 break; 2095 case STATE_STOPPED: 2096 case STATE_STOPPING: 2097 case STATE_REQ_SENT: 2098 case STATE_ACK_RCVD: 2099 case STATE_ACK_SENT: 2100 case STATE_OPENED: 2101 break; 2102 case STATE_CLOSING: 2103 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2104 break; 2105 } 2106 } 2107 2108 static void 2109 sppp_close_event(struct sppp *sp, void *xcp) 2110 { 2111 const struct cp *cp = xcp; 2112 2113 KASSERT(SPPP_WLOCKED(sp)); 2114 KASSERT(!cpu_softintr_p()); 2115 2116 if ((cp->flags & CP_AUTH) != 0 && 2117 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2118 return; 2119 2120 SPPP_DLOG(sp, "%s close(%s)\n", cp->name, 2121 sppp_state_name(sp->scp[cp->protoidx].state)); 2122 2123 switch (sp->scp[cp->protoidx].state) { 2124 case STATE_INITIAL: 2125 case STATE_CLOSED: 2126 case STATE_CLOSING: 2127 break; 2128 case STATE_STARTING: 2129 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2130 (cp->tlf)(cp, sp); 2131 break; 2132 case STATE_STOPPED: 2133 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2134 break; 2135 case STATE_STOPPING: 2136 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2137 break; 2138 case STATE_OPENED: 2139 (cp->tld)(sp); 2140 /* fall through */ 2141 case STATE_REQ_SENT: 2142 case STATE_ACK_RCVD: 2143 case STATE_ACK_SENT: 2144 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 2145 if ((cp->flags & CP_AUTH) == 0) { 2146 sppp_cp_send(sp, cp->proto, TERM_REQ, 2147 ++sp->scp[cp->protoidx].seq, 0, 0); 2148 } 2149 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2150 break; 2151 } 2152 } 2153 2154 static void 2155 sppp_to_event(struct sppp *sp, void *xcp) 2156 { 2157 const struct cp *cp = xcp; 2158 2159 KASSERT(SPPP_WLOCKED(sp)); 2160 KASSERT(!cpu_softintr_p()); 2161 2162 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name, 2163 sppp_state_name(sp->scp[cp->protoidx].state), 2164 sp->scp[cp->protoidx].rst_counter); 2165 2166 if (--sp->scp[cp->protoidx].rst_counter < 0) 2167 /* TO- event */ 2168 switch (sp->scp[cp->protoidx].state) { 2169 case STATE_CLOSING: 2170 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2171 (cp->tlf)(cp, sp); 2172 break; 2173 case STATE_STOPPING: 2174 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2175 (cp->tlf)(cp, sp); 2176 break; 2177 case STATE_REQ_SENT: 2178 case STATE_ACK_RCVD: 2179 case STATE_ACK_SENT: 2180 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2181 (cp->tlf)(cp, sp); 2182 break; 2183 } 2184 else 2185 /* TO+ event */ 2186 switch (sp->scp[cp->protoidx].state) { 2187 case STATE_CLOSING: 2188 case STATE_STOPPING: 2189 if ((cp->flags & CP_AUTH) == 0) { 2190 sppp_cp_send(sp, cp->proto, TERM_REQ, 2191 ++sp->scp[cp->protoidx].seq, 0, 0); 2192 } 2193 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2194 break; 2195 case STATE_REQ_SENT: 2196 case STATE_ACK_RCVD: 2197 (cp->scr)(sp); 2198 /* sppp_cp_change_state() will restart the timer */ 2199 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2200 break; 2201 case STATE_ACK_SENT: 2202 (cp->scr)(sp); 2203 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2204 break; 2205 } 2206 } 2207 static void 2208 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2209 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2210 { 2211 struct ifnet *ifp = &sp->pp_if; 2212 u_char ctype; 2213 2214 if (type == CP_RCR_ERR) { 2215 /* parse error, shut down */ 2216 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2217 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2218 } else if (type == CP_RCR_ACK) { 2219 /* RCR+ event */ 2220 ctype = CONF_ACK; 2221 switch (sp->scp[cp->protoidx].state) { 2222 case STATE_OPENED: 2223 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2224 cp->tld(sp); 2225 cp->scr(sp); 2226 cp->screply(cp, sp, ctype, ident, msglen, msg); 2227 break; 2228 case STATE_REQ_SENT: 2229 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2230 /* fall through */ 2231 case STATE_ACK_SENT: 2232 cp->screply(cp, sp, ctype, ident, msglen, msg); 2233 break; 2234 case STATE_STOPPED: 2235 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2236 cp->scr(sp); 2237 cp->screply(cp, sp, ctype, ident, msglen, msg); 2238 break; 2239 case STATE_ACK_RCVD: 2240 sppp_cp_change_state(cp, sp, STATE_OPENED); 2241 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2242 cp->tlu(sp); 2243 cp->screply(cp, sp, ctype, ident, msglen, msg); 2244 break; 2245 case STATE_CLOSING: 2246 case STATE_STOPPING: 2247 break; 2248 case STATE_CLOSED: 2249 if ((cp->flags & CP_AUTH) == 0) { 2250 sppp_cp_send(sp, cp->proto, TERM_ACK, 2251 ident, 0, 0); 2252 } 2253 break; 2254 default: 2255 SPPP_LOG(sp, LOG_DEBUG, 2256 "%s illegal RCR+ in state %s\n", cp->name, 2257 sppp_state_name(sp->scp[cp->protoidx].state)); 2258 if_statinc(ifp, if_ierrors); 2259 } 2260 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2261 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2262 /* RCR- event */ 2263 switch (sp->scp[cp->protoidx].state) { 2264 case STATE_OPENED: 2265 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2266 cp->tld(sp); 2267 cp->scr(sp); 2268 cp->screply(cp, sp, ctype, ident, msglen, msg); 2269 break; 2270 case STATE_ACK_SENT: 2271 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2272 /* fall through */ 2273 case STATE_REQ_SENT: 2274 cp->screply(cp, sp, ctype, ident, msglen, msg); 2275 break; 2276 case STATE_STOPPED: 2277 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2278 cp->scr(sp); 2279 cp->screply(cp, sp, ctype, ident, msglen, msg); 2280 break; 2281 case STATE_ACK_RCVD: 2282 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2283 cp->screply(cp, sp, ctype, ident, msglen, msg); 2284 break; 2285 case STATE_CLOSING: 2286 case STATE_STOPPING: 2287 break; 2288 case STATE_CLOSED: 2289 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2290 if ((cp->flags & CP_AUTH) == 0) { 2291 sppp_cp_send(sp, cp->proto, TERM_ACK, 2292 ident, 0, 0); 2293 } 2294 break; 2295 default: 2296 SPPP_LOG(sp, LOG_DEBUG, 2297 "%s illegal RCR- in state %s\n", cp->name, 2298 sppp_state_name(sp->scp[cp->protoidx].state)); 2299 if_statinc(ifp, if_ierrors); 2300 } 2301 } 2302 } 2303 2304 static void 2305 sppp_rcr_event(struct sppp *sp, void *xcp) 2306 { 2307 const struct cp *cp = xcp; 2308 struct sppp_cp *scp; 2309 struct lcp_header *h; 2310 struct mbuf *m; 2311 enum cp_rcr_type type; 2312 size_t len; 2313 uint8_t *buf; 2314 size_t blen, rlen; 2315 uint8_t ident; 2316 2317 KASSERT(!cpu_softintr_p()); 2318 2319 scp = &sp->scp[cp->protoidx]; 2320 2321 if (cp->parse_confreq != NULL) { 2322 m = scp->mbuf_confreq; 2323 if (m == NULL) 2324 return; 2325 scp->mbuf_confreq = NULL; 2326 2327 h = mtod(m, struct lcp_header *); 2328 if (h->type != CONF_REQ) { 2329 m_freem(m); 2330 return; 2331 } 2332 2333 ident = h->ident; 2334 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2335 2336 type = (cp->parse_confreq)(sp, h, len, 2337 &buf, &blen, &rlen); 2338 m_freem(m); 2339 } else { 2340 /* mbuf_cofreq is already parsed and freed */ 2341 type = scp->rcr_type; 2342 ident = scp->rconfid; 2343 buf = NULL; 2344 blen = rlen = 0; 2345 } 2346 2347 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2348 2349 if (buf != NULL) 2350 kmem_free(buf, blen); 2351 } 2352 2353 static void 2354 sppp_rca_event(struct sppp *sp, void *xcp) 2355 { 2356 struct ifnet *ifp = &sp->pp_if; 2357 const struct cp *cp = xcp; 2358 2359 KASSERT(!cpu_softintr_p()); 2360 2361 switch (sp->scp[cp->protoidx].state) { 2362 case STATE_CLOSED: 2363 case STATE_STOPPED: 2364 if ((cp->flags & CP_AUTH) == 0) { 2365 sppp_cp_send(sp, cp->proto, TERM_ACK, 2366 sp->scp[cp->protoidx].rconfid, 0, 0); 2367 } 2368 break; 2369 case STATE_CLOSING: 2370 case STATE_STOPPING: 2371 break; 2372 case STATE_REQ_SENT: 2373 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2374 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2375 break; 2376 case STATE_OPENED: 2377 (cp->tld)(sp); 2378 /* fall through */ 2379 case STATE_ACK_RCVD: 2380 (cp->scr)(sp); 2381 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2382 break; 2383 case STATE_ACK_SENT: 2384 sppp_cp_change_state(cp, sp, STATE_OPENED); 2385 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2386 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2387 (cp->tlu)(sp); 2388 break; 2389 default: 2390 SPPP_LOG(sp, LOG_DEBUG, 2391 "%s illegal RCA in state %s\n", cp->name, 2392 sppp_state_name(sp->scp[cp->protoidx].state)); 2393 if_statinc(ifp, if_ierrors); 2394 } 2395 } 2396 2397 static void 2398 sppp_rcn_event(struct sppp *sp, void *xcp) 2399 { 2400 const struct cp *cp = xcp; 2401 struct sppp_cp *scp; 2402 struct lcp_header *h; 2403 struct mbuf *m; 2404 struct ifnet *ifp = &sp->pp_if; 2405 size_t len; 2406 2407 KASSERT(!cpu_softintr_p()); 2408 2409 scp = &sp->scp[cp->protoidx]; 2410 m = scp->mbuf_confnak; 2411 if (m == NULL) 2412 return; 2413 scp->mbuf_confnak = NULL; 2414 2415 h = mtod(m, struct lcp_header *); 2416 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2417 2418 switch (h->type) { 2419 case CONF_NAK: 2420 (cp->parse_confnak)(sp, h, len); 2421 break; 2422 case CONF_REJ: 2423 (cp->parse_confrej)(sp, h, len); 2424 break; 2425 default: 2426 m_freem(m); 2427 return; 2428 } 2429 2430 m_freem(m); 2431 2432 switch (scp->state) { 2433 case STATE_CLOSED: 2434 case STATE_STOPPED: 2435 if ((cp->flags & CP_AUTH) == 0) { 2436 sppp_cp_send(sp, cp->proto, TERM_ACK, 2437 scp->rconfid, 0, 0); 2438 } 2439 break; 2440 case STATE_REQ_SENT: 2441 case STATE_ACK_SENT: 2442 scp->rst_counter = sp->lcp.max_configure; 2443 (cp->scr)(sp); 2444 break; 2445 case STATE_OPENED: 2446 (cp->tld)(sp); 2447 /* fall through */ 2448 case STATE_ACK_RCVD: 2449 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2450 (cp->scr)(sp); 2451 break; 2452 case STATE_CLOSING: 2453 case STATE_STOPPING: 2454 break; 2455 default: 2456 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n", 2457 cp->name, sppp_state_name(scp->state)); 2458 if_statinc(ifp, if_ierrors); 2459 } 2460 } 2461 2462 static void 2463 sppp_rtr_event(struct sppp *sp, void *xcp) 2464 { 2465 struct ifnet *ifp = &sp->pp_if; 2466 const struct cp *cp = xcp; 2467 2468 KASSERT(!cpu_softintr_p()); 2469 2470 switch (sp->scp[cp->protoidx].state) { 2471 case STATE_ACK_RCVD: 2472 case STATE_ACK_SENT: 2473 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2474 break; 2475 case STATE_CLOSED: 2476 case STATE_STOPPED: 2477 case STATE_CLOSING: 2478 case STATE_STOPPING: 2479 case STATE_REQ_SENT: 2480 break; 2481 case STATE_OPENED: 2482 (cp->tld)(sp); 2483 sp->scp[cp->protoidx].rst_counter = 0; 2484 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2485 break; 2486 default: 2487 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n", 2488 cp->name, 2489 sppp_state_name(sp->scp[cp->protoidx].state)); 2490 if_statinc(ifp, if_ierrors); 2491 return; 2492 } 2493 2494 /* Send Terminate-Ack packet. */ 2495 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name); 2496 if ((cp->flags & CP_AUTH) == 0) { 2497 sppp_cp_send(sp, cp->proto, TERM_ACK, 2498 sp->scp[cp->protoidx].rseq, 0, 0); 2499 } 2500 } 2501 2502 static void 2503 sppp_rta_event(struct sppp *sp, void *xcp) 2504 { 2505 const struct cp *cp = xcp; 2506 struct ifnet *ifp = &sp->pp_if; 2507 2508 KASSERT(!cpu_softintr_p()); 2509 2510 switch (sp->scp[cp->protoidx].state) { 2511 case STATE_CLOSED: 2512 case STATE_STOPPED: 2513 case STATE_REQ_SENT: 2514 case STATE_ACK_SENT: 2515 break; 2516 case STATE_CLOSING: 2517 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2518 (cp->tlf)(cp, sp); 2519 break; 2520 case STATE_STOPPING: 2521 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2522 (cp->tlf)(cp, sp); 2523 break; 2524 case STATE_ACK_RCVD: 2525 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2526 break; 2527 case STATE_OPENED: 2528 (cp->tld)(sp); 2529 (cp->scr)(sp); 2530 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2531 break; 2532 default: 2533 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n", 2534 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2535 if_statinc(ifp, if_ierrors); 2536 } 2537 } 2538 2539 static void 2540 sppp_rxj_event(struct sppp *sp, void *xcp) 2541 { 2542 const struct cp *cp = xcp; 2543 struct ifnet *ifp = &sp->pp_if; 2544 2545 KASSERT(!cpu_softintr_p()); 2546 2547 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2548 switch (sp->scp[cp->protoidx].state) { 2549 case STATE_CLOSED: 2550 case STATE_STOPPED: 2551 case STATE_REQ_SENT: 2552 case STATE_ACK_SENT: 2553 case STATE_CLOSING: 2554 case STATE_STOPPING: 2555 case STATE_OPENED: 2556 break; 2557 case STATE_ACK_RCVD: 2558 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2559 break; 2560 default: 2561 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n", 2562 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2563 if_statinc(ifp, if_ierrors); 2564 } 2565 } 2566 2567 /* 2568 * Change the state of a control protocol in the state automaton. 2569 * Takes care of starting/stopping the restart timer. 2570 */ 2571 void 2572 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2573 { 2574 2575 KASSERT(SPPP_WLOCKED(sp)); 2576 2577 sp->scp[cp->protoidx].state = newstate; 2578 callout_stop(&sp->scp[cp->protoidx].ch); 2579 switch (newstate) { 2580 case STATE_INITIAL: 2581 case STATE_STARTING: 2582 case STATE_CLOSED: 2583 case STATE_STOPPED: 2584 case STATE_OPENED: 2585 break; 2586 case STATE_CLOSING: 2587 case STATE_STOPPING: 2588 case STATE_REQ_SENT: 2589 case STATE_ACK_RCVD: 2590 case STATE_ACK_SENT: 2591 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2592 break; 2593 } 2594 } 2595 2596 /* 2597 *--------------------------------------------------------------------------* 2598 * * 2599 * The LCP implementation. * 2600 * * 2601 *--------------------------------------------------------------------------* 2602 */ 2603 static void 2604 sppp_lcp_init(struct sppp *sp) 2605 { 2606 2607 KASSERT(SPPP_WLOCKED(sp)); 2608 2609 sppp_cp_init(&lcp, sp); 2610 2611 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2612 sp->lcp.magic = 0; 2613 sp->lcp.protos = 0; 2614 sp->lcp.max_terminate = 2; 2615 sp->lcp.max_configure = 10; 2616 sp->lcp.max_failure = 10; 2617 sp->lcp.lower_running = false; 2618 2619 /* 2620 * Initialize counters and timeout values. Note that we don't 2621 * use the 3 seconds suggested in RFC 1661 since we are likely 2622 * running on a fast link. XXX We should probably implement 2623 * the exponential backoff option. Note that these values are 2624 * relevant for all control protocols, not just LCP only. 2625 */ 2626 sp->lcp.timeout = 1 * hz; 2627 } 2628 2629 static void 2630 sppp_lcp_up(struct sppp *sp, void *xcp) 2631 { 2632 2633 KASSERT(SPPP_WLOCKED(sp)); 2634 2635 /* Initialize activity timestamp: opening a connection is an activity */ 2636 atomic_store_relaxed(&sp->pp_last_receive, time_uptime32); 2637 atomic_store_relaxed(&sp->pp_last_activity, time_uptime32); 2638 2639 sppp_up_event(sp, xcp); 2640 } 2641 2642 static void 2643 sppp_lcp_down(struct sppp *sp, void *xcp) 2644 { 2645 const struct cp *cp = xcp; 2646 int pidx = cp->protoidx; 2647 2648 KASSERT(SPPP_WLOCKED(sp)); 2649 KASSERT(!cpu_softintr_p()); 2650 2651 sppp_down_event(sp, xcp); 2652 2653 switch (sp->scp[pidx].state) { 2654 case STATE_STARTING: 2655 /* 2656 * Req-Sent/Ack-Sent/Ack-Rcvd -> Starting: 2657 * This transition requires an extra TLS action. 2658 * * sequence of events/actions: 2659 * 1. Closing -> Closed : Triggers TLF action. 2660 * 2. Closed -> Req-Sent : Occurs on Open event. 2661 * 3. Req-Sent -> Ack-Sent...: (Optional state progression) 2662 * 4. Req-Sent/Ack-Sent/Ack-Rcvd -> Starting: 2663 * - Triggered by a Down event caused by the previous TLF action. 2664 * - This specific transition does NOT trigger another TLS action. 