Home | History | Annotate | Line # | Download | only in net
if_spppsubr.c revision 1.165.2.1
      1  1.165.2.1    bouyer /*	$NetBSD: if_spppsubr.c,v 1.165.2.1 2017/04/21 16:54:05 bouyer Exp $	 */
      2        1.4  explorer 
      3        1.1  explorer /*
      4        1.1  explorer  * Synchronous PPP/Cisco link level subroutines.
      5        1.1  explorer  * Keepalive protocol implemented in both Cisco and PPP modes.
      6        1.1  explorer  *
      7        1.3  explorer  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
      8        1.3  explorer  * Author: Serge Vakulenko, <vak (at) cronyx.ru>
      9        1.3  explorer  *
     10        1.3  explorer  * Heavily revamped to conform to RFC 1661.
     11        1.3  explorer  * Copyright (C) 1997, Joerg Wunsch.
     12        1.1  explorer  *
     13        1.9    itojun  * RFC2472 IPv6CP support.
     14        1.9    itojun  * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>.
     15        1.9    itojun  *
     16       1.60    itojun  * Redistribution and use in source and binary forms, with or without
     17       1.60    itojun  * modification, are permitted provided that the following conditions are met:
     18       1.60    itojun  * 1. Redistributions of source code must retain the above copyright notice,
     19       1.60    itojun  *    this list of conditions and the following disclaimer.
     20       1.60    itojun  * 2. Redistributions in binary form must reproduce the above copyright notice,
     21       1.60    itojun  *    this list of conditions and the following disclaimer in the documentation
     22       1.60    itojun  *    and/or other materials provided with the distribution.
     23       1.60    itojun  *
     24       1.82     perry  * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
     25       1.82     perry  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     26       1.60    itojun  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     27       1.60    itojun  * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
     28       1.60    itojun  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     29       1.60    itojun  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     30       1.60    itojun  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     31       1.60    itojun  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     32       1.60    itojun  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     33       1.82     perry  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     34       1.60    itojun  * POSSIBILITY OF SUCH DAMAGE.
     35        1.1  explorer  *
     36        1.3  explorer  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
     37        1.3  explorer  *
     38        1.3  explorer  * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp
     39        1.3  explorer  *
     40        1.4  explorer  * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp
     41        1.1  explorer  */
     42       1.29     lukem 
     43       1.29     lukem #include <sys/cdefs.h>
     44  1.165.2.1    bouyer __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.165.2.1 2017/04/21 16:54:05 bouyer Exp $");
     45        1.1  explorer 
     46      1.120  jmcneill #if defined(_KERNEL_OPT)
     47        1.1  explorer #include "opt_inet.h"
     48      1.120  jmcneill #include "opt_modular.h"
     49      1.120  jmcneill #include "opt_compat_netbsd.h"
     50      1.157  knakahar #include "opt_net_mpsafe.h"
     51      1.120  jmcneill #endif
     52      1.120  jmcneill 
     53        1.1  explorer 
     54        1.1  explorer #include <sys/param.h>
     55       1.36    martin #include <sys/proc.h>
     56        1.1  explorer #include <sys/systm.h>
     57        1.1  explorer #include <sys/kernel.h>
     58        1.3  explorer #include <sys/sockio.h>
     59        1.1  explorer #include <sys/socket.h>
     60        1.3  explorer #include <sys/syslog.h>
     61        1.3  explorer #include <sys/malloc.h>
     62        1.1  explorer #include <sys/mbuf.h>
     63       1.36    martin #include <sys/callout.h>
     64        1.3  explorer #include <sys/md5.h>
     65       1.63      tron #include <sys/inttypes.h>
     66       1.90      elad #include <sys/kauth.h>
     67      1.124       tls #include <sys/cprng.h>
     68      1.147  pgoyette #include <sys/module.h>
     69      1.159  knakahar #include <sys/workqueue.h>
     70      1.159  knakahar #include <sys/atomic.h>
     71        1.3  explorer 
     72        1.1  explorer #include <net/if.h>
     73        1.1  explorer #include <net/netisr.h>
     74        1.1  explorer #include <net/if_types.h>
     75        1.3  explorer #include <net/route.h>
     76       1.11  sommerfe #include <net/ppp_defs.h>
     77        1.3  explorer 
     78        1.1  explorer #include <netinet/in.h>
     79        1.1  explorer #include <netinet/in_systm.h>
     80        1.1  explorer #include <netinet/in_var.h>
     81       1.12    itojun #ifdef INET
     82        1.1  explorer #include <netinet/ip.h>
     83        1.1  explorer #include <netinet/tcp.h>
     84       1.12    itojun #endif
     85        1.3  explorer #include <net/ethertypes.h>
     86        1.1  explorer 
     87       1.87    rpaulo #ifdef INET6
     88       1.87    rpaulo #include <netinet6/scope6_var.h>
     89       1.87    rpaulo #endif
     90       1.87    rpaulo 
     91        1.1  explorer #include <net/if_sppp.h>
     92       1.36    martin #include <net/if_spppvar.h>
     93        1.1  explorer 
     94      1.163  knakahar #ifdef NET_MPSAFE
     95      1.163  knakahar #define SPPPSUBR_MPSAFE	1
     96      1.163  knakahar #endif
     97      1.163  knakahar 
     98       1.68    martin #define	LCP_KEEPALIVE_INTERVAL		10	/* seconds between checks */
     99       1.68    martin #define LOOPALIVECNT     		3	/* loopback detection tries */
    100       1.68    martin #define DEFAULT_MAXALIVECNT    		3	/* max. missed alive packets */
    101       1.68    martin #define	DEFAULT_NORECV_TIME		15	/* before we get worried */
    102       1.39    martin #define DEFAULT_MAX_AUTH_FAILURES	5	/* max. auth. failures */
    103        1.1  explorer 
    104        1.3  explorer /*
    105        1.3  explorer  * Interface flags that can be set in an ifconfig command.
    106        1.3  explorer  *
    107        1.3  explorer  * Setting link0 will make the link passive, i.e. it will be marked
    108        1.3  explorer  * as being administrative openable, but won't be opened to begin
    109        1.3  explorer  * with.  Incoming calls will be answered, or subsequent calls with
    110        1.3  explorer  * -link1 will cause the administrative open of the LCP layer.
    111        1.3  explorer  *
    112        1.3  explorer  * Setting link1 will cause the link to auto-dial only as packets
    113        1.3  explorer  * arrive to be sent.
    114        1.3  explorer  *
    115        1.3  explorer  * Setting IFF_DEBUG will syslog the option negotiation and state
    116        1.3  explorer  * transitions at level kern.debug.  Note: all logs consistently look
    117        1.3  explorer  * like
    118        1.3  explorer  *
    119        1.3  explorer  *   <if-name><unit>: <proto-name> <additional info...>
    120        1.3  explorer  *
    121        1.3  explorer  * with <if-name><unit> being something like "bppp0", and <proto-name>
    122        1.3  explorer  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
    123        1.3  explorer  */
    124        1.3  explorer 
    125        1.3  explorer #define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
    126        1.3  explorer #define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
    127        1.3  explorer 
    128        1.3  explorer #define CONF_REQ	1		/* PPP configure request */
    129        1.3  explorer #define CONF_ACK	2		/* PPP configure acknowledge */
    130        1.3  explorer #define CONF_NAK	3		/* PPP configure negative ack */
    131        1.3  explorer #define CONF_REJ	4		/* PPP configure reject */
    132        1.3  explorer #define TERM_REQ	5		/* PPP terminate request */
    133        1.3  explorer #define TERM_ACK	6		/* PPP terminate acknowledge */
    134        1.3  explorer #define CODE_REJ	7		/* PPP code reject */
    135        1.3  explorer #define PROTO_REJ	8		/* PPP protocol reject */
    136        1.3  explorer #define ECHO_REQ	9		/* PPP echo request */
    137        1.3  explorer #define ECHO_REPLY	10		/* PPP echo reply */
    138        1.3  explorer #define DISC_REQ	11		/* PPP discard request */
    139        1.3  explorer 
    140        1.3  explorer #define LCP_OPT_MRU		1	/* maximum receive unit */
    141        1.3  explorer #define LCP_OPT_ASYNC_MAP	2	/* async control character map */
    142        1.3  explorer #define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
    143        1.3  explorer #define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
    144        1.3  explorer #define LCP_OPT_MAGIC		5	/* magic number */
    145        1.3  explorer #define LCP_OPT_RESERVED	6	/* reserved */
    146        1.3  explorer #define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
    147        1.3  explorer #define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
    148        1.3  explorer 
    149        1.3  explorer #define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
    150       1.14    itojun #define IPCP_OPT_COMPRESSION	2	/* IP compression protocol */
    151        1.3  explorer #define IPCP_OPT_ADDRESS	3	/* local IP address */
    152       1.31    martin #define	IPCP_OPT_PRIMDNS	129	/* primary remote dns address */
    153       1.31    martin #define	IPCP_OPT_SECDNS		131	/* secondary remote dns address */
    154        1.3  explorer 
    155      1.161  knakahar #define IPCP_UPDATE_LIMIT	8	/* limit of pending IP updating job */
    156      1.161  knakahar #define IPCP_SET_ADDRS		1	/* marker for IP address setting job */
    157      1.161  knakahar #define IPCP_CLEAR_ADDRS	2	/* marker for IP address clearing job */
    158      1.161  knakahar 
    159        1.9    itojun #define IPV6CP_OPT_IFID		1	/* interface identifier */
    160        1.9    itojun #define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
    161        1.9    itojun 
    162        1.3  explorer #define PAP_REQ			1	/* PAP name/password request */
    163        1.3  explorer #define PAP_ACK			2	/* PAP acknowledge */
    164        1.3  explorer #define PAP_NAK			3	/* PAP fail */
    165        1.3  explorer 
    166        1.3  explorer #define CHAP_CHALLENGE		1	/* CHAP challenge request */
    167        1.3  explorer #define CHAP_RESPONSE		2	/* CHAP challenge response */
    168        1.3  explorer #define CHAP_SUCCESS		3	/* CHAP response ok */
    169        1.3  explorer #define CHAP_FAILURE		4	/* CHAP response failed */
    170        1.3  explorer 
    171        1.3  explorer #define CHAP_MD5		5	/* hash algorithm - MD5 */
    172        1.3  explorer 
    173        1.3  explorer #define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
    174        1.3  explorer #define CISCO_UNICAST		0x0f	/* Cisco unicast address */
    175        1.3  explorer #define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
    176        1.3  explorer #define CISCO_ADDR_REQ		0	/* Cisco address request */
    177        1.3  explorer #define CISCO_ADDR_REPLY	1	/* Cisco address reply */
    178        1.3  explorer #define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
    179        1.3  explorer 
    180        1.3  explorer /* states are named and numbered according to RFC 1661 */
    181        1.3  explorer #define STATE_INITIAL	0
    182        1.3  explorer #define STATE_STARTING	1
    183        1.3  explorer #define STATE_CLOSED	2
    184        1.3  explorer #define STATE_STOPPED	3
    185        1.3  explorer #define STATE_CLOSING	4
    186        1.3  explorer #define STATE_STOPPING	5
    187        1.3  explorer #define STATE_REQ_SENT	6
    188        1.3  explorer #define STATE_ACK_RCVD	7
    189        1.3  explorer #define STATE_ACK_SENT	8
    190        1.3  explorer #define STATE_OPENED	9
    191        1.1  explorer 
    192        1.1  explorer struct ppp_header {
    193      1.109      matt 	uint8_t address;
    194      1.109      matt 	uint8_t control;
    195      1.109      matt 	uint16_t protocol;
    196      1.107     perry } __packed;
    197        1.1  explorer #define PPP_HEADER_LEN          sizeof (struct ppp_header)
    198        1.1  explorer 
    199        1.1  explorer struct lcp_header {
    200      1.109      matt 	uint8_t type;
    201      1.109      matt 	uint8_t ident;
    202      1.109      matt 	uint16_t len;
    203      1.107     perry } __packed;
    204        1.1  explorer #define LCP_HEADER_LEN          sizeof (struct lcp_header)
    205        1.1  explorer 
    206        1.1  explorer struct cisco_packet {
    207      1.109      matt 	uint32_t type;
    208      1.109      matt 	uint32_t par1;
    209      1.109      matt 	uint32_t par2;
    210      1.109      matt 	uint16_t rel;
    211      1.109      matt 	uint16_t time0;
    212      1.109      matt 	uint16_t time1;
    213      1.107     perry } __packed;
    214        1.1  explorer #define CISCO_PACKET_LEN 18
    215        1.1  explorer 
    216        1.3  explorer /*
    217        1.3  explorer  * We follow the spelling and capitalization of RFC 1661 here, to make
    218        1.3  explorer  * it easier comparing with the standard.  Please refer to this RFC in
    219        1.3  explorer  * case you can't make sense out of these abbreviation; it will also
    220        1.3  explorer  * explain the semantics related to the various events and actions.
    221        1.3  explorer  */
    222        1.3  explorer struct cp {
    223        1.3  explorer 	u_short	proto;		/* PPP control protocol number */
    224        1.3  explorer 	u_char protoidx;	/* index into state table in struct sppp */
    225        1.3  explorer 	u_char flags;
    226        1.3  explorer #define CP_LCP		0x01	/* this is the LCP */
    227        1.3  explorer #define CP_AUTH		0x02	/* this is an authentication protocol */
    228        1.3  explorer #define CP_NCP		0x04	/* this is a NCP */
    229        1.3  explorer #define CP_QUAL		0x08	/* this is a quality reporting protocol */
    230        1.3  explorer 	const char *name;	/* name of this control protocol */
    231        1.3  explorer 	/* event handlers */
    232        1.3  explorer 	void	(*Up)(struct sppp *sp);
    233        1.3  explorer 	void	(*Down)(struct sppp *sp);
    234        1.3  explorer 	void	(*Open)(struct sppp *sp);
    235        1.3  explorer 	void	(*Close)(struct sppp *sp);
    236        1.3  explorer 	void	(*TO)(void *sp);
    237        1.3  explorer 	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
    238        1.3  explorer 	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
    239        1.3  explorer 	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
    240        1.3  explorer 	/* actions */
    241        1.3  explorer 	void	(*tlu)(struct sppp *sp);
    242        1.3  explorer 	void	(*tld)(struct sppp *sp);
    243        1.3  explorer 	void	(*tls)(struct sppp *sp);
    244        1.3  explorer 	void	(*tlf)(struct sppp *sp);
    245        1.3  explorer 	void	(*scr)(struct sppp *sp);
    246        1.3  explorer };
    247        1.3  explorer 
    248        1.1  explorer static struct sppp *spppq;
    249      1.163  knakahar static kmutex_t *spppq_lock = NULL;
    250      1.106        ad static callout_t keepalive_ch;
    251        1.3  explorer 
    252      1.163  knakahar #define SPPPQ_LOCK()	if (spppq_lock) \
    253      1.163  knakahar 				mutex_enter(spppq_lock);
    254      1.163  knakahar #define SPPPQ_UNLOCK()	if (spppq_lock) \
    255      1.163  knakahar 				mutex_exit(spppq_lock);
    256      1.163  knakahar 
    257       1.12    itojun #ifdef INET
    258      1.163  knakahar #ifndef SPPPSUBR_MPSAFE
    259        1.1  explorer /*
    260        1.1  explorer  * The following disgusting hack gets around the problem that IP TOS
    261        1.1  explorer  * can't be set yet.  We want to put "interactive" traffic on a high
    262        1.1  explorer  * priority queue.  To decide if traffic is interactive, we check that
    263        1.1  explorer  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
    264        1.3  explorer  *
    265        1.3  explorer  * XXX is this really still necessary?  - joerg -
    266        1.1  explorer  */
    267        1.3  explorer static u_short interactive_ports[8] = {
    268        1.1  explorer 	0,	513,	0,	0,
    269        1.1  explorer 	0,	21,	0,	23,
    270        1.1  explorer };
    271       1.59    itojun #define INTERACTIVE(p)	(interactive_ports[(p) & 7] == (p))
    272      1.163  knakahar #endif /* SPPPSUBR_MPSAFE */
    273       1.12    itojun #endif
    274        1.1  explorer 
    275        1.3  explorer /* almost every function needs these */
    276        1.3  explorer #define STDDCL							\
    277        1.3  explorer 	struct ifnet *ifp = &sp->pp_if;				\
    278        1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG
    279        1.3  explorer 
    280        1.3  explorer static int sppp_output(struct ifnet *ifp, struct mbuf *m,
    281      1.141     ozaki 		       const struct sockaddr *dst, const struct rtentry *rt);
    282        1.3  explorer 
    283       1.30      ross static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2);
    284        1.3  explorer static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
    285        1.3  explorer 
    286        1.3  explorer static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
    287        1.3  explorer 			  struct mbuf *m);
    288        1.3  explorer static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
    289        1.3  explorer 			 u_char ident, u_short len, void *data);
    290        1.3  explorer /* static void sppp_cp_timeout(void *arg); */
    291        1.3  explorer static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
    292        1.3  explorer 				 int newstate);
    293        1.3  explorer static void sppp_auth_send(const struct cp *cp,
    294        1.3  explorer 			   struct sppp *sp, unsigned int type, unsigned int id,
    295        1.3  explorer 			   ...);
    296        1.3  explorer 
    297        1.3  explorer static void sppp_up_event(const struct cp *cp, struct sppp *sp);
    298        1.3  explorer static void sppp_down_event(const struct cp *cp, struct sppp *sp);
    299        1.3  explorer static void sppp_open_event(const struct cp *cp, struct sppp *sp);
    300        1.3  explorer static void sppp_close_event(const struct cp *cp, struct sppp *sp);
    301        1.3  explorer static void sppp_to_event(const struct cp *cp, struct sppp *sp);
    302        1.3  explorer 
    303        1.3  explorer static void sppp_null(struct sppp *sp);
    304        1.3  explorer 
    305        1.3  explorer static void sppp_lcp_init(struct sppp *sp);
    306        1.3  explorer static void sppp_lcp_up(struct sppp *sp);
    307        1.3  explorer static void sppp_lcp_down(struct sppp *sp);
    308        1.3  explorer static void sppp_lcp_open(struct sppp *sp);
    309        1.3  explorer static void sppp_lcp_close(struct sppp *sp);
    310        1.3  explorer static void sppp_lcp_TO(void *sp);
    311        1.3  explorer static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    312        1.3  explorer static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    313        1.3  explorer static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    314        1.3  explorer static void sppp_lcp_tlu(struct sppp *sp);
    315        1.3  explorer static void sppp_lcp_tld(struct sppp *sp);
    316        1.3  explorer static void sppp_lcp_tls(struct sppp *sp);
    317        1.3  explorer static void sppp_lcp_tlf(struct sppp *sp);
    318        1.3  explorer static void sppp_lcp_scr(struct sppp *sp);
    319        1.3  explorer static void sppp_lcp_check_and_close(struct sppp *sp);
    320        1.3  explorer static int sppp_ncp_check(struct sppp *sp);
    321        1.3  explorer 
    322        1.3  explorer static void sppp_ipcp_init(struct sppp *sp);
    323        1.3  explorer static void sppp_ipcp_up(struct sppp *sp);
    324        1.3  explorer static void sppp_ipcp_down(struct sppp *sp);
    325        1.3  explorer static void sppp_ipcp_open(struct sppp *sp);
    326        1.3  explorer static void sppp_ipcp_close(struct sppp *sp);
    327        1.3  explorer static void sppp_ipcp_TO(void *sp);
    328        1.3  explorer static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    329        1.3  explorer static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    330        1.3  explorer static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    331        1.3  explorer static void sppp_ipcp_tlu(struct sppp *sp);
    332        1.3  explorer static void sppp_ipcp_tld(struct sppp *sp);
    333        1.3  explorer static void sppp_ipcp_tls(struct sppp *sp);
    334        1.3  explorer static void sppp_ipcp_tlf(struct sppp *sp);
    335        1.3  explorer static void sppp_ipcp_scr(struct sppp *sp);
    336        1.3  explorer 
    337        1.9    itojun static void sppp_ipv6cp_init(struct sppp *sp);
    338        1.9    itojun static void sppp_ipv6cp_up(struct sppp *sp);
    339        1.9    itojun static void sppp_ipv6cp_down(struct sppp *sp);
    340        1.9    itojun static void sppp_ipv6cp_open(struct sppp *sp);
    341        1.9    itojun static void sppp_ipv6cp_close(struct sppp *sp);
    342        1.9    itojun static void sppp_ipv6cp_TO(void *sp);
    343        1.9    itojun static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    344        1.9    itojun static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    345        1.9    itojun static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    346        1.9    itojun static void sppp_ipv6cp_tlu(struct sppp *sp);
    347        1.9    itojun static void sppp_ipv6cp_tld(struct sppp *sp);
    348        1.9    itojun static void sppp_ipv6cp_tls(struct sppp *sp);
    349        1.9    itojun static void sppp_ipv6cp_tlf(struct sppp *sp);
    350        1.9    itojun static void sppp_ipv6cp_scr(struct sppp *sp);
    351        1.9    itojun 
    352        1.3  explorer static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
    353        1.3  explorer static void sppp_pap_init(struct sppp *sp);
    354        1.3  explorer static void sppp_pap_open(struct sppp *sp);
    355        1.3  explorer static void sppp_pap_close(struct sppp *sp);
    356        1.3  explorer static void sppp_pap_TO(void *sp);
    357        1.3  explorer static void sppp_pap_my_TO(void *sp);
    358        1.3  explorer static void sppp_pap_tlu(struct sppp *sp);
    359        1.3  explorer static void sppp_pap_tld(struct sppp *sp);
    360        1.3  explorer static void sppp_pap_scr(struct sppp *sp);
    361        1.3  explorer 
    362        1.3  explorer static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
    363        1.3  explorer static void sppp_chap_init(struct sppp *sp);
    364        1.3  explorer static void sppp_chap_open(struct sppp *sp);
    365        1.3  explorer static void sppp_chap_close(struct sppp *sp);
    366        1.3  explorer static void sppp_chap_TO(void *sp);
    367        1.3  explorer static void sppp_chap_tlu(struct sppp *sp);
    368        1.3  explorer static void sppp_chap_tld(struct sppp *sp);
    369        1.3  explorer static void sppp_chap_scr(struct sppp *sp);
    370        1.3  explorer 
    371        1.3  explorer static const char *sppp_auth_type_name(u_short proto, u_char type);
    372        1.3  explorer static const char *sppp_cp_type_name(u_char type);
    373      1.109      matt static const char *sppp_dotted_quad(uint32_t addr);
    374        1.3  explorer static const char *sppp_ipcp_opt_name(u_char opt);
    375        1.9    itojun #ifdef INET6
    376        1.9    itojun static const char *sppp_ipv6cp_opt_name(u_char opt);
    377        1.9    itojun #endif
    378        1.3  explorer static const char *sppp_lcp_opt_name(u_char opt);
    379       1.36    martin static const char *sppp_phase_name(int phase);
    380        1.3  explorer static const char *sppp_proto_name(u_short proto);
    381        1.3  explorer static const char *sppp_state_name(int state);
    382      1.110  gmcgarry static int sppp_params(struct sppp *sp, u_long cmd, void *data);
    383       1.79  christos #ifdef INET
    384      1.109      matt static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst,
    385      1.109      matt 			      uint32_t *srcmask);
    386      1.161  knakahar static void sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp);
    387      1.158  knakahar static void sppp_set_ip_addrs(struct sppp *sp);
    388      1.161  knakahar static void sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp);
    389       1.79  christos static void sppp_clear_ip_addrs(struct sppp *sp);
    390      1.161  knakahar static void sppp_update_ip_addrs_work(struct work *wk, void *arg);
    391       1.79  christos #endif
    392        1.3  explorer static void sppp_keepalive(void *dummy);
    393        1.3  explorer static void sppp_phase_network(struct sppp *sp);
    394        1.3  explorer static void sppp_print_bytes(const u_char *p, u_short len);
    395        1.3  explorer static void sppp_print_string(const char *p, u_short len);
    396        1.9    itojun #ifdef INET6
    397        1.9    itojun static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
    398        1.9    itojun 				struct in6_addr *dst, struct in6_addr *srcmask);
    399        1.9    itojun #ifdef IPV6CP_MYIFID_DYN
    400        1.9    itojun static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    401        1.9    itojun static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    402        1.9    itojun #endif
    403        1.9    itojun static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
    404        1.9    itojun #endif
    405        1.3  explorer 
    406        1.3  explorer /* our control protocol descriptors */
    407        1.3  explorer static const struct cp lcp = {
    408        1.3  explorer 	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
    409        1.3  explorer 	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
    410        1.3  explorer 	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
    411        1.3  explorer 	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
    412        1.3  explorer 	sppp_lcp_scr
    413        1.3  explorer };
    414        1.3  explorer 
    415        1.3  explorer static const struct cp ipcp = {
    416       1.19    itojun 	PPP_IPCP, IDX_IPCP,
    417       1.19    itojun #ifdef INET
    418       1.19    itojun 	CP_NCP,	/*don't run IPCP if there's no IPv4 support*/
    419       1.19    itojun #else
    420       1.19    itojun 	0,
    421       1.19    itojun #endif
    422       1.19    itojun 	"ipcp",
    423        1.3  explorer 	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
    424        1.3  explorer 	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
    425        1.3  explorer 	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
    426        1.3  explorer 	sppp_ipcp_scr
    427        1.3  explorer };
    428        1.3  explorer 
    429        1.9    itojun static const struct cp ipv6cp = {
    430        1.9    itojun 	PPP_IPV6CP, IDX_IPV6CP,
    431        1.9    itojun #ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
    432        1.9    itojun 	CP_NCP,
    433        1.9    itojun #else
    434        1.9    itojun 	0,
    435        1.9    itojun #endif
    436        1.9    itojun 	"ipv6cp",
    437        1.9    itojun 	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
    438        1.9    itojun 	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
    439        1.9    itojun 	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
    440        1.9    itojun 	sppp_ipv6cp_scr
    441        1.9    itojun };
    442        1.9    itojun 
    443        1.3  explorer static const struct cp pap = {
    444        1.3  explorer 	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
    445        1.3  explorer 	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
    446        1.3  explorer 	sppp_pap_TO, 0, 0, 0,
    447        1.3  explorer 	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
    448        1.3  explorer 	sppp_pap_scr
    449        1.3  explorer };
    450        1.3  explorer 
    451        1.3  explorer static const struct cp chap = {
    452        1.3  explorer 	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
    453        1.3  explorer 	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
    454        1.3  explorer 	sppp_chap_TO, 0, 0, 0,
    455        1.3  explorer 	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
    456        1.3  explorer 	sppp_chap_scr
    457        1.3  explorer };
    458        1.3  explorer 
    459        1.3  explorer static const struct cp *cps[IDX_COUNT] = {
    460        1.3  explorer 	&lcp,			/* IDX_LCP */
    461        1.3  explorer 	&ipcp,			/* IDX_IPCP */
    462        1.9    itojun 	&ipv6cp,		/* IDX_IPV6CP */
    463        1.3  explorer 	&pap,			/* IDX_PAP */
    464        1.3  explorer 	&chap,			/* IDX_CHAP */
    465        1.3  explorer };
    466        1.1  explorer 
    467      1.149     joerg static void
    468      1.149     joerg sppp_change_phase(struct sppp *sp, int phase)
    469      1.149     joerg {
    470      1.149     joerg 	STDDCL;
    471      1.149     joerg 
    472      1.163  knakahar 	KASSERT(sppp_locked(sp));
    473      1.163  knakahar 
    474      1.149     joerg 	if (sp->pp_phase == phase)
    475      1.149     joerg 		return;
    476      1.149     joerg 
    477      1.149     joerg 	sp->pp_phase = phase;
    478      1.149     joerg 
    479      1.149     joerg 	if (phase == SPPP_PHASE_NETWORK)
    480      1.149     joerg 		if_link_state_change(ifp, LINK_STATE_UP);
    481      1.149     joerg 	else
    482      1.149     joerg 		if_link_state_change(ifp, LINK_STATE_DOWN);
    483      1.149     joerg 
    484      1.149     joerg 	if (debug)
    485      1.149     joerg 	{
    486      1.149     joerg 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
    487      1.149     joerg 			sppp_phase_name(sp->pp_phase));
    488      1.149     joerg 	}
    489      1.149     joerg }
    490        1.1  explorer 
    491       1.42  jdolecek /*
    492        1.3  explorer  * Exported functions, comprising our interface to the lower layer.
    493        1.1  explorer  */
    494        1.1  explorer 
    495        1.1  explorer /*
    496        1.1  explorer  * Process the received packet.
    497        1.1  explorer  */
    498        1.3  explorer void
    499        1.3  explorer sppp_input(struct ifnet *ifp, struct mbuf *m)
    500        1.1  explorer {
    501       1.22    martin 	struct ppp_header *h = NULL;
    502      1.129     rmind 	pktqueue_t *pktq = NULL;
    503      1.129     rmind 	struct ifqueue *inq = NULL;
    504      1.109      matt 	uint16_t protocol;
    505        1.3  explorer 	struct sppp *sp = (struct sppp *)ifp;
    506        1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
    507      1.128   msaitoh 	int isr = 0;
    508        1.1  explorer 
    509      1.163  knakahar 	KASSERT(!sppp_locked(sp));
    510      1.163  knakahar 
    511      1.163  knakahar 	sppp_lock_enter(sp);
    512      1.163  knakahar 
    513       1.68    martin 	if (ifp->if_flags & IFF_UP) {
    514       1.22    martin 		/* Count received bytes, add hardware framing */
    515       1.22    martin 		ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
    516       1.68    martin 		/* Note time of last receive */
    517       1.92    kardel 		sp->pp_last_receive = time_uptime;
    518       1.68    martin 	}
    519        1.1  explorer 
    520        1.1  explorer 	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
    521        1.1  explorer 		/* Too small packet, drop it. */
    522        1.3  explorer 		if (debug)
    523        1.3  explorer 			log(LOG_DEBUG,
    524       1.64    itojun 			    "%s: input packet is too small, %d bytes\n",
    525       1.64    itojun 			    ifp->if_xname, m->m_pkthdr.len);
    526        1.3  explorer 	  drop:
    527        1.3  explorer 		++ifp->if_ierrors;
    528        1.3  explorer 		++ifp->if_iqdrops;
    529       1.59    itojun 		m_freem(m);
    530      1.163  knakahar 		sppp_lock_exit(sp);
    531        1.1  explorer 		return;
    532        1.1  explorer 	}
    533        1.1  explorer 
    534       1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
    535       1.30      ross 		memcpy(&protocol, mtod(m, void *), 2);
    536       1.22    martin 		protocol = ntohs(protocol);
    537       1.22    martin 		m_adj(m, 2);
    538       1.22    martin 	} else {
    539        1.1  explorer 
    540       1.22    martin 		/* Get PPP header. */
    541       1.59    itojun 		h = mtod(m, struct ppp_header *);
    542       1.59    itojun 		m_adj(m, PPP_HEADER_LEN);
    543       1.22    martin 
    544       1.22    martin 		switch (h->address) {
    545       1.22    martin 		case PPP_ALLSTATIONS:
    546       1.22    martin 			if (h->control != PPP_UI)
    547       1.22    martin 				goto invalid;
    548       1.22    martin 			if (sp->pp_flags & PP_CISCO) {
    549       1.22    martin 				if (debug)
    550       1.22    martin 					log(LOG_DEBUG,
    551       1.64    itojun 					    "%s: PPP packet in Cisco mode "
    552       1.22    martin 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    553       1.64    itojun 					    ifp->if_xname,
    554       1.22    martin 					    h->address, h->control, ntohs(h->protocol));
    555       1.22    martin 				goto drop;
    556       1.22    martin 			}
    557       1.22    martin 			break;
    558       1.22    martin 		case CISCO_MULTICAST:
    559       1.22    martin 		case CISCO_UNICAST:
    560       1.22    martin 			/* Don't check the control field here (RFC 1547). */
    561       1.22    martin 			if (! (sp->pp_flags & PP_CISCO)) {
    562       1.22    martin 				if (debug)
    563       1.22    martin 					log(LOG_DEBUG,
    564       1.64    itojun 					    "%s: Cisco packet in PPP mode "
    565       1.22    martin 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    566       1.64    itojun 					    ifp->if_xname,
    567       1.22    martin 					    h->address, h->control, ntohs(h->protocol));
    568       1.22    martin 				goto drop;
    569       1.22    martin 			}
    570       1.59    itojun 			switch (ntohs(h->protocol)) {
    571       1.22    martin 			default:
    572       1.22    martin 				++ifp->if_noproto;
    573       1.22    martin 				goto invalid;
    574       1.22    martin 			case CISCO_KEEPALIVE:
    575      1.163  knakahar 				sppp_lock_exit(sp);
    576       1.59    itojun 				sppp_cisco_input((struct sppp *) ifp, m);
    577       1.59    itojun 				m_freem(m);
    578       1.22    martin 				return;
    579        1.1  explorer #ifdef INET
    580       1.22    martin 			case ETHERTYPE_IP:
    581      1.129     rmind 				pktq = ip_pktq;
    582       1.22    martin 				break;
    583        1.1  explorer #endif
    584        1.8    itojun #ifdef INET6
    585       1.22    martin 			case ETHERTYPE_IPV6:
    586      1.129     rmind 				pktq = ip6_pktq;
    587       1.22    martin 				break;
    588        1.8    itojun #endif
    589        1.1  explorer 			}
    590       1.22    martin 			goto queue_pkt;
    591       1.22    martin 		default:        /* Invalid PPP packet. */
    592       1.22    martin 		  invalid:
    593        1.3  explorer 			if (debug)
    594        1.3  explorer 				log(LOG_DEBUG,
    595       1.64    itojun 				    "%s: invalid input packet "
    596        1.3  explorer 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    597       1.64    itojun 				    ifp->if_xname,
    598        1.3  explorer 				    h->address, h->control, ntohs(h->protocol));
    599        1.1  explorer 			goto drop;
    600        1.1  explorer 		}
    601       1.59    itojun 		protocol = ntohs(h->protocol);
    602       1.22    martin 	}
    603       1.22    martin 
    604       1.22    martin 	switch (protocol) {
    605       1.22    martin 	default:
    606       1.22    martin 		if (sp->state[IDX_LCP] == STATE_OPENED) {
    607      1.109      matt 			uint16_t prot = htons(protocol);
    608       1.59    itojun 			sppp_cp_send(sp, PPP_LCP, PROTO_REJ,
    609       1.22    martin 			    ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
    610       1.22    martin 			    &prot);
    611       1.22    martin 		}
    612       1.22    martin 		if (debug)
    613       1.22    martin 			log(LOG_DEBUG,
    614       1.64    itojun 			    "%s: invalid input protocol "
    615       1.64    itojun 			    "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol));
    616       1.22    martin 		++ifp->if_noproto;
    617       1.22    martin 		goto drop;
    618       1.22    martin 	case PPP_LCP:
    619      1.163  knakahar 		sppp_lock_exit(sp);
    620       1.22    martin 		sppp_cp_input(&lcp, sp, m);
    621       1.59    itojun 		m_freem(m);
    622       1.22    martin 		return;
    623       1.22    martin 	case PPP_PAP:
    624      1.163  knakahar 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
    625      1.163  knakahar 			sppp_lock_exit(sp);
    626       1.22    martin 			sppp_pap_input(sp, m);
    627      1.163  knakahar 		} else
    628      1.163  knakahar 			sppp_lock_exit(sp);
    629       1.59    itojun 		m_freem(m);
    630       1.22    martin 		return;
    631       1.22    martin 	case PPP_CHAP:
    632      1.163  knakahar 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
    633      1.163  knakahar 			sppp_lock_exit(sp);
    634       1.22    martin 			sppp_chap_input(sp, m);
    635      1.163  knakahar 		} else
    636      1.163  knakahar 			sppp_lock_exit(sp);
    637       1.59    itojun 		m_freem(m);
    638       1.22    martin 		return;
    639        1.1  explorer #ifdef INET
    640       1.22    martin 	case PPP_IPCP:
    641      1.163  knakahar 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    642      1.163  knakahar 			sppp_lock_exit(sp);
    643       1.22    martin 			sppp_cp_input(&ipcp, sp, m);
    644      1.163  knakahar 		} else
    645      1.163  knakahar 			sppp_lock_exit(sp);
    646       1.59    itojun 		m_freem(m);
    647       1.22    martin 		return;
    648       1.22    martin 	case PPP_IP:
    649       1.22    martin 		if (sp->state[IDX_IPCP] == STATE_OPENED) {
    650       1.92    kardel 			sp->pp_last_activity = time_uptime;
    651      1.129     rmind 			pktq = ip_pktq;
    652       1.22    martin 		}
    653       1.22    martin 		break;
    654        1.1  explorer #endif
    655        1.8    itojun #ifdef INET6
    656       1.22    martin 	case PPP_IPV6CP:
    657      1.163  knakahar 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    658      1.163  knakahar 			sppp_lock_exit(sp);
    659       1.22    martin 			sppp_cp_input(&ipv6cp, sp, m);
    660      1.163  knakahar 		} else
    661      1.163  knakahar 			sppp_lock_exit(sp);
    662       1.59    itojun 		m_freem(m);
    663       1.22    martin 		return;
    664       1.22    martin 
    665       1.22    martin 	case PPP_IPV6:
    666       1.22    martin 		if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
    667       1.92    kardel 			sp->pp_last_activity = time_uptime;
    668      1.129     rmind 			pktq = ip6_pktq;
    669       1.22    martin 		}
    670       1.22    martin 		break;
    671        1.8    itojun #endif
    672        1.1  explorer 	}
    673        1.1  explorer 
    674       1.22    martin queue_pkt:
    675      1.130     rmind 	if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) {
    676        1.1  explorer 		goto drop;
    677      1.130     rmind 	}
    678        1.1  explorer 
    679      1.163  knakahar 	sppp_lock_exit(sp);
    680        1.1  explorer 	/* Check queue. */
    681      1.129     rmind 	if (__predict_true(pktq)) {
    682      1.129     rmind 		if (__predict_false(!pktq_enqueue(pktq, m, 0))) {
    683      1.163  knakahar 			sppp_lock_enter(sp);
    684      1.129     rmind 			goto drop;
    685      1.129     rmind 		}
    686      1.129     rmind 		return;
    687      1.129     rmind 	}
    688      1.129     rmind 
    689      1.155     ozaki 	IFQ_LOCK(inq);
    690       1.59    itojun 	if (IF_QFULL(inq)) {
    691        1.1  explorer 		/* Queue overflow. */
    692        1.3  explorer 		IF_DROP(inq);
    693      1.155     ozaki 		IFQ_UNLOCK(inq);
    694        1.3  explorer 		if (debug)
    695       1.64    itojun 			log(LOG_DEBUG, "%s: protocol queue overflow\n",
    696       1.64    itojun 				ifp->if_xname);
    697      1.163  knakahar 		sppp_lock_enter(sp);
    698        1.1  explorer 		goto drop;
    699        1.1  explorer 	}
    700        1.3  explorer 	IF_ENQUEUE(inq, m);
    701      1.155     ozaki 	IFQ_UNLOCK(inq);
    702      1.128   msaitoh 	schednetisr(isr);
    703        1.1  explorer }
    704        1.1  explorer 
    705        1.1  explorer /*
    706        1.1  explorer  * Enqueue transmit packet.
    707        1.1  explorer  */
    708        1.1  explorer static int
    709        1.3  explorer sppp_output(struct ifnet *ifp, struct mbuf *m,
    710      1.141     ozaki     const struct sockaddr *dst, const struct rtentry *rt)
    711        1.1  explorer {
    712       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    713       1.22    martin 	struct ppp_header *h = NULL;
    714      1.163  knakahar #ifndef SPPPSUBR_MPSAFE
    715       1.15   thorpej 	struct ifqueue *ifq = NULL;		/* XXX */
    716      1.163  knakahar #endif
    717       1.83  christos 	int s, error = 0;
    718      1.109      matt 	uint16_t protocol;
    719  1.165.2.1    bouyer 	size_t pktlen;
    720        1.3  explorer 
    721       1.23   thorpej 	s = splnet();
    722        1.1  explorer 
    723      1.163  knakahar 	sppp_lock_enter(sp);
    724       1.92    kardel 	sp->pp_last_activity = time_uptime;
    725       1.38    martin 
    726        1.3  explorer 	if ((ifp->if_flags & IFF_UP) == 0 ||
    727        1.3  explorer 	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
    728      1.163  knakahar 		sppp_lock_exit(sp);
    729       1.59    itojun 		m_freem(m);
    730       1.59    itojun 		splx(s);
    731        1.1  explorer 		return (ENETDOWN);
    732        1.1  explorer 	}
    733        1.1  explorer 
    734        1.3  explorer 	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
    735        1.3  explorer 		/*
    736        1.3  explorer 		 * Interface is not yet running, but auto-dial.  Need
    737        1.3  explorer 		 * to start LCP for it.
    738        1.3  explorer 		 */
    739        1.3  explorer 		ifp->if_flags |= IFF_RUNNING;
    740        1.3  explorer 		splx(s);
    741        1.3  explorer 		lcp.Open(sp);
    742       1.23   thorpej 		s = splnet();
    743        1.3  explorer 	}
    744        1.3  explorer 
    745       1.15   thorpej 	/*
    746       1.15   thorpej 	 * If the queueing discipline needs packet classification,
    747       1.15   thorpej 	 * do it before prepending link headers.
