Home | History | Annotate | Line # | Download | only in net
if_spppsubr.c revision 1.20.2.12
      1 /*	$NetBSD: if_spppsubr.c,v 1.20.2.12 2002/06/24 22:11:36 nathanw Exp $	 */
      2 
      3 /*
      4  * Synchronous PPP/Cisco link level subroutines.
      5  * Keepalive protocol implemented in both Cisco and PPP modes.
      6  *
      7  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
      8  * Author: Serge Vakulenko, <vak (at) cronyx.ru>
      9  *
     10  * Heavily revamped to conform to RFC 1661.
     11  * Copyright (C) 1997, Joerg Wunsch.
     12  *
     13  * RFC2472 IPv6CP support.
     14  * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>.
     15  *
     16  * This software is distributed with NO WARRANTIES, not even the implied
     17  * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
     18  *
     19  * Authors grant any other persons or organisations permission to use
     20  * or modify this software as long as this message is kept with the software,
     21  * all derivative works or modified versions.
     22  *
     23  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
     24  *
     25  * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp
     26  *
     27  * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp
     28  */
     29 
     30 #include <sys/cdefs.h>
     31 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.20.2.12 2002/06/24 22:11:36 nathanw Exp $");
     32 
     33 #include "opt_inet.h"
     34 #include "opt_ipx.h"
     35 #include "opt_iso.h"
     36 #include "opt_ns.h"
     37 
     38 #include <sys/param.h>
     39 #include <sys/lwp.h>
     40 #include <sys/proc.h>
     41 #include <sys/systm.h>
     42 #include <sys/kernel.h>
     43 #include <sys/sockio.h>
     44 #include <sys/socket.h>
     45 #include <sys/syslog.h>
     46 #include <sys/malloc.h>
     47 #include <sys/mbuf.h>
     48 #include <sys/callout.h>
     49 #include <sys/md5.h>
     50 
     51 #include <net/if.h>
     52 #include <net/netisr.h>
     53 #include <net/if_types.h>
     54 #include <net/route.h>
     55 #include <net/ppp_defs.h>
     56 
     57 #include <machine/stdarg.h>
     58 
     59 #include <netinet/in.h>
     60 #include <netinet/in_systm.h>
     61 #include <netinet/in_var.h>
     62 #ifdef INET
     63 #include <netinet/ip.h>
     64 #include <netinet/tcp.h>
     65 #endif
     66 #include <net/ethertypes.h>
     67 
     68 #ifdef IPX
     69 #include <netipx/ipx.h>
     70 #include <netipx/ipx_if.h>
     71 #endif
     72 
     73 #ifdef NS
     74 #include <netns/ns.h>
     75 #include <netns/ns_if.h>
     76 #endif
     77 
     78 #ifdef ISO
     79 #include <netiso/argo_debug.h>
     80 #include <netiso/iso.h>
     81 #include <netiso/iso_var.h>
     82 #include <netiso/iso_snpac.h>
     83 #endif
     84 
     85 #include <net/if_sppp.h>
     86 #include <net/if_spppvar.h>
     87 
     88 #define MAXALIVECNT     		3	/* max. alive packets */
     89 #define DEFAULT_MAX_AUTH_FAILURES	5	/* max. auth. failures */
     90 
     91 /*
     92  * Interface flags that can be set in an ifconfig command.
     93  *
     94  * Setting link0 will make the link passive, i.e. it will be marked
     95  * as being administrative openable, but won't be opened to begin
     96  * with.  Incoming calls will be answered, or subsequent calls with
     97  * -link1 will cause the administrative open of the LCP layer.
     98  *
     99  * Setting link1 will cause the link to auto-dial only as packets
    100  * arrive to be sent.
    101  *
    102  * Setting IFF_DEBUG will syslog the option negotiation and state
    103  * transitions at level kern.debug.  Note: all logs consistently look
    104  * like
    105  *
    106  *   <if-name><unit>: <proto-name> <additional info...>
    107  *
    108  * with <if-name><unit> being something like "bppp0", and <proto-name>
    109  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
    110  */
    111 
    112 #define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
    113 #define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
    114 
    115 #define CONF_REQ	1		/* PPP configure request */
    116 #define CONF_ACK	2		/* PPP configure acknowledge */
    117 #define CONF_NAK	3		/* PPP configure negative ack */
    118 #define CONF_REJ	4		/* PPP configure reject */
    119 #define TERM_REQ	5		/* PPP terminate request */
    120 #define TERM_ACK	6		/* PPP terminate acknowledge */
    121 #define CODE_REJ	7		/* PPP code reject */
    122 #define PROTO_REJ	8		/* PPP protocol reject */
    123 #define ECHO_REQ	9		/* PPP echo request */
    124 #define ECHO_REPLY	10		/* PPP echo reply */
    125 #define DISC_REQ	11		/* PPP discard request */
    126 
    127 #define LCP_OPT_MRU		1	/* maximum receive unit */
    128 #define LCP_OPT_ASYNC_MAP	2	/* async control character map */
    129 #define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
    130 #define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
    131 #define LCP_OPT_MAGIC		5	/* magic number */
    132 #define LCP_OPT_RESERVED	6	/* reserved */
    133 #define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
    134 #define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
    135 
    136 #define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
    137 #define IPCP_OPT_COMPRESSION	2	/* IP compression protocol */
    138 #define IPCP_OPT_ADDRESS	3	/* local IP address */
    139 #define	IPCP_OPT_PRIMDNS	129	/* primary remote dns address */
    140 #define	IPCP_OPT_SECDNS		131	/* secondary remote dns address */
    141 
    142 #define IPV6CP_OPT_IFID		1	/* interface identifier */
    143 #define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
    144 
    145 #define PAP_REQ			1	/* PAP name/password request */
    146 #define PAP_ACK			2	/* PAP acknowledge */
    147 #define PAP_NAK			3	/* PAP fail */
    148 
    149 #define CHAP_CHALLENGE		1	/* CHAP challenge request */
    150 #define CHAP_RESPONSE		2	/* CHAP challenge response */
    151 #define CHAP_SUCCESS		3	/* CHAP response ok */
    152 #define CHAP_FAILURE		4	/* CHAP response failed */
    153 
    154 #define CHAP_MD5		5	/* hash algorithm - MD5 */
    155 
    156 #define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
    157 #define CISCO_UNICAST		0x0f	/* Cisco unicast address */
    158 #define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
    159 #define CISCO_ADDR_REQ		0	/* Cisco address request */
    160 #define CISCO_ADDR_REPLY	1	/* Cisco address reply */
    161 #define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
    162 
    163 /* states are named and numbered according to RFC 1661 */
    164 #define STATE_INITIAL	0
    165 #define STATE_STARTING	1
    166 #define STATE_CLOSED	2
    167 #define STATE_STOPPED	3
    168 #define STATE_CLOSING	4
    169 #define STATE_STOPPING	5
    170 #define STATE_REQ_SENT	6
    171 #define STATE_ACK_RCVD	7
    172 #define STATE_ACK_SENT	8
    173 #define STATE_OPENED	9
    174 
    175 struct ppp_header {
    176 	u_char address;
    177 	u_char control;
    178 	u_short protocol;
    179 } __attribute__((__packed__));
    180 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
    181 
    182 struct lcp_header {
    183 	u_char type;
    184 	u_char ident;
    185 	u_short len;
    186 } __attribute__((__packed__));
    187 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
    188 
    189 struct cisco_packet {
    190 	u_int32_t type;
    191 	u_int32_t par1;
    192 	u_int32_t par2;
    193 	u_short rel;
    194 	u_short time0;
    195 	u_short time1;
    196 } __attribute__((__packed__));
    197 #define CISCO_PACKET_LEN 18
    198 
    199 /*
    200  * We follow the spelling and capitalization of RFC 1661 here, to make
    201  * it easier comparing with the standard.  Please refer to this RFC in
    202  * case you can't make sense out of these abbreviation; it will also
    203  * explain the semantics related to the various events and actions.
    204  */
    205 struct cp {
    206 	u_short	proto;		/* PPP control protocol number */
    207 	u_char protoidx;	/* index into state table in struct sppp */
    208 	u_char flags;
    209 #define CP_LCP		0x01	/* this is the LCP */
    210 #define CP_AUTH		0x02	/* this is an authentication protocol */
    211 #define CP_NCP		0x04	/* this is a NCP */
    212 #define CP_QUAL		0x08	/* this is a quality reporting protocol */
    213 	const char *name;	/* name of this control protocol */
    214 	/* event handlers */
    215 	void	(*Up)(struct sppp *sp);
    216 	void	(*Down)(struct sppp *sp);
    217 	void	(*Open)(struct sppp *sp);
    218 	void	(*Close)(struct sppp *sp);
    219 	void	(*TO)(void *sp);
    220 	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
    221 	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
    222 	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
    223 	/* actions */
    224 	void	(*tlu)(struct sppp *sp);
    225 	void	(*tld)(struct sppp *sp);
    226 	void	(*tls)(struct sppp *sp);
    227 	void	(*tlf)(struct sppp *sp);
    228 	void	(*scr)(struct sppp *sp);
    229 };
    230 
    231 static struct sppp *spppq;
    232 static struct callout keepalive_ch;
    233 
    234 #ifdef __FreeBSD__
    235 #define	SPP_FMT		"%s%d: "
    236 #define	SPP_ARGS(ifp)	(ifp)->if_name, (ifp)->if_unit
    237 #else
    238 #define	SPP_FMT		"%s: "
    239 #define	SPP_ARGS(ifp)	(ifp)->if_xname
    240 #endif
    241 
    242 #ifdef INET
    243 /*
    244  * The following disgusting hack gets around the problem that IP TOS
    245  * can't be set yet.  We want to put "interactive" traffic on a high
    246  * priority queue.  To decide if traffic is interactive, we check that
    247  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
    248  *
    249  * XXX is this really still necessary?  - joerg -
    250  */
    251 static u_short interactive_ports[8] = {
    252 	0,	513,	0,	0,
    253 	0,	21,	0,	23,
    254 };
    255 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
    256 #endif
    257 
    258 /* almost every function needs these */
    259 #define STDDCL							\
    260 	struct ifnet *ifp = &sp->pp_if;				\
    261 	int debug = ifp->if_flags & IFF_DEBUG
    262 
    263 static int sppp_output(struct ifnet *ifp, struct mbuf *m,
    264 		       struct sockaddr *dst, struct rtentry *rt);
    265 
    266 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2);
    267 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
    268 
    269 static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
    270 			  struct mbuf *m);
    271 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
    272 			 u_char ident, u_short len, void *data);
    273 /* static void sppp_cp_timeout(void *arg); */
    274 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
    275 				 int newstate);
    276 static void sppp_auth_send(const struct cp *cp,
    277 			   struct sppp *sp, unsigned int type, unsigned int id,
    278 			   ...);
    279 
    280 static void sppp_up_event(const struct cp *cp, struct sppp *sp);
    281 static void sppp_down_event(const struct cp *cp, struct sppp *sp);
    282 static void sppp_open_event(const struct cp *cp, struct sppp *sp);
    283 static void sppp_close_event(const struct cp *cp, struct sppp *sp);
    284 static void sppp_to_event(const struct cp *cp, struct sppp *sp);
    285 
    286 static void sppp_null(struct sppp *sp);
    287 
    288 static void sppp_lcp_init(struct sppp *sp);
    289 static void sppp_lcp_up(struct sppp *sp);
    290 static void sppp_lcp_down(struct sppp *sp);
    291 static void sppp_lcp_open(struct sppp *sp);
    292 static void sppp_lcp_close(struct sppp *sp);
    293 static void sppp_lcp_TO(void *sp);
    294 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    295 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    296 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    297 static void sppp_lcp_tlu(struct sppp *sp);
    298 static void sppp_lcp_tld(struct sppp *sp);
    299 static void sppp_lcp_tls(struct sppp *sp);
    300 static void sppp_lcp_tlf(struct sppp *sp);
    301 static void sppp_lcp_scr(struct sppp *sp);
    302 static void sppp_lcp_check_and_close(struct sppp *sp);
    303 static int sppp_ncp_check(struct sppp *sp);
    304 
    305 static void sppp_ipcp_init(struct sppp *sp);
    306 static void sppp_ipcp_up(struct sppp *sp);
    307 static void sppp_ipcp_down(struct sppp *sp);
    308 static void sppp_ipcp_open(struct sppp *sp);
    309 static void sppp_ipcp_close(struct sppp *sp);
    310 static void sppp_ipcp_TO(void *sp);
    311 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    312 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    313 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    314 static void sppp_ipcp_tlu(struct sppp *sp);
    315 static void sppp_ipcp_tld(struct sppp *sp);
    316 static void sppp_ipcp_tls(struct sppp *sp);
    317 static void sppp_ipcp_tlf(struct sppp *sp);
    318 static void sppp_ipcp_scr(struct sppp *sp);
    319 
    320 static void sppp_ipv6cp_init(struct sppp *sp);
    321 static void sppp_ipv6cp_up(struct sppp *sp);
    322 static void sppp_ipv6cp_down(struct sppp *sp);
    323 static void sppp_ipv6cp_open(struct sppp *sp);
    324 static void sppp_ipv6cp_close(struct sppp *sp);
    325 static void sppp_ipv6cp_TO(void *sp);
    326 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
    327 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
    328 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
    329 static void sppp_ipv6cp_tlu(struct sppp *sp);
    330 static void sppp_ipv6cp_tld(struct sppp *sp);
    331 static void sppp_ipv6cp_tls(struct sppp *sp);
    332 static void sppp_ipv6cp_tlf(struct sppp *sp);
    333 static void sppp_ipv6cp_scr(struct sppp *sp);
    334 
    335 static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
    336 static void sppp_pap_init(struct sppp *sp);
    337 static void sppp_pap_open(struct sppp *sp);
    338 static void sppp_pap_close(struct sppp *sp);
    339 static void sppp_pap_TO(void *sp);
    340 static void sppp_pap_my_TO(void *sp);
    341 static void sppp_pap_tlu(struct sppp *sp);
    342 static void sppp_pap_tld(struct sppp *sp);
    343 static void sppp_pap_scr(struct sppp *sp);
    344 
    345 static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
    346 static void sppp_chap_init(struct sppp *sp);
    347 static void sppp_chap_open(struct sppp *sp);
    348 static void sppp_chap_close(struct sppp *sp);
    349 static void sppp_chap_TO(void *sp);
    350 static void sppp_chap_tlu(struct sppp *sp);
    351 static void sppp_chap_tld(struct sppp *sp);
    352 static void sppp_chap_scr(struct sppp *sp);
    353 
    354 static const char *sppp_auth_type_name(u_short proto, u_char type);
    355 static const char *sppp_cp_type_name(u_char type);
    356 static const char *sppp_dotted_quad(u_int32_t addr);
    357 static const char *sppp_ipcp_opt_name(u_char opt);
    358 #ifdef INET6
    359 static const char *sppp_ipv6cp_opt_name(u_char opt);
    360 #endif
    361 static const char *sppp_lcp_opt_name(u_char opt);
    362 static const char *sppp_phase_name(int phase);
    363 static const char *sppp_proto_name(u_short proto);
    364 static const char *sppp_state_name(int state);
    365 static int sppp_params(struct sppp *sp, int cmd, void *data);
    366 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst,
    367 			      u_int32_t *srcmask);
    368 static void sppp_keepalive(void *dummy);
    369 static void sppp_phase_network(struct sppp *sp);
    370 static void sppp_print_bytes(const u_char *p, u_short len);
    371 static void sppp_print_string(const char *p, u_short len);
    372 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr);
    373 static void sppp_clear_ip_addrs(struct sppp *sp);
    374 #ifdef INET6
    375 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
    376 				struct in6_addr *dst, struct in6_addr *srcmask);
    377 #ifdef IPV6CP_MYIFID_DYN
    378 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    379 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
    380 #endif
    381 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
    382 #endif
    383 
    384 /* our control protocol descriptors */
    385 static const struct cp lcp = {
    386 	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
    387 	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
    388 	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
    389 	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
    390 	sppp_lcp_scr
    391 };
    392 
    393 static const struct cp ipcp = {
    394 	PPP_IPCP, IDX_IPCP,
    395 #ifdef INET
    396 	CP_NCP,	/*don't run IPCP if there's no IPv4 support*/
    397 #else
    398 	0,
    399 #endif
    400 	"ipcp",
    401 	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
    402 	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
    403 	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
    404 	sppp_ipcp_scr
    405 };
    406 
    407 static const struct cp ipv6cp = {
    408 	PPP_IPV6CP, IDX_IPV6CP,
    409 #ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
    410 	CP_NCP,
    411 #else
    412 	0,
    413 #endif
    414 	"ipv6cp",
    415 	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
    416 	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
    417 	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
    418 	sppp_ipv6cp_scr
    419 };
    420 
    421 static const struct cp pap = {
    422 	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
    423 	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
    424 	sppp_pap_TO, 0, 0, 0,
    425 	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
    426 	sppp_pap_scr
    427 };
    428 
    429 static const struct cp chap = {
    430 	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
    431 	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
    432 	sppp_chap_TO, 0, 0, 0,
    433 	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
    434 	sppp_chap_scr
    435 };
    436 
    437 static const struct cp *cps[IDX_COUNT] = {
    438 	&lcp,			/* IDX_LCP */
    439 	&ipcp,			/* IDX_IPCP */
    440 	&ipv6cp,		/* IDX_IPV6CP */
    441 	&pap,			/* IDX_PAP */
    442 	&chap,			/* IDX_CHAP */
    443 };
    444 
    445 
    446 /*
    447  * Exported functions, comprising our interface to the lower layer.
    448  */
    449 
    450 /*
    451  * Process the received packet.
    452  */
    453 void
    454 sppp_input(struct ifnet *ifp, struct mbuf *m)
    455 {
    456 	struct ppp_header *h = NULL;
    457 	struct ifqueue *inq = 0;
    458 	u_int16_t protocol;
    459 	int s;
    460 	struct sppp *sp = (struct sppp *)ifp;
    461 	int debug = ifp->if_flags & IFF_DEBUG;
    462 
    463 	if (ifp->if_flags & IFF_UP)
    464 		/* Count received bytes, add hardware framing */
    465 		ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
    466 
    467 	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
    468 		/* Too small packet, drop it. */
    469 		if (debug)
    470 			log(LOG_DEBUG,
    471 			    SPP_FMT "input packet is too small, %d bytes\n",
    472 			    SPP_ARGS(ifp), m->m_pkthdr.len);
    473 	  drop:
    474 		++ifp->if_ierrors;
    475 		++ifp->if_iqdrops;
    476 		m_freem (m);
    477 		return;
    478 	}
    479 
    480 	if (sp->pp_flags & PP_NOFRAMING) {
    481 		memcpy(&protocol, mtod(m, void *), 2);
    482 		protocol = ntohs(protocol);
    483 		m_adj(m, 2);
    484 	} else {
    485 
    486 		/* Get PPP header. */
    487 		h = mtod (m, struct ppp_header*);
    488 		m_adj (m, PPP_HEADER_LEN);
    489 
    490 		switch (h->address) {
    491 		case PPP_ALLSTATIONS:
    492 			if (h->control != PPP_UI)
    493 				goto invalid;
    494 			if (sp->pp_flags & PP_CISCO) {
    495 				if (debug)
    496 					log(LOG_DEBUG,
    497 					    SPP_FMT "PPP packet in Cisco mode "
    498 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    499 					    SPP_ARGS(ifp),
    500 					    h->address, h->control, ntohs(h->protocol));
    501 				goto drop;
    502 			}
    503 			break;
    504 		case CISCO_MULTICAST:
    505 		case CISCO_UNICAST:
    506 			/* Don't check the control field here (RFC 1547). */
    507 			if (! (sp->pp_flags & PP_CISCO)) {
    508 				if (debug)
    509 					log(LOG_DEBUG,
    510 					    SPP_FMT "Cisco packet in PPP mode "
    511 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    512 					    SPP_ARGS(ifp),
    513 					    h->address, h->control, ntohs(h->protocol));
    514 				goto drop;
    515 			}
    516 			switch (ntohs (h->protocol)) {
    517 			default:
    518 				++ifp->if_noproto;
    519 				goto invalid;
    520 			case CISCO_KEEPALIVE:
    521 				sppp_cisco_input ((struct sppp*) ifp, m);
    522 				m_freem (m);
    523 				return;
    524 #ifdef INET
    525 			case ETHERTYPE_IP:
    526 				schednetisr (NETISR_IP);
    527 				inq = &ipintrq;
    528 				break;
    529 #endif
    530 #ifdef INET6
    531 			case ETHERTYPE_IPV6:
    532 				schednetisr (NETISR_IPV6);
    533 				inq = &ip6intrq;
    534 				break;
    535 #endif
    536 #ifdef IPX
    537 			case ETHERTYPE_IPX:
    538 				schednetisr (NETISR_IPX);
    539 				inq = &ipxintrq;
    540 				break;
    541 #endif
    542 #ifdef NS
    543 			case ETHERTYPE_NS:
    544 				schednetisr (NETISR_NS);
    545 				inq = &nsintrq;
    546 				break;
    547 #endif
    548 			}
    549 			goto queue_pkt;
    550 		default:        /* Invalid PPP packet. */
    551 		  invalid:
    552 			if (debug)
    553 				log(LOG_DEBUG,
    554 				    SPP_FMT "invalid input packet "
    555 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
    556 				    SPP_ARGS(ifp),
    557 				    h->address, h->control, ntohs(h->protocol));
    558 			goto drop;
    559 		}
    560 		protocol = ntohs (h->protocol);
    561 	}
    562 
    563 	switch (protocol) {
    564 	default:
    565 		if (sp->state[IDX_LCP] == STATE_OPENED) {
    566 			u_int16_t prot = htons(protocol);
    567 			sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
    568 			    ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
    569 			    &prot);
    570 		}
    571 		if (debug)
    572 			log(LOG_DEBUG,
    573 			    SPP_FMT "invalid input protocol "
    574 			    "<proto=0x%x>\n", SPP_ARGS(ifp), ntohs(protocol));
    575 		++ifp->if_noproto;
    576 		goto drop;
    577 	case PPP_LCP:
    578 		sppp_cp_input(&lcp, sp, m);
    579 		m_freem (m);
    580 		return;
    581 	case PPP_PAP:
    582 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE)
    583 			sppp_pap_input(sp, m);
    584 		m_freem (m);
    585 		return;
    586 	case PPP_CHAP:
    587 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE)
    588 			sppp_chap_input(sp, m);
    589 		m_freem (m);
    590 		return;
    591 #ifdef INET
    592 	case PPP_IPCP:
    593 		if (sp->pp_phase == SPPP_PHASE_NETWORK)
    594 			sppp_cp_input(&ipcp, sp, m);
    595 		m_freem (m);
    596 		return;
    597 	case PPP_IP:
    598 		if (sp->state[IDX_IPCP] == STATE_OPENED) {
    599 			schednetisr (NETISR_IP);
    600 			inq = &ipintrq;
    601 			sp->pp_last_activity = time.tv_sec;
    602 		}
    603 		break;
    604 #endif
    605 #ifdef INET6
    606 	case PPP_IPV6CP:
    607 		if (sp->pp_phase == SPPP_PHASE_NETWORK)
    608 			sppp_cp_input(&ipv6cp, sp, m);
    609 		m_freem (m);
    610 		return;
    611 
    612 	case PPP_IPV6:
    613 		if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
    614 			schednetisr (NETISR_IPV6);
    615 			inq = &ip6intrq;
    616 			sp->pp_last_activity = time.tv_sec;
    617 		}
    618 		break;
    619 #endif
    620 #ifdef IPX
    621 	case PPP_IPX:
    622 		/* IPX IPXCP not implemented yet */
    623 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    624 			schednetisr (NETISR_IPX);
    625 			inq = &ipxintrq;
    626 		}
    627 		break;
    628 #endif
    629 #ifdef NS
    630 	case PPP_XNS:
    631 		/* XNS IDPCP not implemented yet */
    632 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    633 			schednetisr (NETISR_NS);
    634 			inq = &nsintrq;
    635 		}
    636 		break;
    637 #endif
    638 #ifdef ISO
    639 	case PPP_ISO:
    640 		/* OSI NLCP not implemented yet */
    641 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
    642 			schednetisr (NETISR_ISO);
    643 			inq = &clnlintrq;
    644 		}
    645 		break;
    646 #endif
    647 	}
    648 
    649 queue_pkt:
    650 	if (! (ifp->if_flags & IFF_UP) || ! inq)
    651 		goto drop;
    652 
    653 	/* Check queue. */
    654 	s = splnet();
    655 	if (IF_QFULL (inq)) {
    656 		/* Queue overflow. */
    657 		IF_DROP(inq);
    658 		splx(s);
    659 		if (debug)
    660 			log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
    661 				SPP_ARGS(ifp));
    662 		goto drop;
    663 	}
    664 	IF_ENQUEUE(inq, m);
    665 	splx(s);
    666 }
    667 
    668 /*
    669  * Enqueue transmit packet.