2665 */ 2666 cp->tls(cp, sp); 2667 break; 2668 case STATE_INITIAL: 2669 /* 2670 * Closing -> Initial: 2671 * A Down event in the Closing state triggers a transition to 2672 * Initial state without a TLF action. Since the lower layer 2673 * will attempt to reconnect, we explicitly stop it here. 2674 */ 2675 cp->tlf(cp, sp); 2676 break; 2677 } 2678 2679 SPPP_DLOG(sp, "Down event (carrier loss)\n"); 2680 2681 sp->scp[pidx].fail_counter = 0; 2682 } 2683 2684 static void 2685 sppp_lcp_open(struct sppp *sp, void *xcp) 2686 { 2687 2688 KASSERT(SPPP_WLOCKED(sp)); 2689 KASSERT(!cpu_softintr_p()); 2690 2691 sp->scp[IDX_LCP].fail_counter = 0; 2692 2693 if (sp->pp_if.if_mtu < PP_MTU) { 2694 sp->lcp.mru = sp->pp_if.if_mtu; 2695 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2696 } else { 2697 sp->lcp.mru = PP_MTU; 2698 } 2699 sp->lcp.their_mru = PP_MTU; 2700 2701 /* 2702 * If we are authenticator, negotiate LCP_AUTH 2703 */ 2704 if (sp->hisauth.proto != PPP_NOPROTO) 2705 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2706 else 2707 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2708 sp->pp_flags &= ~PP_NEEDAUTH; 2709 sppp_open_event(sp, xcp); 2710 } 2711 2712 /* 2713 * Analyze a configure request. Return true if it was agreeable, and 2714 * caused action sca, false if it has been rejected or nak'ed, and 2715 * caused action scn. (The return value is used to make the state 2716 * transition decision in the state automaton.) 2717 */ 2718 static enum cp_rcr_type 2719 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2720 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2721 { 2722 const bool debug = sppp_debug_enabled(sp); 2723 u_char *buf, *r, *p, l, blen; 2724 enum cp_rcr_type type; 2725 int len, rlen; 2726 uint32_t nmagic; 2727 u_short authproto; 2728 char lbuf[SPPP_LCPOPT_NAMELEN]; 2729 2730 KASSERT(SPPP_WLOCKED(sp)); 2731 2732 if (origlen < sizeof(*h)) 2733 return CP_RCR_DROP; 2734 2735 origlen -= sizeof(*h); 2736 type = CP_RCR_NONE; 2737 type = 0; 2738 2739 if (origlen <= 0) 2740 return CP_RCR_DROP; 2741 else 2742 blen = origlen; 2743 2744 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2745 if (buf == NULL) 2746 return CP_RCR_DROP; 2747 2748 if (debug) 2749 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:"); 2750 2751 /* pass 1: check for things that need to be rejected */ 2752 p = (void *)(h + 1); 2753 r = buf; 2754 rlen = 0; 2755 for (len = origlen; len > 1; len-= l, p += l) { 2756 l = p[1]; 2757 if (l == 0) 2758 break; 2759 2760 /* Sanity check option length */ 2761 if (l > len) { 2762 /* 2763 * Malicious option - drop immediately. 2764 * XXX Maybe we should just RXJ it? 2765 */ 2766 if (debug) 2767 addlog("\n"); 2768 2769 SPPP_LOG(sp, LOG_DEBUG, 2770 "received malicious LCP option 0x%02x, " 2771 "length 0x%02x, (len: 0x%02x) dropping.\n", 2772 p[0], l, len); 2773 type = CP_RCR_ERR; 2774 goto end; 2775 } 2776 if (debug) 2777 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2778 switch (p[0]) { 2779 case LCP_OPT_MAGIC: 2780 /* Magic number. */ 2781 /* fall through, both are same length */ 2782 case LCP_OPT_ASYNC_MAP: 2783 /* Async control character map. */ 2784 if (len >= 6 || l == 6) 2785 continue; 2786 if (debug) 2787 addlog(" [invalid]"); 2788 break; 2789 case LCP_OPT_MP_EID: 2790 if (len >= l && l >= 3) { 2791 switch (p[2]) { 2792 case 0: if (l==3+ 0) continue;break; 2793 case 2: if (l==3+ 4) continue;break; 2794 case 3: if (l==3+ 6) continue;break; 2795 case 6: if (l==3+16) continue;break; 2796 case 1: /* FALLTHROUGH */ 2797 case 4: if (l<=3+20) continue;break; 2798 case 5: if (l<=3+15) continue;break; 2799 /* XXX should it be default: continue;? */ 2800 } 2801 } 2802 if (debug) 2803 addlog(" [invalid class %d len %d]", p[2], l); 2804 break; 2805 case LCP_OPT_MP_SSNHF: 2806 if (len >= 2 && l == 2) { 2807 if (debug) 2808 addlog(" [rej]"); 2809 break; 2810 } 2811 if (debug) 2812 addlog(" [invalid]"); 2813 break; 2814 case LCP_OPT_MP_MRRU: 2815 /* Multilink maximum received reconstructed unit */ 2816 /* should be fall through, both are same length */ 2817 /* FALLTHROUGH */ 2818 case LCP_OPT_MRU: 2819 /* Maximum receive unit. */ 2820 if (len >= 4 && l == 4) 2821 continue; 2822 if (debug) 2823 addlog(" [invalid]"); 2824 break; 2825 case LCP_OPT_AUTH_PROTO: 2826 if (len < 4) { 2827 if (debug) 2828 addlog(" [invalid]"); 2829 break; 2830 } 2831 authproto = (p[2] << 8) + p[3]; 2832 if (authproto == PPP_CHAP && l != 5) { 2833 if (debug) 2834 addlog(" [invalid chap len]"); 2835 break; 2836 } 2837 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2838 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2839 sp->myauth.proto = authproto; 2840 } 2841 if (sp->myauth.proto == PPP_NOPROTO) { 2842 /* we are not configured to do auth */ 2843 if (debug) 2844 addlog(" [not configured]"); 2845 break; 2846 } 2847 /* 2848 * Remote want us to authenticate, remember this, 2849 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2850 * up. 2851 */ 2852 sp->pp_flags |= PP_NEEDAUTH; 2853 continue; 2854 default: 2855 /* Others not supported. */ 2856 if (debug) 2857 addlog(" [rej]"); 2858 break; 2859 } 2860 if (rlen + l > blen) { 2861 if (debug) 2862 addlog(" [overflow]"); 2863 continue; 2864 } 2865 /* Add the option to rejected list. */ 2866 memcpy(r, p, l); 2867 r += l; 2868 rlen += l; 2869 } 2870 2871 if (rlen > 0) { 2872 type = CP_RCR_REJ; 2873 goto end; 2874 } 2875 2876 if (debug) 2877 addlog("\n"); 2878 2879 /* 2880 * pass 2: check for option values that are unacceptable and 2881 * thus require to be nak'ed. 2882 */ 2883 if (debug) 2884 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:"); 2885 2886 p = (void *)(h + 1); 2887 r = buf; 2888 rlen = 0; 2889 for (len = origlen; len > 0; len -= l, p += l) { 2890 l = p[1]; 2891 if (l == 0) 2892 break; 2893 2894 if (debug) 2895 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2896 switch (p[0]) { 2897 case LCP_OPT_MAGIC: 2898 /* Magic number -- extract. */ 2899 nmagic = (uint32_t)p[2] << 24 | 2900 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2901 if (nmagic != sp->lcp.magic) { 2902 if (debug) 2903 addlog(" 0x%x", nmagic); 2904 continue; 2905 } 2906 /* 2907 * Local and remote magics equal -- loopback? 2908 */ 2909 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2910 SPPP_DLOG(sp, "loopback\n"); 2911 sp->pp_loopcnt = 0; 2912 2913 if (sp->pp_flags & PP_IFDOWN) 2914 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 2915 sppp_wq_add(sp->wq_cp, 2916 &sp->scp[IDX_LCP].work_close); 2917 sppp_wq_add(sp->wq_cp, 2918 &sp->scp[IDX_LCP].work_open); 2919 } else { 2920 if (debug) 2921 addlog(" [glitch]"); 2922 ++sp->pp_loopcnt; 2923 } 2924 /* 2925 * We negate our magic here, and NAK it. If 2926 * we see it later in an NAK packet, we 2927 * suggest a new one. 2928 */ 2929 nmagic = ~sp->lcp.magic; 2930 /* Gonna NAK it. */ 2931 p[2] = nmagic >> 24; 2932 p[3] = nmagic >> 16; 2933 p[4] = nmagic >> 8; 2934 p[5] = nmagic; 2935 break; 2936 2937 case LCP_OPT_ASYNC_MAP: 2938 /* 2939 * Async control character map -- just ignore it. 2940 * 2941 * Quote from RFC 1662, chapter 6: 2942 * To enable this functionality, synchronous PPP 2943 * implementations MUST always respond to the 2944 * Async-Control-Character-Map Configuration 2945 * Option with the LCP Configure-Ack. However, 2946 * acceptance of the Configuration Option does 2947 * not imply that the synchronous implementation 2948 * will do any ACCM mapping. Instead, all such 2949 * octet mapping will be performed by the 2950 * asynchronous-to-synchronous converter. 2951 */ 2952 continue; 2953 2954 case LCP_OPT_MRU: 2955 /* 2956 * Maximum receive unit. Always agreeable, 2957 * but ignored by now. 2958 */ 2959 sp->lcp.their_mru = p[2] * 256 + p[3]; 2960 if (debug) 2961 addlog(" %ld", sp->lcp.their_mru); 2962 continue; 2963 2964 case LCP_OPT_AUTH_PROTO: 2965 authproto = (p[2] << 8) + p[3]; 2966 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2967 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2968 sp->myauth.proto = authproto; 2969 } 2970 if (sp->myauth.proto == authproto) { 2971 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 2972 continue; 2973 } 2974 if (debug) 2975 addlog(" [chap without MD5]"); 2976 } else { 2977 if (debug) { 2978 char pbuf1[SPPP_PROTO_NAMELEN]; 2979 char pbuf2[SPPP_PROTO_NAMELEN]; 2980 const char *pname1, *pname2; 2981 2982 pname1 = sppp_proto_name(pbuf1, 2983 sizeof(pbuf1), sp->myauth.proto); 2984 pname2 = sppp_proto_name(pbuf2, 2985 sizeof(pbuf2), authproto); 2986 addlog(" [mine %s != his %s]", 2987 pname1, pname2); 2988 } 2989 } 2990 /* not agreed, nak */ 2991 if (sp->myauth.proto == PPP_CHAP) { 2992 l = 5; 2993 } else { 2994 l = 4; 2995 } 2996 2997 if (rlen + l > blen) { 2998 if (debug) 2999 addlog(" [overflow]"); 3000 continue; 3001 } 3002 3003 r[0] = LCP_OPT_AUTH_PROTO; 3004 r[1] = l; 3005 r[2] = sp->myauth.proto >> 8; 3006 r[3] = sp->myauth.proto & 0xff; 3007 if (sp->myauth.proto == PPP_CHAP) 3008 r[4] = CHAP_MD5; 3009 rlen += l; 3010 r += l; 3011 continue; 3012 case LCP_OPT_MP_EID: 3013 /* 3014 * Endpoint identification. 3015 * Always agreeable, 3016 * but ignored by now. 3017 */ 3018 if (debug) { 3019 addlog(" type %d", p[2]); 3020 sppp_print_bytes(p+3, p[1]-3); 3021 } 3022 continue; 3023 case LCP_OPT_MP_MRRU: 3024 /* 3025 * Maximum received reconstructed unit. 3026 * Always agreeable, 3027 * but ignored by now. 3028 */ 3029 sp->lcp.their_mrru = p[2] * 256 + p[3]; 3030 if (debug) 3031 addlog(" %ld", sp->lcp.their_mrru); 3032 continue; 3033 } 3034 if (rlen + l > blen) { 3035 if (debug) 3036 addlog(" [overflow]"); 3037 continue; 3038 } 3039 /* Add the option to nak'ed list. */ 3040 memcpy(r, p, l); 3041 r += l; 3042 rlen += l; 3043 } 3044 3045 if (rlen > 0) { 3046 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 3047 if (debug) 3048 addlog(" max_failure (%d) exceeded, ", 3049 sp->lcp.max_failure); 3050 type = CP_RCR_REJ; 3051 } else { 3052 type = CP_RCR_NAK; 3053 } 3054 } else { 3055 type = CP_RCR_ACK; 3056 rlen = origlen; 3057 memcpy(r, h + 1, rlen); 3058 sp->scp[IDX_LCP].fail_counter = 0; 3059 sp->pp_loopcnt = 0; 3060 } 3061 3062 end: 3063 if (debug) 3064 addlog("\n"); 3065 3066 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3067 if (buf != NULL) 3068 kmem_intr_free(buf, blen); 3069 } else { 3070 *msgbuf = buf; 3071 *buflen = blen; 3072 *msglen = rlen; 3073 } 3074 3075 return type; 3076 } 3077 3078 /* 3079 * Analyze the LCP Configure-Reject option list, and adjust our 3080 * negotiation. 3081 */ 3082 static void 3083 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3084 { 3085 const bool debug = sppp_debug_enabled(sp); 3086 u_char *p, l; 3087 3088 KASSERT(SPPP_WLOCKED(sp)); 3089 3090 if (len <= sizeof(*h)) 3091 return; 3092 3093 len -= sizeof(*h); 3094 3095 if (debug) 3096 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:"); 3097 3098 p = (void *)(h + 1); 3099 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3100 /* Sanity check option length */ 3101 if (l > len) { 3102 /* 3103 * Malicious option - drop immediately. 3104 * XXX Maybe we should just RXJ it? 3105 */ 3106 if (debug) 3107 addlog("\n"); 3108 3109 SPPP_LOG(sp, LOG_DEBUG, 3110 "received malicious LCP option, dropping.\n"); 3111 goto end; 3112 } 3113 if (debug) { 3114 char lbuf[SPPP_LCPOPT_NAMELEN]; 3115 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 3116 } 3117 switch (p[0]) { 3118 case LCP_OPT_MAGIC: 3119 /* Magic number -- can't use it, use 0 */ 3120 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 3121 sp->lcp.magic = 0; 3122 break; 3123 case LCP_OPT_MRU: 3124 /* 3125 * We try to negotiate a lower MRU if the underlying 3126 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 3127 * peer rejects this lower rate, fallback to the 3128 * default. 3129 */ 3130 if (!debug) { 3131 SPPP_LOG(sp, LOG_INFO, 3132 "peer rejected our MRU of " 3133 "%ld bytes. Defaulting to %d bytes\n", 3134 sp->lcp.mru, PP_MTU); 3135 } 3136 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3137 sp->lcp.mru = PP_MTU; 3138 break; 3139 case LCP_OPT_AUTH_PROTO: 3140 /* 3141 * Peer doesn't want to authenticate himself, 3142 * deny unless SPPP_AUTHFLAG_NOCALLOUT is set. 3143 */ 3144 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 3145 if (debug) { 3146 addlog(" [don't insist on auth " 3147 "for callout]"); 3148 } 3149 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3150 break; 3151 } 3152 if (debug) 3153 addlog("[access denied]\n"); 3154 sppp_disconnect(sp); 3155 break; 3156 } 3157 } 3158 if (debug) 3159 addlog("\n"); 3160 end: 3161 return; 3162 } 3163 3164 /* 3165 * Analyze the LCP Configure-NAK option list, and adjust our 3166 * negotiation. 3167 */ 3168 static void 3169 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3170 { 3171 const bool debug = sppp_debug_enabled(sp); 3172 u_char *p, l; 3173 uint32_t magic; 3174 3175 KASSERT(SPPP_WLOCKED(sp)); 3176 3177 if (len <= sizeof(*h)) 3178 return; 3179 3180 len -= sizeof(*h); 3181 3182 if (debug) 3183 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:"); 3184 3185 p = (void *)(h + 1); 3186 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3187 /* Sanity check option length */ 3188 if (l > len) { 3189 /* 3190 * Malicious option - drop immediately. 3191 * XXX Maybe we should just RXJ it? 3192 */ 3193 if (debug) 3194 addlog("\n"); 3195 3196 SPPP_LOG(sp, LOG_DEBUG, 3197 "received malicious LCP option, dropping.\n"); 3198 goto end; 3199 } 3200 if (debug) { 3201 char lbuf[SPPP_LCPOPT_NAMELEN]; 3202 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 3203 } 3204 switch (p[0]) { 3205 case LCP_OPT_MAGIC: 3206 /* Magic number -- renegotiate */ 3207 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3208 len >= 6 && l == 6) { 3209 magic = (uint32_t)p[2] << 24 | 3210 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3211 /* 3212 * If the remote magic is our negated one, 3213 * this looks like a loopback problem. 3214 * Suggest a new magic to make sure. 3215 */ 3216 if (magic == ~sp->lcp.magic) { 3217 if (debug) 3218 addlog(" magic glitch"); 3219 sp->lcp.magic = cprng_fast32(); 3220 } else { 3221 sp->lcp.magic = magic; 3222 if (debug) 3223 addlog(" %d", magic); 3224 } 3225 } 3226 break; 3227 case LCP_OPT_MRU: 3228 /* 3229 * Peer wants to advise us to negotiate an MRU. 3230 * Agree on it if it's reasonable, or use 3231 * default otherwise. 3232 */ 3233 if (len >= 4 && l == 4) { 3234 u_int mru = p[2] * 256 + p[3]; 3235 if (debug) 3236 addlog(" %d", mru); 3237 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3238 mru = sp->pp_if.if_mtu; 3239 sp->lcp.mru = mru; 3240 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3241 } 3242 break; 3243 case LCP_OPT_AUTH_PROTO: 3244 /* 3245 * Peer doesn't like our authentication method, 3246 * deny. 3247 */ 3248 if (debug) 3249 addlog("[access denied]\n"); 3250 sppp_disconnect(sp); 3251 break; 3252 } 3253 } 3254 if (debug) 3255 addlog("\n"); 3256 end: 3257 return; 3258 } 3259 3260 static void 3261 sppp_lcp_tlu(struct sppp *sp) 3262 { 3263 struct ifnet *ifp = &sp->pp_if; 3264 struct sppp_cp *scp; 3265 int i; 3266 3267 KASSERT(SPPP_WLOCKED(sp)); 3268 3269 /* unlock for IFNET_LOCK */ 3270 SPPP_UNLOCK(sp); 3271 3272 /* the interface was down by PP_IFDOWN flag */ 3273 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_RUNNING) { 3274 SPPP_LOG(sp, LOG_DEBUG, "interface is going up\n"); 3275 if_up(ifp); 3276 } 3277 3278 IFNET_LOCK(ifp); 3279 SPPP_LOCK(sp, RW_WRITER); 3280 if (ifp->if_mtu > sp->lcp.their_mru) { 3281 sp->pp_saved_mtu = ifp->if_mtu; 3282 ifp->if_mtu = sp->lcp.their_mru; 3283 SPPP_DLOG(sp, "setting MTU " 3284 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3285 sp->pp_saved_mtu, ifp->if_mtu); 3286 } 3287 SPPP_UNLOCK(sp); 3288 IFNET_UNLOCK(ifp); 3289 3290 SPPP_LOCK(sp, RW_WRITER); 3291 3292 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3293 (sp->pp_flags & PP_NEEDAUTH) != 0) 3294 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3295 else 3296 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3297 3298 for (i = 0; i < IDX_COUNT; i++) { 3299 scp = &sp->scp[(cps[i])->protoidx]; 3300 3301 if (((cps[i])->flags & CP_LCP) == 0) 3302 sppp_wq_add(sp->wq_cp, &scp->work_up); 3303 3304 /* 3305 * Open all authentication protocols. This is even required 3306 * if we already proceeded to network phase, since it might be 3307 * that remote wants us to authenticate, so we might have to 3308 * send a PAP request. Undesired authentication protocols 3309 * don't do anything when they get an Open event. 