if_spppsubr.c revision 1.131
1 /* $NetBSD: if_spppsubr.c,v 1.131 2014/11/28 08:29:00 ozaki-r Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.131 2014/11/28 08:29:00 ozaki-r Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_ipx.h" 49 #include "opt_modular.h" 50 #include "opt_compat_netbsd.h" 51 #endif 52 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 69 #include <net/if.h> 70 #include <net/netisr.h> 71 #include <net/if_types.h> 72 #include <net/route.h> 73 #include <net/ppp_defs.h> 74 75 #include <netinet/in.h> 76 #include <netinet/in_systm.h> 77 #include <netinet/in_var.h> 78 #ifdef INET 79 #include <netinet/ip.h> 80 #include <netinet/tcp.h> 81 #endif 82 #include <net/ethertypes.h> 83 84 #ifdef INET6 85 #include <netinet6/scope6_var.h> 86 #endif 87 88 #ifdef IPX 89 #include <netipx/ipx.h> 90 #include <netipx/ipx_if.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 97 #define LOOPALIVECNT 3 /* loopback detection tries */ 98 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 99 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 100 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 101 102 /* 103 * Interface flags that can be set in an ifconfig command. 104 * 105 * Setting link0 will make the link passive, i.e. it will be marked 106 * as being administrative openable, but won't be opened to begin 107 * with. Incoming calls will be answered, or subsequent calls with 108 * -link1 will cause the administrative open of the LCP layer. 109 * 110 * Setting link1 will cause the link to auto-dial only as packets 111 * arrive to be sent. 112 * 113 * Setting IFF_DEBUG will syslog the option negotiation and state 114 * transitions at level kern.debug. Note: all logs consistently look 115 * like 116 * 117 * <if-name><unit>: <proto-name> <additional info...> 118 * 119 * with <if-name><unit> being something like "bppp0", and <proto-name> 120 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 121 */ 122 123 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 124 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 125 126 #define CONF_REQ 1 /* PPP configure request */ 127 #define CONF_ACK 2 /* PPP configure acknowledge */ 128 #define CONF_NAK 3 /* PPP configure negative ack */ 129 #define CONF_REJ 4 /* PPP configure reject */ 130 #define TERM_REQ 5 /* PPP terminate request */ 131 #define TERM_ACK 6 /* PPP terminate acknowledge */ 132 #define CODE_REJ 7 /* PPP code reject */ 133 #define PROTO_REJ 8 /* PPP protocol reject */ 134 #define ECHO_REQ 9 /* PPP echo request */ 135 #define ECHO_REPLY 10 /* PPP echo reply */ 136 #define DISC_REQ 11 /* PPP discard request */ 137 138 #define LCP_OPT_MRU 1 /* maximum receive unit */ 139 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 140 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 141 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 142 #define LCP_OPT_MAGIC 5 /* magic number */ 143 #define LCP_OPT_RESERVED 6 /* reserved */ 144 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 145 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 146 147 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 148 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 149 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 150 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 151 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 152 153 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 154 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 155 156 #define PAP_REQ 1 /* PAP name/password request */ 157 #define PAP_ACK 2 /* PAP acknowledge */ 158 #define PAP_NAK 3 /* PAP fail */ 159 160 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 161 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 162 #define CHAP_SUCCESS 3 /* CHAP response ok */ 163 #define CHAP_FAILURE 4 /* CHAP response failed */ 164 165 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 166 167 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 168 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 169 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 170 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 171 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 172 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 173 174 /* states are named and numbered according to RFC 1661 */ 175 #define STATE_INITIAL 0 176 #define STATE_STARTING 1 177 #define STATE_CLOSED 2 178 #define STATE_STOPPED 3 179 #define STATE_CLOSING 4 180 #define STATE_STOPPING 5 181 #define STATE_REQ_SENT 6 182 #define STATE_ACK_RCVD 7 183 #define STATE_ACK_SENT 8 184 #define STATE_OPENED 9 185 186 struct ppp_header { 187 uint8_t address; 188 uint8_t control; 189 uint16_t protocol; 190 } __packed; 191 #define PPP_HEADER_LEN sizeof (struct ppp_header) 192 193 struct lcp_header { 194 uint8_t type; 195 uint8_t ident; 196 uint16_t len; 197 } __packed; 198 #define LCP_HEADER_LEN sizeof (struct lcp_header) 199 200 struct cisco_packet { 201 uint32_t type; 202 uint32_t par1; 203 uint32_t par2; 204 uint16_t rel; 205 uint16_t time0; 206 uint16_t time1; 207 } __packed; 208 #define CISCO_PACKET_LEN 18 209 210 /* 211 * We follow the spelling and capitalization of RFC 1661 here, to make 212 * it easier comparing with the standard. Please refer to this RFC in 213 * case you can't make sense out of these abbreviation; it will also 214 * explain the semantics related to the various events and actions. 215 */ 216 struct cp { 217 u_short proto; /* PPP control protocol number */ 218 u_char protoidx; /* index into state table in struct sppp */ 219 u_char flags; 220 #define CP_LCP 0x01 /* this is the LCP */ 221 #define CP_AUTH 0x02 /* this is an authentication protocol */ 222 #define CP_NCP 0x04 /* this is a NCP */ 223 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 224 const char *name; /* name of this control protocol */ 225 /* event handlers */ 226 void (*Up)(struct sppp *sp); 227 void (*Down)(struct sppp *sp); 228 void (*Open)(struct sppp *sp); 229 void (*Close)(struct sppp *sp); 230 void (*TO)(void *sp); 231 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 232 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 233 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 234 /* actions */ 235 void (*tlu)(struct sppp *sp); 236 void (*tld)(struct sppp *sp); 237 void (*tls)(struct sppp *sp); 238 void (*tlf)(struct sppp *sp); 239 void (*scr)(struct sppp *sp); 240 }; 241 242 static struct sppp *spppq; 243 static callout_t keepalive_ch; 244 245 #ifdef INET 246 /* 247 * The following disgusting hack gets around the problem that IP TOS 248 * can't be set yet. We want to put "interactive" traffic on a high 249 * priority queue. To decide if traffic is interactive, we check that 250 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 251 * 252 * XXX is this really still necessary? - joerg - 253 */ 254 static u_short interactive_ports[8] = { 255 0, 513, 0, 0, 256 0, 21, 0, 23, 257 }; 258 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 259 #endif 260 261 /* almost every function needs these */ 262 #define STDDCL \ 263 struct ifnet *ifp = &sp->pp_if; \ 264 int debug = ifp->if_flags & IFF_DEBUG 265 266 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 267 const struct sockaddr *dst, struct rtentry *rt); 268 269 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 270 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 271 272 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 273 struct mbuf *m); 274 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 275 u_char ident, u_short len, void *data); 276 /* static void sppp_cp_timeout(void *arg); */ 277 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 278 int newstate); 279 static void sppp_auth_send(const struct cp *cp, 280 struct sppp *sp, unsigned int type, unsigned int id, 281 ...); 282 283 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 284 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 285 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 286 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 287 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 288 289 static void sppp_null(struct sppp *sp); 290 291 static void sppp_lcp_init(struct sppp *sp); 292 static void sppp_lcp_up(struct sppp *sp); 293 static void sppp_lcp_down(struct sppp *sp); 294 static void sppp_lcp_open(struct sppp *sp); 295 static void sppp_lcp_close(struct sppp *sp); 296 static void sppp_lcp_TO(void *sp); 297 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 298 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 299 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 300 static void sppp_lcp_tlu(struct sppp *sp); 301 static void sppp_lcp_tld(struct sppp *sp); 302 static void sppp_lcp_tls(struct sppp *sp); 303 static void sppp_lcp_tlf(struct sppp *sp); 304 static void sppp_lcp_scr(struct sppp *sp); 305 static void sppp_lcp_check_and_close(struct sppp *sp); 306 static int sppp_ncp_check(struct sppp *sp); 307 308 static void sppp_ipcp_init(struct sppp *sp); 309 static void sppp_ipcp_up(struct sppp *sp); 310 static void sppp_ipcp_down(struct sppp *sp); 311 static void sppp_ipcp_open(struct sppp *sp); 312 static void sppp_ipcp_close(struct sppp *sp); 313 static void sppp_ipcp_TO(void *sp); 314 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 315 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 316 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 317 static void sppp_ipcp_tlu(struct sppp *sp); 318 static void sppp_ipcp_tld(struct sppp *sp); 319 static void sppp_ipcp_tls(struct sppp *sp); 320 static void sppp_ipcp_tlf(struct sppp *sp); 321 static void sppp_ipcp_scr(struct sppp *sp); 322 323 static void sppp_ipv6cp_init(struct sppp *sp); 324 static void sppp_ipv6cp_up(struct sppp *sp); 325 static void sppp_ipv6cp_down(struct sppp *sp); 326 static void sppp_ipv6cp_open(struct sppp *sp); 327 static void sppp_ipv6cp_close(struct sppp *sp); 328 static void sppp_ipv6cp_TO(void *sp); 329 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 330 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 331 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 332 static void sppp_ipv6cp_tlu(struct sppp *sp); 333 static void sppp_ipv6cp_tld(struct sppp *sp); 334 static void sppp_ipv6cp_tls(struct sppp *sp); 335 static void sppp_ipv6cp_tlf(struct sppp *sp); 336 static void sppp_ipv6cp_scr(struct sppp *sp); 337 338 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 339 static void sppp_pap_init(struct sppp *sp); 340 static void sppp_pap_open(struct sppp *sp); 341 static void sppp_pap_close(struct sppp *sp); 342 static void sppp_pap_TO(void *sp); 343 static void sppp_pap_my_TO(void *sp); 344 static void sppp_pap_tlu(struct sppp *sp); 345 static void sppp_pap_tld(struct sppp *sp); 346 static void sppp_pap_scr(struct sppp *sp); 347 348 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 349 static void sppp_chap_init(struct sppp *sp); 350 static void sppp_chap_open(struct sppp *sp); 351 static void sppp_chap_close(struct sppp *sp); 352 static void sppp_chap_TO(void *sp); 353 static void sppp_chap_tlu(struct sppp *sp); 354 static void sppp_chap_tld(struct sppp *sp); 355 static void sppp_chap_scr(struct sppp *sp); 356 357 static const char *sppp_auth_type_name(u_short proto, u_char type); 358 static const char *sppp_cp_type_name(u_char type); 359 static const char *sppp_dotted_quad(uint32_t addr); 360 static const char *sppp_ipcp_opt_name(u_char opt); 361 #ifdef INET6 362 static const char *sppp_ipv6cp_opt_name(u_char opt); 363 #endif 364 static const char *sppp_lcp_opt_name(u_char opt); 365 static const char *sppp_phase_name(int phase); 366 static const char *sppp_proto_name(u_short proto); 367 static const char *sppp_state_name(int state); 368 static int sppp_params(struct sppp *sp, u_long cmd, void *data); 369 #ifdef INET 370 static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, 371 uint32_t *srcmask); 372 static void sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr); 373 static void sppp_clear_ip_addrs(struct sppp *sp); 374 #endif 375 static void sppp_keepalive(void *dummy); 376 static void sppp_phase_network(struct sppp *sp); 377 static void sppp_print_bytes(const u_char *p, u_short len); 378 static void sppp_print_string(const char *p, u_short len); 379 #ifdef INET6 380 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 381 struct in6_addr *dst, struct in6_addr *srcmask); 382 #ifdef IPV6CP_MYIFID_DYN 383 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 384 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 385 #endif 386 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 387 #endif 388 389 /* our control protocol descriptors */ 390 static const struct cp lcp = { 391 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 392 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 393 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 394 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 395 sppp_lcp_scr 396 }; 397 398 static const struct cp ipcp = { 399 PPP_IPCP, IDX_IPCP, 400 #ifdef INET 401 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 402 #else 403 0, 404 #endif 405 "ipcp", 406 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 407 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 408 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 409 sppp_ipcp_scr 410 }; 411 412 static const struct cp ipv6cp = { 413 PPP_IPV6CP, IDX_IPV6CP, 414 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 415 CP_NCP, 416 #else 417 0, 418 #endif 419 "ipv6cp", 420 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 421 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 422 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 423 sppp_ipv6cp_scr 424 }; 425 426 static const struct cp pap = { 427 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 428 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 429 sppp_pap_TO, 0, 0, 0, 430 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 431 sppp_pap_scr 432 }; 433 434 static const struct cp chap = { 435 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 436 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 437 sppp_chap_TO, 0, 0, 0, 438 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 439 sppp_chap_scr 440 }; 441 442 static const struct cp *cps[IDX_COUNT] = { 443 &lcp, /* IDX_LCP */ 444 &ipcp, /* IDX_IPCP */ 445 &ipv6cp, /* IDX_IPV6CP */ 446 &pap, /* IDX_PAP */ 447 &chap, /* IDX_CHAP */ 448 }; 449 450 451 void spppattach(int); 452 void 453 /*ARGSUSED*/ 454 spppattach(int count) 455 { 456 } 457 458 /* 459 * Exported functions, comprising our interface to the lower layer. 460 */ 461 462 /* 463 * Process the received packet. 464 */ 465 void 466 sppp_input(struct ifnet *ifp, struct mbuf *m) 467 { 468 struct ppp_header *h = NULL; 469 pktqueue_t *pktq = NULL; 470 struct ifqueue *inq = NULL; 471 uint16_t protocol; 472 int s; 473 struct sppp *sp = (struct sppp *)ifp; 474 int debug = ifp->if_flags & IFF_DEBUG; 475 int isr = 0; 476 477 if (ifp->if_flags & IFF_UP) { 478 /* Count received bytes, add hardware framing */ 479 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 480 /* Note time of last receive */ 481 sp->pp_last_receive = time_uptime; 482 } 483 484 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 485 /* Too small packet, drop it. */ 486 if (debug) 487 log(LOG_DEBUG, 488 "%s: input packet is too small, %d bytes\n", 489 ifp->if_xname, m->m_pkthdr.len); 490 drop: 491 ++ifp->if_ierrors; 492 ++ifp->if_iqdrops; 493 m_freem(m); 494 return; 495 } 496 497 if (sp->pp_flags & PP_NOFRAMING) { 498 memcpy(&protocol, mtod(m, void *), 2); 499 protocol = ntohs(protocol); 500 m_adj(m, 2); 501 } else { 502 503 /* Get PPP header. */ 504 h = mtod(m, struct ppp_header *); 505 m_adj(m, PPP_HEADER_LEN); 506 507 switch (h->address) { 508 case PPP_ALLSTATIONS: 509 if (h->control != PPP_UI) 510 goto invalid; 511 if (sp->pp_flags & PP_CISCO) { 512 if (debug) 513 log(LOG_DEBUG, 514 "%s: PPP packet in Cisco mode " 515 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 516 ifp->if_xname, 517 h->address, h->control, ntohs(h->protocol)); 518 goto drop; 519 } 520 break; 521 case CISCO_MULTICAST: 522 case CISCO_UNICAST: 523 /* Don't check the control field here (RFC 1547). */ 524 if (! (sp->pp_flags & PP_CISCO)) { 525 if (debug) 526 log(LOG_DEBUG, 527 "%s: Cisco packet in PPP mode " 528 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 529 ifp->if_xname, 530 h->address, h->control, ntohs(h->protocol)); 531 goto drop; 532 } 533 switch (ntohs(h->protocol)) { 534 default: 535 ++ifp->if_noproto; 536 goto invalid; 537 case CISCO_KEEPALIVE: 538 sppp_cisco_input((struct sppp *) ifp, m); 539 m_freem(m); 540 return; 541 #ifdef INET 542 case ETHERTYPE_IP: 543 pktq = ip_pktq; 544 break; 545 #endif 546 #ifdef INET6 547 case ETHERTYPE_IPV6: 548 pktq = ip6_pktq; 549 break; 550 #endif 551 #ifdef IPX 552 case ETHERTYPE_IPX: 553 isr = NETISR_IPX; 554 inq = &ipxintrq; 555 break; 556 #endif 557 } 558 goto queue_pkt; 559 default: /* Invalid PPP packet. */ 560 invalid: 561 if (debug) 562 log(LOG_DEBUG, 563 "%s: invalid input packet " 564 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 565 ifp->if_xname, 566 h->address, h->control, ntohs(h->protocol)); 567 goto drop; 568 } 569 protocol = ntohs(h->protocol); 570 } 571 572 switch (protocol) { 573 default: 574 if (sp->state[IDX_LCP] == STATE_OPENED) { 575 uint16_t prot = htons(protocol); 576 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 577 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 578 &prot); 579 } 580 if (debug) 581 log(LOG_DEBUG, 582 "%s: invalid input protocol " 583 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 584 ++ifp->if_noproto; 585 goto drop; 586 case PPP_LCP: 587 sppp_cp_input(&lcp, sp, m); 588 m_freem(m); 589 return; 590 case PPP_PAP: 591 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 592 sppp_pap_input(sp, m); 593 m_freem(m); 594 return; 595 case PPP_CHAP: 596 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 597 sppp_chap_input(sp, m); 598 m_freem(m); 599 return; 600 #ifdef INET 601 case PPP_IPCP: 602 if (sp->pp_phase == SPPP_PHASE_NETWORK) 603 sppp_cp_input(&ipcp, sp, m); 604 m_freem(m); 605 return; 606 case PPP_IP: 607 if (sp->state[IDX_IPCP] == STATE_OPENED) { 608 sp->pp_last_activity = time_uptime; 609 pktq = ip_pktq; 610 } 611 break; 612 #endif 613 #ifdef INET6 614 case PPP_IPV6CP: 615 if (sp->pp_phase == SPPP_PHASE_NETWORK) 616 sppp_cp_input(&ipv6cp, sp, m); 617 m_freem(m); 618 return; 619 620 case PPP_IPV6: 621 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 622 sp->pp_last_activity = time_uptime; 623 pktq = ip6_pktq; 624 } 625 break; 626 #endif 627 #ifdef IPX 628 case PPP_IPX: 629 /* IPX IPXCP not implemented yet */ 630 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 631 isr = NETISR_IPX; 632 inq = &ipxintrq; 633 } 634 break; 635 #endif 636 } 637 638 queue_pkt: 639 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 640 goto drop; 641 } 642 643 /* Check queue. */ 644 if (__predict_true(pktq)) { 645 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 646 goto drop; 647 } 648 return; 649 } 650 651 s = splnet(); 652 if (IF_QFULL(inq)) { 653 /* Queue overflow. */ 654 IF_DROP(inq); 655 splx(s); 656 if (debug) 657 log(LOG_DEBUG, "%s: protocol queue overflow\n", 658 ifp->if_xname); 659 goto drop; 660 } 661 IF_ENQUEUE(inq, m); 662 schednetisr(isr); 663 splx(s); 664 } 665 666 /* 667 * Enqueue transmit packet. 