if_spppsubr.c revision 1.201
1 /* $NetBSD: if_spppsubr.c,v 1.201 2020/11/25 09:46:05 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.201 2020/11/25 09:46:05 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #endif 52 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 73 #include <net/if.h> 74 #include <net/netisr.h> 75 #include <net/if_types.h> 76 #include <net/route.h> 77 #include <net/ppp_defs.h> 78 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/in_var.h> 82 #ifdef INET 83 #include <netinet/ip.h> 84 #include <netinet/tcp.h> 85 #endif 86 #include <net/ethertypes.h> 87 88 #ifdef INET6 89 #include <netinet6/scope6_var.h> 90 #endif 91 92 #include <net/if_sppp.h> 93 #include <net/if_spppvar.h> 94 95 #ifdef NET_MPSAFE 96 #define SPPPSUBR_MPSAFE 1 97 #endif 98 99 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 100 #define LOOPALIVECNT 3 /* loopback detection tries */ 101 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 102 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 103 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 104 105 #define FAILMSG "Failed..." 106 #define SUCCMSG "Welcome!" 107 108 /* 109 * Interface flags that can be set in an ifconfig command. 110 * 111 * Setting link0 will make the link passive, i.e. it will be marked 112 * as being administrative openable, but won't be opened to begin 113 * with. Incoming calls will be answered, or subsequent calls with 114 * -link1 will cause the administrative open of the LCP layer. 115 * 116 * Setting link1 will cause the link to auto-dial only as packets 117 * arrive to be sent. 118 * 119 * Setting IFF_DEBUG will syslog the option negotiation and state 120 * transitions at level kern.debug. Note: all logs consistently look 121 * like 122 * 123 * <if-name><unit>: <proto-name> <additional info...> 124 * 125 * with <if-name><unit> being something like "bppp0", and <proto-name> 126 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 127 */ 128 129 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 130 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 131 132 #define CONF_REQ 1 /* PPP configure request */ 133 #define CONF_ACK 2 /* PPP configure acknowledge */ 134 #define CONF_NAK 3 /* PPP configure negative ack */ 135 #define CONF_REJ 4 /* PPP configure reject */ 136 #define TERM_REQ 5 /* PPP terminate request */ 137 #define TERM_ACK 6 /* PPP terminate acknowledge */ 138 #define CODE_REJ 7 /* PPP code reject */ 139 #define PROTO_REJ 8 /* PPP protocol reject */ 140 #define ECHO_REQ 9 /* PPP echo request */ 141 #define ECHO_REPLY 10 /* PPP echo reply */ 142 #define DISC_REQ 11 /* PPP discard request */ 143 144 #define LCP_OPT_MRU 1 /* maximum receive unit */ 145 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 146 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 147 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 148 #define LCP_OPT_MAGIC 5 /* magic number */ 149 #define LCP_OPT_RESERVED 6 /* reserved */ 150 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 151 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 152 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 153 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 154 #define LCP_OPT_CALL_BACK 13 /* callback */ 155 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 156 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 157 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 158 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 159 160 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 161 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 162 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 163 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 164 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 165 166 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 167 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 168 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 169 170 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 171 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 172 173 #define PAP_REQ 1 /* PAP name/password request */ 174 #define PAP_ACK 2 /* PAP acknowledge */ 175 #define PAP_NAK 3 /* PAP fail */ 176 177 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 178 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 179 #define CHAP_SUCCESS 3 /* CHAP response ok */ 180 #define CHAP_FAILURE 4 /* CHAP response failed */ 181 182 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 183 184 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 185 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 186 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 187 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 188 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 189 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 190 191 /* states are named and numbered according to RFC 1661 */ 192 #define STATE_INITIAL 0 193 #define STATE_STARTING 1 194 #define STATE_CLOSED 2 195 #define STATE_STOPPED 3 196 #define STATE_CLOSING 4 197 #define STATE_STOPPING 5 198 #define STATE_REQ_SENT 6 199 #define STATE_ACK_RCVD 7 200 #define STATE_ACK_SENT 8 201 #define STATE_OPENED 9 202 203 struct ppp_header { 204 uint8_t address; 205 uint8_t control; 206 uint16_t protocol; 207 } __packed; 208 #define PPP_HEADER_LEN sizeof (struct ppp_header) 209 210 struct lcp_header { 211 uint8_t type; 212 uint8_t ident; 213 uint16_t len; 214 } __packed; 215 #define LCP_HEADER_LEN sizeof (struct lcp_header) 216 217 struct cisco_packet { 218 uint32_t type; 219 uint32_t par1; 220 uint32_t par2; 221 uint16_t rel; 222 uint16_t time0; 223 uint16_t time1; 224 } __packed; 225 #define CISCO_PACKET_LEN 18 226 227 /* 228 * We follow the spelling and capitalization of RFC 1661 here, to make 229 * it easier comparing with the standard. Please refer to this RFC in 230 * case you can't make sense out of these abbreviation; it will also 231 * explain the semantics related to the various events and actions. 232 */ 233 struct cp { 234 u_short proto; /* PPP control protocol number */ 235 u_char protoidx; /* index into state table in struct sppp */ 236 u_char flags; 237 #define CP_LCP 0x01 /* this is the LCP */ 238 #define CP_AUTH 0x02 /* this is an authentication protocol */ 239 #define CP_NCP 0x04 /* this is a NCP */ 240 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 241 const char *name; /* name of this control protocol */ 242 /* event handlers */ 243 void (*Up)(struct sppp *, void *); 244 void (*Down)(struct sppp *, void *); 245 void (*Open)(struct sppp *, void *); 246 void (*Close)(struct sppp *, void *); 247 void (*TO)(struct sppp *, void *); 248 int (*RCR)(struct sppp *, struct lcp_header *, int); 249 void (*RCN_rej)(struct sppp *, struct lcp_header *, int); 250 void (*RCN_nak)(struct sppp *, struct lcp_header *, int); 251 /* actions */ 252 void (*tlu)(struct sppp *sp); 253 void (*tld)(struct sppp *sp); 254 void (*tls)(struct sppp *sp); 255 void (*tlf)(struct sppp *sp); 256 void (*scr)(struct sppp *sp); 257 void (*scan)(const struct cp *, struct sppp *); 258 }; 259 260 enum auth_role { 261 SPPP_AUTH_NOROLE = 0, 262 SPPP_AUTH_SERV = __BIT(0), 263 SPPP_AUTH_PEER = __BIT(1), 264 }; 265 266 static struct sppp *spppq; 267 static kmutex_t *spppq_lock = NULL; 268 static callout_t keepalive_ch; 269 270 #define SPPPQ_LOCK() if (spppq_lock) \ 271 mutex_enter(spppq_lock); 272 #define SPPPQ_UNLOCK() if (spppq_lock) \ 273 mutex_exit(spppq_lock); 274 275 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 276 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 277 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 278 #define SPPP_UPGRADE(_sp) do{ \ 279 SPPP_UNLOCK(_sp); \ 280 SPPP_LOCK(_sp, RW_WRITER); \ 281 }while (0) 282 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 283 #define SPPP_WQ_SET(_wk, _func, _arg) \ 284 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 285 286 #ifdef INET 287 #ifndef SPPPSUBR_MPSAFE 288 /* 289 * The following disgusting hack gets around the problem that IP TOS 290 * can't be set yet. We want to put "interactive" traffic on a high 291 * priority queue. To decide if traffic is interactive, we check that 292 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 293 * 294 * XXX is this really still necessary? - joerg - 295 */ 296 static u_short interactive_ports[8] = { 297 0, 513, 0, 0, 298 0, 21, 0, 23, 299 }; 300 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 301 #endif /* SPPPSUBR_MPSAFE */ 302 #endif 303 304 /* almost every function needs these */ 305 #define STDDCL \ 306 struct ifnet *ifp = &sp->pp_if; \ 307 int debug = ifp->if_flags & IFF_DEBUG 308 309 static int sppp_output(struct ifnet *, struct mbuf *, 310 const struct sockaddr *, const struct rtentry *); 311 312 static void sppp_cisco_send(struct sppp *, int, int32_t, int32_t); 313 static void sppp_cisco_input(struct sppp *, struct mbuf *); 314 315 static void sppp_cp_init(const struct cp *, struct sppp *); 316 static void sppp_cp_fini(const struct cp *, struct sppp *); 317 static void sppp_cp_input(const struct cp *, struct sppp *, 318 struct mbuf *); 319 static void sppp_cp_input(const struct cp *, struct sppp *, 320 struct mbuf *); 321 static void sppp_cp_send(struct sppp *, u_short, u_char, 322 u_char, u_short, void *); 323 /* static void sppp_cp_timeout(void *arg); */ 324 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 325 static struct workqueue * 326 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 327 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 328 static void sppp_wq_set(struct sppp_work *, 329 void (*)(struct sppp *, void *), void *); 330 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 331 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 332 static void sppp_cp_to_lcp(void *); 333 static void sppp_cp_to_ipcp(void *); 334 static void sppp_cp_to_ipv6cp(void *); 335 static void sppp_auth_send(const struct cp *, struct sppp *, 336 unsigned int, unsigned int, ...); 337 static int sppp_auth_role(const struct cp *, struct sppp *); 338 static void sppp_auth_to_event(const struct cp *, struct sppp *); 339 340 static void sppp_up_event(struct sppp *, void *); 341 static void sppp_down_event(struct sppp *, void *); 342 static void sppp_open_event(struct sppp *, void *); 343 static void sppp_close_event(struct sppp *, void *); 344 static void sppp_to_event(struct sppp *, void *); 345 static void sppp_rcr_event(struct sppp *, void *); 346 static void sppp_rca_event(struct sppp *, void *); 347 static void sppp_rcn_event(struct sppp *, void *); 348 static