if_spppsubr.c revision 1.190
1 /* $NetBSD: if_spppsubr.c,v 1.190 2020/10/05 16:11:25 roy Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.190 2020/10/05 16:11:25 roy Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #endif 52 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 73 #include <net/if.h> 74 #include <net/netisr.h> 75 #include <net/if_types.h> 76 #include <net/route.h> 77 #include <net/ppp_defs.h> 78 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/in_var.h> 82 #ifdef INET 83 #include <netinet/ip.h> 84 #include <netinet/tcp.h> 85 #endif 86 #include <net/ethertypes.h> 87 88 #ifdef INET6 89 #include <netinet6/scope6_var.h> 90 #endif 91 92 #include <net/if_sppp.h> 93 #include <net/if_spppvar.h> 94 95 #ifdef NET_MPSAFE 96 #define SPPPSUBR_MPSAFE 1 97 #endif 98 99 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 100 #define LOOPALIVECNT 3 /* loopback detection tries */ 101 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 102 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 103 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 104 105 /* 106 * Interface flags that can be set in an ifconfig command. 107 * 108 * Setting link0 will make the link passive, i.e. it will be marked 109 * as being administrative openable, but won't be opened to begin 110 * with. Incoming calls will be answered, or subsequent calls with 111 * -link1 will cause the administrative open of the LCP layer. 112 * 113 * Setting link1 will cause the link to auto-dial only as packets 114 * arrive to be sent. 115 * 116 * Setting IFF_DEBUG will syslog the option negotiation and state 117 * transitions at level kern.debug. Note: all logs consistently look 118 * like 119 * 120 * <if-name><unit>: <proto-name> <additional info...> 121 * 122 * with <if-name><unit> being something like "bppp0", and <proto-name> 123 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 124 */ 125 126 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 127 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 128 129 #define CONF_REQ 1 /* PPP configure request */ 130 #define CONF_ACK 2 /* PPP configure acknowledge */ 131 #define CONF_NAK 3 /* PPP configure negative ack */ 132 #define CONF_REJ 4 /* PPP configure reject */ 133 #define TERM_REQ 5 /* PPP terminate request */ 134 #define TERM_ACK 6 /* PPP terminate acknowledge */ 135 #define CODE_REJ 7 /* PPP code reject */ 136 #define PROTO_REJ 8 /* PPP protocol reject */ 137 #define ECHO_REQ 9 /* PPP echo request */ 138 #define ECHO_REPLY 10 /* PPP echo reply */ 139 #define DISC_REQ 11 /* PPP discard request */ 140 141 #define LCP_OPT_MRU 1 /* maximum receive unit */ 142 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 143 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 144 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 145 #define LCP_OPT_MAGIC 5 /* magic number */ 146 #define LCP_OPT_RESERVED 6 /* reserved */ 147 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 148 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 149 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 150 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 151 #define LCP_OPT_CALL_BACK 13 /* callback */ 152 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 153 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 154 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 155 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 156 157 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 158 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 159 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 160 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 161 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 162 163 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 164 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 165 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 166 167 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 168 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 169 170 #define PAP_REQ 1 /* PAP name/password request */ 171 #define PAP_ACK 2 /* PAP acknowledge */ 172 #define PAP_NAK 3 /* PAP fail */ 173 174 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 175 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 176 #define CHAP_SUCCESS 3 /* CHAP response ok */ 177 #define CHAP_FAILURE 4 /* CHAP response failed */ 178 179 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 180 181 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 182 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 183 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 184 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 185 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 186 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 187 188 /* states are named and numbered according to RFC 1661 */ 189 #define STATE_INITIAL 0 190 #define STATE_STARTING 1 191 #define STATE_CLOSED 2 192 #define STATE_STOPPED 3 193 #define STATE_CLOSING 4 194 #define STATE_STOPPING 5 195 #define STATE_REQ_SENT 6 196 #define STATE_ACK_RCVD 7 197 #define STATE_ACK_SENT 8 198 #define STATE_OPENED 9 199 200 struct ppp_header { 201 uint8_t address; 202 uint8_t control; 203 uint16_t protocol; 204 } __packed; 205 #define PPP_HEADER_LEN sizeof (struct ppp_header) 206 207 struct lcp_header { 208 uint8_t type; 209 uint8_t ident; 210 uint16_t len; 211 } __packed; 212 #define LCP_HEADER_LEN sizeof (struct lcp_header) 213 214 struct cisco_packet { 215 uint32_t type; 216 uint32_t par1; 217 uint32_t par2; 218 uint16_t rel; 219 uint16_t time0; 220 uint16_t time1; 221 } __packed; 222 #define CISCO_PACKET_LEN 18 223 224 /* 225 * We follow the spelling and capitalization of RFC 1661 here, to make 226 * it easier comparing with the standard. Please refer to this RFC in 227 * case you can't make sense out of these abbreviation; it will also 228 * explain the semantics related to the various events and actions. 229 */ 230 struct cp { 231 u_short proto; /* PPP control protocol number */ 232 u_char protoidx; /* index into state table in struct sppp */ 233 u_char flags; 234 #define CP_LCP 0x01 /* this is the LCP */ 235 #define CP_AUTH 0x02 /* this is an authentication protocol */ 236 #define CP_NCP 0x04 /* this is a NCP */ 237 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 238 const char *name; /* name of this control protocol */ 239 /* event handlers */ 240 void (*Up)(struct sppp *sp); 241 void (*Down)(struct sppp *sp); 242 void (*Open)(struct sppp *sp); 243 void (*Close)(struct sppp *sp); 244 void (*TO)(void *sp); 245 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 246 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 247 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 248 /* actions */ 249 void (*tlu)(struct sppp *sp); 250 void (*tld)(struct sppp *sp); 251 void (*tls)(struct sppp *sp); 252 void (*tlf)(struct sppp *sp); 253 void (*scr)(struct sppp *sp); 254 }; 255 256 static struct sppp *spppq; 257 static kmutex_t *spppq_lock = NULL; 258 static callout_t keepalive_ch; 259 260 #define SPPPQ_LOCK() if (spppq_lock) \ 261 mutex_enter(spppq_lock); 262 #define SPPPQ_UNLOCK() if (spppq_lock) \ 263 mutex_exit(spppq_lock); 264 265 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 266 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 267 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 268 #define SPPP_UPGRADE(_sp) do{ \ 269 SPPP_UNLOCK(_sp); \ 270 SPPP_LOCK(_sp, RW_WRITER); \ 271 }while (0) 272 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 273 274 #ifdef INET 275 #ifndef SPPPSUBR_MPSAFE 276 /* 277 * The following disgusting hack gets around the problem that IP TOS 278 * can't be set yet. We want to put "interactive" traffic on a high 279 * priority queue. To decide if traffic is interactive, we check that 280 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 281 * 282 * XXX is this really still necessary? - joerg - 283 */ 284 static u_short interactive_ports[8] = { 285 0, 513, 0, 0, 286 0, 21, 0, 23, 287 }; 288 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 289 #endif /* SPPPSUBR_MPSAFE */ 290 #endif 291 292 /* almost every function needs these */ 293 #define STDDCL \ 294 struct ifnet *ifp = &sp->pp_if; \ 295 int debug = ifp->if_flags & IFF_DEBUG 296 297 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 298 const struct sockaddr *dst, const struct rtentry *rt); 299 300 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 301 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 302 303 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 304 struct mbuf *m); 305 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 306 u_char ident, u_short len, void *data); 307 /* static void sppp_cp_timeout(void *arg); */ 308 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 309 int newstate); 310 static void sppp_auth_send(const struct cp *cp, 311 struct sppp *sp, unsigned int type, unsigned int id, 312 ...); 313 314 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 315 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 316 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 317 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 318 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 319 320 static void sppp_null(struct sppp *sp); 321 322 static void sppp_lcp_init(struct sppp *sp); 323 static void sppp_lcp_up(struct sppp *sp); 324 static void sppp_lcp_down(struct sppp *sp); 325 static void sppp_lcp_open(struct sppp *sp); 326 static void sppp_lcp_close(struct sppp *sp); 327 static void sppp_lcp_TO(void *sp); 328 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 329 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 330 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 331 static void sppp_lcp_tlu(struct sppp *sp); 332 static void sppp_lcp_tld(struct sppp *sp); 333 static void sppp_lcp_tls(struct sppp *sp); 334 static void sppp_lcp_tlf(struct sppp *sp); 335 static void sppp_lcp_scr(struct sppp *sp); 336 static void sppp_lcp_check_and_close(struct sppp *sp); 337 static int sppp_ncp_check(struct sppp *sp); 338 339 static void sppp_ipcp_init(struct sppp *sp); 340 static void sppp_ipcp_up(struct sppp *sp); 341 static void sppp_ipcp_down(struct sppp *sp); 342 static void sppp_ipcp_open(struct sppp *sp); 343 static void sppp_ipcp_close(struct sppp *sp); 344 static void sppp_ipcp_TO(void *sp); 345 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 346 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 347 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 348 static void sppp_ipcp_tlu(struct sppp *sp); 349 static void sppp_ipcp_tld(struct sppp *sp); 350 static void sppp_ipcp_tls(struct sppp *sp); 351 static void sppp_ipcp_tlf(struct sppp *sp); 352 static void sppp_ipcp_scr(struct sppp *sp); 353 354 static void sppp_ipv6cp_init(struct sppp *sp); 355 static void sppp_ipv6cp_up(struct sppp *sp); 356 static void sppp_ipv6cp_down(struct sppp *sp); 357 static void sppp_ipv6cp_open(struct sppp *sp); 358 static void sppp_ipv6cp_close(struct sppp *sp); 359 static void sppp_ipv6cp_TO(void *sp); 360 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 361 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 362 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 363 static void sppp_ipv6cp_tlu(struct sppp *sp); 364 static void sppp_ipv6cp_tld(struct sppp *sp); 365 static void sppp_ipv6cp_tls(struct sppp *sp); 366 static void sppp_ipv6cp_tlf(struct sppp *sp); 367 static void sppp_ipv6cp_scr(struct sppp *sp); 368 369 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 370 static void sppp_pap_init(struct sppp *sp); 371 static void sppp_pap_open(struct sppp *sp); 372 static void sppp_pap_close(struct sppp *sp); 373 static void sppp_pap_TO(void *sp); 374 static void sppp_pap_my_TO(void *sp); 375 static void sppp_pap_tlu(struct sppp *sp); 376 static void sppp_pap_tld(struct sppp *sp); 377 static void sppp_pap_scr(struct sppp *sp); 378 379 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 380 static void sppp_chap_init(struct sppp *sp); 381 static void sppp_chap_open(struct sppp *sp); 382 static void sppp_chap_close(struct sppp *sp); 383 static void sppp_chap_TO(void *sp); 384 static void sppp_chap_tlu(struct sppp *sp); 385 static void sppp_chap_tld(struct sppp *sp); 386 static void sppp_chap_scr(struct sppp *sp); 387 388 static const char *sppp_auth_type_name(u_short proto, u_char type); 389 static const char *sppp_cp_type_name(u_char type); 390 static const char *sppp_dotted_quad(uint32_t addr); 391 static const char *sppp_ipcp_opt_name(u_char opt); 392 #ifdef INET6 393 static const char *sppp_ipv6cp_opt_name(u_char opt); 394 #endif 395 static const char *sppp_lcp_opt_name(u_char opt); 396 static const char *sppp_phase_name(int phase); 397 static const char *sppp_proto_name(u_short proto); 398 static const char *sppp_state_name(int state); 399 static int sppp_params(struct sppp *sp, u_long cmd, void *data); 400 #ifdef INET 401 static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, 402 uint32_t *srcmask); 403 static void sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp); 404 static void sppp_set_ip_addrs(struct sppp *sp); 405 static void sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp); 406 static void sppp_clear_ip_addrs(struct sppp *sp); 407 static void sppp_update_ip_addrs_work(struct work *wk, void *arg); 408 #endif 409 static void sppp_keepalive(void *dummy); 410 static void sppp_phase_network(struct sppp *sp); 411 static void sppp_print_bytes(const u_char *p, u_short len); 412 static void sppp_print_string(const char *p, u_short len); 413 #ifdef INET6 414 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 415 struct in6_addr *dst, struct in6_addr *srcmask); 416 #ifdef IPV6CP_MYIFID_DYN 417 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 418 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 419 #endif 420 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 421 #endif 422 423 static void sppp_notify_up(struct sppp *); 424 static void sppp_notify_down(struct sppp *); 425 static void sppp_notify_tls_wlocked(struct sppp *); 426 static void sppp_notify_tlf_wlocked(struct sppp *); 427 #ifdef INET6 428 static void sppp_notify_con_wlocked(struct sppp *); 429 #endif 430 static void sppp_notify_con(struct sppp *); 431 432 static void sppp_notify_chg_wlocked(struct sppp *); 433 434 435 /* our control protocol descriptors */ 436 static const struct cp lcp = { 437 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 438 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 439 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 440 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 441 sppp_lcp_scr 442 }; 443 444 static const struct cp ipcp = { 445 PPP_IPCP, IDX_IPCP, 446 #ifdef INET 447 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 448 #else 449 0, 450 #endif 451 "ipcp", 452 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 453 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 454 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 455 sppp_ipcp_scr 456 }; 457 458 static const struct cp ipv6cp = { 459 PPP_IPV6CP, IDX_IPV6CP, 460 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 461 CP_NCP, 462 #else 463 0, 464 #endif 465 "ipv6cp", 466 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 467 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 468 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 469 sppp_ipv6cp_scr 470 }; 471 472 static const struct cp pap = { 473 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 474 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 475 sppp_pap_TO, 0, 0, 0, 476 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 477 sppp_pap_scr 478 }; 479 480 static const struct cp chap = { 481 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 482 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 483 sppp_chap_TO, 0, 0, 0, 484 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 485 sppp_chap_scr 486 }; 487 488 static const struct cp *cps[IDX_COUNT] = { 489 &lcp, /* IDX_LCP */ 490 &ipcp, /* IDX_IPCP */ 491 &ipv6cp, /* IDX_IPV6CP */ 492 &pap, /* IDX_PAP */ 493 &chap, /* IDX_CHAP */ 494 }; 495 496 static void 497 sppp_change_phase(struct sppp *sp, int phase) 498 { 499 STDDCL; 500 501 KASSERT(SPPP_WLOCKED(sp)); 502 503 if (sp->pp_phase == phase) 504 return; 505 506 sp->pp_phase = phase; 507 508 if (phase == SPPP_PHASE_NETWORK) 509 if_link_state_change(ifp, LINK_STATE_UP); 510 else 511 if_link_state_change(ifp, LINK_STATE_DOWN); 512 513 if (debug) 514 { 515 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 516 sppp_phase_name(sp->pp_phase)); 517 } 518 } 519 520 /* 521 * Exported functions, comprising our interface to the lower layer. 522 */ 523 524 /* 525 * Process the received packet. 526 */ 527 void 528 sppp_input(struct ifnet *ifp, struct mbuf *m) 529 { 530 struct ppp_header *h = NULL; 531 pktqueue_t *pktq = NULL; 532 struct ifqueue *inq = NULL; 533 uint16_t protocol; 534 struct sppp *sp = (struct sppp *)ifp; 535 int debug = ifp->if_flags & IFF_DEBUG; 536 int isr = 0; 537 538 SPPP_LOCK(sp, RW_READER); 539 540 if (ifp->if_flags & IFF_UP) { 541 /* Count received bytes, add hardware framing */ 542 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 543 /* Note time of last receive */ 544 sp->pp_last_receive = time_uptime; 545 } 546 547 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 548 /* Too small packet, drop it. */ 549 if (debug) 550 log(LOG_DEBUG, 551 "%s: input packet is too small, %d bytes\n", 552 ifp->if_xname, m->m_pkthdr.len); 553 drop: 554 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 555 m_freem(m); 556 SPPP_UNLOCK(sp); 557 return; 558 } 559 560 if (sp->pp_flags & PP_NOFRAMING) { 561 memcpy(&protocol, mtod(m, void *), 2); 562 protocol = ntohs(protocol); 563 m_adj(m, 2); 564 } else { 565 566 /* Get PPP header. */ 567 h = mtod(m, struct ppp_header *); 568 m_adj(m, PPP_HEADER_LEN); 569 570 switch (h->address) { 571 case PPP_ALLSTATIONS: 572 if (h->control != PPP_UI) 573 goto invalid; 574 if (sp->pp_flags & PP_CISCO) { 575 if (debug) 576 log(LOG_DEBUG, 577 "%s: PPP packet in Cisco mode " 578 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 579 ifp->if_xname, 580 h->address, h->control, ntohs(h->protocol)); 581 goto drop; 582 } 583 break; 584 case CISCO_MULTICAST: 585 case CISCO_UNICAST: 586 /* Don't check the control field here (RFC 1547). */ 587 if (! (sp->pp_flags & PP_CISCO)) { 588 if (debug) 589 log(LOG_DEBUG, 590 "%s: Cisco packet in PPP mode " 591 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 592 ifp->if_xname, 593 h->address, h->control, ntohs(h->protocol)); 594 goto drop; 595 } 596 switch (ntohs(h->protocol)) { 597 default: 598 if_statinc(ifp, if_noproto); 599 goto invalid; 600 case CISCO_KEEPALIVE: 601 SPPP_UNLOCK(sp); 602 sppp_cisco_input((struct sppp *) ifp, m); 603 m_freem(m); 604 return; 605 #ifdef INET 606 case ETHERTYPE_IP: 607 pktq = ip_pktq; 608 break; 609 #endif 610 #ifdef INET6 611 case ETHERTYPE_IPV6: 612 pktq = ip6_pktq; 613 break; 614 #endif 615 } 616 goto queue_pkt; 617 default: /* Invalid PPP packet. */ 618 invalid: 619 if (debug) 620 log(LOG_DEBUG, 621 "%s: invalid input packet " 622 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 623 ifp->if_xname, 624 h->address, h->control, ntohs(h->protocol)); 625 goto drop; 626 } 627 protocol = ntohs(h->protocol); 628 } 629 630 switch (protocol) { 631 default: 632 if (sp->state[IDX_LCP] == STATE_OPENED) { 633 uint16_t prot = htons(protocol); 634 635 SPPP_UPGRADE(sp); 636 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 637 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 638 &prot); 639 SPPP_DOWNGRADE(sp); 640 } 641 if (debug) 642 log(LOG_DEBUG, 643 "%s: invalid input protocol " 644 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 645 if_statinc(ifp, if_noproto); 646 goto drop; 647 case PPP_LCP: 648 SPPP_UNLOCK(sp); 649 sppp_cp_input(&lcp, sp, m); 650 m_freem(m); 651 return; 652 case PPP_PAP: 653 SPPP_UNLOCK(sp); 654 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 655 sppp_pap_input(sp, m); 656 } 657 m_freem(m); 658 return; 659 case PPP_CHAP: 660 SPPP_UNLOCK(sp); 661 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 662 sppp_chap_input(sp, m); 663 } 664 m_freem(m); 665 return; 666 #ifdef INET 667 case PPP_IPCP: 668 SPPP_UNLOCK(sp); 669 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 670 sppp_cp_input(&ipcp, sp, m); 671 } 672 m_freem(m); 673 return; 674 case PPP_IP: 675 if (sp->state[IDX_IPCP] == STATE_OPENED) { 676 sp->pp_last_activity = time_uptime; 677 pktq = ip_pktq; 678 } 679 break; 680 #endif 681 #ifdef INET6 682 case PPP_IPV6CP: 683 SPPP_UNLOCK(sp); 684 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 685 sppp_cp_input(&ipv6cp, sp, m); 686 } 687 m_freem(m); 688 return; 689 690 case PPP_IPV6: 691 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 692 sp->pp_last_activity = time_uptime; 693 pktq = ip6_pktq; 694 } 695 break; 696 #endif 697 } 698 699 queue_pkt: 700 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 701 goto drop; 702 } 703 704 /* Check queue. */ 705 if (__predict_true(pktq)) { 706 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 707 goto drop; 708 } 709 SPPP_UNLOCK(sp); 710 return; 711 } 712 713 SPPP_UNLOCK(sp); 714 715 IFQ_LOCK(inq); 716 if (IF_QFULL(inq)) { 717 /* Queue overflow. */ 718 IF_DROP(inq); 719 IFQ_UNLOCK(inq); 720 if (debug) 721 log(LOG_DEBUG, "%s: protocol queue overflow\n", 722 ifp->if_xname); 723 724 SPPP_LOCK(sp, RW_READER); 725 goto drop; 726 } 727 IF_ENQUEUE(inq, m); 728 IFQ_UNLOCK(inq); 729 schednetisr(isr); 730 } 731 732 /* 733 * Enqueue transmit packet. 