    748       1.15   thorpej 	 */
    749      1.136  knakahar 	IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family);
    750        1.3  explorer 
    751        1.1  explorer #ifdef INET
    752       1.48    itojun 	if (dst->sa_family == AF_INET) {
    753       1.48    itojun 		struct ip *ip = NULL;
    754      1.163  knakahar #ifndef SPPPSUBR_MPSAFE
    755       1.48    itojun 		struct tcphdr *th = NULL;
    756      1.163  knakahar #endif
    757       1.48    itojun 
    758       1.48    itojun 		if (m->m_len >= sizeof(struct ip)) {
    759       1.59    itojun 			ip = mtod(m, struct ip *);
    760      1.163  knakahar #ifndef SPPPSUBR_MPSAFE
    761       1.48    itojun 			if (ip->ip_p == IPPROTO_TCP &&
    762       1.48    itojun 			    m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
    763       1.48    itojun 			    sizeof(struct tcphdr)) {
    764       1.48    itojun 				th = (struct tcphdr *)
    765      1.104  christos 				    ((char *)ip + (ip->ip_hl << 2));
    766       1.48    itojun 			}
    767      1.163  knakahar #endif
    768       1.48    itojun 		} else
    769       1.48    itojun 			ip = NULL;
    770        1.1  explorer 
    771        1.3  explorer 		/*
    772        1.3  explorer 		 * When using dynamic local IP address assignment by using
    773        1.3  explorer 		 * 0.0.0.0 as a local address, the first TCP session will
    774        1.3  explorer 		 * not connect because the local TCP checksum is computed
    775        1.3  explorer 		 * using 0.0.0.0 which will later become our real IP address
    776        1.3  explorer 		 * so the TCP checksum computed at the remote end will
    777        1.3  explorer 		 * become invalid. So we
    778        1.3  explorer 		 * - don't let packets with src ip addr 0 thru
    779        1.3  explorer 		 * - we flag TCP packets with src ip 0 as an error
    780       1.82     perry 		 */
    781       1.48    itojun 		if (ip && ip->ip_src.s_addr == INADDR_ANY) {
    782      1.109      matt 			uint8_t proto = ip->ip_p;
    783       1.49      yamt 
    784      1.163  knakahar 			sppp_lock_exit(sp);
    785        1.3  explorer 			m_freem(m);
    786        1.3  explorer 			splx(s);
    787       1.49      yamt 			if (proto == IPPROTO_TCP)
    788       1.58    itojun 				return (EADDRNOTAVAIL);
    789        1.3  explorer 			else
    790       1.58    itojun 				return (0);
    791        1.3  explorer 		}
    792       1.82     perry 
    793      1.163  knakahar #ifndef SPPPSUBR_MPSAFE
    794        1.3  explorer 		/*
    795        1.3  explorer 		 * Put low delay, telnet, rlogin and ftp control packets
    796        1.3  explorer 		 * in front of the queue.
    797        1.3  explorer 		 */
    798       1.48    itojun 		if (!IF_QFULL(&sp->pp_fastq) &&
    799       1.48    itojun 		    ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
    800       1.48    itojun 		     (th && (INTERACTIVE(ntohs(th->th_sport)) ||
    801       1.48    itojun 		      INTERACTIVE(ntohs(th->th_dport))))))
    802        1.1  explorer 			ifq = &sp->pp_fastq;
    803      1.163  knakahar #endif /* !SPPPSUBR_MPSAFE */
    804        1.1  explorer 	}
    805        1.1  explorer #endif
    806        1.1  explorer 
    807        1.5    itojun #ifdef INET6
    808        1.5    itojun 	if (dst->sa_family == AF_INET6) {
    809        1.5    itojun 		/* XXX do something tricky here? */
    810        1.5    itojun 	}
    811        1.5    itojun #endif
    812        1.5    itojun 
    813       1.22    martin 	if ((sp->pp_flags & PP_NOFRAMING) == 0) {
    814       1.22    martin 		/*
    815       1.22    martin 		 * Prepend general data packet PPP header. For now, IP only.
    816       1.22    martin 		 */
    817       1.59    itojun 		M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT);
    818       1.22    martin 		if (! m) {
    819       1.22    martin 			if (ifp->if_flags & IFF_DEBUG)
    820       1.64    itojun 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
    821       1.64    itojun 					ifp->if_xname);
    822       1.22    martin 			++ifp->if_oerrors;
    823      1.163  knakahar 			sppp_lock_exit(sp);
    824       1.59    itojun 			splx(s);
    825       1.22    martin 			return (ENOBUFS);
    826       1.22    martin 		}
    827       1.22    martin 		/*
    828       1.22    martin 		 * May want to check size of packet
    829       1.22    martin 		 * (albeit due to the implementation it's always enough)
    830       1.22    martin 		 */
    831       1.59    itojun 		h = mtod(m, struct ppp_header *);
    832       1.22    martin 		if (sp->pp_flags & PP_CISCO) {
    833       1.22    martin 			h->address = CISCO_UNICAST;        /* unicast address */
    834       1.22    martin 			h->control = 0;
    835       1.22    martin 		} else {
    836       1.22    martin 			h->address = PPP_ALLSTATIONS;        /* broadcast address */
    837       1.22    martin 			h->control = PPP_UI;                 /* Unnumbered Info */
    838       1.22    martin 		}
    839        1.1  explorer 	}
    840        1.1  explorer 
    841        1.1  explorer 	switch (dst->sa_family) {
    842        1.1  explorer #ifdef INET
    843        1.1  explorer 	case AF_INET:   /* Internet Protocol */
    844        1.1  explorer 		if (sp->pp_flags & PP_CISCO)
    845       1.59    itojun 			protocol = htons(ETHERTYPE_IP);
    846        1.1  explorer 		else {
    847        1.3  explorer 			/*
    848        1.3  explorer 			 * Don't choke with an ENETDOWN early.  It's
    849        1.3  explorer 			 * possible that we just started dialing out,
    850        1.3  explorer 			 * so don't drop the packet immediately.  If
    851        1.3  explorer 			 * we notice that we run out of buffer space
    852        1.3  explorer 			 * below, we will however remember that we are
    853        1.3  explorer 			 * not ready to carry IP packets, and return
    854        1.3  explorer 			 * ENETDOWN, as opposed to ENOBUFS.
    855        1.3  explorer 			 */
    856       1.22    martin 			protocol = htons(PPP_IP);
    857        1.5    itojun 			if (sp->state[IDX_IPCP] != STATE_OPENED)
    858       1.83  christos 				error = ENETDOWN;
    859        1.5    itojun 		}
    860        1.5    itojun 		break;
    861        1.5    itojun #endif
    862        1.5    itojun #ifdef INET6
    863        1.5    itojun 	case AF_INET6:   /* Internet Protocol version 6 */
    864        1.5    itojun 		if (sp->pp_flags & PP_CISCO)
    865       1.59    itojun 			protocol = htons(ETHERTYPE_IPV6);
    866        1.5    itojun 		else {
    867        1.5    itojun 			/*
    868        1.5    itojun 			 * Don't choke with an ENETDOWN early.  It's
    869        1.5    itojun 			 * possible that we just started dialing out,
    870        1.5    itojun 			 * so don't drop the packet immediately.  If
    871        1.5    itojun 			 * we notice that we run out of buffer space
    872        1.5    itojun 			 * below, we will however remember that we are
    873        1.5    itojun 			 * not ready to carry IP packets, and return
    874        1.5    itojun 			 * ENETDOWN, as opposed to ENOBUFS.
    875        1.5    itojun 			 */
    876       1.22    martin 			protocol = htons(PPP_IPV6);
    877        1.9    itojun 			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
    878       1.83  christos 				error = ENETDOWN;
    879        1.1  explorer 		}
    880        1.1  explorer 		break;
    881        1.1  explorer #endif
    882        1.1  explorer 	default:
    883       1.59    itojun 		m_freem(m);
    884        1.3  explorer 		++ifp->if_oerrors;
    885      1.163  knakahar 		sppp_lock_exit(sp);
    886       1.59    itojun 		splx(s);
    887        1.1  explorer 		return (EAFNOSUPPORT);
    888        1.1  explorer 	}
    889        1.1  explorer 
    890       1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
    891       1.59    itojun 		M_PREPEND(m, 2, M_DONTWAIT);
    892       1.22    martin 		if (m == NULL) {
    893       1.22    martin 			if (ifp->if_flags & IFF_DEBUG)
    894       1.64    itojun 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
    895       1.64    itojun 					ifp->if_xname);
    896       1.22    martin 			++ifp->if_oerrors;
    897      1.163  knakahar 			sppp_lock_exit(sp);
    898       1.59    itojun 			splx(s);
    899       1.22    martin 			return (ENOBUFS);
    900       1.22    martin 		}
    901      1.109      matt 		*mtod(m, uint16_t *) = protocol;
    902       1.22    martin 	} else {
    903       1.22    martin 		h->protocol = protocol;
    904       1.22    martin 	}
    905       1.22    martin 
    906  1.165.2.1    bouyer 	pktlen = m->m_pkthdr.len;
    907      1.163  knakahar #ifdef SPPPSUBR_MPSAFE
    908      1.163  knakahar 	error = if_transmit_lock(ifp, m);
    909      1.163  knakahar 	if (error == 0)
    910  1.165.2.1    bouyer 		ifp->if_obytes += pktlen + sp->pp_framebytes;
    911      1.163  knakahar #else /* !SPPPSUBR_MPSAFE */
    912      1.136  knakahar 	error = ifq_enqueue2(ifp, ifq, m);
    913        1.1  explorer 
    914       1.83  christos 	if (error == 0) {
    915       1.83  christos 		/*
    916       1.83  christos 		 * Count output packets and bytes.
    917       1.83  christos 		 * The packet length includes header + additional hardware
    918       1.83  christos 		 * framing according to RFC 1333.
    919       1.83  christos 		 */
    920      1.163  knakahar 		if (!(ifp->if_flags & IFF_OACTIVE)) {
    921      1.163  knakahar 			sppp_lock_exit(sp);
    922      1.143  knakahar 			if_start_lock(ifp);
    923      1.163  knakahar 			sppp_lock_enter(sp);
    924      1.163  knakahar 		}
    925  1.165.2.1    bouyer 		ifp->if_obytes += pktlen + sp->pp_framebytes;
    926       1.83  christos 	}
    927      1.163  knakahar #endif /* !SPPPSUBR_MPSAFE */
    928      1.163  knakahar 	sppp_lock_exit(sp);
    929       1.59    itojun 	splx(s);
    930       1.83  christos 	return error;
    931        1.1  explorer }
    932        1.1  explorer 
    933      1.150       roy static int
    934      1.150       roy sppp_mediachange(struct ifnet *ifp)
    935      1.150       roy {
    936      1.150       roy 
    937      1.150       roy 	return (0);
    938      1.150       roy }
    939      1.150       roy 
    940      1.150       roy static void
    941      1.150       roy sppp_mediastatus(struct ifnet *ifp, struct ifmediareq *imr)
    942      1.150       roy {
    943      1.163  knakahar 	struct sppp *sp = (struct sppp *)ifp;
    944      1.163  knakahar 	KASSERT(!sppp_locked(sp));
    945      1.150       roy 
    946      1.163  knakahar 	sppp_lock_enter(sp);
    947      1.150       roy 	switch (ifp->if_link_state) {
    948      1.150       roy 	case LINK_STATE_UP:
    949      1.150       roy 		imr->ifm_status = IFM_AVALID | IFM_ACTIVE;
    950      1.150       roy 		break;
    951      1.150       roy 	case LINK_STATE_DOWN:
    952      1.150       roy 		imr->ifm_status = IFM_AVALID;
    953      1.150       roy 		break;
    954      1.150       roy 	default:
    955      1.150       roy 		/* Should be impossible as we set link state down in attach. */
    956      1.150       roy 		imr->ifm_status = 0;
    957      1.150       roy 		break;
    958      1.150       roy 	}
    959      1.163  knakahar 	sppp_lock_exit(sp);
    960      1.150       roy }
    961      1.150       roy 
    962        1.3  explorer void
    963        1.3  explorer sppp_attach(struct ifnet *ifp)
    964        1.1  explorer {
    965       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
    966        1.1  explorer 
    967        1.1  explorer 	/* Initialize keepalive handler. */
    968        1.7   thorpej 	if (! spppq) {
    969      1.106        ad 		callout_init(&keepalive_ch, 0);
    970       1.57    martin 		callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
    971        1.7   thorpej 	}
    972        1.1  explorer 
    973      1.163  knakahar 	if (! spppq_lock)
    974      1.163  knakahar 		spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET);
    975      1.163  knakahar 
    976        1.1  explorer 	/* Insert new entry into the keepalive list. */
    977        1.1  explorer 	sp->pp_next = spppq;
    978        1.1  explorer 	spppq = sp;
    979        1.1  explorer 
    980        1.1  explorer 	sp->pp_if.if_type = IFT_PPP;
    981        1.1  explorer 	sp->pp_if.if_output = sppp_output;
    982        1.1  explorer 	sp->pp_fastq.ifq_maxlen = 32;
    983        1.3  explorer 	sp->pp_cpq.ifq_maxlen = 20;
    984        1.1  explorer 	sp->pp_loopcnt = 0;
    985        1.1  explorer 	sp->pp_alivecnt = 0;
    986       1.38    martin 	sp->pp_last_activity = 0;
    987       1.68    martin 	sp->pp_last_receive = 0;
    988       1.68    martin 	sp->pp_maxalive = DEFAULT_MAXALIVECNT;
    989       1.68    martin 	sp->pp_max_noreceive = DEFAULT_NORECV_TIME;
    990       1.38    martin 	sp->pp_idle_timeout = 0;
    991       1.25   thorpej 	memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq));
    992       1.25   thorpej 	memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq));
    993       1.39    martin 	sp->pp_auth_failures = 0;
    994       1.39    martin 	sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES;
    995       1.36    martin 	sp->pp_phase = SPPP_PHASE_DEAD;
    996        1.3  explorer 	sp->pp_up = lcp.Up;
    997        1.3  explorer 	sp->pp_down = lcp.Down;
    998      1.163  knakahar 	sp->pp_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET);
    999        1.3  explorer 
   1000       1.20   thorpej 	if_alloc_sadl(ifp);
   1001       1.20   thorpej 
   1002      1.150       roy 	/* Lets not beat about the bush, we know we're down. */
   1003      1.150       roy 	ifp->if_link_state = LINK_STATE_DOWN;
   1004      1.150       roy 	/* There is no media for PPP, but it's needed to report link status. */
   1005      1.150       roy 	ifmedia_init(&sp->pp_im, 0, sppp_mediachange, sppp_mediastatus);
   1006      1.150       roy 
   1007       1.36    martin 	memset(&sp->myauth, 0, sizeof sp->myauth);
   1008       1.36    martin 	memset(&sp->hisauth, 0, sizeof sp->hisauth);
   1009        1.3  explorer 	sppp_lcp_init(sp);
   1010        1.3  explorer 	sppp_ipcp_init(sp);
   1011        1.9    itojun 	sppp_ipv6cp_init(sp);
   1012        1.3  explorer 	sppp_pap_init(sp);
   1013        1.3  explorer 	sppp_chap_init(sp);
   1014        1.1  explorer }
   1015        1.1  explorer 
   1016        1.3  explorer void
   1017        1.3  explorer sppp_detach(struct ifnet *ifp)
   1018        1.1  explorer {
   1019       1.59    itojun 	struct sppp **q, *p, *sp = (struct sppp *) ifp;
   1020        1.1  explorer 
   1021      1.163  knakahar 	sppp_lock_enter(sp);
   1022        1.1  explorer 	/* Remove the entry from the keepalive list. */
   1023      1.163  knakahar 	SPPPQ_LOCK();
   1024        1.1  explorer 	for (q = &spppq; (p = *q); q = &p->pp_next)
   1025        1.1  explorer 		if (p == sp) {
   1026        1.1  explorer 			*q = p->pp_next;
   1027        1.1  explorer 			break;
   1028        1.1  explorer 		}
   1029        1.1  explorer 
   1030      1.161  knakahar 	/* to avoid workqueue enqueued */
   1031      1.161  knakahar 	atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1);
   1032      1.161  knakahar 	workqueue_destroy(sp->ipcp.update_addrs_wq);
   1033      1.161  knakahar 	pcq_destroy(sp->ipcp.update_addrs_q);
   1034      1.159  knakahar 
   1035        1.1  explorer 	/* Stop keepalive handler. */
   1036        1.7   thorpej 	if (! spppq) {
   1037        1.7   thorpej 		callout_stop(&keepalive_ch);
   1038        1.7   thorpej 	}
   1039      1.163  knakahar 	SPPPQ_UNLOCK();
   1040        1.3  explorer 
   1041      1.113    martin 	callout_stop(&sp->ch[IDX_LCP]);
   1042      1.113    martin 	callout_stop(&sp->ch[IDX_IPCP]);
   1043      1.113    martin 	callout_stop(&sp->ch[IDX_PAP]);
   1044      1.113    martin 	callout_stop(&sp->ch[IDX_CHAP]);
   1045      1.113    martin #ifdef INET6
   1046      1.113    martin 	callout_stop(&sp->ch[IDX_IPV6CP]);
   1047      1.113    martin #endif
   1048        1.7   thorpej 	callout_stop(&sp->pap_my_to_ch);
   1049       1.20   thorpej 
   1050       1.36    martin 	/* free authentication info */
   1051       1.36    martin 	if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF);
   1052       1.36    martin 	if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF);
   1053       1.36    martin 	if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF);
   1054       1.36    martin 	if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF);
   1055      1.151       roy 
   1056      1.151       roy 	/* Safety - shouldn't be needed as there is no media to set. */
   1057      1.151       roy 	ifmedia_delete_instance(&sp->pp_im, IFM_INST_ANY);
   1058      1.163  knakahar 
   1059      1.163  knakahar 	sppp_lock_exit(sp);
   1060      1.163  knakahar 	if (sp->pp_lock)
   1061      1.163  knakahar 		mutex_obj_free(sp->pp_lock);
   1062      1.163  knakahar 
   1063        1.1  explorer }
   1064        1.1  explorer 
   1065        1.1  explorer /*
   1066        1.1  explorer  * Flush the interface output queue.
   1067        1.1  explorer  */
   1068        1.3  explorer void
   1069        1.3  explorer sppp_flush(struct ifnet *ifp)
   1070        1.1  explorer {
   1071       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1072        1.1  explorer 
   1073       1.59    itojun 	IFQ_PURGE(&sp->pp_if.if_snd);
   1074       1.59    itojun 	IF_PURGE(&sp->pp_fastq);
   1075       1.59    itojun 	IF_PURGE(&sp->pp_cpq);
   1076        1.1  explorer }
   1077        1.1  explorer 
   1078        1.1  explorer /*
   1079        1.1  explorer  * Check if the output queue is empty.
   1080        1.1  explorer  */
   1081        1.1  explorer int
   1082        1.3  explorer sppp_isempty(struct ifnet *ifp)
   1083        1.1  explorer {
   1084       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1085        1.3  explorer 	int empty, s;
   1086        1.1  explorer 
   1087      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   1088      1.163  knakahar 
   1089       1.23   thorpej 	s = splnet();
   1090      1.163  knakahar 	sppp_lock_enter(sp);
   1091       1.44    martin 	empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) &&
   1092       1.44    martin 		IFQ_IS_EMPTY(&sp->pp_if.if_snd);
   1093      1.163  knakahar 	sppp_lock_exit(sp);
   1094        1.3  explorer 	splx(s);
   1095        1.1  explorer 	return (empty);
   1096        1.1  explorer }
   1097        1.1  explorer 
   1098        1.1  explorer /*
   1099        1.1  explorer  * Get next packet to send.
   1100        1.1  explorer  */
   1101        1.3  explorer struct mbuf *
   1102        1.3  explorer sppp_dequeue(struct ifnet *ifp)
   1103        1.1  explorer {
   1104       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1105        1.1  explorer 	struct mbuf *m;
   1106        1.3  explorer 	int s;
   1107        1.1  explorer 
   1108       1.23   thorpej 	s = splnet();
   1109      1.163  knakahar 	sppp_lock_enter(sp);
   1110        1.3  explorer 	/*
   1111        1.3  explorer 	 * Process only the control protocol queue until we have at
   1112        1.3  explorer 	 * least one NCP open.
   1113        1.3  explorer 	 *
   1114        1.3  explorer 	 * Do always serve all three queues in Cisco mode.
   1115        1.3  explorer 	 */
   1116        1.3  explorer 	IF_DEQUEUE(&sp->pp_cpq, m);
   1117        1.3  explorer 	if (m == NULL &&
   1118        1.3  explorer 	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
   1119        1.3  explorer 		IF_DEQUEUE(&sp->pp_fastq, m);
   1120        1.3  explorer 		if (m == NULL)
   1121       1.67    martin 			IFQ_DEQUEUE(&sp->pp_if.if_snd, m);
   1122        1.3  explorer 	}
   1123      1.163  knakahar 	sppp_lock_exit(sp);
   1124        1.3  explorer 	splx(s);
   1125        1.3  explorer 	return m;
   1126        1.1  explorer }
   1127        1.1  explorer 
   1128        1.1  explorer /*
   1129        1.3  explorer  * Process an ioctl request.  Called on low priority level.
   1130        1.1  explorer  */
   1131        1.3  explorer int
   1132        1.3  explorer sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
   1133        1.1  explorer {
   1134      1.100      elad 	struct lwp *l = curlwp;	/* XXX */
   1135       1.59    itojun 	struct ifreq *ifr = (struct ifreq *) data;
   1136      1.132       roy 	struct ifaddr *ifa = (struct ifaddr *) data;
   1137       1.59    itojun 	struct sppp *sp = (struct sppp *) ifp;
   1138       1.42  jdolecek 	int s, error=0, going_up, going_down, newmode;
   1139        1.1  explorer 
   1140       1.23   thorpej 	s = splnet();
   1141        1.3  explorer 	switch (cmd) {
   1142      1.115    dyoung 	case SIOCINITIFADDR:
   1143      1.132       roy 		ifa->ifa_rtrequest = p2p_rtrequest;
   1144        1.1  explorer 		break;
   1145        1.3  explorer 
   1146        1.3  explorer 	case SIOCSIFFLAGS:
   1147      1.115    dyoung 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
   1148      1.115    dyoung 			break;
   1149      1.163  knakahar 
   1150      1.163  knakahar 		sppp_lock_enter(sp);
   1151        1.3  explorer 		going_up = ifp->if_flags & IFF_UP &&
   1152        1.3  explorer 			(ifp->if_flags & IFF_RUNNING) == 0;
   1153        1.3  explorer 		going_down = (ifp->if_flags & IFF_UP) == 0 &&
   1154        1.3  explorer 			ifp->if_flags & IFF_RUNNING;
   1155        1.3  explorer 		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
   1156        1.3  explorer 		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
   1157        1.3  explorer 			/* sanity */
   1158        1.3  explorer 			newmode = IFF_PASSIVE;
   1159        1.3  explorer 			ifp->if_flags &= ~IFF_AUTO;
   1160        1.1  explorer 		}
   1161        1.1  explorer 
   1162      1.163  knakahar 		if (going_up || going_down) {
   1163        1.3  explorer 			lcp.Close(sp);
   1164      1.163  knakahar 		}
   1165        1.3  explorer 		if (going_up && newmode == 0) {
   1166        1.3  explorer 			/* neither auto-dial nor passive */
   1167        1.3  explorer 			ifp->if_flags |= IFF_RUNNING;
   1168        1.3  explorer 			if (!(sp->pp_flags & PP_CISCO))
   1169        1.3  explorer 				lcp.Open(sp);
   1170        1.3  explorer 		} else if (going_down) {
   1171        1.3  explorer 			sppp_flush(ifp);
   1172        1.3  explorer 			ifp->if_flags &= ~IFF_RUNNING;
   1173        1.1  explorer 		}
   1174      1.163  knakahar 		sppp_lock_exit(sp);
   1175        1.3  explorer 		break;
   1176        1.3  explorer 
   1177        1.3  explorer 	case SIOCSIFMTU:
   1178      1.105       scw 		if (ifr->ifr_mtu < PPP_MINMRU ||
   1179      1.105       scw 		    ifr->ifr_mtu > sp->lcp.their_mru) {
   1180       1.61  kristerw 			error = EINVAL;
   1181       1.61  kristerw 			break;
   1182       1.61  kristerw 		}
   1183      1.108    dyoung 		/*FALLTHROUGH*/
   1184        1.3  explorer 	case SIOCGIFMTU:
   1185      1.108    dyoung 		if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
   1186      1.108    dyoung 			error = 0;
   1187        1.1  explorer 		break;
   1188        1.3  explorer 	case SIOCADDMULTI:
   1189        1.3  explorer 	case SIOCDELMULTI:
   1190        1.1  explorer 		break;
   1191        1.1  explorer 
   1192       1.36    martin 	case SPPPSETAUTHCFG:
   1193       1.36    martin 	case SPPPSETLCPCFG:
   1194       1.38    martin 	case SPPPSETIDLETO:
   1195       1.39    martin 	case SPPPSETAUTHFAILURE:
   1196       1.45    martin 	case SPPPSETDNSOPTS:
   1197       1.68    martin 	case SPPPSETKEEPALIVE:
   1198      1.120  jmcneill #if defined(COMPAT_50) || defined(MODULAR)
   1199      1.120  jmcneill 	case __SPPPSETIDLETO50:
   1200      1.120  jmcneill 	case __SPPPSETKEEPALIVE50:
   1201      1.120  jmcneill #endif /* COMPAT_50 || MODULAR */
   1202      1.100      elad 		error = kauth_authorize_network(l->l_cred,
   1203      1.100      elad 		    KAUTH_NETWORK_INTERFACE,
   1204      1.100      elad 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
   1205      1.100      elad 		    NULL);
   1206      1.100      elad 		if (error)
   1207      1.100      elad 			break;
   1208      1.100      elad 		error = sppp_params(sp, cmd, data);
   1209      1.100      elad 		break;
   1210       1.36    martin 
   1211      1.100      elad 	case SPPPGETAUTHCFG:
   1212      1.100      elad 	case SPPPGETLCPCFG:
   1213      1.100      elad 	case SPPPGETAUTHFAILURES:
   1214      1.100      elad 		error = kauth_authorize_network(l->l_cred,
   1215      1.100      elad 		    KAUTH_NETWORK_INTERFACE,
   1216      1.100      elad 		    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd,
   1217      1.100      elad 		    NULL);
   1218      1.100      elad 		if (error)
   1219       1.36    martin 			break;
   1220      1.100      elad 		error = sppp_params(sp, cmd, data);
   1221      1.100      elad 		break;
   1222      1.100      elad 
   1223       1.36    martin 	case SPPPGETSTATUS:
   1224       1.75    martin 	case SPPPGETSTATUSNCP:
   1225       1.38    martin 	case SPPPGETIDLETO:
   1226       1.45    martin 	case SPPPGETDNSOPTS:
   1227       1.45    martin 	case SPPPGETDNSADDRS:
   1228       1.68    martin 	case SPPPGETKEEPALIVE:
   1229      1.120  jmcneill #if defined(COMPAT_50) || defined(MODULAR)
   1230      1.120  jmcneill 	case __SPPPGETIDLETO50:
   1231      1.120  jmcneill 	case __SPPPGETKEEPALIVE50:
   1232      1.120  jmcneill #endif /* COMPAT_50 || MODULAR */
   1233       1.42  jdolecek 		error = sppp_params(sp, cmd, data);
   1234        1.1  explorer 		break;
   1235        1.3  explorer 
   1236      1.150       roy 	case SIOCGIFMEDIA:
   1237      1.150       roy 		error = ifmedia_ioctl(ifp, ifr, &sp->pp_im, cmd);
   1238      1.150       roy 		break;
   1239      1.150       roy 
   1240        1.3  explorer 	default:
   1241      1.115    dyoung 		error = ifioctl_common(ifp, cmd, data);
   1242      1.115    dyoung 		break;
   1243        1.1  explorer 	}
   1244        1.3  explorer 	splx(s);
   1245       1.42  jdolecek 	return (error);
   1246        1.1  explorer }
   1247        1.1  explorer 
   1248        1.3  explorer 
   1249       1.42  jdolecek /*
   1250        1.3  explorer  * Cisco framing implementation.
   1251        1.3  explorer  */
   1252        1.3  explorer 
   1253        1.1  explorer /*
   1254        1.1  explorer  * Handle incoming Cisco keepalive protocol packets.
   1255        1.1  explorer  */
   1256        1.3  explorer static void
   1257        1.3  explorer sppp_cisco_input(struct sppp *sp, struct mbuf *m)
   1258        1.1  explorer {
   1259        1.3  explorer 	STDDCL;
   1260        1.1  explorer 	struct cisco_packet *h;
   1261       1.79  christos #ifdef INET
   1262      1.109      matt 	uint32_t me, mymask = 0;	/* XXX: GCC */
   1263       1.79  christos #endif
   1264        1.1  explorer 
   1265      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   1266      1.163  knakahar 
   1267      1.163  knakahar 	sppp_lock_enter(sp);
   1268      1.163  knakahar 
   1269        1.1  explorer 	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
   1270        1.3  explorer 		if (debug)
   1271        1.3  explorer 			log(LOG_DEBUG,
   1272       1.64    itojun 			    "%s: cisco invalid packet length: %d bytes\n",
   1273       1.64    itojun 			    ifp->if_xname, m->m_pkthdr.len);
   1274      1.163  knakahar 		sppp_lock_exit(sp);
   1275        1.1  explorer 		return;
   1276        1.1  explorer 	}
   1277       1.59    itojun 	h = mtod(m, struct cisco_packet *);
   1278        1.3  explorer 	if (debug)
   1279        1.3  explorer 		log(LOG_DEBUG,
   1280       1.64    itojun 		    "%s: cisco input: %d bytes "
   1281       1.30      ross 		    "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1282       1.64    itojun 		    ifp->if_xname, m->m_pkthdr.len,
   1283       1.80    itojun 		    ntohl(h->type), h->par1, h->par2, (u_int)h->rel,
   1284        1.3  explorer 		    (u_int)h->time0, (u_int)h->time1);
   1285       1.80    itojun 	switch (ntohl(h->type)) {
   1286        1.1  explorer 	default:
   1287        1.3  explorer 		if (debug)
   1288       1.64    itojun 			addlog("%s: cisco unknown packet type: 0x%x\n",
   1289       1.80    itojun 			       ifp->if_xname, ntohl(h->type));
   1290        1.1  explorer 		break;
   1291        1.1  explorer 	case CISCO_ADDR_REPLY:
   1292        1.1  explorer 		/* Reply on address request, ignore */
   1293        1.1  explorer 		break;
   1294        1.1  explorer 	case CISCO_KEEPALIVE_REQ:
   1295        1.1  explorer 		sp->pp_alivecnt = 0;
   1296       1.80    itojun 		sp->pp_rseq[IDX_LCP] = ntohl(h->par1);
   1297        1.9    itojun 		if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
   1298        1.1  explorer 			/* Local and remote sequence numbers are equal.
   1299        1.1  explorer 			 * Probably, the line is in loopback mode. */
   1300       1.68    martin 			if (sp->pp_loopcnt >= LOOPALIVECNT) {
   1301       1.64    itojun 				printf ("%s: loopback\n",
   1302       1.64    itojun 					ifp->if_xname);
   1303        1.1  explorer 				sp->pp_loopcnt = 0;
   1304        1.1  explorer 				if (ifp->if_flags & IFF_UP) {
   1305      1.163  knakahar 					sppp_lock_exit(sp);
   1306       1.59    itojun 					if_down(ifp);
   1307      1.163  knakahar 					sppp_lock_enter(sp);
   1308       1.59    itojun 					IF_PURGE(&sp->pp_cpq);
   1309        1.1  explorer 				}
   1310        1.1  explorer 			}
   1311        1.1  explorer 			++sp->pp_loopcnt;
   1312        1.1  explorer 
   1313        1.1  explorer 			/* Generate new local sequence number */
   1314      1.124       tls 			sp->pp_seq[IDX_LCP] = cprng_fast32();
   1315        1.1  explorer 			break;
   1316        1.1  explorer 		}
   1317        1.3  explorer 		sp->pp_loopcnt = 0;
   1318        1.1  explorer 		if (! (ifp->if_flags & IFF_UP) &&
   1319        1.1  explorer 		    (ifp->if_flags & IFF_RUNNING)) {
   1320      1.163  knakahar 			sppp_lock_exit(sp);
   1321        1.3  explorer 			if_up(ifp);
   1322      1.163  knakahar 			sppp_lock_enter(sp);
   1323        1.1  explorer 		}
   1324        1.1  explorer 		break;
   1325        1.1  explorer 	case CISCO_ADDR_REQ:
   1326       1.79  christos #ifdef INET
   1327      1.163  knakahar 		sppp_lock_exit(sp);
   1328        1.3  explorer 		sppp_get_ip_addrs(sp, &me, 0, &mymask);
   1329        1.3  explorer 		if (me != 0L)
   1330        1.3  explorer 			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
   1331       1.79  christos #endif
   1332      1.163  knakahar 		sppp_lock_enter(sp);
   1333        1.1  explorer 		break;
   1334        1.1  explorer 	}
   1335      1.163  knakahar 	sppp_lock_exit(sp);
   1336        1.1  explorer }
   1337        1.1  explorer 
   1338        1.1  explorer /*
   1339        1.3  explorer  * Send Cisco keepalive packet.
   1340        1.1  explorer  */
   1341        1.1  explorer static void
   1342       1.30      ross sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2)
   1343        1.1  explorer {
   1344        1.3  explorer 	STDDCL;
   1345        1.1  explorer 	struct ppp_header *h;
   1346        1.3  explorer 	struct cisco_packet *ch;
   1347        1.1  explorer 	struct mbuf *m;
   1348      1.109      matt 	uint32_t t;
   1349        1.1  explorer 
   1350      1.163  knakahar 	KASSERT(sppp_locked(sp));
   1351      1.163  knakahar 
   1352       1.92    kardel 	t = time_uptime * 1000;
   1353       1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1354        1.1  explorer 	if (! m)
   1355        1.1  explorer 		return;
   1356        1.3  explorer 	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
   1357      1.142     ozaki 	m_reset_rcvif(m);
   1358        1.1  explorer 
   1359       1.59    itojun 	h = mtod(m, struct ppp_header *);
   1360        1.3  explorer 	h->address = CISCO_MULTICAST;
   1361        1.3  explorer 	h->control = 0;
   1362       1.59    itojun 	h->protocol = htons(CISCO_KEEPALIVE);
   1363        1.3  explorer 
   1364       1.59    itojun 	ch = (struct cisco_packet *)(h + 1);
   1365       1.59    itojun 	ch->type = htonl(type);
   1366       1.59    itojun 	ch->par1 = htonl(par1);
   1367       1.59    itojun 	ch->par2 = htonl(par2);
   1368        1.3  explorer 	ch->rel = -1;
   1369        1.3  explorer 
   1370       1.59    itojun 	ch->time0 = htons((u_short)(t >> 16));
   1371       1.59    itojun 	ch->time1 = htons((u_short) t);
   1372        1.1  explorer 
   1373        1.3  explorer 	if (debug)
   1374        1.3  explorer 		log(LOG_DEBUG,
   1375       1.64    itojun 		    "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1376       1.80    itojun 			ifp->if_xname, ntohl(ch->type), ch->par1,
   1377       1.30      ross 			ch->par2, (u_int)ch->rel, (u_int)ch->time0,
   1378       1.30      ross 			(u_int)ch->time1);
   1379        1.1  explorer 
   1380       1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   1381       1.59    itojun 		IF_DROP(&sp->pp_fastq);
   1382       1.59    itojun 		IF_DROP(&ifp->if_snd);
   1383       1.59    itojun 		m_freem(m);
   1384       1.50      yamt 		++ifp->if_oerrors;
   1385       1.50      yamt 		return;
   1386  1.165.2.1    bouyer 	}
   1387  1.165.2.1    bouyer 
   1388  1.165.2.1    bouyer 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1389  1.165.2.1    bouyer 	IF_ENQUEUE(&sp->pp_cpq, m);
   1390  1.165.2.1    bouyer 
   1391      1.163  knakahar 	if (! (ifp->if_flags & IFF_OACTIVE)) {
   1392      1.163  knakahar 		sppp_lock_exit(sp);
   1393      1.143  knakahar 		if_start_lock(ifp);
   1394      1.163  knakahar 		sppp_lock_enter(sp);
   1395      1.163  knakahar 	}
   1396        1.1  explorer }
   1397        1.1  explorer 
   1398       1.42  jdolecek /*
   1399        1.3  explorer  * PPP protocol implementation.
   1400        1.3  explorer  */
   1401        1.3  explorer 
   1402        1.1  explorer /*
   1403        1.3  explorer  * Send PPP control protocol packet.
   1404        1.1  explorer  */
   1405        1.1  explorer static void
   1406        1.3  explorer sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
   1407        1.3  explorer 	     u_char ident, u_short len, void *data)
   1408        1.1  explorer {
   1409        1.3  explorer 	STDDCL;
   1410        1.3  explorer 	struct lcp_header *lh;
   1411        1.1  explorer 	struct mbuf *m;
   1412       1.22    martin 	size_t pkthdrlen;
   1413        1.1  explorer 
   1414      1.163  knakahar 	KASSERT(sppp_locked(sp));
   1415      1.163  knakahar 
   1416       1.22    martin 	pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
   1417       1.22    martin 
   1418       1.22    martin 	if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
   1419       1.22    martin 		len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
   1420       1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1421        1.1  explorer 	if (! m)
   1422        1.1  explorer 		return;
   1423       1.22    martin 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   1424      1.142     ozaki 	m_reset_rcvif(m);
   1425        1.1  explorer 
   1426       1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
   1427      1.109      matt 		*mtod(m, uint16_t *) = htons(proto);
   1428      1.109      matt 		lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2);
   1429       1.22    martin 	} else {
   1430       1.22    martin 		struct ppp_header *h;
   1431       1.59    itojun 		h = mtod(m, struct ppp_header *);
   1432       1.22    martin 		h->address = PPP_ALLSTATIONS;        /* broadcast address */
   1433       1.22    martin 		h->control = PPP_UI;                 /* Unnumbered Info */
   1434       1.59    itojun 		h->protocol = htons(proto);         /* Link Control Protocol */
   1435       1.59    itojun 		lh = (struct lcp_header *)(h + 1);
   1436       1.22    martin 	}
   1437        1.3  explorer 	lh->type = type;
   1438        1.3  explorer 	lh->ident = ident;
   1439       1.59    itojun 	lh->len = htons(LCP_HEADER_LEN + len);
   1440        1.3  explorer 	if (len)
   1441      1.140  christos 		memcpy(lh + 1, data, len);
   1442        1.1  explorer 
   1443        1.3  explorer 	if (debug) {
   1444       1.64    itojun 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
   1445       1.64    itojun 		    ifp->if_xname,
   1446        1.3  explorer 		    sppp_proto_name(proto),
   1447       1.59    itojun 		    sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len));
   1448        1.3  explorer 		if (len)
   1449       1.59    itojun 			sppp_print_bytes((u_char *)(lh + 1), len);
   1450        1.3  explorer 		addlog(">\n");
   1451        1.3  explorer 	}
   1452       1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   1453       1.59    itojun 		IF_DROP(&sp->pp_fastq);
   1454       1.59    itojun 		IF_DROP(&ifp->if_snd);
   1455       1.59    itojun 		m_freem(m);
   1456        1.3  explorer 		++ifp->if_oerrors;
   1457       1.50      yamt 		return;
   1458  1.165.2.1    bouyer 	}
   1459  1.165.2.1    bouyer 
   1460  1.165.2.1    bouyer 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1461  1.165.2.1    bouyer 	IF_ENQUEUE(&sp->pp_cpq, m);
   1462      1.163  knakahar 
   1463      1.163  knakahar 	if (! (ifp->if_flags & IFF_OACTIVE)) {
   1464      1.163  knakahar 		sppp_lock_exit(sp);
   1465      1.143  knakahar 		if_start_lock(ifp);
   1466      1.163  knakahar 		sppp_lock_enter(sp);
   1467      1.163  knakahar 	}
   1468        1.1  explorer }
   1469        1.1  explorer 
   1470        1.1  explorer /*
   1471        1.3  explorer  * Handle incoming PPP control protocol packets.