668 */ 669 static int 670 sppp_output(struct ifnet *ifp, struct mbuf *m, 671 const struct sockaddr *dst, struct rtentry *rt) 672 { 673 struct sppp *sp = (struct sppp *) ifp; 674 struct ppp_header *h = NULL; 675 struct ifqueue *ifq = NULL; /* XXX */ 676 int s, error = 0; 677 uint16_t protocol; 678 ALTQ_DECL(struct altq_pktattr pktattr;) 679 680 s = splnet(); 681 682 sp->pp_last_activity = time_uptime; 683 684 if ((ifp->if_flags & IFF_UP) == 0 || 685 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 686 m_freem(m); 687 splx(s); 688 return (ENETDOWN); 689 } 690 691 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 692 /* 693 * Interface is not yet running, but auto-dial. Need 694 * to start LCP for it. 695 */ 696 ifp->if_flags |= IFF_RUNNING; 697 splx(s); 698 lcp.Open(sp); 699 s = splnet(); 700 } 701 702 /* 703 * If the queueing discipline needs packet classification, 704 * do it before prepending link headers. 705 */ 706 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 707 708 #ifdef INET 709 if (dst->sa_family == AF_INET) { 710 struct ip *ip = NULL; 711 struct tcphdr *th = NULL; 712 713 if (m->m_len >= sizeof(struct ip)) { 714 ip = mtod(m, struct ip *); 715 if (ip->ip_p == IPPROTO_TCP && 716 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 717 sizeof(struct tcphdr)) { 718 th = (struct tcphdr *) 719 ((char *)ip + (ip->ip_hl << 2)); 720 } 721 } else 722 ip = NULL; 723 724 /* 725 * When using dynamic local IP address assignment by using 726 * 0.0.0.0 as a local address, the first TCP session will 727 * not connect because the local TCP checksum is computed 728 * using 0.0.0.0 which will later become our real IP address 729 * so the TCP checksum computed at the remote end will 730 * become invalid. So we 731 * - don't let packets with src ip addr 0 thru 732 * - we flag TCP packets with src ip 0 as an error 733 */ 734 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 735 uint8_t proto = ip->ip_p; 736 737 m_freem(m); 738 splx(s); 739 if (proto == IPPROTO_TCP) 740 return (EADDRNOTAVAIL); 741 else 742 return (0); 743 } 744 745 /* 746 * Put low delay, telnet, rlogin and ftp control packets 747 * in front of the queue. 748 */ 749 750 if (!IF_QFULL(&sp->pp_fastq) && 751 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 752 (th && (INTERACTIVE(ntohs(th->th_sport)) || 753 INTERACTIVE(ntohs(th->th_dport)))))) 754 ifq = &sp->pp_fastq; 755 } 756 #endif 757 758 #ifdef INET6 759 if (dst->sa_family == AF_INET6) { 760 /* XXX do something tricky here? */ 761 } 762 #endif 763 764 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 765 /* 766 * Prepend general data packet PPP header. For now, IP only. 767 */ 768 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 769 if (! m) { 770 if (ifp->if_flags & IFF_DEBUG) 771 log(LOG_DEBUG, "%s: no memory for transmit header\n", 772 ifp->if_xname); 773 ++ifp->if_oerrors; 774 splx(s); 775 return (ENOBUFS); 776 } 777 /* 778 * May want to check size of packet 779 * (albeit due to the implementation it's always enough) 780 */ 781 h = mtod(m, struct ppp_header *); 782 if (sp->pp_flags & PP_CISCO) { 783 h->address = CISCO_UNICAST; /* unicast address */ 784 h->control = 0; 785 } else { 786 h->address = PPP_ALLSTATIONS; /* broadcast address */ 787 h->control = PPP_UI; /* Unnumbered Info */ 788 } 789 } 790 791 switch (dst->sa_family) { 792 #ifdef INET 793 case AF_INET: /* Internet Protocol */ 794 if (sp->pp_flags & PP_CISCO) 795 protocol = htons(ETHERTYPE_IP); 796 else { 797 /* 798 * Don't choke with an ENETDOWN early. It's 799 * possible that we just started dialing out, 800 * so don't drop the packet immediately. If 801 * we notice that we run out of buffer space 802 * below, we will however remember that we are 803 * not ready to carry IP packets, and return 804 * ENETDOWN, as opposed to ENOBUFS. 805 */ 806 protocol = htons(PPP_IP); 807 if (sp->state[IDX_IPCP] != STATE_OPENED) 808 error = ENETDOWN; 809 } 810 break; 811 #endif 812 #ifdef INET6 813 case AF_INET6: /* Internet Protocol version 6 */ 814 if (sp->pp_flags & PP_CISCO) 815 protocol = htons(ETHERTYPE_IPV6); 816 else { 817 /* 818 * Don't choke with an ENETDOWN early. It's 819 * possible that we just started dialing out, 820 * so don't drop the packet immediately. If 821 * we notice that we run out of buffer space 822 * below, we will however remember that we are 823 * not ready to carry IP packets, and return 824 * ENETDOWN, as opposed to ENOBUFS. 825 */ 826 protocol = htons(PPP_IPV6); 827 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 828 error = ENETDOWN; 829 } 830 break; 831 #endif 832 #ifdef IPX 833 case AF_IPX: /* Novell IPX Protocol */ 834 protocol = htons((sp->pp_flags & PP_CISCO) ? 835 ETHERTYPE_IPX : PPP_IPX); 836 break; 837 #endif 838 default: 839 m_freem(m); 840 ++ifp->if_oerrors; 841 splx(s); 842 return (EAFNOSUPPORT); 843 } 844 845 if (sp->pp_flags & PP_NOFRAMING) { 846 M_PREPEND(m, 2, M_DONTWAIT); 847 if (m == NULL) { 848 if (ifp->if_flags & IFF_DEBUG) 849 log(LOG_DEBUG, "%s: no memory for transmit header\n", 850 ifp->if_xname); 851 ++ifp->if_oerrors; 852 splx(s); 853 return (ENOBUFS); 854 } 855 *mtod(m, uint16_t *) = protocol; 856 } else { 857 h->protocol = protocol; 858 } 859 860 861 error = ifq_enqueue2(ifp, ifq, m ALTQ_COMMA ALTQ_DECL(&pktattr)); 862 863 if (error == 0) { 864 /* 865 * Count output packets and bytes. 866 * The packet length includes header + additional hardware 867 * framing according to RFC 1333. 868 */ 869 if (!(ifp->if_flags & IFF_OACTIVE)) 870 (*ifp->if_start)(ifp); 871 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 872 } 873 splx(s); 874 return error; 875 } 876 877 void 878 sppp_attach(struct ifnet *ifp) 879 { 880 struct sppp *sp = (struct sppp *) ifp; 881 882 /* Initialize keepalive handler. */ 883 if (! spppq) { 884 callout_init(&keepalive_ch, 0); 885 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 886 } 887 888 /* Insert new entry into the keepalive list. */ 889 sp->pp_next = spppq; 890 spppq = sp; 891 892 sp->pp_if.if_type = IFT_PPP; 893 sp->pp_if.if_output = sppp_output; 894 sp->pp_fastq.ifq_maxlen = 32; 895 sp->pp_cpq.ifq_maxlen = 20; 896 sp->pp_loopcnt = 0; 897 sp->pp_alivecnt = 0; 898 sp->pp_last_activity = 0; 899 sp->pp_last_receive = 0; 900 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 901 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 902 sp->pp_idle_timeout = 0; 903 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 904 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 905 sp->pp_auth_failures = 0; 906 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 907 sp->pp_phase = SPPP_PHASE_DEAD; 908 sp->pp_up = lcp.Up; 909 sp->pp_down = lcp.Down; 910 911 if_alloc_sadl(ifp); 912 913 memset(&sp->myauth, 0, sizeof sp->myauth); 914 memset(&sp->hisauth, 0, sizeof sp->hisauth); 915 sppp_lcp_init(sp); 916 sppp_ipcp_init(sp); 917 sppp_ipv6cp_init(sp); 918 sppp_pap_init(sp); 919 sppp_chap_init(sp); 920 } 921 922 void 923 sppp_detach(struct ifnet *ifp) 924 { 925 struct sppp **q, *p, *sp = (struct sppp *) ifp; 926 927 /* Remove the entry from the keepalive list. */ 928 for (q = &spppq; (p = *q); q = &p->pp_next) 929 if (p == sp) { 930 *q = p->pp_next; 931 break; 932 } 933 934 /* Stop keepalive handler. */ 935 if (! spppq) { 936 callout_stop(&keepalive_ch); 937 } 938 939 callout_stop(&sp->ch[IDX_LCP]); 940 callout_stop(&sp->ch[IDX_IPCP]); 941 callout_stop(&sp->ch[IDX_PAP]); 942 callout_stop(&sp->ch[IDX_CHAP]); 943 #ifdef INET6 944 callout_stop(&sp->ch[IDX_IPV6CP]); 945 #endif 946 callout_stop(&sp->pap_my_to_ch); 947 948 /* free authentication info */ 949 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 950 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 951 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 952 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 953 } 954 955 /* 956 * Flush the interface output queue. 957 */ 958 void 959 sppp_flush(struct ifnet *ifp) 960 { 961 struct sppp *sp = (struct sppp *) ifp; 962 963 IFQ_PURGE(&sp->pp_if.if_snd); 964 IF_PURGE(&sp->pp_fastq); 965 IF_PURGE(&sp->pp_cpq); 966 } 967 968 /* 969 * Check if the output queue is empty. 970 */ 971 int 972 sppp_isempty(struct ifnet *ifp) 973 { 974 struct sppp *sp = (struct sppp *) ifp; 975 int empty, s; 976 977 s = splnet(); 978 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 979 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 980 splx(s); 981 return (empty); 982 } 983 984 /* 985 * Get next packet to send. 986 */ 987 struct mbuf * 988 sppp_dequeue(struct ifnet *ifp) 989 { 990 struct sppp *sp = (struct sppp *) ifp; 991 struct mbuf *m; 992 int s; 993 994 s = splnet(); 995 /* 996 * Process only the control protocol queue until we have at 997 * least one NCP open. 998 * 999 * Do always serve all three queues in Cisco mode. 1000 */ 1001 IF_DEQUEUE(&sp->pp_cpq, m); 1002 if (m == NULL && 1003 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1004 IF_DEQUEUE(&sp->pp_fastq, m); 1005 if (m == NULL) 1006 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1007 } 1008 splx(s); 1009 return m; 1010 } 1011 1012 /* 1013 * Process an ioctl request. Called on low priority level. 1014 */ 1015 int 1016 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1017 { 1018 struct lwp *l = curlwp; /* XXX */ 1019 struct ifreq *ifr = (struct ifreq *) data; 1020 struct sppp *sp = (struct sppp *) ifp; 1021 int s, error=0, going_up, going_down, newmode; 1022 1023 s = splnet(); 1024 switch (cmd) { 1025 case SIOCINITIFADDR: 1026 break; 1027 1028 case SIOCSIFFLAGS: 1029 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1030 break; 1031 going_up = ifp->if_flags & IFF_UP && 1032 (ifp->if_flags & IFF_RUNNING) == 0; 1033 going_down = (ifp->if_flags & IFF_UP) == 0 && 1034 ifp->if_flags & IFF_RUNNING; 1035 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1036 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1037 /* sanity */ 1038 newmode = IFF_PASSIVE; 1039 ifp->if_flags &= ~IFF_AUTO; 1040 } 1041 1042 if (going_up || going_down) 1043 lcp.Close(sp); 1044 if (going_up && newmode == 0) { 1045 /* neither auto-dial nor passive */ 1046 ifp->if_flags |= IFF_RUNNING; 1047 if (!(sp->pp_flags & PP_CISCO)) 1048 lcp.Open(sp); 1049 } else if (going_down) { 1050 sppp_flush(ifp); 1051 ifp->if_flags &= ~IFF_RUNNING; 1052 } 1053 1054 break; 1055 1056 case SIOCSIFMTU: 1057 if (ifr->ifr_mtu < PPP_MINMRU || 1058 ifr->ifr_mtu > sp->lcp.their_mru) { 1059 error = EINVAL; 1060 break; 1061 } 1062 /*FALLTHROUGH*/ 1063 case SIOCGIFMTU: 1064 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1065 error = 0; 1066 break; 1067 case SIOCADDMULTI: 1068 case SIOCDELMULTI: 1069 break; 1070 1071 case SPPPSETAUTHCFG: 1072 case SPPPSETLCPCFG: 1073 case SPPPSETIDLETO: 1074 case SPPPSETAUTHFAILURE: 1075 case SPPPSETDNSOPTS: 1076 case SPPPSETKEEPALIVE: 1077 #if defined(COMPAT_50) || defined(MODULAR) 1078 case __SPPPSETIDLETO50: 1079 case __SPPPSETKEEPALIVE50: 1080 #endif /* COMPAT_50 || MODULAR */ 1081 error = kauth_authorize_network(l->l_cred, 1082 KAUTH_NETWORK_INTERFACE, 1083 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1084 NULL); 1085 if (error) 1086 break; 1087 error = sppp_params(sp, cmd, data); 1088 break; 1089 1090 case SPPPGETAUTHCFG: 1091 case SPPPGETLCPCFG: 1092 case SPPPGETAUTHFAILURES: 1093 error = kauth_authorize_network(l->l_cred, 1094 KAUTH_NETWORK_INTERFACE, 1095 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1096 NULL); 1097 if (error) 1098 break; 1099 error = sppp_params(sp, cmd, data); 1100 break; 1101 1102 case SPPPGETSTATUS: 1103 case SPPPGETSTATUSNCP: 1104 case SPPPGETIDLETO: 1105 case SPPPGETDNSOPTS: 1106 case SPPPGETDNSADDRS: 1107 case SPPPGETKEEPALIVE: 1108 #if defined(COMPAT_50) || defined(MODULAR) 1109 case __SPPPGETIDLETO50: 1110 case __SPPPGETKEEPALIVE50: 1111 #endif /* COMPAT_50 || MODULAR */ 1112 error = sppp_params(sp, cmd, data); 1113 break; 1114 1115 default: 1116 error = ifioctl_common(ifp, cmd, data); 1117 break; 1118 } 1119 splx(s); 1120 return (error); 1121 } 1122 1123 1124 /* 1125 * Cisco framing implementation. 1126 */ 1127 1128 /* 1129 * Handle incoming Cisco keepalive protocol packets. 1130 */ 1131 static void 1132 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1133 { 1134 STDDCL; 1135 struct cisco_packet *h; 1136 #ifdef INET 1137 uint32_t me, mymask = 0; /* XXX: GCC */ 1138 #endif 1139 1140 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1141 if (debug) 1142 log(LOG_DEBUG, 1143 "%s: cisco invalid packet length: %d bytes\n", 1144 ifp->if_xname, m->m_pkthdr.len); 1145 return; 1146 } 1147 h = mtod(m, struct cisco_packet *); 1148 if (debug) 1149 log(LOG_DEBUG, 1150 "%s: cisco input: %d bytes " 1151 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1152 ifp->if_xname, m->m_pkthdr.len, 1153 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1154 (u_int)h->time0, (u_int)h->time1); 1155 switch (ntohl(h->type)) { 1156 default: 1157 if (debug) 1158 addlog("%s: cisco unknown packet type: 0x%x\n", 1159 ifp->if_xname, ntohl(h->type)); 1160 break; 1161 case CISCO_ADDR_REPLY: 1162 /* Reply on address request, ignore */ 1163 break; 1164 case CISCO_KEEPALIVE_REQ: 1165 sp->pp_alivecnt = 0; 1166 sp->pp_rseq[IDX_LCP] = ntohl(h->par1); 1167 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1168 /* Local and remote sequence numbers are equal. 1169 * Probably, the line is in loopback mode. */ 1170 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1171 printf ("%s: loopback\n", 1172 ifp->if_xname); 1173 sp->pp_loopcnt = 0; 1174 if (ifp->if_flags & IFF_UP) { 1175 if_down(ifp); 1176 IF_PURGE(&sp->pp_cpq); 1177 } 1178 } 1179 ++sp->pp_loopcnt; 1180 1181 /* Generate new local sequence number */ 1182 sp->pp_seq[IDX_LCP] = cprng_fast32(); 1183 break; 1184 } 1185 sp->pp_loopcnt = 0; 1186 if (! (ifp->if_flags & IFF_UP) && 1187 (ifp->if_flags & IFF_RUNNING)) { 1188 if_up(ifp); 1189 } 1190 break; 1191 case CISCO_ADDR_REQ: 1192 #ifdef INET 1193 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1194 if (me != 0L) 1195 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1196 #endif 1197 break; 1198 } 1199 } 1200 1201 /* 1202 * Send Cisco keepalive packet. 1203 */ 1204 static void 1205 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1206 { 1207 STDDCL; 1208 struct ppp_header *h; 1209 struct cisco_packet *ch; 1210 struct mbuf *m; 1211 uint32_t t; 1212 1213 t = time_uptime * 1000; 1214 MGETHDR(m, M_DONTWAIT, MT_DATA); 1215 if (! m) 1216 return; 1217 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1218 m->m_pkthdr.rcvif = 0; 1219 1220 h = mtod(m, struct ppp_header *); 1221 h->address = CISCO_MULTICAST; 1222 h->control = 0; 1223 h->protocol = htons(CISCO_KEEPALIVE); 1224 1225 ch = (struct cisco_packet *)(h + 1); 1226 ch->type = htonl(type); 1227 ch->par1 = htonl(par1); 1228 ch->par2 = htonl(par2); 1229 ch->rel = -1; 1230 1231 ch->time0 = htons((u_short)(t >> 16)); 1232 ch->time1 = htons((u_short) t); 1233 1234 if (debug) 1235 log(LOG_DEBUG, 1236 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1237 ifp->if_xname, ntohl(ch->type), ch->par1, 1238 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1239 (u_int)ch->time1); 1240 1241 if (IF_QFULL(&sp->pp_cpq)) { 1242 IF_DROP(&sp->pp_fastq); 1243 IF_DROP(&ifp->if_snd); 1244 m_freem(m); 1245 ++ifp->if_oerrors; 1246 return; 1247 } else 1248 IF_ENQUEUE(&sp->pp_cpq, m); 1249 if (! (ifp->if_flags & IFF_OACTIVE)) 1250 (*ifp->if_start)(ifp); 1251 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1252 } 1253 1254 /* 1255 * PPP protocol implementation. 1256 */ 1257 1258 /* 1259 * Send PPP control protocol packet. 1260 */ 1261 static void 1262 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1263 u_char ident, u_short len, void *data) 1264 { 1265 STDDCL; 1266 struct lcp_header *lh; 1267 struct mbuf *m; 1268 size_t pkthdrlen; 1269 1270 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1271 1272 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1273 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1274 MGETHDR(m, M_DONTWAIT, MT_DATA); 1275 if (! m) 1276 return; 1277 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1278 m->m_pkthdr.rcvif = 0; 1279 1280 if (sp->pp_flags & PP_NOFRAMING) { 1281 *mtod(m, uint16_t *) = htons(proto); 1282 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1283 } else { 1284 struct ppp_header *h; 1285 h = mtod(m, struct ppp_header *); 1286 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1287 h->control = PPP_UI; /* Unnumbered Info */ 1288 h->protocol = htons(proto); /* Link Control Protocol */ 1289 lh = (struct lcp_header *)(h + 1); 1290 } 1291 lh->type = type; 1292 lh->ident = ident; 1293 lh->len = htons(LCP_HEADER_LEN + len); 1294 if (len) 1295 bcopy (data, lh + 1, len); 1296 1297 if (debug) { 1298 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1299 ifp->if_xname, 1300 sppp_proto_name(proto), 1301 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1302 if (len) 1303 sppp_print_bytes((u_char *)(lh + 1), len); 1304 addlog(">\n"); 1305 } 1306 if (IF_QFULL(&sp->pp_cpq)) { 1307 IF_DROP(&sp->pp_fastq); 1308 IF_DROP(&ifp->if_snd); 1309 m_freem(m); 1310 ++ifp->if_oerrors; 1311 return; 1312 } else 1313 IF_ENQUEUE(&sp->pp_cpq, m); 1314 if (! (ifp->if_flags & IFF_OACTIVE)) 1315 (*ifp->if_start)(ifp); 1316 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1317 } 1318 1319 /* 1320 * Handle incoming PPP control protocol packets. 