void sppp_rtr_event(struct sppp *, void *); 349 static void sppp_rta_event(struct sppp *, void *); 350 static void sppp_rxj_event(struct sppp *, void *); 351 352 static void sppp_null(struct sppp *); 353 static void sppp_sca_scn(const struct cp *, struct sppp *); 354 static void sppp_ifdown(struct sppp *, void *); 355 356 static void sppp_lcp_init(struct sppp *); 357 static void sppp_lcp_up(struct sppp *, void *); 358 static void sppp_lcp_down(struct sppp *, void *); 359 static void sppp_lcp_open(struct sppp *, void *); 360 static void sppp_lcp_close(struct sppp *, void *); 361 static void sppp_lcp_TO(struct sppp *, void *); 362 static int sppp_lcp_RCR(struct sppp *, struct lcp_header *, int); 363 static void sppp_lcp_RCN_rej(struct sppp *, struct lcp_header *, int); 364 static void sppp_lcp_RCN_nak(struct sppp *, struct lcp_header *, int); 365 static void sppp_lcp_tlu(struct sppp *); 366 static void sppp_lcp_tld(struct sppp *); 367 static void sppp_lcp_tls(struct sppp *); 368 static void sppp_lcp_tlf(struct sppp *); 369 static void sppp_lcp_scr(struct sppp *); 370 static void sppp_lcp_check_and_close(struct sppp *); 371 static int sppp_ncp_check(struct sppp *); 372 static int sppp_auth_check(struct sppp *); 373 374 static void sppp_ipcp_init(struct sppp *); 375 static void sppp_ipcp_up(struct sppp *, void *); 376 static void sppp_ipcp_down(struct sppp *, void *); 377 static void sppp_ipcp_open(struct sppp *, void *); 378 static void sppp_ipcp_close(struct sppp *, void *); 379 static void sppp_ipcp_TO(struct sppp *, void *); 380 static int sppp_ipcp_RCR(struct sppp *, struct lcp_header *, int); 381 static void sppp_ipcp_RCN_rej(struct sppp *, struct lcp_header *, int); 382 static void sppp_ipcp_RCN_nak(struct sppp *, struct lcp_header *, int); 383 static void sppp_ipcp_tlu(struct sppp *); 384 static void sppp_ipcp_tld(struct sppp *); 385 static void sppp_ipcp_tls(struct sppp *); 386 static void sppp_ipcp_tlf(struct sppp *); 387 static void sppp_ipcp_scr(struct sppp *); 388 389 static void sppp_ipv6cp_init(struct sppp *); 390 static void sppp_ipv6cp_up(struct sppp *, void *); 391 static void sppp_ipv6cp_down(struct sppp *, void *); 392 static void sppp_ipv6cp_open(struct sppp *, void *); 393 static void sppp_ipv6cp_close(struct sppp *, void *); 394 static void sppp_ipv6cp_TO(struct sppp *, void *); 395 static int sppp_ipv6cp_RCR(struct sppp *, struct lcp_header *, int); 396 static void sppp_ipv6cp_RCN_rej(struct sppp *, struct lcp_header *, int); 397 static void sppp_ipv6cp_RCN_nak(struct sppp *, struct lcp_header *, int); 398 static void sppp_ipv6cp_tlu(struct sppp *); 399 static void sppp_ipv6cp_tld(struct sppp *); 400 static void sppp_ipv6cp_tls(struct sppp *); 401 static void sppp_ipv6cp_tlf(struct sppp *); 402 static void sppp_ipv6cp_scr(struct sppp *); 403 404 static void sppp_pap_input(struct sppp *, struct mbuf *); 405 static void sppp_pap_init(struct sppp *); 406 static void sppp_pap_up(struct sppp *, void *); 407 static void sppp_pap_down(struct sppp *, void *); 408 static void sppp_pap_open(struct sppp *, void *); 409 static void sppp_pap_close(struct sppp *, void *); 410 static void sppp_pap_TO(struct sppp *, void *); 411 static void sppp_pap_tls(struct sppp *); 412 static void sppp_pap_tlf(struct sppp *); 413 static void sppp_pap_tlu(struct sppp *); 414 static void sppp_pap_scr(struct sppp *); 415 static void sppp_pap_scr(struct sppp *); 416 static void sppp_pap_scan(const struct cp *, struct sppp *); 417 418 static void sppp_chap_input(struct sppp *, struct mbuf *); 419 static void sppp_chap_init(struct sppp *); 420 static void sppp_chap_up(struct sppp *, void *); 421 static void sppp_chap_down(struct sppp *, void *); 422 static void sppp_chap_open(struct sppp *, void *); 423 static void sppp_chap_close(struct sppp *, void *); 424 static void sppp_chap_TO(struct sppp *, void *); 425 static void sppp_chap_tlu(struct sppp *); 426 static void sppp_chap_tls(struct sppp *); 427 static void sppp_chap_tlf(struct sppp *); 428 static void sppp_chap_scr(struct sppp *); 429 static void sppp_chap_scan(const struct cp *, struct sppp *); 430 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 431 432 static const char *sppp_auth_type_name(u_short, u_char); 433 static const char *sppp_cp_type_name(u_char); 434 static const char *sppp_dotted_quad(uint32_t); 435 static const char *sppp_ipcp_opt_name(u_char); 436 #ifdef INET6 437 static const char *sppp_ipv6cp_opt_name(u_char); 438 #endif 439 static const char *sppp_lcp_opt_name(u_char); 440 static const char *sppp_phase_name(int); 441 static const char *sppp_proto_name(u_short); 442 static const char *sppp_state_name(int); 443 static int sppp_params(struct sppp *, u_long, void *); 444 #ifdef INET 445 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 446 static void sppp_set_ip_addrs_work(struct work *, struct sppp *); 447 static void sppp_set_ip_addrs(struct sppp *); 448 static void sppp_clear_ip_addrs_work(struct work *, struct sppp *); 449 static void sppp_clear_ip_addrs(struct sppp *); 450 static void sppp_update_ip_addrs_work(struct work *, void *); 451 #endif 452 static void sppp_keepalive(void *); 453 static void sppp_phase_network(struct sppp *); 454 static void sppp_print_bytes(const u_char *, u_short); 455 static void sppp_print_string(const char *, u_short); 456 #ifdef INET6 457 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 458 struct in6_addr *, struct in6_addr *); 459 #ifdef IPV6CP_MYIFID_DYN 460 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 461 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 462 #endif 463 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 464 #endif 465 466 static void sppp_notify_up(struct sppp *); 467 static void sppp_notify_down(struct sppp *); 468 static void sppp_notify_tls_wlocked(struct sppp *); 469 static void sppp_notify_tlf_wlocked(struct sppp *); 470 #ifdef INET6 471 static void sppp_notify_con_wlocked(struct sppp *); 472 #endif 473 static void sppp_notify_con(struct sppp *); 474 475 static void sppp_notify_chg_wlocked(struct sppp *); 476 477 478 /* our control protocol descriptors */ 479 static const struct cp lcp = { 480 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 481 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 482 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 483 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 484 sppp_lcp_scr, sppp_sca_scn 485 }; 486 487 static const struct cp ipcp = { 488 PPP_IPCP, IDX_IPCP, 489 #ifdef INET 490 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 491 #else 492 0, 493 #endif 494 "ipcp", 495 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 496 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 497 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 498 sppp_ipcp_scr, sppp_sca_scn 499 }; 500 501 static const struct cp ipv6cp = { 502 PPP_IPV6CP, IDX_IPV6CP, 503 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 504 CP_NCP, 505 #else 506 0, 507 #endif 508 "ipv6cp", 509 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 510 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 511 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 512 sppp_ipv6cp_scr, sppp_sca_scn 513 }; 514 515 static const struct cp pap = { 516 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 517 sppp_pap_up, sppp_pap_down, sppp_pap_open, sppp_pap_close, 518 sppp_pap_TO, 0, 0, 0, 519 sppp_pap_tlu, sppp_null, sppp_pap_tls, sppp_pap_tlf, 520 sppp_pap_scr, sppp_pap_scan 521 }; 522 523 static const struct cp chap = { 524 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 525 sppp_chap_up, sppp_chap_down, sppp_chap_open, sppp_chap_close, 526 sppp_chap_TO, 0, 0, 0, 527 sppp_chap_tlu, sppp_null, sppp_chap_tls, sppp_chap_tlf, 528 sppp_chap_scr, sppp_chap_scan 529 }; 530 531 static const struct cp *cps[IDX_COUNT] = { 532 &lcp, /* IDX_LCP */ 533 &ipcp, /* IDX_IPCP */ 534 &ipv6cp, /* IDX_IPV6CP */ 535 &pap, /* IDX_PAP */ 536 &chap, /* IDX_CHAP */ 537 }; 538 539 static void 540 sppp_change_phase(struct sppp *sp, int phase) 541 { 542 STDDCL; 543 544 KASSERT(SPPP_WLOCKED(sp)); 545 546 if (sp->pp_phase == phase) 547 return; 548 549 sp->pp_phase = phase; 550 551 if (phase == SPPP_PHASE_NETWORK) 552 if_link_state_change(ifp, LINK_STATE_UP); 553 else 554 if_link_state_change(ifp, LINK_STATE_DOWN); 555 556 if (debug) 557 { 558 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 559 sppp_phase_name(sp->pp_phase)); 560 } 561 } 562 563 /* 564 * Exported functions, comprising our interface to the lower layer. 565 */ 566 567 /* 568 * Process the received packet. 569 */ 570 void 571 sppp_input(struct ifnet *ifp, struct mbuf *m) 572 { 573 struct ppp_header *h = NULL; 574 pktqueue_t *pktq = NULL; 575 struct ifqueue *inq = NULL; 576 uint16_t protocol; 577 struct sppp *sp = (struct sppp *)ifp; 578 int debug = ifp->if_flags & IFF_DEBUG; 579 int isr = 0; 580 581 SPPP_LOCK(sp, RW_READER); 582 583 if (ifp->if_flags & IFF_UP) { 584 /* Count received bytes, add hardware framing */ 585 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 586 /* Note time of last receive */ 587 sp->pp_last_receive = time_uptime; 588 } 589 590 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 591 /* Too small packet, drop it. */ 592 if (debug) 593 log(LOG_DEBUG, 594 "%s: input packet is too small, %d bytes\n", 595 ifp->if_xname, m->m_pkthdr.len); 596 drop: 597 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 598 m_freem(m); 599 SPPP_UNLOCK(sp); 600 return; 601 } 602 603 if (sp->pp_flags & PP_NOFRAMING) { 604 memcpy(&protocol, mtod(m, void *), 2); 605 protocol = ntohs(protocol); 606 m_adj(m, 2); 607 } else { 608 609 /* Get PPP header. */ 610 h = mtod(m, struct ppp_header *); 611 m_adj(m, PPP_HEADER_LEN); 612 613 switch (h->address) { 614 case PPP_ALLSTATIONS: 615 if (h->control != PPP_UI) 616 goto invalid; 617 if (sp->pp_flags & PP_CISCO) { 618 if (debug) 619 log(LOG_DEBUG, 620 "%s: PPP packet in Cisco mode " 621 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 622 ifp->if_xname, 623 h->address, h->control, ntohs(h->protocol)); 624 goto drop; 625 } 626 break; 627 case CISCO_MULTICAST: 628 case CISCO_UNICAST: 629 /* Don't check the control field here (RFC 1547). */ 630 if (! (sp->pp_flags & PP_CISCO)) { 631 if (debug) 632 log(LOG_DEBUG, 633 "%s: Cisco packet in PPP mode " 634 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 635 ifp->if_xname, 636 h->address, h->control, ntohs(h->protocol)); 637 goto drop; 638 } 639 switch (ntohs(h->protocol)) { 640 default: 641 if_statinc(ifp, if_noproto); 642 goto invalid; 643 case CISCO_KEEPALIVE: 