   1472        1.1  explorer  */
   1473        1.1  explorer static void
   1474        1.3  explorer sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
   1475        1.1  explorer {
   1476        1.3  explorer 	STDDCL;
   1477        1.1  explorer 	struct lcp_header *h;
   1478       1.96   adrianp 	int printlen, len = m->m_pkthdr.len;
   1479        1.3  explorer 	int rv;
   1480        1.3  explorer 	u_char *p;
   1481      1.109      matt 	uint32_t u32;
   1482        1.1  explorer 
   1483      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   1484        1.1  explorer 	if (len < 4) {
   1485        1.3  explorer 		if (debug)
   1486        1.3  explorer 			log(LOG_DEBUG,
   1487       1.64    itojun 			    "%s: %s invalid packet length: %d bytes\n",
   1488       1.64    itojun 			    ifp->if_xname, cp->name, len);
   1489        1.1  explorer 		return;
   1490        1.1  explorer 	}
   1491       1.59    itojun 	h = mtod(m, struct lcp_header *);
   1492        1.3  explorer 	if (debug) {
   1493       1.96   adrianp 		printlen = ntohs(h->len);
   1494        1.3  explorer 		log(LOG_DEBUG,
   1495       1.64    itojun 		    "%s: %s input(%s): <%s id=0x%x len=%d",
   1496       1.64    itojun 		    ifp->if_xname, cp->name,
   1497        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]),
   1498       1.96   adrianp 		    sppp_cp_type_name(h->type), h->ident, printlen);
   1499       1.96   adrianp 		if (len < printlen)
   1500       1.96   adrianp 			printlen = len;
   1501       1.96   adrianp 		if (printlen > 4)
   1502       1.96   adrianp 			sppp_print_bytes((u_char *)(h + 1), printlen - 4);
   1503        1.3  explorer 		addlog(">\n");
   1504        1.1  explorer 	}
   1505       1.59    itojun 	if (len > ntohs(h->len))
   1506       1.59    itojun 		len = ntohs(h->len);
   1507        1.3  explorer 	p = (u_char *)(h + 1);
   1508        1.1  explorer 	switch (h->type) {
   1509        1.3  explorer 	case CONF_REQ:
   1510        1.1  explorer 		if (len < 4) {
   1511        1.3  explorer 			if (debug)
   1512       1.64    itojun 				addlog("%s: %s invalid conf-req length %d\n",
   1513       1.64    itojun 				       ifp->if_xname, cp->name,
   1514        1.3  explorer 				       len);
   1515      1.163  knakahar 			sppp_lock_enter(sp);
   1516        1.3  explorer 			++ifp->if_ierrors;
   1517      1.163  knakahar 			sppp_lock_exit(sp);
   1518        1.3  explorer 			break;
   1519        1.3  explorer 		}
   1520        1.3  explorer 		/* handle states where RCR doesn't get a SCA/SCN */
   1521      1.163  knakahar 		sppp_lock_enter(sp);
   1522        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1523        1.3  explorer 		case STATE_CLOSING:
   1524        1.3  explorer 		case STATE_STOPPING:
   1525      1.163  knakahar 			sppp_lock_exit(sp);
   1526        1.1  explorer 			return;
   1527        1.3  explorer 		case STATE_CLOSED:
   1528        1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
   1529        1.3  explorer 				     0, 0);
   1530      1.163  knakahar 			sppp_lock_exit(sp);
   1531        1.3  explorer 			return;
   1532        1.3  explorer 		}
   1533        1.3  explorer 		rv = (cp->RCR)(sp, h, len);
   1534       1.96   adrianp 		if (rv < 0) {
   1535       1.96   adrianp 			/* fatal error, shut down */
   1536       1.96   adrianp 			(cp->tld)(sp);
   1537       1.96   adrianp 			sppp_lcp_tlf(sp);
   1538      1.163  knakahar 			sppp_lock_exit(sp);
   1539       1.96   adrianp 			return;
   1540       1.96   adrianp 		}
   1541        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1542        1.3  explorer 		case STATE_OPENED:
   1543        1.3  explorer 			(cp->tld)(sp);
   1544        1.3  explorer 			(cp->scr)(sp);
   1545        1.3  explorer 			/* fall through... */
   1546        1.3  explorer 		case STATE_ACK_SENT:
   1547        1.3  explorer 		case STATE_REQ_SENT:
   1548        1.3  explorer 			sppp_cp_change_state(cp, sp, rv?
   1549        1.3  explorer 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1550        1.3  explorer 			break;
   1551        1.3  explorer 		case STATE_STOPPED:
   1552        1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1553        1.3  explorer 			(cp->scr)(sp);
   1554        1.3  explorer 			sppp_cp_change_state(cp, sp, rv?
   1555        1.3  explorer 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1556        1.3  explorer 			break;
   1557        1.3  explorer 		case STATE_ACK_RCVD:
   1558        1.3  explorer 			if (rv) {
   1559        1.3  explorer 				sppp_cp_change_state(cp, sp, STATE_OPENED);
   1560        1.3  explorer 				if (debug)
   1561       1.64    itojun 					log(LOG_DEBUG, "%s: %s tlu\n",
   1562       1.64    itojun 					    ifp->if_xname,
   1563        1.3  explorer 					    cp->name);
   1564        1.3  explorer 				(cp->tlu)(sp);
   1565        1.3  explorer 			} else
   1566        1.3  explorer 				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1567        1.3  explorer 			break;
   1568        1.3  explorer 		default:
   1569      1.163  knakahar 			sppp_lock_enter(sp);
   1570       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1571       1.64    itojun 			       ifp->if_xname, cp->name,
   1572        1.3  explorer 			       sppp_cp_type_name(h->type),
   1573        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1574        1.3  explorer 			++ifp->if_ierrors;
   1575        1.3  explorer 		}
   1576      1.163  knakahar 		sppp_lock_exit(sp);
   1577        1.3  explorer 		break;
   1578        1.3  explorer 	case CONF_ACK:
   1579      1.163  knakahar 		sppp_lock_enter(sp);
   1580        1.3  explorer 		if (h->ident != sp->confid[cp->protoidx]) {
   1581        1.3  explorer 			if (debug)
   1582       1.64    itojun 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
   1583       1.64    itojun 				       ifp->if_xname, cp->name,
   1584        1.3  explorer 				       h->ident, sp->confid[cp->protoidx]);
   1585        1.3  explorer 			++ifp->if_ierrors;
   1586      1.163  knakahar 			sppp_lock_exit(sp);
   1587        1.3  explorer 			break;
   1588        1.3  explorer 		}
   1589        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1590        1.3  explorer 		case STATE_CLOSED:
   1591        1.3  explorer 		case STATE_STOPPED:
   1592        1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1593        1.3  explorer 			break;
   1594        1.3  explorer 		case STATE_CLOSING:
   1595        1.3  explorer 		case STATE_STOPPING:
   1596        1.3  explorer 			break;
   1597        1.3  explorer 		case STATE_REQ_SENT:
   1598        1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1599        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1600        1.3  explorer 			break;
   1601        1.3  explorer 		case STATE_OPENED:
   1602        1.3  explorer 			(cp->tld)(sp);
   1603        1.3  explorer 			/* fall through */
   1604        1.3  explorer 		case STATE_ACK_RCVD:
   1605        1.3  explorer 			(cp->scr)(sp);
   1606        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1607        1.3  explorer 			break;
   1608        1.3  explorer 		case STATE_ACK_SENT:
   1609        1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1610        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_OPENED);
   1611        1.3  explorer 			if (debug)
   1612       1.64    itojun 				log(LOG_DEBUG, "%s: %s tlu\n",
   1613       1.64    itojun 				       ifp->if_xname, cp->name);
   1614        1.3  explorer 			(cp->tlu)(sp);
   1615        1.3  explorer 			break;
   1616        1.3  explorer 		default:
   1617       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1618       1.64    itojun 			       ifp->if_xname, cp->name,
   1619        1.3  explorer 			       sppp_cp_type_name(h->type),
   1620        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1621        1.3  explorer 			++ifp->if_ierrors;
   1622        1.3  explorer 		}
   1623      1.163  knakahar 		sppp_lock_exit(sp);
   1624        1.3  explorer 		break;
   1625        1.3  explorer 	case CONF_NAK:
   1626        1.3  explorer 	case CONF_REJ:
   1627      1.163  knakahar 		sppp_lock_enter(sp);
   1628        1.3  explorer 		if (h->ident != sp->confid[cp->protoidx]) {
   1629        1.3  explorer 			if (debug)
   1630       1.64    itojun 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
   1631       1.64    itojun 				       ifp->if_xname, cp->name,
   1632        1.3  explorer 				       h->ident, sp->confid[cp->protoidx]);
   1633        1.3  explorer 			++ifp->if_ierrors;
   1634      1.163  knakahar 			sppp_lock_exit(sp);
   1635        1.3  explorer 			break;
   1636        1.1  explorer 		}
   1637        1.3  explorer 		if (h->type == CONF_NAK)
   1638        1.3  explorer 			(cp->RCN_nak)(sp, h, len);
   1639        1.3  explorer 		else /* CONF_REJ */
   1640        1.3  explorer 			(cp->RCN_rej)(sp, h, len);
   1641        1.3  explorer 
   1642        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1643        1.3  explorer 		case STATE_CLOSED:
   1644        1.3  explorer 		case STATE_STOPPED:
   1645        1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1646        1.3  explorer 			break;
   1647        1.3  explorer 		case STATE_REQ_SENT:
   1648        1.3  explorer 		case STATE_ACK_SENT:
   1649        1.3  explorer 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1650        1.3  explorer 			(cp->scr)(sp);
   1651        1.3  explorer 			break;
   1652        1.3  explorer 		case STATE_OPENED:
   1653        1.3  explorer 			(cp->tld)(sp);
   1654        1.3  explorer 			/* fall through */
   1655        1.3  explorer 		case STATE_ACK_RCVD:
   1656        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
   1657        1.3  explorer 			(cp->scr)(sp);
   1658        1.3  explorer 			break;
   1659        1.3  explorer 		case STATE_CLOSING:
   1660        1.3  explorer 		case STATE_STOPPING:
   1661        1.3  explorer 			break;
   1662        1.3  explorer 		default:
   1663       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1664       1.64    itojun 			       ifp->if_xname, cp->name,
   1665        1.3  explorer 			       sppp_cp_type_name(h->type),
   1666        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1667        1.3  explorer 			++ifp->if_ierrors;
   1668        1.3  explorer 		}
   1669      1.163  knakahar 		sppp_lock_exit(sp);
   1670        1.3  explorer 		break;
   1671        1.3  explorer 
   1672        1.3  explorer 	case TERM_REQ:
   1673      1.163  knakahar 		sppp_lock_enter(sp);
   1674        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1675        1.3  explorer 		case STATE_ACK_RCVD:
   1676        1.3  explorer 		case STATE_ACK_SENT:
   1677        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1678        1.3  explorer 			/* fall through */
   1679        1.3  explorer 		case STATE_CLOSED:
   1680        1.3  explorer 		case STATE_STOPPED:
   1681        1.3  explorer 		case STATE_CLOSING:
   1682        1.3  explorer 		case STATE_STOPPING:
   1683        1.3  explorer 		case STATE_REQ_SENT:
   1684        1.3  explorer 		  sta:
   1685        1.3  explorer 			/* Send Terminate-Ack packet. */
   1686        1.3  explorer 			if (debug)
   1687       1.64    itojun 				log(LOG_DEBUG, "%s: %s send terminate-ack\n",
   1688       1.64    itojun 				    ifp->if_xname, cp->name);
   1689        1.3  explorer 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1690        1.3  explorer 			break;
   1691        1.3  explorer 		case STATE_OPENED:
   1692        1.3  explorer 			(cp->tld)(sp);
   1693        1.3  explorer 			sp->rst_counter[cp->protoidx] = 0;
   1694        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPING);
   1695        1.3  explorer 			goto sta;
   1696        1.3  explorer 		default:
   1697       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1698       1.64    itojun 			       ifp->if_xname, cp->name,
   1699        1.3  explorer 			       sppp_cp_type_name(h->type),
   1700        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1701        1.3  explorer 			++ifp->if_ierrors;
   1702        1.1  explorer 		}
   1703      1.163  knakahar 		sppp_lock_exit(sp);
   1704        1.1  explorer 		break;
   1705        1.3  explorer 	case TERM_ACK:
   1706      1.163  knakahar 		sppp_lock_enter(sp);
   1707        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1708        1.3  explorer 		case STATE_CLOSED:
   1709        1.3  explorer 		case STATE_STOPPED:
   1710        1.3  explorer 		case STATE_REQ_SENT:
   1711        1.3  explorer 		case STATE_ACK_SENT:
   1712        1.3  explorer 			break;
   1713        1.3  explorer 		case STATE_CLOSING:
   1714        1.3  explorer 			(cp->tlf)(sp);
   1715        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1716       1.24    martin 			sppp_lcp_check_and_close(sp);
   1717        1.3  explorer 			break;
   1718        1.3  explorer 		case STATE_STOPPING:
   1719        1.3  explorer 			(cp->tlf)(sp);
   1720        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1721       1.24    martin 			sppp_lcp_check_and_close(sp);
   1722        1.1  explorer 			break;
   1723        1.3  explorer 		case STATE_ACK_RCVD:
   1724        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1725        1.1  explorer 			break;
   1726        1.3  explorer 		case STATE_OPENED:
   1727        1.3  explorer 			(cp->tld)(sp);
   1728        1.3  explorer 			(cp->scr)(sp);
   1729        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1730        1.1  explorer 			break;
   1731        1.3  explorer 		default:
   1732       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1733       1.64    itojun 			       ifp->if_xname, cp->name,
   1734        1.3  explorer 			       sppp_cp_type_name(h->type),
   1735        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1736        1.3  explorer 			++ifp->if_ierrors;
   1737        1.1  explorer 		}
   1738      1.163  knakahar 		sppp_lock_exit(sp);
   1739        1.1  explorer 		break;
   1740        1.3  explorer 	case CODE_REJ:
   1741        1.3  explorer 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1742      1.163  knakahar 		sppp_lock_enter(sp);
   1743        1.3  explorer 		log(LOG_INFO,
   1744       1.64    itojun 		    "%s: %s: ignoring RXJ (%s) for code ?, "
   1745        1.3  explorer 		    "danger will robinson\n",
   1746       1.64    itojun 		    ifp->if_xname, cp->name,
   1747        1.9    itojun 		    sppp_cp_type_name(h->type));
   1748        1.9    itojun 		switch (sp->state[cp->protoidx]) {
   1749        1.9    itojun 		case STATE_CLOSED:
   1750        1.9    itojun 		case STATE_STOPPED:
   1751        1.9    itojun 		case STATE_REQ_SENT:
   1752        1.9    itojun 		case STATE_ACK_SENT:
   1753        1.9    itojun 		case STATE_CLOSING:
   1754        1.9    itojun 		case STATE_STOPPING:
   1755        1.9    itojun 		case STATE_OPENED:
   1756        1.9    itojun 			break;
   1757        1.9    itojun 		case STATE_ACK_RCVD:
   1758        1.9    itojun 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1759        1.9    itojun 			break;
   1760        1.9    itojun 		default:
   1761       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1762       1.64    itojun 			       ifp->if_xname, cp->name,
   1763        1.9    itojun 			       sppp_cp_type_name(h->type),
   1764        1.9    itojun 			       sppp_state_name(sp->state[cp->protoidx]));
   1765        1.9    itojun 			++ifp->if_ierrors;
   1766        1.9    itojun 		}
   1767      1.163  knakahar 		sppp_lock_exit(sp);
   1768        1.9    itojun 		break;
   1769        1.9    itojun 	case PROTO_REJ:
   1770        1.9    itojun 	    {
   1771        1.9    itojun 		int catastrophic;
   1772        1.9    itojun 		const struct cp *upper;
   1773        1.9    itojun 		int i;
   1774      1.109      matt 		uint16_t proto;
   1775        1.9    itojun 
   1776        1.9    itojun 		catastrophic = 0;
   1777        1.9    itojun 		upper = NULL;
   1778       1.30      ross 		proto = p[0] << 8 | p[1];
   1779        1.9    itojun 		for (i = 0; i < IDX_COUNT; i++) {
   1780        1.9    itojun 			if (cps[i]->proto == proto) {
   1781        1.9    itojun 				upper = cps[i];
   1782        1.9    itojun 				break;
   1783        1.9    itojun 			}
   1784        1.9    itojun 		}
   1785        1.9    itojun 		if (upper == NULL)
   1786        1.9    itojun 			catastrophic++;
   1787        1.9    itojun 
   1788      1.163  knakahar 		sppp_lock_enter(sp);
   1789      1.163  knakahar 
   1790       1.46    martin 		if (debug)
   1791       1.46    martin 			log(LOG_INFO,
   1792       1.64    itojun 			    "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
   1793       1.64    itojun 			    ifp->if_xname, cp->name, catastrophic ? '-' : '+',
   1794       1.46    martin 			    sppp_cp_type_name(h->type), proto,
   1795       1.46    martin 			    upper ? upper->name : "unknown",
   1796       1.46    martin 			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
   1797        1.9    itojun 
   1798        1.9    itojun 		/*
   1799        1.9    itojun 		 * if we got RXJ+ against conf-req, the peer does not implement
   1800        1.9    itojun 		 * this particular protocol type.  terminate the protocol.
   1801        1.9    itojun 		 */
   1802        1.9    itojun 		if (upper && !catastrophic) {
   1803        1.9    itojun 			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
   1804        1.9    itojun 				upper->Close(sp);
   1805      1.163  knakahar 				sppp_lock_exit(sp);
   1806        1.9    itojun 				break;
   1807        1.9    itojun 			}
   1808        1.9    itojun 		}
   1809        1.9    itojun 
   1810        1.9    itojun 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1811        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   1812        1.3  explorer 		case STATE_CLOSED:
   1813        1.3  explorer 		case STATE_STOPPED:
   1814        1.3  explorer 		case STATE_REQ_SENT:
   1815        1.3  explorer 		case STATE_ACK_SENT:
   1816        1.3  explorer 		case STATE_CLOSING:
   1817        1.3  explorer 		case STATE_STOPPING:
   1818        1.3  explorer 		case STATE_OPENED:
   1819        1.3  explorer 			break;
   1820        1.3  explorer 		case STATE_ACK_RCVD:
   1821        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1822        1.1  explorer 			break;
   1823        1.3  explorer 		default:
   1824       1.64    itojun 			printf("%s: %s illegal %s in state %s\n",
   1825       1.64    itojun 			       ifp->if_xname, cp->name,
   1826        1.3  explorer 			       sppp_cp_type_name(h->type),
   1827        1.3  explorer 			       sppp_state_name(sp->state[cp->protoidx]));
   1828        1.3  explorer 			++ifp->if_ierrors;
   1829        1.3  explorer 		}
   1830      1.163  knakahar 		sppp_lock_exit(sp);
   1831        1.1  explorer 		break;
   1832        1.9    itojun 	    }
   1833        1.3  explorer 	case DISC_REQ:
   1834        1.3  explorer 		if (cp->proto != PPP_LCP)
   1835        1.3  explorer 			goto illegal;
   1836        1.3  explorer 		/* Discard the packet. */
   1837        1.3  explorer 		break;
   1838        1.3  explorer 	case ECHO_REQ:
   1839        1.3  explorer 		if (cp->proto != PPP_LCP)
   1840        1.3  explorer 			goto illegal;
   1841      1.163  knakahar 		sppp_lock_enter(sp);
   1842        1.3  explorer 		if (sp->state[cp->protoidx] != STATE_OPENED) {
   1843        1.3  explorer 			if (debug)
   1844       1.64    itojun 				addlog("%s: lcp echo req but lcp closed\n",
   1845       1.64    itojun 				       ifp->if_xname);
   1846        1.3  explorer 			++ifp->if_ierrors;
   1847      1.163  knakahar 			sppp_lock_exit(sp);
   1848        1.3  explorer 			break;
   1849        1.3  explorer 		}
   1850        1.3  explorer 		if (len < 8) {
   1851        1.3  explorer 			if (debug)
   1852       1.64    itojun 				addlog("%s: invalid lcp echo request "
   1853        1.3  explorer 				       "packet length: %d bytes\n",
   1854       1.64    itojun 				       ifp->if_xname, len);
   1855      1.163  knakahar 			sppp_lock_exit(sp);
   1856        1.3  explorer 			break;
   1857        1.3  explorer 		}
   1858       1.30      ross 		memcpy(&u32, h + 1, sizeof u32);
   1859       1.30      ross 		if (ntohl(u32) == sp->lcp.magic) {
   1860        1.3  explorer 			/* Line loopback mode detected. */
   1861       1.64    itojun 			printf("%s: loopback\n", ifp->if_xname);
   1862       1.59    itojun 			if_down(ifp);
   1863       1.59    itojun 			IF_PURGE(&sp->pp_cpq);
   1864        1.3  explorer 
   1865        1.3  explorer 			/* Shut down the PPP link. */
   1866        1.3  explorer 			/* XXX */
   1867        1.3  explorer 			lcp.Down(sp);
   1868        1.3  explorer 			lcp.Up(sp);
   1869      1.163  knakahar 			sppp_lock_exit(sp);
   1870        1.3  explorer 			break;
   1871        1.3  explorer 		}
   1872       1.30      ross 		u32 = htonl(sp->lcp.magic);
   1873       1.30      ross 		memcpy(h + 1, &u32, sizeof u32);
   1874        1.3  explorer 		if (debug)
   1875       1.64    itojun 			addlog("%s: got lcp echo req, sending echo rep\n",
   1876       1.64    itojun 			       ifp->if_xname);
   1877       1.59    itojun 		sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4,
   1878       1.59    itojun 		    h + 1);
   1879      1.163  knakahar 		sppp_lock_exit(sp);
   1880        1.1  explorer 		break;
   1881        1.3  explorer 	case ECHO_REPLY:
   1882        1.3  explorer 		if (cp->proto != PPP_LCP)
   1883        1.3  explorer 			goto illegal;
   1884      1.163  knakahar 		sppp_lock_enter(sp);
   1885        1.3  explorer 		if (h->ident != sp->lcp.echoid) {
   1886        1.3  explorer 			++ifp->if_ierrors;
   1887      1.163  knakahar 			sppp_lock_exit(sp);
   1888        1.3  explorer 			break;
   1889        1.3  explorer 		}
   1890        1.3  explorer 		if (len < 8) {
   1891        1.3  explorer 			if (debug)
   1892       1.64    itojun 				addlog("%s: lcp invalid echo reply "
   1893        1.3  explorer 				       "packet length: %d bytes\n",
   1894       1.64    itojun 				       ifp->if_xname, len);
   1895      1.163  knakahar 			sppp_lock_exit(sp);
   1896        1.3  explorer 			break;
   1897        1.3  explorer 		}
   1898        1.3  explorer 		if (debug)
   1899       1.64    itojun 			addlog("%s: lcp got echo rep\n",
   1900       1.64    itojun 			       ifp->if_xname);
   1901       1.30      ross 		memcpy(&u32, h + 1, sizeof u32);
   1902       1.30      ross 		if (ntohl(u32) != sp->lcp.magic)
   1903        1.3  explorer 			sp->pp_alivecnt = 0;
   1904      1.163  knakahar 		sppp_lock_exit(sp);
   1905        1.1  explorer 		break;
   1906        1.3  explorer 	default:
   1907        1.3  explorer 		/* Unknown packet type -- send Code-Reject packet. */
   1908        1.3  explorer 	  illegal:
   1909      1.163  knakahar 		sppp_lock_enter(sp);
   1910        1.3  explorer 		if (debug)
   1911       1.64    itojun 			addlog("%s: %s send code-rej for 0x%x\n",
   1912       1.64    itojun 			       ifp->if_xname, cp->name, h->type);
   1913        1.9    itojun 		sppp_cp_send(sp, cp->proto, CODE_REJ,
   1914        1.9    itojun 		    ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
   1915        1.3  explorer 		++ifp->if_ierrors;
   1916      1.163  knakahar 		sppp_lock_exit(sp);
   1917        1.1  explorer 	}
   1918        1.1  explorer }
   1919        1.1  explorer 
   1920        1.3  explorer 
   1921        1.3  explorer /*
   1922        1.3  explorer  * The generic part of all Up/Down/Open/Close/TO event handlers.
   1923        1.3  explorer  * Basically, the state transition handling in the automaton.
   1924        1.3  explorer  */
   1925        1.1  explorer static void
   1926        1.3  explorer sppp_up_event(const struct cp *cp, struct sppp *sp)
   1927        1.1  explorer {
   1928        1.3  explorer 	STDDCL;
   1929        1.1  explorer 
   1930      1.163  knakahar 	KASSERT(sppp_locked(sp));
   1931      1.163  knakahar 
   1932        1.3  explorer 	if (debug)
   1933       1.64    itojun 		log(LOG_DEBUG, "%s: %s up(%s)\n",
   1934       1.64    itojun 		    ifp->if_xname, cp->name,
   1935        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1936        1.3  explorer 
   1937        1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1938        1.3  explorer 	case STATE_INITIAL:
   1939        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1940        1.3  explorer 		break;
   1941        1.3  explorer 	case STATE_STARTING:
   1942        1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1943        1.3  explorer 		(cp->scr)(sp);
   1944        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1945        1.3  explorer 		break;
   1946        1.3  explorer 	default:
   1947       1.64    itojun 		printf("%s: %s illegal up in state %s\n",
   1948       1.64    itojun 		       ifp->if_xname, cp->name,
   1949        1.3  explorer 		       sppp_state_name(sp->state[cp->protoidx]));
   1950        1.3  explorer 	}
   1951        1.1  explorer }
   1952        1.1  explorer 
   1953        1.1  explorer static void
   1954        1.3  explorer sppp_down_event(const struct cp *cp, struct sppp *sp)
   1955        1.1  explorer {
   1956        1.3  explorer 	STDDCL;
   1957        1.3  explorer 
   1958      1.163  knakahar 	KASSERT(sppp_locked(sp));
   1959      1.163  knakahar 
   1960        1.3  explorer 	if (debug)
   1961       1.64    itojun 		log(LOG_DEBUG, "%s: %s down(%s)\n",
   1962       1.64    itojun 		    ifp->if_xname, cp->name,
   1963        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   1964        1.3  explorer 
   1965        1.3  explorer 	switch (sp->state[cp->protoidx]) {
   1966        1.3  explorer 	case STATE_CLOSED:
   1967        1.3  explorer 	case STATE_CLOSING:
   1968        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   1969        1.3  explorer 		break;
   1970        1.3  explorer 	case STATE_STOPPED:
   1971        1.3  explorer 		(cp->tls)(sp);
   1972        1.3  explorer 		/* fall through */
   1973        1.3  explorer 	case STATE_STOPPING:
   1974        1.3  explorer 	case STATE_REQ_SENT:
   1975        1.3  explorer 	case STATE_ACK_RCVD:
   1976        1.3  explorer 	case STATE_ACK_SENT:
   1977        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1978        1.3  explorer 		break;
   1979        1.3  explorer 	case STATE_OPENED:
   1980        1.3  explorer 		(cp->tld)(sp);
   1981        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1982        1.3  explorer 		break;
   1983        1.3  explorer 	default:
   1984       1.64    itojun 		printf("%s: %s illegal down in state %s\n",
   1985       1.64    itojun 		       ifp->if_xname, cp->name,
   1986        1.3  explorer 		       sppp_state_name(sp->state[cp->protoidx]));
   1987        1.3  explorer 	}
   1988        1.1  explorer }
   1989        1.1  explorer 
   1990        1.3  explorer 
   1991        1.1  explorer static void
   1992        1.3  explorer sppp_open_event(const struct cp *cp, struct sppp *sp)
   1993        1.1  explorer {
   1994        1.3  explorer 	STDDCL;
   1995        1.1  explorer 
   1996      1.163  knakahar 	KASSERT(sppp_locked(sp));
   1997      1.163  knakahar 
   1998        1.3  explorer 	if (debug)
   1999       1.64    itojun 		log(LOG_DEBUG, "%s: %s open(%s)\n",
   2000       1.64    itojun 		    ifp->if_xname, cp->name,
   2001        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   2002        1.3  explorer 
   2003        1.3  explorer 	switch (sp->state[cp->protoidx]) {
   2004        1.3  explorer 	case STATE_INITIAL:
   2005       1.91  christos 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   2006        1.3  explorer 		(cp->tls)(sp);
   2007        1.3  explorer 		break;
   2008        1.3  explorer 	case STATE_STARTING:
   2009        1.3  explorer 		break;
   2010        1.3  explorer 	case STATE_CLOSED:
   2011        1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   2012        1.3  explorer 		(cp->scr)(sp);
   2013        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   2014        1.3  explorer 		break;
   2015        1.3  explorer 	case STATE_STOPPED:
   2016        1.3  explorer 	case STATE_STOPPING:
   2017        1.3  explorer 	case STATE_REQ_SENT:
   2018        1.3  explorer 	case STATE_ACK_RCVD:
   2019        1.3  explorer 	case STATE_ACK_SENT:
   2020        1.3  explorer 	case STATE_OPENED:
   2021        1.3  explorer 		break;
   2022        1.3  explorer 	case STATE_CLOSING:
   2023        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_STOPPING);
   2024        1.1  explorer 		break;
   2025        1.1  explorer 	}
   2026        1.1  explorer }
   2027        1.1  explorer 
   2028        1.3  explorer 
   2029        1.3  explorer static void
   2030        1.3  explorer sppp_close_event(const struct cp *cp, struct sppp *sp)
   2031        1.1  explorer {
   2032        1.3  explorer 	STDDCL;
   2033        1.1  explorer 
   2034      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2035      1.163  knakahar 
   2036        1.3  explorer 	if (debug)
   2037       1.64    itojun 		log(LOG_DEBUG, "%s: %s close(%s)\n",
   2038       1.64    itojun 		    ifp->if_xname, cp->name,
   2039        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]));
   2040        1.3  explorer 
   2041        1.3  explorer 	switch (sp->state[cp->protoidx]) {
   2042        1.3  explorer 	case STATE_INITIAL:
   2043        1.3  explorer 	case STATE_CLOSED:
   2044        1.3  explorer 	case STATE_CLOSING:
   2045        1.3  explorer 		break;
   2046        1.3  explorer 	case STATE_STARTING:
   2047       1.91  christos 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   2048        1.3  explorer 		(cp->tlf)(sp);
   2049        1.3  explorer 		break;
   2050        1.3  explorer 	case STATE_STOPPED:
   2051        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   2052        1.3  explorer 		break;
   2053        1.3  explorer 	case STATE_STOPPING:
   2054        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   2055        1.3  explorer 		break;
   2056        1.3  explorer 	case STATE_OPENED:
   2057        1.3  explorer 		(cp->tld)(sp);
   2058        1.3  explorer 		/* fall through */
   2059        1.3  explorer 	case STATE_REQ_SENT:
   2060        1.3  explorer 	case STATE_ACK_RCVD:
   2061        1.3  explorer 	case STATE_ACK_SENT:
   2062        1.3  explorer 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
   2063        1.9    itojun 		sppp_cp_send(sp, cp->proto, TERM_REQ,
   2064        1.9    itojun 		    ++sp->pp_seq[cp->protoidx], 0, 0);
   2065        1.3  explorer 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   2066        1.3  explorer 		break;
   2067        1.3  explorer 	}
   2068        1.3  explorer }
   2069        1.3  explorer 
   2070        1.3  explorer static void
   2071        1.3  explorer sppp_to_event(const struct cp *cp, struct sppp *sp)
   2072        1.3  explorer {
   2073        1.3  explorer 	STDDCL;
   2074        1.3  explorer 	int s;
   2075        1.3  explorer 
   2076      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2077      1.163  knakahar 
   2078       1.23   thorpej 	s = splnet();
   2079      1.163  knakahar 
   2080        1.3  explorer 	if (debug)
   2081       1.64    itojun 		log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n",
   2082       1.64    itojun 		    ifp->if_xname, cp->name,
   2083        1.3  explorer 		    sppp_state_name(sp->state[cp->protoidx]),
   2084        1.3  explorer 		    sp->rst_counter[cp->protoidx]);
   2085        1.3  explorer 
   2086        1.3  explorer 	if (--sp->rst_counter[cp->protoidx] < 0)
   2087        1.3  explorer 		/* TO- event */
   2088        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   2089        1.3  explorer 		case STATE_CLOSING:
   2090        1.3  explorer 			(cp->tlf)(sp);
   2091        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   2092       1.24    martin 			sppp_lcp_check_and_close(sp);
   2093        1.3  explorer 			break;
   2094        1.3  explorer 		case STATE_STOPPING:
   2095        1.3  explorer 			(cp->tlf)(sp);
   2096        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   2097       1.24    martin 			sppp_lcp_check_and_close(sp);
   2098        1.3  explorer 			break;
   2099        1.3  explorer 		case STATE_REQ_SENT:
   2100        1.3  explorer 		case STATE_ACK_RCVD:
   2101        1.3  explorer 		case STATE_ACK_SENT:
   2102        1.3  explorer 			(cp->tlf)(sp);
   2103        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   2104       1.24    martin 			sppp_lcp_check_and_close(sp);
   2105        1.3  explorer 			break;
   2106        1.3  explorer 		}
   2107        1.3  explorer 	else
   2108        1.3  explorer 		/* TO+ event */
   2109        1.3  explorer 		switch (sp->state[cp->protoidx]) {
   2110        1.3  explorer 		case STATE_CLOSING:
   2111        1.3  explorer 		case STATE_STOPPING:
   2112        1.9    itojun 			sppp_cp_send(sp, cp->proto, TERM_REQ,
   2113        1.9    itojun 			    ++sp->pp_seq[cp->protoidx], 0, 0);
   2114        1.7   thorpej 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   2115        1.7   thorpej 			    cp->TO, sp);
   2116        1.3  explorer 			break;
   2117        1.3  explorer 		case STATE_REQ_SENT:
   2118        1.3  explorer 		case STATE_ACK_RCVD:
   2119        1.3  explorer 			(cp->scr)(sp);
   2120        1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   2121        1.3  explorer 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   2122        1.3  explorer 			break;
   2123        1.3  explorer 		case STATE_ACK_SENT:
   2124        1.3  explorer 			(cp->scr)(sp);
   2125        1.7   thorpej 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   2126        1.7   thorpej 			    cp->TO, sp);
   2127        1.3  explorer 			break;
   2128        1.3  explorer 		}
   2129        1.3  explorer 
   2130        1.3  explorer 	splx(s);
   2131        1.3  explorer }
   2132        1.3  explorer 
   2133        1.3  explorer /*
   2134        1.3  explorer  * Change the state of a control protocol in the state automaton.
   2135        1.3  explorer  * Takes care of starting/stopping the restart timer.
   2136        1.3  explorer  */
   2137        1.3  explorer void
   2138        1.3  explorer sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
   2139        1.3  explorer {
   2140      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2141      1.163  knakahar 
   2142        1.3  explorer 	sp->state[cp->protoidx] = newstate;
   2143        1.7   thorpej 	callout_stop(&sp->ch[cp->protoidx]);
   2144        1.3  explorer 	switch (newstate) {
   2145        1.3  explorer 	case STATE_INITIAL:
   2146        1.3  explorer 	case STATE_STARTING:
   2147        1.3  explorer 	case STATE_CLOSED:
   2148        1.3  explorer 	case STATE_STOPPED:
   2149        1.3  explorer 	case STATE_OPENED:
   2150        1.3  explorer 		break;
   2151        1.3  explorer 	case STATE_CLOSING:
   2152        1.3  explorer 	case STATE_STOPPING:
   2153        1.3  explorer 	case STATE_REQ_SENT:
   2154        1.3  explorer 	case STATE_ACK_RCVD:
   2155        1.3  explorer 	case STATE_ACK_SENT:
   2156        1.7   thorpej 		callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   2157        1.7   thorpej 		    cp->TO, sp);
   2158        1.3  explorer 		break;
   2159        1.3  explorer 	}
   2160        1.3  explorer }
   2161       1.42  jdolecek 
   2162       1.42  jdolecek /*
   2163        1.3  explorer  *--------------------------------------------------------------------------*
   2164        1.3  explorer  *                                                                          *
   2165        1.3  explorer  *                         The LCP implementation.                          *
   2166        1.3  explorer  *                                                                          *
   2167        1.3  explorer  *--------------------------------------------------------------------------*
   2168        1.3  explorer  */
   2169        1.3  explorer static void
   2170        1.3  explorer sppp_lcp_init(struct sppp *sp)
   2171        1.3  explorer {
   2172      1.163  knakahar 	sppp_lock_enter(sp);
   2173        1.3  explorer 	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
   2174        1.3  explorer 	sp->lcp.magic = 0;
   2175        1.3  explorer 	sp->state[IDX_LCP] = STATE_INITIAL;
   2176        1.3  explorer 	sp->fail_counter[IDX_LCP] = 0;
   2177        1.9    itojun 	sp->pp_seq[IDX_LCP] = 0;
   2178        1.9    itojun 	sp->pp_rseq[IDX_LCP] = 0;
   2179        1.3  explorer 	sp->lcp.protos = 0;
   2180        1.3  explorer 
   2181        1.3  explorer 	/*
   2182        1.3  explorer 	 * Initialize counters and timeout values.  Note that we don't
   2183        1.3  explorer 	 * use the 3 seconds suggested in RFC 1661 since we are likely
   2184        1.3  explorer 	 * running on a fast link.  XXX We should probably implement
   2185        1.3  explorer 	 * the exponential backoff option.  Note that these values are
   2186        1.3  explorer 	 * relevant for all control protocols, not just LCP only.
   2187        1.3  explorer 	 */
   2188        1.3  explorer 	sp->lcp.timeout = 1 * hz;
   2189        1.3  explorer 	sp->lcp.max_terminate = 2;
   2190        1.3  explorer 	sp->lcp.max_configure = 10;
   2191        1.3  explorer 	sp->lcp.max_failure = 10;
   2192      1.106        ad 	callout_init(&sp->ch[IDX_LCP], 0);
   2193      1.163  knakahar 	sppp_lock_exit(sp);
   2194        1.3  explorer }
   2195        1.3  explorer 
   2196        1.3  explorer static void
   2197        1.3  explorer sppp_lcp_up(struct sppp *sp)
   2198        1.3  explorer {
   2199        1.3  explorer 	STDDCL;
   2200        1.3  explorer 
   2201      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2202      1.163  knakahar 
   2203       1.40    martin 	/* Initialize activity timestamp: opening a connection is an activity */
   2204       1.92    kardel 	sp->pp_last_receive = sp->pp_last_activity = time_uptime;
   2205       1.40    martin 
   2206        1.3  explorer 	/*
   2207        1.3  explorer 	 * If this interface is passive or dial-on-demand, and we are
   2208        1.3  explorer 	 * still in Initial state, it means we've got an incoming
   2209        1.3  explorer 	 * call.  Activate the interface.
   2210        1.3  explorer 	 */
   2211        1.3  explorer 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
   2212        1.3  explorer 		if (debug)
   2213        1.3  explorer 			log(LOG_DEBUG,
   2214       1.64    itojun 			    "%s: Up event", ifp->if_xname);
   2215        1.3  explorer 		ifp->if_flags |= IFF_RUNNING;
   2216        1.3  explorer 		if (sp->state[IDX_LCP] == STATE_INITIAL) {
   2217        1.3  explorer 			if (debug)
   2218        1.3  explorer 				addlog("(incoming call)\n");
   2219        1.3  explorer 			sp->pp_flags |= PP_CALLIN;
   2220        1.3  explorer 			lcp.Open(sp);
   2221        1.3  explorer 		} else if (debug)
   2222        1.3  explorer 			addlog("\n");
   2223       1.32    martin 	} else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
   2224       1.32    martin 		   (sp->state[IDX_LCP] == STATE_INITIAL)) {
   2225       1.32    martin 			ifp->if_flags |= IFF_RUNNING;
   2226       1.32    martin 			lcp.Open(sp);
   2227        1.3  explorer 	}
   2228        1.3  explorer 
   2229        1.3  explorer 	sppp_up_event(&lcp, sp);
   2230        1.3  explorer }
   2231        1.3  explorer 
   2232        1.3  explorer static void
   2233        1.3  explorer sppp_lcp_down(struct sppp *sp)
   2234        1.3  explorer {
   2235        1.3  explorer 	STDDCL;
   2236        1.3  explorer 
   2237      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2238      1.163  knakahar 
   2239        1.3  explorer 	sppp_down_event(&lcp, sp);
   2240        1.3  explorer 
   2241        1.3  explorer 	/*
   2242        1.3  explorer 	 * If this is neither a dial-on-demand nor a passive
   2243        1.3  explorer 	 * interface, simulate an ``ifconfig down'' action, so the
   2244        1.3  explorer 	 * administrator can force a redial by another ``ifconfig
   2245        1.3  explorer 	 * up''.  XXX For leased line operation, should we immediately
   2246        1.3  explorer 	 * try to reopen the connection here?
