if_spppsubr.c revision 1.138
1 /* $NetBSD: if_spppsubr.c,v 1.138 2016/04/24 16:59:15 christos Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.138 2016/04/24 16:59:15 christos Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #endif 51 52 53 #include <sys/param.h> 54 #include <sys/proc.h> 55 #include <sys/systm.h> 56 #include <sys/kernel.h> 57 #include <sys/sockio.h> 58 #include <sys/socket.h> 59 #include <sys/syslog.h> 60 #include <sys/malloc.h> 61 #include <sys/mbuf.h> 62 #include <sys/callout.h> 63 #include <sys/md5.h> 64 #include <sys/inttypes.h> 65 #include <sys/kauth.h> 66 #include <sys/cprng.h> 67 68 #include <net/if.h> 69 #include <net/netisr.h> 70 #include <net/if_types.h> 71 #include <net/route.h> 72 #include <net/ppp_defs.h> 73 74 #include <netinet/in.h> 75 #include <netinet/in_systm.h> 76 #include <netinet/in_var.h> 77 #ifdef INET 78 #include <netinet/ip.h> 79 #include <netinet/tcp.h> 80 #endif 81 #include <net/ethertypes.h> 82 83 #ifdef INET6 84 #include <netinet6/scope6_var.h> 85 #endif 86 87 #include <net/if_sppp.h> 88 #include <net/if_spppvar.h> 89 90 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 91 #define LOOPALIVECNT 3 /* loopback detection tries */ 92 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 93 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 94 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 95 96 /* 97 * Interface flags that can be set in an ifconfig command. 98 * 99 * Setting link0 will make the link passive, i.e. it will be marked 100 * as being administrative openable, but won't be opened to begin 101 * with. Incoming calls will be answered, or subsequent calls with 102 * -link1 will cause the administrative open of the LCP layer. 103 * 104 * Setting link1 will cause the link to auto-dial only as packets 105 * arrive to be sent. 106 * 107 * Setting IFF_DEBUG will syslog the option negotiation and state 108 * transitions at level kern.debug. Note: all logs consistently look 109 * like 110 * 111 * <if-name><unit>: <proto-name> <additional info...> 112 * 113 * with <if-name><unit> being something like "bppp0", and <proto-name> 114 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 115 */ 116 117 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 118 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 119 120 #define CONF_REQ 1 /* PPP configure request */ 121 #define CONF_ACK 2 /* PPP configure acknowledge */ 122 #define CONF_NAK 3 /* PPP configure negative ack */ 123 #define CONF_REJ 4 /* PPP configure reject */ 124 #define TERM_REQ 5 /* PPP terminate request */ 125 #define TERM_ACK 6 /* PPP terminate acknowledge */ 126 #define CODE_REJ 7 /* PPP code reject */ 127 #define PROTO_REJ 8 /* PPP protocol reject */ 128 #define ECHO_REQ 9 /* PPP echo request */ 129 #define ECHO_REPLY 10 /* PPP echo reply */ 130 #define DISC_REQ 11 /* PPP discard request */ 131 132 #define LCP_OPT_MRU 1 /* maximum receive unit */ 133 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 134 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 135 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 136 #define LCP_OPT_MAGIC 5 /* magic number */ 137 #define LCP_OPT_RESERVED 6 /* reserved */ 138 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 139 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 140 141 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 142 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 143 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 144 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 145 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 146 147 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 148 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 149 150 #define PAP_REQ 1 /* PAP name/password request */ 151 #define PAP_ACK 2 /* PAP acknowledge */ 152 #define PAP_NAK 3 /* PAP fail */ 153 154 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 155 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 156 #define CHAP_SUCCESS 3 /* CHAP response ok */ 157 #define CHAP_FAILURE 4 /* CHAP response failed */ 158 159 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 160 161 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 162 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 163 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 164 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 165 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 166 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 167 168 /* states are named and numbered according to RFC 1661 */ 169 #define STATE_INITIAL 0 170 #define STATE_STARTING 1 171 #define STATE_CLOSED 2 172 #define STATE_STOPPED 3 173 #define STATE_CLOSING 4 174 #define STATE_STOPPING 5 175 #define STATE_REQ_SENT 6 176 #define STATE_ACK_RCVD 7 177 #define STATE_ACK_SENT 8 178 #define STATE_OPENED 9 179 180 struct ppp_header { 181 uint8_t address; 182 uint8_t control; 183 uint16_t protocol; 184 } __packed; 185 #define PPP_HEADER_LEN sizeof (struct ppp_header) 186 187 struct lcp_header { 188 uint8_t type; 189 uint8_t ident; 190 uint16_t len; 191 } __packed; 192 #define LCP_HEADER_LEN sizeof (struct lcp_header) 193 194 struct cisco_packet { 195 uint32_t type; 196 uint32_t par1; 197 uint32_t par2; 198 uint16_t rel; 199 uint16_t time0; 200 uint16_t time1; 201 } __packed; 202 #define CISCO_PACKET_LEN 18 203 204 /* 205 * We follow the spelling and capitalization of RFC 1661 here, to make 206 * it easier comparing with the standard. Please refer to this RFC in 207 * case you can't make sense out of these abbreviation; it will also 208 * explain the semantics related to the various events and actions. 209 */ 210 struct cp { 211 u_short proto; /* PPP control protocol number */ 212 u_char protoidx; /* index into state table in struct sppp */ 213 u_char flags; 214 #define CP_LCP 0x01 /* this is the LCP */ 215 #define CP_AUTH 0x02 /* this is an authentication protocol */ 216 #define CP_NCP 0x04 /* this is a NCP */ 217 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 218 const char *name; /* name of this control protocol */ 219 /* event handlers */ 220 void (*Up)(struct sppp *sp); 221 void (*Down)(struct sppp *sp); 222 void (*Open)(struct sppp *sp); 223 void (*Close)(struct sppp *sp); 224 void (*TO)(void *sp); 225 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 226 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 227 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 228 /* actions */ 229 void (*tlu)(struct sppp *sp); 230 void (*tld)(struct sppp *sp); 231 void (*tls)(struct sppp *sp); 232 void (*tlf)(struct sppp *sp); 233 void (*scr)(struct sppp *sp); 234 }; 235 236 static struct sppp *spppq; 237 static callout_t keepalive_ch; 238 239 #ifdef INET 240 /* 241 * The following disgusting hack gets around the problem that IP TOS 242 * can't be set yet. We want to put "interactive" traffic on a high 243 * priority queue. To decide if traffic is interactive, we check that 244 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 245 * 246 * XXX is this really still necessary? - joerg - 247 */ 248 static u_short interactive_ports[8] = { 249 0, 513, 0, 0, 250 0, 21, 0, 23, 251 }; 252 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 253 #endif 254 255 /* almost every function needs these */ 256 #define STDDCL \ 257 struct ifnet *ifp = &sp->pp_if; \ 258 int debug = ifp->if_flags & IFF_DEBUG 259 260 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 261 const struct sockaddr *dst, struct rtentry *rt); 262 263 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 264 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 265 266 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 267 struct mbuf *m); 268 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 269 u_char ident, u_short len, void *data); 270 /* static void sppp_cp_timeout(void *arg); */ 271 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 272 int newstate); 273 static void sppp_auth_send(const struct cp *cp, 274 struct sppp *sp, unsigned int type, unsigned int id, 275 ...); 276 277 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 278 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 279 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 280 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 281 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 282 283 static void sppp_null(struct sppp *sp); 284 285 static void sppp_lcp_init(struct sppp *sp); 286 static void sppp_lcp_up(struct sppp *sp); 287 static void sppp_lcp_down(struct sppp *sp); 288 static void sppp_lcp_open(struct sppp *sp); 289 static void sppp_lcp_close(struct sppp *sp); 290 static void sppp_lcp_TO(void *sp); 291 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 292 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 293 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 294 static void sppp_lcp_tlu(struct sppp *sp); 295 static void sppp_lcp_tld(struct sppp *sp); 296 static void sppp_lcp_tls(struct sppp *sp); 297 static void sppp_lcp_tlf(struct sppp *sp); 298 static void sppp_lcp_scr(struct sppp *sp); 299 static void sppp_lcp_check_and_close(struct sppp *sp); 300 static int sppp_ncp_check(struct sppp *sp); 301 302 static void sppp_ipcp_init(struct sppp *sp); 303 static void sppp_ipcp_up(struct sppp *sp); 304 static void sppp_ipcp_down(struct sppp *sp); 305 static void sppp_ipcp_open(struct sppp *sp); 306 static void sppp_ipcp_close(struct sppp *sp); 307 static void sppp_ipcp_TO(void *sp); 308 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 309 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 310 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 311 static void sppp_ipcp_tlu(struct sppp *sp); 312 static void sppp_ipcp_tld(struct sppp *sp); 313 static void sppp_ipcp_tls(struct sppp *sp); 314 static void sppp_ipcp_tlf(struct sppp *sp); 315 static void sppp_ipcp_scr(struct sppp *sp); 316 317 static void sppp_ipv6cp_init(struct sppp *sp); 318 static void sppp_ipv6cp_up(struct sppp *sp); 319 static void sppp_ipv6cp_down(struct sppp *sp); 320 static void sppp_ipv6cp_open(struct sppp *sp); 321 static void sppp_ipv6cp_close(struct sppp *sp); 322 static void sppp_ipv6cp_TO(void *sp); 323 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 324 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 325 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 326 static void sppp_ipv6cp_tlu(struct sppp *sp); 327 static void sppp_ipv6cp_tld(struct sppp *sp); 328 static void sppp_ipv6cp_tls(struct sppp *sp); 329 static void sppp_ipv6cp_tlf(struct sppp *sp); 330 static void sppp_ipv6cp_scr(struct sppp *sp); 331 332 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 333 static void sppp_pap_init(struct sppp *sp); 334 static void sppp_pap_open(struct sppp *sp); 335 static void sppp_pap_close(struct sppp *sp); 336 static void sppp_pap_TO(void *sp); 337 static void sppp_pap_my_TO(void *sp); 338 static void sppp_pap_tlu(struct sppp *sp); 339 static void sppp_pap_tld(struct sppp *sp); 340 static void sppp_pap_scr(struct sppp *sp); 341 342 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 343 static void sppp_chap_init(struct sppp *sp); 344 static void sppp_chap_open(struct sppp *sp); 345 static void sppp_chap_close(struct sppp *sp); 346 static void sppp_chap_TO(void *sp); 347 static void sppp_chap_tlu(struct sppp *sp); 348 static void sppp_chap_tld(struct sppp *sp); 349 static void sppp_chap_scr(struct sppp *sp); 350 351 static const char *sppp_auth_type_name(u_short proto, u_char type); 352 static const char *sppp_cp_type_name(u_char type); 353 static const char *sppp_dotted_quad(uint32_t addr); 354 static const char *sppp_ipcp_opt_name(u_char opt); 355 #ifdef INET6 356 static const char *sppp_ipv6cp_opt_name(u_char opt); 357 #endif 358 static const char *sppp_lcp_opt_name(u_char opt); 359 static const char *sppp_phase_name(int phase); 360 static const char *sppp_proto_name(u_short proto); 361 static const char *sppp_state_name(int state); 362 static int sppp_params(struct sppp *sp, u_long cmd, void *data); 363 #ifdef INET 364 static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, 365 uint32_t *srcmask); 366 static void sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr); 367 static void sppp_clear_ip_addrs(struct sppp *sp); 368 #endif 369 static void sppp_keepalive(void *dummy); 370 static void sppp_phase_network(struct sppp *sp); 371 static void sppp_print_bytes(const u_char *p, u_short len); 372 static void sppp_print_string(const char *p, u_short len); 373 #ifdef INET6 374 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 375 struct in6_addr *dst, struct in6_addr *srcmask); 376 #ifdef IPV6CP_MYIFID_DYN 377 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 378 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 379 #endif 380 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 381 #endif 382 383 /* our control protocol descriptors */ 384 static const struct cp lcp = { 385 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 386 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 387 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 388 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 389 sppp_lcp_scr 390 }; 391 392 static const struct cp ipcp = { 393 PPP_IPCP, IDX_IPCP, 394 #ifdef INET 395 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 396 #else 397 0, 398 #endif 399 "ipcp", 400 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 401 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 402 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 403 sppp_ipcp_scr 404 }; 405 406 static const struct cp ipv6cp = { 407 PPP_IPV6CP, IDX_IPV6CP, 408 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 409 CP_NCP, 410 #else 411 0, 412 #endif 413 "ipv6cp", 414 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 415 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 416 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 417 sppp_ipv6cp_scr 418 }; 419 420 static const struct cp pap = { 421 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 422 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 423 sppp_pap_TO, 0, 0, 0, 424 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 425 sppp_pap_scr 426 }; 427 428 static const struct cp chap = { 429 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 430 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 431 sppp_chap_TO, 0, 0, 0, 432 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 433 sppp_chap_scr 434 }; 435 436 static const struct cp *cps[IDX_COUNT] = { 437 &lcp, /* IDX_LCP */ 438 &ipcp, /* IDX_IPCP */ 439 &ipv6cp, /* IDX_IPV6CP */ 440 &pap, /* IDX_PAP */ 441 &chap, /* IDX_CHAP */ 442 }; 443 444 445 /* 446 * Exported functions, comprising our interface to the lower layer. 447 */ 448 449 /* 450 * Process the received packet. 451 */ 452 void 453 sppp_input(struct ifnet *ifp, struct mbuf *m) 454 { 455 struct ppp_header *h = NULL; 456 pktqueue_t *pktq = NULL; 457 struct ifqueue *inq = NULL; 458 uint16_t protocol; 459 int s; 460 struct sppp *sp = (struct sppp *)ifp; 461 int debug = ifp->if_flags & IFF_DEBUG; 462 int isr = 0; 463 464 if (ifp->if_flags & IFF_UP) { 465 /* Count received bytes, add hardware framing */ 466 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 467 /* Note time of last receive */ 468 sp->pp_last_receive = time_uptime; 469 } 470 471 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 472 /* Too small packet, drop it. */ 473 if (debug) 474 log(LOG_DEBUG, 475 "%s: input packet is too small, %d bytes\n", 476 ifp->if_xname, m->m_pkthdr.len); 477 drop: 478 ++ifp->if_ierrors; 479 ++ifp->if_iqdrops; 480 m_freem(m); 481 return; 482 } 483 484 if (sp->pp_flags & PP_NOFRAMING) { 485 memcpy(&protocol, mtod(m, void *), 2); 486 protocol = ntohs(protocol); 487 m_adj(m, 2); 488 } else { 489 490 /* Get PPP header. */ 491 h = mtod(m, struct ppp_header *); 492 m_adj(m, PPP_HEADER_LEN); 493 494 switch (h->address) { 495 case PPP_ALLSTATIONS: 496 if (h->control != PPP_UI) 497 goto invalid; 498 if (sp->pp_flags & PP_CISCO) { 499 if (debug) 500 log(LOG_DEBUG, 501 "%s: PPP packet in Cisco mode " 502 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 503 ifp->if_xname, 504 h->address, h->control, ntohs(h->protocol)); 505 goto drop; 506 } 507 break; 508 case CISCO_MULTICAST: 509 case CISCO_UNICAST: 510 /* Don't check the control field here (RFC 1547). */ 511 if (! (sp->pp_flags & PP_CISCO)) { 512 if (debug) 513 log(LOG_DEBUG, 514 "%s: Cisco packet in PPP mode " 515 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 516 ifp->if_xname, 517 h->address, h->control, ntohs(h->protocol)); 518 goto drop; 519 } 520 switch (ntohs(h->protocol)) { 521 default: 522 ++ifp->if_noproto; 523 goto invalid; 524 case CISCO_KEEPALIVE: 525 sppp_cisco_input((struct sppp *) ifp, m); 526 m_freem(m); 527 return; 528 #ifdef INET 529 case ETHERTYPE_IP: 530 pktq = ip_pktq; 531 break; 532 #endif 533 #ifdef INET6 534 case ETHERTYPE_IPV6: 535 pktq = ip6_pktq; 536 break; 537 #endif 538 } 539 goto queue_pkt; 540 default: /* Invalid PPP packet. */ 541 invalid: 542 if (debug) 543 log(LOG_DEBUG, 544 "%s: invalid input packet " 545 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 546 ifp->if_xname, 547 h->address, h->control, ntohs(h->protocol)); 548 goto drop; 549 } 550 protocol = ntohs(h->protocol); 551 } 552 553 switch (protocol) { 554 default: 555 if (sp->state[IDX_LCP] == STATE_OPENED) { 556 uint16_t prot = htons(protocol); 557 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 558 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 559 &prot); 560 } 561 if (debug) 562 log(LOG_DEBUG, 563 "%s: invalid input protocol " 564 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 565 ++ifp->if_noproto; 566 goto drop; 567 case PPP_LCP: 568 sppp_cp_input(&lcp, sp, m); 569 m_freem(m); 570 return; 571 case PPP_PAP: 572 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 573 sppp_pap_input(sp, m); 574 m_freem(m); 575 return; 576 case PPP_CHAP: 577 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 578 sppp_chap_input(sp, m); 579 m_freem(m); 580 return; 581 #ifdef INET 582 case PPP_IPCP: 583 if (sp->pp_phase == SPPP_PHASE_NETWORK) 584 sppp_cp_input(&ipcp, sp, m); 585 m_freem(m); 586 return; 587 case PPP_IP: 588 if (sp->state[IDX_IPCP] == STATE_OPENED) { 589 sp->pp_last_activity = time_uptime; 590 pktq = ip_pktq; 591 } 592 break; 593 #endif 594 #ifdef INET6 595 case PPP_IPV6CP: 596 if (sp->pp_phase == SPPP_PHASE_NETWORK) 597 sppp_cp_input(&ipv6cp, sp, m); 598 m_freem(m); 599 return; 600 601 case PPP_IPV6: 602 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 603 sp->pp_last_activity = time_uptime; 604 pktq = ip6_pktq; 605 } 606 break; 607 #endif 608 } 609 610 queue_pkt: 611 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 612 goto drop; 613 } 614 615 /* Check queue. */ 616 if (__predict_true(pktq)) { 617 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 618 goto drop; 619 } 620 return; 621 } 622 623 s = splnet(); 624 if (IF_QFULL(inq)) { 625 /* Queue overflow. */ 626 IF_DROP(inq); 627 splx(s); 628 if (debug) 629 log(LOG_DEBUG, "%s: protocol queue overflow\n", 630 ifp->if_xname); 631 goto drop; 632 } 633 IF_ENQUEUE(inq, m); 634 schednetisr(isr); 635 splx(s); 636 } 637 638 /* 639 * Enqueue transmit packet. 