Home | History | Annotate | Line # | Download | only in net
if_spppsubr.c revision 1.109.12.1
      1  1.109.12.1  wrstuden /*	$NetBSD: if_spppsubr.c,v 1.109.12.1 2008/09/18 04:37:00 wrstuden Exp $	 */
      2         1.4  explorer 
      3         1.1  explorer /*
      4         1.1  explorer  * Synchronous PPP/Cisco link level subroutines.
      5         1.1  explorer  * Keepalive protocol implemented in both Cisco and PPP modes.
      6         1.1  explorer  *
      7         1.3  explorer  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
      8         1.3  explorer  * Author: Serge Vakulenko, <vak (at) cronyx.ru>
      9         1.3  explorer  *
     10         1.3  explorer  * Heavily revamped to conform to RFC 1661.
     11         1.3  explorer  * Copyright (C) 1997, Joerg Wunsch.
     12         1.1  explorer  *
     13         1.9    itojun  * RFC2472 IPv6CP support.
     14         1.9    itojun  * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>.
     15         1.9    itojun  *
     16        1.60    itojun  * Redistribution and use in source and binary forms, with or without
     17        1.60    itojun  * modification, are permitted provided that the following conditions are met:
     18        1.60    itojun  * 1. Redistributions of source code must retain the above copyright notice,
     19        1.60    itojun  *    this list of conditions and the following disclaimer.
     20        1.60    itojun  * 2. Redistributions in binary form must reproduce the above copyright notice,
     21        1.60    itojun  *    this list of conditions and the following disclaimer in the documentation
     22        1.60    itojun  *    and/or other materials provided with the distribution.
     23        1.60    itojun  *
     24        1.82     perry  * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
     25        1.82     perry  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     26        1.60    itojun  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     27        1.60    itojun  * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
     28        1.60    itojun  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     29        1.60    itojun  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     30        1.60    itojun  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     31        1.60    itojun  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     32        1.60    itojun  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     33        1.82     perry  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     34        1.60    itojun  * POSSIBILITY OF SUCH DAMAGE.
     35         1.1  explorer  *
     36         1.3  explorer  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
     37         1.3  explorer  *
     38         1.3  explorer  * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp
     39         1.3  explorer  *
     40         1.4  explorer  * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp
     41         1.1  explorer  */
     42        1.29     lukem 
     43        1.29     lukem #include <sys/cdefs.h>
     44  1.109.12.1  wrstuden __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.109.12.1 2008/09/18 04:37:00 wrstuden Exp $");
     45         1.1  explorer 
     46         1.1  explorer #include "opt_inet.h"
     47         1.3  explorer #include "opt_ipx.h"
     48         1.3  explorer #include "opt_iso.h"
     49        1.78      yamt #include "opt_pfil_hooks.h"
     50         1.1  explorer 
     51         1.1  explorer #include <sys/param.h>
     52        1.36    martin #include <sys/proc.h>
     53         1.1  explorer #include <sys/systm.h>
     54         1.1  explorer #include <sys/kernel.h>
     55         1.3  explorer #include <sys/sockio.h>
     56         1.1  explorer #include <sys/socket.h>
     57         1.3  explorer #include <sys/syslog.h>
     58         1.3  explorer #include <sys/malloc.h>
     59         1.1  explorer #include <sys/mbuf.h>
     60        1.36    martin #include <sys/callout.h>
     61         1.3  explorer #include <sys/md5.h>
     62        1.63      tron #include <sys/inttypes.h>
     63        1.90      elad #include <sys/kauth.h>
     64         1.3  explorer 
     65         1.1  explorer #include <net/if.h>
     66         1.1  explorer #include <net/netisr.h>
     67         1.1  explorer #include <net/if_types.h>
     68         1.3  explorer #include <net/route.h>
     69        1.11  sommerfe #include <net/ppp_defs.h>
     70         1.3  explorer 
     71         1.3  explorer #include <machine/stdarg.h>
     72         1.1  explorer 
     73         1.1  explorer #include <netinet/in.h>
     74         1.1  explorer #include <netinet/in_systm.h>
     75         1.1  explorer #include <netinet/in_var.h>
     76        1.12    itojun #ifdef INET
     77         1.1  explorer #include <netinet/ip.h>
     78         1.1  explorer #include <netinet/tcp.h>
     79        1.12    itojun #endif
     80         1.3  explorer #include <net/ethertypes.h>
     81         1.1  explorer 
     82        1.87    rpaulo #ifdef INET6
     83        1.87    rpaulo #include <netinet6/scope6_var.h>
     84        1.87    rpaulo #endif
     85        1.87    rpaulo 
     86         1.1  explorer #ifdef IPX
     87         1.1  explorer #include <netipx/ipx.h>
     88         1.1  explorer #include <netipx/ipx_if.h>
     89         1.1  explorer #endif
     90         1.1  explorer 
     91         1.1  explorer 
     92         1.1  explorer #ifdef ISO
     93         1.1  explorer #include <netiso/argo_debug.h>
     94         1.1  explorer #include <netiso/iso.h>
     95         1.1  explorer #include <netiso/iso_var.h>
     96         1.1  explorer #include <netiso/iso_snpac.h>
     97         1.1  explorer #endif
     98         1.1  explorer 
     99         1.1  explorer #include <net/if_sppp.h>
    100        1.36    martin #include <net/if_spppvar.h>
    101         1.1  explorer 
    102        1.68    martin #define	LCP_KEEPALIVE_INTERVAL		10	/* seconds between checks */
    103        1.68    martin #define LOOPALIVECNT     		3	/* loopback detection tries */
    104        1.68    martin #define DEFAULT_MAXALIVECNT    		3	/* max. missed alive packets */
    105        1.68    martin #define	DEFAULT_NORECV_TIME		15	/* before we get worried */
    106        1.39    martin #define DEFAULT_MAX_AUTH_FAILURES	5	/* max. auth. failures */
    107         1.1  explorer 
    108         1.3  explorer /*
    109         1.3  explorer  * Interface flags that can be set in an ifconfig command.
    110         1.3  explorer  *
    111         1.3  explorer  * Setting link0 will make the link passive, i.e. it will be marked
    112         1.3  explorer  * as being administrative openable, but won't be opened to begin
    113         1.3  explorer  * with.  Incoming calls will be answered, or subsequent calls with
    114         1.3  explorer  * -link1 will cause the administrative open of the LCP layer.
    115         1.3  explorer  *
    116         1.3  explorer  * Setting link1 will cause the link to auto-dial only as packets
    117         1.3  explorer  * arrive to be sent.
    118         1.3  explorer  *
    119         1.3  explorer  * Setting IFF_DEBUG will syslog the option negotiation and state
    120         1.3  explorer  * transitions at level kern.debug.  Note: all logs consistently look
    121         1.3  explorer  * like
    122         1.3  explorer  *
    123         1.3  explorer  *   <if-name><unit>: <proto-name> <additional info...>
    124         1.3  explorer  *
    125         1.3  explorer  * with <if-name><unit> being something like "bppp0", and <proto-name>
    126         1.3  explorer  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
    127         1.3  explorer  */
    128         1.3  explorer 
    129         1.3  explorer #define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
    130         1.3  explorer #define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
    131         1.3  explorer 
    132         1.3  explorer #define CONF_REQ	1		/* PPP configure request */
    133         1.3  explorer #define CONF_ACK	2		/* PPP configure acknowledge */
    134         1.3  explorer #define CONF_NAK	3		/* PPP configure negative ack */
    135         1.3  explorer #define CONF_REJ	4		/* PPP configure reject */
    136         1.3  explorer #define TERM_REQ	5		/* PPP terminate request */
    137         1.3  explorer #define TERM_ACK	6		/* PPP terminate acknowledge */
    138         1.3  explorer #define CODE_REJ	7		/* PPP code reject */
    139         1.3  explorer #define PROTO_REJ	8		/* PPP protocol reject */
    140         1.3  explorer #define ECHO_REQ	9		/* PPP echo request */
    141         1.3  explorer #define ECHO_REPLY	10		/* PPP echo reply */
    142         1.3  explorer #define DISC_REQ	11		/* PPP discard request */
    143         1.3  explorer 
    144         1.3  explorer #define LCP_OPT_MRU		1	/* maximum receive unit */
    145         1.3  explorer #define LCP_OPT_ASYNC_MAP	2	/* async control character map */
    146         1.3  explorer #define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
    147         1.3  explorer #define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
    148         1.3  explorer #define LCP_OPT_MAGIC		5	/* magic number */
    149         1.3  explorer #define LCP_OPT_RESERVED	6	/* reserved */
    150         1.3  explorer #define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
    151         1.3  explorer #define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
    152         1.3  explorer 
    153         1.3  explorer #define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
    154        1.14    itojun #define IPCP_OPT_COMPRESSION	2	/* IP compression protocol */
    155         1.3  explorer #define IPCP_OPT_ADDRESS	3	/* local IP address */
    156        1.31    martin #define	IPCP_OPT_PRIMDNS	129	/* primary remote dns address */
    157        1.31    martin #define	IPCP_OPT_SECDNS		131	/* secondary remote dns address */
    158         1.3  explorer 
    159         1.9    itojun #define IPV6CP_OPT_IFID		1	/* interface identifier */
    160         1.9    itojun #define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
    161         1.9    itojun 
    162         1.3  explorer #define PAP_REQ			1	/* PAP name/password request */
    163         1.3  explorer #define PAP_ACK			2	/* PAP acknowledge */
    164         1.3  explorer #define PAP_NAK			3	/* PAP fail */
    165         1.3  explorer 
    166         1.3  explorer #define CHAP_CHALLENGE		1	/* CHAP challenge request */
    167         1.3  explorer #define CHAP_RESPONSE		2	/* CHAP challenge response */
    168         1.3  explorer #define CHAP_SUCCESS		3	/* CHAP response ok */
    169         1.3  explorer #define CHAP_FAILURE		4	/* CHAP response failed */
    170         1.3  explorer 
    171         1.3  explorer #define CHAP_MD5		5	/* hash algorithm - MD5 */
    172         1.3  explorer 
    173         1.3  explorer #define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
    174         1.3  explorer #define CISCO_UNICAST		0x0f	/* Cisco unicast address */
    175         1.3  explorer #define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
    176         1.3  explorer #define CISCO_ADDR_REQ		0	/* Cisco address request */
    177         1.3  explorer #define CISCO_ADDR_REPLY	1	/* Cisco address reply */
    178         1.3  explorer #define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
    179         1.3  explorer 
    180         1.3  explorer /* states are named and numbered according to RFC 1661 */
    181         1.3  explorer #define STATE_INITIAL	0
    182         1.3  explorer #define STATE_STARTING	1
    183         1.3  explorer #define STATE_CLOSED	2
    184         1.3  explorer #define STATE_STOPPED	3
    185         1.3  explorer #define STATE_CLOSING	4
    186         1.3  explorer #define STATE_STOPPING	5
    187         1.3  explorer #define STATE_REQ_SENT	6
    188         1.3  explorer #define STATE_ACK_RCVD	7
    189         1.3  explorer #define STATE_ACK_SENT	8
    190         1.3  explorer #define STATE_OPENED	9
    191         1.1  explorer 
    192         1.1  explorer struct ppp_header {
    193       1.109      matt 	uint8_t address;
    194       1.109      matt 	uint8_t control;
    195       1.109      matt 	uint16_t protocol;
    196       1.107     perry } __packed;
    197         1.1  explorer #define PPP_HEADER_LEN          sizeof (struct ppp_header)
    198         1.1  explorer 
    199         1.1  explorer struct lcp_header {
    200       1.109      matt 	uint8_t type;
    201       1.109      matt 	uint8_t ident;
    202       1.109      matt 	uint16_t len;
    203       1.107     perry } __packed;
    204         1.1  explorer #define LCP_HEADER_LEN          sizeof (struct lcp_header)
    205         1.1  explorer 
    206         1.1  explorer struct cisco_packet {
    207       1.109      matt 	uint32_t type;
    208       1.109      matt 	uint32_t par1;
    209       1.109      matt 	uint32_t par2;
    210       1.109      matt 	uint16_t rel;
    211       1.109      matt 	uint16_t time0;
    212       1.109      matt 	uint16_t time1;
    213       1.107     perry } __packed;
    214         1.1  explorer #define CISCO_PACKET_LEN 18
    215         1.1  explorer 
    216         1.3  explorer /*
    217         1.3  explorer  * We follow the spelling and capitalization of RFC 1661 here, to make
    218         1.3  explorer  * it easier comparing with the standard.  Please refer to this RFC in
    219         1.3  explorer  * case you can't make sense out of these abbreviation; it will also
    220         1.3  explorer  * explain the semantics related to the various events and actions.
    221         1.3  explorer  */
    222         1.3  explorer struct cp {
    223         1.3  explorer 	u_short	proto;		/* PPP control protocol number */
    224         1.3  explorer 	u_char protoidx;	/* index into state table in struct sppp */
    225         1.3  explorer 	u_char flags;
    226         1.3  explorer #define CP_LCP		0x01	/* this is the LCP */
    227         1.3  explorer #define CP_AUTH		0x02	/* this is an authentication protocol */
    228         1.3  explorer #define CP_NCP		0x04	/* this is a NCP */
    229         1.3  explorer #define CP_QUAL		0x08	/* this is a quality reporting protocol */
    230         1.3  explorer 	const char *name;	/* name of this control protocol */
    231         1.3  explorer 	/* event handlers */
    232         1.3  explorer 	void	(*Up)(struct sppp *sp);
    233         1.3  explorer 	void	(*Down)(struct sppp *sp);
    234         1.3  explorer 	void	(*Open)(struct sppp *sp);
    235         1.3  explorer 	void	(*Close)(struct sppp *sp);
    236         1.3  explorer 	void	(*TO)(void *sp);
    237         1.3  explorer 	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
    238         1.3  explorer 	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
    239         1.3  explorer 	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
    240         1.3  explorer 	/* actions */
    241         1.3  explorer 	void	(*tlu)(struct sppp *sp);
    242         1.3  explorer 	void	(*tld)(struct sppp *sp);
    243         1.3  explorer 	void	(*tls)(struct sppp *sp);
    244         1.3  explorer 	void	(*tlf)(struct sppp *sp);
    245         1.3  explorer 	void	(*scr)(struct sppp *sp);
    246         1.3  explorer };
    247         1.3  explorer 
    248         1.1  explorer static struct sppp *spppq;
    249       1.106        ad static callout_t keepalive_ch;
    250         1.3  explorer 
    251        1.12    itojun #ifdef INET
    252         1.1  explorer /*
    253         1.1  explorer  * The following disgusting hack gets around the problem that IP TOS
    254         1.1  explorer  * can't be set yet.  We want to put "interactive" traffic on a high
    255         1.1  explorer  * priority queue.  To decide if traffic is interactive, we check that
    256         1.1  explorer  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
    257         1.3  explorer  *
    258         1.3  explorer  * XXX is this really still necessary?  - joerg -
    259         1.1  explorer  */
    260         1.3  explorer static u_short interactive_ports[8] = {
    261         1.1  explorer 	0,	513,	0,	0,
    262         1.1  explorer 	0,	21,	0,	23,
    263         1.1  explorer };
    264        1.59    itojun #define INTERACTIVE(p)	(interactive_ports[(p) & 7] == (p))
    265        1.12    itojun #endif
    266         1.1  explorer 
    267         1.3  explorer /* almost every function needs these */
    268         1.3  explorer #define STDDCL							\
    269         1.3  explorer 	struct ifnet *ifp = &sp->pp_if;				\
    270         1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG
    271         1.3  explorer 
    272         1.3  explorer static int sppp_output(struct ifnet *ifp, struct mbuf *m,
    273       1.103    dyoung 		       const struct sockaddr *dst, struct rtentry *rt);
    274         1.3  explorer 
    275        1.30      ross static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2);
    276         1.3  explorer static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
    277         1.3  explorer 
    278         1.3  explorer static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
    279         1.3  explorer 			  struct mbuf *m);
    280         1.3  explorer static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
    281         1.3  explorer 			 u_char ident, u_short len, void *data);
    282         1.3  explorer /* static void sppp_cp_timeout(void *arg); */
    283         1.3  explorer static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
    284         1.3  explorer 				 int newstate);
    285         1.3  explorer static void sppp_auth_send(const struct cp *cp,
    286         1.3  explorer 			   struct sppp *sp, unsigned int type, unsigned int id,
    287         1.3  explorer 			   ...);
    288         1.3  explorer 
    289         1.3  explorer static void sppp_up_event(const struct cp *cp, struct sppp *sp);
    290         1.3  explorer static void sppp_down_event(const struct cp *cp, struct sppp *sp);
    291         1.3  explorer static void sppp_open_event(const struct cp *cp, struct sppp *sp);
    292         1.3  explorer static void sppp_close_event(const struct cp *cp, struct sppp *sp);
    293         1.3  explorer static void sppp_to_event(const struct cp *cp, struct sppp *sp);
    294         1.3  explorer 
    295         1.3  explorer static void sppp_null(struct sppp *sp);
    296         1.3  explorer 
    297         1.3  explorer static void sppp_lcp_init(struct sppp *sp);
    298         1.3  explorer static void sppp_lcp_up(struct sppp *sp);
    299         1.3  explorer static void sppp_lcp_down(struct sppp *sp);
    300         1.3  explorer static void sppp_lcp_open(struct sppp *sp);
    301         1.3  explorer static void sppp_lcp_close(struct sppp *sp);
    302         1.3  explorer static void sppp_lcp_TO(void *sp);
    303         1.3  explorer static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    304         1.3  explorer static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    305         1.3  explorer static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    306         1.3  explorer static void sppp_lcp_tlu(struct sppp *sp);
    307         1.3  explorer static void sppp_lcp_tld(struct sppp *sp);
    308         1.3  explorer static void sppp_lcp_tls(struct sppp *sp);
    309         1.3  explorer static void sppp_lcp_tlf(struct sppp *sp);
    310         1.3  explorer static void sppp_lcp_scr(struct sppp *sp);
    311         1.3  explorer static void sppp_lcp_check_and_close(struct sppp *sp);
    312         1.3  explorer static int sppp_ncp_check(struct sppp *sp);
    313         1.3  explorer 
    314         1.3  explorer static void sppp_ipcp_init(struct sppp *sp);
    315         1.3  explorer static void sppp_ipcp_up(struct sppp *sp);
    316         1.3  explorer static void sppp_ipcp_down(struct sppp *sp);
    317         1.3  explorer static void sppp_ipcp_open(struct sppp *sp);
    318         1.3  explorer static void sppp_ipcp_close(struct sppp *sp);
    319         1.3  explorer static void sppp_ipcp_TO(void *sp);
    320         1.3  explorer static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    321         1.3  explorer static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    322         1.3  explorer static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    323         1.3  explorer static void sppp_ipcp_tlu(struct sppp *sp);
    324         1.3  explorer static void sppp_ipcp_tld(struct sppp *sp);
    325         1.3  explorer static void sppp_ipcp_tls(struct sppp *sp);
    326         1.3  explorer static void sppp_ipcp_tlf(struct sppp *sp);
    327         1.3  explorer static void sppp_ipcp_scr(struct sppp *sp);
    328         1.3  explorer 
    329         1.9    itojun static void sppp_ipv6cp_init(struct sppp *sp);
    330         1.9    itojun static void sppp_ipv6cp_up(struct sppp *sp);
    331         1.9    itojun static void sppp_ipv6cp_down(struct sppp *sp);
    332         1.9    itojun static void sppp_ipv6cp_open(struct sppp *sp);
    333         1.9    itojun static void sppp_ipv6cp_close(struct sppp *sp);
    334         1.9    itojun static void sppp_ipv6cp_TO(void *sp);
    335         1.9    itojun static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    336         1.9    itojun static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    337         1.9    itojun static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    338         1.9    itojun static void sppp_ipv6cp_tlu(struct sppp *sp);
    339         1.9    itojun static void sppp_ipv6cp_tld(struct sppp *sp);
    340         1.9    itojun static void sppp_ipv6cp_tls(struct sppp *sp);
    341         1.9    itojun static void sppp_ipv6cp_tlf(struct sppp *sp);
    342         1.9    itojun static void sppp_ipv6cp_scr(struct sppp *sp);
    343         1.9    itojun 
    344         1.3  explorer static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
    345         1.3  explorer static void sppp_pap_init(struct sppp *sp);
    346         1.3  explorer static void sppp_pap_open(struct sppp *sp);
    347         1.3  explorer static void sppp_pap_close(struct sppp *sp);
    348         1.3  explorer static void sppp_pap_TO(void *sp);
    349         1.3  explorer static void sppp_pap_my_TO(void *sp);
    350         1.3  explorer static void sppp_pap_tlu(struct sppp *sp);
    351         1.3  explorer static void sppp_pap_tld(struct sppp *sp);
    352         1.3  explorer static void sppp_pap_scr(struct sppp *sp);
    353         1.3  explorer 
    354         1.3  explorer static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
    355         1.3  explorer static void sppp_chap_init(struct sppp *sp);
    356         1.3  explorer static void sppp_chap_open(struct sppp *sp);
    357         1.3  explorer static void sppp_chap_close(struct sppp *sp);
    358         1.3  explorer static void sppp_chap_TO(void *sp);
    359         1.3  explorer static void sppp_chap_tlu(struct sppp *sp);
    360         1.3  explorer static void sppp_chap_tld(struct sppp *sp);
    361         1.3  explorer static void sppp_chap_scr(struct sppp *sp);
    362         1.3  explorer 
    363         1.3  explorer static const char *sppp_auth_type_name(u_short proto, u_char type);
    364         1.3  explorer static const char *sppp_cp_type_name(u_char type);
    365       1.109      matt static const char *sppp_dotted_quad(uint32_t addr);
    366         1.3  explorer static const char *sppp_ipcp_opt_name(u_char opt);
    367         1.9    itojun #ifdef INET6
    368         1.9    itojun static const char *sppp_ipv6cp_opt_name(u_char opt);
    369         1.9    itojun #endif
    370         1.3  explorer static const char *sppp_lcp_opt_name(u_char opt);
    371        1.36    martin static const char *sppp_phase_name(int phase);
    372         1.3  explorer static const char *sppp_proto_name(u_short proto);
    373         1.3  explorer static const char *sppp_state_name(int state);
    374  1.109.12.1  wrstuden static int sppp_params(struct sppp *sp, u_long cmd, void *data);
    375        1.79  christos #ifdef INET
    376       1.109      matt static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst,
    377       1.109      matt 			      uint32_t *srcmask);
    378       1.109      matt static void sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr);
    379        1.79  christos static void sppp_clear_ip_addrs(struct sppp *sp);
    380        1.79  christos #endif
    381         1.3  explorer static void sppp_keepalive(void *dummy);
    382         1.3  explorer static void sppp_phase_network(struct sppp *sp);
    383         1.3  explorer static void sppp_print_bytes(const u_char *p, u_short len);
    384         1.3  explorer static void sppp_print_string(const char *p, u_short len);
    385         1.9    itojun #ifdef INET6
    386         1.9    itojun static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
    387         1.9    itojun 				struct in6_addr *dst, struct in6_addr *srcmask);
    388         1.9    itojun #ifdef IPV6CP_MYIFID_DYN
    389         1.9    itojun static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    390         1.9    itojun static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    391         1.9    itojun #endif
    392         1.9    itojun static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
    393         1.9    itojun #endif
    394         1.3  explorer 
    395         1.3  explorer /* our control protocol descriptors */
    396         1.3  explorer static const struct cp lcp = {
    397         1.3  explorer 	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
    398         1.3  explorer 	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
    399         1.3  explorer 	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
    400         1.3  explorer 	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
    401         1.3  explorer 	sppp_lcp_scr
    402         1.3  explorer };
    403         1.3  explorer 
    404         1.3  explorer static const struct cp ipcp = {
    405        1.19    itojun 	PPP_IPCP, IDX_IPCP,
    406        1.19    itojun #ifdef INET
    407        1.19    itojun 	CP_NCP,	/*don't run IPCP if there's no IPv4 support*/
    408        1.19    itojun #else
    409        1.19    itojun 	0,
    410        1.19    itojun #endif
    411        1.19    itojun 	"ipcp",
    412         1.3  explorer 	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
    413         1.3  explorer 	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
    414         1.3  explorer 	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
    415         1.3  explorer 	sppp_ipcp_scr
    416         1.3  explorer };
    417         1.3  explorer 
    418         1.9    itojun static const struct cp ipv6cp = {
    419         1.9    itojun 	PPP_IPV6CP, IDX_IPV6CP,
    420         1.9    itojun #ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
    421         1.9    itojun 	CP_NCP,
    422         1.9    itojun #else
    423         1.9    itojun 	0,
    424         1.9    itojun #endif
    425         1.9    itojun 	"ipv6cp",
    426         1.9    itojun 	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
    427         1.9    itojun 	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
    428         1.9    itojun 	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
    429         1.9    itojun 	sppp_ipv6cp_scr
    430         1.9    itojun };
    431         1.9    itojun 
    432         1.3  explorer static const struct cp pap = {
    433         1.3  explorer 	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
    434         1.3  explorer 	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
    435         1.3  explorer 	sppp_pap_TO, 0, 0, 0,
    436         1.3  explorer 	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
    437         1.3  explorer 	sppp_pap_scr
    438         1.3  explorer };
    439         1.3  explorer 
    440         1.3  explorer static const struct cp chap = {
    441         1.3  explorer 	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
    442         1.3  explorer 	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
    443         1.3  explorer 	sppp_chap_TO, 0, 0, 0,
    444         1.3  explorer 	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
    445         1.3  explorer 	sppp_chap_scr
    446         1.3  explorer };
    447         1.3  explorer 
    448         1.3  explorer static const struct cp *cps[IDX_COUNT] = {
    449         1.3  explorer 	&lcp,			/* IDX_LCP */
    450         1.3  explorer 	&ipcp,			/* IDX_IPCP */
    451         1.9    itojun 	&ipv6cp,		/* IDX_IPV6CP */
    452         1.3  explorer 	&pap,			/* IDX_PAP */
    453         1.3  explorer 	&chap,			/* IDX_CHAP */
    454         1.3  explorer };
    455         1.1  explorer 
    456         1.1  explorer 
    457        1.88  christos void spppattach(int);
    458        1.88  christos void
    459        1.88  christos /*ARGSUSED*/
    460       1.101  christos spppattach(int count)
    461        1.88  christos {
    462        1.88  christos }
    463        1.88  christos 
    464        1.42  jdolecek /*
    465         1.3  explorer  * Exported functions, comprising our interface to the lower layer.
    466         1.1  explorer  */
    467         1.1  explorer 
    468         1.1  explorer /*
    469         1.1  explorer  * Process the received packet.
    470         1.1  explorer  */
    471         1.3  explorer void
    472         1.3  explorer sppp_input(struct ifnet *ifp, struct mbuf *m)
    473         1.1  explorer {
    474        1.22    martin 	struct ppp_header *h = NULL;
    475         1.1  explorer 	struct ifqueue *inq = 0;
    476       1.109      matt 	uint16_t protocol;
    477         1.1  explorer 	int s;
    478         1.3  explorer 	struct sppp *sp = (struct sppp *)ifp;
    479         1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
    480         1.1  explorer 
    481        1.68    martin 	if (ifp->if_flags & IFF_UP) {
    482        1.22    martin 		/* Count received bytes, add hardware framing */
    483        1.22    martin 		ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
    484        1.68    martin 		/* Note time of last receive */
    485        1.92    kardel 		sp->pp_last_receive = time_uptime;
    486        1.68    martin 	}
    487         1.1  explorer 
    488         1.1  explorer 	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
    489         1.1  explorer 		/* Too small packet, drop it. */
    490         1.3  explorer 		if (debug)
    491         1.3  explorer 			log(LOG_DEBUG,
    492        1.64    itojun 			    "%s: input packet is too small, %d bytes\n",
    493        1.64    itojun 			    ifp->if_xname, m->m_pkthdr.len);
    494         1.3  explorer 	  drop:
    495         1.3  explorer 		++ifp->if_ierrors;
    496         1.3  explorer 		++ifp->if_iqdrops;
    497        1.59    itojun 		m_freem(m);
    498         1.1  explorer 		return;
    499         1.1  explorer 	}
    500         1.1  explorer 
    501        1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
    502        1.30      ross 		memcpy(&protocol, mtod(m, void *), 2);
    503        1.22    martin 		protocol = ntohs(protocol);
    504        1.22    martin 		m_adj(m, 2);
    505        1.22    martin 	} else {
    506         1.1  explorer 
    507        1.22    martin 		/* Get PPP header. */
    508        1.59    itojun 		h = mtod(m, struct ppp_header *);
    509        1.59    itojun 		m_adj(m, PPP_HEADER_LEN);
    510        1.22    martin 
    511        1.22    martin 		switch (h->address) {
    512        1.22    martin 		case PPP_ALLSTATIONS:
    513        1.22    martin 			if (h->control != PPP_UI)
    514        1.22    martin 				goto invalid;
    515        1.22    martin 			if (sp->pp_flags & PP_CISCO) {
    516        1.22    martin 				if (debug)
    517        1.22    martin 					log(LOG_DEBUG,
    518        1.64    itojun 					    "%s: PPP packet in Cisco mode "
    519        1.22    martin 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    520        1.64    itojun 					    ifp->if_xname,
    521        1.22    martin 					    h->address, h->control, ntohs(h->protocol));
    522        1.22    martin 				goto drop;
    523        1.22    martin 			}
    524        1.22    martin 			break;
    525        1.22    martin 		case CISCO_MULTICAST:
    526        1.22    martin 		case CISCO_UNICAST:
    527        1.22    martin 			/* Don't check the control field here (RFC 1547). */
    528        1.22    martin 			if (! (sp->pp_flags & PP_CISCO)) {
    529        1.22    martin 				if (debug)
    530        1.22    martin 					log(LOG_DEBUG,
    531        1.64    itojun 					    "%s: Cisco packet in PPP mode "
    532        1.22    martin 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    533        1.64    itojun 					    ifp->if_xname,
    534        1.22    martin 					    h->address, h->control, ntohs(h->protocol));
    535        1.22    martin 				goto drop;
    536        1.22    martin 			}
    537        1.59    itojun 			switch (ntohs(h->protocol)) {
    538        1.22    martin 			default:
    539        1.22    martin 				++ifp->if_noproto;
    540        1.22    martin 				goto invalid;
    541        1.22    martin 			case CISCO_KEEPALIVE:
    542        1.59    itojun 				sppp_cisco_input((struct sppp *) ifp, m);
    543        1.59    itojun 				m_freem(m);
    544        1.22    martin 				return;
    545         1.1  explorer #ifdef INET
    546        1.22    martin 			case ETHERTYPE_IP:
    547        1.59    itojun 				schednetisr(NETISR_IP);
    548         1.1  explorer 				inq = &ipintrq;
    549        1.22    martin 				break;
    550         1.1  explorer #endif
    551         1.8    itojun #ifdef INET6
    552        1.22    martin 			case ETHERTYPE_IPV6:
    553        1.59    itojun 				schednetisr(NETISR_IPV6);
    554         1.8    itojun 				inq = &ip6intrq;
    555        1.22    martin 				break;
    556         1.8    itojun #endif
    557         1.1  explorer #ifdef IPX
    558        1.22    martin 			case ETHERTYPE_IPX:
    559        1.59    itojun 				schednetisr(NETISR_IPX);
    560         1.1  explorer 				inq = &ipxintrq;
    561        1.22    martin 				break;
    562         1.1  explorer #endif
    563         1.1  explorer 			}
    564        1.22    martin 			goto queue_pkt;
    565        1.22    martin 		default:        /* Invalid PPP packet. */
    566        1.22    martin 		  invalid:
    567         1.3  explorer 			if (debug)
    568         1.3  explorer 				log(LOG_DEBUG,
    569        1.64    itojun 				    "%s: invalid input packet "
    570         1.3  explorer 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    571        1.64    itojun 				    ifp->if_xname,
    572         1.3  explorer 				    h->address, h->control, ntohs(h->protocol));
    573         1.1  explorer 			goto drop;
    574         1.1  explorer 		}
    575        1.59    itojun 		protocol = ntohs(h->protocol);
    576        1.22    martin 	}
    577        1.22    martin 
    578        1.22    martin 	switch (protocol) {
    579        1.22    martin 	default:
    580        1.22    martin 		if (sp->state[IDX_LCP] == STATE_OPENED) {
    581       1.109      matt 			uint16_t prot = htons(protocol);
    582        1.59    itojun 			sppp_cp_send(sp, PPP_LCP, PROTO_REJ,
    583        1.22    martin 			    ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
    584        1.22    martin 			    &prot);
    585        1.22    martin 		}
    586        1.22    martin 		if (debug)
    587        1.22    martin 			log(LOG_DEBUG,
    588        1.64    itojun 			    "%s: invalid input protocol "
    589        1.64    itojun 			    "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol));
    590        1.22    martin 		++ifp->if_noproto;
    591        1.22    martin 		goto drop;
    592        1.22    martin 	case PPP_LCP:
    593        1.22    martin 		sppp_cp_input(&lcp, sp, m);
    594        1.59    itojun 		m_freem(m);
    595        1.22    martin 		return;
    596        1.22    martin 	case PPP_PAP:
    597        1.36    martin 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE)
    598        1.22    martin 			sppp_pap_input(sp, m);
    599        1.59    itojun 		m_freem(m);
    600        1.22    martin 		return;
    601        1.22    martin 	case PPP_CHAP:
    602        1.36    martin 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE)
    603        1.22    martin 			sppp_chap_input(sp, m);
    604        1.59    itojun 		m_freem(m);
    605        1.22    martin 		return;
    606         1.1  explorer #ifdef INET
    607        1.22    martin 	case PPP_IPCP:
    608        1.36    martin 		if (sp->pp_phase == SPPP_PHASE_NETWORK)
    609        1.22    martin 			sppp_cp_input(&ipcp, sp, m);
    610        1.59    itojun 		m_freem(m);
    611        1.22    martin 		return;
    612        1.22    martin 	case PPP_IP:
    613        1.22    martin 		if (sp->state[IDX_IPCP] == STATE_OPENED) {
    614        1.59    itojun 			schednetisr(NETISR_IP);
    615         1.1  explorer 			inq = &ipintrq;
    616        1.92    kardel 			sp->pp_last_activity = time_uptime;
    617        1.22    martin 		}
    618        1.22    martin 		break;
    619         1.1  explorer #endif
    620         1.8    itojun #ifdef INET6
    621        1.22    martin 	case PPP_IPV6CP:
    622        1.36    martin 		if (sp->pp_phase == SPPP_PHASE_NETWORK)
    623        1.22    martin 			sppp_cp_input(&ipv6cp, sp, m);
    624        1.59    itojun 		m_freem(m);
    625        1.22    martin 		return;
    626        1.22    martin 
    627        1.22    martin 	case PPP_IPV6:
    628        1.22    martin 		if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
    629        1.59    itojun 			schednetisr(NETISR_IPV6);
    630         1.8    itojun 			inq = &ip6intrq;
    631        1.92    kardel 			sp->pp_last_activity = time_uptime;
    632        1.22    martin 		}
    633        1.22    martin 		break;
    634         1.8    itojun #endif
    635         1.1  explorer #ifdef IPX
    636        1.22    martin 	case PPP_IPX:
    637        1.22    martin 		/* IPX IPXCP not implemented yet */
    638        1.36    martin 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    639        1.59    itojun 			schednetisr(NETISR_IPX);
    640         1.1  explorer 			inq = &ipxintrq;
    641        1.22    martin 		}
    642        1.22    martin 		break;
    643         1.1  explorer #endif
    644        1.22    martin #ifdef ISO
    645        1.22    martin 	case PPP_ISO:
    646        1.22    martin 		/* OSI NLCP not implemented yet */
    647        1.36    martin 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    648        1.59    itojun 			schednetisr(NETISR_ISO);
    649        1.22    martin 			inq = &clnlintrq;
    650         1.1  explorer 		}
    651         1.1  explorer 		break;
    652        1.22    martin #endif
    653         1.1  explorer 	}
    654         1.1  explorer 
    655        1.22    martin queue_pkt:
    656         1.1  explorer 	if (! (ifp->if_flags & IFF_UP) || ! inq)
    657         1.1  explorer 		goto drop;
    658         1.1  explorer 
    659         1.1  explorer 	/* Check queue. */
    660        1.23   thorpej 	s = splnet();
    661        1.59    itojun 	if (IF_QFULL(inq)) {
    662         1.1  explorer 		/* Queue overflow. */
    663         1.3  explorer 		IF_DROP(inq);
    664         1.3  explorer 		splx(s);
    665         1.3  explorer 		if (debug)
    666        1.64    itojun 			log(LOG_DEBUG, "%s: protocol queue overflow\n",
    667        1.64    itojun 				ifp->if_xname);
    668         1.1  explorer 		goto drop;
    669         1.1  explorer 	}
    670         1.3  explorer 	IF_ENQUEUE(inq, m);
    671         1.3  explorer 	splx(s);
    672         1.1  explorer }
    673         1.1  explorer 
    674         1.1  explorer /*
    675         1.1  explorer  * Enqueue transmit packet.