    670  */
    671 static int
    672 sppp_output(struct ifnet *ifp, struct mbuf *m,
    673 	    struct sockaddr *dst, struct rtentry *rt)
    674 {
    675 	struct sppp *sp = (struct sppp*) ifp;
    676 	struct ppp_header *h = NULL;
    677 	struct ifqueue *ifq = NULL;		/* XXX */
    678 	int s, len, rv = 0;
    679 	u_int16_t protocol;
    680 	ALTQ_DECL(struct altq_pktattr pktattr;)
    681 
    682 	s = splnet();
    683 
    684 	sp->pp_last_activity = time.tv_sec;
    685 
    686 	if ((ifp->if_flags & IFF_UP) == 0 ||
    687 	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
    688 		m_freem (m);
    689 		splx (s);
    690 		return (ENETDOWN);
    691 	}
    692 
    693 	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
    694 		/*
    695 		 * Interface is not yet running, but auto-dial.  Need
    696 		 * to start LCP for it.
    697 		 */
    698 		ifp->if_flags |= IFF_RUNNING;
    699 		splx(s);
    700 		lcp.Open(sp);
    701 		s = splnet();
    702 	}
    703 
    704 	/*
    705 	 * If the queueing discipline needs packet classification,
    706 	 * do it before prepending link headers.
    707 	 */
    708 	IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr);
    709 
    710 #ifdef INET
    711 	if (dst->sa_family == AF_INET)
    712 	{
    713 		/* Check mbuf length here??? */
    714 		struct ip *ip = mtod (m, struct ip*);
    715 		struct tcphdr *tcp = (struct tcphdr*) ((int32_t*)ip + ip->ip_hl);
    716 
    717 		/*
    718 		 * When using dynamic local IP address assignment by using
    719 		 * 0.0.0.0 as a local address, the first TCP session will
    720 		 * not connect because the local TCP checksum is computed
    721 		 * using 0.0.0.0 which will later become our real IP address
    722 		 * so the TCP checksum computed at the remote end will
    723 		 * become invalid. So we
    724 		 * - don't let packets with src ip addr 0 thru
    725 		 * - we flag TCP packets with src ip 0 as an error
    726 		 */
    727 
    728 		if(ip->ip_src.s_addr == INADDR_ANY)	/* -hm */
    729 		{
    730 			m_freem(m);
    731 			splx(s);
    732 			if(ip->ip_p == IPPROTO_TCP)
    733 				return(EADDRNOTAVAIL);
    734 			else
    735 				return(0);
    736 		}
    737 
    738 		/*
    739 		 * Put low delay, telnet, rlogin and ftp control packets
    740 		 * in front of the queue.
    741 		 */
    742 
    743 		if (! IF_QFULL (&sp->pp_fastq) &&
    744 		    ((ip->ip_tos & IPTOS_LOWDELAY) ||
    745 	    	    ((ip->ip_p == IPPROTO_TCP &&
    746 	    	    m->m_len >= sizeof (struct ip) + sizeof (struct tcphdr) &&
    747 	    	    (INTERACTIVE (ntohs (tcp->th_sport)))) ||
    748 	    	    INTERACTIVE (ntohs (tcp->th_dport)))))
    749 			ifq = &sp->pp_fastq;
    750 	}
    751 #endif
    752 
    753 #ifdef INET6
    754 	if (dst->sa_family == AF_INET6) {
    755 		/* XXX do something tricky here? */
    756 	}
    757 #endif
    758 
    759 	if ((sp->pp_flags & PP_NOFRAMING) == 0) {
    760 		/*
    761 		 * Prepend general data packet PPP header. For now, IP only.
    762 		 */
    763 		M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
    764 		if (! m) {
    765 			if (ifp->if_flags & IFF_DEBUG)
    766 				log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
    767 					SPP_ARGS(ifp));
    768 			++ifp->if_oerrors;
    769 			splx (s);
    770 			return (ENOBUFS);
    771 		}
    772 		/*
    773 		 * May want to check size of packet
    774 		 * (albeit due to the implementation it's always enough)
    775 		 */
    776 		h = mtod (m, struct ppp_header*);
    777 		if (sp->pp_flags & PP_CISCO) {
    778 			h->address = CISCO_UNICAST;        /* unicast address */
    779 			h->control = 0;
    780 		} else {
    781 			h->address = PPP_ALLSTATIONS;        /* broadcast address */
    782 			h->control = PPP_UI;                 /* Unnumbered Info */
    783 		}
    784 	}
    785 
    786 	switch (dst->sa_family) {
    787 #ifdef INET
    788 	case AF_INET:   /* Internet Protocol */
    789 		if (sp->pp_flags & PP_CISCO)
    790 			protocol = htons (ETHERTYPE_IP);
    791 		else {
    792 			/*
    793 			 * Don't choke with an ENETDOWN early.  It's
    794 			 * possible that we just started dialing out,
    795 			 * so don't drop the packet immediately.  If
    796 			 * we notice that we run out of buffer space
    797 			 * below, we will however remember that we are
    798 			 * not ready to carry IP packets, and return
    799 			 * ENETDOWN, as opposed to ENOBUFS.
    800 			 */
    801 			protocol = htons(PPP_IP);
    802 			if (sp->state[IDX_IPCP] != STATE_OPENED)
    803 				rv = ENETDOWN;
    804 		}
    805 		break;
    806 #endif
    807 #ifdef INET6
    808 	case AF_INET6:   /* Internet Protocol version 6 */
    809 		if (sp->pp_flags & PP_CISCO)
    810 			protocol = htons (ETHERTYPE_IPV6);
    811 		else {
    812 			/*
    813 			 * Don't choke with an ENETDOWN early.  It's
    814 			 * possible that we just started dialing out,
    815 			 * so don't drop the packet immediately.  If
    816 			 * we notice that we run out of buffer space
    817 			 * below, we will however remember that we are
    818 			 * not ready to carry IP packets, and return
    819 			 * ENETDOWN, as opposed to ENOBUFS.
    820 			 */
    821 			protocol = htons(PPP_IPV6);
    822 			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
    823 				rv = ENETDOWN;
    824 		}
    825 		break;
    826 #endif
    827 #ifdef NS
    828 	case AF_NS:     /* Xerox NS Protocol */
    829 		protocol = htons ((sp->pp_flags & PP_CISCO) ?
    830 			ETHERTYPE_NS : PPP_XNS);
    831 		break;
    832 #endif
    833 #ifdef IPX
    834 	case AF_IPX:     /* Novell IPX Protocol */
    835 		protocol = htons ((sp->pp_flags & PP_CISCO) ?
    836 			ETHERTYPE_IPX : PPP_IPX);
    837 		break;
    838 #endif
    839 #ifdef ISO
    840 	case AF_ISO:    /* ISO OSI Protocol */
    841 		if (sp->pp_flags & PP_CISCO)
    842 			goto nosupport;
    843 		protocol = htons (PPP_ISO);
    844 		break;
    845 nosupport:
    846 #endif
    847 	default:
    848 		m_freem (m);
    849 		++ifp->if_oerrors;
    850 		splx (s);
    851 		return (EAFNOSUPPORT);
    852 	}
    853 
    854 	if (sp->pp_flags & PP_NOFRAMING) {
    855 		M_PREPEND (m, 2, M_DONTWAIT);
    856 		if (m == NULL) {
    857 			if (ifp->if_flags & IFF_DEBUG)
    858 				log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
    859 					SPP_ARGS(ifp));
    860 			++ifp->if_oerrors;
    861 			splx (s);
    862 			return (ENOBUFS);
    863 		}
    864 		*mtod(m, u_int16_t*) = protocol;
    865 	} else {
    866 		h->protocol = protocol;
    867 	}
    868 
    869 	/*
    870 	 * Queue message on interface, and start output if interface
    871 	 * not yet active.
    872 	 */
    873 	len = m->m_pkthdr.len;
    874 	if (ifq != NULL
    875 #ifdef ALTQ
    876 	    && ALTQ_IS_ENABLED(&ifp->if_snd) == 0
    877 #endif
    878 	    ) {
    879 		if (IF_QFULL (ifq)) {
    880 			IF_DROP (&ifp->if_snd);
    881 			m_freem (m);
    882 			if (rv == 0)
    883 				rv = ENOBUFS;
    884 		}
    885 		IF_ENQUEUE(ifq, m);
    886 	} else
    887 		IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv);
    888 	if (rv != 0) {
    889 		++ifp->if_oerrors;
    890 		splx(s);
    891 		return (rv);
    892 	}
    893 
    894 	if (! (ifp->if_flags & IFF_OACTIVE))
    895 		(*ifp->if_start) (ifp);
    896 
    897 	/*
    898 	 * Count output packets and bytes.
    899 	 * The packet length includes header + additional hardware framing
    900 	 * according to RFC 1333.
    901 	 */
    902 	ifp->if_obytes += len + sp->pp_framebytes;
    903 	splx (s);
    904 	return (0);
    905 }
    906 
    907 void
    908 sppp_attach(struct ifnet *ifp)
    909 {
    910 	struct sppp *sp = (struct sppp*) ifp;
    911 
    912 	/* Initialize keepalive handler. */
    913 	if (! spppq) {
    914 		callout_init(&keepalive_ch);
    915 		callout_reset(&keepalive_ch, hz * 10, sppp_keepalive, NULL);
    916 	}
    917 
    918 	/* Insert new entry into the keepalive list. */
    919 	sp->pp_next = spppq;
    920 	spppq = sp;
    921 
    922 	sp->pp_if.if_type = IFT_PPP;
    923 	sp->pp_if.if_output = sppp_output;
    924 	sp->pp_fastq.ifq_maxlen = 32;
    925 	sp->pp_cpq.ifq_maxlen = 20;
    926 	sp->pp_loopcnt = 0;
    927 	sp->pp_alivecnt = 0;
    928 	sp->pp_last_activity = 0;
    929 	sp->pp_idle_timeout = 0;
    930 	memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq));
    931 	memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq));
    932 	sp->pp_auth_failures = 0;
    933 	sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES;
    934 	sp->pp_phase = SPPP_PHASE_DEAD;
    935 	sp->pp_up = lcp.Up;
    936 	sp->pp_down = lcp.Down;
    937 
    938 	if_alloc_sadl(ifp);
    939 
    940 	memset(&sp->myauth, 0, sizeof sp->myauth);
    941 	memset(&sp->hisauth, 0, sizeof sp->hisauth);
    942 	sppp_lcp_init(sp);
    943 	sppp_ipcp_init(sp);
    944 	sppp_ipv6cp_init(sp);
    945 	sppp_pap_init(sp);
    946 	sppp_chap_init(sp);
    947 }
    948 
    949 void
    950 sppp_detach(struct ifnet *ifp)
    951 {
    952 	struct sppp **q, *p, *sp = (struct sppp*) ifp;
    953 	int i;
    954 
    955 	/* Remove the entry from the keepalive list. */
    956 	for (q = &spppq; (p = *q); q = &p->pp_next)
    957 		if (p == sp) {
    958 			*q = p->pp_next;
    959 			break;
    960 		}
    961 
    962 	/* Stop keepalive handler. */
    963 	if (! spppq) {
    964 		callout_stop(&keepalive_ch);
    965 	}
    966 
    967 	for (i = 0; i < IDX_COUNT; i++) {
    968 		callout_stop(&sp->ch[i]);
    969 	}
    970 	callout_stop(&sp->pap_my_to_ch);
    971 
    972 	/* free authentication info */
    973 	if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF);
    974 	if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF);
    975 	if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF);
    976 	if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF);
    977 
    978 	if_free_sadl(ifp);
    979 }
    980 
    981 /*
    982  * Flush the interface output queue.
    983  */
    984 void
    985 sppp_flush(struct ifnet *ifp)
    986 {
    987 	struct sppp *sp = (struct sppp*) ifp;
    988 
    989 	IFQ_PURGE (&sp->pp_if.if_snd);
    990 	IF_PURGE (&sp->pp_fastq);
    991 	IF_PURGE (&sp->pp_cpq);
    992 }
    993 
    994 /*
    995  * Check if the output queue is empty.
    996  */
    997 int
    998 sppp_isempty(struct ifnet *ifp)
    999 {
   1000 	struct sppp *sp = (struct sppp*) ifp;
   1001 	int empty, s;
   1002 
   1003 	s = splnet();
   1004 	empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) &&
   1005 		IFQ_IS_EMPTY(&sp->pp_if.if_snd);
   1006 	splx(s);
   1007 	return (empty);
   1008 }
   1009 
   1010 /*
   1011  * Get next packet to send.
   1012  */
   1013 struct mbuf *
   1014 sppp_dequeue(struct ifnet *ifp)
   1015 {
   1016 	struct sppp *sp = (struct sppp*) ifp;
   1017 	struct mbuf *m;
   1018 	int s;
   1019 
   1020 	s = splnet();
   1021 	/*
   1022 	 * Process only the control protocol queue until we have at
   1023 	 * least one NCP open.
   1024 	 *
   1025 	 * Do always serve all three queues in Cisco mode.
   1026 	 */
   1027 	IF_DEQUEUE(&sp->pp_cpq, m);
   1028 	if (m == NULL &&
   1029 	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
   1030 		IF_DEQUEUE(&sp->pp_fastq, m);
   1031 		if (m == NULL)
   1032 			IF_DEQUEUE (&sp->pp_if.if_snd, m);
   1033 	}
   1034 	splx(s);
   1035 	return m;
   1036 }
   1037 
   1038 /*
   1039  * Pick the next packet, do not remove it from the queue.
   1040  */
   1041 struct mbuf *
   1042 sppp_pick(struct ifnet *ifp)
   1043 {
   1044 	struct sppp *sp = (struct sppp*)ifp;
   1045 	struct mbuf *m;
   1046 	int s;
   1047 
   1048 	s= splnet ();
   1049 
   1050 	m = sp->pp_cpq.ifq_head;
   1051 	if (m == NULL &&
   1052 	    (sp->pp_phase == SPPP_PHASE_NETWORK ||
   1053 	     (sp->pp_flags & PP_CISCO) != 0))
   1054 		if ((m = sp->pp_fastq.ifq_head) == NULL)
   1055 			m = sp->pp_if.if_snd.ifq_head;
   1056 	splx (s);
   1057 	return (m);
   1058 }
   1059 
   1060 /*
   1061  * Process an ioctl request.  Called on low priority level.
   1062  */
   1063 int
   1064 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
   1065 {
   1066 	struct ifreq *ifr = (struct ifreq*) data;
   1067 	struct sppp *sp = (struct sppp*) ifp;
   1068 	int s, error=0, going_up, going_down, newmode;
   1069 
   1070 	s = splnet();
   1071 	switch (cmd) {
   1072 	case SIOCAIFADDR:
   1073 	case SIOCSIFDSTADDR:
   1074 		break;
   1075 
   1076 	case SIOCSIFADDR:
   1077 		if_up(ifp);
   1078 		/* fall through... */
   1079 
   1080 	case SIOCSIFFLAGS:
   1081 		going_up = ifp->if_flags & IFF_UP &&
   1082 			(ifp->if_flags & IFF_RUNNING) == 0;
   1083 		going_down = (ifp->if_flags & IFF_UP) == 0 &&
   1084 			ifp->if_flags & IFF_RUNNING;
   1085 		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
   1086 		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
   1087 			/* sanity */
   1088 			newmode = IFF_PASSIVE;
   1089 			ifp->if_flags &= ~IFF_AUTO;
   1090 		}
   1091 
   1092 		if (going_up || going_down)
   1093 			lcp.Close(sp);
   1094 		if (going_up && newmode == 0) {
   1095 			/* neither auto-dial nor passive */
   1096 			ifp->if_flags |= IFF_RUNNING;
   1097 			if (!(sp->pp_flags & PP_CISCO))
   1098 				lcp.Open(sp);
   1099 		} else if (going_down) {
   1100 			sppp_flush(ifp);
   1101 			ifp->if_flags &= ~IFF_RUNNING;
   1102 		}
   1103 
   1104 		break;
   1105 
   1106 #ifdef SIOCSIFMTU
   1107 #ifndef ifr_mtu
   1108 #define ifr_mtu ifr_metric
   1109 #endif
   1110 	case SIOCSIFMTU:
   1111 		if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru)
   1112 			return (EINVAL);
   1113 		ifp->if_mtu = ifr->ifr_mtu;
   1114 		break;
   1115 #endif
   1116 #ifdef SLIOCSETMTU
   1117 	case SLIOCSETMTU:
   1118 		if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru)
   1119 			return (EINVAL);
   1120 		ifp->if_mtu = *(short*)data;
   1121 		break;
   1122 #endif
   1123 #ifdef SIOCGIFMTU
   1124 	case SIOCGIFMTU:
   1125 		ifr->ifr_mtu = ifp->if_mtu;
   1126 		break;
   1127 #endif
   1128 #ifdef SLIOCGETMTU
   1129 	case SLIOCGETMTU:
   1130 		*(short*)data = ifp->if_mtu;
   1131 		break;
   1132 #endif
   1133 	case SIOCADDMULTI:
   1134 	case SIOCDELMULTI:
   1135 		break;
   1136 
   1137 	case SPPPSETAUTHCFG:
   1138 	case SPPPSETLCPCFG:
   1139 	case SPPPSETIDLETO:
   1140 	case SPPPSETAUTHFAILURE:
   1141 	case SPPPSETDNSOPTS:
   1142 	{
   1143 		struct proc *p = curproc;		/* XXX */
   1144 
   1145 		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
   1146 			break;
   1147 	}
   1148 	/* FALLTHROUGH */
   1149 	case SPPPGETAUTHCFG:
   1150 	case SPPPGETLCPCFG:
   1151 	case SPPPGETSTATUS:
   1152 	case SPPPGETIDLETO:
   1153 	case SPPPGETAUTHFAILURES:
   1154 	case SPPPGETDNSOPTS:
   1155 	case SPPPGETDNSADDRS:
   1156 		error = sppp_params(sp, cmd, data);
   1157 		break;
   1158 
   1159 	default:
   1160 		error = ENOTTY;
   1161 	}
   1162 	splx(s);
   1163 	return (error);
   1164 }
   1165 
   1166 
   1167 /*
   1168  * Cisco framing implementation.
   1169  */
   1170 
   1171 /*
   1172  * Handle incoming Cisco keepalive protocol packets.
   1173  */
   1174 static void
   1175 sppp_cisco_input(struct sppp *sp, struct mbuf *m)
   1176 {
   1177 	STDDCL;
   1178 	struct cisco_packet *h;
   1179 	u_int32_t me, mymask;
   1180 
   1181 	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
   1182 		if (debug)
   1183 			log(LOG_DEBUG,
   1184 			    SPP_FMT "cisco invalid packet length: %d bytes\n",
   1185 			    SPP_ARGS(ifp), m->m_pkthdr.len);
   1186 		return;
   1187 	}
   1188 	h = mtod (m, struct cisco_packet*);
   1189 	if (debug)
   1190 		log(LOG_DEBUG,
   1191 		    SPP_FMT "cisco input: %d bytes "
   1192 		    "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1193 		    SPP_ARGS(ifp), m->m_pkthdr.len,
   1194 		    ntohl (h->type), h->par1, h->par2, (u_int)h->rel,
   1195 		    (u_int)h->time0, (u_int)h->time1);
   1196 	switch (ntohl (h->type)) {
   1197 	default:
   1198 		if (debug)
   1199 			addlog(SPP_FMT "cisco unknown packet type: 0x%x\n",
   1200 			       SPP_ARGS(ifp), ntohl (h->type));
   1201 		break;
   1202 	case CISCO_ADDR_REPLY:
   1203 		/* Reply on address request, ignore */
   1204 		break;
   1205 	case CISCO_KEEPALIVE_REQ:
   1206 		sp->pp_alivecnt = 0;
   1207 		sp->pp_rseq[IDX_LCP] = ntohl (h->par1);
   1208 		if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
   1209 			/* Local and remote sequence numbers are equal.
   1210 			 * Probably, the line is in loopback mode. */
   1211 			if (sp->pp_loopcnt >= MAXALIVECNT) {
   1212 				printf (SPP_FMT "loopback\n",
   1213 					SPP_ARGS(ifp));
   1214 				sp->pp_loopcnt = 0;
   1215 				if (ifp->if_flags & IFF_UP) {
   1216 					if_down (ifp);
   1217 					IF_PURGE (&sp->pp_cpq);
   1218 				}
   1219 			}
   1220 			++sp->pp_loopcnt;
   1221 
   1222 			/* Generate new local sequence number */
   1223 			sp->pp_seq[IDX_LCP] = random();
   1224 			break;
   1225 		}
   1226 		sp->pp_loopcnt = 0;
   1227 		if (! (ifp->if_flags & IFF_UP) &&
   1228 		    (ifp->if_flags & IFF_RUNNING)) {
   1229 			if_up(ifp);
   1230 		}
   1231 		break;
   1232 	case CISCO_ADDR_REQ:
   1233 		sppp_get_ip_addrs(sp, &me, 0, &mymask);
   1234 		if (me != 0L)
   1235 			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
   1236 		break;
   1237 	}
   1238 }
   1239 
   1240 /*
   1241  * Send Cisco keepalive packet.
   1242  */
   1243 static void
   1244 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2)
   1245 {
   1246 	STDDCL;
   1247 	struct ppp_header *h;
   1248 	struct cisco_packet *ch;
   1249 	struct mbuf *m;
   1250 	u_int32_t t = (time.tv_sec - boottime.tv_sec) * 1000;
   1251 
   1252 	MGETHDR (m, M_DONTWAIT, MT_DATA);
   1253 	if (! m)
   1254 		return;
   1255 	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
   1256 	m->m_pkthdr.rcvif = 0;
   1257 
   1258 	h = mtod (m, struct ppp_header*);
   1259 	h->address = CISCO_MULTICAST;
   1260 	h->control = 0;
   1261 	h->protocol = htons (CISCO_KEEPALIVE);
   1262 
   1263 	ch = (struct cisco_packet*) (h + 1);
   1264 	ch->type = htonl (type);
   1265 	ch->par1 = htonl (par1);
   1266 	ch->par2 = htonl (par2);
   1267 	ch->rel = -1;
   1268 
   1269 	ch->time0 = htons ((u_short) (t >> 16));
   1270 	ch->time1 = htons ((u_short) t);
   1271 
   1272 	if (debug)
   1273 		log(LOG_DEBUG,
   1274 		    SPP_FMT "cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
   1275 			SPP_ARGS(ifp), ntohl (ch->type), ch->par1,
   1276 			ch->par2, (u_int)ch->rel, (u_int)ch->time0,
   1277 			(u_int)ch->time1);
   1278 
   1279 	if (IF_QFULL (&sp->pp_cpq)) {
   1280 		IF_DROP (&sp->pp_fastq);
   1281 		IF_DROP (&ifp->if_snd);
   1282 		m_freem (m);
   1283 	} else
   1284 		IF_ENQUEUE (&sp->pp_cpq, m);
   1285 	if (! (ifp->if_flags & IFF_OACTIVE))
   1286 		(*ifp->if_start) (ifp);
   1287 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1288 }
   1289 
   1290 /*
   1291  * PPP protocol implementation.
   1292  */
   1293 
   1294 /*
   1295  * Send PPP control protocol packet.