640 */ 641 static int 642 sppp_output(struct ifnet *ifp, struct mbuf *m, 643 const struct sockaddr *dst, struct rtentry *rt) 644 { 645 struct sppp *sp = (struct sppp *) ifp; 646 struct ppp_header *h = NULL; 647 struct ifqueue *ifq = NULL; /* XXX */ 648 int s, error = 0; 649 uint16_t protocol; 650 651 s = splnet(); 652 653 sp->pp_last_activity = time_uptime; 654 655 if ((ifp->if_flags & IFF_UP) == 0 || 656 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 657 m_freem(m); 658 splx(s); 659 return (ENETDOWN); 660 } 661 662 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 663 /* 664 * Interface is not yet running, but auto-dial. Need 665 * to start LCP for it. 666 */ 667 ifp->if_flags |= IFF_RUNNING; 668 splx(s); 669 lcp.Open(sp); 670 s = splnet(); 671 } 672 673 /* 674 * If the queueing discipline needs packet classification, 675 * do it before prepending link headers. 676 */ 677 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 678 679 #ifdef INET 680 if (dst->sa_family == AF_INET) { 681 struct ip *ip = NULL; 682 struct tcphdr *th = NULL; 683 684 if (m->m_len >= sizeof(struct ip)) { 685 ip = mtod(m, struct ip *); 686 if (ip->ip_p == IPPROTO_TCP && 687 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 688 sizeof(struct tcphdr)) { 689 th = (struct tcphdr *) 690 ((char *)ip + (ip->ip_hl << 2)); 691 } 692 } else 693 ip = NULL; 694 695 /* 696 * When using dynamic local IP address assignment by using 697 * 0.0.0.0 as a local address, the first TCP session will 698 * not connect because the local TCP checksum is computed 699 * using 0.0.0.0 which will later become our real IP address 700 * so the TCP checksum computed at the remote end will 701 * become invalid. So we 702 * - don't let packets with src ip addr 0 thru 703 * - we flag TCP packets with src ip 0 as an error 704 */ 705 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 706 uint8_t proto = ip->ip_p; 707 708 m_freem(m); 709 splx(s); 710 if (proto == IPPROTO_TCP) 711 return (EADDRNOTAVAIL); 712 else 713 return (0); 714 } 715 716 /* 717 * Put low delay, telnet, rlogin and ftp control packets 718 * in front of the queue. 719 */ 720 721 if (!IF_QFULL(&sp->pp_fastq) && 722 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 723 (th && (INTERACTIVE(ntohs(th->th_sport)) || 724 INTERACTIVE(ntohs(th->th_dport)))))) 725 ifq = &sp->pp_fastq; 726 } 727 #endif 728 729 #ifdef INET6 730 if (dst->sa_family == AF_INET6) { 731 /* XXX do something tricky here? */ 732 } 733 #endif 734 735 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 736 /* 737 * Prepend general data packet PPP header. For now, IP only. 738 */ 739 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 740 if (! m) { 741 if (ifp->if_flags & IFF_DEBUG) 742 log(LOG_DEBUG, "%s: no memory for transmit header\n", 743 ifp->if_xname); 744 ++ifp->if_oerrors; 745 splx(s); 746 return (ENOBUFS); 747 } 748 /* 749 * May want to check size of packet 750 * (albeit due to the implementation it's always enough) 751 */ 752 h = mtod(m, struct ppp_header *); 753 if (sp->pp_flags & PP_CISCO) { 754 h->address = CISCO_UNICAST; /* unicast address */ 755 h->control = 0; 756 } else { 757 h->address = PPP_ALLSTATIONS; /* broadcast address */ 758 h->control = PPP_UI; /* Unnumbered Info */ 759 } 760 } 761 762 switch (dst->sa_family) { 763 #ifdef INET 764 case AF_INET: /* Internet Protocol */ 765 if (sp->pp_flags & PP_CISCO) 766 protocol = htons(ETHERTYPE_IP); 767 else { 768 /* 769 * Don't choke with an ENETDOWN early. It's 770 * possible that we just started dialing out, 771 * so don't drop the packet immediately. If 772 * we notice that we run out of buffer space 773 * below, we will however remember that we are 774 * not ready to carry IP packets, and return 775 * ENETDOWN, as opposed to ENOBUFS. 776 */ 777 protocol = htons(PPP_IP); 778 if (sp->state[IDX_IPCP] != STATE_OPENED) 779 error = ENETDOWN; 780 } 781 break; 782 #endif 783 #ifdef INET6 784 case AF_INET6: /* Internet Protocol version 6 */ 785 if (sp->pp_flags & PP_CISCO) 786 protocol = htons(ETHERTYPE_IPV6); 787 else { 788 /* 789 * Don't choke with an ENETDOWN early. It's 790 * possible that we just started dialing out, 791 * so don't drop the packet immediately. If 792 * we notice that we run out of buffer space 793 * below, we will however remember that we are 794 * not ready to carry IP packets, and return 795 * ENETDOWN, as opposed to ENOBUFS. 796 */ 797 protocol = htons(PPP_IPV6); 798 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 799 error = ENETDOWN; 800 } 801 break; 802 #endif 803 default: 804 m_freem(m); 805 ++ifp->if_oerrors; 806 splx(s); 807 return (EAFNOSUPPORT); 808 } 809 810 if (sp->pp_flags & PP_NOFRAMING) { 811 M_PREPEND(m, 2, M_DONTWAIT); 812 if (m == NULL) { 813 if (ifp->if_flags & IFF_DEBUG) 814 log(LOG_DEBUG, "%s: no memory for transmit header\n", 815 ifp->if_xname); 816 ++ifp->if_oerrors; 817 splx(s); 818 return (ENOBUFS); 819 } 820 *mtod(m, uint16_t *) = protocol; 821 } else { 822 h->protocol = protocol; 823 } 824 825 826 error = ifq_enqueue2(ifp, ifq, m); 827 828 if (error == 0) { 829 /* 830 * Count output packets and bytes. 831 * The packet length includes header + additional hardware 832 * framing according to RFC 1333. 833 */ 834 if (!(ifp->if_flags & IFF_OACTIVE)) 835 (*ifp->if_start)(ifp); 836 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 837 } 838 splx(s); 839 return error; 840 } 841 842 void 843 sppp_attach(struct ifnet *ifp) 844 { 845 struct sppp *sp = (struct sppp *) ifp; 846 847 /* Initialize keepalive handler. */ 848 if (! spppq) { 849 callout_init(&keepalive_ch, 0); 850 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 851 } 852 853 /* Insert new entry into the keepalive list. */ 854 sp->pp_next = spppq; 855 spppq = sp; 856 857 sp->pp_if.if_type = IFT_PPP; 858 sp->pp_if.if_output = sppp_output; 859 sp->pp_fastq.ifq_maxlen = 32; 860 sp->pp_cpq.ifq_maxlen = 20; 861 sp->pp_loopcnt = 0; 862 sp->pp_alivecnt = 0; 863 sp->pp_last_activity = 0; 864 sp->pp_last_receive = 0; 865 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 866 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 867 sp->pp_idle_timeout = 0; 868 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 869 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 870 sp->pp_auth_failures = 0; 871 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 872 sp->pp_phase = SPPP_PHASE_DEAD; 873 sp->pp_up = lcp.Up; 874 sp->pp_down = lcp.Down; 875 876 if_alloc_sadl(ifp); 877 878 memset(&sp->myauth, 0, sizeof sp->myauth); 879 memset(&sp->hisauth, 0, sizeof sp->hisauth); 880 sppp_lcp_init(sp); 881 sppp_ipcp_init(sp); 882 sppp_ipv6cp_init(sp); 883 sppp_pap_init(sp); 884 sppp_chap_init(sp); 885 } 886 887 void 888 sppp_detach(struct ifnet *ifp) 889 { 890 struct sppp **q, *p, *sp = (struct sppp *) ifp; 891 892 /* Remove the entry from the keepalive list. */ 893 for (q = &spppq; (p = *q); q = &p->pp_next) 894 if (p == sp) { 895 *q = p->pp_next; 896 break; 897 } 898 899 /* Stop keepalive handler. */ 900 if (! spppq) { 901 callout_stop(&keepalive_ch); 902 } 903 904 callout_stop(&sp->ch[IDX_LCP]); 905 callout_stop(&sp->ch[IDX_IPCP]); 906 callout_stop(&sp->ch[IDX_PAP]); 907 callout_stop(&sp->ch[IDX_CHAP]); 908 #ifdef INET6 909 callout_stop(&sp->ch[IDX_IPV6CP]); 910 #endif 911 callout_stop(&sp->pap_my_to_ch); 912 913 /* free authentication info */ 914 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 915 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 916 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 917 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 918 } 919 920 /* 921 * Flush the interface output queue. 922 */ 923 void 924 sppp_flush(struct ifnet *ifp) 925 { 926 struct sppp *sp = (struct sppp *) ifp; 927 928 IFQ_PURGE(&sp->pp_if.if_snd); 929 IF_PURGE(&sp->pp_fastq); 930 IF_PURGE(&sp->pp_cpq); 931 } 932 933 /* 934 * Check if the output queue is empty. 935 */ 936 int 937 sppp_isempty(struct ifnet *ifp) 938 { 939 struct sppp *sp = (struct sppp *) ifp; 940 int empty, s; 941 942 s = splnet(); 943 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 944 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 945 splx(s); 946 return (empty); 947 } 948 949 /* 950 * Get next packet to send. 951 */ 952 struct mbuf * 953 sppp_dequeue(struct ifnet *ifp) 954 { 955 struct sppp *sp = (struct sppp *) ifp; 956 struct mbuf *m; 957 int s; 958 959 s = splnet(); 960 /* 961 * Process only the control protocol queue until we have at 962 * least one NCP open. 963 * 964 * Do always serve all three queues in Cisco mode. 965 */ 966 IF_DEQUEUE(&sp->pp_cpq, m); 967 if (m == NULL && 968 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 969 IF_DEQUEUE(&sp->pp_fastq, m); 970 if (m == NULL) 971 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 972 } 973 splx(s); 974 return m; 975 } 976 977 /* 978 * Process an ioctl request. Called on low priority level. 979 */ 980 int 981 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 982 { 983 struct lwp *l = curlwp; /* XXX */ 984 struct ifreq *ifr = (struct ifreq *) data; 985 struct ifaddr *ifa = (struct ifaddr *) data; 986 struct sppp *sp = (struct sppp *) ifp; 987 int s, error=0, going_up, going_down, newmode; 988 989 s = splnet(); 990 switch (cmd) { 991 case SIOCINITIFADDR: 992 ifa->ifa_rtrequest = p2p_rtrequest; 993 break; 994 995 case SIOCSIFFLAGS: 996 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 997 break; 998 going_up = ifp->if_flags & IFF_UP && 999 (ifp->if_flags & IFF_RUNNING) == 0; 1000 going_down = (ifp->if_flags & IFF_UP) == 0 && 1001 ifp->if_flags & IFF_RUNNING; 1002 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1003 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1004 /* sanity */ 1005 newmode = IFF_PASSIVE; 1006 ifp->if_flags &= ~IFF_AUTO; 1007 } 1008 1009 if (going_up || going_down) 1010 lcp.Close(sp); 1011 if (going_up && newmode == 0) { 1012 /* neither auto-dial nor passive */ 1013 ifp->if_flags |= IFF_RUNNING; 1014 if (!(sp->pp_flags & PP_CISCO)) 1015 lcp.Open(sp); 1016 } else if (going_down) { 1017 sppp_flush(ifp); 1018 ifp->if_flags &= ~IFF_RUNNING; 1019 } 1020 1021 break; 1022 1023 case SIOCSIFMTU: 1024 if (ifr->ifr_mtu < PPP_MINMRU || 1025 ifr->ifr_mtu > sp->lcp.their_mru) { 1026 error = EINVAL; 1027 break; 1028 } 1029 /*FALLTHROUGH*/ 1030 case SIOCGIFMTU: 1031 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1032 error = 0; 1033 break; 1034 case SIOCADDMULTI: 1035 case SIOCDELMULTI: 1036 break; 1037 1038 case SPPPSETAUTHCFG: 1039 case SPPPSETLCPCFG: 1040 case SPPPSETIDLETO: 1041 case SPPPSETAUTHFAILURE: 1042 case SPPPSETDNSOPTS: 1043 case SPPPSETKEEPALIVE: 1044 #if defined(COMPAT_50) || defined(MODULAR) 1045 case __SPPPSETIDLETO50: 1046 case __SPPPSETKEEPALIVE50: 1047 #endif /* COMPAT_50 || MODULAR */ 1048 error = kauth_authorize_network(l->l_cred, 1049 KAUTH_NETWORK_INTERFACE, 1050 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1051 NULL); 1052 if (error) 1053 break; 1054 error = sppp_params(sp, cmd, data); 1055 break; 1056 1057 case SPPPGETAUTHCFG: 1058 case SPPPGETLCPCFG: 1059 case SPPPGETAUTHFAILURES: 1060 error = kauth_authorize_network(l->l_cred, 1061 KAUTH_NETWORK_INTERFACE, 1062 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1063 NULL); 1064 if (error) 1065 break; 1066 error = sppp_params(sp, cmd, data); 1067 break; 1068 1069 case SPPPGETSTATUS: 1070 case SPPPGETSTATUSNCP: 1071 case SPPPGETIDLETO: 1072 case SPPPGETDNSOPTS: 1073 case SPPPGETDNSADDRS: 1074 case SPPPGETKEEPALIVE: 1075 #if defined(COMPAT_50) || defined(MODULAR) 1076 case __SPPPGETIDLETO50: 1077 case __SPPPGETKEEPALIVE50: 1078 #endif /* COMPAT_50 || MODULAR */ 1079 error = sppp_params(sp, cmd, data); 1080 break; 1081 1082 default: 1083 error = ifioctl_common(ifp, cmd, data); 1084 break; 1085 } 1086 splx(s); 1087 return (error); 1088 } 1089 1090 1091 /* 1092 * Cisco framing implementation. 1093 */ 1094 1095 /* 1096 * Handle incoming Cisco keepalive protocol packets. 1097 */ 1098 static void 1099 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1100 { 1101 STDDCL; 1102 struct cisco_packet *h; 1103 #ifdef INET 1104 uint32_t me, mymask = 0; /* XXX: GCC */ 1105 #endif 1106 1107 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1108 if (debug) 1109 log(LOG_DEBUG, 1110 "%s: cisco invalid packet length: %d bytes\n", 1111 ifp->if_xname, m->m_pkthdr.len); 1112 return; 1113 } 1114 h = mtod(m, struct cisco_packet *); 1115 if (debug) 1116 log(LOG_DEBUG, 1117 "%s: cisco input: %d bytes " 1118 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1119 ifp->if_xname, m->m_pkthdr.len, 1120 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1121 (u_int)h->time0, (u_int)h->time1); 1122 switch (ntohl(h->type)) { 1123 default: 1124 if (debug) 1125 addlog("%s: cisco unknown packet type: 0x%x\n", 1126 ifp->if_xname, ntohl(h->type)); 1127 break; 1128 case CISCO_ADDR_REPLY: 1129 /* Reply on address request, ignore */ 1130 break; 1131 case CISCO_KEEPALIVE_REQ: 1132 sp->pp_alivecnt = 0; 1133 sp->pp_rseq[IDX_LCP] = ntohl(h->par1); 1134 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1135 /* Local and remote sequence numbers are equal. 1136 * Probably, the line is in loopback mode. */ 1137 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1138 printf ("%s: loopback\n", 1139 ifp->if_xname); 1140 sp->pp_loopcnt = 0; 1141 if (ifp->if_flags & IFF_UP) { 1142 if_down(ifp); 1143 IF_PURGE(&sp->pp_cpq); 1144 } 1145 } 1146 ++sp->pp_loopcnt; 1147 1148 /* Generate new local sequence number */ 1149 sp->pp_seq[IDX_LCP] = cprng_fast32(); 1150 break; 1151 } 1152 sp->pp_loopcnt = 0; 1153 if (! (ifp->if_flags & IFF_UP) && 1154 (ifp->if_flags & IFF_RUNNING)) { 1155 if_up(ifp); 1156 } 1157 break; 1158 case CISCO_ADDR_REQ: 1159 #ifdef INET 1160 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1161 if (me != 0L) 1162 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1163 #endif 1164 break; 1165 } 1166 } 1167 1168 /* 1169 * Send Cisco keepalive packet. 1170 */ 1171 static void 1172 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1173 { 1174 STDDCL; 1175 struct ppp_header *h; 1176 struct cisco_packet *ch; 1177 struct mbuf *m; 1178 uint32_t t; 1179 1180 t = time_uptime * 1000; 1181 MGETHDR(m, M_DONTWAIT, MT_DATA); 1182 if (! m) 1183 return; 1184 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1185 m->m_pkthdr.rcvif = 0; 1186 1187 h = mtod(m, struct ppp_header *); 1188 h->address = CISCO_MULTICAST; 1189 h->control = 0; 1190 h->protocol = htons(CISCO_KEEPALIVE); 1191 1192 ch = (struct cisco_packet *)(h + 1); 1193 ch->type = htonl(type); 1194 ch->par1 = htonl(par1); 1195 ch->par2 = htonl(par2); 1196 ch->rel = -1; 1197 1198 ch->time0 = htons((u_short)(t >> 16)); 1199 ch->time1 = htons((u_short) t); 1200 1201 if (debug) 1202 log(LOG_DEBUG, 1203 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1204 ifp->if_xname, ntohl(ch->type), ch->par1, 1205 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1206 (u_int)ch->time1); 1207 1208 if (IF_QFULL(&sp->pp_cpq)) { 1209 IF_DROP(&sp->pp_fastq); 1210 IF_DROP(&ifp->if_snd); 1211 m_freem(m); 1212 ++ifp->if_oerrors; 1213 return; 1214 } else 1215 IF_ENQUEUE(&sp->pp_cpq, m); 1216 if (! (ifp->if_flags & IFF_OACTIVE)) 1217 (*ifp->if_start)(ifp); 1218 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1219 } 1220 1221 /* 1222 * PPP protocol implementation. 1223 */ 1224 1225 /* 1226 * Send PPP control protocol packet. 1227 */ 1228 static void 1229 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1230 u_char ident, u_short len, void *data) 1231 { 1232 STDDCL; 1233 struct lcp_header *lh; 1234 struct mbuf *m; 1235 size_t pkthdrlen; 1236 1237 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1238 1239 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1240 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1241 MGETHDR(m, M_DONTWAIT, MT_DATA); 1242 if (! m) 1243 return; 1244 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1245 m->m_pkthdr.rcvif = 0; 1246 1247 if (sp->pp_flags & PP_NOFRAMING) { 1248 *mtod(m, uint16_t *) = htons(proto); 1249 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1250 } else { 1251 struct ppp_header *h; 1252 h = mtod(m, struct ppp_header *); 1253 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1254 h->control = PPP_UI; /* Unnumbered Info */ 1255 h->protocol = htons(proto); /* Link Control Protocol */ 1256 lh = (struct lcp_header *)(h + 1); 1257 } 1258 lh->type = type; 1259 lh->ident = ident; 1260 lh->len = htons(LCP_HEADER_LEN + len); 1261 if (len) 1262 bcopy (data, lh + 1, len); 1263 1264 if (debug) { 1265 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1266 ifp->if_xname, 1267 sppp_proto_name(proto), 1268 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1269 if (len) 1270 sppp_print_bytes((u_char *)(lh + 1), len); 1271 addlog(">\n"); 1272 } 1273 if (IF_QFULL(&sp->pp_cpq)) { 1274 IF_DROP(&sp->pp_fastq); 1275 IF_DROP(&ifp->if_snd); 1276 m_freem(m); 1277 ++ifp->if_oerrors; 1278 return; 1279 } else 1280 IF_ENQUEUE(&sp->pp_cpq, m); 1281 if (! (ifp->if_flags & IFF_OACTIVE)) 1282 (*ifp->if_start)(ifp); 1283 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1284 } 1285 1286 /* 1287 * Handle incoming PPP control protocol packets. 