644 SPPP_UNLOCK(sp); 645 sppp_cisco_input((struct sppp *) ifp, m); 646 m_freem(m); 647 return; 648 #ifdef INET 649 case ETHERTYPE_IP: 650 pktq = ip_pktq; 651 break; 652 #endif 653 #ifdef INET6 654 case ETHERTYPE_IPV6: 655 pktq = ip6_pktq; 656 break; 657 #endif 658 } 659 goto queue_pkt; 660 default: /* Invalid PPP packet. */ 661 invalid: 662 if (debug) 663 log(LOG_DEBUG, 664 "%s: invalid input packet " 665 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 666 ifp->if_xname, 667 h->address, h->control, ntohs(h->protocol)); 668 goto drop; 669 } 670 protocol = ntohs(h->protocol); 671 } 672 673 switch (protocol) { 674 default: 675 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 676 uint16_t prot = htons(protocol); 677 678 SPPP_UPGRADE(sp); 679 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 680 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 681 &prot); 682 SPPP_DOWNGRADE(sp); 683 } 684 if (debug) 685 log(LOG_DEBUG, 686 "%s: invalid input protocol " 687 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 688 if_statinc(ifp, if_noproto); 689 goto drop; 690 case PPP_LCP: 691 SPPP_UNLOCK(sp); 692 sppp_cp_input(&lcp, sp, m); 693 m_freem(m); 694 return; 695 case PPP_PAP: 696 SPPP_UNLOCK(sp); 697 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 698 sppp_pap_input(sp, m); 699 } 700 m_freem(m); 701 return; 702 case PPP_CHAP: 703 SPPP_UNLOCK(sp); 704 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 705 sppp_chap_input(sp, m); 706 } 707 m_freem(m); 708 return; 709 #ifdef INET 710 case PPP_IPCP: 711 SPPP_UNLOCK(sp); 712 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 713 sppp_cp_input(&ipcp, sp, m); 714 } 715 m_freem(m); 716 return; 717 case PPP_IP: 718 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 719 sp->pp_last_activity = time_uptime; 720 pktq = ip_pktq; 721 } 722 break; 723 #endif 724 #ifdef INET6 725 case PPP_IPV6CP: 726 SPPP_UNLOCK(sp); 727 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 728 sppp_cp_input(&ipv6cp, sp, m); 729 } 730 m_freem(m); 731 return; 732 733 case PPP_IPV6: 734 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 735 sp->pp_last_activity = time_uptime; 736 pktq = ip6_pktq; 737 } 738 break; 739 #endif 740 } 741 742 queue_pkt: 743 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 744 goto drop; 745 } 746 747 /* Check queue. */ 748 if (__predict_true(pktq)) { 749 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 750 goto drop; 751 } 752 SPPP_UNLOCK(sp); 753 return; 754 } 755 756 SPPP_UNLOCK(sp); 757 758 IFQ_LOCK(inq); 759 if (IF_QFULL(inq)) { 760 /* Queue overflow. */ 761 IF_DROP(inq); 762 IFQ_UNLOCK(inq); 763 if (debug) 764 log(LOG_DEBUG, "%s: protocol queue overflow\n", 765 ifp->if_xname); 766 767 SPPP_LOCK(sp, RW_READER); 768 goto drop; 769 } 770 IF_ENQUEUE(inq, m); 771 IFQ_UNLOCK(inq); 772 schednetisr(isr); 773 } 774 775 /* 776 * Enqueue transmit packet. 777 */ 778 static int 779 sppp_output(struct ifnet *ifp, struct mbuf *m, 780 const struct sockaddr *dst, const struct rtentry *rt) 781 { 782 struct sppp *sp = (struct sppp *) ifp; 783 struct ppp_header *h = NULL; 784 #ifndef SPPPSUBR_MPSAFE 785 struct ifqueue *ifq = NULL; /* XXX */ 786 #endif 787 int s, error = 0; 788 uint16_t protocol; 789 size_t pktlen; 790 791 s = splnet(); 792 SPPP_LOCK(sp, RW_READER); 793 794 sp->pp_last_activity = time_uptime; 795 796 if ((ifp->if_flags & IFF_UP) == 0 || 797 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 798 SPPP_UNLOCK(sp); 799 splx(s); 800 801 m_freem(m); 802 803 return (ENETDOWN); 804 } 805 806 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 807 /* 808 * Interface is not yet running, but auto-dial. Need 809 * to start LCP for it. 810 */ 811 ifp->if_flags |= IFF_RUNNING; 812 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 813 } 814 815 /* 816 * If the queueing discipline needs packet classification, 817 * do it before prepending link headers. 818 */ 819 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 820 821 #ifdef INET 822 if (dst->sa_family == AF_INET) { 823 struct ip *ip = NULL; 824 #ifndef SPPPSUBR_MPSAFE 825 struct tcphdr *th = NULL; 826 #endif 827 828 if (m->m_len >= sizeof(struct ip)) { 829 ip = mtod(m, struct ip *); 830 #ifndef SPPPSUBR_MPSAFE 831 if (ip->ip_p == IPPROTO_TCP && 832 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 833 sizeof(struct tcphdr)) { 834 th = (struct tcphdr *) 835 ((char *)ip + (ip->ip_hl << 2)); 836 } 837 #endif 838 } else 839 ip = NULL; 840 841 /* 842 * When using dynamic local IP address assignment by using 843 * 0.0.0.0 as a local address, the first TCP session will 844 * not connect because the local TCP checksum is computed 845 * using 0.0.0.0 which will later become our real IP address 846 * so the TCP checksum computed at the remote end will 847 * become invalid. So we 848 * - don't let packets with src ip addr 0 thru 849 * - we flag TCP packets with src ip 0 as an error 850 */ 851 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 852 uint8_t proto = ip->ip_p; 853 854 SPPP_UNLOCK(sp); 855 splx(s); 856 857 m_freem(m); 858 if (proto == IPPROTO_TCP) 859 return (EADDRNOTAVAIL); 860 else 861 return (0); 862 } 863 864 #ifndef SPPPSUBR_MPSAFE 865 /* 866 * Put low delay, telnet, rlogin and ftp control packets 867 * in front of the queue. 868 */ 869 if (!IF_QFULL(&sp->pp_fastq) && 870 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 871 (th && (INTERACTIVE(ntohs(th->th_sport)) || 872 INTERACTIVE(ntohs(th->th_dport)))))) 873 ifq = &sp->pp_fastq; 874 #endif /* !SPPPSUBR_MPSAFE */ 875 } 876 #endif 877 878 #ifdef INET6 879 if (dst->sa_family == AF_INET6) { 880 /* XXX do something tricky here? */ 881 } 882 #endif 883 884 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 885 /* 886 * Prepend general data packet PPP header. For now, IP only. 887 */ 888 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 889 if (! m) { 890 if (ifp->if_flags & IFF_DEBUG) 891 log(LOG_DEBUG, "%s: no memory for transmit header\n", 892 ifp->if_xname); 893 if_statinc(ifp, if_oerrors); 894 SPPP_UNLOCK(sp); 895 splx(s); 896 return (ENOBUFS); 897 } 898 /* 899 * May want to check size of packet 900 * (albeit due to the implementation it's always enough) 901 */ 902 h = mtod(m, struct ppp_header *); 903 if (sp->pp_flags & PP_CISCO) { 904 h->address = CISCO_UNICAST; /* unicast address */ 905 h->control = 0; 906 } else { 907 h->address = PPP_ALLSTATIONS; /* broadcast address */ 908 h->control = PPP_UI; /* Unnumbered Info */ 909 } 910 } 911 912 switch (dst->sa_family) { 913 #ifdef INET 914 case AF_INET: /* Internet Protocol */ 915 if (sp->pp_flags & PP_CISCO) 916 protocol = htons(ETHERTYPE_IP); 917 else { 918 /* 919 * Don't choke with an ENETDOWN early. It's 920 * possible that we just started dialing out, 921 * so don't drop the packet immediately. If 922 * we notice that we run out of buffer space 923 * below, we will however remember that we are 924 * not ready to carry IP packets, and return 925 * ENETDOWN, as opposed to ENOBUFS. 926 */ 927 protocol = htons(PPP_IP); 928 if (sp->scp[IDX_IPCP].state != STATE_OPENED) 929 error = ENETDOWN; 930 } 931 break; 932 #endif 933 #ifdef INET6 934 case AF_INET6: /* Internet Protocol version 6 */ 935 if (sp->pp_flags & PP_CISCO) 936 protocol = htons(ETHERTYPE_IPV6); 937 else { 938 /* 939 * Don't choke with an ENETDOWN early. It's 940 * possible that we just started dialing out, 941 * so don't drop the packet immediately. If 942 * we notice that we run out of buffer space 943 * below, we will however remember that we are 944 * not ready to carry IP packets, and return 945 * ENETDOWN, as opposed to ENOBUFS. 946 */ 947 protocol = htons(PPP_IPV6); 948 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) 949 error = ENETDOWN; 950 } 951 break; 952 #endif 953 default: 954 m_freem(m); 955 if_statinc(ifp, if_oerrors); 956 SPPP_UNLOCK(sp); 957 splx(s); 958 return (EAFNOSUPPORT); 959 } 960 961 if (sp->pp_flags & PP_NOFRAMING) { 962 M_PREPEND(m, 2, M_DONTWAIT); 963 if (m == NULL) { 964 if (ifp->if_flags & IFF_DEBUG) 965 log(LOG_DEBUG, "%s: no memory for transmit header\n", 966 ifp->if_xname); 967 if_statinc(ifp, if_oerrors); 968 SPPP_UNLOCK(sp); 969 splx(s); 970 return (ENOBUFS); 971 } 972 *mtod(m, uint16_t *) = protocol; 973 } else { 974 h->protocol = protocol; 975 } 976 977 pktlen = m->m_pkthdr.len; 978 #ifdef SPPPSUBR_MPSAFE 979 SPPP_UNLOCK(sp); 980 error = if_transmit_lock(ifp, m); 981 SPPP_LOCK(sp, RW_READER); 982 if (error == 0) 983 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 984 #else /* !SPPPSUBR_MPSAFE */ 985 error = ifq_enqueue2(ifp, ifq, m); 986 987 if (error == 0) { 988 /* 989 * Count output packets and bytes. 990 * The packet length includes header + additional hardware 991 * framing according to RFC 1333. 992 */ 993 if (!(ifp->if_flags & IFF_OACTIVE)) { 994 SPPP_UNLOCK(sp); 995 if_start_lock(ifp); 996 SPPP_LOCK(sp, RW_READER); 997 } 998 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 999 } 1000 #endif /* !SPPPSUBR_MPSAFE */ 1001 SPPP_UNLOCK(sp); 1002 splx(s); 1003 return error; 1004 } 1005 1006 void 1007 sppp_attach(struct ifnet *ifp) 1008 { 1009 struct sppp *sp = (struct sppp *) ifp; 1010 char xnamebuf[MAXCOMLEN]; 1011 1012 /* Initialize keepalive handler. */ 1013 if (! spppq) { 1014 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1015 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1016 } 1017 1018 if (! spppq_lock) 1019 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1020 1021 sp->pp_if.if_type = IFT_PPP; 1022 sp->pp_if.if_output = sppp_output; 1023 sp->pp_fastq.ifq_maxlen = 32; 1024 sp->pp_cpq.ifq_maxlen = 20; 1025 sp->pp_loopcnt = 0; 1026 sp->pp_alivecnt = 0; 1027 sp->pp_last_activity = 0; 1028 sp->pp_last_receive = 0; 1029 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1030 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 1031 sp->pp_idle_timeout = 0; 1032 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1033 sp->pp_phase = SPPP_PHASE_DEAD; 1034 sp->pp_up = sppp_notify_up; 1035 sp->pp_down = sppp_notify_down; 1036 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1037 memset(sp->scp, 0, sizeof(sp->scp)); 1038 rw_init(&sp->pp_lock); 1039 1040 if_alloc_sadl(ifp); 1041 1042 /* Lets not beat about the bush, we know we're down. */ 1043 ifp->if_link_state = LINK_STATE_DOWN; 1044 1045 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1046 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1047 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1048 1049 memset(&sp->myauth, 0, sizeof sp->myauth); 1050 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1051 SPPP_LOCK(sp, RW_WRITER); 