   2247        1.3  explorer 	 */
   2248        1.3  explorer 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
   2249       1.46    martin 		if (debug)
   2250       1.46    martin 			log(LOG_INFO,
   2251       1.64    itojun 			    "%s: Down event (carrier loss), taking interface down.\n",
   2252       1.64    itojun 			    ifp->if_xname);
   2253      1.163  knakahar 		sppp_lock_exit(sp);
   2254        1.3  explorer 		if_down(ifp);
   2255      1.163  knakahar 		sppp_lock_enter(sp);
   2256        1.3  explorer 	} else {
   2257        1.3  explorer 		if (debug)
   2258        1.3  explorer 			log(LOG_DEBUG,
   2259       1.64    itojun 			    "%s: Down event (carrier loss)\n",
   2260       1.64    itojun 			    ifp->if_xname);
   2261        1.3  explorer 	}
   2262        1.3  explorer 	sp->pp_flags &= ~PP_CALLIN;
   2263        1.3  explorer 	if (sp->state[IDX_LCP] != STATE_INITIAL)
   2264        1.3  explorer 		lcp.Close(sp);
   2265        1.3  explorer 	ifp->if_flags &= ~IFF_RUNNING;
   2266        1.3  explorer }
   2267        1.3  explorer 
   2268        1.3  explorer static void
   2269        1.3  explorer sppp_lcp_open(struct sppp *sp)
   2270        1.3  explorer {
   2271      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2272      1.163  knakahar 
   2273      1.122       rjs 	if (sp->pp_if.if_mtu < PP_MTU) {
   2274      1.122       rjs 		sp->lcp.mru = sp->pp_if.if_mtu;
   2275      1.122       rjs 		sp->lcp.opts |= (1 << LCP_OPT_MRU);
   2276      1.122       rjs 	} else
   2277      1.122       rjs 		sp->lcp.mru = PP_MTU;
   2278      1.122       rjs 	sp->lcp.their_mru = PP_MTU;
   2279      1.122       rjs 
   2280        1.3  explorer 	/*
   2281        1.3  explorer 	 * If we are authenticator, negotiate LCP_AUTH
   2282        1.3  explorer 	 */
   2283        1.3  explorer 	if (sp->hisauth.proto != 0)
   2284        1.3  explorer 		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
   2285        1.3  explorer 	else
   2286        1.3  explorer 		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2287        1.3  explorer 	sp->pp_flags &= ~PP_NEEDAUTH;
   2288        1.3  explorer 	sppp_open_event(&lcp, sp);
   2289        1.3  explorer }
   2290        1.3  explorer 
   2291        1.3  explorer static void
   2292        1.3  explorer sppp_lcp_close(struct sppp *sp)
   2293        1.3  explorer {
   2294      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2295        1.3  explorer 	sppp_close_event(&lcp, sp);
   2296        1.3  explorer }
   2297        1.3  explorer 
   2298        1.3  explorer static void
   2299        1.3  explorer sppp_lcp_TO(void *cookie)
   2300        1.3  explorer {
   2301      1.163  knakahar 	struct sppp *sp = (struct sppp*)cookie;
   2302      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   2303      1.163  knakahar 
   2304      1.163  knakahar 	sppp_lock_enter(sp);
   2305      1.163  knakahar 	sppp_to_event(&lcp, sp);
   2306      1.163  knakahar 	sppp_lock_exit(sp);
   2307        1.3  explorer }
   2308        1.3  explorer 
   2309        1.3  explorer /*
   2310        1.3  explorer  * Analyze a configure request.  Return true if it was agreeable, and
   2311        1.3  explorer  * caused action sca, false if it has been rejected or nak'ed, and
   2312        1.3  explorer  * caused action scn.  (The return value is used to make the state
   2313        1.3  explorer  * transition decision in the state automaton.)
   2314        1.3  explorer  */
   2315        1.3  explorer static int
   2316        1.3  explorer sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   2317        1.3  explorer {
   2318        1.3  explorer 	STDDCL;
   2319      1.140  christos 	u_char *buf, *r, *p, l, blen;
   2320        1.3  explorer 	int origlen, rlen;
   2321      1.109      matt 	uint32_t nmagic;
   2322        1.3  explorer 	u_short authproto;
   2323        1.3  explorer 
   2324      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2325      1.163  knakahar 
   2326        1.3  explorer 	len -= 4;
   2327        1.3  explorer 	origlen = len;
   2328      1.140  christos 	buf = r = malloc (blen = len, M_TEMP, M_NOWAIT);
   2329        1.3  explorer 	if (! buf)
   2330        1.3  explorer 		return (0);
   2331        1.3  explorer 
   2332        1.3  explorer 	if (debug)
   2333       1.64    itojun 		log(LOG_DEBUG, "%s: lcp parse opts:",
   2334       1.64    itojun 		    ifp->if_xname);
   2335        1.3  explorer 
   2336        1.3  explorer 	/* pass 1: check for things that need to be rejected */
   2337       1.59    itojun 	p = (void *)(h + 1);
   2338      1.140  christos 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   2339       1.96   adrianp 		/* Sanity check option length */
   2340      1.140  christos 		if (l > len) {
   2341       1.96   adrianp 			/*
   2342      1.102       wiz 			 * Malicious option - drop immediately.
   2343       1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2344       1.96   adrianp 			 */
   2345       1.96   adrianp 			addlog("%s: received malicious LCP option 0x%02x, "
   2346       1.96   adrianp 			    "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname,
   2347      1.140  christos 			    p[0], l, len);
   2348       1.96   adrianp 			goto drop;
   2349       1.96   adrianp 		}
   2350        1.3  explorer 		if (debug)
   2351        1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2352        1.3  explorer 		switch (*p) {
   2353        1.3  explorer 		case LCP_OPT_MAGIC:
   2354        1.3  explorer 			/* Magic number. */
   2355        1.3  explorer 			/* fall through, both are same length */
   2356        1.3  explorer 		case LCP_OPT_ASYNC_MAP:
   2357        1.3  explorer 			/* Async control character map. */
   2358      1.140  christos 			if (len >= 6 || l == 6)
   2359        1.3  explorer 				continue;
   2360        1.3  explorer 			if (debug)
   2361        1.9    itojun 				addlog(" [invalid]");
   2362        1.3  explorer 			break;
   2363        1.3  explorer 		case LCP_OPT_MRU:
   2364        1.3  explorer 			/* Maximum receive unit. */
   2365      1.140  christos 			if (len >= 4 && l == 4)
   2366        1.3  explorer 				continue;
   2367        1.3  explorer 			if (debug)
   2368        1.9    itojun 				addlog(" [invalid]");
   2369        1.3  explorer 			break;
   2370        1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2371        1.3  explorer 			if (len < 4) {
   2372        1.3  explorer 				if (debug)
   2373        1.9    itojun 					addlog(" [invalid]");
   2374        1.3  explorer 				break;
   2375        1.3  explorer 			}
   2376        1.3  explorer 			authproto = (p[2] << 8) + p[3];
   2377      1.140  christos 			if (authproto == PPP_CHAP && l != 5) {
   2378        1.3  explorer 				if (debug)
   2379        1.9    itojun 					addlog(" [invalid chap len]");
   2380        1.3  explorer 				break;
   2381        1.3  explorer 			}
   2382        1.3  explorer 			if (sp->myauth.proto == 0) {
   2383        1.3  explorer 				/* we are not configured to do auth */
   2384        1.3  explorer 				if (debug)
   2385        1.9    itojun 					addlog(" [not configured]");
   2386        1.3  explorer 				break;
   2387        1.3  explorer 			}
   2388        1.3  explorer 			/*
   2389        1.3  explorer 			 * Remote want us to authenticate, remember this,
   2390       1.36    martin 			 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got
   2391        1.3  explorer 			 * up.
   2392        1.3  explorer 			 */
   2393        1.3  explorer 			sp->pp_flags |= PP_NEEDAUTH;
   2394        1.3  explorer 			continue;
   2395        1.3  explorer 		default:
   2396        1.3  explorer 			/* Others not supported. */
   2397        1.3  explorer 			if (debug)
   2398        1.9    itojun 				addlog(" [rej]");
   2399        1.3  explorer 			break;
   2400        1.3  explorer 		}
   2401      1.140  christos 		if (rlen + l > blen) {
   2402      1.140  christos 			if (debug)
   2403      1.140  christos 				addlog(" [overflow]");
   2404      1.140  christos 			continue;
   2405      1.140  christos 		}
   2406        1.3  explorer 		/* Add the option to rejected list. */
   2407      1.140  christos 		memcpy(r, p, l);
   2408      1.140  christos 		r += l;
   2409      1.140  christos 		rlen += l;
   2410        1.3  explorer 	}
   2411        1.3  explorer 	if (rlen) {
   2412        1.3  explorer 		if (debug)
   2413        1.3  explorer 			addlog(" send conf-rej\n");
   2414       1.59    itojun 		sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2415        1.9    itojun 		goto end;
   2416        1.3  explorer 	} else if (debug)
   2417        1.3  explorer 		addlog("\n");
   2418        1.3  explorer 
   2419        1.3  explorer 	/*
   2420        1.3  explorer 	 * pass 2: check for option values that are unacceptable and
   2421        1.3  explorer 	 * thus require to be nak'ed.
   2422        1.3  explorer 	 */
   2423        1.3  explorer 	if (debug)
   2424       1.64    itojun 		log(LOG_DEBUG, "%s: lcp parse opt values: ",
   2425       1.64    itojun 		    ifp->if_xname);
   2426        1.3  explorer 
   2427       1.59    itojun 	p = (void *)(h + 1);
   2428        1.3  explorer 	len = origlen;
   2429      1.140  christos 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   2430        1.3  explorer 		if (debug)
   2431        1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2432        1.3  explorer 		switch (*p) {
   2433        1.3  explorer 		case LCP_OPT_MAGIC:
   2434        1.3  explorer 			/* Magic number -- extract. */
   2435      1.109      matt 			nmagic = (uint32_t)p[2] << 24 |
   2436      1.109      matt 				(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
   2437        1.3  explorer 			if (nmagic != sp->lcp.magic) {
   2438        1.3  explorer 				if (debug)
   2439       1.30      ross 					addlog(" 0x%x", nmagic);
   2440        1.3  explorer 				continue;
   2441        1.3  explorer 			}
   2442        1.3  explorer 			/*
   2443        1.3  explorer 			 * Local and remote magics equal -- loopback?
   2444        1.3  explorer 			 */
   2445       1.68    martin 			if (sp->pp_loopcnt >= LOOPALIVECNT*5) {
   2446       1.64    itojun 				printf ("%s: loopback\n",
   2447       1.64    itojun 					ifp->if_xname);
   2448        1.3  explorer 				sp->pp_loopcnt = 0;
   2449        1.3  explorer 				if (ifp->if_flags & IFF_UP) {
   2450      1.163  knakahar 					sppp_lock_exit(sp);
   2451        1.3  explorer 					if_down(ifp);
   2452      1.163  knakahar 					sppp_lock_enter(sp);
   2453       1.26    itojun 					IF_PURGE(&sp->pp_cpq);
   2454        1.3  explorer 					/* XXX ? */
   2455        1.3  explorer 					lcp.Down(sp);
   2456        1.3  explorer 					lcp.Up(sp);
   2457        1.3  explorer 				}
   2458        1.3  explorer 			} else if (debug)
   2459        1.9    itojun 				addlog(" [glitch]");
   2460        1.3  explorer 			++sp->pp_loopcnt;
   2461        1.3  explorer 			/*
   2462        1.3  explorer 			 * We negate our magic here, and NAK it.  If
   2463        1.3  explorer 			 * we see it later in an NAK packet, we
   2464        1.3  explorer 			 * suggest a new one.
   2465        1.3  explorer 			 */
   2466        1.3  explorer 			nmagic = ~sp->lcp.magic;
   2467        1.3  explorer 			/* Gonna NAK it. */
   2468        1.3  explorer 			p[2] = nmagic >> 24;
   2469        1.3  explorer 			p[3] = nmagic >> 16;
   2470        1.3  explorer 			p[4] = nmagic >> 8;
   2471        1.3  explorer 			p[5] = nmagic;
   2472        1.3  explorer 			break;
   2473        1.3  explorer 
   2474        1.3  explorer 		case LCP_OPT_ASYNC_MAP:
   2475       1.56  christos 			/*
   2476       1.56  christos 			 * Async control character map -- just ignore it.
   2477       1.56  christos 			 *
   2478       1.56  christos 			 * Quote from RFC 1662, chapter 6:
   2479       1.56  christos 			 * To enable this functionality, synchronous PPP
   2480       1.56  christos 			 * implementations MUST always respond to the
   2481       1.56  christos 			 * Async-Control-Character-Map Configuration
   2482       1.56  christos 			 * Option with the LCP Configure-Ack.  However,
   2483       1.56  christos 			 * acceptance of the Configuration Option does
   2484       1.56  christos 			 * not imply that the synchronous implementation
   2485       1.56  christos 			 * will do any ACCM mapping.  Instead, all such
   2486       1.56  christos 			 * octet mapping will be performed by the
   2487       1.56  christos 			 * asynchronous-to-synchronous converter.
   2488       1.56  christos 			 */
   2489       1.55  christos 			continue;
   2490        1.3  explorer 
   2491        1.3  explorer 		case LCP_OPT_MRU:
   2492        1.3  explorer 			/*
   2493        1.3  explorer 			 * Maximum receive unit.  Always agreeable,
   2494        1.3  explorer 			 * but ignored by now.
   2495        1.3  explorer 			 */
   2496        1.3  explorer 			sp->lcp.their_mru = p[2] * 256 + p[3];
   2497        1.3  explorer 			if (debug)
   2498        1.9    itojun 				addlog(" %ld", sp->lcp.their_mru);
   2499        1.3  explorer 			continue;
   2500        1.3  explorer 
   2501        1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2502        1.3  explorer 			authproto = (p[2] << 8) + p[3];
   2503        1.3  explorer 			if (sp->myauth.proto != authproto) {
   2504        1.3  explorer 				/* not agreed, nak */
   2505        1.3  explorer 				if (debug)
   2506        1.9    itojun 					addlog(" [mine %s != his %s]",
   2507       1.71       oki 					       sppp_proto_name(sp->myauth.proto),
   2508        1.3  explorer 					       sppp_proto_name(authproto));
   2509        1.3  explorer 				p[2] = sp->myauth.proto >> 8;
   2510        1.3  explorer 				p[3] = sp->myauth.proto;
   2511        1.3  explorer 				break;
   2512        1.3  explorer 			}
   2513        1.3  explorer 			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
   2514        1.3  explorer 				if (debug)
   2515        1.9    itojun 					addlog(" [chap not MD5]");
   2516        1.3  explorer 				p[4] = CHAP_MD5;
   2517        1.3  explorer 				break;
   2518        1.3  explorer 			}
   2519        1.3  explorer 			continue;
   2520        1.3  explorer 		}
   2521      1.140  christos 		if (rlen + l > blen) {
   2522      1.140  christos 			if (debug)
   2523      1.140  christos 				addlog(" [overflow]");
   2524      1.140  christos 			continue;
   2525      1.140  christos 		}
   2526        1.3  explorer 		/* Add the option to nak'ed list. */
   2527      1.140  christos 		memcpy(r, p, l);
   2528      1.140  christos 		r += l;
   2529      1.140  christos 		rlen += l;
   2530        1.3  explorer 	}
   2531        1.3  explorer 	if (rlen) {
   2532        1.3  explorer 		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
   2533        1.3  explorer 			if (debug)
   2534        1.3  explorer 				addlog(" max_failure (%d) exceeded, "
   2535        1.3  explorer 				       "send conf-rej\n",
   2536        1.3  explorer 				       sp->lcp.max_failure);
   2537        1.3  explorer 			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2538        1.3  explorer 		} else {
   2539        1.3  explorer 			if (debug)
   2540        1.3  explorer 				addlog(" send conf-nak\n");
   2541       1.59    itojun 			sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
   2542        1.3  explorer 		}
   2543        1.9    itojun 		goto end;
   2544        1.3  explorer 	} else {
   2545        1.3  explorer 		if (debug)
   2546        1.3  explorer 			addlog(" send conf-ack\n");
   2547        1.3  explorer 		sp->fail_counter[IDX_LCP] = 0;
   2548        1.3  explorer 		sp->pp_loopcnt = 0;
   2549       1.59    itojun 		sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1);
   2550        1.3  explorer 	}
   2551        1.3  explorer 
   2552        1.9    itojun  end:
   2553       1.59    itojun 	free(buf, M_TEMP);
   2554        1.3  explorer 	return (rlen == 0);
   2555       1.96   adrianp 
   2556       1.96   adrianp  drop:
   2557       1.96   adrianp 	free(buf, M_TEMP);
   2558       1.96   adrianp 	return -1;
   2559        1.3  explorer }
   2560        1.3  explorer 
   2561        1.3  explorer /*
   2562        1.3  explorer  * Analyze the LCP Configure-Reject option list, and adjust our
   2563        1.3  explorer  * negotiation.
   2564        1.3  explorer  */
   2565        1.3  explorer static void
   2566        1.3  explorer sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   2567        1.3  explorer {
   2568        1.3  explorer 	STDDCL;
   2569      1.140  christos 	u_char *buf, *p, l;
   2570        1.3  explorer 
   2571      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2572      1.163  knakahar 
   2573        1.3  explorer 	len -= 4;
   2574        1.3  explorer 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2575        1.3  explorer 	if (!buf)
   2576        1.3  explorer 		return;
   2577        1.3  explorer 
   2578        1.3  explorer 	if (debug)
   2579       1.64    itojun 		log(LOG_DEBUG, "%s: lcp rej opts:",
   2580       1.64    itojun 		    ifp->if_xname);
   2581        1.3  explorer 
   2582       1.59    itojun 	p = (void *)(h + 1);
   2583      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   2584       1.96   adrianp 		/* Sanity check option length */
   2585      1.140  christos 		if (l > len) {
   2586       1.96   adrianp 			/*
   2587      1.102       wiz 			 * Malicious option - drop immediately.
   2588       1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2589       1.96   adrianp 			 */
   2590       1.96   adrianp 			addlog("%s: received malicious LCP option, "
   2591       1.96   adrianp 			    "dropping.\n", ifp->if_xname);
   2592       1.96   adrianp 			goto drop;
   2593       1.96   adrianp 		}
   2594        1.3  explorer 		if (debug)
   2595        1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2596        1.3  explorer 		switch (*p) {
   2597        1.3  explorer 		case LCP_OPT_MAGIC:
   2598        1.3  explorer 			/* Magic number -- can't use it, use 0 */
   2599        1.3  explorer 			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
   2600        1.3  explorer 			sp->lcp.magic = 0;
   2601        1.3  explorer 			break;
   2602        1.3  explorer 		case LCP_OPT_MRU:
   2603        1.3  explorer 			/*
   2604      1.105       scw 			 * We try to negotiate a lower MRU if the underlying
   2605      1.105       scw 			 * link's MTU is less than PP_MTU (e.g. PPPoE). If the
   2606      1.105       scw 			 * peer rejects this lower rate, fallback to the
   2607      1.105       scw 			 * default.
   2608        1.3  explorer 			 */
   2609      1.105       scw 			if (debug) {
   2610      1.105       scw 				addlog("%s: warning: peer rejected our MRU of "
   2611      1.105       scw 				    "%ld bytes. Defaulting to %d bytes\n",
   2612      1.105       scw 				    ifp->if_xname, sp->lcp.mru, PP_MTU);
   2613      1.105       scw 			}
   2614        1.3  explorer 			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
   2615      1.105       scw 			sp->lcp.mru = PP_MTU;
   2616        1.3  explorer 			break;
   2617        1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2618        1.3  explorer 			/*
   2619        1.3  explorer 			 * Peer doesn't want to authenticate himself,
   2620        1.3  explorer 			 * deny unless this is a dialout call, and
   2621       1.36    martin 			 * SPPP_AUTHFLAG_NOCALLOUT is set.
   2622        1.3  explorer 			 */
   2623        1.3  explorer 			if ((sp->pp_flags & PP_CALLIN) == 0 &&
   2624       1.36    martin 			    (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) {
   2625        1.3  explorer 				if (debug)
   2626        1.9    itojun 					addlog(" [don't insist on auth "
   2627        1.3  explorer 					       "for callout]");
   2628        1.3  explorer 				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2629        1.3  explorer 				break;
   2630        1.3  explorer 			}
   2631        1.3  explorer 			if (debug)
   2632        1.3  explorer 				addlog("[access denied]\n");
   2633        1.3  explorer 			lcp.Close(sp);
   2634        1.3  explorer 			break;
   2635        1.3  explorer 		}
   2636        1.3  explorer 	}
   2637        1.3  explorer 	if (debug)
   2638        1.3  explorer 		addlog("\n");
   2639       1.96   adrianp drop:
   2640       1.59    itojun 	free(buf, M_TEMP);
   2641        1.3  explorer 	return;
   2642        1.3  explorer }
   2643        1.3  explorer 
   2644        1.3  explorer /*
   2645        1.3  explorer  * Analyze the LCP Configure-NAK option list, and adjust our
   2646        1.3  explorer  * negotiation.
   2647        1.3  explorer  */
   2648        1.3  explorer static void
   2649        1.3  explorer sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   2650        1.3  explorer {
   2651        1.3  explorer 	STDDCL;
   2652      1.140  christos 	u_char *buf, *p, l, blen;
   2653      1.109      matt 	uint32_t magic;
   2654        1.3  explorer 
   2655      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2656      1.163  knakahar 
   2657        1.3  explorer 	len -= 4;
   2658      1.140  christos 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
   2659        1.3  explorer 	if (!buf)
   2660        1.3  explorer 		return;
   2661        1.3  explorer 
   2662        1.3  explorer 	if (debug)
   2663       1.64    itojun 		log(LOG_DEBUG, "%s: lcp nak opts:",
   2664       1.64    itojun 		    ifp->if_xname);
   2665        1.3  explorer 
   2666       1.59    itojun 	p = (void *)(h + 1);
   2667      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   2668       1.96   adrianp 		/* Sanity check option length */
   2669      1.140  christos 		if (l > len) {
   2670       1.96   adrianp 			/*
   2671      1.102       wiz 			 * Malicious option - drop immediately.
   2672       1.96   adrianp 			 * XXX Maybe we should just RXJ it?
   2673       1.96   adrianp 			 */
   2674       1.96   adrianp 			addlog("%s: received malicious LCP option, "
   2675       1.96   adrianp 			    "dropping.\n", ifp->if_xname);
   2676       1.96   adrianp 			goto drop;
   2677       1.96   adrianp 		}
   2678        1.3  explorer 		if (debug)
   2679        1.9    itojun 			addlog(" %s", sppp_lcp_opt_name(*p));
   2680        1.3  explorer 		switch (*p) {
   2681        1.3  explorer 		case LCP_OPT_MAGIC:
   2682        1.3  explorer 			/* Magic number -- renegotiate */
   2683        1.3  explorer 			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
   2684      1.140  christos 			    len >= 6 && l == 6) {
   2685      1.109      matt 				magic = (uint32_t)p[2] << 24 |
   2686      1.109      matt 					(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
   2687        1.3  explorer 				/*
   2688        1.3  explorer 				 * If the remote magic is our negated one,
   2689        1.3  explorer 				 * this looks like a loopback problem.
   2690        1.3  explorer 				 * Suggest a new magic to make sure.
   2691        1.3  explorer 				 */
   2692        1.3  explorer 				if (magic == ~sp->lcp.magic) {
   2693        1.3  explorer 					if (debug)
   2694        1.9    itojun 						addlog(" magic glitch");
   2695      1.124       tls 					sp->lcp.magic = cprng_fast32();
   2696        1.3  explorer 				} else {
   2697        1.3  explorer 					sp->lcp.magic = magic;
   2698        1.3  explorer 					if (debug)
   2699       1.30      ross 						addlog(" %d", magic);
   2700        1.3  explorer 				}
   2701        1.3  explorer 			}
   2702        1.3  explorer 			break;
   2703        1.3  explorer 		case LCP_OPT_MRU:
   2704        1.3  explorer 			/*
   2705        1.3  explorer 			 * Peer wants to advise us to negotiate an MRU.
   2706        1.3  explorer 			 * Agree on it if it's reasonable, or use
   2707        1.3  explorer 			 * default otherwise.
   2708        1.3  explorer 			 */
   2709      1.140  christos 			if (len >= 4 && l == 4) {
   2710        1.3  explorer 				u_int mru = p[2] * 256 + p[3];
   2711        1.3  explorer 				if (debug)
   2712        1.9    itojun 					addlog(" %d", mru);
   2713      1.105       scw 				if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu)
   2714      1.105       scw 					mru = sp->pp_if.if_mtu;
   2715        1.3  explorer 				sp->lcp.mru = mru;
   2716        1.3  explorer 				sp->lcp.opts |= (1 << LCP_OPT_MRU);
   2717        1.3  explorer 			}
   2718        1.3  explorer 			break;
   2719        1.3  explorer 		case LCP_OPT_AUTH_PROTO:
   2720        1.3  explorer 			/*
   2721        1.3  explorer 			 * Peer doesn't like our authentication method,
   2722        1.3  explorer 			 * deny.
   2723        1.3  explorer 			 */
   2724        1.3  explorer 			if (debug)
   2725        1.3  explorer 				addlog("[access denied]\n");
   2726        1.3  explorer 			lcp.Close(sp);
   2727        1.3  explorer 			break;
   2728        1.3  explorer 		}
   2729        1.3  explorer 	}
   2730        1.3  explorer 	if (debug)
   2731        1.3  explorer 		addlog("\n");
   2732       1.96   adrianp drop:
   2733       1.59    itojun 	free(buf, M_TEMP);
   2734        1.3  explorer 	return;
   2735        1.3  explorer }
   2736        1.3  explorer 
   2737        1.3  explorer static void
   2738        1.3  explorer sppp_lcp_tlu(struct sppp *sp)
   2739        1.3  explorer {
   2740      1.149     joerg 	struct ifnet *ifp = &sp->pp_if;
   2741        1.3  explorer 	int i;
   2742      1.109      matt 	uint32_t mask;
   2743        1.3  explorer 
   2744      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2745      1.163  knakahar 
   2746        1.3  explorer 	/* XXX ? */
   2747        1.3  explorer 	if (! (ifp->if_flags & IFF_UP) &&
   2748        1.3  explorer 	    (ifp->if_flags & IFF_RUNNING)) {
   2749        1.3  explorer 		/* Coming out of loopback mode. */
   2750      1.163  knakahar 		sppp_lock_exit(sp);
   2751        1.3  explorer 		if_up(ifp);
   2752      1.163  knakahar 		sppp_lock_enter(sp);
   2753        1.3  explorer 	}
   2754        1.3  explorer 
   2755        1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   2756        1.3  explorer 		if ((cps[i])->flags & CP_QUAL)
   2757        1.3  explorer 			(cps[i])->Open(sp);
   2758        1.3  explorer 
   2759        1.3  explorer 	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
   2760        1.3  explorer 	    (sp->pp_flags & PP_NEEDAUTH) != 0)
   2761      1.149     joerg 		sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE);
   2762        1.3  explorer 	else
   2763      1.149     joerg 		sppp_change_phase(sp, SPPP_PHASE_NETWORK);
   2764        1.3  explorer 
   2765        1.3  explorer 	/*
   2766        1.3  explorer 	 * Open all authentication protocols.  This is even required
   2767        1.3  explorer 	 * if we already proceeded to network phase, since it might be
   2768        1.3  explorer 	 * that remote wants us to authenticate, so we might have to
   2769        1.3  explorer 	 * send a PAP request.  Undesired authentication protocols
   2770        1.3  explorer 	 * don't do anything when they get an Open event.
   2771        1.3  explorer 	 */
   2772        1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   2773        1.3  explorer 		if ((cps[i])->flags & CP_AUTH)
   2774        1.3  explorer 			(cps[i])->Open(sp);
   2775        1.3  explorer 
   2776       1.36    martin 	if (sp->pp_phase == SPPP_PHASE_NETWORK) {
   2777        1.3  explorer 		/* Notify all NCPs. */
   2778        1.3  explorer 		for (i = 0; i < IDX_COUNT; i++)
   2779        1.3  explorer 			if ((cps[i])->flags & CP_NCP)
   2780        1.3  explorer 				(cps[i])->Open(sp);
   2781        1.3  explorer 	}
   2782        1.3  explorer 
   2783        1.3  explorer 	/* Send Up events to all started protos. */
   2784      1.163  knakahar 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) {
   2785      1.163  knakahar 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
   2786        1.3  explorer 			(cps[i])->Up(sp);
   2787      1.163  knakahar 		}
   2788      1.163  knakahar 	}
   2789        1.3  explorer 
   2790        1.3  explorer 	/* notify low-level driver of state change */
   2791        1.3  explorer 	if (sp->pp_chg)
   2792        1.3  explorer 		sp->pp_chg(sp, (int)sp->pp_phase);
   2793       1.82     perry 
   2794       1.36    martin 	if (sp->pp_phase == SPPP_PHASE_NETWORK)
   2795        1.3  explorer 		/* if no NCP is starting, close down */
   2796        1.3  explorer 		sppp_lcp_check_and_close(sp);
   2797        1.3  explorer }
   2798        1.3  explorer 
   2799        1.3  explorer static void
   2800        1.3  explorer sppp_lcp_tld(struct sppp *sp)
   2801        1.3  explorer {
   2802        1.3  explorer 	int i;
   2803      1.109      matt 	uint32_t mask;
   2804        1.3  explorer 
   2805      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2806      1.163  knakahar 
   2807      1.149     joerg 	sppp_change_phase(sp, SPPP_PHASE_TERMINATE);
   2808        1.3  explorer 
   2809        1.3  explorer 	/*
   2810        1.3  explorer 	 * Take upper layers down.  We send the Down event first and
   2811        1.3  explorer 	 * the Close second to prevent the upper layers from sending
   2812        1.3  explorer 	 * ``a flurry of terminate-request packets'', as the RFC
   2813        1.3  explorer 	 * describes it.
   2814        1.3  explorer 	 */
   2815      1.163  knakahar 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) {
   2816       1.13    itojun 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
   2817        1.3  explorer 			(cps[i])->Down(sp);
   2818        1.3  explorer 			(cps[i])->Close(sp);
   2819        1.3  explorer 		}
   2820      1.163  knakahar 	}
   2821        1.3  explorer }
   2822        1.3  explorer 
   2823        1.3  explorer static void
   2824        1.3  explorer sppp_lcp_tls(struct sppp *sp)
   2825        1.3  explorer {
   2826        1.3  explorer 
   2827      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2828      1.163  knakahar 
   2829       1.39    martin 	if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) {
   2830      1.163  knakahar 		printf("%s: authentication failed %d times, not retrying again\n",
   2831       1.39    martin 		sp->pp_if.if_xname, sp->pp_auth_failures);
   2832      1.163  knakahar 		sppp_lock_exit(sp);
   2833      1.163  knakahar 		if_down(&sp->pp_if);
   2834      1.163  knakahar 		sppp_lock_enter(sp);
   2835      1.163  knakahar 		return;
   2836       1.39    martin 	}
   2837       1.39    martin 
   2838      1.149     joerg 	sppp_change_phase(sp, SPPP_PHASE_ESTABLISH);
   2839        1.3  explorer 
   2840        1.3  explorer 	/* Notify lower layer if desired. */
   2841        1.3  explorer 	if (sp->pp_tls)
   2842        1.3  explorer 		(sp->pp_tls)(sp);
   2843        1.3  explorer }
   2844        1.3  explorer 
   2845        1.3  explorer static void
   2846        1.3  explorer sppp_lcp_tlf(struct sppp *sp)
   2847        1.3  explorer {
   2848      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2849        1.3  explorer 
   2850      1.149     joerg 	sppp_change_phase(sp, SPPP_PHASE_DEAD);
   2851        1.3  explorer 
   2852        1.3  explorer 	/* Notify lower layer if desired. */
   2853        1.3  explorer 	if (sp->pp_tlf)
   2854        1.3  explorer 		(sp->pp_tlf)(sp);
   2855        1.3  explorer }
   2856        1.3  explorer 
   2857        1.3  explorer static void
   2858        1.3  explorer sppp_lcp_scr(struct sppp *sp)
   2859        1.3  explorer {
   2860        1.3  explorer 	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
   2861        1.3  explorer 	int i = 0;
   2862        1.3  explorer 	u_short authproto;
   2863        1.3  explorer 
   2864      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2865      1.163  knakahar 
   2866        1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
   2867        1.3  explorer 		if (! sp->lcp.magic)
   2868      1.124       tls 			sp->lcp.magic = cprng_fast32();
   2869        1.3  explorer 		opt[i++] = LCP_OPT_MAGIC;
   2870        1.3  explorer 		opt[i++] = 6;
   2871        1.3  explorer 		opt[i++] = sp->lcp.magic >> 24;
   2872        1.3  explorer 		opt[i++] = sp->lcp.magic >> 16;
   2873        1.3  explorer 		opt[i++] = sp->lcp.magic >> 8;
   2874        1.3  explorer 		opt[i++] = sp->lcp.magic;
   2875        1.3  explorer 	}
   2876        1.3  explorer 
   2877        1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
   2878        1.3  explorer 		opt[i++] = LCP_OPT_MRU;
   2879        1.3  explorer 		opt[i++] = 4;
   2880        1.3  explorer 		opt[i++] = sp->lcp.mru >> 8;
   2881        1.3  explorer 		opt[i++] = sp->lcp.mru;
   2882        1.3  explorer 	}
   2883        1.3  explorer 
   2884        1.3  explorer 	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
   2885        1.3  explorer 		authproto = sp->hisauth.proto;
   2886        1.3  explorer 		opt[i++] = LCP_OPT_AUTH_PROTO;
   2887        1.3  explorer 		opt[i++] = authproto == PPP_CHAP? 5: 4;
   2888        1.3  explorer 		opt[i++] = authproto >> 8;
   2889        1.3  explorer 		opt[i++] = authproto;
   2890        1.3  explorer 		if (authproto == PPP_CHAP)
   2891        1.3  explorer 			opt[i++] = CHAP_MD5;
   2892        1.3  explorer 	}
   2893        1.3  explorer 
   2894        1.9    itojun 	sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
   2895       1.59    itojun 	sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
   2896        1.3  explorer }
   2897        1.3  explorer 
   2898        1.3  explorer /*
   2899        1.3  explorer  * Check the open NCPs, return true if at least one NCP is open.
   2900        1.3  explorer  */
   2901        1.3  explorer static int
   2902        1.3  explorer sppp_ncp_check(struct sppp *sp)
   2903        1.3  explorer {
   2904        1.3  explorer 	int i, mask;
   2905        1.3  explorer 
   2906        1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2907       1.13    itojun 		if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
   2908        1.3  explorer 			return 1;
   2909        1.3  explorer 	return 0;
   2910        1.3  explorer }
   2911        1.3  explorer 
   2912        1.3  explorer /*
   2913        1.3  explorer  * Re-check the open NCPs and see if we should terminate the link.
   2914        1.3  explorer  * Called by the NCPs during their tlf action handling.
   2915        1.3  explorer  */
   2916        1.3  explorer static void
   2917        1.3  explorer sppp_lcp_check_and_close(struct sppp *sp)
   2918        1.3  explorer {
   2919      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2920        1.3  explorer 
   2921       1.36    martin 	if (sp->pp_phase < SPPP_PHASE_NETWORK)
   2922        1.3  explorer 		/* don't bother, we are already going down */
   2923        1.3  explorer 		return;
   2924        1.3  explorer 
   2925        1.3  explorer 	if (sppp_ncp_check(sp))
   2926        1.3  explorer 		return;
   2927        1.3  explorer 	lcp.Close(sp);
   2928        1.3  explorer }
   2929        1.9    itojun 
   2930        1.9    itojun 
   2931       1.42  jdolecek /*
   2932        1.3  explorer  *--------------------------------------------------------------------------*
   2933        1.3  explorer  *                                                                          *
   2934        1.3  explorer  *                        The IPCP implementation.                          *
   2935        1.3  explorer  *                                                                          *
   2936        1.3  explorer  *--------------------------------------------------------------------------*
   2937        1.3  explorer  */
   2938        1.3  explorer 
   2939        1.3  explorer static void
   2940        1.3  explorer sppp_ipcp_init(struct sppp *sp)
   2941        1.3  explorer {
   2942      1.159  knakahar 	int error;
   2943      1.159  knakahar 
   2944      1.163  knakahar 	sppp_lock_enter(sp);
   2945        1.3  explorer 	sp->ipcp.opts = 0;
   2946        1.3  explorer 	sp->ipcp.flags = 0;
   2947        1.3  explorer 	sp->state[IDX_IPCP] = STATE_INITIAL;
   2948        1.3  explorer 	sp->fail_counter[IDX_IPCP] = 0;
   2949        1.9    itojun 	sp->pp_seq[IDX_IPCP] = 0;
   2950        1.9    itojun 	sp->pp_rseq[IDX_IPCP] = 0;
   2951      1.106        ad 	callout_init(&sp->ch[IDX_IPCP], 0);
   2952      1.159  knakahar 
   2953      1.161  knakahar 	error = workqueue_create(&sp->ipcp.update_addrs_wq, "ipcp_update_addrs",
   2954      1.161  knakahar 	    sppp_update_ip_addrs_work, sp, PRI_SOFTNET, IPL_NET, 0);
   2955      1.159  knakahar 	if (error)
   2956      1.161  knakahar 		panic("%s: update_addrs workqueue_create failed (%d)\n",
   2957      1.159  knakahar 		    __func__, error);
   2958      1.161  knakahar 	sp->ipcp.update_addrs_q = pcq_create(IPCP_UPDATE_LIMIT, KM_SLEEP);
   2959      1.159  knakahar 
   2960      1.161  knakahar 	sp->ipcp.update_addrs_enqueued = 0;
   2961      1.163  knakahar 	sppp_lock_exit(sp);
   2962        1.3  explorer }
   2963        1.3  explorer 
   2964        1.3  explorer static void
   2965        1.3  explorer sppp_ipcp_up(struct sppp *sp)
   2966        1.3  explorer {
   2967      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2968        1.3  explorer 	sppp_up_event(&ipcp, sp);
   2969        1.3  explorer }
   2970        1.3  explorer 
   2971        1.3  explorer static void
   2972        1.3  explorer sppp_ipcp_down(struct sppp *sp)
   2973        1.3  explorer {
   2974      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2975        1.3  explorer 	sppp_down_event(&ipcp, sp);
   2976        1.3  explorer }
   2977        1.3  explorer 
   2978        1.3  explorer static void
   2979        1.3  explorer sppp_ipcp_open(struct sppp *sp)
   2980        1.3  explorer {
   2981        1.3  explorer 	STDDCL;
   2982      1.109      matt 	uint32_t myaddr, hisaddr;
   2983        1.3  explorer 
   2984      1.163  knakahar 	KASSERT(sppp_locked(sp));
   2985      1.163  knakahar 
   2986       1.31    martin 	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
   2987       1.31    martin 	sp->ipcp.req_myaddr = 0;
   2988       1.31    martin 	sp->ipcp.req_hisaddr = 0;
   2989       1.45    martin 	memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
   2990        1.3  explorer 
   2991       1.79  christos #ifdef INET
   2992        1.3  explorer 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
   2993       1.79  christos #else
   2994       1.79  christos 	myaddr = hisaddr = 0;
   2995       1.79  christos #endif
   2996        1.3  explorer 	/*
   2997        1.3  explorer 	 * If we don't have his address, this probably means our
   2998        1.3  explorer 	 * interface doesn't want to talk IP at all.  (This could
   2999        1.3  explorer 	 * be the case if somebody wants to speak only IPX, for
   3000        1.3  explorer 	 * example.)  Don't open IPCP in this case.
   3001        1.3  explorer 	 */
   3002       1.79  christos 	if (hisaddr == 0) {
   3003        1.3  explorer 		/* XXX this message should go away */
   3004        1.3  explorer 		if (debug)
   3005       1.64    itojun 			log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n",
   3006       1.64    itojun 			    ifp->if_xname);
   3007        1.3  explorer 		return;
   3008        1.3  explorer 	}
   3009        1.3  explorer 
   3010       1.31    martin 	if (myaddr == 0) {
   3011        1.3  explorer 		/*
   3012        1.3  explorer 		 * I don't have an assigned address, so i need to
   3013        1.3  explorer 		 * negotiate my address.
   3014        1.3  explorer 		 */
   3015        1.3  explorer 		sp->ipcp.flags |= IPCP_MYADDR_DYN;
   3016        1.3  explorer 		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   3017       1.31    martin 	}
   3018       1.31    martin 	if (hisaddr == 1) {
   3019       1.31    martin 		/*
   3020       1.31    martin 		 * XXX - remove this hack!
   3021       1.74       wiz 		 * remote has no valid address, we need to get one assigned.
   3022       1.31    martin 		 */
   3023       1.31    martin 		sp->ipcp.flags |= IPCP_HISADDR_DYN;
   3024       1.31    martin 	}
   3025        1.3  explorer 	sppp_open_event(&ipcp, sp);
   3026        1.3  explorer }
   3027        1.3  explorer 
   3028        1.3  explorer static void
   3029        1.3  explorer sppp_ipcp_close(struct sppp *sp)
   3030        1.3  explorer {
   3031       1.63      tron 
   3032      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3033        1.3  explorer 	sppp_close_event(&ipcp, sp);
   3034      1.163  knakahar 
   3035       1.79  christos #ifdef INET
   3036       1.31    martin 	if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
   3037        1.3  explorer 		/*
   3038       1.31    martin 		 * Some address was dynamic, clear it again.
   3039        1.3  explorer 		 */
   3040       1.31    martin 		sppp_clear_ip_addrs(sp);
   3041       1.79  christos #endif
   3042        1.3  explorer }
   3043        1.3  explorer 
   3044        1.3  explorer static void
   3045        1.3  explorer sppp_ipcp_TO(void *cookie)
   3046        1.3  explorer {
   3047      1.163  knakahar 	struct sppp *sp = cookie;
   3048      1.163  knakahar 
   3049      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   3050      1.163  knakahar 
   3051      1.163  knakahar 	sppp_lock_enter(sp);
   3052        1.3  explorer 	sppp_to_event(&ipcp, (struct sppp *)cookie);
   3053      1.163  knakahar 	sppp_lock_exit(sp);
   3054        1.3  explorer }
   3055        1.3  explorer 
   3056        1.3  explorer /*
   3057        1.3  explorer  * Analyze a configure request.  Return true if it was agreeable, and
   3058        1.3  explorer  * caused action sca, false if it has been rejected or nak'ed, and
   3059        1.3  explorer  * caused action scn.  (The return value is used to make the state
   3060        1.3  explorer  * transition decision in the state automaton.)