734 */ 735 static int 736 sppp_output(struct ifnet *ifp, struct mbuf *m, 737 const struct sockaddr *dst, const struct rtentry *rt) 738 { 739 struct sppp *sp = (struct sppp *) ifp; 740 struct ppp_header *h = NULL; 741 #ifndef SPPPSUBR_MPSAFE 742 struct ifqueue *ifq = NULL; /* XXX */ 743 #endif 744 int s, error = 0; 745 uint16_t protocol; 746 size_t pktlen; 747 748 s = splnet(); 749 SPPP_LOCK(sp, RW_READER); 750 751 sp->pp_last_activity = time_uptime; 752 753 if ((ifp->if_flags & IFF_UP) == 0 || 754 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 755 SPPP_UNLOCK(sp); 756 splx(s); 757 758 m_freem(m); 759 760 return (ENETDOWN); 761 } 762 763 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 764 /* 765 * Interface is not yet running, but auto-dial. Need 766 * to start LCP for it. 767 */ 768 ifp->if_flags |= IFF_RUNNING; 769 770 SPPP_UNLOCK(sp); 771 splx(s); 772 773 SPPP_LOCK(sp, RW_WRITER); 774 lcp.Open(sp); 775 SPPP_UNLOCK(sp); 776 777 s = splnet(); 778 SPPP_LOCK(sp, RW_READER); 779 } 780 781 /* 782 * If the queueing discipline needs packet classification, 783 * do it before prepending link headers. 784 */ 785 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 786 787 #ifdef INET 788 if (dst->sa_family == AF_INET) { 789 struct ip *ip = NULL; 790 #ifndef SPPPSUBR_MPSAFE 791 struct tcphdr *th = NULL; 792 #endif 793 794 if (m->m_len >= sizeof(struct ip)) { 795 ip = mtod(m, struct ip *); 796 #ifndef SPPPSUBR_MPSAFE 797 if (ip->ip_p == IPPROTO_TCP && 798 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 799 sizeof(struct tcphdr)) { 800 th = (struct tcphdr *) 801 ((char *)ip + (ip->ip_hl << 2)); 802 } 803 #endif 804 } else 805 ip = NULL; 806 807 /* 808 * When using dynamic local IP address assignment by using 809 * 0.0.0.0 as a local address, the first TCP session will 810 * not connect because the local TCP checksum is computed 811 * using 0.0.0.0 which will later become our real IP address 812 * so the TCP checksum computed at the remote end will 813 * become invalid. So we 814 * - don't let packets with src ip addr 0 thru 815 * - we flag TCP packets with src ip 0 as an error 816 */ 817 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 818 uint8_t proto = ip->ip_p; 819 820 SPPP_UNLOCK(sp); 821 splx(s); 822 823 m_freem(m); 824 if (proto == IPPROTO_TCP) 825 return (EADDRNOTAVAIL); 826 else 827 return (0); 828 } 829 830 #ifndef SPPPSUBR_MPSAFE 831 /* 832 * Put low delay, telnet, rlogin and ftp control packets 833 * in front of the queue. 834 */ 835 if (!IF_QFULL(&sp->pp_fastq) && 836 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 837 (th && (INTERACTIVE(ntohs(th->th_sport)) || 838 INTERACTIVE(ntohs(th->th_dport)))))) 839 ifq = &sp->pp_fastq; 840 #endif /* !SPPPSUBR_MPSAFE */ 841 } 842 #endif 843 844 #ifdef INET6 845 if (dst->sa_family == AF_INET6) { 846 /* XXX do something tricky here? */ 847 } 848 #endif 849 850 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 851 /* 852 * Prepend general data packet PPP header. For now, IP only. 853 */ 854 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 855 if (! m) { 856 if (ifp->if_flags & IFF_DEBUG) 857 log(LOG_DEBUG, "%s: no memory for transmit header\n", 858 ifp->if_xname); 859 if_statinc(ifp, if_oerrors); 860 SPPP_UNLOCK(sp); 861 splx(s); 862 return (ENOBUFS); 863 } 864 /* 865 * May want to check size of packet 866 * (albeit due to the implementation it's always enough) 867 */ 868 h = mtod(m, struct ppp_header *); 869 if (sp->pp_flags & PP_CISCO) { 870 h->address = CISCO_UNICAST; /* unicast address */ 871 h->control = 0; 872 } else { 873 h->address = PPP_ALLSTATIONS; /* broadcast address */ 874 h->control = PPP_UI; /* Unnumbered Info */ 875 } 876 } 877 878 switch (dst->sa_family) { 879 #ifdef INET 880 case AF_INET: /* Internet Protocol */ 881 if (sp->pp_flags & PP_CISCO) 882 protocol = htons(ETHERTYPE_IP); 883 else { 884 /* 885 * Don't choke with an ENETDOWN early. It's 886 * possible that we just started dialing out, 887 * so don't drop the packet immediately. If 888 * we notice that we run out of buffer space 889 * below, we will however remember that we are 890 * not ready to carry IP packets, and return 891 * ENETDOWN, as opposed to ENOBUFS. 892 */ 893 protocol = htons(PPP_IP); 894 if (sp->state[IDX_IPCP] != STATE_OPENED) 895 error = ENETDOWN; 896 } 897 break; 898 #endif 899 #ifdef INET6 900 case AF_INET6: /* Internet Protocol version 6 */ 901 if (sp->pp_flags & PP_CISCO) 902 protocol = htons(ETHERTYPE_IPV6); 903 else { 904 /* 905 * Don't choke with an ENETDOWN early. It's 906 * possible that we just started dialing out, 907 * so don't drop the packet immediately. If 908 * we notice that we run out of buffer space 909 * below, we will however remember that we are 910 * not ready to carry IP packets, and return 911 * ENETDOWN, as opposed to ENOBUFS. 912 */ 913 protocol = htons(PPP_IPV6); 914 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 915 error = ENETDOWN; 916 } 917 break; 918 #endif 919 default: 920 m_freem(m); 921 if_statinc(ifp, if_oerrors); 922 SPPP_UNLOCK(sp); 923 splx(s); 924 return (EAFNOSUPPORT); 925 } 926 927 if (sp->pp_flags & PP_NOFRAMING) { 928 M_PREPEND(m, 2, M_DONTWAIT); 929 if (m == NULL) { 930 if (ifp->if_flags & IFF_DEBUG) 931 log(LOG_DEBUG, "%s: no memory for transmit header\n", 932 ifp->if_xname); 933 if_statinc(ifp, if_oerrors); 934 SPPP_UNLOCK(sp); 935 splx(s); 936 return (ENOBUFS); 937 } 938 *mtod(m, uint16_t *) = protocol; 939 } else { 940 h->protocol = protocol; 941 } 942 943 pktlen = m->m_pkthdr.len; 944 #ifdef SPPPSUBR_MPSAFE 945 SPPP_UNLOCK(sp); 946 error = if_transmit_lock(ifp, m); 947 SPPP_LOCK(sp, RW_READER); 948 if (error == 0) 949 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 950 #else /* !SPPPSUBR_MPSAFE */ 951 error = ifq_enqueue2(ifp, ifq, m); 952 953 if (error == 0) { 954 /* 955 * Count output packets and bytes. 956 * The packet length includes header + additional hardware 957 * framing according to RFC 1333. 958 */ 959 if (!(ifp->if_flags & IFF_OACTIVE)) { 960 SPPP_UNLOCK(sp); 961 if_start_lock(ifp); 962 SPPP_LOCK(sp, RW_READER); 963 } 964 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 965 } 966 #endif /* !SPPPSUBR_MPSAFE */ 967 SPPP_UNLOCK(sp); 968 splx(s); 969 return error; 970 } 971 972 void 973 sppp_attach(struct ifnet *ifp) 974 { 975 struct sppp *sp = (struct sppp *) ifp; 976 977 /* Initialize keepalive handler. */ 978 if (! spppq) { 979 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 980 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 981 } 982 983 if (! spppq_lock) 984 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 985 986 /* Insert new entry into the keepalive list. */ 987 sp->pp_next = spppq; 988 spppq = sp; 989 990 sp->pp_if.if_type = IFT_PPP; 991 sp->pp_if.if_output = sppp_output; 992 sp->pp_fastq.ifq_maxlen = 32; 993 sp->pp_cpq.ifq_maxlen = 20; 994 sp->pp_loopcnt = 0; 995 sp->pp_alivecnt = 0; 996 sp->pp_last_activity = 0; 997 sp->pp_last_receive = 0; 998 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 999 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 1000 sp->pp_idle_timeout = 0; 1001 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 1002 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 1003 sp->pp_auth_failures = 0; 1004 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1005 sp->pp_phase = SPPP_PHASE_DEAD; 1006 sp->pp_up = sppp_notify_up; 1007 sp->pp_down = sppp_notify_down; 1008 rw_init(&sp->pp_lock); 1009 1010 if_alloc_sadl(ifp); 1011 1012 /* Lets not beat about the bush, we know we're down. */ 1013 ifp->if_link_state = LINK_STATE_DOWN; 1014 1015 memset(&sp->myauth, 0, sizeof sp->myauth); 1016 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1017 SPPP_LOCK(sp, RW_WRITER); 1018 sppp_lcp_init(sp); 1019 sppp_ipcp_init(sp); 1020 sppp_ipv6cp_init(sp); 1021 sppp_pap_init(sp); 1022 sppp_chap_init(sp); 1023 SPPP_UNLOCK(sp); 1024 } 1025 1026 void 1027 sppp_detach(struct ifnet *ifp) 1028 { 1029 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1030 1031 /* Remove the entry from the keepalive list. */ 1032 SPPPQ_LOCK(); 1033 for (q = &spppq; (p = *q); q = &p->pp_next) 1034 if (p == sp) { 1035 *q = p->pp_next; 1036 break; 1037 } 1038 SPPPQ_UNLOCK(); 1039 1040 if (! spppq) { 1041 /* Stop keepalive handler. */ 1042 callout_stop(&keepalive_ch); 1043 mutex_obj_free(spppq_lock); 1044 spppq_lock = NULL; 1045 } 1046 1047 SPPP_LOCK(sp, RW_WRITER); 1048 1049 /* to avoid workqueue enqueued */ 1050 atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1); 1051 workqueue_wait(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk); 1052 workqueue_destroy(sp->ipcp.update_addrs_wq); 1053 pcq_destroy(sp->ipcp.update_addrs_q); 1054 1055 callout_stop(&sp->ch[IDX_LCP]); 1056 callout_stop(&sp->ch[IDX_IPCP]); 1057 callout_stop(&sp->ch[IDX_PAP]); 1058 callout_stop(&sp->ch[IDX_CHAP]); 1059 #ifdef INET6 1060 callout_stop(&sp->ch[IDX_IPV6CP]); 1061 #endif 1062 callout_stop(&sp->pap_my_to_ch); 1063 1064 /* free authentication info */ 1065 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1066 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1067 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1068 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1069 SPPP_UNLOCK(sp); 1070 rw_destroy(&sp->pp_lock); 1071 } 1072 1073 /* 1074 * Flush the interface output queue. 1075 */ 1076 void 1077 sppp_flush(struct ifnet *ifp) 1078 { 1079 struct sppp *sp = (struct sppp *) ifp; 1080 1081 SPPP_LOCK(sp, RW_WRITER); 1082 IFQ_PURGE(&sp->pp_if.if_snd); 1083 IF_PURGE(&sp->pp_fastq); 1084 IF_PURGE(&sp->pp_cpq); 1085 SPPP_UNLOCK(sp); 1086 } 1087 1088 /* 1089 * Check if the output queue is empty. 1090 */ 1091 int 1092 sppp_isempty(struct ifnet *ifp) 1093 { 1094 struct sppp *sp = (struct sppp *) ifp; 1095 int empty, s; 1096 1097 s = splnet(); 1098 SPPP_LOCK(sp, RW_READER); 1099 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1100 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1101 SPPP_UNLOCK(sp); 1102 splx(s); 1103 return (empty); 1104 } 1105 1106 /* 1107 * Get next packet to send. 1108 */ 1109 struct mbuf * 1110 sppp_dequeue(struct ifnet *ifp) 1111 { 1112 struct sppp *sp = (struct sppp *) ifp; 1113 struct mbuf *m; 1114 int s; 1115 1116 s = splnet(); 1117 SPPP_LOCK(sp, RW_WRITER); 1118 /* 1119 * Process only the control protocol queue until we have at 1120 * least one NCP open. 1121 * 1122 * Do always serve all three queues in Cisco mode. 1123 */ 1124 IF_DEQUEUE(&sp->pp_cpq, m); 1125 if (m == NULL && 1126 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1127 IF_DEQUEUE(&sp->pp_fastq, m); 1128 if (m == NULL) 1129 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1130 } 1131 SPPP_UNLOCK(sp); 1132 splx(s); 1133 return m; 1134 } 1135 1136 /* 1137 * Process an ioctl request. Called on low priority level. 1138 */ 1139 int 1140 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1141 { 1142 struct lwp *l = curlwp; /* XXX */ 1143 struct ifreq *ifr = (struct ifreq *) data; 1144 struct ifaddr *ifa = (struct ifaddr *) data; 1145 struct sppp *sp = (struct sppp *) ifp; 1146 int s, error=0, going_up, going_down; 1147 u_short newmode; 1148 1149 s = splnet(); 1150 switch (cmd) { 1151 case SIOCINITIFADDR: 1152 ifa->ifa_rtrequest = p2p_rtrequest; 1153 break; 1154 1155 case SIOCSIFFLAGS: 1156 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1157 break; 1158 1159 SPPP_LOCK(sp, RW_WRITER); 1160 going_up = ifp->if_flags & IFF_UP && 1161 (ifp->if_flags & IFF_RUNNING) == 0; 1162 going_down = (ifp->if_flags & IFF_UP) == 0 && 1163 ifp->if_flags & IFF_RUNNING; 1164 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1165 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1166 /* sanity */ 1167 newmode = IFF_PASSIVE; 1168 ifp->if_flags &= ~IFF_AUTO; 1169 } 1170 1171 if (going_up || going_down) { 1172 lcp.Close(sp); 1173 } 1174 if (going_up && newmode == 0) { 1175 /* neither auto-dial nor passive */ 1176 ifp->if_flags |= IFF_RUNNING; 1177 if (!(sp->pp_flags & PP_CISCO)) 1178 lcp.Open(sp); 1179 } else if (going_down) { 1180 SPPP_UNLOCK(sp); 1181 sppp_flush(ifp); 1182 SPPP_LOCK(sp, RW_WRITER); 1183 1184 ifp->if_flags &= ~IFF_RUNNING; 1185 } 1186 SPPP_UNLOCK(sp); 1187 break; 1188 1189 case SIOCSIFMTU: 1190 if (ifr->ifr_mtu < PPP_MINMRU || 1191 ifr->ifr_mtu > sp->lcp.their_mru) { 1192 error = EINVAL; 1193 break; 1194 } 1195 /*FALLTHROUGH*/ 1196 case SIOCGIFMTU: 1197 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1198 error = 0; 1199 break; 1200 case SIOCADDMULTI: 1201 case SIOCDELMULTI: 1202 break; 1203 1204 case SPPPSETAUTHCFG: 1205 case SPPPSETLCPCFG: 1206 case SPPPSETIDLETO: 1207 case SPPPSETAUTHFAILURE: 1208 case SPPPSETDNSOPTS: 1209 case SPPPSETKEEPALIVE: 1210 #if defined(COMPAT_50) || defined(MODULAR) 1211 case __SPPPSETIDLETO50: 1212 case __SPPPSETKEEPALIVE50: 1213 #endif /* COMPAT_50 || MODULAR */ 1214 error = kauth_authorize_network(l->l_cred, 1215 KAUTH_NETWORK_INTERFACE, 1216 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1217 NULL); 1218 if (error) 1219 break; 1220 error = sppp_params(sp, cmd, data); 1221 break; 1222 1223 case SPPPGETAUTHCFG: 1224 case SPPPGETLCPCFG: 1225 case SPPPGETAUTHFAILURES: 1226 error = kauth_authorize_network(l->l_cred, 1227 KAUTH_NETWORK_INTERFACE, 1228 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1229 NULL); 1230 if (error) 1231 break; 1232 error = sppp_params(sp, cmd, data); 1233 break; 1234 1235 case SPPPGETSTATUS: 1236 case SPPPGETSTATUSNCP: 1237 case SPPPGETIDLETO: 1238 case SPPPGETDNSOPTS: 1239 case SPPPGETDNSADDRS: 1240 case SPPPGETKEEPALIVE: 1241 #if defined(COMPAT_50) || defined(MODULAR) 1242 case __SPPPGETIDLETO50: 1243 case __SPPPGETKEEPALIVE50: 1244 #endif /* COMPAT_50 || MODULAR */ 1245 error = sppp_params(sp, cmd, data); 1246 break; 1247 1248 default: 1249 error = ifioctl_common(ifp, cmd, data); 1250 break; 1251 } 1252 splx(s); 1253 return (error); 1254 } 1255 1256 1257 /* 1258 * Cisco framing implementation. 1259 */ 1260 1261 /* 1262 * Handle incoming Cisco keepalive protocol packets. 1263 */ 1264 static void 1265 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1266 { 1267 STDDCL; 1268 struct cisco_packet *h; 1269 #ifdef INET 1270 uint32_t me, mymask = 0; /* XXX: GCC */ 1271 #endif 1272 1273 SPPP_LOCK(sp, RW_WRITER); 1274 1275 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1276 if (debug) 1277 log(LOG_DEBUG, 1278 "%s: cisco invalid packet length: %d bytes\n", 1279 ifp->if_xname, m->m_pkthdr.len); 1280 SPPP_UNLOCK(sp); 1281 return; 1282 } 1283 h = mtod(m, struct cisco_packet *); 1284 if (debug) 1285 log(LOG_DEBUG, 1286 "%s: cisco input: %d bytes " 1287 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1288 ifp->if_xname, m->m_pkthdr.len, 1289 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1290 (u_int)h->time0, (u_int)h->time1); 1291 switch (ntohl(h->type)) { 1292 default: 1293 if (debug) 1294 addlog("%s: cisco unknown packet type: 0x%x\n", 1295 ifp->if_xname, ntohl(h->type)); 1296 break; 1297 case CISCO_ADDR_REPLY: 1298 /* Reply on address request, ignore */ 1299 break; 1300 case CISCO_KEEPALIVE_REQ: 1301 sp->pp_alivecnt = 0; 1302 sp->pp_rseq[IDX_LCP] = ntohl(h->par1); 1303 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1304 /* Local and remote sequence numbers are equal. 1305 * Probably, the line is in loopback mode. */ 1306 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1307 printf ("%s: loopback\n", 1308 ifp->if_xname); 1309 sp->pp_loopcnt = 0; 1310 if (ifp->if_flags & IFF_UP) { 1311 SPPP_UNLOCK(sp); 1312 if_down(ifp); 1313 SPPP_LOCK(sp, RW_WRITER); 1314 1315 IF_PURGE(&sp->pp_cpq); 1316 } 1317 } 1318 ++sp->pp_loopcnt; 1319 1320 /* Generate new local sequence number */ 1321 sp->pp_seq[IDX_LCP] = cprng_fast32(); 1322 break; 1323 } 1324 sp->pp_loopcnt = 0; 1325 if (! (ifp->if_flags & IFF_UP) && 1326 (ifp->if_flags & IFF_RUNNING)) { 1327 SPPP_UNLOCK(sp); 1328 if_up(ifp); 1329 SPPP_LOCK(sp, RW_WRITER); 1330 } 1331 break; 1332 case CISCO_ADDR_REQ: 1333 #ifdef INET 1334 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1335 if (me != 0L) 1336 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1337 #endif 1338 break; 1339 } 1340 SPPP_UNLOCK(sp); 1341 } 1342 1343 /* 1344 * Send Cisco keepalive packet. 1345 */ 1346 static void 1347 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1348 { 1349 STDDCL; 1350 struct ppp_header *h; 1351 struct cisco_packet *ch; 1352 struct mbuf *m; 1353 uint32_t t; 1354 1355 KASSERT(SPPP_WLOCKED(sp)); 1356 1357 t = time_uptime * 1000; 1358 MGETHDR(m, M_DONTWAIT, MT_DATA); 1359 if (! m) 1360 return; 1361 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1362 m_reset_rcvif(m); 1363 1364 h = mtod(m, struct ppp_header *); 1365 h->address = CISCO_MULTICAST; 1366 h->control = 0; 1367 h->protocol = htons(CISCO_KEEPALIVE); 1368 1369 ch = (struct cisco_packet *)(h + 1); 1370 ch->type = htonl(type); 1371 ch->par1 = htonl(par1); 1372 ch->par2 = htonl(par2); 1373 ch->rel = -1; 1374 1375 ch->time0 = htons((u_short)(t >> 16)); 1376 ch->time1 = htons((u_short) t); 1377 1378 if (debug) 1379 log(LOG_DEBUG, 1380 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1381 ifp->if_xname, ntohl(ch->type), ch->par1, 1382 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1383 (u_int)ch->time1); 1384 1385 if (IF_QFULL(&sp->pp_cpq)) { 1386 IF_DROP(&sp->pp_fastq); 1387 IF_DROP(&ifp->if_snd); 1388 m_freem(m); 1389 if_statinc(ifp, if_oerrors); 1390 return; 1391 } 1392 1393 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1394 IF_ENQUEUE(&sp->pp_cpq, m); 1395 1396 if (! (ifp->if_flags & IFF_OACTIVE)) { 1397 SPPP_UNLOCK(sp); 1398 if_start_lock(ifp); 1399 SPPP_LOCK(sp, RW_WRITER); 1400 } 1401 } 1402 1403 /* 1404 * PPP protocol implementation. 1405 */ 1406 1407 /* 1408 * Send PPP control protocol packet. 1409 */ 1410 static void 1411 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1412 u_char ident, u_short len, void *data) 1413 { 1414 STDDCL; 1415 struct lcp_header *lh; 1416 struct mbuf *m; 1417 size_t pkthdrlen; 1418 1419 KASSERT(SPPP_WLOCKED(sp)); 1420 1421 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1422 1423 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1424 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1425 MGETHDR(m, M_DONTWAIT, MT_DATA); 1426 if (! m) { 1427 return; 1428 } 1429 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1430 m_reset_rcvif(m); 1431 1432 if (sp->pp_flags & PP_NOFRAMING) { 1433 *mtod(m, uint16_t *) = htons(proto); 1434 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1435 } else { 1436 struct ppp_header *h; 1437 h = mtod(m, struct ppp_header *); 1438 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1439 h->control = PPP_UI; /* Unnumbered Info */ 1440 h->protocol = htons(proto); /* Link Control Protocol */ 1441 lh = (struct lcp_header *)(h + 1); 1442 } 1443 lh->type = type; 1444 lh->ident = ident; 1445 lh->len = htons(LCP_HEADER_LEN + len); 1446 if (len) 1447 memcpy(lh + 1, data, len); 1448 1449 if (debug) { 1450 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1451 ifp->if_xname, 1452 sppp_proto_name(proto), 1453 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1454 if (len) 1455 sppp_print_bytes((u_char *)(lh + 1), len); 1456 addlog(">\n"); 1457 } 1458 if (IF_QFULL(&sp->pp_cpq)) { 1459 IF_DROP(&sp->pp_fastq); 1460 IF_DROP(&ifp->if_snd); 1461 m_freem(m); 1462 if_statinc(ifp, if_oerrors); 1463 return; 1464 } 1465 1466 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1467 IF_ENQUEUE(&sp->pp_cpq, m); 1468 1469 1470 if (! (ifp->if_flags & IFF_OACTIVE)) { 1471 SPPP_UNLOCK(sp); 1472 if_start_lock(ifp); 1473 SPPP_LOCK(sp, RW_WRITER); 1474 } 1475 } 1476 1477 /* 1478 * Handle incoming PPP control protocol packets. 