    676         1.1  explorer  */
    677         1.1  explorer static int
    678         1.3  explorer sppp_output(struct ifnet *ifp, struct mbuf *m,
    679       1.103    dyoung     const struct sockaddr *dst, struct rtentry *rt)
    680         1.1  explorer {
    681        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    682        1.22    martin 	struct ppp_header *h = NULL;
    683        1.15   thorpej 	struct ifqueue *ifq = NULL;		/* XXX */
    684        1.83  christos 	int s, error = 0;
    685       1.109      matt 	uint16_t protocol;
    686        1.15   thorpej 	ALTQ_DECL(struct altq_pktattr pktattr;)
    687         1.3  explorer 
    688        1.23   thorpej 	s = splnet();
    689         1.1  explorer 
    690        1.92    kardel 	sp->pp_last_activity = time_uptime;
    691        1.38    martin 
    692         1.3  explorer 	if ((ifp->if_flags & IFF_UP) == 0 ||
    693         1.3  explorer 	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
    694        1.59    itojun 		m_freem(m);
    695        1.59    itojun 		splx(s);
    696         1.1  explorer 		return (ENETDOWN);
    697         1.1  explorer 	}
    698         1.1  explorer 
    699         1.3  explorer 	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
    700         1.3  explorer 		/*
    701         1.3  explorer 		 * Interface is not yet running, but auto-dial.  Need
    702         1.3  explorer 		 * to start LCP for it.
    703         1.3  explorer 		 */
    704         1.3  explorer 		ifp->if_flags |= IFF_RUNNING;
    705         1.3  explorer 		splx(s);
    706         1.3  explorer 		lcp.Open(sp);
    707        1.23   thorpej 		s = splnet();
    708         1.3  explorer 	}
    709         1.3  explorer 
    710        1.15   thorpej 	/*
    711        1.15   thorpej 	 * If the queueing discipline needs packet classification,
    712        1.15   thorpej 	 * do it before prepending link headers.
    713        1.15   thorpej 	 */
    714        1.15   thorpej 	IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr);
    715         1.3  explorer 
    716         1.1  explorer #ifdef INET
    717        1.48    itojun 	if (dst->sa_family == AF_INET) {
    718        1.48    itojun 		struct ip *ip = NULL;
    719        1.48    itojun 		struct tcphdr *th = NULL;
    720        1.48    itojun 
    721        1.48    itojun 		if (m->m_len >= sizeof(struct ip)) {
    722        1.59    itojun 			ip = mtod(m, struct ip *);
    723        1.48    itojun 			if (ip->ip_p == IPPROTO_TCP &&
    724        1.48    itojun 			    m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
    725        1.48    itojun 			    sizeof(struct tcphdr)) {
    726        1.48    itojun 				th = (struct tcphdr *)
    727       1.104  christos 				    ((char *)ip + (ip->ip_hl << 2));
    728        1.48    itojun 			}
    729        1.48    itojun 		} else
    730        1.48    itojun 			ip = NULL;
    731         1.1  explorer 
    732         1.3  explorer 		/*
    733         1.3  explorer 		 * When using dynamic local IP address assignment by using
    734         1.3  explorer 		 * 0.0.0.0 as a local address, the first TCP session will
    735         1.3  explorer 		 * not connect because the local TCP checksum is computed
    736         1.3  explorer 		 * using 0.0.0.0 which will later become our real IP address
    737         1.3  explorer 		 * so the TCP checksum computed at the remote end will
    738         1.3  explorer 		 * become invalid. So we
    739         1.3  explorer 		 * - don't let packets with src ip addr 0 thru
    740         1.3  explorer 		 * - we flag TCP packets with src ip 0 as an error
    741        1.82     perry 		 */
    742        1.48    itojun 		if (ip && ip->ip_src.s_addr == INADDR_ANY) {
    743       1.109      matt 			uint8_t proto = ip->ip_p;
    744        1.49      yamt 
    745         1.3  explorer 			m_freem(m);
    746         1.3  explorer 			splx(s);
    747        1.49      yamt 			if (proto == IPPROTO_TCP)
    748        1.58    itojun 				return (EADDRNOTAVAIL);
    749         1.3  explorer 			else
    750        1.58    itojun 				return (0);
    751         1.3  explorer 		}
    752        1.82     perry 
    753         1.3  explorer 		/*
    754         1.3  explorer 		 * Put low delay, telnet, rlogin and ftp control packets
    755         1.3  explorer 		 * in front of the queue.
    756         1.3  explorer 		 */
    757        1.82     perry 
    758        1.48    itojun 		if (!IF_QFULL(&sp->pp_fastq) &&
    759        1.48    itojun 		    ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
    760        1.48    itojun 		     (th && (INTERACTIVE(ntohs(th->th_sport)) ||
    761        1.48    itojun 		      INTERACTIVE(ntohs(th->th_dport))))))
    762         1.1  explorer 			ifq = &sp->pp_fastq;
    763         1.1  explorer 	}
    764         1.1  explorer #endif
    765         1.1  explorer 
    766         1.5    itojun #ifdef INET6
    767         1.5    itojun 	if (dst->sa_family == AF_INET6) {
    768         1.5    itojun 		/* XXX do something tricky here? */
    769         1.5    itojun 	}
    770         1.5    itojun #endif
    771         1.5    itojun 
    772        1.22    martin 	if ((sp->pp_flags & PP_NOFRAMING) == 0) {
    773        1.22    martin 		/*
    774        1.22    martin 		 * Prepend general data packet PPP header. For now, IP only.
    775        1.22    martin 		 */
    776        1.59    itojun 		M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT);
    777        1.22    martin 		if (! m) {
    778        1.22    martin 			if (ifp->if_flags & IFF_DEBUG)
    779        1.64    itojun 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
    780        1.64    itojun 					ifp->if_xname);
    781        1.22    martin 			++ifp->if_oerrors;
    782        1.59    itojun 			splx(s);
    783        1.22    martin 			return (ENOBUFS);
    784        1.22    martin 		}
    785        1.22    martin 		/*
    786        1.22    martin 		 * May want to check size of packet
    787        1.22    martin 		 * (albeit due to the implementation it's always enough)
    788        1.22    martin 		 */
    789        1.59    itojun 		h = mtod(m, struct ppp_header *);
    790        1.22    martin 		if (sp->pp_flags & PP_CISCO) {
    791        1.22    martin 			h->address = CISCO_UNICAST;        /* unicast address */
    792        1.22    martin 			h->control = 0;
    793        1.22    martin 		} else {
    794        1.22    martin 			h->address = PPP_ALLSTATIONS;        /* broadcast address */
    795        1.22    martin 			h->control = PPP_UI;                 /* Unnumbered Info */
    796        1.22    martin 		}
    797         1.1  explorer 	}
    798         1.1  explorer 
    799         1.1  explorer 	switch (dst->sa_family) {
    800         1.1  explorer #ifdef INET
    801         1.1  explorer 	case AF_INET:   /* Internet Protocol */
    802         1.1  explorer 		if (sp->pp_flags & PP_CISCO)
    803        1.59    itojun 			protocol = htons(ETHERTYPE_IP);
    804         1.1  explorer 		else {
    805         1.3  explorer 			/*
    806         1.3  explorer 			 * Don't choke with an ENETDOWN early.  It's
    807         1.3  explorer 			 * possible that we just started dialing out,
    808         1.3  explorer 			 * so don't drop the packet immediately.  If
    809         1.3  explorer 			 * we notice that we run out of buffer space
    810         1.3  explorer 			 * below, we will however remember that we are
    811         1.3  explorer 			 * not ready to carry IP packets, and return
    812         1.3  explorer 			 * ENETDOWN, as opposed to ENOBUFS.
    813         1.3  explorer 			 */
    814        1.22    martin 			protocol = htons(PPP_IP);
    815         1.5    itojun 			if (sp->state[IDX_IPCP] != STATE_OPENED)
    816        1.83  christos 				error = ENETDOWN;
    817         1.5    itojun 		}
    818         1.5    itojun 		break;
    819         1.5    itojun #endif
    820         1.5    itojun #ifdef INET6
    821         1.5    itojun 	case AF_INET6:   /* Internet Protocol version 6 */
    822         1.5    itojun 		if (sp->pp_flags & PP_CISCO)
    823        1.59    itojun 			protocol = htons(ETHERTYPE_IPV6);
    824         1.5    itojun 		else {
    825         1.5    itojun 			/*
    826         1.5    itojun 			 * Don't choke with an ENETDOWN early.  It's
    827         1.5    itojun 			 * possible that we just started dialing out,
    828         1.5    itojun 			 * so don't drop the packet immediately.  If
    829         1.5    itojun 			 * we notice that we run out of buffer space
    830         1.5    itojun 			 * below, we will however remember that we are
    831         1.5    itojun 			 * not ready to carry IP packets, and return
    832         1.5    itojun 			 * ENETDOWN, as opposed to ENOBUFS.
    833         1.5    itojun 			 */
    834        1.22    martin 			protocol = htons(PPP_IPV6);
    835         1.9    itojun 			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
    836        1.83  christos 				error = ENETDOWN;
    837         1.1  explorer 		}
    838         1.1  explorer 		break;
    839         1.1  explorer #endif
    840         1.1  explorer #ifdef IPX
    841         1.1  explorer 	case AF_IPX:     /* Novell IPX Protocol */
    842        1.59    itojun 		protocol = htons((sp->pp_flags & PP_CISCO) ?
    843         1.1  explorer 			ETHERTYPE_IPX : PPP_IPX);
    844         1.1  explorer 		break;
    845         1.1  explorer #endif
    846         1.1  explorer #ifdef ISO
    847         1.1  explorer 	case AF_ISO:    /* ISO OSI Protocol */
    848         1.1  explorer 		if (sp->pp_flags & PP_CISCO)
    849         1.1  explorer 			goto nosupport;
    850        1.59    itojun 		protocol = htons(PPP_ISO);
    851         1.1  explorer 		break;
    852         1.1  explorer nosupport:
    853         1.1  explorer #endif
    854         1.1  explorer 	default:
    855        1.59    itojun 		m_freem(m);
    856         1.3  explorer 		++ifp->if_oerrors;
    857        1.59    itojun 		splx(s);
    858         1.1  explorer 		return (EAFNOSUPPORT);
    859         1.1  explorer 	}
    860         1.1  explorer 
    861        1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
    862        1.59    itojun 		M_PREPEND(m, 2, M_DONTWAIT);
    863        1.22    martin 		if (m == NULL) {
    864        1.22    martin 			if (ifp->if_flags & IFF_DEBUG)
    865        1.64    itojun 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
    866        1.64    itojun 					ifp->if_xname);
    867        1.22    martin 			++ifp->if_oerrors;
    868        1.59    itojun 			splx(s);
    869        1.22    martin 			return (ENOBUFS);
    870        1.22    martin 		}
    871       1.109      matt 		*mtod(m, uint16_t *) = protocol;
    872        1.22    martin 	} else {
    873        1.22    martin 		h->protocol = protocol;
    874        1.22    martin 	}
    875        1.22    martin 
    876        1.15   thorpej 
    877        1.83  christos 	error = ifq_enqueue2(ifp, ifq, m ALTQ_COMMA ALTQ_DECL(&pktattr));
    878         1.1  explorer 
    879        1.83  christos 	if (error == 0) {
    880        1.83  christos 		/*
    881        1.83  christos 		 * Count output packets and bytes.
    882        1.83  christos 		 * The packet length includes header + additional hardware
    883        1.83  christos 		 * framing according to RFC 1333.
    884        1.83  christos 		 */
    885        1.83  christos 		if (!(ifp->if_flags & IFF_OACTIVE))
    886        1.83  christos 			(*ifp->if_start)(ifp);
    887        1.83  christos 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
    888        1.83  christos 	}
    889        1.59    itojun 	splx(s);
    890        1.83  christos 	return error;
    891         1.1  explorer }
    892         1.1  explorer 
    893         1.3  explorer void
    894         1.3  explorer sppp_attach(struct ifnet *ifp)
    895         1.1  explorer {
    896        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    897         1.1  explorer 
    898         1.1  explorer 	/* Initialize keepalive handler. */
    899         1.7   thorpej 	if (! spppq) {
    900       1.106        ad 		callout_init(&keepalive_ch, 0);
    901        1.57    martin 		callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
    902         1.7   thorpej 	}
    903         1.1  explorer 
    904         1.1  explorer 	/* Insert new entry into the keepalive list. */
    905         1.1  explorer 	sp->pp_next = spppq;
    906         1.1  explorer 	spppq = sp;
    907         1.1  explorer 
    908         1.1  explorer 	sp->pp_if.if_type = IFT_PPP;
    909         1.1  explorer 	sp->pp_if.if_output = sppp_output;
    910         1.1  explorer 	sp->pp_fastq.ifq_maxlen = 32;
    911         1.3  explorer 	sp->pp_cpq.ifq_maxlen = 20;
    912         1.1  explorer 	sp->pp_loopcnt = 0;
    913         1.1  explorer 	sp->pp_alivecnt = 0;
    914        1.38    martin 	sp->pp_last_activity = 0;
    915        1.68    martin 	sp->pp_last_receive = 0;
    916        1.68    martin 	sp->pp_maxalive = DEFAULT_MAXALIVECNT;
    917        1.68    martin 	sp->pp_max_noreceive = DEFAULT_NORECV_TIME;
    918        1.38    martin 	sp->pp_idle_timeout = 0;
    919        1.25   thorpej 	memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq));
    920        1.25   thorpej 	memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq));
    921        1.39    martin 	sp->pp_auth_failures = 0;
    922        1.39    martin 	sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES;
    923        1.36    martin 	sp->pp_phase = SPPP_PHASE_DEAD;
    924         1.3  explorer 	sp->pp_up = lcp.Up;
    925         1.3  explorer 	sp->pp_down = lcp.Down;
    926         1.3  explorer 
    927        1.20   thorpej 	if_alloc_sadl(ifp);
    928        1.20   thorpej 
    929        1.36    martin 	memset(&sp->myauth, 0, sizeof sp->myauth);
    930        1.36    martin 	memset(&sp->hisauth, 0, sizeof sp->hisauth);
    931         1.3  explorer 	sppp_lcp_init(sp);
    932         1.3  explorer 	sppp_ipcp_init(sp);
    933         1.9    itojun 	sppp_ipv6cp_init(sp);
    934         1.3  explorer 	sppp_pap_init(sp);
    935         1.3  explorer 	sppp_chap_init(sp);
    936         1.1  explorer }
    937         1.1  explorer 
    938         1.3  explorer void
    939         1.3  explorer sppp_detach(struct ifnet *ifp)
    940         1.1  explorer {
    941        1.59    itojun 	struct sppp **q, *p, *sp = (struct sppp *) ifp;
    942         1.1  explorer 
    943         1.1  explorer 	/* Remove the entry from the keepalive list. */
    944         1.1  explorer 	for (q = &spppq; (p = *q); q = &p->pp_next)
    945         1.1  explorer 		if (p == sp) {
    946         1.1  explorer 			*q = p->pp_next;
    947         1.1  explorer 			break;
    948         1.1  explorer 		}
    949         1.1  explorer 
    950         1.1  explorer 	/* Stop keepalive handler. */
    951         1.7   thorpej 	if (! spppq) {
    952         1.7   thorpej 		callout_stop(&keepalive_ch);
    953         1.7   thorpej 	}
    954         1.3  explorer 
    955  1.109.12.1  wrstuden 	callout_stop(&sp->ch[IDX_LCP]);
    956  1.109.12.1  wrstuden 	callout_stop(&sp->ch[IDX_IPCP]);
    957  1.109.12.1  wrstuden 	callout_stop(&sp->ch[IDX_PAP]);
    958  1.109.12.1  wrstuden 	callout_stop(&sp->ch[IDX_CHAP]);
    959  1.109.12.1  wrstuden #ifdef INET6
    960  1.109.12.1  wrstuden 	callout_stop(&sp->ch[IDX_IPV6CP]);
    961  1.109.12.1  wrstuden #endif
    962         1.7   thorpej 	callout_stop(&sp->pap_my_to_ch);
    963        1.20   thorpej 
    964        1.36    martin 	/* free authentication info */
    965        1.36    martin 	if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF);
    966        1.36    martin 	if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF);
    967        1.36    martin 	if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF);
    968        1.36    martin 	if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF);
    969        1.36    martin 
    970        1.66    itojun #if 0	/* done in if_detach() */
    971        1.20   thorpej 	if_free_sadl(ifp);
    972        1.66    itojun #endif
    973         1.1  explorer }
    974         1.1  explorer 
    975         1.1  explorer /*
    976         1.1  explorer  * Flush the interface output queue.
    977         1.1  explorer  */
    978         1.3  explorer void
    979         1.3  explorer sppp_flush(struct ifnet *ifp)
    980         1.1  explorer {
    981        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    982         1.1  explorer 
    983        1.59    itojun 	IFQ_PURGE(&sp->pp_if.if_snd);
    984        1.59    itojun 	IF_PURGE(&sp->pp_fastq);
    985        1.59    itojun 	IF_PURGE(&sp->pp_cpq);
    986         1.1  explorer }
    987         1.1  explorer 
    988         1.1  explorer /*
    989         1.1  explorer  * Check if the output queue is empty.
    990         1.1  explorer  */
    991         1.1  explorer int
    992         1.3  explorer sppp_isempty(struct ifnet *ifp)
    993         1.1  explorer {
    994        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    995         1.3  explorer 	int empty, s;
    996         1.1  explorer 
    997        1.23   thorpej 	s = splnet();
    998        1.44    martin 	empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) &&
    999        1.44    martin 		IFQ_IS_EMPTY(&sp->pp_if.if_snd);
   1000         1.3  explorer 	splx(s);
   1001         1.1  explorer 	return (empty);
   1002         1.1  explorer }
   1003         1.1  explorer 
   1004         1.1  explorer /*
   1005         1.1  explorer  * Get next packet to send.
   1006         1.1  explorer  */
   1007         1.3  explorer struct mbuf *
   1008         1.3  explorer sppp_dequeue(struct ifnet *ifp)
   1009         1.1  explorer {
   1010        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1011         1.1  explorer 	struct mbuf *m;
   1012         1.3  explorer 	int s;
   1013         1.1  explorer 
   1014        1.23   thorpej 	s = splnet();
   1015         1.3  explorer 	/*
   1016         1.3  explorer 	 * Process only the control protocol queue until we have at
   1017         1.3  explorer 	 * least one NCP open.
   1018         1.3  explorer 	 *
   1019         1.3  explorer 	 * Do always serve all three queues in Cisco mode.
   1020         1.3  explorer 	 */
   1021         1.3  explorer 	IF_DEQUEUE(&sp->pp_cpq, m);
   1022         1.3  explorer 	if (m == NULL &&
   1023         1.3  explorer 	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
   1024         1.3  explorer 		IF_DEQUEUE(&sp->pp_fastq, m);
   1025         1.3  explorer 		if (m == NULL)
   1026        1.67    martin 			IFQ_DEQUEUE(&sp->pp_if.if_snd, m);
   1027         1.3  explorer 	}
   1028         1.3  explorer 	splx(s);
   1029         1.3  explorer 	return m;
   1030         1.1  explorer }
   1031         1.1  explorer 
   1032         1.1  explorer /*
   1033         1.3  explorer  * Process an ioctl request.  Called on low priority level.
   1034         1.1  explorer  */
   1035         1.3  explorer int
   1036         1.3  explorer sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
   1037         1.1  explorer {
   1038       1.100      elad 	struct lwp *l = curlwp;	/* XXX */
   1039        1.59    itojun 	struct ifreq *ifr = (struct ifreq *) data;
   1040        1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1041        1.42  jdolecek 	int s, error=0, going_up, going_down, newmode;
   1042         1.1  explorer 
   1043        1.23   thorpej 	s = splnet();
   1044         1.3  explorer 	switch (cmd) {
   1045         1.3  explorer 	case SIOCAIFADDR:
   1046         1.3  explorer 	case SIOCSIFDSTADDR:
   1047        1.94    martin 	case SIOCSIFADDR:
   1048         1.1  explorer 		break;
   1049         1.3  explorer 
   1050         1.3  explorer 	case SIOCSIFFLAGS:
   1051         1.3  explorer 		going_up = ifp->if_flags & IFF_UP &&
   1052         1.3  explorer 			(ifp->if_flags & IFF_RUNNING) == 0;
   1053         1.3  explorer 		going_down = (ifp->if_flags & IFF_UP) == 0 &&
   1054         1.3  explorer 			ifp->if_flags & IFF_RUNNING;
   1055         1.3  explorer 		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
   1056         1.3  explorer 		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
   1057         1.3  explorer 			/* sanity */
   1058         1.3  explorer 			newmode = IFF_PASSIVE;
   1059         1.3  explorer 			ifp->if_flags &= ~IFF_AUTO;
   1060         1.1  explorer 		}
   1061         1.1  explorer 
   1062         1.3  explorer 		if (going_up || going_down)
   1063         1.3  explorer 			lcp.Close(sp);
   1064         1.3  explorer 		if (going_up && newmode == 0) {
   1065         1.3  explorer 			/* neither auto-dial nor passive */
   1066         1.3  explorer 			ifp->if_flags |= IFF_RUNNING;
   1067         1.3  explorer 			if (!(sp->pp_flags & PP_CISCO))
   1068         1.3  explorer 				lcp.Open(sp);
   1069         1.3  explorer 		} else if (going_down) {
   1070         1.3  explorer 			sppp_flush(ifp);
   1071         1.3  explorer 			ifp->if_flags &= ~IFF_RUNNING;
   1072         1.1  explorer 		}
   1073         1.3  explorer 
   1074         1.3  explorer 		break;
   1075         1.3  explorer 
   1076         1.3  explorer 	case SIOCSIFMTU:
   1077       1.105       scw 		if (ifr->ifr_mtu < PPP_MINMRU ||
   1078       1.105       scw 		    ifr->ifr_mtu > sp->lcp.their_mru) {
   1079        1.61  kristerw 			error = EINVAL;
   1080        1.61  kristerw 			break;
   1081        1.61  kristerw 		}
   1082       1.108    dyoung 		/*FALLTHROUGH*/
   1083         1.3  explorer 	case SIOCGIFMTU:
   1084       1.108    dyoung 		if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
   1085       1.108    dyoung 			error = 0;
   1086         1.1  explorer 		break;
   1087         1.3  explorer 	case SIOCADDMULTI:
   1088         1.3  explorer 	case SIOCDELMULTI:
   1089         1.1  explorer 		break;
   1090         1.1  explorer 
   1091        1.36    martin 	case SPPPSETAUTHCFG:
   1092        1.36    martin 	case SPPPSETLCPCFG:
   1093        1.38    martin 	case SPPPSETIDLETO:
   1094        1.39    martin 	case SPPPSETAUTHFAILURE:
   1095        1.45    martin 	case SPPPSETDNSOPTS:
   1096        1.68    martin 	case SPPPSETKEEPALIVE:
   1097       1.100      elad 		error = kauth_authorize_network(l->l_cred,
   1098       1.100      elad 		    KAUTH_NETWORK_INTERFACE,
   1099       1.100      elad 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
   1100       1.100      elad 		    NULL);
   1101       1.100      elad 		if (error)
   1102       1.100      elad 			break;
   1103       1.100      elad 		error = sppp_params(sp, cmd, data);
   1104       1.100      elad 		break;
   1105        1.36    martin 
   1106       1.100      elad 	case SPPPGETAUTHCFG:
   1107       1.100      elad 	case SPPPGETLCPCFG:
   1108       1.100      elad 	case SPPPGETAUTHFAILURES:
   1109       1.100      elad 		error = kauth_authorize_network(l->l_cred,
   1110       1.100      elad 		    KAUTH_NETWORK_INTERFACE,
   1111       1.100      elad 		    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd,
   1112       1.100      elad 		    NULL);
   1113       1.100      elad 		if (error)
   1114        1.36    martin 			break;
   1115       1.100      elad 		error = sppp_params(sp, cmd, data);
   1116       1.100      elad 		break;
   1117       1.100      elad 
   1118        1.36    martin 	case SPPPGETSTATUS:
   1119        1.75    martin 	case SPPPGETSTATUSNCP:
   1120        1.38    martin 	case SPPPGETIDLETO:
   1121        1.45    martin 	case SPPPGETDNSOPTS:
   1122        1.45    martin 	case SPPPGETDNSADDRS:
   1123        1.68    martin 	case SPPPGETKEEPALIVE:
   1124        1.42  jdolecek 		error = sppp_params(sp, cmd, data);
   1125         1.1  explorer 		break;
   1126         1.3  explorer 
   1127         1.3  explorer 	default:
   1128        1.42  jdolecek 		error = ENOTTY;
   1129         1.1  explorer 	}
   1130         1.3  explorer 	splx(s);
   1131        1.42  jdolecek 	return (error);
   1132         1.1  explorer }
   1133         1.1  explorer 
   1134         1.3  explorer 
   1135        1.42  jdolecek /*
   1136         1.3  explorer  * Cisco framing implementation.
   1137         1.3  explorer  */
   1138         1.3  explorer 
   1139         1.1  explorer /*
   1140         1.1  explorer  * Handle incoming Cisco keepalive protocol packets.
   1141         1.1  explorer  */
   1142         1.3  explorer static void
   1143         1.3  explorer sppp_cisco_input(struct sppp *sp, struct mbuf *m)
   1144         1.1  explorer {
   1145         1.3  explorer 	STDDCL;
   1146         1.1  explorer 	struct cisco_packet *h;
   1147        1.79  christos #ifdef INET
   1148       1.109      matt 	uint32_t me, mymask = 0;	/* XXX: GCC */
   1149        1.79  christos #endif
   1150         1.1  explorer 
   1151         1.1  explorer 	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
   1152         1.3  explorer 		if (debug)
   1153         1.3  explorer 			log(LOG_DEBUG,
   1154        1.64    itojun 			    "%s: cisco invalid packet length: %d bytes\n",
   1155        1.64    itojun 			    ifp->if_xname, m->m_pkthdr.len);
   1156         1.1  explorer 		return;
   1157         1.1  explorer 	}
   1158        1.59    itojun 	h = mtod(m, struct cisco_packet *);
   1159         1.3  explorer 	if (debug)
   1160         1.3  explorer 		log(LOG_DEBUG,
   1161        1.64    itojun 		    "%s: cisco input: %d bytes "
   1162        1.30      ross 		    "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1163        1.64    itojun 		    ifp->if_xname, m->m_pkthdr.len,
   1164        1.80    itojun 		    ntohl(h->type), h->par1, h->par2, (u_int)h->rel,
   1165         1.3  explorer 		    (u_int)h->time0, (u_int)h->time1);
   1166        1.80    itojun 	switch (ntohl(h->type)) {
   1167         1.1  explorer 	default:
   1168         1.3  explorer 		if (debug)
   1169        1.64    itojun 			addlog("%s: cisco unknown packet type: 0x%x\n",
   1170        1.80    itojun 			       ifp->if_xname, ntohl(h->type));
   1171         1.1  explorer 		break;
   1172         1.1  explorer 	case CISCO_ADDR_REPLY:
   1173         1.1  explorer 		/* Reply on address request, ignore */
   1174         1.1  explorer 		break;
   1175         1.1  explorer 	case CISCO_KEEPALIVE_REQ:
   1176         1.1  explorer 		sp->pp_alivecnt = 0;
   1177        1.80    itojun 		sp->pp_rseq[IDX_LCP] = ntohl(h->par1);
   1178         1.9    itojun 		if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
   1179         1.1  explorer 			/* Local and remote sequence numbers are equal.
   1180         1.1  explorer 			 * Probably, the line is in loopback mode. */
   1181        1.68    martin 			if (sp->pp_loopcnt >= LOOPALIVECNT) {
   1182        1.64    itojun 				printf ("%s: loopback\n",
   1183        1.64    itojun 					ifp->if_xname);
   1184         1.1  explorer 				sp->pp_loopcnt = 0;
   1185         1.1  explorer 				if (ifp->if_flags & IFF_UP) {
   1186        1.59    itojun 					if_down(ifp);
   1187        1.59    itojun 					IF_PURGE(&sp->pp_cpq);
   1188         1.1  explorer 				}
   1189         1.1  explorer 			}
   1190         1.1  explorer 			++sp->pp_loopcnt;
   1191         1.1  explorer 
   1192         1.1  explorer 			/* Generate new local sequence number */
   1193        1.65    itojun 			sp->pp_seq[IDX_LCP] = arc4random();
   1194         1.1  explorer 			break;
   1195         1.1  explorer 		}
   1196         1.3  explorer 		sp->pp_loopcnt = 0;
   1197         1.1  explorer 		if (! (ifp->if_flags & IFF_UP) &&
   1198         1.1  explorer 		    (ifp->if_flags & IFF_RUNNING)) {
   1199         1.3  explorer 			if_up(ifp);
   1200         1.1  explorer 		}
   1201         1.1  explorer 		break;
   1202         1.1  explorer 	case CISCO_ADDR_REQ:
   1203        1.79  christos #ifdef INET
   1204         1.3  explorer 		sppp_get_ip_addrs(sp, &me, 0, &mymask);
   1205         1.3  explorer 		if (me != 0L)
   1206         1.3  explorer 			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
   1207        1.79  christos #endif
   1208         1.1  explorer 		break;
   1209         1.1  explorer 	}
   1210         1.1  explorer }
   1211         1.1  explorer 
   1212         1.1  explorer /*
   1213         1.3  explorer  * Send Cisco keepalive packet.
   1214         1.1  explorer  */
   1215         1.1  explorer static void
   1216        1.30      ross sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2)
   1217         1.1  explorer {
   1218         1.3  explorer 	STDDCL;
   1219         1.1  explorer 	struct ppp_header *h;
   1220         1.3  explorer 	struct cisco_packet *ch;
   1221         1.1  explorer 	struct mbuf *m;
   1222       1.109      matt 	uint32_t t;
   1223         1.1  explorer 
   1224        1.92    kardel 	t = time_uptime * 1000;
   1225        1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1226         1.1  explorer 	if (! m)
   1227         1.1  explorer 		return;
   1228         1.3  explorer 	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
   1229         1.1  explorer 	m->m_pkthdr.rcvif = 0;
   1230         1.1  explorer 
   1231        1.59    itojun 	h = mtod(m, struct ppp_header *);
   1232         1.3  explorer 	h->address = CISCO_MULTICAST;
   1233         1.3  explorer 	h->control = 0;
   1234        1.59    itojun 	h->protocol = htons(CISCO_KEEPALIVE);
   1235         1.3  explorer 
   1236        1.59    itojun 	ch = (struct cisco_packet *)(h + 1);
   1237        1.59    itojun 	ch->type = htonl(type);
   1238        1.59    itojun 	ch->par1 = htonl(par1);
   1239        1.59    itojun 	ch->par2 = htonl(par2);
   1240         1.3  explorer 	ch->rel = -1;
   1241         1.3  explorer 
   1242        1.59    itojun 	ch->time0 = htons((u_short)(t >> 16));
   1243        1.59    itojun 	ch->time1 = htons((u_short) t);
   1244         1.1  explorer 
   1245         1.3  explorer 	if (debug)
   1246         1.3  explorer 		log(LOG_DEBUG,
   1247        1.64    itojun 		    "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1248        1.80    itojun 			ifp->if_xname, ntohl(ch->type), ch->par1,
   1249        1.30      ross 			ch->par2, (u_int)ch->rel, (u_int)ch->time0,
   1250        1.30      ross 			(u_int)ch->time1);
   1251         1.1  explorer 
   1252        1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   1253        1.59    itojun 		IF_DROP(&sp->pp_fastq);
   1254        1.59    itojun 		IF_DROP(&ifp->if_snd);
   1255        1.59    itojun 		m_freem(m);
   1256        1.50      yamt 		++ifp->if_oerrors;
   1257        1.50      yamt 		return;
   1258         1.1  explorer 	} else
   1259        1.59    itojun 		IF_ENQUEUE(&sp->pp_cpq, m);
   1260         1.1  explorer 	if (! (ifp->if_flags & IFF_OACTIVE))
   1261        1.59    itojun 		(*ifp->if_start)(ifp);
   1262        1.22    martin 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1263         1.1  explorer }
   1264         1.1  explorer 
   1265        1.42  jdolecek /*
   1266         1.3  explorer  * PPP protocol implementation.
   1267         1.3  explorer  */
   1268         1.3  explorer 
   1269         1.1  explorer /*
   1270         1.3  explorer  * Send PPP control protocol packet.
   1271         1.1  explorer  */
   1272         1.1  explorer static void
   1273         1.3  explorer sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
   1274         1.3  explorer 	     u_char ident, u_short len, void *data)
   1275         1.1  explorer {
   1276         1.3  explorer 	STDDCL;
   1277         1.3  explorer 	struct lcp_header *lh;
   1278         1.1  explorer 	struct mbuf *m;
   1279        1.22    martin 	size_t pkthdrlen;
   1280         1.1  explorer 
   1281        1.22    martin 	pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
   1282        1.22    martin 
   1283        1.22    martin 	if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
   1284        1.22    martin 		len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
   1285        1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1286         1.1  explorer 	if (! m)
   1287         1.1  explorer 		return;
   1288        1.22    martin 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   1289         1.1  explorer 	m->m_pkthdr.rcvif = 0;
   1290         1.1  explorer 
   1291        1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
   1292       1.109      matt 		*mtod(m, uint16_t *) = htons(proto);
   1293       1.109      matt 		lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2);
   1294        1.22    martin 	} else {
   1295        1.22    martin 		struct ppp_header *h;
   1296        1.59    itojun 		h = mtod(m, struct ppp_header *);
   1297        1.22    martin 		h->address = PPP_ALLSTATIONS;        /* broadcast address */
   1298        1.22    martin 		h->control = PPP_UI;                 /* Unnumbered Info */
   1299        1.59    itojun 		h->protocol = htons(proto);         /* Link Control Protocol */
   1300        1.59    itojun 		lh = (struct lcp_header *)(h + 1);
   1301        1.22    martin 	}
   1302         1.3  explorer 	lh->type = type;
   1303         1.3  explorer 	lh->ident = ident;
   1304        1.59    itojun 	lh->len = htons(LCP_HEADER_LEN + len);
   1305         1.3  explorer 	if (len)
   1306        1.59    itojun 		bcopy (data, lh + 1, len);
   1307         1.1  explorer 
   1308         1.3  explorer 	if (debug) {
   1309        1.64    itojun 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
   1310        1.64    itojun 		    ifp->if_xname,
   1311         1.3  explorer 		    sppp_proto_name(proto),
   1312        1.59    itojun 		    sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len));
   1313         1.3  explorer 		if (len)
   1314        1.59    itojun 			sppp_print_bytes((u_char *)(lh + 1), len);
   1315         1.3  explorer 		addlog(">\n");
   1316         1.3  explorer 	}
   1317        1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   1318        1.59    itojun 		IF_DROP(&sp->pp_fastq);
   1319        1.59    itojun 		IF_DROP(&ifp->if_snd);
   1320        1.59    itojun 		m_freem(m);
   1321         1.3  explorer 		++ifp->if_oerrors;
   1322        1.50      yamt 		return;
   1323         1.1  explorer 	} else
   1324        1.59    itojun 		IF_ENQUEUE(&sp->pp_cpq, m);
   1325         1.1  explorer 	if (! (ifp->if_flags & IFF_OACTIVE))
   1326        1.59    itojun 		(*ifp->if_start)(ifp);
   1327        1.22    martin 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1328         1.1  explorer }
   1329         1.1  explorer 
   1330         1.1  explorer /*
   1331         1.3  explorer  * Handle incoming PPP control protocol packets.