1052 sppp_lcp_init(sp); 1053 sppp_ipcp_init(sp); 1054 sppp_ipv6cp_init(sp); 1055 sppp_pap_init(sp); 1056 sppp_chap_init(sp); 1057 SPPP_UNLOCK(sp); 1058 1059 SPPPQ_LOCK(); 1060 /* Insert new entry into the keepalive list. */ 1061 sp->pp_next = spppq; 1062 spppq = sp; 1063 SPPPQ_UNLOCK(); 1064 } 1065 1066 void 1067 sppp_detach(struct ifnet *ifp) 1068 { 1069 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1070 1071 /* Remove the entry from the keepalive list. */ 1072 SPPPQ_LOCK(); 1073 for (q = &spppq; (p = *q); q = &p->pp_next) 1074 if (p == sp) { 1075 *q = p->pp_next; 1076 break; 1077 } 1078 SPPPQ_UNLOCK(); 1079 1080 if (! spppq) { 1081 /* Stop keepalive handler. */ 1082 callout_stop(&keepalive_ch); 1083 mutex_obj_free(spppq_lock); 1084 spppq_lock = NULL; 1085 } 1086 1087 SPPP_LOCK(sp, RW_WRITER); 1088 1089 /* to avoid workqueue enqueued */ 1090 atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1); 1091 workqueue_wait(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk); 1092 workqueue_destroy(sp->ipcp.update_addrs_wq); 1093 pcq_destroy(sp->ipcp.update_addrs_q); 1094 1095 sppp_cp_fini(&lcp, sp); 1096 sppp_cp_fini(&ipcp, sp); 1097 sppp_cp_fini(&pap, sp); 1098 sppp_cp_fini(&chap, sp); 1099 #ifdef INET6 1100 sppp_cp_fini(&ipv6cp, sp); 1101 #endif 1102 sppp_wq_destroy(sp, sp->wq_cp); 1103 1104 /* free authentication info */ 1105 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1106 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1107 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1108 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1109 SPPP_UNLOCK(sp); 1110 rw_destroy(&sp->pp_lock); 1111 } 1112 1113 /* 1114 * Flush the interface output queue. 1115 */ 1116 void 1117 sppp_flush(struct ifnet *ifp) 1118 { 1119 struct sppp *sp = (struct sppp *) ifp; 1120 1121 SPPP_LOCK(sp, RW_WRITER); 1122 IFQ_PURGE(&sp->pp_if.if_snd); 1123 IF_PURGE(&sp->pp_fastq); 1124 IF_PURGE(&sp->pp_cpq); 1125 SPPP_UNLOCK(sp); 1126 } 1127 1128 /* 1129 * Check if the output queue is empty. 1130 */ 1131 int 1132 sppp_isempty(struct ifnet *ifp) 1133 { 1134 struct sppp *sp = (struct sppp *) ifp; 1135 int empty, s; 1136 1137 s = splnet(); 1138 SPPP_LOCK(sp, RW_READER); 1139 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1140 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1141 SPPP_UNLOCK(sp); 1142 splx(s); 1143 return (empty); 1144 } 1145 1146 /* 1147 * Get next packet to send. 1148 */ 1149 struct mbuf * 1150 sppp_dequeue(struct ifnet *ifp) 1151 { 1152 struct sppp *sp = (struct sppp *) ifp; 1153 struct mbuf *m; 1154 int s; 1155 1156 s = splnet(); 1157 SPPP_LOCK(sp, RW_WRITER); 1158 /* 1159 * Process only the control protocol queue until we have at 1160 * least one NCP open. 1161 * 1162 * Do always serve all three queues in Cisco mode. 1163 */ 1164 IF_DEQUEUE(&sp->pp_cpq, m); 1165 if (m == NULL && 1166 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1167 IF_DEQUEUE(&sp->pp_fastq, m); 1168 if (m == NULL) 1169 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1170 } 1171 SPPP_UNLOCK(sp); 1172 splx(s); 1173 return m; 1174 } 1175 1176 /* 1177 * Process an ioctl request. Called on low priority level. 1178 */ 1179 int 1180 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1181 { 1182 struct lwp *l = curlwp; /* XXX */ 1183 struct ifreq *ifr = (struct ifreq *) data; 1184 struct ifaddr *ifa = (struct ifaddr *) data; 1185 struct sppp *sp = (struct sppp *) ifp; 1186 int s, error=0, going_up, going_down; 1187 u_short newmode; 1188 1189 s = splnet(); 1190 switch (cmd) { 1191 case SIOCINITIFADDR: 1192 ifa->ifa_rtrequest = p2p_rtrequest; 1193 break; 1194 1195 case SIOCSIFFLAGS: 1196 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1197 break; 1198 1199 SPPP_LOCK(sp, RW_WRITER); 1200 going_up = ifp->if_flags & IFF_UP && 1201 (ifp->if_flags & IFF_RUNNING) == 0; 1202 going_down = (ifp->if_flags & IFF_UP) == 0 && 1203 ifp->if_flags & IFF_RUNNING; 1204 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1205 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1206 /* sanity */ 1207 newmode = IFF_PASSIVE; 1208 ifp->if_flags &= ~IFF_AUTO; 1209 } 1210 1211 if (going_up || going_down) { 1212 sp->lcp.reestablish = false; 1213 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1214 } 1215 if (going_up && newmode == 0) { 1216 /* neither auto-dial nor passive */ 1217 ifp->if_flags |= IFF_RUNNING; 1218 if (!(sp->pp_flags & PP_CISCO)) { 1219 sppp_wq_add(sp->wq_cp, 1220 &sp->scp[IDX_LCP].work_open); 1221 } 1222 } else if (going_down) { 1223 SPPP_UNLOCK(sp); 1224 sppp_flush(ifp); 1225 SPPP_LOCK(sp, RW_WRITER); 1226 1227 ifp->if_flags &= ~IFF_RUNNING; 1228 } 1229 SPPP_UNLOCK(sp); 1230 break; 1231 1232 case SIOCSIFMTU: 1233 if (ifr->ifr_mtu < PPP_MINMRU || 1234 ifr->ifr_mtu > sp->lcp.their_mru) { 1235 error = EINVAL; 1236 break; 1237 } 1238 /*FALLTHROUGH*/ 1239 case SIOCGIFMTU: 1240 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1241 error = 0; 1242 break; 1243 case SIOCADDMULTI: 1244 case SIOCDELMULTI: 1245 break; 1246 1247 case SPPPSETAUTHCFG: 1248 case SPPPSETLCPCFG: 1249 case SPPPSETIDLETO: 1250 case SPPPSETAUTHFAILURE: 1251 case SPPPSETDNSOPTS: 1252 case SPPPSETKEEPALIVE: 1253 #if defined(COMPAT_50) || defined(MODULAR) 1254 case __SPPPSETIDLETO50: 1255 case __SPPPSETKEEPALIVE50: 1256 #endif /* COMPAT_50 || MODULAR */ 1257 error = kauth_authorize_network(l->l_cred, 1258 KAUTH_NETWORK_INTERFACE, 1259 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1260 NULL); 1261 if (error) 1262 break; 1263 error = sppp_params(sp, cmd, data); 1264 break; 1265 1266 case SPPPGETAUTHCFG: 1267 case SPPPGETLCPCFG: 1268 case SPPPGETAUTHFAILURES: 1269 error = kauth_authorize_network(l->l_cred, 1270 KAUTH_NETWORK_INTERFACE, 1271 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1272 NULL); 1273 if (error) 1274 break; 1275 error = sppp_params(sp, cmd, data); 1276 break; 1277 1278 case SPPPGETSTATUS: 1279 case SPPPGETSTATUSNCP: 1280 case SPPPGETIDLETO: 1281 case SPPPGETDNSOPTS: 1282 case SPPPGETDNSADDRS: 1283 case SPPPGETKEEPALIVE: 1284 #if defined(COMPAT_50) || defined(MODULAR) 1285 case __SPPPGETIDLETO50: 1286 case __SPPPGETKEEPALIVE50: 1287 #endif /* COMPAT_50 || MODULAR */ 1288 error = sppp_params(sp, cmd, data); 1289 break; 1290 1291 default: 1292 error = ifioctl_common(ifp, cmd, data); 1293 break; 1294 } 1295 splx(s); 1296 return (error); 1297 } 1298 1299 1300 /* 1301 * Cisco framing implementation. 1302 */ 1303 1304 /* 1305 * Handle incoming Cisco keepalive protocol packets. 1306 */ 1307 static void 1308 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1309 { 1310 STDDCL; 1311 struct cisco_packet *h; 1312 #ifdef INET 1313 uint32_t me, mymask = 0; /* XXX: GCC */ 1314 #endif 1315 1316 SPPP_LOCK(sp, RW_WRITER); 1317 1318 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1319 if (debug) 1320 log(LOG_DEBUG, 1321 "%s: cisco invalid packet length: %d bytes\n", 1322 ifp->if_xname, m->m_pkthdr.len); 1323 SPPP_UNLOCK(sp); 1324 return; 1325 } 1326 h = mtod(m, struct cisco_packet *); 1327 if (debug) 1328 log(LOG_DEBUG, 1329 "%s: cisco input: %d bytes " 1330 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1331 ifp->if_xname, m->m_pkthdr.len, 1332 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1333 (u_int)h->time0, (u_int)h->time1); 1334 switch (ntohl(h->type)) { 1335 default: 1336 if (debug) 1337 addlog("%s: cisco unknown packet type: 0x%x\n", 1338 ifp->if_xname, ntohl(h->type)); 1339 break; 1340 case CISCO_ADDR_REPLY: 1341 /* Reply on address request, ignore */ 1342 break; 1343 case CISCO_KEEPALIVE_REQ: 1344 sp->pp_alivecnt = 0; 1345 sp->scp[IDX_LCP].rseq = ntohl(h->par1); 1346 if (sp->scp[IDX_LCP].seq == sp->scp[IDX_LCP].rseq) { 1347 /* Local and remote sequence numbers are equal. 1348 * Probably, the line is in loopback mode. */ 1349 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1350 printf ("%s: loopback\n", 1351 ifp->if_xname); 1352 sp->pp_loopcnt = 0; 1353 if (ifp->if_flags & IFF_UP) { 1354 SPPP_UNLOCK(sp); 1355 if_down(ifp); 1356 SPPP_LOCK(sp, RW_WRITER); 1357 1358 IF_PURGE(&sp->pp_cpq); 1359 } 1360 } 1361 ++sp->pp_loopcnt; 1362 1363 /* Generate new local sequence number */ 1364 sp->scp[IDX_LCP].seq = cprng_fast32(); 1365 break; 1366 } 1367 sp->pp_loopcnt = 0; 1368 if (! (ifp->if_flags & IFF_UP) && 1369 (ifp->if_flags & IFF_RUNNING)) { 1370 SPPP_UNLOCK(sp); 1371 if_up(ifp); 1372 SPPP_LOCK(sp, RW_WRITER); 1373 } 1374 break; 1375 case CISCO_ADDR_REQ: 1376 #ifdef INET 1377 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1378 if (me != 0L) 1379 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1380 #endif 1381 break; 1382 } 1383 SPPP_UNLOCK(sp); 1384 } 1385 1386 /* 1387 * Send Cisco keepalive packet. 1388 */ 1389 static void 1390 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1391 { 1392 STDDCL; 1393 struct ppp_header *h; 1394 struct cisco_packet *ch; 1395 struct mbuf *m; 1396 uint32_t t; 1397 1398 KASSERT(SPPP_WLOCKED(sp)); 1399 1400 t = time_uptime * 1000; 1401 MGETHDR(m, M_DONTWAIT, MT_DATA); 1402 if (! m) 1403 return; 1404 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1405 m_reset_rcvif(m); 1406 1407 h = mtod(m, struct ppp_header *); 1408 h->address = CISCO_MULTICAST; 1409 h->control = 0; 1410 h->protocol = htons(CISCO_KEEPALIVE); 1411 1412 ch = (struct cisco_packet *)(h + 1); 1413 ch->type = htonl(type); 1414 ch->par1 = htonl(par1); 1415 ch->par2 = htonl(par2); 1416 ch->rel = -1; 1417 1418 ch->time0 = htons((u_short)(t >> 16)); 1419 ch->time1 = htons((u_short) t); 1420 1421 if (debug) 1422 log(LOG_DEBUG, 1423 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1424 ifp->if_xname, ntohl(ch->type), ch->par1, 1425 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1426 (u_int)ch->time1); 1427 1428 if (IF_QFULL(&sp->pp_cpq)) { 1429 IF_DROP(&sp->pp_fastq); 1430 IF_DROP(&ifp->if_snd); 1431 m_freem(m); 1432 if_statinc(ifp, if_oerrors); 1433 return; 1434 } 1435 1436 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1437 IF_ENQUEUE(&sp->pp_cpq, m); 1438 1439 if (! (ifp->if_flags & IFF_OACTIVE)) { 1440 SPPP_UNLOCK(sp); 1441 if_start_lock(ifp); 1442 SPPP_LOCK(sp, RW_WRITER); 1443 } 1444 } 1445 1446 /* 1447 * PPP protocol implementation. 1448 */ 1449 1450 /* 1451 * Send PPP control protocol packet. 