if_spppsubr.c revision 1.102.6.1
1 /* $NetBSD: if_spppsubr.c,v 1.102.6.1 2008/09/04 08:46:45 skrll Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.102.6.1 2008/09/04 08:46:45 skrll Exp $"); 45 46 #include "opt_inet.h" 47 #include "opt_ipx.h" 48 #include "opt_iso.h" 49 #include "opt_pfil_hooks.h" 50 51 #include <sys/param.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/kernel.h> 55 #include <sys/sockio.h> 56 #include <sys/socket.h> 57 #include <sys/syslog.h> 58 #include <sys/malloc.h> 59 #include <sys/mbuf.h> 60 #include <sys/callout.h> 61 #include <sys/md5.h> 62 #include <sys/inttypes.h> 63 #include <sys/kauth.h> 64 65 #include <net/if.h> 66 #include <net/netisr.h> 67 #include <net/if_types.h> 68 #include <net/route.h> 69 #include <net/ppp_defs.h> 70 71 #include <machine/stdarg.h> 72 73 #include <netinet/in.h> 74 #include <netinet/in_systm.h> 75 #include <netinet/in_var.h> 76 #ifdef INET 77 #include <netinet/ip.h> 78 #include <netinet/tcp.h> 79 #endif 80 #include <net/ethertypes.h> 81 82 #ifdef INET6 83 #include <netinet6/scope6_var.h> 84 #endif 85 86 #ifdef IPX 87 #include <netipx/ipx.h> 88 #include <netipx/ipx_if.h> 89 #endif 90 91 92 #ifdef ISO 93 #include <netiso/argo_debug.h> 94 #include <netiso/iso.h> 95 #include <netiso/iso_var.h> 96 #include <netiso/iso_snpac.h> 97 #endif 98 99 #include <net/if_sppp.h> 100 #include <net/if_spppvar.h> 101 102 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 103 #define LOOPALIVECNT 3 /* loopback detection tries */ 104 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 105 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 106 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 107 108 /* 109 * Interface flags that can be set in an ifconfig command. 110 * 111 * Setting link0 will make the link passive, i.e. it will be marked 112 * as being administrative openable, but won't be opened to begin 113 * with. Incoming calls will be answered, or subsequent calls with 114 * -link1 will cause the administrative open of the LCP layer. 115 * 116 * Setting link1 will cause the link to auto-dial only as packets 117 * arrive to be sent. 118 * 119 * Setting IFF_DEBUG will syslog the option negotiation and state 120 * transitions at level kern.debug. Note: all logs consistently look 121 * like 122 * 123 * <if-name><unit>: <proto-name> <additional info...> 124 * 125 * with <if-name><unit> being something like "bppp0", and <proto-name> 126 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 127 */ 128 129 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 130 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 131 132 #define CONF_REQ 1 /* PPP configure request */ 133 #define CONF_ACK 2 /* PPP configure acknowledge */ 134 #define CONF_NAK 3 /* PPP configure negative ack */ 135 #define CONF_REJ 4 /* PPP configure reject */ 136 #define TERM_REQ 5 /* PPP terminate request */ 137 #define TERM_ACK 6 /* PPP terminate acknowledge */ 138 #define CODE_REJ 7 /* PPP code reject */ 139 #define PROTO_REJ 8 /* PPP protocol reject */ 140 #define ECHO_REQ 9 /* PPP echo request */ 141 #define ECHO_REPLY 10 /* PPP echo reply */ 142 #define DISC_REQ 11 /* PPP discard request */ 143 144 #define LCP_OPT_MRU 1 /* maximum receive unit */ 145 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 146 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 147 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 148 #define LCP_OPT_MAGIC 5 /* magic number */ 149 #define LCP_OPT_RESERVED 6 /* reserved */ 150 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 151 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 152 153 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 154 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 155 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 156 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 157 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 158 159 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 160 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 161 162 #define PAP_REQ 1 /* PAP name/password request */ 163 #define PAP_ACK 2 /* PAP acknowledge */ 164 #define PAP_NAK 3 /* PAP fail */ 165 166 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 167 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 168 #define CHAP_SUCCESS 3 /* CHAP response ok */ 169 #define CHAP_FAILURE 4 /* CHAP response failed */ 170 171 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 172 173 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 174 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 175 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 176 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 177 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 178 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 179 180 /* states are named and numbered according to RFC 1661 */ 181 #define STATE_INITIAL 0 182 #define STATE_STARTING 1 183 #define STATE_CLOSED 2 184 #define STATE_STOPPED 3 185 #define STATE_CLOSING 4 186 #define STATE_STOPPING 5 187 #define STATE_REQ_SENT 6 188 #define STATE_ACK_RCVD 7 189 #define STATE_ACK_SENT 8 190 #define STATE_OPENED 9 191 192 struct ppp_header { 193 u_int8_t address; 194 u_int8_t control; 195 u_int16_t protocol; 196 } __attribute__((__packed__)); 197 #define PPP_HEADER_LEN sizeof (struct ppp_header) 198 199 struct lcp_header { 200 u_int8_t type; 201 u_int8_t ident; 202 u_int16_t len; 203 } __attribute__((__packed__)); 204 #define LCP_HEADER_LEN sizeof (struct lcp_header) 205 206 struct cisco_packet { 207 u_int32_t type; 208 u_int32_t par1; 209 u_int32_t par2; 210 u_int16_t rel; 211 u_int16_t time0; 212 u_int16_t time1; 213 } __attribute__((__packed__)); 214 #define CISCO_PACKET_LEN 18 215 216 /* 217 * We follow the spelling and capitalization of RFC 1661 here, to make 218 * it easier comparing with the standard. Please refer to this RFC in 219 * case you can't make sense out of these abbreviation; it will also 220 * explain the semantics related to the various events and actions. 221 */ 222 struct cp { 223 u_short proto; /* PPP control protocol number */ 224 u_char protoidx; /* index into state table in struct sppp */ 225 u_char flags; 226 #define CP_LCP 0x01 /* this is the LCP */ 227 #define CP_AUTH 0x02 /* this is an authentication protocol */ 228 #define CP_NCP 0x04 /* this is a NCP */ 229 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 230 const char *name; /* name of this control protocol */ 231 /* event handlers */ 232 void (*Up)(struct sppp *sp); 233 void (*Down)(struct sppp *sp); 234 void (*Open)(struct sppp *sp); 235 void (*Close)(struct sppp *sp); 236 void (*TO)(void *sp); 237 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 238 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 239 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 240 /* actions */ 241 void (*tlu)(struct sppp *sp); 242 void (*tld)(struct sppp *sp); 243 void (*tls)(struct sppp *sp); 244 void (*tlf)(struct sppp *sp); 245 void (*scr)(struct sppp *sp); 246 }; 247 248 static struct sppp *spppq; 249 static struct callout keepalive_ch; 250 251 #ifdef INET 252 /* 253 * The following disgusting hack gets around the problem that IP TOS 254 * can't be set yet. We want to put "interactive" traffic on a high 255 * priority queue. To decide if traffic is interactive, we check that 256 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 257 * 258 * XXX is this really still necessary? - joerg - 259 */ 260 static u_short interactive_ports[8] = { 261 0, 513, 0, 0, 262 0, 21, 0, 23, 263 }; 264 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 265 #endif 266 267 /* almost every function needs these */ 268 #define STDDCL \ 269 struct ifnet *ifp = &sp->pp_if; \ 270 int debug = ifp->if_flags & IFF_DEBUG 271 272 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 273 struct sockaddr *dst, struct rtentry *rt); 274 275 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 276 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 277 278 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 279 struct mbuf *m); 280 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 281 u_char ident, u_short len, void *data); 282 /* static void sppp_cp_timeout(void *arg); */ 283 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 284 int newstate); 285 static void sppp_auth_send(const struct cp *cp, 286 struct sppp *sp, unsigned int type, unsigned int id, 287 ...); 288 289 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 290 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 291 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 292 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 293 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 294 295 static void sppp_null(struct sppp *sp); 296 297 static void sppp_lcp_init(struct sppp *sp); 298 static void sppp_lcp_up(struct sppp *sp); 299 static void sppp_lcp_down(struct sppp *sp); 300 static void sppp_lcp_open(struct sppp *sp); 301 static void sppp_lcp_close(struct sppp *sp); 302 static void sppp_lcp_TO(void *sp); 303 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 304 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 305 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 306 static void sppp_lcp_tlu(struct sppp *sp); 307 static void sppp_lcp_tld(struct sppp *sp); 308 static void sppp_lcp_tls(struct sppp *sp); 309 static void sppp_lcp_tlf(struct sppp *sp); 310 static void sppp_lcp_scr(struct sppp *sp); 311 static void sppp_lcp_check_and_close(struct sppp *sp); 312 static int sppp_ncp_check(struct sppp *sp); 313 314 static void sppp_ipcp_init(struct sppp *sp); 315 static void sppp_ipcp_up(struct sppp *sp); 316 static void sppp_ipcp_down(struct sppp *sp); 317 static void sppp_ipcp_open(struct sppp *sp); 318 static void sppp_ipcp_close(struct sppp *sp); 319 static void sppp_ipcp_TO(void *sp); 320 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 321 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 322 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 323 static void sppp_ipcp_tlu(struct sppp *sp); 324 static void sppp_ipcp_tld(struct sppp *sp); 325 static void sppp_ipcp_tls(struct sppp *sp); 326 static void sppp_ipcp_tlf(struct sppp *sp); 327 static void sppp_ipcp_scr(struct sppp *sp); 328 329 static void sppp_ipv6cp_init(struct sppp *sp); 330 static void sppp_ipv6cp_up(struct sppp *sp); 331 static void sppp_ipv6cp_down(struct sppp *sp); 332 static void sppp_ipv6cp_open(struct sppp *sp); 333 static void sppp_ipv6cp_close(struct sppp *sp); 334 static void sppp_ipv6cp_TO(void *sp); 335 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 336 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 337 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 338 static void sppp_ipv6cp_tlu(struct sppp *sp); 339 static void sppp_ipv6cp_tld(struct sppp *sp); 340 static void sppp_ipv6cp_tls(struct sppp *sp); 341 static void sppp_ipv6cp_tlf(struct sppp *sp); 342 static void sppp_ipv6cp_scr(struct sppp *sp); 343 344 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 345 static void sppp_pap_init(struct sppp *sp); 346 static void sppp_pap_open(struct sppp *sp); 347 static void sppp_pap_close(struct sppp *sp); 348 static void sppp_pap_TO(void *sp); 349 static void sppp_pap_my_TO(void *sp); 350 static void sppp_pap_tlu(struct sppp *sp); 351 static void sppp_pap_tld(struct sppp *sp); 352 static void sppp_pap_scr(struct sppp *sp); 353 354 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 355 static void sppp_chap_init(struct sppp *sp); 356 static void sppp_chap_open(struct sppp *sp); 357 static void sppp_chap_close(struct sppp *sp); 358 static void sppp_chap_TO(void *sp); 359 static void sppp_chap_tlu(struct sppp *sp); 360 static void sppp_chap_tld(struct sppp *sp); 361 static void sppp_chap_scr(struct sppp *sp); 362 363 static const char *sppp_auth_type_name(u_short proto, u_char type); 364 static const char *sppp_cp_type_name(u_char type); 365 static const char *sppp_dotted_quad(u_int32_t addr); 366 static const char *sppp_ipcp_opt_name(u_char opt); 367 #ifdef INET6 368 static const char *sppp_ipv6cp_opt_name(u_char opt); 369 #endif 370 static const char *sppp_lcp_opt_name(u_char opt); 371 static const char *sppp_phase_name(int phase); 372 static const char *sppp_proto_name(u_short proto); 373 static const char *sppp_state_name(int state); 374 static int sppp_params(struct sppp *sp, int cmd, void *data); 375 #ifdef INET 376 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 377 u_int32_t *srcmask); 378 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr); 379 static void sppp_clear_ip_addrs(struct sppp *sp); 380 #endif 381 static void sppp_keepalive(void *dummy); 382 static void sppp_phase_network(struct sppp *sp); 383 static void sppp_print_bytes(const u_char *p, u_short len); 384 static void sppp_print_string(const char *p, u_short len); 385 #ifdef INET6 386 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 387 struct in6_addr *dst, struct in6_addr *srcmask); 388 #ifdef IPV6CP_MYIFID_DYN 389 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 390 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 391 #endif 392 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 393 #endif 394 395 /* our control protocol descriptors */ 396 static const struct cp lcp = { 397 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 398 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 399 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 400 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 401 sppp_lcp_scr 402 }; 403 404 static const struct cp ipcp = { 405 PPP_IPCP, IDX_IPCP, 406 #ifdef INET 407 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 408 #else 409 0, 410 #endif 411 "ipcp", 412 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 413 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 414 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 415 sppp_ipcp_scr 416 }; 417 418 static const struct cp ipv6cp = { 419 PPP_IPV6CP, IDX_IPV6CP, 420 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 421 CP_NCP, 422 #else 423 0, 424 #endif 425 "ipv6cp", 426 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 427 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 428 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 429 sppp_ipv6cp_scr 430 }; 431 432 static const struct cp pap = { 433 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 434 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 435 sppp_pap_TO, 0, 0, 0, 436 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 437 sppp_pap_scr 438 }; 439 440 static const struct cp chap = { 441 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 442 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 443 sppp_chap_TO, 0, 0, 0, 444 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 445 sppp_chap_scr 446 }; 447 448 static const struct cp *cps[IDX_COUNT] = { 449 &lcp, /* IDX_LCP */ 450 &ipcp, /* IDX_IPCP */ 451 &ipv6cp, /* IDX_IPV6CP */ 452 &pap, /* IDX_PAP */ 453 &chap, /* IDX_CHAP */ 454 }; 455 456 457 void spppattach(int); 458 void 459 /*ARGSUSED*/ 460 spppattach(int count) 461 { 462 } 463 464 /* 465 * Exported functions, comprising our interface to the lower layer. 466 */ 467 468 /* 469 * Process the received packet. 470 */ 471 void 472 sppp_input(struct ifnet *ifp, struct mbuf *m) 473 { 474 struct ppp_header *h = NULL; 475 struct ifqueue *inq = 0; 476 u_int16_t protocol; 477 int s; 478 struct sppp *sp = (struct sppp *)ifp; 479 int debug = ifp->if_flags & IFF_DEBUG; 480 481 if (ifp->if_flags & IFF_UP) { 482 /* Count received bytes, add hardware framing */ 483 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 484 /* Note time of last receive */ 485 sp->pp_last_receive = time_uptime; 486 } 487 488 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 489 /* Too small packet, drop it. */ 490 if (debug) 491 log(LOG_DEBUG, 492 "%s: input packet is too small, %d bytes\n", 493 ifp->if_xname, m->m_pkthdr.len); 494 drop: 495 ++ifp->if_ierrors; 496 ++ifp->if_iqdrops; 497 m_freem(m); 498 return; 499 } 500 501 if (sp->pp_flags & PP_NOFRAMING) { 502 memcpy(&protocol, mtod(m, void *), 2); 503 protocol = ntohs(protocol); 504 m_adj(m, 2); 505 } else { 506 507 /* Get PPP header. */ 508 h = mtod(m, struct ppp_header *); 509 m_adj(m, PPP_HEADER_LEN); 510 511 switch (h->address) { 512 case PPP_ALLSTATIONS: 513 if (h->control != PPP_UI) 514 goto invalid; 515 if (sp->pp_flags & PP_CISCO) { 516 if (debug) 517 log(LOG_DEBUG, 518 "%s: PPP packet in Cisco mode " 519 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 520 ifp->if_xname, 521 h->address, h->control, ntohs(h->protocol)); 522 goto drop; 523 } 524 break; 525 case CISCO_MULTICAST: 526 case CISCO_UNICAST: 527 /* Don't check the control field here (RFC 1547). */ 528 if (! (sp->pp_flags & PP_CISCO)) { 529 if (debug) 530 log(LOG_DEBUG, 531 "%s: Cisco packet in PPP mode " 532 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 533 ifp->if_xname, 534 h->address, h->control, ntohs(h->protocol)); 535 goto drop; 536 } 537 switch (ntohs(h->protocol)) { 538 default: 539 ++ifp->if_noproto; 540 goto invalid; 541 case CISCO_KEEPALIVE: 542 sppp_cisco_input((struct sppp *) ifp, m); 543 m_freem(m); 544 return; 545 #ifdef INET 546 case ETHERTYPE_IP: 547 schednetisr(NETISR_IP); 548 inq = &ipintrq; 549 break; 550 #endif 551 #ifdef INET6 552 case ETHERTYPE_IPV6: 553 schednetisr(NETISR_IPV6); 554 inq = &ip6intrq; 555 break; 556 #endif 557 #ifdef IPX 558 case ETHERTYPE_IPX: 559 schednetisr(NETISR_IPX); 560 inq = &ipxintrq; 561 break; 562 #endif 563 } 564 goto queue_pkt; 565 default: /* Invalid PPP packet. */ 566 invalid: 567 if (debug) 568 log(LOG_DEBUG, 569 "%s: invalid input packet " 570 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 571 ifp->if_xname, 572 h->address, h->control, ntohs(h->protocol)); 573 goto drop; 574 } 575 protocol = ntohs(h->protocol); 576 } 577 578 switch (protocol) { 579 default: 580 if (sp->state[IDX_LCP] == STATE_OPENED) { 581 u_int16_t prot = htons(protocol); 582 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 583 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 584 &prot); 585 } 586 if (debug) 587 log(LOG_DEBUG, 588 "%s: invalid input protocol " 589 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 590 ++ifp->if_noproto; 591 goto drop; 592 case PPP_LCP: 593 sppp_cp_input(&lcp, sp, m); 594 m_freem(m); 595 return; 596 case PPP_PAP: 597 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 598 sppp_pap_input(sp, m); 599 m_freem(m); 600 return; 601 case PPP_CHAP: 602 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 603 sppp_chap_input(sp, m); 604 m_freem(m); 605 return; 606 #ifdef INET 607 case PPP_IPCP: 608 if (sp->pp_phase == SPPP_PHASE_NETWORK) 609 sppp_cp_input(&ipcp, sp, m); 610 m_freem(m); 611 return; 612 case PPP_IP: 613 if (sp->state[IDX_IPCP] == STATE_OPENED) { 614 schednetisr(NETISR_IP); 615 inq = &ipintrq; 616 sp->pp_last_activity = time_uptime; 617 } 618 break; 619 #endif 620 #ifdef INET6 621 case PPP_IPV6CP: 622 if (sp->pp_phase == SPPP_PHASE_NETWORK) 623 sppp_cp_input(&ipv6cp, sp, m); 624 m_freem(m); 625 return; 626 627 case PPP_IPV6: 628 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 629 schednetisr(NETISR_IPV6); 630 inq = &ip6intrq; 631 sp->pp_last_activity = time_uptime; 632 } 633 break; 634 #endif 635 #ifdef IPX 636 case PPP_IPX: 637 /* IPX IPXCP not implemented yet */ 638 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 639 schednetisr(NETISR_IPX); 640 inq = &ipxintrq; 641 } 642 break; 643 #endif 644 #ifdef ISO 645 case PPP_ISO: 646 /* OSI NLCP not implemented yet */ 647 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 648 schednetisr(NETISR_ISO); 649 inq = &clnlintrq; 650 } 651 break; 652 #endif 653 } 654 655 queue_pkt: 656 if (! (ifp->if_flags & IFF_UP) || ! inq) 657 goto drop; 658 659 /* Check queue. */ 660 s = splnet(); 661 if (IF_QFULL(inq)) { 662 /* Queue overflow. */ 663 IF_DROP(inq); 664 splx(s); 665 if (debug) 666 log(LOG_DEBUG, "%s: protocol queue overflow\n", 667 ifp->if_xname); 668 goto drop; 669 } 670 IF_ENQUEUE(inq, m); 671 splx(s); 672 } 673 674 /* 675 * Enqueue transmit packet. 