   1332         1.1  explorer  */
   1333         1.1  explorer static void
   1334         1.3  explorer sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
   1335         1.1  explorer {
   1336         1.3  explorer 	STDDCL;
   1337         1.1  explorer 	struct lcp_header *h;
   1338        1.96   adrianp 	int printlen, len = m->m_pkthdr.len;
   1339         1.3  explorer 	int rv;
   1340         1.3  explorer 	u_char *p;
   1341       1.109      matt 	uint32_t u32;
   1342         1.1  explorer 
   1343         1.1  explorer 	if (len < 4) {
   1344         1.3  explorer 		if (debug)
   1345         1.3  explorer 			log(LOG_DEBUG,
   1346        1.64    itojun 			    "%s: %s invalid packet length: %d bytes\n",
   1347        1.64    itojun 			    ifp->if_xname, cp->name, len);
   1348         1.1  explorer 		return;
   1349         1.1  explorer 	}
   1350        1.59    itojun 	h = mtod(m, struct lcp_header *);
   1351         1.3  explorer 	if (debug) {
   1352        1.96   adrianp 		printlen = ntohs(h->len);
   1353         1.3  explorer 		log(LOG_DEBUG,
   1354        1.64    itojun 		    "%s: %s input(%s): <%s id=0x%x len=%d",
   1355        1.64    itojun 		    ifp->if_xname, cp->name,
   1356         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]),
   1357        1.96   adrianp 		    sppp_cp_type_name(h->type), h->ident, printlen);
   1358        1.96   adrianp 		if (len < printlen)
   1359        1.96   adrianp 			printlen = len;
   1360        1.96   adrianp 		if (printlen > 4)
   1361        1.96   adrianp 			sppp_print_bytes((u_char *)(h + 1), printlen - 4);
   1362         1.3  explorer 		addlog(">\n");
   1363         1.1  explorer 	}
   1364        1.59    itojun 	if (len > ntohs(h->len))
   1365        1.59    itojun 		len = ntohs(h->len);
   1366         1.3  explorer 	p = (u_char *)(h + 1);
   1367         1.1  explorer 	switch (h->type) {
   1368         1.3  explorer 	case CONF_REQ:
   1369         1.1  explorer 		if (len < 4) {
   1370         1.3  explorer 			if (debug)
   1371        1.64    itojun 				addlog("%s: %s invalid conf-req length %d\n",
   1372        1.64    itojun 				       ifp->if_xname, cp->name,
   1373         1.3  explorer 				       len);
   1374         1.3  explorer 			++ifp->if_ierrors;
   1375         1.3  explorer 			break;
   1376         1.3  explorer 		}
   1377         1.3  explorer 		/* handle states where RCR doesn't get a SCA/SCN */
   1378         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1379         1.3  explorer 		case STATE_CLOSING:
   1380         1.3  explorer 		case STATE_STOPPING:
   1381         1.1  explorer 			return;
   1382         1.3  explorer 		case STATE_CLOSED:
   1383         1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
   1384         1.3  explorer 				     0, 0);
   1385         1.3  explorer 			return;
   1386         1.3  explorer 		}
   1387         1.3  explorer 		rv = (cp->RCR)(sp, h, len);
   1388        1.96   adrianp 		if (rv < 0) {
   1389        1.96   adrianp 			/* fatal error, shut down */
   1390        1.96   adrianp 			(cp->tld)(sp);
   1391        1.96   adrianp 			sppp_lcp_tlf(sp);
   1392        1.96   adrianp 			return;
   1393        1.96   adrianp 		}
   1394         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1395         1.3  explorer 		case STATE_OPENED:
   1396         1.3  explorer 			(cp->tld)(sp);
   1397         1.3  explorer 			(cp->scr)(sp);
   1398         1.3  explorer 			/* fall through... */
   1399         1.3  explorer 		case STATE_ACK_SENT:
   1400         1.3  explorer 		case STATE_REQ_SENT:
   1401         1.3  explorer 			sppp_cp_change_state(cp, sp, rv?
   1402         1.3  explorer 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1403         1.3  explorer 			break;
   1404         1.3  explorer 		case STATE_STOPPED:
   1405         1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1406         1.3  explorer 			(cp->scr)(sp);
   1407         1.3  explorer 			sppp_cp_change_state(cp, sp, rv?
   1408         1.3  explorer 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1409         1.3  explorer 			break;
   1410         1.3  explorer 		case STATE_ACK_RCVD:
   1411         1.3  explorer 			if (rv) {
   1412         1.3  explorer 				sppp_cp_change_state(cp, sp, STATE_OPENED);
   1413         1.3  explorer 				if (debug)
   1414        1.64    itojun 					log(LOG_DEBUG, "%s: %s tlu\n",
   1415        1.64    itojun 					    ifp->if_xname,
   1416         1.3  explorer 					    cp->name);
   1417         1.3  explorer 				(cp->tlu)(sp);
   1418         1.3  explorer 			} else
   1419         1.3  explorer 				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1420         1.3  explorer 			break;
   1421         1.3  explorer 		default:
   1422        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1423        1.64    itojun 			       ifp->if_xname, cp->name,
   1424         1.3  explorer 			       sppp_cp_type_name(h->type),
   1425         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1426         1.3  explorer 			++ifp->if_ierrors;
   1427         1.3  explorer 		}
   1428         1.3  explorer 		break;
   1429         1.3  explorer 	case CONF_ACK:
   1430         1.3  explorer 		if (h->ident != sp->confid[cp->protoidx]) {
   1431         1.3  explorer 			if (debug)
   1432        1.64    itojun 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
   1433        1.64    itojun 				       ifp->if_xname, cp->name,
   1434         1.3  explorer 				       h->ident, sp->confid[cp->protoidx]);
   1435         1.3  explorer 			++ifp->if_ierrors;
   1436         1.3  explorer 			break;
   1437         1.3  explorer 		}
   1438         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1439         1.3  explorer 		case STATE_CLOSED:
   1440         1.3  explorer 		case STATE_STOPPED:
   1441         1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1442         1.3  explorer 			break;
   1443         1.3  explorer 		case STATE_CLOSING:
   1444         1.3  explorer 		case STATE_STOPPING:
   1445         1.3  explorer 			break;
   1446         1.3  explorer 		case STATE_REQ_SENT:
   1447         1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1448         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1449         1.3  explorer 			break;
   1450         1.3  explorer 		case STATE_OPENED:
   1451         1.3  explorer 			(cp->tld)(sp);
   1452         1.3  explorer 			/* fall through */
   1453         1.3  explorer 		case STATE_ACK_RCVD:
   1454         1.3  explorer 			(cp->scr)(sp);
   1455         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1456         1.3  explorer 			break;
   1457         1.3  explorer 		case STATE_ACK_SENT:
   1458         1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1459         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_OPENED);
   1460         1.3  explorer 			if (debug)
   1461        1.64    itojun 				log(LOG_DEBUG, "%s: %s tlu\n",
   1462        1.64    itojun 				       ifp->if_xname, cp->name);
   1463         1.3  explorer 			(cp->tlu)(sp);
   1464         1.3  explorer 			break;
   1465         1.3  explorer 		default:
   1466        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1467        1.64    itojun 			       ifp->if_xname, cp->name,
   1468         1.3  explorer 			       sppp_cp_type_name(h->type),
   1469         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1470         1.3  explorer 			++ifp->if_ierrors;
   1471         1.3  explorer 		}
   1472         1.3  explorer 		break;
   1473         1.3  explorer 	case CONF_NAK:
   1474         1.3  explorer 	case CONF_REJ:
   1475         1.3  explorer 		if (h->ident != sp->confid[cp->protoidx]) {
   1476         1.3  explorer 			if (debug)
   1477        1.64    itojun 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
   1478        1.64    itojun 				       ifp->if_xname, cp->name,
   1479         1.3  explorer 				       h->ident, sp->confid[cp->protoidx]);
   1480         1.3  explorer 			++ifp->if_ierrors;
   1481         1.3  explorer 			break;
   1482         1.1  explorer 		}
   1483         1.3  explorer 		if (h->type == CONF_NAK)
   1484         1.3  explorer 			(cp->RCN_nak)(sp, h, len);
   1485         1.3  explorer 		else /* CONF_REJ */
   1486         1.3  explorer 			(cp->RCN_rej)(sp, h, len);
   1487         1.3  explorer 
   1488         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1489         1.3  explorer 		case STATE_CLOSED:
   1490         1.3  explorer 		case STATE_STOPPED:
   1491         1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1492         1.3  explorer 			break;
   1493         1.3  explorer 		case STATE_REQ_SENT:
   1494         1.3  explorer 		case STATE_ACK_SENT:
   1495         1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1496         1.3  explorer 			(cp->scr)(sp);
   1497         1.3  explorer 			break;
   1498         1.3  explorer 		case STATE_OPENED:
   1499         1.3  explorer 			(cp->tld)(sp);
   1500         1.3  explorer 			/* fall through */
   1501         1.3  explorer 		case STATE_ACK_RCVD:
   1502         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
   1503         1.3  explorer 			(cp->scr)(sp);
   1504         1.3  explorer 			break;
   1505         1.3  explorer 		case STATE_CLOSING:
   1506         1.3  explorer 		case STATE_STOPPING:
   1507         1.3  explorer 			break;
   1508         1.3  explorer 		default:
   1509        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1510        1.64    itojun 			       ifp->if_xname, cp->name,
   1511         1.3  explorer 			       sppp_cp_type_name(h->type),
   1512         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1513         1.3  explorer 			++ifp->if_ierrors;
   1514         1.3  explorer 		}
   1515         1.3  explorer 		break;
   1516         1.3  explorer 
   1517         1.3  explorer 	case TERM_REQ:
   1518         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1519         1.3  explorer 		case STATE_ACK_RCVD:
   1520         1.3  explorer 		case STATE_ACK_SENT:
   1521         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1522         1.3  explorer 			/* fall through */
   1523         1.3  explorer 		case STATE_CLOSED:
   1524         1.3  explorer 		case STATE_STOPPED:
   1525         1.3  explorer 		case STATE_CLOSING:
   1526         1.3  explorer 		case STATE_STOPPING:
   1527         1.3  explorer 		case STATE_REQ_SENT:
   1528         1.3  explorer 		  sta:
   1529         1.3  explorer 			/* Send Terminate-Ack packet. */
   1530         1.3  explorer 			if (debug)
   1531        1.64    itojun 				log(LOG_DEBUG, "%s: %s send terminate-ack\n",
   1532        1.64    itojun 				    ifp->if_xname, cp->name);
   1533         1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1534         1.3  explorer 			break;
   1535         1.3  explorer 		case STATE_OPENED:
   1536         1.3  explorer 			(cp->tld)(sp);
   1537         1.3  explorer 			sp->rst_counter[cp->protoidx] = 0;
   1538         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPING);
   1539         1.3  explorer 			goto sta;
   1540         1.3  explorer 		default:
   1541        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1542        1.64    itojun 			       ifp->if_xname, cp->name,
   1543         1.3  explorer 			       sppp_cp_type_name(h->type),
   1544         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1545         1.3  explorer 			++ifp->if_ierrors;
   1546         1.1  explorer 		}
   1547         1.1  explorer 		break;
   1548         1.3  explorer 	case TERM_ACK:
   1549         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1550         1.3  explorer 		case STATE_CLOSED:
   1551         1.3  explorer 		case STATE_STOPPED:
   1552         1.3  explorer 		case STATE_REQ_SENT:
   1553         1.3  explorer 		case STATE_ACK_SENT:
   1554         1.3  explorer 			break;
   1555         1.3  explorer 		case STATE_CLOSING:
   1556         1.3  explorer 			(cp->tlf)(sp);
   1557         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1558        1.24    martin 			sppp_lcp_check_and_close(sp);
   1559         1.3  explorer 			break;
   1560         1.3  explorer 		case STATE_STOPPING:
   1561         1.3  explorer 			(cp->tlf)(sp);
   1562         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1563        1.24    martin 			sppp_lcp_check_and_close(sp);
   1564         1.1  explorer 			break;
   1565         1.3  explorer 		case STATE_ACK_RCVD:
   1566         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1567         1.1  explorer 			break;
   1568         1.3  explorer 		case STATE_OPENED:
   1569         1.3  explorer 			(cp->tld)(sp);
   1570         1.3  explorer 			(cp->scr)(sp);
   1571         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1572         1.1  explorer 			break;
   1573         1.3  explorer 		default:
   1574        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1575        1.64    itojun 			       ifp->if_xname, cp->name,
   1576         1.3  explorer 			       sppp_cp_type_name(h->type),
   1577         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1578         1.3  explorer 			++ifp->if_ierrors;
   1579         1.1  explorer 		}
   1580         1.1  explorer 		break;
   1581         1.3  explorer 	case CODE_REJ:
   1582         1.3  explorer 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1583         1.3  explorer 		log(LOG_INFO,
   1584        1.64    itojun 		    "%s: %s: ignoring RXJ (%s) for code ?, "
   1585         1.3  explorer 		    "danger will robinson\n",
   1586        1.64    itojun 		    ifp->if_xname, cp->name,
   1587         1.9    itojun 		    sppp_cp_type_name(h->type));
   1588         1.9    itojun 		switch (sp->state[cp->protoidx]) {
   1589         1.9    itojun 		case STATE_CLOSED:
   1590         1.9    itojun 		case STATE_STOPPED:
   1591         1.9    itojun 		case STATE_REQ_SENT:
   1592         1.9    itojun 		case STATE_ACK_SENT:
   1593         1.9    itojun 		case STATE_CLOSING:
   1594         1.9    itojun 		case STATE_STOPPING:
   1595         1.9    itojun 		case STATE_OPENED:
   1596         1.9    itojun 			break;
   1597         1.9    itojun 		case STATE_ACK_RCVD:
   1598         1.9    itojun 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1599         1.9    itojun 			break;
   1600         1.9    itojun 		default:
   1601        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1602        1.64    itojun 			       ifp->if_xname, cp->name,
   1603         1.9    itojun 			       sppp_cp_type_name(h->type),
   1604         1.9    itojun 			       sppp_state_name(sp->state[cp->protoidx]));
   1605         1.9    itojun 			++ifp->if_ierrors;
   1606         1.9    itojun 		}
   1607         1.9    itojun 		break;
   1608         1.9    itojun 	case PROTO_REJ:
   1609         1.9    itojun 	    {
   1610         1.9    itojun 		int catastrophic;
   1611         1.9    itojun 		const struct cp *upper;
   1612         1.9    itojun 		int i;
   1613       1.109      matt 		uint16_t proto;
   1614         1.9    itojun 
   1615         1.9    itojun 		catastrophic = 0;
   1616         1.9    itojun 		upper = NULL;
   1617        1.30      ross 		proto = p[0] << 8 | p[1];
   1618         1.9    itojun 		for (i = 0; i < IDX_COUNT; i++) {
   1619         1.9    itojun 			if (cps[i]->proto == proto) {
   1620         1.9    itojun 				upper = cps[i];
   1621         1.9    itojun 				break;
   1622         1.9    itojun 			}
   1623         1.9    itojun 		}
   1624         1.9    itojun 		if (upper == NULL)
   1625         1.9    itojun 			catastrophic++;
   1626         1.9    itojun 
   1627        1.46    martin 		if (debug)
   1628        1.46    martin 			log(LOG_INFO,
   1629        1.64    itojun 			    "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
   1630        1.64    itojun 			    ifp->if_xname, cp->name, catastrophic ? '-' : '+',
   1631        1.46    martin 			    sppp_cp_type_name(h->type), proto,
   1632        1.46    martin 			    upper ? upper->name : "unknown",
   1633        1.46    martin 			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
   1634         1.9    itojun 
   1635         1.9    itojun 		/*
   1636         1.9    itojun 		 * if we got RXJ+ against conf-req, the peer does not implement
   1637         1.9    itojun 		 * this particular protocol type.  terminate the protocol.
   1638         1.9    itojun 		 */
   1639         1.9    itojun 		if (upper && !catastrophic) {
   1640         1.9    itojun 			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
   1641         1.9    itojun 				upper->Close(sp);
   1642         1.9    itojun 				break;
   1643         1.9    itojun 			}
   1644         1.9    itojun 		}
   1645         1.9    itojun 
   1646         1.9    itojun 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1647         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1648         1.3  explorer 		case STATE_CLOSED:
   1649         1.3  explorer 		case STATE_STOPPED:
   1650         1.3  explorer 		case STATE_REQ_SENT:
   1651         1.3  explorer 		case STATE_ACK_SENT:
   1652         1.3  explorer 		case STATE_CLOSING:
   1653         1.3  explorer 		case STATE_STOPPING:
   1654         1.3  explorer 		case STATE_OPENED:
   1655         1.3  explorer 			break;
   1656         1.3  explorer 		case STATE_ACK_RCVD:
   1657         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1658         1.1  explorer 			break;
   1659         1.3  explorer 		default:
   1660        1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1661        1.64    itojun 			       ifp->if_xname, cp->name,
   1662         1.3  explorer 			       sppp_cp_type_name(h->type),
   1663         1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1664         1.3  explorer 			++ifp->if_ierrors;
   1665         1.3  explorer 		}
   1666         1.1  explorer 		break;
   1667         1.9    itojun 	    }
   1668         1.3  explorer 	case DISC_REQ:
   1669         1.3  explorer 		if (cp->proto != PPP_LCP)
   1670         1.3  explorer 			goto illegal;
   1671         1.3  explorer 		/* Discard the packet. */
   1672         1.3  explorer 		break;
   1673         1.3  explorer 	case ECHO_REQ:
   1674         1.3  explorer 		if (cp->proto != PPP_LCP)
   1675         1.3  explorer 			goto illegal;
   1676         1.3  explorer 		if (sp->state[cp->protoidx] != STATE_OPENED) {
   1677         1.3  explorer 			if (debug)
   1678        1.64    itojun 				addlog("%s: lcp echo req but lcp closed\n",
   1679        1.64    itojun 				       ifp->if_xname);
   1680         1.3  explorer 			++ifp->if_ierrors;
   1681         1.3  explorer 			break;
   1682         1.3  explorer 		}
   1683         1.3  explorer 		if (len < 8) {
   1684         1.3  explorer 			if (debug)
   1685        1.64    itojun 				addlog("%s: invalid lcp echo request "
   1686         1.3  explorer 				       "packet length: %d bytes\n",
   1687        1.64    itojun 				       ifp->if_xname, len);
   1688         1.3  explorer 			break;
   1689         1.3  explorer 		}
   1690        1.30      ross 		memcpy(&u32, h + 1, sizeof u32);
   1691        1.30      ross 		if (ntohl(u32) == sp->lcp.magic) {
   1692         1.3  explorer 			/* Line loopback mode detected. */
   1693        1.64    itojun 			printf("%s: loopback\n", ifp->if_xname);
   1694        1.59    itojun 			if_down(ifp);
   1695        1.59    itojun 			IF_PURGE(&sp->pp_cpq);
   1696         1.3  explorer 
   1697         1.3  explorer 			/* Shut down the PPP link. */
   1698         1.3  explorer 			/* XXX */
   1699         1.3  explorer 			lcp.Down(sp);
   1700         1.3  explorer 			lcp.Up(sp);
   1701         1.3  explorer 			break;
   1702         1.3  explorer 		}
   1703        1.30      ross 		u32 = htonl(sp->lcp.magic);
   1704        1.30      ross 		memcpy(h + 1, &u32, sizeof u32);
   1705         1.3  explorer 		if (debug)
   1706        1.64    itojun 			addlog("%s: got lcp echo req, sending echo rep\n",
   1707        1.64    itojun 			       ifp->if_xname);
   1708        1.59    itojun 		sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4,
   1709        1.59    itojun 		    h + 1);
   1710         1.1  explorer 		break;
   1711         1.3  explorer 	case ECHO_REPLY:
   1712         1.3  explorer 		if (cp->proto != PPP_LCP)
   1713         1.3  explorer 			goto illegal;
   1714         1.3  explorer 		if (h->ident != sp->lcp.echoid) {
   1715         1.3  explorer 			++ifp->if_ierrors;
   1716         1.3  explorer 			break;
   1717         1.3  explorer 		}
   1718         1.3  explorer 		if (len < 8) {
   1719         1.3  explorer 			if (debug)
   1720        1.64    itojun 				addlog("%s: lcp invalid echo reply "
   1721         1.3  explorer 				       "packet length: %d bytes\n",
   1722        1.64    itojun 				       ifp->if_xname, len);
   1723         1.3  explorer 			break;
   1724         1.3  explorer 		}
   1725         1.3  explorer 		if (debug)
   1726        1.64    itojun 			addlog("%s: lcp got echo rep\n",
   1727        1.64    itojun 			       ifp->if_xname);
   1728        1.30      ross 		memcpy(&u32, h + 1, sizeof u32);
   1729        1.30      ross 		if (ntohl(u32) != sp->lcp.magic)
   1730         1.3  explorer 			sp->pp_alivecnt = 0;
   1731         1.1  explorer 		break;
   1732         1.3  explorer 	default:
   1733         1.3  explorer 		/* Unknown packet type -- send Code-Reject packet. */
   1734         1.3  explorer 	  illegal:
   1735         1.3  explorer 		if (debug)
   1736        1.64    itojun 			addlog("%s: %s send code-rej for 0x%x\n",
   1737        1.64    itojun 			       ifp->if_xname, cp->name, h->type);
   1738         1.9    itojun 		sppp_cp_send(sp, cp->proto, CODE_REJ,
   1739         1.9    itojun 		    ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
   1740         1.3  explorer 		++ifp->if_ierrors;
   1741         1.1  explorer 	}
   1742         1.1  explorer }
   1743         1.1  explorer 
   1744         1.3  explorer 
   1745         1.3  explorer /*
   1746         1.3  explorer  * The generic part of all Up/Down/Open/Close/TO event handlers.
   1747         1.3  explorer  * Basically, the state transition handling in the automaton.
   1748         1.3  explorer  */
   1749         1.1  explorer static void
   1750         1.3  explorer sppp_up_event(const struct cp *cp, struct sppp *sp)
   1751         1.1  explorer {
   1752         1.3  explorer 	STDDCL;
   1753         1.1  explorer 
   1754         1.3  explorer 	if (debug)
   1755        1.64    itojun 		log(LOG_DEBUG, "%s: %s up(%s)\n",
   1756        1.64    itojun 		    ifp->if_xname, cp->name,
   1757         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1758         1.3  explorer 
   1759         1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1760         1.3  explorer 	case STATE_INITIAL:
   1761         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1762         1.3  explorer 		break;
   1763         1.3  explorer 	case STATE_STARTING:
   1764         1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1765         1.3  explorer 		(cp->scr)(sp);
   1766         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1767         1.3  explorer 		break;
   1768         1.3  explorer 	default:
   1769        1.64    itojun 		printf("%s: %s illegal up in state %s\n",
   1770        1.64    itojun 		       ifp->if_xname, cp->name,
   1771         1.3  explorer 		       sppp_state_name(sp->state[cp->protoidx]));
   1772         1.3  explorer 	}
   1773         1.1  explorer }
   1774         1.1  explorer 
   1775         1.1  explorer static void
   1776         1.3  explorer sppp_down_event(const struct cp *cp, struct sppp *sp)
   1777         1.1  explorer {
   1778         1.3  explorer 	STDDCL;
   1779         1.3  explorer 
   1780         1.3  explorer 	if (debug)
   1781        1.64    itojun 		log(LOG_DEBUG, "%s: %s down(%s)\n",
   1782        1.64    itojun 		    ifp->if_xname, cp->name,
   1783         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1784         1.3  explorer 
   1785         1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1786         1.3  explorer 	case STATE_CLOSED:
   1787         1.3  explorer 	case STATE_CLOSING:
   1788         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   1789         1.3  explorer 		break;
   1790         1.3  explorer 	case STATE_STOPPED:
   1791         1.3  explorer 		(cp->tls)(sp);
   1792         1.3  explorer 		/* fall through */
   1793         1.3  explorer 	case STATE_STOPPING:
   1794         1.3  explorer 	case STATE_REQ_SENT:
   1795         1.3  explorer 	case STATE_ACK_RCVD:
   1796         1.3  explorer 	case STATE_ACK_SENT:
   1797         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1798         1.3  explorer 		break;
   1799         1.3  explorer 	case STATE_OPENED:
   1800         1.3  explorer 		(cp->tld)(sp);
   1801         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1802         1.3  explorer 		break;
   1803         1.3  explorer 	default:
   1804        1.64    itojun 		printf("%s: %s illegal down in state %s\n",
   1805        1.64    itojun 		       ifp->if_xname, cp->name,
   1806         1.3  explorer 		       sppp_state_name(sp->state[cp->protoidx]));
   1807         1.3  explorer 	}
   1808         1.1  explorer }
   1809         1.1  explorer 
   1810         1.3  explorer 
   1811         1.1  explorer static void
   1812         1.3  explorer sppp_open_event(const struct cp *cp, struct sppp *sp)
   1813         1.1  explorer {
   1814         1.3  explorer 	STDDCL;
   1815         1.1  explorer 
   1816         1.3  explorer 	if (debug)
   1817        1.64    itojun 		log(LOG_DEBUG, "%s: %s open(%s)\n",
   1818        1.64    itojun 		    ifp->if_xname, cp->name,
   1819         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1820         1.3  explorer 
   1821         1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1822         1.3  explorer 	case STATE_INITIAL:
   1823        1.91  christos 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1824         1.3  explorer 		(cp->tls)(sp);
   1825         1.3  explorer 		break;
   1826         1.3  explorer 	case STATE_STARTING:
   1827         1.3  explorer 		break;
   1828         1.3  explorer 	case STATE_CLOSED:
   1829         1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1830         1.3  explorer 		(cp->scr)(sp);
   1831         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1832         1.3  explorer 		break;
   1833         1.3  explorer 	case STATE_STOPPED:
   1834         1.3  explorer 	case STATE_STOPPING:
   1835         1.3  explorer 	case STATE_REQ_SENT:
   1836         1.3  explorer 	case STATE_ACK_RCVD:
   1837         1.3  explorer 	case STATE_ACK_SENT:
   1838         1.3  explorer 	case STATE_OPENED:
   1839         1.3  explorer 		break;
   1840         1.3  explorer 	case STATE_CLOSING:
   1841         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STOPPING);
   1842         1.1  explorer 		break;
   1843         1.1  explorer 	}
   1844         1.1  explorer }
   1845         1.1  explorer 
   1846         1.3  explorer 
   1847         1.3  explorer static void
   1848         1.3  explorer sppp_close_event(const struct cp *cp, struct sppp *sp)
   1849         1.1  explorer {
   1850         1.3  explorer 	STDDCL;
   1851         1.1  explorer 
   1852         1.3  explorer 	if (debug)
   1853        1.64    itojun 		log(LOG_DEBUG, "%s: %s close(%s)\n",
   1854        1.64    itojun 		    ifp->if_xname, cp->name,
   1855         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1856         1.3  explorer 
   1857         1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1858         1.3  explorer 	case STATE_INITIAL:
   1859         1.3  explorer 	case STATE_CLOSED:
   1860         1.3  explorer 	case STATE_CLOSING:
   1861         1.3  explorer 		break;
   1862         1.3  explorer 	case STATE_STARTING:
   1863        1.91  christos 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   1864         1.3  explorer 		(cp->tlf)(sp);
   1865         1.3  explorer 		break;
   1866         1.3  explorer 	case STATE_STOPPED:
   1867         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1868         1.3  explorer 		break;
   1869         1.3  explorer 	case STATE_STOPPING:
   1870         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   1871         1.3  explorer 		break;
   1872         1.3  explorer 	case STATE_OPENED:
   1873         1.3  explorer 		(cp->tld)(sp);
   1874         1.3  explorer 		/* fall through */
   1875         1.3  explorer 	case STATE_REQ_SENT:
   1876         1.3  explorer 	case STATE_ACK_RCVD:
   1877         1.3  explorer 	case STATE_ACK_SENT:
   1878         1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
   1879         1.9    itojun 		sppp_cp_send(sp, cp->proto, TERM_REQ,
   1880         1.9    itojun 		    ++sp->pp_seq[cp->protoidx], 0, 0);
   1881         1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   1882         1.3  explorer 		break;
   1883         1.3  explorer 	}
   1884         1.3  explorer }
   1885         1.3  explorer 
   1886         1.3  explorer static void
   1887         1.3  explorer sppp_to_event(const struct cp *cp, struct sppp *sp)
   1888         1.3  explorer {
   1889         1.3  explorer 	STDDCL;
   1890         1.3  explorer 	int s;
   1891         1.3  explorer 
   1892        1.23   thorpej 	s = splnet();
   1893         1.3  explorer 	if (debug)
   1894        1.64    itojun 		log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n",
   1895        1.64    itojun 		    ifp->if_xname, cp->name,
   1896         1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]),
   1897         1.3  explorer 		    sp->rst_counter[cp->protoidx]);
   1898         1.3  explorer 
   1899         1.3  explorer 	if (--sp->rst_counter[cp->protoidx] < 0)
   1900         1.3  explorer 		/* TO- event */
   1901         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1902         1.3  explorer 		case STATE_CLOSING:
   1903         1.3  explorer 			(cp->tlf)(sp);
   1904         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1905        1.24    martin 			sppp_lcp_check_and_close(sp);
   1906         1.3  explorer 			break;
   1907         1.3  explorer 		case STATE_STOPPING:
   1908         1.3  explorer 			(cp->tlf)(sp);
   1909         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1910        1.24    martin 			sppp_lcp_check_and_close(sp);
   1911         1.3  explorer 			break;
   1912         1.3  explorer 		case STATE_REQ_SENT:
   1913         1.3  explorer 		case STATE_ACK_RCVD:
   1914         1.3  explorer 		case STATE_ACK_SENT:
   1915         1.3  explorer 			(cp->tlf)(sp);
   1916         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1917        1.24    martin 			sppp_lcp_check_and_close(sp);
   1918         1.3  explorer 			break;
   1919         1.3  explorer 		}
   1920         1.3  explorer 	else
   1921         1.3  explorer 		/* TO+ event */
   1922         1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1923         1.3  explorer 		case STATE_CLOSING:
   1924         1.3  explorer 		case STATE_STOPPING:
   1925         1.9    itojun 			sppp_cp_send(sp, cp->proto, TERM_REQ,
   1926         1.9    itojun 			    ++sp->pp_seq[cp->protoidx], 0, 0);
   1927         1.7   thorpej 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1928         1.7   thorpej 			    cp->TO, sp);
   1929         1.3  explorer 			break;
   1930         1.3  explorer 		case STATE_REQ_SENT:
   1931         1.3  explorer 		case STATE_ACK_RCVD:
   1932         1.3  explorer 			(cp->scr)(sp);
   1933         1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   1934         1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1935         1.3  explorer 			break;
   1936         1.3  explorer 		case STATE_ACK_SENT:
   1937         1.3  explorer 			(cp->scr)(sp);
   1938         1.7   thorpej 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1939         1.7   thorpej 			    cp->TO, sp);
   1940         1.3  explorer 			break;
   1941         1.3  explorer 		}
   1942         1.3  explorer 
   1943         1.3  explorer 	splx(s);
   1944         1.3  explorer }
   1945         1.3  explorer 
   1946         1.3  explorer /*
   1947         1.3  explorer  * Change the state of a control protocol in the state automaton.
   1948         1.3  explorer  * Takes care of starting/stopping the restart timer.
   1949         1.3  explorer  */
   1950         1.3  explorer void
   1951         1.3  explorer sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
   1952         1.3  explorer {
   1953         1.3  explorer 	sp->state[cp->protoidx] = newstate;
   1954         1.7   thorpej 	callout_stop(&sp->ch[cp->protoidx]);
   1955         1.3  explorer 	switch (newstate) {
   1956         1.3  explorer 	case STATE_INITIAL:
   1957         1.3  explorer 	case STATE_STARTING:
   1958         1.3  explorer 	case STATE_CLOSED:
   1959         1.3  explorer 	case STATE_STOPPED:
   1960         1.3  explorer 	case STATE_OPENED:
   1961         1.3  explorer 		break;
   1962         1.3  explorer 	case STATE_CLOSING:
   1963         1.3  explorer 	case STATE_STOPPING:
   1964         1.3  explorer 	case STATE_REQ_SENT:
   1965         1.3  explorer 	case STATE_ACK_RCVD:
   1966         1.3  explorer 	case STATE_ACK_SENT:
   1967         1.7   thorpej 		callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1968         1.7   thorpej 		    cp->TO, sp);
   1969         1.3  explorer 		break;
   1970         1.3  explorer 	}
   1971         1.3  explorer }
   1972        1.42  jdolecek 
   1973        1.42  jdolecek /*
   1974         1.3  explorer  *--------------------------------------------------------------------------*
   1975         1.3  explorer  *                                                                          *
   1976         1.3  explorer  *                         The LCP implementation.                          *
   1977         1.3  explorer  *                                                                          *
   1978         1.3  explorer  *--------------------------------------------------------------------------*
   1979         1.3  explorer  */
   1980         1.3  explorer static void
   1981         1.3  explorer sppp_lcp_init(struct sppp *sp)
   1982         1.3  explorer {
   1983         1.3  explorer 	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
   1984         1.3  explorer 	sp->lcp.magic = 0;
   1985         1.3  explorer 	sp->state[IDX_LCP] = STATE_INITIAL;
   1986         1.3  explorer 	sp->fail_counter[IDX_LCP] = 0;
   1987         1.9    itojun 	sp->pp_seq[IDX_LCP] = 0;
   1988         1.9    itojun 	sp->pp_rseq[IDX_LCP] = 0;
   1989         1.3  explorer 	sp->lcp.protos = 0;
   1990       1.105       scw 	if (sp->pp_if.if_mtu < PP_MTU) {
   1991       1.105       scw 		sp->lcp.mru = sp->pp_if.if_mtu;
   1992       1.105       scw 		sp->lcp.opts |= (1 << LCP_OPT_MRU);
   1993       1.105       scw 	} else
   1994       1.105       scw 		sp->lcp.mru = PP_MTU;
   1995       1.105       scw 	sp->lcp.their_mru = PP_MTU;
   1996         1.3  explorer 
   1997         1.3  explorer 	/*
   1998         1.3  explorer 	 * Initialize counters and timeout values.  Note that we don't
   1999         1.3  explorer 	 * use the 3 seconds suggested in RFC 1661 since we are likely
   2000         1.3  explorer 	 * running on a fast link.  XXX We should probably implement
   2001         1.3  explorer 	 * the exponential backoff option.  Note that these values are
   2002         1.3  explorer 	 * relevant for all control protocols, not just LCP only.
   2003         1.3  explorer 	 */
   2004         1.3  explorer 	sp->lcp.timeout = 1 * hz;
   2005         1.3  explorer 	sp->lcp.max_terminate = 2;
   2006         1.3  explorer 	sp->lcp.max_configure = 10;
   2007         1.3  explorer 	sp->lcp.max_failure = 10;
   2008       1.106        ad 	callout_init(&sp->ch[IDX_LCP], 0);
   2009         1.3  explorer }
   2010         1.3  explorer 
   2011         1.3  explorer static void
   2012         1.3  explorer sppp_lcp_up(struct sppp *sp)
   2013         1.3  explorer {
   2014         1.3  explorer 	STDDCL;
   2015         1.3  explorer 
   2016        1.40    martin 	/* Initialize activity timestamp: opening a connection is an activity */
   2017        1.92    kardel 	sp->pp_last_receive = sp->pp_last_activity = time_uptime;
   2018        1.40    martin 
   2019         1.3  explorer 	/*
   2020         1.3  explorer 	 * If this interface is passive or dial-on-demand, and we are
   2021         1.3  explorer 	 * still in Initial state, it means we've got an incoming
   2022         1.3  explorer 	 * call.  Activate the interface.
   2023         1.3  explorer 	 */
   2024         1.3  explorer 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
   2025         1.3  explorer 		if (debug)
   2026         1.3  explorer 			log(LOG_DEBUG,
   2027        1.64    itojun 			    "%s: Up event", ifp->if_xname);
   2028         1.3  explorer 		ifp->if_flags |= IFF_RUNNING;
   2029         1.3  explorer 		if (sp->state[IDX_LCP] == STATE_INITIAL) {
   2030         1.3  explorer 			if (debug)
   2031         1.3  explorer 				addlog("(incoming call)\n");
   2032         1.3  explorer 			sp->pp_flags |= PP_CALLIN;
   2033         1.3  explorer 			lcp.Open(sp);
   2034         1.3  explorer 		} else if (debug)
   2035         1.3  explorer 			addlog("\n");
   2036        1.32    martin 	} else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
   2037        1.32    martin 		   (sp->state[IDX_LCP] == STATE_INITIAL)) {
   2038        1.32    martin 			ifp->if_flags |= IFF_RUNNING;
   2039        1.32    martin 			lcp.Open(sp);
   2040         1.3  explorer 	}
   2041         1.3  explorer 
   2042         1.3  explorer 	sppp_up_event(&lcp, sp);
   2043         1.3  explorer }
   2044         1.3  explorer 
   2045         1.3  explorer static void
   2046         1.3  explorer sppp_lcp_down(struct sppp *sp)
   2047         1.3  explorer {
   2048         1.3  explorer 	STDDCL;
   2049         1.3  explorer 
   2050         1.3  explorer 	sppp_down_event(&lcp, sp);
   2051         1.3  explorer 
   2052         1.3  explorer 	/*
   2053         1.3  explorer 	 * If this is neither a dial-on-demand nor a passive
   2054         1.3  explorer 	 * interface, simulate an ``ifconfig down'' action, so the
   2055         1.3  explorer 	 * administrator can force a redial by another ``ifconfig
   2056         1.3  explorer 	 * up''.  XXX For leased line operation, should we immediately
   2057         1.3  explorer 	 * try to reopen the connection here?