1288 */ 1289 static void 1290 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1291 { 1292 STDDCL; 1293 struct lcp_header *h; 1294 int printlen, len = m->m_pkthdr.len; 1295 int rv; 1296 u_char *p; 1297 uint32_t u32; 1298 1299 if (len < 4) { 1300 if (debug) 1301 log(LOG_DEBUG, 1302 "%s: %s invalid packet length: %d bytes\n", 1303 ifp->if_xname, cp->name, len); 1304 return; 1305 } 1306 h = mtod(m, struct lcp_header *); 1307 if (debug) { 1308 printlen = ntohs(h->len); 1309 log(LOG_DEBUG, 1310 "%s: %s input(%s): <%s id=0x%x len=%d", 1311 ifp->if_xname, cp->name, 1312 sppp_state_name(sp->state[cp->protoidx]), 1313 sppp_cp_type_name(h->type), h->ident, printlen); 1314 if (len < printlen) 1315 printlen = len; 1316 if (printlen > 4) 1317 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1318 addlog(">\n"); 1319 } 1320 if (len > ntohs(h->len)) 1321 len = ntohs(h->len); 1322 p = (u_char *)(h + 1); 1323 switch (h->type) { 1324 case CONF_REQ: 1325 if (len < 4) { 1326 if (debug) 1327 addlog("%s: %s invalid conf-req length %d\n", 1328 ifp->if_xname, cp->name, 1329 len); 1330 ++ifp->if_ierrors; 1331 break; 1332 } 1333 /* handle states where RCR doesn't get a SCA/SCN */ 1334 switch (sp->state[cp->protoidx]) { 1335 case STATE_CLOSING: 1336 case STATE_STOPPING: 1337 return; 1338 case STATE_CLOSED: 1339 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1340 0, 0); 1341 return; 1342 } 1343 rv = (cp->RCR)(sp, h, len); 1344 if (rv < 0) { 1345 /* fatal error, shut down */ 1346 (cp->tld)(sp); 1347 sppp_lcp_tlf(sp); 1348 return; 1349 } 1350 switch (sp->state[cp->protoidx]) { 1351 case STATE_OPENED: 1352 (cp->tld)(sp); 1353 (cp->scr)(sp); 1354 /* fall through... */ 1355 case STATE_ACK_SENT: 1356 case STATE_REQ_SENT: 1357 sppp_cp_change_state(cp, sp, rv? 1358 STATE_ACK_SENT: STATE_REQ_SENT); 1359 break; 1360 case STATE_STOPPED: 1361 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1362 (cp->scr)(sp); 1363 sppp_cp_change_state(cp, sp, rv? 1364 STATE_ACK_SENT: STATE_REQ_SENT); 1365 break; 1366 case STATE_ACK_RCVD: 1367 if (rv) { 1368 sppp_cp_change_state(cp, sp, STATE_OPENED); 1369 if (debug) 1370 log(LOG_DEBUG, "%s: %s tlu\n", 1371 ifp->if_xname, 1372 cp->name); 1373 (cp->tlu)(sp); 1374 } else 1375 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1376 break; 1377 default: 1378 printf("%s: %s illegal %s in state %s\n", 1379 ifp->if_xname, cp->name, 1380 sppp_cp_type_name(h->type), 1381 sppp_state_name(sp->state[cp->protoidx])); 1382 ++ifp->if_ierrors; 1383 } 1384 break; 1385 case CONF_ACK: 1386 if (h->ident != sp->confid[cp->protoidx]) { 1387 if (debug) 1388 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1389 ifp->if_xname, cp->name, 1390 h->ident, sp->confid[cp->protoidx]); 1391 ++ifp->if_ierrors; 1392 break; 1393 } 1394 switch (sp->state[cp->protoidx]) { 1395 case STATE_CLOSED: 1396 case STATE_STOPPED: 1397 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1398 break; 1399 case STATE_CLOSING: 1400 case STATE_STOPPING: 1401 break; 1402 case STATE_REQ_SENT: 1403 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1404 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1405 break; 1406 case STATE_OPENED: 1407 (cp->tld)(sp); 1408 /* fall through */ 1409 case STATE_ACK_RCVD: 1410 (cp->scr)(sp); 1411 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1412 break; 1413 case STATE_ACK_SENT: 1414 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1415 sppp_cp_change_state(cp, sp, STATE_OPENED); 1416 if (debug) 1417 log(LOG_DEBUG, "%s: %s tlu\n", 1418 ifp->if_xname, cp->name); 1419 (cp->tlu)(sp); 1420 break; 1421 default: 1422 printf("%s: %s illegal %s in state %s\n", 1423 ifp->if_xname, cp->name, 1424 sppp_cp_type_name(h->type), 1425 sppp_state_name(sp->state[cp->protoidx])); 1426 ++ifp->if_ierrors; 1427 } 1428 break; 1429 case CONF_NAK: 1430 case CONF_REJ: 1431 if (h->ident != sp->confid[cp->protoidx]) { 1432 if (debug) 1433 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1434 ifp->if_xname, cp->name, 1435 h->ident, sp->confid[cp->protoidx]); 1436 ++ifp->if_ierrors; 1437 break; 1438 } 1439 if (h->type == CONF_NAK) 1440 (cp->RCN_nak)(sp, h, len); 1441 else /* CONF_REJ */ 1442 (cp->RCN_rej)(sp, h, len); 1443 1444 switch (sp->state[cp->protoidx]) { 1445 case STATE_CLOSED: 1446 case STATE_STOPPED: 1447 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1448 break; 1449 case STATE_REQ_SENT: 1450 case STATE_ACK_SENT: 1451 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1452 (cp->scr)(sp); 1453 break; 1454 case STATE_OPENED: 1455 (cp->tld)(sp); 1456 /* fall through */ 1457 case STATE_ACK_RCVD: 1458 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1459 (cp->scr)(sp); 1460 break; 1461 case STATE_CLOSING: 1462 case STATE_STOPPING: 1463 break; 1464 default: 1465 printf("%s: %s illegal %s in state %s\n", 1466 ifp->if_xname, cp->name, 1467 sppp_cp_type_name(h->type), 1468 sppp_state_name(sp->state[cp->protoidx])); 1469 ++ifp->if_ierrors; 1470 } 1471 break; 1472 1473 case TERM_REQ: 1474 switch (sp->state[cp->protoidx]) { 1475 case STATE_ACK_RCVD: 1476 case STATE_ACK_SENT: 1477 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1478 /* fall through */ 1479 case STATE_CLOSED: 1480 case STATE_STOPPED: 1481 case STATE_CLOSING: 1482 case STATE_STOPPING: 1483 case STATE_REQ_SENT: 1484 sta: 1485 /* Send Terminate-Ack packet. */ 1486 if (debug) 1487 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 1488 ifp->if_xname, cp->name); 1489 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1490 break; 1491 case STATE_OPENED: 1492 (cp->tld)(sp); 1493 sp->rst_counter[cp->protoidx] = 0; 1494 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1495 goto sta; 1496 default: 1497 printf("%s: %s illegal %s in state %s\n", 1498 ifp->if_xname, cp->name, 1499 sppp_cp_type_name(h->type), 1500 sppp_state_name(sp->state[cp->protoidx])); 1501 ++ifp->if_ierrors; 1502 } 1503 break; 1504 case TERM_ACK: 1505 switch (sp->state[cp->protoidx]) { 1506 case STATE_CLOSED: 1507 case STATE_STOPPED: 1508 case STATE_REQ_SENT: 1509 case STATE_ACK_SENT: 1510 break; 1511 case STATE_CLOSING: 1512 (cp->tlf)(sp); 1513 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1514 sppp_lcp_check_and_close(sp); 1515 break; 1516 case STATE_STOPPING: 1517 (cp->tlf)(sp); 1518 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1519 sppp_lcp_check_and_close(sp); 1520 break; 1521 case STATE_ACK_RCVD: 1522 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1523 break; 1524 case STATE_OPENED: 1525 (cp->tld)(sp); 1526 (cp->scr)(sp); 1527 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1528 break; 1529 default: 1530 printf("%s: %s illegal %s in state %s\n", 1531 ifp->if_xname, cp->name, 1532 sppp_cp_type_name(h->type), 1533 sppp_state_name(sp->state[cp->protoidx])); 1534 ++ifp->if_ierrors; 1535 } 1536 break; 1537 case CODE_REJ: 1538 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1539 log(LOG_INFO, 1540 "%s: %s: ignoring RXJ (%s) for code ?, " 1541 "danger will robinson\n", 1542 ifp->if_xname, cp->name, 1543 sppp_cp_type_name(h->type)); 1544 switch (sp->state[cp->protoidx]) { 1545 case STATE_CLOSED: 1546 case STATE_STOPPED: 1547 case STATE_REQ_SENT: 1548 case STATE_ACK_SENT: 1549 case STATE_CLOSING: 1550 case STATE_STOPPING: 1551 case STATE_OPENED: 1552 break; 1553 case STATE_ACK_RCVD: 1554 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1555 break; 1556 default: 1557 printf("%s: %s illegal %s in state %s\n", 1558 ifp->if_xname, cp->name, 1559 sppp_cp_type_name(h->type), 1560 sppp_state_name(sp->state[cp->protoidx])); 1561 ++ifp->if_ierrors; 1562 } 1563 break; 1564 case PROTO_REJ: 1565 { 1566 int catastrophic; 1567 const struct cp *upper; 1568 int i; 1569 uint16_t proto; 1570 1571 catastrophic = 0; 1572 upper = NULL; 1573 proto = p[0] << 8 | p[1]; 1574 for (i = 0; i < IDX_COUNT; i++) { 1575 if (cps[i]->proto == proto) { 1576 upper = cps[i]; 1577 break; 1578 } 1579 } 1580 if (upper == NULL) 1581 catastrophic++; 1582 1583 if (debug) 1584 log(LOG_INFO, 1585 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1586 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1587 sppp_cp_type_name(h->type), proto, 1588 upper ? upper->name : "unknown", 1589 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1590 1591 /* 1592 * if we got RXJ+ against conf-req, the peer does not implement 1593 * this particular protocol type. terminate the protocol. 1594 */ 1595 if (upper && !catastrophic) { 1596 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1597 upper->Close(sp); 1598 break; 1599 } 1600 } 1601 1602 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1603 switch (sp->state[cp->protoidx]) { 1604 case STATE_CLOSED: 1605 case STATE_STOPPED: 1606 case STATE_REQ_SENT: 1607 case STATE_ACK_SENT: 1608 case STATE_CLOSING: 1609 case STATE_STOPPING: 1610 case STATE_OPENED: 1611 break; 1612 case STATE_ACK_RCVD: 1613 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1614 break; 1615 default: 1616 printf("%s: %s illegal %s in state %s\n", 1617 ifp->if_xname, cp->name, 1618 sppp_cp_type_name(h->type), 1619 sppp_state_name(sp->state[cp->protoidx])); 1620 ++ifp->if_ierrors; 1621 } 1622 break; 1623 } 1624 case DISC_REQ: 1625 if (cp->proto != PPP_LCP) 1626 goto illegal; 1627 /* Discard the packet. */ 1628 break; 1629 case ECHO_REQ: 1630 if (cp->proto != PPP_LCP) 1631 goto illegal; 1632 if (sp->state[cp->protoidx] != STATE_OPENED) { 1633 if (debug) 1634 addlog("%s: lcp echo req but lcp closed\n", 1635 ifp->if_xname); 1636 ++ifp->if_ierrors; 1637 break; 1638 } 1639 if (len < 8) { 1640 if (debug) 1641 addlog("%s: invalid lcp echo request " 1642 "packet length: %d bytes\n", 1643 ifp->if_xname, len); 1644 break; 1645 } 1646 memcpy(&u32, h + 1, sizeof u32); 1647 if (ntohl(u32) == sp->lcp.magic) { 1648 /* Line loopback mode detected. */ 1649 printf("%s: loopback\n", ifp->if_xname); 1650 if_down(ifp); 1651 IF_PURGE(&sp->pp_cpq); 1652 1653 /* Shut down the PPP link. */ 1654 /* XXX */ 1655 lcp.Down(sp); 1656 lcp.Up(sp); 1657 break; 1658 } 1659 u32 = htonl(sp->lcp.magic); 1660 memcpy(h + 1, &u32, sizeof u32); 1661 if (debug) 1662 addlog("%s: got lcp echo req, sending echo rep\n", 1663 ifp->if_xname); 1664 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1665 h + 1); 1666 break; 1667 case ECHO_REPLY: 1668 if (cp->proto != PPP_LCP) 1669 goto illegal; 1670 if (h->ident != sp->lcp.echoid) { 1671 ++ifp->if_ierrors; 1672 break; 1673 } 1674 if (len < 8) { 1675 if (debug) 1676 addlog("%s: lcp invalid echo reply " 1677 "packet length: %d bytes\n", 1678 ifp->if_xname, len); 1679 break; 1680 } 1681 if (debug) 1682 addlog("%s: lcp got echo rep\n", 1683 ifp->if_xname); 1684 memcpy(&u32, h + 1, sizeof u32); 1685 if (ntohl(u32) != sp->lcp.magic) 1686 sp->pp_alivecnt = 0; 1687 break; 1688 default: 1689 /* Unknown packet type -- send Code-Reject packet. */ 1690 illegal: 1691 if (debug) 1692 addlog("%s: %s send code-rej for 0x%x\n", 1693 ifp->if_xname, cp->name, h->type); 1694 sppp_cp_send(sp, cp->proto, CODE_REJ, 1695 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1696 ++ifp->if_ierrors; 1697 } 1698 } 1699 1700 1701 /* 1702 * The generic part of all Up/Down/Open/Close/TO event handlers. 1703 * Basically, the state transition handling in the automaton. 1704 */ 1705 static void 1706 sppp_up_event(const struct cp *cp, struct sppp *sp) 1707 { 1708 STDDCL; 1709 1710 if (debug) 1711 log(LOG_DEBUG, "%s: %s up(%s)\n", 1712 ifp->if_xname, cp->name, 1713 sppp_state_name(sp->state[cp->protoidx])); 1714 1715 switch (sp->state[cp->protoidx]) { 1716 case STATE_INITIAL: 1717 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1718 break; 1719 case STATE_STARTING: 1720 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1721 (cp->scr)(sp); 1722 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1723 break; 1724 default: 1725 printf("%s: %s illegal up in state %s\n", 1726 ifp->if_xname, cp->name, 1727 sppp_state_name(sp->state[cp->protoidx])); 1728 } 1729 } 1730 1731 static void 1732 sppp_down_event(const struct cp *cp, struct sppp *sp) 1733 { 1734 STDDCL; 1735 1736 if (debug) 1737 log(LOG_DEBUG, "%s: %s down(%s)\n", 1738 ifp->if_xname, cp->name, 1739 sppp_state_name(sp->state[cp->protoidx])); 1740 1741 switch (sp->state[cp->protoidx]) { 1742 case STATE_CLOSED: 1743 case STATE_CLOSING: 1744 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1745 break; 1746 case STATE_STOPPED: 1747 (cp->tls)(sp); 1748 /* fall through */ 1749 case STATE_STOPPING: 1750 case STATE_REQ_SENT: 1751 case STATE_ACK_RCVD: 1752 case STATE_ACK_SENT: 1753 sppp_cp_change_state(cp, sp, STATE_STARTING); 1754 break; 1755 case STATE_OPENED: 1756 (cp->tld)(sp); 1757 sppp_cp_change_state(cp, sp, STATE_STARTING); 1758 break; 1759 default: 1760 printf("%s: %s illegal down in state %s\n", 1761 ifp->if_xname, cp->name, 1762 sppp_state_name(sp->state[cp->protoidx])); 1763 } 1764 } 1765 1766 1767 static void 1768 sppp_open_event(const struct cp *cp, struct sppp *sp) 1769 { 1770 STDDCL; 1771 1772 if (debug) 1773 log(LOG_DEBUG, "%s: %s open(%s)\n", 1774 ifp->if_xname, cp->name, 1775 sppp_state_name(sp->state[cp->protoidx])); 1776 1777 switch (sp->state[cp->protoidx]) { 1778 case STATE_INITIAL: 1779 sppp_cp_change_state(cp, sp, STATE_STARTING); 1780 (cp->tls)(sp); 1781 break; 1782 case STATE_STARTING: 1783 break; 1784 case STATE_CLOSED: 1785 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1786 (cp->scr)(sp); 1787 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1788 break; 1789 case STATE_STOPPED: 1790 case STATE_STOPPING: 1791 case STATE_REQ_SENT: 1792 case STATE_ACK_RCVD: 1793 case STATE_ACK_SENT: 1794 case STATE_OPENED: 1795 break; 1796 case STATE_CLOSING: 1797 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1798 break; 1799 } 1800 } 1801 1802 1803 static void 1804 sppp_close_event(const struct cp *cp, struct sppp *sp) 1805 { 1806 STDDCL; 1807 1808 if (debug) 1809 log(LOG_DEBUG, "%s: %s close(%s)\n", 1810 ifp->if_xname, cp->name, 1811 sppp_state_name(sp->state[cp->protoidx])); 1812 1813 switch (sp->state[cp->protoidx]) { 1814 case STATE_INITIAL: 1815 case STATE_CLOSED: 1816 case STATE_CLOSING: 1817 break; 1818 case STATE_STARTING: 1819 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1820 (cp->tlf)(sp); 1821 break; 1822 case STATE_STOPPED: 1823 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1824 break; 1825 case STATE_STOPPING: 1826 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1827 break; 1828 case STATE_OPENED: 1829 (cp->tld)(sp); 1830 /* fall through */ 1831 case STATE_REQ_SENT: 1832 case STATE_ACK_RCVD: 1833 case STATE_ACK_SENT: 1834 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1835 sppp_cp_send(sp, cp->proto, TERM_REQ, 1836 ++sp->pp_seq[cp->protoidx], 0, 0); 1837 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1838 break; 1839 } 1840 } 1841 1842 static void 1843 sppp_to_event(const struct cp *cp, struct sppp *sp) 1844 { 1845 STDDCL; 1846 int s; 1847 1848 s = splnet(); 1849 if (debug) 1850 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 1851 ifp->if_xname, cp->name, 1852 sppp_state_name(sp->state[cp->protoidx]), 1853 sp->rst_counter[cp->protoidx]); 1854 1855 if (--sp->rst_counter[cp->protoidx] < 0) 1856 /* TO- event */ 1857 switch (sp->state[cp->protoidx]) { 1858 case STATE_CLOSING: 1859 (cp->tlf)(sp); 1860 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1861 sppp_lcp_check_and_close(sp); 1862 break; 1863 case STATE_STOPPING: 1864 (cp->tlf)(sp); 1865 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1866 sppp_lcp_check_and_close(sp); 1867 break; 1868 case STATE_REQ_SENT: 1869 case STATE_ACK_RCVD: 1870 case STATE_ACK_SENT: 1871 (cp->tlf)(sp); 1872 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1873 sppp_lcp_check_and_close(sp); 1874 break; 1875 } 1876 else 1877 /* TO+ event */ 1878 switch (sp->state[cp->protoidx]) { 1879 case STATE_CLOSING: 1880 case STATE_STOPPING: 1881 sppp_cp_send(sp, cp->proto, TERM_REQ, 1882 ++sp->pp_seq[cp->protoidx], 0, 0); 1883 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1884 cp->TO, sp); 1885 break; 1886 case STATE_REQ_SENT: 1887 case STATE_ACK_RCVD: 1888 (cp->scr)(sp); 1889 /* sppp_cp_change_state() will restart the timer */ 1890 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1891 break; 1892 case STATE_ACK_SENT: 1893 (cp->scr)(sp); 1894 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1895 cp->TO, sp); 1896 break; 1897 } 1898 1899 splx(s); 1900 } 1901 1902 /* 1903 * Change the state of a control protocol in the state automaton. 1904 * Takes care of starting/stopping the restart timer. 1905 */ 1906 void 1907 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1908 { 1909 sp->state[cp->protoidx] = newstate; 1910 callout_stop(&sp->ch[cp->protoidx]); 1911 switch (newstate) { 1912 case STATE_INITIAL: 1913 case STATE_STARTING: 1914 case STATE_CLOSED: 1915 case STATE_STOPPED: 1916 case STATE_OPENED: 1917 break; 1918 case STATE_CLOSING: 1919 case STATE_STOPPING: 1920 case STATE_REQ_SENT: 1921 case STATE_ACK_RCVD: 1922 case STATE_ACK_SENT: 1923 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1924 cp->TO, sp); 1925 break; 1926 } 1927 } 1928 1929 /* 1930 *--------------------------------------------------------------------------* 1931 * * 1932 * The LCP implementation. * 1933 * * 1934 *--------------------------------------------------------------------------* 1935 */ 1936 static void 1937 sppp_lcp_init(struct sppp *sp) 1938 { 1939 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 1940 sp->lcp.magic = 0; 1941 sp->state[IDX_LCP] = STATE_INITIAL; 1942 sp->fail_counter[IDX_LCP] = 0; 1943 sp->pp_seq[IDX_LCP] = 0; 1944 sp->pp_rseq[IDX_LCP] = 0; 1945 sp->lcp.protos = 0; 1946 1947 /* 1948 * Initialize counters and timeout values. Note that we don't 1949 * use the 3 seconds suggested in RFC 1661 since we are likely 1950 * running on a fast link. XXX We should probably implement 1951 * the exponential backoff option. Note that these values are 1952 * relevant for all control protocols, not just LCP only. 1953 */ 1954 sp->lcp.timeout = 1 * hz; 1955 sp->lcp.max_terminate = 2; 1956 sp->lcp.max_configure = 10; 1957 sp->lcp.max_failure = 10; 1958 callout_init(&sp->ch[IDX_LCP], 0); 1959 } 1960 1961 static void 1962 sppp_lcp_up(struct sppp *sp) 1963 { 1964 STDDCL; 1965 1966 /* Initialize activity timestamp: opening a connection is an activity */ 1967 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 1968 1969 /* 1970 * If this interface is passive or dial-on-demand, and we are 1971 * still in Initial state, it means we've got an incoming 1972 * call. Activate the interface. 1973 */ 1974 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 1975 if (debug) 1976 log(LOG_DEBUG, 1977 "%s: Up event", ifp->if_xname); 1978 ifp->if_flags |= IFF_RUNNING; 1979 if (sp->state[IDX_LCP] == STATE_INITIAL) { 1980 if (debug) 1981 addlog("(incoming call)\n"); 1982 sp->pp_flags |= PP_CALLIN; 1983 lcp.Open(sp); 1984 } else if (debug) 1985 addlog("\n"); 1986 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 1987 (sp->state[IDX_LCP] == STATE_INITIAL)) { 1988 ifp->if_flags |= IFF_RUNNING; 1989 lcp.Open(sp); 1990 } 1991 1992 sppp_up_event(&lcp, sp); 1993 } 1994 1995 static void 1996 sppp_lcp_down(struct sppp *sp) 1997 { 1998 STDDCL; 1999 2000 sppp_down_event(&lcp, sp); 2001 2002 /* 2003 * If this is neither a dial-on-demand nor a passive 2004 * interface, simulate an ``ifconfig down'' action, so the 2005 * administrator can force a redial by another ``ifconfig 2006 * up''. XXX For leased line operation, should we immediately 2007 * try to reopen the connection here? 2008 */ 2009 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2010 if (debug) 2011 log(LOG_INFO, 2012 "%s: Down event (carrier loss), taking interface down.