676 */ 677 static int 678 sppp_output(struct ifnet *ifp, struct mbuf *m, 679 struct sockaddr *dst, struct rtentry *rt) 680 { 681 struct sppp *sp = (struct sppp *) ifp; 682 struct ppp_header *h = NULL; 683 struct ifqueue *ifq = NULL; /* XXX */ 684 int s, error = 0; 685 u_int16_t protocol; 686 ALTQ_DECL(struct altq_pktattr pktattr;) 687 688 s = splnet(); 689 690 sp->pp_last_activity = time_uptime; 691 692 if ((ifp->if_flags & IFF_UP) == 0 || 693 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 694 m_freem(m); 695 splx(s); 696 return (ENETDOWN); 697 } 698 699 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 700 /* 701 * Interface is not yet running, but auto-dial. Need 702 * to start LCP for it. 703 */ 704 ifp->if_flags |= IFF_RUNNING; 705 splx(s); 706 lcp.Open(sp); 707 s = splnet(); 708 } 709 710 /* 711 * If the queueing discipline needs packet classification, 712 * do it before prepending link headers. 713 */ 714 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 715 716 #ifdef INET 717 if (dst->sa_family == AF_INET) { 718 struct ip *ip = NULL; 719 struct tcphdr *th = NULL; 720 721 if (m->m_len >= sizeof(struct ip)) { 722 ip = mtod(m, struct ip *); 723 if (ip->ip_p == IPPROTO_TCP && 724 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 725 sizeof(struct tcphdr)) { 726 th = (struct tcphdr *) 727 ((caddr_t)ip + (ip->ip_hl << 2)); 728 } 729 } else 730 ip = NULL; 731 732 /* 733 * When using dynamic local IP address assignment by using 734 * 0.0.0.0 as a local address, the first TCP session will 735 * not connect because the local TCP checksum is computed 736 * using 0.0.0.0 which will later become our real IP address 737 * so the TCP checksum computed at the remote end will 738 * become invalid. So we 739 * - don't let packets with src ip addr 0 thru 740 * - we flag TCP packets with src ip 0 as an error 741 */ 742 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 743 u_int8_t proto = ip->ip_p; 744 745 m_freem(m); 746 splx(s); 747 if (proto == IPPROTO_TCP) 748 return (EADDRNOTAVAIL); 749 else 750 return (0); 751 } 752 753 /* 754 * Put low delay, telnet, rlogin and ftp control packets 755 * in front of the queue. 756 */ 757 758 if (!IF_QFULL(&sp->pp_fastq) && 759 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 760 (th && (INTERACTIVE(ntohs(th->th_sport)) || 761 INTERACTIVE(ntohs(th->th_dport)))))) 762 ifq = &sp->pp_fastq; 763 } 764 #endif 765 766 #ifdef INET6 767 if (dst->sa_family == AF_INET6) { 768 /* XXX do something tricky here? */ 769 } 770 #endif 771 772 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 773 /* 774 * Prepend general data packet PPP header. For now, IP only. 775 */ 776 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 777 if (! m) { 778 if (ifp->if_flags & IFF_DEBUG) 779 log(LOG_DEBUG, "%s: no memory for transmit header\n", 780 ifp->if_xname); 781 ++ifp->if_oerrors; 782 splx(s); 783 return (ENOBUFS); 784 } 785 /* 786 * May want to check size of packet 787 * (albeit due to the implementation it's always enough) 788 */ 789 h = mtod(m, struct ppp_header *); 790 if (sp->pp_flags & PP_CISCO) { 791 h->address = CISCO_UNICAST; /* unicast address */ 792 h->control = 0; 793 } else { 794 h->address = PPP_ALLSTATIONS; /* broadcast address */ 795 h->control = PPP_UI; /* Unnumbered Info */ 796 } 797 } 798 799 switch (dst->sa_family) { 800 #ifdef INET 801 case AF_INET: /* Internet Protocol */ 802 if (sp->pp_flags & PP_CISCO) 803 protocol = htons(ETHERTYPE_IP); 804 else { 805 /* 806 * Don't choke with an ENETDOWN early. It's 807 * possible that we just started dialing out, 808 * so don't drop the packet immediately. If 809 * we notice that we run out of buffer space 810 * below, we will however remember that we are 811 * not ready to carry IP packets, and return 812 * ENETDOWN, as opposed to ENOBUFS. 813 */ 814 protocol = htons(PPP_IP); 815 if (sp->state[IDX_IPCP] != STATE_OPENED) 816 error = ENETDOWN; 817 } 818 break; 819 #endif 820 #ifdef INET6 821 case AF_INET6: /* Internet Protocol version 6 */ 822 if (sp->pp_flags & PP_CISCO) 823 protocol = htons(ETHERTYPE_IPV6); 824 else { 825 /* 826 * Don't choke with an ENETDOWN early. It's 827 * possible that we just started dialing out, 828 * so don't drop the packet immediately. If 829 * we notice that we run out of buffer space 830 * below, we will however remember that we are 831 * not ready to carry IP packets, and return 832 * ENETDOWN, as opposed to ENOBUFS. 833 */ 834 protocol = htons(PPP_IPV6); 835 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 836 error = ENETDOWN; 837 } 838 break; 839 #endif 840 #ifdef IPX 841 case AF_IPX: /* Novell IPX Protocol */ 842 protocol = htons((sp->pp_flags & PP_CISCO) ? 843 ETHERTYPE_IPX : PPP_IPX); 844 break; 845 #endif 846 #ifdef ISO 847 case AF_ISO: /* ISO OSI Protocol */ 848 if (sp->pp_flags & PP_CISCO) 849 goto nosupport; 850 protocol = htons(PPP_ISO); 851 break; 852 nosupport: 853 #endif 854 default: 855 m_freem(m); 856 ++ifp->if_oerrors; 857 splx(s); 858 return (EAFNOSUPPORT); 859 } 860 861 if (sp->pp_flags & PP_NOFRAMING) { 862 M_PREPEND(m, 2, M_DONTWAIT); 863 if (m == NULL) { 864 if (ifp->if_flags & IFF_DEBUG) 865 log(LOG_DEBUG, "%s: no memory for transmit header\n", 866 ifp->if_xname); 867 ++ifp->if_oerrors; 868 splx(s); 869 return (ENOBUFS); 870 } 871 *mtod(m, u_int16_t *) = protocol; 872 } else { 873 h->protocol = protocol; 874 } 875 876 877 error = ifq_enqueue2(ifp, ifq, m ALTQ_COMMA ALTQ_DECL(&pktattr)); 878 879 if (error == 0) { 880 /* 881 * Count output packets and bytes. 882 * The packet length includes header + additional hardware 883 * framing according to RFC 1333. 884 */ 885 if (!(ifp->if_flags & IFF_OACTIVE)) 886 (*ifp->if_start)(ifp); 887 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 888 } 889 splx(s); 890 return error; 891 } 892 893 void 894 sppp_attach(struct ifnet *ifp) 895 { 896 struct sppp *sp = (struct sppp *) ifp; 897 898 /* Initialize keepalive handler. */ 899 if (! spppq) { 900 callout_init(&keepalive_ch); 901 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 902 } 903 904 /* Insert new entry into the keepalive list. */ 905 sp->pp_next = spppq; 906 spppq = sp; 907 908 sp->pp_if.if_type = IFT_PPP; 909 sp->pp_if.if_output = sppp_output; 910 sp->pp_fastq.ifq_maxlen = 32; 911 sp->pp_cpq.ifq_maxlen = 20; 912 sp->pp_loopcnt = 0; 913 sp->pp_alivecnt = 0; 914 sp->pp_last_activity = 0; 915 sp->pp_last_receive = 0; 916 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 917 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 918 sp->pp_idle_timeout = 0; 919 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 920 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 921 sp->pp_auth_failures = 0; 922 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 923 sp->pp_phase = SPPP_PHASE_DEAD; 924 sp->pp_up = lcp.Up; 925 sp->pp_down = lcp.Down; 926 927 if_alloc_sadl(ifp); 928 929 memset(&sp->myauth, 0, sizeof sp->myauth); 930 memset(&sp->hisauth, 0, sizeof sp->hisauth); 931 sppp_lcp_init(sp); 932 sppp_ipcp_init(sp); 933 sppp_ipv6cp_init(sp); 934 sppp_pap_init(sp); 935 sppp_chap_init(sp); 936 } 937 938 void 939 sppp_detach(struct ifnet *ifp) 940 { 941 struct sppp **q, *p, *sp = (struct sppp *) ifp; 942 943 /* Remove the entry from the keepalive list. */ 944 for (q = &spppq; (p = *q); q = &p->pp_next) 945 if (p == sp) { 946 *q = p->pp_next; 947 break; 948 } 949 950 /* Stop keepalive handler. */ 951 if (! spppq) { 952 callout_stop(&keepalive_ch); 953 } 954 955 callout_stop(&sp->ch[IDX_LCP]); 956 callout_stop(&sp->ch[IDX_IPCP]); 957 callout_stop(&sp->ch[IDX_PAP]); 958 callout_stop(&sp->ch[IDX_CHAP]); 959 #ifdef INET6 960 callout_stop(&sp->ch[IDX_IPV6CP]); 961 #endif 962 callout_stop(&sp->pap_my_to_ch); 963 964 /* free authentication info */ 965 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 966 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 967 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 968 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 969 970 #if 0 /* done in if_detach() */ 971 if_free_sadl(ifp); 972 #endif 973 } 974 975 /* 976 * Flush the interface output queue. 977 */ 978 void 979 sppp_flush(struct ifnet *ifp) 980 { 981 struct sppp *sp = (struct sppp *) ifp; 982 983 IFQ_PURGE(&sp->pp_if.if_snd); 984 IF_PURGE(&sp->pp_fastq); 985 IF_PURGE(&sp->pp_cpq); 986 } 987 988 /* 989 * Check if the output queue is empty. 990 */ 991 int 992 sppp_isempty(struct ifnet *ifp) 993 { 994 struct sppp *sp = (struct sppp *) ifp; 995 int empty, s; 996 997 s = splnet(); 998 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 999 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1000 splx(s); 1001 return (empty); 1002 } 1003 1004 /* 1005 * Get next packet to send. 1006 */ 1007 struct mbuf * 1008 sppp_dequeue(struct ifnet *ifp) 1009 { 1010 struct sppp *sp = (struct sppp *) ifp; 1011 struct mbuf *m; 1012 int s; 1013 1014 s = splnet(); 1015 /* 1016 * Process only the control protocol queue until we have at 1017 * least one NCP open. 1018 * 1019 * Do always serve all three queues in Cisco mode. 1020 */ 1021 IF_DEQUEUE(&sp->pp_cpq, m); 1022 if (m == NULL && 1023 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1024 IF_DEQUEUE(&sp->pp_fastq, m); 1025 if (m == NULL) 1026 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1027 } 1028 splx(s); 1029 return m; 1030 } 1031 1032 /* 1033 * Process an ioctl request. Called on low priority level. 1034 */ 1035 int 1036 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1037 { 1038 struct lwp *l = curlwp; /* XXX */ 1039 struct ifreq *ifr = (struct ifreq *) data; 1040 struct sppp *sp = (struct sppp *) ifp; 1041 int s, error=0, going_up, going_down, newmode; 1042 1043 s = splnet(); 1044 switch (cmd) { 1045 case SIOCAIFADDR: 1046 case SIOCSIFDSTADDR: 1047 case SIOCSIFADDR: 1048 break; 1049 1050 case SIOCSIFFLAGS: 1051 going_up = ifp->if_flags & IFF_UP && 1052 (ifp->if_flags & IFF_RUNNING) == 0; 1053 going_down = (ifp->if_flags & IFF_UP) == 0 && 1054 ifp->if_flags & IFF_RUNNING; 1055 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1056 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1057 /* sanity */ 1058 newmode = IFF_PASSIVE; 1059 ifp->if_flags &= ~IFF_AUTO; 1060 } 1061 1062 if (going_up || going_down) 1063 lcp.Close(sp); 1064 if (going_up && newmode == 0) { 1065 /* neither auto-dial nor passive */ 1066 ifp->if_flags |= IFF_RUNNING; 1067 if (!(sp->pp_flags & PP_CISCO)) 1068 lcp.Open(sp); 1069 } else if (going_down) { 1070 sppp_flush(ifp); 1071 ifp->if_flags &= ~IFF_RUNNING; 1072 } 1073 1074 break; 1075 1076 #ifdef SIOCSIFMTU 1077 #ifndef ifr_mtu 1078 #define ifr_mtu ifr_metric 1079 #endif 1080 case SIOCSIFMTU: 1081 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1082 error = EINVAL; 1083 break; 1084 } 1085 1086 ifp->if_mtu = ifr->ifr_mtu; 1087 break; 1088 #endif 1089 #ifdef SLIOCSETMTU 1090 case SLIOCSETMTU: 1091 if (*(short *)data < 128 || *(short *)data > sp->lcp.their_mru) 1092 { 1093 error = EINVAL; 1094 break; 1095 } 1096 1097 ifp->if_mtu = *(short *)data; 1098 break; 1099 #endif 1100 #ifdef SIOCGIFMTU 1101 case SIOCGIFMTU: 1102 ifr->ifr_mtu = ifp->if_mtu; 1103 break; 1104 #endif 1105 #ifdef SLIOCGETMTU 1106 case SLIOCGETMTU: 1107 *(short *)data = ifp->if_mtu; 1108 break; 1109 #endif 1110 case SIOCADDMULTI: 1111 case SIOCDELMULTI: 1112 break; 1113 1114 case SPPPSETAUTHCFG: 1115 case SPPPSETLCPCFG: 1116 case SPPPSETIDLETO: 1117 case SPPPSETAUTHFAILURE: 1118 case SPPPSETDNSOPTS: 1119 case SPPPSETKEEPALIVE: 1120 error = kauth_authorize_network(l->l_cred, 1121 KAUTH_NETWORK_INTERFACE, 1122 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1123 NULL); 1124 if (error) 1125 break; 1126 error = sppp_params(sp, cmd, data); 1127 break; 1128 1129 case SPPPGETAUTHCFG: 1130 case SPPPGETLCPCFG: 1131 case SPPPGETAUTHFAILURES: 1132 error = kauth_authorize_network(l->l_cred, 1133 KAUTH_NETWORK_INTERFACE, 1134 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1135 NULL); 1136 if (error) 1137 break; 1138 error = sppp_params(sp, cmd, data); 1139 break; 1140 1141 case SPPPGETSTATUS: 1142 case SPPPGETSTATUSNCP: 1143 case SPPPGETIDLETO: 1144 case SPPPGETDNSOPTS: 1145 case SPPPGETDNSADDRS: 1146 case SPPPGETKEEPALIVE: 1147 error = sppp_params(sp, cmd, data); 1148 break; 1149 1150 default: 1151 error = ENOTTY; 1152 } 1153 splx(s); 1154 return (error); 1155 } 1156 1157 1158 /* 1159 * Cisco framing implementation. 1160 */ 1161 1162 /* 1163 * Handle incoming Cisco keepalive protocol packets. 1164 */ 1165 static void 1166 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1167 { 1168 STDDCL; 1169 struct cisco_packet *h; 1170 #ifdef INET 1171 u_int32_t me, mymask = 0; /* XXX: GCC */ 1172 #endif 1173 1174 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1175 if (debug) 1176 log(LOG_DEBUG, 1177 "%s: cisco invalid packet length: %d bytes\n", 1178 ifp->if_xname, m->m_pkthdr.len); 1179 return; 1180 } 1181 h = mtod(m, struct cisco_packet *); 1182 if (debug) 1183 log(LOG_DEBUG, 1184 "%s: cisco input: %d bytes " 1185 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1186 ifp->if_xname, m->m_pkthdr.len, 1187 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1188 (u_int)h->time0, (u_int)h->time1); 1189 switch (ntohl(h->type)) { 1190 default: 1191 if (debug) 1192 addlog("%s: cisco unknown packet type: 0x%x\n", 1193 ifp->if_xname, ntohl(h->type)); 1194 break; 1195 case CISCO_ADDR_REPLY: 1196 /* Reply on address request, ignore */ 1197 break; 1198 case CISCO_KEEPALIVE_REQ: 1199 sp->pp_alivecnt = 0; 1200 sp->pp_rseq[IDX_LCP] = ntohl(h->par1); 1201 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1202 /* Local and remote sequence numbers are equal. 1203 * Probably, the line is in loopback mode. */ 1204 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1205 printf ("%s: loopback\n", 1206 ifp->if_xname); 1207 sp->pp_loopcnt = 0; 1208 if (ifp->if_flags & IFF_UP) { 1209 if_down(ifp); 1210 IF_PURGE(&sp->pp_cpq); 1211 } 1212 } 1213 ++sp->pp_loopcnt; 1214 1215 /* Generate new local sequence number */ 1216 sp->pp_seq[IDX_LCP] = arc4random(); 1217 break; 1218 } 1219 sp->pp_loopcnt = 0; 1220 if (! (ifp->if_flags & IFF_UP) && 1221 (ifp->if_flags & IFF_RUNNING)) { 1222 if_up(ifp); 1223 } 1224 break; 1225 case CISCO_ADDR_REQ: 1226 #ifdef INET 1227 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1228 if (me != 0L) 1229 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1230 #endif 1231 break; 1232 } 1233 } 1234 1235 /* 1236 * Send Cisco keepalive packet. 1237 */ 1238 static void 1239 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1240 { 1241 STDDCL; 1242 struct ppp_header *h; 1243 struct cisco_packet *ch; 1244 struct mbuf *m; 1245 u_int32_t t; 1246 1247 t = time_uptime * 1000; 1248 MGETHDR(m, M_DONTWAIT, MT_DATA); 1249 if (! m) 1250 return; 1251 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1252 m->m_pkthdr.rcvif = 0; 1253 1254 h = mtod(m, struct ppp_header *); 1255 h->address = CISCO_MULTICAST; 1256 h->control = 0; 1257 h->protocol = htons(CISCO_KEEPALIVE); 1258 1259 ch = (struct cisco_packet *)(h + 1); 1260 ch->type = htonl(type); 1261 ch->par1 = htonl(par1); 1262 ch->par2 = htonl(par2); 1263 ch->rel = -1; 1264 1265 ch->time0 = htons((u_short)(t >> 16)); 1266 ch->time1 = htons((u_short) t); 1267 1268 if (debug) 1269 log(LOG_DEBUG, 1270 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1271 ifp->if_xname, ntohl(ch->type), ch->par1, 1272 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1273 (u_int)ch->time1); 1274 1275 if (IF_QFULL(&sp->pp_cpq)) { 1276 IF_DROP(&sp->pp_fastq); 1277 IF_DROP(&ifp->if_snd); 1278 m_freem(m); 1279 ++ifp->if_oerrors; 1280 return; 1281 } else 1282 IF_ENQUEUE(&sp->pp_cpq, m); 1283 if (! (ifp->if_flags & IFF_OACTIVE)) 1284 (*ifp->if_start)(ifp); 1285 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1286 } 1287 1288 /* 1289 * PPP protocol implementation. 1290 */ 1291 1292 /* 1293 * Send PPP control protocol packet. 1294 */ 1295 static void 1296 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1297 u_char ident, u_short len, void *data) 1298 { 1299 STDDCL; 1300 struct lcp_header *lh; 1301 struct mbuf *m; 1302 size_t pkthdrlen; 1303 1304 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1305 1306 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1307 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1308 MGETHDR(m, M_DONTWAIT, MT_DATA); 1309 if (! m) 1310 return; 1311 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1312 m->m_pkthdr.rcvif = 0; 1313 1314 if (sp->pp_flags & PP_NOFRAMING) { 1315 *mtod(m, u_int16_t *) = htons(proto); 1316 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1317 } else { 1318 struct ppp_header *h; 1319 h = mtod(m, struct ppp_header *); 1320 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1321 h->control = PPP_UI; /* Unnumbered Info */ 1322 h->protocol = htons(proto); /* Link Control Protocol */ 1323 lh = (struct lcp_header *)(h + 1); 1324 } 1325 lh->type = type; 1326 lh->ident = ident; 1327 lh->len = htons(LCP_HEADER_LEN + len); 1328 if (len) 1329 bcopy (data, lh + 1, len); 1330 1331 if (debug) { 1332 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1333 ifp->if_xname, 1334 sppp_proto_name(proto), 1335 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1336 if (len) 1337 sppp_print_bytes((u_char *)(lh + 1), len); 1338 addlog(">\n"); 1339 } 1340 if (IF_QFULL(&sp->pp_cpq)) { 1341 IF_DROP(&sp->pp_fastq); 1342 IF_DROP(&ifp->if_snd); 1343 m_freem(m); 1344 ++ifp->if_oerrors; 1345 return; 1346 } else 1347 IF_ENQUEUE(&sp->pp_cpq, m); 1348 if (! (ifp->if_flags & IFF_OACTIVE)) 1349 (*ifp->if_start)(ifp); 1350 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1351 } 1352 1353 /* 1354 * Handle incoming PPP control protocol packets. 