1452 */ 1453 static void 1454 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1455 u_char ident, u_short len, void *data) 1456 { 1457 STDDCL; 1458 struct lcp_header *lh; 1459 struct mbuf *m; 1460 size_t pkthdrlen; 1461 1462 KASSERT(SPPP_WLOCKED(sp)); 1463 1464 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1465 1466 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1467 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1468 MGETHDR(m, M_DONTWAIT, MT_DATA); 1469 if (! m) { 1470 return; 1471 } 1472 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1473 m_reset_rcvif(m); 1474 1475 if (sp->pp_flags & PP_NOFRAMING) { 1476 *mtod(m, uint16_t *) = htons(proto); 1477 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1478 } else { 1479 struct ppp_header *h; 1480 h = mtod(m, struct ppp_header *); 1481 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1482 h->control = PPP_UI; /* Unnumbered Info */ 1483 h->protocol = htons(proto); /* Link Control Protocol */ 1484 lh = (struct lcp_header *)(h + 1); 1485 } 1486 lh->type = type; 1487 lh->ident = ident; 1488 lh->len = htons(LCP_HEADER_LEN + len); 1489 if (len) 1490 memcpy(lh + 1, data, len); 1491 1492 if (debug) { 1493 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1494 ifp->if_xname, 1495 sppp_proto_name(proto), 1496 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1497 if (len) 1498 sppp_print_bytes((u_char *)(lh + 1), len); 1499 addlog(">\n"); 1500 } 1501 if (IF_QFULL(&sp->pp_cpq)) { 1502 IF_DROP(&sp->pp_fastq); 1503 IF_DROP(&ifp->if_snd); 1504 m_freem(m); 1505 if_statinc(ifp, if_oerrors); 1506 return; 1507 } 1508 1509 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1510 IF_ENQUEUE(&sp->pp_cpq, m); 1511 1512 1513 if (! (ifp->if_flags & IFF_OACTIVE)) { 1514 SPPP_UNLOCK(sp); 1515 if_start_lock(ifp); 1516 SPPP_LOCK(sp, RW_WRITER); 1517 } 1518 } 1519 1520 static void 1521 sppp_cp_to_lcp(void *xsp) 1522 { 1523 struct sppp *sp = xsp; 1524 1525 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1526 } 1527 1528 static void 1529 sppp_cp_to_ipcp(void *xsp) 1530 { 1531 struct sppp *sp = xsp; 1532 1533 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1534 } 1535 1536 static void 1537 sppp_cp_to_ipv6cp(void *xsp) 1538 { 1539 struct sppp *sp = xsp; 1540 1541 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1542 } 1543 1544 static void 1545 sppp_cp_to_pap(void *xsp) 1546 { 1547 struct sppp *sp = xsp; 1548 1549 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1550 } 1551 1552 static void 1553 sppp_cp_to_chap(void *xsp) 1554 { 1555 struct sppp *sp = xsp; 1556 1557 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1558 } 1559 1560 1561 static void 1562 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1563 { 1564 struct sppp_cp *scp; 1565 typedef void (*sppp_co_cb_t)(void *); 1566 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1567 [IDX_LCP] = sppp_cp_to_lcp, 1568 [IDX_IPCP] = sppp_cp_to_ipcp, 1569 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1570 [IDX_PAP] = sppp_cp_to_pap, 1571 [IDX_CHAP] = sppp_cp_to_chap, 1572 }; 1573 1574 scp = &sp->scp[cp->protoidx]; 1575 1576 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1577 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1578 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1579 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1580 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1581 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1582 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1583 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1584 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1585 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1586 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1587 1588 callout_init(&scp->ch, CALLOUT_MPSAFE); 1589 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1590 } 1591 1592 static void 1593 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1594 { 1595 struct sppp_cp *scp; 1596 scp = &sp->scp[cp->protoidx]; 1597 1598 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1599 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1600 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1601 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1602 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1603 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1604 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1605 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1606 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1607 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1608 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1609 1610 callout_halt(&scp->ch, NULL); 1611 callout_destroy(&scp->ch); 1612 } 1613 1614 /* 1615 * Handle incoming PPP control protocol packets. 1616 */ 1617 static void 1618 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1619 { 1620 STDDCL; 1621 struct lcp_header *h; 1622 int printlen, len = m->m_pkthdr.len; 1623 int rv; 1624 u_char *p; 1625 uint32_t u32; 1626 1627 SPPP_LOCK(sp, RW_WRITER); 1628 1629 if (len < 4) { 1630 if (debug) 1631 log(LOG_DEBUG, 1632 "%s: %s invalid packet length: %d bytes\n", 1633 ifp->if_xname, cp->name, len); 1634 SPPP_UNLOCK(sp); 1635 return; 1636 } 1637 h = mtod(m, struct lcp_header *); 1638 if (debug) { 1639 printlen = ntohs(h->len); 1640 log(LOG_DEBUG, 1641 "%s: %s input(%s): <%s id=0x%x len=%d", 1642 ifp->if_xname, cp->name, 1643 sppp_state_name(sp->scp[cp->protoidx].state), 1644 sppp_cp_type_name(h->type), h->ident, printlen); 1645 if (len < printlen) 1646 printlen = len; 1647 if (printlen > 4) 1648 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1649 addlog(">\n"); 1650 } 1651 if (len > ntohs(h->len)) 1652 len = ntohs(h->len); 1653 p = (u_char *)(h + 1); 1654 switch (h->type) { 1655 case CONF_REQ: 1656 if (len < 4) { 1657 if (debug) 1658 addlog("%s: %s invalid conf-req length %d\n", 1659 ifp->if_xname, cp->name, 1660 len); 1661 if_statinc(ifp, if_ierrors); 1662 break; 1663 } 1664 rv = (cp->RCR)(sp, h, len); 1665 if (rv < 0) { 1666 /* fatal error, shut down */ 1667 (cp->tld)(sp); 1668 sppp_lcp_tlf(sp); 1669 SPPP_UNLOCK(sp); 1670 return; 1671 } 1672 sp->scp[cp->protoidx].rconfid = h->ident; 1673 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rcr); 1674 break; 1675 case CONF_ACK: 1676 if (h->ident != sp->scp[cp->protoidx].confid) { 1677 if (debug) 1678 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1679 ifp->if_xname, cp->name, 1680 h->ident, sp->scp[cp->protoidx].confid); 1681 if_statinc(ifp, if_ierrors); 1682 break; 1683 } 1684 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rca); 1685 break; 1686 case CONF_NAK: 1687 case CONF_REJ: 1688 if (h->ident != sp->scp[cp->protoidx].confid) { 1689 if (debug) 1690 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1691 ifp->if_xname, cp->name, 1692 h->ident, sp->scp[cp->protoidx].confid); 1693 if_statinc(ifp, if_ierrors); 1694 break; 1695 } 1696 if (h->type == CONF_NAK) 1697 (cp->RCN_nak)(sp, h, len); 1698 else /* CONF_REJ */ 1699 (cp->RCN_rej)(sp, h, len); 1700 1701 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rcn); 1702 break; 1703 1704 case TERM_REQ: 1705 sp->scp[cp->protoidx].rseq = h->ident; 1706 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rtr); 1707 break; 1708 case TERM_ACK: 1709 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rta); 1710 break; 1711 case CODE_REJ: 1712 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1713 log(LOG_INFO, 1714 "%s: %s: ignoring RXJ (%s) for code ?, " 1715 "danger will robinson\n", 1716 ifp->if_xname, cp->name, 1717 sppp_cp_type_name(h->type)); 1718 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rxj); 1719 break; 1720 case PROTO_REJ: 1721 { 1722 int catastrophic; 1723 const struct cp *upper; 1724 int i; 1725 uint16_t proto; 1726 1727 catastrophic = 0; 1728 upper = NULL; 1729 proto = p[0] << 8 | p[1]; 1730 for (i = 0; i < IDX_COUNT; i++) { 1731 if (cps[i]->proto == proto) { 1732 upper = cps[i]; 1733 break; 1734 } 1735 } 1736 if (upper == NULL) 1737 catastrophic++; 1738 1739 if (debug) 1740 log(LOG_INFO, 1741 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1742 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1743 sppp_cp_type_name(h->type), proto, 1744 upper ? upper->name : "unknown", 1745 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1746 1747 /* 1748 * if we got RXJ+ against conf-req, the peer does not implement 1749 * this particular protocol type. terminate the protocol. 1750 */ 1751 if (upper && !catastrophic) { 1752 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1753 sppp_wq_add(sp->wq_cp, 1754 &sp->scp[upper->protoidx].work_close); 1755 break; 1756 } 1757 } 1758 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rxj); 1759 break; 1760 } 1761 case DISC_REQ: 1762 if (cp->proto != PPP_LCP) 1763 goto illegal; 1764 /* Discard the packet. */ 1765 break; 1766 case ECHO_REQ: 1767 if (cp->proto != PPP_LCP) 1768 goto illegal; 1769 if (sp->scp[cp->protoidx].state != STATE_OPENED) { 1770 if (debug) 1771 addlog("%s: lcp echo req but lcp closed\n", 1772 ifp->if_xname); 1773 if_statinc(ifp, if_ierrors); 1774 break; 1775 } 1776 if (len < 8) { 1777 if (debug) 1778 addlog("%s: invalid lcp echo request " 1779 "packet length: %d bytes\n", 1780 ifp->if_xname, len); 1781 break; 1782 } 1783 memcpy(&u32, h + 1, sizeof u32); 1784 if (ntohl(u32) == sp->lcp.magic) { 1785 /* Line loopback mode detected. */ 1786 printf("%s: loopback\n", ifp->if_xname); 1787 SPPP_UNLOCK(sp); 1788 if_down(ifp); 1789 SPPP_LOCK(sp, RW_WRITER); 1790 1791 IF_PURGE(&sp->pp_cpq); 1792 1793 /* Shut down the PPP link. */ 1794 /* XXX */ 1795 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 1796 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 1797 break; 1798 } 1799 u32 = htonl(sp->lcp.magic); 1800 memcpy(h + 1, &u32, sizeof u32); 1801 if (debug) 1802 addlog("%s: got lcp echo req, sending echo rep\n", 1803 ifp->if_xname); 1804 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1805 h + 1); 1806 break; 1807 case ECHO_REPLY: 1808 if (cp->proto != PPP_LCP) 1809 goto illegal; 1810 if (h->ident != sp->lcp.echoid) { 1811 if_statinc(ifp, if_ierrors); 1812 break; 1813 } 1814 if (len < 8) { 1815 if (debug) 1816 addlog("%s: lcp invalid echo reply " 1817 "packet length: %d bytes\n", 1818 ifp->if_xname, len); 1819 break; 1820 } 1821 if (debug) 1822 addlog("%s: lcp got echo rep\n", 1823 ifp->if_xname); 1824 memcpy(&u32, h + 1, sizeof u32); 1825 if (ntohl(u32) != sp->lcp.magic) 1826 sp->pp_alivecnt = 0; 1827 break; 1828 default: 1829 /* Unknown packet type -- send Code-Reject packet. */ 1830 illegal: 1831 if (debug) 1832 addlog("%s: %s send code-rej for 0x%x\n", 1833 ifp->if_xname, cp->name, h->type); 1834 sppp_cp_send(sp, cp->proto, CODE_REJ, 1835 ++sp->scp[cp->protoidx].seq, m->m_pkthdr.len, h); 1836 if_statinc(ifp, if_ierrors); 1837 } 1838 1839 SPPP_UNLOCK(sp); 1840 } 1841 1842 1843 /* 1844 * The generic part of all Up/Down/Open/Close/TO event handlers. 