1479 */ 1480 static void 1481 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1482 { 1483 STDDCL; 1484 struct lcp_header *h; 1485 int printlen, len = m->m_pkthdr.len; 1486 int rv; 1487 u_char *p; 1488 uint32_t u32; 1489 1490 SPPP_LOCK(sp, RW_WRITER); 1491 1492 if (len < 4) { 1493 if (debug) 1494 log(LOG_DEBUG, 1495 "%s: %s invalid packet length: %d bytes\n", 1496 ifp->if_xname, cp->name, len); 1497 SPPP_UNLOCK(sp); 1498 return; 1499 } 1500 h = mtod(m, struct lcp_header *); 1501 if (debug) { 1502 printlen = ntohs(h->len); 1503 log(LOG_DEBUG, 1504 "%s: %s input(%s): <%s id=0x%x len=%d", 1505 ifp->if_xname, cp->name, 1506 sppp_state_name(sp->state[cp->protoidx]), 1507 sppp_cp_type_name(h->type), h->ident, printlen); 1508 if (len < printlen) 1509 printlen = len; 1510 if (printlen > 4) 1511 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1512 addlog(">\n"); 1513 } 1514 if (len > ntohs(h->len)) 1515 len = ntohs(h->len); 1516 p = (u_char *)(h + 1); 1517 switch (h->type) { 1518 case CONF_REQ: 1519 if (len < 4) { 1520 if (debug) 1521 addlog("%s: %s invalid conf-req length %d\n", 1522 ifp->if_xname, cp->name, 1523 len); 1524 if_statinc(ifp, if_ierrors); 1525 break; 1526 } 1527 /* handle states where RCR doesn't get a SCA/SCN */ 1528 switch (sp->state[cp->protoidx]) { 1529 case STATE_CLOSING: 1530 case STATE_STOPPING: 1531 SPPP_UNLOCK(sp); 1532 return; 1533 case STATE_CLOSED: 1534 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1535 0, 0); 1536 SPPP_UNLOCK(sp); 1537 return; 1538 } 1539 rv = (cp->RCR)(sp, h, len); 1540 if (rv < 0) { 1541 /* fatal error, shut down */ 1542 (cp->tld)(sp); 1543 sppp_lcp_tlf(sp); 1544 SPPP_UNLOCK(sp); 1545 return; 1546 } 1547 switch (sp->state[cp->protoidx]) { 1548 case STATE_OPENED: 1549 (cp->tld)(sp); 1550 (cp->scr)(sp); 1551 /* fall through... */ 1552 case STATE_ACK_SENT: 1553 case STATE_REQ_SENT: 1554 sppp_cp_change_state(cp, sp, rv? 1555 STATE_ACK_SENT: STATE_REQ_SENT); 1556 break; 1557 case STATE_STOPPED: 1558 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1559 (cp->scr)(sp); 1560 sppp_cp_change_state(cp, sp, rv? 1561 STATE_ACK_SENT: STATE_REQ_SENT); 1562 break; 1563 case STATE_ACK_RCVD: 1564 if (rv) { 1565 sppp_cp_change_state(cp, sp, STATE_OPENED); 1566 if (debug) 1567 log(LOG_DEBUG, "%s: %s tlu\n", 1568 ifp->if_xname, 1569 cp->name); 1570 (cp->tlu)(sp); 1571 } else 1572 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1573 break; 1574 default: 1575 printf("%s: %s illegal %s in state %s\n", 1576 ifp->if_xname, cp->name, 1577 sppp_cp_type_name(h->type), 1578 sppp_state_name(sp->state[cp->protoidx])); 1579 if_statinc(ifp, if_ierrors); 1580 } 1581 break; 1582 case CONF_ACK: 1583 if (h->ident != sp->confid[cp->protoidx]) { 1584 if (debug) 1585 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1586 ifp->if_xname, cp->name, 1587 h->ident, sp->confid[cp->protoidx]); 1588 if_statinc(ifp, if_ierrors); 1589 break; 1590 } 1591 switch (sp->state[cp->protoidx]) { 1592 case STATE_CLOSED: 1593 case STATE_STOPPED: 1594 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1595 break; 1596 case STATE_CLOSING: 1597 case STATE_STOPPING: 1598 break; 1599 case STATE_REQ_SENT: 1600 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1601 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1602 break; 1603 case STATE_OPENED: 1604 (cp->tld)(sp); 1605 /* fall through */ 1606 case STATE_ACK_RCVD: 1607 (cp->scr)(sp); 1608 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1609 break; 1610 case STATE_ACK_SENT: 1611 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1612 sppp_cp_change_state(cp, sp, STATE_OPENED); 1613 if (debug) 1614 log(LOG_DEBUG, "%s: %s tlu\n", 1615 ifp->if_xname, cp->name); 1616 (cp->tlu)(sp); 1617 break; 1618 default: 1619 printf("%s: %s illegal %s in state %s\n", 1620 ifp->if_xname, cp->name, 1621 sppp_cp_type_name(h->type), 1622 sppp_state_name(sp->state[cp->protoidx])); 1623 if_statinc(ifp, if_ierrors); 1624 } 1625 break; 1626 case CONF_NAK: 1627 case CONF_REJ: 1628 if (h->ident != sp->confid[cp->protoidx]) { 1629 if (debug) 1630 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1631 ifp->if_xname, cp->name, 1632 h->ident, sp->confid[cp->protoidx]); 1633 if_statinc(ifp, if_ierrors); 1634 break; 1635 } 1636 if (h->type == CONF_NAK) 1637 (cp->RCN_nak)(sp, h, len); 1638 else /* CONF_REJ */ 1639 (cp->RCN_rej)(sp, h, len); 1640 1641 switch (sp->state[cp->protoidx]) { 1642 case STATE_CLOSED: 1643 case STATE_STOPPED: 1644 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1645 break; 1646 case STATE_REQ_SENT: 1647 case STATE_ACK_SENT: 1648 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1649 (cp->scr)(sp); 1650 break; 1651 case STATE_OPENED: 1652 (cp->tld)(sp); 1653 /* fall through */ 1654 case STATE_ACK_RCVD: 1655 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1656 (cp->scr)(sp); 1657 break; 1658 case STATE_CLOSING: 1659 case STATE_STOPPING: 1660 break; 1661 default: 1662 printf("%s: %s illegal %s in state %s\n", 1663 ifp->if_xname, cp->name, 1664 sppp_cp_type_name(h->type), 1665 sppp_state_name(sp->state[cp->protoidx])); 1666 if_statinc(ifp, if_ierrors); 1667 } 1668 break; 1669 1670 case TERM_REQ: 1671 switch (sp->state[cp->protoidx]) { 1672 case STATE_ACK_RCVD: 1673 case STATE_ACK_SENT: 1674 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1675 /* fall through */ 1676 case STATE_CLOSED: 1677 case STATE_STOPPED: 1678 case STATE_CLOSING: 1679 case STATE_STOPPING: 1680 case STATE_REQ_SENT: 1681 sta: 1682 /* Send Terminate-Ack packet. */ 1683 if (debug) 1684 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 1685 ifp->if_xname, cp->name); 1686 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1687 break; 1688 case STATE_OPENED: 1689 (cp->tld)(sp); 1690 sp->rst_counter[cp->protoidx] = 0; 1691 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1692 goto sta; 1693 default: 1694 printf("%s: %s illegal %s in state %s\n", 1695 ifp->if_xname, cp->name, 1696 sppp_cp_type_name(h->type), 1697 sppp_state_name(sp->state[cp->protoidx])); 1698 if_statinc(ifp, if_ierrors); 1699 } 1700 break; 1701 case TERM_ACK: 1702 switch (sp->state[cp->protoidx]) { 1703 case STATE_CLOSED: 1704 case STATE_STOPPED: 1705 case STATE_REQ_SENT: 1706 case STATE_ACK_SENT: 1707 break; 1708 case STATE_CLOSING: 1709 (cp->tlf)(sp); 1710 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1711 sppp_lcp_check_and_close(sp); 1712 break; 1713 case STATE_STOPPING: 1714 (cp->tlf)(sp); 1715 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1716 sppp_lcp_check_and_close(sp); 1717 break; 1718 case STATE_ACK_RCVD: 1719 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1720 break; 1721 case STATE_OPENED: 1722 (cp->tld)(sp); 1723 (cp->scr)(sp); 1724 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1725 break; 1726 default: 1727 printf("%s: %s illegal %s in state %s\n", 1728 ifp->if_xname, cp->name, 1729 sppp_cp_type_name(h->type), 1730 sppp_state_name(sp->state[cp->protoidx])); 1731 if_statinc(ifp, if_ierrors); 1732 } 1733 break; 1734 case CODE_REJ: 1735 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1736 log(LOG_INFO, 1737 "%s: %s: ignoring RXJ (%s) for code ?, " 1738 "danger will robinson\n", 1739 ifp->if_xname, cp->name, 1740 sppp_cp_type_name(h->type)); 1741 switch (sp->state[cp->protoidx]) { 1742 case STATE_CLOSED: 1743 case STATE_STOPPED: 1744 case STATE_REQ_SENT: 1745 case STATE_ACK_SENT: 1746 case STATE_CLOSING: 1747 case STATE_STOPPING: 1748 case STATE_OPENED: 1749 break; 1750 case STATE_ACK_RCVD: 1751 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1752 break; 1753 default: 1754 printf("%s: %s illegal %s in state %s\n", 1755 ifp->if_xname, cp->name, 1756 sppp_cp_type_name(h->type), 1757 sppp_state_name(sp->state[cp->protoidx])); 1758 if_statinc(ifp, if_ierrors); 1759 } 1760 break; 1761 case PROTO_REJ: 1762 { 1763 int catastrophic; 1764 const struct cp *upper; 1765 int i; 1766 uint16_t proto; 1767 1768 catastrophic = 0; 1769 upper = NULL; 1770 proto = p[0] << 8 | p[1]; 1771 for (i = 0; i < IDX_COUNT; i++) { 1772 if (cps[i]->proto == proto) { 1773 upper = cps[i]; 1774 break; 1775 } 1776 } 1777 if (upper == NULL) 1778 catastrophic++; 1779 1780 if (debug) 1781 log(LOG_INFO, 1782 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1783 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1784 sppp_cp_type_name(h->type), proto, 1785 upper ? upper->name : "unknown", 1786 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1787 1788 /* 1789 * if we got RXJ+ against conf-req, the peer does not implement 1790 * this particular protocol type. terminate the protocol. 1791 */ 1792 if (upper && !catastrophic) { 1793 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1794 upper->Close(sp); 1795 break; 1796 } 1797 } 1798 1799 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1800 switch (sp->state[cp->protoidx]) { 1801 case STATE_CLOSED: 1802 case STATE_STOPPED: 1803 case STATE_REQ_SENT: 1804 case STATE_ACK_SENT: 1805 case STATE_CLOSING: 1806 case STATE_STOPPING: 1807 case STATE_OPENED: 1808 break; 1809 case STATE_ACK_RCVD: 1810 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1811 break; 1812 default: 1813 printf("%s: %s illegal %s in state %s\n", 1814 ifp->if_xname, cp->name, 1815 sppp_cp_type_name(h->type), 1816 sppp_state_name(sp->state[cp->protoidx])); 1817 if_statinc(ifp, if_ierrors); 1818 } 1819 break; 1820 } 1821 case DISC_REQ: 1822 if (cp->proto != PPP_LCP) 1823 goto illegal; 1824 /* Discard the packet. */ 1825 break; 1826 case ECHO_REQ: 1827 if (cp->proto != PPP_LCP) 1828 goto illegal; 1829 if (sp->state[cp->protoidx] != STATE_OPENED) { 1830 if (debug) 1831 addlog("%s: lcp echo req but lcp closed\n", 1832 ifp->if_xname); 1833 if_statinc(ifp, if_ierrors); 1834 break; 1835 } 1836 if (len < 8) { 1837 if (debug) 1838 addlog("%s: invalid lcp echo request " 1839 "packet length: %d bytes\n", 1840 ifp->if_xname, len); 1841 break; 1842 } 1843 memcpy(&u32, h + 1, sizeof u32); 1844 if (ntohl(u32) == sp->lcp.magic) { 1845 /* Line loopback mode detected. */ 1846 printf("%s: loopback\n", ifp->if_xname); 1847 SPPP_UNLOCK(sp); 1848 if_down(ifp); 1849 SPPP_LOCK(sp, RW_WRITER); 1850 1851 IF_PURGE(&sp->pp_cpq); 1852 1853 /* Shut down the PPP link. */ 1854 /* XXX */ 1855 lcp.Down(sp); 1856 lcp.Up(sp); 1857 break; 1858 } 1859 u32 = htonl(sp->lcp.magic); 1860 memcpy(h + 1, &u32, sizeof u32); 1861 if (debug) 1862 addlog("%s: got lcp echo req, sending echo rep\n", 1863 ifp->if_xname); 1864 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1865 h + 1); 1866 break; 1867 case ECHO_REPLY: 1868 if (cp->proto != PPP_LCP) 1869 goto illegal; 1870 if (h->ident != sp->lcp.echoid) { 1871 if_statinc(ifp, if_ierrors); 1872 break; 1873 } 1874 if (len < 8) { 1875 if (debug) 1876 addlog("%s: lcp invalid echo reply " 1877 "packet length: %d bytes\n", 1878 ifp->if_xname, len); 1879 break; 1880 } 1881 if (debug) 1882 addlog("%s: lcp got echo rep\n", 1883 ifp->if_xname); 1884 memcpy(&u32, h + 1, sizeof u32); 1885 if (ntohl(u32) != sp->lcp.magic) 1886 sp->pp_alivecnt = 0; 1887 break; 1888 default: 1889 /* Unknown packet type -- send Code-Reject packet. */ 1890 illegal: 1891 if (debug) 1892 addlog("%s: %s send code-rej for 0x%x\n", 1893 ifp->if_xname, cp->name, h->type); 1894 sppp_cp_send(sp, cp->proto, CODE_REJ, 1895 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1896 if_statinc(ifp, if_ierrors); 1897 } 1898 1899 SPPP_UNLOCK(sp); 1900 } 1901 1902 1903 /* 1904 * The generic part of all Up/Down/Open/Close/TO event handlers. 1905 * Basically, the state transition handling in the automaton. 1906 */ 1907 static void 1908 sppp_up_event(const struct cp *cp, struct sppp *sp) 1909 { 1910 STDDCL; 1911 1912 KASSERT(SPPP_WLOCKED(sp)); 1913 1914 if (debug) 1915 log(LOG_DEBUG, "%s: %s up(%s)\n", 1916 ifp->if_xname, cp->name, 1917 sppp_state_name(sp->state[cp->protoidx])); 1918 1919 switch (sp->state[cp->protoidx]) { 1920 case STATE_INITIAL: 1921 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1922 break; 1923 case STATE_STARTING: 1924 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1925 (cp->scr)(sp); 1926 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1927 break; 1928 default: 1929 printf("%s: %s illegal up in state %s\n", 1930 ifp->if_xname, cp->name, 1931 sppp_state_name(sp->state[cp->protoidx])); 1932 } 1933 } 1934 1935 static void 1936 sppp_down_event(const struct cp *cp, struct sppp *sp) 1937 { 1938 STDDCL; 1939 1940 KASSERT(SPPP_WLOCKED(sp)); 1941 1942 if (debug) 1943 log(LOG_DEBUG, "%s: %s down(%s)\n", 1944 ifp->if_xname, cp->name, 1945 sppp_state_name(sp->state[cp->protoidx])); 1946 1947 switch (sp->state[cp->protoidx]) { 1948 case STATE_CLOSED: 1949 case STATE_CLOSING: 1950 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1951 break; 1952 case STATE_STOPPED: 1953 (cp->tls)(sp); 1954 /* fall through */ 1955 case STATE_STOPPING: 1956 case STATE_REQ_SENT: 1957 case STATE_ACK_RCVD: 1958 case STATE_ACK_SENT: 1959 sppp_cp_change_state(cp, sp, STATE_STARTING); 1960 break; 1961 case STATE_OPENED: 1962 (cp->tld)(sp); 1963 sppp_cp_change_state(cp, sp, STATE_STARTING); 1964 break; 1965 default: 1966 printf("%s: %s illegal down in state %s\n", 1967 ifp->if_xname, cp->name, 1968 sppp_state_name(sp->state[cp->protoidx])); 1969 } 1970 } 1971 1972 1973 static void 1974 sppp_open_event(const struct cp *cp, struct sppp *sp) 1975 { 1976 STDDCL; 1977 1978 KASSERT(SPPP_WLOCKED(sp)); 1979 1980 if (debug) 1981 log(LOG_DEBUG, "%s: %s open(%s)\n", 1982 ifp->if_xname, cp->name, 1983 sppp_state_name(sp->state[cp->protoidx])); 1984 1985 switch (sp->state[cp->protoidx]) { 1986 case STATE_INITIAL: 1987 sppp_cp_change_state(cp, sp, STATE_STARTING); 1988 (cp->tls)(sp); 1989 break; 1990 case STATE_STARTING: 1991 break; 1992 case STATE_CLOSED: 1993 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1994 (cp->scr)(sp); 1995 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1996 break; 1997 case STATE_STOPPED: 1998 case STATE_STOPPING: 1999 case STATE_REQ_SENT: 2000 case STATE_ACK_RCVD: 2001 case STATE_ACK_SENT: 2002 case STATE_OPENED: 2003 break; 2004 case STATE_CLOSING: 2005 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2006 break; 2007 } 2008 } 2009 2010 2011 static void 2012 sppp_close_event(const struct cp *cp, struct sppp *sp) 2013 { 2014 STDDCL; 2015 2016 KASSERT(SPPP_WLOCKED(sp)); 2017 2018 if (debug) 2019 log(LOG_DEBUG, "%s: %s close(%s)\n", 2020 ifp->if_xname, cp->name, 2021 sppp_state_name(sp->state[cp->protoidx])); 2022 2023 switch (sp->state[cp->protoidx]) { 2024 case STATE_INITIAL: 2025 case STATE_CLOSED: 2026 case STATE_CLOSING: 2027 break; 2028 case STATE_STARTING: 2029 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2030 (cp->tlf)(sp); 2031 break; 2032 case STATE_STOPPED: 2033 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2034 break; 2035 case STATE_STOPPING: 2036 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2037 break; 2038 case STATE_OPENED: 2039 (cp->tld)(sp); 2040 /* fall through */ 2041 case STATE_REQ_SENT: 2042 case STATE_ACK_RCVD: 2043 case STATE_ACK_SENT: 2044 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 2045 sppp_cp_send(sp, cp->proto, TERM_REQ, 2046 ++sp->pp_seq[cp->protoidx], 0, 0); 2047 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2048 break; 2049 } 2050 } 2051 2052 static void 2053 sppp_to_event(const struct cp *cp, struct sppp *sp) 2054 { 2055 STDDCL; 2056 int s; 2057 2058 KASSERT(SPPP_WLOCKED(sp)); 2059 2060 s = splnet(); 2061 2062 if (debug) 2063 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 2064 ifp->if_xname, cp->name, 2065 sppp_state_name(sp->state[cp->protoidx]), 2066 sp->rst_counter[cp->protoidx]); 2067 2068 if (--sp->rst_counter[cp->protoidx] < 0) 2069 /* TO- event */ 2070 switch (sp->state[cp->protoidx]) { 2071 case STATE_CLOSING: 2072 (cp->tlf)(sp); 2073 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2074 sppp_lcp_check_and_close(sp); 2075 break; 2076 case STATE_STOPPING: 2077 (cp->tlf)(sp); 2078 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2079 sppp_lcp_check_and_close(sp); 2080 break; 2081 case STATE_REQ_SENT: 2082 case STATE_ACK_RCVD: 2083 case STATE_ACK_SENT: 2084 (cp->tlf)(sp); 2085 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2086 sppp_lcp_check_and_close(sp); 2087 break; 2088 } 2089 else 2090 /* TO+ event */ 2091 switch (sp->state[cp->protoidx]) { 2092 case STATE_CLOSING: 2093 case STATE_STOPPING: 2094 sppp_cp_send(sp, cp->proto, TERM_REQ, 2095 ++sp->pp_seq[cp->protoidx], 0, 0); 2096 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2097 cp->TO, sp); 2098 break; 2099 case STATE_REQ_SENT: 2100 case STATE_ACK_RCVD: 2101 (cp->scr)(sp); 2102 /* sppp_cp_change_state() will restart the timer */ 2103 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2104 break; 2105 case STATE_ACK_SENT: 2106 (cp->scr)(sp); 2107 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2108 cp->TO, sp); 2109 break; 2110 } 2111 2112 splx(s); 2113 } 2114 2115 /* 2116 * Change the state of a control protocol in the state automaton. 2117 * Takes care of starting/stopping the restart timer. 2118 */ 2119 void 2120 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2121 { 2122 2123 KASSERT(SPPP_WLOCKED(sp)); 2124 2125 sp->state[cp->protoidx] = newstate; 2126 callout_stop(&sp->ch[cp->protoidx]); 2127 switch (newstate) { 2128 case STATE_INITIAL: 2129 case STATE_STARTING: 2130 case STATE_CLOSED: 2131 case STATE_STOPPED: 2132 case STATE_OPENED: 2133 break; 2134 case STATE_CLOSING: 2135 case STATE_STOPPING: 2136 case STATE_REQ_SENT: 2137 case STATE_ACK_RCVD: 2138 case STATE_ACK_SENT: 2139 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2140 cp->TO, sp); 2141 break; 2142 } 2143 } 2144 2145 /* 2146 *--------------------------------------------------------------------------* 2147 * * 2148 * The LCP implementation. * 2149 * * 2150 *--------------------------------------------------------------------------* 2151 */ 2152 static void 2153 sppp_lcp_init(struct sppp *sp) 2154 { 2155 2156 KASSERT(SPPP_WLOCKED(sp)); 2157 2158 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2159 sp->lcp.magic = 0; 2160 sp->state[IDX_LCP] = STATE_INITIAL; 2161 sp->fail_counter[IDX_LCP] = 0; 2162 sp->pp_seq[IDX_LCP] = 0; 2163 sp->pp_rseq[IDX_LCP] = 0; 2164 sp->lcp.protos = 0; 2165 2166 /* 2167 * Initialize counters and timeout values. Note that we don't 2168 * use the 3 seconds suggested in RFC 1661 since we are likely 2169 * running on a fast link. XXX We should probably implement 2170 * the exponential backoff option. Note that these values are 2171 * relevant for all control protocols, not just LCP only. 2172 */ 2173 sp->lcp.timeout = 1 * hz; 2174 sp->lcp.max_terminate = 2; 2175 sp->lcp.max_configure = 10; 2176 sp->lcp.max_failure = 10; 2177 callout_init(&sp->ch[IDX_LCP], CALLOUT_MPSAFE); 2178 } 2179 2180 static void 2181 sppp_lcp_up(struct sppp *sp) 2182 { 2183 STDDCL; 2184 2185 KASSERT(SPPP_WLOCKED(sp)); 2186 2187 /* Initialize activity timestamp: opening a connection is an activity */ 2188 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2189 2190 /* 2191 * If this interface is passive or dial-on-demand, and we are 2192 * still in Initial state, it means we've got an incoming 2193 * call. Activate the interface. 2194 */ 2195 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2196 if (debug) 2197 log(LOG_DEBUG, 2198 "%s: Up event", ifp->if_xname); 2199 ifp->if_flags |= IFF_RUNNING; 2200 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2201 if (debug) 2202 addlog("(incoming call)\n"); 2203 sp->pp_flags |= PP_CALLIN; 2204 lcp.Open(sp); 2205 } else if (debug) 2206 addlog("\n"); 2207 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2208 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2209 ifp->if_flags |= IFF_RUNNING; 2210 lcp.Open(sp); 2211 } 2212 2213 sppp_up_event(&lcp, sp); 2214 } 2215 2216 static void 2217 sppp_lcp_down(struct sppp *sp) 2218 { 2219 STDDCL; 2220 2221 KASSERT(SPPP_WLOCKED(sp)); 2222 2223 sppp_down_event(&lcp, sp); 2224 2225 /* 2226 * If this is neither a dial-on-demand nor a passive 2227 * interface, simulate an ``ifconfig down'' action, so the 2228 * administrator can force a redial by another ``ifconfig 2229 * up''. XXX For leased line operation, should we immediately 2230 * try to reopen the connection here? 2231 */ 2232 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2233 if (debug) 2234 log(LOG_INFO, 2235 "%s: Down event (carrier loss), taking interface down.\n", 2236 ifp->if_xname); 2237 SPPP_UNLOCK(sp); 2238 if_down(ifp); 2239 SPPP_LOCK(sp, RW_WRITER); 2240 } else { 2241 if (debug) 2242 log(LOG_DEBUG, 2243 "%s: Down event (carrier loss)\n", 2244 ifp->if_xname); 2245 } 2246 sp->fail_counter[IDX_LCP] = 0; 2247 sp->pp_flags &= ~PP_CALLIN; 2248 if (sp->state[IDX_LCP] != STATE_INITIAL) 2249 lcp.Close(sp); 2250 ifp->if_flags &= ~IFF_RUNNING; 2251 } 2252 2253 static void 2254 sppp_lcp_open(struct sppp *sp) 2255 { 2256 2257 KASSERT(SPPP_WLOCKED(sp)); 2258 2259 if (sp->pp_if.if_mtu < PP_MTU) { 2260 sp->lcp.mru = sp->pp_if.if_mtu; 2261 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2262 } else 2263 sp->lcp.mru = PP_MTU; 2264 sp->lcp.their_mru = PP_MTU; 2265 2266 /* 2267 * If we are authenticator, negotiate LCP_AUTH 2268 */ 2269 if (sp->hisauth.proto != 0) 2270 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2271 else 2272 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2273 sp->pp_flags &= ~PP_NEEDAUTH; 2274 sppp_open_event(&lcp, sp); 2275 } 2276 2277 static void 2278 sppp_lcp_close(struct sppp *sp) 2279 { 2280 2281 KASSERT(SPPP_WLOCKED(sp)); 2282 sppp_close_event(&lcp, sp); 2283 } 2284 2285 static void 2286 sppp_lcp_TO(void *cookie) 2287 { 2288 struct sppp *sp = (struct sppp*)cookie; 2289 2290 SPPP_LOCK(sp, RW_WRITER); 2291 sppp_to_event(&lcp, sp); 2292 SPPP_UNLOCK(sp); 2293 } 2294 2295 /* 2296 * Analyze a configure request. Return true if it was agreeable, and 2297 * caused action sca, false if it has been rejected or nak'ed, and 2298 * caused action scn. (The return value is used to make the state 2299 * transition decision in the state automaton.) 