   3061        1.3  explorer  */
   3062        1.3  explorer static int
   3063        1.3  explorer sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   3064        1.3  explorer {
   3065      1.140  christos 	u_char *buf, *r, *p, l, blen;
   3066        1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   3067        1.3  explorer 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   3068      1.109      matt 	uint32_t hisaddr, desiredaddr;
   3069        1.3  explorer 
   3070      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3071        1.3  explorer 	len -= 4;
   3072        1.3  explorer 	origlen = len;
   3073        1.3  explorer 	/*
   3074        1.3  explorer 	 * Make sure to allocate a buf that can at least hold a
   3075        1.3  explorer 	 * conf-nak with an `address' option.  We might need it below.
   3076        1.3  explorer 	 */
   3077      1.140  christos 	blen = len < 6 ? 6 : len;
   3078      1.140  christos 	buf = r = malloc (blen, M_TEMP, M_NOWAIT);
   3079        1.3  explorer 	if (! buf)
   3080        1.3  explorer 		return (0);
   3081        1.3  explorer 
   3082        1.3  explorer 	/* pass 1: see if we can recognize them */
   3083        1.3  explorer 	if (debug)
   3084       1.64    itojun 		log(LOG_DEBUG, "%s: ipcp parse opts:",
   3085       1.64    itojun 		    ifp->if_xname);
   3086       1.59    itojun 	p = (void *)(h + 1);
   3087      1.140  christos 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3088       1.96   adrianp 		/* Sanity check option length */
   3089      1.140  christos 		if (l > len) {
   3090       1.96   adrianp 			/* XXX should we just RXJ? */
   3091       1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   3092       1.96   adrianp 			    ifp->if_xname);
   3093       1.96   adrianp 			goto drop;
   3094       1.96   adrianp 		}
   3095        1.3  explorer 		if (debug)
   3096        1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3097        1.3  explorer 		switch (*p) {
   3098        1.3  explorer #ifdef notyet
   3099        1.3  explorer 		case IPCP_OPT_COMPRESSION:
   3100      1.140  christos 			if (len >= 6 && l >= 6) {
   3101        1.3  explorer 				/* correctly formed compress option */
   3102        1.3  explorer 				continue;
   3103        1.3  explorer 			}
   3104        1.3  explorer 			if (debug)
   3105        1.9    itojun 				addlog(" [invalid]");
   3106        1.3  explorer 			break;
   3107        1.3  explorer #endif
   3108        1.3  explorer 		case IPCP_OPT_ADDRESS:
   3109      1.140  christos 			if (len >= 6 && l == 6) {
   3110        1.3  explorer 				/* correctly formed address option */
   3111        1.3  explorer 				continue;
   3112        1.3  explorer 			}
   3113        1.3  explorer 			if (debug)
   3114        1.9    itojun 				addlog(" [invalid]");
   3115        1.3  explorer 			break;
   3116        1.3  explorer 		default:
   3117        1.3  explorer 			/* Others not supported. */
   3118        1.3  explorer 			if (debug)
   3119        1.9    itojun 				addlog(" [rej]");
   3120        1.3  explorer 			break;
   3121        1.3  explorer 		}
   3122        1.3  explorer 		/* Add the option to rejected list. */
   3123      1.140  christos 		if (rlen + l > blen) {
   3124      1.140  christos 			if (debug)
   3125      1.140  christos 				addlog(" [overflow]");
   3126      1.140  christos 			continue;
   3127      1.140  christos 		}
   3128      1.140  christos 		memcpy(r, p, l);
   3129      1.140  christos 		r += l;
   3130      1.140  christos 		rlen += l;
   3131        1.3  explorer 	}
   3132        1.3  explorer 	if (rlen) {
   3133        1.3  explorer 		if (debug)
   3134        1.3  explorer 			addlog(" send conf-rej\n");
   3135       1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
   3136        1.9    itojun 		goto end;
   3137        1.3  explorer 	} else if (debug)
   3138        1.3  explorer 		addlog("\n");
   3139        1.3  explorer 
   3140        1.3  explorer 	/* pass 2: parse option values */
   3141       1.31    martin 	if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
   3142       1.31    martin 		hisaddr = sp->ipcp.req_hisaddr;	/* we already aggreed on that */
   3143       1.31    martin 	else
   3144       1.79  christos #ifdef INET
   3145       1.31    martin 		sppp_get_ip_addrs(sp, 0, &hisaddr, 0);	/* user configuration */
   3146       1.79  christos #else
   3147       1.79  christos 		hisaddr = 0;
   3148       1.79  christos #endif
   3149        1.3  explorer 	if (debug)
   3150       1.64    itojun 		log(LOG_DEBUG, "%s: ipcp parse opt values: ",
   3151       1.64    itojun 		       ifp->if_xname);
   3152       1.59    itojun 	p = (void *)(h + 1);
   3153        1.3  explorer 	len = origlen;
   3154      1.140  christos 	for (rlen=0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3155        1.3  explorer 		if (debug)
   3156        1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3157        1.3  explorer 		switch (*p) {
   3158        1.3  explorer #ifdef notyet
   3159        1.3  explorer 		case IPCP_OPT_COMPRESSION:
   3160        1.3  explorer 			continue;
   3161        1.3  explorer #endif
   3162        1.3  explorer 		case IPCP_OPT_ADDRESS:
   3163        1.3  explorer 			desiredaddr = p[2] << 24 | p[3] << 16 |
   3164        1.3  explorer 				p[4] << 8 | p[5];
   3165       1.31    martin 			if (desiredaddr == hisaddr ||
   3166       1.31    martin 		    	   ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) {
   3167        1.3  explorer 				/*
   3168       1.31    martin 			 	* Peer's address is same as our value,
   3169       1.31    martin 			 	* this is agreeable.  Gonna conf-ack
   3170       1.31    martin 			 	* it.
   3171       1.31    martin 			 	*/
   3172        1.3  explorer 				if (debug)
   3173       1.31    martin 					addlog(" %s [ack]",
   3174       1.31    martin 				       		sppp_dotted_quad(hisaddr));
   3175       1.31    martin 				/* record that we've seen it already */
   3176       1.31    martin 				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
   3177       1.31    martin 				sp->ipcp.req_hisaddr = desiredaddr;
   3178       1.31    martin 				hisaddr = desiredaddr;
   3179        1.3  explorer 				continue;
   3180       1.31    martin 			}
   3181       1.31    martin 			/*
   3182       1.31    martin 		 	* The address wasn't agreeable.  This is either
   3183       1.31    martin 		 	* he sent us 0.0.0.0, asking to assign him an
   3184       1.31    martin 		 	* address, or he send us another address not
   3185       1.31    martin 		 	* matching our value.  Either case, we gonna
   3186       1.31    martin 		 	* conf-nak it with our value.
   3187       1.31    martin 		 	*/
   3188       1.31    martin 			if (debug) {
   3189       1.31    martin 				if (desiredaddr == 0)
   3190       1.31    martin 					addlog(" [addr requested]");
   3191       1.31    martin 				else
   3192       1.31    martin 					addlog(" %s [not agreed]",
   3193       1.31    martin 				       		sppp_dotted_quad(desiredaddr));
   3194       1.31    martin 			}
   3195        1.3  explorer 
   3196       1.31    martin 			p[2] = hisaddr >> 24;
   3197       1.31    martin 			p[3] = hisaddr >> 16;
   3198       1.31    martin 			p[4] = hisaddr >> 8;
   3199       1.31    martin 			p[5] = hisaddr;
   3200       1.31    martin 			break;
   3201        1.3  explorer 		}
   3202      1.140  christos 		if (rlen + l > blen) {
   3203      1.140  christos 			if (debug)
   3204      1.140  christos 				addlog(" [overflow]");
   3205      1.140  christos 			continue;
   3206      1.140  christos 		}
   3207        1.3  explorer 		/* Add the option to nak'ed list. */
   3208      1.140  christos 		memcpy(r, p, l);
   3209      1.140  christos 		r += l;
   3210      1.140  christos 		rlen += l;
   3211        1.3  explorer 	}
   3212        1.3  explorer 
   3213        1.3  explorer 	/*
   3214        1.3  explorer 	 * If we are about to conf-ack the request, but haven't seen
   3215        1.3  explorer 	 * his address so far, gonna conf-nak it instead, with the
   3216        1.3  explorer 	 * `address' option present and our idea of his address being
   3217        1.3  explorer 	 * filled in there, to request negotiation of both addresses.
   3218        1.3  explorer 	 *
   3219        1.3  explorer 	 * XXX This can result in an endless req - nak loop if peer
   3220        1.3  explorer 	 * doesn't want to send us his address.  Q: What should we do
   3221        1.3  explorer 	 * about it?  XXX  A: implement the max-failure counter.
   3222        1.3  explorer 	 */
   3223       1.31    martin 	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
   3224        1.3  explorer 		buf[0] = IPCP_OPT_ADDRESS;
   3225        1.3  explorer 		buf[1] = 6;
   3226        1.3  explorer 		buf[2] = hisaddr >> 24;
   3227        1.3  explorer 		buf[3] = hisaddr >> 16;
   3228        1.3  explorer 		buf[4] = hisaddr >> 8;
   3229        1.3  explorer 		buf[5] = hisaddr;
   3230        1.3  explorer 		rlen = 6;
   3231        1.3  explorer 		if (debug)
   3232        1.9    itojun 			addlog(" still need hisaddr");
   3233        1.3  explorer 	}
   3234        1.3  explorer 
   3235        1.3  explorer 	if (rlen) {
   3236        1.3  explorer 		if (debug)
   3237        1.3  explorer 			addlog(" send conf-nak\n");
   3238       1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
   3239        1.3  explorer 	} else {
   3240        1.3  explorer 		if (debug)
   3241        1.3  explorer 			addlog(" send conf-ack\n");
   3242       1.59    itojun 		sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1);
   3243        1.3  explorer 	}
   3244        1.3  explorer 
   3245        1.9    itojun  end:
   3246       1.59    itojun 	free(buf, M_TEMP);
   3247        1.3  explorer 	return (rlen == 0);
   3248       1.96   adrianp 
   3249       1.96   adrianp  drop:
   3250       1.96   adrianp 	free(buf, M_TEMP);
   3251       1.96   adrianp 	return -1;
   3252        1.3  explorer }
   3253        1.3  explorer 
   3254        1.3  explorer /*
   3255        1.3  explorer  * Analyze the IPCP Configure-Reject option list, and adjust our
   3256        1.3  explorer  * negotiation.
   3257        1.3  explorer  */
   3258        1.3  explorer static void
   3259        1.3  explorer sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3260        1.3  explorer {
   3261      1.140  christos 	u_char *buf, *p, l, blen;
   3262        1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   3263        1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
   3264        1.3  explorer 
   3265      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3266      1.163  knakahar 
   3267        1.3  explorer 	len -= 4;
   3268      1.140  christos 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
   3269        1.3  explorer 	if (!buf)
   3270        1.3  explorer 		return;
   3271        1.3  explorer 
   3272        1.3  explorer 	if (debug)
   3273       1.64    itojun 		log(LOG_DEBUG, "%s: ipcp rej opts:",
   3274       1.64    itojun 		    ifp->if_xname);
   3275        1.3  explorer 
   3276       1.59    itojun 	p = (void *)(h + 1);
   3277      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3278       1.96   adrianp 		/* Sanity check option length */
   3279      1.140  christos 		if (l > len) {
   3280       1.96   adrianp 			/* XXX should we just RXJ? */
   3281       1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   3282       1.96   adrianp 			    ifp->if_xname);
   3283       1.96   adrianp 			goto drop;
   3284       1.96   adrianp 		}
   3285        1.3  explorer 		if (debug)
   3286        1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3287        1.3  explorer 		switch (*p) {
   3288        1.3  explorer 		case IPCP_OPT_ADDRESS:
   3289        1.3  explorer 			/*
   3290        1.3  explorer 			 * Peer doesn't grok address option.  This is
   3291        1.3  explorer 			 * bad.  XXX  Should we better give up here?
   3292        1.3  explorer 			 */
   3293        1.3  explorer 			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
   3294        1.3  explorer 			break;
   3295        1.3  explorer #ifdef notyet
   3296        1.3  explorer 		case IPCP_OPT_COMPRESS:
   3297        1.3  explorer 			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
   3298        1.3  explorer 			break;
   3299        1.3  explorer #endif
   3300        1.3  explorer 		}
   3301        1.3  explorer 	}
   3302        1.3  explorer 	if (debug)
   3303        1.3  explorer 		addlog("\n");
   3304       1.96   adrianp drop:
   3305       1.59    itojun 	free(buf, M_TEMP);
   3306        1.3  explorer 	return;
   3307        1.3  explorer }
   3308        1.3  explorer 
   3309        1.3  explorer /*
   3310        1.3  explorer  * Analyze the IPCP Configure-NAK option list, and adjust our
   3311        1.3  explorer  * negotiation.
   3312        1.3  explorer  */
   3313        1.3  explorer static void
   3314        1.3  explorer sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3315        1.3  explorer {
   3316      1.140  christos 	u_char *p, l;
   3317        1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   3318        1.3  explorer 	int debug = ifp->if_flags & IFF_DEBUG;
   3319      1.109      matt 	uint32_t wantaddr;
   3320        1.3  explorer 
   3321      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3322      1.163  knakahar 
   3323        1.3  explorer 	len -= 4;
   3324        1.3  explorer 
   3325        1.3  explorer 	if (debug)
   3326       1.64    itojun 		log(LOG_DEBUG, "%s: ipcp nak opts:",
   3327       1.64    itojun 		    ifp->if_xname);
   3328        1.3  explorer 
   3329       1.59    itojun 	p = (void *)(h + 1);
   3330      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3331       1.96   adrianp 		/* Sanity check option length */
   3332      1.140  christos 		if (l > len) {
   3333       1.96   adrianp 			/* XXX should we just RXJ? */
   3334       1.96   adrianp 			addlog("%s: malicious IPCP option received, dropping\n",
   3335       1.96   adrianp 			    ifp->if_xname);
   3336       1.96   adrianp 			return;
   3337       1.96   adrianp 		}
   3338        1.3  explorer 		if (debug)
   3339        1.9    itojun 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3340        1.3  explorer 		switch (*p) {
   3341        1.3  explorer 		case IPCP_OPT_ADDRESS:
   3342        1.3  explorer 			/*
   3343        1.3  explorer 			 * Peer doesn't like our local IP address.  See
   3344        1.3  explorer 			 * if we can do something for him.  We'll drop
   3345        1.3  explorer 			 * him our address then.
   3346        1.3  explorer 			 */
   3347      1.140  christos 			if (len >= 6 && l == 6) {
   3348        1.3  explorer 				wantaddr = p[2] << 24 | p[3] << 16 |
   3349        1.3  explorer 					p[4] << 8 | p[5];
   3350        1.3  explorer 				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   3351        1.3  explorer 				if (debug)
   3352        1.9    itojun 					addlog(" [wantaddr %s]",
   3353        1.3  explorer 					       sppp_dotted_quad(wantaddr));
   3354        1.3  explorer 				/*
   3355        1.3  explorer 				 * When doing dynamic address assignment,
   3356        1.3  explorer 				 * we accept his offer.  Otherwise, we
   3357        1.3  explorer 				 * ignore it and thus continue to negotiate
   3358        1.3  explorer 				 * our already existing value.
   3359        1.3  explorer 				 */
   3360        1.3  explorer 				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
   3361        1.3  explorer 					if (debug)
   3362        1.9    itojun 						addlog(" [agree]");
   3363        1.3  explorer 					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
   3364       1.31    martin 					sp->ipcp.req_myaddr = wantaddr;
   3365        1.3  explorer 				}
   3366        1.3  explorer 			}
   3367        1.3  explorer 			break;
   3368       1.45    martin 
   3369       1.45    martin 		case IPCP_OPT_PRIMDNS:
   3370      1.140  christos 			if (len >= 6 && l == 6) {
   3371       1.45    martin 				sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 |
   3372       1.82     perry 					p[4] << 8 | p[5];
   3373       1.45    martin 			}
   3374       1.45    martin 			break;
   3375       1.45    martin 
   3376       1.45    martin 		case IPCP_OPT_SECDNS:
   3377      1.140  christos 			if (len >= 6 && l == 6) {
   3378       1.45    martin 				sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 |
   3379       1.82     perry 					p[4] << 8 | p[5];
   3380       1.45    martin 			}
   3381       1.45    martin 			break;
   3382        1.3  explorer #ifdef notyet
   3383        1.3  explorer 		case IPCP_OPT_COMPRESS:
   3384        1.3  explorer 			/*
   3385        1.3  explorer 			 * Peer wants different compression parameters.
   3386        1.3  explorer 			 */
   3387        1.3  explorer 			break;
   3388        1.3  explorer #endif
   3389        1.3  explorer 		}
   3390        1.3  explorer 	}
   3391        1.3  explorer 	if (debug)
   3392        1.3  explorer 		addlog("\n");
   3393        1.3  explorer }
   3394        1.3  explorer 
   3395        1.3  explorer static void
   3396        1.3  explorer sppp_ipcp_tlu(struct sppp *sp)
   3397        1.3  explorer {
   3398       1.79  christos #ifdef INET
   3399      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3400       1.31    martin 	/* we are up. Set addresses and notify anyone interested */
   3401      1.158  knakahar 	sppp_set_ip_addrs(sp);
   3402       1.79  christos #endif
   3403        1.3  explorer }
   3404        1.3  explorer 
   3405        1.3  explorer static void
   3406      1.101  christos sppp_ipcp_tld(struct sppp *sp)
   3407        1.3  explorer {
   3408        1.3  explorer }
   3409        1.3  explorer 
   3410        1.3  explorer static void
   3411        1.3  explorer sppp_ipcp_tls(struct sppp *sp)
   3412        1.3  explorer {
   3413      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3414        1.3  explorer 	/* indicate to LCP that it must stay alive */
   3415        1.3  explorer 	sp->lcp.protos |= (1 << IDX_IPCP);
   3416        1.3  explorer }
   3417        1.3  explorer 
   3418        1.3  explorer static void
   3419        1.3  explorer sppp_ipcp_tlf(struct sppp *sp)
   3420        1.3  explorer {
   3421      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3422        1.3  explorer 	/* we no longer need LCP */
   3423        1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_IPCP);
   3424        1.3  explorer }
   3425        1.3  explorer 
   3426        1.3  explorer static void
   3427        1.3  explorer sppp_ipcp_scr(struct sppp *sp)
   3428        1.3  explorer {
   3429      1.156     joerg 	uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */];
   3430       1.79  christos #ifdef INET
   3431      1.109      matt 	uint32_t ouraddr;
   3432       1.79  christos #endif
   3433        1.3  explorer 	int i = 0;
   3434        1.3  explorer 
   3435      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3436      1.163  knakahar 
   3437        1.3  explorer #ifdef notyet
   3438        1.3  explorer 	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
   3439        1.3  explorer 		opt[i++] = IPCP_OPT_COMPRESSION;
   3440        1.3  explorer 		opt[i++] = 6;
   3441        1.3  explorer 		opt[i++] = 0;	/* VJ header compression */
   3442        1.3  explorer 		opt[i++] = 0x2d; /* VJ header compression */
   3443        1.3  explorer 		opt[i++] = max_slot_id;
   3444        1.3  explorer 		opt[i++] = comp_slot_id;
   3445        1.3  explorer 	}
   3446        1.3  explorer #endif
   3447        1.3  explorer 
   3448       1.79  christos #ifdef INET
   3449        1.3  explorer 	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
   3450       1.31    martin 		if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
   3451       1.31    martin 			ouraddr = sp->ipcp.req_myaddr;	/* not sure if this can ever happen */
   3452       1.31    martin 		else
   3453       1.31    martin 			sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
   3454        1.3  explorer 		opt[i++] = IPCP_OPT_ADDRESS;
   3455        1.3  explorer 		opt[i++] = 6;
   3456        1.3  explorer 		opt[i++] = ouraddr >> 24;
   3457        1.3  explorer 		opt[i++] = ouraddr >> 16;
   3458        1.3  explorer 		opt[i++] = ouraddr >> 8;
   3459        1.3  explorer 		opt[i++] = ouraddr;
   3460        1.3  explorer 	}
   3461       1.79  christos #endif
   3462        1.3  explorer 
   3463       1.45    martin 	if (sp->query_dns & 1) {
   3464       1.45    martin 		opt[i++] = IPCP_OPT_PRIMDNS;
   3465       1.45    martin 		opt[i++] = 6;
   3466       1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 24;
   3467       1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 16;
   3468       1.45    martin 		opt[i++] = sp->dns_addrs[0] >> 8;
   3469       1.45    martin 		opt[i++] = sp->dns_addrs[0];
   3470       1.45    martin 	}
   3471       1.45    martin 	if (sp->query_dns & 2) {
   3472       1.45    martin 		opt[i++] = IPCP_OPT_SECDNS;
   3473       1.45    martin 		opt[i++] = 6;
   3474       1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 24;
   3475       1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 16;
   3476       1.45    martin 		opt[i++] = sp->dns_addrs[1] >> 8;
   3477       1.45    martin 		opt[i++] = sp->dns_addrs[1];
   3478       1.45    martin 	}
   3479       1.45    martin 
   3480        1.9    itojun 	sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
   3481        1.3  explorer 	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
   3482        1.3  explorer }
   3483        1.3  explorer 
   3484        1.3  explorer 
   3485       1.42  jdolecek /*
   3486        1.3  explorer  *--------------------------------------------------------------------------*
   3487        1.3  explorer  *                                                                          *
   3488        1.9    itojun  *                      The IPv6CP implementation.                          *
   3489        1.9    itojun  *                                                                          *
   3490        1.9    itojun  *--------------------------------------------------------------------------*
   3491        1.9    itojun  */
   3492        1.9    itojun 
   3493        1.9    itojun #ifdef INET6
   3494        1.9    itojun static void
   3495        1.9    itojun sppp_ipv6cp_init(struct sppp *sp)
   3496        1.9    itojun {
   3497      1.163  knakahar 	sppp_lock_enter(sp);
   3498        1.9    itojun 	sp->ipv6cp.opts = 0;
   3499        1.9    itojun 	sp->ipv6cp.flags = 0;
   3500        1.9    itojun 	sp->state[IDX_IPV6CP] = STATE_INITIAL;
   3501        1.9    itojun 	sp->fail_counter[IDX_IPV6CP] = 0;
   3502        1.9    itojun 	sp->pp_seq[IDX_IPV6CP] = 0;
   3503        1.9    itojun 	sp->pp_rseq[IDX_IPV6CP] = 0;
   3504      1.106        ad 	callout_init(&sp->ch[IDX_IPV6CP], 0);
   3505      1.163  knakahar 	sppp_lock_exit(sp);
   3506        1.9    itojun }
   3507        1.9    itojun 
   3508        1.9    itojun static void
   3509        1.9    itojun sppp_ipv6cp_up(struct sppp *sp)
   3510        1.9    itojun {
   3511      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3512        1.9    itojun 	sppp_up_event(&ipv6cp, sp);
   3513        1.9    itojun }
   3514        1.9    itojun 
   3515        1.9    itojun static void
   3516        1.9    itojun sppp_ipv6cp_down(struct sppp *sp)
   3517        1.9    itojun {
   3518      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3519        1.9    itojun 	sppp_down_event(&ipv6cp, sp);
   3520        1.9    itojun }
   3521        1.9    itojun 
   3522        1.9    itojun static void
   3523        1.9    itojun sppp_ipv6cp_open(struct sppp *sp)
   3524        1.9    itojun {
   3525        1.9    itojun 	STDDCL;
   3526        1.9    itojun 	struct in6_addr myaddr, hisaddr;
   3527        1.9    itojun 
   3528      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3529      1.163  knakahar 
   3530        1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   3531        1.9    itojun 	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
   3532        1.9    itojun #else
   3533        1.9    itojun 	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
   3534        1.9    itojun #endif
   3535        1.9    itojun 
   3536        1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
   3537        1.9    itojun 	/*
   3538        1.9    itojun 	 * If we don't have our address, this probably means our
   3539        1.9    itojun 	 * interface doesn't want to talk IPv6 at all.  (This could
   3540        1.9    itojun 	 * be the case if somebody wants to speak only IPX, for
   3541        1.9    itojun 	 * example.)  Don't open IPv6CP in this case.
   3542        1.9    itojun 	 */
   3543        1.9    itojun 	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
   3544        1.9    itojun 		/* XXX this message should go away */
   3545        1.9    itojun 		if (debug)
   3546       1.64    itojun 			log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n",
   3547       1.64    itojun 			    ifp->if_xname);
   3548        1.9    itojun 		return;
   3549        1.9    itojun 	}
   3550        1.9    itojun 
   3551        1.9    itojun 	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3552        1.9    itojun 	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3553        1.9    itojun 	sppp_open_event(&ipv6cp, sp);
   3554        1.9    itojun }
   3555        1.9    itojun 
   3556        1.9    itojun static void
   3557        1.9    itojun sppp_ipv6cp_close(struct sppp *sp)
   3558        1.9    itojun {
   3559      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3560        1.9    itojun 	sppp_close_event(&ipv6cp, sp);
   3561        1.9    itojun }
   3562        1.9    itojun 
   3563        1.9    itojun static void
   3564        1.9    itojun sppp_ipv6cp_TO(void *cookie)
   3565        1.9    itojun {
   3566      1.163  knakahar 	struct sppp *sp = cookie;
   3567      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   3568      1.163  knakahar 
   3569      1.163  knakahar 	sppp_lock_enter(sp);
   3570        1.9    itojun 	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
   3571      1.163  knakahar 	sppp_lock_exit(sp);
   3572        1.9    itojun }
   3573        1.9    itojun 
   3574        1.9    itojun /*
   3575        1.9    itojun  * Analyze a configure request.  Return true if it was agreeable, and
   3576        1.9    itojun  * caused action sca, false if it has been rejected or nak'ed, and
   3577        1.9    itojun  * caused action scn.  (The return value is used to make the state
   3578        1.9    itojun  * transition decision in the state automaton.)
   3579        1.9    itojun  */
   3580        1.9    itojun static int
   3581        1.9    itojun sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   3582        1.9    itojun {
   3583      1.140  christos 	u_char *buf, *r, *p, l, blen;
   3584        1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3585        1.9    itojun 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   3586        1.9    itojun 	struct in6_addr myaddr, desiredaddr, suggestaddr;
   3587        1.9    itojun 	int ifidcount;
   3588        1.9    itojun 	int type;
   3589        1.9    itojun 	int collision, nohisaddr;
   3590  1.165.2.1    bouyer 	char ip6buf[INET6_ADDRSTRLEN];
   3591        1.9    itojun 
   3592      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3593      1.163  knakahar 
   3594        1.9    itojun 	len -= 4;
   3595        1.9    itojun 	origlen = len;
   3596        1.9    itojun 	/*
   3597        1.9    itojun 	 * Make sure to allocate a buf that can at least hold a
   3598        1.9    itojun 	 * conf-nak with an `address' option.  We might need it below.
   3599        1.9    itojun 	 */
   3600      1.140  christos 	blen = len < 6 ? 6 : len;
   3601      1.140  christos 	buf = r = malloc (blen, M_TEMP, M_NOWAIT);
   3602        1.9    itojun 	if (! buf)
   3603        1.9    itojun 		return (0);
   3604        1.9    itojun 
   3605        1.9    itojun 	/* pass 1: see if we can recognize them */
   3606        1.9    itojun 	if (debug)
   3607       1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp parse opts:",
   3608       1.64    itojun 		    ifp->if_xname);
   3609       1.59    itojun 	p = (void *)(h + 1);
   3610        1.9    itojun 	ifidcount = 0;
   3611      1.140  christos 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3612       1.96   adrianp 		/* Sanity check option length */
   3613      1.140  christos 		if (l > len) {
   3614       1.96   adrianp 			/* XXX just RXJ? */
   3615       1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3616       1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3617       1.96   adrianp 			goto drop;
   3618       1.96   adrianp 		}
   3619        1.9    itojun 		if (debug)
   3620        1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3621        1.9    itojun 		switch (*p) {
   3622        1.9    itojun 		case IPV6CP_OPT_IFID:
   3623      1.140  christos 			if (len >= 10 && l == 10 && ifidcount == 0) {
   3624        1.9    itojun 				/* correctly formed address option */
   3625        1.9    itojun 				ifidcount++;
   3626        1.9    itojun 				continue;
   3627        1.9    itojun 			}
   3628        1.9    itojun 			if (debug)
   3629        1.9    itojun 				addlog(" [invalid]");
   3630        1.9    itojun 			break;
   3631        1.9    itojun #ifdef notyet
   3632        1.9    itojun 		case IPV6CP_OPT_COMPRESSION:
   3633      1.140  christos 			if (len >= 4 && l >= 4) {
   3634        1.9    itojun 				/* correctly formed compress option */
   3635        1.9    itojun 				continue;
   3636        1.9    itojun 			}
   3637        1.9    itojun 			if (debug)
   3638        1.9    itojun 				addlog(" [invalid]");
   3639        1.9    itojun 			break;
   3640        1.9    itojun #endif
   3641        1.9    itojun 		default:
   3642        1.9    itojun 			/* Others not supported. */
   3643        1.9    itojun 			if (debug)
   3644        1.9    itojun 				addlog(" [rej]");
   3645        1.9    itojun 			break;
   3646        1.9    itojun 		}
   3647      1.140  christos 		if (rlen + l > blen) {
   3648      1.140  christos 			if (debug)
   3649      1.140  christos 				addlog(" [overflow]");
   3650      1.140  christos 			continue;
   3651      1.140  christos 		}
   3652        1.9    itojun 		/* Add the option to rejected list. */
   3653      1.140  christos 		memcpy(r, p, l);
   3654      1.140  christos 		r += l;
   3655      1.140  christos 		rlen += l;
   3656        1.9    itojun 	}
   3657        1.9    itojun 	if (rlen) {
   3658        1.9    itojun 		if (debug)
   3659        1.9    itojun 			addlog(" send conf-rej\n");
   3660       1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
   3661        1.9    itojun 		goto end;
   3662        1.9    itojun 	} else if (debug)
   3663        1.9    itojun 		addlog("\n");
   3664        1.9    itojun 
   3665        1.9    itojun 	/* pass 2: parse option values */
   3666        1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   3667        1.9    itojun 	if (debug)
   3668       1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp parse opt values: ",
   3669       1.64    itojun 		       ifp->if_xname);
   3670       1.59    itojun 	p = (void *)(h + 1);
   3671        1.9    itojun 	len = origlen;
   3672        1.9    itojun 	type = CONF_ACK;
   3673      1.140  christos 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3674        1.9    itojun 		if (debug)
   3675        1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3676        1.9    itojun 		switch (*p) {
   3677        1.9    itojun #ifdef notyet
   3678        1.9    itojun 		case IPV6CP_OPT_COMPRESSION:
   3679        1.9    itojun 			continue;
   3680        1.9    itojun #endif
   3681        1.9    itojun 		case IPV6CP_OPT_IFID:
   3682       1.25   thorpej 			memset(&desiredaddr, 0, sizeof(desiredaddr));
   3683      1.118   tsutsui 			memcpy(&desiredaddr.s6_addr[8], &p[2], 8);
   3684       1.36    martin 			collision = (memcmp(&desiredaddr.s6_addr[8],
   3685        1.9    itojun 					&myaddr.s6_addr[8], 8) == 0);
   3686        1.9    itojun 			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
   3687        1.9    itojun 
   3688        1.9    itojun 			desiredaddr.s6_addr16[0] = htons(0xfe80);
   3689       1.87    rpaulo 			(void)in6_setscope(&desiredaddr, &sp->pp_if, NULL);
   3690        1.9    itojun 
   3691        1.9    itojun 			if (!collision && !nohisaddr) {
   3692        1.9    itojun 				/* no collision, hisaddr known - Conf-Ack */
   3693        1.9    itojun 				type = CONF_ACK;
   3694        1.9    itojun 
   3695        1.9    itojun 				if (debug) {
   3696        1.9    itojun 					addlog(" %s [%s]",
   3697  1.165.2.1    bouyer 					    IN6_PRINT(ip6buf, &desiredaddr),
   3698        1.9    itojun 					    sppp_cp_type_name(type));
   3699        1.9    itojun 				}
   3700        1.9    itojun 				continue;
   3701        1.9    itojun 			}
   3702        1.9    itojun 
   3703      1.114     pooka 			memset(&suggestaddr, 0, sizeof(suggestaddr));
   3704        1.9    itojun 			if (collision && nohisaddr) {
   3705        1.9    itojun 				/* collision, hisaddr unknown - Conf-Rej */
   3706        1.9    itojun 				type = CONF_REJ;
   3707       1.25   thorpej 				memset(&p[2], 0, 8);
   3708        1.9    itojun 			} else {
   3709        1.9    itojun 				/*
   3710        1.9    itojun 				 * - no collision, hisaddr unknown, or
   3711        1.9    itojun 				 * - collision, hisaddr known
   3712        1.9    itojun 				 * Conf-Nak, suggest hisaddr
   3713        1.9    itojun 				 */
   3714        1.9    itojun 				type = CONF_NAK;
   3715        1.9    itojun 				sppp_suggest_ip6_addr(sp, &suggestaddr);
   3716      1.118   tsutsui 				memcpy(&p[2], &suggestaddr.s6_addr[8], 8);
   3717        1.9    itojun 			}
   3718        1.9    itojun 			if (debug)
   3719  1.165.2.1    bouyer 				addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr),
   3720        1.9    itojun 				    sppp_cp_type_name(type));
   3721        1.9    itojun 			break;
   3722        1.9    itojun 		}
   3723      1.140  christos 		if (rlen + l > blen) {
   3724      1.140  christos 			if (debug)
   3725      1.140  christos 				addlog(" [overflow]");
   3726      1.140  christos 			continue;
   3727      1.140  christos 		}
   3728        1.9    itojun 		/* Add the option to nak'ed list. */
   3729      1.140  christos 		memcpy(r, p, l);
   3730      1.140  christos 		r += l;
   3731      1.140  christos 		rlen += l;
   3732        1.9    itojun 	}
   3733        1.9    itojun 
   3734        1.9    itojun 	if (rlen == 0 && type == CONF_ACK) {
   3735        1.9    itojun 		if (debug)
   3736        1.9    itojun 			addlog(" send %s\n", sppp_cp_type_name(type));
   3737       1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1);
   3738        1.9    itojun 	} else {
   3739       1.47    itojun #ifdef notdef
   3740        1.9    itojun 		if (type == CONF_ACK)
   3741        1.9    itojun 			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
   3742        1.9    itojun #endif
   3743        1.9    itojun 
   3744        1.9    itojun 		if (debug) {
   3745        1.9    itojun 			addlog(" send %s suggest %s\n",
   3746  1.165.2.1    bouyer 			    sppp_cp_type_name(type), IN6_PRINT(ip6buf, &suggestaddr));
   3747        1.9    itojun 		}
   3748       1.59    itojun 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
   3749        1.9    itojun 	}
   3750        1.9    itojun 
   3751        1.9    itojun  end:
   3752       1.59    itojun 	free(buf, M_TEMP);
   3753        1.9    itojun 	return (rlen == 0);
   3754       1.96   adrianp 
   3755       1.96   adrianp  drop:
   3756       1.96   adrianp 	free(buf, M_TEMP);
   3757       1.96   adrianp 	return -1;
   3758        1.9    itojun }
   3759        1.9    itojun 
   3760        1.9    itojun /*
   3761        1.9    itojun  * Analyze the IPv6CP Configure-Reject option list, and adjust our
   3762        1.9    itojun  * negotiation.
   3763        1.9    itojun  */
   3764        1.9    itojun static void
   3765        1.9    itojun sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3766        1.9    itojun {
   3767      1.140  christos 	u_char *buf, *p, l, blen;
   3768        1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3769        1.9    itojun 	int debug = ifp->if_flags & IFF_DEBUG;
   3770        1.9    itojun 
   3771      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3772      1.163  knakahar 
   3773        1.9    itojun 	len -= 4;
   3774      1.140  christos 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
   3775        1.9    itojun 	if (!buf)
   3776        1.9    itojun 		return;
   3777        1.9    itojun 
   3778        1.9    itojun 	if (debug)
   3779       1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp rej opts:",
   3780       1.64    itojun 		    ifp->if_xname);
   3781        1.9    itojun 
   3782       1.59    itojun 	p = (void *)(h + 1);
   3783      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3784      1.140  christos 		if (l > len) {
   3785       1.96   adrianp 			/* XXX just RXJ? */
   3786       1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3787       1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3788       1.96   adrianp 			goto drop;
   3789       1.96   adrianp 		}
   3790        1.9    itojun 		if (debug)
   3791        1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3792        1.9    itojun 		switch (*p) {
   3793        1.9    itojun 		case IPV6CP_OPT_IFID:
   3794        1.9    itojun 			/*
   3795        1.9    itojun 			 * Peer doesn't grok address option.  This is
   3796        1.9    itojun 			 * bad.  XXX  Should we better give up here?
   3797        1.9    itojun 			 */
   3798        1.9    itojun 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
   3799        1.9    itojun 			break;
   3800        1.9    itojun #ifdef notyet
   3801        1.9    itojun 		case IPV6CP_OPT_COMPRESS:
   3802        1.9    itojun 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
   3803        1.9    itojun 			break;
   3804        1.9    itojun #endif
   3805        1.9    itojun 		}
   3806        1.9    itojun 	}
   3807        1.9    itojun 	if (debug)
   3808        1.9    itojun 		addlog("\n");
   3809       1.96   adrianp drop:
   3810       1.59    itojun 	free(buf, M_TEMP);
   3811        1.9    itojun 	return;
   3812        1.9    itojun }
   3813        1.9    itojun 
   3814        1.9    itojun /*
   3815        1.9    itojun  * Analyze the IPv6CP Configure-NAK option list, and adjust our
   3816        1.9    itojun  * negotiation.
   3817        1.9    itojun  */
   3818        1.9    itojun static void
   3819        1.9    itojun sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3820        1.9    itojun {
   3821      1.140  christos 	u_char *buf, *p, l, blen;
   3822        1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   3823        1.9    itojun 	int debug = ifp->if_flags & IFF_DEBUG;
   3824        1.9    itojun 	struct in6_addr suggestaddr;
   3825  1.165.2.1    bouyer 	char ip6buf[INET6_ADDRSTRLEN];
   3826        1.9    itojun 
   3827      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3828      1.163  knakahar 
   3829        1.9    itojun 	len -= 4;
   3830      1.140  christos 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
   3831        1.9    itojun 	if (!buf)
   3832        1.9    itojun 		return;
   3833        1.9    itojun 
   3834        1.9    itojun 	if (debug)
   3835       1.64    itojun 		log(LOG_DEBUG, "%s: ipv6cp nak opts:",
   3836       1.64    itojun 		    ifp->if_xname);
   3837        1.9    itojun 
   3838       1.59    itojun 	p = (void *)(h + 1);
   3839      1.140  christos 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
   3840      1.140  christos 		if (l > len) {
   3841       1.96   adrianp 			/* XXX just RXJ? */
   3842       1.96   adrianp 			addlog("%s: received malicious IPCPv6 option, "
   3843       1.96   adrianp 			    "dropping\n", ifp->if_xname);
   3844       1.96   adrianp 			goto drop;
   3845       1.96   adrianp 		}
   3846        1.9    itojun 		if (debug)
   3847        1.9    itojun 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3848        1.9    itojun 		switch (*p) {
   3849        1.9    itojun 		case IPV6CP_OPT_IFID:
   3850        1.9    itojun 			/*
   3851        1.9    itojun 			 * Peer doesn't like our local ifid.  See
   3852        1.9    itojun 			 * if we can do something for him.  We'll drop
   3853        1.9    itojun 			 * him our address then.
   3854        1.9    itojun 			 */
   3855      1.140  christos 			if (len < 10 || l != 10)
   3856        1.9    itojun 				break;
   3857       1.25   thorpej 			memset(&suggestaddr, 0, sizeof(suggestaddr));
   3858        1.9    itojun 			suggestaddr.s6_addr16[0] = htons(0xfe80);
   3859       1.87    rpaulo 			(void)in6_setscope(&suggestaddr, &sp->pp_if, NULL);
   3860      1.118   tsutsui 			memcpy(&suggestaddr.s6_addr[8], &p[2], 8);
   3861        1.9    itojun 
   3862        1.9    itojun 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3863        1.9    itojun 			if (debug)
   3864        1.9    itojun 				addlog(" [suggestaddr %s]",
   3865  1.165.2.1    bouyer 				       IN6_PRINT(ip6buf, &suggestaddr));
   3866        1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   3867        1.9    itojun 			/*
   3868        1.9    itojun 			 * When doing dynamic address assignment,
   3869        1.9    itojun 			 * we accept his offer.
   3870        1.9    itojun 			 */
   3871        1.9    itojun 			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
   3872        1.9    itojun 				struct in6_addr lastsuggest;
   3873        1.9    itojun 				/*
   3874        1.9    itojun 				 * If <suggested myaddr from peer> equals to
   3875        1.9    itojun 				 * <hisaddr we have suggested last time>,
   3876        1.9    itojun 				 * we have a collision.  generate new random
   3877        1.9    itojun 				 * ifid.