   2058         1.3  explorer 	 */
   2059         1.3  explorer 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
   2060        1.46    martin 		if (debug)
   2061        1.46    martin 			log(LOG_INFO,
   2062        1.64    itojun 			    "%s: Down event (carrier loss), taking interface down.\n",
   2063        1.64    itojun 			    ifp->if_xname);
   2064         1.3  explorer 		if_down(ifp);
   2065         1.3  explorer 	} else {
   2066         1.3  explorer 		if (debug)
   2067         1.3  explorer 			log(LOG_DEBUG,
   2068        1.64    itojun 			    "%s: Down event (carrier loss)\n",
   2069        1.64    itojun 			    ifp->if_xname);
   2070         1.3  explorer 	}
   2071         1.3  explorer 	sp->pp_flags &= ~PP_CALLIN;
   2072         1.3  explorer 	if (sp->state[IDX_LCP] != STATE_INITIAL)
   2073         1.3  explorer 		lcp.Close(sp);
   2074         1.3  explorer 	ifp->if_flags &= ~IFF_RUNNING;
   2075         1.3  explorer }
   2076         1.3  explorer 
   2077         1.3  explorer static void
   2078         1.3  explorer sppp_lcp_open(struct sppp *sp)
   2079         1.3  explorer {
   2080         1.3  explorer 	/*
   2081         1.3  explorer 	 * If we are authenticator, negotiate LCP_AUTH
   2082         1.3  explorer 	 */
   2083         1.3  explorer 	if (sp->hisauth.proto != 0)
   2084         1.3  explorer 		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
   2085         1.3  explorer 	else
   2086         1.3  explorer 		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2087         1.3  explorer 	sp->pp_flags &= ~PP_NEEDAUTH;
   2088         1.3  explorer 	sppp_open_event(&lcp, sp);
   2089         1.3  explorer }
   2090         1.3  explorer 
   2091         1.3  explorer static void
   2092         1.3  explorer sppp_lcp_close(struct sppp *sp)
   2093         1.3  explorer {
   2094         1.3  explorer 	sppp_close_event(&lcp, sp);
   2095         1.3  explorer }
   2096         1.3  explorer 
   2097         1.3  explorer static void
   2098         1.3  explorer sppp_lcp_TO(void *cookie)
   2099         1.3  explorer {
   2100         1.3  explorer 	sppp_to_event(&lcp, (struct sppp *)cookie);
   2101         1.3  explorer }
   2102         1.3  explorer 
   2103         1.3  explorer /*
   2104         1.3  explorer  * Analyze a configure request.  Return true if it was agreeable, and
   2105         1.3  explorer  * caused action sca, false if it has been rejected or nak'ed, and
   2106         1.3  explorer  * caused action scn.  (The return value is used to make the state
   2107         1.3  explorer  * transition decision in the state automaton.)
   2108         1.3  explorer  */
   2109         1.3  explorer static int
   2110         1.3  explorer sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   2111         1.3  explorer {
   2112         1.3  explorer 	STDDCL;
   2113         1.3  explorer 	u_char *buf, *r, *p;
   2114         1.3  explorer 	int origlen, rlen;
   2115       1.109      matt 	uint32_t nmagic;
   2116         1.3  explorer 	u_short authproto;
   2117         1.3  explorer 
   2118         1.3  explorer 	len -= 4;
   2119         1.3  explorer 	origlen = len;
   2120         1.3  explorer 	buf = r = malloc (len, M_TEMP, M_NOWAIT);
   2121         1.3  explorer 	if (! buf)
   2122         1.3  explorer 		return (0);
   2123         1.3  explorer 
   2124         1.3  explorer 	if (debug)
   2125        1.64    itojun 		log(LOG_DEBUG, "%s: lcp parse opts:",
   2126        1.64    itojun 		    ifp->if_xname);
   2127         1.3  explorer 
   2128         1.3  explorer 	/* pass 1: check for things that need to be rejected */
   2129        1.59    itojun 	p = (void *)(h + 1);
   2130         1.3  explorer 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2131        1.96   adrianp 		/* Sanity check option length */
   2132        1.96   adrianp 		if (p[1] > len) {
   2133        1.96   adrianp 			/*
   2134       1.102       wiz 			 * Malicious option - drop immediately.
   2135        1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2136        1.96   adrianp 			 */
   2137        1.96   adrianp 			addlog("%s: received malicious LCP option 0x%02x, "
   2138        1.96   adrianp 			    "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname,
   2139        1.96   adrianp 			    p[0], p[1], len);
   2140        1.96   adrianp 			goto drop;
   2141        1.96   adrianp 		}
   2142         1.3  explorer 		if (debug)
   2143         1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2144         1.3  explorer 		switch (*p) {
   2145         1.3  explorer 		case LCP_OPT_MAGIC:
   2146         1.3  explorer 			/* Magic number. */
   2147         1.3  explorer 			/* fall through, both are same length */
   2148         1.3  explorer 		case LCP_OPT_ASYNC_MAP:
   2149         1.3  explorer 			/* Async control character map. */
   2150         1.3  explorer 			if (len >= 6 || p[1] == 6)
   2151         1.3  explorer 				continue;
   2152         1.3  explorer 			if (debug)
   2153         1.9    itojun 				addlog(" [invalid]");
   2154         1.3  explorer 			break;
   2155         1.3  explorer 		case LCP_OPT_MRU:
   2156         1.3  explorer 			/* Maximum receive unit. */
   2157         1.3  explorer 			if (len >= 4 && p[1] == 4)
   2158         1.3  explorer 				continue;
   2159         1.3  explorer 			if (debug)
   2160         1.9    itojun 				addlog(" [invalid]");
   2161         1.3  explorer 			break;
   2162         1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2163         1.3  explorer 			if (len < 4) {
   2164         1.3  explorer 				if (debug)
   2165         1.9    itojun 					addlog(" [invalid]");
   2166         1.3  explorer 				break;
   2167         1.3  explorer 			}
   2168         1.3  explorer 			authproto = (p[2] << 8) + p[3];
   2169         1.3  explorer 			if (authproto == PPP_CHAP && p[1] != 5) {
   2170         1.3  explorer 				if (debug)
   2171         1.9    itojun 					addlog(" [invalid chap len]");
   2172         1.3  explorer 				break;
   2173         1.3  explorer 			}
   2174         1.3  explorer 			if (sp->myauth.proto == 0) {
   2175         1.3  explorer 				/* we are not configured to do auth */
   2176         1.3  explorer 				if (debug)
   2177         1.9    itojun 					addlog(" [not configured]");
   2178         1.3  explorer 				break;
   2179         1.3  explorer 			}
   2180         1.3  explorer 			/*
   2181         1.3  explorer 			 * Remote want us to authenticate, remember this,
   2182        1.36    martin 			 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got
   2183         1.3  explorer 			 * up.
   2184         1.3  explorer 			 */
   2185         1.3  explorer 			sp->pp_flags |= PP_NEEDAUTH;
   2186         1.3  explorer 			continue;
   2187         1.3  explorer 		default:
   2188         1.3  explorer 			/* Others not supported. */
   2189         1.3  explorer 			if (debug)
   2190         1.9    itojun 				addlog(" [rej]");
   2191         1.3  explorer 			break;
   2192         1.3  explorer 		}
   2193         1.3  explorer 		/* Add the option to rejected list. */
   2194         1.3  explorer 		bcopy (p, r, p[1]);
   2195         1.3  explorer 		r += p[1];
   2196         1.3  explorer 		rlen += p[1];
   2197         1.3  explorer 	}
   2198         1.3  explorer 	if (rlen) {
   2199         1.3  explorer 		if (debug)
   2200         1.3  explorer 			addlog(" send conf-rej\n");
   2201        1.59    itojun 		sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2202         1.9    itojun 		goto end;
   2203         1.3  explorer 	} else if (debug)
   2204         1.3  explorer 		addlog("\n");
   2205         1.3  explorer 
   2206         1.3  explorer 	/*
   2207         1.3  explorer 	 * pass 2: check for option values that are unacceptable and
   2208         1.3  explorer 	 * thus require to be nak'ed.
   2209         1.3  explorer 	 */
   2210         1.3  explorer 	if (debug)
   2211        1.64    itojun 		log(LOG_DEBUG, "%s: lcp parse opt values: ",
   2212        1.64    itojun 		    ifp->if_xname);
   2213         1.3  explorer 
   2214        1.59    itojun 	p = (void *)(h + 1);
   2215         1.3  explorer 	len = origlen;
   2216         1.3  explorer 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2217         1.3  explorer 		if (debug)
   2218         1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2219         1.3  explorer 		switch (*p) {
   2220         1.3  explorer 		case LCP_OPT_MAGIC:
   2221         1.3  explorer 			/* Magic number -- extract. */
   2222       1.109      matt 			nmagic = (uint32_t)p[2] << 24 |
   2223       1.109      matt 				(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
   2224         1.3  explorer 			if (nmagic != sp->lcp.magic) {
   2225         1.3  explorer 				if (debug)
   2226        1.30      ross 					addlog(" 0x%x", nmagic);
   2227         1.3  explorer 				continue;
   2228         1.3  explorer 			}
   2229         1.3  explorer 			/*
   2230         1.3  explorer 			 * Local and remote magics equal -- loopback?
   2231         1.3  explorer 			 */
   2232        1.68    martin 			if (sp->pp_loopcnt >= LOOPALIVECNT*5) {
   2233        1.64    itojun 				printf ("%s: loopback\n",
   2234        1.64    itojun 					ifp->if_xname);
   2235         1.3  explorer 				sp->pp_loopcnt = 0;
   2236         1.3  explorer 				if (ifp->if_flags & IFF_UP) {
   2237         1.3  explorer 					if_down(ifp);
   2238        1.26    itojun 					IF_PURGE(&sp->pp_cpq);
   2239         1.3  explorer 					/* XXX ? */
   2240         1.3  explorer 					lcp.Down(sp);
   2241         1.3  explorer 					lcp.Up(sp);
   2242         1.3  explorer 				}
   2243         1.3  explorer 			} else if (debug)
   2244         1.9    itojun 				addlog(" [glitch]");
   2245         1.3  explorer 			++sp->pp_loopcnt;
   2246         1.3  explorer 			/*
   2247         1.3  explorer 			 * We negate our magic here, and NAK it.  If
   2248         1.3  explorer 			 * we see it later in an NAK packet, we
   2249         1.3  explorer 			 * suggest a new one.
   2250         1.3  explorer 			 */
   2251         1.3  explorer 			nmagic = ~sp->lcp.magic;
   2252         1.3  explorer 			/* Gonna NAK it. */
   2253         1.3  explorer 			p[2] = nmagic >> 24;
   2254         1.3  explorer 			p[3] = nmagic >> 16;
   2255         1.3  explorer 			p[4] = nmagic >> 8;
   2256         1.3  explorer 			p[5] = nmagic;
   2257         1.3  explorer 			break;
   2258         1.3  explorer 
   2259         1.3  explorer 		case LCP_OPT_ASYNC_MAP:
   2260        1.56  christos 			/*
   2261        1.56  christos 			 * Async control character map -- just ignore it.
   2262        1.56  christos 			 *
   2263        1.56  christos 			 * Quote from RFC 1662, chapter 6:
   2264        1.56  christos 			 * To enable this functionality, synchronous PPP
   2265        1.56  christos 			 * implementations MUST always respond to the
   2266        1.56  christos 			 * Async-Control-Character-Map Configuration
   2267        1.56  christos 			 * Option with the LCP Configure-Ack.  However,
   2268        1.56  christos 			 * acceptance of the Configuration Option does
   2269        1.56  christos 			 * not imply that the synchronous implementation
   2270        1.56  christos 			 * will do any ACCM mapping.  Instead, all such
   2271        1.56  christos 			 * octet mapping will be performed by the
   2272        1.56  christos 			 * asynchronous-to-synchronous converter.
   2273        1.56  christos 			 */
   2274        1.55  christos 			continue;
   2275         1.3  explorer 
   2276         1.3  explorer 		case LCP_OPT_MRU:
   2277         1.3  explorer 			/*
   2278         1.3  explorer 			 * Maximum receive unit.  Always agreeable,
   2279         1.3  explorer 			 * but ignored by now.
   2280         1.3  explorer 			 */
   2281         1.3  explorer 			sp->lcp.their_mru = p[2] * 256 + p[3];
   2282         1.3  explorer 			if (debug)
   2283         1.9    itojun 				addlog(" %ld", sp->lcp.their_mru);
   2284         1.3  explorer 			continue;
   2285         1.3  explorer 
   2286         1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2287         1.3  explorer 			authproto = (p[2] << 8) + p[3];
   2288         1.3  explorer 			if (sp->myauth.proto != authproto) {
   2289         1.3  explorer 				/* not agreed, nak */
   2290         1.3  explorer 				if (debug)
   2291         1.9    itojun 					addlog(" [mine %s != his %s]",
   2292        1.71       oki 					       sppp_proto_name(sp->myauth.proto),
   2293         1.3  explorer 					       sppp_proto_name(authproto));
   2294         1.3  explorer 				p[2] = sp->myauth.proto >> 8;
   2295         1.3  explorer 				p[3] = sp->myauth.proto;
   2296         1.3  explorer 				break;
   2297         1.3  explorer 			}
   2298         1.3  explorer 			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
   2299         1.3  explorer 				if (debug)
   2300         1.9    itojun 					addlog(" [chap not MD5]");
   2301         1.3  explorer 				p[4] = CHAP_MD5;
   2302         1.3  explorer 				break;
   2303         1.3  explorer 			}
   2304         1.3  explorer 			continue;
   2305         1.3  explorer 		}
   2306         1.3  explorer 		/* Add the option to nak'ed list. */
   2307         1.3  explorer 		bcopy (p, r, p[1]);
   2308         1.3  explorer 		r += p[1];
   2309         1.3  explorer 		rlen += p[1];
   2310         1.3  explorer 	}
   2311         1.3  explorer 	if (rlen) {
   2312         1.3  explorer 		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
   2313         1.3  explorer 			if (debug)
   2314         1.3  explorer 				addlog(" max_failure (%d) exceeded, "
   2315         1.3  explorer 				       "send conf-rej\n",
   2316         1.3  explorer 				       sp->lcp.max_failure);
   2317         1.3  explorer 			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2318         1.3  explorer 		} else {
   2319         1.3  explorer 			if (debug)
   2320         1.3  explorer 				addlog(" send conf-nak\n");
   2321        1.59    itojun 			sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
   2322         1.3  explorer 		}
   2323         1.9    itojun 		goto end;
   2324         1.3  explorer 	} else {
   2325         1.3  explorer 		if (debug)
   2326         1.3  explorer 			addlog(" send conf-ack\n");
   2327         1.3  explorer 		sp->fail_counter[IDX_LCP] = 0;
   2328         1.3  explorer 		sp->pp_loopcnt = 0;
   2329        1.59    itojun 		sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1);
   2330         1.3  explorer 	}
   2331         1.3  explorer 
   2332         1.9    itojun  end:
   2333        1.59    itojun 	free(buf, M_TEMP);
   2334         1.3  explorer 	return (rlen == 0);
   2335        1.96   adrianp 
   2336        1.96   adrianp  drop:
   2337        1.96   adrianp 	free(buf, M_TEMP);
   2338        1.96   adrianp 	return -1;
   2339         1.3  explorer }
   2340         1.3  explorer 
   2341         1.3  explorer /*
   2342         1.3  explorer  * Analyze the LCP Configure-Reject option list, and adjust our
   2343         1.3  explorer  * negotiation.
   2344         1.3  explorer  */
   2345         1.3  explorer static void
   2346         1.3  explorer sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   2347         1.3  explorer {
   2348         1.3  explorer 	STDDCL;
   2349         1.3  explorer 	u_char *buf, *p;
   2350         1.3  explorer 
   2351         1.3  explorer 	len -= 4;
   2352         1.3  explorer 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2353         1.3  explorer 	if (!buf)
   2354         1.3  explorer 		return;
   2355         1.3  explorer 
   2356         1.3  explorer 	if (debug)
   2357        1.64    itojun 		log(LOG_DEBUG, "%s: lcp rej opts:",
   2358        1.64    itojun 		    ifp->if_xname);
   2359         1.3  explorer 
   2360        1.59    itojun 	p = (void *)(h + 1);
   2361         1.3  explorer 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   2362        1.96   adrianp 		/* Sanity check option length */
   2363        1.96   adrianp 		if (p[1] > len) {
   2364        1.96   adrianp 			/*
   2365       1.102       wiz 			 * Malicious option - drop immediately.
   2366        1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2367        1.96   adrianp 			 */
   2368        1.96   adrianp 			addlog("%s: received malicious LCP option, "
   2369        1.96   adrianp 			    "dropping.\n", ifp->if_xname);
   2370        1.96   adrianp 			goto drop;
   2371        1.96   adrianp 		}
   2372         1.3  explorer 		if (debug)
   2373         1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2374         1.3  explorer 		switch (*p) {
   2375         1.3  explorer 		case LCP_OPT_MAGIC:
   2376         1.3  explorer 			/* Magic number -- can't use it, use 0 */
   2377         1.3  explorer 			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
   2378         1.3  explorer 			sp->lcp.magic = 0;
   2379         1.3  explorer 			break;
   2380         1.3  explorer 		case LCP_OPT_MRU:
   2381         1.3  explorer 			/*
   2382       1.105       scw 			 * We try to negotiate a lower MRU if the underlying
   2383       1.105       scw 			 * link's MTU is less than PP_MTU (e.g. PPPoE). If the
   2384       1.105       scw 			 * peer rejects this lower rate, fallback to the
   2385       1.105       scw 			 * default.
   2386         1.3  explorer 			 */
   2387       1.105       scw 			if (debug) {
   2388       1.105       scw 				addlog("%s: warning: peer rejected our MRU of "
   2389       1.105       scw 				    "%ld bytes. Defaulting to %d bytes\n",
   2390       1.105       scw 				    ifp->if_xname, sp->lcp.mru, PP_MTU);
   2391       1.105       scw 			}
   2392         1.3  explorer 			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
   2393       1.105       scw 			sp->lcp.mru = PP_MTU;
   2394         1.3  explorer 			break;
   2395         1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2396         1.3  explorer 			/*
   2397         1.3  explorer 			 * Peer doesn't want to authenticate himself,
   2398         1.3  explorer 			 * deny unless this is a dialout call, and
   2399        1.36    martin 			 * SPPP_AUTHFLAG_NOCALLOUT is set.
   2400         1.3  explorer 			 */
   2401         1.3  explorer 			if ((sp->pp_flags & PP_CALLIN) == 0 &&
   2402        1.36    martin 			    (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) {
   2403         1.3  explorer 				if (debug)
   2404         1.9    itojun 					addlog(" [don't insist on auth "
   2405         1.3  explorer 					       "for callout]");
   2406         1.3  explorer 				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2407         1.3  explorer 				break;
   2408         1.3  explorer 			}
   2409         1.3  explorer 			if (debug)
   2410         1.3  explorer 				addlog("[access denied]\n");
   2411         1.3  explorer 			lcp.Close(sp);
   2412         1.3  explorer 			break;
   2413         1.3  explorer 		}
   2414         1.3  explorer 	}
   2415         1.3  explorer 	if (debug)
   2416         1.3  explorer 		addlog("\n");
   2417        1.96   adrianp drop:
   2418        1.59    itojun 	free(buf, M_TEMP);
   2419         1.3  explorer 	return;
   2420         1.3  explorer }
   2421         1.3  explorer 
   2422         1.3  explorer /*
   2423         1.3  explorer  * Analyze the LCP Configure-NAK option list, and adjust our
   2424         1.3  explorer  * negotiation.
   2425         1.3  explorer  */
   2426         1.3  explorer static void
   2427         1.3  explorer sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   2428         1.3  explorer {
   2429         1.3  explorer 	STDDCL;
   2430         1.3  explorer 	u_char *buf, *p;
   2431       1.109      matt 	uint32_t magic;
   2432         1.3  explorer 
   2433         1.3  explorer 	len -= 4;
   2434         1.3  explorer 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2435         1.3  explorer 	if (!buf)
   2436         1.3  explorer 		return;
   2437         1.3  explorer 
   2438         1.3  explorer 	if (debug)
   2439        1.64    itojun 		log(LOG_DEBUG, "%s: lcp nak opts:",
   2440        1.64    itojun 		    ifp->if_xname);
   2441         1.3  explorer 
   2442        1.59    itojun 	p = (void *)(h + 1);
   2443         1.3  explorer 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   2444        1.96   adrianp 		/* Sanity check option length */
   2445        1.96   adrianp 		if (p[1] > len) {
   2446        1.96   adrianp 			/*
   2447       1.102       wiz 			 * Malicious option - drop immediately.
   2448        1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2449        1.96   adrianp 			 */
   2450        1.96   adrianp 			addlog("%s: received malicious LCP option, "
   2451        1.96   adrianp 			    "dropping.\n", ifp->if_xname);
   2452        1.96   adrianp 			goto drop;
   2453        1.96   adrianp 		}
   2454         1.3  explorer 		if (debug)
   2455         1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2456         1.3  explorer 		switch (*p) {
   2457         1.3  explorer 		case LCP_OPT_MAGIC:
   2458         1.3  explorer 			/* Magic number -- renegotiate */
   2459         1.3  explorer 			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
   2460         1.3  explorer 			    len >= 6 && p[1] == 6) {
   2461       1.109      matt 				magic = (uint32_t)p[2] << 24 |
   2462       1.109      matt 					(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
   2463         1.3  explorer 				/*
   2464         1.3  explorer 				 * If the remote magic is our negated one,
   2465         1.3  explorer 				 * this looks like a loopback problem.
   2466         1.3  explorer 				 * Suggest a new magic to make sure.
   2467         1.3  explorer 				 */
   2468         1.3  explorer 				if (magic == ~sp->lcp.magic) {
   2469         1.3  explorer 					if (debug)
   2470         1.9    itojun 						addlog(" magic glitch");
   2471        1.65    itojun 					sp->lcp.magic = arc4random();
   2472         1.3  explorer 				} else {
   2473         1.3  explorer 					sp->lcp.magic = magic;
   2474         1.3  explorer 					if (debug)
   2475        1.30      ross 						addlog(" %d", magic);
   2476         1.3  explorer 				}
   2477         1.3  explorer 			}
   2478         1.3  explorer 			break;
   2479         1.3  explorer 		case LCP_OPT_MRU:
   2480         1.3  explorer 			/*
   2481         1.3  explorer 			 * Peer wants to advise us to negotiate an MRU.
   2482         1.3  explorer 			 * Agree on it if it's reasonable, or use
   2483         1.3  explorer 			 * default otherwise.
   2484         1.3  explorer 			 */
   2485         1.3  explorer 			if (len >= 4 && p[1] == 4) {
   2486         1.3  explorer 				u_int mru = p[2] * 256 + p[3];
   2487         1.3  explorer 				if (debug)
   2488         1.9    itojun 					addlog(" %d", mru);
   2489       1.105       scw 				if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu)
   2490       1.105       scw 					mru = sp->pp_if.if_mtu;
   2491         1.3  explorer 				sp->lcp.mru = mru;
   2492         1.3  explorer 				sp->lcp.opts |= (1 << LCP_OPT_MRU);
   2493         1.3  explorer 			}
   2494         1.3  explorer 			break;
   2495         1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2496         1.3  explorer 			/*
   2497         1.3  explorer 			 * Peer doesn't like our authentication method,
   2498         1.3  explorer 			 * deny.
   2499         1.3  explorer 			 */
   2500         1.3  explorer 			if (debug)
   2501         1.3  explorer 				addlog("[access denied]\n");
   2502         1.3  explorer 			lcp.Close(sp);
   2503         1.3  explorer 			break;
   2504         1.3  explorer 		}
   2505         1.3  explorer 	}
   2506         1.3  explorer 	if (debug)
   2507         1.3  explorer 		addlog("\n");
   2508        1.96   adrianp drop:
   2509        1.59    itojun 	free(buf, M_TEMP);
   2510         1.3  explorer 	return;
   2511         1.3  explorer }
   2512         1.3  explorer 
   2513         1.3  explorer static void
   2514         1.3  explorer sppp_lcp_tlu(struct sppp *sp)
   2515         1.3  explorer {
   2516         1.3  explorer 	STDDCL;
   2517         1.3  explorer 	int i;
   2518       1.109      matt 	uint32_t mask;
   2519         1.3  explorer 
   2520         1.3  explorer 	/* XXX ? */
   2521         1.3  explorer 	if (! (ifp->if_flags & IFF_UP) &&
   2522         1.3  explorer 	    (ifp->if_flags & IFF_RUNNING)) {
   2523         1.3  explorer 		/* Coming out of loopback mode. */
   2524         1.3  explorer 		if_up(ifp);
   2525         1.3  explorer 	}
   2526         1.3  explorer 
   2527         1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   2528         1.3  explorer 		if ((cps[i])->flags & CP_QUAL)
   2529         1.3  explorer 			(cps[i])->Open(sp);
   2530         1.3  explorer 
   2531         1.3  explorer 	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
   2532         1.3  explorer 	    (sp->pp_flags & PP_NEEDAUTH) != 0)
   2533        1.36    martin 		sp->pp_phase = SPPP_PHASE_AUTHENTICATE;
   2534         1.3  explorer 	else
   2535        1.36    martin 		sp->pp_phase = SPPP_PHASE_NETWORK;
   2536         1.3  explorer 
   2537        1.70    itojun 	if (debug)
   2538         1.3  explorer 	{
   2539        1.64    itojun 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
   2540         1.3  explorer 		    sppp_phase_name(sp->pp_phase));
   2541         1.3  explorer 	}
   2542         1.3  explorer 
   2543         1.3  explorer 	/*
   2544         1.3  explorer 	 * Open all authentication protocols.  This is even required
   2545         1.3  explorer 	 * if we already proceeded to network phase, since it might be
   2546         1.3  explorer 	 * that remote wants us to authenticate, so we might have to
   2547         1.3  explorer 	 * send a PAP request.  Undesired authentication protocols
   2548         1.3  explorer 	 * don't do anything when they get an Open event.
   2549         1.3  explorer 	 */
   2550         1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   2551         1.3  explorer 		if ((cps[i])->flags & CP_AUTH)
   2552         1.3  explorer 			(cps[i])->Open(sp);
   2553         1.3  explorer 
   2554        1.36    martin 	if (sp->pp_phase == SPPP_PHASE_NETWORK) {
   2555         1.3  explorer 		/* Notify all NCPs. */
   2556         1.3  explorer 		for (i = 0; i < IDX_COUNT; i++)
   2557         1.3  explorer 			if ((cps[i])->flags & CP_NCP)
   2558         1.3  explorer 				(cps[i])->Open(sp);
   2559         1.3  explorer 	}
   2560         1.3  explorer 
   2561         1.3  explorer 	/* Send Up events to all started protos. */
   2562         1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2563        1.13    itojun 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0)
   2564         1.3  explorer 			(cps[i])->Up(sp);
   2565         1.3  explorer 
   2566         1.3  explorer 	/* notify low-level driver of state change */
   2567         1.3  explorer 	if (sp->pp_chg)
   2568         1.3  explorer 		sp->pp_chg(sp, (int)sp->pp_phase);
   2569        1.82     perry 
   2570        1.36    martin 	if (sp->pp_phase == SPPP_PHASE_NETWORK)
   2571         1.3  explorer 		/* if no NCP is starting, close down */
   2572         1.3  explorer 		sppp_lcp_check_and_close(sp);
   2573         1.3  explorer }
   2574         1.3  explorer 
   2575         1.3  explorer static void
   2576         1.3  explorer sppp_lcp_tld(struct sppp *sp)
   2577         1.3  explorer {
   2578         1.3  explorer 	STDDCL;
   2579         1.3  explorer 	int i;
   2580       1.109      matt 	uint32_t mask;
   2581         1.3  explorer 
   2582        1.36    martin 	sp->pp_phase = SPPP_PHASE_TERMINATE;
   2583         1.3  explorer 
   2584        1.70    itojun 	if (debug)
   2585         1.3  explorer 	{
   2586        1.64    itojun 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
   2587         1.3  explorer 			sppp_phase_name(sp->pp_phase));
   2588         1.3  explorer 	}
   2589         1.3  explorer 
   2590         1.3  explorer 	/*
   2591         1.3  explorer 	 * Take upper layers down.  We send the Down event first and
   2592         1.3  explorer 	 * the Close second to prevent the upper layers from sending
   2593         1.3  explorer 	 * ``a flurry of terminate-request packets'', as the RFC
   2594         1.3  explorer 	 * describes it.
   2595         1.3  explorer 	 */
   2596         1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2597        1.13    itojun 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
   2598         1.3  explorer 			(cps[i])->Down(sp);
   2599         1.3  explorer 			(cps[i])->Close(sp);
   2600         1.3  explorer 		}
   2601         1.3  explorer }
   2602         1.3  explorer 
   2603         1.3  explorer static void
   2604         1.3  explorer sppp_lcp_tls(struct sppp *sp)
   2605         1.3  explorer {
   2606         1.3  explorer 	STDDCL;
   2607         1.3  explorer 
   2608        1.39    martin 	if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) {
   2609        1.39    martin 	    printf("%s: authentication failed %d times, not retrying again\n",
   2610        1.39    martin 		sp->pp_if.if_xname, sp->pp_auth_failures);
   2611        1.39    martin 	    if_down(&sp->pp_if);
   2612        1.39    martin 	    return;
   2613        1.39    martin 	}
   2614        1.39    martin 
   2615        1.36    martin 	sp->pp_phase = SPPP_PHASE_ESTABLISH;
   2616         1.3  explorer 
   2617        1.70    itojun 	if (debug)
   2618         1.3  explorer 	{
   2619        1.64    itojun 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
   2620         1.3  explorer 			sppp_phase_name(sp->pp_phase));
   2621         1.3  explorer 	}
   2622         1.3  explorer 
   2623         1.3  explorer 	/* Notify lower layer if desired. */
   2624         1.3  explorer 	if (sp->pp_tls)
   2625         1.3  explorer 		(sp->pp_tls)(sp);
   2626         1.3  explorer }
   2627         1.3  explorer 
   2628         1.3  explorer static void
   2629         1.3  explorer sppp_lcp_tlf(struct sppp *sp)
   2630         1.3  explorer {
   2631         1.3  explorer 	STDDCL;
   2632         1.3  explorer 
   2633        1.36    martin 	sp->pp_phase = SPPP_PHASE_DEAD;
   2634         1.3  explorer 
   2635        1.70    itojun 	if (debug)
   2636         1.3  explorer 	{
   2637        1.64    itojun 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
   2638         1.3  explorer 			sppp_phase_name(sp->pp_phase));
   2639         1.3  explorer 	}
   2640         1.3  explorer 
   2641         1.3  explorer 	/* Notify lower layer if desired. */
   2642         1.3  explorer 	if (sp->pp_tlf)
   2643         1.3  explorer 		(sp->pp_tlf)(sp);
   2644         1.3  explorer }
   2645         1.3  explorer 
   2646         1.3  explorer static void
   2647         1.3  explorer sppp_lcp_scr(struct sppp *sp)
   2648         1.3  explorer {
   2649         1.3  explorer 	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
   2650         1.3  explorer 	int i = 0;
   2651         1.3  explorer 	u_short authproto;
   2652         1.3  explorer 
   2653         1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
   2654         1.3  explorer 		if (! sp->lcp.magic)
   2655        1.65    itojun 			sp->lcp.magic = arc4random();
   2656         1.3  explorer 		opt[i++] = LCP_OPT_MAGIC;
   2657         1.3  explorer 		opt[i++] = 6;
   2658         1.3  explorer 		opt[i++] = sp->lcp.magic >> 24;
   2659         1.3  explorer 		opt[i++] = sp->lcp.magic >> 16;
   2660         1.3  explorer 		opt[i++] = sp->lcp.magic >> 8;
   2661         1.3  explorer 		opt[i++] = sp->lcp.magic;
   2662         1.3  explorer 	}
   2663         1.3  explorer 
   2664         1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
   2665         1.3  explorer 		opt[i++] = LCP_OPT_MRU;
   2666         1.3  explorer 		opt[i++] = 4;
   2667         1.3  explorer 		opt[i++] = sp->lcp.mru >> 8;
   2668         1.3  explorer 		opt[i++] = sp->lcp.mru;
   2669         1.3  explorer 	}
   2670         1.3  explorer 
   2671         1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
   2672         1.3  explorer 		authproto = sp->hisauth.proto;
   2673         1.3  explorer 		opt[i++] = LCP_OPT_AUTH_PROTO;
   2674         1.3  explorer 		opt[i++] = authproto == PPP_CHAP? 5: 4;
   2675         1.3  explorer 		opt[i++] = authproto >> 8;
   2676         1.3  explorer 		opt[i++] = authproto;
   2677         1.3  explorer 		if (authproto == PPP_CHAP)
   2678         1.3  explorer 			opt[i++] = CHAP_MD5;
   2679         1.3  explorer 	}
   2680         1.3  explorer 
   2681         1.9    itojun 	sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
   2682        1.59    itojun 	sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
   2683         1.3  explorer }
   2684         1.3  explorer 
   2685         1.3  explorer /*
   2686         1.3  explorer  * Check the open NCPs, return true if at least one NCP is open.
   2687         1.3  explorer  */
   2688         1.3  explorer static int
   2689         1.3  explorer sppp_ncp_check(struct sppp *sp)
   2690         1.3  explorer {
   2691         1.3  explorer 	int i, mask;
   2692         1.3  explorer 
   2693         1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2694        1.13    itojun 		if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
   2695         1.3  explorer 			return 1;
   2696         1.3  explorer 	return 0;
   2697         1.3  explorer }
   2698         1.3  explorer 
   2699         1.3  explorer /*
   2700         1.3  explorer  * Re-check the open NCPs and see if we should terminate the link.
   2701         1.3  explorer  * Called by the NCPs during their tlf action handling.
   2702         1.3  explorer  */
   2703         1.3  explorer static void
   2704         1.3  explorer sppp_lcp_check_and_close(struct sppp *sp)
   2705         1.3  explorer {
   2706         1.3  explorer 
   2707        1.36    martin 	if (sp->pp_phase < SPPP_PHASE_NETWORK)
   2708         1.3  explorer 		/* don't bother, we are already going down */
   2709         1.3  explorer 		return;
   2710         1.3  explorer 
   2711         1.3  explorer 	if (sppp_ncp_check(sp))
   2712         1.3  explorer 		return;
   2713         1.3  explorer 
   2714         1.3  explorer 	lcp.Close(sp);
   2715         1.3  explorer }
   2716         1.9    itojun 
   2717         1.9    itojun 
   2718        1.42  jdolecek /*
   2719         1.3  explorer  *--------------------------------------------------------------------------*
   2720         1.3  explorer  *                                                                          *
   2721         1.3  explorer  *                        The IPCP implementation.                          *
   2722         1.3  explorer  *                                                                          *
   2723         1.3  explorer  *--------------------------------------------------------------------------*
   2724         1.3  explorer  */
   2725         1.3  explorer 
   2726         1.3  explorer static void
   2727         1.3  explorer sppp_ipcp_init(struct sppp *sp)
   2728         1.3  explorer {
   2729         1.3  explorer 	sp->ipcp.opts = 0;
   2730         1.3  explorer 	sp->ipcp.flags = 0;
   2731         1.3  explorer 	sp->state[IDX_IPCP] = STATE_INITIAL;
   2732         1.3  explorer 	sp->fail_counter[IDX_IPCP] = 0;
   2733         1.9    itojun 	sp->pp_seq[IDX_IPCP] = 0;
   2734         1.9    itojun 	sp->pp_rseq[IDX_IPCP] = 0;
   2735       1.106        ad 	callout_init(&sp->ch[IDX_IPCP], 0);
   2736         1.3  explorer }
   2737         1.3  explorer 
   2738         1.3  explorer static void
   2739         1.3  explorer sppp_ipcp_up(struct sppp *sp)
   2740         1.3  explorer {
   2741         1.3  explorer 	sppp_up_event(&ipcp, sp);
   2742         1.3  explorer }
   2743         1.3  explorer 
   2744         1.3  explorer static void
   2745         1.3  explorer sppp_ipcp_down(struct sppp *sp)
   2746         1.3  explorer {
   2747         1.3  explorer 	sppp_down_event(&ipcp, sp);
   2748         1.3  explorer }
   2749         1.3  explorer 
   2750         1.3  explorer static void
   2751         1.3  explorer sppp_ipcp_open(struct sppp *sp)
   2752         1.3  explorer {
   2753         1.3  explorer 	STDDCL;
   2754       1.109      matt 	uint32_t myaddr, hisaddr;
   2755         1.3  explorer 
   2756        1.31    martin 	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
   2757        1.31    martin 	sp->ipcp.req_myaddr = 0;
   2758        1.31    martin 	sp->ipcp.req_hisaddr = 0;
   2759        1.45    martin 	memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
   2760         1.3  explorer 
   2761        1.79  christos #ifdef INET
   2762         1.3  explorer 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
   2763        1.79  christos #else
   2764        1.79  christos 	myaddr = hisaddr = 0;
   2765        1.79  christos #endif
   2766         1.3  explorer 	/*
   2767         1.3  explorer 	 * If we don't have his address, this probably means our
   2768         1.3  explorer 	 * interface doesn't want to talk IP at all.  (This could
   2769         1.3  explorer 	 * be the case if somebody wants to speak only IPX, for
   2770         1.3  explorer 	 * example.)  Don't open IPCP in this case.