1321 */ 1322 static void 1323 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1324 { 1325 STDDCL; 1326 struct lcp_header *h; 1327 int printlen, len = m->m_pkthdr.len; 1328 int rv; 1329 u_char *p; 1330 uint32_t u32; 1331 1332 if (len < 4) { 1333 if (debug) 1334 log(LOG_DEBUG, 1335 "%s: %s invalid packet length: %d bytes\n", 1336 ifp->if_xname, cp->name, len); 1337 return; 1338 } 1339 h = mtod(m, struct lcp_header *); 1340 if (debug) { 1341 printlen = ntohs(h->len); 1342 log(LOG_DEBUG, 1343 "%s: %s input(%s): <%s id=0x%x len=%d", 1344 ifp->if_xname, cp->name, 1345 sppp_state_name(sp->state[cp->protoidx]), 1346 sppp_cp_type_name(h->type), h->ident, printlen); 1347 if (len < printlen) 1348 printlen = len; 1349 if (printlen > 4) 1350 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1351 addlog(">\n"); 1352 } 1353 if (len > ntohs(h->len)) 1354 len = ntohs(h->len); 1355 p = (u_char *)(h + 1); 1356 switch (h->type) { 1357 case CONF_REQ: 1358 if (len < 4) { 1359 if (debug) 1360 addlog("%s: %s invalid conf-req length %d\n", 1361 ifp->if_xname, cp->name, 1362 len); 1363 ++ifp->if_ierrors; 1364 break; 1365 } 1366 /* handle states where RCR doesn't get a SCA/SCN */ 1367 switch (sp->state[cp->protoidx]) { 1368 case STATE_CLOSING: 1369 case STATE_STOPPING: 1370 return; 1371 case STATE_CLOSED: 1372 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1373 0, 0); 1374 return; 1375 } 1376 rv = (cp->RCR)(sp, h, len); 1377 if (rv < 0) { 1378 /* fatal error, shut down */ 1379 (cp->tld)(sp); 1380 sppp_lcp_tlf(sp); 1381 return; 1382 } 1383 switch (sp->state[cp->protoidx]) { 1384 case STATE_OPENED: 1385 (cp->tld)(sp); 1386 (cp->scr)(sp); 1387 /* fall through... */ 1388 case STATE_ACK_SENT: 1389 case STATE_REQ_SENT: 1390 sppp_cp_change_state(cp, sp, rv? 1391 STATE_ACK_SENT: STATE_REQ_SENT); 1392 break; 1393 case STATE_STOPPED: 1394 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1395 (cp->scr)(sp); 1396 sppp_cp_change_state(cp, sp, rv? 1397 STATE_ACK_SENT: STATE_REQ_SENT); 1398 break; 1399 case STATE_ACK_RCVD: 1400 if (rv) { 1401 sppp_cp_change_state(cp, sp, STATE_OPENED); 1402 if (debug) 1403 log(LOG_DEBUG, "%s: %s tlu\n", 1404 ifp->if_xname, 1405 cp->name); 1406 (cp->tlu)(sp); 1407 } else 1408 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1409 break; 1410 default: 1411 printf("%s: %s illegal %s in state %s\n", 1412 ifp->if_xname, cp->name, 1413 sppp_cp_type_name(h->type), 1414 sppp_state_name(sp->state[cp->protoidx])); 1415 ++ifp->if_ierrors; 1416 } 1417 break; 1418 case CONF_ACK: 1419 if (h->ident != sp->confid[cp->protoidx]) { 1420 if (debug) 1421 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1422 ifp->if_xname, cp->name, 1423 h->ident, sp->confid[cp->protoidx]); 1424 ++ifp->if_ierrors; 1425 break; 1426 } 1427 switch (sp->state[cp->protoidx]) { 1428 case STATE_CLOSED: 1429 case STATE_STOPPED: 1430 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1431 break; 1432 case STATE_CLOSING: 1433 case STATE_STOPPING: 1434 break; 1435 case STATE_REQ_SENT: 1436 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1437 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1438 break; 1439 case STATE_OPENED: 1440 (cp->tld)(sp); 1441 /* fall through */ 1442 case STATE_ACK_RCVD: 1443 (cp->scr)(sp); 1444 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1445 break; 1446 case STATE_ACK_SENT: 1447 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1448 sppp_cp_change_state(cp, sp, STATE_OPENED); 1449 if (debug) 1450 log(LOG_DEBUG, "%s: %s tlu\n", 1451 ifp->if_xname, cp->name); 1452 (cp->tlu)(sp); 1453 break; 1454 default: 1455 printf("%s: %s illegal %s in state %s\n", 1456 ifp->if_xname, cp->name, 1457 sppp_cp_type_name(h->type), 1458 sppp_state_name(sp->state[cp->protoidx])); 1459 ++ifp->if_ierrors; 1460 } 1461 break; 1462 case CONF_NAK: 1463 case CONF_REJ: 1464 if (h->ident != sp->confid[cp->protoidx]) { 1465 if (debug) 1466 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1467 ifp->if_xname, cp->name, 1468 h->ident, sp->confid[cp->protoidx]); 1469 ++ifp->if_ierrors; 1470 break; 1471 } 1472 if (h->type == CONF_NAK) 1473 (cp->RCN_nak)(sp, h, len); 1474 else /* CONF_REJ */ 1475 (cp->RCN_rej)(sp, h, len); 1476 1477 switch (sp->state[cp->protoidx]) { 1478 case STATE_CLOSED: 1479 case STATE_STOPPED: 1480 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1481 break; 1482 case STATE_REQ_SENT: 1483 case STATE_ACK_SENT: 1484 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1485 (cp->scr)(sp); 1486 break; 1487 case STATE_OPENED: 1488 (cp->tld)(sp); 1489 /* fall through */ 1490 case STATE_ACK_RCVD: 1491 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1492 (cp->scr)(sp); 1493 break; 1494 case STATE_CLOSING: 1495 case STATE_STOPPING: 1496 break; 1497 default: 1498 printf("%s: %s illegal %s in state %s\n", 1499 ifp->if_xname, cp->name, 1500 sppp_cp_type_name(h->type), 1501 sppp_state_name(sp->state[cp->protoidx])); 1502 ++ifp->if_ierrors; 1503 } 1504 break; 1505 1506 case TERM_REQ: 1507 switch (sp->state[cp->protoidx]) { 1508 case STATE_ACK_RCVD: 1509 case STATE_ACK_SENT: 1510 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1511 /* fall through */ 1512 case STATE_CLOSED: 1513 case STATE_STOPPED: 1514 case STATE_CLOSING: 1515 case STATE_STOPPING: 1516 case STATE_REQ_SENT: 1517 sta: 1518 /* Send Terminate-Ack packet. */ 1519 if (debug) 1520 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 1521 ifp->if_xname, cp->name); 1522 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1523 break; 1524 case STATE_OPENED: 1525 (cp->tld)(sp); 1526 sp->rst_counter[cp->protoidx] = 0; 1527 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1528 goto sta; 1529 default: 1530 printf("%s: %s illegal %s in state %s\n", 1531 ifp->if_xname, cp->name, 1532 sppp_cp_type_name(h->type), 1533 sppp_state_name(sp->state[cp->protoidx])); 1534 ++ifp->if_ierrors; 1535 } 1536 break; 1537 case TERM_ACK: 1538 switch (sp->state[cp->protoidx]) { 1539 case STATE_CLOSED: 1540 case STATE_STOPPED: 1541 case STATE_REQ_SENT: 1542 case STATE_ACK_SENT: 1543 break; 1544 case STATE_CLOSING: 1545 (cp->tlf)(sp); 1546 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1547 sppp_lcp_check_and_close(sp); 1548 break; 1549 case STATE_STOPPING: 1550 (cp->tlf)(sp); 1551 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1552 sppp_lcp_check_and_close(sp); 1553 break; 1554 case STATE_ACK_RCVD: 1555 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1556 break; 1557 case STATE_OPENED: 1558 (cp->tld)(sp); 1559 (cp->scr)(sp); 1560 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1561 break; 1562 default: 1563 printf("%s: %s illegal %s in state %s\n", 1564 ifp->if_xname, cp->name, 1565 sppp_cp_type_name(h->type), 1566 sppp_state_name(sp->state[cp->protoidx])); 1567 ++ifp->if_ierrors; 1568 } 1569 break; 1570 case CODE_REJ: 1571 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1572 log(LOG_INFO, 1573 "%s: %s: ignoring RXJ (%s) for code ?, " 1574 "danger will robinson\n", 1575 ifp->if_xname, cp->name, 1576 sppp_cp_type_name(h->type)); 1577 switch (sp->state[cp->protoidx]) { 1578 case STATE_CLOSED: 1579 case STATE_STOPPED: 1580 case STATE_REQ_SENT: 1581 case STATE_ACK_SENT: 1582 case STATE_CLOSING: 1583 case STATE_STOPPING: 1584 case STATE_OPENED: 1585 break; 1586 case STATE_ACK_RCVD: 1587 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1588 break; 1589 default: 1590 printf("%s: %s illegal %s in state %s\n", 1591 ifp->if_xname, cp->name, 1592 sppp_cp_type_name(h->type), 1593 sppp_state_name(sp->state[cp->protoidx])); 1594 ++ifp->if_ierrors; 1595 } 1596 break; 1597 case PROTO_REJ: 1598 { 1599 int catastrophic; 1600 const struct cp *upper; 1601 int i; 1602 uint16_t proto; 1603 1604 catastrophic = 0; 1605 upper = NULL; 1606 proto = p[0] << 8 | p[1]; 1607 for (i = 0; i < IDX_COUNT; i++) { 1608 if (cps[i]->proto == proto) { 1609 upper = cps[i]; 1610 break; 1611 } 1612 } 1613 if (upper == NULL) 1614 catastrophic++; 1615 1616 if (debug) 1617 log(LOG_INFO, 1618 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1619 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1620 sppp_cp_type_name(h->type), proto, 1621 upper ? upper->name : "unknown", 1622 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1623 1624 /* 1625 * if we got RXJ+ against conf-req, the peer does not implement 1626 * this particular protocol type. terminate the protocol. 1627 */ 1628 if (upper && !catastrophic) { 1629 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1630 upper->Close(sp); 1631 break; 1632 } 1633 } 1634 1635 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1636 switch (sp->state[cp->protoidx]) { 1637 case STATE_CLOSED: 1638 case STATE_STOPPED: 1639 case STATE_REQ_SENT: 1640 case STATE_ACK_SENT: 1641 case STATE_CLOSING: 1642 case STATE_STOPPING: 1643 case STATE_OPENED: 1644 break; 1645 case STATE_ACK_RCVD: 1646 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1647 break; 1648 default: 1649 printf("%s: %s illegal %s in state %s\n", 1650 ifp->if_xname, cp->name, 1651 sppp_cp_type_name(h->type), 1652 sppp_state_name(sp->state[cp->protoidx])); 1653 ++ifp->if_ierrors; 1654 } 1655 break; 1656 } 1657 case DISC_REQ: 1658 if (cp->proto != PPP_LCP) 1659 goto illegal; 1660 /* Discard the packet. */ 1661 break; 1662 case ECHO_REQ: 1663 if (cp->proto != PPP_LCP) 1664 goto illegal; 1665 if (sp->state[cp->protoidx] != STATE_OPENED) { 1666 if (debug) 1667 addlog("%s: lcp echo req but lcp closed\n", 1668 ifp->if_xname); 1669 ++ifp->if_ierrors; 1670 break; 1671 } 1672 if (len < 8) { 1673 if (debug) 1674 addlog("%s: invalid lcp echo request " 1675 "packet length: %d bytes\n", 1676 ifp->if_xname, len); 1677 break; 1678 } 1679 memcpy(&u32, h + 1, sizeof u32); 1680 if (ntohl(u32) == sp->lcp.magic) { 1681 /* Line loopback mode detected. */ 1682 printf("%s: loopback\n", ifp->if_xname); 1683 if_down(ifp); 1684 IF_PURGE(&sp->pp_cpq); 1685 1686 /* Shut down the PPP link. */ 1687 /* XXX */ 1688 lcp.Down(sp); 1689 lcp.Up(sp); 1690 break; 1691 } 1692 u32 = htonl(sp->lcp.magic); 1693 memcpy(h + 1, &u32, sizeof u32); 1694 if (debug) 1695 addlog("%s: got lcp echo req, sending echo rep\n", 1696 ifp->if_xname); 1697 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1698 h + 1); 1699 break; 1700 case ECHO_REPLY: 1701 if (cp->proto != PPP_LCP) 1702 goto illegal; 1703 if (h->ident != sp->lcp.echoid) { 1704 ++ifp->if_ierrors; 1705 break; 1706 } 1707 if (len < 8) { 1708 if (debug) 1709 addlog("%s: lcp invalid echo reply " 1710 "packet length: %d bytes\n", 1711 ifp->if_xname, len); 1712 break; 1713 } 1714 if (debug) 1715 addlog("%s: lcp got echo rep\n", 1716 ifp->if_xname); 1717 memcpy(&u32, h + 1, sizeof u32); 1718 if (ntohl(u32) != sp->lcp.magic) 1719 sp->pp_alivecnt = 0; 1720 break; 1721 default: 1722 /* Unknown packet type -- send Code-Reject packet. */ 1723 illegal: 1724 if (debug) 1725 addlog("%s: %s send code-rej for 0x%x\n", 1726 ifp->if_xname, cp->name, h->type); 1727 sppp_cp_send(sp, cp->proto, CODE_REJ, 1728 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1729 ++ifp->if_ierrors; 1730 } 1731 } 1732 1733 1734 /* 1735 * The generic part of all Up/Down/Open/Close/TO event handlers. 1736 * Basically, the state transition handling in the automaton. 1737 */ 1738 static void 1739 sppp_up_event(const struct cp *cp, struct sppp *sp) 1740 { 1741 STDDCL; 1742 1743 if (debug) 1744 log(LOG_DEBUG, "%s: %s up(%s)\n", 1745 ifp->if_xname, cp->name, 1746 sppp_state_name(sp->state[cp->protoidx])); 1747 1748 switch (sp->state[cp->protoidx]) { 1749 case STATE_INITIAL: 1750 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1751 break; 1752 case STATE_STARTING: 1753 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1754 (cp->scr)(sp); 1755 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1756 break; 1757 default: 1758 printf("%s: %s illegal up in state %s\n", 1759 ifp->if_xname, cp->name, 1760 sppp_state_name(sp->state[cp->protoidx])); 1761 } 1762 } 1763 1764 static void 1765 sppp_down_event(const struct cp *cp, struct sppp *sp) 1766 { 1767 STDDCL; 1768 1769 if (debug) 1770 log(LOG_DEBUG, "%s: %s down(%s)\n", 1771 ifp->if_xname, cp->name, 1772 sppp_state_name(sp->state[cp->protoidx])); 1773 1774 switch (sp->state[cp->protoidx]) { 1775 case STATE_CLOSED: 1776 case STATE_CLOSING: 1777 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1778 break; 1779 case STATE_STOPPED: 1780 (cp->tls)(sp); 1781 /* fall through */ 1782 case STATE_STOPPING: 1783 case STATE_REQ_SENT: 1784 case STATE_ACK_RCVD: 1785 case STATE_ACK_SENT: 1786 sppp_cp_change_state(cp, sp, STATE_STARTING); 1787 break; 1788 case STATE_OPENED: 1789 (cp->tld)(sp); 1790 sppp_cp_change_state(cp, sp, STATE_STARTING); 1791 break; 1792 default: 1793 printf("%s: %s illegal down in state %s\n", 1794 ifp->if_xname, cp->name, 1795 sppp_state_name(sp->state[cp->protoidx])); 1796 } 1797 } 1798 1799 1800 static void 1801 sppp_open_event(const struct cp *cp, struct sppp *sp) 1802 { 1803 STDDCL; 1804 1805 if (debug) 1806 log(LOG_DEBUG, "%s: %s open(%s)\n", 1807 ifp->if_xname, cp->name, 1808 sppp_state_name(sp->state[cp->protoidx])); 1809 1810 switch (sp->state[cp->protoidx]) { 1811 case STATE_INITIAL: 1812 sppp_cp_change_state(cp, sp, STATE_STARTING); 1813 (cp->tls)(sp); 1814 break; 1815 case STATE_STARTING: 1816 break; 1817 case STATE_CLOSED: 1818 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1819 (cp->scr)(sp); 1820 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1821 break; 1822 case STATE_STOPPED: 1823 case STATE_STOPPING: 1824 case STATE_REQ_SENT: 1825 case STATE_ACK_RCVD: 1826 case STATE_ACK_SENT: 1827 case STATE_OPENED: 1828 break; 1829 case STATE_CLOSING: 1830 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1831 break; 1832 } 1833 } 1834 1835 1836 static void 1837 sppp_close_event(const struct cp *cp, struct sppp *sp) 1838 { 1839 STDDCL; 1840 1841 if (debug) 1842 log(LOG_DEBUG, "%s: %s close(%s)\n", 1843 ifp->if_xname, cp->name, 1844 sppp_state_name(sp->state[cp->protoidx])); 1845 1846 switch (sp->state[cp->protoidx]) { 1847 case STATE_INITIAL: 1848 case STATE_CLOSED: 1849 case STATE_CLOSING: 1850 break; 1851 case STATE_STARTING: 1852 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1853 (cp->tlf)(sp); 1854 break; 1855 case STATE_STOPPED: 1856 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1857 break; 1858 case STATE_STOPPING: 1859 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1860 break; 1861 case STATE_OPENED: 1862 (cp->tld)(sp); 1863 /* fall through */ 1864 case STATE_REQ_SENT: 1865 case STATE_ACK_RCVD: 1866 case STATE_ACK_SENT: 1867 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1868 sppp_cp_send(sp, cp->proto, TERM_REQ, 1869 ++sp->pp_seq[cp->protoidx], 0, 0); 1870 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1871 break; 1872 } 1873 } 1874 1875 static void 1876 sppp_to_event(const struct cp *cp, struct sppp *sp) 1877 { 1878 STDDCL; 1879 int s; 1880 1881 s = splnet(); 1882 if (debug) 1883 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 1884 ifp->if_xname, cp->name, 1885 sppp_state_name(sp->state[cp->protoidx]), 1886 sp->rst_counter[cp->protoidx]); 1887 1888 if (--sp->rst_counter[cp->protoidx] < 0) 1889 /* TO- event */ 1890 switch (sp->state[cp->protoidx]) { 1891 case STATE_CLOSING: 1892 (cp->tlf)(sp); 1893 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1894 sppp_lcp_check_and_close(sp); 1895 break; 1896 case STATE_STOPPING: 1897 (cp->tlf)(sp); 1898 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1899 sppp_lcp_check_and_close(sp); 1900 break; 1901 case STATE_REQ_SENT: 1902 case STATE_ACK_RCVD: 1903 case STATE_ACK_SENT: 1904 (cp->tlf)(sp); 1905 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1906 sppp_lcp_check_and_close(sp); 1907 break; 1908 } 1909 else 1910 /* TO+ event */ 1911 switch (sp->state[cp->protoidx]) { 1912 case STATE_CLOSING: 1913 case STATE_STOPPING: 1914 sppp_cp_send(sp, cp->proto, TERM_REQ, 1915 ++sp->pp_seq[cp->protoidx], 0, 0); 1916 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1917 cp->TO, sp); 1918 break; 1919 case STATE_REQ_SENT: 1920 case STATE_ACK_RCVD: 1921 (cp->scr)(sp); 1922 /* sppp_cp_change_state() will restart the timer */ 1923 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1924 break; 1925 case STATE_ACK_SENT: 1926 (cp->scr)(sp); 1927 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1928 cp->TO, sp); 1929 break; 1930 } 1931 1932 splx(s); 1933 } 1934 1935 /* 1936 * Change the state of a control protocol in the state automaton. 1937 * Takes care of starting/stopping the restart timer. 1938 */ 1939 void 1940 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1941 { 1942 sp->state[cp->protoidx] = newstate; 1943 callout_stop(&sp->ch[cp->protoidx]); 1944 switch (newstate) { 1945 case STATE_INITIAL: 1946 case STATE_STARTING: 1947 case STATE_CLOSED: 1948 case STATE_STOPPED: 1949 case STATE_OPENED: 1950 break; 1951 case STATE_CLOSING: 1952 case STATE_STOPPING: 1953 case STATE_REQ_SENT: 1954 case STATE_ACK_RCVD: 1955 case STATE_ACK_SENT: 1956 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1957 cp->TO, sp); 1958 break; 1959 } 1960 } 1961 1962 /* 1963 *--------------------------------------------------------------------------* 1964 * * 1965 * The LCP implementation. * 1966 * * 1967 *--------------------------------------------------------------------------* 1968 */ 1969 static void 1970 sppp_lcp_init(struct sppp *sp) 1971 { 1972 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 1973 sp->lcp.magic = 0; 1974 sp->state[IDX_LCP] = STATE_INITIAL; 1975 sp->fail_counter[IDX_LCP] = 0; 1976 sp->pp_seq[IDX_LCP] = 0; 1977 sp->pp_rseq[IDX_LCP] = 0; 1978 sp->lcp.protos = 0; 1979 1980 /* 1981 * Initialize counters and timeout values. Note that we don't 1982 * use the 3 seconds suggested in RFC 1661 since we are likely 1983 * running on a fast link. XXX We should probably implement 1984 * the exponential backoff option. Note that these values are 1985 * relevant for all control protocols, not just LCP only. 1986 */ 1987 sp->lcp.timeout = 1 * hz; 1988 sp->lcp.max_terminate = 2; 1989 sp->lcp.max_configure = 10; 1990 sp->lcp.max_failure = 10; 1991 callout_init(&sp->ch[IDX_LCP], 0); 1992 } 1993 1994 static void 1995 sppp_lcp_up(struct sppp *sp) 1996 { 1997 STDDCL; 1998 1999 /* Initialize activity timestamp: opening a connection is an activity */ 2000 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2001 2002 /* 2003 * If this interface is passive or dial-on-demand, and we are 2004 * still in Initial state, it means we've got an incoming 2005 * call. Activate the interface. 2006 */ 2007 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2008 if (debug) 2009 log(LOG_DEBUG, 2010 "%s: Up event", ifp->if_xname); 2011 ifp->if_flags |= IFF_RUNNING; 2012 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2013 if (debug) 2014 addlog("(incoming call)\n"); 2015 sp->pp_flags |= PP_CALLIN; 2016 lcp.Open(sp); 2017 } else if (debug) 2018 addlog("\n"); 2019 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2020 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2021 ifp->if_flags |= IFF_RUNNING; 2022 lcp.Open(sp); 2023 } 2024 2025 sppp_up_event(&lcp, sp); 2026 } 2027 2028 static void 2029 sppp_lcp_down(struct sppp *sp) 2030 { 2031 STDDCL; 2032 2033 sppp_down_event(&lcp, sp); 2034 2035 /* 2036 * If this is neither a dial-on-demand nor a passive 2037 * interface, simulate an ``ifconfig down'' action, so the 2038 * administrator can force a redial by another ``ifconfig 2039 * up''. XXX For leased line operation, should we immediately 2040 * try to reopen the connection here? 2041 */ 2042 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2043 if (debug) 2044 log(LOG_INFO, 2045 "%s: Down event (carrier loss), taking interface down.