\n", 2013 ifp->if_xname); 2014 if_down(ifp); 2015 } else { 2016 if (debug) 2017 log(LOG_DEBUG, 2018 "%s: Down event (carrier loss)\n", 2019 ifp->if_xname); 2020 } 2021 sp->pp_flags &= ~PP_CALLIN; 2022 if (sp->state[IDX_LCP] != STATE_INITIAL) 2023 lcp.Close(sp); 2024 ifp->if_flags &= ~IFF_RUNNING; 2025 } 2026 2027 static void 2028 sppp_lcp_open(struct sppp *sp) 2029 { 2030 if (sp->pp_if.if_mtu < PP_MTU) { 2031 sp->lcp.mru = sp->pp_if.if_mtu; 2032 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2033 } else 2034 sp->lcp.mru = PP_MTU; 2035 sp->lcp.their_mru = PP_MTU; 2036 2037 /* 2038 * If we are authenticator, negotiate LCP_AUTH 2039 */ 2040 if (sp->hisauth.proto != 0) 2041 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2042 else 2043 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2044 sp->pp_flags &= ~PP_NEEDAUTH; 2045 sppp_open_event(&lcp, sp); 2046 } 2047 2048 static void 2049 sppp_lcp_close(struct sppp *sp) 2050 { 2051 sppp_close_event(&lcp, sp); 2052 } 2053 2054 static void 2055 sppp_lcp_TO(void *cookie) 2056 { 2057 sppp_to_event(&lcp, (struct sppp *)cookie); 2058 } 2059 2060 /* 2061 * Analyze a configure request. Return true if it was agreeable, and 2062 * caused action sca, false if it has been rejected or nak'ed, and 2063 * caused action scn. (The return value is used to make the state 2064 * transition decision in the state automaton.) 2065 */ 2066 static int 2067 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2068 { 2069 STDDCL; 2070 u_char *buf, *r, *p; 2071 int origlen, rlen; 2072 uint32_t nmagic; 2073 u_short authproto; 2074 2075 len -= 4; 2076 origlen = len; 2077 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2078 if (! buf) 2079 return (0); 2080 2081 if (debug) 2082 log(LOG_DEBUG, "%s: lcp parse opts:", 2083 ifp->if_xname); 2084 2085 /* pass 1: check for things that need to be rejected */ 2086 p = (void *)(h + 1); 2087 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2088 /* Sanity check option length */ 2089 if (p[1] > len) { 2090 /* 2091 * Malicious option - drop immediately. 2092 * XXX Maybe we should just RXJ it? 2093 */ 2094 addlog("%s: received malicious LCP option 0x%02x, " 2095 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2096 p[0], p[1], len); 2097 goto drop; 2098 } 2099 if (debug) 2100 addlog(" %s", sppp_lcp_opt_name(*p)); 2101 switch (*p) { 2102 case LCP_OPT_MAGIC: 2103 /* Magic number. */ 2104 /* fall through, both are same length */ 2105 case LCP_OPT_ASYNC_MAP: 2106 /* Async control character map. */ 2107 if (len >= 6 || p[1] == 6) 2108 continue; 2109 if (debug) 2110 addlog(" [invalid]"); 2111 break; 2112 case LCP_OPT_MRU: 2113 /* Maximum receive unit. */ 2114 if (len >= 4 && p[1] == 4) 2115 continue; 2116 if (debug) 2117 addlog(" [invalid]"); 2118 break; 2119 case LCP_OPT_AUTH_PROTO: 2120 if (len < 4) { 2121 if (debug) 2122 addlog(" [invalid]"); 2123 break; 2124 } 2125 authproto = (p[2] << 8) + p[3]; 2126 if (authproto == PPP_CHAP && p[1] != 5) { 2127 if (debug) 2128 addlog(" [invalid chap len]"); 2129 break; 2130 } 2131 if (sp->myauth.proto == 0) { 2132 /* we are not configured to do auth */ 2133 if (debug) 2134 addlog(" [not configured]"); 2135 break; 2136 } 2137 /* 2138 * Remote want us to authenticate, remember this, 2139 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2140 * up. 2141 */ 2142 sp->pp_flags |= PP_NEEDAUTH; 2143 continue; 2144 default: 2145 /* Others not supported. */ 2146 if (debug) 2147 addlog(" [rej]"); 2148 break; 2149 } 2150 /* Add the option to rejected list. */ 2151 bcopy (p, r, p[1]); 2152 r += p[1]; 2153 rlen += p[1]; 2154 } 2155 if (rlen) { 2156 if (debug) 2157 addlog(" send conf-rej\n"); 2158 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2159 goto end; 2160 } else if (debug) 2161 addlog("\n"); 2162 2163 /* 2164 * pass 2: check for option values that are unacceptable and 2165 * thus require to be nak'ed. 2166 */ 2167 if (debug) 2168 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2169 ifp->if_xname); 2170 2171 p = (void *)(h + 1); 2172 len = origlen; 2173 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2174 if (debug) 2175 addlog(" %s", sppp_lcp_opt_name(*p)); 2176 switch (*p) { 2177 case LCP_OPT_MAGIC: 2178 /* Magic number -- extract. */ 2179 nmagic = (uint32_t)p[2] << 24 | 2180 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2181 if (nmagic != sp->lcp.magic) { 2182 if (debug) 2183 addlog(" 0x%x", nmagic); 2184 continue; 2185 } 2186 /* 2187 * Local and remote magics equal -- loopback? 2188 */ 2189 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2190 printf ("%s: loopback\n", 2191 ifp->if_xname); 2192 sp->pp_loopcnt = 0; 2193 if (ifp->if_flags & IFF_UP) { 2194 if_down(ifp); 2195 IF_PURGE(&sp->pp_cpq); 2196 /* XXX ? */ 2197 lcp.Down(sp); 2198 lcp.Up(sp); 2199 } 2200 } else if (debug) 2201 addlog(" [glitch]"); 2202 ++sp->pp_loopcnt; 2203 /* 2204 * We negate our magic here, and NAK it. If 2205 * we see it later in an NAK packet, we 2206 * suggest a new one. 2207 */ 2208 nmagic = ~sp->lcp.magic; 2209 /* Gonna NAK it. */ 2210 p[2] = nmagic >> 24; 2211 p[3] = nmagic >> 16; 2212 p[4] = nmagic >> 8; 2213 p[5] = nmagic; 2214 break; 2215 2216 case LCP_OPT_ASYNC_MAP: 2217 /* 2218 * Async control character map -- just ignore it. 2219 * 2220 * Quote from RFC 1662, chapter 6: 2221 * To enable this functionality, synchronous PPP 2222 * implementations MUST always respond to the 2223 * Async-Control-Character-Map Configuration 2224 * Option with the LCP Configure-Ack. However, 2225 * acceptance of the Configuration Option does 2226 * not imply that the synchronous implementation 2227 * will do any ACCM mapping. Instead, all such 2228 * octet mapping will be performed by the 2229 * asynchronous-to-synchronous converter. 2230 */ 2231 continue; 2232 2233 case LCP_OPT_MRU: 2234 /* 2235 * Maximum receive unit. Always agreeable, 2236 * but ignored by now. 2237 */ 2238 sp->lcp.their_mru = p[2] * 256 + p[3]; 2239 if (debug) 2240 addlog(" %ld", sp->lcp.their_mru); 2241 continue; 2242 2243 case LCP_OPT_AUTH_PROTO: 2244 authproto = (p[2] << 8) + p[3]; 2245 if (sp->myauth.proto != authproto) { 2246 /* not agreed, nak */ 2247 if (debug) 2248 addlog(" [mine %s != his %s]", 2249 sppp_proto_name(sp->myauth.proto), 2250 sppp_proto_name(authproto)); 2251 p[2] = sp->myauth.proto >> 8; 2252 p[3] = sp->myauth.proto; 2253 break; 2254 } 2255 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2256 if (debug) 2257 addlog(" [chap not MD5]"); 2258 p[4] = CHAP_MD5; 2259 break; 2260 } 2261 continue; 2262 } 2263 /* Add the option to nak'ed list. */ 2264 bcopy (p, r, p[1]); 2265 r += p[1]; 2266 rlen += p[1]; 2267 } 2268 if (rlen) { 2269 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2270 if (debug) 2271 addlog(" max_failure (%d) exceeded, " 2272 "send conf-rej\n", 2273 sp->lcp.max_failure); 2274 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2275 } else { 2276 if (debug) 2277 addlog(" send conf-nak\n"); 2278 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2279 } 2280 goto end; 2281 } else { 2282 if (debug) 2283 addlog(" send conf-ack\n"); 2284 sp->fail_counter[IDX_LCP] = 0; 2285 sp->pp_loopcnt = 0; 2286 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2287 } 2288 2289 end: 2290 free(buf, M_TEMP); 2291 return (rlen == 0); 2292 2293 drop: 2294 free(buf, M_TEMP); 2295 return -1; 2296 } 2297 2298 /* 2299 * Analyze the LCP Configure-Reject option list, and adjust our 2300 * negotiation. 2301 */ 2302 static void 2303 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2304 { 2305 STDDCL; 2306 u_char *buf, *p; 2307 2308 len -= 4; 2309 buf = malloc (len, M_TEMP, M_NOWAIT); 2310 if (!buf) 2311 return; 2312 2313 if (debug) 2314 log(LOG_DEBUG, "%s: lcp rej opts:", 2315 ifp->if_xname); 2316 2317 p = (void *)(h + 1); 2318 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2319 /* Sanity check option length */ 2320 if (p[1] > len) { 2321 /* 2322 * Malicious option - drop immediately. 2323 * XXX Maybe we should just RXJ it? 2324 */ 2325 addlog("%s: received malicious LCP option, " 2326 "dropping.\n", ifp->if_xname); 2327 goto drop; 2328 } 2329 if (debug) 2330 addlog(" %s", sppp_lcp_opt_name(*p)); 2331 switch (*p) { 2332 case LCP_OPT_MAGIC: 2333 /* Magic number -- can't use it, use 0 */ 2334 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2335 sp->lcp.magic = 0; 2336 break; 2337 case LCP_OPT_MRU: 2338 /* 2339 * We try to negotiate a lower MRU if the underlying 2340 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2341 * peer rejects this lower rate, fallback to the 2342 * default. 2343 */ 2344 if (debug) { 2345 addlog("%s: warning: peer rejected our MRU of " 2346 "%ld bytes. Defaulting to %d bytes\n", 2347 ifp->if_xname, sp->lcp.mru, PP_MTU); 2348 } 2349 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2350 sp->lcp.mru = PP_MTU; 2351 break; 2352 case LCP_OPT_AUTH_PROTO: 2353 /* 2354 * Peer doesn't want to authenticate himself, 2355 * deny unless this is a dialout call, and 2356 * SPPP_AUTHFLAG_NOCALLOUT is set. 2357 */ 2358 if ((sp->pp_flags & PP_CALLIN) == 0 && 2359 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2360 if (debug) 2361 addlog(" [don't insist on auth " 2362 "for callout]"); 2363 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2364 break; 2365 } 2366 if (debug) 2367 addlog("[access denied]\n"); 2368 lcp.Close(sp); 2369 break; 2370 } 2371 } 2372 if (debug) 2373 addlog("\n"); 2374 drop: 2375 free(buf, M_TEMP); 2376 return; 2377 } 2378 2379 /* 2380 * Analyze the LCP Configure-NAK option list, and adjust our 2381 * negotiation. 2382 */ 2383 static void 2384 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2385 { 2386 STDDCL; 2387 u_char *buf, *p; 2388 uint32_t magic; 2389 2390 len -= 4; 2391 buf = malloc (len, M_TEMP, M_NOWAIT); 2392 if (!buf) 2393 return; 2394 2395 if (debug) 2396 log(LOG_DEBUG, "%s: lcp nak opts:", 2397 ifp->if_xname); 2398 2399 p = (void *)(h + 1); 2400 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2401 /* Sanity check option length */ 2402 if (p[1] > len) { 2403 /* 2404 * Malicious option - drop immediately. 2405 * XXX Maybe we should just RXJ it? 2406 */ 2407 addlog("%s: received malicious LCP option, " 2408 "dropping.\n", ifp->if_xname); 2409 goto drop; 2410 } 2411 if (debug) 2412 addlog(" %s", sppp_lcp_opt_name(*p)); 2413 switch (*p) { 2414 case LCP_OPT_MAGIC: 2415 /* Magic number -- renegotiate */ 2416 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2417 len >= 6 && p[1] == 6) { 2418 magic = (uint32_t)p[2] << 24 | 2419 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2420 /* 2421 * If the remote magic is our negated one, 2422 * this looks like a loopback problem. 2423 * Suggest a new magic to make sure. 2424 */ 2425 if (magic == ~sp->lcp.magic) { 2426 if (debug) 2427 addlog(" magic glitch"); 2428 sp->lcp.magic = cprng_fast32(); 2429 } else { 2430 sp->lcp.magic = magic; 2431 if (debug) 2432 addlog(" %d", magic); 2433 } 2434 } 2435 break; 2436 case LCP_OPT_MRU: 2437 /* 2438 * Peer wants to advise us to negotiate an MRU. 2439 * Agree on it if it's reasonable, or use 2440 * default otherwise. 2441 */ 2442 if (len >= 4 && p[1] == 4) { 2443 u_int mru = p[2] * 256 + p[3]; 2444 if (debug) 2445 addlog(" %d", mru); 2446 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 2447 mru = sp->pp_if.if_mtu; 2448 sp->lcp.mru = mru; 2449 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2450 } 2451 break; 2452 case LCP_OPT_AUTH_PROTO: 2453 /* 2454 * Peer doesn't like our authentication method, 2455 * deny. 2456 */ 2457 if (debug) 2458 addlog("[access denied]\n"); 2459 lcp.Close(sp); 2460 break; 2461 } 2462 } 2463 if (debug) 2464 addlog("\n"); 2465 drop: 2466 free(buf, M_TEMP); 2467 return; 2468 } 2469 2470 static void 2471 sppp_lcp_tlu(struct sppp *sp) 2472 { 2473 STDDCL; 2474 int i; 2475 uint32_t mask; 2476 2477 /* XXX ? */ 2478 if (! (ifp->if_flags & IFF_UP) && 2479 (ifp->if_flags & IFF_RUNNING)) { 2480 /* Coming out of loopback mode. */ 2481 if_up(ifp); 2482 } 2483 2484 for (i = 0; i < IDX_COUNT; i++) 2485 if ((cps[i])->flags & CP_QUAL) 2486 (cps[i])->Open(sp); 2487 2488 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2489 (sp->pp_flags & PP_NEEDAUTH) != 0) 2490 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2491 else 2492 sp->pp_phase = SPPP_PHASE_NETWORK; 2493 2494 if (debug) 2495 { 2496 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2497 sppp_phase_name(sp->pp_phase)); 2498 } 2499 2500 /* 2501 * Open all authentication protocols. This is even required 2502 * if we already proceeded to network phase, since it might be 2503 * that remote wants us to authenticate, so we might have to 2504 * send a PAP request. Undesired authentication protocols 2505 * don't do anything when they get an Open event. 2506 */ 2507 for (i = 0; i < IDX_COUNT; i++) 2508 if ((cps[i])->flags & CP_AUTH) 2509 (cps[i])->Open(sp); 2510 2511 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2512 /* Notify all NCPs. */ 2513 for (i = 0; i < IDX_COUNT; i++) 2514 if ((cps[i])->flags & CP_NCP) 2515 (cps[i])->Open(sp); 2516 } 2517 2518 /* Send Up events to all started protos. */ 2519 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2520 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2521 (cps[i])->Up(sp); 2522 2523 /* notify low-level driver of state change */ 2524 if (sp->pp_chg) 2525 sp->pp_chg(sp, (int)sp->pp_phase); 2526 2527 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2528 /* if no NCP is starting, close down */ 2529 sppp_lcp_check_and_close(sp); 2530 } 2531 2532 static void 2533 sppp_lcp_tld(struct sppp *sp) 2534 { 2535 STDDCL; 2536 int i; 2537 uint32_t mask; 2538 2539 sp->pp_phase = SPPP_PHASE_TERMINATE; 2540 2541 if (debug) 2542 { 2543 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2544 sppp_phase_name(sp->pp_phase)); 2545 } 2546 2547 /* 2548 * Take upper layers down. We send the Down event first and 2549 * the Close second to prevent the upper layers from sending 2550 * ``a flurry of terminate-request packets'', as the RFC 2551 * describes it. 2552 */ 2553 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2554 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2555 (cps[i])->Down(sp); 2556 (cps[i])->Close(sp); 2557 } 2558 } 2559 2560 static void 2561 sppp_lcp_tls(struct sppp *sp) 2562 { 2563 STDDCL; 2564 2565 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2566 printf("%s: authentication failed %d times, not retrying again\n", 2567 sp->pp_if.if_xname, sp->pp_auth_failures); 2568 if_down(&sp->pp_if); 2569 return; 2570 } 2571 2572 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2573 2574 if (debug) 2575 { 2576 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2577 sppp_phase_name(sp->pp_phase)); 2578 } 2579 2580 /* Notify lower layer if desired. */ 2581 if (sp->pp_tls) 2582 (sp->pp_tls)(sp); 2583 } 2584 2585 static void 2586 sppp_lcp_tlf(struct sppp *sp) 2587 { 2588 STDDCL; 2589 2590 sp->pp_phase = SPPP_PHASE_DEAD; 2591 2592 if (debug) 2593 { 2594 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2595 sppp_phase_name(sp->pp_phase)); 2596 } 2597 2598 /* Notify lower layer if desired. */ 2599 if (sp->pp_tlf) 2600 (sp->pp_tlf)(sp); 2601 } 2602 2603 static void 2604 sppp_lcp_scr(struct sppp *sp) 2605 { 2606 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2607 int i = 0; 2608 u_short authproto; 2609 2610 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2611 if (! sp->lcp.magic) 2612 sp->lcp.magic = cprng_fast32(); 2613 opt[i++] = LCP_OPT_MAGIC; 2614 opt[i++] = 6; 2615 opt[i++] = sp->lcp.magic >> 24; 2616 opt[i++] = sp->lcp.magic >> 16; 2617 opt[i++] = sp->lcp.magic >> 8; 2618 opt[i++] = sp->lcp.magic; 2619 } 2620 2621 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2622 opt[i++] = LCP_OPT_MRU; 2623 opt[i++] = 4; 2624 opt[i++] = sp->lcp.mru >> 8; 2625 opt[i++] = sp->lcp.mru; 2626 } 2627 2628 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2629 authproto = sp->hisauth.proto; 2630 opt[i++] = LCP_OPT_AUTH_PROTO; 2631 opt[i++] = authproto == PPP_CHAP? 5: 4; 2632 opt[i++] = authproto >> 8; 2633 opt[i++] = authproto; 2634 if (authproto == PPP_CHAP) 2635 opt[i++] = CHAP_MD5; 2636 } 2637 2638 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2639 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2640 } 2641 2642 /* 2643 * Check the open NCPs, return true if at least one NCP is open. 2644 */ 2645 static int 2646 sppp_ncp_check(struct sppp *sp) 2647 { 2648 int i, mask; 2649 2650 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2651 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2652 return 1; 2653 return 0; 2654 } 2655 2656 /* 2657 * Re-check the open NCPs and see if we should terminate the link. 2658 * Called by the NCPs during their tlf action handling. 2659 */ 2660 static void 2661 sppp_lcp_check_and_close(struct sppp *sp) 2662 { 2663 2664 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2665 /* don't bother, we are already going down */ 2666 return; 2667 2668 if (sppp_ncp_check(sp)) 2669 return; 2670 2671 lcp.Close(sp); 2672 } 2673 2674 2675 /* 2676 *--------------------------------------------------------------------------* 2677 * * 2678 * The IPCP implementation. * 2679 * * 2680 *--------------------------------------------------------------------------* 2681 */ 2682 2683 static void 2684 sppp_ipcp_init(struct sppp *sp) 2685 { 2686 sp->ipcp.opts = 0; 2687 sp->ipcp.flags = 0; 2688 sp->state[IDX_IPCP] = STATE_INITIAL; 2689 sp->fail_counter[IDX_IPCP] = 0; 2690 sp->pp_seq[IDX_IPCP] = 0; 2691 sp->pp_rseq[IDX_IPCP] = 0; 2692 callout_init(&sp->ch[IDX_IPCP], 0); 2693 } 2694 2695 static void 2696 sppp_ipcp_up(struct sppp *sp) 2697 { 2698 sppp_up_event(&ipcp, sp); 2699 } 2700 2701 static void 2702 sppp_ipcp_down(struct sppp *sp) 2703 { 2704 sppp_down_event(&ipcp, sp); 2705 } 2706 2707 static void 2708 sppp_ipcp_open(struct sppp *sp) 2709 { 2710 STDDCL; 2711 uint32_t myaddr, hisaddr; 2712 2713 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2714 sp->ipcp.req_myaddr = 0; 2715 sp->ipcp.req_hisaddr = 0; 2716 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2717 2718 #ifdef INET 2719 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2720 #else 2721 myaddr = hisaddr = 0; 2722 #endif 2723 /* 2724 * If we don't have his address, this probably means our 2725 * interface doesn't want to talk IP at all. (This could 2726 * be the case if somebody wants to speak only IPX, for 2727 * example.) Don't open IPCP in this case. 2728 */ 2729 if (hisaddr == 0) { 2730 /* XXX this message should go away */ 2731 if (debug) 2732 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 2733 ifp->if_xname); 2734 return; 2735 } 2736 2737 if (myaddr == 0) { 2738 /* 2739 * I don't have an assigned address, so i need to 2740 * negotiate my address. 2741 */ 2742 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2743 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2744 } 2745 if (hisaddr == 1) { 2746 /* 2747 * XXX - remove this hack! 2748 * remote has no valid address, we need to get one assigned. 2749 */ 2750 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2751 } 2752 sppp_open_event(&ipcp, sp); 2753 } 2754 2755 static void 2756 sppp_ipcp_close(struct sppp *sp) 2757 { 2758 STDDCL; 2759 2760 sppp_close_event(&ipcp, sp); 2761 #ifdef INET 2762 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2763 /* 2764 * Some address was dynamic, clear it again. 