   2771         1.3  explorer 	 */
   2772        1.79  christos 	if (hisaddr == 0) {
   2773         1.3  explorer 		/* XXX this message should go away */
   2774         1.3  explorer 		if (debug)
   2775        1.64    itojun 			log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n",
   2776        1.64    itojun 			    ifp->if_xname);
   2777         1.3  explorer 		return;
   2778         1.3  explorer 	}
   2779         1.3  explorer 
   2780        1.31    martin 	if (myaddr == 0) {
   2781         1.3  explorer 		/*
   2782         1.3  explorer 		 * I don't have an assigned address, so i need to
   2783         1.3  explorer 		 * negotiate my address.
   2784         1.3  explorer 		 */
   2785         1.3  explorer 		sp->ipcp.flags |= IPCP_MYADDR_DYN;
   2786         1.3  explorer 		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   2787        1.31    martin 	}
   2788        1.31    martin 	if (hisaddr == 1) {
   2789        1.31    martin 		/*
   2790        1.31    martin 		 * XXX - remove this hack!
   2791        1.74       wiz 		 * remote has no valid address, we need to get one assigned.
   2792        1.31    martin 		 */
   2793        1.31    martin 		sp->ipcp.flags |= IPCP_HISADDR_DYN;
   2794        1.31    martin 	}
   2795         1.3  explorer 	sppp_open_event(&ipcp, sp);
   2796         1.3  explorer }
   2797         1.3  explorer 
   2798         1.3  explorer static void
   2799         1.3  explorer sppp_ipcp_close(struct sppp *sp)
   2800         1.3  explorer {
   2801        1.63      tron 	STDDCL;
   2802        1.63      tron 
   2803         1.3  explorer 	sppp_close_event(&ipcp, sp);
   2804        1.79  christos #ifdef INET
   2805        1.31    martin 	if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
   2806         1.3  explorer 		/*
   2807        1.31    martin 		 * Some address was dynamic, clear it again.
   2808         1.3  explorer 		 */
   2809        1.31    martin 		sppp_clear_ip_addrs(sp);
   2810        1.79  christos #endif
   2811        1.63      tron 
   2812        1.63      tron 	if (sp->pp_saved_mtu > 0) {
   2813        1.63      tron 		ifp->if_mtu = sp->pp_saved_mtu;
   2814        1.63      tron 		sp->pp_saved_mtu = 0;
   2815        1.63      tron 		if (debug)
   2816        1.63      tron 			log(LOG_DEBUG,
   2817        1.64    itojun 			    "%s: resetting MTU to %" PRIu64 " bytes\n",
   2818        1.64    itojun 			    ifp->if_xname, ifp->if_mtu);
   2819        1.63      tron 	}
   2820         1.3  explorer }
   2821         1.3  explorer 
   2822         1.3  explorer static void
   2823         1.3  explorer sppp_ipcp_TO(void *cookie)
   2824         1.3  explorer {
   2825         1.3  explorer 	sppp_to_event(&ipcp, (struct sppp *)cookie);
   2826         1.3  explorer }
   2827         1.3  explorer 
   2828         1.3  explorer /*
   2829         1.3  explorer  * Analyze a configure request.  Return true if it was agreeable, and
   2830         1.3  explorer  * caused action sca, false if it has been rejected or nak'ed, and
   2831         1.3  explorer  * caused action scn.  (The return value is used to make the state
   2832         1.3  explorer  * transition decision in the state automaton.)
   2833         1.3  explorer  */
   2834         1.3  explorer static int
   2835         1.3  explorer sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   2836         1.3  explorer {
   2837         1.3  explorer 	u_char *buf, *r, *p;
   2838         1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   2839         1.3  explorer 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   2840       1.109      matt 	uint32_t hisaddr, desiredaddr;
   2841         1.3  explorer 
   2842         1.3  explorer 	len -= 4;
   2843         1.3  explorer 	origlen = len;
   2844         1.3  explorer 	/*
   2845         1.3  explorer 	 * Make sure to allocate a buf that can at least hold a
   2846         1.3  explorer 	 * conf-nak with an `address' option.  We might need it below.
   2847         1.3  explorer 	 */
   2848         1.3  explorer 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
   2849         1.3  explorer 	if (! buf)
   2850         1.3  explorer 		return (0);
   2851         1.3  explorer 
   2852         1.3  explorer 	/* pass 1: see if we can recognize them */
   2853         1.3  explorer 	if (debug)
   2854        1.64    itojun 		log(LOG_DEBUG, "%s: ipcp parse opts:",
   2855        1.64    itojun 		    ifp->if_xname);
   2856        1.59    itojun 	p = (void *)(h + 1);
   2857         1.3  explorer 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2858        1.96   adrianp 		/* Sanity check option length */
   2859        1.96   adrianp 		if (p[1] > len) {
   2860        1.96   adrianp 			/* XXX should we just RXJ? */
   2861        1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   2862        1.96   adrianp 			    ifp->if_xname);
   2863        1.96   adrianp 			goto drop;
   2864        1.96   adrianp 		}
   2865         1.3  explorer 		if (debug)
   2866         1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   2867         1.3  explorer 		switch (*p) {
   2868         1.3  explorer #ifdef notyet
   2869         1.3  explorer 		case IPCP_OPT_COMPRESSION:
   2870         1.3  explorer 			if (len >= 6 && p[1] >= 6) {
   2871         1.3  explorer 				/* correctly formed compress option */
   2872         1.3  explorer 				continue;
   2873         1.3  explorer 			}
   2874         1.3  explorer 			if (debug)
   2875         1.9    itojun 				addlog(" [invalid]");
   2876         1.3  explorer 			break;
   2877         1.3  explorer #endif
   2878         1.3  explorer 		case IPCP_OPT_ADDRESS:
   2879         1.3  explorer 			if (len >= 6 && p[1] == 6) {
   2880         1.3  explorer 				/* correctly formed address option */
   2881         1.3  explorer 				continue;
   2882         1.3  explorer 			}
   2883         1.3  explorer 			if (debug)
   2884         1.9    itojun 				addlog(" [invalid]");
   2885         1.3  explorer 			break;
   2886         1.3  explorer 		default:
   2887         1.3  explorer 			/* Others not supported. */
   2888         1.3  explorer 			if (debug)
   2889         1.9    itojun 				addlog(" [rej]");
   2890         1.3  explorer 			break;
   2891         1.3  explorer 		}
   2892         1.3  explorer 		/* Add the option to rejected list. */
   2893         1.3  explorer 		bcopy (p, r, p[1]);
   2894         1.3  explorer 		r += p[1];
   2895         1.3  explorer 		rlen += p[1];
   2896         1.3  explorer 	}
   2897         1.3  explorer 	if (rlen) {
   2898         1.3  explorer 		if (debug)
   2899         1.3  explorer 			addlog(" send conf-rej\n");
   2900        1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
   2901         1.9    itojun 		goto end;
   2902         1.3  explorer 	} else if (debug)
   2903         1.3  explorer 		addlog("\n");
   2904         1.3  explorer 
   2905         1.3  explorer 	/* pass 2: parse option values */
   2906        1.31    martin 	if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
   2907        1.31    martin 		hisaddr = sp->ipcp.req_hisaddr;	/* we already aggreed on that */
   2908        1.31    martin 	else
   2909        1.79  christos #ifdef INET
   2910        1.31    martin 		sppp_get_ip_addrs(sp, 0, &hisaddr, 0);	/* user configuration */
   2911        1.79  christos #else
   2912        1.79  christos 		hisaddr = 0;
   2913        1.79  christos #endif
   2914         1.3  explorer 	if (debug)
   2915        1.64    itojun 		log(LOG_DEBUG, "%s: ipcp parse opt values: ",
   2916        1.64    itojun 		       ifp->if_xname);
   2917        1.59    itojun 	p = (void *)(h + 1);
   2918         1.3  explorer 	len = origlen;
   2919         1.3  explorer 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2920         1.3  explorer 		if (debug)
   2921         1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   2922         1.3  explorer 		switch (*p) {
   2923         1.3  explorer #ifdef notyet
   2924         1.3  explorer 		case IPCP_OPT_COMPRESSION:
   2925         1.3  explorer 			continue;
   2926         1.3  explorer #endif
   2927         1.3  explorer 		case IPCP_OPT_ADDRESS:
   2928         1.3  explorer 			desiredaddr = p[2] << 24 | p[3] << 16 |
   2929         1.3  explorer 				p[4] << 8 | p[5];
   2930        1.31    martin 			if (desiredaddr == hisaddr ||
   2931        1.31    martin 		    	   ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) {
   2932         1.3  explorer 				/*
   2933        1.31    martin 			 	* Peer's address is same as our value,
   2934        1.31    martin 			 	* this is agreeable.  Gonna conf-ack
   2935        1.31    martin 			 	* it.
   2936        1.31    martin 			 	*/
   2937         1.3  explorer 				if (debug)
   2938        1.31    martin 					addlog(" %s [ack]",
   2939        1.31    martin 				       		sppp_dotted_quad(hisaddr));
   2940        1.31    martin 				/* record that we've seen it already */
   2941        1.31    martin 				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
   2942        1.31    martin 				sp->ipcp.req_hisaddr = desiredaddr;
   2943        1.31    martin 				hisaddr = desiredaddr;
   2944         1.3  explorer 				continue;
   2945        1.31    martin 			}
   2946        1.31    martin 			/*
   2947        1.31    martin 		 	* The address wasn't agreeable.  This is either
   2948        1.31    martin 		 	* he sent us 0.0.0.0, asking to assign him an
   2949        1.31    martin 		 	* address, or he send us another address not
   2950        1.31    martin 		 	* matching our value.  Either case, we gonna
   2951        1.31    martin 		 	* conf-nak it with our value.
   2952        1.31    martin 		 	*/
   2953        1.31    martin 			if (debug) {
   2954        1.31    martin 				if (desiredaddr == 0)
   2955        1.31    martin 					addlog(" [addr requested]");
   2956        1.31    martin 				else
   2957        1.31    martin 					addlog(" %s [not agreed]",
   2958        1.31    martin 				       		sppp_dotted_quad(desiredaddr));
   2959        1.31    martin 			}
   2960         1.3  explorer 
   2961        1.31    martin 			p[2] = hisaddr >> 24;
   2962        1.31    martin 			p[3] = hisaddr >> 16;
   2963        1.31    martin 			p[4] = hisaddr >> 8;
   2964        1.31    martin 			p[5] = hisaddr;
   2965        1.31    martin 			break;
   2966         1.3  explorer 		}
   2967         1.3  explorer 		/* Add the option to nak'ed list. */
   2968         1.3  explorer 		bcopy (p, r, p[1]);
   2969         1.3  explorer 		r += p[1];
   2970         1.3  explorer 		rlen += p[1];
   2971         1.3  explorer 	}
   2972         1.3  explorer 
   2973         1.3  explorer 	/*
   2974         1.3  explorer 	 * If we are about to conf-ack the request, but haven't seen
   2975         1.3  explorer 	 * his address so far, gonna conf-nak it instead, with the
   2976         1.3  explorer 	 * `address' option present and our idea of his address being
   2977         1.3  explorer 	 * filled in there, to request negotiation of both addresses.
   2978         1.3  explorer 	 *
   2979         1.3  explorer 	 * XXX This can result in an endless req - nak loop if peer
   2980         1.3  explorer 	 * doesn't want to send us his address.  Q: What should we do
   2981         1.3  explorer 	 * about it?  XXX  A: implement the max-failure counter.
   2982         1.3  explorer 	 */
   2983        1.31    martin 	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
   2984         1.3  explorer 		buf[0] = IPCP_OPT_ADDRESS;
   2985         1.3  explorer 		buf[1] = 6;
   2986         1.3  explorer 		buf[2] = hisaddr >> 24;
   2987         1.3  explorer 		buf[3] = hisaddr >> 16;
   2988         1.3  explorer 		buf[4] = hisaddr >> 8;
   2989         1.3  explorer 		buf[5] = hisaddr;
   2990         1.3  explorer 		rlen = 6;
   2991         1.3  explorer 		if (debug)
   2992         1.9    itojun 			addlog(" still need hisaddr");
   2993         1.3  explorer 	}
   2994         1.3  explorer 
   2995         1.3  explorer 	if (rlen) {
   2996         1.3  explorer 		if (debug)
   2997         1.3  explorer 			addlog(" send conf-nak\n");
   2998        1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
   2999         1.3  explorer 	} else {
   3000         1.3  explorer 		if (debug)
   3001         1.3  explorer 			addlog(" send conf-ack\n");
   3002        1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1);
   3003         1.3  explorer 	}
   3004         1.3  explorer 
   3005         1.9    itojun  end:
   3006        1.59    itojun 	free(buf, M_TEMP);
   3007         1.3  explorer 	return (rlen == 0);
   3008        1.96   adrianp 
   3009        1.96   adrianp  drop:
   3010        1.96   adrianp 	free(buf, M_TEMP);
   3011        1.96   adrianp 	return -1;
   3012         1.3  explorer }
   3013         1.3  explorer 
   3014         1.3  explorer /*
   3015         1.3  explorer  * Analyze the IPCP Configure-Reject option list, and adjust our
   3016         1.3  explorer  * negotiation.
   3017         1.3  explorer  */
   3018         1.3  explorer static void
   3019         1.3  explorer sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3020         1.3  explorer {
   3021         1.3  explorer 	u_char *buf, *p;
   3022         1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   3023         1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
   3024         1.3  explorer 
   3025         1.3  explorer 	len -= 4;
   3026         1.3  explorer 	buf = malloc (len, M_TEMP, M_NOWAIT);
   3027         1.3  explorer 	if (!buf)
   3028         1.3  explorer 		return;
   3029         1.3  explorer 
   3030         1.3  explorer 	if (debug)
   3031        1.64    itojun 		log(LOG_DEBUG, "%s: ipcp rej opts:",
   3032        1.64    itojun 		    ifp->if_xname);
   3033         1.3  explorer 
   3034        1.59    itojun 	p = (void *)(h + 1);
   3035         1.3  explorer 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3036        1.96   adrianp 		/* Sanity check option length */
   3037        1.96   adrianp 		if (p[1] > len) {
   3038        1.96   adrianp 			/* XXX should we just RXJ? */
   3039        1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   3040        1.96   adrianp 			    ifp->if_xname);
   3041        1.96   adrianp 			goto drop;
   3042        1.96   adrianp 		}
   3043         1.3  explorer 		if (debug)
   3044         1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3045         1.3  explorer 		switch (*p) {
   3046         1.3  explorer 		case IPCP_OPT_ADDRESS:
   3047         1.3  explorer 			/*
   3048         1.3  explorer 			 * Peer doesn't grok address option.  This is
   3049         1.3  explorer 			 * bad.  XXX  Should we better give up here?
   3050         1.3  explorer 			 */
   3051         1.3  explorer 			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
   3052         1.3  explorer 			break;
   3053         1.3  explorer #ifdef notyet
   3054         1.3  explorer 		case IPCP_OPT_COMPRESS:
   3055         1.3  explorer 			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
   3056         1.3  explorer 			break;
   3057         1.3  explorer #endif
   3058         1.3  explorer 		}
   3059         1.3  explorer 	}
   3060         1.3  explorer 	if (debug)
   3061         1.3  explorer 		addlog("\n");
   3062        1.96   adrianp drop:
   3063        1.59    itojun 	free(buf, M_TEMP);
   3064         1.3  explorer 	return;
   3065         1.3  explorer }
   3066         1.3  explorer 
   3067         1.3  explorer /*
   3068         1.3  explorer  * Analyze the IPCP Configure-NAK option list, and adjust our
   3069         1.3  explorer  * negotiation.
   3070         1.3  explorer  */
   3071         1.3  explorer static void
   3072         1.3  explorer sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3073         1.3  explorer {
   3074        1.45    martin 	u_char *p;
   3075         1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   3076         1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
   3077       1.109      matt 	uint32_t wantaddr;
   3078         1.3  explorer 
   3079         1.3  explorer 	len -= 4;
   3080         1.3  explorer 
   3081         1.3  explorer 	if (debug)
   3082        1.64    itojun 		log(LOG_DEBUG, "%s: ipcp nak opts:",
   3083        1.64    itojun 		    ifp->if_xname);
   3084         1.3  explorer 
   3085        1.59    itojun 	p = (void *)(h + 1);
   3086         1.3  explorer 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3087        1.96   adrianp 		/* Sanity check option length */
   3088        1.96   adrianp 		if (p[1] > len) {
   3089        1.96   adrianp 			/* XXX should we just RXJ? */
   3090        1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   3091        1.96   adrianp 			    ifp->if_xname);
   3092        1.96   adrianp 			return;
   3093        1.96   adrianp 		}
   3094         1.3  explorer 		if (debug)
   3095         1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3096         1.3  explorer 		switch (*p) {
   3097         1.3  explorer 		case IPCP_OPT_ADDRESS:
   3098         1.3  explorer 			/*
   3099         1.3  explorer 			 * Peer doesn't like our local IP address.  See
   3100         1.3  explorer 			 * if we can do something for him.  We'll drop
   3101         1.3  explorer 			 * him our address then.
   3102         1.3  explorer 			 */
   3103         1.3  explorer 			if (len >= 6 && p[1] == 6) {
   3104         1.3  explorer 				wantaddr = p[2] << 24 | p[3] << 16 |
   3105         1.3  explorer 					p[4] << 8 | p[5];
   3106         1.3  explorer 				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   3107         1.3  explorer 				if (debug)
   3108         1.9    itojun 					addlog(" [wantaddr %s]",
   3109         1.3  explorer 					       sppp_dotted_quad(wantaddr));
   3110         1.3  explorer 				/*
   3111         1.3  explorer 				 * When doing dynamic address assignment,
   3112         1.3  explorer 				 * we accept his offer.  Otherwise, we
   3113         1.3  explorer 				 * ignore it and thus continue to negotiate
   3114         1.3  explorer 				 * our already existing value.
   3115         1.3  explorer 				 */
   3116         1.3  explorer 				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
   3117         1.3  explorer 					if (debug)
   3118         1.9    itojun 						addlog(" [agree]");
   3119         1.3  explorer 					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
   3120        1.31    martin 					sp->ipcp.req_myaddr = wantaddr;
   3121         1.3  explorer 				}
   3122         1.3  explorer 			}
   3123         1.3  explorer 			break;
   3124        1.45    martin 
   3125        1.45    martin 		case IPCP_OPT_PRIMDNS:
   3126        1.45    martin 			if (len >= 6 && p[1] == 6) {
   3127        1.45    martin 				sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 |
   3128        1.82     perry 					p[4] << 8 | p[5];
   3129        1.45    martin 			}
   3130        1.45    martin 			break;
   3131        1.45    martin 
   3132        1.45    martin 		case IPCP_OPT_SECDNS:
   3133        1.45    martin 			if (len >= 6 && p[1] == 6) {
   3134        1.45    martin 				sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 |
   3135        1.82     perry 					p[4] << 8 | p[5];
   3136        1.45    martin 			}
   3137        1.45    martin 			break;
   3138         1.3  explorer #ifdef notyet
   3139         1.3  explorer 		case IPCP_OPT_COMPRESS:
   3140         1.3  explorer 			/*
   3141         1.3  explorer 			 * Peer wants different compression parameters.
   3142         1.3  explorer 			 */
   3143         1.3  explorer 			break;
   3144         1.3  explorer #endif
   3145         1.3  explorer 		}
   3146         1.3  explorer 	}
   3147         1.3  explorer 	if (debug)
   3148         1.3  explorer 		addlog("\n");
   3149         1.3  explorer }
   3150         1.3  explorer 
   3151         1.3  explorer static void
   3152         1.3  explorer sppp_ipcp_tlu(struct sppp *sp)
   3153         1.3  explorer {
   3154        1.79  christos #ifdef INET
   3155        1.31    martin 	/* we are up. Set addresses and notify anyone interested */
   3156        1.63      tron 	STDDCL;
   3157       1.109      matt 	uint32_t myaddr, hisaddr;
   3158        1.63      tron 
   3159        1.31    martin 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
   3160        1.31    martin 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN))
   3161        1.31    martin 		myaddr = sp->ipcp.req_myaddr;
   3162        1.31    martin 	if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN))
   3163        1.31    martin 		hisaddr = sp->ipcp.req_hisaddr;
   3164        1.31    martin 	sppp_set_ip_addrs(sp, myaddr, hisaddr);
   3165        1.63      tron 
   3166        1.63      tron 	if (ifp->if_mtu > sp->lcp.their_mru) {
   3167        1.63      tron 		sp->pp_saved_mtu = ifp->if_mtu;
   3168        1.63      tron 		ifp->if_mtu = sp->lcp.their_mru;
   3169        1.63      tron 		if (debug)
   3170        1.63      tron 			log(LOG_DEBUG,
   3171        1.64    itojun 			    "%s: setting MTU to %" PRIu64 " bytes\n",
   3172        1.64    itojun 			    ifp->if_xname, ifp->if_mtu);
   3173        1.63      tron 	}
   3174        1.63      tron 
   3175         1.3  explorer 	if (sp->pp_con)
   3176         1.3  explorer 		sp->pp_con(sp);
   3177        1.79  christos #endif
   3178         1.3  explorer }
   3179         1.3  explorer 
   3180         1.3  explorer static void
   3181       1.101  christos sppp_ipcp_tld(struct sppp *sp)
   3182         1.3  explorer {
   3183         1.3  explorer }
   3184         1.3  explorer 
   3185         1.3  explorer static void
   3186         1.3  explorer sppp_ipcp_tls(struct sppp *sp)
   3187         1.3  explorer {
   3188         1.3  explorer 	/* indicate to LCP that it must stay alive */
   3189         1.3  explorer 	sp->lcp.protos |= (1 << IDX_IPCP);
   3190         1.3  explorer }
   3191         1.3  explorer 
   3192         1.3  explorer static void
   3193         1.3  explorer sppp_ipcp_tlf(struct sppp *sp)
   3194         1.3  explorer {
   3195         1.3  explorer 	/* we no longer need LCP */
   3196         1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_IPCP);
   3197         1.3  explorer }
   3198         1.3  explorer 
   3199         1.3  explorer static void
   3200         1.3  explorer sppp_ipcp_scr(struct sppp *sp)
   3201         1.3  explorer {
   3202        1.45    martin 	char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */];
   3203        1.79  christos #ifdef INET
   3204       1.109      matt 	uint32_t ouraddr;
   3205        1.79  christos #endif
   3206         1.3  explorer 	int i = 0;
   3207         1.3  explorer 
   3208         1.3  explorer #ifdef notyet
   3209         1.3  explorer 	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
   3210         1.3  explorer 		opt[i++] = IPCP_OPT_COMPRESSION;
   3211         1.3  explorer 		opt[i++] = 6;
   3212         1.3  explorer 		opt[i++] = 0;	/* VJ header compression */
   3213         1.3  explorer 		opt[i++] = 0x2d; /* VJ header compression */
   3214         1.3  explorer 		opt[i++] = max_slot_id;
   3215         1.3  explorer 		opt[i++] = comp_slot_id;
   3216         1.3  explorer 	}
   3217         1.3  explorer #endif
   3218         1.3  explorer 
   3219        1.79  christos #ifdef INET
   3220         1.3  explorer 	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
   3221        1.31    martin 		if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
   3222        1.31    martin 			ouraddr = sp->ipcp.req_myaddr;	/* not sure if this can ever happen */
   3223        1.31    martin 		else
   3224        1.31    martin 			sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
   3225         1.3  explorer 		opt[i++] = IPCP_OPT_ADDRESS;
   3226         1.3  explorer 		opt[i++] = 6;
   3227         1.3  explorer 		opt[i++] = ouraddr >> 24;
   3228         1.3  explorer 		opt[i++] = ouraddr >> 16;
   3229         1.3  explorer 		opt[i++] = ouraddr >> 8;
   3230         1.3  explorer 		opt[i++] = ouraddr;
   3231         1.3  explorer 	}
   3232        1.79  christos #endif
   3233         1.3  explorer 
   3234        1.45    martin 	if (sp->query_dns & 1) {
   3235        1.45    martin 		opt[i++] = IPCP_OPT_PRIMDNS;
   3236        1.45    martin 		opt[i++] = 6;
   3237        1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 24;
   3238        1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 16;
   3239        1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 8;
   3240        1.45    martin 		opt[i++] = sp->dns_addrs[0];
   3241        1.45    martin 	}
   3242        1.45    martin 	if (sp->query_dns & 2) {
   3243        1.45    martin 		opt[i++] = IPCP_OPT_SECDNS;
   3244        1.45    martin 		opt[i++] = 6;
   3245        1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 24;
   3246        1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 16;
   3247        1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 8;
   3248        1.45    martin 		opt[i++] = sp->dns_addrs[1];
   3249        1.45    martin 	}
   3250        1.45    martin 
   3251         1.9    itojun 	sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
   3252         1.3  explorer 	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
   3253         1.3  explorer }
   3254         1.3  explorer 
   3255         1.3  explorer 
   3256        1.42  jdolecek /*
   3257         1.3  explorer  *--------------------------------------------------------------------------*
   3258         1.3  explorer  *                                                                          *
   3259         1.9    itojun  *                      The IPv6CP implementation.                          *
   3260         1.9    itojun  *                                                                          *
   3261         1.9    itojun  *--------------------------------------------------------------------------*
   3262         1.9    itojun  */
   3263         1.9    itojun 
   3264         1.9    itojun #ifdef INET6
   3265         1.9    itojun static void
   3266         1.9    itojun sppp_ipv6cp_init(struct sppp *sp)
   3267         1.9    itojun {
   3268         1.9    itojun 	sp->ipv6cp.opts = 0;
   3269         1.9    itojun 	sp->ipv6cp.flags = 0;
   3270         1.9    itojun 	sp->state[IDX_IPV6CP] = STATE_INITIAL;
   3271         1.9    itojun 	sp->fail_counter[IDX_IPV6CP] = 0;
   3272         1.9    itojun 	sp->pp_seq[IDX_IPV6CP] = 0;
   3273         1.9    itojun 	sp->pp_rseq[IDX_IPV6CP] = 0;
   3274       1.106        ad 	callout_init(&sp->ch[IDX_IPV6CP], 0);
   3275         1.9    itojun }
   3276         1.9    itojun 
   3277         1.9    itojun static void
   3278         1.9    itojun sppp_ipv6cp_up(struct sppp *sp)
   3279         1.9    itojun {
   3280         1.9    itojun 	sppp_up_event(&ipv6cp, sp);
   3281         1.9    itojun }
   3282         1.9    itojun 
   3283         1.9    itojun static void
   3284         1.9    itojun sppp_ipv6cp_down(struct sppp *sp)
   3285         1.9    itojun {
   3286         1.9    itojun 	sppp_down_event(&ipv6cp, sp);
   3287         1.9    itojun }
   3288         1.9    itojun 
   3289         1.9    itojun static void
   3290         1.9    itojun sppp_ipv6cp_open(struct sppp *sp)
   3291         1.9    itojun {
   3292         1.9    itojun 	STDDCL;
   3293         1.9    itojun 	struct in6_addr myaddr, hisaddr;
   3294         1.9    itojun 
   3295         1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   3296         1.9    itojun 	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
   3297         1.9    itojun #else
   3298         1.9    itojun 	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
   3299         1.9    itojun #endif
   3300         1.9    itojun 
   3301         1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
   3302         1.9    itojun 	/*
   3303         1.9    itojun 	 * If we don't have our address, this probably means our
   3304         1.9    itojun 	 * interface doesn't want to talk IPv6 at all.  (This could
   3305         1.9    itojun 	 * be the case if somebody wants to speak only IPX, for
   3306         1.9    itojun 	 * example.)  Don't open IPv6CP in this case.
   3307         1.9    itojun 	 */
   3308         1.9    itojun 	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
   3309         1.9    itojun 		/* XXX this message should go away */
   3310         1.9    itojun 		if (debug)
   3311        1.64    itojun 			log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n",
   3312        1.64    itojun 			    ifp->if_xname);
   3313         1.9    itojun 		return;
   3314         1.9    itojun 	}
   3315         1.9    itojun 
   3316         1.9    itojun 	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3317         1.9    itojun 	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3318         1.9    itojun 	sppp_open_event(&ipv6cp, sp);
   3319         1.9    itojun }
   3320         1.9    itojun 
   3321         1.9    itojun static void
   3322         1.9    itojun sppp_ipv6cp_close(struct sppp *sp)
   3323         1.9    itojun {
   3324         1.9    itojun 	sppp_close_event(&ipv6cp, sp);
   3325         1.9    itojun }
   3326         1.9    itojun 
   3327         1.9    itojun static void
   3328         1.9    itojun sppp_ipv6cp_TO(void *cookie)
   3329         1.9    itojun {
   3330         1.9    itojun 	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
   3331         1.9    itojun }
   3332         1.9    itojun 
   3333         1.9    itojun /*
   3334         1.9    itojun  * Analyze a configure request.  Return true if it was agreeable, and
   3335         1.9    itojun  * caused action sca, false if it has been rejected or nak'ed, and
   3336         1.9    itojun  * caused action scn.  (The return value is used to make the state
   3337         1.9    itojun  * transition decision in the state automaton.)
   3338         1.9    itojun  */
   3339         1.9    itojun static int
   3340         1.9    itojun sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   3341         1.9    itojun {
   3342         1.9    itojun 	u_char *buf, *r, *p;
   3343         1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3344         1.9    itojun 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   3345         1.9    itojun 	struct in6_addr myaddr, desiredaddr, suggestaddr;
   3346         1.9    itojun 	int ifidcount;
   3347         1.9    itojun 	int type;
   3348         1.9    itojun 	int collision, nohisaddr;
   3349         1.9    itojun 
   3350         1.9    itojun 	len -= 4;
   3351         1.9    itojun 	origlen = len;
   3352         1.9    itojun 	/*
   3353         1.9    itojun 	 * Make sure to allocate a buf that can at least hold a
   3354         1.9    itojun 	 * conf-nak with an `address' option.  We might need it below.
   3355         1.9    itojun 	 */
   3356         1.9    itojun 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
   3357         1.9    itojun 	if (! buf)
   3358         1.9    itojun 		return (0);
   3359         1.9    itojun 
   3360         1.9    itojun 	/* pass 1: see if we can recognize them */
   3361         1.9    itojun 	if (debug)
   3362        1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp parse opts:",
   3363        1.64    itojun 		    ifp->if_xname);
   3364        1.59    itojun 	p = (void *)(h + 1);
   3365         1.9    itojun 	ifidcount = 0;
   3366         1.9    itojun 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   3367        1.96   adrianp 		/* Sanity check option length */
   3368        1.96   adrianp 		if (p[1] > len) {
   3369        1.96   adrianp 			/* XXX just RXJ? */
   3370        1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3371        1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3372        1.96   adrianp 			goto drop;
   3373        1.96   adrianp 		}
   3374         1.9    itojun 		if (debug)
   3375         1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3376         1.9    itojun 		switch (*p) {
   3377         1.9    itojun 		case IPV6CP_OPT_IFID:
   3378         1.9    itojun 			if (len >= 10 && p[1] == 10 && ifidcount == 0) {
   3379         1.9    itojun 				/* correctly formed address option */
   3380         1.9    itojun 				ifidcount++;
   3381         1.9    itojun 				continue;
   3382         1.9    itojun 			}
   3383         1.9    itojun 			if (debug)
   3384         1.9    itojun 				addlog(" [invalid]");
   3385         1.9    itojun 			break;
   3386         1.9    itojun #ifdef notyet
   3387         1.9    itojun 		case IPV6CP_OPT_COMPRESSION:
   3388         1.9    itojun 			if (len >= 4 && p[1] >= 4) {
   3389         1.9    itojun 				/* correctly formed compress option */
   3390         1.9    itojun 				continue;
   3391         1.9    itojun 			}
   3392         1.9    itojun 			if (debug)
   3393         1.9    itojun 				addlog(" [invalid]");
   3394         1.9    itojun 			break;
   3395         1.9    itojun #endif
   3396         1.9    itojun 		default:
   3397         1.9    itojun 			/* Others not supported. */
   3398         1.9    itojun 			if (debug)
   3399         1.9    itojun 				addlog(" [rej]");
   3400         1.9    itojun 			break;
   3401         1.9    itojun 		}
   3402         1.9    itojun 		/* Add the option to rejected list. */
   3403         1.9    itojun 		bcopy (p, r, p[1]);
   3404         1.9    itojun 		r += p[1];
   3405         1.9    itojun 		rlen += p[1];
   3406         1.9    itojun 	}
   3407         1.9    itojun 	if (rlen) {
   3408         1.9    itojun 		if (debug)
   3409         1.9    itojun 			addlog(" send conf-rej\n");
   3410        1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
   3411         1.9    itojun 		goto end;
   3412         1.9    itojun 	} else if (debug)
   3413         1.9    itojun 		addlog("\n");
   3414         1.9    itojun 
   3415         1.9    itojun 	/* pass 2: parse option values */
   3416         1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   3417         1.9    itojun 	if (debug)
   3418        1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp parse opt values: ",
   3419        1.64    itojun 		       ifp->if_xname);
   3420        1.59    itojun 	p = (void *)(h + 1);
   3421         1.9    itojun 	len = origlen;
   3422         1.9    itojun 	type = CONF_ACK;
   3423         1.9    itojun 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   3424         1.9    itojun 		if (debug)
   3425         1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3426         1.9    itojun 		switch (*p) {
   3427         1.9    itojun #ifdef notyet
   3428         1.9    itojun 		case IPV6CP_OPT_COMPRESSION:
   3429         1.9    itojun 			continue;
   3430         1.9    itojun #endif
   3431         1.9    itojun 		case IPV6CP_OPT_IFID:
   3432        1.25   thorpej 			memset(&desiredaddr, 0, sizeof(desiredaddr));
   3433         1.9    itojun 			bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
   3434        1.36    martin 			collision = (memcmp(&desiredaddr.s6_addr[8],
   3435         1.9    itojun 					&myaddr.s6_addr[8], 8) == 0);
   3436         1.9    itojun 			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
   3437         1.9    itojun 
   3438         1.9    itojun 			desiredaddr.s6_addr16[0] = htons(0xfe80);
   3439        1.87    rpaulo 			(void)in6_setscope(&desiredaddr, &sp->pp_if, NULL);
   3440         1.9    itojun 
   3441         1.9    itojun 			if (!collision && !nohisaddr) {
   3442         1.9    itojun 				/* no collision, hisaddr known - Conf-Ack */
   3443         1.9    itojun 				type = CONF_ACK;
   3444         1.9    itojun 
   3445         1.9    itojun 				if (debug) {
   3446         1.9    itojun 					addlog(" %s [%s]",
   3447         1.9    itojun 					    ip6_sprintf(&desiredaddr),
   3448         1.9    itojun 					    sppp_cp_type_name(type));
   3449         1.9    itojun 				}
   3450         1.9    itojun 				continue;
   3451         1.9    itojun 			}
   3452         1.9    itojun 
   3453        1.25   thorpej 			memset(&suggestaddr, 0, sizeof(&suggestaddr));
   3454         1.9    itojun 			if (collision && nohisaddr) {
   3455         1.9    itojun 				/* collision, hisaddr unknown - Conf-Rej */
   3456         1.9    itojun 				type = CONF_REJ;
   3457        1.25   thorpej 				memset(&p[2], 0, 8);
   3458         1.9    itojun 			} else {
   3459         1.9    itojun 				/*
   3460         1.9    itojun 				 * - no collision, hisaddr unknown, or
   3461         1.9    itojun 				 * - collision, hisaddr known
   3462         1.9    itojun 				 * Conf-Nak, suggest hisaddr
   3463         1.9    itojun 				 */
   3464         1.9    itojun 				type = CONF_NAK;
   3465         1.9    itojun 				sppp_suggest_ip6_addr(sp, &suggestaddr);
   3466         1.9    itojun 				bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
   3467         1.9    itojun 			}
   3468         1.9    itojun 			if (debug)
   3469         1.9    itojun 				addlog(" %s [%s]", ip6_sprintf(&desiredaddr),
   3470         1.9    itojun 				    sppp_cp_type_name(type));
   3471         1.9    itojun 			break;
   3472         1.9    itojun 		}
   3473         1.9    itojun 		/* Add the option to nak'ed list. */
   3474         1.9    itojun 		bcopy (p, r, p[1]);
   3475         1.9    itojun 		r += p[1];
   3476         1.9    itojun 		rlen += p[1];
   3477         1.9    itojun 	}
   3478         1.9    itojun 
   3479         1.9    itojun 	if (rlen == 0 && type == CONF_ACK) {
   3480         1.9    itojun 		if (debug)
   3481         1.9    itojun 			addlog(" send %s\n", sppp_cp_type_name(type));
   3482        1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1);
   3483         1.9    itojun 	} else {
   3484        1.47    itojun #ifdef notdef
   3485         1.9    itojun 		if (type == CONF_ACK)
   3486         1.9    itojun 			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
   3487         1.9    itojun #endif
   3488         1.9    itojun 
   3489         1.9    itojun 		if (debug) {
   3490         1.9    itojun 			addlog(" send %s suggest %s\n",
   3491         1.9    itojun 			    sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
   3492         1.9    itojun 		}
   3493        1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
   3494         1.9    itojun 	}
   3495         1.9    itojun 
   3496         1.9    itojun  end:
   3497        1.59    itojun 	free(buf, M_TEMP);
   3498         1.9    itojun 	return (rlen == 0);
   3499        1.96   adrianp 
   3500        1.96   adrianp  drop:
   3501        1.96   adrianp 	free(buf, M_TEMP);
   3502        1.96   adrianp 	return -1;
   3503         1.9    itojun }
   3504         1.9    itojun 
   3505         1.9    itojun /*
   3506         1.9    itojun  * Analyze the IPv6CP Configure-Reject option list, and adjust our
   3507         1.9    itojun  * negotiation.