\n", 2046 ifp->if_xname); 2047 if_down(ifp); 2048 } else { 2049 if (debug) 2050 log(LOG_DEBUG, 2051 "%s: Down event (carrier loss)\n", 2052 ifp->if_xname); 2053 } 2054 sp->pp_flags &= ~PP_CALLIN; 2055 if (sp->state[IDX_LCP] != STATE_INITIAL) 2056 lcp.Close(sp); 2057 ifp->if_flags &= ~IFF_RUNNING; 2058 } 2059 2060 static void 2061 sppp_lcp_open(struct sppp *sp) 2062 { 2063 if (sp->pp_if.if_mtu < PP_MTU) { 2064 sp->lcp.mru = sp->pp_if.if_mtu; 2065 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2066 } else 2067 sp->lcp.mru = PP_MTU; 2068 sp->lcp.their_mru = PP_MTU; 2069 2070 /* 2071 * If we are authenticator, negotiate LCP_AUTH 2072 */ 2073 if (sp->hisauth.proto != 0) 2074 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2075 else 2076 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2077 sp->pp_flags &= ~PP_NEEDAUTH; 2078 sppp_open_event(&lcp, sp); 2079 } 2080 2081 static void 2082 sppp_lcp_close(struct sppp *sp) 2083 { 2084 sppp_close_event(&lcp, sp); 2085 } 2086 2087 static void 2088 sppp_lcp_TO(void *cookie) 2089 { 2090 sppp_to_event(&lcp, (struct sppp *)cookie); 2091 } 2092 2093 /* 2094 * Analyze a configure request. Return true if it was agreeable, and 2095 * caused action sca, false if it has been rejected or nak'ed, and 2096 * caused action scn. (The return value is used to make the state 2097 * transition decision in the state automaton.) 2098 */ 2099 static int 2100 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2101 { 2102 STDDCL; 2103 u_char *buf, *r, *p; 2104 int origlen, rlen; 2105 uint32_t nmagic; 2106 u_short authproto; 2107 2108 len -= 4; 2109 origlen = len; 2110 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2111 if (! buf) 2112 return (0); 2113 2114 if (debug) 2115 log(LOG_DEBUG, "%s: lcp parse opts:", 2116 ifp->if_xname); 2117 2118 /* pass 1: check for things that need to be rejected */ 2119 p = (void *)(h + 1); 2120 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2121 /* Sanity check option length */ 2122 if (p[1] > len) { 2123 /* 2124 * Malicious option - drop immediately. 2125 * XXX Maybe we should just RXJ it? 2126 */ 2127 addlog("%s: received malicious LCP option 0x%02x, " 2128 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2129 p[0], p[1], len); 2130 goto drop; 2131 } 2132 if (debug) 2133 addlog(" %s", sppp_lcp_opt_name(*p)); 2134 switch (*p) { 2135 case LCP_OPT_MAGIC: 2136 /* Magic number. */ 2137 /* fall through, both are same length */ 2138 case LCP_OPT_ASYNC_MAP: 2139 /* Async control character map. */ 2140 if (len >= 6 || p[1] == 6) 2141 continue; 2142 if (debug) 2143 addlog(" [invalid]"); 2144 break; 2145 case LCP_OPT_MRU: 2146 /* Maximum receive unit. */ 2147 if (len >= 4 && p[1] == 4) 2148 continue; 2149 if (debug) 2150 addlog(" [invalid]"); 2151 break; 2152 case LCP_OPT_AUTH_PROTO: 2153 if (len < 4) { 2154 if (debug) 2155 addlog(" [invalid]"); 2156 break; 2157 } 2158 authproto = (p[2] << 8) + p[3]; 2159 if (authproto == PPP_CHAP && p[1] != 5) { 2160 if (debug) 2161 addlog(" [invalid chap len]"); 2162 break; 2163 } 2164 if (sp->myauth.proto == 0) { 2165 /* we are not configured to do auth */ 2166 if (debug) 2167 addlog(" [not configured]"); 2168 break; 2169 } 2170 /* 2171 * Remote want us to authenticate, remember this, 2172 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2173 * up. 2174 */ 2175 sp->pp_flags |= PP_NEEDAUTH; 2176 continue; 2177 default: 2178 /* Others not supported. */ 2179 if (debug) 2180 addlog(" [rej]"); 2181 break; 2182 } 2183 /* Add the option to rejected list. */ 2184 bcopy (p, r, p[1]); 2185 r += p[1]; 2186 rlen += p[1]; 2187 } 2188 if (rlen) { 2189 if (debug) 2190 addlog(" send conf-rej\n"); 2191 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2192 goto end; 2193 } else if (debug) 2194 addlog("\n"); 2195 2196 /* 2197 * pass 2: check for option values that are unacceptable and 2198 * thus require to be nak'ed. 2199 */ 2200 if (debug) 2201 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2202 ifp->if_xname); 2203 2204 p = (void *)(h + 1); 2205 len = origlen; 2206 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2207 if (debug) 2208 addlog(" %s", sppp_lcp_opt_name(*p)); 2209 switch (*p) { 2210 case LCP_OPT_MAGIC: 2211 /* Magic number -- extract. */ 2212 nmagic = (uint32_t)p[2] << 24 | 2213 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2214 if (nmagic != sp->lcp.magic) { 2215 if (debug) 2216 addlog(" 0x%x", nmagic); 2217 continue; 2218 } 2219 /* 2220 * Local and remote magics equal -- loopback? 2221 */ 2222 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2223 printf ("%s: loopback\n", 2224 ifp->if_xname); 2225 sp->pp_loopcnt = 0; 2226 if (ifp->if_flags & IFF_UP) { 2227 if_down(ifp); 2228 IF_PURGE(&sp->pp_cpq); 2229 /* XXX ? */ 2230 lcp.Down(sp); 2231 lcp.Up(sp); 2232 } 2233 } else if (debug) 2234 addlog(" [glitch]"); 2235 ++sp->pp_loopcnt; 2236 /* 2237 * We negate our magic here, and NAK it. If 2238 * we see it later in an NAK packet, we 2239 * suggest a new one. 2240 */ 2241 nmagic = ~sp->lcp.magic; 2242 /* Gonna NAK it. */ 2243 p[2] = nmagic >> 24; 2244 p[3] = nmagic >> 16; 2245 p[4] = nmagic >> 8; 2246 p[5] = nmagic; 2247 break; 2248 2249 case LCP_OPT_ASYNC_MAP: 2250 /* 2251 * Async control character map -- just ignore it. 2252 * 2253 * Quote from RFC 1662, chapter 6: 2254 * To enable this functionality, synchronous PPP 2255 * implementations MUST always respond to the 2256 * Async-Control-Character-Map Configuration 2257 * Option with the LCP Configure-Ack. However, 2258 * acceptance of the Configuration Option does 2259 * not imply that the synchronous implementation 2260 * will do any ACCM mapping. Instead, all such 2261 * octet mapping will be performed by the 2262 * asynchronous-to-synchronous converter. 2263 */ 2264 continue; 2265 2266 case LCP_OPT_MRU: 2267 /* 2268 * Maximum receive unit. Always agreeable, 2269 * but ignored by now. 2270 */ 2271 sp->lcp.their_mru = p[2] * 256 + p[3]; 2272 if (debug) 2273 addlog(" %ld", sp->lcp.their_mru); 2274 continue; 2275 2276 case LCP_OPT_AUTH_PROTO: 2277 authproto = (p[2] << 8) + p[3]; 2278 if (sp->myauth.proto != authproto) { 2279 /* not agreed, nak */ 2280 if (debug) 2281 addlog(" [mine %s != his %s]", 2282 sppp_proto_name(sp->myauth.proto), 2283 sppp_proto_name(authproto)); 2284 p[2] = sp->myauth.proto >> 8; 2285 p[3] = sp->myauth.proto; 2286 break; 2287 } 2288 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2289 if (debug) 2290 addlog(" [chap not MD5]"); 2291 p[4] = CHAP_MD5; 2292 break; 2293 } 2294 continue; 2295 } 2296 /* Add the option to nak'ed list. */ 2297 bcopy (p, r, p[1]); 2298 r += p[1]; 2299 rlen += p[1]; 2300 } 2301 if (rlen) { 2302 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2303 if (debug) 2304 addlog(" max_failure (%d) exceeded, " 2305 "send conf-rej\n", 2306 sp->lcp.max_failure); 2307 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2308 } else { 2309 if (debug) 2310 addlog(" send conf-nak\n"); 2311 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2312 } 2313 goto end; 2314 } else { 2315 if (debug) 2316 addlog(" send conf-ack\n"); 2317 sp->fail_counter[IDX_LCP] = 0; 2318 sp->pp_loopcnt = 0; 2319 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2320 } 2321 2322 end: 2323 free(buf, M_TEMP); 2324 return (rlen == 0); 2325 2326 drop: 2327 free(buf, M_TEMP); 2328 return -1; 2329 } 2330 2331 /* 2332 * Analyze the LCP Configure-Reject option list, and adjust our 2333 * negotiation. 2334 */ 2335 static void 2336 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2337 { 2338 STDDCL; 2339 u_char *buf, *p; 2340 2341 len -= 4; 2342 buf = malloc (len, M_TEMP, M_NOWAIT); 2343 if (!buf) 2344 return; 2345 2346 if (debug) 2347 log(LOG_DEBUG, "%s: lcp rej opts:", 2348 ifp->if_xname); 2349 2350 p = (void *)(h + 1); 2351 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2352 /* Sanity check option length */ 2353 if (p[1] > len) { 2354 /* 2355 * Malicious option - drop immediately. 2356 * XXX Maybe we should just RXJ it? 2357 */ 2358 addlog("%s: received malicious LCP option, " 2359 "dropping.\n", ifp->if_xname); 2360 goto drop; 2361 } 2362 if (debug) 2363 addlog(" %s", sppp_lcp_opt_name(*p)); 2364 switch (*p) { 2365 case LCP_OPT_MAGIC: 2366 /* Magic number -- can't use it, use 0 */ 2367 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2368 sp->lcp.magic = 0; 2369 break; 2370 case LCP_OPT_MRU: 2371 /* 2372 * We try to negotiate a lower MRU if the underlying 2373 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2374 * peer rejects this lower rate, fallback to the 2375 * default. 2376 */ 2377 if (debug) { 2378 addlog("%s: warning: peer rejected our MRU of " 2379 "%ld bytes. Defaulting to %d bytes\n", 2380 ifp->if_xname, sp->lcp.mru, PP_MTU); 2381 } 2382 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2383 sp->lcp.mru = PP_MTU; 2384 break; 2385 case LCP_OPT_AUTH_PROTO: 2386 /* 2387 * Peer doesn't want to authenticate himself, 2388 * deny unless this is a dialout call, and 2389 * SPPP_AUTHFLAG_NOCALLOUT is set. 2390 */ 2391 if ((sp->pp_flags & PP_CALLIN) == 0 && 2392 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2393 if (debug) 2394 addlog(" [don't insist on auth " 2395 "for callout]"); 2396 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2397 break; 2398 } 2399 if (debug) 2400 addlog("[access denied]\n"); 2401 lcp.Close(sp); 2402 break; 2403 } 2404 } 2405 if (debug) 2406 addlog("\n"); 2407 drop: 2408 free(buf, M_TEMP); 2409 return; 2410 } 2411 2412 /* 2413 * Analyze the LCP Configure-NAK option list, and adjust our 2414 * negotiation. 2415 */ 2416 static void 2417 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2418 { 2419 STDDCL; 2420 u_char *buf, *p; 2421 uint32_t magic; 2422 2423 len -= 4; 2424 buf = malloc (len, M_TEMP, M_NOWAIT); 2425 if (!buf) 2426 return; 2427 2428 if (debug) 2429 log(LOG_DEBUG, "%s: lcp nak opts:", 2430 ifp->if_xname); 2431 2432 p = (void *)(h + 1); 2433 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2434 /* Sanity check option length */ 2435 if (p[1] > len) { 2436 /* 2437 * Malicious option - drop immediately. 2438 * XXX Maybe we should just RXJ it? 2439 */ 2440 addlog("%s: received malicious LCP option, " 2441 "dropping.\n", ifp->if_xname); 2442 goto drop; 2443 } 2444 if (debug) 2445 addlog(" %s", sppp_lcp_opt_name(*p)); 2446 switch (*p) { 2447 case LCP_OPT_MAGIC: 2448 /* Magic number -- renegotiate */ 2449 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2450 len >= 6 && p[1] == 6) { 2451 magic = (uint32_t)p[2] << 24 | 2452 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2453 /* 2454 * If the remote magic is our negated one, 2455 * this looks like a loopback problem. 2456 * Suggest a new magic to make sure. 2457 */ 2458 if (magic == ~sp->lcp.magic) { 2459 if (debug) 2460 addlog(" magic glitch"); 2461 sp->lcp.magic = cprng_fast32(); 2462 } else { 2463 sp->lcp.magic = magic; 2464 if (debug) 2465 addlog(" %d", magic); 2466 } 2467 } 2468 break; 2469 case LCP_OPT_MRU: 2470 /* 2471 * Peer wants to advise us to negotiate an MRU. 2472 * Agree on it if it's reasonable, or use 2473 * default otherwise. 2474 */ 2475 if (len >= 4 && p[1] == 4) { 2476 u_int mru = p[2] * 256 + p[3]; 2477 if (debug) 2478 addlog(" %d", mru); 2479 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 2480 mru = sp->pp_if.if_mtu; 2481 sp->lcp.mru = mru; 2482 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2483 } 2484 break; 2485 case LCP_OPT_AUTH_PROTO: 2486 /* 2487 * Peer doesn't like our authentication method, 2488 * deny. 2489 */ 2490 if (debug) 2491 addlog("[access denied]\n"); 2492 lcp.Close(sp); 2493 break; 2494 } 2495 } 2496 if (debug) 2497 addlog("\n"); 2498 drop: 2499 free(buf, M_TEMP); 2500 return; 2501 } 2502 2503 static void 2504 sppp_lcp_tlu(struct sppp *sp) 2505 { 2506 STDDCL; 2507 int i; 2508 uint32_t mask; 2509 2510 /* XXX ? */ 2511 if (! (ifp->if_flags & IFF_UP) && 2512 (ifp->if_flags & IFF_RUNNING)) { 2513 /* Coming out of loopback mode. */ 2514 if_up(ifp); 2515 } 2516 2517 for (i = 0; i < IDX_COUNT; i++) 2518 if ((cps[i])->flags & CP_QUAL) 2519 (cps[i])->Open(sp); 2520 2521 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2522 (sp->pp_flags & PP_NEEDAUTH) != 0) 2523 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2524 else 2525 sp->pp_phase = SPPP_PHASE_NETWORK; 2526 2527 if (debug) 2528 { 2529 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2530 sppp_phase_name(sp->pp_phase)); 2531 } 2532 2533 /* 2534 * Open all authentication protocols. This is even required 2535 * if we already proceeded to network phase, since it might be 2536 * that remote wants us to authenticate, so we might have to 2537 * send a PAP request. Undesired authentication protocols 2538 * don't do anything when they get an Open event. 2539 */ 2540 for (i = 0; i < IDX_COUNT; i++) 2541 if ((cps[i])->flags & CP_AUTH) 2542 (cps[i])->Open(sp); 2543 2544 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2545 /* Notify all NCPs. */ 2546 for (i = 0; i < IDX_COUNT; i++) 2547 if ((cps[i])->flags & CP_NCP) 2548 (cps[i])->Open(sp); 2549 } 2550 2551 /* Send Up events to all started protos. */ 2552 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2553 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2554 (cps[i])->Up(sp); 2555 2556 /* notify low-level driver of state change */ 2557 if (sp->pp_chg) 2558 sp->pp_chg(sp, (int)sp->pp_phase); 2559 2560 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2561 /* if no NCP is starting, close down */ 2562 sppp_lcp_check_and_close(sp); 2563 } 2564 2565 static void 2566 sppp_lcp_tld(struct sppp *sp) 2567 { 2568 STDDCL; 2569 int i; 2570 uint32_t mask; 2571 2572 sp->pp_phase = SPPP_PHASE_TERMINATE; 2573 2574 if (debug) 2575 { 2576 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2577 sppp_phase_name(sp->pp_phase)); 2578 } 2579 2580 /* 2581 * Take upper layers down. We send the Down event first and 2582 * the Close second to prevent the upper layers from sending 2583 * ``a flurry of terminate-request packets'', as the RFC 2584 * describes it. 2585 */ 2586 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2587 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2588 (cps[i])->Down(sp); 2589 (cps[i])->Close(sp); 2590 } 2591 } 2592 2593 static void 2594 sppp_lcp_tls(struct sppp *sp) 2595 { 2596 STDDCL; 2597 2598 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2599 printf("%s: authentication failed %d times, not retrying again\n", 2600 sp->pp_if.if_xname, sp->pp_auth_failures); 2601 if_down(&sp->pp_if); 2602 return; 2603 } 2604 2605 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2606 2607 if (debug) 2608 { 2609 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2610 sppp_phase_name(sp->pp_phase)); 2611 } 2612 2613 /* Notify lower layer if desired. */ 2614 if (sp->pp_tls) 2615 (sp->pp_tls)(sp); 2616 } 2617 2618 static void 2619 sppp_lcp_tlf(struct sppp *sp) 2620 { 2621 STDDCL; 2622 2623 sp->pp_phase = SPPP_PHASE_DEAD; 2624 2625 if (debug) 2626 { 2627 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2628 sppp_phase_name(sp->pp_phase)); 2629 } 2630 2631 /* Notify lower layer if desired. */ 2632 if (sp->pp_tlf) 2633 (sp->pp_tlf)(sp); 2634 } 2635 2636 static void 2637 sppp_lcp_scr(struct sppp *sp) 2638 { 2639 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2640 int i = 0; 2641 u_short authproto; 2642 2643 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2644 if (! sp->lcp.magic) 2645 sp->lcp.magic = cprng_fast32(); 2646 opt[i++] = LCP_OPT_MAGIC; 2647 opt[i++] = 6; 2648 opt[i++] = sp->lcp.magic >> 24; 2649 opt[i++] = sp->lcp.magic >> 16; 2650 opt[i++] = sp->lcp.magic >> 8; 2651 opt[i++] = sp->lcp.magic; 2652 } 2653 2654 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2655 opt[i++] = LCP_OPT_MRU; 2656 opt[i++] = 4; 2657 opt[i++] = sp->lcp.mru >> 8; 2658 opt[i++] = sp->lcp.mru; 2659 } 2660 2661 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2662 authproto = sp->hisauth.proto; 2663 opt[i++] = LCP_OPT_AUTH_PROTO; 2664 opt[i++] = authproto == PPP_CHAP? 5: 4; 2665 opt[i++] = authproto >> 8; 2666 opt[i++] = authproto; 2667 if (authproto == PPP_CHAP) 2668 opt[i++] = CHAP_MD5; 2669 } 2670 2671 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2672 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2673 } 2674 2675 /* 2676 * Check the open NCPs, return true if at least one NCP is open. 2677 */ 2678 static int 2679 sppp_ncp_check(struct sppp *sp) 2680 { 2681 int i, mask; 2682 2683 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2684 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2685 return 1; 2686 return 0; 2687 } 2688 2689 /* 2690 * Re-check the open NCPs and see if we should terminate the link. 2691 * Called by the NCPs during their tlf action handling. 2692 */ 2693 static void 2694 sppp_lcp_check_and_close(struct sppp *sp) 2695 { 2696 2697 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2698 /* don't bother, we are already going down */ 2699 return; 2700 2701 if (sppp_ncp_check(sp)) 2702 return; 2703 2704 lcp.Close(sp); 2705 } 2706 2707 2708 /* 2709 *--------------------------------------------------------------------------* 2710 * * 2711 * The IPCP implementation. * 2712 * * 2713 *--------------------------------------------------------------------------* 2714 */ 2715 2716 static void 2717 sppp_ipcp_init(struct sppp *sp) 2718 { 2719 sp->ipcp.opts = 0; 2720 sp->ipcp.flags = 0; 2721 sp->state[IDX_IPCP] = STATE_INITIAL; 2722 sp->fail_counter[IDX_IPCP] = 0; 2723 sp->pp_seq[IDX_IPCP] = 0; 2724 sp->pp_rseq[IDX_IPCP] = 0; 2725 callout_init(&sp->ch[IDX_IPCP], 0); 2726 } 2727 2728 static void 2729 sppp_ipcp_up(struct sppp *sp) 2730 { 2731 sppp_up_event(&ipcp, sp); 2732 } 2733 2734 static void 2735 sppp_ipcp_down(struct sppp *sp) 2736 { 2737 sppp_down_event(&ipcp, sp); 2738 } 2739 2740 static void 2741 sppp_ipcp_open(struct sppp *sp) 2742 { 2743 STDDCL; 2744 uint32_t myaddr, hisaddr; 2745 2746 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2747 sp->ipcp.req_myaddr = 0; 2748 sp->ipcp.req_hisaddr = 0; 2749 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2750 2751 #ifdef INET 2752 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2753 #else 2754 myaddr = hisaddr = 0; 2755 #endif 2756 /* 2757 * If we don't have his address, this probably means our 2758 * interface doesn't want to talk IP at all. (This could 2759 * be the case if somebody wants to speak only IPX, for 2760 * example.) Don't open IPCP in this case. 2761 */ 2762 if (hisaddr == 0) { 2763 /* XXX this message should go away */ 2764 if (debug) 2765 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 2766 ifp->if_xname); 2767 return; 2768 } 2769 2770 if (myaddr == 0) { 2771 /* 2772 * I don't have an assigned address, so i need to 2773 * negotiate my address. 2774 */ 2775 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2776 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2777 } 2778 if (hisaddr == 1) { 2779 /* 2780 * XXX - remove this hack! 2781 * remote has no valid address, we need to get one assigned. 