1355 */ 1356 static void 1357 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1358 { 1359 STDDCL; 1360 struct lcp_header *h; 1361 int printlen, len = m->m_pkthdr.len; 1362 int rv; 1363 u_char *p; 1364 u_int32_t u32; 1365 1366 if (len < 4) { 1367 if (debug) 1368 log(LOG_DEBUG, 1369 "%s: %s invalid packet length: %d bytes\n", 1370 ifp->if_xname, cp->name, len); 1371 return; 1372 } 1373 h = mtod(m, struct lcp_header *); 1374 if (debug) { 1375 printlen = ntohs(h->len); 1376 log(LOG_DEBUG, 1377 "%s: %s input(%s): <%s id=0x%x len=%d", 1378 ifp->if_xname, cp->name, 1379 sppp_state_name(sp->state[cp->protoidx]), 1380 sppp_cp_type_name(h->type), h->ident, printlen); 1381 if (len < printlen) 1382 printlen = len; 1383 if (printlen > 4) 1384 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1385 addlog(">\n"); 1386 } 1387 if (len > ntohs(h->len)) 1388 len = ntohs(h->len); 1389 p = (u_char *)(h + 1); 1390 switch (h->type) { 1391 case CONF_REQ: 1392 if (len < 4) { 1393 if (debug) 1394 addlog("%s: %s invalid conf-req length %d\n", 1395 ifp->if_xname, cp->name, 1396 len); 1397 ++ifp->if_ierrors; 1398 break; 1399 } 1400 /* handle states where RCR doesn't get a SCA/SCN */ 1401 switch (sp->state[cp->protoidx]) { 1402 case STATE_CLOSING: 1403 case STATE_STOPPING: 1404 return; 1405 case STATE_CLOSED: 1406 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1407 0, 0); 1408 return; 1409 } 1410 rv = (cp->RCR)(sp, h, len); 1411 if (rv < 0) { 1412 /* fatal error, shut down */ 1413 (cp->tld)(sp); 1414 sppp_lcp_tlf(sp); 1415 return; 1416 } 1417 switch (sp->state[cp->protoidx]) { 1418 case STATE_OPENED: 1419 (cp->tld)(sp); 1420 (cp->scr)(sp); 1421 /* fall through... */ 1422 case STATE_ACK_SENT: 1423 case STATE_REQ_SENT: 1424 sppp_cp_change_state(cp, sp, rv? 1425 STATE_ACK_SENT: STATE_REQ_SENT); 1426 break; 1427 case STATE_STOPPED: 1428 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1429 (cp->scr)(sp); 1430 sppp_cp_change_state(cp, sp, rv? 1431 STATE_ACK_SENT: STATE_REQ_SENT); 1432 break; 1433 case STATE_ACK_RCVD: 1434 if (rv) { 1435 sppp_cp_change_state(cp, sp, STATE_OPENED); 1436 if (debug) 1437 log(LOG_DEBUG, "%s: %s tlu\n", 1438 ifp->if_xname, 1439 cp->name); 1440 (cp->tlu)(sp); 1441 } else 1442 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1443 break; 1444 default: 1445 printf("%s: %s illegal %s in state %s\n", 1446 ifp->if_xname, cp->name, 1447 sppp_cp_type_name(h->type), 1448 sppp_state_name(sp->state[cp->protoidx])); 1449 ++ifp->if_ierrors; 1450 } 1451 break; 1452 case CONF_ACK: 1453 if (h->ident != sp->confid[cp->protoidx]) { 1454 if (debug) 1455 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1456 ifp->if_xname, cp->name, 1457 h->ident, sp->confid[cp->protoidx]); 1458 ++ifp->if_ierrors; 1459 break; 1460 } 1461 switch (sp->state[cp->protoidx]) { 1462 case STATE_CLOSED: 1463 case STATE_STOPPED: 1464 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1465 break; 1466 case STATE_CLOSING: 1467 case STATE_STOPPING: 1468 break; 1469 case STATE_REQ_SENT: 1470 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1471 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1472 break; 1473 case STATE_OPENED: 1474 (cp->tld)(sp); 1475 /* fall through */ 1476 case STATE_ACK_RCVD: 1477 (cp->scr)(sp); 1478 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1479 break; 1480 case STATE_ACK_SENT: 1481 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1482 sppp_cp_change_state(cp, sp, STATE_OPENED); 1483 if (debug) 1484 log(LOG_DEBUG, "%s: %s tlu\n", 1485 ifp->if_xname, cp->name); 1486 (cp->tlu)(sp); 1487 break; 1488 default: 1489 printf("%s: %s illegal %s in state %s\n", 1490 ifp->if_xname, cp->name, 1491 sppp_cp_type_name(h->type), 1492 sppp_state_name(sp->state[cp->protoidx])); 1493 ++ifp->if_ierrors; 1494 } 1495 break; 1496 case CONF_NAK: 1497 case CONF_REJ: 1498 if (h->ident != sp->confid[cp->protoidx]) { 1499 if (debug) 1500 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1501 ifp->if_xname, cp->name, 1502 h->ident, sp->confid[cp->protoidx]); 1503 ++ifp->if_ierrors; 1504 break; 1505 } 1506 if (h->type == CONF_NAK) 1507 (cp->RCN_nak)(sp, h, len); 1508 else /* CONF_REJ */ 1509 (cp->RCN_rej)(sp, h, len); 1510 1511 switch (sp->state[cp->protoidx]) { 1512 case STATE_CLOSED: 1513 case STATE_STOPPED: 1514 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1515 break; 1516 case STATE_REQ_SENT: 1517 case STATE_ACK_SENT: 1518 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1519 (cp->scr)(sp); 1520 break; 1521 case STATE_OPENED: 1522 (cp->tld)(sp); 1523 /* fall through */ 1524 case STATE_ACK_RCVD: 1525 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1526 (cp->scr)(sp); 1527 break; 1528 case STATE_CLOSING: 1529 case STATE_STOPPING: 1530 break; 1531 default: 1532 printf("%s: %s illegal %s in state %s\n", 1533 ifp->if_xname, cp->name, 1534 sppp_cp_type_name(h->type), 1535 sppp_state_name(sp->state[cp->protoidx])); 1536 ++ifp->if_ierrors; 1537 } 1538 break; 1539 1540 case TERM_REQ: 1541 switch (sp->state[cp->protoidx]) { 1542 case STATE_ACK_RCVD: 1543 case STATE_ACK_SENT: 1544 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1545 /* fall through */ 1546 case STATE_CLOSED: 1547 case STATE_STOPPED: 1548 case STATE_CLOSING: 1549 case STATE_STOPPING: 1550 case STATE_REQ_SENT: 1551 sta: 1552 /* Send Terminate-Ack packet. */ 1553 if (debug) 1554 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 1555 ifp->if_xname, cp->name); 1556 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1557 break; 1558 case STATE_OPENED: 1559 (cp->tld)(sp); 1560 sp->rst_counter[cp->protoidx] = 0; 1561 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1562 goto sta; 1563 default: 1564 printf("%s: %s illegal %s in state %s\n", 1565 ifp->if_xname, cp->name, 1566 sppp_cp_type_name(h->type), 1567 sppp_state_name(sp->state[cp->protoidx])); 1568 ++ifp->if_ierrors; 1569 } 1570 break; 1571 case TERM_ACK: 1572 switch (sp->state[cp->protoidx]) { 1573 case STATE_CLOSED: 1574 case STATE_STOPPED: 1575 case STATE_REQ_SENT: 1576 case STATE_ACK_SENT: 1577 break; 1578 case STATE_CLOSING: 1579 (cp->tlf)(sp); 1580 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1581 sppp_lcp_check_and_close(sp); 1582 break; 1583 case STATE_STOPPING: 1584 (cp->tlf)(sp); 1585 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1586 sppp_lcp_check_and_close(sp); 1587 break; 1588 case STATE_ACK_RCVD: 1589 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1590 break; 1591 case STATE_OPENED: 1592 (cp->tld)(sp); 1593 (cp->scr)(sp); 1594 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1595 break; 1596 default: 1597 printf("%s: %s illegal %s in state %s\n", 1598 ifp->if_xname, cp->name, 1599 sppp_cp_type_name(h->type), 1600 sppp_state_name(sp->state[cp->protoidx])); 1601 ++ifp->if_ierrors; 1602 } 1603 break; 1604 case CODE_REJ: 1605 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1606 log(LOG_INFO, 1607 "%s: %s: ignoring RXJ (%s) for code ?, " 1608 "danger will robinson\n", 1609 ifp->if_xname, cp->name, 1610 sppp_cp_type_name(h->type)); 1611 switch (sp->state[cp->protoidx]) { 1612 case STATE_CLOSED: 1613 case STATE_STOPPED: 1614 case STATE_REQ_SENT: 1615 case STATE_ACK_SENT: 1616 case STATE_CLOSING: 1617 case STATE_STOPPING: 1618 case STATE_OPENED: 1619 break; 1620 case STATE_ACK_RCVD: 1621 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1622 break; 1623 default: 1624 printf("%s: %s illegal %s in state %s\n", 1625 ifp->if_xname, cp->name, 1626 sppp_cp_type_name(h->type), 1627 sppp_state_name(sp->state[cp->protoidx])); 1628 ++ifp->if_ierrors; 1629 } 1630 break; 1631 case PROTO_REJ: 1632 { 1633 int catastrophic; 1634 const struct cp *upper; 1635 int i; 1636 u_int16_t proto; 1637 1638 catastrophic = 0; 1639 upper = NULL; 1640 proto = p[0] << 8 | p[1]; 1641 for (i = 0; i < IDX_COUNT; i++) { 1642 if (cps[i]->proto == proto) { 1643 upper = cps[i]; 1644 break; 1645 } 1646 } 1647 if (upper == NULL) 1648 catastrophic++; 1649 1650 if (debug) 1651 log(LOG_INFO, 1652 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1653 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1654 sppp_cp_type_name(h->type), proto, 1655 upper ? upper->name : "unknown", 1656 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1657 1658 /* 1659 * if we got RXJ+ against conf-req, the peer does not implement 1660 * this particular protocol type. terminate the protocol. 1661 */ 1662 if (upper && !catastrophic) { 1663 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1664 upper->Close(sp); 1665 break; 1666 } 1667 } 1668 1669 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1670 switch (sp->state[cp->protoidx]) { 1671 case STATE_CLOSED: 1672 case STATE_STOPPED: 1673 case STATE_REQ_SENT: 1674 case STATE_ACK_SENT: 1675 case STATE_CLOSING: 1676 case STATE_STOPPING: 1677 case STATE_OPENED: 1678 break; 1679 case STATE_ACK_RCVD: 1680 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1681 break; 1682 default: 1683 printf("%s: %s illegal %s in state %s\n", 1684 ifp->if_xname, cp->name, 1685 sppp_cp_type_name(h->type), 1686 sppp_state_name(sp->state[cp->protoidx])); 1687 ++ifp->if_ierrors; 1688 } 1689 break; 1690 } 1691 case DISC_REQ: 1692 if (cp->proto != PPP_LCP) 1693 goto illegal; 1694 /* Discard the packet. */ 1695 break; 1696 case ECHO_REQ: 1697 if (cp->proto != PPP_LCP) 1698 goto illegal; 1699 if (sp->state[cp->protoidx] != STATE_OPENED) { 1700 if (debug) 1701 addlog("%s: lcp echo req but lcp closed\n", 1702 ifp->if_xname); 1703 ++ifp->if_ierrors; 1704 break; 1705 } 1706 if (len < 8) { 1707 if (debug) 1708 addlog("%s: invalid lcp echo request " 1709 "packet length: %d bytes\n", 1710 ifp->if_xname, len); 1711 break; 1712 } 1713 memcpy(&u32, h + 1, sizeof u32); 1714 if (ntohl(u32) == sp->lcp.magic) { 1715 /* Line loopback mode detected. */ 1716 printf("%s: loopback\n", ifp->if_xname); 1717 if_down(ifp); 1718 IF_PURGE(&sp->pp_cpq); 1719 1720 /* Shut down the PPP link. */ 1721 /* XXX */ 1722 lcp.Down(sp); 1723 lcp.Up(sp); 1724 break; 1725 } 1726 u32 = htonl(sp->lcp.magic); 1727 memcpy(h + 1, &u32, sizeof u32); 1728 if (debug) 1729 addlog("%s: got lcp echo req, sending echo rep\n", 1730 ifp->if_xname); 1731 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1732 h + 1); 1733 break; 1734 case ECHO_REPLY: 1735 if (cp->proto != PPP_LCP) 1736 goto illegal; 1737 if (h->ident != sp->lcp.echoid) { 1738 ++ifp->if_ierrors; 1739 break; 1740 } 1741 if (len < 8) { 1742 if (debug) 1743 addlog("%s: lcp invalid echo reply " 1744 "packet length: %d bytes\n", 1745 ifp->if_xname, len); 1746 break; 1747 } 1748 if (debug) 1749 addlog("%s: lcp got echo rep\n", 1750 ifp->if_xname); 1751 memcpy(&u32, h + 1, sizeof u32); 1752 if (ntohl(u32) != sp->lcp.magic) 1753 sp->pp_alivecnt = 0; 1754 break; 1755 default: 1756 /* Unknown packet type -- send Code-Reject packet. */ 1757 illegal: 1758 if (debug) 1759 addlog("%s: %s send code-rej for 0x%x\n", 1760 ifp->if_xname, cp->name, h->type); 1761 sppp_cp_send(sp, cp->proto, CODE_REJ, 1762 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1763 ++ifp->if_ierrors; 1764 } 1765 } 1766 1767 1768 /* 1769 * The generic part of all Up/Down/Open/Close/TO event handlers. 1770 * Basically, the state transition handling in the automaton. 1771 */ 1772 static void 1773 sppp_up_event(const struct cp *cp, struct sppp *sp) 1774 { 1775 STDDCL; 1776 1777 if (debug) 1778 log(LOG_DEBUG, "%s: %s up(%s)\n", 1779 ifp->if_xname, cp->name, 1780 sppp_state_name(sp->state[cp->protoidx])); 1781 1782 switch (sp->state[cp->protoidx]) { 1783 case STATE_INITIAL: 1784 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1785 break; 1786 case STATE_STARTING: 1787 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1788 (cp->scr)(sp); 1789 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1790 break; 1791 default: 1792 printf("%s: %s illegal up in state %s\n", 1793 ifp->if_xname, cp->name, 1794 sppp_state_name(sp->state[cp->protoidx])); 1795 } 1796 } 1797 1798 static void 1799 sppp_down_event(const struct cp *cp, struct sppp *sp) 1800 { 1801 STDDCL; 1802 1803 if (debug) 1804 log(LOG_DEBUG, "%s: %s down(%s)\n", 1805 ifp->if_xname, cp->name, 1806 sppp_state_name(sp->state[cp->protoidx])); 1807 1808 switch (sp->state[cp->protoidx]) { 1809 case STATE_CLOSED: 1810 case STATE_CLOSING: 1811 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1812 break; 1813 case STATE_STOPPED: 1814 (cp->tls)(sp); 1815 /* fall through */ 1816 case STATE_STOPPING: 1817 case STATE_REQ_SENT: 1818 case STATE_ACK_RCVD: 1819 case STATE_ACK_SENT: 1820 sppp_cp_change_state(cp, sp, STATE_STARTING); 1821 break; 1822 case STATE_OPENED: 1823 (cp->tld)(sp); 1824 sppp_cp_change_state(cp, sp, STATE_STARTING); 1825 break; 1826 default: 1827 printf("%s: %s illegal down in state %s\n", 1828 ifp->if_xname, cp->name, 1829 sppp_state_name(sp->state[cp->protoidx])); 1830 } 1831 } 1832 1833 1834 static void 1835 sppp_open_event(const struct cp *cp, struct sppp *sp) 1836 { 1837 STDDCL; 1838 1839 if (debug) 1840 log(LOG_DEBUG, "%s: %s open(%s)\n", 1841 ifp->if_xname, cp->name, 1842 sppp_state_name(sp->state[cp->protoidx])); 1843 1844 switch (sp->state[cp->protoidx]) { 1845 case STATE_INITIAL: 1846 sppp_cp_change_state(cp, sp, STATE_STARTING); 1847 (cp->tls)(sp); 1848 break; 1849 case STATE_STARTING: 1850 break; 1851 case STATE_CLOSED: 1852 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1853 (cp->scr)(sp); 1854 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1855 break; 1856 case STATE_STOPPED: 1857 case STATE_STOPPING: 1858 case STATE_REQ_SENT: 1859 case STATE_ACK_RCVD: 1860 case STATE_ACK_SENT: 1861 case STATE_OPENED: 1862 break; 1863 case STATE_CLOSING: 1864 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1865 break; 1866 } 1867 } 1868 1869 1870 static void 1871 sppp_close_event(const struct cp *cp, struct sppp *sp) 1872 { 1873 STDDCL; 1874 1875 if (debug) 1876 log(LOG_DEBUG, "%s: %s close(%s)\n", 1877 ifp->if_xname, cp->name, 1878 sppp_state_name(sp->state[cp->protoidx])); 1879 1880 switch (sp->state[cp->protoidx]) { 1881 case STATE_INITIAL: 1882 case STATE_CLOSED: 1883 case STATE_CLOSING: 1884 break; 1885 case STATE_STARTING: 1886 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1887 (cp->tlf)(sp); 1888 break; 1889 case STATE_STOPPED: 1890 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1891 break; 1892 case STATE_STOPPING: 1893 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1894 break; 1895 case STATE_OPENED: 1896 (cp->tld)(sp); 1897 /* fall through */ 1898 case STATE_REQ_SENT: 1899 case STATE_ACK_RCVD: 1900 case STATE_ACK_SENT: 1901 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1902 sppp_cp_send(sp, cp->proto, TERM_REQ, 1903 ++sp->pp_seq[cp->protoidx], 0, 0); 1904 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1905 break; 1906 } 1907 } 1908 1909 static void 1910 sppp_to_event(const struct cp *cp, struct sppp *sp) 1911 { 1912 STDDCL; 1913 int s; 1914 1915 s = splnet(); 1916 if (debug) 1917 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 1918 ifp->if_xname, cp->name, 1919 sppp_state_name(sp->state[cp->protoidx]), 1920 sp->rst_counter[cp->protoidx]); 1921 1922 if (--sp->rst_counter[cp->protoidx] < 0) 1923 /* TO- event */ 1924 switch (sp->state[cp->protoidx]) { 1925 case STATE_CLOSING: 1926 (cp->tlf)(sp); 1927 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1928 sppp_lcp_check_and_close(sp); 1929 break; 1930 case STATE_STOPPING: 1931 (cp->tlf)(sp); 1932 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1933 sppp_lcp_check_and_close(sp); 1934 break; 1935 case STATE_REQ_SENT: 1936 case STATE_ACK_RCVD: 1937 case STATE_ACK_SENT: 1938 (cp->tlf)(sp); 1939 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1940 sppp_lcp_check_and_close(sp); 1941 break; 1942 } 1943 else 1944 /* TO+ event */ 1945 switch (sp->state[cp->protoidx]) { 1946 case STATE_CLOSING: 1947 case STATE_STOPPING: 1948 sppp_cp_send(sp, cp->proto, TERM_REQ, 1949 ++sp->pp_seq[cp->protoidx], 0, 0); 1950 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1951 cp->TO, sp); 1952 break; 1953 case STATE_REQ_SENT: 1954 case STATE_ACK_RCVD: 1955 (cp->scr)(sp); 1956 /* sppp_cp_change_state() will restart the timer */ 1957 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1958 break; 1959 case STATE_ACK_SENT: 1960 (cp->scr)(sp); 1961 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1962 cp->TO, sp); 1963 break; 1964 } 1965 1966 splx(s); 1967 } 1968 1969 /* 1970 * Change the state of a control protocol in the state automaton. 1971 * Takes care of starting/stopping the restart timer. 1972 */ 1973 void 1974 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1975 { 1976 sp->state[cp->protoidx] = newstate; 1977 callout_stop(&sp->ch[cp->protoidx]); 1978 switch (newstate) { 1979 case STATE_INITIAL: 1980 case STATE_STARTING: 1981 case STATE_CLOSED: 1982 case STATE_STOPPED: 1983 case STATE_OPENED: 1984 break; 1985 case STATE_CLOSING: 1986 case STATE_STOPPING: 1987 case STATE_REQ_SENT: 1988 case STATE_ACK_RCVD: 1989 case STATE_ACK_SENT: 1990 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1991 cp->TO, sp); 1992 break; 1993 } 1994 } 1995 1996 /* 1997 *--------------------------------------------------------------------------* 1998 * * 1999 * The LCP implementation. * 2000 * * 2001 *--------------------------------------------------------------------------* 2002 */ 2003 static void 2004 sppp_lcp_init(struct sppp *sp) 2005 { 2006 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2007 sp->lcp.magic = 0; 2008 sp->state[IDX_LCP] = STATE_INITIAL; 2009 sp->fail_counter[IDX_LCP] = 0; 2010 sp->pp_seq[IDX_LCP] = 0; 2011 sp->pp_rseq[IDX_LCP] = 0; 2012 sp->lcp.protos = 0; 2013 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2014 2015 /* 2016 * Initialize counters and timeout values. Note that we don't 2017 * use the 3 seconds suggested in RFC 1661 since we are likely 2018 * running on a fast link. XXX We should probably implement 2019 * the exponential backoff option. Note that these values are 2020 * relevant for all control protocols, not just LCP only. 2021 */ 2022 sp->lcp.timeout = 1 * hz; 2023 sp->lcp.max_terminate = 2; 2024 sp->lcp.max_configure = 10; 2025 sp->lcp.max_failure = 10; 2026 callout_init(&sp->ch[IDX_LCP]); 2027 } 2028 2029 static void 2030 sppp_lcp_up(struct sppp *sp) 2031 { 2032 STDDCL; 2033 2034 /* Initialize activity timestamp: opening a connection is an activity */ 2035 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2036 2037 /* 2038 * If this interface is passive or dial-on-demand, and we are 2039 * still in Initial state, it means we've got an incoming 2040 * call. Activate the interface. 