2765 */ 2766 sppp_clear_ip_addrs(sp); 2767 #endif 2768 2769 if (sp->pp_saved_mtu > 0) { 2770 ifp->if_mtu = sp->pp_saved_mtu; 2771 sp->pp_saved_mtu = 0; 2772 if (debug) 2773 log(LOG_DEBUG, 2774 "%s: resetting MTU to %" PRIu64 " bytes\n", 2775 ifp->if_xname, ifp->if_mtu); 2776 } 2777 } 2778 2779 static void 2780 sppp_ipcp_TO(void *cookie) 2781 { 2782 sppp_to_event(&ipcp, (struct sppp *)cookie); 2783 } 2784 2785 /* 2786 * Analyze a configure request. Return true if it was agreeable, and 2787 * caused action sca, false if it has been rejected or nak'ed, and 2788 * caused action scn. (The return value is used to make the state 2789 * transition decision in the state automaton.) 2790 */ 2791 static int 2792 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2793 { 2794 u_char *buf, *r, *p; 2795 struct ifnet *ifp = &sp->pp_if; 2796 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2797 uint32_t hisaddr, desiredaddr; 2798 2799 len -= 4; 2800 origlen = len; 2801 /* 2802 * Make sure to allocate a buf that can at least hold a 2803 * conf-nak with an `address' option. We might need it below. 2804 */ 2805 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2806 if (! buf) 2807 return (0); 2808 2809 /* pass 1: see if we can recognize them */ 2810 if (debug) 2811 log(LOG_DEBUG, "%s: ipcp parse opts:", 2812 ifp->if_xname); 2813 p = (void *)(h + 1); 2814 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2815 /* Sanity check option length */ 2816 if (p[1] > len) { 2817 /* XXX should we just RXJ? */ 2818 addlog("%s: malicious IPCP option received, dropping\n", 2819 ifp->if_xname); 2820 goto drop; 2821 } 2822 if (debug) 2823 addlog(" %s", sppp_ipcp_opt_name(*p)); 2824 switch (*p) { 2825 #ifdef notyet 2826 case IPCP_OPT_COMPRESSION: 2827 if (len >= 6 && p[1] >= 6) { 2828 /* correctly formed compress option */ 2829 continue; 2830 } 2831 if (debug) 2832 addlog(" [invalid]"); 2833 break; 2834 #endif 2835 case IPCP_OPT_ADDRESS: 2836 if (len >= 6 && p[1] == 6) { 2837 /* correctly formed address option */ 2838 continue; 2839 } 2840 if (debug) 2841 addlog(" [invalid]"); 2842 break; 2843 default: 2844 /* Others not supported. */ 2845 if (debug) 2846 addlog(" [rej]"); 2847 break; 2848 } 2849 /* Add the option to rejected list. */ 2850 bcopy (p, r, p[1]); 2851 r += p[1]; 2852 rlen += p[1]; 2853 } 2854 if (rlen) { 2855 if (debug) 2856 addlog(" send conf-rej\n"); 2857 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2858 goto end; 2859 } else if (debug) 2860 addlog("\n"); 2861 2862 /* pass 2: parse option values */ 2863 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2864 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2865 else 2866 #ifdef INET 2867 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2868 #else 2869 hisaddr = 0; 2870 #endif 2871 if (debug) 2872 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 2873 ifp->if_xname); 2874 p = (void *)(h + 1); 2875 len = origlen; 2876 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2877 if (debug) 2878 addlog(" %s", sppp_ipcp_opt_name(*p)); 2879 switch (*p) { 2880 #ifdef notyet 2881 case IPCP_OPT_COMPRESSION: 2882 continue; 2883 #endif 2884 case IPCP_OPT_ADDRESS: 2885 desiredaddr = p[2] << 24 | p[3] << 16 | 2886 p[4] << 8 | p[5]; 2887 if (desiredaddr == hisaddr || 2888 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2889 /* 2890 * Peer's address is same as our value, 2891 * this is agreeable. Gonna conf-ack 2892 * it. 2893 */ 2894 if (debug) 2895 addlog(" %s [ack]", 2896 sppp_dotted_quad(hisaddr)); 2897 /* record that we've seen it already */ 2898 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2899 sp->ipcp.req_hisaddr = desiredaddr; 2900 hisaddr = desiredaddr; 2901 continue; 2902 } 2903 /* 2904 * The address wasn't agreeable. This is either 2905 * he sent us 0.0.0.0, asking to assign him an 2906 * address, or he send us another address not 2907 * matching our value. Either case, we gonna 2908 * conf-nak it with our value. 2909 */ 2910 if (debug) { 2911 if (desiredaddr == 0) 2912 addlog(" [addr requested]"); 2913 else 2914 addlog(" %s [not agreed]", 2915 sppp_dotted_quad(desiredaddr)); 2916 } 2917 2918 p[2] = hisaddr >> 24; 2919 p[3] = hisaddr >> 16; 2920 p[4] = hisaddr >> 8; 2921 p[5] = hisaddr; 2922 break; 2923 } 2924 /* Add the option to nak'ed list. */ 2925 bcopy (p, r, p[1]); 2926 r += p[1]; 2927 rlen += p[1]; 2928 } 2929 2930 /* 2931 * If we are about to conf-ack the request, but haven't seen 2932 * his address so far, gonna conf-nak it instead, with the 2933 * `address' option present and our idea of his address being 2934 * filled in there, to request negotiation of both addresses. 2935 * 2936 * XXX This can result in an endless req - nak loop if peer 2937 * doesn't want to send us his address. Q: What should we do 2938 * about it? XXX A: implement the max-failure counter. 2939 */ 2940 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2941 buf[0] = IPCP_OPT_ADDRESS; 2942 buf[1] = 6; 2943 buf[2] = hisaddr >> 24; 2944 buf[3] = hisaddr >> 16; 2945 buf[4] = hisaddr >> 8; 2946 buf[5] = hisaddr; 2947 rlen = 6; 2948 if (debug) 2949 addlog(" still need hisaddr"); 2950 } 2951 2952 if (rlen) { 2953 if (debug) 2954 addlog(" send conf-nak\n"); 2955 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2956 } else { 2957 if (debug) 2958 addlog(" send conf-ack\n"); 2959 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 2960 } 2961 2962 end: 2963 free(buf, M_TEMP); 2964 return (rlen == 0); 2965 2966 drop: 2967 free(buf, M_TEMP); 2968 return -1; 2969 } 2970 2971 /* 2972 * Analyze the IPCP Configure-Reject option list, and adjust our 2973 * negotiation. 2974 */ 2975 static void 2976 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2977 { 2978 u_char *buf, *p; 2979 struct ifnet *ifp = &sp->pp_if; 2980 int debug = ifp->if_flags & IFF_DEBUG; 2981 2982 len -= 4; 2983 buf = malloc (len, M_TEMP, M_NOWAIT); 2984 if (!buf) 2985 return; 2986 2987 if (debug) 2988 log(LOG_DEBUG, "%s: ipcp rej opts:", 2989 ifp->if_xname); 2990 2991 p = (void *)(h + 1); 2992 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2993 /* Sanity check option length */ 2994 if (p[1] > len) { 2995 /* XXX should we just RXJ? */ 2996 addlog("%s: malicious IPCP option received, dropping\n", 2997 ifp->if_xname); 2998 goto drop; 2999 } 3000 if (debug) 3001 addlog(" %s", sppp_ipcp_opt_name(*p)); 3002 switch (*p) { 3003 case IPCP_OPT_ADDRESS: 3004 /* 3005 * Peer doesn't grok address option. This is 3006 * bad. XXX Should we better give up here? 3007 */ 3008 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3009 break; 3010 #ifdef notyet 3011 case IPCP_OPT_COMPRESS: 3012 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3013 break; 3014 #endif 3015 } 3016 } 3017 if (debug) 3018 addlog("\n"); 3019 drop: 3020 free(buf, M_TEMP); 3021 return; 3022 } 3023 3024 /* 3025 * Analyze the IPCP Configure-NAK option list, and adjust our 3026 * negotiation. 3027 */ 3028 static void 3029 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3030 { 3031 u_char *p; 3032 struct ifnet *ifp = &sp->pp_if; 3033 int debug = ifp->if_flags & IFF_DEBUG; 3034 uint32_t wantaddr; 3035 3036 len -= 4; 3037 3038 if (debug) 3039 log(LOG_DEBUG, "%s: ipcp nak opts:", 3040 ifp->if_xname); 3041 3042 p = (void *)(h + 1); 3043 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3044 /* Sanity check option length */ 3045 if (p[1] > len) { 3046 /* XXX should we just RXJ? */ 3047 addlog("%s: malicious IPCP option received, dropping\n", 3048 ifp->if_xname); 3049 return; 3050 } 3051 if (debug) 3052 addlog(" %s", sppp_ipcp_opt_name(*p)); 3053 switch (*p) { 3054 case IPCP_OPT_ADDRESS: 3055 /* 3056 * Peer doesn't like our local IP address. See 3057 * if we can do something for him. We'll drop 3058 * him our address then. 3059 */ 3060 if (len >= 6 && p[1] == 6) { 3061 wantaddr = p[2] << 24 | p[3] << 16 | 3062 p[4] << 8 | p[5]; 3063 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3064 if (debug) 3065 addlog(" [wantaddr %s]", 3066 sppp_dotted_quad(wantaddr)); 3067 /* 3068 * When doing dynamic address assignment, 3069 * we accept his offer. Otherwise, we 3070 * ignore it and thus continue to negotiate 3071 * our already existing value. 3072 */ 3073 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3074 if (debug) 3075 addlog(" [agree]"); 3076 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3077 sp->ipcp.req_myaddr = wantaddr; 3078 } 3079 } 3080 break; 3081 3082 case IPCP_OPT_PRIMDNS: 3083 if (len >= 6 && p[1] == 6) { 3084 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3085 p[4] << 8 | p[5]; 3086 } 3087 break; 3088 3089 case IPCP_OPT_SECDNS: 3090 if (len >= 6 && p[1] == 6) { 3091 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3092 p[4] << 8 | p[5]; 3093 } 3094 break; 3095 #ifdef notyet 3096 case IPCP_OPT_COMPRESS: 3097 /* 3098 * Peer wants different compression parameters. 3099 */ 3100 break; 3101 #endif 3102 } 3103 } 3104 if (debug) 3105 addlog("\n"); 3106 } 3107 3108 static void 3109 sppp_ipcp_tlu(struct sppp *sp) 3110 { 3111 #ifdef INET 3112 /* we are up. Set addresses and notify anyone interested */ 3113 STDDCL; 3114 uint32_t myaddr, hisaddr; 3115 3116 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3117 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3118 myaddr = sp->ipcp.req_myaddr; 3119 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3120 hisaddr = sp->ipcp.req_hisaddr; 3121 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3122 3123 if (ifp->if_mtu > sp->lcp.their_mru) { 3124 sp->pp_saved_mtu = ifp->if_mtu; 3125 ifp->if_mtu = sp->lcp.their_mru; 3126 if (debug) 3127 log(LOG_DEBUG, 3128 "%s: setting MTU to %" PRIu64 " bytes\n", 3129 ifp->if_xname, ifp->if_mtu); 3130 } 3131 3132 if (sp->pp_con) 3133 sp->pp_con(sp); 3134 #endif 3135 } 3136 3137 static void 3138 sppp_ipcp_tld(struct sppp *sp) 3139 { 3140 } 3141 3142 static void 3143 sppp_ipcp_tls(struct sppp *sp) 3144 { 3145 /* indicate to LCP that it must stay alive */ 3146 sp->lcp.protos |= (1 << IDX_IPCP); 3147 } 3148 3149 static void 3150 sppp_ipcp_tlf(struct sppp *sp) 3151 { 3152 /* we no longer need LCP */ 3153 sp->lcp.protos &= ~(1 << IDX_IPCP); 3154 } 3155 3156 static void 3157 sppp_ipcp_scr(struct sppp *sp) 3158 { 3159 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3160 #ifdef INET 3161 uint32_t ouraddr; 3162 #endif 3163 int i = 0; 3164 3165 #ifdef notyet 3166 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3167 opt[i++] = IPCP_OPT_COMPRESSION; 3168 opt[i++] = 6; 3169 opt[i++] = 0; /* VJ header compression */ 3170 opt[i++] = 0x2d; /* VJ header compression */ 3171 opt[i++] = max_slot_id; 3172 opt[i++] = comp_slot_id; 3173 } 3174 #endif 3175 3176 #ifdef INET 3177 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3178 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3179 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3180 else 3181 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3182 opt[i++] = IPCP_OPT_ADDRESS; 3183 opt[i++] = 6; 3184 opt[i++] = ouraddr >> 24; 3185 opt[i++] = ouraddr >> 16; 3186 opt[i++] = ouraddr >> 8; 3187 opt[i++] = ouraddr; 3188 } 3189 #endif 3190 3191 if (sp->query_dns & 1) { 3192 opt[i++] = IPCP_OPT_PRIMDNS; 3193 opt[i++] = 6; 3194 opt[i++] = sp->dns_addrs[0] >> 24; 3195 opt[i++] = sp->dns_addrs[0] >> 16; 3196 opt[i++] = sp->dns_addrs[0] >> 8; 3197 opt[i++] = sp->dns_addrs[0]; 3198 } 3199 if (sp->query_dns & 2) { 3200 opt[i++] = IPCP_OPT_SECDNS; 3201 opt[i++] = 6; 3202 opt[i++] = sp->dns_addrs[1] >> 24; 3203 opt[i++] = sp->dns_addrs[1] >> 16; 3204 opt[i++] = sp->dns_addrs[1] >> 8; 3205 opt[i++] = sp->dns_addrs[1]; 3206 } 3207 3208 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3209 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3210 } 3211 3212 3213 /* 3214 *--------------------------------------------------------------------------* 3215 * * 3216 * The IPv6CP implementation. * 3217 * * 3218 *--------------------------------------------------------------------------* 3219 */ 3220 3221 #ifdef INET6 3222 static void 3223 sppp_ipv6cp_init(struct sppp *sp) 3224 { 3225 sp->ipv6cp.opts = 0; 3226 sp->ipv6cp.flags = 0; 3227 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3228 sp->fail_counter[IDX_IPV6CP] = 0; 3229 sp->pp_seq[IDX_IPV6CP] = 0; 3230 sp->pp_rseq[IDX_IPV6CP] = 0; 3231 callout_init(&sp->ch[IDX_IPV6CP], 0); 3232 } 3233 3234 static void 3235 sppp_ipv6cp_up(struct sppp *sp) 3236 { 3237 sppp_up_event(&ipv6cp, sp); 3238 } 3239 3240 static void 3241 sppp_ipv6cp_down(struct sppp *sp) 3242 { 3243 sppp_down_event(&ipv6cp, sp); 3244 } 3245 3246 static void 3247 sppp_ipv6cp_open(struct sppp *sp) 3248 { 3249 STDDCL; 3250 struct in6_addr myaddr, hisaddr; 3251 3252 #ifdef IPV6CP_MYIFID_DYN 3253 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3254 #else 3255 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3256 #endif 3257 3258 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3259 /* 3260 * If we don't have our address, this probably means our 3261 * interface doesn't want to talk IPv6 at all. (This could 3262 * be the case if somebody wants to speak only IPX, for 3263 * example.) Don't open IPv6CP in this case. 3264 */ 3265 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3266 /* XXX this message should go away */ 3267 if (debug) 3268 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3269 ifp->if_xname); 3270 return; 3271 } 3272 3273 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3274 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3275 sppp_open_event(&ipv6cp, sp); 3276 } 3277 3278 static void 3279 sppp_ipv6cp_close(struct sppp *sp) 3280 { 3281 sppp_close_event(&ipv6cp, sp); 3282 } 3283 3284 static void 3285 sppp_ipv6cp_TO(void *cookie) 3286 { 3287 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3288 } 3289 3290 /* 3291 * Analyze a configure request. Return true if it was agreeable, and 3292 * caused action sca, false if it has been rejected or nak'ed, and 3293 * caused action scn. (The return value is used to make the state 3294 * transition decision in the state automaton.) 3295 */ 3296 static int 3297 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3298 { 3299 u_char *buf, *r, *p; 3300 struct ifnet *ifp = &sp->pp_if; 3301 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3302 struct in6_addr myaddr, desiredaddr, suggestaddr; 3303 int ifidcount; 3304 int type; 3305 int collision, nohisaddr; 3306 3307 len -= 4; 3308 origlen = len; 3309 /* 3310 * Make sure to allocate a buf that can at least hold a 3311 * conf-nak with an `address' option. We might need it below. 3312 */ 3313 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3314 if (! buf) 3315 return (0); 3316 3317 /* pass 1: see if we can recognize them */ 3318 if (debug) 3319 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3320 ifp->if_xname); 3321 p = (void *)(h + 1); 3322 ifidcount = 0; 3323 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3324 /* Sanity check option length */ 3325 if (p[1] > len) { 3326 /* XXX just RXJ? */ 3327 addlog("%s: received malicious IPCPv6 option, " 3328 "dropping\n", ifp->if_xname); 3329 goto drop; 3330 } 3331 if (debug) 3332 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3333 switch (*p) { 3334 case IPV6CP_OPT_IFID: 3335 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3336 /* correctly formed address option */ 3337 ifidcount++; 3338 continue; 3339 } 3340 if (debug) 3341 addlog(" [invalid]"); 3342 break; 3343 #ifdef notyet 3344 case IPV6CP_OPT_COMPRESSION: 3345 if (len >= 4 && p[1] >= 4) { 3346 /* correctly formed compress option */ 3347 continue; 3348 } 3349 if (debug) 3350 addlog(" [invalid]"); 3351 break; 3352 #endif 3353 default: 3354 /* Others not supported. */ 3355 if (debug) 3356 addlog(" [rej]"); 3357 break; 3358 } 3359 /* Add the option to rejected list. */ 3360 bcopy (p, r, p[1]); 3361 r += p[1]; 3362 rlen += p[1]; 3363 } 3364 if (rlen) { 3365 if (debug) 3366 addlog(" send conf-rej\n"); 3367 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3368 goto end; 3369 } else if (debug) 3370 addlog("\n"); 3371 3372 /* pass 2: parse option values */ 3373 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3374 if (debug) 3375 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3376 ifp->if_xname); 3377 p = (void *)(h + 1); 3378 len = origlen; 3379 type = CONF_ACK; 3380 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3381 if (debug) 3382 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3383 switch (*p) { 3384 #ifdef notyet 3385 case IPV6CP_OPT_COMPRESSION: 3386 continue; 3387 #endif 3388 case IPV6CP_OPT_IFID: 3389 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3390 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 3391 collision = (memcmp(&desiredaddr.s6_addr[8], 3392 &myaddr.s6_addr[8], 8) == 0); 3393 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3394 3395 desiredaddr.s6_addr16[0] = htons(0xfe80); 3396 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 3397 3398 if (!collision && !nohisaddr) { 3399 /* no collision, hisaddr known - Conf-Ack */ 3400 type = CONF_ACK; 3401 3402 if (debug) { 3403 addlog(" %s [%s]", 3404 ip6_sprintf(&desiredaddr), 3405 sppp_cp_type_name(type)); 3406 } 3407 continue; 3408 } 3409 3410 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3411 if (collision && nohisaddr) { 3412 /* collision, hisaddr unknown - Conf-Rej */ 3413 type = CONF_REJ; 3414 memset(&p[2], 0, 8); 3415 } else { 3416 /* 3417 * - no collision, hisaddr unknown, or 3418 * - collision, hisaddr known 3419 * Conf-Nak, suggest hisaddr 3420 */ 3421 type = CONF_NAK; 3422 sppp_suggest_ip6_addr(sp, &suggestaddr); 3423 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 3424 } 3425 if (debug) 3426 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3427 sppp_cp_type_name(type)); 3428 break; 3429 } 3430 /* Add the option to nak'ed list. */ 3431 bcopy (p, r, p[1]); 3432 r += p[1]; 3433 rlen += p[1]; 3434 } 3435 3436 if (rlen == 0 && type == CONF_ACK) { 3437 if (debug) 3438 addlog(" send %s\n", sppp_cp_type_name(type)); 3439 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3440 } else { 3441 #ifdef notdef 3442 if (type == CONF_ACK) 3443 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3444 #endif 3445 3446 if (debug) { 3447 addlog(" send %s suggest %s\n", 3448 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3449 } 3450 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3451 } 3452 3453 end: 3454 free(buf, M_TEMP); 3455 return (rlen == 0); 3456 3457 drop: 3458 free(buf, M_TEMP); 3459 return -1; 3460 } 3461 3462 /* 3463 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3464 * negotiation. 