   1296  */
   1297 static void
   1298 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
   1299 	     u_char ident, u_short len, void *data)
   1300 {
   1301 	STDDCL;
   1302 	struct lcp_header *lh;
   1303 	struct mbuf *m;
   1304 	size_t pkthdrlen;
   1305 
   1306 	pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
   1307 
   1308 	if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
   1309 		len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
   1310 	MGETHDR (m, M_DONTWAIT, MT_DATA);
   1311 	if (! m)
   1312 		return;
   1313 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   1314 	m->m_pkthdr.rcvif = 0;
   1315 
   1316 	if (sp->pp_flags & PP_NOFRAMING) {
   1317 		*mtod(m, u_int16_t*) = htons(proto);
   1318 		lh = (struct lcp_header*)(mtod(m, u_int8_t*) + 2);
   1319 	} else {
   1320 		struct ppp_header *h;
   1321 		h = mtod (m, struct ppp_header*);
   1322 		h->address = PPP_ALLSTATIONS;        /* broadcast address */
   1323 		h->control = PPP_UI;                 /* Unnumbered Info */
   1324 		h->protocol = htons (proto);         /* Link Control Protocol */
   1325 		lh = (struct lcp_header*) (h + 1);
   1326 	}
   1327 	lh->type = type;
   1328 	lh->ident = ident;
   1329 	lh->len = htons (LCP_HEADER_LEN + len);
   1330 	if (len)
   1331 		bcopy (data, lh+1, len);
   1332 
   1333 	if (debug) {
   1334 		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
   1335 		    SPP_ARGS(ifp),
   1336 		    sppp_proto_name(proto),
   1337 		    sppp_cp_type_name (lh->type), lh->ident,
   1338 			ntohs (lh->len));
   1339 		if (len)
   1340 			sppp_print_bytes ((u_char*) (lh+1), len);
   1341 		addlog(">\n");
   1342 	}
   1343 	if (IF_QFULL (&sp->pp_cpq)) {
   1344 		IF_DROP (&sp->pp_fastq);
   1345 		IF_DROP (&ifp->if_snd);
   1346 		m_freem (m);
   1347 		++ifp->if_oerrors;
   1348 	} else
   1349 		IF_ENQUEUE (&sp->pp_cpq, m);
   1350 	if (! (ifp->if_flags & IFF_OACTIVE))
   1351 		(*ifp->if_start) (ifp);
   1352 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
   1353 }
   1354 
   1355 /*
   1356  * Handle incoming PPP control protocol packets.
   1357  */
   1358 static void
   1359 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
   1360 {
   1361 	STDDCL;
   1362 	struct lcp_header *h;
   1363 	int len = m->m_pkthdr.len;
   1364 	int rv;
   1365 	u_char *p;
   1366 	u_int32_t u32;
   1367 
   1368 	if (len < 4) {
   1369 		if (debug)
   1370 			log(LOG_DEBUG,
   1371 			    SPP_FMT "%s invalid packet length: %d bytes\n",
   1372 			    SPP_ARGS(ifp), cp->name, len);
   1373 		return;
   1374 	}
   1375 	h = mtod (m, struct lcp_header*);
   1376 	if (debug) {
   1377 		log(LOG_DEBUG,
   1378 		    SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
   1379 		    SPP_ARGS(ifp), cp->name,
   1380 		    sppp_state_name(sp->state[cp->protoidx]),
   1381 		    sppp_cp_type_name (h->type), h->ident, ntohs (h->len));
   1382 		if (len > 4)
   1383 			sppp_print_bytes ((u_char*) (h+1), len-4);
   1384 		addlog(">\n");
   1385 	}
   1386 	if (len > ntohs (h->len))
   1387 		len = ntohs (h->len);
   1388 	p = (u_char *)(h + 1);
   1389 	switch (h->type) {
   1390 	case CONF_REQ:
   1391 		if (len < 4) {
   1392 			if (debug)
   1393 				addlog(SPP_FMT "%s invalid conf-req length %d\n",
   1394 				       SPP_ARGS(ifp), cp->name,
   1395 				       len);
   1396 			++ifp->if_ierrors;
   1397 			break;
   1398 		}
   1399 		/* handle states where RCR doesn't get a SCA/SCN */
   1400 		switch (sp->state[cp->protoidx]) {
   1401 		case STATE_CLOSING:
   1402 		case STATE_STOPPING:
   1403 			return;
   1404 		case STATE_CLOSED:
   1405 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
   1406 				     0, 0);
   1407 			return;
   1408 		}
   1409 		rv = (cp->RCR)(sp, h, len);
   1410 		switch (sp->state[cp->protoidx]) {
   1411 		case STATE_OPENED:
   1412 			(cp->tld)(sp);
   1413 			(cp->scr)(sp);
   1414 			/* fall through... */
   1415 		case STATE_ACK_SENT:
   1416 		case STATE_REQ_SENT:
   1417 			sppp_cp_change_state(cp, sp, rv?
   1418 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1419 			break;
   1420 		case STATE_STOPPED:
   1421 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1422 			(cp->scr)(sp);
   1423 			sppp_cp_change_state(cp, sp, rv?
   1424 					     STATE_ACK_SENT: STATE_REQ_SENT);
   1425 			break;
   1426 		case STATE_ACK_RCVD:
   1427 			if (rv) {
   1428 				sppp_cp_change_state(cp, sp, STATE_OPENED);
   1429 				if (debug)
   1430 					log(LOG_DEBUG, SPP_FMT "%s tlu\n",
   1431 					    SPP_ARGS(ifp),
   1432 					    cp->name);
   1433 				(cp->tlu)(sp);
   1434 			} else
   1435 				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1436 			break;
   1437 		default:
   1438 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1439 			       SPP_ARGS(ifp), cp->name,
   1440 			       sppp_cp_type_name(h->type),
   1441 			       sppp_state_name(sp->state[cp->protoidx]));
   1442 			++ifp->if_ierrors;
   1443 		}
   1444 		break;
   1445 	case CONF_ACK:
   1446 		if (h->ident != sp->confid[cp->protoidx]) {
   1447 			if (debug)
   1448 				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
   1449 				       SPP_ARGS(ifp), cp->name,
   1450 				       h->ident, sp->confid[cp->protoidx]);
   1451 			++ifp->if_ierrors;
   1452 			break;
   1453 		}
   1454 		switch (sp->state[cp->protoidx]) {
   1455 		case STATE_CLOSED:
   1456 		case STATE_STOPPED:
   1457 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1458 			break;
   1459 		case STATE_CLOSING:
   1460 		case STATE_STOPPING:
   1461 			break;
   1462 		case STATE_REQ_SENT:
   1463 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1464 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1465 			break;
   1466 		case STATE_OPENED:
   1467 			(cp->tld)(sp);
   1468 			/* fall through */
   1469 		case STATE_ACK_RCVD:
   1470 			(cp->scr)(sp);
   1471 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1472 			break;
   1473 		case STATE_ACK_SENT:
   1474 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1475 			sppp_cp_change_state(cp, sp, STATE_OPENED);
   1476 			if (debug)
   1477 				log(LOG_DEBUG, SPP_FMT "%s tlu\n",
   1478 				       SPP_ARGS(ifp), cp->name);
   1479 			(cp->tlu)(sp);
   1480 			break;
   1481 		default:
   1482 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1483 			       SPP_ARGS(ifp), cp->name,
   1484 			       sppp_cp_type_name(h->type),
   1485 			       sppp_state_name(sp->state[cp->protoidx]));
   1486 			++ifp->if_ierrors;
   1487 		}
   1488 		break;
   1489 	case CONF_NAK:
   1490 	case CONF_REJ:
   1491 		if (h->ident != sp->confid[cp->protoidx]) {
   1492 			if (debug)
   1493 				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
   1494 				       SPP_ARGS(ifp), cp->name,
   1495 				       h->ident, sp->confid[cp->protoidx]);
   1496 			++ifp->if_ierrors;
   1497 			break;
   1498 		}
   1499 		if (h->type == CONF_NAK)
   1500 			(cp->RCN_nak)(sp, h, len);
   1501 		else /* CONF_REJ */
   1502 			(cp->RCN_rej)(sp, h, len);
   1503 
   1504 		switch (sp->state[cp->protoidx]) {
   1505 		case STATE_CLOSED:
   1506 		case STATE_STOPPED:
   1507 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1508 			break;
   1509 		case STATE_REQ_SENT:
   1510 		case STATE_ACK_SENT:
   1511 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1512 			(cp->scr)(sp);
   1513 			break;
   1514 		case STATE_OPENED:
   1515 			(cp->tld)(sp);
   1516 			/* fall through */
   1517 		case STATE_ACK_RCVD:
   1518 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
   1519 			(cp->scr)(sp);
   1520 			break;
   1521 		case STATE_CLOSING:
   1522 		case STATE_STOPPING:
   1523 			break;
   1524 		default:
   1525 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1526 			       SPP_ARGS(ifp), cp->name,
   1527 			       sppp_cp_type_name(h->type),
   1528 			       sppp_state_name(sp->state[cp->protoidx]));
   1529 			++ifp->if_ierrors;
   1530 		}
   1531 		break;
   1532 
   1533 	case TERM_REQ:
   1534 		switch (sp->state[cp->protoidx]) {
   1535 		case STATE_ACK_RCVD:
   1536 		case STATE_ACK_SENT:
   1537 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1538 			/* fall through */
   1539 		case STATE_CLOSED:
   1540 		case STATE_STOPPED:
   1541 		case STATE_CLOSING:
   1542 		case STATE_STOPPING:
   1543 		case STATE_REQ_SENT:
   1544 		  sta:
   1545 			/* Send Terminate-Ack packet. */
   1546 			if (debug)
   1547 				log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
   1548 				    SPP_ARGS(ifp), cp->name);
   1549 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
   1550 			break;
   1551 		case STATE_OPENED:
   1552 			(cp->tld)(sp);
   1553 			sp->rst_counter[cp->protoidx] = 0;
   1554 			sppp_cp_change_state(cp, sp, STATE_STOPPING);
   1555 			goto sta;
   1556 			break;
   1557 		default:
   1558 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1559 			       SPP_ARGS(ifp), cp->name,
   1560 			       sppp_cp_type_name(h->type),
   1561 			       sppp_state_name(sp->state[cp->protoidx]));
   1562 			++ifp->if_ierrors;
   1563 		}
   1564 		break;
   1565 	case TERM_ACK:
   1566 		switch (sp->state[cp->protoidx]) {
   1567 		case STATE_CLOSED:
   1568 		case STATE_STOPPED:
   1569 		case STATE_REQ_SENT:
   1570 		case STATE_ACK_SENT:
   1571 			break;
   1572 		case STATE_CLOSING:
   1573 			(cp->tlf)(sp);
   1574 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1575 			sppp_lcp_check_and_close(sp);
   1576 			break;
   1577 		case STATE_STOPPING:
   1578 			(cp->tlf)(sp);
   1579 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1580 			sppp_lcp_check_and_close(sp);
   1581 			break;
   1582 		case STATE_ACK_RCVD:
   1583 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1584 			break;
   1585 		case STATE_OPENED:
   1586 			(cp->tld)(sp);
   1587 			(cp->scr)(sp);
   1588 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
   1589 			break;
   1590 		default:
   1591 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1592 			       SPP_ARGS(ifp), cp->name,
   1593 			       sppp_cp_type_name(h->type),
   1594 			       sppp_state_name(sp->state[cp->protoidx]));
   1595 			++ifp->if_ierrors;
   1596 		}
   1597 		break;
   1598 	case CODE_REJ:
   1599 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1600 		log(LOG_INFO,
   1601 		    SPP_FMT "%s: ignoring RXJ (%s) for code ?, "
   1602 		    "danger will robinson\n",
   1603 		    SPP_ARGS(ifp), cp->name,
   1604 		    sppp_cp_type_name(h->type));
   1605 		switch (sp->state[cp->protoidx]) {
   1606 		case STATE_CLOSED:
   1607 		case STATE_STOPPED:
   1608 		case STATE_REQ_SENT:
   1609 		case STATE_ACK_SENT:
   1610 		case STATE_CLOSING:
   1611 		case STATE_STOPPING:
   1612 		case STATE_OPENED:
   1613 			break;
   1614 		case STATE_ACK_RCVD:
   1615 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1616 			break;
   1617 		default:
   1618 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1619 			       SPP_ARGS(ifp), cp->name,
   1620 			       sppp_cp_type_name(h->type),
   1621 			       sppp_state_name(sp->state[cp->protoidx]));
   1622 			++ifp->if_ierrors;
   1623 		}
   1624 		break;
   1625 	case PROTO_REJ:
   1626 	    {
   1627 		int catastrophic;
   1628 		const struct cp *upper;
   1629 		int i;
   1630 		u_int16_t proto;
   1631 
   1632 		catastrophic = 0;
   1633 		upper = NULL;
   1634 		proto = p[0] << 8 | p[1];
   1635 		for (i = 0; i < IDX_COUNT; i++) {
   1636 			if (cps[i]->proto == proto) {
   1637 				upper = cps[i];
   1638 				break;
   1639 			}
   1640 		}
   1641 		if (upper == NULL)
   1642 			catastrophic++;
   1643 
   1644 		if (debug)
   1645 			log(LOG_INFO,
   1646 			    SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
   1647 			    SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+',
   1648 			    sppp_cp_type_name(h->type), proto,
   1649 			    upper ? upper->name : "unknown",
   1650 			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
   1651 
   1652 		/*
   1653 		 * if we got RXJ+ against conf-req, the peer does not implement
   1654 		 * this particular protocol type.  terminate the protocol.
   1655 		 */
   1656 		if (upper && !catastrophic) {
   1657 			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
   1658 				upper->Close(sp);
   1659 				break;
   1660 			}
   1661 		}
   1662 
   1663 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
   1664 		switch (sp->state[cp->protoidx]) {
   1665 		case STATE_CLOSED:
   1666 		case STATE_STOPPED:
   1667 		case STATE_REQ_SENT:
   1668 		case STATE_ACK_SENT:
   1669 		case STATE_CLOSING:
   1670 		case STATE_STOPPING:
   1671 		case STATE_OPENED:
   1672 			break;
   1673 		case STATE_ACK_RCVD:
   1674 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1675 			break;
   1676 		default:
   1677 			printf(SPP_FMT "%s illegal %s in state %s\n",
   1678 			       SPP_ARGS(ifp), cp->name,
   1679 			       sppp_cp_type_name(h->type),
   1680 			       sppp_state_name(sp->state[cp->protoidx]));
   1681 			++ifp->if_ierrors;
   1682 		}
   1683 		break;
   1684 	    }
   1685 	case DISC_REQ:
   1686 		if (cp->proto != PPP_LCP)
   1687 			goto illegal;
   1688 		/* Discard the packet. */
   1689 		break;
   1690 	case ECHO_REQ:
   1691 		if (cp->proto != PPP_LCP)
   1692 			goto illegal;
   1693 		if (sp->state[cp->protoidx] != STATE_OPENED) {
   1694 			if (debug)
   1695 				addlog(SPP_FMT "lcp echo req but lcp closed\n",
   1696 				       SPP_ARGS(ifp));
   1697 			++ifp->if_ierrors;
   1698 			break;
   1699 		}
   1700 		if (len < 8) {
   1701 			if (debug)
   1702 				addlog(SPP_FMT "invalid lcp echo request "
   1703 				       "packet length: %d bytes\n",
   1704 				       SPP_ARGS(ifp), len);
   1705 			break;
   1706 		}
   1707 		memcpy(&u32, h + 1, sizeof u32);
   1708 		if (ntohl(u32) == sp->lcp.magic) {
   1709 			/* Line loopback mode detected. */
   1710 			printf(SPP_FMT "loopback\n", SPP_ARGS(ifp));
   1711 			if_down (ifp);
   1712 			IF_PURGE (&sp->pp_cpq);
   1713 
   1714 			/* Shut down the PPP link. */
   1715 			/* XXX */
   1716 			lcp.Down(sp);
   1717 			lcp.Up(sp);
   1718 			break;
   1719 		}
   1720 		u32 = htonl(sp->lcp.magic);
   1721 		memcpy(h + 1, &u32, sizeof u32);
   1722 		if (debug)
   1723 			addlog(SPP_FMT "got lcp echo req, sending echo rep\n",
   1724 			       SPP_ARGS(ifp));
   1725 		sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
   1726 		break;
   1727 	case ECHO_REPLY:
   1728 		if (cp->proto != PPP_LCP)
   1729 			goto illegal;
   1730 		if (h->ident != sp->lcp.echoid) {
   1731 			++ifp->if_ierrors;
   1732 			break;
   1733 		}
   1734 		if (len < 8) {
   1735 			if (debug)
   1736 				addlog(SPP_FMT "lcp invalid echo reply "
   1737 				       "packet length: %d bytes\n",
   1738 				       SPP_ARGS(ifp), len);
   1739 			break;
   1740 		}
   1741 		if (debug)
   1742 			addlog(SPP_FMT "lcp got echo rep\n",
   1743 			       SPP_ARGS(ifp));
   1744 		memcpy(&u32, h + 1, sizeof u32);
   1745 		if (ntohl(u32) != sp->lcp.magic)
   1746 			sp->pp_alivecnt = 0;
   1747 		break;
   1748 	default:
   1749 		/* Unknown packet type -- send Code-Reject packet. */
   1750 	  illegal:
   1751 		if (debug)
   1752 			addlog(SPP_FMT "%s send code-rej for 0x%x\n",
   1753 			       SPP_ARGS(ifp), cp->name, h->type);
   1754 		sppp_cp_send(sp, cp->proto, CODE_REJ,
   1755 		    ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
   1756 		++ifp->if_ierrors;
   1757 	}
   1758 }
   1759 
   1760 
   1761 /*
   1762  * The generic part of all Up/Down/Open/Close/TO event handlers.
   1763  * Basically, the state transition handling in the automaton.
   1764  */
   1765 static void
   1766 sppp_up_event(const struct cp *cp, struct sppp *sp)
   1767 {
   1768 	STDDCL;
   1769 
   1770 	if (debug)
   1771 		log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
   1772 		    SPP_ARGS(ifp), cp->name,
   1773 		    sppp_state_name(sp->state[cp->protoidx]));
   1774 
   1775 	switch (sp->state[cp->protoidx]) {
   1776 	case STATE_INITIAL:
   1777 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1778 		break;
   1779 	case STATE_STARTING:
   1780 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1781 		(cp->scr)(sp);
   1782 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1783 		break;
   1784 	default:
   1785 		printf(SPP_FMT "%s illegal up in state %s\n",
   1786 		       SPP_ARGS(ifp), cp->name,
   1787 		       sppp_state_name(sp->state[cp->protoidx]));
   1788 	}
   1789 }
   1790 
   1791 static void
   1792 sppp_down_event(const struct cp *cp, struct sppp *sp)
   1793 {
   1794 	STDDCL;
   1795 
   1796 	if (debug)
   1797 		log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
   1798 		    SPP_ARGS(ifp), cp->name,
   1799 		    sppp_state_name(sp->state[cp->protoidx]));
   1800 
   1801 	switch (sp->state[cp->protoidx]) {
   1802 	case STATE_CLOSED:
   1803 	case STATE_CLOSING:
   1804 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   1805 		break;
   1806 	case STATE_STOPPED:
   1807 		(cp->tls)(sp);
   1808 		/* fall through */
   1809 	case STATE_STOPPING:
   1810 	case STATE_REQ_SENT:
   1811 	case STATE_ACK_RCVD:
   1812 	case STATE_ACK_SENT:
   1813 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1814 		break;
   1815 	case STATE_OPENED:
   1816 		(cp->tld)(sp);
   1817 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1818 		break;
   1819 	default:
   1820 		printf(SPP_FMT "%s illegal down in state %s\n",
   1821 		       SPP_ARGS(ifp), cp->name,
   1822 		       sppp_state_name(sp->state[cp->protoidx]));
   1823 	}
   1824 }
   1825 
   1826 
   1827 static void
   1828 sppp_open_event(const struct cp *cp, struct sppp *sp)
   1829 {
   1830 	STDDCL;
   1831 
   1832 	if (debug)
   1833 		log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
   1834 		    SPP_ARGS(ifp), cp->name,
   1835 		    sppp_state_name(sp->state[cp->protoidx]));
   1836 
   1837 	switch (sp->state[cp->protoidx]) {
   1838 	case STATE_INITIAL:
   1839 		(cp->tls)(sp);
   1840 		sppp_cp_change_state(cp, sp, STATE_STARTING);
   1841 		break;
   1842 	case STATE_STARTING:
   1843 		break;
   1844 	case STATE_CLOSED:
   1845 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
   1846 		(cp->scr)(sp);
   1847 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1848 		break;
   1849 	case STATE_STOPPED:
   1850 	case STATE_STOPPING:
   1851 	case STATE_REQ_SENT:
   1852 	case STATE_ACK_RCVD:
   1853 	case STATE_ACK_SENT:
   1854 	case STATE_OPENED:
   1855 		break;
   1856 	case STATE_CLOSING:
   1857 		sppp_cp_change_state(cp, sp, STATE_STOPPING);
   1858 		break;
   1859 	}
   1860 }
   1861 
   1862 
   1863 static void
   1864 sppp_close_event(const struct cp *cp, struct sppp *sp)
   1865 {
   1866 	STDDCL;
   1867 
   1868 	if (debug)
   1869 		log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
   1870 		    SPP_ARGS(ifp), cp->name,
   1871 		    sppp_state_name(sp->state[cp->protoidx]));
   1872 
   1873 	switch (sp->state[cp->protoidx]) {
   1874 	case STATE_INITIAL:
   1875 	case STATE_CLOSED:
   1876 	case STATE_CLOSING:
   1877 		break;
   1878 	case STATE_STARTING:
   1879 		(cp->tlf)(sp);
   1880 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
   1881 		break;
   1882 	case STATE_STOPPED:
   1883 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1884 		break;
   1885 	case STATE_STOPPING:
   1886 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   1887 		break;
   1888 	case STATE_OPENED:
   1889 		(cp->tld)(sp);
   1890 		/* fall through */
   1891 	case STATE_REQ_SENT:
   1892 	case STATE_ACK_RCVD:
   1893 	case STATE_ACK_SENT:
   1894 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
   1895 		sppp_cp_send(sp, cp->proto, TERM_REQ,
   1896 		    ++sp->pp_seq[cp->protoidx], 0, 0);
   1897 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
   1898 		break;
   1899 	}
   1900 }
   1901 
   1902 static void
   1903 sppp_to_event(const struct cp *cp, struct sppp *sp)
   1904 {
   1905 	STDDCL;
   1906 	int s;
   1907 
   1908 	s = splnet();
   1909 	if (debug)
   1910 		log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
   1911 		    SPP_ARGS(ifp), cp->name,
   1912 		    sppp_state_name(sp->state[cp->protoidx]),
   1913 		    sp->rst_counter[cp->protoidx]);
   1914 
   1915 	if (--sp->rst_counter[cp->protoidx] < 0)
   1916 		/* TO- event */
   1917 		switch (sp->state[cp->protoidx]) {
   1918 		case STATE_CLOSING:
   1919 			(cp->tlf)(sp);
   1920 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
   1921 			sppp_lcp_check_and_close(sp);
   1922 			break;
   1923 		case STATE_STOPPING:
   1924 			(cp->tlf)(sp);
   1925 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1926 			sppp_lcp_check_and_close(sp);
   1927 			break;
   1928 		case STATE_REQ_SENT:
   1929 		case STATE_ACK_RCVD:
   1930 		case STATE_ACK_SENT:
   1931 			(cp->tlf)(sp);
   1932 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
   1933 			sppp_lcp_check_and_close(sp);
   1934 			break;
   1935 		}
   1936 	else
   1937 		/* TO+ event */
   1938 		switch (sp->state[cp->protoidx]) {
   1939 		case STATE_CLOSING:
   1940 		case STATE_STOPPING:
   1941 			sppp_cp_send(sp, cp->proto, TERM_REQ,
   1942 			    ++sp->pp_seq[cp->protoidx], 0, 0);
   1943 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1944 			    cp->TO, sp);
   1945 			break;
   1946 		case STATE_REQ_SENT:
   1947 		case STATE_ACK_RCVD:
   1948 			(cp->scr)(sp);
   1949 			/* sppp_cp_change_state() will restart the timer */
   1950 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
   1951 			break;
   1952 		case STATE_ACK_SENT:
   1953 			(cp->scr)(sp);
   1954 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1955 			    cp->TO, sp);
   1956 			break;
   1957 		}
   1958 
   1959 	splx(s);
   1960 }
   1961 
   1962 /*
   1963  * Change the state of a control protocol in the state automaton.
   1964  * Takes care of starting/stopping the restart timer.