   3508         1.9    itojun  */
   3509         1.9    itojun static void
   3510         1.9    itojun sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3511         1.9    itojun {
   3512         1.9    itojun 	u_char *buf, *p;
   3513         1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3514         1.9    itojun 	int debug = ifp->if_flags & IFF_DEBUG;
   3515         1.9    itojun 
   3516         1.9    itojun 	len -= 4;
   3517         1.9    itojun 	buf = malloc (len, M_TEMP, M_NOWAIT);
   3518         1.9    itojun 	if (!buf)
   3519         1.9    itojun 		return;
   3520         1.9    itojun 
   3521         1.9    itojun 	if (debug)
   3522        1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp rej opts:",
   3523        1.64    itojun 		    ifp->if_xname);
   3524         1.9    itojun 
   3525        1.59    itojun 	p = (void *)(h + 1);
   3526         1.9    itojun 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3527        1.96   adrianp 		if (p[1] > len) {
   3528        1.96   adrianp 			/* XXX just RXJ? */
   3529        1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3530        1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3531        1.96   adrianp 			goto drop;
   3532        1.96   adrianp 		}
   3533         1.9    itojun 		if (debug)
   3534         1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3535         1.9    itojun 		switch (*p) {
   3536         1.9    itojun 		case IPV6CP_OPT_IFID:
   3537         1.9    itojun 			/*
   3538         1.9    itojun 			 * Peer doesn't grok address option.  This is
   3539         1.9    itojun 			 * bad.  XXX  Should we better give up here?
   3540         1.9    itojun 			 */
   3541         1.9    itojun 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
   3542         1.9    itojun 			break;
   3543         1.9    itojun #ifdef notyet
   3544         1.9    itojun 		case IPV6CP_OPT_COMPRESS:
   3545         1.9    itojun 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
   3546         1.9    itojun 			break;
   3547         1.9    itojun #endif
   3548         1.9    itojun 		}
   3549         1.9    itojun 	}
   3550         1.9    itojun 	if (debug)
   3551         1.9    itojun 		addlog("\n");
   3552        1.96   adrianp drop:
   3553        1.59    itojun 	free(buf, M_TEMP);
   3554         1.9    itojun 	return;
   3555         1.9    itojun }
   3556         1.9    itojun 
   3557         1.9    itojun /*
   3558         1.9    itojun  * Analyze the IPv6CP Configure-NAK option list, and adjust our
   3559         1.9    itojun  * negotiation.
   3560         1.9    itojun  */
   3561         1.9    itojun static void
   3562         1.9    itojun sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3563         1.9    itojun {
   3564         1.9    itojun 	u_char *buf, *p;
   3565         1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3566         1.9    itojun 	int debug = ifp->if_flags & IFF_DEBUG;
   3567         1.9    itojun 	struct in6_addr suggestaddr;
   3568         1.9    itojun 
   3569         1.9    itojun 	len -= 4;
   3570         1.9    itojun 	buf = malloc (len, M_TEMP, M_NOWAIT);
   3571         1.9    itojun 	if (!buf)
   3572         1.9    itojun 		return;
   3573         1.9    itojun 
   3574         1.9    itojun 	if (debug)
   3575        1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp nak opts:",
   3576        1.64    itojun 		    ifp->if_xname);
   3577         1.9    itojun 
   3578        1.59    itojun 	p = (void *)(h + 1);
   3579         1.9    itojun 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3580        1.96   adrianp 		if (p[1] > len) {
   3581        1.96   adrianp 			/* XXX just RXJ? */
   3582        1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3583        1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3584        1.96   adrianp 			goto drop;
   3585        1.96   adrianp 		}
   3586         1.9    itojun 		if (debug)
   3587         1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3588         1.9    itojun 		switch (*p) {
   3589         1.9    itojun 		case IPV6CP_OPT_IFID:
   3590         1.9    itojun 			/*
   3591         1.9    itojun 			 * Peer doesn't like our local ifid.  See
   3592         1.9    itojun 			 * if we can do something for him.  We'll drop
   3593         1.9    itojun 			 * him our address then.
   3594         1.9    itojun 			 */
   3595         1.9    itojun 			if (len < 10 || p[1] != 10)
   3596         1.9    itojun 				break;
   3597        1.25   thorpej 			memset(&suggestaddr, 0, sizeof(suggestaddr));
   3598         1.9    itojun 			suggestaddr.s6_addr16[0] = htons(0xfe80);
   3599        1.87    rpaulo 			(void)in6_setscope(&suggestaddr, &sp->pp_if, NULL);
   3600         1.9    itojun 			bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
   3601         1.9    itojun 
   3602         1.9    itojun 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3603         1.9    itojun 			if (debug)
   3604         1.9    itojun 				addlog(" [suggestaddr %s]",
   3605         1.9    itojun 				       ip6_sprintf(&suggestaddr));
   3606         1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   3607         1.9    itojun 			/*
   3608         1.9    itojun 			 * When doing dynamic address assignment,
   3609         1.9    itojun 			 * we accept his offer.
   3610         1.9    itojun 			 */
   3611         1.9    itojun 			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
   3612         1.9    itojun 				struct in6_addr lastsuggest;
   3613         1.9    itojun 				/*
   3614         1.9    itojun 				 * If <suggested myaddr from peer> equals to
   3615         1.9    itojun 				 * <hisaddr we have suggested last time>,
   3616         1.9    itojun 				 * we have a collision.  generate new random
   3617         1.9    itojun 				 * ifid.
   3618         1.9    itojun 				 */
   3619         1.9    itojun 				sppp_suggest_ip6_addr(&lastsuggest);
   3620         1.9    itojun 				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
   3621         1.9    itojun 						 lastsuggest)) {
   3622         1.9    itojun 					if (debug)
   3623         1.9    itojun 						addlog(" [random]");
   3624         1.9    itojun 					sppp_gen_ip6_addr(sp, &suggestaddr);
   3625         1.9    itojun 				}
   3626         1.9    itojun 				sppp_set_ip6_addr(sp, &suggestaddr, 0);
   3627         1.9    itojun 				if (debug)
   3628         1.9    itojun 					addlog(" [agree]");
   3629         1.9    itojun 				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3630         1.9    itojun 			}
   3631         1.9    itojun #else
   3632         1.9    itojun 			/*
   3633         1.9    itojun 			 * Since we do not do dynamic address assignment,
   3634         1.9    itojun 			 * we ignore it and thus continue to negotiate
   3635         1.9    itojun 			 * our already existing value.  This can possibly
   3636         1.9    itojun 			 * go into infinite request-reject loop.
   3637         1.9    itojun 			 *
   3638         1.9    itojun 			 * This is not likely because we normally use
   3639         1.9    itojun 			 * ifid based on MAC-address.
   3640         1.9    itojun 			 * If you have no ethernet card on the node, too bad.
   3641         1.9    itojun 			 * XXX should we use fail_counter?
   3642         1.9    itojun 			 */
   3643         1.9    itojun #endif
   3644         1.9    itojun 			break;
   3645         1.9    itojun #ifdef notyet
   3646         1.9    itojun 		case IPV6CP_OPT_COMPRESS:
   3647         1.9    itojun 			/*
   3648         1.9    itojun 			 * Peer wants different compression parameters.
   3649         1.9    itojun 			 */
   3650         1.9    itojun 			break;
   3651         1.9    itojun #endif
   3652         1.9    itojun 		}
   3653         1.9    itojun 	}
   3654         1.9    itojun 	if (debug)
   3655         1.9    itojun 		addlog("\n");
   3656        1.96   adrianp drop:
   3657        1.59    itojun 	free(buf, M_TEMP);
   3658         1.9    itojun 	return;
   3659         1.9    itojun }
   3660         1.9    itojun 
   3661         1.9    itojun static void
   3662         1.9    itojun sppp_ipv6cp_tlu(struct sppp *sp)
   3663         1.9    itojun {
   3664         1.9    itojun 	/* we are up - notify isdn daemon */
   3665         1.9    itojun 	if (sp->pp_con)
   3666         1.9    itojun 		sp->pp_con(sp);
   3667         1.9    itojun }
   3668         1.9    itojun 
   3669         1.9    itojun static void
   3670       1.101  christos sppp_ipv6cp_tld(struct sppp *sp)
   3671         1.9    itojun {
   3672         1.9    itojun }
   3673         1.9    itojun 
   3674         1.9    itojun static void
   3675         1.9    itojun sppp_ipv6cp_tls(struct sppp *sp)
   3676         1.9    itojun {
   3677         1.9    itojun 	/* indicate to LCP that it must stay alive */
   3678         1.9    itojun 	sp->lcp.protos |= (1 << IDX_IPV6CP);
   3679         1.9    itojun }
   3680         1.9    itojun 
   3681         1.9    itojun static void
   3682         1.9    itojun sppp_ipv6cp_tlf(struct sppp *sp)
   3683         1.9    itojun {
   3684         1.9    itojun 	/* we no longer need LCP */
   3685         1.9    itojun 	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
   3686         1.9    itojun }
   3687         1.9    itojun 
   3688         1.9    itojun static void
   3689         1.9    itojun sppp_ipv6cp_scr(struct sppp *sp)
   3690         1.9    itojun {
   3691         1.9    itojun 	char opt[10 /* ifid */ + 4 /* compression, minimum */];
   3692         1.9    itojun 	struct in6_addr ouraddr;
   3693         1.9    itojun 	int i = 0;
   3694         1.9    itojun 
   3695         1.9    itojun 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
   3696         1.9    itojun 		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
   3697         1.9    itojun 		opt[i++] = IPV6CP_OPT_IFID;
   3698         1.9    itojun 		opt[i++] = 10;
   3699         1.9    itojun 		bcopy(&ouraddr.s6_addr[8], &opt[i], 8);
   3700         1.9    itojun 		i += 8;
   3701         1.9    itojun 	}
   3702         1.9    itojun 
   3703         1.9    itojun #ifdef notyet
   3704         1.9    itojun 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
   3705         1.9    itojun 		opt[i++] = IPV6CP_OPT_COMPRESSION;
   3706         1.9    itojun 		opt[i++] = 4;
   3707         1.9    itojun 		opt[i++] = 0;	/* TBD */
   3708         1.9    itojun 		opt[i++] = 0;	/* TBD */
   3709         1.9    itojun 		/* variable length data may follow */
   3710         1.9    itojun 	}
   3711         1.9    itojun #endif
   3712         1.9    itojun 
   3713         1.9    itojun 	sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP];
   3714         1.9    itojun 	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt);
   3715         1.9    itojun }
   3716         1.9    itojun #else /*INET6*/
   3717        1.99    dogcow static void
   3718       1.101  christos sppp_ipv6cp_init(struct sppp *sp)
   3719         1.9    itojun {
   3720         1.9    itojun }
   3721         1.9    itojun 
   3722        1.99    dogcow static void
   3723       1.101  christos sppp_ipv6cp_up(struct sppp *sp)
   3724         1.9    itojun {
   3725         1.9    itojun }
   3726         1.9    itojun 
   3727        1.99    dogcow static void
   3728       1.101  christos sppp_ipv6cp_down(struct sppp *sp)
   3729         1.9    itojun {
   3730         1.9    itojun }
   3731         1.9    itojun 
   3732        1.99    dogcow static void
   3733       1.101  christos sppp_ipv6cp_open(struct sppp *sp)
   3734         1.9    itojun {
   3735         1.9    itojun }
   3736         1.9    itojun 
   3737        1.99    dogcow static void
   3738       1.101  christos sppp_ipv6cp_close(struct sppp *sp)
   3739         1.9    itojun {
   3740         1.9    itojun }
   3741         1.9    itojun 
   3742        1.99    dogcow static void
   3743       1.101  christos sppp_ipv6cp_TO(void *sp)
   3744         1.9    itojun {
   3745         1.9    itojun }
   3746         1.9    itojun 
   3747        1.99    dogcow static int
   3748       1.101  christos sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h,
   3749       1.101  christos 		int len)
   3750         1.9    itojun {
   3751         1.9    itojun 	return 0;
   3752         1.9    itojun }
   3753         1.9    itojun 
   3754        1.99    dogcow static void
   3755       1.101  christos sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h,
   3756       1.101  christos 		    int len)
   3757         1.9    itojun {
   3758         1.9    itojun }
   3759         1.9    itojun 
   3760        1.99    dogcow static void
   3761       1.101  christos sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h,
   3762       1.101  christos 		    int len)
   3763         1.9    itojun {
   3764         1.9    itojun }
   3765         1.9    itojun 
   3766        1.99    dogcow static void
   3767       1.101  christos sppp_ipv6cp_tlu(struct sppp *sp)
   3768         1.9    itojun {
   3769         1.9    itojun }
   3770         1.9    itojun 
   3771        1.99    dogcow static void
   3772       1.101  christos sppp_ipv6cp_tld(struct sppp *sp)
   3773         1.9    itojun {
   3774         1.9    itojun }
   3775         1.9    itojun 
   3776        1.99    dogcow static void
   3777       1.101  christos sppp_ipv6cp_tls(struct sppp *sp)
   3778         1.9    itojun {
   3779         1.9    itojun }
   3780         1.9    itojun 
   3781        1.99    dogcow static void
   3782       1.101  christos sppp_ipv6cp_tlf(struct sppp *sp)
   3783         1.9    itojun {
   3784         1.9    itojun }
   3785         1.9    itojun 
   3786        1.99    dogcow static void
   3787       1.101  christos sppp_ipv6cp_scr(struct sppp *sp)
   3788         1.9    itojun {
   3789         1.9    itojun }
   3790         1.9    itojun #endif /*INET6*/
   3791         1.9    itojun 
   3792         1.9    itojun 
   3793        1.42  jdolecek /*
   3794         1.9    itojun  *--------------------------------------------------------------------------*
   3795         1.9    itojun  *                                                                          *
   3796         1.3  explorer  *                        The CHAP implementation.                          *
   3797         1.3  explorer  *                                                                          *
   3798         1.3  explorer  *--------------------------------------------------------------------------*
   3799         1.3  explorer  */
   3800         1.3  explorer 
   3801         1.3  explorer /*
   3802         1.3  explorer  * The authentication protocols don't employ a full-fledged state machine as
   3803         1.3  explorer  * the control protocols do, since they do have Open and Close events, but
   3804         1.3  explorer  * not Up and Down, nor are they explicitly terminated.  Also, use of the
   3805         1.3  explorer  * authentication protocols may be different in both directions (this makes
   3806         1.3  explorer  * sense, think of a machine that never accepts incoming calls but only
   3807         1.3  explorer  * calls out, it doesn't require the called party to authenticate itself).
   3808         1.3  explorer  *
   3809         1.3  explorer  * Our state machine for the local authentication protocol (we are requesting
   3810         1.3  explorer  * the peer to authenticate) looks like:
   3811         1.3  explorer  *
   3812         1.3  explorer  *						    RCA-
   3813         1.3  explorer  *	      +--------------------------------------------+
   3814         1.3  explorer  *	      V					    scn,tld|
   3815         1.3  explorer  *	  +--------+			       Close   +---------+ RCA+
   3816         1.3  explorer  *	  |	   |<----------------------------------|	 |------+
   3817         1.3  explorer  *   +--->| Closed |				TO*    | Opened	 | sca	|
   3818         1.3  explorer  *   |	  |	   |-----+		       +-------|	 |<-----+
   3819         1.3  explorer  *   |	  +--------+ irc |		       |       +---------+
   3820         1.3  explorer  *   |	    ^		 |		       |	   ^
   3821         1.3  explorer  *   |	    |		 |		       |	   |
   3822         1.3  explorer  *   |	    |		 |		       |	   |
   3823         1.3  explorer  *   |	 TO-|		 |		       |	   |
   3824         1.3  explorer  *   |	    |tld  TO+	 V		       |	   |
   3825         1.3  explorer  *   |	    |	+------->+		       |	   |
   3826         1.3  explorer  *   |	    |	|	 |		       |	   |
   3827         1.3  explorer  *   |	  +--------+	 V		       |	   |
   3828         1.3  explorer  *   |	  |	   |<----+<--------------------+	   |
   3829         1.3  explorer  *   |	  | Req-   | scr				   |
   3830         1.3  explorer  *   |	  | Sent   |					   |
   3831         1.3  explorer  *   |	  |	   |					   |
   3832         1.3  explorer  *   |	  +--------+					   |
   3833         1.3  explorer  *   | RCA- |	| RCA+					   |
   3834         1.3  explorer  *   +------+	+------------------------------------------+
   3835         1.3  explorer  *   scn,tld	  sca,irc,ict,tlu
   3836         1.3  explorer  *
   3837         1.3  explorer  *
   3838         1.3  explorer  *   with:
   3839         1.3  explorer  *
   3840         1.3  explorer  *	Open:	LCP reached authentication phase
   3841         1.3  explorer  *	Close:	LCP reached terminate phase
   3842         1.3  explorer  *
   3843         1.3  explorer  *	RCA+:	received reply (pap-req, chap-response), acceptable
   3844         1.3  explorer  *	RCN:	received reply (pap-req, chap-response), not acceptable
   3845         1.3  explorer  *	TO+:	timeout with restart counter >= 0
   3846         1.3  explorer  *	TO-:	timeout with restart counter < 0
   3847         1.3  explorer  *	TO*:	reschedule timeout for CHAP
   3848         1.3  explorer  *
   3849         1.3  explorer  *	scr:	send request packet (none for PAP, chap-challenge)
   3850         1.3  explorer  *	sca:	send ack packet (pap-ack, chap-success)
   3851         1.3  explorer  *	scn:	send nak packet (pap-nak, chap-failure)
   3852         1.3  explorer  *	ict:	initialize re-challenge timer (CHAP only)
   3853         1.3  explorer  *
   3854         1.3  explorer  *	tlu:	this-layer-up, LCP reaches network phase
   3855         1.3  explorer  *	tld:	this-layer-down, LCP enters terminate phase
   3856         1.3  explorer  *
   3857         1.3  explorer  * Note that in CHAP mode, after sending a new challenge, while the state
   3858         1.3  explorer  * automaton falls back into Req-Sent state, it doesn't signal a tld
   3859         1.3  explorer  * event to LCP, so LCP remains in network phase.  Only after not getting
   3860         1.3  explorer  * any response (or after getting an unacceptable response), CHAP closes,
   3861         1.3  explorer  * causing LCP to enter terminate phase.
   3862         1.3  explorer  *
   3863         1.3  explorer  * With PAP, there is no initial request that can be sent.  The peer is
   3864         1.3  explorer  * expected to send one based on the successful negotiation of PAP as
   3865         1.3  explorer  * the authentication protocol during the LCP option negotiation.
   3866         1.3  explorer  *
   3867         1.3  explorer  * Incoming authentication protocol requests (remote requests
   3868         1.3  explorer  * authentication, we are peer) don't employ a state machine at all,
   3869         1.3  explorer  * they are simply answered.  Some peers [Ascend P50 firmware rev
   3870         1.9    itojun  * 4.50] react allergically when sending IPCP/IPv6CP requests while they are
   3871         1.3  explorer  * still in authentication phase (thereby violating the standard that
   3872         1.3  explorer  * demands that these NCP packets are to be discarded), so we keep
   3873         1.3  explorer  * track of the peer demanding us to authenticate, and only proceed to
   3874         1.3  explorer  * phase network once we've seen a positive acknowledge for the
   3875         1.3  explorer  * authentication.
   3876         1.3  explorer  */
   3877         1.3  explorer 
   3878         1.3  explorer /*
   3879         1.3  explorer  * Handle incoming CHAP packets.
   3880         1.3  explorer  */
   3881         1.3  explorer void
   3882         1.3  explorer sppp_chap_input(struct sppp *sp, struct mbuf *m)
   3883         1.3  explorer {
   3884         1.3  explorer 	STDDCL;
   3885         1.3  explorer 	struct lcp_header *h;
   3886         1.3  explorer 	int len, x;
   3887        1.36    martin 	u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize;
   3888         1.3  explorer 	int value_len, name_len;
   3889         1.3  explorer 	MD5_CTX ctx;
   3890         1.3  explorer 
   3891         1.3  explorer 	len = m->m_pkthdr.len;
   3892         1.3  explorer 	if (len < 4) {
   3893         1.3  explorer 		if (debug)
   3894         1.3  explorer 			log(LOG_DEBUG,
   3895        1.64    itojun 			    "%s: chap invalid packet length: %d bytes\n",
   3896        1.64    itojun 			    ifp->if_xname, len);
   3897         1.3  explorer 		return;
   3898         1.3  explorer 	}
   3899        1.59    itojun 	h = mtod(m, struct lcp_header *);
   3900        1.59    itojun 	if (len > ntohs(h->len))
   3901        1.59    itojun 		len = ntohs(h->len);
   3902         1.3  explorer 
   3903         1.3  explorer 	switch (h->type) {
   3904         1.3  explorer 	/* challenge, failure and success are his authproto */
   3905         1.3  explorer 	case CHAP_CHALLENGE:
   3906        1.36    martin 		if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   3907        1.36    martin 		    /* can't do anything usefull */
   3908        1.39    martin 		    sp->pp_auth_failures++;
   3909        1.64    itojun 		    printf("%s: chap input without my name and my secret being set\n",
   3910        1.64    itojun 		    	ifp->if_xname);
   3911        1.36    martin 		    break;
   3912        1.36    martin 		}
   3913        1.59    itojun 		value = 1 + (u_char *)(h + 1);
   3914         1.3  explorer 		value_len = value[-1];
   3915         1.3  explorer 		name = value + value_len;
   3916         1.3  explorer 		name_len = len - value_len - 5;
   3917         1.3  explorer 		if (name_len < 0) {
   3918         1.3  explorer 			if (debug) {
   3919         1.3  explorer 				log(LOG_DEBUG,
   3920        1.64    itojun 				    "%s: chap corrupted challenge "
   3921         1.3  explorer 				    "<%s id=0x%x len=%d",
   3922        1.64    itojun 				    ifp->if_xname,
   3923         1.3  explorer 				    sppp_auth_type_name(PPP_CHAP, h->type),
   3924         1.3  explorer 				    h->ident, ntohs(h->len));
   3925         1.3  explorer 				if (len > 4)
   3926        1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   3927        1.59    itojun 					    len - 4);
   3928         1.3  explorer 				addlog(">\n");
   3929         1.3  explorer 			}
   3930         1.3  explorer 			break;
   3931         1.3  explorer 		}
   3932        1.82     perry 
   3933         1.3  explorer 		if (debug) {
   3934         1.3  explorer 			log(LOG_DEBUG,
   3935        1.64    itojun 			    "%s: chap input <%s id=0x%x len=%d name=",
   3936        1.64    itojun 			    ifp->if_xname,
   3937         1.3  explorer 			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
   3938         1.3  explorer 			    ntohs(h->len));
   3939        1.59    itojun 			sppp_print_string((char *) name, name_len);
   3940         1.3  explorer 			addlog(" value-size=%d value=", value_len);
   3941         1.3  explorer 			sppp_print_bytes(value, value_len);
   3942         1.3  explorer 			addlog(">\n");
   3943         1.3  explorer 		}
   3944         1.3  explorer 
   3945         1.3  explorer 		/* Compute reply value. */
   3946         1.3  explorer 		MD5Init(&ctx);
   3947         1.3  explorer 		MD5Update(&ctx, &h->ident, 1);
   3948        1.54  christos 		MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len);
   3949         1.3  explorer 		MD5Update(&ctx, value, value_len);
   3950         1.3  explorer 		MD5Final(digest, &ctx);
   3951         1.3  explorer 		dsize = sizeof digest;
   3952         1.3  explorer 
   3953         1.3  explorer 		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
   3954         1.3  explorer 			       sizeof dsize, (const char *)&dsize,
   3955         1.3  explorer 			       sizeof digest, digest,
   3956        1.54  christos 			       sp->myauth.name_len,
   3957         1.3  explorer 			       sp->myauth.name,
   3958         1.3  explorer 			       0);
   3959         1.3  explorer 		break;
   3960         1.3  explorer 
   3961         1.3  explorer 	case CHAP_SUCCESS:
   3962         1.3  explorer 		if (debug) {
   3963        1.64    itojun 			log(LOG_DEBUG, "%s: chap success",
   3964        1.64    itojun 			    ifp->if_xname);
   3965         1.3  explorer 			if (len > 4) {
   3966         1.3  explorer 				addlog(": ");
   3967        1.59    itojun 				sppp_print_string((char *)(h + 1), len - 4);
   3968         1.3  explorer 			}
   3969         1.3  explorer 			addlog("\n");
   3970         1.3  explorer 		}
   3971        1.23   thorpej 		x = splnet();
   3972        1.39    martin 		sp->pp_auth_failures = 0;
   3973         1.3  explorer 		sp->pp_flags &= ~PP_NEEDAUTH;
   3974         1.3  explorer 		if (sp->myauth.proto == PPP_CHAP &&
   3975         1.3  explorer 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   3976         1.3  explorer 		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
   3977         1.3  explorer 			/*
   3978         1.3  explorer 			 * We are authenticator for CHAP but didn't
   3979         1.3  explorer 			 * complete yet.  Leave it to tlu to proceed
   3980         1.3  explorer 			 * to network phase.
   3981         1.3  explorer 			 */
   3982         1.3  explorer 			splx(x);
   3983         1.3  explorer 			break;
   3984         1.3  explorer 		}
   3985         1.3  explorer 		splx(x);
   3986         1.3  explorer 		sppp_phase_network(sp);
   3987         1.3  explorer 		break;
   3988         1.3  explorer 
   3989         1.3  explorer 	case CHAP_FAILURE:
   3990        1.39    martin 		x = splnet();
   3991        1.39    martin 		sp->pp_auth_failures++;
   3992        1.39    martin 		splx(x);
   3993         1.3  explorer 		if (debug) {
   3994        1.64    itojun 			log(LOG_INFO, "%s: chap failure",
   3995        1.64    itojun 			    ifp->if_xname);
   3996         1.3  explorer 			if (len > 4) {
   3997         1.3  explorer 				addlog(": ");
   3998        1.59    itojun 				sppp_print_string((char *)(h + 1), len - 4);
   3999         1.3  explorer 			}
   4000         1.3  explorer 			addlog("\n");
   4001         1.3  explorer 		} else
   4002        1.64    itojun 			log(LOG_INFO, "%s: chap failure\n",
   4003        1.64    itojun 			    ifp->if_xname);
   4004         1.3  explorer 		/* await LCP shutdown by authenticator */
   4005         1.3  explorer 		break;
   4006         1.3  explorer 
   4007         1.3  explorer 	/* response is my authproto */
   4008         1.3  explorer 	case CHAP_RESPONSE:
   4009        1.36    martin 		if (sp->hisauth.secret == NULL) {
   4010        1.36    martin 		    /* can't do anything usefull */
   4011        1.64    itojun 		    printf("%s: chap input without his secret being set\n",
   4012        1.64    itojun 		    	ifp->if_xname);
   4013        1.36    martin 		    break;
   4014        1.36    martin 		}
   4015        1.59    itojun 		value = 1 + (u_char *)(h + 1);
   4016         1.3  explorer 		value_len = value[-1];
   4017         1.3  explorer 		name = value + value_len;
   4018         1.3  explorer 		name_len = len - value_len - 5;
   4019         1.3  explorer 		if (name_len < 0) {
   4020         1.3  explorer 			if (debug) {
   4021         1.3  explorer 				log(LOG_DEBUG,
   4022        1.64    itojun 				    "%s: chap corrupted response "
   4023         1.3  explorer 				    "<%s id=0x%x len=%d",
   4024        1.64    itojun 				    ifp->if_xname,
   4025         1.3  explorer 				    sppp_auth_type_name(PPP_CHAP, h->type),
   4026         1.3  explorer 				    h->ident, ntohs(h->len));
   4027         1.3  explorer 				if (len > 4)
   4028        1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   4029        1.59    itojun 					    len - 4);
   4030         1.3  explorer 				addlog(">\n");
   4031         1.3  explorer 			}
   4032         1.3  explorer 			break;
   4033         1.3  explorer 		}
   4034         1.3  explorer 		if (h->ident != sp->confid[IDX_CHAP]) {
   4035         1.3  explorer 			if (debug)
   4036         1.3  explorer 				log(LOG_DEBUG,
   4037        1.64    itojun 				    "%s: chap dropping response for old ID "
   4038         1.3  explorer 				    "(got %d, expected %d)\n",
   4039        1.64    itojun 				    ifp->if_xname,
   4040         1.3  explorer 				    h->ident, sp->confid[IDX_CHAP]);
   4041         1.3  explorer 			break;
   4042         1.3  explorer 		}
   4043        1.82     perry 		if (sp->hisauth.name != NULL &&
   4044        1.54  christos 		    (name_len != sp->hisauth.name_len
   4045        1.36    martin 		    || memcmp(name, sp->hisauth.name, name_len) != 0)) {
   4046        1.64    itojun 			log(LOG_INFO, "%s: chap response, his name ",
   4047        1.64    itojun 			    ifp->if_xname);
   4048         1.3  explorer 			sppp_print_string(name, name_len);
   4049         1.3  explorer 			addlog(" != expected ");
   4050         1.3  explorer 			sppp_print_string(sp->hisauth.name,
   4051        1.54  christos 					  sp->hisauth.name_len);
   4052         1.3  explorer 			addlog("\n");
   4053        1.36    martin 		    goto chap_failure;
   4054        1.36    martin 		}
   4055         1.3  explorer 		if (debug) {
   4056        1.64    itojun 			log(LOG_DEBUG, "%s: chap input(%s) "
   4057         1.3  explorer 			    "<%s id=0x%x len=%d name=",
   4058        1.64    itojun 			    ifp->if_xname,
   4059         1.3  explorer 			    sppp_state_name(sp->state[IDX_CHAP]),
   4060         1.3  explorer 			    sppp_auth_type_name(PPP_CHAP, h->type),
   4061        1.59    itojun 			    h->ident, ntohs(h->len));
   4062        1.59    itojun 			sppp_print_string((char *)name, name_len);
   4063         1.3  explorer 			addlog(" value-size=%d value=", value_len);
   4064         1.3  explorer 			sppp_print_bytes(value, value_len);
   4065         1.3  explorer 			addlog(">\n");
   4066         1.3  explorer 		}
   4067        1.36    martin 		if (value_len != sizeof(sp->myauth.challenge)) {
   4068         1.3  explorer 			if (debug)
   4069         1.3  explorer 				log(LOG_DEBUG,
   4070        1.64    itojun 				    "%s: chap bad hash value length: "
   4071        1.37   thorpej 				    "%d bytes, should be %ld\n",
   4072        1.64    itojun 				    ifp->if_xname, value_len,
   4073        1.37   thorpej 				    (long) sizeof(sp->myauth.challenge));
   4074        1.36    martin 			goto chap_failure;
   4075         1.3  explorer 		}
   4076         1.3  explorer 
   4077         1.3  explorer 		MD5Init(&ctx);
   4078         1.3  explorer 		MD5Update(&ctx, &h->ident, 1);
   4079        1.54  christos 		MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len);
   4080        1.36    martin 		MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge));
   4081         1.3  explorer 		MD5Final(digest, &ctx);
   4082         1.3  explorer 
   4083         1.3  explorer #define FAILMSG "Failed..."
   4084         1.3  explorer #define SUCCMSG "Welcome!"
   4085         1.3  explorer 
   4086         1.3  explorer 		if (value_len != sizeof digest ||
   4087        1.36    martin 		    memcmp(digest, value, value_len) != 0) {
   4088        1.36    martin chap_failure:
   4089         1.3  explorer 			/* action scn, tld */
   4090        1.39    martin 			x = splnet();
   4091        1.39    martin 			sp->pp_auth_failures++;
   4092        1.39    martin 			splx(x);
   4093         1.3  explorer 			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
   4094        1.85  christos 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
   4095         1.3  explorer 				       0);
   4096         1.3  explorer 			chap.tld(sp);
   4097         1.3  explorer 			break;
   4098         1.3  explorer 		}
   4099        1.39    martin 		sp->pp_auth_failures = 0;
   4100         1.3  explorer 		/* action sca, perhaps tlu */
   4101         1.3  explorer 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
   4102         1.3  explorer 		    sp->state[IDX_CHAP] == STATE_OPENED)
   4103         1.3  explorer 			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
   4104        1.85  christos 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
   4105         1.3  explorer 				       0);
   4106         1.3  explorer 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
   4107         1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_OPENED);
   4108         1.3  explorer 			chap.tlu(sp);
   4109         1.3  explorer 		}
   4110         1.3  explorer 		break;
   4111         1.3  explorer 
   4112         1.3  explorer 	default:
   4113         1.3  explorer 		/* Unknown CHAP packet type -- ignore. */
   4114         1.3  explorer 		if (debug) {
   4115        1.64    itojun 			log(LOG_DEBUG, "%s: chap unknown input(%s) "
   4116         1.3  explorer 			    "<0x%x id=0x%xh len=%d",
   4117        1.64    itojun 			    ifp->if_xname,
   4118         1.3  explorer 			    sppp_state_name(sp->state[IDX_CHAP]),
   4119         1.3  explorer 			    h->type, h->ident, ntohs(h->len));
   4120         1.3  explorer 			if (len > 4)
   4121        1.59    itojun 				sppp_print_bytes((u_char *)(h + 1), len - 4);
   4122         1.3  explorer 			addlog(">\n");
   4123         1.3  explorer 		}
   4124         1.3  explorer 		break;
   4125         1.3  explorer 
   4126         1.3  explorer 	}
   4127         1.3  explorer }
   4128         1.3  explorer 
   4129         1.3  explorer static void
   4130         1.3  explorer sppp_chap_init(struct sppp *sp)
   4131         1.3  explorer {
   4132         1.3  explorer 	/* Chap doesn't have STATE_INITIAL at all. */
   4133         1.3  explorer 	sp->state[IDX_CHAP] = STATE_CLOSED;
   4134         1.3  explorer 	sp->fail_counter[IDX_CHAP] = 0;
   4135         1.9    itojun 	sp->pp_seq[IDX_CHAP] = 0;
   4136         1.9    itojun 	sp->pp_rseq[IDX_CHAP] = 0;
   4137       1.106        ad 	callout_init(&sp->ch[IDX_CHAP], 0);
   4138         1.3  explorer }
   4139         1.3  explorer 
   4140         1.3  explorer static void
   4141         1.3  explorer sppp_chap_open(struct sppp *sp)
   4142         1.3  explorer {
   4143         1.3  explorer 	if (sp->myauth.proto == PPP_CHAP &&
   4144         1.3  explorer 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4145         1.3  explorer 		/* we are authenticator for CHAP, start it */
   4146         1.3  explorer 		chap.scr(sp);
   4147         1.3  explorer 		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4148         1.3  explorer 		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4149         1.3  explorer 	}
   4150         1.3  explorer 	/* nothing to be done if we are peer, await a challenge */
   4151         1.3  explorer }
   4152         1.3  explorer 
   4153         1.3  explorer static void
   4154         1.3  explorer sppp_chap_close(struct sppp *sp)
   4155         1.3  explorer {
   4156         1.3  explorer 	if (sp->state[IDX_CHAP] != STATE_CLOSED)
   4157         1.3  explorer 		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4158         1.3  explorer }
   4159         1.3  explorer 
   4160         1.3  explorer static void
   4161         1.3  explorer sppp_chap_TO(void *cookie)
   4162         1.3  explorer {
   4163         1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4164         1.3  explorer 	STDDCL;
   4165         1.3  explorer 	int s;
   4166         1.3  explorer 
   4167        1.23   thorpej 	s = splnet();
   4168         1.3  explorer 	if (debug)
   4169        1.64    itojun 		log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n",
   4170        1.64    itojun 		    ifp->if_xname,
   4171         1.3  explorer 		    sppp_state_name(sp->state[IDX_CHAP]),
   4172         1.3  explorer 		    sp->rst_counter[IDX_CHAP]);
   4173         1.3  explorer 
   4174         1.3  explorer 	if (--sp->rst_counter[IDX_CHAP] < 0)
   4175         1.3  explorer 		/* TO- event */
   4176         1.3  explorer 		switch (sp->state[IDX_CHAP]) {
   4177         1.3  explorer 		case STATE_REQ_SENT:
   4178         1.3  explorer 			chap.tld(sp);
   4179         1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4180         1.3  explorer 			break;
   4181         1.3  explorer 		}
   4182         1.3  explorer 	else
   4183         1.3  explorer 		/* TO+ (or TO*) event */
   4184         1.3  explorer 		switch (sp->state[IDX_CHAP]) {
   4185         1.3  explorer 		case STATE_OPENED:
   4186         1.3  explorer 			/* TO* event */
   4187         1.3  explorer 			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4188         1.3  explorer 			/* fall through */
   4189         1.3  explorer 		case STATE_REQ_SENT:
   4190         1.3  explorer 			chap.scr(sp);
   4191         1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   4192         1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4193         1.3  explorer 			break;
   4194         1.3  explorer 		}
   4195         1.3  explorer 
   4196         1.3  explorer 	splx(s);
   4197         1.3  explorer }
   4198         1.3  explorer 
   4199         1.3  explorer static void
   4200         1.3  explorer sppp_chap_tlu(struct sppp *sp)
   4201         1.3  explorer {
   4202         1.3  explorer 	STDDCL;
   4203         1.3  explorer 	int i, x;
   4204         1.3  explorer 
   4205         1.3  explorer 	i = 0;
   4206         1.3  explorer 	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4207         1.3  explorer 
   4208         1.3  explorer 	/*
   4209         1.3  explorer 	 * Some broken CHAP implementations (Conware CoNet, firmware
   4210         1.3  explorer 	 * 4.0.?) don't want to re-authenticate their CHAP once the
   4211         1.3  explorer 	 * initial challenge-response exchange has taken place.