3310 */ 3311 if ((cps[i])->flags & CP_AUTH) 3312 sppp_wq_add(sp->wq_cp, &scp->work_open); 3313 3314 /* Open all NCPs. */ 3315 if (sp->pp_phase == SPPP_PHASE_NETWORK && 3316 ((cps[i])->flags & CP_NCP) != 0) { 3317 sppp_wq_add(sp->wq_cp, &scp->work_open); 3318 } 3319 } 3320 } 3321 3322 static void 3323 sppp_lcp_tld(struct sppp *sp) 3324 { 3325 struct ifnet *ifp; 3326 struct sppp_cp *scp; 3327 int i, phase; 3328 3329 KASSERT(SPPP_WLOCKED(sp)); 3330 3331 phase = sp->pp_phase; 3332 3333 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3334 3335 if (sp->pp_saved_mtu > 0) { 3336 ifp = &sp->pp_if; 3337 3338 SPPP_UNLOCK(sp); 3339 IFNET_LOCK(ifp); 3340 SPPP_LOCK(sp, RW_WRITER); 3341 3342 SPPP_DLOG(sp, "setting MTU " 3343 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3344 ifp->if_mtu, sp->pp_saved_mtu); 3345 3346 ifp->if_mtu = sp->pp_saved_mtu; 3347 sp->pp_saved_mtu = 0; 3348 IFNET_UNLOCK(ifp); 3349 } 3350 3351 /* 3352 * Take upper layers down. We send the Down event first and 3353 * the Close second to prevent the upper layers from sending 3354 * ``a flurry of terminate-request packets'', as the RFC 3355 * describes it. 3356 */ 3357 for (i = 0; i < IDX_COUNT; i++) { 3358 scp = &sp->scp[(cps[i])->protoidx]; 3359 3360 if (((cps[i])->flags & CP_LCP) == 0) 3361 sppp_wq_add(sp->wq_cp, &scp->work_down); 3362 3363 if ((cps[i])->flags & CP_AUTH) { 3364 sppp_wq_add(sp->wq_cp, &scp->work_close); 3365 } 3366 3367 /* Close all NCPs. */ 3368 if (phase == SPPP_PHASE_NETWORK && 3369 ((cps[i])->flags & CP_NCP) != 0) { 3370 sppp_wq_add(sp->wq_cp, &scp->work_close); 3371 } 3372 } 3373 } 3374 3375 static void 3376 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3377 { 3378 3379 KASSERT(SPPP_WLOCKED(sp)); 3380 3381 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3382 3383 /* Notify lower layer if desired. */ 3384 if (!sp->lcp.lower_running) { 3385 sp->lcp.lower_running = true; 3386 sppp_notify_tls_wlocked(sp); 3387 } 3388 } 3389 3390 static void 3391 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3392 { 3393 3394 KASSERT(SPPP_WLOCKED(sp)); 3395 3396 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3397 3398 /* Notify lower layer if desired. */ 3399 if (sp->lcp.lower_running) { 3400 sp->lcp.lower_running = false; 3401 sppp_notify_tlf_wlocked(sp); 3402 } 3403 } 3404 3405 static void 3406 sppp_lcp_scr(struct sppp *sp) 3407 { 3408 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3409 int i = 0; 3410 u_short authproto; 3411 3412 KASSERT(SPPP_WLOCKED(sp)); 3413 3414 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3415 if (! sp->lcp.magic) 3416 sp->lcp.magic = cprng_fast32(); 3417 opt[i++] = LCP_OPT_MAGIC; 3418 opt[i++] = 6; 3419 opt[i++] = sp->lcp.magic >> 24; 3420 opt[i++] = sp->lcp.magic >> 16; 3421 opt[i++] = sp->lcp.magic >> 8; 3422 opt[i++] = sp->lcp.magic; 3423 } 3424 3425 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3426 opt[i++] = LCP_OPT_MRU; 3427 opt[i++] = 4; 3428 opt[i++] = sp->lcp.mru >> 8; 3429 opt[i++] = sp->lcp.mru; 3430 } 3431 3432 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3433 authproto = sp->hisauth.proto; 3434 opt[i++] = LCP_OPT_AUTH_PROTO; 3435 opt[i++] = authproto == PPP_CHAP? 5: 4; 3436 opt[i++] = authproto >> 8; 3437 opt[i++] = authproto; 3438 if (authproto == PPP_CHAP) 3439 opt[i++] = CHAP_MD5; 3440 } 3441 3442 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3443 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3444 } 3445 3446 /* 3447 * Check the open NCPs, return true if at least one NCP is open. 3448 */ 3449 3450 static int 3451 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3452 { 3453 int i, mask; 3454 3455 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3456 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3457 return 1; 3458 return 0; 3459 } 3460 3461 /* 3462 * Check the opened NCPs, return true if at least one NCP is opened. 3463 */ 3464 static bool 3465 sppp_is_ncp_opened(struct sppp *sp) 3466 { 3467 size_t i; 3468 3469 for (i = 0; i < IDX_COUNT; i++) 3470 if (((cps[i])->flags & CP_NCP) && 3471 (sp->scp[i].state == STATE_OPENED)) 3472 return true; 3473 return false; 3474 } 3475 3476 /* 3477 * Re-check the open NCPs and see if we should terminate the link. 3478 * Called by the NCPs during their tlf action handling. 3479 */ 3480 static void 3481 sppp_lcp_check_and_close(struct sppp *sp) 3482 { 3483 3484 KASSERT(SPPP_WLOCKED(sp)); 3485 3486 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3487 /* don't bother, we are already going down */ 3488 return; 3489 } 3490 3491 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3492 sppp_cp_check(sp, CP_AUTH)) 3493 return; 3494 3495 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3496 sppp_cp_check(sp, CP_NCP)) 3497 return; 3498 3499 if (sp->pp_max_auth_fail != 0 && 3500 sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3501 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, " 3502 "not retrying again\n", sp->pp_auth_failures); 3503 3504 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 3505 sppp_disconnect(sp); 3506 } else { 3507 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3508 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3509 } 3510 } 3511 3512 /* 3513 *--------------------------------------------------------------------------* 3514 * * 3515 * The IPCP implementation. * 3516 * * 3517 *--------------------------------------------------------------------------* 3518 */ 3519 3520 static void 3521 sppp_ipcp_init(struct sppp *sp) 3522 { 3523 3524 KASSERT(SPPP_WLOCKED(sp)); 3525 3526 sppp_cp_init(&ipcp, sp); 3527 3528 sp->ipcp.opts = 0; 3529 sp->ipcp.flags = 0; 3530 } 3531 3532 static void 3533 sppp_ipcp_open(struct sppp *sp, void *xcp) 3534 { 3535 uint32_t myaddr, hisaddr; 3536 3537 KASSERT(SPPP_WLOCKED(sp)); 3538 KASSERT(!cpu_softintr_p()); 3539 3540 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3541 return; 3542 3543 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3544 sp->ipcp.req_myaddr = 0; 3545 sp->ipcp.req_hisaddr = 0; 3546 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3547 3548 #ifdef INET 3549 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3550 #else 3551 myaddr = hisaddr = 0; 3552 #endif 3553 /* 3554 * If we don't have his address, this probably means our 3555 * interface doesn't want to talk IP at all. (This could 3556 * be the case if somebody wants to speak only IPX, for 3557 * example.) Don't open IPCP in this case. 3558 */ 3559 if (hisaddr == 0) { 3560 /* XXX this message should go away */ 3561 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n"); 3562 return; 3563 } 3564 3565 if (myaddr == 0) { 3566 /* 3567 * I don't have an assigned address, so i need to 3568 * negotiate my address. 3569 */ 3570 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3571 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3572 } 3573 if (hisaddr == 1) { 3574 /* 3575 * XXX - remove this hack! 3576 * remote has no valid address, we need to get one assigned. 3577 */ 3578 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3579 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3580 } 3581 3582 if (sp->query_dns & 1) { 3583 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3584 } else { 3585 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3586 } 3587 3588 if (sp->query_dns & 2) { 3589 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3590 } else { 3591 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3592 } 3593 sppp_open_event(sp, xcp); 3594 } 3595 3596 static void 3597 sppp_ipcp_close(struct sppp *sp, void *xcp) 3598 { 3599 3600 KASSERT(SPPP_WLOCKED(sp)); 3601 KASSERT(!cpu_softintr_p()); 3602 3603 sppp_close_event(sp, xcp); 3604 3605 #ifdef INET 3606 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3607 /* 3608 * Some address was dynamic, clear it again. 3609 */ 3610 sppp_clear_ip_addrs(sp); 3611 } 3612 #endif 3613 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3614 } 3615 3616 /* 3617 * Analyze a configure request. Return true if it was agreeable, and 3618 * caused action sca, false if it has been rejected or nak'ed, and 3619 * caused action scn. (The return value is used to make the state 3620 * transition decision in the state automaton.) 3621 */ 3622 static enum cp_rcr_type 3623 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3624 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3625 { 3626 const bool debug = sppp_debug_enabled(sp); 3627 u_char *buf, *r, *p, l, blen; 3628 enum cp_rcr_type type; 3629 int rlen, len; 3630 uint32_t hisaddr, desiredaddr; 3631 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3632 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3633 const char *dq; 3634 3635 KASSERT(SPPP_WLOCKED(sp)); 3636 3637 type = CP_RCR_NONE; 3638 origlen -= sizeof(*h); 3639 3640 if (origlen < 0) 3641 return CP_RCR_DROP; 3642 3643 /* 3644 * Make sure to allocate a buf that can at least hold a 3645 * conf-nak with an `address' option. We might need it below. 3646 */ 3647 blen = MAX(6, origlen); 3648 3649 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3650 if (buf == NULL) 3651 return CP_RCR_DROP; 3652 3653 /* pass 1: see if we can recognize them */ 3654 if (debug) 3655 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:"); 3656 p = (void *)(h + 1); 3657 r = buf; 3658 rlen = 0; 3659 for (len = origlen; len > 1; len -= l, p += l) { 3660 l = p[1]; 3661 if (l == 0) 3662 break; 3663 3664 /* Sanity check option length */ 3665 if (l > len) { 3666 /* XXX should we just RXJ? */ 3667 if (debug) 3668 addlog("\n"); 3669 3670 SPPP_LOG(sp, LOG_DEBUG, 3671 " malicious IPCP option received, dropping\n"); 3672 type = CP_RCR_ERR; 3673 goto end; 3674 } 3675 if (debug) { 3676 addlog(" %s", 3677 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3678 } 3679 switch (p[0]) { 3680 #ifdef notyet 3681 case IPCP_OPT_COMPRESSION: 3682 if (len >= 6 && l >= 6) { 3683 /* correctly formed compress option */ 3684 continue; 3685 } 3686 if (debug) 3687 addlog(" [invalid]"); 3688 break; 3689 #endif 3690 case IPCP_OPT_ADDRESS: 3691 if (len >= 6 && l == 6) { 3692 /* correctly formed address option */ 3693 continue; 3694 } 3695 if (debug) 3696 addlog(" [invalid]"); 3697 break; 3698 default: 3699 /* Others not supported. */ 3700 if (debug) 3701 addlog(" [rej]"); 3702 break; 3703 } 3704 /* Add the option to rejected list. */ 3705 if (rlen + l > blen) { 3706 if (debug) 3707 addlog(" [overflow]"); 3708 continue; 3709 } 3710 memcpy(r, p, l); 3711 r += l; 3712 rlen += l; 3713 } 3714 3715 if (rlen > 0) { 3716 type = CP_RCR_REJ; 3717 goto end; 3718 } 3719 3720 if (debug) 3721 addlog("\n"); 3722 3723 /* pass 2: parse option values */ 3724 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3725 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3726 else 3727 #ifdef INET 3728 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3729 #else 3730 hisaddr = 0; 3731 #endif 3732 if (debug) 3733 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:"); 3734 p = (void *)(h + 1); 3735 r = buf; 3736 rlen = 0; 3737 for (len = origlen; len > 1; len -= l, p += l) { 3738 l = p[1]; 3739 if (l == 0) 3740 break; 3741 3742 if (debug) { 3743 addlog(" %s", 3744 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3745 } 3746 switch (p[0]) { 3747 #ifdef notyet 3748 case IPCP_OPT_COMPRESSION: 3749 continue; 3750 #endif 3751 case IPCP_OPT_ADDRESS: 3752 desiredaddr = p[2] << 24 | p[3] << 16 | 3753 p[4] << 8 | p[5]; 3754 if (desiredaddr == hisaddr || 3755 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3756 /* 3757 * Peer's address is same as our value, 3758 * this is agreeable. Gonna conf-ack 3759 * it. 3760 */ 3761 if (debug) { 3762 dq = sppp_dotted_quad(dqbuf, 3763 sizeof(dqbuf), hisaddr); 3764 addlog(" %s [ack]", dq); 3765 } 3766 /* record that we've seen it already */ 3767 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3768 sp->ipcp.req_hisaddr = desiredaddr; 3769 hisaddr = desiredaddr; 3770 continue; 3771 } 3772 /* 3773 * The address wasn't agreeable. This is either 3774 * he sent us 0.0.0.0, asking to assign him an 3775 * address, or he send us another address not 3776 * matching our value. Either case, we gonna 3777 * conf-nak it with our value. 3778 */ 3779 if (debug) { 3780 if (desiredaddr == 0) { 3781 addlog(" [addr requested]"); 3782 } else { 3783 dq = sppp_dotted_quad(dqbuf, 3784 sizeof(dqbuf), desiredaddr); 3785 addlog(" %s [not agreed]", dq); 3786 } 3787 } 3788 3789 p[2] = hisaddr >> 24; 3790 p[3] = hisaddr >> 16; 3791 p[4] = hisaddr >> 8; 3792 p[5] = hisaddr; 3793 break; 3794 } 3795 if (rlen + l > blen) { 3796 if (debug) 3797 addlog(" [overflow]"); 3798 continue; 3799 } 3800 /* Add the option to nak'ed list. */ 3801 memcpy(r, p, l); 3802 r += l; 3803 rlen += l; 3804 } 3805 3806 if (rlen > 0) { 3807 type = CP_RCR_NAK; 3808 } else { 3809 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3810 /* 3811 * If we are about to conf-ack the request, but haven't seen 3812 * his address so far, gonna conf-nak it instead, with the 3813 * `address' option present and our idea of his address being 3814 * filled in there, to request negotiation of both addresses. 3815 * 3816 * XXX This can result in an endless req - nak loop if peer 3817 * doesn't want to send us his address. Q: What should we do 3818 * about it? XXX A: implement the max-failure counter. 3819 */ 3820 buf[0] = IPCP_OPT_ADDRESS; 3821 buf[1] = 6; 3822 buf[2] = hisaddr >> 24; 3823 buf[3] = hisaddr >> 16; 3824 buf[4] = hisaddr >> 8; 3825 buf[5] = hisaddr; 3826 rlen = 6; 3827 if (debug) 3828 addlog(" still need hisaddr"); 3829 type = CP_RCR_NAK; 3830 } else { 3831 type = CP_RCR_ACK; 3832 rlen = origlen; 3833 memcpy(r, h + 1, rlen); 3834 } 3835 } 3836 3837 end: 3838 if (debug) 3839 addlog("\n"); 3840 3841 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3842 if (buf != NULL) 3843 kmem_intr_free(buf, blen); 3844 } else { 3845 *msgbuf = buf; 3846 *buflen = blen; 3847 *msglen = rlen; 3848 } 3849 3850 return type; 3851 } 3852 3853 /* 3854 * Analyze the IPCP Configure-Reject option list, and adjust our 3855 * negotiation. 3856 */ 3857 static void 3858 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3859 { 3860 const bool debug = sppp_debug_enabled(sp); 3861 u_char *p, l; 3862 3863 KASSERT(SPPP_WLOCKED(sp)); 3864 3865 if (len <= sizeof(*h)) 3866 return; 3867 3868 len -= sizeof(*h); 3869 3870 if (debug) 3871 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:"); 3872 3873 p = (void *)(h + 1); 3874 for (; len > 1; len -= l, p += l) { 3875 l = p[1]; 3876 if (l == 0) 3877 break; 3878 3879 /* Sanity check option length */ 3880 if (l > len) { 3881 /* XXX should we just RXJ? */ 3882 if (debug) 3883 addlog("\n"); 3884 SPPP_LOG(sp, LOG_DEBUG, 3885 "malicious IPCP option received, dropping\n"); 3886 goto end; 3887 } 3888 if (debug) { 3889 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3890 addlog(" %s", 3891 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3892 } 3893 switch (p[0]) { 3894 case IPCP_OPT_ADDRESS: 3895 /* 3896 * Peer doesn't grok address option. This is 3897 * bad. XXX Should we better give up here? 3898 */ 3899 if (!debug) { 3900 SPPP_LOG(sp, LOG_ERR, 3901 "IPCP address option rejected\n"); 3902 } 3903 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3904 break; 3905 #ifdef notyet 3906 case IPCP_OPT_COMPRESS: 3907 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3908 break; 3909 #endif 3910 case IPCP_OPT_PRIMDNS: 3911 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3912 break; 3913 3914 case IPCP_OPT_SECDNS: 3915 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3916 break; 3917 } 3918 } 3919 if (debug) 3920 addlog("\n"); 3921 end: 3922 return; 3923 } 3924 3925 /* 3926 * Analyze the IPCP Configure-NAK option list, and adjust our 3927 * negotiation. 