   1965  */
   1966 void
   1967 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
   1968 {
   1969 	sp->state[cp->protoidx] = newstate;
   1970 	callout_stop(&sp->ch[cp->protoidx]);
   1971 	switch (newstate) {
   1972 	case STATE_INITIAL:
   1973 	case STATE_STARTING:
   1974 	case STATE_CLOSED:
   1975 	case STATE_STOPPED:
   1976 	case STATE_OPENED:
   1977 		break;
   1978 	case STATE_CLOSING:
   1979 	case STATE_STOPPING:
   1980 	case STATE_REQ_SENT:
   1981 	case STATE_ACK_RCVD:
   1982 	case STATE_ACK_SENT:
   1983 		callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
   1984 		    cp->TO, sp);
   1985 		break;
   1986 	}
   1987 }
   1988 
   1989 /*
   1990  *--------------------------------------------------------------------------*
   1991  *                                                                          *
   1992  *                         The LCP implementation.                          *
   1993  *                                                                          *
   1994  *--------------------------------------------------------------------------*
   1995  */
   1996 static void
   1997 sppp_lcp_init(struct sppp *sp)
   1998 {
   1999 	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
   2000 	sp->lcp.magic = 0;
   2001 	sp->state[IDX_LCP] = STATE_INITIAL;
   2002 	sp->fail_counter[IDX_LCP] = 0;
   2003 	sp->pp_seq[IDX_LCP] = 0;
   2004 	sp->pp_rseq[IDX_LCP] = 0;
   2005 	sp->lcp.protos = 0;
   2006 	sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
   2007 
   2008 	/*
   2009 	 * Initialize counters and timeout values.  Note that we don't
   2010 	 * use the 3 seconds suggested in RFC 1661 since we are likely
   2011 	 * running on a fast link.  XXX We should probably implement
   2012 	 * the exponential backoff option.  Note that these values are
   2013 	 * relevant for all control protocols, not just LCP only.
   2014 	 */
   2015 	sp->lcp.timeout = 1 * hz;
   2016 	sp->lcp.max_terminate = 2;
   2017 	sp->lcp.max_configure = 10;
   2018 	sp->lcp.max_failure = 10;
   2019 	callout_init(&sp->ch[IDX_LCP]);
   2020 }
   2021 
   2022 static void
   2023 sppp_lcp_up(struct sppp *sp)
   2024 {
   2025 	STDDCL;
   2026 
   2027 	/* Initialize activity timestamp: opening a connection is an activity */
   2028 	sp->pp_last_activity = time.tv_sec;
   2029 
   2030 	/*
   2031 	 * If this interface is passive or dial-on-demand, and we are
   2032 	 * still in Initial state, it means we've got an incoming
   2033 	 * call.  Activate the interface.
   2034 	 */
   2035 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
   2036 		if (debug)
   2037 			log(LOG_DEBUG,
   2038 			    SPP_FMT "Up event", SPP_ARGS(ifp));
   2039 		ifp->if_flags |= IFF_RUNNING;
   2040 		if (sp->state[IDX_LCP] == STATE_INITIAL) {
   2041 			if (debug)
   2042 				addlog("(incoming call)\n");
   2043 			sp->pp_flags |= PP_CALLIN;
   2044 			lcp.Open(sp);
   2045 		} else if (debug)
   2046 			addlog("\n");
   2047 	} else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
   2048 		   (sp->state[IDX_LCP] == STATE_INITIAL)) {
   2049 			ifp->if_flags |= IFF_RUNNING;
   2050 			lcp.Open(sp);
   2051 	}
   2052 
   2053 	sppp_up_event(&lcp, sp);
   2054 }
   2055 
   2056 static void
   2057 sppp_lcp_down(struct sppp *sp)
   2058 {
   2059 	STDDCL;
   2060 
   2061 	sppp_down_event(&lcp, sp);
   2062 
   2063 	/*
   2064 	 * If this is neither a dial-on-demand nor a passive
   2065 	 * interface, simulate an ``ifconfig down'' action, so the
   2066 	 * administrator can force a redial by another ``ifconfig
   2067 	 * up''.  XXX For leased line operation, should we immediately
   2068 	 * try to reopen the connection here?
   2069 	 */
   2070 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
   2071 		if (debug)
   2072 			log(LOG_INFO,
   2073 			    SPP_FMT "Down event (carrier loss), taking interface down.\n",
   2074 			    SPP_ARGS(ifp));
   2075 		if_down(ifp);
   2076 	} else {
   2077 		if (debug)
   2078 			log(LOG_DEBUG,
   2079 			    SPP_FMT "Down event (carrier loss)\n",
   2080 			    SPP_ARGS(ifp));
   2081 	}
   2082 	sp->pp_flags &= ~PP_CALLIN;
   2083 	if (sp->state[IDX_LCP] != STATE_INITIAL)
   2084 		lcp.Close(sp);
   2085 	ifp->if_flags &= ~IFF_RUNNING;
   2086 }
   2087 
   2088 static void
   2089 sppp_lcp_open(struct sppp *sp)
   2090 {
   2091 	/*
   2092 	 * If we are authenticator, negotiate LCP_AUTH
   2093 	 */
   2094 	if (sp->hisauth.proto != 0)
   2095 		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
   2096 	else
   2097 		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2098 	sp->pp_flags &= ~PP_NEEDAUTH;
   2099 	sppp_open_event(&lcp, sp);
   2100 }
   2101 
   2102 static void
   2103 sppp_lcp_close(struct sppp *sp)
   2104 {
   2105 	sppp_close_event(&lcp, sp);
   2106 }
   2107 
   2108 static void
   2109 sppp_lcp_TO(void *cookie)
   2110 {
   2111 	sppp_to_event(&lcp, (struct sppp *)cookie);
   2112 }
   2113 
   2114 /*
   2115  * Analyze a configure request.  Return true if it was agreeable, and
   2116  * caused action sca, false if it has been rejected or nak'ed, and
   2117  * caused action scn.  (The return value is used to make the state
   2118  * transition decision in the state automaton.)
   2119  */
   2120 static int
   2121 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   2122 {
   2123 	STDDCL;
   2124 	u_char *buf, *r, *p;
   2125 	int origlen, rlen;
   2126 	u_int32_t nmagic;
   2127 	u_short authproto;
   2128 
   2129 	len -= 4;
   2130 	origlen = len;
   2131 	buf = r = malloc (len, M_TEMP, M_NOWAIT);
   2132 	if (! buf)
   2133 		return (0);
   2134 
   2135 	if (debug)
   2136 		log(LOG_DEBUG, SPP_FMT "lcp parse opts:",
   2137 		    SPP_ARGS(ifp));
   2138 
   2139 	/* pass 1: check for things that need to be rejected */
   2140 	p = (void*) (h+1);
   2141 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2142 		if (debug)
   2143 			addlog(" %s", sppp_lcp_opt_name(*p));
   2144 		switch (*p) {
   2145 		case LCP_OPT_MAGIC:
   2146 			/* Magic number. */
   2147 			/* fall through, both are same length */
   2148 		case LCP_OPT_ASYNC_MAP:
   2149 			/* Async control character map. */
   2150 			if (len >= 6 || p[1] == 6)
   2151 				continue;
   2152 			if (debug)
   2153 				addlog(" [invalid]");
   2154 			break;
   2155 		case LCP_OPT_MRU:
   2156 			/* Maximum receive unit. */
   2157 			if (len >= 4 && p[1] == 4)
   2158 				continue;
   2159 			if (debug)
   2160 				addlog(" [invalid]");
   2161 			break;
   2162 		case LCP_OPT_AUTH_PROTO:
   2163 			if (len < 4) {
   2164 				if (debug)
   2165 					addlog(" [invalid]");
   2166 				break;
   2167 			}
   2168 			authproto = (p[2] << 8) + p[3];
   2169 			if (authproto == PPP_CHAP && p[1] != 5) {
   2170 				if (debug)
   2171 					addlog(" [invalid chap len]");
   2172 				break;
   2173 			}
   2174 			if (sp->myauth.proto == 0) {
   2175 				/* we are not configured to do auth */
   2176 				if (debug)
   2177 					addlog(" [not configured]");
   2178 				break;
   2179 			}
   2180 			/*
   2181 			 * Remote want us to authenticate, remember this,
   2182 			 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got
   2183 			 * up.
   2184 			 */
   2185 			sp->pp_flags |= PP_NEEDAUTH;
   2186 			continue;
   2187 		default:
   2188 			/* Others not supported. */
   2189 			if (debug)
   2190 				addlog(" [rej]");
   2191 			break;
   2192 		}
   2193 		/* Add the option to rejected list. */
   2194 		bcopy (p, r, p[1]);
   2195 		r += p[1];
   2196 		rlen += p[1];
   2197 	}
   2198 	if (rlen) {
   2199 		if (debug)
   2200 			addlog(" send conf-rej\n");
   2201 		sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2202 		goto end;
   2203 	} else if (debug)
   2204 		addlog("\n");
   2205 
   2206 	/*
   2207 	 * pass 2: check for option values that are unacceptable and
   2208 	 * thus require to be nak'ed.
   2209 	 */
   2210 	if (debug)
   2211 		log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
   2212 		    SPP_ARGS(ifp));
   2213 
   2214 	p = (void*) (h+1);
   2215 	len = origlen;
   2216 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2217 		if (debug)
   2218 			addlog(" %s", sppp_lcp_opt_name(*p));
   2219 		switch (*p) {
   2220 		case LCP_OPT_MAGIC:
   2221 			/* Magic number -- extract. */
   2222 			nmagic = (u_int32_t)p[2] << 24 |
   2223 				(u_int32_t)p[3] << 16 | p[4] << 8 | p[5];
   2224 			if (nmagic != sp->lcp.magic) {
   2225 				if (debug)
   2226 					addlog(" 0x%x", nmagic);
   2227 				continue;
   2228 			}
   2229 			/*
   2230 			 * Local and remote magics equal -- loopback?
   2231 			 */
   2232 			if (sp->pp_loopcnt >= MAXALIVECNT*5) {
   2233 				printf (SPP_FMT "loopback\n",
   2234 					SPP_ARGS(ifp));
   2235 				sp->pp_loopcnt = 0;
   2236 				if (ifp->if_flags & IFF_UP) {
   2237 					if_down(ifp);
   2238 					IF_PURGE(&sp->pp_cpq);
   2239 					/* XXX ? */
   2240 					lcp.Down(sp);
   2241 					lcp.Up(sp);
   2242 				}
   2243 			} else if (debug)
   2244 				addlog(" [glitch]");
   2245 			++sp->pp_loopcnt;
   2246 			/*
   2247 			 * We negate our magic here, and NAK it.  If
   2248 			 * we see it later in an NAK packet, we
   2249 			 * suggest a new one.
   2250 			 */
   2251 			nmagic = ~sp->lcp.magic;
   2252 			/* Gonna NAK it. */
   2253 			p[2] = nmagic >> 24;
   2254 			p[3] = nmagic >> 16;
   2255 			p[4] = nmagic >> 8;
   2256 			p[5] = nmagic;
   2257 			break;
   2258 
   2259 		case LCP_OPT_ASYNC_MAP:
   2260 			/* Async control character map -- check to be zero. */
   2261 			if (! p[2] && ! p[3] && ! p[4] && ! p[5]) {
   2262 				if (debug)
   2263 					addlog(" [empty]");
   2264 				continue;
   2265 			}
   2266 			if (debug)
   2267 				addlog(" [non-empty]");
   2268 			/* suggest a zero one */
   2269 			p[2] = p[3] = p[4] = p[5] = 0;
   2270 			break;
   2271 
   2272 		case LCP_OPT_MRU:
   2273 			/*
   2274 			 * Maximum receive unit.  Always agreeable,
   2275 			 * but ignored by now.
   2276 			 */
   2277 			sp->lcp.their_mru = p[2] * 256 + p[3];
   2278 			if (debug)
   2279 				addlog(" %ld", sp->lcp.their_mru);
   2280 			continue;
   2281 
   2282 		case LCP_OPT_AUTH_PROTO:
   2283 			authproto = (p[2] << 8) + p[3];
   2284 			if (sp->myauth.proto != authproto) {
   2285 				/* not agreed, nak */
   2286 				if (debug)
   2287 					addlog(" [mine %s != his %s]",
   2288 					       sppp_proto_name(sp->hisauth.proto),
   2289 					       sppp_proto_name(authproto));
   2290 				p[2] = sp->myauth.proto >> 8;
   2291 				p[3] = sp->myauth.proto;
   2292 				break;
   2293 			}
   2294 			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
   2295 				if (debug)
   2296 					addlog(" [chap not MD5]");
   2297 				p[4] = CHAP_MD5;
   2298 				break;
   2299 			}
   2300 			continue;
   2301 		}
   2302 		/* Add the option to nak'ed list. */
   2303 		bcopy (p, r, p[1]);
   2304 		r += p[1];
   2305 		rlen += p[1];
   2306 	}
   2307 	if (rlen) {
   2308 		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
   2309 			if (debug)
   2310 				addlog(" max_failure (%d) exceeded, "
   2311 				       "send conf-rej\n",
   2312 				       sp->lcp.max_failure);
   2313 			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
   2314 		} else {
   2315 			if (debug)
   2316 				addlog(" send conf-nak\n");
   2317 			sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
   2318 		}
   2319 		goto end;
   2320 	} else {
   2321 		if (debug)
   2322 			addlog(" send conf-ack\n");
   2323 		sp->fail_counter[IDX_LCP] = 0;
   2324 		sp->pp_loopcnt = 0;
   2325 		sppp_cp_send (sp, PPP_LCP, CONF_ACK,
   2326 			      h->ident, origlen, h+1);
   2327 	}
   2328 
   2329  end:
   2330 	free (buf, M_TEMP);
   2331 	return (rlen == 0);
   2332 }
   2333 
   2334 /*
   2335  * Analyze the LCP Configure-Reject option list, and adjust our
   2336  * negotiation.
   2337  */
   2338 static void
   2339 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   2340 {
   2341 	STDDCL;
   2342 	u_char *buf, *p;
   2343 
   2344 	len -= 4;
   2345 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2346 	if (!buf)
   2347 		return;
   2348 
   2349 	if (debug)
   2350 		log(LOG_DEBUG, SPP_FMT "lcp rej opts:",
   2351 		    SPP_ARGS(ifp));
   2352 
   2353 	p = (void*) (h+1);
   2354 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   2355 		if (debug)
   2356 			addlog(" %s", sppp_lcp_opt_name(*p));
   2357 		switch (*p) {
   2358 		case LCP_OPT_MAGIC:
   2359 			/* Magic number -- can't use it, use 0 */
   2360 			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
   2361 			sp->lcp.magic = 0;
   2362 			break;
   2363 		case LCP_OPT_MRU:
   2364 			/*
   2365 			 * Should not be rejected anyway, since we only
   2366 			 * negotiate a MRU if explicitly requested by
   2367 			 * peer.
   2368 			 */
   2369 			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
   2370 			break;
   2371 		case LCP_OPT_AUTH_PROTO:
   2372 			/*
   2373 			 * Peer doesn't want to authenticate himself,
   2374 			 * deny unless this is a dialout call, and
   2375 			 * SPPP_AUTHFLAG_NOCALLOUT is set.
   2376 			 */
   2377 			if ((sp->pp_flags & PP_CALLIN) == 0 &&
   2378 			    (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) {
   2379 				if (debug)
   2380 					addlog(" [don't insist on auth "
   2381 					       "for callout]");
   2382 				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
   2383 				break;
   2384 			}
   2385 			if (debug)
   2386 				addlog("[access denied]\n");
   2387 			lcp.Close(sp);
   2388 			break;
   2389 		}
   2390 	}
   2391 	if (debug)
   2392 		addlog("\n");
   2393 	free (buf, M_TEMP);
   2394 	return;
   2395 }
   2396 
   2397 /*
   2398  * Analyze the LCP Configure-NAK option list, and adjust our
   2399  * negotiation.
   2400  */
   2401 static void
   2402 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   2403 {
   2404 	STDDCL;
   2405 	u_char *buf, *p;
   2406 	u_int32_t magic;
   2407 
   2408 	len -= 4;
   2409 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2410 	if (!buf)
   2411 		return;
   2412 
   2413 	if (debug)
   2414 		log(LOG_DEBUG, SPP_FMT "lcp nak opts:",
   2415 		    SPP_ARGS(ifp));
   2416 
   2417 	p = (void*) (h+1);
   2418 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   2419 		if (debug)
   2420 			addlog(" %s", sppp_lcp_opt_name(*p));
   2421 		switch (*p) {
   2422 		case LCP_OPT_MAGIC:
   2423 			/* Magic number -- renegotiate */
   2424 			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
   2425 			    len >= 6 && p[1] == 6) {
   2426 				magic = (u_int32_t)p[2] << 24 |
   2427 					(u_int32_t)p[3] << 16 | p[4] << 8 | p[5];
   2428 				/*
   2429 				 * If the remote magic is our negated one,
   2430 				 * this looks like a loopback problem.
   2431 				 * Suggest a new magic to make sure.
   2432 				 */
   2433 				if (magic == ~sp->lcp.magic) {
   2434 					if (debug)
   2435 						addlog(" magic glitch");
   2436 					sp->lcp.magic = random();
   2437 				} else {
   2438 					sp->lcp.magic = magic;
   2439 					if (debug)
   2440 						addlog(" %d", magic);
   2441 				}
   2442 			}
   2443 			break;
   2444 		case LCP_OPT_MRU:
   2445 			/*
   2446 			 * Peer wants to advise us to negotiate an MRU.
   2447 			 * Agree on it if it's reasonable, or use
   2448 			 * default otherwise.
   2449 			 */
   2450 			if (len >= 4 && p[1] == 4) {
   2451 				u_int mru = p[2] * 256 + p[3];
   2452 				if (debug)
   2453 					addlog(" %d", mru);
   2454 				if (mru < PP_MTU || mru > PP_MAX_MRU)
   2455 					mru = PP_MTU;
   2456 				sp->lcp.mru = mru;
   2457 				sp->lcp.opts |= (1 << LCP_OPT_MRU);
   2458 			}
   2459 			break;
   2460 		case LCP_OPT_AUTH_PROTO:
   2461 			/*
   2462 			 * Peer doesn't like our authentication method,
   2463 			 * deny.
   2464 			 */
   2465 			if (debug)
   2466 				addlog("[access denied]\n");
   2467 			lcp.Close(sp);
   2468 			break;
   2469 		}
   2470 	}
   2471 	if (debug)
   2472 		addlog("\n");
   2473 	free (buf, M_TEMP);
   2474 	return;
   2475 }
   2476 
   2477 static void
   2478 sppp_lcp_tlu(struct sppp *sp)
   2479 {
   2480 	STDDCL;
   2481 	int i;
   2482 	u_int32_t mask;
   2483 
   2484 	/* XXX ? */
   2485 	if (! (ifp->if_flags & IFF_UP) &&
   2486 	    (ifp->if_flags & IFF_RUNNING)) {
   2487 		/* Coming out of loopback mode. */
   2488 		if_up(ifp);
   2489 	}
   2490 
   2491 	for (i = 0; i < IDX_COUNT; i++)
   2492 		if ((cps[i])->flags & CP_QUAL)
   2493 			(cps[i])->Open(sp);
   2494 
   2495 	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
   2496 	    (sp->pp_flags & PP_NEEDAUTH) != 0)
   2497 		sp->pp_phase = SPPP_PHASE_AUTHENTICATE;
   2498 	else
   2499 		sp->pp_phase = SPPP_PHASE_NETWORK;
   2500 
   2501 	if(debug)
   2502 	{
   2503 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
   2504 		    sppp_phase_name(sp->pp_phase));
   2505 	}
   2506 
   2507 	/*
   2508 	 * Open all authentication protocols.  This is even required
   2509 	 * if we already proceeded to network phase, since it might be
   2510 	 * that remote wants us to authenticate, so we might have to
   2511 	 * send a PAP request.  Undesired authentication protocols
   2512 	 * don't do anything when they get an Open event.
   2513 	 */
   2514 	for (i = 0; i < IDX_COUNT; i++)
   2515 		if ((cps[i])->flags & CP_AUTH)
   2516 			(cps[i])->Open(sp);
   2517 
   2518 	if (sp->pp_phase == SPPP_PHASE_NETWORK) {
   2519 		/* Notify all NCPs. */
   2520 		for (i = 0; i < IDX_COUNT; i++)
   2521 			if ((cps[i])->flags & CP_NCP)
   2522 				(cps[i])->Open(sp);
   2523 	}
   2524 
   2525 	/* Send Up events to all started protos. */
   2526 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2527 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0)
   2528 			(cps[i])->Up(sp);
   2529 
   2530 	/* notify low-level driver of state change */
   2531 	if (sp->pp_chg)
   2532 		sp->pp_chg(sp, (int)sp->pp_phase);
   2533 
   2534 	if (sp->pp_phase == SPPP_PHASE_NETWORK)
   2535 		/* if no NCP is starting, close down */
   2536 		sppp_lcp_check_and_close(sp);
   2537 }
   2538 
   2539 static void
   2540 sppp_lcp_tld(struct sppp *sp)
   2541 {
   2542 	STDDCL;
   2543 	int i;
   2544 	u_int32_t mask;
   2545 
   2546 	sp->pp_phase = SPPP_PHASE_TERMINATE;
   2547 
   2548 	if(debug)
   2549 	{
   2550 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
   2551 			sppp_phase_name(sp->pp_phase));
   2552 	}
   2553 
   2554 	/*
   2555 	 * Take upper layers down.  We send the Down event first and
   2556 	 * the Close second to prevent the upper layers from sending
   2557 	 * ``a flurry of terminate-request packets'', as the RFC
   2558 	 * describes it.
   2559 	 */
   2560 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2561 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
   2562 			(cps[i])->Down(sp);
   2563 			(cps[i])->Close(sp);
   2564 		}
   2565 }
   2566 
   2567 static void
   2568 sppp_lcp_tls(struct sppp *sp)
   2569 {
   2570 	STDDCL;
   2571 
   2572 	if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) {
   2573 	    printf("%s: authentication failed %d times, not retrying again\n",
   2574 		sp->pp_if.if_xname, sp->pp_auth_failures);
   2575 	    if_down(&sp->pp_if);
   2576 	    return;
   2577 	}
   2578 
   2579 	sp->pp_phase = SPPP_PHASE_ESTABLISH;
   2580 
   2581 	if(debug)
   2582 	{
   2583 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
   2584 			sppp_phase_name(sp->pp_phase));
   2585 	}
   2586 
   2587 	/* Notify lower layer if desired. */
   2588 	if (sp->pp_tls)
   2589 		(sp->pp_tls)(sp);
   2590 }
   2591 
   2592 static void
   2593 sppp_lcp_tlf(struct sppp *sp)
   2594 {
   2595 	STDDCL;
   2596 
   2597 	sp->pp_phase = SPPP_PHASE_DEAD;
   2598 
   2599 	if(debug)
   2600 	{
   2601 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
   2602 			sppp_phase_name(sp->pp_phase));
   2603 	}
   2604 
   2605 	/* Notify lower layer if desired. */
   2606 	if (sp->pp_tlf)
   2607 		(sp->pp_tlf)(sp);
   2608 }
   2609 
   2610 static void
   2611 sppp_lcp_scr(struct sppp *sp)
   2612 {
   2613 	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
   2614 	int i = 0;
   2615 	u_short authproto;
   2616 
   2617 	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
   2618 		if (! sp->lcp.magic)
   2619 			sp->lcp.magic = random();
   2620 		opt[i++] = LCP_OPT_MAGIC;
   2621 		opt[i++] = 6;
   2622 		opt[i++] = sp->lcp.magic >> 24;
   2623 		opt[i++] = sp->lcp.magic >> 16;
   2624 		opt[i++] = sp->lcp.magic >> 8;
   2625 		opt[i++] = sp->lcp.magic;
   2626 	}
   2627 
   2628 	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
   2629 		opt[i++] = LCP_OPT_MRU;
   2630 		opt[i++] = 4;
   2631 		opt[i++] = sp->lcp.mru >> 8;
   2632 		opt[i++] = sp->lcp.mru;
   2633 	}
   2634 
   2635 	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
   2636 		authproto = sp->hisauth.proto;
   2637 		opt[i++] = LCP_OPT_AUTH_PROTO;
   2638 		opt[i++] = authproto == PPP_CHAP? 5: 4;
   2639 		opt[i++] = authproto >> 8;
   2640 		opt[i++] = authproto;
   2641 		if (authproto == PPP_CHAP)
   2642 			opt[i++] = CHAP_MD5;
   2643 	}
   2644 
   2645 	sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
   2646 	sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
   2647 }
   2648 
   2649 /*
   2650  * Check the open NCPs, return true if at least one NCP is open.
   2651  */
   2652 static int
   2653 sppp_ncp_check(struct sppp *sp)
   2654 {
   2655 	int i, mask;
   2656 
   2657 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   2658 		if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
   2659 			return 1;
   2660 	return 0;
   2661 }
   2662 
   2663 /*
   2664  * Re-check the open NCPs and see if we should terminate the link.