2041 */ 2042 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2043 if (debug) 2044 log(LOG_DEBUG, 2045 "%s: Up event", ifp->if_xname); 2046 ifp->if_flags |= IFF_RUNNING; 2047 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2048 if (debug) 2049 addlog("(incoming call)\n"); 2050 sp->pp_flags |= PP_CALLIN; 2051 lcp.Open(sp); 2052 } else if (debug) 2053 addlog("\n"); 2054 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2055 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2056 ifp->if_flags |= IFF_RUNNING; 2057 lcp.Open(sp); 2058 } 2059 2060 sppp_up_event(&lcp, sp); 2061 } 2062 2063 static void 2064 sppp_lcp_down(struct sppp *sp) 2065 { 2066 STDDCL; 2067 2068 sppp_down_event(&lcp, sp); 2069 2070 /* 2071 * If this is neither a dial-on-demand nor a passive 2072 * interface, simulate an ``ifconfig down'' action, so the 2073 * administrator can force a redial by another ``ifconfig 2074 * up''. XXX For leased line operation, should we immediately 2075 * try to reopen the connection here? 2076 */ 2077 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2078 if (debug) 2079 log(LOG_INFO, 2080 "%s: Down event (carrier loss), taking interface down.\n", 2081 ifp->if_xname); 2082 if_down(ifp); 2083 } else { 2084 if (debug) 2085 log(LOG_DEBUG, 2086 "%s: Down event (carrier loss)\n", 2087 ifp->if_xname); 2088 } 2089 sp->pp_flags &= ~PP_CALLIN; 2090 if (sp->state[IDX_LCP] != STATE_INITIAL) 2091 lcp.Close(sp); 2092 ifp->if_flags &= ~IFF_RUNNING; 2093 } 2094 2095 static void 2096 sppp_lcp_open(struct sppp *sp) 2097 { 2098 /* 2099 * If we are authenticator, negotiate LCP_AUTH 2100 */ 2101 if (sp->hisauth.proto != 0) 2102 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2103 else 2104 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2105 sp->pp_flags &= ~PP_NEEDAUTH; 2106 sppp_open_event(&lcp, sp); 2107 } 2108 2109 static void 2110 sppp_lcp_close(struct sppp *sp) 2111 { 2112 sppp_close_event(&lcp, sp); 2113 } 2114 2115 static void 2116 sppp_lcp_TO(void *cookie) 2117 { 2118 sppp_to_event(&lcp, (struct sppp *)cookie); 2119 } 2120 2121 /* 2122 * Analyze a configure request. Return true if it was agreeable, and 2123 * caused action sca, false if it has been rejected or nak'ed, and 2124 * caused action scn. (The return value is used to make the state 2125 * transition decision in the state automaton.) 2126 */ 2127 static int 2128 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2129 { 2130 STDDCL; 2131 u_char *buf, *r, *p; 2132 int origlen, rlen; 2133 u_int32_t nmagic; 2134 u_short authproto; 2135 2136 len -= 4; 2137 origlen = len; 2138 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2139 if (! buf) 2140 return (0); 2141 2142 if (debug) 2143 log(LOG_DEBUG, "%s: lcp parse opts:", 2144 ifp->if_xname); 2145 2146 /* pass 1: check for things that need to be rejected */ 2147 p = (void *)(h + 1); 2148 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2149 /* Sanity check option length */ 2150 if (p[1] > len) { 2151 /* 2152 * Malicious option - drop immediately. 2153 * XXX Maybe we should just RXJ it? 2154 */ 2155 addlog("%s: received malicious LCP option 0x%02x, " 2156 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2157 p[0], p[1], len); 2158 goto drop; 2159 } 2160 if (debug) 2161 addlog(" %s", sppp_lcp_opt_name(*p)); 2162 switch (*p) { 2163 case LCP_OPT_MAGIC: 2164 /* Magic number. */ 2165 /* fall through, both are same length */ 2166 case LCP_OPT_ASYNC_MAP: 2167 /* Async control character map. */ 2168 if (len >= 6 || p[1] == 6) 2169 continue; 2170 if (debug) 2171 addlog(" [invalid]"); 2172 break; 2173 case LCP_OPT_MRU: 2174 /* Maximum receive unit. */ 2175 if (len >= 4 && p[1] == 4) 2176 continue; 2177 if (debug) 2178 addlog(" [invalid]"); 2179 break; 2180 case LCP_OPT_AUTH_PROTO: 2181 if (len < 4) { 2182 if (debug) 2183 addlog(" [invalid]"); 2184 break; 2185 } 2186 authproto = (p[2] << 8) + p[3]; 2187 if (authproto == PPP_CHAP && p[1] != 5) { 2188 if (debug) 2189 addlog(" [invalid chap len]"); 2190 break; 2191 } 2192 if (sp->myauth.proto == 0) { 2193 /* we are not configured to do auth */ 2194 if (debug) 2195 addlog(" [not configured]"); 2196 break; 2197 } 2198 /* 2199 * Remote want us to authenticate, remember this, 2200 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2201 * up. 2202 */ 2203 sp->pp_flags |= PP_NEEDAUTH; 2204 continue; 2205 default: 2206 /* Others not supported. */ 2207 if (debug) 2208 addlog(" [rej]"); 2209 break; 2210 } 2211 /* Add the option to rejected list. */ 2212 bcopy (p, r, p[1]); 2213 r += p[1]; 2214 rlen += p[1]; 2215 } 2216 if (rlen) { 2217 if (debug) 2218 addlog(" send conf-rej\n"); 2219 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2220 goto end; 2221 } else if (debug) 2222 addlog("\n"); 2223 2224 /* 2225 * pass 2: check for option values that are unacceptable and 2226 * thus require to be nak'ed. 2227 */ 2228 if (debug) 2229 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2230 ifp->if_xname); 2231 2232 p = (void *)(h + 1); 2233 len = origlen; 2234 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2235 if (debug) 2236 addlog(" %s", sppp_lcp_opt_name(*p)); 2237 switch (*p) { 2238 case LCP_OPT_MAGIC: 2239 /* Magic number -- extract. */ 2240 nmagic = (u_int32_t)p[2] << 24 | 2241 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2242 if (nmagic != sp->lcp.magic) { 2243 if (debug) 2244 addlog(" 0x%x", nmagic); 2245 continue; 2246 } 2247 /* 2248 * Local and remote magics equal -- loopback? 2249 */ 2250 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2251 printf ("%s: loopback\n", 2252 ifp->if_xname); 2253 sp->pp_loopcnt = 0; 2254 if (ifp->if_flags & IFF_UP) { 2255 if_down(ifp); 2256 IF_PURGE(&sp->pp_cpq); 2257 /* XXX ? */ 2258 lcp.Down(sp); 2259 lcp.Up(sp); 2260 } 2261 } else if (debug) 2262 addlog(" [glitch]"); 2263 ++sp->pp_loopcnt; 2264 /* 2265 * We negate our magic here, and NAK it. If 2266 * we see it later in an NAK packet, we 2267 * suggest a new one. 2268 */ 2269 nmagic = ~sp->lcp.magic; 2270 /* Gonna NAK it. */ 2271 p[2] = nmagic >> 24; 2272 p[3] = nmagic >> 16; 2273 p[4] = nmagic >> 8; 2274 p[5] = nmagic; 2275 break; 2276 2277 case LCP_OPT_ASYNC_MAP: 2278 /* 2279 * Async control character map -- just ignore it. 2280 * 2281 * Quote from RFC 1662, chapter 6: 2282 * To enable this functionality, synchronous PPP 2283 * implementations MUST always respond to the 2284 * Async-Control-Character-Map Configuration 2285 * Option with the LCP Configure-Ack. However, 2286 * acceptance of the Configuration Option does 2287 * not imply that the synchronous implementation 2288 * will do any ACCM mapping. Instead, all such 2289 * octet mapping will be performed by the 2290 * asynchronous-to-synchronous converter. 2291 */ 2292 continue; 2293 2294 case LCP_OPT_MRU: 2295 /* 2296 * Maximum receive unit. Always agreeable, 2297 * but ignored by now. 2298 */ 2299 sp->lcp.their_mru = p[2] * 256 + p[3]; 2300 if (debug) 2301 addlog(" %ld", sp->lcp.their_mru); 2302 continue; 2303 2304 case LCP_OPT_AUTH_PROTO: 2305 authproto = (p[2] << 8) + p[3]; 2306 if (sp->myauth.proto != authproto) { 2307 /* not agreed, nak */ 2308 if (debug) 2309 addlog(" [mine %s != his %s]", 2310 sppp_proto_name(sp->myauth.proto), 2311 sppp_proto_name(authproto)); 2312 p[2] = sp->myauth.proto >> 8; 2313 p[3] = sp->myauth.proto; 2314 break; 2315 } 2316 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2317 if (debug) 2318 addlog(" [chap not MD5]"); 2319 p[4] = CHAP_MD5; 2320 break; 2321 } 2322 continue; 2323 } 2324 /* Add the option to nak'ed list. */ 2325 bcopy (p, r, p[1]); 2326 r += p[1]; 2327 rlen += p[1]; 2328 } 2329 if (rlen) { 2330 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2331 if (debug) 2332 addlog(" max_failure (%d) exceeded, " 2333 "send conf-rej\n", 2334 sp->lcp.max_failure); 2335 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2336 } else { 2337 if (debug) 2338 addlog(" send conf-nak\n"); 2339 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2340 } 2341 goto end; 2342 } else { 2343 if (debug) 2344 addlog(" send conf-ack\n"); 2345 sp->fail_counter[IDX_LCP] = 0; 2346 sp->pp_loopcnt = 0; 2347 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2348 } 2349 2350 end: 2351 free(buf, M_TEMP); 2352 return (rlen == 0); 2353 2354 drop: 2355 free(buf, M_TEMP); 2356 return -1; 2357 } 2358 2359 /* 2360 * Analyze the LCP Configure-Reject option list, and adjust our 2361 * negotiation. 2362 */ 2363 static void 2364 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2365 { 2366 STDDCL; 2367 u_char *buf, *p; 2368 2369 len -= 4; 2370 buf = malloc (len, M_TEMP, M_NOWAIT); 2371 if (!buf) 2372 return; 2373 2374 if (debug) 2375 log(LOG_DEBUG, "%s: lcp rej opts:", 2376 ifp->if_xname); 2377 2378 p = (void *)(h + 1); 2379 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2380 /* Sanity check option length */ 2381 if (p[1] > len) { 2382 /* 2383 * Malicious option - drop immediately. 2384 * XXX Maybe we should just RXJ it? 2385 */ 2386 addlog("%s: received malicious LCP option, " 2387 "dropping.\n", ifp->if_xname); 2388 goto drop; 2389 } 2390 if (debug) 2391 addlog(" %s", sppp_lcp_opt_name(*p)); 2392 switch (*p) { 2393 case LCP_OPT_MAGIC: 2394 /* Magic number -- can't use it, use 0 */ 2395 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2396 sp->lcp.magic = 0; 2397 break; 2398 case LCP_OPT_MRU: 2399 /* 2400 * Should not be rejected anyway, since we only 2401 * negotiate a MRU if explicitly requested by 2402 * peer. 2403 */ 2404 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2405 break; 2406 case LCP_OPT_AUTH_PROTO: 2407 /* 2408 * Peer doesn't want to authenticate himself, 2409 * deny unless this is a dialout call, and 2410 * SPPP_AUTHFLAG_NOCALLOUT is set. 2411 */ 2412 if ((sp->pp_flags & PP_CALLIN) == 0 && 2413 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2414 if (debug) 2415 addlog(" [don't insist on auth " 2416 "for callout]"); 2417 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2418 break; 2419 } 2420 if (debug) 2421 addlog("[access denied]\n"); 2422 lcp.Close(sp); 2423 break; 2424 } 2425 } 2426 if (debug) 2427 addlog("\n"); 2428 drop: 2429 free(buf, M_TEMP); 2430 return; 2431 } 2432 2433 /* 2434 * Analyze the LCP Configure-NAK option list, and adjust our 2435 * negotiation. 2436 */ 2437 static void 2438 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2439 { 2440 STDDCL; 2441 u_char *buf, *p; 2442 u_int32_t magic; 2443 2444 len -= 4; 2445 buf = malloc (len, M_TEMP, M_NOWAIT); 2446 if (!buf) 2447 return; 2448 2449 if (debug) 2450 log(LOG_DEBUG, "%s: lcp nak opts:", 2451 ifp->if_xname); 2452 2453 p = (void *)(h + 1); 2454 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2455 /* Sanity check option length */ 2456 if (p[1] > len) { 2457 /* 2458 * Malicious option - drop immediately. 2459 * XXX Maybe we should just RXJ it? 2460 */ 2461 addlog("%s: received malicious LCP option, " 2462 "dropping.\n", ifp->if_xname); 2463 goto drop; 2464 } 2465 if (debug) 2466 addlog(" %s", sppp_lcp_opt_name(*p)); 2467 switch (*p) { 2468 case LCP_OPT_MAGIC: 2469 /* Magic number -- renegotiate */ 2470 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2471 len >= 6 && p[1] == 6) { 2472 magic = (u_int32_t)p[2] << 24 | 2473 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2474 /* 2475 * If the remote magic is our negated one, 2476 * this looks like a loopback problem. 2477 * Suggest a new magic to make sure. 2478 */ 2479 if (magic == ~sp->lcp.magic) { 2480 if (debug) 2481 addlog(" magic glitch"); 2482 sp->lcp.magic = arc4random(); 2483 } else { 2484 sp->lcp.magic = magic; 2485 if (debug) 2486 addlog(" %d", magic); 2487 } 2488 } 2489 break; 2490 case LCP_OPT_MRU: 2491 /* 2492 * Peer wants to advise us to negotiate an MRU. 2493 * Agree on it if it's reasonable, or use 2494 * default otherwise. 2495 */ 2496 if (len >= 4 && p[1] == 4) { 2497 u_int mru = p[2] * 256 + p[3]; 2498 if (debug) 2499 addlog(" %d", mru); 2500 if (mru < PP_MTU || mru > PP_MAX_MRU) 2501 mru = PP_MTU; 2502 sp->lcp.mru = mru; 2503 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2504 } 2505 break; 2506 case LCP_OPT_AUTH_PROTO: 2507 /* 2508 * Peer doesn't like our authentication method, 2509 * deny. 2510 */ 2511 if (debug) 2512 addlog("[access denied]\n"); 2513 lcp.Close(sp); 2514 break; 2515 } 2516 } 2517 if (debug) 2518 addlog("\n"); 2519 drop: 2520 free(buf, M_TEMP); 2521 return; 2522 } 2523 2524 static void 2525 sppp_lcp_tlu(struct sppp *sp) 2526 { 2527 STDDCL; 2528 int i; 2529 u_int32_t mask; 2530 2531 /* XXX ? */ 2532 if (! (ifp->if_flags & IFF_UP) && 2533 (ifp->if_flags & IFF_RUNNING)) { 2534 /* Coming out of loopback mode. */ 2535 if_up(ifp); 2536 } 2537 2538 for (i = 0; i < IDX_COUNT; i++) 2539 if ((cps[i])->flags & CP_QUAL) 2540 (cps[i])->Open(sp); 2541 2542 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2543 (sp->pp_flags & PP_NEEDAUTH) != 0) 2544 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2545 else 2546 sp->pp_phase = SPPP_PHASE_NETWORK; 2547 2548 if (debug) 2549 { 2550 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2551 sppp_phase_name(sp->pp_phase)); 2552 } 2553 2554 /* 2555 * Open all authentication protocols. This is even required 2556 * if we already proceeded to network phase, since it might be 2557 * that remote wants us to authenticate, so we might have to 2558 * send a PAP request. Undesired authentication protocols 2559 * don't do anything when they get an Open event. 2560 */ 2561 for (i = 0; i < IDX_COUNT; i++) 2562 if ((cps[i])->flags & CP_AUTH) 2563 (cps[i])->Open(sp); 2564 2565 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2566 /* Notify all NCPs. */ 2567 for (i = 0; i < IDX_COUNT; i++) 2568 if ((cps[i])->flags & CP_NCP) 2569 (cps[i])->Open(sp); 2570 } 2571 2572 /* Send Up events to all started protos. */ 2573 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2574 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2575 (cps[i])->Up(sp); 2576 2577 /* notify low-level driver of state change */ 2578 if (sp->pp_chg) 2579 sp->pp_chg(sp, (int)sp->pp_phase); 2580 2581 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2582 /* if no NCP is starting, close down */ 2583 sppp_lcp_check_and_close(sp); 2584 } 2585 2586 static void 2587 sppp_lcp_tld(struct sppp *sp) 2588 { 2589 STDDCL; 2590 int i; 2591 u_int32_t mask; 2592 2593 sp->pp_phase = SPPP_PHASE_TERMINATE; 2594 2595 if (debug) 2596 { 2597 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2598 sppp_phase_name(sp->pp_phase)); 2599 } 2600 2601 /* 2602 * Take upper layers down. We send the Down event first and 2603 * the Close second to prevent the upper layers from sending 2604 * ``a flurry of terminate-request packets'', as the RFC 2605 * describes it. 2606 */ 2607 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2608 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2609 (cps[i])->Down(sp); 2610 (cps[i])->Close(sp); 2611 } 2612 } 2613 2614 static void 2615 sppp_lcp_tls(struct sppp *sp) 2616 { 2617 STDDCL; 2618 2619 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2620 printf("%s: authentication failed %d times, not retrying again\n", 2621 sp->pp_if.if_xname, sp->pp_auth_failures); 2622 if_down(&sp->pp_if); 2623 return; 2624 } 2625 2626 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2627 2628 if (debug) 2629 { 2630 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2631 sppp_phase_name(sp->pp_phase)); 2632 } 2633 2634 /* Notify lower layer if desired. */ 2635 if (sp->pp_tls) 2636 (sp->pp_tls)(sp); 2637 } 2638 2639 static void 2640 sppp_lcp_tlf(struct sppp *sp) 2641 { 2642 STDDCL; 2643 2644 sp->pp_phase = SPPP_PHASE_DEAD; 2645 2646 if (debug) 2647 { 2648 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2649 sppp_phase_name(sp->pp_phase)); 2650 } 2651 2652 /* Notify lower layer if desired. */ 2653 if (sp->pp_tlf) 2654 (sp->pp_tlf)(sp); 2655 } 2656 2657 static void 2658 sppp_lcp_scr(struct sppp *sp) 2659 { 2660 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2661 int i = 0; 2662 u_short authproto; 2663 2664 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2665 if (! sp->lcp.magic) 2666 sp->lcp.magic = arc4random(); 2667 opt[i++] = LCP_OPT_MAGIC; 2668 opt[i++] = 6; 2669 opt[i++] = sp->lcp.magic >> 24; 2670 opt[i++] = sp->lcp.magic >> 16; 2671 opt[i++] = sp->lcp.magic >> 8; 2672 opt[i++] = sp->lcp.magic; 2673 } 2674 2675 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2676 opt[i++] = LCP_OPT_MRU; 2677 opt[i++] = 4; 2678 opt[i++] = sp->lcp.mru >> 8; 2679 opt[i++] = sp->lcp.mru; 2680 } 2681 2682 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2683 authproto = sp->hisauth.proto; 2684 opt[i++] = LCP_OPT_AUTH_PROTO; 2685 opt[i++] = authproto == PPP_CHAP? 5: 4; 2686 opt[i++] = authproto >> 8; 2687 opt[i++] = authproto; 2688 if (authproto == PPP_CHAP) 2689 opt[i++] = CHAP_MD5; 2690 } 2691 2692 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2693 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2694 } 2695 2696 /* 2697 * Check the open NCPs, return true if at least one NCP is open. 2698 */ 2699 static int 2700 sppp_ncp_check(struct sppp *sp) 2701 { 2702 int i, mask; 2703 2704 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2705 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2706 return 1; 2707 return 0; 2708 } 2709 2710 /* 2711 * Re-check the open NCPs and see if we should terminate the link. 2712 * Called by the NCPs during their tlf action handling. 2713 */ 2714 static void 2715 sppp_lcp_check_and_close(struct sppp *sp) 2716 { 2717 2718 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2719 /* don't bother, we are already going down */ 2720 return; 2721 2722 if (sppp_ncp_check(sp)) 2723 return; 2724 2725 lcp.Close(sp); 2726 } 2727 2728 2729 /* 2730 *--------------------------------------------------------------------------* 2731 * * 2732 * The IPCP implementation. * 2733 * * 2734 *--------------------------------------------------------------------------* 2735 */ 2736 2737 static void 2738 sppp_ipcp_init(struct sppp *sp) 2739 { 2740 sp->ipcp.opts = 0; 2741 sp->ipcp.flags = 0; 2742 sp->state[IDX_IPCP] = STATE_INITIAL; 2743 sp->fail_counter[IDX_IPCP] = 0; 2744 sp->pp_seq[IDX_IPCP] = 0; 2745 sp->pp_rseq[IDX_IPCP] = 0; 2746 callout_init(&sp->ch[IDX_IPCP]); 2747 } 2748 2749 static void 2750 sppp_ipcp_up(struct sppp *sp) 2751 { 2752 sppp_up_event(&ipcp, sp); 2753 } 2754 2755 static void 2756 sppp_ipcp_down(struct sppp *sp) 2757 { 2758 sppp_down_event(&ipcp, sp); 2759 } 2760 2761 static void 2762 sppp_ipcp_open(struct sppp *sp) 2763 { 2764 STDDCL; 2765 u_int32_t myaddr, hisaddr; 2766 2767 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2768 sp->ipcp.req_myaddr = 0; 2769 sp->ipcp.req_hisaddr = 0; 2770 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2771 2772 #ifdef INET 2773 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2774 #else 2775 myaddr = hisaddr = 0; 2776 #endif 2777 /* 2778 * If we don't have his address, this probably means our 2779 * interface doesn't want to talk IP at all. (This could 2780 * be the case if somebody wants to speak only IPX, for 2781 * example.) Don't open IPCP in this case. 2782 */ 2783 if (hisaddr == 0) { 2784 /* XXX this message should go away */ 2785 if (debug) 2786 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 2787 ifp->if_xname); 2788 return; 2789 } 2790 2791 if (myaddr == 0) { 2792 /* 2793 * I don't have an assigned address, so i need to 2794 * negotiate my address. 