3465 */ 3466 static void 3467 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3468 { 3469 u_char *buf, *p; 3470 struct ifnet *ifp = &sp->pp_if; 3471 int debug = ifp->if_flags & IFF_DEBUG; 3472 3473 len -= 4; 3474 buf = malloc (len, M_TEMP, M_NOWAIT); 3475 if (!buf) 3476 return; 3477 3478 if (debug) 3479 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3480 ifp->if_xname); 3481 3482 p = (void *)(h + 1); 3483 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3484 if (p[1] > len) { 3485 /* XXX just RXJ? */ 3486 addlog("%s: received malicious IPCPv6 option, " 3487 "dropping\n", ifp->if_xname); 3488 goto drop; 3489 } 3490 if (debug) 3491 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3492 switch (*p) { 3493 case IPV6CP_OPT_IFID: 3494 /* 3495 * Peer doesn't grok address option. This is 3496 * bad. XXX Should we better give up here? 3497 */ 3498 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3499 break; 3500 #ifdef notyet 3501 case IPV6CP_OPT_COMPRESS: 3502 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3503 break; 3504 #endif 3505 } 3506 } 3507 if (debug) 3508 addlog("\n"); 3509 drop: 3510 free(buf, M_TEMP); 3511 return; 3512 } 3513 3514 /* 3515 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3516 * negotiation. 3517 */ 3518 static void 3519 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3520 { 3521 u_char *buf, *p; 3522 struct ifnet *ifp = &sp->pp_if; 3523 int debug = ifp->if_flags & IFF_DEBUG; 3524 struct in6_addr suggestaddr; 3525 3526 len -= 4; 3527 buf = malloc (len, M_TEMP, M_NOWAIT); 3528 if (!buf) 3529 return; 3530 3531 if (debug) 3532 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 3533 ifp->if_xname); 3534 3535 p = (void *)(h + 1); 3536 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3537 if (p[1] > len) { 3538 /* XXX just RXJ? */ 3539 addlog("%s: received malicious IPCPv6 option, " 3540 "dropping\n", ifp->if_xname); 3541 goto drop; 3542 } 3543 if (debug) 3544 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3545 switch (*p) { 3546 case IPV6CP_OPT_IFID: 3547 /* 3548 * Peer doesn't like our local ifid. See 3549 * if we can do something for him. We'll drop 3550 * him our address then. 3551 */ 3552 if (len < 10 || p[1] != 10) 3553 break; 3554 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3555 suggestaddr.s6_addr16[0] = htons(0xfe80); 3556 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 3557 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 3558 3559 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3560 if (debug) 3561 addlog(" [suggestaddr %s]", 3562 ip6_sprintf(&suggestaddr)); 3563 #ifdef IPV6CP_MYIFID_DYN 3564 /* 3565 * When doing dynamic address assignment, 3566 * we accept his offer. 3567 */ 3568 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3569 struct in6_addr lastsuggest; 3570 /* 3571 * If <suggested myaddr from peer> equals to 3572 * <hisaddr we have suggested last time>, 3573 * we have a collision. generate new random 3574 * ifid. 3575 */ 3576 sppp_suggest_ip6_addr(&lastsuggest); 3577 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3578 lastsuggest)) { 3579 if (debug) 3580 addlog(" [random]"); 3581 sppp_gen_ip6_addr(sp, &suggestaddr); 3582 } 3583 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3584 if (debug) 3585 addlog(" [agree]"); 3586 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3587 } 3588 #else 3589 /* 3590 * Since we do not do dynamic address assignment, 3591 * we ignore it and thus continue to negotiate 3592 * our already existing value. This can possibly 3593 * go into infinite request-reject loop. 3594 * 3595 * This is not likely because we normally use 3596 * ifid based on MAC-address. 3597 * If you have no ethernet card on the node, too bad. 3598 * XXX should we use fail_counter? 3599 */ 3600 #endif 3601 break; 3602 #ifdef notyet 3603 case IPV6CP_OPT_COMPRESS: 3604 /* 3605 * Peer wants different compression parameters. 3606 */ 3607 break; 3608 #endif 3609 } 3610 } 3611 if (debug) 3612 addlog("\n"); 3613 drop: 3614 free(buf, M_TEMP); 3615 return; 3616 } 3617 3618 static void 3619 sppp_ipv6cp_tlu(struct sppp *sp) 3620 { 3621 /* we are up - notify isdn daemon */ 3622 if (sp->pp_con) 3623 sp->pp_con(sp); 3624 } 3625 3626 static void 3627 sppp_ipv6cp_tld(struct sppp *sp) 3628 { 3629 } 3630 3631 static void 3632 sppp_ipv6cp_tls(struct sppp *sp) 3633 { 3634 /* indicate to LCP that it must stay alive */ 3635 sp->lcp.protos |= (1 << IDX_IPV6CP); 3636 } 3637 3638 static void 3639 sppp_ipv6cp_tlf(struct sppp *sp) 3640 { 3641 /* we no longer need LCP */ 3642 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3643 } 3644 3645 static void 3646 sppp_ipv6cp_scr(struct sppp *sp) 3647 { 3648 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3649 struct in6_addr ouraddr; 3650 int i = 0; 3651 3652 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3653 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3654 opt[i++] = IPV6CP_OPT_IFID; 3655 opt[i++] = 10; 3656 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 3657 i += 8; 3658 } 3659 3660 #ifdef notyet 3661 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3662 opt[i++] = IPV6CP_OPT_COMPRESSION; 3663 opt[i++] = 4; 3664 opt[i++] = 0; /* TBD */ 3665 opt[i++] = 0; /* TBD */ 3666 /* variable length data may follow */ 3667 } 3668 #endif 3669 3670 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3671 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3672 } 3673 #else /*INET6*/ 3674 static void 3675 sppp_ipv6cp_init(struct sppp *sp) 3676 { 3677 } 3678 3679 static void 3680 sppp_ipv6cp_up(struct sppp *sp) 3681 { 3682 } 3683 3684 static void 3685 sppp_ipv6cp_down(struct sppp *sp) 3686 { 3687 } 3688 3689 static void 3690 sppp_ipv6cp_open(struct sppp *sp) 3691 { 3692 } 3693 3694 static void 3695 sppp_ipv6cp_close(struct sppp *sp) 3696 { 3697 } 3698 3699 static void 3700 sppp_ipv6cp_TO(void *sp) 3701 { 3702 } 3703 3704 static int 3705 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 3706 int len) 3707 { 3708 return 0; 3709 } 3710 3711 static void 3712 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 3713 int len) 3714 { 3715 } 3716 3717 static void 3718 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 3719 int len) 3720 { 3721 } 3722 3723 static void 3724 sppp_ipv6cp_tlu(struct sppp *sp) 3725 { 3726 } 3727 3728 static void 3729 sppp_ipv6cp_tld(struct sppp *sp) 3730 { 3731 } 3732 3733 static void 3734 sppp_ipv6cp_tls(struct sppp *sp) 3735 { 3736 } 3737 3738 static void 3739 sppp_ipv6cp_tlf(struct sppp *sp) 3740 { 3741 } 3742 3743 static void 3744 sppp_ipv6cp_scr(struct sppp *sp) 3745 { 3746 } 3747 #endif /*INET6*/ 3748 3749 3750 /* 3751 *--------------------------------------------------------------------------* 3752 * * 3753 * The CHAP implementation. * 3754 * * 3755 *--------------------------------------------------------------------------* 3756 */ 3757 3758 /* 3759 * The authentication protocols don't employ a full-fledged state machine as 3760 * the control protocols do, since they do have Open and Close events, but 3761 * not Up and Down, nor are they explicitly terminated. Also, use of the 3762 * authentication protocols may be different in both directions (this makes 3763 * sense, think of a machine that never accepts incoming calls but only 3764 * calls out, it doesn't require the called party to authenticate itself). 3765 * 3766 * Our state machine for the local authentication protocol (we are requesting 3767 * the peer to authenticate) looks like: 3768 * 3769 * RCA- 3770 * +--------------------------------------------+ 3771 * V scn,tld| 3772 * +--------+ Close +---------+ RCA+ 3773 * | |<----------------------------------| |------+ 3774 * +--->| Closed | TO* | Opened | sca | 3775 * | | |-----+ +-------| |<-----+ 3776 * | +--------+ irc | | +---------+ 3777 * | ^ | | ^ 3778 * | | | | | 3779 * | | | | | 3780 * | TO-| | | | 3781 * | |tld TO+ V | | 3782 * | | +------->+ | | 3783 * | | | | | | 3784 * | +--------+ V | | 3785 * | | |<----+<--------------------+ | 3786 * | | Req- | scr | 3787 * | | Sent | | 3788 * | | | | 3789 * | +--------+ | 3790 * | RCA- | | RCA+ | 3791 * +------+ +------------------------------------------+ 3792 * scn,tld sca,irc,ict,tlu 3793 * 3794 * 3795 * with: 3796 * 3797 * Open: LCP reached authentication phase 3798 * Close: LCP reached terminate phase 3799 * 3800 * RCA+: received reply (pap-req, chap-response), acceptable 3801 * RCN: received reply (pap-req, chap-response), not acceptable 3802 * TO+: timeout with restart counter >= 0 3803 * TO-: timeout with restart counter < 0 3804 * TO*: reschedule timeout for CHAP 3805 * 3806 * scr: send request packet (none for PAP, chap-challenge) 3807 * sca: send ack packet (pap-ack, chap-success) 3808 * scn: send nak packet (pap-nak, chap-failure) 3809 * ict: initialize re-challenge timer (CHAP only) 3810 * 3811 * tlu: this-layer-up, LCP reaches network phase 3812 * tld: this-layer-down, LCP enters terminate phase 3813 * 3814 * Note that in CHAP mode, after sending a new challenge, while the state 3815 * automaton falls back into Req-Sent state, it doesn't signal a tld 3816 * event to LCP, so LCP remains in network phase. Only after not getting 3817 * any response (or after getting an unacceptable response), CHAP closes, 3818 * causing LCP to enter terminate phase. 3819 * 3820 * With PAP, there is no initial request that can be sent. The peer is 3821 * expected to send one based on the successful negotiation of PAP as 3822 * the authentication protocol during the LCP option negotiation. 3823 * 3824 * Incoming authentication protocol requests (remote requests 3825 * authentication, we are peer) don't employ a state machine at all, 3826 * they are simply answered. Some peers [Ascend P50 firmware rev 3827 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3828 * still in authentication phase (thereby violating the standard that 3829 * demands that these NCP packets are to be discarded), so we keep 3830 * track of the peer demanding us to authenticate, and only proceed to 3831 * phase network once we've seen a positive acknowledge for the 3832 * authentication. 3833 */ 3834 3835 /* 3836 * Handle incoming CHAP packets. 3837 */ 3838 void 3839 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3840 { 3841 STDDCL; 3842 struct lcp_header *h; 3843 int len, x; 3844 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3845 int value_len, name_len; 3846 MD5_CTX ctx; 3847 3848 len = m->m_pkthdr.len; 3849 if (len < 4) { 3850 if (debug) 3851 log(LOG_DEBUG, 3852 "%s: chap invalid packet length: %d bytes\n", 3853 ifp->if_xname, len); 3854 return; 3855 } 3856 h = mtod(m, struct lcp_header *); 3857 if (len > ntohs(h->len)) 3858 len = ntohs(h->len); 3859 3860 switch (h->type) { 3861 /* challenge, failure and success are his authproto */ 3862 case CHAP_CHALLENGE: 3863 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3864 /* can't do anything useful */ 3865 sp->pp_auth_failures++; 3866 printf("%s: chap input without my name and my secret being set\n", 3867 ifp->if_xname); 3868 break; 3869 } 3870 value = 1 + (u_char *)(h + 1); 3871 value_len = value[-1]; 3872 name = value + value_len; 3873 name_len = len - value_len - 5; 3874 if (name_len < 0) { 3875 if (debug) { 3876 log(LOG_DEBUG, 3877 "%s: chap corrupted challenge " 3878 "<%s id=0x%x len=%d", 3879 ifp->if_xname, 3880 sppp_auth_type_name(PPP_CHAP, h->type), 3881 h->ident, ntohs(h->len)); 3882 if (len > 4) 3883 sppp_print_bytes((u_char *)(h + 1), 3884 len - 4); 3885 addlog(">\n"); 3886 } 3887 break; 3888 } 3889 3890 if (debug) { 3891 log(LOG_DEBUG, 3892 "%s: chap input <%s id=0x%x len=%d name=", 3893 ifp->if_xname, 3894 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3895 ntohs(h->len)); 3896 sppp_print_string((char *) name, name_len); 3897 addlog(" value-size=%d value=", value_len); 3898 sppp_print_bytes(value, value_len); 3899 addlog(">\n"); 3900 } 3901 3902 /* Compute reply value. */ 3903 MD5Init(&ctx); 3904 MD5Update(&ctx, &h->ident, 1); 3905 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3906 MD5Update(&ctx, value, value_len); 3907 MD5Final(digest, &ctx); 3908 dsize = sizeof digest; 3909 3910 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3911 sizeof dsize, (const char *)&dsize, 3912 sizeof digest, digest, 3913 sp->myauth.name_len, 3914 sp->myauth.name, 3915 0); 3916 break; 3917 3918 case CHAP_SUCCESS: 3919 if (debug) { 3920 log(LOG_DEBUG, "%s: chap success", 3921 ifp->if_xname); 3922 if (len > 4) { 3923 addlog(": "); 3924 sppp_print_string((char *)(h + 1), len - 4); 3925 } 3926 addlog("\n"); 3927 } 3928 x = splnet(); 3929 sp->pp_auth_failures = 0; 3930 sp->pp_flags &= ~PP_NEEDAUTH; 3931 if (sp->myauth.proto == PPP_CHAP && 3932 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3933 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3934 /* 3935 * We are authenticator for CHAP but didn't 3936 * complete yet. Leave it to tlu to proceed 3937 * to network phase. 3938 */ 3939 splx(x); 3940 break; 3941 } 3942 splx(x); 3943 sppp_phase_network(sp); 3944 break; 3945 3946 case CHAP_FAILURE: 3947 x = splnet(); 3948 sp->pp_auth_failures++; 3949 splx(x); 3950 if (debug) { 3951 log(LOG_INFO, "%s: chap failure", 3952 ifp->if_xname); 3953 if (len > 4) { 3954 addlog(": "); 3955 sppp_print_string((char *)(h + 1), len - 4); 3956 } 3957 addlog("\n"); 3958 } else 3959 log(LOG_INFO, "%s: chap failure\n", 3960 ifp->if_xname); 3961 /* await LCP shutdown by authenticator */ 3962 break; 3963 3964 /* response is my authproto */ 3965 case CHAP_RESPONSE: 3966 if (sp->hisauth.secret == NULL) { 3967 /* can't do anything useful */ 3968 printf("%s: chap input without his secret being set\n", 3969 ifp->if_xname); 3970 break; 3971 } 3972 value = 1 + (u_char *)(h + 1); 3973 value_len = value[-1]; 3974 name = value + value_len; 3975 name_len = len - value_len - 5; 3976 if (name_len < 0) { 3977 if (debug) { 3978 log(LOG_DEBUG, 3979 "%s: chap corrupted response " 3980 "<%s id=0x%x len=%d", 3981 ifp->if_xname, 3982 sppp_auth_type_name(PPP_CHAP, h->type), 3983 h->ident, ntohs(h->len)); 3984 if (len > 4) 3985 sppp_print_bytes((u_char *)(h + 1), 3986 len - 4); 3987 addlog(">\n"); 3988 } 3989 break; 3990 } 3991 if (h->ident != sp->confid[IDX_CHAP]) { 3992 if (debug) 3993 log(LOG_DEBUG, 3994 "%s: chap dropping response for old ID " 3995 "(got %d, expected %d)\n", 3996 ifp->if_xname, 3997 h->ident, sp->confid[IDX_CHAP]); 3998 break; 3999 } 4000 if (sp->hisauth.name != NULL && 4001 (name_len != sp->hisauth.name_len 4002 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4003 log(LOG_INFO, "%s: chap response, his name ", 4004 ifp->if_xname); 4005 sppp_print_string(name, name_len); 4006 addlog(" != expected "); 4007 sppp_print_string(sp->hisauth.name, 4008 sp->hisauth.name_len); 4009 addlog("\n"); 4010 goto chap_failure; 4011 } 4012 if (debug) { 4013 log(LOG_DEBUG, "%s: chap input(%s) " 4014 "<%s id=0x%x len=%d name=", 4015 ifp->if_xname, 4016 sppp_state_name(sp->state[IDX_CHAP]), 4017 sppp_auth_type_name(PPP_CHAP, h->type), 4018 h->ident, ntohs(h->len)); 4019 sppp_print_string((char *)name, name_len); 4020 addlog(" value-size=%d value=", value_len); 4021 sppp_print_bytes(value, value_len); 4022 addlog(">\n"); 4023 } 4024 if (value_len != sizeof(sp->myauth.challenge)) { 4025 if (debug) 4026 log(LOG_DEBUG, 4027 "%s: chap bad hash value length: " 4028 "%d bytes, should be %ld\n", 4029 ifp->if_xname, value_len, 4030 (long) sizeof(sp->myauth.challenge)); 4031 goto chap_failure; 4032 } 4033 4034 MD5Init(&ctx); 4035 MD5Update(&ctx, &h->ident, 1); 4036 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4037 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 4038 MD5Final(digest, &ctx); 4039 4040 #define FAILMSG "Failed..." 4041 #define SUCCMSG "Welcome!" 4042 4043 if (value_len != sizeof digest || 4044 memcmp(digest, value, value_len) != 0) { 4045 chap_failure: 4046 /* action scn, tld */ 4047 x = splnet(); 4048 sp->pp_auth_failures++; 4049 splx(x); 4050 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4051 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4052 0); 4053 chap.tld(sp); 4054 break; 4055 } 4056 sp->pp_auth_failures = 0; 4057 /* action sca, perhaps tlu */ 4058 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4059 sp->state[IDX_CHAP] == STATE_OPENED) 4060 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4061 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4062 0); 4063 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4064 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4065 chap.tlu(sp); 4066 } 4067 break; 4068 4069 default: 4070 /* Unknown CHAP packet type -- ignore. */ 4071 if (debug) { 4072 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4073 "<0x%x id=0x%xh len=%d", 4074 ifp->if_xname, 4075 sppp_state_name(sp->state[IDX_CHAP]), 4076 h->type, h->ident, ntohs(h->len)); 4077 if (len > 4) 4078 sppp_print_bytes((u_char *)(h + 1), len - 4); 4079 addlog(">\n"); 4080 } 4081 break; 4082 4083 } 4084 } 4085 4086 static void 4087 sppp_chap_init(struct sppp *sp) 4088 { 4089 /* Chap doesn't have STATE_INITIAL at all. */ 4090 sp->state[IDX_CHAP] = STATE_CLOSED; 4091 sp->fail_counter[IDX_CHAP] = 0; 4092 sp->pp_seq[IDX_CHAP] = 0; 4093 sp->pp_rseq[IDX_CHAP] = 0; 4094 callout_init(&sp->ch[IDX_CHAP], 0); 4095 } 4096 4097 static void 4098 sppp_chap_open(struct sppp *sp) 4099 { 4100 if (sp->myauth.proto == PPP_CHAP && 4101 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4102 /* we are authenticator for CHAP, start it */ 4103 chap.scr(sp); 4104 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4105 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4106 } 4107 /* nothing to be done if we are peer, await a challenge */ 4108 } 4109 4110 static void 4111 sppp_chap_close(struct sppp *sp) 4112 { 4113 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4114 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4115 } 4116 4117 static void 4118 sppp_chap_TO(void *cookie) 4119 { 4120 struct sppp *sp = (struct sppp *)cookie; 4121 STDDCL; 4122 int s; 4123 4124 s = splnet(); 4125 if (debug) 4126 log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n", 4127 ifp->if_xname, 4128 sppp_state_name(sp->state[IDX_CHAP]), 4129 sp->rst_counter[IDX_CHAP]); 4130 4131 if (--sp->rst_counter[IDX_CHAP] < 0) 4132 /* TO- event */ 4133 switch (sp->state[IDX_CHAP]) { 4134 case STATE_REQ_SENT: 4135 chap.tld(sp); 4136 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4137 break; 4138 } 4139 else 4140 /* TO+ (or TO*) event */ 4141 switch (sp->state[IDX_CHAP]) { 4142 case STATE_OPENED: 4143 /* TO* event */ 4144 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4145 /* fall through */ 4146 case STATE_REQ_SENT: 4147 chap.scr(sp); 4148 /* sppp_cp_change_state() will restart the timer */ 4149 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4150 break; 4151 } 4152 4153 splx(s); 4154 } 4155 4156 static void 4157 sppp_chap_tlu(struct sppp *sp) 4158 { 4159 STDDCL; 4160 int i, x; 4161 4162 i = 0; 4163 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4164 4165 /* 4166 * Some broken CHAP implementations (Conware CoNet, firmware 4167 * 4.0.?) don't want to re-authenticate their CHAP once the 4168 * initial challenge-response exchange has taken place. 