   2665  * Called by the NCPs during their tlf action handling.
   2666  */
   2667 static void
   2668 sppp_lcp_check_and_close(struct sppp *sp)
   2669 {
   2670 
   2671 	if (sp->pp_phase < SPPP_PHASE_NETWORK)
   2672 		/* don't bother, we are already going down */
   2673 		return;
   2674 
   2675 	if (sppp_ncp_check(sp))
   2676 		return;
   2677 
   2678 	lcp.Close(sp);
   2679 }
   2680 
   2681 
   2682 /*
   2683  *--------------------------------------------------------------------------*
   2684  *                                                                          *
   2685  *                        The IPCP implementation.                          *
   2686  *                                                                          *
   2687  *--------------------------------------------------------------------------*
   2688  */
   2689 
   2690 static void
   2691 sppp_ipcp_init(struct sppp *sp)
   2692 {
   2693 	sp->ipcp.opts = 0;
   2694 	sp->ipcp.flags = 0;
   2695 	sp->state[IDX_IPCP] = STATE_INITIAL;
   2696 	sp->fail_counter[IDX_IPCP] = 0;
   2697 	sp->pp_seq[IDX_IPCP] = 0;
   2698 	sp->pp_rseq[IDX_IPCP] = 0;
   2699 	callout_init(&sp->ch[IDX_IPCP]);
   2700 }
   2701 
   2702 static void
   2703 sppp_ipcp_up(struct sppp *sp)
   2704 {
   2705 	sppp_up_event(&ipcp, sp);
   2706 }
   2707 
   2708 static void
   2709 sppp_ipcp_down(struct sppp *sp)
   2710 {
   2711 	sppp_down_event(&ipcp, sp);
   2712 }
   2713 
   2714 static void
   2715 sppp_ipcp_open(struct sppp *sp)
   2716 {
   2717 	STDDCL;
   2718 	u_int32_t myaddr, hisaddr;
   2719 
   2720 	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
   2721 	sp->ipcp.req_myaddr = 0;
   2722 	sp->ipcp.req_hisaddr = 0;
   2723 	memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
   2724 
   2725 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
   2726 	/*
   2727 	 * If we don't have his address, this probably means our
   2728 	 * interface doesn't want to talk IP at all.  (This could
   2729 	 * be the case if somebody wants to speak only IPX, for
   2730 	 * example.)  Don't open IPCP in this case.
   2731 	 */
   2732 	if (hisaddr == 0L) {
   2733 		/* XXX this message should go away */
   2734 		if (debug)
   2735 			log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
   2736 			    SPP_ARGS(ifp));
   2737 		return;
   2738 	}
   2739 
   2740 	if (myaddr == 0) {
   2741 		/*
   2742 		 * I don't have an assigned address, so i need to
   2743 		 * negotiate my address.
   2744 		 */
   2745 		sp->ipcp.flags |= IPCP_MYADDR_DYN;
   2746 		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   2747 	}
   2748 	if (hisaddr == 1) {
   2749 		/*
   2750 		 * XXX - remove this hack!
   2751 		 * remote has no valid adress, we need to get one assigned.
   2752 		 */
   2753 		sp->ipcp.flags |= IPCP_HISADDR_DYN;
   2754 	}
   2755 	sppp_open_event(&ipcp, sp);
   2756 }
   2757 
   2758 static void
   2759 sppp_ipcp_close(struct sppp *sp)
   2760 {
   2761 	sppp_close_event(&ipcp, sp);
   2762 	if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
   2763 		/*
   2764 		 * Some address was dynamic, clear it again.
   2765 		 */
   2766 		sppp_clear_ip_addrs(sp);
   2767 }
   2768 
   2769 static void
   2770 sppp_ipcp_TO(void *cookie)
   2771 {
   2772 	sppp_to_event(&ipcp, (struct sppp *)cookie);
   2773 }
   2774 
   2775 /*
   2776  * Analyze a configure request.  Return true if it was agreeable, and
   2777  * caused action sca, false if it has been rejected or nak'ed, and
   2778  * caused action scn.  (The return value is used to make the state
   2779  * transition decision in the state automaton.)
   2780  */
   2781 static int
   2782 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   2783 {
   2784 	u_char *buf, *r, *p;
   2785 	struct ifnet *ifp = &sp->pp_if;
   2786 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   2787 	u_int32_t hisaddr, desiredaddr;
   2788 
   2789 	len -= 4;
   2790 	origlen = len;
   2791 	/*
   2792 	 * Make sure to allocate a buf that can at least hold a
   2793 	 * conf-nak with an `address' option.  We might need it below.
   2794 	 */
   2795 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
   2796 	if (! buf)
   2797 		return (0);
   2798 
   2799 	/* pass 1: see if we can recognize them */
   2800 	if (debug)
   2801 		log(LOG_DEBUG, SPP_FMT "ipcp parse opts:",
   2802 		    SPP_ARGS(ifp));
   2803 	p = (void*) (h+1);
   2804 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2805 		if (debug)
   2806 			addlog(" %s", sppp_ipcp_opt_name(*p));
   2807 		switch (*p) {
   2808 #ifdef notyet
   2809 		case IPCP_OPT_COMPRESSION:
   2810 			if (len >= 6 && p[1] >= 6) {
   2811 				/* correctly formed compress option */
   2812 				continue;
   2813 			}
   2814 			if (debug)
   2815 				addlog(" [invalid]");
   2816 			break;
   2817 #endif
   2818 		case IPCP_OPT_ADDRESS:
   2819 			if (len >= 6 && p[1] == 6) {
   2820 				/* correctly formed address option */
   2821 				continue;
   2822 			}
   2823 			if (debug)
   2824 				addlog(" [invalid]");
   2825 			break;
   2826 		default:
   2827 			/* Others not supported. */
   2828 			if (debug)
   2829 				addlog(" [rej]");
   2830 			break;
   2831 		}
   2832 		/* Add the option to rejected list. */
   2833 		bcopy (p, r, p[1]);
   2834 		r += p[1];
   2835 		rlen += p[1];
   2836 	}
   2837 	if (rlen) {
   2838 		if (debug)
   2839 			addlog(" send conf-rej\n");
   2840 		sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
   2841 		goto end;
   2842 	} else if (debug)
   2843 		addlog("\n");
   2844 
   2845 	/* pass 2: parse option values */
   2846 	if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
   2847 		hisaddr = sp->ipcp.req_hisaddr;	/* we already aggreed on that */
   2848 	else
   2849 		sppp_get_ip_addrs(sp, 0, &hisaddr, 0);	/* user configuration */
   2850 	if (debug)
   2851 		log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
   2852 		       SPP_ARGS(ifp));
   2853 	p = (void*) (h+1);
   2854 	len = origlen;
   2855 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   2856 		if (debug)
   2857 			addlog(" %s", sppp_ipcp_opt_name(*p));
   2858 		switch (*p) {
   2859 #ifdef notyet
   2860 		case IPCP_OPT_COMPRESSION:
   2861 			continue;
   2862 #endif
   2863 		case IPCP_OPT_ADDRESS:
   2864 			desiredaddr = p[2] << 24 | p[3] << 16 |
   2865 				p[4] << 8 | p[5];
   2866 			if (desiredaddr == hisaddr ||
   2867 		    	   ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) {
   2868 				/*
   2869 			 	* Peer's address is same as our value,
   2870 			 	* this is agreeable.  Gonna conf-ack
   2871 			 	* it.
   2872 			 	*/
   2873 				if (debug)
   2874 					addlog(" %s [ack]",
   2875 				       		sppp_dotted_quad(hisaddr));
   2876 				/* record that we've seen it already */
   2877 				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
   2878 				sp->ipcp.req_hisaddr = desiredaddr;
   2879 				hisaddr = desiredaddr;
   2880 				continue;
   2881 			}
   2882 			/*
   2883 		 	* The address wasn't agreeable.  This is either
   2884 		 	* he sent us 0.0.0.0, asking to assign him an
   2885 		 	* address, or he send us another address not
   2886 		 	* matching our value.  Either case, we gonna
   2887 		 	* conf-nak it with our value.
   2888 		 	*/
   2889 			if (debug) {
   2890 				if (desiredaddr == 0)
   2891 					addlog(" [addr requested]");
   2892 				else
   2893 					addlog(" %s [not agreed]",
   2894 				       		sppp_dotted_quad(desiredaddr));
   2895 			}
   2896 
   2897 			p[2] = hisaddr >> 24;
   2898 			p[3] = hisaddr >> 16;
   2899 			p[4] = hisaddr >> 8;
   2900 			p[5] = hisaddr;
   2901 			break;
   2902 		}
   2903 		/* Add the option to nak'ed list. */
   2904 		bcopy (p, r, p[1]);
   2905 		r += p[1];
   2906 		rlen += p[1];
   2907 	}
   2908 
   2909 	/*
   2910 	 * If we are about to conf-ack the request, but haven't seen
   2911 	 * his address so far, gonna conf-nak it instead, with the
   2912 	 * `address' option present and our idea of his address being
   2913 	 * filled in there, to request negotiation of both addresses.
   2914 	 *
   2915 	 * XXX This can result in an endless req - nak loop if peer
   2916 	 * doesn't want to send us his address.  Q: What should we do
   2917 	 * about it?  XXX  A: implement the max-failure counter.
   2918 	 */
   2919 	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
   2920 		buf[0] = IPCP_OPT_ADDRESS;
   2921 		buf[1] = 6;
   2922 		buf[2] = hisaddr >> 24;
   2923 		buf[3] = hisaddr >> 16;
   2924 		buf[4] = hisaddr >> 8;
   2925 		buf[5] = hisaddr;
   2926 		rlen = 6;
   2927 		if (debug)
   2928 			addlog(" still need hisaddr");
   2929 	}
   2930 
   2931 	if (rlen) {
   2932 		if (debug)
   2933 			addlog(" send conf-nak\n");
   2934 		sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
   2935 	} else {
   2936 		if (debug)
   2937 			addlog(" send conf-ack\n");
   2938 		sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
   2939 			      h->ident, origlen, h+1);
   2940 	}
   2941 
   2942  end:
   2943 	free (buf, M_TEMP);
   2944 	return (rlen == 0);
   2945 }
   2946 
   2947 /*
   2948  * Analyze the IPCP Configure-Reject option list, and adjust our
   2949  * negotiation.
   2950  */
   2951 static void
   2952 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   2953 {
   2954 	u_char *buf, *p;
   2955 	struct ifnet *ifp = &sp->pp_if;
   2956 	int debug = ifp->if_flags & IFF_DEBUG;
   2957 
   2958 	len -= 4;
   2959 	buf = malloc (len, M_TEMP, M_NOWAIT);
   2960 	if (!buf)
   2961 		return;
   2962 
   2963 	if (debug)
   2964 		log(LOG_DEBUG, SPP_FMT "ipcp rej opts:",
   2965 		    SPP_ARGS(ifp));
   2966 
   2967 	p = (void*) (h+1);
   2968 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   2969 		if (debug)
   2970 			addlog(" %s", sppp_ipcp_opt_name(*p));
   2971 		switch (*p) {
   2972 		case IPCP_OPT_ADDRESS:
   2973 			/*
   2974 			 * Peer doesn't grok address option.  This is
   2975 			 * bad.  XXX  Should we better give up here?
   2976 			 */
   2977 			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
   2978 			break;
   2979 #ifdef notyet
   2980 		case IPCP_OPT_COMPRESS:
   2981 			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
   2982 			break;
   2983 #endif
   2984 		}
   2985 	}
   2986 	if (debug)
   2987 		addlog("\n");
   2988 	free (buf, M_TEMP);
   2989 	return;
   2990 }
   2991 
   2992 /*
   2993  * Analyze the IPCP Configure-NAK option list, and adjust our
   2994  * negotiation.
   2995  */
   2996 static void
   2997 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   2998 {
   2999 	u_char *p;
   3000 	struct ifnet *ifp = &sp->pp_if;
   3001 	int debug = ifp->if_flags & IFF_DEBUG;
   3002 	u_int32_t wantaddr;
   3003 
   3004 	len -= 4;
   3005 
   3006 	if (debug)
   3007 		log(LOG_DEBUG, SPP_FMT "ipcp nak opts:",
   3008 		    SPP_ARGS(ifp));
   3009 
   3010 	p = (void*) (h+1);
   3011 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3012 		if (debug)
   3013 			addlog(" %s", sppp_ipcp_opt_name(*p));
   3014 		switch (*p) {
   3015 		case IPCP_OPT_ADDRESS:
   3016 			/*
   3017 			 * Peer doesn't like our local IP address.  See
   3018 			 * if we can do something for him.  We'll drop
   3019 			 * him our address then.
   3020 			 */
   3021 			if (len >= 6 && p[1] == 6) {
   3022 				wantaddr = p[2] << 24 | p[3] << 16 |
   3023 					p[4] << 8 | p[5];
   3024 				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
   3025 				if (debug)
   3026 					addlog(" [wantaddr %s]",
   3027 					       sppp_dotted_quad(wantaddr));
   3028 				/*
   3029 				 * When doing dynamic address assignment,
   3030 				 * we accept his offer.  Otherwise, we
   3031 				 * ignore it and thus continue to negotiate
   3032 				 * our already existing value.
   3033 				 */
   3034 				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
   3035 					if (debug)
   3036 						addlog(" [agree]");
   3037 					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
   3038 					sp->ipcp.req_myaddr = wantaddr;
   3039 				}
   3040 			}
   3041 			break;
   3042 
   3043 		case IPCP_OPT_PRIMDNS:
   3044 			if (len >= 6 && p[1] == 6) {
   3045 				sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 |
   3046 					p[4] << 8 | p[5];
   3047 			}
   3048 			break;
   3049 
   3050 		case IPCP_OPT_SECDNS:
   3051 			if (len >= 6 && p[1] == 6) {
   3052 				sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 |
   3053 					p[4] << 8 | p[5];
   3054 			}
   3055 			break;
   3056 #ifdef notyet
   3057 		case IPCP_OPT_COMPRESS:
   3058 			/*
   3059 			 * Peer wants different compression parameters.
   3060 			 */
   3061 			break;
   3062 #endif
   3063 		}
   3064 	}
   3065 	if (debug)
   3066 		addlog("\n");
   3067 	return;
   3068 }
   3069 
   3070 static void
   3071 sppp_ipcp_tlu(struct sppp *sp)
   3072 {
   3073 	/* we are up. Set addresses and notify anyone interested */
   3074 	u_int32_t myaddr, hisaddr;
   3075 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
   3076 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN))
   3077 		myaddr = sp->ipcp.req_myaddr;
   3078 	if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN))
   3079 		hisaddr = sp->ipcp.req_hisaddr;
   3080 	sppp_set_ip_addrs(sp, myaddr, hisaddr);
   3081 	if (sp->pp_con)
   3082 		sp->pp_con(sp);
   3083 }
   3084 
   3085 static void
   3086 sppp_ipcp_tld(struct sppp *sp)
   3087 {
   3088 }
   3089 
   3090 static void
   3091 sppp_ipcp_tls(struct sppp *sp)
   3092 {
   3093 	/* indicate to LCP that it must stay alive */
   3094 	sp->lcp.protos |= (1 << IDX_IPCP);
   3095 }
   3096 
   3097 static void
   3098 sppp_ipcp_tlf(struct sppp *sp)
   3099 {
   3100 	/* we no longer need LCP */
   3101 	sp->lcp.protos &= ~(1 << IDX_IPCP);
   3102 }
   3103 
   3104 static void
   3105 sppp_ipcp_scr(struct sppp *sp)
   3106 {
   3107 	char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */];
   3108 	u_int32_t ouraddr;
   3109 	int i = 0;
   3110 
   3111 #ifdef notyet
   3112 	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
   3113 		opt[i++] = IPCP_OPT_COMPRESSION;
   3114 		opt[i++] = 6;
   3115 		opt[i++] = 0;	/* VJ header compression */
   3116 		opt[i++] = 0x2d; /* VJ header compression */
   3117 		opt[i++] = max_slot_id;
   3118 		opt[i++] = comp_slot_id;
   3119 	}
   3120 #endif
   3121 
   3122 	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
   3123 		if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
   3124 			ouraddr = sp->ipcp.req_myaddr;	/* not sure if this can ever happen */
   3125 		else
   3126 			sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
   3127 		opt[i++] = IPCP_OPT_ADDRESS;
   3128 		opt[i++] = 6;
   3129 		opt[i++] = ouraddr >> 24;
   3130 		opt[i++] = ouraddr >> 16;
   3131 		opt[i++] = ouraddr >> 8;
   3132 		opt[i++] = ouraddr;
   3133 	}
   3134 
   3135 	if (sp->query_dns & 1) {
   3136 		opt[i++] = IPCP_OPT_PRIMDNS;
   3137 		opt[i++] = 6;
   3138 		opt[i++] = sp->dns_addrs[0] >> 24;
   3139 		opt[i++] = sp->dns_addrs[0] >> 16;
   3140 		opt[i++] = sp->dns_addrs[0] >> 8;
   3141 		opt[i++] = sp->dns_addrs[0];
   3142 	}
   3143 	if (sp->query_dns & 2) {
   3144 		opt[i++] = IPCP_OPT_SECDNS;
   3145 		opt[i++] = 6;
   3146 		opt[i++] = sp->dns_addrs[1] >> 24;
   3147 		opt[i++] = sp->dns_addrs[1] >> 16;
   3148 		opt[i++] = sp->dns_addrs[1] >> 8;
   3149 		opt[i++] = sp->dns_addrs[1];
   3150 	}
   3151 
   3152 	sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
   3153 	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
   3154 }
   3155 
   3156 
   3157 /*
   3158  *--------------------------------------------------------------------------*
   3159  *                                                                          *
   3160  *                      The IPv6CP implementation.                          *
   3161  *                                                                          *
   3162  *--------------------------------------------------------------------------*
   3163  */
   3164 
   3165 #ifdef INET6
   3166 static void
   3167 sppp_ipv6cp_init(struct sppp *sp)
   3168 {
   3169 	sp->ipv6cp.opts = 0;
   3170 	sp->ipv6cp.flags = 0;
   3171 	sp->state[IDX_IPV6CP] = STATE_INITIAL;
   3172 	sp->fail_counter[IDX_IPV6CP] = 0;
   3173 	sp->pp_seq[IDX_IPV6CP] = 0;
   3174 	sp->pp_rseq[IDX_IPV6CP] = 0;
   3175 	callout_init(&sp->ch[IDX_IPV6CP]);
   3176 }
   3177 
   3178 static void
   3179 sppp_ipv6cp_up(struct sppp *sp)
   3180 {
   3181 	sppp_up_event(&ipv6cp, sp);
   3182 }
   3183 
   3184 static void
   3185 sppp_ipv6cp_down(struct sppp *sp)
   3186 {
   3187 	sppp_down_event(&ipv6cp, sp);
   3188 }
   3189 
   3190 static void
   3191 sppp_ipv6cp_open(struct sppp *sp)
   3192 {
   3193 	STDDCL;
   3194 	struct in6_addr myaddr, hisaddr;
   3195 
   3196 #ifdef IPV6CP_MYIFID_DYN
   3197 	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
   3198 #else
   3199 	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
   3200 #endif
   3201 
   3202 	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
   3203 	/*
   3204 	 * If we don't have our address, this probably means our
   3205 	 * interface doesn't want to talk IPv6 at all.  (This could
   3206 	 * be the case if somebody wants to speak only IPX, for
   3207 	 * example.)  Don't open IPv6CP in this case.
   3208 	 */
   3209 	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
   3210 		/* XXX this message should go away */
   3211 		if (debug)
   3212 			log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n",
   3213 			    SPP_ARGS(ifp));
   3214 		return;
   3215 	}
   3216 
   3217 	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3218 	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3219 	sppp_open_event(&ipv6cp, sp);
   3220 }
   3221 
   3222 static void
   3223 sppp_ipv6cp_close(struct sppp *sp)
   3224 {
   3225 	sppp_close_event(&ipv6cp, sp);
   3226 }
   3227 
   3228 static void
   3229 sppp_ipv6cp_TO(void *cookie)
   3230 {
   3231 	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
   3232 }
   3233 
   3234 /*
   3235  * Analyze a configure request.  Return true if it was agreeable, and
   3236  * caused action sca, false if it has been rejected or nak'ed, and
   3237  * caused action scn.  (The return value is used to make the state
   3238  * transition decision in the state automaton.)
   3239  */
   3240 static int
   3241 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   3242 {
   3243 	u_char *buf, *r, *p;
   3244 	struct ifnet *ifp = &sp->pp_if;
   3245 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
   3246 	struct in6_addr myaddr, desiredaddr, suggestaddr;
   3247 	int ifidcount;
   3248 	int type;
   3249 	int collision, nohisaddr;
   3250 
   3251 	len -= 4;
   3252 	origlen = len;
   3253 	/*
   3254 	 * Make sure to allocate a buf that can at least hold a
   3255 	 * conf-nak with an `address' option.  We might need it below.
   3256 	 */
   3257 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
   3258 	if (! buf)
   3259 		return (0);
   3260 
   3261 	/* pass 1: see if we can recognize them */
   3262 	if (debug)
   3263 		log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:",
   3264 		    SPP_ARGS(ifp));
   3265 	p = (void*) (h+1);
   3266 	ifidcount = 0;
   3267 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   3268 		if (debug)
   3269 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3270 		switch (*p) {
   3271 		case IPV6CP_OPT_IFID:
   3272 			if (len >= 10 && p[1] == 10 && ifidcount == 0) {
   3273 				/* correctly formed address option */
   3274 				ifidcount++;
   3275 				continue;
   3276 			}
   3277 			if (debug)
   3278 				addlog(" [invalid]");
   3279 			break;
   3280 #ifdef notyet
   3281 		case IPV6CP_OPT_COMPRESSION:
   3282 			if (len >= 4 && p[1] >= 4) {
   3283 				/* correctly formed compress option */
   3284 				continue;
   3285 			}
   3286 			if (debug)
   3287 				addlog(" [invalid]");
   3288 			break;
   3289 #endif
   3290 		default:
   3291 			/* Others not supported. */
   3292 			if (debug)
   3293 				addlog(" [rej]");
   3294 			break;
   3295 		}
   3296 		/* Add the option to rejected list. */
   3297 		bcopy (p, r, p[1]);
   3298 		r += p[1];
   3299 		rlen += p[1];
   3300 	}
   3301 	if (rlen) {
   3302 		if (debug)
   3303 			addlog(" send conf-rej\n");
   3304 		sppp_cp_send (sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
   3305 		goto end;
   3306 	} else if (debug)
   3307 		addlog("\n");
   3308 
   3309 	/* pass 2: parse option values */
   3310 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   3311 	if (debug)
   3312 		log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ",
   3313 		       SPP_ARGS(ifp));
   3314 	p = (void*) (h+1);
   3315 	len = origlen;
   3316 	type = CONF_ACK;
   3317 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
   3318 		if (debug)
   3319 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3320 		switch (*p) {
   3321 #ifdef notyet
   3322 		case IPV6CP_OPT_COMPRESSION:
   3323 			continue;
   3324 #endif
   3325 		case IPV6CP_OPT_IFID:
   3326 			memset(&desiredaddr, 0, sizeof(desiredaddr));
   3327 			bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
   3328 			collision = (memcmp(&desiredaddr.s6_addr[8],
   3329 					&myaddr.s6_addr[8], 8) == 0);
   3330 			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
   3331 
   3332 			desiredaddr.s6_addr16[0] = htons(0xfe80);
   3333 			desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
   3334 
   3335 			if (!collision && !nohisaddr) {
   3336 				/* no collision, hisaddr known - Conf-Ack */
   3337 				type = CONF_ACK;
   3338 
   3339 				if (debug) {
   3340 					addlog(" %s [%s]",
   3341 					    ip6_sprintf(&desiredaddr),
   3342 					    sppp_cp_type_name(type));
   3343 				}
   3344 				continue;
   3345 			}
   3346 
   3347 			memset(&suggestaddr, 0, sizeof(&suggestaddr));
   3348 			if (collision && nohisaddr) {
   3349 				/* collision, hisaddr unknown - Conf-Rej */
   3350 				type = CONF_REJ;
   3351 				memset(&p[2], 0, 8);
   3352 			} else {
   3353 				/*
   3354 				 * - no collision, hisaddr unknown, or
   3355 				 * - collision, hisaddr known
   3356 				 * Conf-Nak, suggest hisaddr
   3357 				 */
   3358 				type = CONF_NAK;
   3359 				sppp_suggest_ip6_addr(sp, &suggestaddr);
   3360 				bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
   3361 			}
   3362 			if (debug)
   3363 				addlog(" %s [%s]", ip6_sprintf(&desiredaddr),
   3364 				    sppp_cp_type_name(type));
   3365 			break;
   3366 		}
   3367 		/* Add the option to nak'ed list. */
   3368 		bcopy (p, r, p[1]);
   3369 		r += p[1];
   3370 		rlen += p[1];
   3371 	}
   3372 
   3373 	if (rlen == 0 && type == CONF_ACK) {
   3374 		if (debug)
   3375 			addlog(" send %s\n", sppp_cp_type_name(type));
   3376 		sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, origlen, h+1);
   3377 	} else {
   3378 #ifdef notdef
   3379 		if (type == CONF_ACK)
   3380 			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
   3381 #endif
   3382 
   3383 		if (debug) {
   3384 			addlog(" send %s suggest %s\n",
   3385 			    sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
   3386 		}
   3387 		sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, rlen, buf);
   3388 	}
   3389 
   3390  end:
   3391 	free (buf, M_TEMP);
   3392 	return (rlen == 0);
   3393 }
   3394 
   3395 /*
   3396  * Analyze the IPv6CP Configure-Reject option list, and adjust our
   3397  * negotiation.