   4212         1.3  explorer 	 * Provide for an option to avoid rechallenges.
   4213         1.3  explorer 	 */
   4214        1.36    martin 	if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
   4215         1.3  explorer 		/*
   4216         1.3  explorer 		 * Compute the re-challenge timeout.  This will yield
   4217         1.3  explorer 		 * a number between 300 and 810 seconds.
   4218         1.3  explorer 		 */
   4219        1.65    itojun 		i = 300 + ((unsigned)(arc4random() & 0xff00) >> 7);
   4220         1.3  explorer 
   4221         1.7   thorpej 		callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp);
   4222         1.3  explorer 	}
   4223         1.3  explorer 
   4224         1.3  explorer 	if (debug) {
   4225         1.3  explorer 		log(LOG_DEBUG,
   4226        1.64    itojun 		    "%s: chap %s, ",
   4227        1.64    itojun 		    ifp->if_xname,
   4228        1.36    martin 		    sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu");
   4229        1.36    martin 		if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0)
   4230         1.3  explorer 			addlog("next re-challenge in %d seconds\n", i);
   4231         1.3  explorer 		else
   4232         1.3  explorer 			addlog("re-challenging supressed\n");
   4233         1.3  explorer 	}
   4234         1.3  explorer 
   4235        1.23   thorpej 	x = splnet();
   4236        1.39    martin 	sp->pp_auth_failures = 0;
   4237         1.3  explorer 	/* indicate to LCP that we need to be closed down */
   4238         1.3  explorer 	sp->lcp.protos |= (1 << IDX_CHAP);
   4239         1.3  explorer 
   4240         1.3  explorer 	if (sp->pp_flags & PP_NEEDAUTH) {
   4241         1.3  explorer 		/*
   4242         1.3  explorer 		 * Remote is authenticator, but his auth proto didn't
   4243         1.3  explorer 		 * complete yet.  Defer the transition to network
   4244         1.3  explorer 		 * phase.
   4245         1.3  explorer 		 */
   4246         1.3  explorer 		splx(x);
   4247         1.3  explorer 		return;
   4248         1.3  explorer 	}
   4249         1.3  explorer 	splx(x);
   4250         1.3  explorer 
   4251         1.3  explorer 	/*
   4252         1.3  explorer 	 * If we are already in phase network, we are done here.  This
   4253         1.3  explorer 	 * is the case if this is a dummy tlu event after a re-challenge.
   4254         1.3  explorer 	 */
   4255        1.36    martin 	if (sp->pp_phase != SPPP_PHASE_NETWORK)
   4256         1.3  explorer 		sppp_phase_network(sp);
   4257         1.3  explorer }
   4258         1.3  explorer 
   4259         1.3  explorer static void
   4260         1.3  explorer sppp_chap_tld(struct sppp *sp)
   4261         1.3  explorer {
   4262         1.3  explorer 	STDDCL;
   4263         1.3  explorer 
   4264         1.3  explorer 	if (debug)
   4265        1.64    itojun 		log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname);
   4266         1.7   thorpej 	callout_stop(&sp->ch[IDX_CHAP]);
   4267         1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_CHAP);
   4268         1.3  explorer 
   4269         1.3  explorer 	lcp.Close(sp);
   4270         1.3  explorer }
   4271         1.3  explorer 
   4272         1.3  explorer static void
   4273         1.3  explorer sppp_chap_scr(struct sppp *sp)
   4274         1.3  explorer {
   4275       1.109      matt 	uint32_t *ch;
   4276         1.3  explorer 	u_char clen;
   4277         1.3  explorer 
   4278        1.36    martin 	if (sp->myauth.name == NULL) {
   4279        1.36    martin 	    /* can't do anything usefull */
   4280        1.64    itojun 	    printf("%s: chap starting without my name being set\n",
   4281        1.64    itojun 	    	sp->pp_if.if_xname);
   4282        1.36    martin 	    return;
   4283        1.36    martin 	}
   4284        1.36    martin 
   4285         1.3  explorer 	/* Compute random challenge. */
   4286       1.109      matt 	ch = (uint32_t *)sp->myauth.challenge;
   4287        1.65    itojun 	ch[0] = arc4random();
   4288        1.65    itojun 	ch[1] = arc4random();
   4289        1.65    itojun 	ch[2] = arc4random();
   4290        1.65    itojun 	ch[3] = arc4random();
   4291       1.109      matt 	clen = 16;	/* 4 * sizeof(uint32_t) */
   4292         1.3  explorer 
   4293         1.9    itojun 	sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];
   4294         1.3  explorer 
   4295         1.3  explorer 	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
   4296         1.3  explorer 		       sizeof clen, (const char *)&clen,
   4297        1.36    martin 		       sizeof(sp->myauth.challenge), sp->myauth.challenge,
   4298        1.54  christos 		       sp->myauth.name_len,
   4299         1.3  explorer 		       sp->myauth.name,
   4300         1.3  explorer 		       0);
   4301         1.3  explorer }
   4302        1.42  jdolecek 
   4303        1.42  jdolecek /*
   4304         1.3  explorer  *--------------------------------------------------------------------------*
   4305         1.3  explorer  *                                                                          *
   4306         1.3  explorer  *                        The PAP implementation.                           *
   4307         1.3  explorer  *                                                                          *
   4308         1.3  explorer  *--------------------------------------------------------------------------*
   4309         1.3  explorer  */
   4310         1.3  explorer /*
   4311         1.3  explorer  * For PAP, we need to keep a little state also if we are the peer, not the
   4312         1.3  explorer  * authenticator.  This is since we don't get a request to authenticate, but
   4313         1.3  explorer  * have to repeatedly authenticate ourself until we got a response (or the
   4314         1.3  explorer  * retry counter is expired).
   4315         1.3  explorer  */
   4316         1.3  explorer 
   4317         1.3  explorer /*
   4318         1.3  explorer  * Handle incoming PAP packets.  */
   4319         1.3  explorer static void
   4320         1.3  explorer sppp_pap_input(struct sppp *sp, struct mbuf *m)
   4321         1.3  explorer {
   4322         1.3  explorer 	STDDCL;
   4323         1.3  explorer 	struct lcp_header *h;
   4324         1.3  explorer 	int len, x;
   4325        1.36    martin 	u_char mlen;
   4326        1.53  christos 	char *name, *secret;
   4327        1.52  christos 	int name_len, secret_len;
   4328         1.3  explorer 
   4329        1.96   adrianp 	/*
   4330        1.96   adrianp 	 * Malicious input might leave this uninitialized, so
   4331        1.96   adrianp 	 * init to an impossible value.
   4332        1.96   adrianp 	 */
   4333        1.96   adrianp 	secret_len = -1;
   4334        1.96   adrianp 
   4335         1.3  explorer 	len = m->m_pkthdr.len;
   4336         1.3  explorer 	if (len < 5) {
   4337         1.3  explorer 		if (debug)
   4338         1.3  explorer 			log(LOG_DEBUG,
   4339        1.64    itojun 			    "%s: pap invalid packet length: %d bytes\n",
   4340        1.64    itojun 			    ifp->if_xname, len);
   4341         1.3  explorer 		return;
   4342         1.3  explorer 	}
   4343        1.59    itojun 	h = mtod(m, struct lcp_header *);
   4344        1.59    itojun 	if (len > ntohs(h->len))
   4345        1.59    itojun 		len = ntohs(h->len);
   4346         1.3  explorer 	switch (h->type) {
   4347         1.3  explorer 	/* PAP request is my authproto */
   4348         1.3  explorer 	case PAP_REQ:
   4349        1.36    martin 		if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
   4350        1.36    martin 		    /* can't do anything usefull */
   4351        1.64    itojun 		    printf("%s: pap request without his name and his secret being set\n",
   4352        1.64    itojun 		    	ifp->if_xname);
   4353        1.36    martin 		    break;
   4354        1.36    martin 		}
   4355        1.59    itojun 		name = 1 + (u_char *)(h + 1);
   4356         1.3  explorer 		name_len = name[-1];
   4357        1.52  christos 		secret = name + name_len + 1;
   4358         1.3  explorer 		if (name_len > len - 6 ||
   4359        1.52  christos 		    (secret_len = secret[-1]) > len - 6 - name_len) {
   4360         1.3  explorer 			if (debug) {
   4361        1.64    itojun 				log(LOG_DEBUG, "%s: pap corrupted input "
   4362         1.3  explorer 				    "<%s id=0x%x len=%d",
   4363        1.64    itojun 				    ifp->if_xname,
   4364         1.3  explorer 				    sppp_auth_type_name(PPP_PAP, h->type),
   4365         1.3  explorer 				    h->ident, ntohs(h->len));
   4366         1.3  explorer 				if (len > 4)
   4367        1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   4368        1.59    itojun 					    len - 4);
   4369         1.3  explorer 				addlog(">\n");
   4370         1.3  explorer 			}
   4371         1.3  explorer 			break;
   4372         1.3  explorer 		}
   4373         1.3  explorer 		if (debug) {
   4374        1.64    itojun 			log(LOG_DEBUG, "%s: pap input(%s) "
   4375         1.3  explorer 			    "<%s id=0x%x len=%d name=",
   4376        1.64    itojun 			    ifp->if_xname,
   4377         1.3  explorer 			    sppp_state_name(sp->state[IDX_PAP]),
   4378         1.3  explorer 			    sppp_auth_type_name(PPP_PAP, h->type),
   4379         1.3  explorer 			    h->ident, ntohs(h->len));
   4380        1.59    itojun 			sppp_print_string((char *)name, name_len);
   4381        1.52  christos 			addlog(" secret=");
   4382        1.59    itojun 			sppp_print_string((char *)secret, secret_len);
   4383         1.3  explorer 			addlog(">\n");
   4384         1.3  explorer 		}
   4385        1.54  christos 		if (name_len != sp->hisauth.name_len ||
   4386        1.54  christos 		    secret_len != sp->hisauth.secret_len ||
   4387        1.53  christos 		    memcmp(name, sp->hisauth.name, name_len) != 0 ||
   4388        1.53  christos 		    memcmp(secret, sp->hisauth.secret, secret_len) != 0) {
   4389         1.3  explorer 			/* action scn, tld */
   4390        1.39    martin 			sp->pp_auth_failures++;
   4391         1.3  explorer 			mlen = sizeof(FAILMSG) - 1;
   4392         1.3  explorer 			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
   4393         1.3  explorer 				       sizeof mlen, (const char *)&mlen,
   4394        1.85  christos 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
   4395         1.3  explorer 				       0);
   4396         1.3  explorer 			pap.tld(sp);
   4397         1.3  explorer 			break;
   4398         1.3  explorer 		}
   4399         1.3  explorer 		/* action sca, perhaps tlu */
   4400         1.3  explorer 		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
   4401         1.3  explorer 		    sp->state[IDX_PAP] == STATE_OPENED) {
   4402         1.3  explorer 			mlen = sizeof(SUCCMSG) - 1;
   4403         1.3  explorer 			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
   4404         1.3  explorer 				       sizeof mlen, (const char *)&mlen,
   4405        1.85  christos 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
   4406         1.3  explorer 				       0);
   4407         1.3  explorer 		}
   4408         1.3  explorer 		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
   4409         1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_OPENED);
   4410         1.3  explorer 			pap.tlu(sp);
   4411         1.3  explorer 		}
   4412         1.3  explorer 		break;
   4413         1.3  explorer 
   4414         1.3  explorer 	/* ack and nak are his authproto */
   4415         1.3  explorer 	case PAP_ACK:
   4416         1.7   thorpej 		callout_stop(&sp->pap_my_to_ch);
   4417         1.3  explorer 		if (debug) {
   4418        1.64    itojun 			log(LOG_DEBUG, "%s: pap success",
   4419        1.64    itojun 			    ifp->if_xname);
   4420        1.96   adrianp 			name = 1 + (u_char *)(h + 1);
   4421        1.96   adrianp 			name_len = name[-1];
   4422        1.96   adrianp 			if (len > 5 && name_len < len+4) {
   4423         1.3  explorer 				addlog(": ");
   4424        1.96   adrianp 				sppp_print_string(name, name_len);
   4425         1.3  explorer 			}
   4426         1.3  explorer 			addlog("\n");
   4427         1.3  explorer 		}
   4428        1.23   thorpej 		x = splnet();
   4429        1.39    martin 		sp->pp_auth_failures = 0;
   4430         1.3  explorer 		sp->pp_flags &= ~PP_NEEDAUTH;
   4431         1.3  explorer 		if (sp->myauth.proto == PPP_PAP &&
   4432         1.3  explorer 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   4433         1.3  explorer 		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
   4434         1.3  explorer 			/*
   4435         1.3  explorer 			 * We are authenticator for PAP but didn't
   4436         1.3  explorer 			 * complete yet.  Leave it to tlu to proceed
   4437         1.3  explorer 			 * to network phase.
   4438         1.3  explorer 			 */
   4439         1.3  explorer 			splx(x);
   4440         1.3  explorer 			break;
   4441         1.3  explorer 		}
   4442         1.3  explorer 		splx(x);
   4443         1.3  explorer 		sppp_phase_network(sp);
   4444         1.3  explorer 		break;
   4445         1.3  explorer 
   4446         1.3  explorer 	case PAP_NAK:
   4447         1.7   thorpej 		callout_stop(&sp->pap_my_to_ch);
   4448        1.39    martin 		sp->pp_auth_failures++;
   4449         1.3  explorer 		if (debug) {
   4450        1.64    itojun 			log(LOG_INFO, "%s: pap failure",
   4451        1.64    itojun 			    ifp->if_xname);
   4452        1.96   adrianp 			name = 1 + (u_char *)(h + 1);
   4453        1.96   adrianp 			name_len = name[-1];
   4454        1.96   adrianp 			if (len > 5 && name_len < len+4) {
   4455         1.3  explorer 				addlog(": ");
   4456        1.96   adrianp 				sppp_print_string(name, name_len);
   4457         1.3  explorer 			}
   4458         1.3  explorer 			addlog("\n");
   4459         1.3  explorer 		} else
   4460        1.64    itojun 			log(LOG_INFO, "%s: pap failure\n",
   4461        1.64    itojun 			    ifp->if_xname);
   4462         1.3  explorer 		/* await LCP shutdown by authenticator */
   4463         1.3  explorer 		break;
   4464         1.3  explorer 
   4465         1.3  explorer 	default:
   4466         1.3  explorer 		/* Unknown PAP packet type -- ignore. */
   4467         1.3  explorer 		if (debug) {
   4468        1.64    itojun 			log(LOG_DEBUG, "%s: pap corrupted input "
   4469         1.3  explorer 			    "<0x%x id=0x%x len=%d",
   4470        1.64    itojun 			    ifp->if_xname,
   4471         1.3  explorer 			    h->type, h->ident, ntohs(h->len));
   4472         1.3  explorer 			if (len > 4)
   4473        1.59    itojun 				sppp_print_bytes((u_char *)(h + 1), len - 4);
   4474         1.3  explorer 			addlog(">\n");
   4475         1.3  explorer 		}
   4476         1.3  explorer 		break;
   4477         1.3  explorer 
   4478         1.3  explorer 	}
   4479         1.3  explorer }
   4480         1.3  explorer 
   4481         1.3  explorer static void
   4482         1.3  explorer sppp_pap_init(struct sppp *sp)
   4483         1.3  explorer {
   4484         1.3  explorer 	/* PAP doesn't have STATE_INITIAL at all. */
   4485         1.3  explorer 	sp->state[IDX_PAP] = STATE_CLOSED;
   4486         1.3  explorer 	sp->fail_counter[IDX_PAP] = 0;
   4487         1.9    itojun 	sp->pp_seq[IDX_PAP] = 0;
   4488         1.9    itojun 	sp->pp_rseq[IDX_PAP] = 0;
   4489       1.106        ad 	callout_init(&sp->ch[IDX_PAP], 0);
   4490       1.106        ad 	callout_init(&sp->pap_my_to_ch, 0);
   4491         1.3  explorer }
   4492         1.3  explorer 
   4493         1.3  explorer static void
   4494         1.3  explorer sppp_pap_open(struct sppp *sp)
   4495         1.3  explorer {
   4496         1.3  explorer 	if (sp->hisauth.proto == PPP_PAP &&
   4497         1.3  explorer 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4498         1.3  explorer 		/* we are authenticator for PAP, start our timer */
   4499         1.3  explorer 		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4500         1.3  explorer 		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4501         1.3  explorer 	}
   4502         1.3  explorer 	if (sp->myauth.proto == PPP_PAP) {
   4503         1.3  explorer 		/* we are peer, send a request, and start a timer */
   4504         1.3  explorer 		pap.scr(sp);
   4505         1.7   thorpej 		callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout,
   4506         1.7   thorpej 		    sppp_pap_my_TO, sp);
   4507         1.3  explorer 	}
   4508         1.3  explorer }
   4509         1.3  explorer 
   4510         1.3  explorer static void
   4511         1.3  explorer sppp_pap_close(struct sppp *sp)
   4512         1.3  explorer {
   4513         1.3  explorer 	if (sp->state[IDX_PAP] != STATE_CLOSED)
   4514         1.3  explorer 		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4515         1.3  explorer }
   4516         1.3  explorer 
   4517         1.3  explorer /*
   4518         1.3  explorer  * That's the timeout routine if we are authenticator.  Since the
   4519         1.3  explorer  * authenticator is basically passive in PAP, we can't do much here.
   4520         1.3  explorer  */
   4521         1.3  explorer static void
   4522         1.3  explorer sppp_pap_TO(void *cookie)
   4523         1.3  explorer {
   4524         1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4525         1.3  explorer 	STDDCL;
   4526         1.3  explorer 	int s;
   4527         1.3  explorer 
   4528        1.23   thorpej 	s = splnet();
   4529         1.3  explorer 	if (debug)
   4530        1.64    itojun 		log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n",
   4531        1.64    itojun 		    ifp->if_xname,
   4532         1.3  explorer 		    sppp_state_name(sp->state[IDX_PAP]),
   4533         1.3  explorer 		    sp->rst_counter[IDX_PAP]);
   4534         1.3  explorer 
   4535         1.3  explorer 	if (--sp->rst_counter[IDX_PAP] < 0)
   4536         1.3  explorer 		/* TO- event */
   4537         1.3  explorer 		switch (sp->state[IDX_PAP]) {
   4538         1.3  explorer 		case STATE_REQ_SENT:
   4539         1.3  explorer 			pap.tld(sp);
   4540         1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4541         1.3  explorer 			break;
   4542         1.3  explorer 		}
   4543         1.3  explorer 	else
   4544         1.3  explorer 		/* TO+ event, not very much we could do */
   4545         1.3  explorer 		switch (sp->state[IDX_PAP]) {
   4546         1.3  explorer 		case STATE_REQ_SENT:
   4547         1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   4548         1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4549         1.3  explorer 			break;
   4550         1.3  explorer 		}
   4551         1.3  explorer 
   4552         1.3  explorer 	splx(s);
   4553         1.3  explorer }
   4554         1.3  explorer 
   4555         1.3  explorer /*
   4556         1.3  explorer  * That's the timeout handler if we are peer.  Since the peer is active,
   4557         1.3  explorer  * we need to retransmit our PAP request since it is apparently lost.
   4558         1.3  explorer  * XXX We should impose a max counter.
   4559         1.3  explorer  */
   4560         1.3  explorer static void
   4561         1.3  explorer sppp_pap_my_TO(void *cookie)
   4562         1.3  explorer {
   4563         1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4564         1.3  explorer 	STDDCL;
   4565         1.3  explorer 
   4566         1.3  explorer 	if (debug)
   4567        1.64    itojun 		log(LOG_DEBUG, "%s: pap peer TO\n",
   4568        1.64    itojun 		    ifp->if_xname);
   4569         1.3  explorer 
   4570         1.3  explorer 	pap.scr(sp);
   4571         1.3  explorer }
   4572         1.3  explorer 
   4573         1.3  explorer static void
   4574         1.3  explorer sppp_pap_tlu(struct sppp *sp)
   4575         1.3  explorer {
   4576         1.3  explorer 	STDDCL;
   4577         1.3  explorer 	int x;
   4578         1.3  explorer 
   4579         1.3  explorer 	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4580         1.3  explorer 
   4581         1.3  explorer 	if (debug)
   4582        1.64    itojun 		log(LOG_DEBUG, "%s: %s tlu\n",
   4583        1.64    itojun 		    ifp->if_xname, pap.name);
   4584         1.3  explorer 
   4585        1.23   thorpej 	x = splnet();
   4586        1.39    martin 	sp->pp_auth_failures = 0;
   4587         1.3  explorer 	/* indicate to LCP that we need to be closed down */
   4588         1.3  explorer 	sp->lcp.protos |= (1 << IDX_PAP);
   4589         1.3  explorer 
   4590         1.3  explorer 	if (sp->pp_flags & PP_NEEDAUTH) {
   4591         1.3  explorer 		/*
   4592         1.3  explorer 		 * Remote is authenticator, but his auth proto didn't
   4593         1.3  explorer 		 * complete yet.  Defer the transition to network
   4594         1.3  explorer 		 * phase.
   4595         1.3  explorer 		 */
   4596         1.3  explorer 		splx(x);
   4597         1.3  explorer 		return;
   4598         1.3  explorer 	}
   4599         1.3  explorer 	splx(x);
   4600         1.3  explorer 	sppp_phase_network(sp);
   4601         1.3  explorer }
   4602         1.3  explorer 
   4603         1.3  explorer static void
   4604         1.3  explorer sppp_pap_tld(struct sppp *sp)
   4605         1.3  explorer {
   4606         1.3  explorer 	STDDCL;
   4607         1.3  explorer 
   4608         1.3  explorer 	if (debug)
   4609        1.64    itojun 		log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname);
   4610         1.7   thorpej 	callout_stop(&sp->ch[IDX_PAP]);
   4611         1.7   thorpej 	callout_stop(&sp->pap_my_to_ch);
   4612         1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_PAP);
   4613         1.3  explorer 
   4614         1.3  explorer 	lcp.Close(sp);
   4615         1.3  explorer }
   4616         1.3  explorer 
   4617         1.3  explorer static void
   4618         1.3  explorer sppp_pap_scr(struct sppp *sp)
   4619         1.3  explorer {
   4620         1.3  explorer 	u_char idlen, pwdlen;
   4621         1.3  explorer 
   4622        1.36    martin 	if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   4623        1.36    martin 	    /* can't do anything usefull */
   4624        1.64    itojun 	    printf("%s: pap starting without my name and secret being set\n",
   4625        1.64    itojun 	    	sp->pp_if.if_xname);
   4626        1.36    martin 	    return;
   4627        1.36    martin 	}
   4628        1.82     perry 
   4629         1.9    itojun 	sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP];
   4630        1.54  christos 	pwdlen = sp->myauth.secret_len;
   4631        1.54  christos 	idlen = sp->myauth.name_len;
   4632         1.3  explorer 
   4633         1.3  explorer 	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
   4634         1.3  explorer 		       sizeof idlen, (const char *)&idlen,
   4635        1.36    martin 		       idlen, sp->myauth.name,
   4636         1.3  explorer 		       sizeof pwdlen, (const char *)&pwdlen,
   4637        1.36    martin 		       pwdlen, sp->myauth.secret,
   4638         1.3  explorer 		       0);
   4639         1.3  explorer }
   4640        1.42  jdolecek 
   4641        1.42  jdolecek /*
   4642         1.3  explorer  * Random miscellaneous functions.
   4643         1.3  explorer  */
   4644         1.3  explorer 
   4645         1.3  explorer /*
   4646         1.3  explorer  * Send a PAP or CHAP proto packet.
   4647         1.3  explorer  *
   4648         1.3  explorer  * Varadic function, each of the elements for the ellipsis is of type
   4649         1.3  explorer  * ``size_t mlen, const u_char *msg''.  Processing will stop iff
   4650         1.3  explorer  * mlen == 0.
   4651         1.3  explorer  * NOTE: never declare variadic functions with types subject to type
   4652         1.3  explorer  * promotion (i.e. u_char). This is asking for big trouble depending
   4653         1.3  explorer  * on the architecture you are on...
   4654         1.3  explorer  */
   4655         1.3  explorer 
   4656         1.3  explorer static void
   4657         1.3  explorer sppp_auth_send(const struct cp *cp, struct sppp *sp,
   4658         1.3  explorer                unsigned int type, unsigned int id,
   4659         1.3  explorer 	       ...)
   4660         1.3  explorer {
   4661         1.3  explorer 	STDDCL;
   4662         1.3  explorer 	struct lcp_header *lh;
   4663         1.3  explorer 	struct mbuf *m;
   4664         1.3  explorer 	u_char *p;
   4665         1.3  explorer 	int len;
   4666        1.22    martin 	size_t pkthdrlen;
   4667         1.3  explorer 	unsigned int mlen;
   4668         1.3  explorer 	const char *msg;
   4669         1.3  explorer 	va_list ap;
   4670         1.3  explorer 
   4671        1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   4672         1.3  explorer 	if (! m)
   4673         1.3  explorer 		return;
   4674         1.3  explorer 	m->m_pkthdr.rcvif = 0;
   4675         1.3  explorer 
   4676        1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
   4677       1.109      matt 		*mtod(m, uint16_t *) = htons(cp->proto);
   4678        1.22    martin 		pkthdrlen = 2;
   4679       1.109      matt 		lh = (struct lcp_header *)(mtod(m, uint8_t *)+2);
   4680        1.22    martin 	} else {
   4681        1.22    martin 		struct ppp_header *h;
   4682        1.59    itojun 		h = mtod(m, struct ppp_header *);
   4683        1.22    martin 		h->address = PPP_ALLSTATIONS;		/* broadcast address */
   4684        1.22    martin 		h->control = PPP_UI;			/* Unnumbered Info */
   4685        1.22    martin 		h->protocol = htons(cp->proto);
   4686        1.22    martin 		pkthdrlen = PPP_HEADER_LEN;
   4687        1.22    martin 
   4688        1.59    itojun 		lh = (struct lcp_header *)(h + 1);
   4689        1.22    martin 	}
   4690         1.3  explorer 
   4691         1.3  explorer 	lh->type = type;
   4692         1.3  explorer 	lh->ident = id;
   4693        1.59    itojun 	p = (u_char *)(lh + 1);
   4694         1.3  explorer 
   4695         1.3  explorer 	va_start(ap, id);
   4696         1.3  explorer 	len = 0;
   4697         1.3  explorer 
   4698         1.3  explorer 	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
   4699         1.3  explorer 		msg = va_arg(ap, const char *);
   4700         1.3  explorer 		len += mlen;
   4701        1.22    martin 		if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
   4702         1.3  explorer 			va_end(ap);
   4703         1.3  explorer 			m_freem(m);
   4704         1.3  explorer 			return;
   4705         1.3  explorer 		}
   4706         1.3  explorer 
   4707         1.3  explorer 		bcopy(msg, p, mlen);
   4708         1.3  explorer 		p += mlen;
   4709         1.3  explorer 	}
   4710         1.3  explorer 	va_end(ap);
   4711         1.3  explorer 
   4712        1.22    martin 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   4713        1.59    itojun 	lh->len = htons(LCP_HEADER_LEN + len);
   4714         1.3  explorer 
   4715         1.3  explorer 	if (debug) {
   4716        1.64    itojun 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
   4717        1.64    itojun 		    ifp->if_xname, cp->name,
   4718         1.3  explorer 		    sppp_auth_type_name(cp->proto, lh->type),
   4719         1.3  explorer 		    lh->ident, ntohs(lh->len));
   4720         1.3  explorer 		if (len)
   4721        1.59    itojun 			sppp_print_bytes((u_char *)(lh + 1), len);
   4722         1.3  explorer 		addlog(">\n");
   4723         1.3  explorer 	}
   4724        1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   4725        1.59    itojun 		IF_DROP(&sp->pp_fastq);
   4726        1.59    itojun 		IF_DROP(&ifp->if_snd);
   4727        1.59    itojun 		m_freem(m);
   4728         1.3  explorer 		++ifp->if_oerrors;
   4729        1.50      yamt 		return;
   4730         1.3  explorer 	} else
   4731        1.59    itojun 		IF_ENQUEUE(&sp->pp_cpq, m);
   4732         1.3  explorer 	if (! (ifp->if_flags & IFF_OACTIVE))
   4733        1.59    itojun 		(*ifp->if_start)(ifp);
   4734         1.3  explorer 	ifp->if_obytes += m->m_pkthdr.len + 3;
   4735         1.3  explorer }
   4736         1.3  explorer 
   4737         1.3  explorer /*
   4738         1.3  explorer  * Send keepalive packets, every 10 seconds.
   4739         1.3  explorer  */
   4740         1.3  explorer static void
   4741       1.101  christos sppp_keepalive(void *dummy)
   4742         1.3  explorer {
   4743         1.3  explorer 	struct sppp *sp;
   4744         1.3  explorer 	int s;
   4745        1.38    martin 	time_t now;
   4746         1.3  explorer 
   4747        1.23   thorpej 	s = splnet();
   4748        1.92    kardel 	now = time_uptime;
   4749         1.3  explorer 	for (sp=spppq; sp; sp=sp->pp_next) {
   4750         1.3  explorer 		struct ifnet *ifp = &sp->pp_if;
   4751         1.3  explorer 
   4752        1.38    martin 		/* check idle timeout */
   4753        1.40    martin 		if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING)
   4754        1.40    martin 		    && (sp->pp_phase == SPPP_PHASE_NETWORK)) {
   4755        1.38    martin 		    /* idle timeout is enabled for this interface */
   4756        1.38    martin 		    if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) {
   4757        1.38    martin 		    	if (ifp->if_flags & IFF_DEBUG)
   4758        1.84    martin 			    printf("%s: no activity for %lu seconds\n",
   4759        1.38    martin 				sp->pp_if.if_xname,
   4760        1.38    martin 				(unsigned long)(now-sp->pp_last_activity));
   4761        1.38    martin 			lcp.Close(sp);
   4762        1.38    martin 			continue;
   4763        1.38    martin 		    }
   4764        1.38    martin 		}
   4765        1.38    martin 
   4766         1.3  explorer 		/* Keepalive mode disabled or channel down? */
   4767         1.3  explorer 		if (! (sp->pp_flags & PP_KEEPALIVE) ||
   4768         1.3  explorer 		    ! (ifp->if_flags & IFF_RUNNING))
   4769         1.3  explorer 			continue;
   4770         1.3  explorer 
   4771         1.3  explorer 		/* No keepalive in PPP mode if LCP not opened yet. */
   4772         1.3  explorer 		if (! (sp->pp_flags & PP_CISCO) &&
   4773        1.36    martin 		    sp->pp_phase < SPPP_PHASE_AUTHENTICATE)
   4774         1.3  explorer 			continue;
   4775         1.3  explorer 
   4776        1.57    martin 		/* No echo reply, but maybe user data passed through? */
   4777        1.68    martin 		if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) {
   4778        1.57    martin 			sp->pp_alivecnt = 0;
   4779        1.57    martin 			continue;
   4780        1.57    martin 		}
   4781        1.57    martin 
   4782        1.68    martin 		if (sp->pp_alivecnt >= sp->pp_maxalive) {
   4783         1.3  explorer 			/* No keepalive packets got.  Stop the interface. */
   4784         1.3  explorer 			if_down (ifp);
   4785        1.59    itojun 			IF_PURGE(&sp->pp_cpq);
   4786         1.3  explorer 			if (! (sp->pp_flags & PP_CISCO)) {
   4787        1.33    martin 				printf("%s: LCP keepalive timed out, going to restart the connection\n",
   4788        1.33    martin 					ifp->if_xname);
   4789        1.33    martin 				sp->pp_alivecnt = 0;
   4790        1.33    martin 
   4791        1.33    martin 				/* we are down, close all open protocols */
   4792        1.33    martin 				lcp.Close(sp);
   4793        1.33    martin 
   4794        1.33    martin 				/* And now prepare LCP to reestablish the link, if configured to do so. */
   4795        1.33    martin 				sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
   4796        1.33    martin 
   4797       1.102       wiz 				/* Close connection immediately, completition of this
   4798        1.33    martin 				 * will summon the magic needed to reestablish it. */
   4799        1.91  christos 				if (sp->pp_tlf)
   4800        1.91  christos 					sp->pp_tlf(sp);
   4801        1.33    martin 				continue;
   4802         1.3  explorer 			}
   4803         1.3  explorer 		}
   4804        1.68    martin 		if (sp->pp_alivecnt < sp->pp_maxalive)
   4805         1.3  explorer 			++sp->pp_alivecnt;
   4806         1.3  explorer 		if (sp->pp_flags & PP_CISCO)
   4807        1.59    itojun 			sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ,
   4808         1.9    itojun 			    ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]);
   4809        1.36    martin 		else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
   4810        1.59    itojun 			int32_t nmagic = htonl(sp->lcp.magic);
   4811         1.9    itojun 			sp->lcp.echoid = ++sp->pp_seq[IDX_LCP];
   4812        1.59    itojun 			sppp_cp_send(sp, PPP_LCP, ECHO_REQ,
   4813         1.3  explorer 				sp->lcp.echoid, 4, &nmagic);
   4814         1.3  explorer 		}
   4815         1.3  explorer 	}
   4816         1.3  explorer 	splx(s);
   4817        1.57    martin 	callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
   4818         1.3  explorer }
   4819         1.3  explorer 
   4820        1.79  christos #ifdef INET
   4821         1.3  explorer /*
   4822         1.3  explorer  * Get both IP addresses.
   4823         1.3  explorer  */
   4824         1.3  explorer static void
   4825       1.109      matt sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask)
   4826         1.3  explorer {
   4827         1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   4828         1.3  explorer 	struct ifaddr *ifa;
   4829         1.3  explorer 	struct sockaddr_in *si, *sm;
   4830       1.109      matt 	uint32_t ssrc, ddst;
   4831         1.3  explorer 
   4832         1.3  explorer 	sm = NULL;
   4833        1.30      ross 	ssrc = ddst = 0;
   4834         1.3  explorer 	/*
   4835         1.3  explorer 	 * Pick the first AF_INET address from the list,
   4836         1.3  explorer 	 * aliases don't make any sense on a p2p link anyway.
   4837         1.3  explorer 	 */
   4838        1.28      matt 	si = 0;
   4839        1.81      matt 	IFADDR_FOREACH(ifa, ifp) {
   4840         1.3  explorer 		if (ifa->ifa_addr->sa_family == AF_INET) {
   4841         1.3  explorer 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4842         1.3  explorer 			sm = (struct sockaddr_in *)ifa->ifa_netmask;
   4843         1.3  explorer 			if (si)
   4844         1.3  explorer 				break;
   4845         1.3  explorer 		}
   4846        1.28      matt 	}
   4847         1.3  explorer 	if (ifa) {
   4848         1.3  explorer 		if (si && si->sin_addr.s_addr) {
   4849         1.3  explorer 			ssrc = si->sin_addr.s_addr;
   4850         1.3  explorer 			if (srcmask)
   4851         1.3  explorer 				*srcmask = ntohl(sm->sin_addr.s_addr);
   4852         1.3  explorer 		}
   4853         1.3  explorer 
   4854         1.3  explorer 		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4855         1.3  explorer 		if (si && si->sin_addr.s_addr)
   4856         1.3  explorer 			ddst = si->sin_addr.s_addr;
   4857         1.3  explorer 	}
   4858         1.3  explorer 
   4859         1.3  explorer 	if (dst) *dst = ntohl(ddst);
   4860         1.3  explorer 	if (src) *src = ntohl(ssrc);
   4861         1.3  explorer }
   4862         1.3  explorer 
   4863         1.3  explorer /*
   4864        1.31    martin  * Set IP addresses.  Must be called at splnet.
   4865        1.31    martin  * If an address is 0, leave it the way it is.