2782 */ 2783 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2784 } 2785 sppp_open_event(&ipcp, sp); 2786 } 2787 2788 static void 2789 sppp_ipcp_close(struct sppp *sp) 2790 { 2791 STDDCL; 2792 2793 sppp_close_event(&ipcp, sp); 2794 #ifdef INET 2795 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2796 /* 2797 * Some address was dynamic, clear it again. 2798 */ 2799 sppp_clear_ip_addrs(sp); 2800 #endif 2801 2802 if (sp->pp_saved_mtu > 0) { 2803 ifp->if_mtu = sp->pp_saved_mtu; 2804 sp->pp_saved_mtu = 0; 2805 if (debug) 2806 log(LOG_DEBUG, 2807 "%s: resetting MTU to %" PRIu64 " bytes\n", 2808 ifp->if_xname, ifp->if_mtu); 2809 } 2810 } 2811 2812 static void 2813 sppp_ipcp_TO(void *cookie) 2814 { 2815 sppp_to_event(&ipcp, (struct sppp *)cookie); 2816 } 2817 2818 /* 2819 * Analyze a configure request. Return true if it was agreeable, and 2820 * caused action sca, false if it has been rejected or nak'ed, and 2821 * caused action scn. (The return value is used to make the state 2822 * transition decision in the state automaton.) 2823 */ 2824 static int 2825 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2826 { 2827 u_char *buf, *r, *p; 2828 struct ifnet *ifp = &sp->pp_if; 2829 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2830 uint32_t hisaddr, desiredaddr; 2831 2832 len -= 4; 2833 origlen = len; 2834 /* 2835 * Make sure to allocate a buf that can at least hold a 2836 * conf-nak with an `address' option. We might need it below. 2837 */ 2838 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2839 if (! buf) 2840 return (0); 2841 2842 /* pass 1: see if we can recognize them */ 2843 if (debug) 2844 log(LOG_DEBUG, "%s: ipcp parse opts:", 2845 ifp->if_xname); 2846 p = (void *)(h + 1); 2847 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2848 /* Sanity check option length */ 2849 if (p[1] > len) { 2850 /* XXX should we just RXJ? */ 2851 addlog("%s: malicious IPCP option received, dropping\n", 2852 ifp->if_xname); 2853 goto drop; 2854 } 2855 if (debug) 2856 addlog(" %s", sppp_ipcp_opt_name(*p)); 2857 switch (*p) { 2858 #ifdef notyet 2859 case IPCP_OPT_COMPRESSION: 2860 if (len >= 6 && p[1] >= 6) { 2861 /* correctly formed compress option */ 2862 continue; 2863 } 2864 if (debug) 2865 addlog(" [invalid]"); 2866 break; 2867 #endif 2868 case IPCP_OPT_ADDRESS: 2869 if (len >= 6 && p[1] == 6) { 2870 /* correctly formed address option */ 2871 continue; 2872 } 2873 if (debug) 2874 addlog(" [invalid]"); 2875 break; 2876 default: 2877 /* Others not supported. */ 2878 if (debug) 2879 addlog(" [rej]"); 2880 break; 2881 } 2882 /* Add the option to rejected list. */ 2883 bcopy (p, r, p[1]); 2884 r += p[1]; 2885 rlen += p[1]; 2886 } 2887 if (rlen) { 2888 if (debug) 2889 addlog(" send conf-rej\n"); 2890 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2891 goto end; 2892 } else if (debug) 2893 addlog("\n"); 2894 2895 /* pass 2: parse option values */ 2896 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2897 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2898 else 2899 #ifdef INET 2900 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2901 #else 2902 hisaddr = 0; 2903 #endif 2904 if (debug) 2905 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 2906 ifp->if_xname); 2907 p = (void *)(h + 1); 2908 len = origlen; 2909 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2910 if (debug) 2911 addlog(" %s", sppp_ipcp_opt_name(*p)); 2912 switch (*p) { 2913 #ifdef notyet 2914 case IPCP_OPT_COMPRESSION: 2915 continue; 2916 #endif 2917 case IPCP_OPT_ADDRESS: 2918 desiredaddr = p[2] << 24 | p[3] << 16 | 2919 p[4] << 8 | p[5]; 2920 if (desiredaddr == hisaddr || 2921 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2922 /* 2923 * Peer's address is same as our value, 2924 * this is agreeable. Gonna conf-ack 2925 * it. 2926 */ 2927 if (debug) 2928 addlog(" %s [ack]", 2929 sppp_dotted_quad(hisaddr)); 2930 /* record that we've seen it already */ 2931 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2932 sp->ipcp.req_hisaddr = desiredaddr; 2933 hisaddr = desiredaddr; 2934 continue; 2935 } 2936 /* 2937 * The address wasn't agreeable. This is either 2938 * he sent us 0.0.0.0, asking to assign him an 2939 * address, or he send us another address not 2940 * matching our value. Either case, we gonna 2941 * conf-nak it with our value. 2942 */ 2943 if (debug) { 2944 if (desiredaddr == 0) 2945 addlog(" [addr requested]"); 2946 else 2947 addlog(" %s [not agreed]", 2948 sppp_dotted_quad(desiredaddr)); 2949 } 2950 2951 p[2] = hisaddr >> 24; 2952 p[3] = hisaddr >> 16; 2953 p[4] = hisaddr >> 8; 2954 p[5] = hisaddr; 2955 break; 2956 } 2957 /* Add the option to nak'ed list. */ 2958 bcopy (p, r, p[1]); 2959 r += p[1]; 2960 rlen += p[1]; 2961 } 2962 2963 /* 2964 * If we are about to conf-ack the request, but haven't seen 2965 * his address so far, gonna conf-nak it instead, with the 2966 * `address' option present and our idea of his address being 2967 * filled in there, to request negotiation of both addresses. 2968 * 2969 * XXX This can result in an endless req - nak loop if peer 2970 * doesn't want to send us his address. Q: What should we do 2971 * about it? XXX A: implement the max-failure counter. 2972 */ 2973 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2974 buf[0] = IPCP_OPT_ADDRESS; 2975 buf[1] = 6; 2976 buf[2] = hisaddr >> 24; 2977 buf[3] = hisaddr >> 16; 2978 buf[4] = hisaddr >> 8; 2979 buf[5] = hisaddr; 2980 rlen = 6; 2981 if (debug) 2982 addlog(" still need hisaddr"); 2983 } 2984 2985 if (rlen) { 2986 if (debug) 2987 addlog(" send conf-nak\n"); 2988 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2989 } else { 2990 if (debug) 2991 addlog(" send conf-ack\n"); 2992 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 2993 } 2994 2995 end: 2996 free(buf, M_TEMP); 2997 return (rlen == 0); 2998 2999 drop: 3000 free(buf, M_TEMP); 3001 return -1; 3002 } 3003 3004 /* 3005 * Analyze the IPCP Configure-Reject option list, and adjust our 3006 * negotiation. 3007 */ 3008 static void 3009 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3010 { 3011 u_char *buf, *p; 3012 struct ifnet *ifp = &sp->pp_if; 3013 int debug = ifp->if_flags & IFF_DEBUG; 3014 3015 len -= 4; 3016 buf = malloc (len, M_TEMP, M_NOWAIT); 3017 if (!buf) 3018 return; 3019 3020 if (debug) 3021 log(LOG_DEBUG, "%s: ipcp rej opts:", 3022 ifp->if_xname); 3023 3024 p = (void *)(h + 1); 3025 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3026 /* Sanity check option length */ 3027 if (p[1] > len) { 3028 /* XXX should we just RXJ? */ 3029 addlog("%s: malicious IPCP option received, dropping\n", 3030 ifp->if_xname); 3031 goto drop; 3032 } 3033 if (debug) 3034 addlog(" %s", sppp_ipcp_opt_name(*p)); 3035 switch (*p) { 3036 case IPCP_OPT_ADDRESS: 3037 /* 3038 * Peer doesn't grok address option. This is 3039 * bad. XXX Should we better give up here? 3040 */ 3041 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3042 break; 3043 #ifdef notyet 3044 case IPCP_OPT_COMPRESS: 3045 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3046 break; 3047 #endif 3048 } 3049 } 3050 if (debug) 3051 addlog("\n"); 3052 drop: 3053 free(buf, M_TEMP); 3054 return; 3055 } 3056 3057 /* 3058 * Analyze the IPCP Configure-NAK option list, and adjust our 3059 * negotiation. 3060 */ 3061 static void 3062 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3063 { 3064 u_char *p; 3065 struct ifnet *ifp = &sp->pp_if; 3066 int debug = ifp->if_flags & IFF_DEBUG; 3067 uint32_t wantaddr; 3068 3069 len -= 4; 3070 3071 if (debug) 3072 log(LOG_DEBUG, "%s: ipcp nak opts:", 3073 ifp->if_xname); 3074 3075 p = (void *)(h + 1); 3076 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3077 /* Sanity check option length */ 3078 if (p[1] > len) { 3079 /* XXX should we just RXJ? */ 3080 addlog("%s: malicious IPCP option received, dropping\n", 3081 ifp->if_xname); 3082 return; 3083 } 3084 if (debug) 3085 addlog(" %s", sppp_ipcp_opt_name(*p)); 3086 switch (*p) { 3087 case IPCP_OPT_ADDRESS: 3088 /* 3089 * Peer doesn't like our local IP address. See 3090 * if we can do something for him. We'll drop 3091 * him our address then. 3092 */ 3093 if (len >= 6 && p[1] == 6) { 3094 wantaddr = p[2] << 24 | p[3] << 16 | 3095 p[4] << 8 | p[5]; 3096 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3097 if (debug) 3098 addlog(" [wantaddr %s]", 3099 sppp_dotted_quad(wantaddr)); 3100 /* 3101 * When doing dynamic address assignment, 3102 * we accept his offer. Otherwise, we 3103 * ignore it and thus continue to negotiate 3104 * our already existing value. 3105 */ 3106 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3107 if (debug) 3108 addlog(" [agree]"); 3109 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3110 sp->ipcp.req_myaddr = wantaddr; 3111 } 3112 } 3113 break; 3114 3115 case IPCP_OPT_PRIMDNS: 3116 if (len >= 6 && p[1] == 6) { 3117 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3118 p[4] << 8 | p[5]; 3119 } 3120 break; 3121 3122 case IPCP_OPT_SECDNS: 3123 if (len >= 6 && p[1] == 6) { 3124 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3125 p[4] << 8 | p[5]; 3126 } 3127 break; 3128 #ifdef notyet 3129 case IPCP_OPT_COMPRESS: 3130 /* 3131 * Peer wants different compression parameters. 3132 */ 3133 break; 3134 #endif 3135 } 3136 } 3137 if (debug) 3138 addlog("\n"); 3139 } 3140 3141 static void 3142 sppp_ipcp_tlu(struct sppp *sp) 3143 { 3144 #ifdef INET 3145 /* we are up. Set addresses and notify anyone interested */ 3146 STDDCL; 3147 uint32_t myaddr, hisaddr; 3148 3149 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3150 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3151 myaddr = sp->ipcp.req_myaddr; 3152 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3153 hisaddr = sp->ipcp.req_hisaddr; 3154 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3155 3156 if (ifp->if_mtu > sp->lcp.their_mru) { 3157 sp->pp_saved_mtu = ifp->if_mtu; 3158 ifp->if_mtu = sp->lcp.their_mru; 3159 if (debug) 3160 log(LOG_DEBUG, 3161 "%s: setting MTU to %" PRIu64 " bytes\n", 3162 ifp->if_xname, ifp->if_mtu); 3163 } 3164 3165 if (sp->pp_con) 3166 sp->pp_con(sp); 3167 #endif 3168 } 3169 3170 static void 3171 sppp_ipcp_tld(struct sppp *sp) 3172 { 3173 } 3174 3175 static void 3176 sppp_ipcp_tls(struct sppp *sp) 3177 { 3178 /* indicate to LCP that it must stay alive */ 3179 sp->lcp.protos |= (1 << IDX_IPCP); 3180 } 3181 3182 static void 3183 sppp_ipcp_tlf(struct sppp *sp) 3184 { 3185 /* we no longer need LCP */ 3186 sp->lcp.protos &= ~(1 << IDX_IPCP); 3187 } 3188 3189 static void 3190 sppp_ipcp_scr(struct sppp *sp) 3191 { 3192 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3193 #ifdef INET 3194 uint32_t ouraddr; 3195 #endif 3196 int i = 0; 3197 3198 #ifdef notyet 3199 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3200 opt[i++] = IPCP_OPT_COMPRESSION; 3201 opt[i++] = 6; 3202 opt[i++] = 0; /* VJ header compression */ 3203 opt[i++] = 0x2d; /* VJ header compression */ 3204 opt[i++] = max_slot_id; 3205 opt[i++] = comp_slot_id; 3206 } 3207 #endif 3208 3209 #ifdef INET 3210 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3211 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3212 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3213 else 3214 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3215 opt[i++] = IPCP_OPT_ADDRESS; 3216 opt[i++] = 6; 3217 opt[i++] = ouraddr >> 24; 3218 opt[i++] = ouraddr >> 16; 3219 opt[i++] = ouraddr >> 8; 3220 opt[i++] = ouraddr; 3221 } 3222 #endif 3223 3224 if (sp->query_dns & 1) { 3225 opt[i++] = IPCP_OPT_PRIMDNS; 3226 opt[i++] = 6; 3227 opt[i++] = sp->dns_addrs[0] >> 24; 3228 opt[i++] = sp->dns_addrs[0] >> 16; 3229 opt[i++] = sp->dns_addrs[0] >> 8; 3230 opt[i++] = sp->dns_addrs[0]; 3231 } 3232 if (sp->query_dns & 2) { 3233 opt[i++] = IPCP_OPT_SECDNS; 3234 opt[i++] = 6; 3235 opt[i++] = sp->dns_addrs[1] >> 24; 3236 opt[i++] = sp->dns_addrs[1] >> 16; 3237 opt[i++] = sp->dns_addrs[1] >> 8; 3238 opt[i++] = sp->dns_addrs[1]; 3239 } 3240 3241 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3242 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3243 } 3244 3245 3246 /* 3247 *--------------------------------------------------------------------------* 3248 * * 3249 * The IPv6CP implementation. * 3250 * * 3251 *--------------------------------------------------------------------------* 3252 */ 3253 3254 #ifdef INET6 3255 static void 3256 sppp_ipv6cp_init(struct sppp *sp) 3257 { 3258 sp->ipv6cp.opts = 0; 3259 sp->ipv6cp.flags = 0; 3260 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3261 sp->fail_counter[IDX_IPV6CP] = 0; 3262 sp->pp_seq[IDX_IPV6CP] = 0; 3263 sp->pp_rseq[IDX_IPV6CP] = 0; 3264 callout_init(&sp->ch[IDX_IPV6CP], 0); 3265 } 3266 3267 static void 3268 sppp_ipv6cp_up(struct sppp *sp) 3269 { 3270 sppp_up_event(&ipv6cp, sp); 3271 } 3272 3273 static void 3274 sppp_ipv6cp_down(struct sppp *sp) 3275 { 3276 sppp_down_event(&ipv6cp, sp); 3277 } 3278 3279 static void 3280 sppp_ipv6cp_open(struct sppp *sp) 3281 { 3282 STDDCL; 3283 struct in6_addr myaddr, hisaddr; 3284 3285 #ifdef IPV6CP_MYIFID_DYN 3286 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3287 #else 3288 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3289 #endif 3290 3291 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3292 /* 3293 * If we don't have our address, this probably means our 3294 * interface doesn't want to talk IPv6 at all. (This could 3295 * be the case if somebody wants to speak only IPX, for 3296 * example.) Don't open IPv6CP in this case. 3297 */ 3298 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3299 /* XXX this message should go away */ 3300 if (debug) 3301 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3302 ifp->if_xname); 3303 return; 3304 } 3305 3306 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3307 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3308 sppp_open_event(&ipv6cp, sp); 3309 } 3310 3311 static void 3312 sppp_ipv6cp_close(struct sppp *sp) 3313 { 3314 sppp_close_event(&ipv6cp, sp); 3315 } 3316 3317 static void 3318 sppp_ipv6cp_TO(void *cookie) 3319 { 3320 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3321 } 3322 3323 /* 3324 * Analyze a configure request. Return true if it was agreeable, and 3325 * caused action sca, false if it has been rejected or nak'ed, and 3326 * caused action scn. (The return value is used to make the state 3327 * transition decision in the state automaton.) 3328 */ 3329 static int 3330 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3331 { 3332 u_char *buf, *r, *p; 3333 struct ifnet *ifp = &sp->pp_if; 3334 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3335 struct in6_addr myaddr, desiredaddr, suggestaddr; 3336 int ifidcount; 3337 int type; 3338 int collision, nohisaddr; 3339 3340 len -= 4; 3341 origlen = len; 3342 /* 3343 * Make sure to allocate a buf that can at least hold a 3344 * conf-nak with an `address' option. We might need it below. 3345 */ 3346 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3347 if (! buf) 3348 return (0); 3349 3350 /* pass 1: see if we can recognize them */ 3351 if (debug) 3352 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3353 ifp->if_xname); 3354 p = (void *)(h + 1); 3355 ifidcount = 0; 3356 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3357 /* Sanity check option length */ 3358 if (p[1] > len) { 3359 /* XXX just RXJ? */ 3360 addlog("%s: received malicious IPCPv6 option, " 3361 "dropping\n", ifp->if_xname); 3362 goto drop; 3363 } 3364 if (debug) 3365 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3366 switch (*p) { 3367 case IPV6CP_OPT_IFID: 3368 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3369 /* correctly formed address option */ 3370 ifidcount++; 3371 continue; 3372 } 3373 if (debug) 3374 addlog(" [invalid]"); 3375 break; 3376 #ifdef notyet 3377 case IPV6CP_OPT_COMPRESSION: 3378 if (len >= 4 && p[1] >= 4) { 3379 /* correctly formed compress option */ 3380 continue; 3381 } 3382 if (debug) 3383 addlog(" [invalid]"); 3384 break; 3385 #endif 3386 default: 3387 /* Others not supported. */ 3388 if (debug) 3389 addlog(" [rej]"); 3390 break; 3391 } 3392 /* Add the option to rejected list. */ 3393 bcopy (p, r, p[1]); 3394 r += p[1]; 3395 rlen += p[1]; 3396 } 3397 if (rlen) { 3398 if (debug) 3399 addlog(" send conf-rej\n"); 3400 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3401 goto end; 3402 } else if (debug) 3403 addlog("\n"); 3404 3405 /* pass 2: parse option values */ 3406 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3407 if (debug) 3408 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3409 ifp->if_xname); 3410 p = (void *)(h + 1); 3411 len = origlen; 3412 type = CONF_ACK; 3413 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3414 if (debug) 3415 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3416 switch (*p) { 3417 #ifdef notyet 3418 case IPV6CP_OPT_COMPRESSION: 3419 continue; 3420 #endif 3421 case IPV6CP_OPT_IFID: 3422 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3423 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 3424 collision = (memcmp(&desiredaddr.s6_addr[8], 3425 &myaddr.s6_addr[8], 8) == 0); 3426 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3427 3428 desiredaddr.s6_addr16[0] = htons(0xfe80); 3429 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 3430 3431 if (!collision && !nohisaddr) { 3432 /* no collision, hisaddr known - Conf-Ack */ 3433 type = CONF_ACK; 3434 3435 if (debug) { 3436 addlog(" %s [%s]", 3437 ip6_sprintf(&desiredaddr), 3438 sppp_cp_type_name(type)); 3439 } 3440 continue; 3441 } 3442 3443 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3444 if (collision && nohisaddr) { 3445 /* collision, hisaddr unknown - Conf-Rej */ 3446 type = CONF_REJ; 3447 memset(&p[2], 0, 8); 3448 } else { 3449 /* 3450 * - no collision, hisaddr unknown, or 3451 * - collision, hisaddr known 3452 * Conf-Nak, suggest hisaddr 3453 */ 3454 type = CONF_NAK; 3455 sppp_suggest_ip6_addr(sp, &suggestaddr); 3456 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 3457 } 3458 if (debug) 3459 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3460 sppp_cp_type_name(type)); 3461 break; 3462 } 3463 /* Add the option to nak'ed list. */ 3464 bcopy (p, r, p[1]); 3465 r += p[1]; 3466 rlen += p[1]; 3467 } 3468 3469 if (rlen == 0 && type == CONF_ACK) { 3470 if (debug) 3471 addlog(" send %s\n", sppp_cp_type_name(type)); 3472 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3473 } else { 3474 #ifdef notdef 3475 if (type == CONF_ACK) 3476 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3477 #endif 3478 3479 if (debug) { 3480 addlog(" send %s suggest %s\n", 3481 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3482 } 3483 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3484 } 3485 3486 end: 3487 free(buf, M_TEMP); 3488 return (rlen == 0); 3489 3490 drop: 3491 free(buf, M_TEMP); 3492 return -1; 3493 } 3494 3495 /* 3496 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3497 * negotiation. 