4169 * Provide for an option to avoid rechallenges. 4170 */ 4171 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4172 /* 4173 * Compute the re-challenge timeout. This will yield 4174 * a number between 300 and 810 seconds. 4175 */ 4176 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4177 4178 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4179 } 4180 4181 if (debug) { 4182 log(LOG_DEBUG, 4183 "%s: chap %s, ", 4184 ifp->if_xname, 4185 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4186 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4187 addlog("next re-challenge in %d seconds\n", i); 4188 else 4189 addlog("re-challenging supressed\n"); 4190 } 4191 4192 x = splnet(); 4193 sp->pp_auth_failures = 0; 4194 /* indicate to LCP that we need to be closed down */ 4195 sp->lcp.protos |= (1 << IDX_CHAP); 4196 4197 if (sp->pp_flags & PP_NEEDAUTH) { 4198 /* 4199 * Remote is authenticator, but his auth proto didn't 4200 * complete yet. Defer the transition to network 4201 * phase. 4202 */ 4203 splx(x); 4204 return; 4205 } 4206 splx(x); 4207 4208 /* 4209 * If we are already in phase network, we are done here. This 4210 * is the case if this is a dummy tlu event after a re-challenge. 4211 */ 4212 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4213 sppp_phase_network(sp); 4214 } 4215 4216 static void 4217 sppp_chap_tld(struct sppp *sp) 4218 { 4219 STDDCL; 4220 4221 if (debug) 4222 log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname); 4223 callout_stop(&sp->ch[IDX_CHAP]); 4224 sp->lcp.protos &= ~(1 << IDX_CHAP); 4225 4226 lcp.Close(sp); 4227 } 4228 4229 static void 4230 sppp_chap_scr(struct sppp *sp) 4231 { 4232 uint32_t *ch; 4233 u_char clen = 4 * sizeof(uint32_t); 4234 4235 if (sp->myauth.name == NULL) { 4236 /* can't do anything useful */ 4237 printf("%s: chap starting without my name being set\n", 4238 sp->pp_if.if_xname); 4239 return; 4240 } 4241 4242 /* Compute random challenge. */ 4243 ch = (uint32_t *)sp->myauth.challenge; 4244 cprng_strong(kern_cprng, ch, clen, 0); 4245 4246 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4247 4248 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4249 sizeof clen, (const char *)&clen, 4250 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4251 sp->myauth.name_len, 4252 sp->myauth.name, 4253 0); 4254 } 4255 4256 /* 4257 *--------------------------------------------------------------------------* 4258 * * 4259 * The PAP implementation. * 4260 * * 4261 *--------------------------------------------------------------------------* 4262 */ 4263 /* 4264 * For PAP, we need to keep a little state also if we are the peer, not the 4265 * authenticator. This is since we don't get a request to authenticate, but 4266 * have to repeatedly authenticate ourself until we got a response (or the 4267 * retry counter is expired). 4268 */ 4269 4270 /* 4271 * Handle incoming PAP packets. */ 4272 static void 4273 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4274 { 4275 STDDCL; 4276 struct lcp_header *h; 4277 int len, x; 4278 u_char mlen; 4279 char *name, *secret; 4280 int name_len, secret_len; 4281 4282 /* 4283 * Malicious input might leave this uninitialized, so 4284 * init to an impossible value. 4285 */ 4286 secret_len = -1; 4287 4288 len = m->m_pkthdr.len; 4289 if (len < 5) { 4290 if (debug) 4291 log(LOG_DEBUG, 4292 "%s: pap invalid packet length: %d bytes\n", 4293 ifp->if_xname, len); 4294 return; 4295 } 4296 h = mtod(m, struct lcp_header *); 4297 if (len > ntohs(h->len)) 4298 len = ntohs(h->len); 4299 switch (h->type) { 4300 /* PAP request is my authproto */ 4301 case PAP_REQ: 4302 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4303 /* can't do anything useful */ 4304 printf("%s: pap request without his name and his secret being set\n", 4305 ifp->if_xname); 4306 break; 4307 } 4308 name = 1 + (u_char *)(h + 1); 4309 name_len = name[-1]; 4310 secret = name + name_len + 1; 4311 if (name_len > len - 6 || 4312 (secret_len = secret[-1]) > len - 6 - name_len) { 4313 if (debug) { 4314 log(LOG_DEBUG, "%s: pap corrupted input " 4315 "<%s id=0x%x len=%d", 4316 ifp->if_xname, 4317 sppp_auth_type_name(PPP_PAP, h->type), 4318 h->ident, ntohs(h->len)); 4319 if (len > 4) 4320 sppp_print_bytes((u_char *)(h + 1), 4321 len - 4); 4322 addlog(">\n"); 4323 } 4324 break; 4325 } 4326 if (debug) { 4327 log(LOG_DEBUG, "%s: pap input(%s) " 4328 "<%s id=0x%x len=%d name=", 4329 ifp->if_xname, 4330 sppp_state_name(sp->state[IDX_PAP]), 4331 sppp_auth_type_name(PPP_PAP, h->type), 4332 h->ident, ntohs(h->len)); 4333 sppp_print_string((char *)name, name_len); 4334 addlog(" secret="); 4335 sppp_print_string((char *)secret, secret_len); 4336 addlog(">\n"); 4337 } 4338 if (name_len != sp->hisauth.name_len || 4339 secret_len != sp->hisauth.secret_len || 4340 memcmp(name, sp->hisauth.name, name_len) != 0 || 4341 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4342 /* action scn, tld */ 4343 sp->pp_auth_failures++; 4344 mlen = sizeof(FAILMSG) - 1; 4345 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4346 sizeof mlen, (const char *)&mlen, 4347 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4348 0); 4349 pap.tld(sp); 4350 break; 4351 } 4352 /* action sca, perhaps tlu */ 4353 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4354 sp->state[IDX_PAP] == STATE_OPENED) { 4355 mlen = sizeof(SUCCMSG) - 1; 4356 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4357 sizeof mlen, (const char *)&mlen, 4358 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4359 0); 4360 } 4361 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4362 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4363 pap.tlu(sp); 4364 } 4365 break; 4366 4367 /* ack and nak are his authproto */ 4368 case PAP_ACK: 4369 callout_stop(&sp->pap_my_to_ch); 4370 if (debug) { 4371 log(LOG_DEBUG, "%s: pap success", 4372 ifp->if_xname); 4373 name = 1 + (u_char *)(h + 1); 4374 name_len = name[-1]; 4375 if (len > 5 && name_len < len+4) { 4376 addlog(": "); 4377 sppp_print_string(name, name_len); 4378 } 4379 addlog("\n"); 4380 } 4381 x = splnet(); 4382 sp->pp_auth_failures = 0; 4383 sp->pp_flags &= ~PP_NEEDAUTH; 4384 if (sp->myauth.proto == PPP_PAP && 4385 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4386 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4387 /* 4388 * We are authenticator for PAP but didn't 4389 * complete yet. Leave it to tlu to proceed 4390 * to network phase. 4391 */ 4392 splx(x); 4393 break; 4394 } 4395 splx(x); 4396 sppp_phase_network(sp); 4397 break; 4398 4399 case PAP_NAK: 4400 callout_stop(&sp->pap_my_to_ch); 4401 sp->pp_auth_failures++; 4402 if (debug) { 4403 log(LOG_INFO, "%s: pap failure", 4404 ifp->if_xname); 4405 name = 1 + (u_char *)(h + 1); 4406 name_len = name[-1]; 4407 if (len > 5 && name_len < len+4) { 4408 addlog(": "); 4409 sppp_print_string(name, name_len); 4410 } 4411 addlog("\n"); 4412 } else 4413 log(LOG_INFO, "%s: pap failure\n", 4414 ifp->if_xname); 4415 /* await LCP shutdown by authenticator */ 4416 break; 4417 4418 default: 4419 /* Unknown PAP packet type -- ignore. */ 4420 if (debug) { 4421 log(LOG_DEBUG, "%s: pap corrupted input " 4422 "<0x%x id=0x%x len=%d", 4423 ifp->if_xname, 4424 h->type, h->ident, ntohs(h->len)); 4425 if (len > 4) 4426 sppp_print_bytes((u_char *)(h + 1), len - 4); 4427 addlog(">\n"); 4428 } 4429 break; 4430 4431 } 4432 } 4433 4434 static void 4435 sppp_pap_init(struct sppp *sp) 4436 { 4437 /* PAP doesn't have STATE_INITIAL at all. */ 4438 sp->state[IDX_PAP] = STATE_CLOSED; 4439 sp->fail_counter[IDX_PAP] = 0; 4440 sp->pp_seq[IDX_PAP] = 0; 4441 sp->pp_rseq[IDX_PAP] = 0; 4442 callout_init(&sp->ch[IDX_PAP], 0); 4443 callout_init(&sp->pap_my_to_ch, 0); 4444 } 4445 4446 static void 4447 sppp_pap_open(struct sppp *sp) 4448 { 4449 if (sp->hisauth.proto == PPP_PAP && 4450 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4451 /* we are authenticator for PAP, start our timer */ 4452 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4453 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4454 } 4455 if (sp->myauth.proto == PPP_PAP) { 4456 /* we are peer, send a request, and start a timer */ 4457 pap.scr(sp); 4458 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4459 sppp_pap_my_TO, sp); 4460 } 4461 } 4462 4463 static void 4464 sppp_pap_close(struct sppp *sp) 4465 { 4466 if (sp->state[IDX_PAP] != STATE_CLOSED) 4467 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4468 } 4469 4470 /* 4471 * That's the timeout routine if we are authenticator. Since the 4472 * authenticator is basically passive in PAP, we can't do much here. 4473 */ 4474 static void 4475 sppp_pap_TO(void *cookie) 4476 { 4477 struct sppp *sp = (struct sppp *)cookie; 4478 STDDCL; 4479 int s; 4480 4481 s = splnet(); 4482 if (debug) 4483 log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n", 4484 ifp->if_xname, 4485 sppp_state_name(sp->state[IDX_PAP]), 4486 sp->rst_counter[IDX_PAP]); 4487 4488 if (--sp->rst_counter[IDX_PAP] < 0) 4489 /* TO- event */ 4490 switch (sp->state[IDX_PAP]) { 4491 case STATE_REQ_SENT: 4492 pap.tld(sp); 4493 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4494 break; 4495 } 4496 else 4497 /* TO+ event, not very much we could do */ 4498 switch (sp->state[IDX_PAP]) { 4499 case STATE_REQ_SENT: 4500 /* sppp_cp_change_state() will restart the timer */ 4501 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4502 break; 4503 } 4504 4505 splx(s); 4506 } 4507 4508 /* 4509 * That's the timeout handler if we are peer. Since the peer is active, 4510 * we need to retransmit our PAP request since it is apparently lost. 4511 * XXX We should impose a max counter. 4512 */ 4513 static void 4514 sppp_pap_my_TO(void *cookie) 4515 { 4516 struct sppp *sp = (struct sppp *)cookie; 4517 STDDCL; 4518 4519 if (debug) 4520 log(LOG_DEBUG, "%s: pap peer TO\n", 4521 ifp->if_xname); 4522 4523 pap.scr(sp); 4524 } 4525 4526 static void 4527 sppp_pap_tlu(struct sppp *sp) 4528 { 4529 STDDCL; 4530 int x; 4531 4532 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4533 4534 if (debug) 4535 log(LOG_DEBUG, "%s: %s tlu\n", 4536 ifp->if_xname, pap.name); 4537 4538 x = splnet(); 4539 sp->pp_auth_failures = 0; 4540 /* indicate to LCP that we need to be closed down */ 4541 sp->lcp.protos |= (1 << IDX_PAP); 4542 4543 if (sp->pp_flags & PP_NEEDAUTH) { 4544 /* 4545 * Remote is authenticator, but his auth proto didn't 4546 * complete yet. Defer the transition to network 4547 * phase. 4548 */ 4549 splx(x); 4550 return; 4551 } 4552 splx(x); 4553 sppp_phase_network(sp); 4554 } 4555 4556 static void 4557 sppp_pap_tld(struct sppp *sp) 4558 { 4559 STDDCL; 4560 4561 if (debug) 4562 log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname); 4563 callout_stop(&sp->ch[IDX_PAP]); 4564 callout_stop(&sp->pap_my_to_ch); 4565 sp->lcp.protos &= ~(1 << IDX_PAP); 4566 4567 lcp.Close(sp); 4568 } 4569 4570 static void 4571 sppp_pap_scr(struct sppp *sp) 4572 { 4573 u_char idlen, pwdlen; 4574 4575 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4576 /* can't do anything useful */ 4577 printf("%s: pap starting without my name and secret being set\n", 4578 sp->pp_if.if_xname); 4579 return; 4580 } 4581 4582 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4583 pwdlen = sp->myauth.secret_len; 4584 idlen = sp->myauth.name_len; 4585 4586 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4587 sizeof idlen, (const char *)&idlen, 4588 idlen, sp->myauth.name, 4589 sizeof pwdlen, (const char *)&pwdlen, 4590 pwdlen, sp->myauth.secret, 4591 0); 4592 } 4593 4594 /* 4595 * Random miscellaneous functions. 4596 */ 4597 4598 /* 4599 * Send a PAP or CHAP proto packet. 4600 * 4601 * Varadic function, each of the elements for the ellipsis is of type 4602 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4603 * mlen == 0. 4604 * NOTE: never declare variadic functions with types subject to type 4605 * promotion (i.e. u_char). This is asking for big trouble depending 4606 * on the architecture you are on... 4607 */ 4608 4609 static void 4610 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4611 unsigned int type, unsigned int id, 4612 ...) 4613 { 4614 STDDCL; 4615 struct lcp_header *lh; 4616 struct mbuf *m; 4617 u_char *p; 4618 int len; 4619 size_t pkthdrlen; 4620 unsigned int mlen; 4621 const char *msg; 4622 va_list ap; 4623 4624 MGETHDR(m, M_DONTWAIT, MT_DATA); 4625 if (! m) 4626 return; 4627 m->m_pkthdr.rcvif = 0; 4628 4629 if (sp->pp_flags & PP_NOFRAMING) { 4630 *mtod(m, uint16_t *) = htons(cp->proto); 4631 pkthdrlen = 2; 4632 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 4633 } else { 4634 struct ppp_header *h; 4635 h = mtod(m, struct ppp_header *); 4636 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4637 h->control = PPP_UI; /* Unnumbered Info */ 4638 h->protocol = htons(cp->proto); 4639 pkthdrlen = PPP_HEADER_LEN; 4640 4641 lh = (struct lcp_header *)(h + 1); 4642 } 4643 4644 lh->type = type; 4645 lh->ident = id; 4646 p = (u_char *)(lh + 1); 4647 4648 va_start(ap, id); 4649 len = 0; 4650 4651 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4652 msg = va_arg(ap, const char *); 4653 len += mlen; 4654 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4655 va_end(ap); 4656 m_freem(m); 4657 return; 4658 } 4659 4660 memcpy(p, msg, mlen); 4661 p += mlen; 4662 } 4663 va_end(ap); 4664 4665 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4666 lh->len = htons(LCP_HEADER_LEN + len); 4667 4668 if (debug) { 4669 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 4670 ifp->if_xname, cp->name, 4671 sppp_auth_type_name(cp->proto, lh->type), 4672 lh->ident, ntohs(lh->len)); 4673 if (len) 4674 sppp_print_bytes((u_char *)(lh + 1), len); 4675 addlog(">\n"); 4676 } 4677 if (IF_QFULL(&sp->pp_cpq)) { 4678 IF_DROP(&sp->pp_fastq); 4679 IF_DROP(&ifp->if_snd); 4680 m_freem(m); 4681 ++ifp->if_oerrors; 4682 return; 4683 } else 4684 IF_ENQUEUE(&sp->pp_cpq, m); 4685 if (! (ifp->if_flags & IFF_OACTIVE)) 4686 (*ifp->if_start)(ifp); 4687 ifp->if_obytes += m->m_pkthdr.len + 3; 4688 } 4689 4690 /* 4691 * Send keepalive packets, every 10 seconds. 4692 */ 4693 static void 4694 sppp_keepalive(void *dummy) 4695 { 4696 struct sppp *sp; 4697 int s; 4698 time_t now; 4699 4700 s = splnet(); 4701 now = time_uptime; 4702 for (sp=spppq; sp; sp=sp->pp_next) { 4703 struct ifnet *ifp = &sp->pp_if; 4704 4705 /* check idle timeout */ 4706 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4707 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4708 /* idle timeout is enabled for this interface */ 4709 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4710 if (ifp->if_flags & IFF_DEBUG) 4711 printf("%s: no activity for %lu seconds\n", 4712 sp->pp_if.if_xname, 4713 (unsigned long)(now-sp->pp_last_activity)); 4714 lcp.Close(sp); 4715 continue; 4716 } 4717 } 4718 4719 /* Keepalive mode disabled or channel down? */ 4720 if (! (sp->pp_flags & PP_KEEPALIVE) || 4721 ! (ifp->if_flags & IFF_RUNNING)) 4722 continue; 4723 4724 /* No keepalive in PPP mode if LCP not opened yet. */ 4725 if (! (sp->pp_flags & PP_CISCO) && 4726 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4727 continue; 4728 4729 /* No echo reply, but maybe user data passed through? */ 4730 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 4731 sp->pp_alivecnt = 0; 4732 continue; 4733 } 4734 4735 if (sp->pp_alivecnt >= sp->pp_maxalive) { 4736 /* No keepalive packets got. Stop the interface. */ 4737 if_down (ifp); 4738 IF_PURGE(&sp->pp_cpq); 4739 if (! (sp->pp_flags & PP_CISCO)) { 4740 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4741 ifp->if_xname); 4742 sp->pp_alivecnt = 0; 4743 4744 /* we are down, close all open protocols */ 4745 lcp.Close(sp); 4746 4747 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4748 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4749 4750 /* Close connection immediately, completition of this 4751 * will summon the magic needed to reestablish it. */ 4752 if (sp->pp_tlf) 4753 sp->pp_tlf(sp); 4754 continue; 4755 } 4756 } 4757 if (sp->pp_alivecnt < sp->pp_maxalive) 4758 ++sp->pp_alivecnt; 4759 if (sp->pp_flags & PP_CISCO) 4760 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4761 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4762 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4763 int32_t nmagic = htonl(sp->lcp.magic); 4764 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4765 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4766 sp->lcp.echoid, 4, &nmagic); 4767 } 4768 } 4769 splx(s); 4770 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4771 } 4772 4773 #ifdef INET 4774 /* 4775 * Get both IP addresses. 4776 */ 4777 static void 4778 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 4779 { 4780 struct ifnet *ifp = &sp->pp_if; 4781 struct ifaddr *ifa; 4782 struct sockaddr_in *si, *sm; 4783 uint32_t ssrc, ddst; 4784 4785 sm = NULL; 4786 ssrc = ddst = 0; 4787 /* 4788 * Pick the first AF_INET address from the list, 4789 * aliases don't make any sense on a p2p link anyway. 4790 */ 4791 si = 0; 4792 IFADDR_FOREACH(ifa, ifp) { 4793 if (ifa->ifa_addr->sa_family == AF_INET) { 4794 si = (struct sockaddr_in *)ifa->ifa_addr; 4795 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4796 if (si) 4797 break; 4798 } 4799 } 4800 if (ifa) { 4801 if (si && si->sin_addr.s_addr) { 4802 ssrc = si->sin_addr.s_addr; 4803 if (srcmask) 4804 *srcmask = ntohl(sm->sin_addr.s_addr); 4805 } 4806 4807 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4808 if (si && si->sin_addr.s_addr) 4809 ddst = si->sin_addr.s_addr; 4810 } 4811 4812 if (dst) *dst = ntohl(ddst); 4813 if (src) *src = ntohl(ssrc); 4814 } 4815 4816 /* 4817 * Set IP addresses. Must be called at splnet. 4818 * If an address is 0, leave it the way it is. 4819 */ 4820 static void 4821 sppp_set_ip_addrs(struct sppp *sp, uint32_t myaddr, uint32_t hisaddr) 4822 { 4823 STDDCL; 4824 struct ifaddr *ifa; 4825 struct sockaddr_in *si, *dest; 4826 4827 /* 4828 * Pick the first AF_INET address from the list, 4829 * aliases don't make any sense on a p2p link anyway. 4830 */ 4831 4832 IFADDR_FOREACH(ifa, ifp) { 4833 if (ifa->ifa_addr->sa_family == AF_INET) { 4834 si = (struct sockaddr_in *)ifa->ifa_addr; 4835 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4836 goto found; 4837 } 4838 } 4839 return; 4840 4841 found: 4842 { 4843 int error, hostIsNew; 4844 struct sockaddr_in new_sin = *si; 4845 struct sockaddr_in new_dst = *dest; 4846 4847 /* 4848 * Scrub old routes now instead of calling in_ifinit with 4849 * scrub=1, because we may change the dstaddr 4850 * before the call to in_ifinit. 