2795 */ 2796 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2797 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2798 } 2799 if (hisaddr == 1) { 2800 /* 2801 * XXX - remove this hack! 2802 * remote has no valid address, we need to get one assigned. 2803 */ 2804 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2805 } 2806 sppp_open_event(&ipcp, sp); 2807 } 2808 2809 static void 2810 sppp_ipcp_close(struct sppp *sp) 2811 { 2812 STDDCL; 2813 2814 sppp_close_event(&ipcp, sp); 2815 #ifdef INET 2816 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2817 /* 2818 * Some address was dynamic, clear it again. 2819 */ 2820 sppp_clear_ip_addrs(sp); 2821 #endif 2822 2823 if (sp->pp_saved_mtu > 0) { 2824 ifp->if_mtu = sp->pp_saved_mtu; 2825 sp->pp_saved_mtu = 0; 2826 if (debug) 2827 log(LOG_DEBUG, 2828 "%s: resetting MTU to %" PRIu64 " bytes\n", 2829 ifp->if_xname, ifp->if_mtu); 2830 } 2831 } 2832 2833 static void 2834 sppp_ipcp_TO(void *cookie) 2835 { 2836 sppp_to_event(&ipcp, (struct sppp *)cookie); 2837 } 2838 2839 /* 2840 * Analyze a configure request. Return true if it was agreeable, and 2841 * caused action sca, false if it has been rejected or nak'ed, and 2842 * caused action scn. (The return value is used to make the state 2843 * transition decision in the state automaton.) 2844 */ 2845 static int 2846 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2847 { 2848 u_char *buf, *r, *p; 2849 struct ifnet *ifp = &sp->pp_if; 2850 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2851 u_int32_t hisaddr, desiredaddr; 2852 2853 len -= 4; 2854 origlen = len; 2855 /* 2856 * Make sure to allocate a buf that can at least hold a 2857 * conf-nak with an `address' option. We might need it below. 2858 */ 2859 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2860 if (! buf) 2861 return (0); 2862 2863 /* pass 1: see if we can recognize them */ 2864 if (debug) 2865 log(LOG_DEBUG, "%s: ipcp parse opts:", 2866 ifp->if_xname); 2867 p = (void *)(h + 1); 2868 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2869 /* Sanity check option length */ 2870 if (p[1] > len) { 2871 /* XXX should we just RXJ? */ 2872 addlog("%s: malicious IPCP option received, dropping\n", 2873 ifp->if_xname); 2874 goto drop; 2875 } 2876 if (debug) 2877 addlog(" %s", sppp_ipcp_opt_name(*p)); 2878 switch (*p) { 2879 #ifdef notyet 2880 case IPCP_OPT_COMPRESSION: 2881 if (len >= 6 && p[1] >= 6) { 2882 /* correctly formed compress option */ 2883 continue; 2884 } 2885 if (debug) 2886 addlog(" [invalid]"); 2887 break; 2888 #endif 2889 case IPCP_OPT_ADDRESS: 2890 if (len >= 6 && p[1] == 6) { 2891 /* correctly formed address option */ 2892 continue; 2893 } 2894 if (debug) 2895 addlog(" [invalid]"); 2896 break; 2897 default: 2898 /* Others not supported. */ 2899 if (debug) 2900 addlog(" [rej]"); 2901 break; 2902 } 2903 /* Add the option to rejected list. */ 2904 bcopy (p, r, p[1]); 2905 r += p[1]; 2906 rlen += p[1]; 2907 } 2908 if (rlen) { 2909 if (debug) 2910 addlog(" send conf-rej\n"); 2911 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2912 goto end; 2913 } else if (debug) 2914 addlog("\n"); 2915 2916 /* pass 2: parse option values */ 2917 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2918 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2919 else 2920 #ifdef INET 2921 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2922 #else 2923 hisaddr = 0; 2924 #endif 2925 if (debug) 2926 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 2927 ifp->if_xname); 2928 p = (void *)(h + 1); 2929 len = origlen; 2930 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2931 if (debug) 2932 addlog(" %s", sppp_ipcp_opt_name(*p)); 2933 switch (*p) { 2934 #ifdef notyet 2935 case IPCP_OPT_COMPRESSION: 2936 continue; 2937 #endif 2938 case IPCP_OPT_ADDRESS: 2939 desiredaddr = p[2] << 24 | p[3] << 16 | 2940 p[4] << 8 | p[5]; 2941 if (desiredaddr == hisaddr || 2942 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2943 /* 2944 * Peer's address is same as our value, 2945 * this is agreeable. Gonna conf-ack 2946 * it. 2947 */ 2948 if (debug) 2949 addlog(" %s [ack]", 2950 sppp_dotted_quad(hisaddr)); 2951 /* record that we've seen it already */ 2952 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2953 sp->ipcp.req_hisaddr = desiredaddr; 2954 hisaddr = desiredaddr; 2955 continue; 2956 } 2957 /* 2958 * The address wasn't agreeable. This is either 2959 * he sent us 0.0.0.0, asking to assign him an 2960 * address, or he send us another address not 2961 * matching our value. Either case, we gonna 2962 * conf-nak it with our value. 2963 */ 2964 if (debug) { 2965 if (desiredaddr == 0) 2966 addlog(" [addr requested]"); 2967 else 2968 addlog(" %s [not agreed]", 2969 sppp_dotted_quad(desiredaddr)); 2970 } 2971 2972 p[2] = hisaddr >> 24; 2973 p[3] = hisaddr >> 16; 2974 p[4] = hisaddr >> 8; 2975 p[5] = hisaddr; 2976 break; 2977 } 2978 /* Add the option to nak'ed list. */ 2979 bcopy (p, r, p[1]); 2980 r += p[1]; 2981 rlen += p[1]; 2982 } 2983 2984 /* 2985 * If we are about to conf-ack the request, but haven't seen 2986 * his address so far, gonna conf-nak it instead, with the 2987 * `address' option present and our idea of his address being 2988 * filled in there, to request negotiation of both addresses. 2989 * 2990 * XXX This can result in an endless req - nak loop if peer 2991 * doesn't want to send us his address. Q: What should we do 2992 * about it? XXX A: implement the max-failure counter. 2993 */ 2994 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2995 buf[0] = IPCP_OPT_ADDRESS; 2996 buf[1] = 6; 2997 buf[2] = hisaddr >> 24; 2998 buf[3] = hisaddr >> 16; 2999 buf[4] = hisaddr >> 8; 3000 buf[5] = hisaddr; 3001 rlen = 6; 3002 if (debug) 3003 addlog(" still need hisaddr"); 3004 } 3005 3006 if (rlen) { 3007 if (debug) 3008 addlog(" send conf-nak\n"); 3009 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 3010 } else { 3011 if (debug) 3012 addlog(" send conf-ack\n"); 3013 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 3014 } 3015 3016 end: 3017 free(buf, M_TEMP); 3018 return (rlen == 0); 3019 3020 drop: 3021 free(buf, M_TEMP); 3022 return -1; 3023 } 3024 3025 /* 3026 * Analyze the IPCP Configure-Reject option list, and adjust our 3027 * negotiation. 3028 */ 3029 static void 3030 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3031 { 3032 u_char *buf, *p; 3033 struct ifnet *ifp = &sp->pp_if; 3034 int debug = ifp->if_flags & IFF_DEBUG; 3035 3036 len -= 4; 3037 buf = malloc (len, M_TEMP, M_NOWAIT); 3038 if (!buf) 3039 return; 3040 3041 if (debug) 3042 log(LOG_DEBUG, "%s: ipcp rej opts:", 3043 ifp->if_xname); 3044 3045 p = (void *)(h + 1); 3046 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3047 /* Sanity check option length */ 3048 if (p[1] > len) { 3049 /* XXX should we just RXJ? */ 3050 addlog("%s: malicious IPCP option received, dropping\n", 3051 ifp->if_xname); 3052 goto drop; 3053 } 3054 if (debug) 3055 addlog(" %s", sppp_ipcp_opt_name(*p)); 3056 switch (*p) { 3057 case IPCP_OPT_ADDRESS: 3058 /* 3059 * Peer doesn't grok address option. This is 3060 * bad. XXX Should we better give up here? 3061 */ 3062 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3063 break; 3064 #ifdef notyet 3065 case IPCP_OPT_COMPRESS: 3066 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3067 break; 3068 #endif 3069 } 3070 } 3071 if (debug) 3072 addlog("\n"); 3073 drop: 3074 free(buf, M_TEMP); 3075 return; 3076 } 3077 3078 /* 3079 * Analyze the IPCP Configure-NAK option list, and adjust our 3080 * negotiation. 3081 */ 3082 static void 3083 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3084 { 3085 u_char *p; 3086 struct ifnet *ifp = &sp->pp_if; 3087 int debug = ifp->if_flags & IFF_DEBUG; 3088 u_int32_t wantaddr; 3089 3090 len -= 4; 3091 3092 if (debug) 3093 log(LOG_DEBUG, "%s: ipcp nak opts:", 3094 ifp->if_xname); 3095 3096 p = (void *)(h + 1); 3097 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3098 /* Sanity check option length */ 3099 if (p[1] > len) { 3100 /* XXX should we just RXJ? */ 3101 addlog("%s: malicious IPCP option received, dropping\n", 3102 ifp->if_xname); 3103 return; 3104 } 3105 if (debug) 3106 addlog(" %s", sppp_ipcp_opt_name(*p)); 3107 switch (*p) { 3108 case IPCP_OPT_ADDRESS: 3109 /* 3110 * Peer doesn't like our local IP address. See 3111 * if we can do something for him. We'll drop 3112 * him our address then. 3113 */ 3114 if (len >= 6 && p[1] == 6) { 3115 wantaddr = p[2] << 24 | p[3] << 16 | 3116 p[4] << 8 | p[5]; 3117 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3118 if (debug) 3119 addlog(" [wantaddr %s]", 3120 sppp_dotted_quad(wantaddr)); 3121 /* 3122 * When doing dynamic address assignment, 3123 * we accept his offer. Otherwise, we 3124 * ignore it and thus continue to negotiate 3125 * our already existing value. 3126 */ 3127 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3128 if (debug) 3129 addlog(" [agree]"); 3130 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3131 sp->ipcp.req_myaddr = wantaddr; 3132 } 3133 } 3134 break; 3135 3136 case IPCP_OPT_PRIMDNS: 3137 if (len >= 6 && p[1] == 6) { 3138 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3139 p[4] << 8 | p[5]; 3140 } 3141 break; 3142 3143 case IPCP_OPT_SECDNS: 3144 if (len >= 6 && p[1] == 6) { 3145 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3146 p[4] << 8 | p[5]; 3147 } 3148 break; 3149 #ifdef notyet 3150 case IPCP_OPT_COMPRESS: 3151 /* 3152 * Peer wants different compression parameters. 3153 */ 3154 break; 3155 #endif 3156 } 3157 } 3158 if (debug) 3159 addlog("\n"); 3160 } 3161 3162 static void 3163 sppp_ipcp_tlu(struct sppp *sp) 3164 { 3165 #ifdef INET 3166 /* we are up. Set addresses and notify anyone interested */ 3167 STDDCL; 3168 u_int32_t myaddr, hisaddr; 3169 3170 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3171 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3172 myaddr = sp->ipcp.req_myaddr; 3173 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3174 hisaddr = sp->ipcp.req_hisaddr; 3175 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3176 3177 if (ifp->if_mtu > sp->lcp.their_mru) { 3178 sp->pp_saved_mtu = ifp->if_mtu; 3179 ifp->if_mtu = sp->lcp.their_mru; 3180 if (debug) 3181 log(LOG_DEBUG, 3182 "%s: setting MTU to %" PRIu64 " bytes\n", 3183 ifp->if_xname, ifp->if_mtu); 3184 } 3185 3186 if (sp->pp_con) 3187 sp->pp_con(sp); 3188 #endif 3189 } 3190 3191 static void 3192 sppp_ipcp_tld(struct sppp *sp) 3193 { 3194 } 3195 3196 static void 3197 sppp_ipcp_tls(struct sppp *sp) 3198 { 3199 /* indicate to LCP that it must stay alive */ 3200 sp->lcp.protos |= (1 << IDX_IPCP); 3201 } 3202 3203 static void 3204 sppp_ipcp_tlf(struct sppp *sp) 3205 { 3206 /* we no longer need LCP */ 3207 sp->lcp.protos &= ~(1 << IDX_IPCP); 3208 } 3209 3210 static void 3211 sppp_ipcp_scr(struct sppp *sp) 3212 { 3213 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3214 #ifdef INET 3215 u_int32_t ouraddr; 3216 #endif 3217 int i = 0; 3218 3219 #ifdef notyet 3220 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3221 opt[i++] = IPCP_OPT_COMPRESSION; 3222 opt[i++] = 6; 3223 opt[i++] = 0; /* VJ header compression */ 3224 opt[i++] = 0x2d; /* VJ header compression */ 3225 opt[i++] = max_slot_id; 3226 opt[i++] = comp_slot_id; 3227 } 3228 #endif 3229 3230 #ifdef INET 3231 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3232 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3233 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3234 else 3235 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3236 opt[i++] = IPCP_OPT_ADDRESS; 3237 opt[i++] = 6; 3238 opt[i++] = ouraddr >> 24; 3239 opt[i++] = ouraddr >> 16; 3240 opt[i++] = ouraddr >> 8; 3241 opt[i++] = ouraddr; 3242 } 3243 #endif 3244 3245 if (sp->query_dns & 1) { 3246 opt[i++] = IPCP_OPT_PRIMDNS; 3247 opt[i++] = 6; 3248 opt[i++] = sp->dns_addrs[0] >> 24; 3249 opt[i++] = sp->dns_addrs[0] >> 16; 3250 opt[i++] = sp->dns_addrs[0] >> 8; 3251 opt[i++] = sp->dns_addrs[0]; 3252 } 3253 if (sp->query_dns & 2) { 3254 opt[i++] = IPCP_OPT_SECDNS; 3255 opt[i++] = 6; 3256 opt[i++] = sp->dns_addrs[1] >> 24; 3257 opt[i++] = sp->dns_addrs[1] >> 16; 3258 opt[i++] = sp->dns_addrs[1] >> 8; 3259 opt[i++] = sp->dns_addrs[1]; 3260 } 3261 3262 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3263 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3264 } 3265 3266 3267 /* 3268 *--------------------------------------------------------------------------* 3269 * * 3270 * The IPv6CP implementation. * 3271 * * 3272 *--------------------------------------------------------------------------* 3273 */ 3274 3275 #ifdef INET6 3276 static void 3277 sppp_ipv6cp_init(struct sppp *sp) 3278 { 3279 sp->ipv6cp.opts = 0; 3280 sp->ipv6cp.flags = 0; 3281 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3282 sp->fail_counter[IDX_IPV6CP] = 0; 3283 sp->pp_seq[IDX_IPV6CP] = 0; 3284 sp->pp_rseq[IDX_IPV6CP] = 0; 3285 callout_init(&sp->ch[IDX_IPV6CP]); 3286 } 3287 3288 static void 3289 sppp_ipv6cp_up(struct sppp *sp) 3290 { 3291 sppp_up_event(&ipv6cp, sp); 3292 } 3293 3294 static void 3295 sppp_ipv6cp_down(struct sppp *sp) 3296 { 3297 sppp_down_event(&ipv6cp, sp); 3298 } 3299 3300 static void 3301 sppp_ipv6cp_open(struct sppp *sp) 3302 { 3303 STDDCL; 3304 struct in6_addr myaddr, hisaddr; 3305 3306 #ifdef IPV6CP_MYIFID_DYN 3307 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3308 #else 3309 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3310 #endif 3311 3312 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3313 /* 3314 * If we don't have our address, this probably means our 3315 * interface doesn't want to talk IPv6 at all. (This could 3316 * be the case if somebody wants to speak only IPX, for 3317 * example.) Don't open IPv6CP in this case. 3318 */ 3319 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3320 /* XXX this message should go away */ 3321 if (debug) 3322 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3323 ifp->if_xname); 3324 return; 3325 } 3326 3327 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3328 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3329 sppp_open_event(&ipv6cp, sp); 3330 } 3331 3332 static void 3333 sppp_ipv6cp_close(struct sppp *sp) 3334 { 3335 sppp_close_event(&ipv6cp, sp); 3336 } 3337 3338 static void 3339 sppp_ipv6cp_TO(void *cookie) 3340 { 3341 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3342 } 3343 3344 /* 3345 * Analyze a configure request. Return true if it was agreeable, and 3346 * caused action sca, false if it has been rejected or nak'ed, and 3347 * caused action scn. (The return value is used to make the state 3348 * transition decision in the state automaton.) 3349 */ 3350 static int 3351 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3352 { 3353 u_char *buf, *r, *p; 3354 struct ifnet *ifp = &sp->pp_if; 3355 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3356 struct in6_addr myaddr, desiredaddr, suggestaddr; 3357 int ifidcount; 3358 int type; 3359 int collision, nohisaddr; 3360 3361 len -= 4; 3362 origlen = len; 3363 /* 3364 * Make sure to allocate a buf that can at least hold a 3365 * conf-nak with an `address' option. We might need it below. 3366 */ 3367 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3368 if (! buf) 3369 return (0); 3370 3371 /* pass 1: see if we can recognize them */ 3372 if (debug) 3373 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3374 ifp->if_xname); 3375 p = (void *)(h + 1); 3376 ifidcount = 0; 3377 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3378 /* Sanity check option length */ 3379 if (p[1] > len) { 3380 /* XXX just RXJ? */ 3381 addlog("%s: received malicious IPCPv6 option, " 3382 "dropping\n", ifp->if_xname); 3383 goto drop; 3384 } 3385 if (debug) 3386 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3387 switch (*p) { 3388 case IPV6CP_OPT_IFID: 3389 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3390 /* correctly formed address option */ 3391 ifidcount++; 3392 continue; 3393 } 3394 if (debug) 3395 addlog(" [invalid]"); 3396 break; 3397 #ifdef notyet 3398 case IPV6CP_OPT_COMPRESSION: 3399 if (len >= 4 && p[1] >= 4) { 3400 /* correctly formed compress option */ 3401 continue; 3402 } 3403 if (debug) 3404 addlog(" [invalid]"); 3405 break; 3406 #endif 3407 default: 3408 /* Others not supported. */ 3409 if (debug) 3410 addlog(" [rej]"); 3411 break; 3412 } 3413 /* Add the option to rejected list. */ 3414 bcopy (p, r, p[1]); 3415 r += p[1]; 3416 rlen += p[1]; 3417 } 3418 if (rlen) { 3419 if (debug) 3420 addlog(" send conf-rej\n"); 3421 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3422 goto end; 3423 } else if (debug) 3424 addlog("\n"); 3425 3426 /* pass 2: parse option values */ 3427 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3428 if (debug) 3429 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3430 ifp->if_xname); 3431 p = (void *)(h + 1); 3432 len = origlen; 3433 type = CONF_ACK; 3434 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3435 if (debug) 3436 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3437 switch (*p) { 3438 #ifdef notyet 3439 case IPV6CP_OPT_COMPRESSION: 3440 continue; 3441 #endif 3442 case IPV6CP_OPT_IFID: 3443 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3444 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3445 collision = (memcmp(&desiredaddr.s6_addr[8], 3446 &myaddr.s6_addr[8], 8) == 0); 3447 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3448 3449 desiredaddr.s6_addr16[0] = htons(0xfe80); 3450 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 3451 3452 if (!collision && !nohisaddr) { 3453 /* no collision, hisaddr known - Conf-Ack */ 3454 type = CONF_ACK; 3455 3456 if (debug) { 3457 addlog(" %s [%s]", 3458 ip6_sprintf(&desiredaddr), 3459 sppp_cp_type_name(type)); 3460 } 3461 continue; 3462 } 3463 3464 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3465 if (collision && nohisaddr) { 3466 /* collision, hisaddr unknown - Conf-Rej */ 3467 type = CONF_REJ; 3468 memset(&p[2], 0, 8); 3469 } else { 3470 /* 3471 * - no collision, hisaddr unknown, or 3472 * - collision, hisaddr known 3473 * Conf-Nak, suggest hisaddr 3474 */ 3475 type = CONF_NAK; 3476 sppp_suggest_ip6_addr(sp, &suggestaddr); 3477 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3478 } 3479 if (debug) 3480 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3481 sppp_cp_type_name(type)); 3482 break; 3483 } 3484 /* Add the option to nak'ed list. */ 3485 bcopy (p, r, p[1]); 3486 r += p[1]; 3487 rlen += p[1]; 3488 } 3489 3490 if (rlen == 0 && type == CONF_ACK) { 3491 if (debug) 3492 addlog(" send %s\n", sppp_cp_type_name(type)); 3493 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3494 } else { 3495 #ifdef notdef 3496 if (type == CONF_ACK) 3497 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3498 #endif 3499 3500 if (debug) { 3501 addlog(" send %s suggest %s\n", 3502 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3503 } 3504 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3505 } 3506 3507 end: 3508 free(buf, M_TEMP); 3509 return (rlen == 0); 3510 3511 drop: 3512 free(buf, M_TEMP); 3513 return -1; 3514 } 3515 3516 /* 3517 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3518 * negotiation. 