3498 */ 3499 static void 3500 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3501 { 3502 u_char *buf, *p; 3503 struct ifnet *ifp = &sp->pp_if; 3504 int debug = ifp->if_flags & IFF_DEBUG; 3505 3506 len -= 4; 3507 buf = malloc (len, M_TEMP, M_NOWAIT); 3508 if (!buf) 3509 return; 3510 3511 if (debug) 3512 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3513 ifp->if_xname); 3514 3515 p = (void *)(h + 1); 3516 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3517 if (p[1] > len) { 3518 /* XXX just RXJ? */ 3519 addlog("%s: received malicious IPCPv6 option, " 3520 "dropping\n", ifp->if_xname); 3521 goto drop; 3522 } 3523 if (debug) 3524 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3525 switch (*p) { 3526 case IPV6CP_OPT_IFID: 3527 /* 3528 * Peer doesn't grok address option. This is 3529 * bad. XXX Should we better give up here? 3530 */ 3531 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3532 break; 3533 #ifdef notyet 3534 case IPV6CP_OPT_COMPRESS: 3535 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3536 break; 3537 #endif 3538 } 3539 } 3540 if (debug) 3541 addlog("\n"); 3542 drop: 3543 free(buf, M_TEMP); 3544 return; 3545 } 3546 3547 /* 3548 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3549 * negotiation. 3550 */ 3551 static void 3552 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3553 { 3554 u_char *buf, *p; 3555 struct ifnet *ifp = &sp->pp_if; 3556 int debug = ifp->if_flags & IFF_DEBUG; 3557 struct in6_addr suggestaddr; 3558 3559 len -= 4; 3560 buf = malloc (len, M_TEMP, M_NOWAIT); 3561 if (!buf) 3562 return; 3563 3564 if (debug) 3565 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 3566 ifp->if_xname); 3567 3568 p = (void *)(h + 1); 3569 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3570 if (p[1] > len) { 3571 /* XXX just RXJ? */ 3572 addlog("%s: received malicious IPCPv6 option, " 3573 "dropping\n", ifp->if_xname); 3574 goto drop; 3575 } 3576 if (debug) 3577 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3578 switch (*p) { 3579 case IPV6CP_OPT_IFID: 3580 /* 3581 * Peer doesn't like our local ifid. See 3582 * if we can do something for him. We'll drop 3583 * him our address then. 3584 */ 3585 if (len < 10 || p[1] != 10) 3586 break; 3587 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3588 suggestaddr.s6_addr16[0] = htons(0xfe80); 3589 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 3590 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 3591 3592 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3593 if (debug) 3594 addlog(" [suggestaddr %s]", 3595 ip6_sprintf(&suggestaddr)); 3596 #ifdef IPV6CP_MYIFID_DYN 3597 /* 3598 * When doing dynamic address assignment, 3599 * we accept his offer. 3600 */ 3601 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3602 struct in6_addr lastsuggest; 3603 /* 3604 * If <suggested myaddr from peer> equals to 3605 * <hisaddr we have suggested last time>, 3606 * we have a collision. generate new random 3607 * ifid. 3608 */ 3609 sppp_suggest_ip6_addr(&lastsuggest); 3610 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3611 lastsuggest)) { 3612 if (debug) 3613 addlog(" [random]"); 3614 sppp_gen_ip6_addr(sp, &suggestaddr); 3615 } 3616 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3617 if (debug) 3618 addlog(" [agree]"); 3619 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3620 } 3621 #else 3622 /* 3623 * Since we do not do dynamic address assignment, 3624 * we ignore it and thus continue to negotiate 3625 * our already existing value. This can possibly 3626 * go into infinite request-reject loop. 3627 * 3628 * This is not likely because we normally use 3629 * ifid based on MAC-address. 3630 * If you have no ethernet card on the node, too bad. 3631 * XXX should we use fail_counter? 3632 */ 3633 #endif 3634 break; 3635 #ifdef notyet 3636 case IPV6CP_OPT_COMPRESS: 3637 /* 3638 * Peer wants different compression parameters. 3639 */ 3640 break; 3641 #endif 3642 } 3643 } 3644 if (debug) 3645 addlog("\n"); 3646 drop: 3647 free(buf, M_TEMP); 3648 return; 3649 } 3650 3651 static void 3652 sppp_ipv6cp_tlu(struct sppp *sp) 3653 { 3654 /* we are up - notify isdn daemon */ 3655 if (sp->pp_con) 3656 sp->pp_con(sp); 3657 } 3658 3659 static void 3660 sppp_ipv6cp_tld(struct sppp *sp) 3661 { 3662 } 3663 3664 static void 3665 sppp_ipv6cp_tls(struct sppp *sp) 3666 { 3667 /* indicate to LCP that it must stay alive */ 3668 sp->lcp.protos |= (1 << IDX_IPV6CP); 3669 } 3670 3671 static void 3672 sppp_ipv6cp_tlf(struct sppp *sp) 3673 { 3674 /* we no longer need LCP */ 3675 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3676 } 3677 3678 static void 3679 sppp_ipv6cp_scr(struct sppp *sp) 3680 { 3681 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3682 struct in6_addr ouraddr; 3683 int i = 0; 3684 3685 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3686 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3687 opt[i++] = IPV6CP_OPT_IFID; 3688 opt[i++] = 10; 3689 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 3690 i += 8; 3691 } 3692 3693 #ifdef notyet 3694 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3695 opt[i++] = IPV6CP_OPT_COMPRESSION; 3696 opt[i++] = 4; 3697 opt[i++] = 0; /* TBD */ 3698 opt[i++] = 0; /* TBD */ 3699 /* variable length data may follow */ 3700 } 3701 #endif 3702 3703 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3704 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3705 } 3706 #else /*INET6*/ 3707 static void 3708 sppp_ipv6cp_init(struct sppp *sp) 3709 { 3710 } 3711 3712 static void 3713 sppp_ipv6cp_up(struct sppp *sp) 3714 { 3715 } 3716 3717 static void 3718 sppp_ipv6cp_down(struct sppp *sp) 3719 { 3720 } 3721 3722 static void 3723 sppp_ipv6cp_open(struct sppp *sp) 3724 { 3725 } 3726 3727 static void 3728 sppp_ipv6cp_close(struct sppp *sp) 3729 { 3730 } 3731 3732 static void 3733 sppp_ipv6cp_TO(void *sp) 3734 { 3735 } 3736 3737 static int 3738 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 3739 int len) 3740 { 3741 return 0; 3742 } 3743 3744 static void 3745 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 3746 int len) 3747 { 3748 } 3749 3750 static void 3751 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 3752 int len) 3753 { 3754 } 3755 3756 static void 3757 sppp_ipv6cp_tlu(struct sppp *sp) 3758 { 3759 } 3760 3761 static void 3762 sppp_ipv6cp_tld(struct sppp *sp) 3763 { 3764 } 3765 3766 static void 3767 sppp_ipv6cp_tls(struct sppp *sp) 3768 { 3769 } 3770 3771 static void 3772 sppp_ipv6cp_tlf(struct sppp *sp) 3773 { 3774 } 3775 3776 static void 3777 sppp_ipv6cp_scr(struct sppp *sp) 3778 { 3779 } 3780 #endif /*INET6*/ 3781 3782 3783 /* 3784 *--------------------------------------------------------------------------* 3785 * * 3786 * The CHAP implementation. * 3787 * * 3788 *--------------------------------------------------------------------------* 3789 */ 3790 3791 /* 3792 * The authentication protocols don't employ a full-fledged state machine as 3793 * the control protocols do, since they do have Open and Close events, but 3794 * not Up and Down, nor are they explicitly terminated. Also, use of the 3795 * authentication protocols may be different in both directions (this makes 3796 * sense, think of a machine that never accepts incoming calls but only 3797 * calls out, it doesn't require the called party to authenticate itself). 3798 * 3799 * Our state machine for the local authentication protocol (we are requesting 3800 * the peer to authenticate) looks like: 3801 * 3802 * RCA- 3803 * +--------------------------------------------+ 3804 * V scn,tld| 3805 * +--------+ Close +---------+ RCA+ 3806 * | |<----------------------------------| |------+ 3807 * +--->| Closed | TO* | Opened | sca | 3808 * | | |-----+ +-------| |<-----+ 3809 * | +--------+ irc | | +---------+ 3810 * | ^ | | ^ 3811 * | | | | | 3812 * | | | | | 3813 * | TO-| | | | 3814 * | |tld TO+ V | | 3815 * | | +------->+ | | 3816 * | | | | | | 3817 * | +--------+ V | | 3818 * | | |<----+<--------------------+ | 3819 * | | Req- | scr | 3820 * | | Sent | | 3821 * | | | | 3822 * | +--------+ | 3823 * | RCA- | | RCA+ | 3824 * +------+ +------------------------------------------+ 3825 * scn,tld sca,irc,ict,tlu 3826 * 3827 * 3828 * with: 3829 * 3830 * Open: LCP reached authentication phase 3831 * Close: LCP reached terminate phase 3832 * 3833 * RCA+: received reply (pap-req, chap-response), acceptable 3834 * RCN: received reply (pap-req, chap-response), not acceptable 3835 * TO+: timeout with restart counter >= 0 3836 * TO-: timeout with restart counter < 0 3837 * TO*: reschedule timeout for CHAP 3838 * 3839 * scr: send request packet (none for PAP, chap-challenge) 3840 * sca: send ack packet (pap-ack, chap-success) 3841 * scn: send nak packet (pap-nak, chap-failure) 3842 * ict: initialize re-challenge timer (CHAP only) 3843 * 3844 * tlu: this-layer-up, LCP reaches network phase 3845 * tld: this-layer-down, LCP enters terminate phase 3846 * 3847 * Note that in CHAP mode, after sending a new challenge, while the state 3848 * automaton falls back into Req-Sent state, it doesn't signal a tld 3849 * event to LCP, so LCP remains in network phase. Only after not getting 3850 * any response (or after getting an unacceptable response), CHAP closes, 3851 * causing LCP to enter terminate phase. 3852 * 3853 * With PAP, there is no initial request that can be sent. The peer is 3854 * expected to send one based on the successful negotiation of PAP as 3855 * the authentication protocol during the LCP option negotiation. 3856 * 3857 * Incoming authentication protocol requests (remote requests 3858 * authentication, we are peer) don't employ a state machine at all, 3859 * they are simply answered. Some peers [Ascend P50 firmware rev 3860 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3861 * still in authentication phase (thereby violating the standard that 3862 * demands that these NCP packets are to be discarded), so we keep 3863 * track of the peer demanding us to authenticate, and only proceed to 3864 * phase network once we've seen a positive acknowledge for the 3865 * authentication. 3866 */ 3867 3868 /* 3869 * Handle incoming CHAP packets. 3870 */ 3871 void 3872 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3873 { 3874 STDDCL; 3875 struct lcp_header *h; 3876 int len, x; 3877 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3878 int value_len, name_len; 3879 MD5_CTX ctx; 3880 3881 len = m->m_pkthdr.len; 3882 if (len < 4) { 3883 if (debug) 3884 log(LOG_DEBUG, 3885 "%s: chap invalid packet length: %d bytes\n", 3886 ifp->if_xname, len); 3887 return; 3888 } 3889 h = mtod(m, struct lcp_header *); 3890 if (len > ntohs(h->len)) 3891 len = ntohs(h->len); 3892 3893 switch (h->type) { 3894 /* challenge, failure and success are his authproto */ 3895 case CHAP_CHALLENGE: 3896 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3897 /* can't do anything useful */ 3898 sp->pp_auth_failures++; 3899 printf("%s: chap input without my name and my secret being set\n", 3900 ifp->if_xname); 3901 break; 3902 } 3903 value = 1 + (u_char *)(h + 1); 3904 value_len = value[-1]; 3905 name = value + value_len; 3906 name_len = len - value_len - 5; 3907 if (name_len < 0) { 3908 if (debug) { 3909 log(LOG_DEBUG, 3910 "%s: chap corrupted challenge " 3911 "<%s id=0x%x len=%d", 3912 ifp->if_xname, 3913 sppp_auth_type_name(PPP_CHAP, h->type), 3914 h->ident, ntohs(h->len)); 3915 if (len > 4) 3916 sppp_print_bytes((u_char *)(h + 1), 3917 len - 4); 3918 addlog(">\n"); 3919 } 3920 break; 3921 } 3922 3923 if (debug) { 3924 log(LOG_DEBUG, 3925 "%s: chap input <%s id=0x%x len=%d name=", 3926 ifp->if_xname, 3927 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3928 ntohs(h->len)); 3929 sppp_print_string((char *) name, name_len); 3930 addlog(" value-size=%d value=", value_len); 3931 sppp_print_bytes(value, value_len); 3932 addlog(">\n"); 3933 } 3934 3935 /* Compute reply value. */ 3936 MD5Init(&ctx); 3937 MD5Update(&ctx, &h->ident, 1); 3938 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3939 MD5Update(&ctx, value, value_len); 3940 MD5Final(digest, &ctx); 3941 dsize = sizeof digest; 3942 3943 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3944 sizeof dsize, (const char *)&dsize, 3945 sizeof digest, digest, 3946 sp->myauth.name_len, 3947 sp->myauth.name, 3948 0); 3949 break; 3950 3951 case CHAP_SUCCESS: 3952 if (debug) { 3953 log(LOG_DEBUG, "%s: chap success", 3954 ifp->if_xname); 3955 if (len > 4) { 3956 addlog(": "); 3957 sppp_print_string((char *)(h + 1), len - 4); 3958 } 3959 addlog("\n"); 3960 } 3961 x = splnet(); 3962 sp->pp_auth_failures = 0; 3963 sp->pp_flags &= ~PP_NEEDAUTH; 3964 if (sp->myauth.proto == PPP_CHAP && 3965 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3966 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3967 /* 3968 * We are authenticator for CHAP but didn't 3969 * complete yet. Leave it to tlu to proceed 3970 * to network phase. 3971 */ 3972 splx(x); 3973 break; 3974 } 3975 splx(x); 3976 sppp_phase_network(sp); 3977 break; 3978 3979 case CHAP_FAILURE: 3980 x = splnet(); 3981 sp->pp_auth_failures++; 3982 splx(x); 3983 if (debug) { 3984 log(LOG_INFO, "%s: chap failure", 3985 ifp->if_xname); 3986 if (len > 4) { 3987 addlog(": "); 3988 sppp_print_string((char *)(h + 1), len - 4); 3989 } 3990 addlog("\n"); 3991 } else 3992 log(LOG_INFO, "%s: chap failure\n", 3993 ifp->if_xname); 3994 /* await LCP shutdown by authenticator */ 3995 break; 3996 3997 /* response is my authproto */ 3998 case CHAP_RESPONSE: 3999 if (sp->hisauth.secret == NULL) { 4000 /* can't do anything useful */ 4001 printf("%s: chap input without his secret being set\n", 4002 ifp->if_xname); 4003 break; 4004 } 4005 value = 1 + (u_char *)(h + 1); 4006 value_len = value[-1]; 4007 name = value + value_len; 4008 name_len = len - value_len - 5; 4009 if (name_len < 0) { 4010 if (debug) { 4011 log(LOG_DEBUG, 4012 "%s: chap corrupted response " 4013 "<%s id=0x%x len=%d", 4014 ifp->if_xname, 4015 sppp_auth_type_name(PPP_CHAP, h->type), 4016 h->ident, ntohs(h->len)); 4017 if (len > 4) 4018 sppp_print_bytes((u_char *)(h + 1), 4019 len - 4); 4020 addlog(">\n"); 4021 } 4022 break; 4023 } 4024 if (h->ident != sp->confid[IDX_CHAP]) { 4025 if (debug) 4026 log(LOG_DEBUG, 4027 "%s: chap dropping response for old ID " 4028 "(got %d, expected %d)\n", 4029 ifp->if_xname, 4030 h->ident, sp->confid[IDX_CHAP]); 4031 break; 4032 } 4033 if (sp->hisauth.name != NULL && 4034 (name_len != sp->hisauth.name_len 4035 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4036 log(LOG_INFO, "%s: chap response, his name ", 4037 ifp->if_xname); 4038 sppp_print_string(name, name_len); 4039 addlog(" != expected "); 4040 sppp_print_string(sp->hisauth.name, 4041 sp->hisauth.name_len); 4042 addlog("\n"); 4043 goto chap_failure; 4044 } 4045 if (debug) { 4046 log(LOG_DEBUG, "%s: chap input(%s) " 4047 "<%s id=0x%x len=%d name=", 4048 ifp->if_xname, 4049 sppp_state_name(sp->state[IDX_CHAP]), 4050 sppp_auth_type_name(PPP_CHAP, h->type), 4051 h->ident, ntohs(h->len)); 4052 sppp_print_string((char *)name, name_len); 4053 addlog(" value-size=%d value=", value_len); 4054 sppp_print_bytes(value, value_len); 4055 addlog(">\n"); 4056 } 4057 if (value_len != sizeof(sp->myauth.challenge)) { 4058 if (debug) 4059 log(LOG_DEBUG, 4060 "%s: chap bad hash value length: " 4061 "%d bytes, should be %ld\n", 4062 ifp->if_xname, value_len, 4063 (long) sizeof(sp->myauth.challenge)); 4064 goto chap_failure; 4065 } 4066 4067 MD5Init(&ctx); 4068 MD5Update(&ctx, &h->ident, 1); 4069 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4070 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 4071 MD5Final(digest, &ctx); 4072 4073 #define FAILMSG "Failed..." 4074 #define SUCCMSG "Welcome!" 4075 4076 if (value_len != sizeof digest || 4077 memcmp(digest, value, value_len) != 0) { 4078 chap_failure: 4079 /* action scn, tld */ 4080 x = splnet(); 4081 sp->pp_auth_failures++; 4082 splx(x); 4083 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4084 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4085 0); 4086 chap.tld(sp); 4087 break; 4088 } 4089 sp->pp_auth_failures = 0; 4090 /* action sca, perhaps tlu */ 4091 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4092 sp->state[IDX_CHAP] == STATE_OPENED) 4093 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4094 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4095 0); 4096 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4097 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4098 chap.tlu(sp); 4099 } 4100 break; 4101 4102 default: 4103 /* Unknown CHAP packet type -- ignore. */ 4104 if (debug) { 4105 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4106 "<0x%x id=0x%xh len=%d", 4107 ifp->if_xname, 4108 sppp_state_name(sp->state[IDX_CHAP]), 4109 h->type, h->ident, ntohs(h->len)); 4110 if (len > 4) 4111 sppp_print_bytes((u_char *)(h + 1), len - 4); 4112 addlog(">\n"); 4113 } 4114 break; 4115 4116 } 4117 } 4118 4119 static void 4120 sppp_chap_init(struct sppp *sp) 4121 { 4122 /* Chap doesn't have STATE_INITIAL at all. */ 4123 sp->state[IDX_CHAP] = STATE_CLOSED; 4124 sp->fail_counter[IDX_CHAP] = 0; 4125 sp->pp_seq[IDX_CHAP] = 0; 4126 sp->pp_rseq[IDX_CHAP] = 0; 4127 callout_init(&sp->ch[IDX_CHAP], 0); 4128 } 4129 4130 static void 4131 sppp_chap_open(struct sppp *sp) 4132 { 4133 if (sp->myauth.proto == PPP_CHAP && 4134 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4135 /* we are authenticator for CHAP, start it */ 4136 chap.scr(sp); 4137 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4138 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4139 } 4140 /* nothing to be done if we are peer, await a challenge */ 4141 } 4142 4143 static void 4144 sppp_chap_close(struct sppp *sp) 4145 { 4146 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4147 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4148 } 4149 4150 static void 4151 sppp_chap_TO(void *cookie) 4152 { 4153 struct sppp *sp = (struct sppp *)cookie; 4154 STDDCL; 4155 int s; 4156 4157 s = splnet(); 4158 if (debug) 4159 log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n", 4160 ifp->if_xname, 4161 sppp_state_name(sp->state[IDX_CHAP]), 4162 sp->rst_counter[IDX_CHAP]); 4163 4164 if (--sp->rst_counter[IDX_CHAP] < 0) 4165 /* TO- event */ 4166 switch (sp->state[IDX_CHAP]) { 4167 case STATE_REQ_SENT: 4168 chap.tld(sp); 4169 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4170 break; 4171 } 4172 else 4173 /* TO+ (or TO*) event */ 4174 switch (sp->state[IDX_CHAP]) { 4175 case STATE_OPENED: 4176 /* TO* event */ 4177 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4178 /* fall through */ 4179 case STATE_REQ_SENT: 4180 chap.scr(sp); 4181 /* sppp_cp_change_state() will restart the timer */ 4182 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4183 break; 4184 } 4185 4186 splx(s); 4187 } 4188 4189 static void 4190 sppp_chap_tlu(struct sppp *sp) 4191 { 4192 STDDCL; 4193 int i, x; 4194 4195 i = 0; 4196 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4197 4198 /* 4199 * Some broken CHAP implementations (Conware CoNet, firmware 4200 * 4.0.?) don't want to re-authenticate their CHAP once the 4201 * initial challenge-response exchange has taken place. 