   3878        1.9    itojun 				 */
   3879        1.9    itojun 				sppp_suggest_ip6_addr(&lastsuggest);
   3880        1.9    itojun 				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
   3881        1.9    itojun 						 lastsuggest)) {
   3882        1.9    itojun 					if (debug)
   3883        1.9    itojun 						addlog(" [random]");
   3884        1.9    itojun 					sppp_gen_ip6_addr(sp, &suggestaddr);
   3885        1.9    itojun 				}
   3886        1.9    itojun 				sppp_set_ip6_addr(sp, &suggestaddr, 0);
   3887        1.9    itojun 				if (debug)
   3888        1.9    itojun 					addlog(" [agree]");
   3889        1.9    itojun 				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3890        1.9    itojun 			}
   3891        1.9    itojun #else
   3892        1.9    itojun 			/*
   3893        1.9    itojun 			 * Since we do not do dynamic address assignment,
   3894        1.9    itojun 			 * we ignore it and thus continue to negotiate
   3895        1.9    itojun 			 * our already existing value.  This can possibly
   3896        1.9    itojun 			 * go into infinite request-reject loop.
   3897        1.9    itojun 			 *
   3898        1.9    itojun 			 * This is not likely because we normally use
   3899        1.9    itojun 			 * ifid based on MAC-address.
   3900        1.9    itojun 			 * If you have no ethernet card on the node, too bad.
   3901        1.9    itojun 			 * XXX should we use fail_counter?
   3902        1.9    itojun 			 */
   3903        1.9    itojun #endif
   3904        1.9    itojun 			break;
   3905        1.9    itojun #ifdef notyet
   3906        1.9    itojun 		case IPV6CP_OPT_COMPRESS:
   3907        1.9    itojun 			/*
   3908        1.9    itojun 			 * Peer wants different compression parameters.
   3909        1.9    itojun 			 */
   3910        1.9    itojun 			break;
   3911        1.9    itojun #endif
   3912        1.9    itojun 		}
   3913        1.9    itojun 	}
   3914        1.9    itojun 	if (debug)
   3915        1.9    itojun 		addlog("\n");
   3916       1.96   adrianp drop:
   3917       1.59    itojun 	free(buf, M_TEMP);
   3918        1.9    itojun 	return;
   3919        1.9    itojun }
   3920        1.9    itojun 
   3921        1.9    itojun static void
   3922        1.9    itojun sppp_ipv6cp_tlu(struct sppp *sp)
   3923        1.9    itojun {
   3924      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3925        1.9    itojun 	/* we are up - notify isdn daemon */
   3926        1.9    itojun 	if (sp->pp_con)
   3927        1.9    itojun 		sp->pp_con(sp);
   3928        1.9    itojun }
   3929        1.9    itojun 
   3930        1.9    itojun static void
   3931      1.101  christos sppp_ipv6cp_tld(struct sppp *sp)
   3932        1.9    itojun {
   3933        1.9    itojun }
   3934        1.9    itojun 
   3935        1.9    itojun static void
   3936        1.9    itojun sppp_ipv6cp_tls(struct sppp *sp)
   3937        1.9    itojun {
   3938      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3939        1.9    itojun 	/* indicate to LCP that it must stay alive */
   3940        1.9    itojun 	sp->lcp.protos |= (1 << IDX_IPV6CP);
   3941        1.9    itojun }
   3942        1.9    itojun 
   3943        1.9    itojun static void
   3944        1.9    itojun sppp_ipv6cp_tlf(struct sppp *sp)
   3945        1.9    itojun {
   3946      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3947        1.9    itojun 	/* we no longer need LCP */
   3948        1.9    itojun 	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
   3949        1.9    itojun }
   3950        1.9    itojun 
   3951        1.9    itojun static void
   3952        1.9    itojun sppp_ipv6cp_scr(struct sppp *sp)
   3953        1.9    itojun {
   3954        1.9    itojun 	char opt[10 /* ifid */ + 4 /* compression, minimum */];
   3955        1.9    itojun 	struct in6_addr ouraddr;
   3956        1.9    itojun 	int i = 0;
   3957        1.9    itojun 
   3958      1.163  knakahar 	KASSERT(sppp_locked(sp));
   3959      1.163  knakahar 
   3960        1.9    itojun 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
   3961        1.9    itojun 		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
   3962        1.9    itojun 		opt[i++] = IPV6CP_OPT_IFID;
   3963        1.9    itojun 		opt[i++] = 10;
   3964      1.118   tsutsui 		memcpy(&opt[i], &ouraddr.s6_addr[8], 8);
   3965        1.9    itojun 		i += 8;
   3966        1.9    itojun 	}
   3967        1.9    itojun 
   3968        1.9    itojun #ifdef notyet
   3969        1.9    itojun 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
   3970        1.9    itojun 		opt[i++] = IPV6CP_OPT_COMPRESSION;
   3971        1.9    itojun 		opt[i++] = 4;
   3972        1.9    itojun 		opt[i++] = 0;	/* TBD */
   3973        1.9    itojun 		opt[i++] = 0;	/* TBD */
   3974        1.9    itojun 		/* variable length data may follow */
   3975        1.9    itojun 	}
   3976        1.9    itojun #endif
   3977        1.9    itojun 
   3978        1.9    itojun 	sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP];
   3979        1.9    itojun 	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt);
   3980        1.9    itojun }
   3981        1.9    itojun #else /*INET6*/
   3982       1.99    dogcow static void
   3983      1.101  christos sppp_ipv6cp_init(struct sppp *sp)
   3984        1.9    itojun {
   3985        1.9    itojun }
   3986        1.9    itojun 
   3987       1.99    dogcow static void
   3988      1.101  christos sppp_ipv6cp_up(struct sppp *sp)
   3989        1.9    itojun {
   3990        1.9    itojun }
   3991        1.9    itojun 
   3992       1.99    dogcow static void
   3993      1.101  christos sppp_ipv6cp_down(struct sppp *sp)
   3994        1.9    itojun {
   3995        1.9    itojun }
   3996        1.9    itojun 
   3997       1.99    dogcow static void
   3998      1.101  christos sppp_ipv6cp_open(struct sppp *sp)
   3999        1.9    itojun {
   4000        1.9    itojun }
   4001        1.9    itojun 
   4002       1.99    dogcow static void
   4003      1.101  christos sppp_ipv6cp_close(struct sppp *sp)
   4004        1.9    itojun {
   4005        1.9    itojun }
   4006        1.9    itojun 
   4007       1.99    dogcow static void
   4008      1.101  christos sppp_ipv6cp_TO(void *sp)
   4009        1.9    itojun {
   4010        1.9    itojun }
   4011        1.9    itojun 
   4012       1.99    dogcow static int
   4013      1.101  christos sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h,
   4014      1.101  christos 		int len)
   4015        1.9    itojun {
   4016        1.9    itojun 	return 0;
   4017        1.9    itojun }
   4018        1.9    itojun 
   4019       1.99    dogcow static void
   4020      1.101  christos sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h,
   4021      1.101  christos 		    int len)
   4022        1.9    itojun {
   4023        1.9    itojun }
   4024        1.9    itojun 
   4025       1.99    dogcow static void
   4026      1.101  christos sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h,
   4027      1.101  christos 		    int len)
   4028        1.9    itojun {
   4029        1.9    itojun }
   4030        1.9    itojun 
   4031       1.99    dogcow static void
   4032      1.101  christos sppp_ipv6cp_tlu(struct sppp *sp)
   4033        1.9    itojun {
   4034        1.9    itojun }
   4035        1.9    itojun 
   4036       1.99    dogcow static void
   4037      1.101  christos sppp_ipv6cp_tld(struct sppp *sp)
   4038        1.9    itojun {
   4039        1.9    itojun }
   4040        1.9    itojun 
   4041       1.99    dogcow static void
   4042      1.101  christos sppp_ipv6cp_tls(struct sppp *sp)
   4043        1.9    itojun {
   4044        1.9    itojun }
   4045        1.9    itojun 
   4046       1.99    dogcow static void
   4047      1.101  christos sppp_ipv6cp_tlf(struct sppp *sp)
   4048        1.9    itojun {
   4049        1.9    itojun }
   4050        1.9    itojun 
   4051       1.99    dogcow static void
   4052      1.101  christos sppp_ipv6cp_scr(struct sppp *sp)
   4053        1.9    itojun {
   4054        1.9    itojun }
   4055        1.9    itojun #endif /*INET6*/
   4056        1.9    itojun 
   4057        1.9    itojun 
   4058       1.42  jdolecek /*
   4059        1.9    itojun  *--------------------------------------------------------------------------*
   4060        1.9    itojun  *                                                                          *
   4061        1.3  explorer  *                        The CHAP implementation.                          *
   4062        1.3  explorer  *                                                                          *
   4063        1.3  explorer  *--------------------------------------------------------------------------*
   4064        1.3  explorer  */
   4065        1.3  explorer 
   4066        1.3  explorer /*
   4067        1.3  explorer  * The authentication protocols don't employ a full-fledged state machine as
   4068        1.3  explorer  * the control protocols do, since they do have Open and Close events, but
   4069        1.3  explorer  * not Up and Down, nor are they explicitly terminated.  Also, use of the
   4070        1.3  explorer  * authentication protocols may be different in both directions (this makes
   4071        1.3  explorer  * sense, think of a machine that never accepts incoming calls but only
   4072        1.3  explorer  * calls out, it doesn't require the called party to authenticate itself).
   4073        1.3  explorer  *
   4074        1.3  explorer  * Our state machine for the local authentication protocol (we are requesting
   4075        1.3  explorer  * the peer to authenticate) looks like:
   4076        1.3  explorer  *
   4077        1.3  explorer  *						    RCA-
   4078        1.3  explorer  *	      +--------------------------------------------+
   4079        1.3  explorer  *	      V					    scn,tld|
   4080        1.3  explorer  *	  +--------+			       Close   +---------+ RCA+
   4081        1.3  explorer  *	  |	   |<----------------------------------|	 |------+
   4082        1.3  explorer  *   +--->| Closed |				TO*    | Opened	 | sca	|
   4083        1.3  explorer  *   |	  |	   |-----+		       +-------|	 |<-----+
   4084        1.3  explorer  *   |	  +--------+ irc |		       |       +---------+
   4085        1.3  explorer  *   |	    ^		 |		       |	   ^
   4086        1.3  explorer  *   |	    |		 |		       |	   |
   4087        1.3  explorer  *   |	    |		 |		       |	   |
   4088        1.3  explorer  *   |	 TO-|		 |		       |	   |
   4089        1.3  explorer  *   |	    |tld  TO+	 V		       |	   |
   4090        1.3  explorer  *   |	    |	+------->+		       |	   |
   4091        1.3  explorer  *   |	    |	|	 |		       |	   |
   4092        1.3  explorer  *   |	  +--------+	 V		       |	   |
   4093        1.3  explorer  *   |	  |	   |<----+<--------------------+	   |
   4094        1.3  explorer  *   |	  | Req-   | scr				   |
   4095        1.3  explorer  *   |	  | Sent   |					   |
   4096        1.3  explorer  *   |	  |	   |					   |
   4097        1.3  explorer  *   |	  +--------+					   |
   4098        1.3  explorer  *   | RCA- |	| RCA+					   |
   4099        1.3  explorer  *   +------+	+------------------------------------------+
   4100        1.3  explorer  *   scn,tld	  sca,irc,ict,tlu
   4101        1.3  explorer  *
   4102        1.3  explorer  *
   4103        1.3  explorer  *   with:
   4104        1.3  explorer  *
   4105        1.3  explorer  *	Open:	LCP reached authentication phase
   4106        1.3  explorer  *	Close:	LCP reached terminate phase
   4107        1.3  explorer  *
   4108        1.3  explorer  *	RCA+:	received reply (pap-req, chap-response), acceptable
   4109        1.3  explorer  *	RCN:	received reply (pap-req, chap-response), not acceptable
   4110        1.3  explorer  *	TO+:	timeout with restart counter >= 0
   4111        1.3  explorer  *	TO-:	timeout with restart counter < 0
   4112        1.3  explorer  *	TO*:	reschedule timeout for CHAP
   4113        1.3  explorer  *
   4114        1.3  explorer  *	scr:	send request packet (none for PAP, chap-challenge)
   4115        1.3  explorer  *	sca:	send ack packet (pap-ack, chap-success)
   4116        1.3  explorer  *	scn:	send nak packet (pap-nak, chap-failure)
   4117        1.3  explorer  *	ict:	initialize re-challenge timer (CHAP only)
   4118        1.3  explorer  *
   4119        1.3  explorer  *	tlu:	this-layer-up, LCP reaches network phase
   4120        1.3  explorer  *	tld:	this-layer-down, LCP enters terminate phase
   4121        1.3  explorer  *
   4122        1.3  explorer  * Note that in CHAP mode, after sending a new challenge, while the state
   4123        1.3  explorer  * automaton falls back into Req-Sent state, it doesn't signal a tld
   4124        1.3  explorer  * event to LCP, so LCP remains in network phase.  Only after not getting
   4125        1.3  explorer  * any response (or after getting an unacceptable response), CHAP closes,
   4126        1.3  explorer  * causing LCP to enter terminate phase.
   4127        1.3  explorer  *
   4128        1.3  explorer  * With PAP, there is no initial request that can be sent.  The peer is
   4129        1.3  explorer  * expected to send one based on the successful negotiation of PAP as
   4130        1.3  explorer  * the authentication protocol during the LCP option negotiation.
   4131        1.3  explorer  *
   4132        1.3  explorer  * Incoming authentication protocol requests (remote requests
   4133        1.3  explorer  * authentication, we are peer) don't employ a state machine at all,
   4134        1.3  explorer  * they are simply answered.  Some peers [Ascend P50 firmware rev
   4135        1.9    itojun  * 4.50] react allergically when sending IPCP/IPv6CP requests while they are
   4136        1.3  explorer  * still in authentication phase (thereby violating the standard that
   4137        1.3  explorer  * demands that these NCP packets are to be discarded), so we keep
   4138        1.3  explorer  * track of the peer demanding us to authenticate, and only proceed to
   4139        1.3  explorer  * phase network once we've seen a positive acknowledge for the
   4140        1.3  explorer  * authentication.
   4141        1.3  explorer  */
   4142        1.3  explorer 
   4143        1.3  explorer /*
   4144        1.3  explorer  * Handle incoming CHAP packets.
   4145        1.3  explorer  */
   4146        1.3  explorer void
   4147        1.3  explorer sppp_chap_input(struct sppp *sp, struct mbuf *m)
   4148        1.3  explorer {
   4149        1.3  explorer 	STDDCL;
   4150        1.3  explorer 	struct lcp_header *h;
   4151        1.3  explorer 	int len, x;
   4152       1.36    martin 	u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize;
   4153        1.3  explorer 	int value_len, name_len;
   4154        1.3  explorer 	MD5_CTX ctx;
   4155        1.3  explorer 
   4156      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   4157      1.163  knakahar 
   4158        1.3  explorer 	len = m->m_pkthdr.len;
   4159        1.3  explorer 	if (len < 4) {
   4160        1.3  explorer 		if (debug)
   4161        1.3  explorer 			log(LOG_DEBUG,
   4162       1.64    itojun 			    "%s: chap invalid packet length: %d bytes\n",
   4163       1.64    itojun 			    ifp->if_xname, len);
   4164        1.3  explorer 		return;
   4165        1.3  explorer 	}
   4166       1.59    itojun 	h = mtod(m, struct lcp_header *);
   4167       1.59    itojun 	if (len > ntohs(h->len))
   4168       1.59    itojun 		len = ntohs(h->len);
   4169        1.3  explorer 
   4170        1.3  explorer 	switch (h->type) {
   4171        1.3  explorer 	/* challenge, failure and success are his authproto */
   4172        1.3  explorer 	case CHAP_CHALLENGE:
   4173      1.163  knakahar 		sppp_lock_enter(sp);
   4174       1.36    martin 		if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   4175      1.163  knakahar 			/* can't do anything useful */
   4176      1.163  knakahar 			sp->pp_auth_failures++;
   4177      1.163  knakahar 			printf("%s: chap input without my name and my secret being set\n",
   4178      1.163  knakahar 				ifp->if_xname);
   4179      1.163  knakahar 			sppp_lock_exit(sp);
   4180      1.163  knakahar 			break;
   4181       1.36    martin 		}
   4182       1.59    itojun 		value = 1 + (u_char *)(h + 1);
   4183        1.3  explorer 		value_len = value[-1];
   4184        1.3  explorer 		name = value + value_len;
   4185        1.3  explorer 		name_len = len - value_len - 5;
   4186        1.3  explorer 		if (name_len < 0) {
   4187        1.3  explorer 			if (debug) {
   4188        1.3  explorer 				log(LOG_DEBUG,
   4189       1.64    itojun 				    "%s: chap corrupted challenge "
   4190        1.3  explorer 				    "<%s id=0x%x len=%d",
   4191       1.64    itojun 				    ifp->if_xname,
   4192        1.3  explorer 				    sppp_auth_type_name(PPP_CHAP, h->type),
   4193        1.3  explorer 				    h->ident, ntohs(h->len));
   4194        1.3  explorer 				if (len > 4)
   4195       1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   4196       1.59    itojun 					    len - 4);
   4197        1.3  explorer 				addlog(">\n");
   4198        1.3  explorer 			}
   4199      1.163  knakahar 			sppp_lock_exit(sp);
   4200        1.3  explorer 			break;
   4201        1.3  explorer 		}
   4202       1.82     perry 
   4203        1.3  explorer 		if (debug) {
   4204        1.3  explorer 			log(LOG_DEBUG,
   4205       1.64    itojun 			    "%s: chap input <%s id=0x%x len=%d name=",
   4206       1.64    itojun 			    ifp->if_xname,
   4207        1.3  explorer 			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
   4208        1.3  explorer 			    ntohs(h->len));
   4209       1.59    itojun 			sppp_print_string((char *) name, name_len);
   4210        1.3  explorer 			addlog(" value-size=%d value=", value_len);
   4211        1.3  explorer 			sppp_print_bytes(value, value_len);
   4212        1.3  explorer 			addlog(">\n");
   4213        1.3  explorer 		}
   4214        1.3  explorer 
   4215        1.3  explorer 		/* Compute reply value. */
   4216        1.3  explorer 		MD5Init(&ctx);
   4217        1.3  explorer 		MD5Update(&ctx, &h->ident, 1);
   4218       1.54  christos 		MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len);
   4219        1.3  explorer 		MD5Update(&ctx, value, value_len);
   4220        1.3  explorer 		MD5Final(digest, &ctx);
   4221        1.3  explorer 		dsize = sizeof digest;
   4222        1.3  explorer 
   4223        1.3  explorer 		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
   4224        1.3  explorer 			       sizeof dsize, (const char *)&dsize,
   4225        1.3  explorer 			       sizeof digest, digest,
   4226       1.54  christos 			       sp->myauth.name_len,
   4227        1.3  explorer 			       sp->myauth.name,
   4228        1.3  explorer 			       0);
   4229      1.163  knakahar 		sppp_lock_exit(sp);
   4230        1.3  explorer 		break;
   4231        1.3  explorer 
   4232        1.3  explorer 	case CHAP_SUCCESS:
   4233      1.163  knakahar 		sppp_lock_enter(sp);
   4234        1.3  explorer 		if (debug) {
   4235       1.64    itojun 			log(LOG_DEBUG, "%s: chap success",
   4236       1.64    itojun 			    ifp->if_xname);
   4237        1.3  explorer 			if (len > 4) {
   4238        1.3  explorer 				addlog(": ");
   4239       1.59    itojun 				sppp_print_string((char *)(h + 1), len - 4);
   4240        1.3  explorer 			}
   4241        1.3  explorer 			addlog("\n");
   4242        1.3  explorer 		}
   4243       1.23   thorpej 		x = splnet();
   4244       1.39    martin 		sp->pp_auth_failures = 0;
   4245        1.3  explorer 		sp->pp_flags &= ~PP_NEEDAUTH;
   4246        1.3  explorer 		if (sp->myauth.proto == PPP_CHAP &&
   4247        1.3  explorer 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   4248        1.3  explorer 		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
   4249        1.3  explorer 			/*
   4250        1.3  explorer 			 * We are authenticator for CHAP but didn't
   4251        1.3  explorer 			 * complete yet.  Leave it to tlu to proceed
   4252        1.3  explorer 			 * to network phase.
   4253        1.3  explorer 			 */
   4254        1.3  explorer 			splx(x);
   4255      1.163  knakahar 			sppp_lock_exit(sp);
   4256        1.3  explorer 			break;
   4257        1.3  explorer 		}
   4258        1.3  explorer 		splx(x);
   4259        1.3  explorer 		sppp_phase_network(sp);
   4260      1.163  knakahar 		sppp_lock_exit(sp);
   4261        1.3  explorer 		break;
   4262        1.3  explorer 
   4263        1.3  explorer 	case CHAP_FAILURE:
   4264       1.39    martin 		x = splnet();
   4265      1.163  knakahar 		sppp_lock_enter(sp);
   4266       1.39    martin 		sp->pp_auth_failures++;
   4267       1.39    martin 		splx(x);
   4268        1.3  explorer 		if (debug) {
   4269       1.64    itojun 			log(LOG_INFO, "%s: chap failure",
   4270       1.64    itojun 			    ifp->if_xname);
   4271        1.3  explorer 			if (len > 4) {
   4272        1.3  explorer 				addlog(": ");
   4273       1.59    itojun 				sppp_print_string((char *)(h + 1), len - 4);
   4274        1.3  explorer 			}
   4275        1.3  explorer 			addlog("\n");
   4276        1.3  explorer 		} else
   4277       1.64    itojun 			log(LOG_INFO, "%s: chap failure\n",
   4278       1.64    itojun 			    ifp->if_xname);
   4279      1.163  knakahar 		sppp_lock_exit(sp);
   4280        1.3  explorer 		/* await LCP shutdown by authenticator */
   4281        1.3  explorer 		break;
   4282        1.3  explorer 
   4283        1.3  explorer 	/* response is my authproto */
   4284        1.3  explorer 	case CHAP_RESPONSE:
   4285      1.163  knakahar 		sppp_lock_enter(sp);
   4286       1.36    martin 		if (sp->hisauth.secret == NULL) {
   4287      1.163  knakahar 			/* can't do anything useful */
   4288      1.163  knakahar 			printf("%s: chap input without his secret being set\n",
   4289      1.163  knakahar 			    ifp->if_xname);
   4290      1.163  knakahar 			sppp_lock_exit(sp);
   4291       1.36    martin 		    break;
   4292       1.36    martin 		}
   4293       1.59    itojun 		value = 1 + (u_char *)(h + 1);
   4294        1.3  explorer 		value_len = value[-1];
   4295        1.3  explorer 		name = value + value_len;
   4296        1.3  explorer 		name_len = len - value_len - 5;
   4297        1.3  explorer 		if (name_len < 0) {
   4298        1.3  explorer 			if (debug) {
   4299        1.3  explorer 				log(LOG_DEBUG,
   4300       1.64    itojun 				    "%s: chap corrupted response "
   4301        1.3  explorer 				    "<%s id=0x%x len=%d",
   4302       1.64    itojun 				    ifp->if_xname,
   4303        1.3  explorer 				    sppp_auth_type_name(PPP_CHAP, h->type),
   4304        1.3  explorer 				    h->ident, ntohs(h->len));
   4305        1.3  explorer 				if (len > 4)
   4306       1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   4307       1.59    itojun 					    len - 4);
   4308        1.3  explorer 				addlog(">\n");
   4309        1.3  explorer 			}
   4310      1.163  knakahar 			sppp_lock_exit(sp);
   4311        1.3  explorer 			break;
   4312        1.3  explorer 		}
   4313        1.3  explorer 		if (h->ident != sp->confid[IDX_CHAP]) {
   4314        1.3  explorer 			if (debug)
   4315        1.3  explorer 				log(LOG_DEBUG,
   4316       1.64    itojun 				    "%s: chap dropping response for old ID "
   4317        1.3  explorer 				    "(got %d, expected %d)\n",
   4318       1.64    itojun 				    ifp->if_xname,
   4319        1.3  explorer 				    h->ident, sp->confid[IDX_CHAP]);
   4320      1.163  knakahar 			sppp_lock_exit(sp);
   4321        1.3  explorer 			break;
   4322        1.3  explorer 		}
   4323       1.82     perry 		if (sp->hisauth.name != NULL &&
   4324       1.54  christos 		    (name_len != sp->hisauth.name_len
   4325       1.36    martin 		    || memcmp(name, sp->hisauth.name, name_len) != 0)) {
   4326       1.64    itojun 			log(LOG_INFO, "%s: chap response, his name ",
   4327       1.64    itojun 			    ifp->if_xname);
   4328        1.3  explorer 			sppp_print_string(name, name_len);
   4329        1.3  explorer 			addlog(" != expected ");
   4330        1.3  explorer 			sppp_print_string(sp->hisauth.name,
   4331       1.54  christos 					  sp->hisauth.name_len);
   4332        1.3  explorer 			addlog("\n");
   4333       1.36    martin 		    goto chap_failure;
   4334       1.36    martin 		}
   4335        1.3  explorer 		if (debug) {
   4336       1.64    itojun 			log(LOG_DEBUG, "%s: chap input(%s) "
   4337        1.3  explorer 			    "<%s id=0x%x len=%d name=",
   4338       1.64    itojun 			    ifp->if_xname,
   4339        1.3  explorer 			    sppp_state_name(sp->state[IDX_CHAP]),
   4340        1.3  explorer 			    sppp_auth_type_name(PPP_CHAP, h->type),
   4341       1.59    itojun 			    h->ident, ntohs(h->len));
   4342       1.59    itojun 			sppp_print_string((char *)name, name_len);
   4343        1.3  explorer 			addlog(" value-size=%d value=", value_len);
   4344        1.3  explorer 			sppp_print_bytes(value, value_len);
   4345        1.3  explorer 			addlog(">\n");
   4346        1.3  explorer 		}
   4347      1.148  christos 		if (value_len != sizeof(sp->hisauth.challenge)) {
   4348        1.3  explorer 			if (debug)
   4349        1.3  explorer 				log(LOG_DEBUG,
   4350       1.64    itojun 				    "%s: chap bad hash value length: "
   4351      1.148  christos 				    "%d bytes, should be %zu\n",
   4352       1.64    itojun 				    ifp->if_xname, value_len,
   4353      1.148  christos 				    sizeof(sp->hisauth.challenge));
   4354       1.36    martin 			goto chap_failure;
   4355        1.3  explorer 		}
   4356        1.3  explorer 
   4357        1.3  explorer 		MD5Init(&ctx);
   4358        1.3  explorer 		MD5Update(&ctx, &h->ident, 1);
   4359       1.54  christos 		MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len);
   4360      1.148  christos 		MD5Update(&ctx, sp->hisauth.challenge, sizeof(sp->hisauth.challenge));
   4361        1.3  explorer 		MD5Final(digest, &ctx);
   4362        1.3  explorer 
   4363        1.3  explorer #define FAILMSG "Failed..."
   4364        1.3  explorer #define SUCCMSG "Welcome!"
   4365        1.3  explorer 
   4366        1.3  explorer 		if (value_len != sizeof digest ||
   4367       1.36    martin 		    memcmp(digest, value, value_len) != 0) {
   4368       1.36    martin chap_failure:
   4369      1.163  knakahar 			KASSERT(sppp_locked(sp));
   4370        1.3  explorer 			/* action scn, tld */
   4371       1.39    martin 			x = splnet();
   4372       1.39    martin 			sp->pp_auth_failures++;
   4373       1.39    martin 			splx(x);
   4374        1.3  explorer 			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
   4375       1.85  christos 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
   4376        1.3  explorer 				       0);
   4377        1.3  explorer 			chap.tld(sp);
   4378      1.163  knakahar 			sppp_lock_exit(sp);
   4379        1.3  explorer 			break;
   4380        1.3  explorer 		}
   4381       1.39    martin 		sp->pp_auth_failures = 0;
   4382        1.3  explorer 		/* action sca, perhaps tlu */
   4383        1.3  explorer 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
   4384        1.3  explorer 		    sp->state[IDX_CHAP] == STATE_OPENED)
   4385        1.3  explorer 			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
   4386       1.85  christos 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
   4387        1.3  explorer 				       0);
   4388        1.3  explorer 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
   4389        1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_OPENED);
   4390        1.3  explorer 			chap.tlu(sp);
   4391        1.3  explorer 		}
   4392      1.163  knakahar 		sppp_lock_exit(sp);
   4393        1.3  explorer 		break;
   4394        1.3  explorer 
   4395        1.3  explorer 	default:
   4396        1.3  explorer 		/* Unknown CHAP packet type -- ignore. */
   4397      1.163  knakahar 		sppp_lock_enter(sp);
   4398        1.3  explorer 		if (debug) {
   4399       1.64    itojun 			log(LOG_DEBUG, "%s: chap unknown input(%s) "
   4400        1.3  explorer 			    "<0x%x id=0x%xh len=%d",
   4401       1.64    itojun 			    ifp->if_xname,
   4402        1.3  explorer 			    sppp_state_name(sp->state[IDX_CHAP]),
   4403        1.3  explorer 			    h->type, h->ident, ntohs(h->len));
   4404        1.3  explorer 			if (len > 4)
   4405       1.59    itojun 				sppp_print_bytes((u_char *)(h + 1), len - 4);
   4406        1.3  explorer 			addlog(">\n");
   4407        1.3  explorer 		}
   4408      1.163  knakahar 		sppp_lock_exit(sp);
   4409        1.3  explorer 		break;
   4410        1.3  explorer 
   4411        1.3  explorer 	}
   4412        1.3  explorer }
   4413        1.3  explorer 
   4414      1.163  knakahar void
   4415      1.163  knakahar sppp_lock_enter(struct sppp *sp)
   4416      1.163  knakahar {
   4417      1.163  knakahar 	if (sp->pp_lock)
   4418      1.163  knakahar 		mutex_enter(sp->pp_lock);
   4419      1.163  knakahar }
   4420      1.163  knakahar 
   4421      1.163  knakahar void
   4422      1.163  knakahar sppp_lock_exit(struct sppp *sp)
   4423      1.163  knakahar {
   4424      1.163  knakahar 	if (sp->pp_lock)
   4425      1.163  knakahar 		mutex_exit(sp->pp_lock);
   4426      1.163  knakahar }
   4427      1.163  knakahar 
   4428      1.163  knakahar int
   4429      1.163  knakahar sppp_locked(struct sppp *sp)
   4430      1.163  knakahar {
   4431      1.163  knakahar 	return (!(sp->pp_lock) || mutex_owned(sp->pp_lock));
   4432      1.163  knakahar }
   4433      1.163  knakahar 
   4434        1.3  explorer static void
   4435        1.3  explorer sppp_chap_init(struct sppp *sp)
   4436        1.3  explorer {
   4437      1.163  knakahar 	sppp_lock_enter(sp);
   4438        1.3  explorer 	/* Chap doesn't have STATE_INITIAL at all. */
   4439        1.3  explorer 	sp->state[IDX_CHAP] = STATE_CLOSED;
   4440        1.3  explorer 	sp->fail_counter[IDX_CHAP] = 0;
   4441        1.9    itojun 	sp->pp_seq[IDX_CHAP] = 0;
   4442        1.9    itojun 	sp->pp_rseq[IDX_CHAP] = 0;
   4443      1.106        ad 	callout_init(&sp->ch[IDX_CHAP], 0);
   4444      1.163  knakahar 	sppp_lock_exit(sp);
   4445        1.3  explorer }
   4446        1.3  explorer 
   4447        1.3  explorer static void
   4448        1.3  explorer sppp_chap_open(struct sppp *sp)
   4449        1.3  explorer {
   4450      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4451      1.148  christos 	if (sp->hisauth.proto == PPP_CHAP &&
   4452        1.3  explorer 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4453        1.3  explorer 		/* we are authenticator for CHAP, start it */
   4454        1.3  explorer 		chap.scr(sp);
   4455        1.3  explorer 		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4456        1.3  explorer 		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4457        1.3  explorer 	}
   4458        1.3  explorer 	/* nothing to be done if we are peer, await a challenge */
   4459        1.3  explorer }
   4460        1.3  explorer 
   4461        1.3  explorer static void
   4462        1.3  explorer sppp_chap_close(struct sppp *sp)
   4463        1.3  explorer {
   4464      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4465      1.163  knakahar 
   4466        1.3  explorer 	if (sp->state[IDX_CHAP] != STATE_CLOSED)
   4467        1.3  explorer 		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4468        1.3  explorer }
   4469        1.3  explorer 
   4470        1.3  explorer static void
   4471        1.3  explorer sppp_chap_TO(void *cookie)
   4472        1.3  explorer {
   4473        1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4474        1.3  explorer 	STDDCL;
   4475        1.3  explorer 	int s;
   4476        1.3  explorer 
   4477      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   4478      1.163  knakahar 
   4479       1.23   thorpej 	s = splnet();
   4480      1.163  knakahar 	sppp_lock_enter(sp);
   4481      1.163  knakahar 
   4482        1.3  explorer 	if (debug)
   4483       1.64    itojun 		log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n",
   4484       1.64    itojun 		    ifp->if_xname,
   4485        1.3  explorer 		    sppp_state_name(sp->state[IDX_CHAP]),
   4486        1.3  explorer 		    sp->rst_counter[IDX_CHAP]);
   4487        1.3  explorer 
   4488        1.3  explorer 	if (--sp->rst_counter[IDX_CHAP] < 0)
   4489        1.3  explorer 		/* TO- event */
   4490        1.3  explorer 		switch (sp->state[IDX_CHAP]) {
   4491        1.3  explorer 		case STATE_REQ_SENT:
   4492        1.3  explorer 			chap.tld(sp);
   4493        1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4494        1.3  explorer 			break;
   4495        1.3  explorer 		}
   4496        1.3  explorer 	else
   4497        1.3  explorer 		/* TO+ (or TO*) event */
   4498        1.3  explorer 		switch (sp->state[IDX_CHAP]) {
   4499        1.3  explorer 		case STATE_OPENED:
   4500        1.3  explorer 			/* TO* event */
   4501        1.3  explorer 			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4502        1.3  explorer 			/* fall through */
   4503        1.3  explorer 		case STATE_REQ_SENT:
   4504        1.3  explorer 			chap.scr(sp);
   4505        1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   4506        1.3  explorer 			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4507        1.3  explorer 			break;
   4508        1.3  explorer 		}
   4509        1.3  explorer 
   4510      1.163  knakahar 	sppp_lock_exit(sp);
   4511        1.3  explorer 	splx(s);
   4512        1.3  explorer }
   4513        1.3  explorer 
   4514        1.3  explorer static void
   4515        1.3  explorer sppp_chap_tlu(struct sppp *sp)
   4516        1.3  explorer {
   4517        1.3  explorer 	STDDCL;
   4518        1.3  explorer 	int i, x;
   4519        1.3  explorer 
   4520      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4521        1.3  explorer 	i = 0;
   4522        1.3  explorer 	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4523        1.3  explorer 
   4524        1.3  explorer 	/*
   4525        1.3  explorer 	 * Some broken CHAP implementations (Conware CoNet, firmware
   4526        1.3  explorer 	 * 4.0.?) don't want to re-authenticate their CHAP once the
   4527        1.3  explorer 	 * initial challenge-response exchange has taken place.
   4528        1.3  explorer 	 * Provide for an option to avoid rechallenges.
   4529        1.3  explorer 	 */
   4530       1.36    martin 	if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
   4531        1.3  explorer 		/*
   4532        1.3  explorer 		 * Compute the re-challenge timeout.  This will yield
   4533        1.3  explorer 		 * a number between 300 and 810 seconds.
   4534        1.3  explorer 		 */
   4535      1.124       tls 		i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7);
   4536        1.3  explorer 
   4537        1.7   thorpej 		callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp);
   4538        1.3  explorer 	}
   4539        1.3  explorer 
   4540        1.3  explorer 	if (debug) {
   4541        1.3  explorer 		log(LOG_DEBUG,
   4542       1.64    itojun 		    "%s: chap %s, ",
   4543       1.64    itojun 		    ifp->if_xname,
   4544       1.36    martin 		    sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu");
   4545       1.36    martin 		if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0)
   4546        1.3  explorer 			addlog("next re-challenge in %d seconds\n", i);
   4547        1.3  explorer 		else
   4548        1.3  explorer 			addlog("re-challenging supressed\n");
   4549        1.3  explorer 	}
   4550        1.3  explorer 
   4551       1.23   thorpej 	x = splnet();
   4552       1.39    martin 	sp->pp_auth_failures = 0;
   4553        1.3  explorer 	/* indicate to LCP that we need to be closed down */
   4554        1.3  explorer 	sp->lcp.protos |= (1 << IDX_CHAP);
   4555        1.3  explorer 
   4556        1.3  explorer 	if (sp->pp_flags & PP_NEEDAUTH) {
   4557        1.3  explorer 		/*
   4558        1.3  explorer 		 * Remote is authenticator, but his auth proto didn't
   4559        1.3  explorer 		 * complete yet.  Defer the transition to network
   4560        1.3  explorer 		 * phase.
   4561        1.3  explorer 		 */
   4562        1.3  explorer 		splx(x);
   4563        1.3  explorer 		return;
   4564        1.3  explorer 	}
   4565        1.3  explorer 	splx(x);
   4566        1.3  explorer 
   4567        1.3  explorer 	/*
   4568        1.3  explorer 	 * If we are already in phase network, we are done here.  This
   4569        1.3  explorer 	 * is the case if this is a dummy tlu event after a re-challenge.
   4570        1.3  explorer 	 */
   4571       1.36    martin 	if (sp->pp_phase != SPPP_PHASE_NETWORK)
   4572        1.3  explorer 		sppp_phase_network(sp);
   4573        1.3  explorer }
   4574        1.3  explorer 
   4575        1.3  explorer static void
   4576        1.3  explorer sppp_chap_tld(struct sppp *sp)
   4577        1.3  explorer {
   4578        1.3  explorer 	STDDCL;
   4579        1.3  explorer 
   4580      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4581      1.163  knakahar 
   4582        1.3  explorer 	if (debug)
   4583       1.64    itojun 		log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname);
   4584        1.7   thorpej 	callout_stop(&sp->ch[IDX_CHAP]);
   4585        1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_CHAP);
   4586        1.3  explorer 
   4587        1.3  explorer 	lcp.Close(sp);
   4588        1.3  explorer }
   4589        1.3  explorer 
   4590        1.3  explorer static void
   4591        1.3  explorer sppp_chap_scr(struct sppp *sp)
   4592        1.3  explorer {
   4593      1.109      matt 	uint32_t *ch;
   4594      1.124       tls 	u_char clen = 4 * sizeof(uint32_t);
   4595        1.3  explorer 
   4596      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4597      1.163  knakahar 
   4598      1.148  christos 	if (sp->hisauth.name == NULL) {
   4599      1.119       snj 	    /* can't do anything useful */
   4600      1.148  christos 	    printf("%s: chap starting without his name being set\n",
   4601       1.64    itojun 	    	sp->pp_if.if_xname);
   4602       1.36    martin 	    return;
   4603       1.36    martin 	}
   4604       1.36    martin 
   4605        1.3  explorer 	/* Compute random challenge. */
   4606      1.148  christos 	ch = (uint32_t *)sp->hisauth.challenge;
   4607      1.125       tls 	cprng_strong(kern_cprng, ch, clen, 0);
   4608        1.3  explorer 
   4609        1.9    itojun 	sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];
   4610        1.3  explorer 
   4611        1.3  explorer 	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
   4612        1.3  explorer 		       sizeof clen, (const char *)&clen,
   4613      1.148  christos 		       sizeof(sp->hisauth.challenge), sp->hisauth.challenge,
   4614        1.3  explorer 		       0);
   4615        1.3  explorer }
   4616       1.42  jdolecek 
   4617       1.42  jdolecek /*
   4618        1.3  explorer  *--------------------------------------------------------------------------*
   4619        1.3  explorer  *                                                                          *
   4620        1.3  explorer  *                        The PAP implementation.                           *
   4621        1.3  explorer  *                                                                          *
   4622        1.3  explorer  *--------------------------------------------------------------------------*
   4623        1.3  explorer  */
   4624        1.3  explorer /*
   4625        1.3  explorer  * For PAP, we need to keep a little state also if we are the peer, not the
   4626        1.3  explorer  * authenticator.  This is since we don't get a request to authenticate, but
   4627        1.3  explorer  * have to repeatedly authenticate ourself until we got a response (or the
   4628        1.3  explorer  * retry counter is expired).
   4629        1.3  explorer  */
   4630        1.3  explorer 
   4631        1.3  explorer /*
   4632        1.3  explorer  * Handle incoming PAP packets.  */
   4633        1.3  explorer static void
   4634        1.3  explorer sppp_pap_input(struct sppp *sp, struct mbuf *m)
   4635        1.3  explorer {
   4636        1.3  explorer 	STDDCL;
   4637        1.3  explorer 	struct lcp_header *h;
   4638        1.3  explorer 	int len, x;
   4639       1.36    martin 	u_char mlen;
   4640       1.53  christos 	char *name, *secret;
   4641       1.52  christos 	int name_len, secret_len;
   4642        1.3  explorer 
   4643      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   4644      1.163  knakahar 
   4645       1.96   adrianp 	/*
   4646       1.96   adrianp 	 * Malicious input might leave this uninitialized, so
   4647       1.96   adrianp 	 * init to an impossible value.