2300 */ 2301 static int 2302 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2303 { 2304 STDDCL; 2305 u_char *buf, *r, *p, l, blen; 2306 int origlen, rlen; 2307 uint32_t nmagic; 2308 u_short authproto; 2309 2310 KASSERT(SPPP_WLOCKED(sp)); 2311 2312 len -= 4; 2313 origlen = len; 2314 buf = r = malloc (blen = len, M_TEMP, M_NOWAIT); 2315 if (! buf) 2316 return (0); 2317 2318 if (debug) 2319 log(LOG_DEBUG, "%s: lcp parse opts:", 2320 ifp->if_xname); 2321 2322 /* pass 1: check for things that need to be rejected */ 2323 p = (void *)(h + 1); 2324 for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2325 /* Sanity check option length */ 2326 if (l > len) { 2327 /* 2328 * Malicious option - drop immediately. 2329 * XXX Maybe we should just RXJ it? 2330 */ 2331 addlog("%s: received malicious LCP option 0x%02x, " 2332 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2333 p[0], l, len); 2334 goto drop; 2335 } 2336 if (debug) 2337 addlog(" %s", sppp_lcp_opt_name(*p)); 2338 switch (*p) { 2339 case LCP_OPT_MAGIC: 2340 /* Magic number. */ 2341 /* fall through, both are same length */ 2342 case LCP_OPT_ASYNC_MAP: 2343 /* Async control character map. */ 2344 if (len >= 6 || l == 6) 2345 continue; 2346 if (debug) 2347 addlog(" [invalid]"); 2348 break; 2349 case LCP_OPT_MP_EID: 2350 if (len >= l && l >= 3) { 2351 switch (p[2]) { 2352 case 0: if (l==3+ 0) continue;break; 2353 case 2: if (l==3+ 4) continue;break; 2354 case 3: if (l==3+ 6) continue;break; 2355 case 6: if (l==3+16) continue;break; 2356 case 1: /* FALLTHROUGH */ 2357 case 4: if (l<=3+20) continue;break; 2358 case 5: if (l<=3+15) continue;break; 2359 /* XXX should it be default: continue;? */ 2360 } 2361 } 2362 if (debug) 2363 addlog(" [invalid class %d len %d]", p[2], l); 2364 break; 2365 case LCP_OPT_MP_SSNHF: 2366 if (len >= 2 && l == 2) { 2367 if (debug) 2368 addlog(" [rej]"); 2369 break; 2370 } 2371 if (debug) 2372 addlog(" [invalid]"); 2373 break; 2374 case LCP_OPT_MP_MRRU: 2375 /* Multilink maximum received reconstructed unit */ 2376 /* should be fall through, both are same length */ 2377 /* FALLTHROUGH */ 2378 case LCP_OPT_MRU: 2379 /* Maximum receive unit. */ 2380 if (len >= 4 && l == 4) 2381 continue; 2382 if (debug) 2383 addlog(" [invalid]"); 2384 break; 2385 case LCP_OPT_AUTH_PROTO: 2386 if (len < 4) { 2387 if (debug) 2388 addlog(" [invalid]"); 2389 break; 2390 } 2391 authproto = (p[2] << 8) + p[3]; 2392 if (authproto == PPP_CHAP && l != 5) { 2393 if (debug) 2394 addlog(" [invalid chap len]"); 2395 break; 2396 } 2397 if (sp->myauth.proto == 0) { 2398 /* we are not configured to do auth */ 2399 if (debug) 2400 addlog(" [not configured]"); 2401 break; 2402 } 2403 /* 2404 * Remote want us to authenticate, remember this, 2405 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2406 * up. 2407 */ 2408 sp->pp_flags |= PP_NEEDAUTH; 2409 continue; 2410 default: 2411 /* Others not supported. */ 2412 if (debug) 2413 addlog(" [rej]"); 2414 break; 2415 } 2416 if (rlen + l > blen) { 2417 if (debug) 2418 addlog(" [overflow]"); 2419 continue; 2420 } 2421 /* Add the option to rejected list. */ 2422 memcpy(r, p, l); 2423 r += l; 2424 rlen += l; 2425 } 2426 if (rlen) { 2427 if (debug) 2428 addlog(" send conf-rej\n"); 2429 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2430 goto end; 2431 } else if (debug) 2432 addlog("\n"); 2433 2434 /* 2435 * pass 2: check for option values that are unacceptable and 2436 * thus require to be nak'ed. 2437 */ 2438 if (debug) 2439 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2440 ifp->if_xname); 2441 2442 p = (void *)(h + 1); 2443 len = origlen; 2444 for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2445 if (debug) 2446 addlog(" %s", sppp_lcp_opt_name(*p)); 2447 switch (*p) { 2448 case LCP_OPT_MAGIC: 2449 /* Magic number -- extract. */ 2450 nmagic = (uint32_t)p[2] << 24 | 2451 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2452 if (nmagic != sp->lcp.magic) { 2453 if (debug) 2454 addlog(" 0x%x", nmagic); 2455 continue; 2456 } 2457 /* 2458 * Local and remote magics equal -- loopback? 2459 */ 2460 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2461 printf ("%s: loopback\n", 2462 ifp->if_xname); 2463 sp->pp_loopcnt = 0; 2464 if (ifp->if_flags & IFF_UP) { 2465 SPPP_UNLOCK(sp); 2466 if_down(ifp); 2467 SPPP_LOCK(sp, RW_WRITER); 2468 2469 IF_PURGE(&sp->pp_cpq); 2470 /* XXX ? */ 2471 lcp.Down(sp); 2472 lcp.Up(sp); 2473 } 2474 } else if (debug) 2475 addlog(" [glitch]"); 2476 ++sp->pp_loopcnt; 2477 /* 2478 * We negate our magic here, and NAK it. If 2479 * we see it later in an NAK packet, we 2480 * suggest a new one. 2481 */ 2482 nmagic = ~sp->lcp.magic; 2483 /* Gonna NAK it. */ 2484 p[2] = nmagic >> 24; 2485 p[3] = nmagic >> 16; 2486 p[4] = nmagic >> 8; 2487 p[5] = nmagic; 2488 break; 2489 2490 case LCP_OPT_ASYNC_MAP: 2491 /* 2492 * Async control character map -- just ignore it. 2493 * 2494 * Quote from RFC 1662, chapter 6: 2495 * To enable this functionality, synchronous PPP 2496 * implementations MUST always respond to the 2497 * Async-Control-Character-Map Configuration 2498 * Option with the LCP Configure-Ack. However, 2499 * acceptance of the Configuration Option does 2500 * not imply that the synchronous implementation 2501 * will do any ACCM mapping. Instead, all such 2502 * octet mapping will be performed by the 2503 * asynchronous-to-synchronous converter. 2504 */ 2505 continue; 2506 2507 case LCP_OPT_MRU: 2508 /* 2509 * Maximum receive unit. Always agreeable, 2510 * but ignored by now. 2511 */ 2512 sp->lcp.their_mru = p[2] * 256 + p[3]; 2513 if (debug) 2514 addlog(" %ld", sp->lcp.their_mru); 2515 continue; 2516 2517 case LCP_OPT_AUTH_PROTO: 2518 authproto = (p[2] << 8) + p[3]; 2519 if (sp->myauth.proto != authproto) { 2520 /* not agreed, nak */ 2521 if (debug) 2522 addlog(" [mine %s != his %s]", 2523 sppp_proto_name(sp->myauth.proto), 2524 sppp_proto_name(authproto)); 2525 p[2] = sp->myauth.proto >> 8; 2526 p[3] = sp->myauth.proto; 2527 break; 2528 } 2529 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2530 if (debug) 2531 addlog(" [chap not MD5]"); 2532 p[4] = CHAP_MD5; 2533 break; 2534 } 2535 continue; 2536 case LCP_OPT_MP_EID: 2537 /* 2538 * Endpoint identification. 2539 * Always agreeable, 2540 * but ignored by now. 2541 */ 2542 if (debug) { 2543 addlog(" type %d", p[2]); 2544 sppp_print_bytes(p+3, p[1]-3); 2545 } 2546 continue; 2547 case LCP_OPT_MP_MRRU: 2548 /* 2549 * Maximum received reconstructed unit. 2550 * Always agreeable, 2551 * but ignored by now. 2552 */ 2553 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2554 if (debug) 2555 addlog(" %ld", sp->lcp.their_mrru); 2556 continue; 2557 } 2558 if (rlen + l > blen) { 2559 if (debug) 2560 addlog(" [overflow]"); 2561 continue; 2562 } 2563 /* Add the option to nak'ed list. */ 2564 memcpy(r, p, l); 2565 r += l; 2566 rlen += l; 2567 } 2568 if (rlen) { 2569 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2570 if (debug) 2571 addlog(" max_failure (%d) exceeded, " 2572 "send conf-rej\n", 2573 sp->lcp.max_failure); 2574 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2575 } else { 2576 if (debug) 2577 addlog(" send conf-nak\n"); 2578 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2579 } 2580 goto end; 2581 } else { 2582 if (debug) 2583 addlog(" send conf-ack\n"); 2584 sp->fail_counter[IDX_LCP] = 0; 2585 sp->pp_loopcnt = 0; 2586 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2587 } 2588 2589 end: 2590 free(buf, M_TEMP); 2591 return (rlen == 0); 2592 2593 drop: 2594 free(buf, M_TEMP); 2595 return -1; 2596 } 2597 2598 /* 2599 * Analyze the LCP Configure-Reject option list, and adjust our 2600 * negotiation. 2601 */ 2602 static void 2603 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2604 { 2605 STDDCL; 2606 u_char *buf, *p, l; 2607 2608 KASSERT(SPPP_WLOCKED(sp)); 2609 2610 len -= 4; 2611 buf = malloc (len, M_TEMP, M_NOWAIT); 2612 if (!buf) 2613 return; 2614 2615 if (debug) 2616 log(LOG_DEBUG, "%s: lcp rej opts:", 2617 ifp->if_xname); 2618 2619 p = (void *)(h + 1); 2620 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2621 /* Sanity check option length */ 2622 if (l > len) { 2623 /* 2624 * Malicious option - drop immediately. 2625 * XXX Maybe we should just RXJ it? 2626 */ 2627 addlog("%s: received malicious LCP option, " 2628 "dropping.\n", ifp->if_xname); 2629 goto drop; 2630 } 2631 if (debug) 2632 addlog(" %s", sppp_lcp_opt_name(*p)); 2633 switch (*p) { 2634 case LCP_OPT_MAGIC: 2635 /* Magic number -- can't use it, use 0 */ 2636 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2637 sp->lcp.magic = 0; 2638 break; 2639 case LCP_OPT_MRU: 2640 /* 2641 * We try to negotiate a lower MRU if the underlying 2642 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2643 * peer rejects this lower rate, fallback to the 2644 * default. 2645 */ 2646 if (debug) { 2647 addlog("%s: warning: peer rejected our MRU of " 2648 "%ld bytes. Defaulting to %d bytes\n", 2649 ifp->if_xname, sp->lcp.mru, PP_MTU); 2650 } 2651 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2652 sp->lcp.mru = PP_MTU; 2653 break; 2654 case LCP_OPT_AUTH_PROTO: 2655 /* 2656 * Peer doesn't want to authenticate himself, 2657 * deny unless this is a dialout call, and 2658 * SPPP_AUTHFLAG_NOCALLOUT is set. 2659 */ 2660 if ((sp->pp_flags & PP_CALLIN) == 0 && 2661 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2662 if (debug) 2663 addlog(" [don't insist on auth " 2664 "for callout]"); 2665 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2666 break; 2667 } 2668 if (debug) 2669 addlog("[access denied]\n"); 2670 lcp.Close(sp); 2671 break; 2672 } 2673 } 2674 if (debug) 2675 addlog("\n"); 2676 drop: 2677 free(buf, M_TEMP); 2678 return; 2679 } 2680 2681 /* 2682 * Analyze the LCP Configure-NAK option list, and adjust our 2683 * negotiation. 2684 */ 2685 static void 2686 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2687 { 2688 STDDCL; 2689 u_char *buf, *p, l, blen; 2690 uint32_t magic; 2691 2692 KASSERT(SPPP_WLOCKED(sp)); 2693 2694 len -= 4; 2695 buf = malloc (blen = len, M_TEMP, M_NOWAIT); 2696 if (!buf) 2697 return; 2698 2699 if (debug) 2700 log(LOG_DEBUG, "%s: lcp nak opts:", 2701 ifp->if_xname); 2702 2703 p = (void *)(h + 1); 2704 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2705 /* Sanity check option length */ 2706 if (l > len) { 2707 /* 2708 * Malicious option - drop immediately. 2709 * XXX Maybe we should just RXJ it? 2710 */ 2711 addlog("%s: received malicious LCP option, " 2712 "dropping.\n", ifp->if_xname); 2713 goto drop; 2714 } 2715 if (debug) 2716 addlog(" %s", sppp_lcp_opt_name(*p)); 2717 switch (*p) { 2718 case LCP_OPT_MAGIC: 2719 /* Magic number -- renegotiate */ 2720 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2721 len >= 6 && l == 6) { 2722 magic = (uint32_t)p[2] << 24 | 2723 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2724 /* 2725 * If the remote magic is our negated one, 2726 * this looks like a loopback problem. 2727 * Suggest a new magic to make sure. 2728 */ 2729 if (magic == ~sp->lcp.magic) { 2730 if (debug) 2731 addlog(" magic glitch"); 2732 sp->lcp.magic = cprng_fast32(); 2733 } else { 2734 sp->lcp.magic = magic; 2735 if (debug) 2736 addlog(" %d", magic); 2737 } 2738 } 2739 break; 2740 case LCP_OPT_MRU: 2741 /* 2742 * Peer wants to advise us to negotiate an MRU. 2743 * Agree on it if it's reasonable, or use 2744 * default otherwise. 2745 */ 2746 if (len >= 4 && l == 4) { 2747 u_int mru = p[2] * 256 + p[3]; 2748 if (debug) 2749 addlog(" %d", mru); 2750 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 2751 mru = sp->pp_if.if_mtu; 2752 sp->lcp.mru = mru; 2753 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2754 } 2755 break; 2756 case LCP_OPT_AUTH_PROTO: 2757 /* 2758 * Peer doesn't like our authentication method, 2759 * deny. 2760 */ 2761 if (debug) 2762 addlog("[access denied]\n"); 2763 lcp.Close(sp); 2764 break; 2765 } 2766 } 2767 if (debug) 2768 addlog("\n"); 2769 drop: 2770 free(buf, M_TEMP); 2771 return; 2772 } 2773 2774 static void 2775 sppp_lcp_tlu(struct sppp *sp) 2776 { 2777 struct ifnet *ifp = &sp->pp_if; 2778 int i; 2779 uint32_t mask; 2780 2781 KASSERT(SPPP_WLOCKED(sp)); 2782 2783 /* XXX ? */ 2784 if (! (ifp->if_flags & IFF_UP) && 2785 (ifp->if_flags & IFF_RUNNING)) { 2786 /* Coming out of loopback mode. */ 2787 SPPP_UNLOCK(sp); 2788 if_up(ifp); 2789 SPPP_LOCK(sp, RW_WRITER); 2790 } 2791 2792 for (i = 0; i < IDX_COUNT; i++) 2793 if ((cps[i])->flags & CP_QUAL) 2794 (cps[i])->Open(sp); 2795 2796 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2797 (sp->pp_flags & PP_NEEDAUTH) != 0) 2798 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 2799 else 2800 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 2801 2802 /* 2803 * Open all authentication protocols. This is even required 2804 * if we already proceeded to network phase, since it might be 2805 * that remote wants us to authenticate, so we might have to 2806 * send a PAP request. Undesired authentication protocols 2807 * don't do anything when they get an Open event. 2808 */ 2809 for (i = 0; i < IDX_COUNT; i++) 2810 if ((cps[i])->flags & CP_AUTH) 2811 (cps[i])->Open(sp); 2812 2813 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2814 /* Notify all NCPs. */ 2815 for (i = 0; i < IDX_COUNT; i++) 2816 if ((cps[i])->flags & CP_NCP) 2817 (cps[i])->Open(sp); 2818 } 2819 2820 /* Send Up events to all started protos. */ 2821 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) { 2822 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2823 (cps[i])->Up(sp); 2824 } 2825 } 2826 2827 /* notify low-level driver of state change */ 2828 sppp_notify_chg_wlocked(sp); 2829 2830 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2831 /* if no NCP is starting, close down */ 2832 sppp_lcp_check_and_close(sp); 2833 } 2834 2835 static void 2836 sppp_lcp_tld(struct sppp *sp) 2837 { 2838 int i; 2839 uint32_t mask; 2840 2841 KASSERT(SPPP_WLOCKED(sp)); 2842 2843 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 2844 2845 /* 2846 * Take upper layers down. We send the Down event first and 2847 * the Close second to prevent the upper layers from sending 2848 * ``a flurry of terminate-request packets'', as the RFC 2849 * describes it. 2850 */ 2851 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) { 2852 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2853 (cps[i])->Down(sp); 2854 (cps[i])->Close(sp); 2855 } 2856 } 2857 } 2858 2859 static void 2860 sppp_lcp_tls(struct sppp *sp) 2861 { 2862 2863 KASSERT(SPPP_WLOCKED(sp)); 2864 2865 2866 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2867 printf("%s: authentication failed %d times, not retrying again\n", 2868 sp->pp_if.if_xname, sp->pp_auth_failures); 2869 2870 SPPP_UNLOCK(sp); 2871 if_down(&sp->pp_if); 2872 SPPP_LOCK(sp, RW_WRITER); 2873 return; 2874 } 2875 2876 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 2877 2878 /* Notify lower layer if desired. */ 2879 sppp_notify_tls_wlocked(sp); 2880 } 2881 2882 static void 2883 sppp_lcp_tlf(struct sppp *sp) 2884 { 2885 2886 KASSERT(SPPP_WLOCKED(sp)); 2887 2888 sppp_change_phase(sp, SPPP_PHASE_DEAD); 2889 2890 /* Notify lower layer if desired. */ 2891 sppp_notify_tlf_wlocked(sp); 2892 } 2893 2894 static void 2895 sppp_lcp_scr(struct sppp *sp) 2896 { 2897 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2898 int i = 0; 2899 u_short authproto; 2900 2901 KASSERT(SPPP_WLOCKED(sp)); 2902 2903 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2904 if (! sp->lcp.magic) 2905 sp->lcp.magic = cprng_fast32(); 2906 opt[i++] = LCP_OPT_MAGIC; 2907 opt[i++] = 6; 2908 opt[i++] = sp->lcp.magic >> 24; 2909 opt[i++] = sp->lcp.magic >> 16; 2910 opt[i++] = sp->lcp.magic >> 8; 2911 opt[i++] = sp->lcp.magic; 2912 } 2913 2914 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2915 opt[i++] = LCP_OPT_MRU; 2916 opt[i++] = 4; 2917 opt[i++] = sp->lcp.mru >> 8; 2918 opt[i++] = sp->lcp.mru; 2919 } 2920 2921 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2922 authproto = sp->hisauth.proto; 2923 opt[i++] = LCP_OPT_AUTH_PROTO; 2924 opt[i++] = authproto == PPP_CHAP? 5: 4; 2925 opt[i++] = authproto >> 8; 2926 opt[i++] = authproto; 2927 if (authproto == PPP_CHAP) 2928 opt[i++] = CHAP_MD5; 2929 } 2930 2931 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2932 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2933 } 2934 2935 /* 2936 * Check the open NCPs, return true if at least one NCP is open. 2937 */ 2938 static int 2939 sppp_ncp_check(struct sppp *sp) 2940 { 2941 int i, mask; 2942 2943 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2944 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2945 return 1; 2946 return 0; 2947 } 2948 2949 /* 2950 * Re-check the open NCPs and see if we should terminate the link. 2951 * Called by the NCPs during their tlf action handling. 2952 */ 2953 static void 2954 sppp_lcp_check_and_close(struct sppp *sp) 2955 { 2956 2957 KASSERT(SPPP_WLOCKED(sp)); 2958 2959 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2960 /* don't bother, we are already going down */ 2961 return; 2962 2963 if (sppp_ncp_check(sp)) 2964 return; 2965 lcp.Close(sp); 2966 } 2967 2968 2969 /* 2970 *--------------------------------------------------------------------------* 2971 * * 2972 * The IPCP implementation. * 2973 * * 2974 *--------------------------------------------------------------------------* 2975 */ 2976 2977 static void 2978 sppp_ipcp_init(struct sppp *sp) 2979 { 2980 int error; 2981 2982 KASSERT(SPPP_WLOCKED(sp)); 2983 2984 sp->ipcp.opts = 0; 2985 sp->ipcp.flags = 0; 2986 sp->state[IDX_IPCP] = STATE_INITIAL; 2987 sp->fail_counter[IDX_IPCP] = 0; 2988 sp->pp_seq[IDX_IPCP] = 0; 2989 sp->pp_rseq[IDX_IPCP] = 0; 2990 callout_init(&sp->ch[IDX_IPCP], CALLOUT_MPSAFE); 2991 2992 error = workqueue_create(&sp->ipcp.update_addrs_wq, "ipcp_addr", 2993 sppp_update_ip_addrs_work, sp, PRI_SOFTNET, IPL_NET, 0); 2994 if (error) 2995 panic("%s: update_addrs workqueue_create failed (%d)\n", 2996 __func__, error); 2997 sp->ipcp.update_addrs_q = pcq_create(IPCP_UPDATE_LIMIT, KM_SLEEP); 2998 2999 sp->ipcp.update_addrs_enqueued = 0; 3000 } 3001 3002 static void 3003 sppp_ipcp_up(struct sppp *sp) 3004 { 3005 KASSERT(SPPP_WLOCKED(sp)); 3006 sppp_up_event(&ipcp, sp); 3007 } 3008 3009 static void 3010 sppp_ipcp_down(struct sppp *sp) 3011 { 3012 KASSERT(SPPP_WLOCKED(sp)); 3013 sppp_down_event(&ipcp, sp); 3014 } 3015 3016 static void 3017 sppp_ipcp_open(struct sppp *sp) 3018 { 3019 STDDCL; 3020 uint32_t myaddr, hisaddr; 3021 3022 KASSERT(SPPP_WLOCKED(sp)); 3023 3024 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3025 sp->ipcp.req_myaddr = 0; 3026 sp->ipcp.req_hisaddr = 0; 3027 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3028 3029 #ifdef INET 3030 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3031 #else 3032 myaddr = hisaddr = 0; 3033 #endif 3034 /* 3035 * If we don't have his address, this probably means our 3036 * interface doesn't want to talk IP at all. (This could 3037 * be the case if somebody wants to speak only IPX, for 3038 * example.) Don't open IPCP in this case. 3039 */ 3040 if (hisaddr == 0) { 3041 /* XXX this message should go away */ 3042 if (debug) 3043 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 3044 ifp->if_xname); 3045 return; 3046 } 3047 3048 if (myaddr == 0) { 3049 /* 3050 * I don't have an assigned address, so i need to 3051 * negotiate my address. 3052 */ 3053 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3054 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3055 } 3056 if (hisaddr == 1) { 3057 /* 3058 * XXX - remove this hack! 3059 * remote has no valid address, we need to get one assigned. 3060 */ 3061 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3062 } 3063 sppp_open_event(&ipcp, sp); 3064 } 3065 3066 static void 3067 sppp_ipcp_close(struct sppp *sp) 3068 { 3069 3070 KASSERT(SPPP_WLOCKED(sp)); 3071 3072 sppp_close_event(&ipcp, sp); 3073 3074 #ifdef INET 3075 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 3076 /* 3077 * Some address was dynamic, clear it again. 