1845 * Basically, the state transition handling in the automaton. 1846 */ 1847 static void 1848 sppp_up_event(struct sppp *sp, void *xcp) 1849 { 1850 const struct cp *cp = xcp; 1851 STDDCL; 1852 1853 KASSERT(SPPP_WLOCKED(sp)); 1854 1855 if ((cp->flags & CP_AUTH) != 0 && 1856 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1857 return; 1858 1859 if (debug) 1860 log(LOG_DEBUG, "%s: %s up(%s)\n", 1861 ifp->if_xname, cp->name, 1862 sppp_state_name(sp->scp[cp->protoidx].state)); 1863 1864 switch (sp->scp[cp->protoidx].state) { 1865 case STATE_INITIAL: 1866 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1867 break; 1868 case STATE_STARTING: 1869 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1870 (cp->scr)(sp); 1871 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1872 break; 1873 default: 1874 printf("%s: %s illegal up in state %s\n", 1875 ifp->if_xname, cp->name, 1876 sppp_state_name(sp->scp[cp->protoidx].state)); 1877 } 1878 } 1879 1880 static void 1881 sppp_down_event(struct sppp *sp, void *xcp) 1882 { 1883 const struct cp *cp = xcp; 1884 STDDCL; 1885 1886 KASSERT(SPPP_WLOCKED(sp)); 1887 1888 if ((cp->flags & CP_AUTH) != 0 && 1889 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1890 return; 1891 1892 if (debug) 1893 log(LOG_DEBUG, "%s: %s down(%s)\n", 1894 ifp->if_xname, cp->name, 1895 sppp_state_name(sp->scp[cp->protoidx].state)); 1896 1897 switch (sp->scp[cp->protoidx].state) { 1898 case STATE_CLOSED: 1899 case STATE_CLOSING: 1900 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1901 break; 1902 case STATE_STOPPED: 1903 (cp->tls)(sp); 1904 /* fall through */ 1905 case STATE_STOPPING: 1906 case STATE_REQ_SENT: 1907 case STATE_ACK_RCVD: 1908 case STATE_ACK_SENT: 1909 sppp_cp_change_state(cp, sp, STATE_STARTING); 1910 break; 1911 case STATE_OPENED: 1912 (cp->tld)(sp); 1913 sppp_cp_change_state(cp, sp, STATE_STARTING); 1914 break; 1915 default: 1916 printf("%s: %s illegal down in state %s\n", 1917 ifp->if_xname, cp->name, 1918 sppp_state_name(sp->scp[cp->protoidx].state)); 1919 } 1920 } 1921 1922 1923 static void 1924 sppp_open_event(struct sppp *sp, void *xcp) 1925 { 1926 const struct cp *cp = xcp; 1927 STDDCL; 1928 1929 KASSERT(SPPP_WLOCKED(sp)); 1930 1931 if ((cp->flags & CP_AUTH) != 0 && 1932 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1933 return; 1934 1935 if (debug) 1936 log(LOG_DEBUG, "%s: %s open(%s)\n", 1937 ifp->if_xname, cp->name, 1938 sppp_state_name(sp->scp[cp->protoidx].state)); 1939 1940 switch (sp->scp[cp->protoidx].state) { 1941 case STATE_INITIAL: 1942 sppp_cp_change_state(cp, sp, STATE_STARTING); 1943 (cp->tls)(sp); 1944 break; 1945 case STATE_STARTING: 1946 break; 1947 case STATE_CLOSED: 1948 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1949 (cp->scr)(sp); 1950 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1951 break; 1952 case STATE_STOPPED: 1953 case STATE_STOPPING: 1954 case STATE_REQ_SENT: 1955 case STATE_ACK_RCVD: 1956 case STATE_ACK_SENT: 1957 case STATE_OPENED: 1958 break; 1959 case STATE_CLOSING: 1960 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1961 break; 1962 } 1963 } 1964 1965 1966 static void 1967 sppp_close_event(struct sppp *sp, void *xcp) 1968 { 1969 const struct cp *cp = xcp; 1970 STDDCL; 1971 1972 KASSERT(SPPP_WLOCKED(sp)); 1973 1974 if ((cp->flags & CP_AUTH) != 0 && 1975 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1976 return; 1977 1978 if (debug) 1979 log(LOG_DEBUG, "%s: %s close(%s)\n", 1980 ifp->if_xname, cp->name, 1981 sppp_state_name(sp->scp[cp->protoidx].state)); 1982 1983 switch (sp->scp[cp->protoidx].state) { 1984 case STATE_INITIAL: 1985 case STATE_CLOSED: 1986 case STATE_CLOSING: 1987 break; 1988 case STATE_STARTING: 1989 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1990 (cp->tlf)(sp); 1991 break; 1992 case STATE_STOPPED: 1993 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1994 break; 1995 case STATE_STOPPING: 1996 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1997 break; 1998 case STATE_OPENED: 1999 (cp->tld)(sp); 2000 /* fall through */ 2001 case STATE_REQ_SENT: 2002 case STATE_ACK_RCVD: 2003 case STATE_ACK_SENT: 2004 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 2005 if ((cp->flags & CP_AUTH) == 0) { 2006 sppp_cp_send(sp, cp->proto, TERM_REQ, 2007 ++sp->scp[cp->protoidx].seq, 0, 0); 2008 } 2009 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2010 break; 2011 } 2012 } 2013 2014 static void 2015 sppp_to_event(struct sppp *sp, void *xcp) 2016 { 2017 const struct cp *cp = xcp; 2018 int s; 2019 STDDCL; 2020 2021 KASSERT(SPPP_WLOCKED(sp)); 2022 2023 s = splnet(); 2024 2025 if (debug) 2026 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 2027 ifp->if_xname, cp->name, 2028 sppp_state_name(sp->scp[cp->protoidx].state), 2029 sp->scp[cp->protoidx].rst_counter); 2030 2031 if (--sp->scp[cp->protoidx].rst_counter < 0) 2032 /* TO- event */ 2033 switch (sp->scp[cp->protoidx].state) { 2034 case STATE_CLOSING: 2035 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2036 (cp->tlf)(sp); 2037 break; 2038 case STATE_STOPPING: 2039 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2040 (cp->tlf)(sp); 2041 break; 2042 case STATE_REQ_SENT: 2043 case STATE_ACK_RCVD: 2044 case STATE_ACK_SENT: 2045 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2046 (cp->tlf)(sp); 2047 break; 2048 } 2049 else 2050 /* TO+ event */ 2051 switch (sp->scp[cp->protoidx].state) { 2052 case STATE_CLOSING: 2053 case STATE_STOPPING: 2054 if ((cp->flags & CP_AUTH) == 0) { 2055 sppp_cp_send(sp, cp->proto, TERM_REQ, 2056 ++sp->scp[cp->protoidx].seq, 0, 0); 2057 } 2058 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2059 break; 2060 case STATE_REQ_SENT: 2061 case STATE_ACK_RCVD: 2062 (cp->scr)(sp); 2063 /* sppp_cp_change_state() will restart the timer */ 2064 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2065 break; 2066 case STATE_ACK_SENT: 2067 (cp->scr)(sp); 2068 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2069 break; 2070 } 2071 2072 splx(s); 2073 } 2074 2075 static void 2076 sppp_rcr_event(struct sppp *sp, void *xcp) 2077 { 2078 const struct cp *cp = xcp; 2079 u_char type; 2080 void *buf; 2081 size_t blen; 2082 STDDCL; 2083 2084 type = sp->scp[cp->protoidx].rcr_type; 2085 buf = sp->scp[cp->protoidx].rcr_buf; 2086 blen = sp->scp[cp->protoidx].rcr_blen; 2087 2088 if (type == CONF_ACK) { 2089 /* RCR+ event */ 2090 switch (sp->scp[cp->protoidx].state) { 2091 case STATE_OPENED: 2092 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2093 cp->tld(sp); 2094 cp->scr(sp); 2095 cp->scan(cp, sp); 2096 break; 2097 case STATE_ACK_SENT: 2098 case STATE_REQ_SENT: 2099 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2100 cp->scan(cp, sp); 2101 break; 2102 case STATE_STOPPED: 2103 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2104 cp->scr(sp); 2105 cp->scan(cp, sp); 2106 break; 2107 case STATE_ACK_RCVD: 2108 sppp_cp_change_state(cp, sp, STATE_OPENED); 2109 if (debug) 2110 log(LOG_DEBUG, "%s: %s tlu\n", 2111 ifp->if_xname, 2112 cp->name); 2113 cp->tlu(sp); 2114 cp->scan(cp, sp); 2115 break; 2116 case STATE_CLOSING: 2117 case STATE_STOPPING: 2118 if (buf != NULL) { 2119 sp->scp[cp->protoidx].rcr_buf = NULL; 2120 sp->scp[cp->protoidx].rcr_blen = 0; 2121 kmem_free(buf, blen); 2122 } 2123 break; 2124 case STATE_CLOSED: 2125 if ((cp->flags & CP_AUTH) == 0) { 2126 sppp_cp_send(sp, cp->proto, TERM_ACK, 2127 sp->scp[cp->protoidx].rconfid, 0, 0); 2128 } 2129 break; 2130 default: 2131 printf("%s: %s illegal RCR+ in state %s\n", 2132 ifp->if_xname, cp->name, 2133 sppp_state_name(sp->scp[cp->protoidx].state)); 2134 if_statinc(ifp, if_ierrors); 2135 } 2136 } else { 2137 /* RCR- event */ 2138 switch (sp->scp[cp->protoidx].state) { 2139 case STATE_OPENED: 2140 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2141 cp->tld(sp); 2142 cp->scr(sp); 2143 cp->scan(cp, sp); 2144 break; 2145 case STATE_ACK_SENT: 2146 case STATE_REQ_SENT: 2147 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2148 cp->scan(cp, sp); 2149 break; 2150 case STATE_STOPPED: 2151 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2152 cp->scr(sp); 2153 cp->scan(cp, sp); 2154 break; 2155 case STATE_ACK_RCVD: 2156 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2157 cp->scan(cp, sp); 2158 break; 2159 case STATE_CLOSING: 2160 case STATE_STOPPING: 2161 if (buf != NULL) { 2162 sp->scp[cp->protoidx].rcr_buf = NULL; 2163 sp->scp[cp->protoidx].rcr_blen = 0; 2164 kmem_free(buf, blen); 2165 } 2166 break; 2167 case STATE_CLOSED: 2168 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2169 if ((cp->flags & CP_AUTH) == 0) { 2170 sppp_cp_send(sp, cp->proto, TERM_ACK, 2171 sp->scp[cp->protoidx].rconfid, 0, 0); 2172 } 2173 break; 2174 default: 2175 printf("%s: %s illegal RCR- in state %s\n", 2176 ifp->if_xname, cp->name, 2177 sppp_state_name(sp->scp[cp->protoidx].state)); 2178 if_statinc(ifp, if_ierrors); 2179 } 2180 } 2181 } 2182 2183 static void 2184 sppp_rca_event(struct sppp *sp, void *xcp) 2185 { 2186 const struct cp *cp = xcp; 2187 STDDCL; 2188 2189 switch (sp->scp[cp->protoidx].state) { 2190 case STATE_CLOSED: 2191 case STATE_STOPPED: 2192 if ((cp->flags & CP_AUTH) == 0) { 2193 sppp_cp_send(sp, cp->proto, TERM_ACK, 2194 sp->scp[cp->protoidx].rconfid, 0, 0); 2195 } 2196 break; 2197 case STATE_CLOSING: 2198 case STATE_STOPPING: 2199 break; 2200 case STATE_REQ_SENT: 2201 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2202 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2203 break; 2204 case STATE_OPENED: 2205 (cp->tld)(sp); 2206 /* fall through */ 2207 case STATE_ACK_RCVD: 2208 (cp->scr)(sp); 2209 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2210 break; 2211 case STATE_ACK_SENT: 2212 sppp_cp_change_state(cp, sp, STATE_OPENED); 2213 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2214 if (debug) 2215 log(LOG_DEBUG, "%s: %s tlu\n", 2216 ifp->if_xname, cp->name); 2217 (cp->tlu)(sp); 2218 break; 2219 default: 2220 printf("%s: %s illegal RCA in state %s\n", 2221 ifp->if_xname, cp->name, 2222 sppp_state_name(sp->scp[cp->protoidx].state)); 2223 if_statinc(ifp, if_ierrors); 2224 } 2225 } 2226 2227 static void 2228 sppp_rcn_event(struct sppp *sp, void *xcp) 2229 { 2230 const struct cp *cp = xcp; 2231 struct ifnet *ifp = &sp->pp_if; 2232 2233 switch (sp->scp[cp->protoidx].state) { 2234 case STATE_CLOSED: 2235 case STATE_STOPPED: 2236 if ((cp->flags & CP_AUTH) == 0) { 2237 sppp_cp_send(sp, cp->proto, TERM_ACK, 2238 sp->scp[cp->protoidx].rconfid, 0, 0); 2239 } 2240 break; 2241 case STATE_REQ_SENT: 2242 case STATE_ACK_SENT: 2243 