3928 */ 3929 static void 3930 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3931 { 3932 const bool debug = sppp_debug_enabled(sp); 3933 u_char *p, l; 3934 uint32_t wantaddr; 3935 3936 KASSERT(SPPP_WLOCKED(sp)); 3937 3938 len -= sizeof(*h); 3939 3940 if (debug) 3941 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:"); 3942 3943 p = (void *)(h + 1); 3944 for (; len > 1; len -= l, p += l) { 3945 l = p[1]; 3946 if (l == 0) 3947 break; 3948 3949 /* Sanity check option length */ 3950 if (l > len) { 3951 /* XXX should we just RXJ? */ 3952 if (debug) 3953 addlog("\n"); 3954 SPPP_LOG(sp, LOG_DEBUG, 3955 "malicious IPCP option received, dropping\n"); 3956 return; 3957 } 3958 if (debug) { 3959 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3960 addlog(" %s", 3961 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3962 } 3963 switch (*p) { 3964 case IPCP_OPT_ADDRESS: 3965 /* 3966 * Peer doesn't like our local IP address. See 3967 * if we can do something for him. We'll drop 3968 * him our address then. 3969 */ 3970 if (len >= 6 && l == 6) { 3971 wantaddr = p[2] << 24 | p[3] << 16 | 3972 p[4] << 8 | p[5]; 3973 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3974 if (debug) { 3975 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3976 const char *dq; 3977 3978 dq = sppp_dotted_quad(dqbuf, 3979 sizeof(dqbuf), wantaddr); 3980 addlog(" [wantaddr %s]", dq); 3981 } 3982 /* 3983 * When doing dynamic address assignment, 3984 * we accept his offer. Otherwise, we 3985 * ignore it and thus continue to negotiate 3986 * our already existing value. 3987 */ 3988 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3989 if (ntohl(wantaddr) != INADDR_ANY) { 3990 if (debug) 3991 addlog(" [agree]"); 3992 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3993 sp->ipcp.req_myaddr = wantaddr; 3994 } else { 3995 if (debug) 3996 addlog(" [not agreed]"); 3997 } 3998 } 3999 } 4000 break; 4001 4002 case IPCP_OPT_PRIMDNS: 4003 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 4004 len >= 6 && l == 6) { 4005 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 4006 p[4] << 8 | p[5]; 4007 } 4008 break; 4009 4010 case IPCP_OPT_SECDNS: 4011 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 4012 len >= 6 && l == 6) { 4013 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 4014 p[4] << 8 | p[5]; 4015 } 4016 break; 4017 #ifdef notyet 4018 case IPCP_OPT_COMPRESS: 4019 /* 4020 * Peer wants different compression parameters. 4021 */ 4022 break; 4023 #endif 4024 } 4025 } 4026 if (debug) 4027 addlog("\n"); 4028 } 4029 4030 /* 4031 * rt_ifmsg requires sppp to be unlocked as it will attempt to lock it again. 4032 * unlocking sppp is safe here because this logic runs in a single thread, 4033 * the workqueue, so concurrent state transitions are excluded on that basis; 4034 * other tlu functions already release and re-acquire the lock already, 4035 * which is only for coordination with threads _other_ than the workqueue 4036 * thread which doesn't change the state. 4037 */ 4038 static void 4039 sppp_rt_ifmsg(struct sppp *sp) 4040 { 4041 struct ifnet *ifp = &sp->pp_if; 4042 4043 KASSERT(SPPP_WLOCKED(sp)); 4044 4045 SPPP_UNLOCK(sp); 4046 rt_ifmsg(ifp); 4047 SPPP_LOCK(sp, RW_WRITER); 4048 } 4049 4050 static void 4051 sppp_ipcp_tlu(struct sppp *sp) 4052 { 4053 #ifdef INET 4054 4055 KASSERT(SPPP_WLOCKED(sp)); 4056 4057 SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n"); 4058 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 4059 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 4060 SPPP_LOG(sp, LOG_WARNING, 4061 "no IP address, closing IPCP\n"); 4062 sppp_wq_add(sp->wq_cp, 4063 &sp->scp[IDX_IPCP].work_close); 4064 } else { 4065 /* we are up. Set addresses and notify anyone interested */ 4066 sppp_set_ip_addrs(sp); 4067 sppp_rt_ifmsg(sp); 4068 } 4069 #endif 4070 } 4071 4072 static void 4073 sppp_ipcp_tld(struct sppp *sp) 4074 { 4075 #ifdef INET 4076 4077 SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n"); 4078 sppp_rt_ifmsg(sp); 4079 #endif 4080 } 4081 4082 static void 4083 sppp_ipcp_scr(struct sppp *sp) 4084 { 4085 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 4086 #ifdef INET 4087 uint32_t ouraddr; 4088 #endif 4089 int i = 0; 4090 4091 KASSERT(SPPP_WLOCKED(sp)); 4092 4093 #ifdef notyet 4094 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 4095 opt[i++] = IPCP_OPT_COMPRESSION; 4096 opt[i++] = 6; 4097 opt[i++] = 0; /* VJ header compression */ 4098 opt[i++] = 0x2d; /* VJ header compression */ 4099 opt[i++] = max_slot_id; 4100 opt[i++] = comp_slot_id; 4101 } 4102 #endif 4103 4104 #ifdef INET 4105 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 4106 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 4107 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 4108 } else { 4109 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 4110 } 4111 opt[i++] = IPCP_OPT_ADDRESS; 4112 opt[i++] = 6; 4113 opt[i++] = ouraddr >> 24; 4114 opt[i++] = ouraddr >> 16; 4115 opt[i++] = ouraddr >> 8; 4116 opt[i++] = ouraddr; 4117 } 4118 #endif 4119 4120 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 4121 opt[i++] = IPCP_OPT_PRIMDNS; 4122 opt[i++] = 6; 4123 opt[i++] = sp->dns_addrs[0] >> 24; 4124 opt[i++] = sp->dns_addrs[0] >> 16; 4125 opt[i++] = sp->dns_addrs[0] >> 8; 4126 opt[i++] = sp->dns_addrs[0]; 4127 } 4128 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 4129 opt[i++] = IPCP_OPT_SECDNS; 4130 opt[i++] = 6; 4131 opt[i++] = sp->dns_addrs[1] >> 24; 4132 opt[i++] = sp->dns_addrs[1] >> 16; 4133 opt[i++] = sp->dns_addrs[1] >> 8; 4134 opt[i++] = sp->dns_addrs[1]; 4135 } 4136 4137 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 4138 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 4139 } 4140 4141 /* 4142 *--------------------------------------------------------------------------* 4143 * * 4144 * The IPv6CP implementation. * 4145 * * 4146 *--------------------------------------------------------------------------* 4147 */ 4148 4149 #ifdef INET6 4150 static void 4151 sppp_ipv6cp_init(struct sppp *sp) 4152 { 4153 4154 KASSERT(SPPP_WLOCKED(sp)); 4155 4156 sppp_cp_init(&ipv6cp, sp); 4157 4158 sp->ipv6cp.opts = 0; 4159 sp->ipv6cp.flags = 0; 4160 } 4161 4162 static void 4163 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4164 { 4165 struct in6_addr myaddr, hisaddr; 4166 4167 KASSERT(SPPP_WLOCKED(sp)); 4168 KASSERT(!cpu_softintr_p()); 4169 4170 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4171 return; 4172 4173 #ifdef IPV6CP_MYIFID_DYN 4174 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4175 #else 4176 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4177 #endif 4178 4179 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4180 /* 4181 * If we don't have our address, this probably means our 4182 * interface doesn't want to talk IPv6 at all. (This could 4183 * be the case if somebody wants to speak only IPX, for 4184 * example.) Don't open IPv6CP in this case. 4185 */ 4186 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4187 /* XXX this message should go away */ 4188 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n"); 4189 return; 4190 } 4191 4192 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4193 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4194 sppp_open_event(sp, xcp); 4195 } 4196 4197 /* 4198 * Analyze a configure request. Return true if it was agreeable, and 4199 * caused action sca, false if it has been rejected or nak'ed, and 4200 * caused action scn. (The return value is used to make the state 4201 * transition decision in the state automaton.) 4202 */ 4203 static enum cp_rcr_type 4204 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4205 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4206 { 4207 const bool debug = sppp_debug_enabled(sp); 4208 u_char *buf, *r, *p, l, blen; 4209 int rlen, len; 4210 struct in6_addr myaddr, desiredaddr, suggestaddr; 4211 enum cp_rcr_type type; 4212 int ifidcount; 4213 int collision, nohisaddr; 4214 char ip6buf[INET6_ADDRSTRLEN]; 4215 char tbuf[SPPP_CPTYPE_NAMELEN]; 4216 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4217 const char *cpname; 4218 4219 KASSERT(SPPP_WLOCKED(sp)); 4220 4221 type = CP_RCR_NONE; 4222 origlen -= sizeof(*h); 4223 4224 if (origlen < 0) 4225 return CP_RCR_DROP; 4226 4227 /* 4228 * Make sure to allocate a buf that can at least hold a 4229 * conf-nak with an `address' option. We might need it below. 4230 */ 4231 blen = MAX(6, origlen); 4232 4233 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4234 if (buf == NULL) 4235 return CP_RCR_DROP; 4236 4237 /* pass 1: see if we can recognize them */ 4238 if (debug) 4239 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:"); 4240 p = (void *)(h + 1); 4241 r = buf; 4242 rlen = 0; 4243 ifidcount = 0; 4244 for (len = origlen; len > 1; len -= l, p += l) { 4245 l = p[1]; 4246 if (l == 0) 4247 break; 4248 4249 /* Sanity check option length */ 4250 if (l > len) { 4251 /* XXX just RXJ? */ 4252 if (debug) 4253 addlog("\n"); 4254 SPPP_LOG(sp, LOG_DEBUG, 4255 "received malicious IPCPv6 option, " 4256 "dropping\n"); 4257 type = CP_RCR_ERR; 4258 goto end; 4259 } 4260 if (debug) { 4261 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4262 sizeof(ipv6buf),*p)); 4263 } 4264 switch (p[0]) { 4265 case IPV6CP_OPT_IFID: 4266 if (len >= 10 && l == 10 && ifidcount == 0) { 4267 /* correctly formed address option */ 4268 ifidcount++; 4269 continue; 4270 } 4271 if (debug) 4272 addlog(" [invalid]"); 4273 break; 4274 #ifdef notyet 4275 case IPV6CP_OPT_COMPRESSION: 4276 if (len >= 4 && l >= 4) { 4277 /* correctly formed compress option */ 4278 continue; 4279 } 4280 if (debug) 4281 addlog(" [invalid]"); 4282 break; 4283 #endif 4284 default: 4285 /* Others not supported. */ 4286 if (debug) 4287 addlog(" [rej]"); 4288 break; 4289 } 4290 if (rlen + l > blen) { 4291 if (debug) 4292 addlog(" [overflow]"); 4293 continue; 4294 } 4295 /* Add the option to rejected list. */ 4296 memcpy(r, p, l); 4297 r += l; 4298 rlen += l; 4299 } 4300 4301 if (rlen > 0) { 4302 type = CP_RCR_REJ; 4303 goto end; 4304 } 4305 4306 if (debug) 4307 addlog("\n"); 4308 4309 /* pass 2: parse option values */ 4310 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4311 if (debug) 4312 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:"); 4313 p = (void *)(h + 1); 4314 r = buf; 4315 rlen = 0; 4316 type = CP_RCR_ACK; 4317 for (len = origlen; len > 1; len -= l, p += l) { 4318 l = p[1]; 4319 if (l == 0) 4320 break; 4321 4322 if (debug) { 4323 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4324 sizeof(ipv6buf), *p)); 4325 } 4326 switch (p[0]) { 4327 #ifdef notyet 4328 case IPV6CP_OPT_COMPRESSION: 4329 continue; 4330 #endif 4331 case IPV6CP_OPT_IFID: 4332 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4333 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4334 collision = (memcmp(&desiredaddr.s6_addr[8], 4335 &myaddr.s6_addr[8], 8) == 0); 4336 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4337 4338 desiredaddr.s6_addr16[0] = htons(0xfe80); 4339 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4340 4341 if (!collision && !nohisaddr) { 4342 /* no collision, hisaddr known - Conf-Ack */ 4343 type = CP_RCR_ACK; 4344 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4345 sizeof(sp->ipv6cp.my_ifid)); 4346 memcpy(sp->ipv6cp.his_ifid, 4347 &desiredaddr.s6_addr[8], 4348 sizeof(sp->ipv6cp.my_ifid)); 4349 4350 if (debug) { 4351 cpname = sppp_cp_type_name(tbuf, 4352 sizeof(tbuf), CONF_ACK); 4353 addlog(" %s [%s]", 4354 IN6_PRINT(ip6buf, &desiredaddr), 4355 cpname); 4356 } 4357 continue; 4358 } 4359 4360 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4361 if (collision && nohisaddr) { 4362 /* collision, hisaddr unknown - Conf-Rej */ 4363 type = CP_RCR_REJ; 4364 memset(&p[2], 0, 8); 4365 } else { 4366 /* 4367 * - no collision, hisaddr unknown, or 4368 * - collision, hisaddr known 4369 * Conf-Nak, suggest hisaddr 4370 */ 4371 type = CP_RCR_NAK; 4372 sppp_suggest_ip6_addr(sp, &suggestaddr); 4373 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4374 } 4375 if (debug) { 4376 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4377 4378 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4379 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4380 cpname); 4381 } 4382 break; 4383 } 4384 if (rlen + l > blen) { 4385 if (debug) 4386 addlog(" [overflow]"); 4387 continue; 4388 } 4389 /* Add the option to nak'ed list. */ 4390 memcpy(r, p, l); 4391 r += l; 4392 rlen += l; 4393 } 4394 4395 if (rlen > 0) { 4396 if (type != CP_RCR_ACK) { 4397 if (debug) { 4398 int ctype ; 4399 ctype = type == CP_RCR_REJ ? 4400 CONF_REJ : CONF_NAK; 4401 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4402 addlog(" send %s suggest %s\n", 4403 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4404 } 4405 } 4406 #ifdef notdef 4407 if (type == CP_RCR_ACK) 4408 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4409 #endif 4410 } else { 4411 if (type == CP_RCR_ACK) { 4412 rlen = origlen; 4413 memcpy(r, h + 1, rlen); 4414 } 4415 } 4416 end: 4417 if (debug) 4418 addlog("\n"); 4419 4420 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4421 if (buf != NULL) 4422 kmem_intr_free(buf, blen); 4423 } else { 4424 *msgbuf = buf; 4425 *buflen = blen; 4426 *msglen = rlen; 4427 } 4428 4429 return type; 4430 } 4431 4432 /* 4433 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4434 * negotiation. 4435 */ 4436 static void 4437 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4438 { 4439 const bool debug = sppp_debug_enabled(sp); 4440 u_char *p, l; 4441 4442 KASSERT(SPPP_WLOCKED(sp)); 4443 4444 if (len <= sizeof(*h)) 4445 return; 4446 4447 len -= sizeof(*h); 4448 4449 if (debug) 4450 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:"); 4451 4452 p = (void *)(h + 1); 4453 for (; len > 1; len -= l, p += l) { 4454 l = p[1]; 4455 if (l == 0) 4456 break; 4457 4458 if (l > len) { 4459 /* XXX just RXJ? */ 4460 if (debug) 4461 addlog("\n"); 4462 SPPP_LOG(sp, LOG_DEBUG, 4463 "received malicious IPCPv6 option, " 4464 "dropping\n"); 4465 goto end; 4466 } 4467 if (debug) { 4468 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4469 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4470 sizeof(ipv6buf), *p)); 4471 } 4472 switch (p[0]) { 4473 case IPV6CP_OPT_IFID: 4474 /* 4475 * Peer doesn't grok address option. This is 4476 * bad. XXX Should we better give up here? 4477 */ 4478 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4479 break; 4480 #ifdef notyet 4481 case IPV6CP_OPT_COMPRESS: 4482 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4483 break; 4484 #endif 4485 } 4486 } 4487 if (debug) 4488 addlog("\n"); 4489 end: 4490 return; 4491 } 4492 4493 /* 4494 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4495 * negotiation. 