3078 */ 3079 sppp_clear_ip_addrs(sp); 3080 #endif 3081 } 3082 3083 static void 3084 sppp_ipcp_TO(void *cookie) 3085 { 3086 struct sppp *sp = cookie; 3087 3088 SPPP_LOCK(sp, RW_WRITER); 3089 sppp_to_event(&ipcp, sp); 3090 SPPP_UNLOCK(sp); 3091 } 3092 3093 /* 3094 * Analyze a configure request. Return true if it was agreeable, and 3095 * caused action sca, false if it has been rejected or nak'ed, and 3096 * caused action scn. (The return value is used to make the state 3097 * transition decision in the state automaton.) 3098 */ 3099 static int 3100 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3101 { 3102 u_char *buf, *r, *p, l, blen; 3103 struct ifnet *ifp = &sp->pp_if; 3104 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3105 uint32_t hisaddr, desiredaddr; 3106 3107 KASSERT(SPPP_WLOCKED(sp)); 3108 3109 len -= 4; 3110 origlen = len; 3111 /* 3112 * Make sure to allocate a buf that can at least hold a 3113 * conf-nak with an `address' option. We might need it below. 3114 */ 3115 blen = len < 6 ? 6 : len; 3116 buf = r = malloc (blen, M_TEMP, M_NOWAIT); 3117 if (! buf) 3118 return (0); 3119 3120 /* pass 1: see if we can recognize them */ 3121 if (debug) 3122 log(LOG_DEBUG, "%s: ipcp parse opts:", 3123 ifp->if_xname); 3124 p = (void *)(h + 1); 3125 for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3126 /* Sanity check option length */ 3127 if (l > len) { 3128 /* XXX should we just RXJ? */ 3129 addlog("%s: malicious IPCP option received, dropping\n", 3130 ifp->if_xname); 3131 goto drop; 3132 } 3133 if (debug) 3134 addlog(" %s", sppp_ipcp_opt_name(*p)); 3135 switch (*p) { 3136 #ifdef notyet 3137 case IPCP_OPT_COMPRESSION: 3138 if (len >= 6 && l >= 6) { 3139 /* correctly formed compress option */ 3140 continue; 3141 } 3142 if (debug) 3143 addlog(" [invalid]"); 3144 break; 3145 #endif 3146 case IPCP_OPT_ADDRESS: 3147 if (len >= 6 && l == 6) { 3148 /* correctly formed address option */ 3149 continue; 3150 } 3151 if (debug) 3152 addlog(" [invalid]"); 3153 break; 3154 default: 3155 /* Others not supported. */ 3156 if (debug) 3157 addlog(" [rej]"); 3158 break; 3159 } 3160 /* Add the option to rejected list. */ 3161 if (rlen + l > blen) { 3162 if (debug) 3163 addlog(" [overflow]"); 3164 continue; 3165 } 3166 memcpy(r, p, l); 3167 r += l; 3168 rlen += l; 3169 } 3170 if (rlen) { 3171 if (debug) 3172 addlog(" send conf-rej\n"); 3173 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 3174 goto end; 3175 } else if (debug) 3176 addlog("\n"); 3177 3178 /* pass 2: parse option values */ 3179 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3180 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3181 else 3182 #ifdef INET 3183 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3184 #else 3185 hisaddr = 0; 3186 #endif 3187 if (debug) 3188 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 3189 ifp->if_xname); 3190 p = (void *)(h + 1); 3191 len = origlen; 3192 for (rlen=0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3193 if (debug) 3194 addlog(" %s", sppp_ipcp_opt_name(*p)); 3195 switch (*p) { 3196 #ifdef notyet 3197 case IPCP_OPT_COMPRESSION: 3198 continue; 3199 #endif 3200 case IPCP_OPT_ADDRESS: 3201 desiredaddr = p[2] << 24 | p[3] << 16 | 3202 p[4] << 8 | p[5]; 3203 if (desiredaddr == hisaddr || 3204 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3205 /* 3206 * Peer's address is same as our value, 3207 * this is agreeable. Gonna conf-ack 3208 * it. 3209 */ 3210 if (debug) 3211 addlog(" %s [ack]", 3212 sppp_dotted_quad(hisaddr)); 3213 /* record that we've seen it already */ 3214 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3215 sp->ipcp.req_hisaddr = desiredaddr; 3216 hisaddr = desiredaddr; 3217 continue; 3218 } 3219 /* 3220 * The address wasn't agreeable. This is either 3221 * he sent us 0.0.0.0, asking to assign him an 3222 * address, or he send us another address not 3223 * matching our value. Either case, we gonna 3224 * conf-nak it with our value. 3225 */ 3226 if (debug) { 3227 if (desiredaddr == 0) 3228 addlog(" [addr requested]"); 3229 else 3230 addlog(" %s [not agreed]", 3231 sppp_dotted_quad(desiredaddr)); 3232 } 3233 3234 p[2] = hisaddr >> 24; 3235 p[3] = hisaddr >> 16; 3236 p[4] = hisaddr >> 8; 3237 p[5] = hisaddr; 3238 break; 3239 } 3240 if (rlen + l > blen) { 3241 if (debug) 3242 addlog(" [overflow]"); 3243 continue; 3244 } 3245 /* Add the option to nak'ed list. */ 3246 memcpy(r, p, l); 3247 r += l; 3248 rlen += l; 3249 } 3250 3251 /* 3252 * If we are about to conf-ack the request, but haven't seen 3253 * his address so far, gonna conf-nak it instead, with the 3254 * `address' option present and our idea of his address being 3255 * filled in there, to request negotiation of both addresses. 3256 * 3257 * XXX This can result in an endless req - nak loop if peer 3258 * doesn't want to send us his address. Q: What should we do 3259 * about it? XXX A: implement the max-failure counter. 3260 */ 3261 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 3262 buf[0] = IPCP_OPT_ADDRESS; 3263 buf[1] = 6; 3264 buf[2] = hisaddr >> 24; 3265 buf[3] = hisaddr >> 16; 3266 buf[4] = hisaddr >> 8; 3267 buf[5] = hisaddr; 3268 rlen = 6; 3269 if (debug) 3270 addlog(" still need hisaddr"); 3271 } 3272 3273 if (rlen) { 3274 if (debug) 3275 addlog(" send conf-nak\n"); 3276 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 3277 } else { 3278 if (debug) 3279 addlog(" send conf-ack\n"); 3280 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 3281 } 3282 3283 end: 3284 free(buf, M_TEMP); 3285 return (rlen == 0); 3286 3287 drop: 3288 free(buf, M_TEMP); 3289 return -1; 3290 } 3291 3292 /* 3293 * Analyze the IPCP Configure-Reject option list, and adjust our 3294 * negotiation. 3295 */ 3296 static void 3297 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3298 { 3299 u_char *buf, *p, l, blen; 3300 struct ifnet *ifp = &sp->pp_if; 3301 int debug = ifp->if_flags & IFF_DEBUG; 3302 3303 KASSERT(SPPP_WLOCKED(sp)); 3304 3305 len -= 4; 3306 buf = malloc (blen = len, M_TEMP, M_NOWAIT); 3307 if (!buf) 3308 return; 3309 3310 if (debug) 3311 log(LOG_DEBUG, "%s: ipcp rej opts:", 3312 ifp->if_xname); 3313 3314 p = (void *)(h + 1); 3315 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3316 /* Sanity check option length */ 3317 if (l > len) { 3318 /* XXX should we just RXJ? */ 3319 addlog("%s: malicious IPCP option received, dropping\n", 3320 ifp->if_xname); 3321 goto drop; 3322 } 3323 if (debug) 3324 addlog(" %s", sppp_ipcp_opt_name(*p)); 3325 switch (*p) { 3326 case IPCP_OPT_ADDRESS: 3327 /* 3328 * Peer doesn't grok address option. This is 3329 * bad. XXX Should we better give up here? 3330 */ 3331 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3332 break; 3333 #ifdef notyet 3334 case IPCP_OPT_COMPRESS: 3335 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3336 break; 3337 #endif 3338 } 3339 } 3340 if (debug) 3341 addlog("\n"); 3342 drop: 3343 free(buf, M_TEMP); 3344 return; 3345 } 3346 3347 /* 3348 * Analyze the IPCP Configure-NAK option list, and adjust our 3349 * negotiation. 3350 */ 3351 static void 3352 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3353 { 3354 u_char *p, l; 3355 struct ifnet *ifp = &sp->pp_if; 3356 int debug = ifp->if_flags & IFF_DEBUG; 3357 uint32_t wantaddr; 3358 3359 KASSERT(SPPP_WLOCKED(sp)); 3360 3361 len -= 4; 3362 3363 if (debug) 3364 log(LOG_DEBUG, "%s: ipcp nak opts:", 3365 ifp->if_xname); 3366 3367 p = (void *)(h + 1); 3368 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3369 /* Sanity check option length */ 3370 if (l > len) { 3371 /* XXX should we just RXJ? */ 3372 addlog("%s: malicious IPCP option received, dropping\n", 3373 ifp->if_xname); 3374 return; 3375 } 3376 if (debug) 3377 addlog(" %s", sppp_ipcp_opt_name(*p)); 3378 switch (*p) { 3379 case IPCP_OPT_ADDRESS: 3380 /* 3381 * Peer doesn't like our local IP address. See 3382 * if we can do something for him. We'll drop 3383 * him our address then. 3384 */ 3385 if (len >= 6 && l == 6) { 3386 wantaddr = p[2] << 24 | p[3] << 16 | 3387 p[4] << 8 | p[5]; 3388 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3389 if (debug) 3390 addlog(" [wantaddr %s]", 3391 sppp_dotted_quad(wantaddr)); 3392 /* 3393 * When doing dynamic address assignment, 3394 * we accept his offer. Otherwise, we 3395 * ignore it and thus continue to negotiate 3396 * our already existing value. 3397 */ 3398 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3399 if (debug) 3400 addlog(" [agree]"); 3401 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3402 sp->ipcp.req_myaddr = wantaddr; 3403 } 3404 } 3405 break; 3406 3407 case IPCP_OPT_PRIMDNS: 3408 if (len >= 6 && l == 6) { 3409 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3410 p[4] << 8 | p[5]; 3411 } 3412 break; 3413 3414 case IPCP_OPT_SECDNS: 3415 if (len >= 6 && l == 6) { 3416 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3417 p[4] << 8 | p[5]; 3418 } 3419 break; 3420 #ifdef notyet 3421 case IPCP_OPT_COMPRESS: 3422 /* 3423 * Peer wants different compression parameters. 3424 */ 3425 break; 3426 #endif 3427 } 3428 } 3429 if (debug) 3430 addlog("\n"); 3431 } 3432 3433 static void 3434 sppp_ipcp_tlu(struct sppp *sp) 3435 { 3436 #ifdef INET 3437 KASSERT(SPPP_WLOCKED(sp)); 3438 /* we are up. Set addresses and notify anyone interested */ 3439 sppp_set_ip_addrs(sp); 3440 #endif 3441 } 3442 3443 static void 3444 sppp_ipcp_tld(struct sppp *sp) 3445 { 3446 3447 KASSERT(SPPP_WLOCKED(sp)); 3448 } 3449 3450 static void 3451 sppp_ipcp_tls(struct sppp *sp) 3452 { 3453 3454 KASSERT(SPPP_WLOCKED(sp)); 3455 /* indicate to LCP that it must stay alive */ 3456 sp->lcp.protos |= (1 << IDX_IPCP); 3457 } 3458 3459 static void 3460 sppp_ipcp_tlf(struct sppp *sp) 3461 { 3462 3463 KASSERT(SPPP_WLOCKED(sp)); 3464 3465 /* we no longer need LCP */ 3466 sp->lcp.protos &= ~(1 << IDX_IPCP); 3467 } 3468 3469 static void 3470 sppp_ipcp_scr(struct sppp *sp) 3471 { 3472 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3473 #ifdef INET 3474 uint32_t ouraddr; 3475 #endif 3476 int i = 0; 3477 3478 KASSERT(SPPP_WLOCKED(sp)); 3479 3480 #ifdef notyet 3481 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3482 opt[i++] = IPCP_OPT_COMPRESSION; 3483 opt[i++] = 6; 3484 opt[i++] = 0; /* VJ header compression */ 3485 opt[i++] = 0x2d; /* VJ header compression */ 3486 opt[i++] = max_slot_id; 3487 opt[i++] = comp_slot_id; 3488 } 3489 #endif 3490 3491 #ifdef INET 3492 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3493 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3494 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3495 else 3496 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3497 opt[i++] = IPCP_OPT_ADDRESS; 3498 opt[i++] = 6; 3499 opt[i++] = ouraddr >> 24; 3500 opt[i++] = ouraddr >> 16; 3501 opt[i++] = ouraddr >> 8; 3502 opt[i++] = ouraddr; 3503 } 3504 #endif 3505 3506 if (sp->query_dns & 1) { 3507 opt[i++] = IPCP_OPT_PRIMDNS; 3508 opt[i++] = 6; 3509 opt[i++] = sp->dns_addrs[0] >> 24; 3510 opt[i++] = sp->dns_addrs[0] >> 16; 3511 opt[i++] = sp->dns_addrs[0] >> 8; 3512 opt[i++] = sp->dns_addrs[0]; 3513 } 3514 if (sp->query_dns & 2) { 3515 opt[i++] = IPCP_OPT_SECDNS; 3516 opt[i++] = 6; 3517 opt[i++] = sp->dns_addrs[1] >> 24; 3518 opt[i++] = sp->dns_addrs[1] >> 16; 3519 opt[i++] = sp->dns_addrs[1] >> 8; 3520 opt[i++] = sp->dns_addrs[1]; 3521 } 3522 3523 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3524 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3525 } 3526 3527 3528 /* 3529 *--------------------------------------------------------------------------* 3530 * * 3531 * The IPv6CP implementation. * 3532 * * 3533 *--------------------------------------------------------------------------* 3534 */ 3535 3536 #ifdef INET6 3537 static void 3538 sppp_ipv6cp_init(struct sppp *sp) 3539 { 3540 3541 KASSERT(SPPP_WLOCKED(sp)); 3542 3543 sp->ipv6cp.opts = 0; 3544 sp->ipv6cp.flags = 0; 3545 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3546 sp->fail_counter[IDX_IPV6CP] = 0; 3547 sp->pp_seq[IDX_IPV6CP] = 0; 3548 sp->pp_rseq[IDX_IPV6CP] = 0; 3549 callout_init(&sp->ch[IDX_IPV6CP], CALLOUT_MPSAFE); 3550 } 3551 3552 static void 3553 sppp_ipv6cp_up(struct sppp *sp) 3554 { 3555 3556 KASSERT(SPPP_WLOCKED(sp)); 3557 sppp_up_event(&ipv6cp, sp); 3558 } 3559 3560 static void 3561 sppp_ipv6cp_down(struct sppp *sp) 3562 { 3563 3564 KASSERT(SPPP_WLOCKED(sp)); 3565 sppp_down_event(&ipv6cp, sp); 3566 } 3567 3568 static void 3569 sppp_ipv6cp_open(struct sppp *sp) 3570 { 3571 STDDCL; 3572 struct in6_addr myaddr, hisaddr; 3573 3574 KASSERT(SPPP_WLOCKED(sp)); 3575 3576 #ifdef IPV6CP_MYIFID_DYN 3577 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3578 #else 3579 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3580 #endif 3581 3582 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3583 /* 3584 * If we don't have our address, this probably means our 3585 * interface doesn't want to talk IPv6 at all. (This could 3586 * be the case if somebody wants to speak only IPX, for 3587 * example.) Don't open IPv6CP in this case. 3588 */ 3589 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3590 /* XXX this message should go away */ 3591 if (debug) 3592 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3593 ifp->if_xname); 3594 return; 3595 } 3596 3597 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3598 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3599 sppp_open_event(&ipv6cp, sp); 3600 } 3601 3602 static void 3603 sppp_ipv6cp_close(struct sppp *sp) 3604 { 3605 3606 KASSERT(SPPP_WLOCKED(sp)); 3607 sppp_close_event(&ipv6cp, sp); 3608 } 3609 3610 static void 3611 sppp_ipv6cp_TO(void *cookie) 3612 { 3613 struct sppp *sp = cookie; 3614 3615 SPPP_LOCK(sp, RW_WRITER); 3616 sppp_to_event(&ipv6cp, sp); 3617 SPPP_UNLOCK(sp); 3618 } 3619 3620 /* 3621 * Analyze a configure request. Return true if it was agreeable, and 3622 * caused action sca, false if it has been rejected or nak'ed, and 3623 * caused action scn. (The return value is used to make the state 3624 * transition decision in the state automaton.) 3625 */ 3626 static int 3627 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3628 { 3629 u_char *buf, *r, *p, l, blen; 3630 struct ifnet *ifp = &sp->pp_if; 3631 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3632 struct in6_addr myaddr, desiredaddr, suggestaddr; 3633 int ifidcount; 3634 int type; 3635 int collision, nohisaddr; 3636 char ip6buf[INET6_ADDRSTRLEN]; 3637 3638 KASSERT(SPPP_WLOCKED(sp)); 3639 3640 len -= 4; 3641 origlen = len; 3642 /* 3643 * Make sure to allocate a buf that can at least hold a 3644 * conf-nak with an `address' option. We might need it below. 3645 */ 3646 blen = len < 6 ? 6 : len; 3647 buf = r = malloc (blen, M_TEMP, M_NOWAIT); 3648 if (! buf) 3649 return (0); 3650 3651 /* pass 1: see if we can recognize them */ 3652 if (debug) 3653 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3654 ifp->if_xname); 3655 p = (void *)(h + 1); 3656 ifidcount = 0; 3657 for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3658 /* Sanity check option length */ 3659 if (l > len) { 3660 /* XXX just RXJ? */ 3661 addlog("%s: received malicious IPCPv6 option, " 3662 "dropping\n", ifp->if_xname); 3663 goto drop; 3664 } 3665 if (debug) 3666 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3667 switch (*p) { 3668 case IPV6CP_OPT_IFID: 3669 if (len >= 10 && l == 10 && ifidcount == 0) { 3670 /* correctly formed address option */ 3671 ifidcount++; 3672 continue; 3673 } 3674 if (debug) 3675 addlog(" [invalid]"); 3676 break; 3677 #ifdef notyet 3678 case IPV6CP_OPT_COMPRESSION: 3679 if (len >= 4 && l >= 4) { 3680 /* correctly formed compress option */ 3681 continue; 3682 } 3683 if (debug) 3684 addlog(" [invalid]"); 3685 break; 3686 #endif 3687 default: 3688 /* Others not supported. */ 3689 if (debug) 3690 addlog(" [rej]"); 3691 break; 3692 } 3693 if (rlen + l > blen) { 3694 if (debug) 3695 addlog(" [overflow]"); 3696 continue; 3697 } 3698 /* Add the option to rejected list. */ 3699 memcpy(r, p, l); 3700 r += l; 3701 rlen += l; 3702 } 3703 if (rlen) { 3704 if (debug) 3705 addlog(" send conf-rej\n"); 3706 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3707 goto end; 3708 } else if (debug) 3709 addlog("\n"); 3710 3711 /* pass 2: parse option values */ 3712 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3713 if (debug) 3714 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3715 ifp->if_xname); 3716 p = (void *)(h + 1); 3717 len = origlen; 3718 type = CONF_ACK; 3719 for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3720 if (debug) 3721 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3722 switch (*p) { 3723 #ifdef notyet 3724 case IPV6CP_OPT_COMPRESSION: 3725 continue; 3726 #endif 3727 case IPV6CP_OPT_IFID: 3728 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3729 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 3730 collision = (memcmp(&desiredaddr.s6_addr[8], 3731 &myaddr.s6_addr[8], 8) == 0); 3732 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3733 3734 desiredaddr.s6_addr16[0] = htons(0xfe80); 3735 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 3736 3737 if (!collision && !nohisaddr) { 3738 /* no collision, hisaddr known - Conf-Ack */ 3739 type = CONF_ACK; 3740 3741 if (debug) { 3742 addlog(" %s [%s]", 3743 IN6_PRINT(ip6buf, &desiredaddr), 3744 sppp_cp_type_name(type)); 3745 } 3746 continue; 3747 } 3748 3749 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3750 if (collision && nohisaddr) { 3751 /* collision, hisaddr unknown - Conf-Rej */ 3752 type = CONF_REJ; 3753 memset(&p[2], 0, 8); 3754 } else { 3755 /* 3756 * - no collision, hisaddr unknown, or 3757 * - collision, hisaddr known 3758 * Conf-Nak, suggest hisaddr 3759 */ 3760 type = CONF_NAK; 3761 sppp_suggest_ip6_addr(sp, &suggestaddr); 3762 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 3763 } 3764 if (debug) 3765 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 3766 sppp_cp_type_name(type)); 3767 break; 3768 } 3769 if (rlen + l > blen) { 3770 if (debug) 3771 addlog(" [overflow]"); 3772 continue; 3773 } 3774 /* Add the option to nak'ed list. */ 3775 memcpy(r, p, l); 3776 r += l; 3777 rlen += l; 3778 } 3779 3780 if (rlen == 0 && type == CONF_ACK) { 3781 if (debug) 3782 addlog(" send %s\n", sppp_cp_type_name(type)); 3783 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3784 } else { 3785 #ifdef notdef 3786 if (type == CONF_ACK) 3787 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3788 #endif 3789 3790 if (debug) { 3791 addlog(" send %s suggest %s\n", 3792 sppp_cp_type_name(type), IN6_PRINT(ip6buf, &suggestaddr)); 3793 } 3794 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3795 } 3796 3797 end: 3798 free(buf, M_TEMP); 3799 return (rlen == 0); 3800 3801 drop: 3802 free(buf, M_TEMP); 3803 return -1; 3804 } 3805 3806 /* 3807 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3808 * negotiation. 3809 */ 3810 static void 3811 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3812 { 3813 u_char *buf, *p, l, blen; 3814 struct ifnet *ifp = &sp->pp_if; 3815 int debug = ifp->if_flags & IFF_DEBUG; 3816 3817 KASSERT(SPPP_WLOCKED(sp)); 3818 3819 len -= 4; 3820 buf = malloc (blen = len, M_TEMP, M_NOWAIT); 3821 if (!buf) 3822 return; 3823 3824 if (debug) 3825 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3826 ifp->if_xname); 3827 3828 p = (void *)(h + 1); 3829 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3830 if (l > len) { 3831 /* XXX just RXJ? */ 3832 addlog("%s: received malicious IPCPv6 option, " 3833 "dropping\n", ifp->if_xname); 3834 goto drop; 3835 } 3836 if (debug) 3837 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3838 switch (*p) { 3839 case IPV6CP_OPT_IFID: 3840 /* 3841 * Peer doesn't grok address option. This is 3842 * bad. XXX Should we better give up here? 3843 */ 3844 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3845 break; 3846 #ifdef notyet 3847 case IPV6CP_OPT_COMPRESS: 3848 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3849 break; 3850 #endif 3851 } 3852 } 3853 if (debug) 3854 addlog("\n"); 3855 drop: 3856 free(buf, M_TEMP); 3857 return; 3858 } 3859 3860 /* 3861 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3862 * negotiation. 