4202 * Provide for an option to avoid rechallenges. 4203 */ 4204 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4205 /* 4206 * Compute the re-challenge timeout. This will yield 4207 * a number between 300 and 810 seconds. 4208 */ 4209 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4210 4211 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4212 } 4213 4214 if (debug) { 4215 log(LOG_DEBUG, 4216 "%s: chap %s, ", 4217 ifp->if_xname, 4218 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4219 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4220 addlog("next re-challenge in %d seconds\n", i); 4221 else 4222 addlog("re-challenging supressed\n"); 4223 } 4224 4225 x = splnet(); 4226 sp->pp_auth_failures = 0; 4227 /* indicate to LCP that we need to be closed down */ 4228 sp->lcp.protos |= (1 << IDX_CHAP); 4229 4230 if (sp->pp_flags & PP_NEEDAUTH) { 4231 /* 4232 * Remote is authenticator, but his auth proto didn't 4233 * complete yet. Defer the transition to network 4234 * phase. 4235 */ 4236 splx(x); 4237 return; 4238 } 4239 splx(x); 4240 4241 /* 4242 * If we are already in phase network, we are done here. This 4243 * is the case if this is a dummy tlu event after a re-challenge. 4244 */ 4245 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4246 sppp_phase_network(sp); 4247 } 4248 4249 static void 4250 sppp_chap_tld(struct sppp *sp) 4251 { 4252 STDDCL; 4253 4254 if (debug) 4255 log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname); 4256 callout_stop(&sp->ch[IDX_CHAP]); 4257 sp->lcp.protos &= ~(1 << IDX_CHAP); 4258 4259 lcp.Close(sp); 4260 } 4261 4262 static void 4263 sppp_chap_scr(struct sppp *sp) 4264 { 4265 uint32_t *ch; 4266 u_char clen = 4 * sizeof(uint32_t); 4267 4268 if (sp->myauth.name == NULL) { 4269 /* can't do anything useful */ 4270 printf("%s: chap starting without my name being set\n", 4271 sp->pp_if.if_xname); 4272 return; 4273 } 4274 4275 /* Compute random challenge. */ 4276 ch = (uint32_t *)sp->myauth.challenge; 4277 cprng_strong(kern_cprng, ch, clen, 0); 4278 4279 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4280 4281 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4282 sizeof clen, (const char *)&clen, 4283 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4284 sp->myauth.name_len, 4285 sp->myauth.name, 4286 0); 4287 } 4288 4289 /* 4290 *--------------------------------------------------------------------------* 4291 * * 4292 * The PAP implementation. * 4293 * * 4294 *--------------------------------------------------------------------------* 4295 */ 4296 /* 4297 * For PAP, we need to keep a little state also if we are the peer, not the 4298 * authenticator. This is since we don't get a request to authenticate, but 4299 * have to repeatedly authenticate ourself until we got a response (or the 4300 * retry counter is expired). 4301 */ 4302 4303 /* 4304 * Handle incoming PAP packets. */ 4305 static void 4306 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4307 { 4308 STDDCL; 4309 struct lcp_header *h; 4310 int len, x; 4311 u_char mlen; 4312 char *name, *secret; 4313 int name_len, secret_len; 4314 4315 /* 4316 * Malicious input might leave this uninitialized, so 4317 * init to an impossible value. 4318 */ 4319 secret_len = -1; 4320 4321 len = m->m_pkthdr.len; 4322 if (len < 5) { 4323 if (debug) 4324 log(LOG_DEBUG, 4325 "%s: pap invalid packet length: %d bytes\n", 4326 ifp->if_xname, len); 4327 return; 4328 } 4329 h = mtod(m, struct lcp_header *); 4330 if (len > ntohs(h->len)) 4331 len = ntohs(h->len); 4332 switch (h->type) { 4333 /* PAP request is my authproto */ 4334 case PAP_REQ: 4335 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4336 /* can't do anything useful */ 4337 printf("%s: pap request without his name and his secret being set\n", 4338 ifp->if_xname); 4339 break; 4340 } 4341 name = 1 + (u_char *)(h + 1); 4342 name_len = name[-1]; 4343 secret = name + name_len + 1; 4344 if (name_len > len - 6 || 4345 (secret_len = secret[-1]) > len - 6 - name_len) { 4346 if (debug) { 4347 log(LOG_DEBUG, "%s: pap corrupted input " 4348 "<%s id=0x%x len=%d", 4349 ifp->if_xname, 4350 sppp_auth_type_name(PPP_PAP, h->type), 4351 h->ident, ntohs(h->len)); 4352 if (len > 4) 4353 sppp_print_bytes((u_char *)(h + 1), 4354 len - 4); 4355 addlog(">\n"); 4356 } 4357 break; 4358 } 4359 if (debug) { 4360 log(LOG_DEBUG, "%s: pap input(%s) " 4361 "<%s id=0x%x len=%d name=", 4362 ifp->if_xname, 4363 sppp_state_name(sp->state[IDX_PAP]), 4364 sppp_auth_type_name(PPP_PAP, h->type), 4365 h->ident, ntohs(h->len)); 4366 sppp_print_string((char *)name, name_len); 4367 addlog(" secret="); 4368 sppp_print_string((char *)secret, secret_len); 4369 addlog(">\n"); 4370 } 4371 if (name_len != sp->hisauth.name_len || 4372 secret_len != sp->hisauth.secret_len || 4373 memcmp(name, sp->hisauth.name, name_len) != 0 || 4374 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4375 /* action scn, tld */ 4376 sp->pp_auth_failures++; 4377 mlen = sizeof(FAILMSG) - 1; 4378 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4379 sizeof mlen, (const char *)&mlen, 4380 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4381 0); 4382 pap.tld(sp); 4383 break; 4384 } 4385 /* action sca, perhaps tlu */ 4386 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4387 sp->state[IDX_PAP] == STATE_OPENED) { 4388 mlen = sizeof(SUCCMSG) - 1; 4389 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4390 sizeof mlen, (const char *)&mlen, 4391 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4392 0); 4393 } 4394 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4395 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4396 pap.tlu(sp); 4397 } 4398 break; 4399 4400 /* ack and nak are his authproto */ 4401 case PAP_ACK: 4402 callout_stop(&sp->pap_my_to_ch); 4403 if (debug) { 4404 log(LOG_DEBUG, "%s: pap success", 4405 ifp->if_xname); 4406 name = 1 + (u_char *)(h + 1); 4407 name_len = name[-1]; 4408 if (len > 5 && name_len < len+4) { 4409 addlog(": "); 4410 sppp_print_string(name, name_len); 4411 } 4412 addlog("\n"); 4413 } 4414 x = splnet(); 4415 sp->pp_auth_failures = 0; 4416 sp->pp_flags &= ~PP_NEEDAUTH; 4417 if (sp->myauth.proto == PPP_PAP && 4418 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4419 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4420 /* 4421 * We are authenticator for PAP but didn't 4422 * complete yet. Leave it to tlu to proceed 4423 * to network phase. 4424 */ 4425 splx(x); 4426 break; 4427 } 4428 splx(x); 4429 sppp_phase_network(sp); 4430 break; 4431 4432 case PAP_NAK: 4433 callout_stop(&sp->pap_my_to_ch); 4434 sp->pp_auth_failures++; 4435 if (debug) { 4436 log(LOG_INFO, "%s: pap failure", 4437 ifp->if_xname); 4438 name = 1 + (u_char *)(h + 1); 4439 name_len = name[-1]; 4440 if (len > 5 && name_len < len+4) { 4441 addlog(": "); 4442 sppp_print_string(name, name_len); 4443 } 4444 addlog("\n"); 4445 } else 4446 log(LOG_INFO, "%s: pap failure\n", 4447 ifp->if_xname); 4448 /* await LCP shutdown by authenticator */ 4449 break; 4450 4451 default: 4452 /* Unknown PAP packet type -- ignore. */ 4453 if (debug) { 4454 log(LOG_DEBUG, "%s: pap corrupted input " 4455 "<0x%x id=0x%x len=%d", 4456 ifp->if_xname, 4457 h->type, h->ident, ntohs(h->len)); 4458 if (len > 4) 4459 sppp_print_bytes((u_char *)(h + 1), len - 4); 4460 addlog(">\n"); 4461 } 4462 break; 4463 4464 } 4465 } 4466 4467 static void 4468 sppp_pap_init(struct sppp *sp) 4469 { 4470 /* PAP doesn't have STATE_INITIAL at all. */ 4471 sp->state[IDX_PAP] = STATE_CLOSED; 4472 sp->fail_counter[IDX_PAP] = 0; 4473 sp->pp_seq[IDX_PAP] = 0; 4474 sp->pp_rseq[IDX_PAP] = 0; 4475 callout_init(&sp->ch[IDX_PAP], 0); 4476 callout_init(&sp->pap_my_to_ch, 0); 4477 } 4478 4479 static void 4480 sppp_pap_open(struct sppp *sp) 4481 { 4482 if (sp->hisauth.proto == PPP_PAP && 4483 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4484 /* we are authenticator for PAP, start our timer */ 4485 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4486 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4487 } 4488 if (sp->myauth.proto == PPP_PAP) { 4489 /* we are peer, send a request, and start a timer */ 4490 pap.scr(sp); 4491 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4492 sppp_pap_my_TO, sp); 4493 } 4494 } 4495 4496 static void 4497 sppp_pap_close(struct sppp *sp) 4498 { 4499 if (sp->state[IDX_PAP] != STATE_CLOSED) 4500 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4501 } 4502 4503 /* 4504 * That's the timeout routine if we are authenticator. Since the 4505 * authenticator is basically passive in PAP, we can't do much here. 4506 */ 4507 static void 4508 sppp_pap_TO(void *cookie) 4509 { 4510 struct sppp *sp = (struct sppp *)cookie; 4511 STDDCL; 4512 int s; 4513 4514 s = splnet(); 4515 if (debug) 4516 log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n", 4517 ifp->if_xname, 4518 sppp_state_name(sp->state[IDX_PAP]), 4519 sp->rst_counter[IDX_PAP]); 4520 4521 if (--sp->rst_counter[IDX_PAP] < 0) 4522 /* TO- event */ 4523 switch (sp->state[IDX_PAP]) { 4524 case STATE_REQ_SENT: 4525 pap.tld(sp); 4526 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4527 break; 4528 } 4529 else 4530 /* TO+ event, not very much we could do */ 4531 switch (sp->state[IDX_PAP]) { 4532 case STATE_REQ_SENT: 4533 /* sppp_cp_change_state() will restart the timer */ 4534 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4535 break; 4536 } 4537 4538 splx(s); 4539 } 4540 4541 /* 4542 * That's the timeout handler if we are peer. Since the peer is active, 4543 * we need to retransmit our PAP request since it is apparently lost. 4544 * XXX We should impose a max counter. 4545 */ 4546 static void 4547 sppp_pap_my_TO(void *cookie) 4548 { 4549 struct sppp *sp = (struct sppp *)cookie; 4550 STDDCL; 4551 4552 if (debug) 4553 log(LOG_DEBUG, "%s: pap peer TO\n", 4554 ifp->if_xname); 4555 4556 pap.scr(sp); 4557 } 4558 4559 static void 4560 sppp_pap_tlu(struct sppp *sp) 4561 { 4562 STDDCL; 4563 int x; 4564 4565 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4566 4567 if (debug) 4568 log(LOG_DEBUG, "%s: %s tlu\n", 4569 ifp->if_xname, pap.name); 4570 4571 x = splnet(); 4572 sp->pp_auth_failures = 0; 4573 /* indicate to LCP that we need to be closed down */ 4574 sp->lcp.protos |= (1 << IDX_PAP); 4575 4576 if (sp->pp_flags & PP_NEEDAUTH) { 4577 /* 4578 * Remote is authenticator, but his auth proto didn't 4579 * complete yet. Defer the transition to network 4580 * phase. 4581 */ 4582 splx(x); 4583 return; 4584 } 4585 splx(x); 4586 sppp_phase_network(sp); 4587 } 4588 4589 static void 4590 sppp_pap_tld(struct sppp *sp) 4591 { 4592 STDDCL; 4593 4594 if (debug) 4595 log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname); 4596 callout_stop(&sp->ch[IDX_PAP]); 4597 callout_stop(&sp->pap_my_to_ch); 4598 sp->lcp.protos &= ~(1 << IDX_PAP); 4599 4600 lcp.Close(sp); 4601 } 4602 4603 static void 4604 sppp_pap_scr(struct sppp *sp) 4605 { 4606 u_char idlen, pwdlen; 4607 4608 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4609 /* can't do anything useful */ 4610 printf("%s: pap starting without my name and secret being set\n", 4611 sp->pp_if.if_xname); 4612 return; 4613 } 4614 4615 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4616 pwdlen = sp->myauth.secret_len; 4617 idlen = sp->myauth.name_len; 4618 4619 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4620 sizeof idlen, (const char *)&idlen, 4621 idlen, sp->myauth.name, 4622 sizeof pwdlen, (const char *)&pwdlen, 4623 pwdlen, sp->myauth.secret, 4624 0); 4625 } 4626 4627 /* 4628 * Random miscellaneous functions. 4629 */ 4630 4631 /* 4632 * Send a PAP or CHAP proto packet. 4633 * 4634 * Varadic function, each of the elements for the ellipsis is of type 4635 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4636 * mlen == 0. 4637 * NOTE: never declare variadic functions with types subject to type 4638 * promotion (i.e. u_char). This is asking for big trouble depending 4639 * on the architecture you are on... 4640 */ 4641 4642 static void 4643 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4644 unsigned int type, unsigned int id, 4645 ...) 4646 { 4647 STDDCL; 4648 struct lcp_header *lh; 4649 struct mbuf *m; 4650 u_char *p; 4651 int len; 4652 size_t pkthdrlen; 4653 unsigned int mlen; 4654 const char *msg; 4655 va_list ap; 4656 4657 MGETHDR(m, M_DONTWAIT, MT_DATA); 4658 if (! m) 4659 return; 4660 m->m_pkthdr.rcvif = 0; 4661 4662 if (sp->pp_flags & PP_NOFRAMING) { 4663 *mtod(m, uint16_t *) = htons(cp->proto); 4664 pkthdrlen = 2; 4665 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 4666 } else { 4667 struct ppp_header *h; 4668 h = mtod(m, struct ppp_header *); 4669 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4670 h->control = PPP_UI; /* Unnumbered Info */ 4671 h->protocol = htons(cp->proto); 4672 pkthdrlen = PPP_HEADER_LEN; 4673 4674 lh = (struct lcp_header *)(h + 1); 4675 } 4676 4677 lh->type = type; 4678 lh->ident = id; 4679 p = (u_char *)(lh + 1); 4680 4681 va_start(ap, id); 4682 len = 0; 4683 4684 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4685 msg = va_arg(ap, const char *); 4686 len += mlen; 4687 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4688 va_end(ap); 4689 m_freem(m); 4690 return; 4691 } 4692 4693 memcpy(p, msg, mlen); 4694 p += mlen; 4695 } 4696 va_end(ap); 4697 4698 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4699 lh->len = htons(LCP_HEADER_LEN + len); 4700 4701 if (debug) { 4702 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 4703 ifp->if_xname, cp->name, 4704 sppp_auth_type_name(cp->proto, lh->type), 4705 lh->ident, ntohs(lh->len)); 4706 if (len) 4707 sppp_print_bytes((u_char *)(lh + 1), len); 4708 addlog(">\n"); 4709 } 4710 if (IF_QFULL(&sp->pp_cpq)) { 4711 IF_DROP(&sp->pp_fastq); 4712 IF_DROP(&ifp->if_snd); 4713 m_freem(m); 4714 ++ifp->if_oerrors; 4715 return; 4716 } else 4717 IF_ENQUEUE(&sp->pp_cpq, m); 4718 if (! (ifp->if_flags & IFF_OACTIVE)) 4719 (*ifp->if_start)(ifp); 4720 ifp->if_obytes += m->m_pkthdr.len + 3; 4721 } 4722 4723 /* 4724 * Send keepalive packets, every 10 seconds. 4725 */ 4726 static void 4727 sppp_keepalive(void *dummy) 4728 { 4729 struct sppp *sp; 4730 int s; 4731 time_t now; 4732 4733 s = splnet(); 4734 now = time_uptime; 4735 for (sp=spppq; sp; sp=sp->pp_next) { 4736 struct ifnet *ifp = &sp->pp_if; 4737 4738 /* check idle timeout */ 4739 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4740 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4741 /* idle timeout is enabled for this interface */ 4742 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4743 if (ifp->if_flags & IFF_DEBUG) 4744 printf("%s: no activity for %lu seconds\n", 4745 sp->pp_if.if_xname, 4746 (unsigned long)(now-sp->pp_last_activity)); 4747 lcp.Close(sp); 4748 continue; 4749 } 4750 } 4751 4752 /* Keepalive mode disabled or channel down? */ 4753 if (! (sp->pp_flags & PP_KEEPALIVE) || 4754 ! (ifp->if_flags & IFF_RUNNING)) 4755 continue; 4756 4757 /* No keepalive in PPP mode if LCP not opened yet. */ 4758 if (! (sp->pp_flags & PP_CISCO) && 4759 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4760 continue; 4761 4762 /* No echo reply, but maybe user data passed through? */ 4763 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 4764 sp->pp_alivecnt = 0; 4765 continue; 4766 } 4767 4768 if (sp->pp_alivecnt >= sp->pp_maxalive) { 4769 /* No keepalive packets got. Stop the interface. */ 4770 if_down (ifp); 4771 IF_PURGE(&sp->pp_cpq); 4772 if (! (sp->pp_flags & PP_CISCO)) { 4773 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4774 ifp->if_xname); 4775 sp->pp_alivecnt = 0; 4776 4777 /* we are down, close all open protocols */ 4778 lcp.Close(sp); 4779 4780 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4781 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4782 4783 /* Close connection immediately, completition of this 4784 * will summon the magic needed to reestablish it. */ 4785 if (sp->pp_tlf) 4786 sp->pp_tlf(sp); 4787 continue; 4788 } 4789 } 4790 if (sp->pp_alivecnt < sp->pp_maxalive) 4791 ++sp->pp_alivecnt; 4792 if (sp->pp_flags & PP_CISCO) 4793 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4794 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4795 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4796 int32_t nmagic = htonl(sp->lcp.magic); 4797 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4798 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4799 sp->lcp.echoid, 4, &nmagic); 4800 } 4801 } 4802 splx(s); 4803 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4804 } 4805 4806 #ifdef INET 4807 /* 4808 * Get both IP addresses. 4809 */ 4810 static void 4811 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 4812 { 4813 struct ifnet *ifp = &sp->pp_if; 4814 struct ifaddr *ifa; 4815 struct sockaddr_in *si, *sm; 4816 uint32_t ssrc, ddst; 4817 4818 sm = NULL; 4819 ssrc = ddst = 0; 4820 /* 4821 * Pick the first AF_INET address from the list, 4822 * aliases don't make any sense on a p2p link anyway. 4823 */ 4824 si = 0; 4825 IFADDR_FOREACH(ifa, ifp) { 4826 if (ifa->ifa_addr->sa_family == AF_INET) { 4827 si = (struct sockaddr_in *)ifa->ifa_addr; 4828 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4829 if (si) 4830 break; 4831 } 4832 } 4833 if (ifa) { 4834 if (si && si->sin_addr.s_addr) { 4835 ssrc = si->sin_addr.s_addr; 4836 if (srcmask) 4837 *srcmask = ntohl(sm->sin_addr.s_addr); 4838 } 4839 4840 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4841 if (si && si->sin_addr.s_addr) 4842 ddst = si->sin_addr.s_addr; 4843 } 4844 4845 if (dst) *dst = ntohl(ddst); 4846 if (src) *src = ntohl(ssrc); 4847 } 4848 4849 /* 4850 * Set IP addresses. Must be called at splnet. 4851 * If an address is 0, leave it the way it is. 4852 */ 4853 static void 4854 sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr) 4855 { 4856 STDDCL; 4857 struct ifaddr *ifa; 4858 struct sockaddr_in *si, *dest; 4859 4860 /* 4861 * Pick the first AF_INET address from the list, 4862 * aliases don't make any sense on a p2p link anyway. 4863 */ 4864 4865 IFADDR_FOREACH(ifa, ifp) { 4866 if (ifa->ifa_addr->sa_family == AF_INET) { 4867 si = (struct sockaddr_in *)ifa->ifa_addr; 4868 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4869 goto found; 4870 } 4871 } 4872 return; 4873 4874 found: 4875 { 4876 int error; 4877 struct sockaddr_in new_sin = *si; 4878 struct sockaddr_in new_dst = *dest; 4879 4880 /* 4881 * Scrub old routes now instead of calling in_ifinit with 4882 * scrub=1, because we may change the dstaddr 4883 * before the call to in_ifinit. 