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2244 (cp->scr)(sp); 2245 break; 2246 case STATE_OPENED: 2247 (cp->tld)(sp); 2248 /* fall through */ 2249 case STATE_ACK_RCVD: 2250 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2251 (cp->scr)(sp); 2252 break; 2253 case STATE_CLOSING: 2254 case STATE_STOPPING: 2255 break; 2256 default: 2257 printf("%s: %s illegal RCN in state %s\n", 2258 ifp->if_xname, cp->name, 2259 sppp_state_name(sp->scp[cp->protoidx].state)); 2260 if_statinc(ifp, if_ierrors); 2261 } 2262 } 2263 2264 static void 2265 sppp_rtr_event(struct sppp *sp, void *xcp) 2266 { 2267 const struct cp *cp = xcp; 2268 STDDCL; 2269 2270 switch (sp->scp[cp->protoidx].state) { 2271 case STATE_ACK_RCVD: 2272 case STATE_ACK_SENT: 2273 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2274 break; 2275 case STATE_CLOSED: 2276 case STATE_STOPPED: 2277 case STATE_CLOSING: 2278 case STATE_STOPPING: 2279 case STATE_REQ_SENT: 2280 break; 2281 case STATE_OPENED: 2282 (cp->tld)(sp); 2283 sp->scp[cp->protoidx].rst_counter = 0; 2284 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2285 break; 2286 default: 2287 printf("%s: %s illegal RTR in state %s\n", 2288 ifp->if_xname, cp->name, 2289 sppp_state_name(sp->scp[cp->protoidx].state)); 2290 if_statinc(ifp, if_ierrors); 2291 return; 2292 } 2293 2294 /* Send Terminate-Ack packet. */ 2295 if (debug) 2296 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 2297 ifp->if_xname, cp->name); 2298 if ((cp->flags & CP_AUTH) == 0) { 2299 sppp_cp_send(sp, cp->proto, TERM_ACK, 2300 sp->scp[cp->protoidx].rseq, 0, 0); 2301 } 2302 } 2303 2304 static void 2305 sppp_rta_event(struct sppp *sp, void *xcp) 2306 { 2307 const struct cp *cp = xcp; 2308 struct ifnet *ifp = &sp->pp_if; 2309 2310 switch (sp->scp[cp->protoidx].state) { 2311 case STATE_CLOSED: 2312 case STATE_STOPPED: 2313 case STATE_REQ_SENT: 2314 case STATE_ACK_SENT: 2315 break; 2316 case STATE_CLOSING: 2317 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2318 (cp->tlf)(sp); 2319 break; 2320 case STATE_STOPPING: 2321 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2322 (cp->tlf)(sp); 2323 break; 2324 case STATE_ACK_RCVD: 2325 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2326 break; 2327 case STATE_OPENED: 2328 (cp->tld)(sp); 2329 (cp->scr)(sp); 2330 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2331 break; 2332 default: 2333 printf("%s: %s illegal RTA in state %s\n", 2334 ifp->if_xname, cp->name, 2335 sppp_state_name(sp->scp[cp->protoidx].state)); 2336 if_statinc(ifp, if_ierrors); 2337 } 2338 } 2339 2340 static void 2341 sppp_rxj_event(struct sppp *sp, void *xcp) 2342 { 2343 const struct cp *cp = xcp; 2344 struct ifnet *ifp = &sp->pp_if; 2345 2346 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2347 switch (sp->scp[cp->protoidx].state) { 2348 case STATE_CLOSED: 2349 case STATE_STOPPED: 2350 case STATE_REQ_SENT: 2351 case STATE_ACK_SENT: 2352 case STATE_CLOSING: 2353 case STATE_STOPPING: 2354 case STATE_OPENED: 2355 break; 2356 case STATE_ACK_RCVD: 2357 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2358 break; 2359 default: 2360 printf("%s: %s illegal RXJ- in state %s\n", 2361 ifp->if_xname, cp->name, 2362 sppp_state_name(sp->scp[cp->protoidx].state)); 2363 if_statinc(ifp, if_ierrors); 2364 } 2365 } 2366 2367 /* 2368 * Change the state of a control protocol in the state automaton. 2369 * Takes care of starting/stopping the restart timer. 2370 */ 2371 void 2372 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2373 { 2374 2375 KASSERT(SPPP_WLOCKED(sp)); 2376 2377 sp->scp[cp->protoidx].state = newstate; 2378 callout_stop(&sp->scp[cp->protoidx].ch); 2379 switch (newstate) { 2380 case STATE_INITIAL: 2381 case STATE_STARTING: 2382 case STATE_CLOSED: 2383 case STATE_STOPPED: 2384 case STATE_OPENED: 2385 break; 2386 case STATE_CLOSING: 2387 case STATE_STOPPING: 2388 case STATE_REQ_SENT: 2389 case STATE_ACK_RCVD: 2390 case STATE_ACK_SENT: 2391 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2392 break; 2393 } 2394 } 2395 2396 /* 2397 *--------------------------------------------------------------------------* 2398 * * 2399 * The LCP implementation. * 2400 * * 2401 *--------------------------------------------------------------------------* 2402 */ 2403 static void 2404 sppp_lcp_init(struct sppp *sp) 2405 { 2406 2407 KASSERT(SPPP_WLOCKED(sp)); 2408 2409 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2410 sp->lcp.magic = 0; 2411 sp->scp[IDX_LCP].state = STATE_INITIAL; 2412 sp->scp[IDX_LCP].fail_counter = 0; 2413 sp->scp[IDX_LCP].seq = 0; 2414 sp->scp[IDX_LCP].rseq = 0; 2415 sp->lcp.protos = 0; 2416 2417 /* 2418 * Initialize counters and timeout values. Note that we don't 2419 * use the 3 seconds suggested in RFC 1661 since we are likely 2420 * running on a fast link. XXX We should probably implement 2421 * the exponential backoff option. Note that these values are 2422 * relevant for all control protocols, not just LCP only. 2423 */ 2424 sp->lcp.timeout = 1 * hz; 2425 sp->lcp.max_terminate = 2; 2426 sp->lcp.max_configure = 10; 2427 sp->lcp.max_failure = 10; 2428 sppp_cp_init(&lcp, sp); 2429 } 2430 2431 static void 2432 sppp_lcp_up(struct sppp *sp, void *xcp) 2433 { 2434 const struct cp *cp = xcp; 2435 int pidx; 2436 STDDCL; 2437 2438 KASSERT(SPPP_WLOCKED(sp)); 2439 2440 pidx = cp->protoidx; 2441 /* Initialize activity timestamp: opening a connection is an activity */ 2442 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2443 2444 /* 2445 * If this interface is passive or dial-on-demand, and we are 2446 * still in Initial state, it means we've got an incoming 2447 * call. Activate the interface. 2448 */ 2449 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2450 if (debug) 2451 log(LOG_DEBUG, 2452 "%s: Up event", ifp->if_xname); 2453 ifp->if_flags |= IFF_RUNNING; 2454 if (sp->scp[pidx].state == STATE_INITIAL) { 2455 if (debug) 2456 addlog("(incoming call)\n"); 2457 sp->pp_flags |= PP_CALLIN; 2458 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2459 } else if (debug) 2460 addlog("\n"); 2461 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2462 (sp->scp[IDX_LCP].state == STATE_INITIAL)) { 2463 ifp->if_flags |= IFF_RUNNING; 2464 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2465 } 2466 2467 sppp_up_event(sp, xcp); 2468 } 2469 2470 static void 2471 sppp_lcp_down(struct sppp *sp, void *xcp) 2472 { 2473 STDDCL; 2474 2475 KASSERT(SPPP_WLOCKED(sp)); 2476 2477 sppp_down_event(sp, xcp); 2478 2479 /* 2480 * If this is neither a dial-on-demand nor a passive 2481 * interface, simulate an ``ifconfig down'' action, so the 2482 * administrator can force a redial by another ``ifconfig 2483 * up''. XXX For leased line operation, should we immediately 2484 * try to reopen the connection here? 2485 */ 2486 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2487 if (debug) 2488 log(LOG_INFO, 2489 "%s: Down event (carrier loss), taking interface down.\n", 2490 ifp->if_xname); 2491 SPPP_UNLOCK(sp); 2492 if_down(ifp); 2493 SPPP_LOCK(sp, RW_WRITER); 2494 2495 if (sp->lcp.reestablish) 2496 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2497 } else { 2498 if (debug) 2499 log(LOG_DEBUG, 2500 "%s: Down event (carrier loss)\n", 2501 ifp->if_xname); 2502 } 2503 sp->scp[IDX_LCP].fail_counter = 0; 2504 sp->pp_flags &= ~PP_CALLIN; 2505 if (sp->scp[IDX_LCP].state != STATE_INITIAL) 2506 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2507 ifp->if_flags &= ~IFF_RUNNING; 2508 2509 } 2510 2511 static void 2512 sppp_lcp_open(struct sppp *sp, void *xcp) 2513 { 2514 2515 KASSERT(SPPP_WLOCKED(sp)); 2516 2517 sp->lcp.reestablish = false; 2518 2519 if (sp->pp_if.if_mtu < PP_MTU) { 2520 sp->lcp.mru = sp->pp_if.if_mtu; 2521 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2522 } else 2523 sp->lcp.mru = PP_MTU; 2524 sp->lcp.their_mru = PP_MTU; 2525 2526 /* 2527 * If we are authenticator, negotiate LCP_AUTH 2528 */ 2529 if (sp->hisauth.proto != 0) 2530 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2531 else 2532 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2533 sp->pp_flags &= ~PP_NEEDAUTH; 2534 sppp_open_event(sp, xcp); 2535 } 2536 2537 static void 2538 sppp_lcp_close(struct sppp *sp, void *xcp) 2539 { 2540 2541 KASSERT(SPPP_WLOCKED(sp)); 2542 sppp_close_event(sp, xcp); 2543 } 2544 2545 static void 2546 sppp_lcp_TO(struct sppp *sp, void *xcp) 2547 { 2548 2549 sppp_to_event(sp, xcp); 2550 } 2551 2552 /* 2553 * Analyze a configure request. Return true if it was agreeable, and 2554 * caused action sca, false if it has been rejected or nak'ed, and 2555 * caused action scn. (The return value is used to make the state 2556 * transition decision in the state automaton.) 2557 */ 2558 static int 2559 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int origlen) 2560 { 2561 STDDCL; 2562 u_char *buf, *r, *p, l, blen, type; 2563 int len, rlen; 2564 uint32_t nmagic; 2565 u_short authproto; 2566 2567 KASSERT(SPPP_WLOCKED(sp)); 2568 2569 if (origlen < sizeof(*h)) 2570 return 0; 2571 2572 origlen -= sizeof(*h); 2573 type = 0; 2574 2575 if (origlen <= 0) 2576 return 0; 2577 else 2578 blen = origlen; 2579 2580 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2581 if (buf == NULL) 2582 return 0; 2583 2584 if (debug) 2585 log(LOG_DEBUG, "%s: lcp parse opts:", 2586 ifp->if_xname); 2587 2588 /* pass 1: check for things that need to be rejected */ 2589 p = (void *)(h + 1); 2590 r = buf; 2591 rlen = 0; 2592 for (len = origlen; len > 1; len-= l, p += l) { 2593 l = p[1]; 2594 if (l == 0) 2595 break; 2596 2597 /* Sanity check option length */ 2598 if (l > len) { 2599 /* 2600 * Malicious option - drop immediately. 