   4648       1.96   adrianp 	 */
   4649       1.96   adrianp 	secret_len = -1;
   4650       1.96   adrianp 
   4651        1.3  explorer 	len = m->m_pkthdr.len;
   4652        1.3  explorer 	if (len < 5) {
   4653        1.3  explorer 		if (debug)
   4654        1.3  explorer 			log(LOG_DEBUG,
   4655       1.64    itojun 			    "%s: pap invalid packet length: %d bytes\n",
   4656       1.64    itojun 			    ifp->if_xname, len);
   4657        1.3  explorer 		return;
   4658        1.3  explorer 	}
   4659       1.59    itojun 	h = mtod(m, struct lcp_header *);
   4660       1.59    itojun 	if (len > ntohs(h->len))
   4661       1.59    itojun 		len = ntohs(h->len);
   4662        1.3  explorer 	switch (h->type) {
   4663        1.3  explorer 	/* PAP request is my authproto */
   4664        1.3  explorer 	case PAP_REQ:
   4665      1.163  knakahar 		sppp_lock_enter(sp);
   4666       1.36    martin 		if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
   4667      1.163  knakahar 			/* can't do anything useful */
   4668      1.163  knakahar 			printf("%s: "
   4669      1.163  knakahar 			    "pap request without his name and his secret being set\n",
   4670      1.163  knakahar 			    ifp->if_xname);
   4671      1.163  knakahar 			sppp_lock_exit(sp);
   4672      1.163  knakahar 			break;
   4673       1.36    martin 		}
   4674       1.59    itojun 		name = 1 + (u_char *)(h + 1);
   4675        1.3  explorer 		name_len = name[-1];
   4676       1.52  christos 		secret = name + name_len + 1;
   4677        1.3  explorer 		if (name_len > len - 6 ||
   4678       1.52  christos 		    (secret_len = secret[-1]) > len - 6 - name_len) {
   4679        1.3  explorer 			if (debug) {
   4680       1.64    itojun 				log(LOG_DEBUG, "%s: pap corrupted input "
   4681        1.3  explorer 				    "<%s id=0x%x len=%d",
   4682       1.64    itojun 				    ifp->if_xname,
   4683        1.3  explorer 				    sppp_auth_type_name(PPP_PAP, h->type),
   4684        1.3  explorer 				    h->ident, ntohs(h->len));
   4685        1.3  explorer 				if (len > 4)
   4686       1.59    itojun 					sppp_print_bytes((u_char *)(h + 1),
   4687       1.59    itojun 					    len - 4);
   4688        1.3  explorer 				addlog(">\n");
   4689        1.3  explorer 			}
   4690      1.163  knakahar 			sppp_lock_exit(sp);
   4691        1.3  explorer 			break;
   4692        1.3  explorer 		}
   4693        1.3  explorer 		if (debug) {
   4694       1.64    itojun 			log(LOG_DEBUG, "%s: pap input(%s) "
   4695        1.3  explorer 			    "<%s id=0x%x len=%d name=",
   4696       1.64    itojun 			    ifp->if_xname,
   4697        1.3  explorer 			    sppp_state_name(sp->state[IDX_PAP]),
   4698        1.3  explorer 			    sppp_auth_type_name(PPP_PAP, h->type),
   4699        1.3  explorer 			    h->ident, ntohs(h->len));
   4700       1.59    itojun 			sppp_print_string((char *)name, name_len);
   4701       1.52  christos 			addlog(" secret=");
   4702       1.59    itojun 			sppp_print_string((char *)secret, secret_len);
   4703        1.3  explorer 			addlog(">\n");
   4704        1.3  explorer 		}
   4705       1.54  christos 		if (name_len != sp->hisauth.name_len ||
   4706       1.54  christos 		    secret_len != sp->hisauth.secret_len ||
   4707       1.53  christos 		    memcmp(name, sp->hisauth.name, name_len) != 0 ||
   4708       1.53  christos 		    memcmp(secret, sp->hisauth.secret, secret_len) != 0) {
   4709        1.3  explorer 			/* action scn, tld */
   4710       1.39    martin 			sp->pp_auth_failures++;
   4711        1.3  explorer 			mlen = sizeof(FAILMSG) - 1;
   4712        1.3  explorer 			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
   4713        1.3  explorer 				       sizeof mlen, (const char *)&mlen,
   4714       1.85  christos 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
   4715        1.3  explorer 				       0);
   4716        1.3  explorer 			pap.tld(sp);
   4717      1.163  knakahar 			sppp_lock_exit(sp);
   4718        1.3  explorer 			break;
   4719        1.3  explorer 		}
   4720        1.3  explorer 		/* action sca, perhaps tlu */
   4721        1.3  explorer 		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
   4722        1.3  explorer 		    sp->state[IDX_PAP] == STATE_OPENED) {
   4723        1.3  explorer 			mlen = sizeof(SUCCMSG) - 1;
   4724        1.3  explorer 			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
   4725        1.3  explorer 				       sizeof mlen, (const char *)&mlen,
   4726       1.85  christos 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
   4727        1.3  explorer 				       0);
   4728        1.3  explorer 		}
   4729        1.3  explorer 		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
   4730        1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_OPENED);
   4731        1.3  explorer 			pap.tlu(sp);
   4732        1.3  explorer 		}
   4733      1.163  knakahar 		sppp_lock_exit(sp);
   4734        1.3  explorer 		break;
   4735        1.3  explorer 
   4736        1.3  explorer 	/* ack and nak are his authproto */
   4737        1.3  explorer 	case PAP_ACK:
   4738      1.163  knakahar 		sppp_lock_enter(sp);
   4739        1.7   thorpej 		callout_stop(&sp->pap_my_to_ch);
   4740        1.3  explorer 		if (debug) {
   4741       1.64    itojun 			log(LOG_DEBUG, "%s: pap success",
   4742       1.64    itojun 			    ifp->if_xname);
   4743       1.96   adrianp 			name = 1 + (u_char *)(h + 1);
   4744       1.96   adrianp 			name_len = name[-1];
   4745       1.96   adrianp 			if (len > 5 && name_len < len+4) {
   4746        1.3  explorer 				addlog(": ");
   4747       1.96   adrianp 				sppp_print_string(name, name_len);
   4748        1.3  explorer 			}
   4749        1.3  explorer 			addlog("\n");
   4750        1.3  explorer 		}
   4751       1.23   thorpej 		x = splnet();
   4752       1.39    martin 		sp->pp_auth_failures = 0;
   4753        1.3  explorer 		sp->pp_flags &= ~PP_NEEDAUTH;
   4754        1.3  explorer 		if (sp->myauth.proto == PPP_PAP &&
   4755        1.3  explorer 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   4756        1.3  explorer 		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
   4757        1.3  explorer 			/*
   4758        1.3  explorer 			 * We are authenticator for PAP but didn't
   4759        1.3  explorer 			 * complete yet.  Leave it to tlu to proceed
   4760        1.3  explorer 			 * to network phase.
   4761        1.3  explorer 			 */
   4762        1.3  explorer 			splx(x);
   4763      1.163  knakahar 			sppp_lock_exit(sp);
   4764        1.3  explorer 			break;
   4765        1.3  explorer 		}
   4766        1.3  explorer 		splx(x);
   4767        1.3  explorer 		sppp_phase_network(sp);
   4768      1.163  knakahar 		sppp_lock_exit(sp);
   4769        1.3  explorer 		break;
   4770        1.3  explorer 
   4771        1.3  explorer 	case PAP_NAK:
   4772      1.163  knakahar 		sppp_lock_enter(sp);
   4773        1.7   thorpej 		callout_stop(&sp->pap_my_to_ch);
   4774       1.39    martin 		sp->pp_auth_failures++;
   4775        1.3  explorer 		if (debug) {
   4776       1.64    itojun 			log(LOG_INFO, "%s: pap failure",
   4777       1.64    itojun 			    ifp->if_xname);
   4778       1.96   adrianp 			name = 1 + (u_char *)(h + 1);
   4779       1.96   adrianp 			name_len = name[-1];
   4780       1.96   adrianp 			if (len > 5 && name_len < len+4) {
   4781        1.3  explorer 				addlog(": ");
   4782       1.96   adrianp 				sppp_print_string(name, name_len);
   4783        1.3  explorer 			}
   4784        1.3  explorer 			addlog("\n");
   4785        1.3  explorer 		} else
   4786       1.64    itojun 			log(LOG_INFO, "%s: pap failure\n",
   4787       1.64    itojun 			    ifp->if_xname);
   4788        1.3  explorer 		/* await LCP shutdown by authenticator */
   4789      1.163  knakahar 		sppp_lock_exit(sp);
   4790        1.3  explorer 		break;
   4791        1.3  explorer 
   4792        1.3  explorer 	default:
   4793        1.3  explorer 		/* Unknown PAP packet type -- ignore. */
   4794      1.163  knakahar 		sppp_lock_enter(sp);
   4795        1.3  explorer 		if (debug) {
   4796       1.64    itojun 			log(LOG_DEBUG, "%s: pap corrupted input "
   4797        1.3  explorer 			    "<0x%x id=0x%x len=%d",
   4798       1.64    itojun 			    ifp->if_xname,
   4799        1.3  explorer 			    h->type, h->ident, ntohs(h->len));
   4800        1.3  explorer 			if (len > 4)
   4801       1.59    itojun 				sppp_print_bytes((u_char *)(h + 1), len - 4);
   4802        1.3  explorer 			addlog(">\n");
   4803        1.3  explorer 		}
   4804      1.163  knakahar 		sppp_lock_exit(sp);
   4805        1.3  explorer 		break;
   4806        1.3  explorer 
   4807        1.3  explorer 	}
   4808        1.3  explorer }
   4809        1.3  explorer 
   4810        1.3  explorer static void
   4811        1.3  explorer sppp_pap_init(struct sppp *sp)
   4812        1.3  explorer {
   4813        1.3  explorer 	/* PAP doesn't have STATE_INITIAL at all. */
   4814      1.163  knakahar 	sppp_lock_enter(sp);
   4815        1.3  explorer 	sp->state[IDX_PAP] = STATE_CLOSED;
   4816        1.3  explorer 	sp->fail_counter[IDX_PAP] = 0;
   4817        1.9    itojun 	sp->pp_seq[IDX_PAP] = 0;
   4818        1.9    itojun 	sp->pp_rseq[IDX_PAP] = 0;
   4819      1.106        ad 	callout_init(&sp->ch[IDX_PAP], 0);
   4820      1.106        ad 	callout_init(&sp->pap_my_to_ch, 0);
   4821      1.163  knakahar 	sppp_lock_exit(sp);
   4822        1.3  explorer }
   4823        1.3  explorer 
   4824        1.3  explorer static void
   4825        1.3  explorer sppp_pap_open(struct sppp *sp)
   4826        1.3  explorer {
   4827      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4828      1.163  knakahar 
   4829        1.3  explorer 	if (sp->hisauth.proto == PPP_PAP &&
   4830        1.3  explorer 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4831        1.3  explorer 		/* we are authenticator for PAP, start our timer */
   4832        1.3  explorer 		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4833        1.3  explorer 		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4834        1.3  explorer 	}
   4835        1.3  explorer 	if (sp->myauth.proto == PPP_PAP) {
   4836        1.3  explorer 		/* we are peer, send a request, and start a timer */
   4837        1.3  explorer 		pap.scr(sp);
   4838        1.7   thorpej 		callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout,
   4839        1.7   thorpej 		    sppp_pap_my_TO, sp);
   4840        1.3  explorer 	}
   4841        1.3  explorer }
   4842        1.3  explorer 
   4843        1.3  explorer static void
   4844        1.3  explorer sppp_pap_close(struct sppp *sp)
   4845        1.3  explorer {
   4846      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4847        1.3  explorer 	if (sp->state[IDX_PAP] != STATE_CLOSED)
   4848        1.3  explorer 		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4849        1.3  explorer }
   4850        1.3  explorer 
   4851        1.3  explorer /*
   4852        1.3  explorer  * That's the timeout routine if we are authenticator.  Since the
   4853        1.3  explorer  * authenticator is basically passive in PAP, we can't do much here.
   4854        1.3  explorer  */
   4855        1.3  explorer static void
   4856        1.3  explorer sppp_pap_TO(void *cookie)
   4857        1.3  explorer {
   4858        1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4859        1.3  explorer 	STDDCL;
   4860        1.3  explorer 	int s;
   4861        1.3  explorer 
   4862      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   4863      1.163  knakahar 
   4864       1.23   thorpej 	s = splnet();
   4865      1.163  knakahar 	sppp_lock_enter(sp);
   4866        1.3  explorer 	if (debug)
   4867       1.64    itojun 		log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n",
   4868       1.64    itojun 		    ifp->if_xname,
   4869        1.3  explorer 		    sppp_state_name(sp->state[IDX_PAP]),
   4870        1.3  explorer 		    sp->rst_counter[IDX_PAP]);
   4871        1.3  explorer 
   4872        1.3  explorer 	if (--sp->rst_counter[IDX_PAP] < 0)
   4873        1.3  explorer 		/* TO- event */
   4874        1.3  explorer 		switch (sp->state[IDX_PAP]) {
   4875        1.3  explorer 		case STATE_REQ_SENT:
   4876        1.3  explorer 			pap.tld(sp);
   4877        1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4878        1.3  explorer 			break;
   4879        1.3  explorer 		}
   4880        1.3  explorer 	else
   4881        1.3  explorer 		/* TO+ event, not very much we could do */
   4882        1.3  explorer 		switch (sp->state[IDX_PAP]) {
   4883        1.3  explorer 		case STATE_REQ_SENT:
   4884        1.3  explorer 			/* sppp_cp_change_state() will restart the timer */
   4885        1.3  explorer 			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4886        1.3  explorer 			break;
   4887        1.3  explorer 		}
   4888        1.3  explorer 
   4889      1.163  knakahar 	sppp_lock_exit(sp);
   4890        1.3  explorer 	splx(s);
   4891        1.3  explorer }
   4892        1.3  explorer 
   4893        1.3  explorer /*
   4894        1.3  explorer  * That's the timeout handler if we are peer.  Since the peer is active,
   4895        1.3  explorer  * we need to retransmit our PAP request since it is apparently lost.
   4896        1.3  explorer  * XXX We should impose a max counter.
   4897        1.3  explorer  */
   4898        1.3  explorer static void
   4899        1.3  explorer sppp_pap_my_TO(void *cookie)
   4900        1.3  explorer {
   4901        1.3  explorer 	struct sppp *sp = (struct sppp *)cookie;
   4902        1.3  explorer 	STDDCL;
   4903        1.3  explorer 
   4904      1.163  knakahar 	KASSERT(!sppp_locked(sp));
   4905      1.163  knakahar 
   4906      1.163  knakahar 	sppp_lock_enter(sp);
   4907        1.3  explorer 	if (debug)
   4908       1.64    itojun 		log(LOG_DEBUG, "%s: pap peer TO\n",
   4909       1.64    itojun 		    ifp->if_xname);
   4910        1.3  explorer 
   4911        1.3  explorer 	pap.scr(sp);
   4912      1.163  knakahar 	sppp_lock_exit(sp);
   4913        1.3  explorer }
   4914        1.3  explorer 
   4915        1.3  explorer static void
   4916        1.3  explorer sppp_pap_tlu(struct sppp *sp)
   4917        1.3  explorer {
   4918        1.3  explorer 	STDDCL;
   4919        1.3  explorer 	int x;
   4920        1.3  explorer 
   4921      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4922        1.3  explorer 	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4923        1.3  explorer 
   4924        1.3  explorer 	if (debug)
   4925       1.64    itojun 		log(LOG_DEBUG, "%s: %s tlu\n",
   4926       1.64    itojun 		    ifp->if_xname, pap.name);
   4927        1.3  explorer 
   4928       1.23   thorpej 	x = splnet();
   4929       1.39    martin 	sp->pp_auth_failures = 0;
   4930        1.3  explorer 	/* indicate to LCP that we need to be closed down */
   4931        1.3  explorer 	sp->lcp.protos |= (1 << IDX_PAP);
   4932        1.3  explorer 
   4933        1.3  explorer 	if (sp->pp_flags & PP_NEEDAUTH) {
   4934        1.3  explorer 		/*
   4935        1.3  explorer 		 * Remote is authenticator, but his auth proto didn't
   4936        1.3  explorer 		 * complete yet.  Defer the transition to network
   4937        1.3  explorer 		 * phase.
   4938        1.3  explorer 		 */
   4939        1.3  explorer 		splx(x);
   4940        1.3  explorer 		return;
   4941        1.3  explorer 	}
   4942        1.3  explorer 	splx(x);
   4943        1.3  explorer 	sppp_phase_network(sp);
   4944        1.3  explorer }
   4945        1.3  explorer 
   4946        1.3  explorer static void
   4947        1.3  explorer sppp_pap_tld(struct sppp *sp)
   4948        1.3  explorer {
   4949        1.3  explorer 	STDDCL;
   4950        1.3  explorer 
   4951      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4952      1.163  knakahar 
   4953        1.3  explorer 	if (debug)
   4954       1.64    itojun 		log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname);
   4955        1.7   thorpej 	callout_stop(&sp->ch[IDX_PAP]);
   4956        1.7   thorpej 	callout_stop(&sp->pap_my_to_ch);
   4957        1.3  explorer 	sp->lcp.protos &= ~(1 << IDX_PAP);
   4958        1.3  explorer 
   4959        1.3  explorer 	lcp.Close(sp);
   4960        1.3  explorer }
   4961        1.3  explorer 
   4962        1.3  explorer static void
   4963        1.3  explorer sppp_pap_scr(struct sppp *sp)
   4964        1.3  explorer {
   4965        1.3  explorer 	u_char idlen, pwdlen;
   4966        1.3  explorer 
   4967      1.163  knakahar 	KASSERT(sppp_locked(sp));
   4968      1.163  knakahar 
   4969       1.36    martin 	if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   4970      1.119       snj 	    /* can't do anything useful */
   4971       1.64    itojun 	    printf("%s: pap starting without my name and secret being set\n",
   4972       1.64    itojun 	    	sp->pp_if.if_xname);
   4973       1.36    martin 	    return;
   4974       1.36    martin 	}
   4975       1.82     perry 
   4976        1.9    itojun 	sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP];
   4977       1.54  christos 	pwdlen = sp->myauth.secret_len;
   4978       1.54  christos 	idlen = sp->myauth.name_len;
   4979        1.3  explorer 
   4980        1.3  explorer 	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
   4981        1.3  explorer 		       sizeof idlen, (const char *)&idlen,
   4982       1.36    martin 		       idlen, sp->myauth.name,
   4983        1.3  explorer 		       sizeof pwdlen, (const char *)&pwdlen,
   4984       1.36    martin 		       pwdlen, sp->myauth.secret,
   4985        1.3  explorer 		       0);
   4986        1.3  explorer }
   4987       1.42  jdolecek 
   4988       1.42  jdolecek /*
   4989        1.3  explorer  * Random miscellaneous functions.
   4990        1.3  explorer  */
   4991        1.3  explorer 
   4992        1.3  explorer /*
   4993        1.3  explorer  * Send a PAP or CHAP proto packet.
   4994        1.3  explorer  *
   4995        1.3  explorer  * Varadic function, each of the elements for the ellipsis is of type
   4996        1.3  explorer  * ``size_t mlen, const u_char *msg''.  Processing will stop iff
   4997        1.3  explorer  * mlen == 0.
   4998        1.3  explorer  * NOTE: never declare variadic functions with types subject to type
   4999        1.3  explorer  * promotion (i.e. u_char). This is asking for big trouble depending
   5000        1.3  explorer  * on the architecture you are on...
   5001        1.3  explorer  */
   5002        1.3  explorer 
   5003        1.3  explorer static void
   5004        1.3  explorer sppp_auth_send(const struct cp *cp, struct sppp *sp,
   5005        1.3  explorer                unsigned int type, unsigned int id,
   5006        1.3  explorer 	       ...)
   5007        1.3  explorer {
   5008        1.3  explorer 	STDDCL;
   5009        1.3  explorer 	struct lcp_header *lh;
   5010        1.3  explorer 	struct mbuf *m;
   5011        1.3  explorer 	u_char *p;
   5012        1.3  explorer 	int len;
   5013       1.22    martin 	size_t pkthdrlen;
   5014        1.3  explorer 	unsigned int mlen;
   5015        1.3  explorer 	const char *msg;
   5016        1.3  explorer 	va_list ap;
   5017        1.3  explorer 
   5018      1.163  knakahar 	KASSERT(sppp_locked(sp));
   5019      1.163  knakahar 
   5020       1.59    itojun 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   5021        1.3  explorer 	if (! m)
   5022        1.3  explorer 		return;
   5023      1.142     ozaki 	m_reset_rcvif(m);
   5024        1.3  explorer 
   5025       1.22    martin 	if (sp->pp_flags & PP_NOFRAMING) {
   5026      1.109      matt 		*mtod(m, uint16_t *) = htons(cp->proto);
   5027       1.22    martin 		pkthdrlen = 2;
   5028      1.109      matt 		lh = (struct lcp_header *)(mtod(m, uint8_t *)+2);
   5029       1.22    martin 	} else {
   5030       1.22    martin 		struct ppp_header *h;
   5031       1.59    itojun 		h = mtod(m, struct ppp_header *);
   5032       1.22    martin 		h->address = PPP_ALLSTATIONS;		/* broadcast address */
   5033       1.22    martin 		h->control = PPP_UI;			/* Unnumbered Info */
   5034       1.22    martin 		h->protocol = htons(cp->proto);
   5035       1.22    martin 		pkthdrlen = PPP_HEADER_LEN;
   5036       1.22    martin 
   5037       1.59    itojun 		lh = (struct lcp_header *)(h + 1);
   5038       1.22    martin 	}
   5039        1.3  explorer 
   5040        1.3  explorer 	lh->type = type;
   5041        1.3  explorer 	lh->ident = id;
   5042       1.59    itojun 	p = (u_char *)(lh + 1);
   5043        1.3  explorer 
   5044        1.3  explorer 	va_start(ap, id);
   5045        1.3  explorer 	len = 0;
   5046        1.3  explorer 
   5047        1.3  explorer 	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
   5048        1.3  explorer 		msg = va_arg(ap, const char *);
   5049        1.3  explorer 		len += mlen;
   5050       1.22    martin 		if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
   5051        1.3  explorer 			va_end(ap);
   5052        1.3  explorer 			m_freem(m);
   5053        1.3  explorer 			return;
   5054        1.3  explorer 		}
   5055        1.3  explorer 
   5056      1.118   tsutsui 		memcpy(p, msg, mlen);
   5057        1.3  explorer 		p += mlen;
   5058        1.3  explorer 	}
   5059        1.3  explorer 	va_end(ap);
   5060        1.3  explorer 
   5061       1.22    martin 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   5062       1.59    itojun 	lh->len = htons(LCP_HEADER_LEN + len);
   5063        1.3  explorer 
   5064        1.3  explorer 	if (debug) {
   5065       1.64    itojun 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
   5066       1.64    itojun 		    ifp->if_xname, cp->name,
   5067        1.3  explorer 		    sppp_auth_type_name(cp->proto, lh->type),
   5068        1.3  explorer 		    lh->ident, ntohs(lh->len));
   5069        1.3  explorer 		if (len)
   5070       1.59    itojun 			sppp_print_bytes((u_char *)(lh + 1), len);
   5071        1.3  explorer 		addlog(">\n");
   5072        1.3  explorer 	}
   5073       1.59    itojun 	if (IF_QFULL(&sp->pp_cpq)) {
   5074       1.59    itojun 		IF_DROP(&sp->pp_fastq);
   5075       1.59    itojun 		IF_DROP(&ifp->if_snd);
   5076       1.59    itojun 		m_freem(m);
   5077        1.3  explorer 		++ifp->if_oerrors;
   5078       1.50      yamt 		return;
   5079  1.165.2.1    bouyer 	}
   5080  1.165.2.1    bouyer 
   5081  1.165.2.1    bouyer 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   5082  1.165.2.1    bouyer 	IF_ENQUEUE(&sp->pp_cpq, m);
   5083  1.165.2.1    bouyer 
   5084      1.163  knakahar 	if (! (ifp->if_flags & IFF_OACTIVE)) {
   5085      1.163  knakahar 		sppp_lock_exit(sp);
   5086      1.143  knakahar 		if_start_lock(ifp);
   5087      1.163  knakahar 		sppp_lock_enter(sp);
   5088      1.163  knakahar 	}
   5089        1.3  explorer }
   5090        1.3  explorer 
   5091        1.3  explorer /*
   5092        1.3  explorer  * Send keepalive packets, every 10 seconds.
   5093        1.3  explorer  */
   5094        1.3  explorer static void
   5095      1.101  christos sppp_keepalive(void *dummy)
   5096        1.3  explorer {
   5097        1.3  explorer 	struct sppp *sp;
   5098        1.3  explorer 	int s;
   5099       1.38    martin 	time_t now;
   5100        1.3  explorer 
   5101      1.163  knakahar 	SPPPQ_LOCK();
   5102      1.163  knakahar 
   5103       1.23   thorpej 	s = splnet();
   5104       1.92    kardel 	now = time_uptime;
   5105        1.3  explorer 	for (sp=spppq; sp; sp=sp->pp_next) {
   5106      1.163  knakahar 		struct ifnet *ifp = NULL;
   5107      1.163  knakahar 
   5108      1.163  knakahar 		sppp_lock_enter(sp);
   5109      1.163  knakahar 		ifp = &sp->pp_if;
   5110        1.3  explorer 
   5111       1.38    martin 		/* check idle timeout */
   5112       1.40    martin 		if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING)
   5113       1.40    martin 		    && (sp->pp_phase == SPPP_PHASE_NETWORK)) {
   5114       1.38    martin 		    /* idle timeout is enabled for this interface */
   5115       1.38    martin 		    if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) {
   5116       1.38    martin 		    	if (ifp->if_flags & IFF_DEBUG)
   5117       1.84    martin 			    printf("%s: no activity for %lu seconds\n",
   5118       1.38    martin 				sp->pp_if.if_xname,
   5119       1.38    martin 				(unsigned long)(now-sp->pp_last_activity));
   5120       1.38    martin 			lcp.Close(sp);
   5121      1.163  knakahar 			sppp_lock_exit(sp);
   5122       1.38    martin 			continue;
   5123       1.38    martin 		    }
   5124       1.38    martin 		}
   5125       1.38    martin 
   5126        1.3  explorer 		/* Keepalive mode disabled or channel down? */
   5127        1.3  explorer 		if (! (sp->pp_flags & PP_KEEPALIVE) ||
   5128      1.163  knakahar 		    ! (ifp->if_flags & IFF_RUNNING)) {
   5129      1.163  knakahar 			sppp_lock_exit(sp);
   5130        1.3  explorer 			continue;
   5131      1.163  knakahar 		}
   5132      1.163  knakahar 
   5133        1.3  explorer 
   5134        1.3  explorer 		/* No keepalive in PPP mode if LCP not opened yet. */
   5135        1.3  explorer 		if (! (sp->pp_flags & PP_CISCO) &&
   5136      1.163  knakahar 		    sp->pp_phase < SPPP_PHASE_AUTHENTICATE) {
   5137      1.163  knakahar 			sppp_lock_exit(sp);
   5138        1.3  explorer 			continue;
   5139      1.163  knakahar 		}
   5140        1.3  explorer 
   5141       1.57    martin 		/* No echo reply, but maybe user data passed through? */
   5142       1.68    martin 		if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) {
   5143       1.57    martin 			sp->pp_alivecnt = 0;
   5144      1.163  knakahar 			sppp_lock_exit(sp);
   5145       1.57    martin 			continue;
   5146       1.57    martin 		}
   5147       1.57    martin 
   5148       1.68    martin 		if (sp->pp_alivecnt >= sp->pp_maxalive) {
   5149        1.3  explorer 			/* No keepalive packets got.  Stop the interface. */
   5150      1.163  knakahar 			sppp_lock_exit(sp);
   5151        1.3  explorer 			if_down (ifp);
   5152      1.163  knakahar 			sppp_lock_enter(sp);
   5153       1.59    itojun 			IF_PURGE(&sp->pp_cpq);
   5154        1.3  explorer 			if (! (sp->pp_flags & PP_CISCO)) {
   5155       1.33    martin 				printf("%s: LCP keepalive timed out, going to restart the connection\n",
   5156       1.33    martin 					ifp->if_xname);
   5157       1.33    martin 				sp->pp_alivecnt = 0;
   5158       1.33    martin 
   5159       1.33    martin 				/* we are down, close all open protocols */
   5160       1.33    martin 				lcp.Close(sp);
   5161       1.33    martin 
   5162       1.33    martin 				/* And now prepare LCP to reestablish the link, if configured to do so. */
   5163       1.33    martin 				sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
   5164       1.33    martin 
   5165      1.102       wiz 				/* Close connection immediately, completition of this
   5166       1.33    martin 				 * will summon the magic needed to reestablish it. */
   5167       1.91  christos 				if (sp->pp_tlf)
   5168       1.91  christos 					sp->pp_tlf(sp);
   5169      1.163  knakahar 
   5170      1.163  knakahar 				sppp_lock_exit(sp);
   5171       1.33    martin 				continue;
   5172        1.3  explorer 			}
   5173        1.3  explorer 		}
   5174       1.68    martin 		if (sp->pp_alivecnt < sp->pp_maxalive)
   5175        1.3  explorer 			++sp->pp_alivecnt;
   5176        1.3  explorer 		if (sp->pp_flags & PP_CISCO)
   5177       1.59    itojun 			sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ,
   5178        1.9    itojun 			    ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]);
   5179       1.36    martin 		else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
   5180       1.59    itojun 			int32_t nmagic = htonl(sp->lcp.magic);
   5181        1.9    itojun 			sp->lcp.echoid = ++sp->pp_seq[IDX_LCP];
   5182       1.59    itojun 			sppp_cp_send(sp, PPP_LCP, ECHO_REQ,
   5183        1.3  explorer 				sp->lcp.echoid, 4, &nmagic);
   5184        1.3  explorer 		}
   5185      1.163  knakahar 
   5186      1.163  knakahar 		sppp_lock_exit(sp);
   5187        1.3  explorer 	}
   5188        1.3  explorer 	splx(s);
   5189       1.57    martin 	callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
   5190      1.163  knakahar 
   5191      1.163  knakahar 	SPPPQ_UNLOCK();
   5192        1.3  explorer }
   5193        1.3  explorer 
   5194       1.79  christos #ifdef INET
   5195        1.3  explorer /*
   5196        1.3  explorer  * Get both IP addresses.
   5197        1.3  explorer  */
   5198        1.3  explorer static void
   5199      1.109      matt sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask)
   5200        1.3  explorer {
   5201        1.3  explorer 	struct ifnet *ifp = &sp->pp_if;
   5202        1.3  explorer 	struct ifaddr *ifa;
   5203        1.3  explorer 	struct sockaddr_in *si, *sm;
   5204      1.109      matt 	uint32_t ssrc, ddst;
   5205        1.3  explorer 
   5206        1.3  explorer 	sm = NULL;
   5207       1.30      ross 	ssrc = ddst = 0;
   5208        1.3  explorer 	/*
   5209        1.3  explorer 	 * Pick the first AF_INET address from the list,
   5210        1.3  explorer 	 * aliases don't make any sense on a p2p link anyway.
   5211        1.3  explorer 	 */
   5212       1.28      matt 	si = 0;
   5213      1.146     ozaki 	IFADDR_READER_FOREACH(ifa, ifp) {
   5214        1.3  explorer 		if (ifa->ifa_addr->sa_family == AF_INET) {
   5215        1.3  explorer 			si = (struct sockaddr_in *)ifa->ifa_addr;
   5216        1.3  explorer 			sm = (struct sockaddr_in *)ifa->ifa_netmask;
   5217        1.3  explorer 			if (si)
   5218        1.3  explorer 				break;
   5219        1.3  explorer 		}
   5220       1.28      matt 	}
   5221        1.3  explorer 	if (ifa) {
   5222        1.3  explorer 		if (si && si->sin_addr.s_addr) {
   5223        1.3  explorer 			ssrc = si->sin_addr.s_addr;
   5224        1.3  explorer 			if (srcmask)
   5225        1.3  explorer 				*srcmask = ntohl(sm->sin_addr.s_addr);
   5226        1.3  explorer 		}
   5227        1.3  explorer 
   5228        1.3  explorer 		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
   5229        1.3  explorer 		if (si && si->sin_addr.s_addr)
   5230        1.3  explorer 			ddst = si->sin_addr.s_addr;
   5231        1.3  explorer 	}
   5232        1.3  explorer 
   5233        1.3  explorer 	if (dst) *dst = ntohl(ddst);
   5234        1.3  explorer 	if (src) *src = ntohl(ssrc);
   5235        1.3  explorer }
   5236        1.3  explorer 
   5237        1.3  explorer /*
   5238       1.31    martin  * Set IP addresses.  Must be called at splnet.
   5239       1.31    martin  * If an address is 0, leave it the way it is.
   5240        1.3  explorer  */
   5241        1.3  explorer static void
   5242      1.161  knakahar sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp)
   5243        1.3  explorer {
   5244        1.3  explorer 	STDDCL;
   5245        1.3  explorer 	struct ifaddr *ifa;
   5246       1.73   mycroft 	struct sockaddr_in *si, *dest;
   5247      1.158  knakahar 	uint32_t myaddr = 0, hisaddr = 0;
   5248      1.159  knakahar 	int s;
   5249      1.159  knakahar 
   5250        1.3  explorer 	/*
   5251        1.3  explorer 	 * Pick the first AF_INET address from the list,
   5252        1.3  explorer 	 * aliases don't make any sense on a p2p link anyway.
   5253        1.3  explorer 	 */
   5254      1.158  knakahar 	si = dest = NULL;
   5255      1.159  knakahar 	s = pserialize_read_enter();
   5256      1.146     ozaki 	IFADDR_READER_FOREACH(ifa, ifp) {
   5257       1.73   mycroft 		if (ifa->ifa_addr->sa_family == AF_INET) {
   5258        1.3  explorer 			si = (struct sockaddr_in *)ifa->ifa_addr;
   5259       1.31    martin 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   5260      1.158  knakahar 			break;
   5261        1.3  explorer 		}
   5262        1.3  explorer 	}
   5263      1.159  knakahar 	pserialize_read_exit(s);
   5264        1.3  explorer 
   5265      1.158  knakahar 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN))
   5266      1.158  knakahar 		myaddr = sp->ipcp.req_myaddr;
   5267      1.158  knakahar 	else if (si != NULL)
   5268      1.158  knakahar 		myaddr = ntohl(si->sin_addr.s_addr);
   5269      1.158  knakahar 
   5270      1.158  knakahar 	if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN))
   5271      1.158  knakahar 		hisaddr = sp->ipcp.req_hisaddr;
   5272      1.158  knakahar 	else if (dest != NULL)
   5273      1.158  knakahar 		hisaddr = ntohl(dest->sin_addr.s_addr);
   5274      1.158  knakahar 
   5275      1.160  knakahar 	if (si != NULL && dest != NULL) {
   5276      1.152       roy 		int error;
   5277        1.3  explorer 		struct sockaddr_in new_sin = *si;
   5278       1.31    martin 		struct sockaddr_in new_dst = *dest;
   5279        1.3  explorer 
   5280      1.152       roy 		if (myaddr != 0)
   5281      1.152       roy 			new_sin.sin_addr.s_addr = htonl(myaddr);
   5282       1.31    martin 		if (hisaddr != 0) {
   5283       1.31    martin 			new_dst.sin_addr.s_addr = htonl(hisaddr);
   5284      1.154       roy 			if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr)
   5285       1.31    martin 				sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
   5286       1.31    martin 		}
   5287      1.145     ozaki 
   5288      1.162  knakahar 		in_addrhash_remove(ifatoia(ifa));
   5289      1.145     ozaki 
   5290      1.154       roy 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
   5291      1.145     ozaki 
   5292      1.162  knakahar 		in_addrhash_insert(ifatoia(ifa));
   5293      1.145     ozaki 
   5294       1.70    itojun 		if (debug && error)
   5295        1.3  explorer 		{
   5296      1.153       roy 			log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n",
   5297      1.153       roy 			    ifp->if_xname, __func__, error);
   5298        1.3  explorer 		}
   5299      1.127     rmind 		if (!error) {
   5300      1.164  christos 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
   5301      1.127     rmind 		}
   5302       1.31    martin 	}
   5303      1.159  knakahar 
   5304      1.159  knakahar 	if (ifp->if_mtu > sp->lcp.their_mru) {
   5305      1.159  knakahar 		sp->pp_saved_mtu = ifp->if_mtu;
   5306      1.159  knakahar 		ifp->if_mtu = sp->lcp.their_mru;
   5307      1.159  knakahar 		if (debug)
   5308      1.159  knakahar 			log(LOG_DEBUG,
   5309      1.159  knakahar 			    "%s: setting MTU to %" PRIu64 " bytes\n",
   5310      1.159  knakahar 			    ifp->if_xname, ifp->if_mtu);
   5311      1.159  knakahar 	}
   5312      1.159  knakahar 
   5313      1.159  knakahar 	if (sp->pp_con)
   5314      1.159  knakahar 		sp->pp_con(sp);
   5315      1.159  knakahar }
   5316      1.159  knakahar 
   5317      1.159  knakahar static void
   5318      1.159  knakahar sppp_set_ip_addrs(struct sppp *sp)
   5319      1.159  knakahar {
   5320      1.161  knakahar 	struct ifnet *ifp = &sp->pp_if;
   5321      1.159  knakahar 
   5322      1.161  knakahar 	if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_SET_ADDRS)) {
   5323      1.161  knakahar 		log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n",
   5324      1.161  knakahar 		    ifp->if_xname);
   5325      1.161  knakahar 		return;
   5326      1.161  knakahar 	}
   5327      1.161  knakahar 
   5328      1.161  knakahar 	if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1)
   5329      1.159  knakahar 		return;
   5330      1.159  knakahar 
   5331      1.161  knakahar 	workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL);
   5332       1.82     perry }
   5333       1.31    martin 
   5334       1.31    martin /*
   5335       1.31    martin  * Clear IP addresses.  Must be called at splnet.
   5336       1.31    martin  */
   5337       1.31    martin static void
   5338      1.161  knakahar sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp)
   5339       1.31    martin {
   5340      1.153       roy 	STDDCL;
   5341       1.31    martin 	struct ifaddr *ifa;
   5342       1.73   mycroft 	struct sockaddr_in *si, *dest;
   5343      1.159  knakahar 	int s;
   5344      1.159  knakahar 
   5345       1.31    martin 	/*
   5346       1.31    martin 	 * Pick the first AF_INET address from the list,
   5347       1.31    martin 	 * aliases don't make any sense on a p2p link anyway.
   5348       1.31    martin 	 */
   5349      1.158  knakahar 	si = dest = NULL;
   5350      1.159  knakahar 	s = pserialize_read_enter();
   5351      1.146     ozaki 	IFADDR_READER_FOREACH(ifa, ifp) {
   5352       1.73   mycroft 		if (ifa->ifa_addr->sa_family == AF_INET) {
   5353       1.31    martin 			si = (struct sockaddr_in *)ifa->ifa_addr;
   5354       1.31    martin 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   5355      1.158  knakahar 			break;
   5356       1.31    martin 		}
   5357       1.31    martin 	}
   5358      1.159  knakahar 	pserialize_read_exit(s);
   5359       1.31    martin 
   5360      1.158  knakahar 	if (si != NULL) {
   5361       1.31    martin 		struct sockaddr_in new_sin = *si;
   5362      1.154       roy 		struct sockaddr_in new_dst = *dest;
   5363      1.153       roy 		int error;
   5364       1.31    martin 
   5365       1.31    martin 		if (sp->ipcp.flags & IPCP_MYADDR_DYN)
   5366       1.31    martin 			new_sin.sin_addr.s_addr = 0;
   5367       1.31    martin 		if (sp->ipcp.flags & IPCP_HISADDR_DYN)
   5368      1.154       roy 			new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr;
   5369      1.145     ozaki 
   5370      1.162  knakahar 		in_addrhash_remove(ifatoia(ifa));
   5371      1.145     ozaki 
   5372      1.154       roy 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
   5373      1.145     ozaki 
   5374      1.162  knakahar 		in_addrhash_insert(ifatoia(ifa));
   5375      1.145     ozaki 
   5376      1.153       roy 		if (debug && error)
   5377      1.153       roy 		{
   5378      1.153       roy 			log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n",
   5379      1.153       roy 			    ifp->if_xname, __func__, error);
   5380      1.153       roy 		}
   5381      1.153       roy 		if (!error) {
   5382      1.165  christos 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
   5383      1.153       roy 		}
   5384        1.3  explorer 	}
   5385      1.159  knakahar 
   5386      1.159  knakahar 	if (sp->pp_saved_mtu > 0) {
   5387      1.159  knakahar 		ifp->if_mtu = sp->pp_saved_mtu;
   5388      1.159  knakahar 		sp->pp_saved_mtu = 0;
   5389      1.159  knakahar 		if (debug)
   5390      1.159  knakahar 			log(LOG_DEBUG,
   5391      1.159  knakahar 			    "%s: resetting MTU to %" PRIu64 " bytes\n",
   5392      1.159  knakahar 			    ifp->if_xname, ifp->if_mtu);
   5393      1.159  knakahar 	}
   5394      1.159  knakahar }
   5395      1.159  knakahar 
   5396      1.159  knakahar static void
   5397      1.159  knakahar sppp_clear_ip_addrs(struct sppp *sp)
   5398      1.159  knakahar {
   5399      1.161  knakahar 	struct ifnet *ifp = &sp->pp_if;
   5400      1.159  knakahar 
   5401      1.161  knakahar 	if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_CLEAR_ADDRS)) {
   5402      1.161  knakahar 		log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n",
   5403      1.161  knakahar 		    ifp->if_xname);
   5404      1.161  knakahar 		return;
   5405      1.161  knakahar 	}
   5406      1.161  knakahar 
   5407      1.161  knakahar 	if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1)
   5408      1.159  knakahar 		return;
   5409      1.159  knakahar 
   5410      1.161  knakahar 	workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL);
   5411      1.161  knakahar }
   5412      1.161  knakahar 
   5413      1.161  knakahar static void
   5414      1.161  knakahar sppp_update_ip_addrs_work(struct work *wk, void *arg)
   5415      1.161  knakahar {
   5416      1.161  knakahar 	struct sppp *sp = arg;
   5417      1.161  knakahar 	void *work;
   5418      1.161  knakahar 
   5419      1.161  knakahar 	atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 0);
   5420      1.161  knakahar 
   5421      1.161  knakahar 	while ((work = pcq_get(sp->ipcp.update_addrs_q)) != NULL) {
   5422      1.161  knakahar 		int update = (intptr_t)work;
   5423      1.161  knakahar 
   5424      1.161  knakahar 		if (update == IPCP_SET_ADDRS)
   5425      1.161  knakahar 			sppp_set_ip_addrs_work(wk, sp);
   5426      1.161  knakahar 		else if (update == IPCP_CLEAR_ADDRS)
   5427      1.161  knakahar 			sppp_clear_ip_addrs_work(wk, sp);
   5428      1.161  knakahar 	}
   5429       1.82     perry }
   5430       1.79  christos #endif
   5431        1.3  explorer 
   5432        1.9    itojun #ifdef INET6
   5433        1.9    itojun /*
   5434        1.9    itojun  * Get both IPv6 addresses.