4496 */ 4497 static void 4498 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4499 { 4500 const bool debug = sppp_debug_enabled(sp); 4501 u_char *p, l; 4502 struct in6_addr suggestaddr; 4503 char ip6buf[INET6_ADDRSTRLEN]; 4504 4505 KASSERT(SPPP_WLOCKED(sp)); 4506 4507 if (len <= sizeof(*h)) 4508 return; 4509 4510 len -= sizeof(*h); 4511 4512 if (debug) 4513 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:"); 4514 4515 p = (void *)(h + 1); 4516 for (; len > 1; len -= l, p += l) { 4517 l = p[1]; 4518 if (l == 0) 4519 break; 4520 4521 if (l > len) { 4522 /* XXX just RXJ? */ 4523 if (debug) 4524 addlog("\n"); 4525 SPPP_LOG(sp, LOG_DEBUG, 4526 "received malicious IPCPv6 option, " 4527 "dropping\n"); 4528 goto end; 4529 } 4530 if (debug) { 4531 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4532 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4533 sizeof(ipv6buf), *p)); 4534 } 4535 switch (p[0]) { 4536 case IPV6CP_OPT_IFID: 4537 /* 4538 * Peer doesn't like our local ifid. See 4539 * if we can do something for him. We'll drop 4540 * him our address then. 4541 */ 4542 if (len < 10 || l != 10) 4543 break; 4544 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4545 suggestaddr.s6_addr16[0] = htons(0xfe80); 4546 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4547 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4548 4549 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4550 if (debug) 4551 addlog(" [suggestaddr %s]", 4552 IN6_PRINT(ip6buf, &suggestaddr)); 4553 #ifdef IPV6CP_MYIFID_DYN 4554 /* 4555 * When doing dynamic address assignment, 4556 * we accept his offer. 4557 */ 4558 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4559 struct in6_addr lastsuggest; 4560 /* 4561 * If <suggested myaddr from peer> equals to 4562 * <hisaddr we have suggested last time>, 4563 * we have a collision. generate new random 4564 * ifid. 4565 */ 4566 sppp_suggest_ip6_addr(&lastsuggest); 4567 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4568 lastsuggest)) { 4569 if (debug) 4570 addlog(" [random]"); 4571 sppp_gen_ip6_addr(sp, &suggestaddr); 4572 } 4573 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4574 if (debug) 4575 addlog(" [agree]"); 4576 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4577 } 4578 #else 4579 /* 4580 * Since we do not do dynamic address assignment, 4581 * we ignore it and thus continue to negotiate 4582 * our already existing value. This can possibly 4583 * go into infinite request-reject loop. 4584 * 4585 * This is not likely because we normally use 4586 * ifid based on MAC-address. 4587 * If you have no ethernet card on the node, too bad. 4588 * XXX should we use fail_counter? 4589 */ 4590 #endif 4591 break; 4592 #ifdef notyet 4593 case IPV6CP_OPT_COMPRESS: 4594 /* 4595 * Peer wants different compression parameters. 4596 */ 4597 break; 4598 #endif 4599 } 4600 } 4601 if (debug) 4602 addlog("\n"); 4603 end: 4604 return; 4605 } 4606 4607 static void 4608 sppp_ipv6cp_tlu(struct sppp *sp) 4609 { 4610 4611 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n"); 4612 sppp_rt_ifmsg(sp); 4613 } 4614 4615 static void 4616 sppp_ipv6cp_tld(struct sppp *sp) 4617 { 4618 4619 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n"); 4620 sppp_rt_ifmsg(sp); 4621 } 4622 4623 static void 4624 sppp_ipv6cp_scr(struct sppp *sp) 4625 { 4626 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4627 struct in6_addr ouraddr; 4628 int i = 0; 4629 4630 KASSERT(SPPP_WLOCKED(sp)); 4631 4632 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4633 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4634 4635 opt[i++] = IPV6CP_OPT_IFID; 4636 opt[i++] = 10; 4637 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4638 i += 8; 4639 } 4640 4641 #ifdef notyet 4642 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4643 opt[i++] = IPV6CP_OPT_COMPRESSION; 4644 opt[i++] = 4; 4645 opt[i++] = 0; /* TBD */ 4646 opt[i++] = 0; /* TBD */ 4647 /* variable length data may follow */ 4648 } 4649 #endif 4650 4651 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4652 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4653 } 4654 #else /*INET6*/ 4655 static void 4656 sppp_ipv6cp_init(struct sppp *sp) 4657 { 4658 4659 KASSERT(SPPP_WLOCKED(sp)); 4660 } 4661 4662 static void 4663 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4664 { 4665 4666 KASSERT(SPPP_WLOCKED(sp)); 4667 } 4668 4669 static enum cp_rcr_type 4670 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4671 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4672 { 4673 4674 KASSERT(SPPP_WLOCKED(sp)); 4675 return 0; 4676 } 4677 4678 static void 4679 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4680 int len) 4681 { 4682 4683 KASSERT(SPPP_WLOCKED(sp)); 4684 } 4685 4686 static void 4687 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4688 int len) 4689 { 4690 4691 KASSERT(SPPP_WLOCKED(sp)); 4692 } 4693 4694 static void 4695 sppp_ipv6cp_tlu(struct sppp *sp) 4696 { 4697 4698 KASSERT(SPPP_WLOCKED(sp)); 4699 } 4700 4701 static void 4702 sppp_ipv6cp_tld(struct sppp *sp) 4703 { 4704 4705 KASSERT(SPPP_WLOCKED(sp)); 4706 } 4707 4708 static void 4709 sppp_ipv6cp_scr(struct sppp *sp) 4710 { 4711 4712 KASSERT(SPPP_WLOCKED(sp)); 4713 } 4714 #endif /*INET6*/ 4715 4716 /* 4717 *--------------------------------------------------------------------------* 4718 * * 4719 * The CHAP implementation. * 4720 * * 4721 *--------------------------------------------------------------------------* 4722 */ 4723 /* 4724 * The authentication protocols is implemented on the state machine for 4725 * control protocols. And it uses following actions and events. 4726 * 4727 * Actions: 4728 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4729 * - sca: send CHAP_SUCCESS 4730 * - scn: send CHAP_FAILURE and shutdown lcp 4731 * Events: 4732 * - RCR+: receive CHAP_RESPONSE containing correct digest 4733 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4734 * - RCA: receive CHAP_SUCCESS 4735 * - RCN: (this event is unused) 4736 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4737 * - TO-: this layer finish 4738 */ 4739 4740 /* 4741 * Handle incoming CHAP packets. 4742 */ 4743 void 4744 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4745 { 4746 const bool debug = sppp_debug_enabled(sp); 4747 struct ifnet *ifp = &sp->pp_if; 4748 struct lcp_header *h; 4749 int len = m->m_pkthdr.len; 4750 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4751 int value_len, name_len; 4752 MD5_CTX ctx; 4753 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4754 const char *authname; 4755 4756 KASSERT(SPPP_WLOCKED(sp)); 4757 4758 if (len < 4) { 4759 SPPP_DLOG(sp, "chap invalid packet length: " 4760 "%d bytes\n", len); 4761 return; 4762 } 4763 h = mtod(m, struct lcp_header *); 4764 if (len > ntohs(h->len)) 4765 len = ntohs(h->len); 4766 4767 switch (h->type) { 4768 /* challenge, failure and success are his authproto */ 4769 case CHAP_CHALLENGE: 4770 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4771 /* can't do anything useful */ 4772 sp->pp_auth_failures++; 4773 SPPP_DLOG(sp, "chap input " 4774 "without my name and my secret being set\n"); 4775 break; 4776 } 4777 value = 1 + (u_char *)(h + 1); 4778 value_len = value[-1]; 4779 name = value + value_len; 4780 name_len = len - value_len - 5; 4781 if (name_len < 0) { 4782 if (debug) { 4783 authname = sppp_auth_type_name(abuf, 4784 sizeof(abuf), PPP_CHAP, h->type); 4785 SPPP_LOG(sp, LOG_DEBUG, 4786 "chap corrupted challenge " 4787 "<%s id=0x%x len=%d", 4788 authname, h->ident, ntohs(h->len)); 4789 if (len > 4) 4790 sppp_print_bytes((u_char *)(h + 1), 4791 len - 4); 4792 addlog(">\n"); 4793 } 4794 break; 4795 } 4796 4797 if (debug) { 4798 authname = sppp_auth_type_name(abuf, 4799 sizeof(abuf), PPP_CHAP, h->type); 4800 SPPP_LOG(sp, LOG_DEBUG, 4801 "chap input <%s id=0x%x len=%d name=", 4802 authname, h->ident, ntohs(h->len)); 4803 sppp_print_string((char *) name, name_len); 4804 addlog(" value-size=%d value=", value_len); 4805 sppp_print_bytes(value, value_len); 4806 addlog(">\n"); 4807 } 4808 4809 /* Compute reply value. */ 4810 MD5Init(&ctx); 4811 MD5Update(&ctx, &h->ident, 1); 4812 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4813 MD5Update(&ctx, value, value_len); 4814 MD5Final(sp->chap.digest, &ctx); 4815 sp->chap.digest_len = sizeof(sp->chap.digest); 4816 sp->scp[IDX_CHAP].rconfid = h->ident; 4817 4818 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4819 break; 4820 4821 case CHAP_SUCCESS: 4822 if (debug) { 4823 SPPP_LOG(sp, LOG_DEBUG, "chap success"); 4824 if (len > 4) { 4825 addlog(": "); 4826 sppp_print_string((char *)(h + 1), len - 4); 4827 } 4828 addlog("\n"); 4829 } 4830 4831 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4832 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4833 chap.name, h->ident, 4834 sp->scp[IDX_CHAP].rconfid); 4835 if_statinc(ifp, if_ierrors); 4836 break; 4837 } 4838 4839 if (sp->chap.digest_len == 0) { 4840 SPPP_DLOG(sp, "receive CHAP success" 4841 " without challenge\n"); 4842 if_statinc(ifp, if_ierrors); 4843 break; 4844 } 4845 4846 sp->pp_auth_failures = 0; 4847 sp->pp_flags &= ~PP_NEEDAUTH; 4848 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4849 sp->chap.digest_len = 0; 4850 4851 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4852 /* 4853 * we are not authenticator for CHAP, 4854 * generate a dummy RCR+ event without CHAP_RESPONSE 4855 */ 4856 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4857 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4858 } 4859 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4860 break; 4861 4862 case CHAP_FAILURE: 4863 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4864 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4865 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid); 4866 if_statinc(ifp, if_ierrors); 4867 break; 4868 } 4869 4870 if (sp->chap.digest_len == 0) { 4871 SPPP_DLOG(sp, "receive CHAP failure " 4872 "without challenge\n"); 4873 if_statinc(ifp, if_ierrors); 4874 break; 4875 } 4876 4877 sp->pp_auth_failures++; 4878 SPPP_LOG(sp, LOG_INFO, "chap failure"); 4879 if (debug) { 4880 if (len > 4) { 4881 addlog(": "); 4882 sppp_print_string((char *)(h + 1), len - 4); 4883 } 4884 } 4885 addlog("\n"); 4886 4887 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4888 sp->chap.digest_len = 0; 4889 /* 4890 * await LCP shutdown by authenticator, 4891 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4892 */ 4893 break; 4894 4895 /* response is my authproto */ 4896 case CHAP_RESPONSE: 4897 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4898 /* can't do anything useful */ 4899 SPPP_DLOG(sp, "chap response " 4900 "without his name and his secret being set\n"); 4901 break; 4902 } 4903 value = 1 + (u_char *)(h + 1); 4904 value_len = value[-1]; 4905 name = value + value_len; 4906 name_len = len - value_len - 5; 4907 if (name_len < 0) { 4908 if (debug) { 4909 authname = sppp_auth_type_name(abuf, 4910 sizeof(abuf), PPP_CHAP, h->type); 4911 SPPP_LOG(sp, LOG_DEBUG, 4912 "chap corrupted response " 4913 "<%s id=0x%x len=%d", 4914 authname, h->ident, ntohs(h->len)); 4915 if (len > 4) 4916 sppp_print_bytes((u_char *)(h + 1), 4917 len - 4); 4918 addlog(">\n"); 4919 } 4920 break; 4921 } 4922 if (h->ident != sp->scp[IDX_CHAP].confid) { 4923 SPPP_DLOG(sp, "chap dropping response for old ID " 4924 "(got %d, expected %d)\n", 4925 h->ident, sp->scp[IDX_CHAP].confid); 4926 break; 4927 } else { 4928 sp->scp[IDX_CHAP].rconfid = h->ident; 4929 } 4930 4931 if (sp->hisauth.name != NULL && 4932 (name_len != sp->hisauth.name_len 4933 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4934 SPPP_LOG(sp, LOG_INFO, 4935 "chap response, his name "); 4936 sppp_print_string(name, name_len); 4937 addlog(" != expected "); 4938 sppp_print_string(sp->hisauth.name, 4939 sp->hisauth.name_len); 4940 addlog("\n"); 4941 4942 /* generate RCR- event */ 4943 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4944 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4945 break; 4946 } 4947 4948 if (debug) { 4949 authname = sppp_auth_type_name(abuf, 4950 sizeof(abuf), PPP_CHAP, h->type); 4951 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) " 4952 "<%s id=0x%x len=%d name=", 4953 sppp_state_name(sp->scp[IDX_CHAP].state), 4954 authname, h->ident, ntohs(h->len)); 4955 sppp_print_string((char *)name, name_len); 4956 addlog(" value-size=%d value=", value_len); 4957 sppp_print_bytes(value, value_len); 4958 addlog(">\n"); 4959 } 4960 4961 if (value_len == sizeof(sp->chap.challenge) && 4962 value_len == sizeof(sp->chap.digest)) { 4963 MD5Init(&ctx); 4964 MD5Update(&ctx, &h->ident, 1); 4965 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4966 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4967 MD5Final(digest, &ctx); 4968 4969 if (memcmp(digest, value, value_len) == 0) { 4970 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4971 } else { 4972 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4973 } 4974 } else { 4975 if (debug) { 4976 SPPP_LOG(sp, LOG_DEBUG, 4977 "chap bad hash value length: " 4978 "%d bytes, should be %zu\n", 4979 value_len, sizeof(sp->chap.challenge)); 4980 } 4981 4982 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4983 } 4984 4985 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4986 4987 /* generate a dummy RCA event */ 4988 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4989 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4990 sp->chap.rechallenging)) { 4991 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4992 } 4993 break; 4994 4995 default: 4996 /* Unknown CHAP packet type -- ignore. */ 4997 if (debug) { 4998 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) " 4999 "<0x%x id=0x%xh len=%d", 5000 sppp_state_name(sp->scp[IDX_CHAP].state), 5001 h->type, h->ident, ntohs(h->len)); 5002 if (len > 4) 5003 sppp_print_bytes((u_char *)(h + 1), len - 4); 5004 addlog(">\n"); 5005 } 5006 break; 5007 5008 } 5009 } 5010 5011 static void 5012 sppp_chap_init(struct sppp *sp) 5013 { 5014 5015 KASSERT(SPPP_WLOCKED(sp)); 5016 5017 sppp_cp_init(&chap, sp); 5018 5019 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 5020 sppp_chap_rcv_challenge_event, &chap); 5021 } 5022 5023 static void 5024 sppp_chap_open(struct sppp *sp, void *xcp) 5025 { 5026 5027 KASSERT(SPPP_WLOCKED(sp)); 5028 5029 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 5030 sp->chap.digest_len = 0; 5031 sp->chap.rechallenging = false; 5032 sp->chap.response_rcvd = false; 5033 sppp_open_event(sp, xcp); 5034 } 5035 5036 static void 5037 sppp_chap_tlu(struct sppp *sp) 5038 { 5039 int i; 5040 5041 KASSERT(SPPP_WLOCKED(sp)); 5042 5043 i = 0; 5044 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 5045 sp->pp_auth_failures = 0; 5046 5047 SPPP_LOG(sp, LOG_DEBUG, "chap %s", 5048 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 5049 5050 /* 5051 * Some broken CHAP implementations (Conware CoNet, firmware 5052 * 4.0.?) don't want to re-authenticate their CHAP once the 5053 * initial challenge-response exchange has taken place. 5054 * Provide for an option to avoid rechallenges. 5055 */ 5056 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 5057 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5058 /* 5059 * Compute the re-challenge timeout. This will yield 5060 * a number between 300 and 810 seconds. 5061 */ 5062 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 5063 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 5064 5065 if (sppp_debug_enabled(sp)) { 5066 addlog(", next rechallenge in %d seconds", i); 5067 } 5068 } 5069 5070 addlog("\n"); 5071 5072 /* 5073 * If we are already in phase network, we are done here. This 5074 * is the case if this is a dummy tlu event after a re-challenge. 