3519 */ 3520 static void 3521 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3522 { 3523 u_char *buf, *p; 3524 struct ifnet *ifp = &sp->pp_if; 3525 int debug = ifp->if_flags & IFF_DEBUG; 3526 3527 len -= 4; 3528 buf = malloc (len, M_TEMP, M_NOWAIT); 3529 if (!buf) 3530 return; 3531 3532 if (debug) 3533 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3534 ifp->if_xname); 3535 3536 p = (void *)(h + 1); 3537 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3538 if (p[1] > len) { 3539 /* XXX just RXJ? */ 3540 addlog("%s: received malicious IPCPv6 option, " 3541 "dropping\n", ifp->if_xname); 3542 goto drop; 3543 } 3544 if (debug) 3545 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3546 switch (*p) { 3547 case IPV6CP_OPT_IFID: 3548 /* 3549 * Peer doesn't grok address option. This is 3550 * bad. XXX Should we better give up here? 3551 */ 3552 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3553 break; 3554 #ifdef notyet 3555 case IPV6CP_OPT_COMPRESS: 3556 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3557 break; 3558 #endif 3559 } 3560 } 3561 if (debug) 3562 addlog("\n"); 3563 drop: 3564 free(buf, M_TEMP); 3565 return; 3566 } 3567 3568 /* 3569 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3570 * negotiation. 3571 */ 3572 static void 3573 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3574 { 3575 u_char *buf, *p; 3576 struct ifnet *ifp = &sp->pp_if; 3577 int debug = ifp->if_flags & IFF_DEBUG; 3578 struct in6_addr suggestaddr; 3579 3580 len -= 4; 3581 buf = malloc (len, M_TEMP, M_NOWAIT); 3582 if (!buf) 3583 return; 3584 3585 if (debug) 3586 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 3587 ifp->if_xname); 3588 3589 p = (void *)(h + 1); 3590 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3591 if (p[1] > len) { 3592 /* XXX just RXJ? */ 3593 addlog("%s: received malicious IPCPv6 option, " 3594 "dropping\n", ifp->if_xname); 3595 goto drop; 3596 } 3597 if (debug) 3598 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3599 switch (*p) { 3600 case IPV6CP_OPT_IFID: 3601 /* 3602 * Peer doesn't like our local ifid. See 3603 * if we can do something for him. We'll drop 3604 * him our address then. 3605 */ 3606 if (len < 10 || p[1] != 10) 3607 break; 3608 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3609 suggestaddr.s6_addr16[0] = htons(0xfe80); 3610 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 3611 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3612 3613 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3614 if (debug) 3615 addlog(" [suggestaddr %s]", 3616 ip6_sprintf(&suggestaddr)); 3617 #ifdef IPV6CP_MYIFID_DYN 3618 /* 3619 * When doing dynamic address assignment, 3620 * we accept his offer. 3621 */ 3622 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3623 struct in6_addr lastsuggest; 3624 /* 3625 * If <suggested myaddr from peer> equals to 3626 * <hisaddr we have suggested last time>, 3627 * we have a collision. generate new random 3628 * ifid. 3629 */ 3630 sppp_suggest_ip6_addr(&lastsuggest); 3631 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3632 lastsuggest)) { 3633 if (debug) 3634 addlog(" [random]"); 3635 sppp_gen_ip6_addr(sp, &suggestaddr); 3636 } 3637 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3638 if (debug) 3639 addlog(" [agree]"); 3640 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3641 } 3642 #else 3643 /* 3644 * Since we do not do dynamic address assignment, 3645 * we ignore it and thus continue to negotiate 3646 * our already existing value. This can possibly 3647 * go into infinite request-reject loop. 3648 * 3649 * This is not likely because we normally use 3650 * ifid based on MAC-address. 3651 * If you have no ethernet card on the node, too bad. 3652 * XXX should we use fail_counter? 3653 */ 3654 #endif 3655 break; 3656 #ifdef notyet 3657 case IPV6CP_OPT_COMPRESS: 3658 /* 3659 * Peer wants different compression parameters. 3660 */ 3661 break; 3662 #endif 3663 } 3664 } 3665 if (debug) 3666 addlog("\n"); 3667 drop: 3668 free(buf, M_TEMP); 3669 return; 3670 } 3671 3672 static void 3673 sppp_ipv6cp_tlu(struct sppp *sp) 3674 { 3675 /* we are up - notify isdn daemon */ 3676 if (sp->pp_con) 3677 sp->pp_con(sp); 3678 } 3679 3680 static void 3681 sppp_ipv6cp_tld(struct sppp *sp) 3682 { 3683 } 3684 3685 static void 3686 sppp_ipv6cp_tls(struct sppp *sp) 3687 { 3688 /* indicate to LCP that it must stay alive */ 3689 sp->lcp.protos |= (1 << IDX_IPV6CP); 3690 } 3691 3692 static void 3693 sppp_ipv6cp_tlf(struct sppp *sp) 3694 { 3695 /* we no longer need LCP */ 3696 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3697 } 3698 3699 static void 3700 sppp_ipv6cp_scr(struct sppp *sp) 3701 { 3702 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3703 struct in6_addr ouraddr; 3704 int i = 0; 3705 3706 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3707 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3708 opt[i++] = IPV6CP_OPT_IFID; 3709 opt[i++] = 10; 3710 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3711 i += 8; 3712 } 3713 3714 #ifdef notyet 3715 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3716 opt[i++] = IPV6CP_OPT_COMPRESSION; 3717 opt[i++] = 4; 3718 opt[i++] = 0; /* TBD */ 3719 opt[i++] = 0; /* TBD */ 3720 /* variable length data may follow */ 3721 } 3722 #endif 3723 3724 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3725 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3726 } 3727 #else /*INET6*/ 3728 static void 3729 sppp_ipv6cp_init(struct sppp *sp) 3730 { 3731 } 3732 3733 static void 3734 sppp_ipv6cp_up(struct sppp *sp) 3735 { 3736 } 3737 3738 static void 3739 sppp_ipv6cp_down(struct sppp *sp) 3740 { 3741 } 3742 3743 static void 3744 sppp_ipv6cp_open(struct sppp *sp) 3745 { 3746 } 3747 3748 static void 3749 sppp_ipv6cp_close(struct sppp *sp) 3750 { 3751 } 3752 3753 static void 3754 sppp_ipv6cp_TO(void *sp) 3755 { 3756 } 3757 3758 static int 3759 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 3760 int len) 3761 { 3762 return 0; 3763 } 3764 3765 static void 3766 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 3767 int len) 3768 { 3769 } 3770 3771 static void 3772 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 3773 int len) 3774 { 3775 } 3776 3777 static void 3778 sppp_ipv6cp_tlu(struct sppp *sp) 3779 { 3780 } 3781 3782 static void 3783 sppp_ipv6cp_tld(struct sppp *sp) 3784 { 3785 } 3786 3787 static void 3788 sppp_ipv6cp_tls(struct sppp *sp) 3789 { 3790 } 3791 3792 static void 3793 sppp_ipv6cp_tlf(struct sppp *sp) 3794 { 3795 } 3796 3797 static void 3798 sppp_ipv6cp_scr(struct sppp *sp) 3799 { 3800 } 3801 #endif /*INET6*/ 3802 3803 3804 /* 3805 *--------------------------------------------------------------------------* 3806 * * 3807 * The CHAP implementation. * 3808 * * 3809 *--------------------------------------------------------------------------* 3810 */ 3811 3812 /* 3813 * The authentication protocols don't employ a full-fledged state machine as 3814 * the control protocols do, since they do have Open and Close events, but 3815 * not Up and Down, nor are they explicitly terminated. Also, use of the 3816 * authentication protocols may be different in both directions (this makes 3817 * sense, think of a machine that never accepts incoming calls but only 3818 * calls out, it doesn't require the called party to authenticate itself). 3819 * 3820 * Our state machine for the local authentication protocol (we are requesting 3821 * the peer to authenticate) looks like: 3822 * 3823 * RCA- 3824 * +--------------------------------------------+ 3825 * V scn,tld| 3826 * +--------+ Close +---------+ RCA+ 3827 * | |<----------------------------------| |------+ 3828 * +--->| Closed | TO* | Opened | sca | 3829 * | | |-----+ +-------| |<-----+ 3830 * | +--------+ irc | | +---------+ 3831 * | ^ | | ^ 3832 * | | | | | 3833 * | | | | | 3834 * | TO-| | | | 3835 * | |tld TO+ V | | 3836 * | | +------->+ | | 3837 * | | | | | | 3838 * | +--------+ V | | 3839 * | | |<----+<--------------------+ | 3840 * | | Req- | scr | 3841 * | | Sent | | 3842 * | | | | 3843 * | +--------+ | 3844 * | RCA- | | RCA+ | 3845 * +------+ +------------------------------------------+ 3846 * scn,tld sca,irc,ict,tlu 3847 * 3848 * 3849 * with: 3850 * 3851 * Open: LCP reached authentication phase 3852 * Close: LCP reached terminate phase 3853 * 3854 * RCA+: received reply (pap-req, chap-response), acceptable 3855 * RCN: received reply (pap-req, chap-response), not acceptable 3856 * TO+: timeout with restart counter >= 0 3857 * TO-: timeout with restart counter < 0 3858 * TO*: reschedule timeout for CHAP 3859 * 3860 * scr: send request packet (none for PAP, chap-challenge) 3861 * sca: send ack packet (pap-ack, chap-success) 3862 * scn: send nak packet (pap-nak, chap-failure) 3863 * ict: initialize re-challenge timer (CHAP only) 3864 * 3865 * tlu: this-layer-up, LCP reaches network phase 3866 * tld: this-layer-down, LCP enters terminate phase 3867 * 3868 * Note that in CHAP mode, after sending a new challenge, while the state 3869 * automaton falls back into Req-Sent state, it doesn't signal a tld 3870 * event to LCP, so LCP remains in network phase. Only after not getting 3871 * any response (or after getting an unacceptable response), CHAP closes, 3872 * causing LCP to enter terminate phase. 3873 * 3874 * With PAP, there is no initial request that can be sent. The peer is 3875 * expected to send one based on the successful negotiation of PAP as 3876 * the authentication protocol during the LCP option negotiation. 3877 * 3878 * Incoming authentication protocol requests (remote requests 3879 * authentication, we are peer) don't employ a state machine at all, 3880 * they are simply answered. Some peers [Ascend P50 firmware rev 3881 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3882 * still in authentication phase (thereby violating the standard that 3883 * demands that these NCP packets are to be discarded), so we keep 3884 * track of the peer demanding us to authenticate, and only proceed to 3885 * phase network once we've seen a positive acknowledge for the 3886 * authentication. 3887 */ 3888 3889 /* 3890 * Handle incoming CHAP packets. 3891 */ 3892 void 3893 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3894 { 3895 STDDCL; 3896 struct lcp_header *h; 3897 int len, x; 3898 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3899 int value_len, name_len; 3900 MD5_CTX ctx; 3901 3902 len = m->m_pkthdr.len; 3903 if (len < 4) { 3904 if (debug) 3905 log(LOG_DEBUG, 3906 "%s: chap invalid packet length: %d bytes\n", 3907 ifp->if_xname, len); 3908 return; 3909 } 3910 h = mtod(m, struct lcp_header *); 3911 if (len > ntohs(h->len)) 3912 len = ntohs(h->len); 3913 3914 switch (h->type) { 3915 /* challenge, failure and success are his authproto */ 3916 case CHAP_CHALLENGE: 3917 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3918 /* can't do anything usefull */ 3919 sp->pp_auth_failures++; 3920 printf("%s: chap input without my name and my secret being set\n", 3921 ifp->if_xname); 3922 break; 3923 } 3924 value = 1 + (u_char *)(h + 1); 3925 value_len = value[-1]; 3926 name = value + value_len; 3927 name_len = len - value_len - 5; 3928 if (name_len < 0) { 3929 if (debug) { 3930 log(LOG_DEBUG, 3931 "%s: chap corrupted challenge " 3932 "<%s id=0x%x len=%d", 3933 ifp->if_xname, 3934 sppp_auth_type_name(PPP_CHAP, h->type), 3935 h->ident, ntohs(h->len)); 3936 if (len > 4) 3937 sppp_print_bytes((u_char *)(h + 1), 3938 len - 4); 3939 addlog(">\n"); 3940 } 3941 break; 3942 } 3943 3944 if (debug) { 3945 log(LOG_DEBUG, 3946 "%s: chap input <%s id=0x%x len=%d name=", 3947 ifp->if_xname, 3948 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3949 ntohs(h->len)); 3950 sppp_print_string((char *) name, name_len); 3951 addlog(" value-size=%d value=", value_len); 3952 sppp_print_bytes(value, value_len); 3953 addlog(">\n"); 3954 } 3955 3956 /* Compute reply value. */ 3957 MD5Init(&ctx); 3958 MD5Update(&ctx, &h->ident, 1); 3959 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3960 MD5Update(&ctx, value, value_len); 3961 MD5Final(digest, &ctx); 3962 dsize = sizeof digest; 3963 3964 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3965 sizeof dsize, (const char *)&dsize, 3966 sizeof digest, digest, 3967 sp->myauth.name_len, 3968 sp->myauth.name, 3969 0); 3970 break; 3971 3972 case CHAP_SUCCESS: 3973 if (debug) { 3974 log(LOG_DEBUG, "%s: chap success", 3975 ifp->if_xname); 3976 if (len > 4) { 3977 addlog(": "); 3978 sppp_print_string((char *)(h + 1), len - 4); 3979 } 3980 addlog("\n"); 3981 } 3982 x = splnet(); 3983 sp->pp_auth_failures = 0; 3984 sp->pp_flags &= ~PP_NEEDAUTH; 3985 if (sp->myauth.proto == PPP_CHAP && 3986 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3987 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3988 /* 3989 * We are authenticator for CHAP but didn't 3990 * complete yet. Leave it to tlu to proceed 3991 * to network phase. 3992 */ 3993 splx(x); 3994 break; 3995 } 3996 splx(x); 3997 sppp_phase_network(sp); 3998 break; 3999 4000 case CHAP_FAILURE: 4001 x = splnet(); 4002 sp->pp_auth_failures++; 4003 splx(x); 4004 if (debug) { 4005 log(LOG_INFO, "%s: chap failure", 4006 ifp->if_xname); 4007 if (len > 4) { 4008 addlog(": "); 4009 sppp_print_string((char *)(h + 1), len - 4); 4010 } 4011 addlog("\n"); 4012 } else 4013 log(LOG_INFO, "%s: chap failure\n", 4014 ifp->if_xname); 4015 /* await LCP shutdown by authenticator */ 4016 break; 4017 4018 /* response is my authproto */ 4019 case CHAP_RESPONSE: 4020 if (sp->hisauth.secret == NULL) { 4021 /* can't do anything usefull */ 4022 printf("%s: chap input without his secret being set\n", 4023 ifp->if_xname); 4024 break; 4025 } 4026 value = 1 + (u_char *)(h + 1); 4027 value_len = value[-1]; 4028 name = value + value_len; 4029 name_len = len - value_len - 5; 4030 if (name_len < 0) { 4031 if (debug) { 4032 log(LOG_DEBUG, 4033 "%s: chap corrupted response " 4034 "<%s id=0x%x len=%d", 4035 ifp->if_xname, 4036 sppp_auth_type_name(PPP_CHAP, h->type), 4037 h->ident, ntohs(h->len)); 4038 if (len > 4) 4039 sppp_print_bytes((u_char *)(h + 1), 4040 len - 4); 4041 addlog(">\n"); 4042 } 4043 break; 4044 } 4045 if (h->ident != sp->confid[IDX_CHAP]) { 4046 if (debug) 4047 log(LOG_DEBUG, 4048 "%s: chap dropping response for old ID " 4049 "(got %d, expected %d)\n", 4050 ifp->if_xname, 4051 h->ident, sp->confid[IDX_CHAP]); 4052 break; 4053 } 4054 if (sp->hisauth.name != NULL && 4055 (name_len != sp->hisauth.name_len 4056 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4057 log(LOG_INFO, "%s: chap response, his name ", 4058 ifp->if_xname); 4059 sppp_print_string(name, name_len); 4060 addlog(" != expected "); 4061 sppp_print_string(sp->hisauth.name, 4062 sp->hisauth.name_len); 4063 addlog("\n"); 4064 goto chap_failure; 4065 } 4066 if (debug) { 4067 log(LOG_DEBUG, "%s: chap input(%s) " 4068 "<%s id=0x%x len=%d name=", 4069 ifp->if_xname, 4070 sppp_state_name(sp->state[IDX_CHAP]), 4071 sppp_auth_type_name(PPP_CHAP, h->type), 4072 h->ident, ntohs(h->len)); 4073 sppp_print_string((char *)name, name_len); 4074 addlog(" value-size=%d value=", value_len); 4075 sppp_print_bytes(value, value_len); 4076 addlog(">\n"); 4077 } 4078 if (value_len != sizeof(sp->myauth.challenge)) { 4079 if (debug) 4080 log(LOG_DEBUG, 4081 "%s: chap bad hash value length: " 4082 "%d bytes, should be %ld\n", 4083 ifp->if_xname, value_len, 4084 (long) sizeof(sp->myauth.challenge)); 4085 goto chap_failure; 4086 } 4087 4088 MD5Init(&ctx); 4089 MD5Update(&ctx, &h->ident, 1); 4090 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4091 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 4092 MD5Final(digest, &ctx); 4093 4094 #define FAILMSG "Failed..." 4095 #define SUCCMSG "Welcome!" 4096 4097 if (value_len != sizeof digest || 4098 memcmp(digest, value, value_len) != 0) { 4099 chap_failure: 4100 /* action scn, tld */ 4101 x = splnet(); 4102 sp->pp_auth_failures++; 4103 splx(x); 4104 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4105 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4106 0); 4107 chap.tld(sp); 4108 break; 4109 } 4110 sp->pp_auth_failures = 0; 4111 /* action sca, perhaps tlu */ 4112 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4113 sp->state[IDX_CHAP] == STATE_OPENED) 4114 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4115 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4116 0); 4117 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4118 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4119 chap.tlu(sp); 4120 } 4121 break; 4122 4123 default: 4124 /* Unknown CHAP packet type -- ignore. */ 4125 if (debug) { 4126 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4127 "<0x%x id=0x%xh len=%d", 4128 ifp->if_xname, 4129 sppp_state_name(sp->state[IDX_CHAP]), 4130 h->type, h->ident, ntohs(h->len)); 4131 if (len > 4) 4132 sppp_print_bytes((u_char *)(h + 1), len - 4); 4133 addlog(">\n"); 4134 } 4135 break; 4136 4137 } 4138 } 4139 4140 static void 4141 sppp_chap_init(struct sppp *sp) 4142 { 4143 /* Chap doesn't have STATE_INITIAL at all. */ 4144 sp->state[IDX_CHAP] = STATE_CLOSED; 4145 sp->fail_counter[IDX_CHAP] = 0; 4146 sp->pp_seq[IDX_CHAP] = 0; 4147 sp->pp_rseq[IDX_CHAP] = 0; 4148 callout_init(&sp->ch[IDX_CHAP]); 4149 } 4150 4151 static void 4152 sppp_chap_open(struct sppp *sp) 4153 { 4154 if (sp->myauth.proto == PPP_CHAP && 4155 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4156 /* we are authenticator for CHAP, start it */ 4157 chap.scr(sp); 4158 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4159 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4160 } 4161 /* nothing to be done if we are peer, await a challenge */ 4162 } 4163 4164 static void 4165 sppp_chap_close(struct sppp *sp) 4166 { 4167 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4168 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4169 } 4170 4171 static void 4172 sppp_chap_TO(void *cookie) 4173 { 4174 struct sppp *sp = (struct sppp *)cookie; 4175 STDDCL; 4176 int s; 4177 4178 s = splnet(); 4179 if (debug) 4180 log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n", 4181 ifp->if_xname, 4182 sppp_state_name(sp->state[IDX_CHAP]), 4183 sp->rst_counter[IDX_CHAP]); 4184 4185 if (--sp->rst_counter[IDX_CHAP] < 0) 4186 /* TO- event */ 4187 switch (sp->state[IDX_CHAP]) { 4188 case STATE_REQ_SENT: 4189 chap.tld(sp); 4190 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4191 break; 4192 } 4193 else 4194 /* TO+ (or TO*) event */ 4195 switch (sp->state[IDX_CHAP]) { 4196 case STATE_OPENED: 4197 /* TO* event */ 4198 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4199 /* fall through */ 4200 case STATE_REQ_SENT: 4201 chap.scr(sp); 4202 /* sppp_cp_change_state() will restart the timer */ 4203 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4204 break; 4205 } 4206 4207 splx(s); 4208 } 4209 4210 static void 4211 sppp_chap_tlu(struct sppp *sp) 4212 { 4213 STDDCL; 4214 int i, x; 4215 4216 i = 0; 4217 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4218 4219 /* 4220 * Some broken CHAP implementations (Conware CoNet, firmware 4221 * 4.0.?) don't want to re-authenticate their CHAP once the 4222 * initial challenge-response exchange has taken place. 