4851 */ 4852 in_ifscrub(ifp, ifatoia(ifa)); 4853 4854 hostIsNew = 0; 4855 if (myaddr != 0) { 4856 if (new_sin.sin_addr.s_addr != htonl(myaddr)) { 4857 new_sin.sin_addr.s_addr = htonl(myaddr); 4858 hostIsNew = 1; 4859 } 4860 } 4861 if (hisaddr != 0) { 4862 new_dst.sin_addr.s_addr = htonl(hisaddr); 4863 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4864 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4865 *dest = new_dst; /* fix dstaddr in place */ 4866 } 4867 } 4868 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0, hostIsNew); 4869 if (debug && error) 4870 { 4871 log(LOG_DEBUG, "%s: sppp_set_ip_addrs: in_ifinit " 4872 " failed, error=%d\n", ifp->if_xname, error); 4873 } 4874 if (!error) { 4875 (void)pfil_run_hooks(if_pfil, 4876 (struct mbuf **)SIOCAIFADDR, ifp, PFIL_IFADDR); 4877 } 4878 } 4879 } 4880 4881 /* 4882 * Clear IP addresses. Must be called at splnet. 4883 */ 4884 static void 4885 sppp_clear_ip_addrs(struct sppp *sp) 4886 { 4887 struct ifnet *ifp = &sp->pp_if; 4888 struct ifaddr *ifa; 4889 struct sockaddr_in *si, *dest; 4890 4891 uint32_t remote; 4892 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4893 remote = sp->ipcp.saved_hisaddr; 4894 else 4895 sppp_get_ip_addrs(sp, 0, &remote, 0); 4896 4897 /* 4898 * Pick the first AF_INET address from the list, 4899 * aliases don't make any sense on a p2p link anyway. 4900 */ 4901 4902 IFADDR_FOREACH(ifa, ifp) { 4903 if (ifa->ifa_addr->sa_family == AF_INET) { 4904 si = (struct sockaddr_in *)ifa->ifa_addr; 4905 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4906 goto found; 4907 } 4908 } 4909 return; 4910 4911 found: 4912 { 4913 struct sockaddr_in new_sin = *si; 4914 4915 in_ifscrub(ifp, ifatoia(ifa)); 4916 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4917 new_sin.sin_addr.s_addr = 0; 4918 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4919 /* replace peer addr in place */ 4920 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4921 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0, 0); 4922 (void)pfil_run_hooks(if_pfil, 4923 (struct mbuf **)SIOCDIFADDR, ifp, PFIL_IFADDR); 4924 } 4925 } 4926 #endif 4927 4928 #ifdef INET6 4929 /* 4930 * Get both IPv6 addresses. 4931 */ 4932 static void 4933 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4934 struct in6_addr *srcmask) 4935 { 4936 struct ifnet *ifp = &sp->pp_if; 4937 struct ifaddr *ifa; 4938 struct sockaddr_in6 *si, *sm; 4939 struct in6_addr ssrc, ddst; 4940 4941 sm = NULL; 4942 memset(&ssrc, 0, sizeof(ssrc)); 4943 memset(&ddst, 0, sizeof(ddst)); 4944 /* 4945 * Pick the first link-local AF_INET6 address from the list, 4946 * aliases don't make any sense on a p2p link anyway. 4947 */ 4948 si = 0; 4949 IFADDR_FOREACH(ifa, ifp) 4950 if (ifa->ifa_addr->sa_family == AF_INET6) { 4951 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4952 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4953 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4954 break; 4955 } 4956 if (ifa) { 4957 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4958 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 4959 if (srcmask) { 4960 memcpy(srcmask, &sm->sin6_addr, 4961 sizeof(*srcmask)); 4962 } 4963 } 4964 4965 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4966 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4967 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 4968 } 4969 4970 if (dst) 4971 memcpy(dst, &ddst, sizeof(*dst)); 4972 if (src) 4973 memcpy(src, &ssrc, sizeof(*src)); 4974 } 4975 4976 #ifdef IPV6CP_MYIFID_DYN 4977 /* 4978 * Generate random ifid. 4979 */ 4980 static void 4981 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4982 { 4983 /* TBD */ 4984 } 4985 4986 /* 4987 * Set my IPv6 address. Must be called at splnet. 4988 */ 4989 static void 4990 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4991 { 4992 STDDCL; 4993 struct ifaddr *ifa; 4994 struct sockaddr_in6 *sin6; 4995 4996 /* 4997 * Pick the first link-local AF_INET6 address from the list, 4998 * aliases don't make any sense on a p2p link anyway. 4999 */ 5000 5001 sin6 = NULL; 5002 IFADDR_FOREACH(ifa, ifp) 5003 { 5004 if (ifa->ifa_addr->sa_family == AF_INET6) 5005 { 5006 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5007 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 5008 break; 5009 } 5010 } 5011 5012 if (ifa && sin6) 5013 { 5014 int error; 5015 struct sockaddr_in6 new_sin6 = *sin6; 5016 5017 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5018 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5019 if (debug && error) 5020 { 5021 log(LOG_DEBUG, "%s: sppp_set_ip6_addr: in6_ifinit " 5022 " failed, error=%d\n", ifp->if_xname, error); 5023 } 5024 if (!error) { 5025 (void)pfil_run_hooks(if_pfil, 5026 (struct mbuf **)SIOCAIFADDR_IN6, ifp, PFIL_IFADDR); 5027 } 5028 } 5029 } 5030 #endif 5031 5032 /* 5033 * Suggest a candidate address to be used by peer. 5034 */ 5035 static void 5036 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5037 { 5038 struct in6_addr myaddr; 5039 struct timeval tv; 5040 5041 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5042 5043 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5044 microtime(&tv); 5045 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5046 myaddr.s6_addr[14] ^= 0xff; 5047 myaddr.s6_addr[15] ^= 0xff; 5048 } else { 5049 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5050 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5051 } 5052 if (suggest) 5053 memcpy(suggest, &myaddr, sizeof(myaddr)); 5054 } 5055 #endif /*INET6*/ 5056 5057 /* 5058 * Process ioctl requests specific to the PPP interface. 5059 * Permissions have already been checked. 5060 */ 5061 static int 5062 sppp_params(struct sppp *sp, u_long cmd, void *data) 5063 { 5064 switch (cmd) { 5065 case SPPPGETAUTHCFG: 5066 { 5067 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5068 int error; 5069 size_t len; 5070 5071 cfg->myauthflags = sp->myauth.flags; 5072 cfg->hisauthflags = sp->hisauth.flags; 5073 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5074 cfg->hisauth = 0; 5075 if (sp->hisauth.proto) 5076 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5077 cfg->myauth = 0; 5078 if (sp->myauth.proto) 5079 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5080 if (cfg->myname_length == 0) { 5081 if (sp->myauth.name != NULL) 5082 cfg->myname_length = sp->myauth.name_len + 1; 5083 } else { 5084 if (sp->myauth.name == NULL) { 5085 cfg->myname_length = 0; 5086 } else { 5087 len = sp->myauth.name_len + 1; 5088 if (cfg->myname_length < len) 5089 return (ENAMETOOLONG); 5090 error = copyout(sp->myauth.name, cfg->myname, len); 5091 if (error) return error; 5092 } 5093 } 5094 if (cfg->hisname_length == 0) { 5095 if (sp->hisauth.name != NULL) 5096 cfg->hisname_length = sp->hisauth.name_len + 1; 5097 } else { 5098 if (sp->hisauth.name == NULL) { 5099 cfg->hisname_length = 0; 5100 } else { 5101 len = sp->hisauth.name_len + 1; 5102 if (cfg->hisname_length < len) 5103 return (ENAMETOOLONG); 5104 error = copyout(sp->hisauth.name, cfg->hisname, len); 5105 if (error) return error; 5106 } 5107 } 5108 } 5109 break; 5110 case SPPPSETAUTHCFG: 5111 { 5112 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5113 int error; 5114 5115 if (sp->myauth.name) { 5116 free(sp->myauth.name, M_DEVBUF); 5117 sp->myauth.name = NULL; 5118 } 5119 if (sp->myauth.secret) { 5120 free(sp->myauth.secret, M_DEVBUF); 5121 sp->myauth.secret = NULL; 5122 } 5123 if (sp->hisauth.name) { 5124 free(sp->hisauth.name, M_DEVBUF); 5125 sp->hisauth.name = NULL; 5126 } 5127 if (sp->hisauth.secret) { 5128 free(sp->hisauth.secret, M_DEVBUF); 5129 sp->hisauth.secret = NULL; 5130 } 5131 5132 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5133 if (cfg->hisname_length >= MCLBYTES) 5134 return (ENAMETOOLONG); 5135 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5136 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5137 if (error) { 5138 free(sp->hisauth.name, M_DEVBUF); 5139 sp->hisauth.name = NULL; 5140 return error; 5141 } 5142 sp->hisauth.name_len = cfg->hisname_length - 1; 5143 sp->hisauth.name[sp->hisauth.name_len] = 0; 5144 } 5145 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5146 if (cfg->hissecret_length >= MCLBYTES) 5147 return (ENAMETOOLONG); 5148 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5149 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5150 if (error) { 5151 free(sp->hisauth.secret, M_DEVBUF); 5152 sp->hisauth.secret = NULL; 5153 return error; 5154 } 5155 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5156 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5157 } 5158 if (cfg->myname != NULL && cfg->myname_length > 0) { 5159 if (cfg->myname_length >= MCLBYTES) 5160 return (ENAMETOOLONG); 5161 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5162 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5163 if (error) { 5164 free(sp->myauth.name, M_DEVBUF); 5165 sp->myauth.name = NULL; 5166 return error; 5167 } 5168 sp->myauth.name_len = cfg->myname_length - 1; 5169 sp->myauth.name[sp->myauth.name_len] = 0; 5170 } 5171 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5172 if (cfg->mysecret_length >= MCLBYTES) 5173 return (ENAMETOOLONG); 5174 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5175 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5176 if (error) { 5177 free(sp->myauth.secret, M_DEVBUF); 5178 sp->myauth.secret = NULL; 5179 return error; 5180 } 5181 sp->myauth.secret_len = cfg->mysecret_length - 1; 5182 sp->myauth.secret[sp->myauth.secret_len] = 0; 5183 } 5184 sp->myauth.flags = cfg->myauthflags; 5185 if (cfg->myauth) 5186 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5187 sp->hisauth.flags = cfg->hisauthflags; 5188 if (cfg->hisauth) 5189 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5190 sp->pp_auth_failures = 0; 5191 if (sp->hisauth.proto != 0) 5192 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5193 else 5194 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5195 } 5196 break; 5197 case SPPPGETLCPCFG: 5198 { 5199 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5200 lcpp->lcp_timeout = sp->lcp.timeout; 5201 } 5202 break; 5203 case SPPPSETLCPCFG: 5204 { 5205 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5206 sp->lcp.timeout = lcpp->lcp_timeout; 5207 } 5208 break; 5209 case SPPPGETSTATUS: 5210 { 5211 struct spppstatus *status = (struct spppstatus *)data; 5212 status->phase = sp->pp_phase; 5213 } 5214 break; 5215 case SPPPGETSTATUSNCP: 5216 { 5217 struct spppstatusncp *status = (struct spppstatusncp *)data; 5218 status->phase = sp->pp_phase; 5219 status->ncpup = sppp_ncp_check(sp); 5220 } 5221 break; 5222 case SPPPGETIDLETO: 5223 { 5224 struct spppidletimeout *to = (struct spppidletimeout *)data; 5225 to->idle_seconds = sp->pp_idle_timeout; 5226 } 5227 break; 5228 case SPPPSETIDLETO: 5229 { 5230 struct spppidletimeout *to = (struct spppidletimeout *)data; 5231 sp->pp_idle_timeout = to->idle_seconds; 5232 } 5233 break; 5234 case SPPPSETAUTHFAILURE: 5235 { 5236 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5237 sp->pp_max_auth_fail = afsettings->max_failures; 5238 sp->pp_auth_failures = 0; 5239 } 5240 break; 5241 case SPPPGETAUTHFAILURES: 5242 { 5243 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5244 stats->auth_failures = sp->pp_auth_failures; 5245 stats->max_failures = sp->pp_max_auth_fail; 5246 } 5247 break; 5248 case SPPPSETDNSOPTS: 5249 { 5250 struct spppdnssettings *req = (struct spppdnssettings *)data; 5251 sp->query_dns = req->query_dns & 3; 5252 } 5253 break; 5254 case SPPPGETDNSOPTS: 5255 { 5256 struct spppdnssettings *req = (struct spppdnssettings *)data; 5257 req->query_dns = sp->query_dns; 5258 } 5259 break; 5260 case SPPPGETDNSADDRS: 5261 { 5262 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5263 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5264 } 5265 break; 5266 case SPPPGETKEEPALIVE: 5267 { 5268 struct spppkeepalivesettings *settings = 5269 (struct spppkeepalivesettings*)data; 5270 settings->maxalive = sp->pp_maxalive; 5271 settings->max_noreceive = sp->pp_max_noreceive; 5272 } 5273 break; 5274 case SPPPSETKEEPALIVE: 5275 { 5276 struct spppkeepalivesettings *settings = 5277 (struct spppkeepalivesettings*)data; 5278 sp->pp_maxalive = settings->maxalive; 5279 sp->pp_max_noreceive = settings->max_noreceive; 5280 } 5281 break; 5282 #if defined(COMPAT_50) || defined(MODULAR) 5283 case __SPPPGETIDLETO50: 5284 { 5285 struct spppidletimeout50 *to = (struct spppidletimeout50 *)data; 5286 to->idle_seconds = (uint32_t)sp->pp_idle_timeout; 5287 } 5288 break; 5289 case __SPPPSETIDLETO50: 5290 { 5291 struct spppidletimeout50 *to = (struct spppidletimeout50 *)data; 5292 sp->pp_idle_timeout = (time_t)to->idle_seconds; 5293 } 5294 break; 5295 case __SPPPGETKEEPALIVE50: 5296 { 5297 struct spppkeepalivesettings50 *settings = 5298 (struct spppkeepalivesettings50*)data; 5299 settings->maxalive = sp->pp_maxalive; 5300 settings->max_noreceive = (uint32_t)sp->pp_max_noreceive; 5301 } 5302 break; 5303 case __SPPPSETKEEPALIVE50: 5304 { 5305 struct spppkeepalivesettings50 *settings = 5306 (struct spppkeepalivesettings50*)data; 5307 sp->pp_maxalive = settings->maxalive; 5308 sp->pp_max_noreceive = (time_t)settings->max_noreceive; 5309 } 5310 break; 5311 #endif /* COMPAT_50 || MODULAR */ 5312 default: 5313 return (EINVAL); 5314 } 5315 5316 return (0); 5317 } 5318 5319 static void 5320 sppp_phase_network(struct sppp *sp) 5321 { 5322 STDDCL; 5323 int i; 5324 uint32_t mask; 5325 5326 sp->pp_phase = SPPP_PHASE_NETWORK; 5327 5328 if (debug) 5329 { 5330 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 5331 sppp_phase_name(sp->pp_phase)); 5332 } 5333 5334 /* Notify NCPs now. */ 5335 for (i = 0; i < IDX_COUNT; i++) 5336 if ((cps[i])->flags & CP_NCP) 5337 (cps[i])->Open(sp); 5338 5339 /* Send Up events to all NCPs. */ 5340 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5341 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5342 (cps[i])->Up(sp); 5343 5344 /* if no NCP is starting, all this was in vain, close down */ 5345 sppp_lcp_check_and_close(sp); 5346 } 5347 5348 5349 static const char * 5350 sppp_cp_type_name(u_char type) 5351 { 5352 static char buf[12]; 5353 switch (type) { 5354 case CONF_REQ: return "conf-req"; 5355 case CONF_ACK: return "conf-ack"; 5356 case CONF_NAK: return "conf-nak"; 5357 case CONF_REJ: return "conf-rej"; 5358 case TERM_REQ: return "term-req"; 5359 case TERM_ACK: return "term-ack"; 5360 case CODE_REJ: return "code-rej"; 5361 case PROTO_REJ: return "proto-rej"; 5362 case ECHO_REQ: return "echo-req"; 5363 case ECHO_REPLY: return "echo-reply"; 5364 case DISC_REQ: return "discard-req"; 5365 } 5366 snprintf(buf, sizeof(buf), "0x%x", type); 5367 return buf; 5368 } 5369 5370 static const char * 5371 sppp_auth_type_name(u_short proto, u_char type) 5372 { 5373 static char buf[12]; 5374 switch (proto) { 5375 case PPP_CHAP: 5376 switch (type) { 5377 case CHAP_CHALLENGE: return "challenge"; 5378 case CHAP_RESPONSE: return "response"; 5379 case CHAP_SUCCESS: return "success"; 5380 case CHAP_FAILURE: return "failure"; 5381 } 5382 break; 5383 case PPP_PAP: 5384 switch (type) { 5385 case PAP_REQ: return "req"; 5386 case PAP_ACK: return "ack"; 5387 case PAP_NAK: return "nak"; 5388 } 5389 break; 5390 } 5391 snprintf(buf, sizeof(buf), "0x%x", type); 5392 return buf; 5393 } 5394 5395 static const char * 5396 sppp_lcp_opt_name(u_char opt) 5397 { 5398 static char buf[12]; 5399 switch (opt) { 5400 case LCP_OPT_MRU: return "mru"; 5401 case LCP_OPT_ASYNC_MAP: return "async-map"; 5402 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5403 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5404 case LCP_OPT_MAGIC: return "magic"; 5405 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5406 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5407 } 5408 snprintf(buf, sizeof(buf), "0x%x", opt); 5409 return buf; 5410 } 5411 5412 static const char * 5413 sppp_ipcp_opt_name(u_char opt) 5414 { 5415 static char buf[12]; 5416 switch (opt) { 5417 case IPCP_OPT_ADDRESSES: return "addresses"; 5418 case IPCP_OPT_COMPRESSION: return "compression"; 5419 case IPCP_OPT_ADDRESS: return "address"; 5420 } 5421 snprintf(buf, sizeof(buf), "0x%x", opt); 5422 return buf; 5423 } 5424 5425 #ifdef INET6 5426 static const char * 5427 sppp_ipv6cp_opt_name(u_char opt) 5428 { 5429 static char buf[12]; 5430 switch (opt) { 5431 case IPV6CP_OPT_IFID: return "ifid"; 5432 case IPV6CP_OPT_COMPRESSION: return "compression"; 5433 } 5434 snprintf(buf, sizeof(buf), "0x%x", opt); 5435 return buf; 5436 } 5437 #endif 5438 5439 static const char * 5440 sppp_state_name(int state) 5441 { 5442 switch (state) { 5443 case STATE_INITIAL: return "initial"; 5444 case STATE_STARTING: return "starting"; 5445 case STATE_CLOSED: return "closed"; 5446 case STATE_STOPPED: return "stopped"; 5447 case STATE_CLOSING: return "closing"; 5448 case STATE_STOPPING: return "stopping"; 5449 case STATE_REQ_SENT: return "req-sent"; 5450 case STATE_ACK_RCVD: return "ack-rcvd"; 5451 case STATE_ACK_SENT: return "ack-sent"; 5452 case STATE_OPENED: return "opened"; 5453 } 5454 return "illegal"; 5455 } 5456 5457 static const char * 5458 sppp_phase_name(int phase) 5459 { 5460 switch (phase) { 5461 case SPPP_PHASE_DEAD: return "dead"; 5462 case SPPP_PHASE_ESTABLISH: return "establish"; 5463 case SPPP_PHASE_TERMINATE: return "terminate"; 5464 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5465 case SPPP_PHASE_NETWORK: return "network"; 5466 } 5467 return "illegal"; 5468 } 5469 5470 static const char * 5471 sppp_proto_name(u_short proto) 5472 { 5473 static char buf[12]; 5474 switch (proto) { 5475 case PPP_LCP: return "lcp"; 5476 case PPP_IPCP: return "ipcp"; 5477 case PPP_PAP: return "pap"; 5478 case PPP_CHAP: return "chap"; 5479 case PPP_IPV6CP: return "ipv6cp"; 5480 } 5481 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 5482 return buf; 5483 } 5484 5485 static void 5486 sppp_print_bytes(const u_char *p, u_short len) 5487 { 5488 addlog(" %02x", *p++); 5489 while (--len > 0) 5490 addlog("-%02x", *p++); 5491 } 5492 5493 static void 5494 sppp_print_string(const char *p, u_short len) 5495 { 5496 u_char c; 5497 5498 while (len-- > 0) { 5499 c = *p++; 5500 /* 5501 * Print only ASCII chars directly. RFC 1994 recommends 5502 * using only them, but we don't rely on it. */ 5503 if (c < ' ' || c > '~') 5504 addlog("\\x%x", c); 5505 else 5506 addlog("%c", c); 5507 } 5508 } 5509 5510 static const char * 5511 sppp_dotted_quad(uint32_t addr) 5512 { 5513 static char s[16]; 5514 snprintf(s, sizeof(s), "%d.%d.%d.%d", 5515 (int)((addr >> 24) & 0xff), 5516 (int)((addr >> 16) & 0xff), 5517 (int)((addr >> 8) & 0xff), 5518 (int)(addr & 0xff)); 5519 return s; 5520 } 5521 5522 /* a dummy, used to drop uninteresting events */ 5523 static void 5524 sppp_null(struct sppp *unused) 5525 { 5526 /* do just nothing */ 5527 } 5528 /* 5529 * This file is large. Tell emacs to highlight it nevertheless. 5530 * 5531 * Local Variables: 5532 * hilit-auto-highlight-maxout: 120000 5533 * End: 5534 */ 5535
Indexes created Fri Sep 26 08:10:20 GMT 2025