5075 */ 5076 if (sp->pp_phase != SPPP_PHASE_NETWORK) 5077 sppp_phase_network(sp); 5078 } 5079 5080 static void 5081 sppp_chap_scr(struct sppp *sp) 5082 { 5083 uint32_t *ch; 5084 u_char clen, dsize; 5085 int role; 5086 5087 KASSERT(SPPP_WLOCKED(sp)); 5088 5089 role = sppp_auth_role(&chap, sp); 5090 5091 if (ISSET(role, SPPP_AUTH_SERV) && 5092 !sp->chap.response_rcvd) { 5093 /* we are authenticator for CHAP, send challenge */ 5094 ch = (uint32_t *)sp->chap.challenge; 5095 clen = sizeof(sp->chap.challenge); 5096 /* Compute random challenge. */ 5097 cprng_strong(kern_cprng, ch, clen, 0); 5098 5099 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 5100 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 5101 sizeof(clen), (const char *)&clen, 5102 sizeof(sp->chap.challenge), sp->chap.challenge, 5103 0); 5104 } 5105 5106 if (ISSET(role, SPPP_AUTH_PEER) && 5107 sp->chap.digest_len > 0) { 5108 /* we are peer for CHAP, send response */ 5109 dsize = sp->chap.digest_len; 5110 5111 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 5112 sizeof(dsize), (const char *)&dsize, 5113 sp->chap.digest_len, sp->chap.digest, 5114 sp->myauth.name_len, sp->myauth.name, 0); 5115 } 5116 } 5117 5118 static void 5119 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5120 { 5121 const struct cp *cp = xcp; 5122 5123 KASSERT(!cpu_softintr_p()); 5124 5125 sp->chap.rechallenging = false; 5126 5127 switch (sp->scp[IDX_CHAP].state) { 5128 case STATE_REQ_SENT: 5129 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5130 cp->scr(sp); 5131 break; 5132 case STATE_OPENED: 5133 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5134 cp->scr(sp); 5135 break; 5136 } 5137 } 5138 5139 /* 5140 *--------------------------------------------------------------------------* 5141 * * 5142 * The PAP implementation. * 5143 * * 5144 *--------------------------------------------------------------------------* 5145 */ 5146 /* 5147 * PAP uses following actions and events. 5148 * Actions: 5149 * - scr: send PAP_REQ 5150 * - sca: send PAP_ACK 5151 * - scn: send PAP_NAK 5152 * Events: 5153 * - RCR+: receive PAP_REQ containing correct username and password 5154 * - RCR-: receive PAP_REQ containing wrong username and password 5155 * - RCA: receive PAP_ACK 5156 * - RCN: (this event is unused) 5157 * - TO+: re-send PAP_REQ 5158 * - TO-: this layer finish 5159 */ 5160 5161 /* 5162 * Handle incoming PAP packets. */ 5163 static void 5164 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5165 { 5166 const bool debug = sppp_debug_enabled(sp); 5167 struct ifnet *ifp = &sp->pp_if; 5168 struct lcp_header *h; 5169 int len; 5170 char *name, *secret; 5171 int name_len, secret_len; 5172 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5173 const char *authname; 5174 5175 KASSERT(SPPP_WLOCKED(sp)); 5176 /* 5177 * Malicious input might leave this uninitialized, so 5178 * init to an impossible value. 5179 */ 5180 secret_len = -1; 5181 5182 len = m->m_pkthdr.len; 5183 if (len < 5) { 5184 SPPP_DLOG(sp, "pap invalid packet length: " 5185 "%d bytes\n", len); 5186 return; 5187 } 5188 h = mtod(m, struct lcp_header *); 5189 if (len > ntohs(h->len)) 5190 len = ntohs(h->len); 5191 5192 switch (h->type) { 5193 /* PAP request is my authproto */ 5194 case PAP_REQ: 5195 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5196 /* can't do anything useful */ 5197 SPPP_DLOG(sp, "pap request" 5198 " without his name and his secret being set\n"); 5199 break; 5200 } 5201 name = 1 + (u_char *)(h + 1); 5202 name_len = name[-1]; 5203 secret = name + name_len + 1; 5204 if (name_len > len - 6 || 5205 (secret_len = secret[-1]) > len - 6 - name_len) { 5206 if (debug) { 5207 authname = sppp_auth_type_name(abuf, 5208 sizeof(abuf), PPP_PAP, h->type); 5209 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5210 "<%s id=0x%x len=%d", 5211 authname, h->ident, ntohs(h->len)); 5212 if (len > 4) 5213 sppp_print_bytes((u_char *)(h + 1), 5214 len - 4); 5215 addlog(">\n"); 5216 } 5217 break; 5218 } 5219 if (debug) { 5220 authname = sppp_auth_type_name(abuf, 5221 sizeof(abuf), PPP_PAP, h->type); 5222 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) " 5223 "<%s id=0x%x len=%d name=", 5224 sppp_state_name(sp->scp[IDX_PAP].state), 5225 authname, h->ident, ntohs(h->len)); 5226 sppp_print_string((char *)name, name_len); 5227 addlog(" secret="); 5228 sppp_print_string((char *)secret, secret_len); 5229 addlog(">\n"); 5230 } 5231 5232 sp->scp[IDX_PAP].rconfid = h->ident; 5233 5234 if (name_len == sp->hisauth.name_len && 5235 memcmp(name, sp->hisauth.name, name_len) == 0 && 5236 secret_len == sp->hisauth.secret_len && 5237 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5238 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5239 } else { 5240 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5241 } 5242 5243 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5244 5245 /* generate a dummy RCA event */ 5246 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5247 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5248 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5249 } 5250 break; 5251 5252 /* ack and nak are his authproto */ 5253 case PAP_ACK: 5254 if (debug) { 5255 SPPP_LOG(sp, LOG_DEBUG, "pap success"); 5256 name = 1 + (u_char *)(h + 1); 5257 name_len = name[-1]; 5258 if (len > 5 && name_len < len+4) { 5259 addlog(": "); 5260 sppp_print_string(name, name_len); 5261 } 5262 addlog("\n"); 5263 } 5264 5265 if (h->ident != sp->scp[IDX_PAP].confid) { 5266 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5267 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5268 if_statinc(ifp, if_ierrors); 5269 break; 5270 } 5271 5272 sp->pp_auth_failures = 0; 5273 sp->pp_flags &= ~PP_NEEDAUTH; 5274 5275 /* we are not authenticator, generate a dummy RCR+ event */ 5276 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5277 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5278 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5279 } 5280 5281 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5282 break; 5283 5284 case PAP_NAK: 5285 if (debug) { 5286 SPPP_LOG(sp, LOG_INFO, "pap failure"); 5287 name = 1 + (u_char *)(h + 1); 5288 name_len = name[-1]; 5289 if (len > 5 && name_len < len+4) { 5290 addlog(": "); 5291 sppp_print_string(name, name_len); 5292 } 5293 addlog("\n"); 5294 } else { 5295 SPPP_LOG(sp, LOG_INFO, "pap failure\n"); 5296 } 5297 5298 if (h->ident != sp->scp[IDX_PAP].confid) { 5299 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5300 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5301 if_statinc(ifp, if_ierrors); 5302 break; 5303 } 5304 5305 sp->pp_auth_failures++; 5306 /* 5307 * await LCP shutdown by authenticator, 5308 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5309 */ 5310 break; 5311 5312 default: 5313 /* Unknown PAP packet type -- ignore. */ 5314 if (debug) { 5315 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5316 "<0x%x id=0x%x len=%d", 5317 h->type, h->ident, ntohs(h->len)); 5318 if (len > 4) 5319 sppp_print_bytes((u_char *)(h + 1), len - 4); 5320 addlog(">\n"); 5321 } 5322 break; 5323 } 5324 } 5325 5326 static void 5327 sppp_pap_init(struct sppp *sp) 5328 { 5329 5330 KASSERT(SPPP_WLOCKED(sp)); 5331 sppp_cp_init(&pap, sp); 5332 } 5333 5334 static void 5335 sppp_pap_tlu(struct sppp *sp) 5336 { 5337 5338 SPPP_DLOG(sp, "%s tlu\n", pap.name); 5339 5340 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5341 sp->pp_auth_failures = 0; 5342 5343 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5344 sppp_phase_network(sp); 5345 } 5346 5347 static void 5348 sppp_pap_scr(struct sppp *sp) 5349 { 5350 u_char idlen, pwdlen; 5351 5352 KASSERT(SPPP_WLOCKED(sp)); 5353 5354 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5355 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5356 if (sp->myauth.secret == NULL || 5357 sp->myauth.name == NULL) { 5358 SPPP_LOG(sp, LOG_DEBUG, 5359 "couldn't send PAP_REQ " 5360 "because of no name or no secret\n"); 5361 } else { 5362 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5363 pwdlen = sp->myauth.secret_len; 5364 idlen = sp->myauth.name_len; 5365 5366 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5367 sizeof idlen, (const char *)&idlen, 5368 idlen, sp->myauth.name, 5369 sizeof pwdlen, (const char *)&pwdlen, 5370 pwdlen, sp->myauth.secret, 5371 0); 5372 } 5373 } 5374 } 5375 5376 /* 5377 * Random miscellaneous functions. 5378 */ 5379 5380 /* 5381 * Send a PAP or CHAP proto packet. 5382 * 5383 * Variadic function, each of the elements for the ellipsis is of type 5384 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5385 * mlen == 0. 5386 * NOTE: never declare variadic functions with types subject to type 5387 * promotion (i.e. u_char). This is asking for big trouble depending 5388 * on the architecture you are on... 5389 */ 5390 5391 static void 5392 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5393 unsigned int type, unsigned int id, 5394 ...) 5395 { 5396 struct ifnet *ifp = &sp->pp_if; 5397 struct lcp_header *lh; 5398 struct mbuf *m; 5399 u_char *p; 5400 int len; 5401 size_t pkthdrlen; 5402 unsigned int mlen; 5403 const char *msg; 5404 va_list ap; 5405 5406 KASSERT(SPPP_WLOCKED(sp)); 5407 5408 MGETHDR(m, M_DONTWAIT, MT_DATA); 5409 if (! m) 5410 return; 5411 m_reset_rcvif(m); 5412 5413 if (ISSET(sp->pp_dev_flags, PP_DEVF_NOFRAMING)) { 5414 *mtod(m, uint16_t *) = htons(cp->proto); 5415 pkthdrlen = 2; 5416 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5417 } else { 5418 struct ppp_header *h; 5419 h = mtod(m, struct ppp_header *); 5420 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5421 h->control = PPP_UI; /* Unnumbered Info */ 5422 h->protocol = htons(cp->proto); 5423 pkthdrlen = PPP_HEADER_LEN; 5424 5425 lh = (struct lcp_header *)(h + 1); 5426 } 5427 5428 lh->type = type; 5429 lh->ident = id; 5430 p = (u_char *)(lh + 1); 5431 5432 va_start(ap, id); 5433 len = 0; 5434 5435 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5436 msg = va_arg(ap, const char *); 5437 len += mlen; 5438 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5439 va_end(ap); 5440 m_freem(m); 5441 return; 5442 } 5443 5444 memcpy(p, msg, mlen); 5445 p += mlen; 5446 } 5447 va_end(ap); 5448 5449 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5450 lh->len = htons(LCP_HEADER_LEN + len); 5451 5452 if (sppp_debug_enabled(sp)) { 5453 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5454 const char *authname; 5455 5456 authname = sppp_auth_type_name(abuf, 5457 sizeof(abuf), cp->proto, lh->type); 5458 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 5459 cp->name, authname, 5460 lh->ident, ntohs(lh->len)); 5461 if (len) 5462 sppp_print_bytes((u_char *)(lh + 1), len); 5463 addlog(">\n"); 5464 } 5465 if (IF_QFULL(&sp->pp_cpq)) { 5466 IF_DROP(&sp->pp_fastq); 5467 IF_DROP(&ifp->if_snd); 5468 m_freem(m); 5469 return; 5470 } 5471 5472 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5473 IF_ENQUEUE(&sp->pp_cpq, m); 5474 5475 if (! (ifp->if_flags & IFF_OACTIVE)) { 5476 SPPP_UNLOCK(sp); 5477 if_start_lock(ifp); 5478 SPPP_LOCK(sp, RW_WRITER); 5479 } 5480 } 5481 5482 static int 5483 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5484 { 5485 int role; 5486 5487 role = SPPP_AUTH_NOROLE; 5488 5489 if (sp->hisauth.proto == cp->proto && 5490 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5491 SET(role, SPPP_AUTH_SERV); 5492 5493 if (sp->myauth.proto == cp->proto) 5494 SET(role, SPPP_AUTH_PEER); 5495 5496 return role; 5497 } 5498 5499 static void 5500 sppp_auth_to_event(struct sppp *sp, void *xcp) 5501 { 5502 const struct cp *cp = xcp; 5503 bool override; 5504 int state; 5505 5506 KASSERT(SPPP_WLOCKED(sp)); 5507 KASSERT(!cpu_softintr_p()); 5508 5509 override = false; 5510 state = sp->scp[cp->protoidx].state; 5511 5512 if (sp->scp[cp->protoidx].rst_counter > 0) { 5513 /* override TO+ event */ 5514 switch (state) { 5515 case STATE_OPENED: 5516 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5517 override = true; 5518 sp->chap.rechallenging = true; 5519 sp->chap.response_rcvd = false; 5520 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5521 cp->scr(sp); 5522 } 5523 break; 5524 5525 case STATE_ACK_RCVD: 5526 override = true; 5527 cp->scr(sp); 5528 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5529 break; 5530 } 5531 } 5532 5533 if (override) { 5534 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", 5535 cp->name, sppp_state_name(state), 5536 sp->scp[cp->protoidx].rst_counter); 5537 sp->scp[cp->protoidx].rst_counter--; 5538 } else { 5539 sppp_to_event(sp, xcp); 5540 } 5541 } 5542 5543 static void 5544 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5545 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5546 { 5547 static const char *succmsg = "Welcome!"; 5548 static const char *failmsg = "Failed..."; 5549 const char *msg; 5550 u_char type, mlen; 5551 5552 KASSERT(SPPP_WLOCKED(sp)); 5553 5554 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5555 return; 5556 5557 if (ctype == CONF_ACK) { 5558 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5559 msg = succmsg; 5560 mlen = sizeof(succmsg) - 1; 5561 5562 sp->pp_auth_failures = 0; 5563 } else { 5564 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5565 msg = failmsg; 5566 mlen = sizeof(failmsg) - 1; 5567 5568 /* Reset LCP if auth failed */ 5569 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5570 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 5571 sp->pp_auth_failures++; 5572 } 5573 5574 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5575 } 5576 5577 /* 5578 * Send keepalive packets, every 10 seconds. 5579 */ 5580 static void 5581 sppp_keepalive(void *dummy) 5582 { 5583 struct sppp *sp; 5584 uint32_t now, last_activity, last_receive; 5585 5586 SPPPQ_LOCK(); 5587 5588 now = time_uptime32; 5589 for (sp=spppq; sp; sp=sp->pp_next) { 5590 SPPP_LOCK(sp, RW_WRITER); 5591 last_activity = atomic_load_relaxed(&sp->pp_last_activity); 5592 last_receive = atomic_load_relaxed(&sp->pp_last_receive); 5593 5594 /* check idle timeout */ 5595 if ((sp->pp_idle_timeout != 0) && sp->pp_connecting 5596 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5597 /* idle timeout is enabled for this interface */ 5598 if ((now - last_activity) >= sp->pp_idle_timeout) { 5599 SPPP_DLOG(sp, "no activity for %lu seconds\n", 5600 (unsigned long)(now - last_activity)); 5601 sppp_disconnect(sp); 5602 if (!sp->pp_ondemand) 5603 sppp_connect(sp); 5604 SPPP_UNLOCK(sp); 5605 continue; 5606 } 5607 } 5608 5609 /* Keepalive mode disabled or channel down? */ 5610 if (! ISSET(sp->pp_dev_flags, PP_DEVF_KEEPALIVE) || 5611 ! sp->pp_connecting) { 5612 SPPP_UNLOCK(sp); 5613 continue; 5614 } 5615 5616 /* No keepalive in PPP mode if LCP not opened yet. */ 5617 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5618 SPPP_UNLOCK(sp); 5619 continue; 5620 } 5621 5622 /* No echo reply, but maybe user data passed through? */ 5623 if (sp->pp_max_noreceive != 0 && 5624 (now - last_receive) < sp->pp_max_noreceive) { 5625 sp->pp_alivecnt = 0; 5626 SPPP_UNLOCK(sp); 5627 continue; 5628 } 5629 5630 /* No echo request */ 5631 if (sp->pp_alive_interval == 0) { 5632 SPPP_UNLOCK(sp); 5633 continue; 5634 } 5635 5636 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5637 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5638 SPPP_UNLOCK(sp); 5639 continue; 5640 } 5641 5642 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5643 /* No keepalive packets got. Stop the interface. */ 5644 SPPP_LOG(sp, LOG_INFO,"LCP keepalive timed out, " 5645 "going to restart the connection\n"); 5646 5647 sp->pp_alivecnt = 0; 5648 5649 if (sp->pp_flags & PP_IFDOWN) 5650 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5651 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5652 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 5653 5654 SPPP_UNLOCK(sp); 5655 continue; 5656 } 5657 if (sp->pp_alivecnt < sp->pp_maxalive) 5658 ++sp->pp_alivecnt; 5659 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5660 int32_t nmagic = htonl(sp->lcp.magic); 5661 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5662 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5663 sp->lcp.echoid, 4, &nmagic); 5664 } 5665 5666 SPPP_UNLOCK(sp); 5667 } 5668 sppp_keepalive_cnt++; 5669 callout_schedule(&keepalive_ch, hz * sppp_keepalive_interval); 5670 5671 SPPPQ_UNLOCK(); 5672 } 5673 5674 #ifdef INET 5675 /* 5676 * Get both IP addresses. 