   3398  */
   3399 static void
   3400 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3401 {
   3402 	u_char *buf, *p;
   3403 	struct ifnet *ifp = &sp->pp_if;
   3404 	int debug = ifp->if_flags & IFF_DEBUG;
   3405 
   3406 	len -= 4;
   3407 	buf = malloc (len, M_TEMP, M_NOWAIT);
   3408 	if (!buf)
   3409 		return;
   3410 
   3411 	if (debug)
   3412 		log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:",
   3413 		    SPP_ARGS(ifp));
   3414 
   3415 	p = (void*) (h+1);
   3416 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3417 		if (debug)
   3418 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3419 		switch (*p) {
   3420 		case IPV6CP_OPT_IFID:
   3421 			/*
   3422 			 * Peer doesn't grok address option.  This is
   3423 			 * bad.  XXX  Should we better give up here?
   3424 			 */
   3425 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
   3426 			break;
   3427 #ifdef notyet
   3428 		case IPV6CP_OPT_COMPRESS:
   3429 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
   3430 			break;
   3431 #endif
   3432 		}
   3433 	}
   3434 	if (debug)
   3435 		addlog("\n");
   3436 	free (buf, M_TEMP);
   3437 	return;
   3438 }
   3439 
   3440 /*
   3441  * Analyze the IPv6CP Configure-NAK option list, and adjust our
   3442  * negotiation.
   3443  */
   3444 static void
   3445 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3446 {
   3447 	u_char *buf, *p;
   3448 	struct ifnet *ifp = &sp->pp_if;
   3449 	int debug = ifp->if_flags & IFF_DEBUG;
   3450 	struct in6_addr suggestaddr;
   3451 
   3452 	len -= 4;
   3453 	buf = malloc (len, M_TEMP, M_NOWAIT);
   3454 	if (!buf)
   3455 		return;
   3456 
   3457 	if (debug)
   3458 		log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:",
   3459 		    SPP_ARGS(ifp));
   3460 
   3461 	p = (void*) (h+1);
   3462 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
   3463 		if (debug)
   3464 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
   3465 		switch (*p) {
   3466 		case IPV6CP_OPT_IFID:
   3467 			/*
   3468 			 * Peer doesn't like our local ifid.  See
   3469 			 * if we can do something for him.  We'll drop
   3470 			 * him our address then.
   3471 			 */
   3472 			if (len < 10 || p[1] != 10)
   3473 				break;
   3474 			memset(&suggestaddr, 0, sizeof(suggestaddr));
   3475 			suggestaddr.s6_addr16[0] = htons(0xfe80);
   3476 			suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
   3477 			bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
   3478 
   3479 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
   3480 			if (debug)
   3481 				addlog(" [suggestaddr %s]",
   3482 				       ip6_sprintf(&suggestaddr));
   3483 #ifdef IPV6CP_MYIFID_DYN
   3484 			/*
   3485 			 * When doing dynamic address assignment,
   3486 			 * we accept his offer.
   3487 			 */
   3488 			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
   3489 				struct in6_addr lastsuggest;
   3490 				/*
   3491 				 * If <suggested myaddr from peer> equals to
   3492 				 * <hisaddr we have suggested last time>,
   3493 				 * we have a collision.  generate new random
   3494 				 * ifid.
   3495 				 */
   3496 				sppp_suggest_ip6_addr(&lastsuggest);
   3497 				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
   3498 						 lastsuggest)) {
   3499 					if (debug)
   3500 						addlog(" [random]");
   3501 					sppp_gen_ip6_addr(sp, &suggestaddr);
   3502 				}
   3503 				sppp_set_ip6_addr(sp, &suggestaddr, 0);
   3504 				if (debug)
   3505 					addlog(" [agree]");
   3506 				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
   3507 			}
   3508 #else
   3509 			/*
   3510 			 * Since we do not do dynamic address assignment,
   3511 			 * we ignore it and thus continue to negotiate
   3512 			 * our already existing value.  This can possibly
   3513 			 * go into infinite request-reject loop.
   3514 			 *
   3515 			 * This is not likely because we normally use
   3516 			 * ifid based on MAC-address.
   3517 			 * If you have no ethernet card on the node, too bad.
   3518 			 * XXX should we use fail_counter?
   3519 			 */
   3520 #endif
   3521 			break;
   3522 #ifdef notyet
   3523 		case IPV6CP_OPT_COMPRESS:
   3524 			/*
   3525 			 * Peer wants different compression parameters.
   3526 			 */
   3527 			break;
   3528 #endif
   3529 		}
   3530 	}
   3531 	if (debug)
   3532 		addlog("\n");
   3533 	free (buf, M_TEMP);
   3534 	return;
   3535 }
   3536 
   3537 static void
   3538 sppp_ipv6cp_tlu(struct sppp *sp)
   3539 {
   3540 	/* we are up - notify isdn daemon */
   3541 	if (sp->pp_con)
   3542 		sp->pp_con(sp);
   3543 }
   3544 
   3545 static void
   3546 sppp_ipv6cp_tld(struct sppp *sp)
   3547 {
   3548 }
   3549 
   3550 static void
   3551 sppp_ipv6cp_tls(struct sppp *sp)
   3552 {
   3553 	/* indicate to LCP that it must stay alive */
   3554 	sp->lcp.protos |= (1 << IDX_IPV6CP);
   3555 }
   3556 
   3557 static void
   3558 sppp_ipv6cp_tlf(struct sppp *sp)
   3559 {
   3560 	/* we no longer need LCP */
   3561 	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
   3562 }
   3563 
   3564 static void
   3565 sppp_ipv6cp_scr(struct sppp *sp)
   3566 {
   3567 	char opt[10 /* ifid */ + 4 /* compression, minimum */];
   3568 	struct in6_addr ouraddr;
   3569 	int i = 0;
   3570 
   3571 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
   3572 		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
   3573 		opt[i++] = IPV6CP_OPT_IFID;
   3574 		opt[i++] = 10;
   3575 		bcopy(&ouraddr.s6_addr[8], &opt[i], 8);
   3576 		i += 8;
   3577 	}
   3578 
   3579 #ifdef notyet
   3580 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
   3581 		opt[i++] = IPV6CP_OPT_COMPRESSION;
   3582 		opt[i++] = 4;
   3583 		opt[i++] = 0;	/* TBD */
   3584 		opt[i++] = 0;	/* TBD */
   3585 		/* variable length data may follow */
   3586 	}
   3587 #endif
   3588 
   3589 	sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP];
   3590 	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt);
   3591 }
   3592 #else /*INET6*/
   3593 static void sppp_ipv6cp_init(struct sppp *sp)
   3594 {
   3595 }
   3596 
   3597 static void sppp_ipv6cp_up(struct sppp *sp)
   3598 {
   3599 }
   3600 
   3601 static void sppp_ipv6cp_down(struct sppp *sp)
   3602 {
   3603 }
   3604 
   3605 
   3606 static void sppp_ipv6cp_open(struct sppp *sp)
   3607 {
   3608 }
   3609 
   3610 static void sppp_ipv6cp_close(struct sppp *sp)
   3611 {
   3612 }
   3613 
   3614 static void sppp_ipv6cp_TO(void *sp)
   3615 {
   3616 }
   3617 
   3618 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
   3619 {
   3620 	return 0;
   3621 }
   3622 
   3623 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
   3624 {
   3625 }
   3626 
   3627 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
   3628 {
   3629 }
   3630 
   3631 static void sppp_ipv6cp_tlu(struct sppp *sp)
   3632 {
   3633 }
   3634 
   3635 static void sppp_ipv6cp_tld(struct sppp *sp)
   3636 {
   3637 }
   3638 
   3639 static void sppp_ipv6cp_tls(struct sppp *sp)
   3640 {
   3641 }
   3642 
   3643 static void sppp_ipv6cp_tlf(struct sppp *sp)
   3644 {
   3645 }
   3646 
   3647 static void sppp_ipv6cp_scr(struct sppp *sp)
   3648 {
   3649 }
   3650 #endif /*INET6*/
   3651 
   3652 
   3653 /*
   3654  *--------------------------------------------------------------------------*
   3655  *                                                                          *
   3656  *                        The CHAP implementation.                          *
   3657  *                                                                          *
   3658  *--------------------------------------------------------------------------*
   3659  */
   3660 
   3661 /*
   3662  * The authentication protocols don't employ a full-fledged state machine as
   3663  * the control protocols do, since they do have Open and Close events, but
   3664  * not Up and Down, nor are they explicitly terminated.  Also, use of the
   3665  * authentication protocols may be different in both directions (this makes
   3666  * sense, think of a machine that never accepts incoming calls but only
   3667  * calls out, it doesn't require the called party to authenticate itself).
   3668  *
   3669  * Our state machine for the local authentication protocol (we are requesting
   3670  * the peer to authenticate) looks like:
   3671  *
   3672  *						    RCA-
   3673  *	      +--------------------------------------------+
   3674  *	      V					    scn,tld|
   3675  *	  +--------+			       Close   +---------+ RCA+
   3676  *	  |	   |<----------------------------------|	 |------+
   3677  *   +--->| Closed |				TO*    | Opened	 | sca	|
   3678  *   |	  |	   |-----+		       +-------|	 |<-----+
   3679  *   |	  +--------+ irc |		       |       +---------+
   3680  *   |	    ^		 |		       |	   ^
   3681  *   |	    |		 |		       |	   |
   3682  *   |	    |		 |		       |	   |
   3683  *   |	 TO-|		 |		       |	   |
   3684  *   |	    |tld  TO+	 V		       |	   |
   3685  *   |	    |	+------->+		       |	   |
   3686  *   |	    |	|	 |		       |	   |
   3687  *   |	  +--------+	 V		       |	   |
   3688  *   |	  |	   |<----+<--------------------+	   |
   3689  *   |	  | Req-   | scr				   |
   3690  *   |	  | Sent   |					   |
   3691  *   |	  |	   |					   |
   3692  *   |	  +--------+					   |
   3693  *   | RCA- |	| RCA+					   |
   3694  *   +------+	+------------------------------------------+
   3695  *   scn,tld	  sca,irc,ict,tlu
   3696  *
   3697  *
   3698  *   with:
   3699  *
   3700  *	Open:	LCP reached authentication phase
   3701  *	Close:	LCP reached terminate phase
   3702  *
   3703  *	RCA+:	received reply (pap-req, chap-response), acceptable
   3704  *	RCN:	received reply (pap-req, chap-response), not acceptable
   3705  *	TO+:	timeout with restart counter >= 0
   3706  *	TO-:	timeout with restart counter < 0
   3707  *	TO*:	reschedule timeout for CHAP
   3708  *
   3709  *	scr:	send request packet (none for PAP, chap-challenge)
   3710  *	sca:	send ack packet (pap-ack, chap-success)
   3711  *	scn:	send nak packet (pap-nak, chap-failure)
   3712  *	ict:	initialize re-challenge timer (CHAP only)
   3713  *
   3714  *	tlu:	this-layer-up, LCP reaches network phase
   3715  *	tld:	this-layer-down, LCP enters terminate phase
   3716  *
   3717  * Note that in CHAP mode, after sending a new challenge, while the state
   3718  * automaton falls back into Req-Sent state, it doesn't signal a tld
   3719  * event to LCP, so LCP remains in network phase.  Only after not getting
   3720  * any response (or after getting an unacceptable response), CHAP closes,
   3721  * causing LCP to enter terminate phase.
   3722  *
   3723  * With PAP, there is no initial request that can be sent.  The peer is
   3724  * expected to send one based on the successful negotiation of PAP as
   3725  * the authentication protocol during the LCP option negotiation.
   3726  *
   3727  * Incoming authentication protocol requests (remote requests
   3728  * authentication, we are peer) don't employ a state machine at all,
   3729  * they are simply answered.  Some peers [Ascend P50 firmware rev
   3730  * 4.50] react allergically when sending IPCP/IPv6CP requests while they are
   3731  * still in authentication phase (thereby violating the standard that
   3732  * demands that these NCP packets are to be discarded), so we keep
   3733  * track of the peer demanding us to authenticate, and only proceed to
   3734  * phase network once we've seen a positive acknowledge for the
   3735  * authentication.
   3736  */
   3737 
   3738 /*
   3739  * Handle incoming CHAP packets.
   3740  */
   3741 void
   3742 sppp_chap_input(struct sppp *sp, struct mbuf *m)
   3743 {
   3744 	STDDCL;
   3745 	struct lcp_header *h;
   3746 	int len, x;
   3747 	u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize;
   3748 	int value_len, name_len;
   3749 	MD5_CTX ctx;
   3750 
   3751 	len = m->m_pkthdr.len;
   3752 	if (len < 4) {
   3753 		if (debug)
   3754 			log(LOG_DEBUG,
   3755 			    SPP_FMT "chap invalid packet length: %d bytes\n",
   3756 			    SPP_ARGS(ifp), len);
   3757 		return;
   3758 	}
   3759 	h = mtod (m, struct lcp_header*);
   3760 	if (len > ntohs (h->len))
   3761 		len = ntohs (h->len);
   3762 
   3763 	switch (h->type) {
   3764 	/* challenge, failure and success are his authproto */
   3765 	case CHAP_CHALLENGE:
   3766 		if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   3767 		    /* can't do anything usefull */
   3768 		    sp->pp_auth_failures++;
   3769 		    printf(SPP_FMT "chap input without my name and my secret being set\n",
   3770 		    	SPP_ARGS(ifp));
   3771 		    break;
   3772 		}
   3773 		value = 1 + (u_char*)(h+1);
   3774 		value_len = value[-1];
   3775 		name = value + value_len;
   3776 		name_len = len - value_len - 5;
   3777 		if (name_len < 0) {
   3778 			if (debug) {
   3779 				log(LOG_DEBUG,
   3780 				    SPP_FMT "chap corrupted challenge "
   3781 				    "<%s id=0x%x len=%d",
   3782 				    SPP_ARGS(ifp),
   3783 				    sppp_auth_type_name(PPP_CHAP, h->type),
   3784 				    h->ident, ntohs(h->len));
   3785 				if (len > 4)
   3786 					sppp_print_bytes((u_char*) (h+1), len-4);
   3787 				addlog(">\n");
   3788 			}
   3789 			break;
   3790 		}
   3791 
   3792 		if (debug) {
   3793 			log(LOG_DEBUG,
   3794 			    SPP_FMT "chap input <%s id=0x%x len=%d name=",
   3795 			    SPP_ARGS(ifp),
   3796 			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
   3797 			    ntohs(h->len));
   3798 			sppp_print_string((char*) name, name_len);
   3799 			addlog(" value-size=%d value=", value_len);
   3800 			sppp_print_bytes(value, value_len);
   3801 			addlog(">\n");
   3802 		}
   3803 
   3804 		/* Compute reply value. */
   3805 		MD5Init(&ctx);
   3806 		MD5Update(&ctx, &h->ident, 1);
   3807 		MD5Update(&ctx, sp->myauth.secret, strlen(sp->myauth.secret));
   3808 		MD5Update(&ctx, value, value_len);
   3809 		MD5Final(digest, &ctx);
   3810 		dsize = sizeof digest;
   3811 
   3812 		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
   3813 			       sizeof dsize, (const char *)&dsize,
   3814 			       sizeof digest, digest,
   3815 			       strlen(sp->myauth.name),
   3816 			       sp->myauth.name,
   3817 			       0);
   3818 		break;
   3819 
   3820 	case CHAP_SUCCESS:
   3821 		if (debug) {
   3822 			log(LOG_DEBUG, SPP_FMT "chap success",
   3823 			    SPP_ARGS(ifp));
   3824 			if (len > 4) {
   3825 				addlog(": ");
   3826 				sppp_print_string((char*)(h + 1), len - 4);
   3827 			}
   3828 			addlog("\n");
   3829 		}
   3830 		x = splnet();
   3831 		sp->pp_auth_failures = 0;
   3832 		sp->pp_flags &= ~PP_NEEDAUTH;
   3833 		if (sp->myauth.proto == PPP_CHAP &&
   3834 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   3835 		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
   3836 			/*
   3837 			 * We are authenticator for CHAP but didn't
   3838 			 * complete yet.  Leave it to tlu to proceed
   3839 			 * to network phase.
   3840 			 */
   3841 			splx(x);
   3842 			break;
   3843 		}
   3844 		splx(x);
   3845 		sppp_phase_network(sp);
   3846 		break;
   3847 
   3848 	case CHAP_FAILURE:
   3849 		x = splnet();
   3850 		sp->pp_auth_failures++;
   3851 		splx(x);
   3852 		if (debug) {
   3853 			log(LOG_INFO, SPP_FMT "chap failure",
   3854 			    SPP_ARGS(ifp));
   3855 			if (len > 4) {
   3856 				addlog(": ");
   3857 				sppp_print_string((char*)(h + 1), len - 4);
   3858 			}
   3859 			addlog("\n");
   3860 		} else
   3861 			log(LOG_INFO, SPP_FMT "chap failure\n",
   3862 			    SPP_ARGS(ifp));
   3863 		/* await LCP shutdown by authenticator */
   3864 		break;
   3865 
   3866 	/* response is my authproto */
   3867 	case CHAP_RESPONSE:
   3868 		if (sp->hisauth.secret == NULL) {
   3869 		    /* can't do anything usefull */
   3870 		    printf(SPP_FMT "chap input without his secret being set\n",
   3871 		    	SPP_ARGS(ifp));
   3872 		    break;
   3873 		}
   3874 		value = 1 + (u_char*)(h+1);
   3875 		value_len = value[-1];
   3876 		name = value + value_len;
   3877 		name_len = len - value_len - 5;
   3878 		if (name_len < 0) {
   3879 			if (debug) {
   3880 				log(LOG_DEBUG,
   3881 				    SPP_FMT "chap corrupted response "
   3882 				    "<%s id=0x%x len=%d",
   3883 				    SPP_ARGS(ifp),
   3884 				    sppp_auth_type_name(PPP_CHAP, h->type),
   3885 				    h->ident, ntohs(h->len));
   3886 				if (len > 4)
   3887 					sppp_print_bytes((u_char*)(h+1), len-4);
   3888 				addlog(">\n");
   3889 			}
   3890 			break;
   3891 		}
   3892 		if (h->ident != sp->confid[IDX_CHAP]) {
   3893 			if (debug)
   3894 				log(LOG_DEBUG,
   3895 				    SPP_FMT "chap dropping response for old ID "
   3896 				    "(got %d, expected %d)\n",
   3897 				    SPP_ARGS(ifp),
   3898 				    h->ident, sp->confid[IDX_CHAP]);
   3899 			break;
   3900 		}
   3901 		if (sp->hisauth.name != NULL &&
   3902 		    (name_len != strlen(sp->hisauth.name)
   3903 		    || memcmp(name, sp->hisauth.name, name_len) != 0)) {
   3904 			log(LOG_INFO, SPP_FMT "chap response, his name ",
   3905 			    SPP_ARGS(ifp));
   3906 			sppp_print_string(name, name_len);
   3907 			addlog(" != expected ");
   3908 			sppp_print_string(sp->hisauth.name,
   3909 					  strlen(sp->hisauth.name));
   3910 			addlog("\n");
   3911 		    goto chap_failure;
   3912 		}
   3913 		if (debug) {
   3914 			log(LOG_DEBUG, SPP_FMT "chap input(%s) "
   3915 			    "<%s id=0x%x len=%d name=",
   3916 			    SPP_ARGS(ifp),
   3917 			    sppp_state_name(sp->state[IDX_CHAP]),
   3918 			    sppp_auth_type_name(PPP_CHAP, h->type),
   3919 			    h->ident, ntohs (h->len));
   3920 			sppp_print_string((char*)name, name_len);
   3921 			addlog(" value-size=%d value=", value_len);
   3922 			sppp_print_bytes(value, value_len);
   3923 			addlog(">\n");
   3924 		}
   3925 		if (value_len != sizeof(sp->myauth.challenge)) {
   3926 			if (debug)
   3927 				log(LOG_DEBUG,
   3928 				    SPP_FMT "chap bad hash value length: "
   3929 				    "%d bytes, should be %ld\n",
   3930 				    SPP_ARGS(ifp), value_len,
   3931 				    (long) sizeof(sp->myauth.challenge));
   3932 			goto chap_failure;
   3933 		}
   3934 
   3935 		MD5Init(&ctx);
   3936 		MD5Update(&ctx, &h->ident, 1);
   3937 		MD5Update(&ctx, sp->hisauth.secret,
   3938 			  strlen(sp->hisauth.secret));
   3939 		MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge));
   3940 		MD5Final(digest, &ctx);
   3941 
   3942 #define FAILMSG "Failed..."
   3943 #define SUCCMSG "Welcome!"
   3944 
   3945 		if (value_len != sizeof digest ||
   3946 		    memcmp(digest, value, value_len) != 0) {
   3947 chap_failure:
   3948 			/* action scn, tld */
   3949 			x = splnet();
   3950 			sp->pp_auth_failures++;
   3951 			splx(x);
   3952 			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
   3953 				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
   3954 				       0);
   3955 			chap.tld(sp);
   3956 			break;
   3957 		}
   3958 		sp->pp_auth_failures = 0;
   3959 		/* action sca, perhaps tlu */
   3960 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
   3961 		    sp->state[IDX_CHAP] == STATE_OPENED)
   3962 			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
   3963 				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
   3964 				       0);
   3965 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
   3966 			sppp_cp_change_state(&chap, sp, STATE_OPENED);
   3967 			chap.tlu(sp);
   3968 		}
   3969 		break;
   3970 
   3971 	default:
   3972 		/* Unknown CHAP packet type -- ignore. */
   3973 		if (debug) {
   3974 			log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
   3975 			    "<0x%x id=0x%xh len=%d",
   3976 			    SPP_ARGS(ifp),
   3977 			    sppp_state_name(sp->state[IDX_CHAP]),
   3978 			    h->type, h->ident, ntohs(h->len));
   3979 			if (len > 4)
   3980 				sppp_print_bytes((u_char*)(h+1), len-4);
   3981 			addlog(">\n");
   3982 		}
   3983 		break;
   3984 
   3985 	}
   3986 }
   3987 
   3988 static void
   3989 sppp_chap_init(struct sppp *sp)
   3990 {
   3991 	/* Chap doesn't have STATE_INITIAL at all. */
   3992 	sp->state[IDX_CHAP] = STATE_CLOSED;
   3993 	sp->fail_counter[IDX_CHAP] = 0;
   3994 	sp->pp_seq[IDX_CHAP] = 0;
   3995 	sp->pp_rseq[IDX_CHAP] = 0;
   3996 	callout_init(&sp->ch[IDX_CHAP]);
   3997 }
   3998 
   3999 static void
   4000 sppp_chap_open(struct sppp *sp)
   4001 {
   4002 	if (sp->myauth.proto == PPP_CHAP &&
   4003 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4004 		/* we are authenticator for CHAP, start it */
   4005 		chap.scr(sp);
   4006 		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4007 		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4008 	}
   4009 	/* nothing to be done if we are peer, await a challenge */
   4010 }
   4011 
   4012 static void
   4013 sppp_chap_close(struct sppp *sp)
   4014 {
   4015 	if (sp->state[IDX_CHAP] != STATE_CLOSED)
   4016 		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4017 }
   4018 
   4019 static void
   4020 sppp_chap_TO(void *cookie)
   4021 {
   4022 	struct sppp *sp = (struct sppp *)cookie;
   4023 	STDDCL;
   4024 	int s;
   4025 
   4026 	s = splnet();
   4027 	if (debug)
   4028 		log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
   4029 		    SPP_ARGS(ifp),
   4030 		    sppp_state_name(sp->state[IDX_CHAP]),
   4031 		    sp->rst_counter[IDX_CHAP]);
   4032 
   4033 	if (--sp->rst_counter[IDX_CHAP] < 0)
   4034 		/* TO- event */
   4035 		switch (sp->state[IDX_CHAP]) {
   4036 		case STATE_REQ_SENT:
   4037 			chap.tld(sp);
   4038 			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
   4039 			break;
   4040 		}
   4041 	else
   4042 		/* TO+ (or TO*) event */
   4043 		switch (sp->state[IDX_CHAP]) {
   4044 		case STATE_OPENED:
   4045 			/* TO* event */
   4046 			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4047 			/* fall through */
   4048 		case STATE_REQ_SENT:
   4049 			chap.scr(sp);
   4050 			/* sppp_cp_change_state() will restart the timer */
   4051 			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
   4052 			break;
   4053 		}
   4054 
   4055 	splx(s);
   4056 }
   4057 
   4058 static void
   4059 sppp_chap_tlu(struct sppp *sp)
   4060 {
   4061 	STDDCL;
   4062 	int i, x;
   4063 
   4064 	i = 0;
   4065 	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
   4066 
   4067 	/*
   4068 	 * Some broken CHAP implementations (Conware CoNet, firmware
   4069 	 * 4.0.?) don't want to re-authenticate their CHAP once the
   4070 	 * initial challenge-response exchange has taken place.