3863 */ 3864 static void 3865 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3866 { 3867 u_char *buf, *p, l, blen; 3868 struct ifnet *ifp = &sp->pp_if; 3869 int debug = ifp->if_flags & IFF_DEBUG; 3870 struct in6_addr suggestaddr; 3871 char ip6buf[INET6_ADDRSTRLEN]; 3872 3873 KASSERT(SPPP_WLOCKED(sp)); 3874 3875 len -= 4; 3876 buf = malloc (blen = len, M_TEMP, M_NOWAIT); 3877 if (!buf) 3878 return; 3879 3880 if (debug) 3881 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 3882 ifp->if_xname); 3883 3884 p = (void *)(h + 1); 3885 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3886 if (l > len) { 3887 /* XXX just RXJ? */ 3888 addlog("%s: received malicious IPCPv6 option, " 3889 "dropping\n", ifp->if_xname); 3890 goto drop; 3891 } 3892 if (debug) 3893 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3894 switch (*p) { 3895 case IPV6CP_OPT_IFID: 3896 /* 3897 * Peer doesn't like our local ifid. See 3898 * if we can do something for him. We'll drop 3899 * him our address then. 3900 */ 3901 if (len < 10 || l != 10) 3902 break; 3903 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3904 suggestaddr.s6_addr16[0] = htons(0xfe80); 3905 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 3906 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 3907 3908 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3909 if (debug) 3910 addlog(" [suggestaddr %s]", 3911 IN6_PRINT(ip6buf, &suggestaddr)); 3912 #ifdef IPV6CP_MYIFID_DYN 3913 /* 3914 * When doing dynamic address assignment, 3915 * we accept his offer. 3916 */ 3917 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3918 struct in6_addr lastsuggest; 3919 /* 3920 * If <suggested myaddr from peer> equals to 3921 * <hisaddr we have suggested last time>, 3922 * we have a collision. generate new random 3923 * ifid. 3924 */ 3925 sppp_suggest_ip6_addr(&lastsuggest); 3926 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3927 lastsuggest)) { 3928 if (debug) 3929 addlog(" [random]"); 3930 sppp_gen_ip6_addr(sp, &suggestaddr); 3931 } 3932 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3933 if (debug) 3934 addlog(" [agree]"); 3935 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3936 } 3937 #else 3938 /* 3939 * Since we do not do dynamic address assignment, 3940 * we ignore it and thus continue to negotiate 3941 * our already existing value. This can possibly 3942 * go into infinite request-reject loop. 3943 * 3944 * This is not likely because we normally use 3945 * ifid based on MAC-address. 3946 * If you have no ethernet card on the node, too bad. 3947 * XXX should we use fail_counter? 3948 */ 3949 #endif 3950 break; 3951 #ifdef notyet 3952 case IPV6CP_OPT_COMPRESS: 3953 /* 3954 * Peer wants different compression parameters. 3955 */ 3956 break; 3957 #endif 3958 } 3959 } 3960 if (debug) 3961 addlog("\n"); 3962 drop: 3963 free(buf, M_TEMP); 3964 return; 3965 } 3966 3967 static void 3968 sppp_ipv6cp_tlu(struct sppp *sp) 3969 { 3970 3971 KASSERT(SPPP_WLOCKED(sp)); 3972 /* we are up - notify isdn daemon */ 3973 sppp_notify_con_wlocked(sp); 3974 } 3975 3976 static void 3977 sppp_ipv6cp_tld(struct sppp *sp) 3978 { 3979 3980 KASSERT(SPPP_WLOCKED(sp)); 3981 } 3982 3983 static void 3984 sppp_ipv6cp_tls(struct sppp *sp) 3985 { 3986 3987 KASSERT(SPPP_WLOCKED(sp)); 3988 /* indicate to LCP that it must stay alive */ 3989 sp->lcp.protos |= (1 << IDX_IPV6CP); 3990 } 3991 3992 static void 3993 sppp_ipv6cp_tlf(struct sppp *sp) 3994 { 3995 3996 KASSERT(SPPP_WLOCKED(sp)); 3997 /* we no longer need LCP */ 3998 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3999 } 4000 4001 static void 4002 sppp_ipv6cp_scr(struct sppp *sp) 4003 { 4004 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4005 struct in6_addr ouraddr; 4006 int i = 0; 4007 4008 KASSERT(SPPP_WLOCKED(sp)); 4009 4010 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 4011 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4012 opt[i++] = IPV6CP_OPT_IFID; 4013 opt[i++] = 10; 4014 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4015 i += 8; 4016 } 4017 4018 #ifdef notyet 4019 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 4020 opt[i++] = IPV6CP_OPT_COMPRESSION; 4021 opt[i++] = 4; 4022 opt[i++] = 0; /* TBD */ 4023 opt[i++] = 0; /* TBD */ 4024 /* variable length data may follow */ 4025 } 4026 #endif 4027 4028 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 4029 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 4030 } 4031 #else /*INET6*/ 4032 static void 4033 sppp_ipv6cp_init(struct sppp *sp) 4034 { 4035 4036 KASSERT(SPPP_WLOCKED(sp)); 4037 } 4038 4039 static void 4040 sppp_ipv6cp_up(struct sppp *sp) 4041 { 4042 4043 KASSERT(SPPP_WLOCKED(sp)); 4044 } 4045 4046 static void 4047 sppp_ipv6cp_down(struct sppp *sp) 4048 { 4049 4050 KASSERT(SPPP_WLOCKED(sp)); 4051 } 4052 4053 static void 4054 sppp_ipv6cp_open(struct sppp *sp) 4055 { 4056 4057 KASSERT(SPPP_WLOCKED(sp)); 4058 } 4059 4060 static void 4061 sppp_ipv6cp_close(struct sppp *sp) 4062 { 4063 4064 KASSERT(SPPP_WLOCKED(sp)); 4065 } 4066 4067 static void 4068 sppp_ipv6cp_TO(void *cookie) 4069 { 4070 struct sppp *sp __diagused = cookie; 4071 4072 KASSERT(SPPP_WLOCKED(sp)); 4073 } 4074 4075 static int 4076 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 4077 int len) 4078 { 4079 4080 KASSERT(SPPP_WLOCKED(sp)); 4081 return 0; 4082 } 4083 4084 static void 4085 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 4086 int len) 4087 { 4088 4089 KASSERT(SPPP_WLOCKED(sp)); 4090 } 4091 4092 static void 4093 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 4094 int len) 4095 { 4096 4097 KASSERT(SPPP_WLOCKED(sp)); 4098 } 4099 4100 static void 4101 sppp_ipv6cp_tlu(struct sppp *sp) 4102 { 4103 4104 KASSERT(SPPP_WLOCKED(sp)); 4105 } 4106 4107 static void 4108 sppp_ipv6cp_tld(struct sppp *sp) 4109 { 4110 4111 KASSERT(SPPP_WLOCKED(sp)); 4112 } 4113 4114 static void 4115 sppp_ipv6cp_tls(struct sppp *sp) 4116 { 4117 4118 KASSERT(SPPP_WLOCKED(sp)); 4119 } 4120 4121 static void 4122 sppp_ipv6cp_tlf(struct sppp *sp) 4123 { 4124 4125 KASSERT(SPPP_WLOCKED(sp)); 4126 } 4127 4128 static void 4129 sppp_ipv6cp_scr(struct sppp *sp) 4130 { 4131 4132 KASSERT(SPPP_WLOCKED(sp)); 4133 } 4134 #endif /*INET6*/ 4135 4136 4137 /* 4138 *--------------------------------------------------------------------------* 4139 * * 4140 * The CHAP implementation. * 4141 * * 4142 *--------------------------------------------------------------------------* 4143 */ 4144 4145 /* 4146 * The authentication protocols don't employ a full-fledged state machine as 4147 * the control protocols do, since they do have Open and Close events, but 4148 * not Up and Down, nor are they explicitly terminated. Also, use of the 4149 * authentication protocols may be different in both directions (this makes 4150 * sense, think of a machine that never accepts incoming calls but only 4151 * calls out, it doesn't require the called party to authenticate itself). 4152 * 4153 * Our state machine for the local authentication protocol (we are requesting 4154 * the peer to authenticate) looks like: 4155 * 4156 * RCA- 4157 * +--------------------------------------------+ 4158 * V scn,tld| 4159 * +--------+ Close +---------+ RCA+ 4160 * | |<----------------------------------| |------+ 4161 * +--->| Closed | TO* | Opened | sca | 4162 * | | |-----+ +-------| |<-----+ 4163 * | +--------+ irc | | +---------+ 4164 * | ^ | | ^ 4165 * | | | | | 4166 * | | | | | 4167 * | TO-| | | | 4168 * | |tld TO+ V | | 4169 * | | +------->+ | | 4170 * | | | | | | 4171 * | +--------+ V | | 4172 * | | |<----+<--------------------+ | 4173 * | | Req- | scr | 4174 * | | Sent | | 4175 * | | | | 4176 * | +--------+ | 4177 * | RCA- | | RCA+ | 4178 * +------+ +------------------------------------------+ 4179 * scn,tld sca,irc,ict,tlu 4180 * 4181 * 4182 * with: 4183 * 4184 * Open: LCP reached authentication phase 4185 * Close: LCP reached terminate phase 4186 * 4187 * RCA+: received reply (pap-req, chap-response), acceptable 4188 * RCN: received reply (pap-req, chap-response), not acceptable 4189 * TO+: timeout with restart counter >= 0 4190 * TO-: timeout with restart counter < 0 4191 * TO*: reschedule timeout for CHAP 4192 * 4193 * scr: send request packet (none for PAP, chap-challenge) 4194 * sca: send ack packet (pap-ack, chap-success) 4195 * scn: send nak packet (pap-nak, chap-failure) 4196 * ict: initialize re-challenge timer (CHAP only) 4197 * 4198 * tlu: this-layer-up, LCP reaches network phase 4199 * tld: this-layer-down, LCP enters terminate phase 4200 * 4201 * Note that in CHAP mode, after sending a new challenge, while the state 4202 * automaton falls back into Req-Sent state, it doesn't signal a tld 4203 * event to LCP, so LCP remains in network phase. Only after not getting 4204 * any response (or after getting an unacceptable response), CHAP closes, 4205 * causing LCP to enter terminate phase. 4206 * 4207 * With PAP, there is no initial request that can be sent. The peer is 4208 * expected to send one based on the successful negotiation of PAP as 4209 * the authentication protocol during the LCP option negotiation. 4210 * 4211 * Incoming authentication protocol requests (remote requests 4212 * authentication, we are peer) don't employ a state machine at all, 4213 * they are simply answered. Some peers [Ascend P50 firmware rev 4214 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 4215 * still in authentication phase (thereby violating the standard that 4216 * demands that these NCP packets are to be discarded), so we keep 4217 * track of the peer demanding us to authenticate, and only proceed to 4218 * phase network once we've seen a positive acknowledge for the 4219 * authentication. 4220 */ 4221 4222 /* 4223 * Handle incoming CHAP packets. 4224 */ 4225 void 4226 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4227 { 4228 STDDCL; 4229 struct lcp_header *h; 4230 int len, x; 4231 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 4232 int value_len, name_len; 4233 MD5_CTX ctx; 4234 4235 len = m->m_pkthdr.len; 4236 if (len < 4) { 4237 if (debug) 4238 log(LOG_DEBUG, 4239 "%s: chap invalid packet length: %d bytes\n", 4240 ifp->if_xname, len); 4241 return; 4242 } 4243 h = mtod(m, struct lcp_header *); 4244 if (len > ntohs(h->len)) 4245 len = ntohs(h->len); 4246 4247 SPPP_LOCK(sp, RW_WRITER); 4248 4249 switch (h->type) { 4250 /* challenge, failure and success are his authproto */ 4251 case CHAP_CHALLENGE: 4252 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4253 /* can't do anything useful */ 4254 sp->pp_auth_failures++; 4255 printf("%s: chap input without my name and my secret being set\n", 4256 ifp->if_xname); 4257 break; 4258 } 4259 value = 1 + (u_char *)(h + 1); 4260 value_len = value[-1]; 4261 name = value + value_len; 4262 name_len = len - value_len - 5; 4263 if (name_len < 0) { 4264 if (debug) { 4265 log(LOG_DEBUG, 4266 "%s: chap corrupted challenge " 4267 "<%s id=0x%x len=%d", 4268 ifp->if_xname, 4269 sppp_auth_type_name(PPP_CHAP, h->type), 4270 h->ident, ntohs(h->len)); 4271 if (len > 4) 4272 sppp_print_bytes((u_char *)(h + 1), 4273 len - 4); 4274 addlog(">\n"); 4275 } 4276 break; 4277 } 4278 4279 if (debug) { 4280 log(LOG_DEBUG, 4281 "%s: chap input <%s id=0x%x len=%d name=", 4282 ifp->if_xname, 4283 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 4284 ntohs(h->len)); 4285 sppp_print_string((char *) name, name_len); 4286 addlog(" value-size=%d value=", value_len); 4287 sppp_print_bytes(value, value_len); 4288 addlog(">\n"); 4289 } 4290 4291 /* Compute reply value. */ 4292 MD5Init(&ctx); 4293 MD5Update(&ctx, &h->ident, 1); 4294 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4295 MD5Update(&ctx, value, value_len); 4296 MD5Final(digest, &ctx); 4297 dsize = sizeof digest; 4298 4299 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 4300 sizeof dsize, (const char *)&dsize, 4301 sizeof digest, digest, 4302 sp->myauth.name_len, 4303 sp->myauth.name, 4304 0); 4305 break; 4306 4307 case CHAP_SUCCESS: 4308 if (debug) { 4309 log(LOG_DEBUG, "%s: chap success", 4310 ifp->if_xname); 4311 if (len > 4) { 4312 addlog(": "); 4313 sppp_print_string((char *)(h + 1), len - 4); 4314 } 4315 addlog("\n"); 4316 } 4317 x = splnet(); 4318 sp->pp_auth_failures = 0; 4319 sp->pp_flags &= ~PP_NEEDAUTH; 4320 if (sp->myauth.proto == PPP_CHAP && 4321 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4322 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 4323 /* 4324 * We are authenticator for CHAP but didn't 4325 * complete yet. Leave it to tlu to proceed 4326 * to network phase. 4327 */ 4328 splx(x); 4329 break; 4330 } 4331 splx(x); 4332 sppp_phase_network(sp); 4333 break; 4334 4335 case CHAP_FAILURE: 4336 x = splnet(); 4337 sp->pp_auth_failures++; 4338 splx(x); 4339 if (debug) { 4340 log(LOG_INFO, "%s: chap failure", 4341 ifp->if_xname); 4342 if (len > 4) { 4343 addlog(": "); 4344 sppp_print_string((char *)(h + 1), len - 4); 4345 } 4346 addlog("\n"); 4347 } else 4348 log(LOG_INFO, "%s: chap failure\n", 4349 ifp->if_xname); 4350 /* await LCP shutdown by authenticator */ 4351 break; 4352 4353 /* response is my authproto */ 4354 case CHAP_RESPONSE: 4355 if (sp->hisauth.secret == NULL) { 4356 /* can't do anything useful */ 4357 printf("%s: chap input without his secret being set\n", 4358 ifp->if_xname); 4359 break; 4360 } 4361 value = 1 + (u_char *)(h + 1); 4362 value_len = value[-1]; 4363 name = value + value_len; 4364 name_len = len - value_len - 5; 4365 if (name_len < 0) { 4366 if (debug) { 4367 log(LOG_DEBUG, 4368 "%s: chap corrupted response " 4369 "<%s id=0x%x len=%d", 4370 ifp->if_xname, 4371 sppp_auth_type_name(PPP_CHAP, h->type), 4372 h->ident, ntohs(h->len)); 4373 if (len > 4) 4374 sppp_print_bytes((u_char *)(h + 1), 4375 len - 4); 4376 addlog(">\n"); 4377 } 4378 break; 4379 } 4380 if (h->ident != sp->confid[IDX_CHAP]) { 4381 if (debug) 4382 log(LOG_DEBUG, 4383 "%s: chap dropping response for old ID " 4384 "(got %d, expected %d)\n", 4385 ifp->if_xname, 4386 h->ident, sp->confid[IDX_CHAP]); 4387 break; 4388 } 4389 if (sp->hisauth.name != NULL && 4390 (name_len != sp->hisauth.name_len 4391 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4392 log(LOG_INFO, "%s: chap response, his name ", 4393 ifp->if_xname); 4394 sppp_print_string(name, name_len); 4395 addlog(" != expected "); 4396 sppp_print_string(sp->hisauth.name, 4397 sp->hisauth.name_len); 4398 addlog("\n"); 4399 goto chap_failure; 4400 } 4401 if (debug) { 4402 log(LOG_DEBUG, "%s: chap input(%s) " 4403 "<%s id=0x%x len=%d name=", 4404 ifp->if_xname, 4405 sppp_state_name(sp->state[IDX_CHAP]), 4406 sppp_auth_type_name(PPP_CHAP, h->type), 4407 h->ident, ntohs(h->len)); 4408 sppp_print_string((char *)name, name_len); 4409 addlog(" value-size=%d value=", value_len); 4410 sppp_print_bytes(value, value_len); 4411 addlog(">\n"); 4412 } 4413 if (value_len != sizeof(sp->hisauth.challenge)) { 4414 if (debug) 4415 log(LOG_DEBUG, 4416 "%s: chap bad hash value length: " 4417 "%d bytes, should be %zu\n", 4418 ifp->if_xname, value_len, 4419 sizeof(sp->hisauth.challenge)); 4420 goto chap_failure; 4421 } 4422 4423 MD5Init(&ctx); 4424 MD5Update(&ctx, &h->ident, 1); 4425 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4426 MD5Update(&ctx, sp->hisauth.challenge, sizeof(sp->hisauth.challenge)); 4427 MD5Final(digest, &ctx); 4428 4429 #define FAILMSG "Failed..." 4430 #define SUCCMSG "Welcome!" 4431 4432 if (value_len != sizeof digest || 4433 memcmp(digest, value, value_len) != 0) { 4434 chap_failure: 4435 KASSERT(SPPP_WLOCKED(sp)); 4436 /* action scn, tld */ 4437 sp->pp_auth_failures++; 4438 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4439 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4440 0); 4441 chap.tld(sp); 4442 break; 4443 } 4444 sp->pp_auth_failures = 0; 4445 /* action sca, perhaps tlu */ 4446 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4447 sp->state[IDX_CHAP] == STATE_OPENED) 4448 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4449 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4450 0); 4451 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4452 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4453 chap.tlu(sp); 4454 } 4455 break; 4456 4457 default: 4458 /* Unknown CHAP packet type -- ignore. */ 4459 if (debug) { 4460 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4461 "<0x%x id=0x%xh len=%d", 4462 ifp->if_xname, 4463 sppp_state_name(sp->state[IDX_CHAP]), 4464 h->type, h->ident, ntohs(h->len)); 4465 if (len > 4) 4466 sppp_print_bytes((u_char *)(h + 1), len - 4); 4467 addlog(">\n"); 4468 } 4469 break; 4470 4471 } 4472 4473 SPPP_UNLOCK(sp); 4474 } 4475 4476 static void 4477 sppp_chap_init(struct sppp *sp) 4478 { 4479 4480 KASSERT(SPPP_WLOCKED(sp)); 4481 4482 /* Chap doesn't have STATE_INITIAL at all. */ 4483 sp->state[IDX_CHAP] = STATE_CLOSED; 4484 sp->fail_counter[IDX_CHAP] = 0; 4485 sp->pp_seq[IDX_CHAP] = 0; 4486 sp->pp_rseq[IDX_CHAP] = 0; 4487 callout_init(&sp->ch[IDX_CHAP], CALLOUT_MPSAFE); 4488 } 4489 4490 static void 4491 sppp_chap_open(struct sppp *sp) 4492 { 4493 4494 KASSERT(SPPP_WLOCKED(sp)); 4495 if (sp->hisauth.proto == PPP_CHAP && 4496 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4497 /* we are authenticator for CHAP, start it */ 4498 chap.scr(sp); 4499 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4500 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4501 } 4502 /* nothing to be done if we are peer, await a challenge */ 4503 } 4504 4505 static void 4506 sppp_chap_close(struct sppp *sp) 4507 { 4508 4509 KASSERT(SPPP_WLOCKED(sp)); 4510 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4511 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4512 } 4513 4514 static void 4515 sppp_chap_TO(void *cookie) 4516 { 4517 struct sppp *sp = (struct sppp *)cookie; 4518 STDDCL; 4519 int s; 4520 4521 s = splnet(); 4522 4523 SPPP_LOCK(sp, RW_WRITER); 4524 4525 if (debug) 4526 log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n", 4527 ifp->if_xname, 4528 sppp_state_name(sp->state[IDX_CHAP]), 4529 sp->rst_counter[IDX_CHAP]); 4530 4531 if (--sp->rst_counter[IDX_CHAP] < 0) 4532 /* TO- event */ 4533 switch (sp->state[IDX_CHAP]) { 4534 case STATE_REQ_SENT: 4535 chap.tld(sp); 4536 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4537 break; 4538 } 4539 else 4540 /* TO+ (or TO*) event */ 4541 switch (sp->state[IDX_CHAP]) { 4542 case STATE_OPENED: 4543 /* TO* event */ 4544 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4545 /* fall through */ 4546 case STATE_REQ_SENT: 4547 chap.scr(sp); 4548 /* sppp_cp_change_state() will restart the timer */ 4549 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4550 break; 4551 } 4552 4553 SPPP_UNLOCK(sp); 4554 splx(s); 4555 } 4556 4557 static void 4558 sppp_chap_tlu(struct sppp *sp) 4559 { 4560 STDDCL; 4561 int i, x; 4562 4563 KASSERT(SPPP_WLOCKED(sp)); 4564 4565 i = 0; 4566 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4567 4568 /* 4569 * Some broken CHAP implementations (Conware CoNet, firmware 4570 * 4.0.?) don't want to re-authenticate their CHAP once the 4571 * initial challenge-response exchange has taken place. 4572 * Provide for an option to avoid rechallenges. 4573 */ 4574 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4575 /* 4576 * Compute the re-challenge timeout. This will yield 4577 * a number between 300 and 810 seconds. 4578 */ 4579 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4580 4581 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4582 } 4583 4584 if (debug) { 4585 log(LOG_DEBUG, 4586 "%s: chap %s, ", 4587 ifp->if_xname, 4588 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4589 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4590 addlog("next re-challenge in %d seconds\n", i); 4591 else 4592 addlog("re-challenging suppressed\n"); 4593 } 4594 4595 x = splnet(); 4596 sp->pp_auth_failures = 0; 4597 /* indicate to LCP that we need to be closed down */ 4598 sp->lcp.protos |= (1 << IDX_CHAP); 4599 4600 if (sp->pp_flags & PP_NEEDAUTH) { 4601 /* 4602 * Remote is authenticator, but his auth proto didn't 4603 * complete yet. Defer the transition to network 4604 * phase. 4605 */ 4606 splx(x); 4607 return; 4608 } 4609 splx(x); 4610 4611 /* 4612 * If we are already in phase network, we are done here. This 4613 * is the case if this is a dummy tlu event after a re-challenge. 4614 */ 4615 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4616 sppp_phase_network(sp); 4617 } 4618 4619 static void 4620 sppp_chap_tld(struct sppp *sp) 4621 { 4622 STDDCL; 4623 4624 KASSERT(SPPP_WLOCKED(sp)); 4625 4626 if (debug) 4627 log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname); 4628 callout_stop(&sp->ch[IDX_CHAP]); 4629 sp->lcp.protos &= ~(1 << IDX_CHAP); 4630 4631 lcp.Close(sp); 4632 } 4633 4634 static void 4635 sppp_chap_scr(struct sppp *sp) 4636 { 4637 uint32_t *ch; 4638 u_char clen = 4 * sizeof(uint32_t); 4639 4640 KASSERT(SPPP_WLOCKED(sp)); 4641 4642 if (sp->hisauth.name == NULL) { 4643 /* can't do anything useful */ 4644 printf("%s: chap starting without his name being set\n", 4645 sp->pp_if.if_xname); 4646 return; 4647 } 4648 4649 /* Compute random challenge. */ 4650 ch = (uint32_t *)sp->hisauth.challenge; 4651 cprng_strong(kern_cprng, ch, clen, 0); 4652 4653 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4654 4655 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4656 sizeof clen, (const char *)&clen, 4657 sizeof(sp->hisauth.challenge), sp->hisauth.challenge, 4658 0); 4659 } 4660 4661 /* 4662 *--------------------------------------------------------------------------* 4663 * * 4664 * The PAP implementation. * 4665 * * 4666 *--------------------------------------------------------------------------* 4667 */ 4668 /* 4669 * For PAP, we need to keep a little state also if we are the peer, not the 4670 * authenticator. This is since we don't get a request to authenticate, but 4671 * have to repeatedly authenticate ourself until we got a response (or the 4672 * retry counter is expired). 