5677 */ 5678 static void 5679 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5680 { 5681 struct ifnet *ifp = &sp->pp_if; 5682 struct ifaddr *ifa; 5683 uint32_t ssrc, ddst; 5684 int bound; 5685 struct psref psref; 5686 5687 ssrc = ddst = 0; 5688 /* 5689 * Pick the first AF_INET address from the list, 5690 * aliases don't make any sense on a p2p link anyway. 5691 */ 5692 bound = curlwp_bind(); 5693 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5694 if (ifa != NULL) { 5695 struct sockaddr_in *si = satosin(ifa->ifa_addr); 5696 struct sockaddr_in *sm = satosin(ifa->ifa_netmask); 5697 if (si->sin_addr.s_addr) { 5698 ssrc = si->sin_addr.s_addr; 5699 if (srcmask) 5700 *srcmask = ntohl(sm->sin_addr.s_addr); 5701 } 5702 5703 si = satosin(ifa->ifa_dstaddr); 5704 if (si && si->sin_addr.s_addr) 5705 ddst = si->sin_addr.s_addr; 5706 ifa_release(ifa, &psref); 5707 } 5708 curlwp_bindx(bound); 5709 5710 if (dst) *dst = ntohl(ddst); 5711 if (src) *src = ntohl(ssrc); 5712 } 5713 5714 /* 5715 * Set IP addresses. 5716 * If an address is 0, leave it the way it is. 5717 */ 5718 static void 5719 sppp_set_ip_addrs(struct sppp *sp) 5720 { 5721 struct ifnet *ifp = &sp->pp_if; 5722 struct ifaddr *ifa; 5723 struct sockaddr_in *si, *dest; 5724 uint32_t myaddr = 0, hisaddr = 0; 5725 int bound; 5726 struct psref psref; 5727 5728 KASSERT(SPPP_WLOCKED(sp)); 5729 5730 SPPP_UNLOCK(sp); 5731 IFNET_LOCK(ifp); 5732 SPPP_LOCK(sp, RW_WRITER); 5733 5734 /* 5735 * Pick the first AF_INET address from the list, 5736 * aliases don't make any sense on a p2p link anyway. 5737 */ 5738 si = dest = NULL; 5739 bound = curlwp_bind(); 5740 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5741 if (ifa != NULL) { 5742 si = satosin(ifa->ifa_addr); 5743 dest = satosin(ifa->ifa_dstaddr); 5744 } 5745 5746 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5747 myaddr = sp->ipcp.req_myaddr; 5748 else if (si != NULL) 5749 myaddr = ntohl(si->sin_addr.s_addr); 5750 5751 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5752 hisaddr = sp->ipcp.req_hisaddr; 5753 else if (dest != NULL) 5754 hisaddr = ntohl(dest->sin_addr.s_addr); 5755 5756 if (si != NULL && dest != NULL) { 5757 int error; 5758 struct sockaddr_in new_sin = *si; 5759 struct sockaddr_in new_dst = *dest; 5760 5761 if (myaddr != 0) 5762 new_sin.sin_addr.s_addr = htonl(myaddr); 5763 if (hisaddr != 0) { 5764 new_dst.sin_addr.s_addr = htonl(hisaddr); 5765 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5766 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5767 } 5768 5769 in_addrhash_remove(ifatoia(ifa)); 5770 5771 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5772 5773 in_addrhash_insert(ifatoia(ifa)); 5774 5775 if (error) { 5776 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5777 __func__, error); 5778 } else { 5779 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5780 } 5781 } 5782 if (ifa != NULL) 5783 ifa_release(ifa, &psref); 5784 curlwp_bindx(bound); 5785 5786 IFNET_UNLOCK(ifp); 5787 } 5788 5789 /* 5790 * Clear IP addresses. 5791 */ 5792 static void 5793 sppp_clear_ip_addrs(struct sppp *sp) 5794 { 5795 struct ifnet *ifp = &sp->pp_if; 5796 struct ifaddr *ifa; 5797 struct sockaddr_in *si, *dest; 5798 int bound; 5799 struct psref psref; 5800 5801 KASSERT(SPPP_WLOCKED(sp)); 5802 5803 SPPP_UNLOCK(sp); 5804 IFNET_LOCK(ifp); 5805 SPPP_LOCK(sp, RW_WRITER); 5806 5807 /* 5808 * Pick the first AF_INET address from the list, 5809 * aliases don't make any sense on a p2p link anyway. 5810 */ 5811 si = dest = NULL; 5812 bound = curlwp_bind(); 5813 ifa = if_first_addr_psref(ifp, AF_INET, &psref); 5814 if (ifa != NULL) { 5815 si = satosin(ifa->ifa_addr); 5816 dest = satosin(ifa->ifa_dstaddr); 5817 /* 5818 * ignore "0.0.0.0" which means ppp is not opened yet. 5819 */ 5820 if (si->sin_addr.s_addr == INADDR_ANY) 5821 si = NULL; 5822 } 5823 5824 if (si != NULL) { 5825 struct sockaddr_in new_sin = *si; 5826 struct sockaddr_in new_dst = *dest; 5827 int error; 5828 5829 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5830 new_sin.sin_addr.s_addr = 0; 5831 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5832 ntohl(sp->ipcp.saved_hisaddr) != 0) 5833 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5834 5835 in_addrhash_remove(ifatoia(ifa)); 5836 5837 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5838 5839 in_addrhash_insert(ifatoia(ifa)); 5840 5841 if (error) { 5842 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5843 __func__, error); 5844 } else { 5845 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5846 } 5847 } 5848 if (ifa != NULL) 5849 ifa_release(ifa, &psref); 5850 curlwp_bindx(bound); 5851 5852 IFNET_UNLOCK(ifp); 5853 } 5854 #endif 5855 5856 #ifdef INET6 5857 /* 5858 * Get both IPv6 addresses. 5859 */ 5860 static void 5861 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5862 struct in6_addr *srcmask) 5863 { 5864 struct ifnet *ifp = &sp->pp_if; 5865 struct ifaddr *ifa; 5866 struct in6_addr ssrc, ddst; 5867 int bound; 5868 struct psref psref; 5869 5870 memset(&ssrc, 0, sizeof(ssrc)); 5871 memset(&ddst, 0, sizeof(ddst)); 5872 /* 5873 * Pick the first link-local AF_INET6 address from the list, 5874 * aliases don't make any sense on a p2p link anyway. 5875 */ 5876 bound = curlwp_bind(); 5877 ifa = in6ifa_first_lladdr_psref(ifp, &psref); 5878 if (ifa != NULL) { 5879 struct sockaddr_in6 *si = satosin6(ifa->ifa_addr); 5880 struct sockaddr_in6 *sm = satosin6(ifa->ifa_netmask); 5881 if (!IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5882 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5883 if (srcmask) { 5884 memcpy(srcmask, &sm->sin6_addr, 5885 sizeof(*srcmask)); 5886 } 5887 } 5888 5889 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5890 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5891 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5892 ifa_release(ifa, &psref); 5893 } 5894 curlwp_bindx(bound); 5895 5896 if (dst) 5897 memcpy(dst, &ddst, sizeof(*dst)); 5898 if (src) 5899 memcpy(src, &ssrc, sizeof(*src)); 5900 } 5901 5902 #ifdef IPV6CP_MYIFID_DYN 5903 /* 5904 * Generate random ifid. 5905 */ 5906 static void 5907 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5908 { 5909 /* TBD */ 5910 } 5911 5912 /* 5913 * Set my IPv6 address. 5914 */ 5915 static void 5916 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5917 { 5918 struct ifnet *ifp = &sp->pp_if; 5919 struct ifaddr *ifa; 5920 int bound; 5921 struct psref psref; 5922 5923 KASSERT(SPPP_WLOCKED(sp)); 5924 5925 SPPP_UNLOCK(sp); 5926 IFNET_LOCK(ifp); 5927 SPPP_LOCK(sp, RW_WRITER); 5928 5929 /* 5930 * Pick the first link-local AF_INET6 address from the list, 5931 * aliases don't make any sense on a p2p link anyway. 5932 */ 5933 bound = curlwp_bind(); 5934 ifa = in6ifa_first_lladdr_psref(ifp, &psref); 5935 if (ifa != NULL) { 5936 struct sockaddr_in6 *sin6 = satosin6(ifa->ifa_addr); 5937 struct sockaddr_in6 new_sin6 = *sin6; 5938 int error; 5939 5940 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5941 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5942 if (error) { 5943 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n", 5944 __func__, error); 5945 } else { 5946 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5947 } 5948 ifa_release(ifa, &psref); 5949 } 5950 curlwp_bindx(bound); 5951 5952 IFNET_UNLOCK(ifp); 5953 } 5954 #endif 5955 5956 /* 5957 * Suggest a candidate address to be used by peer. 5958 */ 5959 static void 5960 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5961 { 5962 struct in6_addr myaddr; 5963 struct timeval tv; 5964 5965 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5966 5967 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5968 microtime(&tv); 5969 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5970 myaddr.s6_addr[14] ^= 0xff; 5971 myaddr.s6_addr[15] ^= 0xff; 5972 } else { 5973 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5974 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5975 } 5976 if (suggest) 5977 memcpy(suggest, &myaddr, sizeof(myaddr)); 5978 } 5979 #endif /*INET6*/ 5980 5981 /* 5982 * Process ioctl requests specific to the PPP interface. 5983 * Permissions have already been checked. 5984 */ 5985 static int 5986 sppp_params(struct sppp *sp, u_long cmd, void *data) 5987 { 5988 switch (cmd) { 5989 case SPPPGETAUTHCFG: 5990 { 5991 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5992 int error; 5993 size_t len; 5994 5995 SPPP_LOCK(sp, RW_READER); 5996 5997 cfg->myauthflags = sp->myauth.flags; 5998 cfg->hisauthflags = sp->hisauth.flags; 5999 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 6000 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 6001 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 6002 if (cfg->myname_length == 0) { 6003 if (sp->myauth.name != NULL) 6004 cfg->myname_length = sp->myauth.name_len + 1; 6005 } else { 6006 if (sp->myauth.name == NULL) { 6007 cfg->myname_length = 0; 6008 } else { 6009 len = sp->myauth.name_len + 1; 6010 6011 if (cfg->myname_length < len) { 6012 SPPP_UNLOCK(sp); 6013 return (ENAMETOOLONG); 6014 } 6015 error = copyout(sp->myauth.name, cfg->myname, len); 6016 if (error) { 6017 SPPP_UNLOCK(sp); 6018 return error; 6019 } 6020 } 6021 } 6022 if (cfg->hisname_length == 0) { 6023 if (sp->hisauth.name != NULL) 6024 cfg->hisname_length = sp->hisauth.name_len + 1; 6025 } else { 6026 if (sp->hisauth.name == NULL) { 6027 cfg->hisname_length = 0; 6028 } else { 6029 len = sp->hisauth.name_len + 1; 6030 6031 if (cfg->hisname_length < len) { 6032 SPPP_UNLOCK(sp); 6033 return (ENAMETOOLONG); 6034 } 6035 error = copyout(sp->hisauth.name, cfg->hisname, len); 6036 if (error) { 6037 SPPP_UNLOCK(sp); 6038 return error; 6039 } 6040 } 6041 } 6042 SPPP_UNLOCK(sp); 6043 } 6044 break; 6045 case SPPPSETAUTHCFG: 6046 { 6047 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6048 int error; 6049 6050 SPPP_LOCK(sp, RW_WRITER); 6051 6052 if (sp->myauth.name) { 6053 free(sp->myauth.name, M_DEVBUF); 6054 sp->myauth.name = NULL; 6055 } 6056 if (sp->myauth.secret) { 6057 free(sp->myauth.secret, M_DEVBUF); 6058 sp->myauth.secret = NULL; 6059 } 6060 if (sp->hisauth.name) { 6061 free(sp->hisauth.name, M_DEVBUF); 6062 sp->hisauth.name = NULL; 6063 } 6064 if (sp->hisauth.secret) { 6065 free(sp->hisauth.secret, M_DEVBUF); 6066 sp->hisauth.secret = NULL; 6067 } 6068 6069 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6070 if (cfg->hisname_length >= MCLBYTES) { 6071 SPPP_UNLOCK(sp); 6072 return (ENAMETOOLONG); 6073 } 6074 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6075 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6076 if (error) { 6077 free(sp->hisauth.name, M_DEVBUF); 6078 sp->hisauth.name = NULL; 6079 SPPP_UNLOCK(sp); 6080 return error; 6081 } 6082 sp->hisauth.name_len = cfg->hisname_length - 1; 6083 sp->hisauth.name[sp->hisauth.name_len] = 0; 6084 } 6085 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6086 if (cfg->hissecret_length >= MCLBYTES) { 6087 SPPP_UNLOCK(sp); 6088 return (ENAMETOOLONG); 6089 } 6090 sp->hisauth.secret = malloc(cfg->hissecret_length, 6091 M_DEVBUF, M_WAITOK); 6092 error = copyin(cfg->hissecret, sp->hisauth.secret, 6093 cfg->hissecret_length); 6094 if (error) { 6095 free(sp->hisauth.secret, M_DEVBUF); 6096 sp->hisauth.secret = NULL; 6097 SPPP_UNLOCK(sp); 6098 return error; 6099 } 6100 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6101 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6102 } 6103 if (cfg->myname != NULL && cfg->myname_length > 0) { 6104 if (cfg->myname_length >= MCLBYTES) { 6105 SPPP_UNLOCK(sp); 6106 return (ENAMETOOLONG); 6107 } 6108 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6109 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6110 if (error) { 6111 free(sp->myauth.name, M_DEVBUF); 6112 sp->myauth.name = NULL; 6113 SPPP_UNLOCK(sp); 6114 return error; 6115 } 6116 sp->myauth.name_len = cfg->myname_length - 1; 6117 sp->myauth.name[sp->myauth.name_len] = 0; 6118 } 6119 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6120 if (cfg->mysecret_length >= MCLBYTES) { 6121 SPPP_UNLOCK(sp); 6122 return (ENAMETOOLONG); 6123 } 6124 sp->myauth.secret = malloc(cfg->mysecret_length, 6125 M_DEVBUF, M_WAITOK); 6126 error = copyin(cfg->mysecret, sp->myauth.secret, 6127 cfg->mysecret_length); 6128 if (error) { 6129 free(sp->myauth.secret, M_DEVBUF); 6130 sp->myauth.secret = NULL; 6131 SPPP_UNLOCK(sp); 6132 return error; 6133 } 6134 sp->myauth.secret_len = cfg->mysecret_length - 1; 6135 sp->myauth.secret[sp->myauth.secret_len] = 0; 6136 } 6137 sp->myauth.flags = cfg->myauthflags; 6138 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6139 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6140 } 6141 sp->hisauth.flags = cfg->hisauthflags; 6142 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6143 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6144 } 6145 sp->pp_auth_failures = 0; 6146 if (sp->hisauth.proto != PPP_NOPROTO) 6147 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6148 else 6149 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6150 6151 SPPP_UNLOCK(sp); 6152 } 6153 break; 6154 case SPPPGETLCPCFG: 6155 { 6156 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6157 6158 SPPP_LOCK(sp, RW_READER); 6159 lcpp->lcp_timeout = sp->lcp.timeout; 6160 SPPP_UNLOCK(sp); 6161 } 6162 break; 6163 case SPPPSETLCPCFG: 6164 { 6165 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6166 6167 SPPP_LOCK(sp, RW_WRITER); 6168 sp->lcp.timeout = lcpp->lcp_timeout; 6169 SPPP_UNLOCK(sp); 6170 } 6171 break; 6172 case SPPPGETNCPCFG: 6173 { 6174 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6175 6176 SPPP_LOCK(sp, RW_READER); 6177 ncpp->ncp_flags = sp->pp_ncpflags; 6178 SPPP_UNLOCK(sp); 6179 } 6180 break; 6181 case SPPPSETNCPCFG: 6182 { 6183 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6184 6185 SPPP_LOCK(sp, RW_WRITER); 6186 sp->pp_ncpflags = ncpp->ncp_flags; 6187 SPPP_UNLOCK(sp); 6188 } 6189 break; 6190 case SPPPGETSTATUS: 6191 { 6192 struct spppstatus *status = (struct spppstatus *)data; 6193 6194 SPPP_LOCK(sp, RW_READER); 6195 status->phase = sp->pp_phase; 6196 SPPP_UNLOCK(sp); 6197 } 6198 break; 6199 case SPPPGETSTATUSNCP: 6200 { 6201 struct spppstatusncp *status = (struct spppstatusncp *)data; 6202 6203 SPPP_LOCK(sp, RW_READER); 6204 status->phase = sp->pp_phase; 6205 status->ncpup = sppp_cp_check(sp, CP_NCP); 6206 SPPP_UNLOCK(sp); 6207 } 6208 break; 6209 case SPPPGETIDLETO: 6210 { 6211 struct spppidletimeout *to = (struct spppidletimeout *)data; 6212 6213 SPPP_LOCK(sp, RW_READER); 6214 to->idle_seconds = sp->pp_idle_timeout; 6215 SPPP_UNLOCK(sp); 6216 } 6217 break; 6218 case SPPPSETIDLETO: 6219 { 6220 struct spppidletimeout *to = (struct spppidletimeout *)data; 6221 6222 SPPP_LOCK(sp, RW_WRITER); 6223 sp->pp_idle_timeout = MIN(to->idle_seconds, INT32_MAX/2); 6224 #ifdef SPPP_FILTER 6225 atomic_store_relaxed(&sp->pp_active_filt_enabled, 6226 sp->pp_idle_timeout != 0 ? true : false); 6227 #endif 6228 SPPP_UNLOCK(sp); 6229 } 6230 break; 6231 case SPPPSETAUTHFAILURE: 6232 { 6233 struct spppauthfailuresettings *afsettings = 6234 (struct spppauthfailuresettings *)data; 6235 6236 SPPP_LOCK(sp, RW_WRITER); 6237 sp->pp_max_auth_fail = afsettings->max_failures; 6238 sp->pp_auth_failures = 0; 6239 SPPP_UNLOCK(sp); 6240 } 6241 break; 6242 case SPPPGETAUTHFAILURES: 6243 { 6244 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6245 6246 SPPP_LOCK(sp, RW_READER); 6247 stats->auth_failures = sp->pp_auth_failures; 6248 stats->max_failures = sp->pp_max_auth_fail; 6249 SPPP_UNLOCK(sp); 6250 } 6251 break; 6252 case SPPPSETDNSOPTS: 6253 { 6254 struct spppdnssettings *req = (struct spppdnssettings *)data; 6255 6256 SPPP_LOCK(sp, RW_WRITER); 6257 sp->query_dns = req->query_dns & 3; 6258 SPPP_UNLOCK(sp); 6259 } 6260 break; 6261 case SPPPGETDNSOPTS: 6262 { 6263 struct spppdnssettings *req = (struct spppdnssettings *)data; 6264 6265 SPPP_LOCK(sp, RW_READER); 6266 req->query_dns = sp->query_dns; 6267 SPPP_UNLOCK(sp); 6268 } 6269 break; 6270 case SPPPGETDNSADDRS: 6271 { 6272 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6273 6274 SPPP_LOCK(sp, RW_READER); 6275 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6276 SPPP_UNLOCK(sp); 6277 } 6278 break; 6279 case SPPPGETKEEPALIVE: 6280 { 6281 struct spppkeepalivesettings *settings = 6282 (struct spppkeepalivesettings*)data; 6283 6284 SPPP_LOCK(sp, RW_READER); 6285 settings->maxalive = sp->pp_maxalive; 6286 settings->max_noreceive = sp->pp_max_noreceive; 6287 settings->alive_interval = sp->pp_alive_interval; 6288 SPPP_UNLOCK(sp); 6289 } 6290 break; 6291 case SPPPSETKEEPALIVE: 6292 { 6293 struct spppkeepalivesettings *settings = 6294 (struct spppkeepalivesettings*)data; 6295 6296 SPPP_LOCK(sp, RW_WRITER); 6297 sp->pp_maxalive = settings->maxalive; 6298 sp->pp_max_noreceive = MIN(settings->max_noreceive, 6299 INT32_MAX/2); 6300 sp->pp_alive_interval = settings->alive_interval; 6301 SPPP_UNLOCK(sp); 6302 } 6303 break; 6304 case SPPPGETLCPSTATUS: 6305 { 6306 struct sppplcpstatus *status = 6307 (struct sppplcpstatus *)data; 6308 6309 SPPP_LOCK(sp, RW_READER); 6310 status->state = sp->scp[IDX_LCP].state; 6311 status->opts = sp->lcp.opts; 6312 status->magic = sp->lcp.magic; 6313 status->mru = sp->lcp.mru; 6314 SPPP_UNLOCK(sp); 6315 } 6316 break; 6317 case SPPPGETIPCPSTATUS: 6318 { 6319 struct spppipcpstatus *status = 6320 (struct spppipcpstatus *)data; 6321 u_int32_t myaddr; 6322 6323 SPPP_LOCK(sp, RW_READER); 6324 status->state = sp->scp[IDX_IPCP].state; 6325 status->opts = sp->ipcp.opts; 6326 #ifdef INET 6327 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6328 #else 6329 myaddr = 0; 6330 #endif 6331 status->myaddr = ntohl(myaddr); 6332 SPPP_UNLOCK(sp); 6333 } 6334 break; 6335 case SPPPGETIPV6CPSTATUS: 6336 { 6337 struct spppipv6cpstatus *status = 6338 (struct spppipv6cpstatus *)data; 6339 6340 SPPP_LOCK(sp, RW_READER); 6341 status->state = sp->scp[IDX_IPV6CP].state; 6342 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6343 sizeof(status->my_ifid)); 6344 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6345 sizeof(status->his_ifid)); 6346 SPPP_UNLOCK(sp); 6347 } 6348 break; 6349 default: 6350 { 6351 int ret; 6352 6353 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6354 enosys(), ret); 6355 if (ret != ENOSYS) 6356 return ret; 6357 return (EINVAL); 6358 } 6359 } 6360 return (0); 6361 } 6362 6363 static void 6364 sppp_phase_network(struct sppp *sp) 6365 { 6366 int i; 6367 6368 KASSERT(SPPP_WLOCKED(sp)); 6369 6370 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6371 6372 /* Notify NCPs now. */ 6373 for (i = 0; i < IDX_COUNT; i++) 6374 if ((cps[i])->flags & CP_NCP) 6375 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6376 } 6377 6378 static const char * 6379 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6380 { 6381 6382 switch (type) { 6383 case CONF_REQ: return "conf-req"; 6384 case CONF_ACK: return "conf-ack"; 6385 case CONF_NAK: return "conf-nak"; 6386 case CONF_REJ: return "conf-rej"; 6387 case TERM_REQ: return "term-req"; 6388 case TERM_ACK: return "term-ack"; 6389 case CODE_REJ: return "code-rej"; 6390 case PROTO_REJ: return "proto-rej"; 6391 case ECHO_REQ: return "echo-req"; 6392 case ECHO_REPLY: return "echo-reply"; 6393 case DISC_REQ: return "discard-req"; 6394 } 6395 if (buf != NULL) 6396 snprintf(buf, buflen, "0x%02x", type); 6397 return buf; 6398 } 6399 6400 static const char * 6401 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6402 { 6403 const char *name; 6404 6405 switch (proto) { 6406 case PPP_CHAP: 6407 switch (type) { 6408 case CHAP_CHALLENGE: return "challenge"; 6409 case CHAP_RESPONSE: return "response"; 6410 case CHAP_SUCCESS: return "success"; 6411 case CHAP_FAILURE: return "failure"; 6412 default: name = "chap"; break; 6413 } 6414 break; 6415 6416 case PPP_PAP: 6417 switch (type) { 6418 case PAP_REQ: return "req"; 6419 case PAP_ACK: return "ack"; 6420 case PAP_NAK: return "nak"; 6421 default: name = "pap"; break; 6422 } 6423 break; 6424 6425 default: 6426 name = "bad"; 6427 break; 6428 } 6429 6430 if (buf != NULL) 6431 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6432 return buf; 6433 } 6434 6435 static const char * 6436 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6437 { 6438 6439 switch (opt) { 6440 case LCP_OPT_MRU: return "mru"; 6441 case LCP_OPT_ASYNC_MAP: return "async-map"; 6442 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6443 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6444 case LCP_OPT_MAGIC: return "magic"; 6445 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6446 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6447 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6448 case LCP_OPT_CALL_BACK: return "callback"; 6449 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6450 case LCP_OPT_MP_MRRU: return "mrru"; 6451 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6452 case LCP_OPT_MP_EID: return "mp-eid"; 6453 } 6454 if (buf != NULL) 6455 snprintf(buf, buflen, "0x%02x", opt); 6456 return buf; 6457 } 6458 6459 static const char * 6460 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6461 { 6462 6463 switch (opt) { 6464 case IPCP_OPT_ADDRESSES: return "addresses"; 6465 case IPCP_OPT_COMPRESSION: return "compression"; 6466 case IPCP_OPT_ADDRESS: return "address"; 6467 case IPCP_OPT_PRIMDNS: return "primdns"; 6468 case IPCP_OPT_SECDNS: return "secdns"; 6469 } 6470 if (buf != NULL) 6471 snprintf(buf, buflen, "0x%02x", opt); 6472 return buf; 6473 } 6474 6475 #ifdef INET6 6476 static const char * 6477 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6478 { 6479 6480 switch (opt) { 6481 case IPV6CP_OPT_IFID: return "ifid"; 6482 case IPV6CP_OPT_COMPRESSION: return "compression"; 6483 } 6484 if (buf != NULL) 6485 snprintf(buf, buflen, "0x%02x", opt); 6486 return buf; 6487 } 6488 #endif 6489 6490 static const char * 6491 sppp_state_name(int state) 6492 { 6493 6494 switch (state) { 6495 case STATE_INITIAL: return "initial"; 6496 case STATE_STARTING: return "starting"; 6497 case STATE_CLOSED: return "closed"; 6498 case STATE_STOPPED: return "stopped"; 6499 case STATE_CLOSING: return "closing"; 6500 case STATE_STOPPING: return "stopping"; 6501 case STATE_REQ_SENT: return "req-sent"; 6502 case STATE_ACK_RCVD: return "ack-rcvd"; 6503 case STATE_ACK_SENT: return "ack-sent"; 6504 case STATE_OPENED: return "opened"; 6505 } 6506 return "illegal"; 6507 } 6508 6509 static const char * 6510 sppp_phase_name(int phase) 6511 { 6512 6513 switch (phase) { 6514 case SPPP_PHASE_DEAD: return "dead"; 6515 case SPPP_PHASE_ESTABLISH: return "establish"; 6516 case SPPP_PHASE_TERMINATE: return "terminate"; 6517 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6518 case SPPP_PHASE_NETWORK: return "network"; 6519 } 6520 return "illegal"; 6521 } 6522 6523 static const char * 6524 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6525 { 6526 6527 switch (proto) { 6528 case PPP_LCP: return "lcp"; 6529 case PPP_IPCP: return "ipcp"; 6530 case PPP_PAP: return "pap"; 6531 case PPP_CHAP: return "chap"; 6532 case PPP_IPV6CP: return "ipv6cp"; 6533 } 6534 if (buf != NULL) { 6535 snprintf(buf, sizeof(buf), "0x%04x", 6536 (unsigned)proto); 6537 } 6538 return buf; 6539 } 6540 6541 static void 6542 sppp_print_bytes(const u_char *p, u_short len) 6543 { 6544 addlog(" %02x", *p++); 6545 while (--len > 0) 6546 addlog("-%02x", *p++); 6547 } 6548 6549 static void 6550 sppp_print_string(const char *p, u_short len) 6551 { 6552 u_char c; 6553 6554 while (len-- > 0) { 6555 c = *p++; 6556 /* 6557 * Print only ASCII chars directly. RFC 1994 recommends 6558 * using only them, but we don't rely on it. */ 6559 if (c < ' ' || c > '~') 6560 addlog("\\x%x", c); 6561 else 6562 addlog("%c", c); 6563 } 6564 } 6565 6566 static const char * 6567 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6568 { 6569 6570 if (buf != NULL) { 6571 snprintf(buf, buflen, "%u.%u.%u.%u", 6572 (unsigned int)((addr >> 24) & 0xff), 6573 (unsigned int)((addr >> 16) & 0xff), 6574 (unsigned int)((addr >> 8) & 0xff), 6575 (unsigned int)(addr & 0xff)); 6576 } 6577 return buf; 6578 } 6579 6580 /* a dummy, used to drop uninteresting events */ 6581 static void 6582 sppp_null(struct sppp *unused) 6583 { 6584 /* do just nothing */ 6585 } 6586 6587 static void 6588 sppp_tls(const struct cp *cp, struct sppp *sp) 6589 { 6590 6591 SPPP_DLOG(sp, "%s tls\n", cp->name); 6592 6593 /* notify lcp that is lower layer */ 6594 sp->lcp.protos |= (1 << cp->protoidx); 6595 } 6596 6597 static void 6598 sppp_tlf(const struct cp *cp, struct sppp *sp) 6599 { 6600 6601 SPPP_DLOG(sp, "%s tlf\n", cp->name); 6602 6603 /* notify lcp that is lower layer */ 6604 sp->lcp.protos &= ~(1 << cp->protoidx); 6605 6606 /* cleanup */ 6607 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6608 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6609 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6610 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6611 6612 sppp_lcp_check_and_close(sp); 6613 } 6614 6615 static void 6616 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6617 uint8_t ident, size_t msglen, void *msg) 6618 { 6619 6620 if (msglen == 0) 6621 return; 6622 6623 switch (type) { 6624 case CONF_ACK: 6625 case CONF_NAK: 6626 case CONF_REJ: 6627 break; 6628 default: 6629 return; 6630 } 6631 6632 if (sppp_debug_enabled(sp)) { 6633 char tbuf[SPPP_CPTYPE_NAMELEN]; 6634 const char *cpname; 6635 6636 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6637 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname); 6638 } 6639 6640 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6641 } 6642 6643 static void 6644 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6645 { 6646 6647 SPPP_UNLOCK(sp); 6648 if_down(&sp->pp_if); 6649 IF_PURGE(&sp->pp_cpq); 6650 SPPP_LOCK(sp, RW_WRITER); 6651 } 6652 6653 static void 6654 sppp_notify_up(struct sppp *sp) 6655 { 6656 6657 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6658 } 6659 6660 static void 6661 sppp_notify_down(struct sppp *sp) 6662 { 6663 6664 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6665 } 6666 6667 static void 6668 sppp_notify_tls_wlocked(struct sppp *sp) 6669 { 6670 6671 KASSERT(SPPP_WLOCKED(sp)); 6672 6673 if (!sp->pp_tls) 6674 return; 6675 6676 SPPP_UNLOCK(sp); 6677 sp->pp_tls(sp); 6678 SPPP_LOCK(sp, RW_WRITER); 6679 } 6680 6681 static void 6682 sppp_notify_tlf_wlocked(struct sppp *sp) 6683 { 6684 6685 KASSERT(SPPP_WLOCKED(sp)); 6686 6687 if (!sp->pp_tlf) 6688 return; 6689 6690 SPPP_UNLOCK(sp); 6691 sp->pp_tlf(sp); 6692 SPPP_LOCK(sp, RW_WRITER); 6693 } 6694 6695 static void 6696 sppp_wq_work(struct work *wk, void *xsp) 6697 { 6698 struct sppp *sp; 6699 struct sppp_work *work; 6700 6701 sp = xsp; 6702 work = container_of(wk, struct sppp_work, work); 6703 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6704 6705 SPPP_LOCK(sp, RW_WRITER); 6706 work->func(sp, work->arg); 6707 SPPP_UNLOCK(sp); 6708 } 6709 6710 static struct workqueue * 6711 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6712 { 6713 struct workqueue *wq; 6714 int error; 6715 6716 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6717 (void *)sp, prio, ipl, flags); 6718 if (error) { 6719 panic("%s: workqueue_create failed [%s, %d]\n", 6720 sp->pp_if.if_xname, xnamebuf, error); 6721 } 6722 6723 return wq; 6724 } 6725 6726 static void 6727 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6728 { 6729 6730 workqueue_destroy(wq); 6731 } 6732 6733 static void 6734 sppp_wq_set(struct sppp_work *work, 6735 void (*func)(struct sppp *, void *), void *arg) 6736 { 6737 6738 work->func = func; 6739 work->arg = arg; 6740 } 6741 6742 static void 6743 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6744 { 6745 6746 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6747 != SPPP_WK_FREE) 6748 return; 6749 6750 KASSERT(work->func != NULL); 6751 kpreempt_disable(); 6752 workqueue_enqueue(wq, &work->work, NULL); 6753 kpreempt_enable(); 6754 } 6755 static void 6756 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6757 { 6758 6759 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6760 workqueue_wait(wq, &work->work); 6761 } 6762 6763 #ifdef SPPP_FILTER 6764 static void 6765 sppp_update_last_activity(struct sppp *sp, struct mbuf *m, 6766 struct sppp_bpf **sbp) 6767 { 6768 struct sppp_bpf *sb; 6769 struct psref psref; 6770 int s, bound; 6771 6772 if (!atomic_load_relaxed(&sp->pp_active_filt_enabled)) 6773 return; 6774 6775 s = pserialize_read_enter(); 6776 sb = atomic_load_acquire(sbp); 6777 if (sb != NULL) { 6778 bound = curlwp_bind(); 6779 psref_acquire(&psref, &sb->sb_psref, sppp_psref_class); 6780 } 6781 pserialize_read_exit(s); 6782 6783 if (sb == NULL || 6784 bpf_filter(sb->sb_insns, (u_char *)m, m_length(m), 0)) 6785 atomic_store_relaxed(&sp->pp_last_activity, time_uptime32); 6786 6787 if (sb != NULL) { 6788 psref_release(&psref, &sb->sb_psref, sppp_psref_class); 6789 curlwp_bindx(bound); 6790 } 6791 } 6792 6793 static int 6794 sppp_set_filter(struct sppp *sp, struct bpf_program *nbp, 6795 struct sppp_bpf **dst) 6796 { 6797 struct sppp_bpf *new = NULL, *old; 6798 6799 if (nbp->bf_len > BPF_MAXINSNS) 6800 return EINVAL; 6801 6802 if (nbp->bf_len != 0) { 6803 size_t inssize = sizeof(new->sb_insns[0]) * nbp->bf_len; 6804 size_t newsize = sizeof(*new) + inssize; 6805 int error; 6806 6807 new = kmem_alloc(newsize, KM_SLEEP); 6808 new->sb_len = nbp->bf_len; 6809 error = copyin((void *)nbp->bf_insns, 6810 (void *)new->sb_insns, inssize); 6811 if (error != 0) { 6812 kmem_free(new, newsize); 6813 return error; 6814 } 6815 6816 if (!bpf_validate(new->sb_insns, new->sb_len)) { 6817 kmem_free(new, newsize); 6818 return EINVAL; 6819 } 6820 6821 psref_target_init(&new->sb_psref, sppp_psref_class); 6822 } 6823 6824 SPPP_LOCK(sp, RW_WRITER); 6825 old = *dst; 6826 atomic_store_release(dst, new); 6827 SPPP_UNLOCK(sp); 6828 pserialize_perform(sp->pp_psz); 6829 if (old != NULL) { 6830 size_t oldlen = sizeof(*old) + 6831 sizeof(old->sb_insns[0]) * old->sb_len; 6832 psref_target_destroy(&old->sb_psref, sppp_psref_class); 6833 kmem_free(old, oldlen); 6834 } 6835 6836 return 0; 6837 } 6838 #endif 6839 6840 /* 6841 * This file is large. Tell emacs to highlight it nevertheless. 6842 * 6843 * Local Variables: 6844 * hilit-auto-highlight-maxout: 120000 6845 * End: 6846 */ 6847 6848 /* 6849 * Module glue 6850 */ 6851 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6852 6853 static int 6854 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6855 { 6856 6857 switch (cmd) { 6858 case MODULE_CMD_INIT: 6859 case MODULE_CMD_FINI: 6860 return 0; 6861 case MODULE_CMD_STAT: 6862 case MODULE_CMD_AUTOUNLOAD: 6863 default: 6864 return ENOTTY; 6865 } 6866 } 6867
Indexes created Wed Oct 14 00:28:03 UTC 2026