4223 * Provide for an option to avoid rechallenges. 4224 */ 4225 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4226 /* 4227 * Compute the re-challenge timeout. This will yield 4228 * a number between 300 and 810 seconds. 4229 */ 4230 i = 300 + ((unsigned)(arc4random() & 0xff00) >> 7); 4231 4232 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4233 } 4234 4235 if (debug) { 4236 log(LOG_DEBUG, 4237 "%s: chap %s, ", 4238 ifp->if_xname, 4239 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4240 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4241 addlog("next re-challenge in %d seconds\n", i); 4242 else 4243 addlog("re-challenging supressed\n"); 4244 } 4245 4246 x = splnet(); 4247 sp->pp_auth_failures = 0; 4248 /* indicate to LCP that we need to be closed down */ 4249 sp->lcp.protos |= (1 << IDX_CHAP); 4250 4251 if (sp->pp_flags & PP_NEEDAUTH) { 4252 /* 4253 * Remote is authenticator, but his auth proto didn't 4254 * complete yet. Defer the transition to network 4255 * phase. 4256 */ 4257 splx(x); 4258 return; 4259 } 4260 splx(x); 4261 4262 /* 4263 * If we are already in phase network, we are done here. This 4264 * is the case if this is a dummy tlu event after a re-challenge. 4265 */ 4266 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4267 sppp_phase_network(sp); 4268 } 4269 4270 static void 4271 sppp_chap_tld(struct sppp *sp) 4272 { 4273 STDDCL; 4274 4275 if (debug) 4276 log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname); 4277 callout_stop(&sp->ch[IDX_CHAP]); 4278 sp->lcp.protos &= ~(1 << IDX_CHAP); 4279 4280 lcp.Close(sp); 4281 } 4282 4283 static void 4284 sppp_chap_scr(struct sppp *sp) 4285 { 4286 u_int32_t *ch; 4287 u_char clen; 4288 4289 if (sp->myauth.name == NULL) { 4290 /* can't do anything usefull */ 4291 printf("%s: chap starting without my name being set\n", 4292 sp->pp_if.if_xname); 4293 return; 4294 } 4295 4296 /* Compute random challenge. */ 4297 ch = (u_int32_t *)sp->myauth.challenge; 4298 ch[0] = arc4random(); 4299 ch[1] = arc4random(); 4300 ch[2] = arc4random(); 4301 ch[3] = arc4random(); 4302 clen = 16; /* 4 * sizeof(u_int32_t) */ 4303 4304 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4305 4306 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4307 sizeof clen, (const char *)&clen, 4308 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4309 sp->myauth.name_len, 4310 sp->myauth.name, 4311 0); 4312 } 4313 4314 /* 4315 *--------------------------------------------------------------------------* 4316 * * 4317 * The PAP implementation. * 4318 * * 4319 *--------------------------------------------------------------------------* 4320 */ 4321 /* 4322 * For PAP, we need to keep a little state also if we are the peer, not the 4323 * authenticator. This is since we don't get a request to authenticate, but 4324 * have to repeatedly authenticate ourself until we got a response (or the 4325 * retry counter is expired). 4326 */ 4327 4328 /* 4329 * Handle incoming PAP packets. */ 4330 static void 4331 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4332 { 4333 STDDCL; 4334 struct lcp_header *h; 4335 int len, x; 4336 u_char mlen; 4337 char *name, *secret; 4338 int name_len, secret_len; 4339 4340 /* 4341 * Malicious input might leave this uninitialized, so 4342 * init to an impossible value. 4343 */ 4344 secret_len = -1; 4345 4346 len = m->m_pkthdr.len; 4347 if (len < 5) { 4348 if (debug) 4349 log(LOG_DEBUG, 4350 "%s: pap invalid packet length: %d bytes\n", 4351 ifp->if_xname, len); 4352 return; 4353 } 4354 h = mtod(m, struct lcp_header *); 4355 if (len > ntohs(h->len)) 4356 len = ntohs(h->len); 4357 switch (h->type) { 4358 /* PAP request is my authproto */ 4359 case PAP_REQ: 4360 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4361 /* can't do anything usefull */ 4362 printf("%s: pap request without his name and his secret being set\n", 4363 ifp->if_xname); 4364 break; 4365 } 4366 name = 1 + (u_char *)(h + 1); 4367 name_len = name[-1]; 4368 secret = name + name_len + 1; 4369 if (name_len > len - 6 || 4370 (secret_len = secret[-1]) > len - 6 - name_len) { 4371 if (debug) { 4372 log(LOG_DEBUG, "%s: pap corrupted input " 4373 "<%s id=0x%x len=%d", 4374 ifp->if_xname, 4375 sppp_auth_type_name(PPP_PAP, h->type), 4376 h->ident, ntohs(h->len)); 4377 if (len > 4) 4378 sppp_print_bytes((u_char *)(h + 1), 4379 len - 4); 4380 addlog(">\n"); 4381 } 4382 break; 4383 } 4384 if (debug) { 4385 log(LOG_DEBUG, "%s: pap input(%s) " 4386 "<%s id=0x%x len=%d name=", 4387 ifp->if_xname, 4388 sppp_state_name(sp->state[IDX_PAP]), 4389 sppp_auth_type_name(PPP_PAP, h->type), 4390 h->ident, ntohs(h->len)); 4391 sppp_print_string((char *)name, name_len); 4392 addlog(" secret="); 4393 sppp_print_string((char *)secret, secret_len); 4394 addlog(">\n"); 4395 } 4396 if (name_len != sp->hisauth.name_len || 4397 secret_len != sp->hisauth.secret_len || 4398 memcmp(name, sp->hisauth.name, name_len) != 0 || 4399 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4400 /* action scn, tld */ 4401 sp->pp_auth_failures++; 4402 mlen = sizeof(FAILMSG) - 1; 4403 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4404 sizeof mlen, (const char *)&mlen, 4405 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4406 0); 4407 pap.tld(sp); 4408 break; 4409 } 4410 /* action sca, perhaps tlu */ 4411 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4412 sp->state[IDX_PAP] == STATE_OPENED) { 4413 mlen = sizeof(SUCCMSG) - 1; 4414 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4415 sizeof mlen, (const char *)&mlen, 4416 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4417 0); 4418 } 4419 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4420 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4421 pap.tlu(sp); 4422 } 4423 break; 4424 4425 /* ack and nak are his authproto */ 4426 case PAP_ACK: 4427 callout_stop(&sp->pap_my_to_ch); 4428 if (debug) { 4429 log(LOG_DEBUG, "%s: pap success", 4430 ifp->if_xname); 4431 name = 1 + (u_char *)(h + 1); 4432 name_len = name[-1]; 4433 if (len > 5 && name_len < len+4) { 4434 addlog(": "); 4435 sppp_print_string(name, name_len); 4436 } 4437 addlog("\n"); 4438 } 4439 x = splnet(); 4440 sp->pp_auth_failures = 0; 4441 sp->pp_flags &= ~PP_NEEDAUTH; 4442 if (sp->myauth.proto == PPP_PAP && 4443 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4444 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4445 /* 4446 * We are authenticator for PAP but didn't 4447 * complete yet. Leave it to tlu to proceed 4448 * to network phase. 4449 */ 4450 splx(x); 4451 break; 4452 } 4453 splx(x); 4454 sppp_phase_network(sp); 4455 break; 4456 4457 case PAP_NAK: 4458 callout_stop(&sp->pap_my_to_ch); 4459 sp->pp_auth_failures++; 4460 if (debug) { 4461 log(LOG_INFO, "%s: pap failure", 4462 ifp->if_xname); 4463 name = 1 + (u_char *)(h + 1); 4464 name_len = name[-1]; 4465 if (len > 5 && name_len < len+4) { 4466 addlog(": "); 4467 sppp_print_string(name, name_len); 4468 } 4469 addlog("\n"); 4470 } else 4471 log(LOG_INFO, "%s: pap failure\n", 4472 ifp->if_xname); 4473 /* await LCP shutdown by authenticator */ 4474 break; 4475 4476 default: 4477 /* Unknown PAP packet type -- ignore. */ 4478 if (debug) { 4479 log(LOG_DEBUG, "%s: pap corrupted input " 4480 "<0x%x id=0x%x len=%d", 4481 ifp->if_xname, 4482 h->type, h->ident, ntohs(h->len)); 4483 if (len > 4) 4484 sppp_print_bytes((u_char *)(h + 1), len - 4); 4485 addlog(">\n"); 4486 } 4487 break; 4488 4489 } 4490 } 4491 4492 static void 4493 sppp_pap_init(struct sppp *sp) 4494 { 4495 /* PAP doesn't have STATE_INITIAL at all. */ 4496 sp->state[IDX_PAP] = STATE_CLOSED; 4497 sp->fail_counter[IDX_PAP] = 0; 4498 sp->pp_seq[IDX_PAP] = 0; 4499 sp->pp_rseq[IDX_PAP] = 0; 4500 callout_init(&sp->ch[IDX_PAP]); 4501 callout_init(&sp->pap_my_to_ch); 4502 } 4503 4504 static void 4505 sppp_pap_open(struct sppp *sp) 4506 { 4507 if (sp->hisauth.proto == PPP_PAP && 4508 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4509 /* we are authenticator for PAP, start our timer */ 4510 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4511 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4512 } 4513 if (sp->myauth.proto == PPP_PAP) { 4514 /* we are peer, send a request, and start a timer */ 4515 pap.scr(sp); 4516 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4517 sppp_pap_my_TO, sp); 4518 } 4519 } 4520 4521 static void 4522 sppp_pap_close(struct sppp *sp) 4523 { 4524 if (sp->state[IDX_PAP] != STATE_CLOSED) 4525 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4526 } 4527 4528 /* 4529 * That's the timeout routine if we are authenticator. Since the 4530 * authenticator is basically passive in PAP, we can't do much here. 4531 */ 4532 static void 4533 sppp_pap_TO(void *cookie) 4534 { 4535 struct sppp *sp = (struct sppp *)cookie; 4536 STDDCL; 4537 int s; 4538 4539 s = splnet(); 4540 if (debug) 4541 log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n", 4542 ifp->if_xname, 4543 sppp_state_name(sp->state[IDX_PAP]), 4544 sp->rst_counter[IDX_PAP]); 4545 4546 if (--sp->rst_counter[IDX_PAP] < 0) 4547 /* TO- event */ 4548 switch (sp->state[IDX_PAP]) { 4549 case STATE_REQ_SENT: 4550 pap.tld(sp); 4551 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4552 break; 4553 } 4554 else 4555 /* TO+ event, not very much we could do */ 4556 switch (sp->state[IDX_PAP]) { 4557 case STATE_REQ_SENT: 4558 /* sppp_cp_change_state() will restart the timer */ 4559 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4560 break; 4561 } 4562 4563 splx(s); 4564 } 4565 4566 /* 4567 * That's the timeout handler if we are peer. Since the peer is active, 4568 * we need to retransmit our PAP request since it is apparently lost. 4569 * XXX We should impose a max counter. 4570 */ 4571 static void 4572 sppp_pap_my_TO(void *cookie) 4573 { 4574 struct sppp *sp = (struct sppp *)cookie; 4575 STDDCL; 4576 4577 if (debug) 4578 log(LOG_DEBUG, "%s: pap peer TO\n", 4579 ifp->if_xname); 4580 4581 pap.scr(sp); 4582 } 4583 4584 static void 4585 sppp_pap_tlu(struct sppp *sp) 4586 { 4587 STDDCL; 4588 int x; 4589 4590 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4591 4592 if (debug) 4593 log(LOG_DEBUG, "%s: %s tlu\n", 4594 ifp->if_xname, pap.name); 4595 4596 x = splnet(); 4597 sp->pp_auth_failures = 0; 4598 /* indicate to LCP that we need to be closed down */ 4599 sp->lcp.protos |= (1 << IDX_PAP); 4600 4601 if (sp->pp_flags & PP_NEEDAUTH) { 4602 /* 4603 * Remote is authenticator, but his auth proto didn't 4604 * complete yet. Defer the transition to network 4605 * phase. 4606 */ 4607 splx(x); 4608 return; 4609 } 4610 splx(x); 4611 sppp_phase_network(sp); 4612 } 4613 4614 static void 4615 sppp_pap_tld(struct sppp *sp) 4616 { 4617 STDDCL; 4618 4619 if (debug) 4620 log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname); 4621 callout_stop(&sp->ch[IDX_PAP]); 4622 callout_stop(&sp->pap_my_to_ch); 4623 sp->lcp.protos &= ~(1 << IDX_PAP); 4624 4625 lcp.Close(sp); 4626 } 4627 4628 static void 4629 sppp_pap_scr(struct sppp *sp) 4630 { 4631 u_char idlen, pwdlen; 4632 4633 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4634 /* can't do anything usefull */ 4635 printf("%s: pap starting without my name and secret being set\n", 4636 sp->pp_if.if_xname); 4637 return; 4638 } 4639 4640 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4641 pwdlen = sp->myauth.secret_len; 4642 idlen = sp->myauth.name_len; 4643 4644 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4645 sizeof idlen, (const char *)&idlen, 4646 idlen, sp->myauth.name, 4647 sizeof pwdlen, (const char *)&pwdlen, 4648 pwdlen, sp->myauth.secret, 4649 0); 4650 } 4651 4652 /* 4653 * Random miscellaneous functions. 4654 */ 4655 4656 /* 4657 * Send a PAP or CHAP proto packet. 4658 * 4659 * Varadic function, each of the elements for the ellipsis is of type 4660 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4661 * mlen == 0. 4662 * NOTE: never declare variadic functions with types subject to type 4663 * promotion (i.e. u_char). This is asking for big trouble depending 4664 * on the architecture you are on... 4665 */ 4666 4667 static void 4668 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4669 unsigned int type, unsigned int id, 4670 ...) 4671 { 4672 STDDCL; 4673 struct lcp_header *lh; 4674 struct mbuf *m; 4675 u_char *p; 4676 int len; 4677 size_t pkthdrlen; 4678 unsigned int mlen; 4679 const char *msg; 4680 va_list ap; 4681 4682 MGETHDR(m, M_DONTWAIT, MT_DATA); 4683 if (! m) 4684 return; 4685 m->m_pkthdr.rcvif = 0; 4686 4687 if (sp->pp_flags & PP_NOFRAMING) { 4688 *mtod(m, u_int16_t *) = htons(cp->proto); 4689 pkthdrlen = 2; 4690 lh = (struct lcp_header *)(mtod(m, u_int8_t *)+2); 4691 } else { 4692 struct ppp_header *h; 4693 h = mtod(m, struct ppp_header *); 4694 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4695 h->control = PPP_UI; /* Unnumbered Info */ 4696 h->protocol = htons(cp->proto); 4697 pkthdrlen = PPP_HEADER_LEN; 4698 4699 lh = (struct lcp_header *)(h + 1); 4700 } 4701 4702 lh->type = type; 4703 lh->ident = id; 4704 p = (u_char *)(lh + 1); 4705 4706 va_start(ap, id); 4707 len = 0; 4708 4709 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4710 msg = va_arg(ap, const char *); 4711 len += mlen; 4712 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4713 va_end(ap); 4714 m_freem(m); 4715 return; 4716 } 4717 4718 bcopy(msg, p, mlen); 4719 p += mlen; 4720 } 4721 va_end(ap); 4722 4723 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4724 lh->len = htons(LCP_HEADER_LEN + len); 4725 4726 if (debug) { 4727 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 4728 ifp->if_xname, cp->name, 4729 sppp_auth_type_name(cp->proto, lh->type), 4730 lh->ident, ntohs(lh->len)); 4731 if (len) 4732 sppp_print_bytes((u_char *)(lh + 1), len); 4733 addlog(">\n"); 4734 } 4735 if (IF_QFULL(&sp->pp_cpq)) { 4736 IF_DROP(&sp->pp_fastq); 4737 IF_DROP(&ifp->if_snd); 4738 m_freem(m); 4739 ++ifp->if_oerrors; 4740 return; 4741 } else 4742 IF_ENQUEUE(&sp->pp_cpq, m); 4743 if (! (ifp->if_flags & IFF_OACTIVE)) 4744 (*ifp->if_start)(ifp); 4745 ifp->if_obytes += m->m_pkthdr.len + 3; 4746 } 4747 4748 /* 4749 * Send keepalive packets, every 10 seconds. 4750 */ 4751 static void 4752 sppp_keepalive(void *dummy) 4753 { 4754 struct sppp *sp; 4755 int s; 4756 time_t now; 4757 4758 s = splnet(); 4759 now = time_uptime; 4760 for (sp=spppq; sp; sp=sp->pp_next) { 4761 struct ifnet *ifp = &sp->pp_if; 4762 4763 /* check idle timeout */ 4764 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4765 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4766 /* idle timeout is enabled for this interface */ 4767 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4768 if (ifp->if_flags & IFF_DEBUG) 4769 printf("%s: no activity for %lu seconds\n", 4770 sp->pp_if.if_xname, 4771 (unsigned long)(now-sp->pp_last_activity)); 4772 lcp.Close(sp); 4773 continue; 4774 } 4775 } 4776 4777 /* Keepalive mode disabled or channel down? */ 4778 if (! (sp->pp_flags & PP_KEEPALIVE) || 4779 ! (ifp->if_flags & IFF_RUNNING)) 4780 continue; 4781 4782 /* No keepalive in PPP mode if LCP not opened yet. */ 4783 if (! (sp->pp_flags & PP_CISCO) && 4784 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4785 continue; 4786 4787 /* No echo reply, but maybe user data passed through? */ 4788 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 4789 sp->pp_alivecnt = 0; 4790 continue; 4791 } 4792 4793 if (sp->pp_alivecnt >= sp->pp_maxalive) { 4794 /* No keepalive packets got. Stop the interface. */ 4795 if_down (ifp); 4796 IF_PURGE(&sp->pp_cpq); 4797 if (! (sp->pp_flags & PP_CISCO)) { 4798 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4799 ifp->if_xname); 4800 sp->pp_alivecnt = 0; 4801 4802 /* we are down, close all open protocols */ 4803 lcp.Close(sp); 4804 4805 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4806 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4807 4808 /* Close connection immediately, completition of this 4809 * will summon the magic needed to reestablish it. */ 4810 if (sp->pp_tlf) 4811 sp->pp_tlf(sp); 4812 continue; 4813 } 4814 } 4815 if (sp->pp_alivecnt < sp->pp_maxalive) 4816 ++sp->pp_alivecnt; 4817 if (sp->pp_flags & PP_CISCO) 4818 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4819 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4820 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4821 int32_t nmagic = htonl(sp->lcp.magic); 4822 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4823 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4824 sp->lcp.echoid, 4, &nmagic); 4825 } 4826 } 4827 splx(s); 4828 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4829 } 4830 4831 #ifdef INET 4832 /* 4833 * Get both IP addresses. 4834 */ 4835 static void 4836 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask) 4837 { 4838 struct ifnet *ifp = &sp->pp_if; 4839 struct ifaddr *ifa; 4840 struct sockaddr_in *si, *sm; 4841 u_int32_t ssrc, ddst; 4842 4843 sm = NULL; 4844 ssrc = ddst = 0; 4845 /* 4846 * Pick the first AF_INET address from the list, 4847 * aliases don't make any sense on a p2p link anyway. 4848 */ 4849 si = 0; 4850 IFADDR_FOREACH(ifa, ifp) { 4851 if (ifa->ifa_addr->sa_family == AF_INET) { 4852 si = (struct sockaddr_in *)ifa->ifa_addr; 4853 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4854 if (si) 4855 break; 4856 } 4857 } 4858 if (ifa) { 4859 if (si && si->sin_addr.s_addr) { 4860 ssrc = si->sin_addr.s_addr; 4861 if (srcmask) 4862 *srcmask = ntohl(sm->sin_addr.s_addr); 4863 } 4864 4865 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4866 if (si && si->sin_addr.s_addr) 4867 ddst = si->sin_addr.s_addr; 4868 } 4869 4870 if (dst) *dst = ntohl(ddst); 4871 if (src) *src = ntohl(ssrc); 4872 } 4873 4874 /* 4875 * Set IP addresses. Must be called at splnet. 