4673 */ 4674 4675 /* 4676 * Handle incoming PAP packets. */ 4677 static void 4678 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4679 { 4680 STDDCL; 4681 struct lcp_header *h; 4682 int len, x; 4683 u_char mlen; 4684 char *name, *secret; 4685 int name_len, secret_len; 4686 4687 /* 4688 * Malicious input might leave this uninitialized, so 4689 * init to an impossible value. 4690 */ 4691 secret_len = -1; 4692 4693 len = m->m_pkthdr.len; 4694 if (len < 5) { 4695 if (debug) 4696 log(LOG_DEBUG, 4697 "%s: pap invalid packet length: %d bytes\n", 4698 ifp->if_xname, len); 4699 return; 4700 } 4701 h = mtod(m, struct lcp_header *); 4702 if (len > ntohs(h->len)) 4703 len = ntohs(h->len); 4704 4705 SPPP_LOCK(sp, RW_WRITER); 4706 4707 switch (h->type) { 4708 /* PAP request is my authproto */ 4709 case PAP_REQ: 4710 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4711 /* can't do anything useful */ 4712 printf("%s: " 4713 "pap request without his name and his secret being set\n", 4714 ifp->if_xname); 4715 break; 4716 } 4717 name = 1 + (u_char *)(h + 1); 4718 name_len = name[-1]; 4719 secret = name + name_len + 1; 4720 if (name_len > len - 6 || 4721 (secret_len = secret[-1]) > len - 6 - name_len) { 4722 if (debug) { 4723 log(LOG_DEBUG, "%s: pap corrupted input " 4724 "<%s id=0x%x len=%d", 4725 ifp->if_xname, 4726 sppp_auth_type_name(PPP_PAP, h->type), 4727 h->ident, ntohs(h->len)); 4728 if (len > 4) 4729 sppp_print_bytes((u_char *)(h + 1), 4730 len - 4); 4731 addlog(">\n"); 4732 } 4733 break; 4734 } 4735 if (debug) { 4736 log(LOG_DEBUG, "%s: pap input(%s) " 4737 "<%s id=0x%x len=%d name=", 4738 ifp->if_xname, 4739 sppp_state_name(sp->state[IDX_PAP]), 4740 sppp_auth_type_name(PPP_PAP, h->type), 4741 h->ident, ntohs(h->len)); 4742 sppp_print_string((char *)name, name_len); 4743 addlog(" secret="); 4744 sppp_print_string((char *)secret, secret_len); 4745 addlog(">\n"); 4746 } 4747 if (name_len != sp->hisauth.name_len || 4748 secret_len != sp->hisauth.secret_len || 4749 memcmp(name, sp->hisauth.name, name_len) != 0 || 4750 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4751 /* action scn, tld */ 4752 sp->pp_auth_failures++; 4753 mlen = sizeof(FAILMSG) - 1; 4754 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4755 sizeof mlen, (const char *)&mlen, 4756 sizeof(FAILMSG) - 1, (const u_char *)FAILMSG, 4757 0); 4758 pap.tld(sp); 4759 break; 4760 } 4761 /* action sca, perhaps tlu */ 4762 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4763 sp->state[IDX_PAP] == STATE_OPENED) { 4764 mlen = sizeof(SUCCMSG) - 1; 4765 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4766 sizeof mlen, (const char *)&mlen, 4767 sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG, 4768 0); 4769 } 4770 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4771 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4772 pap.tlu(sp); 4773 } 4774 break; 4775 4776 /* ack and nak are his authproto */ 4777 case PAP_ACK: 4778 callout_stop(&sp->pap_my_to_ch); 4779 if (debug) { 4780 log(LOG_DEBUG, "%s: pap success", 4781 ifp->if_xname); 4782 name = 1 + (u_char *)(h + 1); 4783 name_len = name[-1]; 4784 if (len > 5 && name_len < len+4) { 4785 addlog(": "); 4786 sppp_print_string(name, name_len); 4787 } 4788 addlog("\n"); 4789 } 4790 x = splnet(); 4791 sp->pp_auth_failures = 0; 4792 sp->pp_flags &= ~PP_NEEDAUTH; 4793 if (sp->myauth.proto == PPP_PAP && 4794 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4795 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4796 /* 4797 * We are authenticator for PAP but didn't 4798 * complete yet. Leave it to tlu to proceed 4799 * to network phase. 4800 */ 4801 splx(x); 4802 break; 4803 } 4804 splx(x); 4805 sppp_phase_network(sp); 4806 break; 4807 4808 case PAP_NAK: 4809 callout_stop(&sp->pap_my_to_ch); 4810 sp->pp_auth_failures++; 4811 if (debug) { 4812 log(LOG_INFO, "%s: pap failure", 4813 ifp->if_xname); 4814 name = 1 + (u_char *)(h + 1); 4815 name_len = name[-1]; 4816 if (len > 5 && name_len < len+4) { 4817 addlog(": "); 4818 sppp_print_string(name, name_len); 4819 } 4820 addlog("\n"); 4821 } else 4822 log(LOG_INFO, "%s: pap failure\n", 4823 ifp->if_xname); 4824 /* await LCP shutdown by authenticator */ 4825 break; 4826 4827 default: 4828 /* Unknown PAP packet type -- ignore. */ 4829 if (debug) { 4830 log(LOG_DEBUG, "%s: pap corrupted input " 4831 "<0x%x id=0x%x len=%d", 4832 ifp->if_xname, 4833 h->type, h->ident, ntohs(h->len)); 4834 if (len > 4) 4835 sppp_print_bytes((u_char *)(h + 1), len - 4); 4836 addlog(">\n"); 4837 } 4838 break; 4839 } 4840 4841 SPPP_UNLOCK(sp); 4842 } 4843 4844 static void 4845 sppp_pap_init(struct sppp *sp) 4846 { 4847 4848 KASSERT(SPPP_WLOCKED(sp)); 4849 4850 /* PAP doesn't have STATE_INITIAL at all. */ 4851 sp->state[IDX_PAP] = STATE_CLOSED; 4852 sp->fail_counter[IDX_PAP] = 0; 4853 sp->pp_seq[IDX_PAP] = 0; 4854 sp->pp_rseq[IDX_PAP] = 0; 4855 callout_init(&sp->ch[IDX_PAP], CALLOUT_MPSAFE); 4856 callout_init(&sp->pap_my_to_ch, CALLOUT_MPSAFE); 4857 } 4858 4859 static void 4860 sppp_pap_open(struct sppp *sp) 4861 { 4862 4863 KASSERT(SPPP_WLOCKED(sp)); 4864 4865 if (sp->hisauth.proto == PPP_PAP && 4866 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4867 /* we are authenticator for PAP, start our timer */ 4868 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4869 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4870 } 4871 if (sp->myauth.proto == PPP_PAP) { 4872 /* we are peer, send a request, and start a timer */ 4873 pap.scr(sp); 4874 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4875 sppp_pap_my_TO, sp); 4876 } 4877 } 4878 4879 static void 4880 sppp_pap_close(struct sppp *sp) 4881 { 4882 4883 KASSERT(SPPP_WLOCKED(sp)); 4884 4885 if (sp->state[IDX_PAP] != STATE_CLOSED) 4886 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4887 } 4888 4889 /* 4890 * That's the timeout routine if we are authenticator. Since the 4891 * authenticator is basically passive in PAP, we can't do much here. 4892 */ 4893 static void 4894 sppp_pap_TO(void *cookie) 4895 { 4896 struct sppp *sp = (struct sppp *)cookie; 4897 STDDCL; 4898 int s; 4899 4900 s = splnet(); 4901 SPPP_LOCK(sp, RW_WRITER); 4902 4903 if (debug) 4904 log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n", 4905 ifp->if_xname, 4906 sppp_state_name(sp->state[IDX_PAP]), 4907 sp->rst_counter[IDX_PAP]); 4908 4909 if (--sp->rst_counter[IDX_PAP] < 0) 4910 /* TO- event */ 4911 switch (sp->state[IDX_PAP]) { 4912 case STATE_REQ_SENT: 4913 pap.tld(sp); 4914 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4915 break; 4916 } 4917 else 4918 /* TO+ event, not very much we could do */ 4919 switch (sp->state[IDX_PAP]) { 4920 case STATE_REQ_SENT: 4921 /* sppp_cp_change_state() will restart the timer */ 4922 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4923 break; 4924 } 4925 4926 SPPP_UNLOCK(sp); 4927 splx(s); 4928 } 4929 4930 /* 4931 * That's the timeout handler if we are peer. Since the peer is active, 4932 * we need to retransmit our PAP request since it is apparently lost. 4933 * XXX We should impose a max counter. 4934 */ 4935 static void 4936 sppp_pap_my_TO(void *cookie) 4937 { 4938 struct sppp *sp = (struct sppp *)cookie; 4939 STDDCL; 4940 4941 SPPP_LOCK(sp, RW_WRITER); 4942 if (debug) 4943 log(LOG_DEBUG, "%s: pap peer TO\n", 4944 ifp->if_xname); 4945 4946 pap.scr(sp); 4947 4948 SPPP_UNLOCK(sp); 4949 } 4950 4951 static void 4952 sppp_pap_tlu(struct sppp *sp) 4953 { 4954 STDDCL; 4955 int x; 4956 4957 KASSERT(SPPP_WLOCKED(sp)); 4958 4959 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4960 4961 if (debug) 4962 log(LOG_DEBUG, "%s: %s tlu\n", 4963 ifp->if_xname, pap.name); 4964 4965 x = splnet(); 4966 sp->pp_auth_failures = 0; 4967 /* indicate to LCP that we need to be closed down */ 4968 sp->lcp.protos |= (1 << IDX_PAP); 4969 4970 if (sp->pp_flags & PP_NEEDAUTH) { 4971 /* 4972 * Remote is authenticator, but his auth proto didn't 4973 * complete yet. Defer the transition to network 4974 * phase. 4975 */ 4976 splx(x); 4977 return; 4978 } 4979 splx(x); 4980 sppp_phase_network(sp); 4981 } 4982 4983 static void 4984 sppp_pap_tld(struct sppp *sp) 4985 { 4986 STDDCL; 4987 4988 KASSERT(SPPP_WLOCKED(sp)); 4989 4990 if (debug) 4991 log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname); 4992 callout_stop(&sp->ch[IDX_PAP]); 4993 callout_stop(&sp->pap_my_to_ch); 4994 sp->lcp.protos &= ~(1 << IDX_PAP); 4995 4996 lcp.Close(sp); 4997 } 4998 4999 static void 5000 sppp_pap_scr(struct sppp *sp) 5001 { 5002 u_char idlen, pwdlen; 5003 5004 KASSERT(SPPP_WLOCKED(sp)); 5005 5006 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 5007 /* can't do anything useful */ 5008 printf("%s: pap starting without my name and secret being set\n", 5009 sp->pp_if.if_xname); 5010 return; 5011 } 5012 5013 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 5014 pwdlen = sp->myauth.secret_len; 5015 idlen = sp->myauth.name_len; 5016 5017 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 5018 sizeof idlen, (const char *)&idlen, 5019 idlen, sp->myauth.name, 5020 sizeof pwdlen, (const char *)&pwdlen, 5021 pwdlen, sp->myauth.secret, 5022 0); 5023 } 5024 5025 /* 5026 * Random miscellaneous functions. 5027 */ 5028 5029 /* 5030 * Send a PAP or CHAP proto packet. 5031 * 5032 * Varadic function, each of the elements for the ellipsis is of type 5033 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5034 * mlen == 0. 5035 * NOTE: never declare variadic functions with types subject to type 5036 * promotion (i.e. u_char). This is asking for big trouble depending 5037 * on the architecture you are on... 5038 */ 5039 5040 static void 5041 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5042 unsigned int type, unsigned int id, 5043 ...) 5044 { 5045 STDDCL; 5046 struct lcp_header *lh; 5047 struct mbuf *m; 5048 u_char *p; 5049 int len; 5050 size_t pkthdrlen; 5051 unsigned int mlen; 5052 const char *msg; 5053 va_list ap; 5054 5055 KASSERT(SPPP_WLOCKED(sp)); 5056 5057 MGETHDR(m, M_DONTWAIT, MT_DATA); 5058 if (! m) 5059 return; 5060 m_reset_rcvif(m); 5061 5062 if (sp->pp_flags & PP_NOFRAMING) { 5063 *mtod(m, uint16_t *) = htons(cp->proto); 5064 pkthdrlen = 2; 5065 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5066 } else { 5067 struct ppp_header *h; 5068 h = mtod(m, struct ppp_header *); 5069 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5070 h->control = PPP_UI; /* Unnumbered Info */ 5071 h->protocol = htons(cp->proto); 5072 pkthdrlen = PPP_HEADER_LEN; 5073 5074 lh = (struct lcp_header *)(h + 1); 5075 } 5076 5077 lh->type = type; 5078 lh->ident = id; 5079 p = (u_char *)(lh + 1); 5080 5081 va_start(ap, id); 5082 len = 0; 5083 5084 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5085 msg = va_arg(ap, const char *); 5086 len += mlen; 5087 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5088 va_end(ap); 5089 m_freem(m); 5090 return; 5091 } 5092 5093 memcpy(p, msg, mlen); 5094 p += mlen; 5095 } 5096 va_end(ap); 5097 5098 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5099 lh->len = htons(LCP_HEADER_LEN + len); 5100 5101 if (debug) { 5102 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 5103 ifp->if_xname, cp->name, 5104 sppp_auth_type_name(cp->proto, lh->type), 5105 lh->ident, ntohs(lh->len)); 5106 if (len) 5107 sppp_print_bytes((u_char *)(lh + 1), len); 5108 addlog(">\n"); 5109 } 5110 if (IF_QFULL(&sp->pp_cpq)) { 5111 IF_DROP(&sp->pp_fastq); 5112 IF_DROP(&ifp->if_snd); 5113 m_freem(m); 5114 if_statinc(ifp, if_oerrors); 5115 return; 5116 } 5117 5118 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5119 IF_ENQUEUE(&sp->pp_cpq, m); 5120 5121 if (! (ifp->if_flags & IFF_OACTIVE)) { 5122 SPPP_UNLOCK(sp); 5123 if_start_lock(ifp); 5124 SPPP_LOCK(sp, RW_WRITER); 5125 } 5126 } 5127 5128 /* 5129 * Send keepalive packets, every 10 seconds. 5130 */ 5131 static void 5132 sppp_keepalive(void *dummy) 5133 { 5134 struct sppp *sp; 5135 int s; 5136 time_t now; 5137 5138 SPPPQ_LOCK(); 5139 5140 s = splnet(); 5141 now = time_uptime; 5142 for (sp=spppq; sp; sp=sp->pp_next) { 5143 struct ifnet *ifp = NULL; 5144 5145 SPPP_LOCK(sp, RW_WRITER); 5146 ifp = &sp->pp_if; 5147 5148 /* check idle timeout */ 5149 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5150 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5151 /* idle timeout is enabled for this interface */ 5152 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5153 if (ifp->if_flags & IFF_DEBUG) 5154 printf("%s: no activity for %lu seconds\n", 5155 sp->pp_if.if_xname, 5156 (unsigned long)(now-sp->pp_last_activity)); 5157 lcp.Close(sp); 5158 SPPP_UNLOCK(sp); 5159 continue; 5160 } 5161 } 5162 5163 /* Keepalive mode disabled or channel down? */ 5164 if (! (sp->pp_flags & PP_KEEPALIVE) || 5165 ! (ifp->if_flags & IFF_RUNNING)) { 5166 SPPP_UNLOCK(sp); 5167 continue; 5168 } 5169 5170 5171 /* No keepalive in PPP mode if LCP not opened yet. */ 5172 if (! (sp->pp_flags & PP_CISCO) && 5173 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5174 SPPP_UNLOCK(sp); 5175 continue; 5176 } 5177 5178 /* No echo reply, but maybe user data passed through? */ 5179 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5180 sp->pp_alivecnt = 0; 5181 SPPP_UNLOCK(sp); 5182 continue; 5183 } 5184 5185 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5186 /* No keepalive packets got. Stop the interface. */ 5187 SPPP_UNLOCK(sp); 5188 if_down (ifp); 5189 SPPP_LOCK(sp, RW_WRITER); 5190 5191 IF_PURGE(&sp->pp_cpq); 5192 5193 if (! (sp->pp_flags & PP_CISCO)) { 5194 printf("%s: LCP keepalive timed out, going to restart the connection\n", 5195 ifp->if_xname); 5196 sp->pp_alivecnt = 0; 5197 5198 /* we are down, close all open protocols */ 5199 lcp.Close(sp); 5200 5201 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5202 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 5203 5204 /* Close connection immediately, completition of this 5205 * will summon the magic needed to reestablish it. */ 5206 sppp_notify_tlf_wlocked(sp); 5207 5208 SPPP_UNLOCK(sp); 5209 continue; 5210 } 5211 } 5212 if (sp->pp_alivecnt < sp->pp_maxalive) 5213 ++sp->pp_alivecnt; 5214 if (sp->pp_flags & PP_CISCO) 5215 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 5216 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 5217 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5218 int32_t nmagic = htonl(sp->lcp.magic); 5219 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 5220 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5221 sp->lcp.echoid, 4, &nmagic); 5222 } 5223 5224 SPPP_UNLOCK(sp); 5225 } 5226 splx(s); 5227 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5228 5229 SPPPQ_UNLOCK(); 5230 } 5231 5232 #ifdef INET 5233 /* 5234 * Get both IP addresses. 5235 */ 5236 static void 5237 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5238 { 5239 struct ifnet *ifp = &sp->pp_if; 5240 struct ifaddr *ifa; 5241 struct sockaddr_in *si, *sm; 5242 uint32_t ssrc, ddst; 5243 int s; 5244 struct psref psref; 5245 5246 sm = NULL; 5247 ssrc = ddst = 0; 5248 /* 5249 * Pick the first AF_INET address from the list, 5250 * aliases don't make any sense on a p2p link anyway. 5251 */ 5252 si = 0; 5253 s = pserialize_read_enter(); 5254 IFADDR_READER_FOREACH(ifa, ifp) { 5255 if (ifa->ifa_addr->sa_family == AF_INET) { 5256 si = (struct sockaddr_in *)ifa->ifa_addr; 5257 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5258 if (si) { 5259 ifa_acquire(ifa, &psref); 5260 break; 5261 } 5262 } 5263 } 5264 pserialize_read_exit(s); 5265 if (ifa) { 5266 if (si && si->sin_addr.s_addr) { 5267 ssrc = si->sin_addr.s_addr; 5268 if (srcmask) 5269 *srcmask = ntohl(sm->sin_addr.s_addr); 5270 } 5271 5272 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5273 if (si && si->sin_addr.s_addr) 5274 ddst = si->sin_addr.s_addr; 5275 ifa_release(ifa, &psref); 5276 } 5277 5278 if (dst) *dst = ntohl(ddst); 5279 if (src) *src = ntohl(ssrc); 5280 } 5281 5282 /* 5283 * Set IP addresses. Must be called at splnet. 5284 * If an address is 0, leave it the way it is. 5285 */ 5286 static void 5287 sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp) 5288 { 5289 STDDCL; 5290 struct ifaddr *ifa; 5291 struct sockaddr_in *si, *dest; 5292 uint32_t myaddr = 0, hisaddr = 0; 5293 int s; 5294 5295 IFNET_LOCK(ifp); 5296 5297 /* 5298 * Pick the first AF_INET address from the list, 5299 * aliases don't make any sense on a p2p link anyway. 5300 */ 5301 si = dest = NULL; 5302 s = pserialize_read_enter(); 5303 IFADDR_READER_FOREACH(ifa, ifp) { 5304 if (ifa->ifa_addr->sa_family == AF_INET) { 5305 si = (struct sockaddr_in *)ifa->ifa_addr; 5306 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5307 break; 5308 } 5309 } 5310 pserialize_read_exit(s); 5311 5312 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5313 myaddr = sp->ipcp.req_myaddr; 5314 else if (si != NULL) 5315 myaddr = ntohl(si->sin_addr.s_addr); 5316 5317 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5318 hisaddr = sp->ipcp.req_hisaddr; 5319 else if (dest != NULL) 5320 hisaddr = ntohl(dest->sin_addr.s_addr); 5321 5322 if (si != NULL && dest != NULL) { 5323 int error; 5324 struct sockaddr_in new_sin = *si; 5325 struct sockaddr_in new_dst = *dest; 5326 5327 if (myaddr != 0) 5328 new_sin.sin_addr.s_addr = htonl(myaddr); 5329 if (hisaddr != 0) { 5330 new_dst.sin_addr.s_addr = htonl(hisaddr); 5331 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5332 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5333 } 5334 5335 in_addrhash_remove(ifatoia(ifa)); 5336 5337 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5338 5339 in_addrhash_insert(ifatoia(ifa)); 5340 5341 if (debug && error) 5342 { 5343 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5344 ifp->if_xname, __func__, error); 5345 } 5346 if (!error) { 5347 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5348 } 5349 } 5350 5351 if (ifp->if_mtu > sp->lcp.their_mru) { 5352 sp->pp_saved_mtu = ifp->if_mtu; 5353 ifp->if_mtu = sp->lcp.their_mru; 5354 if (debug) 5355 log(LOG_DEBUG, 5356 "%s: setting MTU to %" PRIu64 " bytes\n", 5357 ifp->if_xname, ifp->if_mtu); 5358 } 5359 5360 IFNET_UNLOCK(ifp); 5361 5362 sppp_notify_con(sp); 5363 } 5364 5365 static void 5366 sppp_set_ip_addrs(struct sppp *sp) 5367 { 5368 struct ifnet *ifp = &sp->pp_if; 5369 5370 if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_SET_ADDRS)) { 5371 log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n", 5372 ifp->if_xname); 5373 return; 5374 } 5375 5376 if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1) 5377 return; 5378 5379 workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL); 5380 } 5381 5382 /* 5383 * Clear IP addresses. Must be called at splnet. 5384 */ 5385 static void 5386 sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp) 5387 { 5388 STDDCL; 5389 struct ifaddr *ifa; 5390 struct sockaddr_in *si, *dest; 5391 int s; 5392 5393 IFNET_LOCK(ifp); 5394 5395 /* 5396 * Pick the first AF_INET address from the list, 5397 * aliases don't make any sense on a p2p link anyway. 5398 */ 5399 si = dest = NULL; 5400 s = pserialize_read_enter(); 5401 IFADDR_READER_FOREACH(ifa, ifp) { 5402 if (ifa->ifa_addr->sa_family == AF_INET) { 5403 si = (struct sockaddr_in *)ifa->ifa_addr; 5404 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5405 break; 5406 } 5407 } 5408 pserialize_read_exit(s); 5409 5410 if (si != NULL) { 5411 struct sockaddr_in new_sin = *si; 5412 struct sockaddr_in new_dst = *dest; 5413 int error; 5414 5415 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5416 new_sin.sin_addr.s_addr = 0; 5417 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 5418 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5419 5420 in_addrhash_remove(ifatoia(ifa)); 5421 5422 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5423 5424 in_addrhash_insert(ifatoia(ifa)); 5425 5426 if (debug && error) 5427 { 5428 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5429 ifp->if_xname, __func__, error); 5430 } 5431 if (!error) { 5432 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5433 } 5434 } 5435 5436 if (sp->pp_saved_mtu > 0) { 5437 ifp->if_mtu = sp->pp_saved_mtu; 5438 sp->pp_saved_mtu = 0; 5439 if (debug) 5440 log(LOG_DEBUG, 5441 "%s: resetting MTU to %" PRIu64 " bytes\n", 5442 ifp->if_xname, ifp->if_mtu); 5443 } 5444 5445 IFNET_UNLOCK(ifp); 5446 } 5447 5448 static void 5449 sppp_clear_ip_addrs(struct sppp *sp) 5450 { 5451 struct ifnet *ifp = &sp->pp_if; 5452 5453 if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_CLEAR_ADDRS)) { 5454 log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n", 5455 ifp->if_xname); 5456 return; 5457 } 5458 5459 if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1) 5460 return; 5461 5462 workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL); 5463 } 5464 5465 static void 5466 sppp_update_ip_addrs_work(struct work *wk, void *arg) 5467 { 5468 struct sppp *sp = arg; 5469 void *work; 5470 5471 atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 0); 5472 5473 while ((work = pcq_get(sp->ipcp.update_addrs_q)) != NULL) { 5474 int update = (intptr_t)work; 5475 5476 if (update == IPCP_SET_ADDRS) 5477 sppp_set_ip_addrs_work(wk, sp); 5478 else if (update == IPCP_CLEAR_ADDRS) 5479 sppp_clear_ip_addrs_work(wk, sp); 5480 } 5481 } 5482 #endif 5483 5484 #ifdef INET6 5485 /* 5486 * Get both IPv6 addresses. 