   4866         1.3  explorer  */
   4867         1.3  explorer static void
   4868       1.109      matt sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr)
   4869         1.3  explorer {
   4870         1.3  explorer 	STDDCL;
   4871         1.3  explorer 	struct ifaddr *ifa;
   4872        1.73   mycroft 	struct sockaddr_in *si, *dest;
   4873         1.3  explorer 
   4874         1.3  explorer 	/*
   4875         1.3  explorer 	 * Pick the first AF_INET address from the list,
   4876         1.3  explorer 	 * aliases don't make any sense on a p2p link anyway.
   4877         1.3  explorer 	 */
   4878         1.3  explorer 
   4879        1.81      matt 	IFADDR_FOREACH(ifa, ifp) {
   4880        1.73   mycroft 		if (ifa->ifa_addr->sa_family == AF_INET) {
   4881         1.3  explorer 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4882        1.31    martin 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4883        1.73   mycroft 			goto found;
   4884         1.3  explorer 		}
   4885         1.3  explorer 	}
   4886        1.73   mycroft 	return;
   4887         1.3  explorer 
   4888        1.73   mycroft found:
   4889         1.3  explorer 	{
   4890         1.3  explorer 		int error;
   4891         1.3  explorer 		struct sockaddr_in new_sin = *si;
   4892        1.31    martin 		struct sockaddr_in new_dst = *dest;
   4893         1.3  explorer 
   4894        1.31    martin 		/*
   4895        1.31    martin 		 * Scrub old routes now instead of calling in_ifinit with
   4896        1.31    martin 		 * scrub=1, because we may change the dstaddr
   4897        1.31    martin 		 * before the call to in_ifinit.
   4898        1.31    martin 		 */
   4899        1.31    martin 		in_ifscrub(ifp, ifatoia(ifa));
   4900        1.31    martin 
   4901        1.31    martin 		if (myaddr != 0)
   4902        1.31    martin 			new_sin.sin_addr.s_addr = htonl(myaddr);
   4903        1.31    martin 		if (hisaddr != 0) {
   4904        1.31    martin 			new_dst.sin_addr.s_addr = htonl(hisaddr);
   4905        1.31    martin 			if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) {
   4906        1.31    martin 				sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
   4907        1.31    martin 				*dest = new_dst; /* fix dstaddr in place */
   4908        1.31    martin 			}
   4909        1.31    martin 		}
   4910        1.31    martin 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0);
   4911        1.70    itojun 		if (debug && error)
   4912         1.3  explorer 		{
   4913        1.64    itojun 			log(LOG_DEBUG, "%s: sppp_set_ip_addrs: in_ifinit "
   4914        1.64    itojun 			" failed, error=%d\n", ifp->if_xname, error);
   4915         1.3  explorer 		}
   4916        1.78      yamt #ifdef PFIL_HOOKS
   4917        1.78      yamt 		if (!error)
   4918        1.78      yamt 			(void)pfil_run_hooks(&if_pfil,
   4919        1.78      yamt 			    (struct mbuf **)SIOCAIFADDR, ifp, PFIL_IFADDR);
   4920        1.78      yamt #endif
   4921        1.31    martin 	}
   4922        1.82     perry }
   4923        1.31    martin 
   4924        1.31    martin /*
   4925        1.31    martin  * Clear IP addresses.  Must be called at splnet.
   4926        1.31    martin  */
   4927        1.31    martin static void
   4928        1.31    martin sppp_clear_ip_addrs(struct sppp *sp)
   4929        1.31    martin {
   4930        1.31    martin 	struct ifnet *ifp = &sp->pp_if;
   4931        1.31    martin 	struct ifaddr *ifa;
   4932        1.73   mycroft 	struct sockaddr_in *si, *dest;
   4933        1.31    martin 
   4934       1.109      matt 	uint32_t remote;
   4935        1.31    martin 	if (sp->ipcp.flags & IPCP_HISADDR_DYN)
   4936        1.31    martin 		remote = sp->ipcp.saved_hisaddr;
   4937        1.31    martin 	else
   4938        1.31    martin 		sppp_get_ip_addrs(sp, 0, &remote, 0);
   4939        1.31    martin 
   4940        1.31    martin 	/*
   4941        1.31    martin 	 * Pick the first AF_INET address from the list,
   4942        1.31    martin 	 * aliases don't make any sense on a p2p link anyway.
   4943        1.31    martin 	 */
   4944        1.31    martin 
   4945        1.81      matt 	IFADDR_FOREACH(ifa, ifp) {
   4946        1.73   mycroft 		if (ifa->ifa_addr->sa_family == AF_INET) {
   4947        1.31    martin 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4948        1.31    martin 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4949        1.73   mycroft 			goto found;
   4950        1.31    martin 		}
   4951        1.31    martin 	}
   4952        1.73   mycroft 	return;
   4953        1.31    martin 
   4954        1.73   mycroft found:
   4955        1.31    martin 	{
   4956        1.31    martin 		struct sockaddr_in new_sin = *si;
   4957        1.31    martin 
   4958        1.31    martin 		in_ifscrub(ifp, ifatoia(ifa));
   4959        1.31    martin 		if (sp->ipcp.flags & IPCP_MYADDR_DYN)
   4960        1.31    martin 			new_sin.sin_addr.s_addr = 0;
   4961        1.31    martin 		if (sp->ipcp.flags & IPCP_HISADDR_DYN)
   4962        1.31    martin 			/* replace peer addr in place */
   4963        1.31    martin 			dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr;
   4964        1.31    martin 		in_ifinit(ifp, ifatoia(ifa), &new_sin, 0);
   4965        1.78      yamt #ifdef PFIL_HOOKS
   4966        1.78      yamt 		(void)pfil_run_hooks(&if_pfil,
   4967        1.78      yamt 		    (struct mbuf **)SIOCDIFADDR, ifp, PFIL_IFADDR);
   4968        1.78      yamt #endif
   4969         1.3  explorer 	}
   4970        1.82     perry }
   4971        1.79  christos #endif
   4972         1.3  explorer 
   4973         1.9    itojun #ifdef INET6
   4974         1.9    itojun /*
   4975         1.9    itojun  * Get both IPv6 addresses.
   4976         1.9    itojun  */
   4977         1.9    itojun static void
   4978         1.9    itojun sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
   4979         1.9    itojun 		   struct in6_addr *srcmask)
   4980         1.9    itojun {
   4981         1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   4982         1.9    itojun 	struct ifaddr *ifa;
   4983         1.9    itojun 	struct sockaddr_in6 *si, *sm;
   4984         1.9    itojun 	struct in6_addr ssrc, ddst;
   4985         1.9    itojun 
   4986         1.9    itojun 	sm = NULL;
   4987        1.25   thorpej 	memset(&ssrc, 0, sizeof(ssrc));
   4988        1.25   thorpej 	memset(&ddst, 0, sizeof(ddst));
   4989         1.9    itojun 	/*
   4990         1.9    itojun 	 * Pick the first link-local AF_INET6 address from the list,
   4991         1.9    itojun 	 * aliases don't make any sense on a p2p link anyway.
   4992         1.9    itojun 	 */
   4993        1.28      matt 	si = 0;
   4994        1.81      matt 	IFADDR_FOREACH(ifa, ifp)
   4995         1.9    itojun 		if (ifa->ifa_addr->sa_family == AF_INET6) {
   4996         1.9    itojun 			si = (struct sockaddr_in6 *)ifa->ifa_addr;
   4997         1.9    itojun 			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
   4998         1.9    itojun 			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
   4999         1.9    itojun 				break;
   5000         1.9    itojun 		}
   5001         1.9    itojun 	if (ifa) {
   5002         1.9    itojun 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
   5003         1.9    itojun 			bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc));
   5004         1.9    itojun 			if (srcmask) {
   5005         1.9    itojun 				bcopy(&sm->sin6_addr, srcmask,
   5006         1.9    itojun 				    sizeof(*srcmask));
   5007         1.9    itojun 			}
   5008         1.9    itojun 		}
   5009         1.9    itojun 
   5010         1.9    itojun 		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
   5011         1.9    itojun 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
   5012         1.9    itojun 			bcopy(&si->sin6_addr, &ddst, sizeof(ddst));
   5013         1.9    itojun 	}
   5014         1.9    itojun 
   5015         1.9    itojun 	if (dst)
   5016         1.9    itojun 		bcopy(&ddst, dst, sizeof(*dst));
   5017         1.9    itojun 	if (src)
   5018         1.9    itojun 		bcopy(&ssrc, src, sizeof(*src));
   5019         1.9    itojun }
   5020         1.9    itojun 
   5021         1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   5022         1.9    itojun /*
   5023         1.9    itojun  * Generate random ifid.
   5024         1.9    itojun  */
   5025         1.9    itojun static void
   5026         1.9    itojun sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
   5027         1.9    itojun {
   5028         1.9    itojun 	/* TBD */
   5029         1.9    itojun }
   5030         1.9    itojun 
   5031         1.9    itojun /*
   5032        1.23   thorpej  * Set my IPv6 address.  Must be called at splnet.
   5033         1.9    itojun  */
   5034         1.9    itojun static void
   5035         1.9    itojun sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
   5036         1.9    itojun {
   5037         1.9    itojun 	STDDCL;
   5038         1.9    itojun 	struct ifaddr *ifa;
   5039         1.9    itojun 	struct sockaddr_in6 *sin6;
   5040         1.9    itojun 
   5041         1.9    itojun 	/*
   5042         1.9    itojun 	 * Pick the first link-local AF_INET6 address from the list,
   5043         1.9    itojun 	 * aliases don't make any sense on a p2p link anyway.
   5044         1.9    itojun 	 */
   5045         1.9    itojun 
   5046         1.9    itojun 	sin6 = NULL;
   5047        1.81      matt 	IFADDR_FOREACH(ifa, ifp)
   5048         1.9    itojun 	{
   5049         1.9    itojun 		if (ifa->ifa_addr->sa_family == AF_INET6)
   5050         1.9    itojun 		{
   5051         1.9    itojun 			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
   5052         1.9    itojun 			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
   5053         1.9    itojun 				break;
   5054         1.9    itojun 		}
   5055         1.9    itojun 	}
   5056         1.9    itojun 
   5057         1.9    itojun 	if (ifa && sin6)
   5058         1.9    itojun 	{
   5059         1.9    itojun 		int error;
   5060         1.9    itojun 		struct sockaddr_in6 new_sin6 = *sin6;
   5061         1.9    itojun 
   5062         1.9    itojun 		bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr));
   5063         1.9    itojun 		error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
   5064         1.9    itojun 		if (debug && error)
   5065         1.9    itojun 		{
   5066        1.64    itojun 			log(LOG_DEBUG, "%s: sppp_set_ip6_addr: in6_ifinit "
   5067        1.64    itojun 			" failed, error=%d\n", ifp->if_xname, error);
   5068         1.9    itojun 		}
   5069        1.78      yamt #ifdef PFIL_HOOKS
   5070        1.78      yamt 		if (!error)
   5071        1.78      yamt 			(void)pfil_run_hooks(&if_pfil,
   5072        1.78      yamt 			    (struct mbuf **)SIOCAIFADDR_IN6, ifp, PFIL_IFADDR);
   5073        1.78      yamt #endif
   5074         1.9    itojun 	}
   5075         1.9    itojun }
   5076         1.9    itojun #endif
   5077         1.9    itojun 
   5078         1.9    itojun /*
   5079         1.9    itojun  * Suggest a candidate address to be used by peer.
   5080         1.9    itojun  */
   5081         1.9    itojun static void
   5082         1.9    itojun sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
   5083         1.9    itojun {
   5084         1.9    itojun 	struct in6_addr myaddr;
   5085        1.10    itojun 	struct timeval tv;
   5086         1.9    itojun 
   5087         1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   5088         1.9    itojun 
   5089         1.9    itojun 	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
   5090        1.10    itojun 	microtime(&tv);
   5091        1.10    itojun 	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
   5092        1.10    itojun 		myaddr.s6_addr[14] ^= 0xff;
   5093        1.10    itojun 		myaddr.s6_addr[15] ^= 0xff;
   5094        1.10    itojun 	} else {
   5095        1.10    itojun 		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
   5096        1.10    itojun 		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
   5097        1.10    itojun 	}
   5098         1.9    itojun 	if (suggest)
   5099         1.9    itojun 		bcopy(&myaddr, suggest, sizeof(myaddr));
   5100         1.9    itojun }
   5101         1.9    itojun #endif /*INET6*/
   5102         1.9    itojun 
   5103        1.36    martin /*
   5104        1.36    martin  * Process ioctl requests specific to the PPP interface.
   5105        1.36    martin  * Permissions have already been checked.
   5106        1.36    martin  */
   5107         1.3  explorer static int
   5108  1.109.12.1  wrstuden sppp_params(struct sppp *sp, u_long cmd, void *data)
   5109         1.3  explorer {
   5110        1.36    martin 	switch (cmd) {
   5111        1.36    martin 	case SPPPGETAUTHCFG:
   5112        1.36    martin 	    {
   5113        1.42  jdolecek 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
   5114        1.42  jdolecek 		int error;
   5115        1.42  jdolecek 		size_t len;
   5116        1.42  jdolecek 
   5117        1.36    martin 		cfg->myauthflags = sp->myauth.flags;
   5118        1.36    martin 		cfg->hisauthflags = sp->hisauth.flags;
   5119        1.36    martin 		strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ);
   5120        1.36    martin 		cfg->hisauth = 0;
   5121        1.36    martin 		if (sp->hisauth.proto)
   5122        1.42  jdolecek 		    cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   5123        1.36    martin 		cfg->myauth = 0;
   5124        1.36    martin 		if (sp->myauth.proto)
   5125        1.42  jdolecek 		    cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   5126        1.36    martin 		if (cfg->myname_length == 0) {
   5127        1.36    martin 		    if (sp->myauth.name != NULL)
   5128        1.54  christos 			cfg->myname_length = sp->myauth.name_len + 1;
   5129        1.36    martin 		} else {
   5130        1.41    martin 		    if (sp->myauth.name == NULL) {
   5131        1.41    martin 			cfg->myname_length = 0;
   5132        1.41    martin 		    } else {
   5133        1.54  christos 			len = sp->myauth.name_len + 1;
   5134        1.41    martin 			if (cfg->myname_length < len)
   5135        1.42  jdolecek 			    return (ENAMETOOLONG);
   5136        1.42  jdolecek 			error = copyout(sp->myauth.name, cfg->myname, len);
   5137        1.42  jdolecek 			if (error) return error;
   5138        1.41    martin 		    }
   5139        1.36    martin 		}
   5140        1.36    martin 		if (cfg->hisname_length == 0) {
   5141        1.70    itojun 		    if (sp->hisauth.name != NULL)
   5142        1.54  christos 			cfg->hisname_length = sp->hisauth.name_len + 1;
   5143        1.36    martin 		} else {
   5144        1.41    martin 		    if (sp->hisauth.name == NULL) {
   5145        1.41    martin 		    	cfg->hisname_length = 0;
   5146        1.41    martin 		    } else {
   5147        1.54  christos 			len = sp->hisauth.name_len + 1;
   5148        1.41    martin 			if (cfg->hisname_length < len)
   5149        1.42  jdolecek 			    return (ENAMETOOLONG);
   5150        1.42  jdolecek 			error = copyout(sp->hisauth.name, cfg->hisname, len);
   5151        1.42  jdolecek 			if (error) return error;
   5152        1.41    martin 		    }
   5153         1.3  explorer 		}
   5154        1.36    martin 	    }
   5155        1.36    martin 	    break;
   5156        1.36    martin 	case SPPPSETAUTHCFG:
   5157        1.36    martin 	    {
   5158        1.59    itojun 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
   5159        1.42  jdolecek 		int error;
   5160         1.3  explorer 
   5161        1.42  jdolecek 		if (sp->myauth.name) {
   5162        1.42  jdolecek 			free(sp->myauth.name, M_DEVBUF);
   5163        1.42  jdolecek 			sp->myauth.name = NULL;
   5164        1.42  jdolecek 		}
   5165        1.42  jdolecek 		if (sp->myauth.secret) {
   5166        1.42  jdolecek 			free(sp->myauth.secret, M_DEVBUF);
   5167        1.42  jdolecek 			sp->myauth.secret = NULL;
   5168        1.42  jdolecek 		}
   5169        1.42  jdolecek 		if (sp->hisauth.name) {
   5170        1.42  jdolecek 			free(sp->hisauth.name, M_DEVBUF);
   5171        1.42  jdolecek 			sp->hisauth.name = NULL;
   5172        1.42  jdolecek 		}
   5173        1.42  jdolecek 		if (sp->hisauth.secret) {
   5174        1.42  jdolecek 			free(sp->hisauth.secret, M_DEVBUF);
   5175        1.42  jdolecek 			sp->hisauth.secret = NULL;
   5176        1.42  jdolecek 		}
   5177        1.36    martin 
   5178        1.41    martin 		if (cfg->hisname != NULL && cfg->hisname_length > 0) {
   5179        1.41    martin 		    if (cfg->hisname_length >= MCLBYTES)
   5180        1.42  jdolecek 			return (ENAMETOOLONG);
   5181        1.36    martin 		    sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK);
   5182        1.42  jdolecek 		    error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length);
   5183        1.42  jdolecek 		    if (error) {
   5184        1.41    martin 			free(sp->hisauth.name, M_DEVBUF);
   5185        1.41    martin 			sp->hisauth.name = NULL;
   5186        1.42  jdolecek 			return error;
   5187        1.41    martin 		    }
   5188        1.55  christos 		    sp->hisauth.name_len = cfg->hisname_length - 1;
   5189        1.55  christos 		    sp->hisauth.name[sp->hisauth.name_len] = 0;
   5190        1.36    martin 		}
   5191        1.41    martin 		if (cfg->hissecret != NULL && cfg->hissecret_length > 0) {
   5192        1.41    martin 		    if (cfg->hissecret_length >= MCLBYTES)
   5193        1.42  jdolecek 			return (ENAMETOOLONG);
   5194        1.36    martin 		    sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK);
   5195        1.42  jdolecek 		    error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length);
   5196        1.42  jdolecek 		    if (error) {
   5197        1.41    martin 		    	free(sp->hisauth.secret, M_DEVBUF);
   5198        1.41    martin 		    	sp->hisauth.secret = NULL;
   5199        1.42  jdolecek 			return error;
   5200        1.41    martin 		    }
   5201        1.55  christos 		    sp->hisauth.secret_len = cfg->hissecret_length - 1;
   5202        1.55  christos 		    sp->hisauth.secret[sp->hisauth.secret_len] = 0;
   5203        1.36    martin 		}
   5204        1.41    martin 		if (cfg->myname != NULL && cfg->myname_length > 0) {
   5205        1.41    martin 		    if (cfg->myname_length >= MCLBYTES)
   5206        1.42  jdolecek 			return (ENAMETOOLONG);
   5207        1.36    martin 		    sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK);
   5208        1.42  jdolecek 		    error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length);
   5209        1.42  jdolecek 		    if (error) {
   5210        1.41    martin 			free(sp->myauth.name, M_DEVBUF);
   5211        1.41    martin 			sp->myauth.name = NULL;
   5212        1.42  jdolecek 			return error;
   5213        1.41    martin 		    }
   5214        1.55  christos 		    sp->myauth.name_len = cfg->myname_length - 1;
   5215        1.55  christos 		    sp->myauth.name[sp->myauth.name_len] = 0;
   5216        1.36    martin 		}
   5217        1.41    martin 		if (cfg->mysecret != NULL && cfg->mysecret_length > 0) {
   5218        1.41    martin 		    if (cfg->mysecret_length >= MCLBYTES)
   5219        1.42  jdolecek 			return (ENAMETOOLONG);
   5220        1.36    martin 		    sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK);
   5221        1.42  jdolecek 		    error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length);
   5222        1.42  jdolecek 		    if (error) {
   5223        1.41    martin 		    	free(sp->myauth.secret, M_DEVBUF);
   5224        1.41    martin 		    	sp->myauth.secret = NULL;
   5225        1.42  jdolecek 			return error;
   5226        1.41    martin 		    }
   5227        1.55  christos 		    sp->myauth.secret_len = cfg->mysecret_length - 1;
   5228        1.55  christos 		    sp->myauth.secret[sp->myauth.secret_len] = 0;
   5229        1.36    martin 		}
   5230        1.36    martin 		sp->myauth.flags = cfg->myauthflags;
   5231        1.36    martin 		if (cfg->myauth)
   5232        1.42  jdolecek 		    sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5233        1.36    martin 		sp->hisauth.flags = cfg->hisauthflags;
   5234        1.36    martin 		if (cfg->hisauth)
   5235        1.42  jdolecek 		    sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5236        1.39    martin 		sp->pp_auth_failures = 0;
   5237        1.82     perry 		if (sp->hisauth.proto != 0)
   5238        1.55  christos 		    sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
   5239        1.55  christos 		else
   5240        1.55  christos 		    sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   5241        1.36    martin 	    }
   5242        1.36    martin 	    break;
   5243        1.36    martin 	case SPPPGETLCPCFG:
   5244        1.36    martin 	    {
   5245        1.85  christos 	    	struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
   5246        1.85  christos 	    	lcpp->lcp_timeout = sp->lcp.timeout;
   5247        1.36    martin 	    }
   5248        1.36    martin 	    break;
   5249        1.36    martin 	case SPPPSETLCPCFG:
   5250        1.36    martin 	    {
   5251        1.85  christos 	    	struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
   5252        1.85  christos 	    	sp->lcp.timeout = lcpp->lcp_timeout;
   5253        1.36    martin 	    }
   5254        1.36    martin 	    break;
   5255        1.36    martin 	case SPPPGETSTATUS:
   5256        1.36    martin 	    {
   5257        1.42  jdolecek 		struct spppstatus *status = (struct spppstatus *)data;
   5258        1.36    martin 		status->phase = sp->pp_phase;
   5259        1.38    martin 	    }
   5260        1.38    martin 	    break;
   5261        1.75    martin 	case SPPPGETSTATUSNCP:
   5262        1.75    martin 	    {
   5263        1.75    martin 		struct spppstatusncp *status = (struct spppstatusncp *)data;
   5264        1.75    martin 		status->phase = sp->pp_phase;
   5265        1.75    martin 		status->ncpup = sppp_ncp_check(sp);
   5266        1.75    martin 	    }
   5267        1.75    martin 	    break;
   5268        1.38    martin 	case SPPPGETIDLETO:
   5269        1.38    martin 	    {
   5270        1.42  jdolecek 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5271        1.38    martin 		to->idle_seconds = sp->pp_idle_timeout;
   5272        1.38    martin 	    }
   5273        1.38    martin 	    break;
   5274        1.38    martin 	case SPPPSETIDLETO:
   5275        1.38    martin 	    {
   5276        1.42  jdolecek 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5277        1.38    martin 	    	sp->pp_idle_timeout = to->idle_seconds;
   5278        1.39    martin 	    }
   5279        1.39    martin 	    break;
   5280        1.39    martin 	case SPPPSETAUTHFAILURE:
   5281        1.39    martin 	    {
   5282        1.42  jdolecek 	    	struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data;
   5283        1.39    martin 	    	sp->pp_max_auth_fail = afsettings->max_failures;
   5284        1.39    martin 	    	sp->pp_auth_failures = 0;
   5285        1.39    martin 	    }
   5286        1.39    martin 	    break;
   5287        1.39    martin 	case SPPPGETAUTHFAILURES:
   5288        1.39    martin 	    {
   5289        1.42  jdolecek 	    	struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data;
   5290        1.39    martin 	    	stats->auth_failures = sp->pp_auth_failures;
   5291        1.39    martin 	    	stats->max_failures = sp->pp_max_auth_fail;
   5292        1.45    martin 	    }
   5293        1.45    martin 	    break;
   5294        1.45    martin 	case SPPPSETDNSOPTS:
   5295        1.45    martin 	    {
   5296        1.59    itojun 		struct spppdnssettings *req = (struct spppdnssettings *)data;
   5297        1.45    martin 		sp->query_dns = req->query_dns & 3;
   5298        1.45    martin 	    }
   5299        1.45    martin 	    break;
   5300        1.45    martin 	case SPPPGETDNSOPTS:
   5301        1.45    martin 	    {
   5302        1.59    itojun 		struct spppdnssettings *req = (struct spppdnssettings *)data;
   5303        1.45    martin 		req->query_dns = sp->query_dns;
   5304        1.45    martin 	    }
   5305        1.45    martin 	    break;
   5306        1.45    martin 	case SPPPGETDNSADDRS:
   5307        1.45    martin 	    {
   5308        1.59    itojun 	    	struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data;
   5309        1.45    martin 	    	memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns);
   5310        1.68    martin 	    }
   5311        1.68    martin 	    break;
   5312        1.68    martin 	case SPPPGETKEEPALIVE:
   5313        1.68    martin 	    {
   5314        1.68    martin 	    	struct spppkeepalivesettings *settings =
   5315        1.68    martin 		     (struct spppkeepalivesettings*)data;
   5316        1.68    martin 		settings->maxalive = sp->pp_maxalive;
   5317        1.68    martin 		settings->max_noreceive = sp->pp_max_noreceive;
   5318        1.68    martin 	    }
   5319        1.68    martin 	    break;
   5320        1.68    martin 	case SPPPSETKEEPALIVE:
   5321        1.68    martin 	    {
   5322        1.68    martin 	    	struct spppkeepalivesettings *settings =
   5323        1.68    martin 		     (struct spppkeepalivesettings*)data;
   5324        1.68    martin 		sp->pp_maxalive = settings->maxalive;
   5325        1.68    martin 		sp->pp_max_noreceive = settings->max_noreceive;
   5326        1.36    martin 	    }
   5327        1.36    martin 	    break;
   5328         1.3  explorer 	default:
   5329        1.42  jdolecek 		return (EINVAL);
   5330         1.3  explorer 	}
   5331         1.3  explorer 
   5332        1.42  jdolecek 	return (0);
   5333         1.3  explorer }
   5334         1.3  explorer 
   5335         1.3  explorer static void
   5336         1.3  explorer sppp_phase_network(struct sppp *sp)
   5337         1.3  explorer {
   5338         1.3  explorer 	STDDCL;
   5339         1.3  explorer 	int i;
   5340       1.109      matt 	uint32_t mask;
   5341         1.3  explorer 
   5342        1.36    martin 	sp->pp_phase = SPPP_PHASE_NETWORK;
   5343         1.3  explorer 
   5344        1.70    itojun 	if (debug)
   5345         1.3  explorer 	{
   5346        1.64    itojun 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
   5347         1.3  explorer 			sppp_phase_name(sp->pp_phase));
   5348         1.3  explorer 	}
   5349         1.3  explorer 
   5350         1.3  explorer 	/* Notify NCPs now. */
   5351         1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   5352         1.3  explorer 		if ((cps[i])->flags & CP_NCP)
   5353         1.3  explorer 			(cps[i])->Open(sp);
   5354         1.3  explorer 
   5355         1.3  explorer 	/* Send Up events to all NCPs. */
   5356         1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   5357        1.13    itojun 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP))
   5358         1.3  explorer 			(cps[i])->Up(sp);
   5359         1.3  explorer 
   5360         1.3  explorer 	/* if no NCP is starting, all this was in vain, close down */
   5361         1.3  explorer 	sppp_lcp_check_and_close(sp);
   5362         1.3  explorer }
   5363        1.82     perry 
   5364         1.3  explorer 
   5365         1.3  explorer static const char *
   5366         1.3  explorer sppp_cp_type_name(u_char type)
   5367         1.1  explorer {
   5368         1.3  explorer 	static char buf[12];
   5369         1.1  explorer 	switch (type) {
   5370         1.3  explorer 	case CONF_REQ:   return "conf-req";
   5371         1.3  explorer 	case CONF_ACK:   return "conf-ack";
   5372         1.3  explorer 	case CONF_NAK:   return "conf-nak";
   5373         1.3  explorer 	case CONF_REJ:   return "conf-rej";
   5374         1.3  explorer 	case TERM_REQ:   return "term-req";
   5375         1.3  explorer 	case TERM_ACK:   return "term-ack";
   5376         1.3  explorer 	case CODE_REJ:   return "code-rej";
   5377         1.3  explorer 	case PROTO_REJ:  return "proto-rej";
   5378         1.3  explorer 	case ECHO_REQ:   return "echo-req";
   5379         1.3  explorer 	case ECHO_REPLY: return "echo-reply";
   5380         1.3  explorer 	case DISC_REQ:   return "discard-req";
   5381         1.3  explorer 	}
   5382        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", type);
   5383         1.3  explorer 	return buf;
   5384         1.3  explorer }
   5385         1.3  explorer 
   5386         1.3  explorer static const char *
   5387         1.3  explorer sppp_auth_type_name(u_short proto, u_char type)
   5388         1.3  explorer {
   5389         1.3  explorer 	static char buf[12];
   5390         1.3  explorer 	switch (proto) {
   5391         1.3  explorer 	case PPP_CHAP:
   5392         1.3  explorer 		switch (type) {
   5393         1.3  explorer 		case CHAP_CHALLENGE:	return "challenge";
   5394         1.3  explorer 		case CHAP_RESPONSE:	return "response";
   5395         1.3  explorer 		case CHAP_SUCCESS:	return "success";
   5396         1.3  explorer 		case CHAP_FAILURE:	return "failure";
   5397         1.3  explorer 		}
   5398         1.3  explorer 	case PPP_PAP:
   5399         1.3  explorer 		switch (type) {
   5400         1.3  explorer 		case PAP_REQ:		return "req";
   5401         1.3  explorer 		case PAP_ACK:		return "ack";
   5402         1.3  explorer 		case PAP_NAK:		return "nak";
   5403         1.3  explorer 		}
   5404         1.3  explorer 	}
   5405        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", type);
   5406         1.3  explorer 	return buf;
   5407         1.3  explorer }
   5408         1.3  explorer 
   5409         1.3  explorer static const char *
   5410         1.3  explorer sppp_lcp_opt_name(u_char opt)
   5411         1.3  explorer {
   5412         1.3  explorer 	static char buf[12];
   5413         1.3  explorer 	switch (opt) {
   5414         1.3  explorer 	case LCP_OPT_MRU:		return "mru";
   5415         1.3  explorer 	case LCP_OPT_ASYNC_MAP:		return "async-map";
   5416         1.3  explorer 	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
   5417         1.3  explorer 	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
   5418         1.3  explorer 	case LCP_OPT_MAGIC:		return "magic";
   5419         1.3  explorer 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
   5420         1.3  explorer 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
   5421         1.3  explorer 	}
   5422        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   5423         1.3  explorer 	return buf;
   5424         1.3  explorer }
   5425         1.3  explorer 
   5426         1.3  explorer static const char *
   5427         1.3  explorer sppp_ipcp_opt_name(u_char opt)
   5428         1.3  explorer {
   5429         1.3  explorer 	static char buf[12];
   5430         1.3  explorer 	switch (opt) {
   5431         1.3  explorer 	case IPCP_OPT_ADDRESSES:	return "addresses";
   5432         1.3  explorer 	case IPCP_OPT_COMPRESSION:	return "compression";
   5433         1.3  explorer 	case IPCP_OPT_ADDRESS:		return "address";
   5434         1.3  explorer 	}
   5435        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   5436         1.3  explorer 	return buf;
   5437         1.3  explorer }
   5438         1.3  explorer 
   5439         1.9    itojun #ifdef INET6
   5440         1.9    itojun static const char *
   5441         1.9    itojun sppp_ipv6cp_opt_name(u_char opt)
   5442         1.9    itojun {
   5443         1.9    itojun 	static char buf[12];
   5444         1.9    itojun 	switch (opt) {
   5445         1.9    itojun 	case IPV6CP_OPT_IFID:		return "ifid";
   5446         1.9    itojun 	case IPV6CP_OPT_COMPRESSION:	return "compression";
   5447         1.9    itojun 	}
   5448        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   5449         1.9    itojun 	return buf;
   5450         1.9    itojun }
   5451         1.9    itojun #endif
   5452         1.9    itojun 
   5453         1.3  explorer static const char *
   5454         1.3  explorer sppp_state_name(int state)
   5455         1.3  explorer {
   5456         1.3  explorer 	switch (state) {
   5457         1.3  explorer 	case STATE_INITIAL:	return "initial";
   5458         1.3  explorer 	case STATE_STARTING:	return "starting";
   5459         1.3  explorer 	case STATE_CLOSED:	return "closed";
   5460         1.3  explorer 	case STATE_STOPPED:	return "stopped";
   5461         1.3  explorer 	case STATE_CLOSING:	return "closing";
   5462         1.3  explorer 	case STATE_STOPPING:	return "stopping";
   5463         1.3  explorer 	case STATE_REQ_SENT:	return "req-sent";
   5464         1.3  explorer 	case STATE_ACK_RCVD:	return "ack-rcvd";
   5465         1.3  explorer 	case STATE_ACK_SENT:	return "ack-sent";
   5466         1.3  explorer 	case STATE_OPENED:	return "opened";
   5467         1.3  explorer 	}
   5468         1.3  explorer 	return "illegal";
   5469         1.3  explorer }
   5470         1.3  explorer 
   5471         1.3  explorer static const char *
   5472        1.36    martin sppp_phase_name(int phase)
   5473         1.3  explorer {
   5474         1.3  explorer 	switch (phase) {
   5475        1.36    martin 	case SPPP_PHASE_DEAD:		return "dead";
   5476        1.36    martin 	case SPPP_PHASE_ESTABLISH:	return "establish";
   5477        1.36    martin 	case SPPP_PHASE_TERMINATE:	return "terminate";
   5478        1.36    martin 	case SPPP_PHASE_AUTHENTICATE: 	return "authenticate";
   5479        1.36    martin 	case SPPP_PHASE_NETWORK:	return "network";
   5480         1.3  explorer 	}
   5481         1.3  explorer 	return "illegal";
   5482         1.3  explorer }
   5483         1.3  explorer 
   5484         1.3  explorer static const char *
   5485         1.3  explorer sppp_proto_name(u_short proto)
   5486         1.3  explorer {
   5487         1.3  explorer 	static char buf[12];
   5488         1.3  explorer 	switch (proto) {
   5489         1.3  explorer 	case PPP_LCP:	return "lcp";
   5490         1.3  explorer 	case PPP_IPCP:	return "ipcp";
   5491         1.3  explorer 	case PPP_PAP:	return "pap";
   5492         1.3  explorer 	case PPP_CHAP:	return "chap";
   5493         1.9    itojun 	case PPP_IPV6CP: return "ipv6cp";
   5494         1.1  explorer 	}
   5495        1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto);
   5496         1.3  explorer 	return buf;
   5497         1.1  explorer }
   5498         1.1  explorer 
   5499         1.1  explorer static void
   5500         1.3  explorer sppp_print_bytes(const u_char *p, u_short len)
   5501         1.1  explorer {
   5502         1.3  explorer 	addlog(" %02x", *p++);
   5503         1.1  explorer 	while (--len > 0)
   5504         1.3  explorer 		addlog("-%02x", *p++);
   5505         1.3  explorer }
   5506         1.3  explorer 
   5507         1.3  explorer static void
   5508         1.3  explorer sppp_print_string(const char *p, u_short len)
   5509         1.3  explorer {
   5510         1.3  explorer 	u_char c;
   5511         1.3  explorer 
   5512         1.3  explorer 	while (len-- > 0) {
   5513         1.3  explorer 		c = *p++;
   5514         1.3  explorer 		/*
   5515         1.3  explorer 		 * Print only ASCII chars directly.  RFC 1994 recommends
   5516         1.3  explorer 		 * using only them, but we don't rely on it.  */
   5517         1.3  explorer 		if (c < ' ' || c > '~')
   5518         1.3  explorer 			addlog("\\x%x", c);
   5519         1.3  explorer 		else
   5520         1.3  explorer 			addlog("%c", c);
   5521         1.3  explorer 	}
   5522         1.3  explorer }
   5523         1.3  explorer 
   5524         1.3  explorer static const char *
   5525       1.109      matt sppp_dotted_quad(uint32_t addr)
   5526         1.3  explorer {
   5527         1.3  explorer 	static char s[16];
   5528        1.77    itojun 	snprintf(s, sizeof(s), "%d.%d.%d.%d",
   5529         1.3  explorer 		(int)((addr >> 24) & 0xff),
   5530         1.3  explorer 		(int)((addr >> 16) & 0xff),
   5531         1.3  explorer 		(int)((addr >> 8) & 0xff),
   5532         1.3  explorer 		(int)(addr & 0xff));
   5533         1.3  explorer 	return s;
   5534         1.3  explorer }
   5535         1.3  explorer 
   5536         1.3  explorer /* a dummy, used to drop uninteresting events */
   5537         1.3  explorer static void
   5538       1.101  christos sppp_null(struct sppp *unused)
   5539         1.3  explorer {
   5540         1.3  explorer 	/* do just nothing */
   5541         1.1  explorer }
   5542         1.3  explorer /*
   5543         1.3  explorer  * This file is large.  Tell emacs to highlight it nevertheless.
   5544         1.3  explorer  *
   5545         1.3  explorer  * Local Variables:
   5546         1.3  explorer  * hilit-auto-highlight-maxout: 120000
   5547         1.3  explorer  * End:
   5548         1.3  explorer  */
   5549