4876 * If an address is 0, leave it the way it is. 4877 */ 4878 static void 4879 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4880 { 4881 STDDCL; 4882 struct ifaddr *ifa; 4883 struct sockaddr_in *si, *dest; 4884 4885 /* 4886 * Pick the first AF_INET address from the list, 4887 * aliases don't make any sense on a p2p link anyway. 4888 */ 4889 4890 IFADDR_FOREACH(ifa, ifp) { 4891 if (ifa->ifa_addr->sa_family == AF_INET) { 4892 si = (struct sockaddr_in *)ifa->ifa_addr; 4893 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4894 goto found; 4895 } 4896 } 4897 return; 4898 4899 found: 4900 { 4901 int error; 4902 struct sockaddr_in new_sin = *si; 4903 struct sockaddr_in new_dst = *dest; 4904 4905 /* 4906 * Scrub old routes now instead of calling in_ifinit with 4907 * scrub=1, because we may change the dstaddr 4908 * before the call to in_ifinit. 4909 */ 4910 in_ifscrub(ifp, ifatoia(ifa)); 4911 4912 if (myaddr != 0) 4913 new_sin.sin_addr.s_addr = htonl(myaddr); 4914 if (hisaddr != 0) { 4915 new_dst.sin_addr.s_addr = htonl(hisaddr); 4916 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4917 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4918 *dest = new_dst; /* fix dstaddr in place */ 4919 } 4920 } 4921 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4922 if (debug && error) 4923 { 4924 log(LOG_DEBUG, "%s: sppp_set_ip_addrs: in_ifinit " 4925 " failed, error=%d\n", ifp->if_xname, error); 4926 } 4927 #ifdef PFIL_HOOKS 4928 if (!error) 4929 (void)pfil_run_hooks(&if_pfil, 4930 (struct mbuf **)SIOCAIFADDR, ifp, PFIL_IFADDR); 4931 #endif 4932 } 4933 } 4934 4935 /* 4936 * Clear IP addresses. Must be called at splnet. 4937 */ 4938 static void 4939 sppp_clear_ip_addrs(struct sppp *sp) 4940 { 4941 struct ifnet *ifp = &sp->pp_if; 4942 struct ifaddr *ifa; 4943 struct sockaddr_in *si, *dest; 4944 4945 u_int32_t remote; 4946 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4947 remote = sp->ipcp.saved_hisaddr; 4948 else 4949 sppp_get_ip_addrs(sp, 0, &remote, 0); 4950 4951 /* 4952 * Pick the first AF_INET address from the list, 4953 * aliases don't make any sense on a p2p link anyway. 4954 */ 4955 4956 IFADDR_FOREACH(ifa, ifp) { 4957 if (ifa->ifa_addr->sa_family == AF_INET) { 4958 si = (struct sockaddr_in *)ifa->ifa_addr; 4959 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4960 goto found; 4961 } 4962 } 4963 return; 4964 4965 found: 4966 { 4967 struct sockaddr_in new_sin = *si; 4968 4969 in_ifscrub(ifp, ifatoia(ifa)); 4970 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4971 new_sin.sin_addr.s_addr = 0; 4972 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4973 /* replace peer addr in place */ 4974 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4975 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4976 #ifdef PFIL_HOOKS 4977 (void)pfil_run_hooks(&if_pfil, 4978 (struct mbuf **)SIOCDIFADDR, ifp, PFIL_IFADDR); 4979 #endif 4980 } 4981 } 4982 #endif 4983 4984 #ifdef INET6 4985 /* 4986 * Get both IPv6 addresses. 4987 */ 4988 static void 4989 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4990 struct in6_addr *srcmask) 4991 { 4992 struct ifnet *ifp = &sp->pp_if; 4993 struct ifaddr *ifa; 4994 struct sockaddr_in6 *si, *sm; 4995 struct in6_addr ssrc, ddst; 4996 4997 sm = NULL; 4998 memset(&ssrc, 0, sizeof(ssrc)); 4999 memset(&ddst, 0, sizeof(ddst)); 5000 /* 5001 * Pick the first link-local AF_INET6 address from the list, 5002 * aliases don't make any sense on a p2p link anyway. 5003 */ 5004 si = 0; 5005 IFADDR_FOREACH(ifa, ifp) 5006 if (ifa->ifa_addr->sa_family == AF_INET6) { 5007 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5008 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5009 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 5010 break; 5011 } 5012 if (ifa) { 5013 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5014 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 5015 if (srcmask) { 5016 bcopy(&sm->sin6_addr, srcmask, 5017 sizeof(*srcmask)); 5018 } 5019 } 5020 5021 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5022 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5023 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 5024 } 5025 5026 if (dst) 5027 bcopy(&ddst, dst, sizeof(*dst)); 5028 if (src) 5029 bcopy(&ssrc, src, sizeof(*src)); 5030 } 5031 5032 #ifdef IPV6CP_MYIFID_DYN 5033 /* 5034 * Generate random ifid. 5035 */ 5036 static void 5037 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5038 { 5039 /* TBD */ 5040 } 5041 5042 /* 5043 * Set my IPv6 address. Must be called at splnet. 5044 */ 5045 static void 5046 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5047 { 5048 STDDCL; 5049 struct ifaddr *ifa; 5050 struct sockaddr_in6 *sin6; 5051 5052 /* 5053 * Pick the first link-local AF_INET6 address from the list, 5054 * aliases don't make any sense on a p2p link anyway. 5055 */ 5056 5057 sin6 = NULL; 5058 IFADDR_FOREACH(ifa, ifp) 5059 { 5060 if (ifa->ifa_addr->sa_family == AF_INET6) 5061 { 5062 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5063 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 5064 break; 5065 } 5066 } 5067 5068 if (ifa && sin6) 5069 { 5070 int error; 5071 struct sockaddr_in6 new_sin6 = *sin6; 5072 5073 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 5074 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5075 if (debug && error) 5076 { 5077 log(LOG_DEBUG, "%s: sppp_set_ip6_addr: in6_ifinit " 5078 " failed, error=%d\n", ifp->if_xname, error); 5079 } 5080 #ifdef PFIL_HOOKS 5081 if (!error) 5082 (void)pfil_run_hooks(&if_pfil, 5083 (struct mbuf **)SIOCAIFADDR_IN6, ifp, PFIL_IFADDR); 5084 #endif 5085 } 5086 } 5087 #endif 5088 5089 /* 5090 * Suggest a candidate address to be used by peer. 5091 */ 5092 static void 5093 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5094 { 5095 struct in6_addr myaddr; 5096 struct timeval tv; 5097 5098 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5099 5100 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5101 microtime(&tv); 5102 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5103 myaddr.s6_addr[14] ^= 0xff; 5104 myaddr.s6_addr[15] ^= 0xff; 5105 } else { 5106 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5107 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5108 } 5109 if (suggest) 5110 bcopy(&myaddr, suggest, sizeof(myaddr)); 5111 } 5112 #endif /*INET6*/ 5113 5114 /* 5115 * Process ioctl requests specific to the PPP interface. 5116 * Permissions have already been checked. 5117 */ 5118 static int 5119 sppp_params(struct sppp *sp, int cmd, void *data) 5120 { 5121 switch (cmd) { 5122 case SPPPGETAUTHCFG: 5123 { 5124 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5125 int error; 5126 size_t len; 5127 5128 cfg->myauthflags = sp->myauth.flags; 5129 cfg->hisauthflags = sp->hisauth.flags; 5130 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 5131 cfg->hisauth = 0; 5132 if (sp->hisauth.proto) 5133 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5134 cfg->myauth = 0; 5135 if (sp->myauth.proto) 5136 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5137 if (cfg->myname_length == 0) { 5138 if (sp->myauth.name != NULL) 5139 cfg->myname_length = sp->myauth.name_len + 1; 5140 } else { 5141 if (sp->myauth.name == NULL) { 5142 cfg->myname_length = 0; 5143 } else { 5144 len = sp->myauth.name_len + 1; 5145 if (cfg->myname_length < len) 5146 return (ENAMETOOLONG); 5147 error = copyout(sp->myauth.name, cfg->myname, len); 5148 if (error) return error; 5149 } 5150 } 5151 if (cfg->hisname_length == 0) { 5152 if (sp->hisauth.name != NULL) 5153 cfg->hisname_length = sp->hisauth.name_len + 1; 5154 } else { 5155 if (sp->hisauth.name == NULL) { 5156 cfg->hisname_length = 0; 5157 } else { 5158 len = sp->hisauth.name_len + 1; 5159 if (cfg->hisname_length < len) 5160 return (ENAMETOOLONG); 5161 error = copyout(sp->hisauth.name, cfg->hisname, len); 5162 if (error) return error; 5163 } 5164 } 5165 } 5166 break; 5167 case SPPPSETAUTHCFG: 5168 { 5169 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5170 int error; 5171 5172 if (sp->myauth.name) { 5173 free(sp->myauth.name, M_DEVBUF); 5174 sp->myauth.name = NULL; 5175 } 5176 if (sp->myauth.secret) { 5177 free(sp->myauth.secret, M_DEVBUF); 5178 sp->myauth.secret = NULL; 5179 } 5180 if (sp->hisauth.name) { 5181 free(sp->hisauth.name, M_DEVBUF); 5182 sp->hisauth.name = NULL; 5183 } 5184 if (sp->hisauth.secret) { 5185 free(sp->hisauth.secret, M_DEVBUF); 5186 sp->hisauth.secret = NULL; 5187 } 5188 5189 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5190 if (cfg->hisname_length >= MCLBYTES) 5191 return (ENAMETOOLONG); 5192 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5193 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5194 if (error) { 5195 free(sp->hisauth.name, M_DEVBUF); 5196 sp->hisauth.name = NULL; 5197 return error; 5198 } 5199 sp->hisauth.name_len = cfg->hisname_length - 1; 5200 sp->hisauth.name[sp->hisauth.name_len] = 0; 5201 } 5202 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5203 if (cfg->hissecret_length >= MCLBYTES) 5204 return (ENAMETOOLONG); 5205 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5206 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5207 if (error) { 5208 free(sp->hisauth.secret, M_DEVBUF); 5209 sp->hisauth.secret = NULL; 5210 return error; 5211 } 5212 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5213 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5214 } 5215 if (cfg->myname != NULL && cfg->myname_length > 0) { 5216 if (cfg->myname_length >= MCLBYTES) 5217 return (ENAMETOOLONG); 5218 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5219 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5220 if (error) { 5221 free(sp->myauth.name, M_DEVBUF); 5222 sp->myauth.name = NULL; 5223 return error; 5224 } 5225 sp->myauth.name_len = cfg->myname_length - 1; 5226 sp->myauth.name[sp->myauth.name_len] = 0; 5227 } 5228 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5229 if (cfg->mysecret_length >= MCLBYTES) 5230 return (ENAMETOOLONG); 5231 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5232 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5233 if (error) { 5234 free(sp->myauth.secret, M_DEVBUF); 5235 sp->myauth.secret = NULL; 5236 return error; 5237 } 5238 sp->myauth.secret_len = cfg->mysecret_length - 1; 5239 sp->myauth.secret[sp->myauth.secret_len] = 0; 5240 } 5241 sp->myauth.flags = cfg->myauthflags; 5242 if (cfg->myauth) 5243 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5244 sp->hisauth.flags = cfg->hisauthflags; 5245 if (cfg->hisauth) 5246 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5247 sp->pp_auth_failures = 0; 5248 if (sp->hisauth.proto != 0) 5249 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5250 else 5251 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5252 } 5253 break; 5254 case SPPPGETLCPCFG: 5255 { 5256 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5257 lcpp->lcp_timeout = sp->lcp.timeout; 5258 } 5259 break; 5260 case SPPPSETLCPCFG: 5261 { 5262 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5263 sp->lcp.timeout = lcpp->lcp_timeout; 5264 } 5265 break; 5266 case SPPPGETSTATUS: 5267 { 5268 struct spppstatus *status = (struct spppstatus *)data; 5269 status->phase = sp->pp_phase; 5270 } 5271 break; 5272 case SPPPGETSTATUSNCP: 5273 { 5274 struct spppstatusncp *status = (struct spppstatusncp *)data; 5275 status->phase = sp->pp_phase; 5276 status->ncpup = sppp_ncp_check(sp); 5277 } 5278 break; 5279 case SPPPGETIDLETO: 5280 { 5281 struct spppidletimeout *to = (struct spppidletimeout *)data; 5282 to->idle_seconds = sp->pp_idle_timeout; 5283 } 5284 break; 5285 case SPPPSETIDLETO: 5286 { 5287 struct spppidletimeout *to = (struct spppidletimeout *)data; 5288 sp->pp_idle_timeout = to->idle_seconds; 5289 } 5290 break; 5291 case SPPPSETAUTHFAILURE: 5292 { 5293 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5294 sp->pp_max_auth_fail = afsettings->max_failures; 5295 sp->pp_auth_failures = 0; 5296 } 5297 break; 5298 case SPPPGETAUTHFAILURES: 5299 { 5300 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5301 stats->auth_failures = sp->pp_auth_failures; 5302 stats->max_failures = sp->pp_max_auth_fail; 5303 } 5304 break; 5305 case SPPPSETDNSOPTS: 5306 { 5307 struct spppdnssettings *req = (struct spppdnssettings *)data; 5308 sp->query_dns = req->query_dns & 3; 5309 } 5310 break; 5311 case SPPPGETDNSOPTS: 5312 { 5313 struct spppdnssettings *req = (struct spppdnssettings *)data; 5314 req->query_dns = sp->query_dns; 5315 } 5316 break; 5317 case SPPPGETDNSADDRS: 5318 { 5319 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5320 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5321 } 5322 break; 5323 case SPPPGETKEEPALIVE: 5324 { 5325 struct spppkeepalivesettings *settings = 5326 (struct spppkeepalivesettings*)data; 5327 settings->maxalive = sp->pp_maxalive; 5328 settings->max_noreceive = sp->pp_max_noreceive; 5329 } 5330 break; 5331 case SPPPSETKEEPALIVE: 5332 { 5333 struct spppkeepalivesettings *settings = 5334 (struct spppkeepalivesettings*)data; 5335 sp->pp_maxalive = settings->maxalive; 5336 sp->pp_max_noreceive = settings->max_noreceive; 5337 } 5338 break; 5339 default: 5340 return (EINVAL); 5341 } 5342 5343 return (0); 5344 } 5345 5346 static void 5347 sppp_phase_network(struct sppp *sp) 5348 { 5349 STDDCL; 5350 int i; 5351 u_int32_t mask; 5352 5353 sp->pp_phase = SPPP_PHASE_NETWORK; 5354 5355 if (debug) 5356 { 5357 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 5358 sppp_phase_name(sp->pp_phase)); 5359 } 5360 5361 /* Notify NCPs now. */ 5362 for (i = 0; i < IDX_COUNT; i++) 5363 if ((cps[i])->flags & CP_NCP) 5364 (cps[i])->Open(sp); 5365 5366 /* Send Up events to all NCPs. */ 5367 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5368 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5369 (cps[i])->Up(sp); 5370 5371 /* if no NCP is starting, all this was in vain, close down */ 5372 sppp_lcp_check_and_close(sp); 5373 } 5374 5375 5376 static const char * 5377 sppp_cp_type_name(u_char type) 5378 { 5379 static char buf[12]; 5380 switch (type) { 5381 case CONF_REQ: return "conf-req"; 5382 case CONF_ACK: return "conf-ack"; 5383 case CONF_NAK: return "conf-nak"; 5384 case CONF_REJ: return "conf-rej"; 5385 case TERM_REQ: return "term-req"; 5386 case TERM_ACK: return "term-ack"; 5387 case CODE_REJ: return "code-rej"; 5388 case PROTO_REJ: return "proto-rej"; 5389 case ECHO_REQ: return "echo-req"; 5390 case ECHO_REPLY: return "echo-reply"; 5391 case DISC_REQ: return "discard-req"; 5392 } 5393 snprintf(buf, sizeof(buf), "0x%x", type); 5394 return buf; 5395 } 5396 5397 static const char * 5398 sppp_auth_type_name(u_short proto, u_char type) 5399 { 5400 static char buf[12]; 5401 switch (proto) { 5402 case PPP_CHAP: 5403 switch (type) { 5404 case CHAP_CHALLENGE: return "challenge"; 5405 case CHAP_RESPONSE: return "response"; 5406 case CHAP_SUCCESS: return "success"; 5407 case CHAP_FAILURE: return "failure"; 5408 } 5409 case PPP_PAP: 5410 switch (type) { 5411 case PAP_REQ: return "req"; 5412 case PAP_ACK: return "ack"; 5413 case PAP_NAK: return "nak"; 5414 } 5415 } 5416 snprintf(buf, sizeof(buf), "0x%x", type); 5417 return buf; 5418 } 5419 5420 static const char * 5421 sppp_lcp_opt_name(u_char opt) 5422 { 5423 static char buf[12]; 5424 switch (opt) { 5425 case LCP_OPT_MRU: return "mru"; 5426 case LCP_OPT_ASYNC_MAP: return "async-map"; 5427 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5428 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5429 case LCP_OPT_MAGIC: return "magic"; 5430 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5431 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5432 } 5433 snprintf(buf, sizeof(buf), "0x%x", opt); 5434 return buf; 5435 } 5436 5437 static const char * 5438 sppp_ipcp_opt_name(u_char opt) 5439 { 5440 static char buf[12]; 5441 switch (opt) { 5442 case IPCP_OPT_ADDRESSES: return "addresses"; 5443 case IPCP_OPT_COMPRESSION: return "compression"; 5444 case IPCP_OPT_ADDRESS: return "address"; 5445 } 5446 snprintf(buf, sizeof(buf), "0x%x", opt); 5447 return buf; 5448 } 5449 5450 #ifdef INET6 5451 static const char * 5452 sppp_ipv6cp_opt_name(u_char opt) 5453 { 5454 static char buf[12]; 5455 switch (opt) { 5456 case IPV6CP_OPT_IFID: return "ifid"; 5457 case IPV6CP_OPT_COMPRESSION: return "compression"; 5458 } 5459 snprintf(buf, sizeof(buf), "0x%x", opt); 5460 return buf; 5461 } 5462 #endif 5463 5464 static const char * 5465 sppp_state_name(int state) 5466 { 5467 switch (state) { 5468 case STATE_INITIAL: return "initial"; 5469 case STATE_STARTING: return "starting"; 5470 case STATE_CLOSED: return "closed"; 5471 case STATE_STOPPED: return "stopped"; 5472 case STATE_CLOSING: return "closing"; 5473 case STATE_STOPPING: return "stopping"; 5474 case STATE_REQ_SENT: return "req-sent"; 5475 case STATE_ACK_RCVD: return "ack-rcvd"; 5476 case STATE_ACK_SENT: return "ack-sent"; 5477 case STATE_OPENED: return "opened"; 5478 } 5479 return "illegal"; 5480 } 5481 5482 static const char * 5483 sppp_phase_name(int phase) 5484 { 5485 switch (phase) { 5486 case SPPP_PHASE_DEAD: return "dead"; 5487 case SPPP_PHASE_ESTABLISH: return "establish"; 5488 case SPPP_PHASE_TERMINATE: return "terminate"; 5489 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5490 case SPPP_PHASE_NETWORK: return "network"; 5491 } 5492 return "illegal"; 5493 } 5494 5495 static const char * 5496 sppp_proto_name(u_short proto) 5497 { 5498 static char buf[12]; 5499 switch (proto) { 5500 case PPP_LCP: return "lcp"; 5501 case PPP_IPCP: return "ipcp"; 5502 case PPP_PAP: return "pap"; 5503 case PPP_CHAP: return "chap"; 5504 case PPP_IPV6CP: return "ipv6cp"; 5505 } 5506 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 5507 return buf; 5508 } 5509 5510 static void 5511 sppp_print_bytes(const u_char *p, u_short len) 5512 { 5513 addlog(" %02x", *p++); 5514 while (--len > 0) 5515 addlog("-%02x", *p++); 5516 } 5517 5518 static void 5519 sppp_print_string(const char *p, u_short len) 5520 { 5521 u_char c; 5522 5523 while (len-- > 0) { 5524 c = *p++; 5525 /* 5526 * Print only ASCII chars directly. RFC 1994 recommends 5527 * using only them, but we don't rely on it. */ 5528 if (c < ' ' || c > '~') 5529 addlog("\\x%x", c); 5530 else 5531 addlog("%c", c); 5532 } 5533 } 5534 5535 static const char * 5536 sppp_dotted_quad(u_int32_t addr) 5537 { 5538 static char s[16]; 5539 snprintf(s, sizeof(s), "%d.%d.%d.%d", 5540 (int)((addr >> 24) & 0xff), 5541 (int)((addr >> 16) & 0xff), 5542 (int)((addr >> 8) & 0xff), 5543 (int)(addr & 0xff)); 5544 return s; 5545 } 5546 5547 /* a dummy, used to drop uninteresting events */ 5548 static void 5549 sppp_null(struct sppp *unused) 5550 { 5551 /* do just nothing */ 5552 } 5553 /* 5554 * This file is large. Tell emacs to highlight it nevertheless. 5555 * 5556 * Local Variables: 5557 * hilit-auto-highlight-maxout: 120000 5558 * End: 5559 */ 5560
Indexes created Tue Oct 14 11:09:46 GMT 2025