5487 */ 5488 static void 5489 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5490 struct in6_addr *srcmask) 5491 { 5492 struct ifnet *ifp = &sp->pp_if; 5493 struct ifaddr *ifa; 5494 struct sockaddr_in6 *si, *sm; 5495 struct in6_addr ssrc, ddst; 5496 int s; 5497 struct psref psref; 5498 5499 sm = NULL; 5500 memset(&ssrc, 0, sizeof(ssrc)); 5501 memset(&ddst, 0, sizeof(ddst)); 5502 /* 5503 * Pick the first link-local AF_INET6 address from the list, 5504 * aliases don't make any sense on a p2p link anyway. 5505 */ 5506 si = 0; 5507 s = pserialize_read_enter(); 5508 IFADDR_READER_FOREACH(ifa, ifp) { 5509 if (ifa->ifa_addr->sa_family == AF_INET6) { 5510 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5511 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5512 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5513 ifa_acquire(ifa, &psref); 5514 break; 5515 } 5516 } 5517 } 5518 pserialize_read_exit(s); 5519 5520 if (ifa) { 5521 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5522 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5523 if (srcmask) { 5524 memcpy(srcmask, &sm->sin6_addr, 5525 sizeof(*srcmask)); 5526 } 5527 } 5528 5529 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5530 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5531 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5532 ifa_release(ifa, &psref); 5533 } 5534 5535 if (dst) 5536 memcpy(dst, &ddst, sizeof(*dst)); 5537 if (src) 5538 memcpy(src, &ssrc, sizeof(*src)); 5539 } 5540 5541 #ifdef IPV6CP_MYIFID_DYN 5542 /* 5543 * Generate random ifid. 5544 */ 5545 static void 5546 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5547 { 5548 /* TBD */ 5549 } 5550 5551 /* 5552 * Set my IPv6 address. Must be called at splnet. 5553 */ 5554 static void 5555 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5556 { 5557 STDDCL; 5558 struct ifaddr *ifa; 5559 struct sockaddr_in6 *sin6; 5560 int s; 5561 struct psref psref; 5562 5563 IFNET_LOCK(ifp); 5564 5565 /* 5566 * Pick the first link-local AF_INET6 address from the list, 5567 * aliases don't make any sense on a p2p link anyway. 5568 */ 5569 5570 sin6 = NULL; 5571 s = pserialize_read_enter(); 5572 IFADDR_READER_FOREACH(ifa, ifp) 5573 { 5574 if (ifa->ifa_addr->sa_family == AF_INET6) 5575 { 5576 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5577 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5578 ifa_acquire(ifa, &psref); 5579 break; 5580 } 5581 } 5582 } 5583 pserialize_read_exit(s); 5584 5585 if (ifa && sin6) 5586 { 5587 int error; 5588 struct sockaddr_in6 new_sin6 = *sin6; 5589 5590 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5591 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5592 if (debug && error) 5593 { 5594 log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n", 5595 ifp->if_xname, __func__, error); 5596 } 5597 if (!error) { 5598 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5599 } 5600 ifa_release(ifa, &psref); 5601 } 5602 5603 IFNET_UNLOCK(ifp); 5604 } 5605 #endif 5606 5607 /* 5608 * Suggest a candidate address to be used by peer. 5609 */ 5610 static void 5611 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5612 { 5613 struct in6_addr myaddr; 5614 struct timeval tv; 5615 5616 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5617 5618 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5619 microtime(&tv); 5620 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5621 myaddr.s6_addr[14] ^= 0xff; 5622 myaddr.s6_addr[15] ^= 0xff; 5623 } else { 5624 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5625 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5626 } 5627 if (suggest) 5628 memcpy(suggest, &myaddr, sizeof(myaddr)); 5629 } 5630 #endif /*INET6*/ 5631 5632 /* 5633 * Process ioctl requests specific to the PPP interface. 5634 * Permissions have already been checked. 5635 */ 5636 static int 5637 sppp_params(struct sppp *sp, u_long cmd, void *data) 5638 { 5639 switch (cmd) { 5640 case SPPPGETAUTHCFG: 5641 { 5642 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5643 int error; 5644 size_t len; 5645 5646 SPPP_LOCK(sp, RW_READER); 5647 5648 cfg->myauthflags = sp->myauth.flags; 5649 cfg->hisauthflags = sp->hisauth.flags; 5650 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5651 cfg->hisauth = 0; 5652 if (sp->hisauth.proto) 5653 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5654 cfg->myauth = 0; 5655 if (sp->myauth.proto) 5656 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5657 if (cfg->myname_length == 0) { 5658 if (sp->myauth.name != NULL) 5659 cfg->myname_length = sp->myauth.name_len + 1; 5660 } else { 5661 if (sp->myauth.name == NULL) { 5662 cfg->myname_length = 0; 5663 } else { 5664 len = sp->myauth.name_len + 1; 5665 5666 5667 if (cfg->myname_length < len) { 5668 SPPP_UNLOCK(sp); 5669 return (ENAMETOOLONG); 5670 } 5671 error = copyout(sp->myauth.name, cfg->myname, len); 5672 if (error) { 5673 SPPP_UNLOCK(sp); 5674 return error; 5675 } 5676 } 5677 } 5678 if (cfg->hisname_length == 0) { 5679 if (sp->hisauth.name != NULL) 5680 cfg->hisname_length = sp->hisauth.name_len + 1; 5681 } else { 5682 if (sp->hisauth.name == NULL) { 5683 cfg->hisname_length = 0; 5684 } else { 5685 len = sp->hisauth.name_len + 1; 5686 5687 if (cfg->hisname_length < len) { 5688 SPPP_UNLOCK(sp); 5689 return (ENAMETOOLONG); 5690 } 5691 error = copyout(sp->hisauth.name, cfg->hisname, len); 5692 if (error) { 5693 SPPP_UNLOCK(sp); 5694 return error; 5695 } 5696 } 5697 } 5698 SPPP_UNLOCK(sp); 5699 } 5700 break; 5701 case SPPPSETAUTHCFG: 5702 { 5703 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5704 int error; 5705 5706 SPPP_LOCK(sp, RW_WRITER); 5707 5708 if (sp->myauth.name) { 5709 free(sp->myauth.name, M_DEVBUF); 5710 sp->myauth.name = NULL; 5711 } 5712 if (sp->myauth.secret) { 5713 free(sp->myauth.secret, M_DEVBUF); 5714 sp->myauth.secret = NULL; 5715 } 5716 if (sp->hisauth.name) { 5717 free(sp->hisauth.name, M_DEVBUF); 5718 sp->hisauth.name = NULL; 5719 } 5720 if (sp->hisauth.secret) { 5721 free(sp->hisauth.secret, M_DEVBUF); 5722 sp->hisauth.secret = NULL; 5723 } 5724 5725 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5726 if (cfg->hisname_length >= MCLBYTES) { 5727 SPPP_UNLOCK(sp); 5728 return (ENAMETOOLONG); 5729 } 5730 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5731 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5732 if (error) { 5733 free(sp->hisauth.name, M_DEVBUF); 5734 sp->hisauth.name = NULL; 5735 SPPP_UNLOCK(sp); 5736 return error; 5737 } 5738 sp->hisauth.name_len = cfg->hisname_length - 1; 5739 sp->hisauth.name[sp->hisauth.name_len] = 0; 5740 } 5741 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5742 if (cfg->hissecret_length >= MCLBYTES) { 5743 SPPP_UNLOCK(sp); 5744 return (ENAMETOOLONG); 5745 } 5746 sp->hisauth.secret = malloc(cfg->hissecret_length, 5747 M_DEVBUF, M_WAITOK); 5748 error = copyin(cfg->hissecret, sp->hisauth.secret, 5749 cfg->hissecret_length); 5750 if (error) { 5751 free(sp->hisauth.secret, M_DEVBUF); 5752 sp->hisauth.secret = NULL; 5753 SPPP_UNLOCK(sp); 5754 return error; 5755 } 5756 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5757 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5758 } 5759 if (cfg->myname != NULL && cfg->myname_length > 0) { 5760 if (cfg->myname_length >= MCLBYTES) { 5761 SPPP_UNLOCK(sp); 5762 return (ENAMETOOLONG); 5763 } 5764 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5765 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5766 if (error) { 5767 free(sp->myauth.name, M_DEVBUF); 5768 sp->myauth.name = NULL; 5769 SPPP_UNLOCK(sp); 5770 return error; 5771 } 5772 sp->myauth.name_len = cfg->myname_length - 1; 5773 sp->myauth.name[sp->myauth.name_len] = 0; 5774 } 5775 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5776 if (cfg->mysecret_length >= MCLBYTES) { 5777 SPPP_UNLOCK(sp); 5778 return (ENAMETOOLONG); 5779 } 5780 sp->myauth.secret = malloc(cfg->mysecret_length, 5781 M_DEVBUF, M_WAITOK); 5782 error = copyin(cfg->mysecret, sp->myauth.secret, 5783 cfg->mysecret_length); 5784 if (error) { 5785 free(sp->myauth.secret, M_DEVBUF); 5786 sp->myauth.secret = NULL; 5787 SPPP_UNLOCK(sp); 5788 return error; 5789 } 5790 sp->myauth.secret_len = cfg->mysecret_length - 1; 5791 sp->myauth.secret[sp->myauth.secret_len] = 0; 5792 } 5793 sp->myauth.flags = cfg->myauthflags; 5794 if (cfg->myauth) 5795 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5796 sp->hisauth.flags = cfg->hisauthflags; 5797 if (cfg->hisauth) 5798 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5799 sp->pp_auth_failures = 0; 5800 if (sp->hisauth.proto != 0) 5801 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5802 else 5803 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5804 5805 SPPP_UNLOCK(sp); 5806 } 5807 break; 5808 case SPPPGETLCPCFG: 5809 { 5810 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5811 5812 SPPP_LOCK(sp, RW_READER); 5813 lcpp->lcp_timeout = sp->lcp.timeout; 5814 SPPP_UNLOCK(sp); 5815 } 5816 break; 5817 case SPPPSETLCPCFG: 5818 { 5819 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5820 5821 SPPP_LOCK(sp, RW_WRITER); 5822 sp->lcp.timeout = lcpp->lcp_timeout; 5823 SPPP_UNLOCK(sp); 5824 } 5825 break; 5826 case SPPPGETSTATUS: 5827 { 5828 struct spppstatus *status = (struct spppstatus *)data; 5829 5830 SPPP_LOCK(sp, RW_READER); 5831 status->phase = sp->pp_phase; 5832 SPPP_UNLOCK(sp); 5833 } 5834 break; 5835 case SPPPGETSTATUSNCP: 5836 { 5837 struct spppstatusncp *status = (struct spppstatusncp *)data; 5838 5839 SPPP_LOCK(sp, RW_READER); 5840 status->phase = sp->pp_phase; 5841 status->ncpup = sppp_ncp_check(sp); 5842 SPPP_UNLOCK(sp); 5843 } 5844 break; 5845 case SPPPGETIDLETO: 5846 { 5847 struct spppidletimeout *to = (struct spppidletimeout *)data; 5848 5849 SPPP_LOCK(sp, RW_READER); 5850 to->idle_seconds = sp->pp_idle_timeout; 5851 SPPP_UNLOCK(sp); 5852 } 5853 break; 5854 case SPPPSETIDLETO: 5855 { 5856 struct spppidletimeout *to = (struct spppidletimeout *)data; 5857 5858 SPPP_LOCK(sp, RW_WRITER); 5859 sp->pp_idle_timeout = to->idle_seconds; 5860 SPPP_UNLOCK(sp); 5861 } 5862 break; 5863 case SPPPSETAUTHFAILURE: 5864 { 5865 struct spppauthfailuresettings *afsettings = 5866 (struct spppauthfailuresettings *)data; 5867 5868 SPPP_LOCK(sp, RW_WRITER); 5869 sp->pp_max_auth_fail = afsettings->max_failures; 5870 sp->pp_auth_failures = 0; 5871 SPPP_UNLOCK(sp); 5872 } 5873 break; 5874 case SPPPGETAUTHFAILURES: 5875 { 5876 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5877 5878 SPPP_LOCK(sp, RW_READER); 5879 stats->auth_failures = sp->pp_auth_failures; 5880 stats->max_failures = sp->pp_max_auth_fail; 5881 SPPP_UNLOCK(sp); 5882 } 5883 break; 5884 case SPPPSETDNSOPTS: 5885 { 5886 struct spppdnssettings *req = (struct spppdnssettings *)data; 5887 5888 SPPP_LOCK(sp, RW_WRITER); 5889 sp->query_dns = req->query_dns & 3; 5890 SPPP_UNLOCK(sp); 5891 } 5892 break; 5893 case SPPPGETDNSOPTS: 5894 { 5895 struct spppdnssettings *req = (struct spppdnssettings *)data; 5896 5897 SPPP_LOCK(sp, RW_READER); 5898 req->query_dns = sp->query_dns; 5899 SPPP_UNLOCK(sp); 5900 } 5901 break; 5902 case SPPPGETDNSADDRS: 5903 { 5904 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5905 5906 SPPP_LOCK(sp, RW_READER); 5907 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5908 SPPP_UNLOCK(sp); 5909 } 5910 break; 5911 case SPPPGETKEEPALIVE: 5912 { 5913 struct spppkeepalivesettings *settings = 5914 (struct spppkeepalivesettings*)data; 5915 5916 SPPP_LOCK(sp, RW_READER); 5917 settings->maxalive = sp->pp_maxalive; 5918 settings->max_noreceive = sp->pp_max_noreceive; 5919 SPPP_UNLOCK(sp); 5920 } 5921 break; 5922 case SPPPSETKEEPALIVE: 5923 { 5924 struct spppkeepalivesettings *settings = 5925 (struct spppkeepalivesettings*)data; 5926 5927 SPPP_LOCK(sp, RW_WRITER); 5928 sp->pp_maxalive = settings->maxalive; 5929 sp->pp_max_noreceive = settings->max_noreceive; 5930 SPPP_UNLOCK(sp); 5931 } 5932 break; 5933 default: 5934 { 5935 int ret; 5936 5937 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 5938 enosys(), ret); 5939 if (ret != ENOSYS) 5940 return ret; 5941 return (EINVAL); 5942 } 5943 } 5944 return (0); 5945 } 5946 5947 static void 5948 sppp_phase_network(struct sppp *sp) 5949 { 5950 int i; 5951 uint32_t mask; 5952 5953 KASSERT(SPPP_WLOCKED(sp)); 5954 5955 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 5956 5957 /* Notify NCPs now. */ 5958 for (i = 0; i < IDX_COUNT; i++) 5959 if ((cps[i])->flags & CP_NCP) 5960 (cps[i])->Open(sp); 5961 5962 /* Send Up events to all NCPs. */ 5963 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5964 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) { 5965 (cps[i])->Up(sp); 5966 } 5967 5968 /* if no NCP is starting, all this was in vain, close down */ 5969 sppp_lcp_check_and_close(sp); 5970 } 5971 5972 5973 static const char * 5974 sppp_cp_type_name(u_char type) 5975 { 5976 static char buf[12]; 5977 switch (type) { 5978 case CONF_REQ: return "conf-req"; 5979 case CONF_ACK: return "conf-ack"; 5980 case CONF_NAK: return "conf-nak"; 5981 case CONF_REJ: return "conf-rej"; 5982 case TERM_REQ: return "term-req"; 5983 case TERM_ACK: return "term-ack"; 5984 case CODE_REJ: return "code-rej"; 5985 case PROTO_REJ: return "proto-rej"; 5986 case ECHO_REQ: return "echo-req"; 5987 case ECHO_REPLY: return "echo-reply"; 5988 case DISC_REQ: return "discard-req"; 5989 } 5990 snprintf(buf, sizeof(buf), "0x%x", type); 5991 return buf; 5992 } 5993 5994 static const char * 5995 sppp_auth_type_name(u_short proto, u_char type) 5996 { 5997 static char buf[32]; 5998 const char *name; 5999 6000 switch (proto) { 6001 case PPP_CHAP: 6002 switch (type) { 6003 case CHAP_CHALLENGE: return "challenge"; 6004 case CHAP_RESPONSE: return "response"; 6005 case CHAP_SUCCESS: return "success"; 6006 case CHAP_FAILURE: return "failure"; 6007 default: name = "chap"; break; 6008 } 6009 break; 6010 6011 case PPP_PAP: 6012 switch (type) { 6013 case PAP_REQ: return "req"; 6014 case PAP_ACK: return "ack"; 6015 case PAP_NAK: return "nak"; 6016 default: name = "pap"; break; 6017 } 6018 break; 6019 6020 default: 6021 name = "bad"; 6022 break; 6023 } 6024 6025 snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type); 6026 return buf; 6027 } 6028 6029 static const char * 6030 sppp_lcp_opt_name(u_char opt) 6031 { 6032 static char buf[12]; 6033 switch (opt) { 6034 case LCP_OPT_MRU: return "mru"; 6035 case LCP_OPT_ASYNC_MAP: return "async-map"; 6036 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6037 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6038 case LCP_OPT_MAGIC: return "magic"; 6039 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6040 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6041 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6042 case LCP_OPT_CALL_BACK: return "callback"; 6043 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6044 case LCP_OPT_MP_MRRU: return "mrru"; 6045 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6046 case LCP_OPT_MP_EID: return "mp-eid"; 6047 } 6048 snprintf(buf, sizeof(buf), "0x%x", opt); 6049 return buf; 6050 } 6051 6052 static const char * 6053 sppp_ipcp_opt_name(u_char opt) 6054 { 6055 static char buf[12]; 6056 switch (opt) { 6057 case IPCP_OPT_ADDRESSES: return "addresses"; 6058 case IPCP_OPT_COMPRESSION: return "compression"; 6059 case IPCP_OPT_ADDRESS: return "address"; 6060 } 6061 snprintf(buf, sizeof(buf), "0x%x", opt); 6062 return buf; 6063 } 6064 6065 #ifdef INET6 6066 static const char * 6067 sppp_ipv6cp_opt_name(u_char opt) 6068 { 6069 static char buf[12]; 6070 switch (opt) { 6071 case IPV6CP_OPT_IFID: return "ifid"; 6072 case IPV6CP_OPT_COMPRESSION: return "compression"; 6073 } 6074 snprintf(buf, sizeof(buf), "0x%x", opt); 6075 return buf; 6076 } 6077 #endif 6078 6079 static const char * 6080 sppp_state_name(int state) 6081 { 6082 switch (state) { 6083 case STATE_INITIAL: return "initial"; 6084 case STATE_STARTING: return "starting"; 6085 case STATE_CLOSED: return "closed"; 6086 case STATE_STOPPED: return "stopped"; 6087 case STATE_CLOSING: return "closing"; 6088 case STATE_STOPPING: return "stopping"; 6089 case STATE_REQ_SENT: return "req-sent"; 6090 case STATE_ACK_RCVD: return "ack-rcvd"; 6091 case STATE_ACK_SENT: return "ack-sent"; 6092 case STATE_OPENED: return "opened"; 6093 } 6094 return "illegal"; 6095 } 6096 6097 static const char * 6098 sppp_phase_name(int phase) 6099 { 6100 switch (phase) { 6101 case SPPP_PHASE_DEAD: return "dead"; 6102 case SPPP_PHASE_ESTABLISH: return "establish"; 6103 case SPPP_PHASE_TERMINATE: return "terminate"; 6104 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6105 case SPPP_PHASE_NETWORK: return "network"; 6106 } 6107 return "illegal"; 6108 } 6109 6110 static const char * 6111 sppp_proto_name(u_short proto) 6112 { 6113 static char buf[12]; 6114 switch (proto) { 6115 case PPP_LCP: return "lcp"; 6116 case PPP_IPCP: return "ipcp"; 6117 case PPP_PAP: return "pap"; 6118 case PPP_CHAP: return "chap"; 6119 case PPP_IPV6CP: return "ipv6cp"; 6120 } 6121 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 6122 return buf; 6123 } 6124 6125 static void 6126 sppp_print_bytes(const u_char *p, u_short len) 6127 { 6128 addlog(" %02x", *p++); 6129 while (--len > 0) 6130 addlog("-%02x", *p++); 6131 } 6132 6133 static void 6134 sppp_print_string(const char *p, u_short len) 6135 { 6136 u_char c; 6137 6138 while (len-- > 0) { 6139 c = *p++; 6140 /* 6141 * Print only ASCII chars directly. RFC 1994 recommends 6142 * using only them, but we don't rely on it. */ 6143 if (c < ' ' || c > '~') 6144 addlog("\\x%x", c); 6145 else 6146 addlog("%c", c); 6147 } 6148 } 6149 6150 static const char * 6151 sppp_dotted_quad(uint32_t addr) 6152 { 6153 static char s[16]; 6154 snprintf(s, sizeof(s), "%d.%d.%d.%d", 6155 (int)((addr >> 24) & 0xff), 6156 (int)((addr >> 16) & 0xff), 6157 (int)((addr >> 8) & 0xff), 6158 (int)(addr & 0xff)); 6159 return s; 6160 } 6161 6162 /* a dummy, used to drop uninteresting events */ 6163 static void 6164 sppp_null(struct sppp *unused) 6165 { 6166 /* do just nothing */ 6167 } 6168 /* 6169 * This file is large. Tell emacs to highlight it nevertheless. 6170 * 6171 * Local Variables: 6172 * hilit-auto-highlight-maxout: 120000 6173 * End: 6174 */ 6175 6176 /* 6177 * Module glue 6178 */ 6179 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6180 6181 static int 6182 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6183 { 6184 switch (cmd) { 6185 case MODULE_CMD_INIT: 6186 case MODULE_CMD_FINI: 6187 return 0; 6188 case MODULE_CMD_STAT: 6189 case MODULE_CMD_AUTOUNLOAD: 6190 default: 6191 return ENOTTY; 6192 } 6193 } 6194 6195 static void 6196 sppp_notify_up(struct sppp *sp) 6197 { 6198 6199 SPPP_LOCK(sp, RW_WRITER); 6200 lcp.Up(sp); 6201 SPPP_UNLOCK(sp); 6202 } 6203 6204 static void 6205 sppp_notify_down(struct sppp *sp) 6206 { 6207 6208 SPPP_LOCK(sp, RW_WRITER); 6209 lcp.Down(sp); 6210 SPPP_UNLOCK(sp); 6211 } 6212 6213 static void 6214 sppp_notify_tls_wlocked(struct sppp *sp) 6215 { 6216 6217 KASSERT(SPPP_WLOCKED(sp)); 6218 6219 if (!sp->pp_tls) 6220 return; 6221 6222 SPPP_UNLOCK(sp); 6223 sp->pp_tls(sp); 6224 SPPP_LOCK(sp, RW_WRITER); 6225 } 6226 6227 static void 6228 sppp_notify_tlf_wlocked(struct sppp *sp) 6229 { 6230 6231 KASSERT(SPPP_WLOCKED(sp)); 6232 6233 if (!sp->pp_tlf) 6234 return; 6235 6236 SPPP_UNLOCK(sp); 6237 sp->pp_tlf(sp); 6238 SPPP_LOCK(sp, RW_WRITER); 6239 } 6240 6241 static void 6242 sppp_notify_con(struct sppp *sp) 6243 { 6244 6245 if (!sp->pp_con) 6246 return; 6247 6248 sp->pp_con(sp); 6249 } 6250 6251 #ifdef INET6 6252 static void 6253 sppp_notify_con_wlocked(struct sppp *sp) 6254 { 6255 6256 KASSERT(SPPP_WLOCKED(sp)); 6257 6258 SPPP_UNLOCK(sp); 6259 sppp_notify_con(sp); 6260 SPPP_LOCK(sp, RW_WRITER); 6261 6262 } 6263 #endif 6264 6265 static void 6266 sppp_notify_chg_wlocked(struct sppp *sp) 6267 { 6268 6269 KASSERT(SPPP_WLOCKED(sp)); 6270 6271 if (!sp->pp_chg) 6272 return; 6273 6274 SPPP_UNLOCK(sp); 6275 sp->pp_chg(sp, sp->pp_phase); 6276 SPPP_LOCK(sp, RW_WRITER); 6277 } 6278
Indexes created Tue Oct 14 11:09:46 GMT 2025