   5435        1.9    itojun  */
   5436        1.9    itojun static void
   5437        1.9    itojun sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
   5438        1.9    itojun 		   struct in6_addr *srcmask)
   5439        1.9    itojun {
   5440        1.9    itojun 	struct ifnet *ifp = &sp->pp_if;
   5441        1.9    itojun 	struct ifaddr *ifa;
   5442        1.9    itojun 	struct sockaddr_in6 *si, *sm;
   5443        1.9    itojun 	struct in6_addr ssrc, ddst;
   5444        1.9    itojun 
   5445        1.9    itojun 	sm = NULL;
   5446       1.25   thorpej 	memset(&ssrc, 0, sizeof(ssrc));
   5447       1.25   thorpej 	memset(&ddst, 0, sizeof(ddst));
   5448        1.9    itojun 	/*
   5449        1.9    itojun 	 * Pick the first link-local AF_INET6 address from the list,
   5450        1.9    itojun 	 * aliases don't make any sense on a p2p link anyway.
   5451        1.9    itojun 	 */
   5452       1.28      matt 	si = 0;
   5453      1.146     ozaki 	IFADDR_READER_FOREACH(ifa, ifp)
   5454        1.9    itojun 		if (ifa->ifa_addr->sa_family == AF_INET6) {
   5455        1.9    itojun 			si = (struct sockaddr_in6 *)ifa->ifa_addr;
   5456        1.9    itojun 			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
   5457        1.9    itojun 			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
   5458        1.9    itojun 				break;
   5459        1.9    itojun 		}
   5460        1.9    itojun 	if (ifa) {
   5461        1.9    itojun 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
   5462      1.118   tsutsui 			memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc));
   5463        1.9    itojun 			if (srcmask) {
   5464      1.118   tsutsui 				memcpy(srcmask, &sm->sin6_addr,
   5465        1.9    itojun 				    sizeof(*srcmask));
   5466        1.9    itojun 			}
   5467        1.9    itojun 		}
   5468        1.9    itojun 
   5469        1.9    itojun 		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
   5470        1.9    itojun 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
   5471      1.118   tsutsui 			memcpy(&ddst, &si->sin6_addr, sizeof(ddst));
   5472        1.9    itojun 	}
   5473        1.9    itojun 
   5474        1.9    itojun 	if (dst)
   5475      1.118   tsutsui 		memcpy(dst, &ddst, sizeof(*dst));
   5476        1.9    itojun 	if (src)
   5477      1.118   tsutsui 		memcpy(src, &ssrc, sizeof(*src));
   5478        1.9    itojun }
   5479        1.9    itojun 
   5480        1.9    itojun #ifdef IPV6CP_MYIFID_DYN
   5481        1.9    itojun /*
   5482        1.9    itojun  * Generate random ifid.
   5483        1.9    itojun  */
   5484        1.9    itojun static void
   5485        1.9    itojun sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
   5486        1.9    itojun {
   5487        1.9    itojun 	/* TBD */
   5488        1.9    itojun }
   5489        1.9    itojun 
   5490        1.9    itojun /*
   5491       1.23   thorpej  * Set my IPv6 address.  Must be called at splnet.
   5492        1.9    itojun  */
   5493        1.9    itojun static void
   5494        1.9    itojun sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
   5495        1.9    itojun {
   5496        1.9    itojun 	STDDCL;
   5497        1.9    itojun 	struct ifaddr *ifa;
   5498        1.9    itojun 	struct sockaddr_in6 *sin6;
   5499        1.9    itojun 
   5500        1.9    itojun 	/*
   5501        1.9    itojun 	 * Pick the first link-local AF_INET6 address from the list,
   5502        1.9    itojun 	 * aliases don't make any sense on a p2p link anyway.
   5503        1.9    itojun 	 */
   5504        1.9    itojun 
   5505        1.9    itojun 	sin6 = NULL;
   5506      1.146     ozaki 	IFADDR_READER_FOREACH(ifa, ifp)
   5507        1.9    itojun 	{
   5508        1.9    itojun 		if (ifa->ifa_addr->sa_family == AF_INET6)
   5509        1.9    itojun 		{
   5510        1.9    itojun 			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
   5511        1.9    itojun 			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
   5512        1.9    itojun 				break;
   5513        1.9    itojun 		}
   5514        1.9    itojun 	}
   5515        1.9    itojun 
   5516        1.9    itojun 	if (ifa && sin6)
   5517        1.9    itojun 	{
   5518        1.9    itojun 		int error;
   5519        1.9    itojun 		struct sockaddr_in6 new_sin6 = *sin6;
   5520        1.9    itojun 
   5521      1.118   tsutsui 		memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr));
   5522        1.9    itojun 		error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
   5523        1.9    itojun 		if (debug && error)
   5524        1.9    itojun 		{
   5525      1.153       roy 			log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n",
   5526      1.153       roy 			    ifp->if_xname, __func__, error);
   5527        1.9    itojun 		}
   5528      1.127     rmind 		if (!error) {
   5529      1.164  christos 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa);
   5530      1.127     rmind 		}
   5531        1.9    itojun 	}
   5532        1.9    itojun }
   5533        1.9    itojun #endif
   5534        1.9    itojun 
   5535        1.9    itojun /*
   5536        1.9    itojun  * Suggest a candidate address to be used by peer.
   5537        1.9    itojun  */
   5538        1.9    itojun static void
   5539        1.9    itojun sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
   5540        1.9    itojun {
   5541        1.9    itojun 	struct in6_addr myaddr;
   5542       1.10    itojun 	struct timeval tv;
   5543        1.9    itojun 
   5544        1.9    itojun 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   5545        1.9    itojun 
   5546        1.9    itojun 	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
   5547       1.10    itojun 	microtime(&tv);
   5548       1.10    itojun 	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
   5549       1.10    itojun 		myaddr.s6_addr[14] ^= 0xff;
   5550       1.10    itojun 		myaddr.s6_addr[15] ^= 0xff;
   5551       1.10    itojun 	} else {
   5552       1.10    itojun 		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
   5553       1.10    itojun 		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
   5554       1.10    itojun 	}
   5555        1.9    itojun 	if (suggest)
   5556      1.118   tsutsui 		memcpy(suggest, &myaddr, sizeof(myaddr));
   5557        1.9    itojun }
   5558        1.9    itojun #endif /*INET6*/
   5559        1.9    itojun 
   5560       1.36    martin /*
   5561       1.36    martin  * Process ioctl requests specific to the PPP interface.
   5562       1.36    martin  * Permissions have already been checked.
   5563       1.36    martin  */
   5564        1.3  explorer static int
   5565      1.110  gmcgarry sppp_params(struct sppp *sp, u_long cmd, void *data)
   5566        1.3  explorer {
   5567       1.36    martin 	switch (cmd) {
   5568       1.36    martin 	case SPPPGETAUTHCFG:
   5569       1.36    martin 	    {
   5570       1.42  jdolecek 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
   5571       1.42  jdolecek 		int error;
   5572       1.42  jdolecek 		size_t len;
   5573       1.42  jdolecek 
   5574      1.163  knakahar 		sppp_lock_enter(sp);
   5575      1.163  knakahar 
   5576       1.36    martin 		cfg->myauthflags = sp->myauth.flags;
   5577       1.36    martin 		cfg->hisauthflags = sp->hisauth.flags;
   5578      1.138  christos 		strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname));
   5579       1.36    martin 		cfg->hisauth = 0;
   5580       1.36    martin 		if (sp->hisauth.proto)
   5581       1.42  jdolecek 		    cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   5582       1.36    martin 		cfg->myauth = 0;
   5583       1.36    martin 		if (sp->myauth.proto)
   5584       1.42  jdolecek 		    cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   5585       1.36    martin 		if (cfg->myname_length == 0) {
   5586       1.36    martin 		    if (sp->myauth.name != NULL)
   5587       1.54  christos 			cfg->myname_length = sp->myauth.name_len + 1;
   5588       1.36    martin 		} else {
   5589       1.41    martin 		    if (sp->myauth.name == NULL) {
   5590       1.41    martin 			cfg->myname_length = 0;
   5591       1.41    martin 		    } else {
   5592       1.54  christos 			len = sp->myauth.name_len + 1;
   5593      1.163  knakahar 
   5594      1.163  knakahar 			sppp_lock_exit(sp);
   5595      1.163  knakahar 
   5596       1.41    martin 			if (cfg->myname_length < len)
   5597       1.42  jdolecek 			    return (ENAMETOOLONG);
   5598       1.42  jdolecek 			error = copyout(sp->myauth.name, cfg->myname, len);
   5599       1.42  jdolecek 			if (error) return error;
   5600      1.163  knakahar 
   5601      1.163  knakahar 			sppp_lock_enter(sp);
   5602       1.41    martin 		    }
   5603       1.36    martin 		}
   5604       1.36    martin 		if (cfg->hisname_length == 0) {
   5605       1.70    itojun 		    if (sp->hisauth.name != NULL)
   5606       1.54  christos 			cfg->hisname_length = sp->hisauth.name_len + 1;
   5607       1.36    martin 		} else {
   5608       1.41    martin 		    if (sp->hisauth.name == NULL) {
   5609       1.41    martin 		    	cfg->hisname_length = 0;
   5610       1.41    martin 		    } else {
   5611       1.54  christos 			len = sp->hisauth.name_len + 1;
   5612      1.163  knakahar 
   5613      1.163  knakahar 			sppp_lock_exit(sp);
   5614       1.41    martin 			if (cfg->hisname_length < len)
   5615       1.42  jdolecek 			    return (ENAMETOOLONG);
   5616       1.42  jdolecek 			error = copyout(sp->hisauth.name, cfg->hisname, len);
   5617       1.42  jdolecek 			if (error) return error;
   5618      1.163  knakahar 			sppp_lock_enter(sp);
   5619       1.41    martin 		    }
   5620        1.3  explorer 		}
   5621      1.163  knakahar 		sppp_lock_exit(sp);
   5622       1.36    martin 	    }
   5623       1.36    martin 	    break;
   5624       1.36    martin 	case SPPPSETAUTHCFG:
   5625       1.36    martin 	    {
   5626       1.59    itojun 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
   5627       1.42  jdolecek 		int error;
   5628        1.3  explorer 
   5629      1.163  knakahar 		sppp_lock_enter(sp);
   5630      1.163  knakahar 
   5631       1.42  jdolecek 		if (sp->myauth.name) {
   5632       1.42  jdolecek 			free(sp->myauth.name, M_DEVBUF);
   5633       1.42  jdolecek 			sp->myauth.name = NULL;
   5634       1.42  jdolecek 		}
   5635       1.42  jdolecek 		if (sp->myauth.secret) {
   5636       1.42  jdolecek 			free(sp->myauth.secret, M_DEVBUF);
   5637       1.42  jdolecek 			sp->myauth.secret = NULL;
   5638       1.42  jdolecek 		}
   5639       1.42  jdolecek 		if (sp->hisauth.name) {
   5640       1.42  jdolecek 			free(sp->hisauth.name, M_DEVBUF);
   5641       1.42  jdolecek 			sp->hisauth.name = NULL;
   5642       1.42  jdolecek 		}
   5643       1.42  jdolecek 		if (sp->hisauth.secret) {
   5644       1.42  jdolecek 			free(sp->hisauth.secret, M_DEVBUF);
   5645       1.42  jdolecek 			sp->hisauth.secret = NULL;
   5646       1.42  jdolecek 		}
   5647       1.36    martin 
   5648       1.41    martin 		if (cfg->hisname != NULL && cfg->hisname_length > 0) {
   5649      1.163  knakahar 			if (cfg->hisname_length >= MCLBYTES) {
   5650      1.163  knakahar 				sppp_lock_exit(sp);
   5651      1.163  knakahar 				return (ENAMETOOLONG);
   5652      1.163  knakahar 			}
   5653      1.163  knakahar 			sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK);
   5654      1.163  knakahar 			error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length);
   5655      1.163  knakahar 			if (error) {
   5656      1.163  knakahar 				free(sp->hisauth.name, M_DEVBUF);
   5657      1.163  knakahar 				sp->hisauth.name = NULL;
   5658      1.163  knakahar 				sppp_lock_exit(sp);
   5659      1.163  knakahar 				return error;
   5660      1.163  knakahar 			}
   5661      1.163  knakahar 			sp->hisauth.name_len = cfg->hisname_length - 1;
   5662      1.163  knakahar 			sp->hisauth.name[sp->hisauth.name_len] = 0;
   5663       1.36    martin 		}
   5664       1.41    martin 		if (cfg->hissecret != NULL && cfg->hissecret_length > 0) {
   5665      1.163  knakahar 			if (cfg->hissecret_length >= MCLBYTES) {
   5666      1.163  knakahar 				sppp_lock_exit(sp);
   5667      1.163  knakahar 				return (ENAMETOOLONG);
   5668      1.163  knakahar 			}
   5669      1.163  knakahar 			sp->hisauth.secret = malloc(cfg->hissecret_length,
   5670      1.163  knakahar 			    M_DEVBUF, M_WAITOK);
   5671      1.163  knakahar 			error = copyin(cfg->hissecret, sp->hisauth.secret,
   5672      1.163  knakahar 			    cfg->hissecret_length);
   5673      1.163  knakahar 			if (error) {
   5674      1.163  knakahar 				free(sp->hisauth.secret, M_DEVBUF);
   5675      1.163  knakahar 				sp->hisauth.secret = NULL;
   5676      1.163  knakahar 				sppp_lock_exit(sp);
   5677      1.163  knakahar 				return error;
   5678      1.163  knakahar 			}
   5679      1.163  knakahar 			sp->hisauth.secret_len = cfg->hissecret_length - 1;
   5680      1.163  knakahar 			sp->hisauth.secret[sp->hisauth.secret_len] = 0;
   5681       1.36    martin 		}
   5682       1.41    martin 		if (cfg->myname != NULL && cfg->myname_length > 0) {
   5683      1.163  knakahar 			if (cfg->myname_length >= MCLBYTES) {
   5684      1.163  knakahar 				sppp_lock_exit(sp);
   5685      1.163  knakahar 				return (ENAMETOOLONG);
   5686      1.163  knakahar 			}
   5687      1.163  knakahar 			sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK);
   5688      1.163  knakahar 			error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length);
   5689      1.163  knakahar 			if (error) {
   5690      1.163  knakahar 				free(sp->myauth.name, M_DEVBUF);
   5691      1.163  knakahar 				sp->myauth.name = NULL;
   5692      1.163  knakahar 				sppp_lock_exit(sp);
   5693      1.163  knakahar 				return error;
   5694      1.163  knakahar 			}
   5695      1.163  knakahar 			sp->myauth.name_len = cfg->myname_length - 1;
   5696      1.163  knakahar 			sp->myauth.name[sp->myauth.name_len] = 0;
   5697       1.36    martin 		}
   5698       1.41    martin 		if (cfg->mysecret != NULL && cfg->mysecret_length > 0) {
   5699      1.163  knakahar 			if (cfg->mysecret_length >= MCLBYTES) {
   5700      1.163  knakahar 				sppp_lock_exit(sp);
   5701      1.163  knakahar 				return (ENAMETOOLONG);
   5702      1.163  knakahar 			}
   5703      1.163  knakahar 			sp->myauth.secret = malloc(cfg->mysecret_length,
   5704      1.163  knakahar 			    M_DEVBUF, M_WAITOK);
   5705      1.163  knakahar 			error = copyin(cfg->mysecret, sp->myauth.secret,
   5706      1.163  knakahar 			    cfg->mysecret_length);
   5707      1.163  knakahar 			if (error) {
   5708      1.163  knakahar 				free(sp->myauth.secret, M_DEVBUF);
   5709      1.163  knakahar 				sp->myauth.secret = NULL;
   5710      1.163  knakahar 				sppp_lock_exit(sp);
   5711      1.163  knakahar 				return error;
   5712      1.163  knakahar 			}
   5713      1.163  knakahar 			sp->myauth.secret_len = cfg->mysecret_length - 1;
   5714      1.163  knakahar 			sp->myauth.secret[sp->myauth.secret_len] = 0;
   5715       1.36    martin 		}
   5716       1.36    martin 		sp->myauth.flags = cfg->myauthflags;
   5717       1.36    martin 		if (cfg->myauth)
   5718       1.42  jdolecek 		    sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5719       1.36    martin 		sp->hisauth.flags = cfg->hisauthflags;
   5720       1.36    martin 		if (cfg->hisauth)
   5721       1.42  jdolecek 		    sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5722       1.39    martin 		sp->pp_auth_failures = 0;
   5723       1.82     perry 		if (sp->hisauth.proto != 0)
   5724       1.55  christos 		    sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
   5725       1.55  christos 		else
   5726       1.55  christos 		    sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   5727      1.163  knakahar 
   5728      1.163  knakahar 		sppp_lock_exit(sp);
   5729       1.36    martin 	    }
   5730       1.36    martin 	    break;
   5731       1.36    martin 	case SPPPGETLCPCFG:
   5732       1.36    martin 	    {
   5733      1.163  knakahar 		struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
   5734      1.163  knakahar 		sppp_lock_enter(sp);
   5735      1.163  knakahar 		lcpp->lcp_timeout = sp->lcp.timeout;
   5736      1.163  knakahar 		sppp_lock_exit(sp);
   5737       1.36    martin 	    }
   5738       1.36    martin 	    break;
   5739       1.36    martin 	case SPPPSETLCPCFG:
   5740       1.36    martin 	    {
   5741      1.163  knakahar 		struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
   5742      1.163  knakahar 		sppp_lock_enter(sp);
   5743      1.163  knakahar 		sp->lcp.timeout = lcpp->lcp_timeout;
   5744      1.163  knakahar 		sppp_lock_exit(sp);
   5745       1.36    martin 	    }
   5746       1.36    martin 	    break;
   5747       1.36    martin 	case SPPPGETSTATUS:
   5748       1.36    martin 	    {
   5749       1.42  jdolecek 		struct spppstatus *status = (struct spppstatus *)data;
   5750      1.163  knakahar 		sppp_lock_enter(sp);
   5751       1.36    martin 		status->phase = sp->pp_phase;
   5752      1.163  knakahar 		sppp_lock_exit(sp);
   5753       1.38    martin 	    }
   5754       1.38    martin 	    break;
   5755       1.75    martin 	case SPPPGETSTATUSNCP:
   5756       1.75    martin 	    {
   5757       1.75    martin 		struct spppstatusncp *status = (struct spppstatusncp *)data;
   5758      1.163  knakahar 		sppp_lock_enter(sp);
   5759       1.75    martin 		status->phase = sp->pp_phase;
   5760      1.163  knakahar 		sppp_lock_exit(sp);
   5761       1.75    martin 		status->ncpup = sppp_ncp_check(sp);
   5762       1.75    martin 	    }
   5763       1.75    martin 	    break;
   5764       1.38    martin 	case SPPPGETIDLETO:
   5765       1.38    martin 	    {
   5766       1.42  jdolecek 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5767      1.163  knakahar 		sppp_lock_enter(sp);
   5768       1.38    martin 		to->idle_seconds = sp->pp_idle_timeout;
   5769      1.163  knakahar 		sppp_lock_exit(sp);
   5770       1.38    martin 	    }
   5771       1.38    martin 	    break;
   5772       1.38    martin 	case SPPPSETIDLETO:
   5773       1.38    martin 	    {
   5774       1.42  jdolecek 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5775      1.163  knakahar 		sppp_lock_enter(sp);
   5776      1.163  knakahar 		sp->pp_idle_timeout = to->idle_seconds;
   5777      1.163  knakahar 		sppp_lock_exit(sp);
   5778       1.39    martin 	    }
   5779       1.39    martin 	    break;
   5780       1.39    martin 	case SPPPSETAUTHFAILURE:
   5781       1.39    martin 	    {
   5782       1.42  jdolecek 	    	struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data;
   5783      1.163  knakahar 		sppp_lock_enter(sp);
   5784      1.163  knakahar 		sp->pp_max_auth_fail = afsettings->max_failures;
   5785      1.163  knakahar 		sp->pp_auth_failures = 0;
   5786      1.163  knakahar 		sppp_lock_exit(sp);
   5787       1.39    martin 	    }
   5788       1.39    martin 	    break;
   5789       1.39    martin 	case SPPPGETAUTHFAILURES:
   5790       1.39    martin 	    {
   5791       1.42  jdolecek 	    	struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data;
   5792      1.163  knakahar 		sppp_lock_enter(sp);
   5793      1.163  knakahar 		stats->auth_failures = sp->pp_auth_failures;
   5794      1.163  knakahar 		stats->max_failures = sp->pp_max_auth_fail;
   5795      1.163  knakahar 		sppp_lock_exit(sp);
   5796       1.45    martin 	    }
   5797       1.45    martin 	    break;
   5798       1.45    martin 	case SPPPSETDNSOPTS:
   5799       1.45    martin 	    {
   5800       1.59    itojun 		struct spppdnssettings *req = (struct spppdnssettings *)data;
   5801      1.163  knakahar 		sppp_lock_enter(sp);
   5802       1.45    martin 		sp->query_dns = req->query_dns & 3;
   5803      1.163  knakahar 		sppp_lock_exit(sp);
   5804       1.45    martin 	    }
   5805       1.45    martin 	    break;
   5806       1.45    martin 	case SPPPGETDNSOPTS:
   5807       1.45    martin 	    {
   5808       1.59    itojun 		struct spppdnssettings *req = (struct spppdnssettings *)data;
   5809      1.163  knakahar 		sppp_lock_enter(sp);
   5810       1.45    martin 		req->query_dns = sp->query_dns;
   5811      1.163  knakahar 		sppp_lock_exit(sp);
   5812       1.45    martin 	    }
   5813       1.45    martin 	    break;
   5814       1.45    martin 	case SPPPGETDNSADDRS:
   5815       1.45    martin 	    {
   5816      1.163  knakahar 		struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data;
   5817      1.163  knakahar 		sppp_lock_enter(sp);
   5818      1.163  knakahar 		memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns);
   5819      1.163  knakahar 		sppp_lock_exit(sp);
   5820       1.68    martin 	    }
   5821       1.68    martin 	    break;
   5822       1.68    martin 	case SPPPGETKEEPALIVE:
   5823       1.68    martin 	    {
   5824       1.68    martin 	    	struct spppkeepalivesettings *settings =
   5825       1.68    martin 		     (struct spppkeepalivesettings*)data;
   5826      1.163  knakahar 		sppp_lock_enter(sp);
   5827       1.68    martin 		settings->maxalive = sp->pp_maxalive;
   5828       1.68    martin 		settings->max_noreceive = sp->pp_max_noreceive;
   5829      1.163  knakahar 		sppp_lock_exit(sp);
   5830       1.68    martin 	    }
   5831       1.68    martin 	    break;
   5832       1.68    martin 	case SPPPSETKEEPALIVE:
   5833       1.68    martin 	    {
   5834       1.68    martin 	    	struct spppkeepalivesettings *settings =
   5835       1.68    martin 		     (struct spppkeepalivesettings*)data;
   5836      1.163  knakahar 		sppp_lock_enter(sp);
   5837       1.68    martin 		sp->pp_maxalive = settings->maxalive;
   5838       1.68    martin 		sp->pp_max_noreceive = settings->max_noreceive;
   5839      1.163  knakahar 		sppp_lock_exit(sp);
   5840       1.36    martin 	    }
   5841       1.36    martin 	    break;
   5842      1.120  jmcneill #if defined(COMPAT_50) || defined(MODULAR)
   5843      1.120  jmcneill 	case __SPPPGETIDLETO50:
   5844      1.120  jmcneill 	    {
   5845      1.120  jmcneill 	    	struct spppidletimeout50 *to = (struct spppidletimeout50 *)data;
   5846      1.163  knakahar 		sppp_lock_enter(sp);
   5847      1.120  jmcneill 		to->idle_seconds = (uint32_t)sp->pp_idle_timeout;
   5848      1.163  knakahar 		sppp_lock_exit(sp);
   5849      1.120  jmcneill 	    }
   5850      1.120  jmcneill 	    break;
   5851      1.120  jmcneill 	case __SPPPSETIDLETO50:
   5852      1.120  jmcneill 	    {
   5853      1.163  knakahar 		struct spppidletimeout50 *to = (struct spppidletimeout50 *)data;
   5854      1.163  knakahar 		sppp_lock_enter(sp);
   5855      1.163  knakahar 		sp->pp_idle_timeout = (time_t)to->idle_seconds;
   5856      1.163  knakahar 		sppp_lock_exit(sp);
   5857      1.120  jmcneill 	    }
   5858      1.120  jmcneill 	    break;
   5859      1.120  jmcneill 	case __SPPPGETKEEPALIVE50:
   5860      1.120  jmcneill 	    {
   5861      1.120  jmcneill 	    	struct spppkeepalivesettings50 *settings =
   5862      1.120  jmcneill 		     (struct spppkeepalivesettings50*)data;
   5863      1.163  knakahar 		sppp_lock_enter(sp);
   5864      1.120  jmcneill 		settings->maxalive = sp->pp_maxalive;
   5865      1.120  jmcneill 		settings->max_noreceive = (uint32_t)sp->pp_max_noreceive;
   5866      1.163  knakahar 		sppp_lock_exit(sp);
   5867      1.120  jmcneill 	    }
   5868      1.120  jmcneill 	    break;
   5869      1.120  jmcneill 	case __SPPPSETKEEPALIVE50:
   5870      1.120  jmcneill 	    {
   5871      1.120  jmcneill 	    	struct spppkeepalivesettings50 *settings =
   5872      1.120  jmcneill 		     (struct spppkeepalivesettings50*)data;
   5873      1.163  knakahar 		sppp_lock_enter(sp);
   5874      1.120  jmcneill 		sp->pp_maxalive = settings->maxalive;
   5875      1.120  jmcneill 		sp->pp_max_noreceive = (time_t)settings->max_noreceive;
   5876      1.163  knakahar 		sppp_lock_exit(sp);
   5877      1.120  jmcneill 	    }
   5878      1.120  jmcneill 	    break;
   5879      1.120  jmcneill #endif /* COMPAT_50 || MODULAR */
   5880        1.3  explorer 	default:
   5881       1.42  jdolecek 		return (EINVAL);
   5882        1.3  explorer 	}
   5883        1.3  explorer 
   5884       1.42  jdolecek 	return (0);
   5885        1.3  explorer }
   5886        1.3  explorer 
   5887        1.3  explorer static void
   5888        1.3  explorer sppp_phase_network(struct sppp *sp)
   5889        1.3  explorer {
   5890        1.3  explorer 	int i;
   5891      1.109      matt 	uint32_t mask;
   5892        1.3  explorer 
   5893      1.163  knakahar 	KASSERT(sppp_locked(sp));
   5894      1.163  knakahar 
   5895      1.149     joerg 	sppp_change_phase(sp, SPPP_PHASE_NETWORK);
   5896        1.3  explorer 
   5897        1.3  explorer 	/* Notify NCPs now. */
   5898        1.3  explorer 	for (i = 0; i < IDX_COUNT; i++)
   5899        1.3  explorer 		if ((cps[i])->flags & CP_NCP)
   5900        1.3  explorer 			(cps[i])->Open(sp);
   5901        1.3  explorer 
   5902        1.3  explorer 	/* Send Up events to all NCPs. */
   5903        1.3  explorer 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   5904      1.163  knakahar 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) {
   5905        1.3  explorer 			(cps[i])->Up(sp);
   5906      1.163  knakahar 		}
   5907        1.3  explorer 
   5908        1.3  explorer 	/* if no NCP is starting, all this was in vain, close down */
   5909        1.3  explorer 	sppp_lcp_check_and_close(sp);
   5910        1.3  explorer }
   5911       1.82     perry 
   5912        1.3  explorer 
   5913        1.3  explorer static const char *
   5914        1.3  explorer sppp_cp_type_name(u_char type)
   5915        1.1  explorer {
   5916        1.3  explorer 	static char buf[12];
   5917        1.1  explorer 	switch (type) {
   5918        1.3  explorer 	case CONF_REQ:   return "conf-req";
   5919        1.3  explorer 	case CONF_ACK:   return "conf-ack";
   5920        1.3  explorer 	case CONF_NAK:   return "conf-nak";
   5921        1.3  explorer 	case CONF_REJ:   return "conf-rej";
   5922        1.3  explorer 	case TERM_REQ:   return "term-req";
   5923        1.3  explorer 	case TERM_ACK:   return "term-ack";
   5924        1.3  explorer 	case CODE_REJ:   return "code-rej";
   5925        1.3  explorer 	case PROTO_REJ:  return "proto-rej";
   5926        1.3  explorer 	case ECHO_REQ:   return "echo-req";
   5927        1.3  explorer 	case ECHO_REPLY: return "echo-reply";
   5928        1.3  explorer 	case DISC_REQ:   return "discard-req";
   5929        1.3  explorer 	}
   5930       1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", type);
   5931        1.3  explorer 	return buf;
   5932        1.3  explorer }
   5933        1.3  explorer 
   5934        1.3  explorer static const char *
   5935        1.3  explorer sppp_auth_type_name(u_short proto, u_char type)
   5936        1.3  explorer {
   5937      1.139  christos 	static char buf[32];
   5938      1.139  christos 	const char *name;
   5939      1.139  christos 
   5940        1.3  explorer 	switch (proto) {
   5941        1.3  explorer 	case PPP_CHAP:
   5942        1.3  explorer 		switch (type) {
   5943        1.3  explorer 		case CHAP_CHALLENGE:	return "challenge";
   5944        1.3  explorer 		case CHAP_RESPONSE:	return "response";
   5945        1.3  explorer 		case CHAP_SUCCESS:	return "success";
   5946        1.3  explorer 		case CHAP_FAILURE:	return "failure";
   5947      1.139  christos 		default:		name = "chap"; break;
   5948        1.3  explorer 		}
   5949      1.137    martin 		break;
   5950      1.139  christos 
   5951        1.3  explorer 	case PPP_PAP:
   5952        1.3  explorer 		switch (type) {
   5953        1.3  explorer 		case PAP_REQ:		return "req";
   5954        1.3  explorer 		case PAP_ACK:		return "ack";
   5955        1.3  explorer 		case PAP_NAK:		return "nak";
   5956      1.139  christos 		default:		name = "pap";	break;
   5957        1.3  explorer 		}
   5958      1.137    martin 		break;
   5959      1.139  christos 
   5960      1.139  christos 	default:
   5961      1.139  christos 		name = "bad";
   5962      1.139  christos 		break;
   5963        1.3  explorer 	}
   5964      1.139  christos 
   5965      1.139  christos 	snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type);
   5966        1.3  explorer 	return buf;
   5967        1.3  explorer }
   5968        1.3  explorer 
   5969        1.3  explorer static const char *
   5970        1.3  explorer sppp_lcp_opt_name(u_char opt)
   5971        1.3  explorer {
   5972        1.3  explorer 	static char buf[12];
   5973        1.3  explorer 	switch (opt) {
   5974        1.3  explorer 	case LCP_OPT_MRU:		return "mru";
   5975        1.3  explorer 	case LCP_OPT_ASYNC_MAP:		return "async-map";
   5976        1.3  explorer 	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
   5977        1.3  explorer 	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
   5978        1.3  explorer 	case LCP_OPT_MAGIC:		return "magic";
   5979        1.3  explorer 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
   5980        1.3  explorer 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
   5981        1.3  explorer 	}
   5982       1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   5983        1.3  explorer 	return buf;
   5984        1.3  explorer }
   5985        1.3  explorer 
   5986        1.3  explorer static const char *
   5987        1.3  explorer sppp_ipcp_opt_name(u_char opt)
   5988        1.3  explorer {
   5989        1.3  explorer 	static char buf[12];
   5990        1.3  explorer 	switch (opt) {
   5991        1.3  explorer 	case IPCP_OPT_ADDRESSES:	return "addresses";
   5992        1.3  explorer 	case IPCP_OPT_COMPRESSION:	return "compression";
   5993        1.3  explorer 	case IPCP_OPT_ADDRESS:		return "address";
   5994        1.3  explorer 	}
   5995       1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   5996        1.3  explorer 	return buf;
   5997        1.3  explorer }
   5998        1.3  explorer 
   5999        1.9    itojun #ifdef INET6
   6000        1.9    itojun static const char *
   6001        1.9    itojun sppp_ipv6cp_opt_name(u_char opt)
   6002        1.9    itojun {
   6003        1.9    itojun 	static char buf[12];
   6004        1.9    itojun 	switch (opt) {
   6005        1.9    itojun 	case IPV6CP_OPT_IFID:		return "ifid";
   6006        1.9    itojun 	case IPV6CP_OPT_COMPRESSION:	return "compression";
   6007        1.9    itojun 	}
   6008       1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", opt);
   6009        1.9    itojun 	return buf;
   6010        1.9    itojun }
   6011        1.9    itojun #endif
   6012        1.9    itojun 
   6013        1.3  explorer static const char *
   6014        1.3  explorer sppp_state_name(int state)
   6015        1.3  explorer {
   6016        1.3  explorer 	switch (state) {
   6017        1.3  explorer 	case STATE_INITIAL:	return "initial";
   6018        1.3  explorer 	case STATE_STARTING:	return "starting";
   6019        1.3  explorer 	case STATE_CLOSED:	return "closed";
   6020        1.3  explorer 	case STATE_STOPPED:	return "stopped";
   6021        1.3  explorer 	case STATE_CLOSING:	return "closing";
   6022        1.3  explorer 	case STATE_STOPPING:	return "stopping";
   6023        1.3  explorer 	case STATE_REQ_SENT:	return "req-sent";
   6024        1.3  explorer 	case STATE_ACK_RCVD:	return "ack-rcvd";
   6025        1.3  explorer 	case STATE_ACK_SENT:	return "ack-sent";
   6026        1.3  explorer 	case STATE_OPENED:	return "opened";
   6027        1.3  explorer 	}
   6028        1.3  explorer 	return "illegal";
   6029        1.3  explorer }
   6030        1.3  explorer 
   6031        1.3  explorer static const char *
   6032       1.36    martin sppp_phase_name(int phase)
   6033        1.3  explorer {
   6034        1.3  explorer 	switch (phase) {
   6035       1.36    martin 	case SPPP_PHASE_DEAD:		return "dead";
   6036       1.36    martin 	case SPPP_PHASE_ESTABLISH:	return "establish";
   6037       1.36    martin 	case SPPP_PHASE_TERMINATE:	return "terminate";
   6038       1.36    martin 	case SPPP_PHASE_AUTHENTICATE: 	return "authenticate";
   6039       1.36    martin 	case SPPP_PHASE_NETWORK:	return "network";
   6040        1.3  explorer 	}
   6041        1.3  explorer 	return "illegal";
   6042        1.3  explorer }
   6043        1.3  explorer 
   6044        1.3  explorer static const char *
   6045        1.3  explorer sppp_proto_name(u_short proto)
   6046        1.3  explorer {
   6047        1.3  explorer 	static char buf[12];
   6048        1.3  explorer 	switch (proto) {
   6049        1.3  explorer 	case PPP_LCP:	return "lcp";
   6050        1.3  explorer 	case PPP_IPCP:	return "ipcp";
   6051        1.3  explorer 	case PPP_PAP:	return "pap";
   6052        1.3  explorer 	case PPP_CHAP:	return "chap";
   6053        1.9    itojun 	case PPP_IPV6CP: return "ipv6cp";
   6054        1.1  explorer 	}
   6055       1.77    itojun 	snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto);
   6056        1.3  explorer 	return buf;
   6057        1.1  explorer }
   6058        1.1  explorer 
   6059        1.1  explorer static void
   6060        1.3  explorer sppp_print_bytes(const u_char *p, u_short len)
   6061        1.1  explorer {
   6062        1.3  explorer 	addlog(" %02x", *p++);
   6063        1.1  explorer 	while (--len > 0)
   6064        1.3  explorer 		addlog("-%02x", *p++);
   6065        1.3  explorer }
   6066        1.3  explorer 
   6067        1.3  explorer static void
   6068        1.3  explorer sppp_print_string(const char *p, u_short len)
   6069        1.3  explorer {
   6070        1.3  explorer 	u_char c;
   6071        1.3  explorer 
   6072        1.3  explorer 	while (len-- > 0) {
   6073        1.3  explorer 		c = *p++;
   6074        1.3  explorer 		/*
   6075        1.3  explorer 		 * Print only ASCII chars directly.  RFC 1994 recommends
   6076        1.3  explorer 		 * using only them, but we don't rely on it.  */
   6077        1.3  explorer 		if (c < ' ' || c > '~')
   6078        1.3  explorer 			addlog("\\x%x", c);
   6079        1.3  explorer 		else
   6080        1.3  explorer 			addlog("%c", c);
   6081        1.3  explorer 	}
   6082        1.3  explorer }
   6083        1.3  explorer 
   6084        1.3  explorer static const char *
   6085      1.109      matt sppp_dotted_quad(uint32_t addr)
   6086        1.3  explorer {
   6087        1.3  explorer 	static char s[16];
   6088       1.77    itojun 	snprintf(s, sizeof(s), "%d.%d.%d.%d",
   6089        1.3  explorer 		(int)((addr >> 24) & 0xff),
   6090        1.3  explorer 		(int)((addr >> 16) & 0xff),
   6091        1.3  explorer 		(int)((addr >> 8) & 0xff),
   6092        1.3  explorer 		(int)(addr & 0xff));
   6093        1.3  explorer 	return s;
   6094        1.3  explorer }
   6095        1.3  explorer 
   6096        1.3  explorer /* a dummy, used to drop uninteresting events */
   6097        1.3  explorer static void
   6098      1.101  christos sppp_null(struct sppp *unused)
   6099        1.3  explorer {
   6100        1.3  explorer 	/* do just nothing */
   6101        1.1  explorer }
   6102        1.3  explorer /*
   6103        1.3  explorer  * This file is large.  Tell emacs to highlight it nevertheless.
   6104        1.3  explorer  *
   6105        1.3  explorer  * Local Variables:
   6106        1.3  explorer  * hilit-auto-highlight-maxout: 120000
   6107        1.3  explorer  * End:
   6108        1.3  explorer  */
   6109      1.147  pgoyette 
   6110      1.147  pgoyette /*
   6111      1.147  pgoyette  * Module glue
   6112      1.147  pgoyette  */
   6113      1.147  pgoyette MODULE(MODULE_CLASS_MISC, sppp_subr, NULL);
   6114      1.147  pgoyette 
   6115      1.147  pgoyette static int
   6116      1.147  pgoyette sppp_subr_modcmd(modcmd_t cmd, void *arg)
   6117      1.147  pgoyette {
   6118      1.147  pgoyette         switch (cmd) {
   6119      1.147  pgoyette         case MODULE_CMD_INIT:
   6120      1.147  pgoyette         case MODULE_CMD_FINI:
   6121      1.147  pgoyette                 return 0;
   6122      1.147  pgoyette         case MODULE_CMD_STAT:
   6123      1.147  pgoyette         case MODULE_CMD_AUTOUNLOAD:
   6124      1.147  pgoyette         default:
   6125      1.147  pgoyette                 return ENOTTY;
   6126      1.147  pgoyette         }
   6127      1.147  pgoyette }
   6128      1.147  pgoyette 
   6129