4884 */ 4885 in_ifscrub(ifp, ifatoia(ifa)); 4886 4887 if (myaddr != 0) 4888 new_sin.sin_addr.s_addr = htonl(myaddr); 4889 if (hisaddr != 0) { 4890 new_dst.sin_addr.s_addr = htonl(hisaddr); 4891 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4892 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4893 *dest = new_dst; /* fix dstaddr in place */ 4894 } 4895 } 4896 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4897 if (debug && error) 4898 { 4899 log(LOG_DEBUG, "%s: sppp_set_ip_addrs: in_ifinit " 4900 " failed, error=%d\n", ifp->if_xname, error); 4901 } 4902 if (!error) { 4903 (void)pfil_run_hooks(if_pfil, 4904 (struct mbuf **)SIOCAIFADDR, ifp, PFIL_IFADDR); 4905 } 4906 } 4907 } 4908 4909 /* 4910 * Clear IP addresses. Must be called at splnet. 4911 */ 4912 static void 4913 sppp_clear_ip_addrs(struct sppp *sp) 4914 { 4915 struct ifnet *ifp = &sp->pp_if; 4916 struct ifaddr *ifa; 4917 struct sockaddr_in *si, *dest; 4918 4919 uint32_t remote; 4920 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4921 remote = sp->ipcp.saved_hisaddr; 4922 else 4923 sppp_get_ip_addrs(sp, 0, &remote, 0); 4924 4925 /* 4926 * Pick the first AF_INET address from the list, 4927 * aliases don't make any sense on a p2p link anyway. 4928 */ 4929 4930 IFADDR_FOREACH(ifa, ifp) { 4931 if (ifa->ifa_addr->sa_family == AF_INET) { 4932 si = (struct sockaddr_in *)ifa->ifa_addr; 4933 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4934 goto found; 4935 } 4936 } 4937 return; 4938 4939 found: 4940 { 4941 struct sockaddr_in new_sin = *si; 4942 4943 in_ifscrub(ifp, ifatoia(ifa)); 4944 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4945 new_sin.sin_addr.s_addr = 0; 4946 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4947 /* replace peer addr in place */ 4948 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4949 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4950 (void)pfil_run_hooks(if_pfil, 4951 (struct mbuf **)SIOCDIFADDR, ifp, PFIL_IFADDR); 4952 } 4953 } 4954 #endif 4955 4956 #ifdef INET6 4957 /* 4958 * Get both IPv6 addresses. 4959 */ 4960 static void 4961 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4962 struct in6_addr *srcmask) 4963 { 4964 struct ifnet *ifp = &sp->pp_if; 4965 struct ifaddr *ifa; 4966 struct sockaddr_in6 *si, *sm; 4967 struct in6_addr ssrc, ddst; 4968 4969 sm = NULL; 4970 memset(&ssrc, 0, sizeof(ssrc)); 4971 memset(&ddst, 0, sizeof(ddst)); 4972 /* 4973 * Pick the first link-local AF_INET6 address from the list, 4974 * aliases don't make any sense on a p2p link anyway. 4975 */ 4976 si = 0; 4977 IFADDR_FOREACH(ifa, ifp) 4978 if (ifa->ifa_addr->sa_family == AF_INET6) { 4979 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4980 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4981 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4982 break; 4983 } 4984 if (ifa) { 4985 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4986 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 4987 if (srcmask) { 4988 memcpy(srcmask, &sm->sin6_addr, 4989 sizeof(*srcmask)); 4990 } 4991 } 4992 4993 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4994 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4995 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 4996 } 4997 4998 if (dst) 4999 memcpy(dst, &ddst, sizeof(*dst)); 5000 if (src) 5001 memcpy(src, &ssrc, sizeof(*src)); 5002 } 5003 5004 #ifdef IPV6CP_MYIFID_DYN 5005 /* 5006 * Generate random ifid. 5007 */ 5008 static void 5009 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5010 { 5011 /* TBD */ 5012 } 5013 5014 /* 5015 * Set my IPv6 address. Must be called at splnet. 5016 */ 5017 static void 5018 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5019 { 5020 STDDCL; 5021 struct ifaddr *ifa; 5022 struct sockaddr_in6 *sin6; 5023 5024 /* 5025 * Pick the first link-local AF_INET6 address from the list, 5026 * aliases don't make any sense on a p2p link anyway. 5027 */ 5028 5029 sin6 = NULL; 5030 IFADDR_FOREACH(ifa, ifp) 5031 { 5032 if (ifa->ifa_addr->sa_family == AF_INET6) 5033 { 5034 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5035 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 5036 break; 5037 } 5038 } 5039 5040 if (ifa && sin6) 5041 { 5042 int error; 5043 struct sockaddr_in6 new_sin6 = *sin6; 5044 5045 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5046 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5047 if (debug && error) 5048 { 5049 log(LOG_DEBUG, "%s: sppp_set_ip6_addr: in6_ifinit " 5050 " failed, error=%d\n", ifp->if_xname, error); 5051 } 5052 if (!error) { 5053 (void)pfil_run_hooks(if_pfil, 5054 (struct mbuf **)SIOCAIFADDR_IN6, ifp, PFIL_IFADDR); 5055 } 5056 } 5057 } 5058 #endif 5059 5060 /* 5061 * Suggest a candidate address to be used by peer. 5062 */ 5063 static void 5064 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5065 { 5066 struct in6_addr myaddr; 5067 struct timeval tv; 5068 5069 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5070 5071 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5072 microtime(&tv); 5073 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5074 myaddr.s6_addr[14] ^= 0xff; 5075 myaddr.s6_addr[15] ^= 0xff; 5076 } else { 5077 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5078 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5079 } 5080 if (suggest) 5081 memcpy(suggest, &myaddr, sizeof(myaddr)); 5082 } 5083 #endif /*INET6*/ 5084 5085 /* 5086 * Process ioctl requests specific to the PPP interface. 5087 * Permissions have already been checked. 5088 */ 5089 static int 5090 sppp_params(struct sppp *sp, u_long cmd, void *data) 5091 { 5092 switch (cmd) { 5093 case SPPPGETAUTHCFG: 5094 { 5095 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5096 int error; 5097 size_t len; 5098 5099 cfg->myauthflags = sp->myauth.flags; 5100 cfg->hisauthflags = sp->hisauth.flags; 5101 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 5102 cfg->hisauth = 0; 5103 if (sp->hisauth.proto) 5104 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5105 cfg->myauth = 0; 5106 if (sp->myauth.proto) 5107 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5108 if (cfg->myname_length == 0) { 5109 if (sp->myauth.name != NULL) 5110 cfg->myname_length = sp->myauth.name_len + 1; 5111 } else { 5112 if (sp->myauth.name == NULL) { 5113 cfg->myname_length = 0; 5114 } else { 5115 len = sp->myauth.name_len + 1; 5116 if (cfg->myname_length < len) 5117 return (ENAMETOOLONG); 5118 error = copyout(sp->myauth.name, cfg->myname, len); 5119 if (error) return error; 5120 } 5121 } 5122 if (cfg->hisname_length == 0) { 5123 if (sp->hisauth.name != NULL) 5124 cfg->hisname_length = sp->hisauth.name_len + 1; 5125 } else { 5126 if (sp->hisauth.name == NULL) { 5127 cfg->hisname_length = 0; 5128 } else { 5129 len = sp->hisauth.name_len + 1; 5130 if (cfg->hisname_length < len) 5131 return (ENAMETOOLONG); 5132 error = copyout(sp->hisauth.name, cfg->hisname, len); 5133 if (error) return error; 5134 } 5135 } 5136 } 5137 break; 5138 case SPPPSETAUTHCFG: 5139 { 5140 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5141 int error; 5142 5143 if (sp->myauth.name) { 5144 free(sp->myauth.name, M_DEVBUF); 5145 sp->myauth.name = NULL; 5146 } 5147 if (sp->myauth.secret) { 5148 free(sp->myauth.secret, M_DEVBUF); 5149 sp->myauth.secret = NULL; 5150 } 5151 if (sp->hisauth.name) { 5152 free(sp->hisauth.name, M_DEVBUF); 5153 sp->hisauth.name = NULL; 5154 } 5155 if (sp->hisauth.secret) { 5156 free(sp->hisauth.secret, M_DEVBUF); 5157 sp->hisauth.secret = NULL; 5158 } 5159 5160 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5161 if (cfg->hisname_length >= MCLBYTES) 5162 return (ENAMETOOLONG); 5163 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5164 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5165 if (error) { 5166 free(sp->hisauth.name, M_DEVBUF); 5167 sp->hisauth.name = NULL; 5168 return error; 5169 } 5170 sp->hisauth.name_len = cfg->hisname_length - 1; 5171 sp->hisauth.name[sp->hisauth.name_len] = 0; 5172 } 5173 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5174 if (cfg->hissecret_length >= MCLBYTES) 5175 return (ENAMETOOLONG); 5176 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5177 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5178 if (error) { 5179 free(sp->hisauth.secret, M_DEVBUF); 5180 sp->hisauth.secret = NULL; 5181 return error; 5182 } 5183 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5184 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5185 } 5186 if (cfg->myname != NULL && cfg->myname_length > 0) { 5187 if (cfg->myname_length >= MCLBYTES) 5188 return (ENAMETOOLONG); 5189 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5190 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5191 if (error) { 5192 free(sp->myauth.name, M_DEVBUF); 5193 sp->myauth.name = NULL; 5194 return error; 5195 } 5196 sp->myauth.name_len = cfg->myname_length - 1; 5197 sp->myauth.name[sp->myauth.name_len] = 0; 5198 } 5199 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5200 if (cfg->mysecret_length >= MCLBYTES) 5201 return (ENAMETOOLONG); 5202 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5203 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5204 if (error) { 5205 free(sp->myauth.secret, M_DEVBUF); 5206 sp->myauth.secret = NULL; 5207 return error; 5208 } 5209 sp->myauth.secret_len = cfg->mysecret_length - 1; 5210 sp->myauth.secret[sp->myauth.secret_len] = 0; 5211 } 5212 sp->myauth.flags = cfg->myauthflags; 5213 if (cfg->myauth) 5214 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5215 sp->hisauth.flags = cfg->hisauthflags; 5216 if (cfg->hisauth) 5217 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5218 sp->pp_auth_failures = 0; 5219 if (sp->hisauth.proto != 0) 5220 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5221 else 5222 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5223 } 5224 break; 5225 case SPPPGETLCPCFG: 5226 { 5227 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5228 lcpp->lcp_timeout = sp->lcp.timeout; 5229 } 5230 break; 5231 case SPPPSETLCPCFG: 5232 { 5233 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5234 sp->lcp.timeout = lcpp->lcp_timeout; 5235 } 5236 break; 5237 case SPPPGETSTATUS: 5238 { 5239 struct spppstatus *status = (struct spppstatus *)data; 5240 status->phase = sp->pp_phase; 5241 } 5242 break; 5243 case SPPPGETSTATUSNCP: 5244 { 5245 struct spppstatusncp *status = (struct spppstatusncp *)data; 5246 status->phase = sp->pp_phase; 5247 status->ncpup = sppp_ncp_check(sp); 5248 } 5249 break; 5250 case SPPPGETIDLETO: 5251 { 5252 struct spppidletimeout *to = (struct spppidletimeout *)data; 5253 to->idle_seconds = sp->pp_idle_timeout; 5254 } 5255 break; 5256 case SPPPSETIDLETO: 5257 { 5258 struct spppidletimeout *to = (struct spppidletimeout *)data; 5259 sp->pp_idle_timeout = to->idle_seconds; 5260 } 5261 break; 5262 case SPPPSETAUTHFAILURE: 5263 { 5264 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5265 sp->pp_max_auth_fail = afsettings->max_failures; 5266 sp->pp_auth_failures = 0; 5267 } 5268 break; 5269 case SPPPGETAUTHFAILURES: 5270 { 5271 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5272 stats->auth_failures = sp->pp_auth_failures; 5273 stats->max_failures = sp->pp_max_auth_fail; 5274 } 5275 break; 5276 case SPPPSETDNSOPTS: 5277 { 5278 struct spppdnssettings *req = (struct spppdnssettings *)data; 5279 sp->query_dns = req->query_dns & 3; 5280 } 5281 break; 5282 case SPPPGETDNSOPTS: 5283 { 5284 struct spppdnssettings *req = (struct spppdnssettings *)data; 5285 req->query_dns = sp->query_dns; 5286 } 5287 break; 5288 case SPPPGETDNSADDRS: 5289 { 5290 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5291 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5292 } 5293 break; 5294 case SPPPGETKEEPALIVE: 5295 { 5296 struct spppkeepalivesettings *settings = 5297 (struct spppkeepalivesettings*)data; 5298 settings->maxalive = sp->pp_maxalive; 5299 settings->max_noreceive = sp->pp_max_noreceive; 5300 } 5301 break; 5302 case SPPPSETKEEPALIVE: 5303 { 5304 struct spppkeepalivesettings *settings = 5305 (struct spppkeepalivesettings*)data; 5306 sp->pp_maxalive = settings->maxalive; 5307 sp->pp_max_noreceive = settings->max_noreceive; 5308 } 5309 break; 5310 #if defined(COMPAT_50) || defined(MODULAR) 5311 case __SPPPGETIDLETO50: 5312 { 5313 struct spppidletimeout50 *to = (struct spppidletimeout50 *)data; 5314 to->idle_seconds = (uint32_t)sp->pp_idle_timeout; 5315 } 5316 break; 5317 case __SPPPSETIDLETO50: 5318 { 5319 struct spppidletimeout50 *to = (struct spppidletimeout50 *)data; 5320 sp->pp_idle_timeout = (time_t)to->idle_seconds; 5321 } 5322 break; 5323 case __SPPPGETKEEPALIVE50: 5324 { 5325 struct spppkeepalivesettings50 *settings = 5326 (struct spppkeepalivesettings50*)data; 5327 settings->maxalive = sp->pp_maxalive; 5328 settings->max_noreceive = (uint32_t)sp->pp_max_noreceive; 5329 } 5330 break; 5331 case __SPPPSETKEEPALIVE50: 5332 { 5333 struct spppkeepalivesettings50 *settings = 5334 (struct spppkeepalivesettings50*)data; 5335 sp->pp_maxalive = settings->maxalive; 5336 sp->pp_max_noreceive = (time_t)settings->max_noreceive; 5337 } 5338 break; 5339 #endif /* COMPAT_50 || MODULAR */ 5340 default: 5341 return (EINVAL); 5342 } 5343 5344 return (0); 5345 } 5346 5347 static void 5348 sppp_phase_network(struct sppp *sp) 5349 { 5350 STDDCL; 5351 int i; 5352 uint32_t mask; 5353 5354 sp->pp_phase = SPPP_PHASE_NETWORK; 5355 5356 if (debug) 5357 { 5358 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 5359 sppp_phase_name(sp->pp_phase)); 5360 } 5361 5362 /* Notify NCPs now. */ 5363 for (i = 0; i < IDX_COUNT; i++) 5364 if ((cps[i])->flags & CP_NCP) 5365 (cps[i])->Open(sp); 5366 5367 /* Send Up events to all NCPs. */ 5368 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5369 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5370 (cps[i])->Up(sp); 5371 5372 /* if no NCP is starting, all this was in vain, close down */ 5373 sppp_lcp_check_and_close(sp); 5374 } 5375 5376 5377 static const char * 5378 sppp_cp_type_name(u_char type) 5379 { 5380 static char buf[12]; 5381 switch (type) { 5382 case CONF_REQ: return "conf-req"; 5383 case CONF_ACK: return "conf-ack"; 5384 case CONF_NAK: return "conf-nak"; 5385 case CONF_REJ: return "conf-rej"; 5386 case TERM_REQ: return "term-req"; 5387 case TERM_ACK: return "term-ack"; 5388 case CODE_REJ: return "code-rej"; 5389 case PROTO_REJ: return "proto-rej"; 5390 case ECHO_REQ: return "echo-req"; 5391 case ECHO_REPLY: return "echo-reply"; 5392 case DISC_REQ: return "discard-req"; 5393 } 5394 snprintf(buf, sizeof(buf), "0x%x", type); 5395 return buf; 5396 } 5397 5398 static const char * 5399 sppp_auth_type_name(u_short proto, u_char type) 5400 { 5401 static char buf[12]; 5402 switch (proto) { 5403 case PPP_CHAP: 5404 switch (type) { 5405 case CHAP_CHALLENGE: return "challenge"; 5406 case CHAP_RESPONSE: return "response"; 5407 case CHAP_SUCCESS: return "success"; 5408 case CHAP_FAILURE: return "failure"; 5409 } 5410 case PPP_PAP: 5411 switch (type) { 5412 case PAP_REQ: return "req"; 5413 case PAP_ACK: return "ack"; 5414 case PAP_NAK: return "nak"; 5415 } 5416 } 5417 snprintf(buf, sizeof(buf), "0x%x", type); 5418 return buf; 5419 } 5420 5421 static const char * 5422 sppp_lcp_opt_name(u_char opt) 5423 { 5424 static char buf[12]; 5425 switch (opt) { 5426 case LCP_OPT_MRU: return "mru"; 5427 case LCP_OPT_ASYNC_MAP: return "async-map"; 5428 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5429 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5430 case LCP_OPT_MAGIC: return "magic"; 5431 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5432 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5433 } 5434 snprintf(buf, sizeof(buf), "0x%x", opt); 5435 return buf; 5436 } 5437 5438 static const char * 5439 sppp_ipcp_opt_name(u_char opt) 5440 { 5441 static char buf[12]; 5442 switch (opt) { 5443 case IPCP_OPT_ADDRESSES: return "addresses"; 5444 case IPCP_OPT_COMPRESSION: return "compression"; 5445 case IPCP_OPT_ADDRESS: return "address"; 5446 } 5447 snprintf(buf, sizeof(buf), "0x%x", opt); 5448 return buf; 5449 } 5450 5451 #ifdef INET6 5452 static const char * 5453 sppp_ipv6cp_opt_name(u_char opt) 5454 { 5455 static char buf[12]; 5456 switch (opt) { 5457 case IPV6CP_OPT_IFID: return "ifid"; 5458 case IPV6CP_OPT_COMPRESSION: return "compression"; 5459 } 5460 snprintf(buf, sizeof(buf), "0x%x", opt); 5461 return buf; 5462 } 5463 #endif 5464 5465 static const char * 5466 sppp_state_name(int state) 5467 { 5468 switch (state) { 5469 case STATE_INITIAL: return "initial"; 5470 case STATE_STARTING: return "starting"; 5471 case STATE_CLOSED: return "closed"; 5472 case STATE_STOPPED: return "stopped"; 5473 case STATE_CLOSING: return "closing"; 5474 case STATE_STOPPING: return "stopping"; 5475 case STATE_REQ_SENT: return "req-sent"; 5476 case STATE_ACK_RCVD: return "ack-rcvd"; 5477 case STATE_ACK_SENT: return "ack-sent"; 5478 case STATE_OPENED: return "opened"; 5479 } 5480 return "illegal"; 5481 } 5482 5483 static const char * 5484 sppp_phase_name(int phase) 5485 { 5486 switch (phase) { 5487 case SPPP_PHASE_DEAD: return "dead"; 5488 case SPPP_PHASE_ESTABLISH: return "establish"; 5489 case SPPP_PHASE_TERMINATE: return "terminate"; 5490 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5491 case SPPP_PHASE_NETWORK: return "network"; 5492 } 5493 return "illegal"; 5494 } 5495 5496 static const char * 5497 sppp_proto_name(u_short proto) 5498 { 5499 static char buf[12]; 5500 switch (proto) { 5501 case PPP_LCP: return "lcp"; 5502 case PPP_IPCP: return "ipcp"; 5503 case PPP_PAP: return "pap"; 5504 case PPP_CHAP: return "chap"; 5505 case PPP_IPV6CP: return "ipv6cp"; 5506 } 5507 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 5508 return buf; 5509 } 5510 5511 static void 5512 sppp_print_bytes(const u_char *p, u_short len) 5513 { 5514 addlog(" %02x", *p++); 5515 while (--len > 0) 5516 addlog("-%02x", *p++); 5517 } 5518 5519 static void 5520 sppp_print_string(const char *p, u_short len) 5521 { 5522 u_char c; 5523 5524 while (len-- > 0) { 5525 c = *p++; 5526 /* 5527 * Print only ASCII chars directly. RFC 1994 recommends 5528 * using only them, but we don't rely on it. */ 5529 if (c < ' ' || c > '~') 5530 addlog("\\x%x", c); 5531 else 5532 addlog("%c", c); 5533 } 5534 } 5535 5536 static const char * 5537 sppp_dotted_quad(uint32_t addr) 5538 { 5539 static char s[16]; 5540 snprintf(s, sizeof(s), "%d.%d.%d.%d", 5541 (int)((addr >> 24) & 0xff), 5542 (int)((addr >> 16) & 0xff), 5543 (int)((addr >> 8) & 0xff), 5544 (int)(addr & 0xff)); 5545 return s; 5546 } 5547 5548 /* a dummy, used to drop uninteresting events */ 5549 static void 5550 sppp_null(struct sppp *unused) 5551 { 5552 /* do just nothing */ 5553 } 5554 /* 5555 * This file is large. Tell emacs to highlight it nevertheless. 5556 * 5557 * Local Variables: 5558 * hilit-auto-highlight-maxout: 120000 5559 * End: 5560 */ 5561
Indexes created Mon Oct 13 16:09:52 GMT 2025