   4071 	 * Provide for an option to avoid rechallenges.
   4072 	 */
   4073 	if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
   4074 		/*
   4075 		 * Compute the re-challenge timeout.  This will yield
   4076 		 * a number between 300 and 810 seconds.
   4077 		 */
   4078 		i = 300 + ((unsigned)(random() & 0xff00) >> 7);
   4079 
   4080 		callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp);
   4081 	}
   4082 
   4083 	if (debug) {
   4084 		log(LOG_DEBUG,
   4085 		    SPP_FMT "chap %s, ",
   4086 		    SPP_ARGS(ifp),
   4087 		    sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu");
   4088 		if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0)
   4089 			addlog("next re-challenge in %d seconds\n", i);
   4090 		else
   4091 			addlog("re-challenging supressed\n");
   4092 	}
   4093 
   4094 	x = splnet();
   4095 	sp->pp_auth_failures = 0;
   4096 	/* indicate to LCP that we need to be closed down */
   4097 	sp->lcp.protos |= (1 << IDX_CHAP);
   4098 
   4099 	if (sp->pp_flags & PP_NEEDAUTH) {
   4100 		/*
   4101 		 * Remote is authenticator, but his auth proto didn't
   4102 		 * complete yet.  Defer the transition to network
   4103 		 * phase.
   4104 		 */
   4105 		splx(x);
   4106 		return;
   4107 	}
   4108 	splx(x);
   4109 
   4110 	/*
   4111 	 * If we are already in phase network, we are done here.  This
   4112 	 * is the case if this is a dummy tlu event after a re-challenge.
   4113 	 */
   4114 	if (sp->pp_phase != SPPP_PHASE_NETWORK)
   4115 		sppp_phase_network(sp);
   4116 }
   4117 
   4118 static void
   4119 sppp_chap_tld(struct sppp *sp)
   4120 {
   4121 	STDDCL;
   4122 
   4123 	if (debug)
   4124 		log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
   4125 	callout_stop(&sp->ch[IDX_CHAP]);
   4126 	sp->lcp.protos &= ~(1 << IDX_CHAP);
   4127 
   4128 	lcp.Close(sp);
   4129 }
   4130 
   4131 static void
   4132 sppp_chap_scr(struct sppp *sp)
   4133 {
   4134 	struct timeval tv;
   4135 	u_int32_t *ch, seed;
   4136 	u_char clen;
   4137 
   4138 	if (sp->myauth.name == NULL) {
   4139 	    /* can't do anything usefull */
   4140 	    printf(SPP_FMT "chap starting without my name being set\n",
   4141 	    	SPP_ARGS(&sp->pp_if));
   4142 	    return;
   4143 	}
   4144 
   4145 	/* Compute random challenge. */
   4146 	ch = (u_int32_t *)sp->myauth.challenge;
   4147 	microtime(&tv);
   4148 	seed = tv.tv_sec ^ tv.tv_usec;
   4149 	ch[0] = seed ^ random();
   4150 	ch[1] = seed ^ random();
   4151 	ch[2] = seed ^ random();
   4152 	ch[3] = seed ^ random();
   4153 	clen = 16;	/* 4 * sizeof(u_int32_t) */
   4154 
   4155 	sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];
   4156 
   4157 	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
   4158 		       sizeof clen, (const char *)&clen,
   4159 		       sizeof(sp->myauth.challenge), sp->myauth.challenge,
   4160 		       strlen(sp->myauth.name),
   4161 		       sp->myauth.name,
   4162 		       0);
   4163 }
   4164 
   4165 /*
   4166  *--------------------------------------------------------------------------*
   4167  *                                                                          *
   4168  *                        The PAP implementation.                           *
   4169  *                                                                          *
   4170  *--------------------------------------------------------------------------*
   4171  */
   4172 /*
   4173  * For PAP, we need to keep a little state also if we are the peer, not the
   4174  * authenticator.  This is since we don't get a request to authenticate, but
   4175  * have to repeatedly authenticate ourself until we got a response (or the
   4176  * retry counter is expired).
   4177  */
   4178 
   4179 /*
   4180  * Handle incoming PAP packets.  */
   4181 static void
   4182 sppp_pap_input(struct sppp *sp, struct mbuf *m)
   4183 {
   4184 	STDDCL;
   4185 	struct lcp_header *h;
   4186 	int len, x;
   4187 	u_char mlen;
   4188 	char *name, *passwd;
   4189 	int name_len, passwd_len;
   4190 
   4191 	len = m->m_pkthdr.len;
   4192 	if (len < 5) {
   4193 		if (debug)
   4194 			log(LOG_DEBUG,
   4195 			    SPP_FMT "pap invalid packet length: %d bytes\n",
   4196 			    SPP_ARGS(ifp), len);
   4197 		return;
   4198 	}
   4199 	h = mtod (m, struct lcp_header*);
   4200 	if (len > ntohs (h->len))
   4201 		len = ntohs (h->len);
   4202 	switch (h->type) {
   4203 	/* PAP request is my authproto */
   4204 	case PAP_REQ:
   4205 		if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
   4206 		    /* can't do anything usefull */
   4207 		    printf(SPP_FMT "pap request without his name and his secret being set\n",
   4208 		    	SPP_ARGS(ifp));
   4209 		    break;
   4210 		}
   4211 		name = 1 + (u_char*)(h+1);
   4212 		name_len = name[-1];
   4213 		passwd = name + name_len + 1;
   4214 		if (name_len > len - 6 ||
   4215 		    (passwd_len = passwd[-1]) > len - 6 - name_len) {
   4216 			if (debug) {
   4217 				log(LOG_DEBUG, SPP_FMT "pap corrupted input "
   4218 				    "<%s id=0x%x len=%d",
   4219 				    SPP_ARGS(ifp),
   4220 				    sppp_auth_type_name(PPP_PAP, h->type),
   4221 				    h->ident, ntohs(h->len));
   4222 				if (len > 4)
   4223 					sppp_print_bytes((u_char*)(h+1), len-4);
   4224 				addlog(">\n");
   4225 			}
   4226 			break;
   4227 		}
   4228 		if (debug) {
   4229 			log(LOG_DEBUG, SPP_FMT "pap input(%s) "
   4230 			    "<%s id=0x%x len=%d name=",
   4231 			    SPP_ARGS(ifp),
   4232 			    sppp_state_name(sp->state[IDX_PAP]),
   4233 			    sppp_auth_type_name(PPP_PAP, h->type),
   4234 			    h->ident, ntohs(h->len));
   4235 			sppp_print_string((char*)name, name_len);
   4236 			addlog(" passwd=");
   4237 			sppp_print_string((char*)passwd, passwd_len);
   4238 			addlog(">\n");
   4239 		}
   4240 		if (memcmp(name, sp->hisauth.name, name_len) != 0 ||
   4241 		    memcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
   4242 			/* action scn, tld */
   4243 			sp->pp_auth_failures++;
   4244 			mlen = sizeof(FAILMSG) - 1;
   4245 			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
   4246 				       sizeof mlen, (const char *)&mlen,
   4247 				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
   4248 				       0);
   4249 			pap.tld(sp);
   4250 			break;
   4251 		}
   4252 		/* action sca, perhaps tlu */
   4253 		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
   4254 		    sp->state[IDX_PAP] == STATE_OPENED) {
   4255 			mlen = sizeof(SUCCMSG) - 1;
   4256 			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
   4257 				       sizeof mlen, (const char *)&mlen,
   4258 				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
   4259 				       0);
   4260 		}
   4261 		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
   4262 			sppp_cp_change_state(&pap, sp, STATE_OPENED);
   4263 			pap.tlu(sp);
   4264 		}
   4265 		break;
   4266 
   4267 	/* ack and nak are his authproto */
   4268 	case PAP_ACK:
   4269 		callout_stop(&sp->pap_my_to_ch);
   4270 		if (debug) {
   4271 			log(LOG_DEBUG, SPP_FMT "pap success",
   4272 			    SPP_ARGS(ifp));
   4273 			name_len = *(char *)h;
   4274 			if (len > 5 && name_len) {
   4275 				addlog(": ");
   4276 				sppp_print_string((char*)(h+1), name_len);
   4277 			}
   4278 			addlog("\n");
   4279 		}
   4280 		x = splnet();
   4281 		sp->pp_auth_failures = 0;
   4282 		sp->pp_flags &= ~PP_NEEDAUTH;
   4283 		if (sp->myauth.proto == PPP_PAP &&
   4284 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
   4285 		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
   4286 			/*
   4287 			 * We are authenticator for PAP but didn't
   4288 			 * complete yet.  Leave it to tlu to proceed
   4289 			 * to network phase.
   4290 			 */
   4291 			splx(x);
   4292 			break;
   4293 		}
   4294 		splx(x);
   4295 		sppp_phase_network(sp);
   4296 		break;
   4297 
   4298 	case PAP_NAK:
   4299 		callout_stop(&sp->pap_my_to_ch);
   4300 		sp->pp_auth_failures++;
   4301 		if (debug) {
   4302 			log(LOG_INFO, SPP_FMT "pap failure",
   4303 			    SPP_ARGS(ifp));
   4304 			name_len = *(char *)h;
   4305 			if (len > 5 && name_len) {
   4306 				addlog(": ");
   4307 				sppp_print_string((char*)(h+1), name_len);
   4308 			}
   4309 			addlog("\n");
   4310 		} else
   4311 			log(LOG_INFO, SPP_FMT "pap failure\n",
   4312 			    SPP_ARGS(ifp));
   4313 		/* await LCP shutdown by authenticator */
   4314 		break;
   4315 
   4316 	default:
   4317 		/* Unknown PAP packet type -- ignore. */
   4318 		if (debug) {
   4319 			log(LOG_DEBUG, SPP_FMT "pap corrupted input "
   4320 			    "<0x%x id=0x%x len=%d",
   4321 			    SPP_ARGS(ifp),
   4322 			    h->type, h->ident, ntohs(h->len));
   4323 			if (len > 4)
   4324 				sppp_print_bytes((u_char*)(h+1), len-4);
   4325 			addlog(">\n");
   4326 		}
   4327 		break;
   4328 
   4329 	}
   4330 }
   4331 
   4332 static void
   4333 sppp_pap_init(struct sppp *sp)
   4334 {
   4335 	/* PAP doesn't have STATE_INITIAL at all. */
   4336 	sp->state[IDX_PAP] = STATE_CLOSED;
   4337 	sp->fail_counter[IDX_PAP] = 0;
   4338 	sp->pp_seq[IDX_PAP] = 0;
   4339 	sp->pp_rseq[IDX_PAP] = 0;
   4340 	callout_init(&sp->ch[IDX_PAP]);
   4341 	callout_init(&sp->pap_my_to_ch);
   4342 }
   4343 
   4344 static void
   4345 sppp_pap_open(struct sppp *sp)
   4346 {
   4347 	if (sp->hisauth.proto == PPP_PAP &&
   4348 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
   4349 		/* we are authenticator for PAP, start our timer */
   4350 		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4351 		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4352 	}
   4353 	if (sp->myauth.proto == PPP_PAP) {
   4354 		/* we are peer, send a request, and start a timer */
   4355 		pap.scr(sp);
   4356 		callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout,
   4357 		    sppp_pap_my_TO, sp);
   4358 	}
   4359 }
   4360 
   4361 static void
   4362 sppp_pap_close(struct sppp *sp)
   4363 {
   4364 	if (sp->state[IDX_PAP] != STATE_CLOSED)
   4365 		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4366 }
   4367 
   4368 /*
   4369  * That's the timeout routine if we are authenticator.  Since the
   4370  * authenticator is basically passive in PAP, we can't do much here.
   4371  */
   4372 static void
   4373 sppp_pap_TO(void *cookie)
   4374 {
   4375 	struct sppp *sp = (struct sppp *)cookie;
   4376 	STDDCL;
   4377 	int s;
   4378 
   4379 	s = splnet();
   4380 	if (debug)
   4381 		log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
   4382 		    SPP_ARGS(ifp),
   4383 		    sppp_state_name(sp->state[IDX_PAP]),
   4384 		    sp->rst_counter[IDX_PAP]);
   4385 
   4386 	if (--sp->rst_counter[IDX_PAP] < 0)
   4387 		/* TO- event */
   4388 		switch (sp->state[IDX_PAP]) {
   4389 		case STATE_REQ_SENT:
   4390 			pap.tld(sp);
   4391 			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
   4392 			break;
   4393 		}
   4394 	else
   4395 		/* TO+ event, not very much we could do */
   4396 		switch (sp->state[IDX_PAP]) {
   4397 		case STATE_REQ_SENT:
   4398 			/* sppp_cp_change_state() will restart the timer */
   4399 			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
   4400 			break;
   4401 		}
   4402 
   4403 	splx(s);
   4404 }
   4405 
   4406 /*
   4407  * That's the timeout handler if we are peer.  Since the peer is active,
   4408  * we need to retransmit our PAP request since it is apparently lost.
   4409  * XXX We should impose a max counter.
   4410  */
   4411 static void
   4412 sppp_pap_my_TO(void *cookie)
   4413 {
   4414 	struct sppp *sp = (struct sppp *)cookie;
   4415 	STDDCL;
   4416 
   4417 	if (debug)
   4418 		log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
   4419 		    SPP_ARGS(ifp));
   4420 
   4421 	pap.scr(sp);
   4422 }
   4423 
   4424 static void
   4425 sppp_pap_tlu(struct sppp *sp)
   4426 {
   4427 	STDDCL;
   4428 	int x;
   4429 
   4430 	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
   4431 
   4432 	if (debug)
   4433 		log(LOG_DEBUG, SPP_FMT "%s tlu\n",
   4434 		    SPP_ARGS(ifp), pap.name);
   4435 
   4436 	x = splnet();
   4437 	sp->pp_auth_failures = 0;
   4438 	/* indicate to LCP that we need to be closed down */
   4439 	sp->lcp.protos |= (1 << IDX_PAP);
   4440 
   4441 	if (sp->pp_flags & PP_NEEDAUTH) {
   4442 		/*
   4443 		 * Remote is authenticator, but his auth proto didn't
   4444 		 * complete yet.  Defer the transition to network
   4445 		 * phase.
   4446 		 */
   4447 		splx(x);
   4448 		return;
   4449 	}
   4450 	splx(x);
   4451 	sppp_phase_network(sp);
   4452 }
   4453 
   4454 static void
   4455 sppp_pap_tld(struct sppp *sp)
   4456 {
   4457 	STDDCL;
   4458 
   4459 	if (debug)
   4460 		log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
   4461 	callout_stop(&sp->ch[IDX_PAP]);
   4462 	callout_stop(&sp->pap_my_to_ch);
   4463 	sp->lcp.protos &= ~(1 << IDX_PAP);
   4464 
   4465 	lcp.Close(sp);
   4466 }
   4467 
   4468 static void
   4469 sppp_pap_scr(struct sppp *sp)
   4470 {
   4471 	u_char idlen, pwdlen;
   4472 
   4473 	if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
   4474 	    /* can't do anything usefull */
   4475 	    printf(SPP_FMT "pap starting without my name and secret being set\n",
   4476 	    	SPP_ARGS(&sp->pp_if));
   4477 	    return;
   4478 	}
   4479 
   4480 	sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP];
   4481 	pwdlen = strlen(sp->myauth.secret);
   4482 	idlen = strlen(sp->myauth.name);
   4483 
   4484 	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
   4485 		       sizeof idlen, (const char *)&idlen,
   4486 		       idlen, sp->myauth.name,
   4487 		       sizeof pwdlen, (const char *)&pwdlen,
   4488 		       pwdlen, sp->myauth.secret,
   4489 		       0);
   4490 }
   4491 
   4492 /*
   4493  * Random miscellaneous functions.
   4494  */
   4495 
   4496 /*
   4497  * Send a PAP or CHAP proto packet.
   4498  *
   4499  * Varadic function, each of the elements for the ellipsis is of type
   4500  * ``size_t mlen, const u_char *msg''.  Processing will stop iff
   4501  * mlen == 0.
   4502  * NOTE: never declare variadic functions with types subject to type
   4503  * promotion (i.e. u_char). This is asking for big trouble depending
   4504  * on the architecture you are on...
   4505  */
   4506 
   4507 static void
   4508 sppp_auth_send(const struct cp *cp, struct sppp *sp,
   4509                unsigned int type, unsigned int id,
   4510 	       ...)
   4511 {
   4512 	STDDCL;
   4513 	struct lcp_header *lh;
   4514 	struct mbuf *m;
   4515 	u_char *p;
   4516 	int len;
   4517 	size_t pkthdrlen;
   4518 	unsigned int mlen;
   4519 	const char *msg;
   4520 	va_list ap;
   4521 
   4522 	MGETHDR (m, M_DONTWAIT, MT_DATA);
   4523 	if (! m)
   4524 		return;
   4525 	m->m_pkthdr.rcvif = 0;
   4526 
   4527 	if (sp->pp_flags & PP_NOFRAMING) {
   4528 		*mtod(m, u_int16_t*) = htons(cp->proto);
   4529 		pkthdrlen = 2;
   4530 		lh = (struct lcp_header*)(mtod(m, u_int8_t*)+2);
   4531 	} else {
   4532 		struct ppp_header *h;
   4533 		h = mtod (m, struct ppp_header*);
   4534 		h->address = PPP_ALLSTATIONS;		/* broadcast address */
   4535 		h->control = PPP_UI;			/* Unnumbered Info */
   4536 		h->protocol = htons(cp->proto);
   4537 		pkthdrlen = PPP_HEADER_LEN;
   4538 
   4539 		lh = (struct lcp_header*)(h + 1);
   4540 	}
   4541 
   4542 	lh->type = type;
   4543 	lh->ident = id;
   4544 	p = (u_char*) (lh+1);
   4545 
   4546 	va_start(ap, id);
   4547 	len = 0;
   4548 
   4549 	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
   4550 		msg = va_arg(ap, const char *);
   4551 		len += mlen;
   4552 		if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
   4553 			va_end(ap);
   4554 			m_freem(m);
   4555 			return;
   4556 		}
   4557 
   4558 		bcopy(msg, p, mlen);
   4559 		p += mlen;
   4560 	}
   4561 	va_end(ap);
   4562 
   4563 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
   4564 	lh->len = htons (LCP_HEADER_LEN + len);
   4565 
   4566 	if (debug) {
   4567 		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
   4568 		    SPP_ARGS(ifp), cp->name,
   4569 		    sppp_auth_type_name(cp->proto, lh->type),
   4570 		    lh->ident, ntohs(lh->len));
   4571 		if (len)
   4572 			sppp_print_bytes((u_char*) (lh+1), len);
   4573 		addlog(">\n");
   4574 	}
   4575 	if (IF_QFULL (&sp->pp_cpq)) {
   4576 		IF_DROP (&sp->pp_fastq);
   4577 		IF_DROP (&ifp->if_snd);
   4578 		m_freem (m);
   4579 		++ifp->if_oerrors;
   4580 	} else
   4581 		IF_ENQUEUE (&sp->pp_cpq, m);
   4582 	if (! (ifp->if_flags & IFF_OACTIVE))
   4583 		(*ifp->if_start) (ifp);
   4584 	ifp->if_obytes += m->m_pkthdr.len + 3;
   4585 }
   4586 
   4587 /*
   4588  * Send keepalive packets, every 10 seconds.
   4589  */
   4590 static void
   4591 sppp_keepalive(void *dummy)
   4592 {
   4593 	struct sppp *sp;
   4594 	int s;
   4595 	time_t now;
   4596 
   4597 	s = splnet();
   4598 	now = time.tv_sec;
   4599 	for (sp=spppq; sp; sp=sp->pp_next) {
   4600 		struct ifnet *ifp = &sp->pp_if;
   4601 
   4602 		/* check idle timeout */
   4603 		if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING)
   4604 		    && (sp->pp_phase == SPPP_PHASE_NETWORK)) {
   4605 		    /* idle timeout is enabled for this interface */
   4606 		    if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) {
   4607 		    	if (ifp->if_flags & IFF_DEBUG)
   4608 			    printf("%s: no activitiy for %lu seconds\n",
   4609 				sp->pp_if.if_xname,
   4610 				(unsigned long)(now-sp->pp_last_activity));
   4611 			lcp.Close(sp);
   4612 			continue;
   4613 		    }
   4614 		}
   4615 
   4616 		/* Keepalive mode disabled or channel down? */
   4617 		if (! (sp->pp_flags & PP_KEEPALIVE) ||
   4618 		    ! (ifp->if_flags & IFF_RUNNING))
   4619 			continue;
   4620 
   4621 		/* No keepalive in PPP mode if LCP not opened yet. */
   4622 		if (! (sp->pp_flags & PP_CISCO) &&
   4623 		    sp->pp_phase < SPPP_PHASE_AUTHENTICATE)
   4624 			continue;
   4625 
   4626 		if (sp->pp_alivecnt == MAXALIVECNT) {
   4627 			/* No keepalive packets got.  Stop the interface. */
   4628 			if_down (ifp);
   4629 			IF_PURGE (&sp->pp_cpq);
   4630 			if (! (sp->pp_flags & PP_CISCO)) {
   4631 				printf("%s: LCP keepalive timed out, going to restart the connection\n",
   4632 					ifp->if_xname);
   4633 				sp->pp_alivecnt = 0;
   4634 
   4635 				/* we are down, close all open protocols */
   4636 				lcp.Close(sp);
   4637 
   4638 				/* And now prepare LCP to reestablish the link, if configured to do so. */
   4639 				sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
   4640 
   4641 				/* Close connection imediatly, completition of this
   4642 				 * will summon the magic needed to reestablish it. */
   4643 				sp->pp_tlf(sp);
   4644 				continue;
   4645 			}
   4646 		}
   4647 		if (sp->pp_alivecnt <= MAXALIVECNT)
   4648 			++sp->pp_alivecnt;
   4649 		if (sp->pp_flags & PP_CISCO)
   4650 			sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ,
   4651 			    ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]);
   4652 		else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
   4653 			int32_t nmagic = htonl (sp->lcp.magic);
   4654 			sp->lcp.echoid = ++sp->pp_seq[IDX_LCP];
   4655 			sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
   4656 				sp->lcp.echoid, 4, &nmagic);
   4657 		}
   4658 	}
   4659 	splx(s);
   4660 	callout_reset(&keepalive_ch, hz * 10, sppp_keepalive, NULL);
   4661 }
   4662 
   4663 /*
   4664  * Get both IP addresses.
   4665  */
   4666 static void
   4667 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask)
   4668 {
   4669 	struct ifnet *ifp = &sp->pp_if;
   4670 	struct ifaddr *ifa;
   4671 	struct sockaddr_in *si, *sm;
   4672 	u_int32_t ssrc, ddst;
   4673 
   4674 	sm = NULL;
   4675 	ssrc = ddst = 0;
   4676 	/*
   4677 	 * Pick the first AF_INET address from the list,
   4678 	 * aliases don't make any sense on a p2p link anyway.
   4679 	 */
   4680 	si = 0;
   4681 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
   4682 		if (ifa->ifa_addr->sa_family == AF_INET) {
   4683 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4684 			sm = (struct sockaddr_in *)ifa->ifa_netmask;
   4685 			if (si)
   4686 				break;
   4687 		}
   4688 	}
   4689 	if (ifa) {
   4690 		if (si && si->sin_addr.s_addr) {
   4691 			ssrc = si->sin_addr.s_addr;
   4692 			if (srcmask)
   4693 				*srcmask = ntohl(sm->sin_addr.s_addr);
   4694 		}
   4695 
   4696 		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4697 		if (si && si->sin_addr.s_addr)
   4698 			ddst = si->sin_addr.s_addr;
   4699 	}
   4700 
   4701 	if (dst) *dst = ntohl(ddst);
   4702 	if (src) *src = ntohl(ssrc);
   4703 }
   4704 
   4705 /*
   4706  * Set IP addresses.  Must be called at splnet.
   4707  * If an address is 0, leave it the way it is.
   4708  */
   4709 static void
   4710 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr)
   4711 {
   4712 	STDDCL;
   4713 	struct ifaddr *ifa;
   4714 	struct sockaddr_in *si;
   4715 	struct sockaddr_in *dest;
   4716 
   4717 	/*
   4718 	 * Pick the first AF_INET address from the list,
   4719 	 * aliases don't make any sense on a p2p link anyway.
   4720 	 */
   4721 
   4722 	si = 0;
   4723 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
   4724 	{
   4725 		if (ifa->ifa_addr->sa_family == AF_INET)
   4726 		{
   4727 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4728 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4729 			if (si)
   4730 				break;
   4731 		}
   4732 	}
   4733 
   4734 	if (ifa && si)
   4735 	{
   4736 		int error;
   4737 		struct sockaddr_in new_sin = *si;
   4738 		struct sockaddr_in new_dst = *dest;
   4739 
   4740 		/*
   4741 		 * Scrub old routes now instead of calling in_ifinit with
   4742 		 * scrub=1, because we may change the dstaddr
   4743 		 * before the call to in_ifinit.
   4744 		 */
   4745 		in_ifscrub(ifp, ifatoia(ifa));
   4746 
   4747 		if (myaddr != 0)
   4748 			new_sin.sin_addr.s_addr = htonl(myaddr);
   4749 		if (hisaddr != 0) {
   4750 			new_dst.sin_addr.s_addr = htonl(hisaddr);
   4751 			if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) {
   4752 				sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
   4753 				*dest = new_dst; /* fix dstaddr in place */
   4754 			}
   4755 		}
   4756 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0);
   4757 		if(debug && error)
   4758 		{
   4759 			log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit "
   4760 			" failed, error=%d\n", SPP_ARGS(ifp), error);
   4761 		}
   4762 	}
   4763 }
   4764 
   4765 /*
   4766  * Clear IP addresses.  Must be called at splnet.
   4767  */
   4768 static void
   4769 sppp_clear_ip_addrs(struct sppp *sp)
   4770 {
   4771 	struct ifnet *ifp = &sp->pp_if;
   4772 	struct ifaddr *ifa;
   4773 	struct sockaddr_in *si;
   4774 	struct sockaddr_in *dest;
   4775 
   4776 	u_int32_t remote;
   4777 	if (sp->ipcp.flags & IPCP_HISADDR_DYN)
   4778 		remote = sp->ipcp.saved_hisaddr;
   4779 	else
   4780 		sppp_get_ip_addrs(sp, 0, &remote, 0);
   4781 
   4782 	/*
   4783 	 * Pick the first AF_INET address from the list,
   4784 	 * aliases don't make any sense on a p2p link anyway.
   4785 	 */
   4786 
   4787 	si = 0;
   4788 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
   4789 	{
   4790 		if (ifa->ifa_addr->sa_family == AF_INET)
   4791 		{
   4792 			si = (struct sockaddr_in *)ifa->ifa_addr;
   4793 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
   4794 			if (si)
   4795 				break;
   4796 		}
   4797 	}
   4798 
   4799 	if (ifa && si)
   4800 	{
   4801 		struct sockaddr_in new_sin = *si;
   4802 
   4803 		in_ifscrub(ifp, ifatoia(ifa));
   4804 		if (sp->ipcp.flags & IPCP_MYADDR_DYN)
   4805 			new_sin.sin_addr.s_addr = 0;
   4806 		if (sp->ipcp.flags & IPCP_HISADDR_DYN)
   4807 			/* replace peer addr in place */
   4808 			dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr;
   4809 		in_ifinit(ifp, ifatoia(ifa), &new_sin, 0);
   4810 	}
   4811 }
   4812 
   4813 #ifdef INET6
   4814 /*
   4815  * Get both IPv6 addresses.
   4816  */
   4817 static void
   4818 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
   4819 		   struct in6_addr *srcmask)
   4820 {
   4821 	struct ifnet *ifp = &sp->pp_if;
   4822 	struct ifaddr *ifa;
   4823 	struct sockaddr_in6 *si, *sm;
   4824 	struct in6_addr ssrc, ddst;
   4825 
   4826 	sm = NULL;
   4827 	memset(&ssrc, 0, sizeof(ssrc));
   4828 	memset(&ddst, 0, sizeof(ddst));
   4829 	/*
   4830 	 * Pick the first link-local AF_INET6 address from the list,
   4831 	 * aliases don't make any sense on a p2p link anyway.
   4832 	 */
   4833 	si = 0;
   4834 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
   4835 		if (ifa->ifa_addr->sa_family == AF_INET6) {
   4836 			si = (struct sockaddr_in6 *)ifa->ifa_addr;
   4837 			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
   4838 			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
   4839 				break;
   4840 		}
   4841 	if (ifa) {
   4842 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
   4843 			bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc));
   4844 			if (srcmask) {
   4845 				bcopy(&sm->sin6_addr, srcmask,
   4846 				    sizeof(*srcmask));
   4847 			}
   4848 		}
   4849 
   4850 		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
   4851 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
   4852 			bcopy(&si->sin6_addr, &ddst, sizeof(ddst));
   4853 	}
   4854 
   4855 	if (dst)
   4856 		bcopy(&ddst, dst, sizeof(*dst));
   4857 	if (src)
   4858 		bcopy(&ssrc, src, sizeof(*src));
   4859 }
   4860 
   4861 #ifdef IPV6CP_MYIFID_DYN
   4862 /*
   4863  * Generate random ifid.
   4864  */
   4865 static void
   4866 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
   4867 {
   4868 	/* TBD */
   4869 }
   4870 
   4871 /*
   4872  * Set my IPv6 address.  Must be called at splnet.
   4873  */
   4874 static void
   4875 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
   4876 {
   4877 	STDDCL;
   4878 	struct ifaddr *ifa;
   4879 	struct sockaddr_in6 *sin6;
   4880 
   4881 	/*
   4882 	 * Pick the first link-local AF_INET6 address from the list,
   4883 	 * aliases don't make any sense on a p2p link anyway.
   4884 	 */
   4885 
   4886 	sin6 = NULL;
   4887 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
   4888 	{
   4889 		if (ifa->ifa_addr->sa_family == AF_INET6)
   4890 		{
   4891 			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
   4892 			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
   4893 				break;
   4894 		}
   4895 	}
   4896 
   4897 	if (ifa && sin6)
   4898 	{
   4899 		int error;
   4900 		struct sockaddr_in6 new_sin6 = *sin6;
   4901 
   4902 		bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr));
   4903 		error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
   4904 		if (debug && error)
   4905 		{
   4906 			log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit "
   4907 			" failed, error=%d\n", SPP_ARGS(ifp), error);
   4908 		}
   4909 	}
   4910 }
   4911 #endif
   4912 
   4913 /*
   4914  * Suggest a candidate address to be used by peer.
   4915  */
   4916 static void
   4917 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
   4918 {
   4919 	struct in6_addr myaddr;
   4920 	struct timeval tv;
   4921 
   4922 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
   4923 
   4924 	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
   4925 	microtime(&tv);
   4926 	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
   4927 		myaddr.s6_addr[14] ^= 0xff;
   4928 		myaddr.s6_addr[15] ^= 0xff;
   4929 	} else {
   4930 		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
   4931 		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
   4932 	}
   4933 	if (suggest)
   4934 		bcopy(&myaddr, suggest, sizeof(myaddr));
   4935 }
   4936 #endif /*INET6*/
   4937 
   4938 /*
   4939  * Process ioctl requests specific to the PPP interface.
   4940  * Permissions have already been checked.
   4941  */
   4942 static int
   4943 sppp_params(struct sppp *sp, int cmd, void *data)
   4944 {
   4945 	switch (cmd) {
   4946 	case SPPPGETAUTHCFG:
   4947 	    {
   4948 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
   4949 		int error;
   4950 		size_t len;
   4951 
   4952 		cfg->myauthflags = sp->myauth.flags;
   4953 		cfg->hisauthflags = sp->hisauth.flags;
   4954 		strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ);
   4955 		cfg->hisauth = 0;
   4956 		if (sp->hisauth.proto)
   4957 		    cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   4958 		cfg->myauth = 0;
   4959 		if (sp->myauth.proto)
   4960 		    cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
   4961 		if (cfg->myname_length == 0) {
   4962 		    if (sp->myauth.name != NULL)
   4963 			cfg->myname_length = strlen(sp->myauth.name)+1;
   4964 		} else {
   4965 		    if (sp->myauth.name == NULL) {
   4966 			cfg->myname_length = 0;
   4967 		    } else {
   4968 			len = strlen(sp->myauth.name)+1;
   4969 			if (cfg->myname_length < len)
   4970 			    return (ENAMETOOLONG);
   4971 			error = copyout(sp->myauth.name, cfg->myname, len);
   4972 			if (error) return error;
   4973 		    }
   4974 		}
   4975 		if (cfg->hisname_length == 0) {
   4976 		    if(sp->hisauth.name != NULL)
   4977 			cfg->hisname_length = strlen(sp->hisauth.name)+1;
   4978 		} else {
   4979 		    if (sp->hisauth.name == NULL) {
   4980 		    	cfg->hisname_length = 0;
   4981 		    } else {
   4982 			len = strlen(sp->hisauth.name)+1;
   4983 			if (cfg->hisname_length < len)
   4984 			    return (ENAMETOOLONG);
   4985 			error = copyout(sp->hisauth.name, cfg->hisname, len);
   4986 			if (error) return error;
   4987 		    }
   4988 		}
   4989 	    }
   4990 	    break;
   4991 	case SPPPSETAUTHCFG:
   4992 	    {
   4993 		struct spppauthcfg *cfg = (struct spppauthcfg*)data;
   4994 		int error;
   4995 
   4996 		if (sp->myauth.name) {
   4997 			free(sp->myauth.name, M_DEVBUF);
   4998 			sp->myauth.name = NULL;
   4999 		}
   5000 		if (sp->myauth.secret) {
   5001 			free(sp->myauth.secret, M_DEVBUF);
   5002 			sp->myauth.secret = NULL;
   5003 		}
   5004 		if (sp->hisauth.name) {
   5005 			free(sp->hisauth.name, M_DEVBUF);
   5006 			sp->hisauth.name = NULL;
   5007 		}
   5008 		if (sp->hisauth.secret) {
   5009 			free(sp->hisauth.secret, M_DEVBUF);
   5010 			sp->hisauth.secret = NULL;
   5011 		}
   5012 
   5013 		if (cfg->hisname != NULL && cfg->hisname_length > 0) {
   5014 		    if (cfg->hisname_length >= MCLBYTES)
   5015 			return (ENAMETOOLONG);
   5016 		    sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK);
   5017 		    error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length);
   5018 		    if (error) {
   5019 			free(sp->hisauth.name, M_DEVBUF);
   5020 			sp->hisauth.name = NULL;
   5021 			return error;
   5022 		    }
   5023 		    sp->hisauth.name[cfg->hisname_length-1] = 0;
   5024 		}
   5025 		if (cfg->hissecret != NULL && cfg->hissecret_length > 0) {
   5026 		    if (cfg->hissecret_length >= MCLBYTES)
   5027 			return (ENAMETOOLONG);
   5028 		    sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK);
   5029 		    error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length);
   5030 		    if (error) {
   5031 		    	free(sp->hisauth.secret, M_DEVBUF);
   5032 		    	sp->hisauth.secret = NULL;
   5033 			return error;
   5034 		    }
   5035 		    sp->hisauth.secret[cfg->hissecret_length-1] = 0;
   5036 		}
   5037 		if (cfg->myname != NULL && cfg->myname_length > 0) {
   5038 		    if (cfg->myname_length >= MCLBYTES)
   5039 			return (ENAMETOOLONG);
   5040 		    sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK);
   5041 		    error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length);
   5042 		    if (error) {
   5043 			free(sp->myauth.name, M_DEVBUF);
   5044 			sp->myauth.name = NULL;
   5045 			return error;
   5046 		    }
   5047 		    sp->myauth.name[cfg->myname_length-1] = 0;
   5048 		}
   5049 		if (cfg->mysecret != NULL && cfg->mysecret_length > 0) {
   5050 		    if (cfg->mysecret_length >= MCLBYTES)
   5051 			return (ENAMETOOLONG);
   5052 		    sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK);
   5053 		    error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length);
   5054 		    if (error) {
   5055 		    	free(sp->myauth.secret, M_DEVBUF);
   5056 		    	sp->myauth.secret = NULL;
   5057 			return error;
   5058 		    }
   5059 		    sp->myauth.secret[cfg->mysecret_length-1] = 0;
   5060 		}
   5061 		sp->myauth.flags = cfg->myauthflags;
   5062 		if (cfg->myauth)
   5063 		    sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5064 		sp->hisauth.flags = cfg->hisauthflags;
   5065 		if (cfg->hisauth)
   5066 		    sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
   5067 		sp->pp_auth_failures = 0;
   5068 	    }
   5069 	    break;
   5070 	case SPPPGETLCPCFG:
   5071 	    {
   5072 	    	struct sppplcpcfg *lcp = (struct sppplcpcfg *)data;
   5073 	    	lcp->lcp_timeout = sp->lcp.timeout;
   5074 	    }
   5075 	    break;
   5076 	case SPPPSETLCPCFG:
   5077 	    {
   5078 	    	struct sppplcpcfg *lcp = (struct sppplcpcfg *)data;
   5079 	    	sp->lcp.timeout = lcp->lcp_timeout;
   5080 	    }
   5081 	    break;
   5082 	case SPPPGETSTATUS:
   5083 	    {
   5084 		struct spppstatus *status = (struct spppstatus *)data;
   5085 		status->phase = sp->pp_phase;
   5086 	    }
   5087 	    break;
   5088 	case SPPPGETIDLETO:
   5089 	    {
   5090 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5091 		to->idle_seconds = sp->pp_idle_timeout;
   5092 	    }
   5093 	    break;
   5094 	case SPPPSETIDLETO:
   5095 	    {
   5096 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
   5097 	    	sp->pp_idle_timeout = to->idle_seconds;
   5098 	    }
   5099 	    break;
   5100 	case SPPPSETAUTHFAILURE:
   5101 	    {
   5102 	    	struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data;
   5103 	    	sp->pp_max_auth_fail = afsettings->max_failures;
   5104 	    	sp->pp_auth_failures = 0;
   5105 	    }
   5106 	    break;
   5107 	case SPPPGETAUTHFAILURES:
   5108 	    {
   5109 	    	struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data;
   5110 	    	stats->auth_failures = sp->pp_auth_failures;
   5111 	    	stats->max_failures = sp->pp_max_auth_fail;
   5112 	    }
   5113 	    break;
   5114 	case SPPPSETDNSOPTS:
   5115 	    {
   5116 		struct spppdnssettings *req = (struct spppdnssettings*)data;
   5117 		sp->query_dns = req->query_dns & 3;
   5118 	    }
   5119 	    break;
   5120 	case SPPPGETDNSOPTS:
   5121 	    {
   5122 		struct spppdnssettings *req = (struct spppdnssettings*)data;
   5123 		req->query_dns = sp->query_dns;
   5124 	    }
   5125 	    break;
   5126 	case SPPPGETDNSADDRS:
   5127 	    {
   5128 	    	struct spppdnsaddrs *addrs = (struct spppdnsaddrs*)data;
   5129 	    	memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns);
   5130 	    }
   5131 	    break;
   5132 	default:
   5133 		return (EINVAL);
   5134 	}
   5135 
   5136 	return (0);
   5137 }
   5138 
   5139 static void
   5140 sppp_phase_network(struct sppp *sp)
   5141 {
   5142 	STDDCL;
   5143 	int i;
   5144 	u_int32_t mask;
   5145 
   5146 	sp->pp_phase = SPPP_PHASE_NETWORK;
   5147 
   5148 	if(debug)
   5149 	{
   5150 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
   5151 			sppp_phase_name(sp->pp_phase));
   5152 	}
   5153 
   5154 	/* Notify NCPs now. */
   5155 	for (i = 0; i < IDX_COUNT; i++)
   5156 		if ((cps[i])->flags & CP_NCP)
   5157 			(cps[i])->Open(sp);
   5158 
   5159 	/* Send Up events to all NCPs. */
   5160 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
   5161 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP))
   5162 			(cps[i])->Up(sp);
   5163 
   5164 	/* if no NCP is starting, all this was in vain, close down */
   5165 	sppp_lcp_check_and_close(sp);
   5166 }
   5167 
   5168 
   5169 static const char *
   5170 sppp_cp_type_name(u_char type)
   5171 {
   5172 	static char buf[12];
   5173 	switch (type) {
   5174 	case CONF_REQ:   return "conf-req";
   5175 	case CONF_ACK:   return "conf-ack";
   5176 	case CONF_NAK:   return "conf-nak";
   5177 	case CONF_REJ:   return "conf-rej";
   5178 	case TERM_REQ:   return "term-req";
   5179 	case TERM_ACK:   return "term-ack";
   5180 	case CODE_REJ:   return "code-rej";
   5181 	case PROTO_REJ:  return "proto-rej";
   5182 	case ECHO_REQ:   return "echo-req";
   5183 	case ECHO_REPLY: return "echo-reply";
   5184 	case DISC_REQ:   return "discard-req";
   5185 	}
   5186 	sprintf (buf, "0x%x", type);
   5187 	return buf;
   5188 }
   5189 
   5190 static const char *
   5191 sppp_auth_type_name(u_short proto, u_char type)
   5192 {
   5193 	static char buf[12];
   5194 	switch (proto) {
   5195 	case PPP_CHAP:
   5196 		switch (type) {
   5197 		case CHAP_CHALLENGE:	return "challenge";
   5198 		case CHAP_RESPONSE:	return "response";
   5199 		case CHAP_SUCCESS:	return "success";
   5200 		case CHAP_FAILURE:	return "failure";
   5201 		}
   5202 	case PPP_PAP:
   5203 		switch (type) {
   5204 		case PAP_REQ:		return "req";
   5205 		case PAP_ACK:		return "ack";
   5206 		case PAP_NAK:		return "nak";
   5207 		}
   5208 	}
   5209 	sprintf (buf, "0x%x", type);
   5210 	return buf;
   5211 }
   5212 
   5213 static const char *
   5214 sppp_lcp_opt_name(u_char opt)
   5215 {
   5216 	static char buf[12];
   5217 	switch (opt) {
   5218 	case LCP_OPT_MRU:		return "mru";
   5219 	case LCP_OPT_ASYNC_MAP:		return "async-map";
   5220 	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
   5221 	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
   5222 	case LCP_OPT_MAGIC:		return "magic";
   5223 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
   5224 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
   5225 	}
   5226 	sprintf (buf, "0x%x", opt);
   5227 	return buf;
   5228 }
   5229 
   5230 static const char *
   5231 sppp_ipcp_opt_name(u_char opt)
   5232 {
   5233 	static char buf[12];
   5234 	switch (opt) {
   5235 	case IPCP_OPT_ADDRESSES:	return "addresses";
   5236 	case IPCP_OPT_COMPRESSION:	return "compression";
   5237 	case IPCP_OPT_ADDRESS:		return "address";
   5238 	}
   5239 	sprintf (buf, "0x%x", opt);
   5240 	return buf;
   5241 }
   5242 
   5243 #ifdef INET6
   5244 static const char *
   5245 sppp_ipv6cp_opt_name(u_char opt)
   5246 {
   5247 	static char buf[12];
   5248 	switch (opt) {
   5249 	case IPV6CP_OPT_IFID:		return "ifid";
   5250 	case IPV6CP_OPT_COMPRESSION:	return "compression";
   5251 	}
   5252 	sprintf (buf, "0x%x", opt);
   5253 	return buf;
   5254 }
   5255 #endif
   5256 
   5257 static const char *
   5258 sppp_state_name(int state)
   5259 {
   5260 	switch (state) {
   5261 	case STATE_INITIAL:	return "initial";
   5262 	case STATE_STARTING:	return "starting";
   5263 	case STATE_CLOSED:	return "closed";
   5264 	case STATE_STOPPED:	return "stopped";
   5265 	case STATE_CLOSING:	return "closing";
   5266 	case STATE_STOPPING:	return "stopping";
   5267 	case STATE_REQ_SENT:	return "req-sent";
   5268 	case STATE_ACK_RCVD:	return "ack-rcvd";
   5269 	case STATE_ACK_SENT:	return "ack-sent";
   5270 	case STATE_OPENED:	return "opened";
   5271 	}
   5272 	return "illegal";
   5273 }
   5274 
   5275 static const char *
   5276 sppp_phase_name(int phase)
   5277 {
   5278 	switch (phase) {
   5279 	case SPPP_PHASE_DEAD:		return "dead";
   5280 	case SPPP_PHASE_ESTABLISH:	return "establish";
   5281 	case SPPP_PHASE_TERMINATE:	return "terminate";
   5282 	case SPPP_PHASE_AUTHENTICATE: 	return "authenticate";
   5283 	case SPPP_PHASE_NETWORK:	return "network";
   5284 	}
   5285 	return "illegal";
   5286 }
   5287 
   5288 static const char *
   5289 sppp_proto_name(u_short proto)
   5290 {
   5291 	static char buf[12];
   5292 	switch (proto) {
   5293 	case PPP_LCP:	return "lcp";
   5294 	case PPP_IPCP:	return "ipcp";
   5295 	case PPP_PAP:	return "pap";
   5296 	case PPP_CHAP:	return "chap";
   5297 	case PPP_IPV6CP: return "ipv6cp";
   5298 	}
   5299 	sprintf(buf, "0x%x", (unsigned)proto);
   5300 	return buf;
   5301 }
   5302 
   5303 static void
   5304 sppp_print_bytes(const u_char *p, u_short len)
   5305 {
   5306 	addlog(" %02x", *p++);
   5307 	while (--len > 0)
   5308 		addlog("-%02x", *p++);
   5309 }
   5310 
   5311 static void
   5312 sppp_print_string(const char *p, u_short len)
   5313 {
   5314 	u_char c;
   5315 
   5316 	while (len-- > 0) {
   5317 		c = *p++;
   5318 		/*
   5319 		 * Print only ASCII chars directly.  RFC 1994 recommends
   5320 		 * using only them, but we don't rely on it.  */
   5321 		if (c < ' ' || c > '~')
   5322 			addlog("\\x%x", c);
   5323 		else
   5324 			addlog("%c", c);
   5325 	}
   5326 }
   5327 
   5328 static const char *
   5329 sppp_dotted_quad(u_int32_t addr)
   5330 {
   5331 	static char s[16];
   5332 	sprintf(s, "%d.%d.%d.%d",
   5333 		(int)((addr >> 24) & 0xff),
   5334 		(int)((addr >> 16) & 0xff),
   5335 		(int)((addr >> 8) & 0xff),
   5336 		(int)(addr & 0xff));
   5337 	return s;
   5338 }
   5339 
   5340 /* a dummy, used to drop uninteresting events */
   5341 static void
   5342 sppp_null(struct sppp *unused)
   5343 {
   5344 	/* do just nothing */
   5345 }
   5346 /*
   5347  * This file is large.  Tell emacs to highlight it nevertheless.
   5348  *
   5349  * Local Variables:
   5350  * hilit-auto-highlight-maxout: 120000
   5351  * End:
   5352  */
   5353