2601 * XXX Maybe we should just RXJ it? 2602 */ 2603 addlog("%s: received malicious LCP option 0x%02x, " 2604 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2605 p[0], l, len); 2606 rlen = -1; 2607 goto end; 2608 } 2609 if (debug) 2610 addlog(" %s", sppp_lcp_opt_name(*p)); 2611 switch (p[0]) { 2612 case LCP_OPT_MAGIC: 2613 /* Magic number. */ 2614 /* fall through, both are same length */ 2615 case LCP_OPT_ASYNC_MAP: 2616 /* Async control character map. */ 2617 if (len >= 6 || l == 6) 2618 continue; 2619 if (debug) 2620 addlog(" [invalid]"); 2621 break; 2622 case LCP_OPT_MP_EID: 2623 if (len >= l && l >= 3) { 2624 switch (p[2]) { 2625 case 0: if (l==3+ 0) continue;break; 2626 case 2: if (l==3+ 4) continue;break; 2627 case 3: if (l==3+ 6) continue;break; 2628 case 6: if (l==3+16) continue;break; 2629 case 1: /* FALLTHROUGH */ 2630 case 4: if (l<=3+20) continue;break; 2631 case 5: if (l<=3+15) continue;break; 2632 /* XXX should it be default: continue;? */ 2633 } 2634 } 2635 if (debug) 2636 addlog(" [invalid class %d len %d]", p[2], l); 2637 break; 2638 case LCP_OPT_MP_SSNHF: 2639 if (len >= 2 && l == 2) { 2640 if (debug) 2641 addlog(" [rej]"); 2642 break; 2643 } 2644 if (debug) 2645 addlog(" [invalid]"); 2646 break; 2647 case LCP_OPT_MP_MRRU: 2648 /* Multilink maximum received reconstructed unit */ 2649 /* should be fall through, both are same length */ 2650 /* FALLTHROUGH */ 2651 case LCP_OPT_MRU: 2652 /* Maximum receive unit. */ 2653 if (len >= 4 && l == 4) 2654 continue; 2655 if (debug) 2656 addlog(" [invalid]"); 2657 break; 2658 case LCP_OPT_AUTH_PROTO: 2659 if (len < 4) { 2660 if (debug) 2661 addlog(" [invalid]"); 2662 break; 2663 } 2664 authproto = (p[2] << 8) + p[3]; 2665 if (authproto == PPP_CHAP && l != 5) { 2666 if (debug) 2667 addlog(" [invalid chap len]"); 2668 break; 2669 } 2670 if (sp->myauth.proto == 0) { 2671 /* we are not configured to do auth */ 2672 if (debug) 2673 addlog(" [not configured]"); 2674 break; 2675 } 2676 /* 2677 * Remote want us to authenticate, remember this, 2678 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2679 * up. 2680 */ 2681 sp->pp_flags |= PP_NEEDAUTH; 2682 continue; 2683 default: 2684 /* Others not supported. */ 2685 if (debug) 2686 addlog(" [rej]"); 2687 break; 2688 } 2689 if (rlen + l > blen) { 2690 if (debug) 2691 addlog(" [overflow]"); 2692 continue; 2693 } 2694 /* Add the option to rejected list. */ 2695 memcpy(r, p, l); 2696 r += l; 2697 rlen += l; 2698 } 2699 2700 if (rlen > 0) { 2701 type = CONF_REJ; 2702 goto end; 2703 } 2704 2705 if (debug) 2706 addlog("\n"); 2707 2708 /* 2709 * pass 2: check for option values that are unacceptable and 2710 * thus require to be nak'ed. 2711 */ 2712 if (debug) 2713 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2714 ifp->if_xname); 2715 2716 p = (void *)(h + 1); 2717 r = buf; 2718 rlen = 0; 2719 for (len = origlen; len > 0; len -= l, p += l) { 2720 l = p[1]; 2721 if (l == 0) 2722 break; 2723 2724 if (debug) 2725 addlog(" %s", sppp_lcp_opt_name(*p)); 2726 switch (p[0]) { 2727 case LCP_OPT_MAGIC: 2728 /* Magic number -- extract. */ 2729 nmagic = (uint32_t)p[2] << 24 | 2730 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2731 if (nmagic != sp->lcp.magic) { 2732 if (debug) 2733 addlog(" 0x%x", nmagic); 2734 continue; 2735 } 2736 /* 2737 * Local and remote magics equal -- loopback? 2738 */ 2739 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2740 printf ("%s: loopback\n", 2741 ifp->if_xname); 2742 sp->pp_loopcnt = 0; 2743 if (ifp->if_flags & IFF_UP) { 2744 SPPP_UNLOCK(sp); 2745 if_down(ifp); 2746 SPPP_LOCK(sp, RW_WRITER); 2747 2748 IF_PURGE(&sp->pp_cpq); 2749 /* XXX ? */ 2750 sppp_wq_add(sp->wq_cp, 2751 &sp->scp[IDX_LCP].work_down); 2752 sppp_wq_add(sp->wq_cp, 2753 &sp->scp[IDX_LCP].work_up); 2754 } 2755 } else if (debug) 2756 addlog(" [glitch]"); 2757 ++sp->pp_loopcnt; 2758 /* 2759 * We negate our magic here, and NAK it. If 2760 * we see it later in an NAK packet, we 2761 * suggest a new one. 2762 */ 2763 nmagic = ~sp->lcp.magic; 2764 /* Gonna NAK it. */ 2765 p[2] = nmagic >> 24; 2766 p[3] = nmagic >> 16; 2767 p[4] = nmagic >> 8; 2768 p[5] = nmagic; 2769 break; 2770 2771 case LCP_OPT_ASYNC_MAP: 2772 /* 2773 * Async control character map -- just ignore it. 2774 * 2775 * Quote from RFC 1662, chapter 6: 2776 * To enable this functionality, synchronous PPP 2777 * implementations MUST always respond to the 2778 * Async-Control-Character-Map Configuration 2779 * Option with the LCP Configure-Ack. However, 2780 * acceptance of the Configuration Option does 2781 * not imply that the synchronous implementation 2782 * will do any ACCM mapping. Instead, all such 2783 * octet mapping will be performed by the 2784 * asynchronous-to-synchronous converter. 2785 */ 2786 continue; 2787 2788 case LCP_OPT_MRU: 2789 /* 2790 * Maximum receive unit. Always agreeable, 2791 * but ignored by now. 2792 */ 2793 sp->lcp.their_mru = p[2] * 256 + p[3]; 2794 if (debug) 2795 addlog(" %ld", sp->lcp.their_mru); 2796 continue; 2797 2798 case LCP_OPT_AUTH_PROTO: 2799 authproto = (p[2] << 8) + p[3]; 2800 if (sp->myauth.proto != authproto) { 2801 /* not agreed, nak */ 2802 if (debug) 2803 addlog(" [mine %s != his %s]", 2804 sppp_proto_name(sp->myauth.proto), 2805 sppp_proto_name(authproto)); 2806 p[2] = sp->myauth.proto >> 8; 2807 p[3] = sp->myauth.proto; 2808 break; 2809 } 2810 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2811 if (debug) 2812 addlog(" [chap not MD5]"); 2813 p[4] = CHAP_MD5; 2814 break; 2815 } 2816 continue; 2817 case LCP_OPT_MP_EID: 2818 /* 2819 * Endpoint identification. 2820 * Always agreeable, 2821 * but ignored by now. 2822 */ 2823 if (debug) { 2824 addlog(" type %d", p[2]); 2825 sppp_print_bytes(p+3, p[1]-3); 2826 } 2827 continue; 2828 case LCP_OPT_MP_MRRU: 2829 /* 2830 * Maximum received reconstructed unit. 2831 * Always agreeable, 2832 * but ignored by now. 2833 */ 2834 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2835 if (debug) 2836 addlog(" %ld", sp->lcp.their_mrru); 2837 continue; 2838 } 2839 if (rlen + l > blen) { 2840 if (debug) 2841 addlog(" [overflow]"); 2842 continue; 2843 } 2844 /* Add the option to nak'ed list. */ 2845 memcpy(r, p, l); 2846 r += l; 2847 rlen += l; 2848 } 2849 2850 if (rlen > 0) { 2851 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2852 if (debug) 2853 addlog(" max_failure (%d) exceeded, ", 2854 sp->lcp.max_failure); 2855 type = CONF_REJ; 2856 } else { 2857 type = CONF_NAK; 2858 } 2859 } else { 2860 type = CONF_ACK; 2861 rlen = origlen; 2862 memcpy(r, h + 1, rlen); 2863 sp->scp[IDX_LCP].fail_counter = 0; 2864 sp->pp_loopcnt = 0; 2865 } 2866 2867 end: 2868 if (debug) 2869 addlog("\n"); 2870 2871 if (sp->scp[IDX_LCP].rcr_buf != NULL) { 2872 kmem_intr_free(sp->scp[IDX_LCP].rcr_buf, 2873 sp->scp[IDX_LCP].rcr_blen); 2874 } 2875 2876 if (rlen < 0) { 2877 kmem_intr_free(buf, blen); 2878 sp->scp[IDX_IPCP].rcr_buf = NULL; 2879 sp->scp[IDX_IPCP].rcr_rlen = 0; 2880 return -1; 2881 } 2882 2883 sp->scp[IDX_LCP].rcr_type = type; 2884 sp->scp[IDX_LCP].rcr_buf = buf; 2885 sp->scp[IDX_LCP].rcr_blen = blen; 2886 sp->scp[IDX_LCP].rcr_rlen = rlen; 2887 2888 if (type != CONF_ACK) 2889 return 0; 2890 return 1; 2891 } 2892 2893 /* 2894 * Analyze the LCP Configure-Reject option list, and adjust our 2895 * negotiation. 2896 */ 2897 static void 2898 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2899 { 2900 STDDCL; 2901 u_char *p, l; 2902 2903 KASSERT(SPPP_WLOCKED(sp)); 2904 2905 if (len <= sizeof(*h)) 2906 return; 2907 2908 len -= sizeof(*h); 2909 2910 if (debug) 2911 log(LOG_DEBUG, "%s: lcp rej opts:", 2912 ifp->if_xname); 2913 2914 p = (void *)(h + 1); 2915 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2916 /* Sanity check option length */ 2917 if (l > len) { 2918 /* 2919 * Malicious option - drop immediately. 2920 * XXX Maybe we should just RXJ it? 2921 */ 2922 addlog("%s: received malicious LCP option, " 2923 "dropping.\n", ifp->if_xname); 2924 goto end; 2925 } 2926 if (debug) 2927 addlog(" %s", sppp_lcp_opt_name(*p)); 2928 switch (p[0]) { 2929 case LCP_OPT_MAGIC: 2930 /* Magic number -- can't use it, use 0 */ 2931 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2932 sp->lcp.magic = 0; 2933 break; 2934 case LCP_OPT_MRU: 2935 /* 2936 * We try to negotiate a lower MRU if the underlying 2937 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2938 * peer rejects this lower rate, fallback to the 2939 * default. 2940 */ 2941 if (debug) { 2942 addlog("%s: warning: peer rejected our MRU of " 2943 "%ld bytes. Defaulting to %d bytes\n", 2944 ifp->if_xname, sp->lcp.mru, PP_MTU); 2945 } 2946 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2947 sp->lcp.mru = PP_MTU; 2948 break; 2949 case LCP_OPT_AUTH_PROTO: 2950 /* 2951 * Peer doesn't want to authenticate himself, 2952 * deny unless this is a dialout call, and 2953 * SPPP_AUTHFLAG_NOCALLOUT is set. 2954 */ 2955 if ((sp->pp_flags & PP_CALLIN) == 0 && 2956 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2957 if (debug) 2958 addlog(" [don't insist on auth " 2959 "for callout]"); 2960 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2961 break; 2962 } 2963 if (debug) 2964 addlog("[access denied]\n"); 2965 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2966 break; 2967 } 2968 } 2969 if (debug) 2970 addlog("\n"); 2971 end: 2972 return; 2973 } 2974 2975 /* 2976 * Analyze the LCP Configure-NAK option list, and adjust our 2977 * negotiation. 2978 */ 2979 static void 2980 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2981 { 2982 STDDCL; 2983 u_char *p, l; 2984 uint32_t magic; 2985 2986 KASSERT(SPPP_WLOCKED(sp)); 2987 2988 if (len <= sizeof(*h)) 2989 return; 2990 len -= sizeof(*h); 2991 2992 if (debug) 2993 log(LOG_DEBUG, "%s: lcp nak opts:", 2994 ifp->if_xname); 2995 2996 p = (void *)(h + 1); 2997 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2998 /* Sanity check option length */ 2999 if (l > len) { 3000 /* 3001 * Malicious option - drop immediately. 3002 * XXX Maybe we should just RXJ it? 3003 */ 3004 addlog("%s: received malicious LCP option, " 3005 "dropping.\n", ifp->if_xname); 3006 goto end; 3007 } 3008 if (debug) 3009 addlog(" %s", sppp_lcp_opt_name(*p)); 3010 switch (p[0]) { 3011 case LCP_OPT_MAGIC: 3012 /* Magic number -- renegotiate */ 3013 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 3014 len >= 6 && l == 6) { 3015 magic = (uint32_t)p[2] << 24 | 3016 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3017 /* 3018 * If the remote magic is our negated one, 3019 * this looks like a loopback problem. 3020 * Suggest a new magic to make sure. 3021 */ 3022 if (magic == ~sp->lcp.magic) { 3023 if (debug) 3024 addlog(" magic glitch"); 3025 sp->lcp.magic = cprng_fast32(); 3026 } else { 3027 sp->lcp.magic = magic; 3028 if (debug) 3029 addlog(" %d", magic); 3030 } 3031 } 3032 break; 3033 case LCP_OPT_MRU: 3034 /* 3035 * Peer wants to advise us to negotiate an MRU. 3036 * Agree on it if it's reasonable, or use 3037 * default otherwise. 3038 */ 3039 if (len >= 4 && l == 4) { 3040 u_int mru = p[2] * 256 + p[3]; 3041 if (debug) 3042 addlog(" %d", mru); 3043 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3044 mru = sp->pp_if.if_mtu; 3045 sp->lcp.mru = mru; 3046 sp->lcp.opts |= (1 << LCP_OPT_MRU); 3047 } 3048 break; 3049 case LCP_OPT_AUTH_PROTO: 3050 /* 3051 * Peer doesn't like our authentication method, 3052 * deny. 3053 */ 3054 if (debug) 3055 addlog("[access denied]\n"); 3056 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3057 break; 3058 } 3059 } 3060 if (debug) 3061 addlog("\n"); 3062 end: 3063 return; 3064 } 3065 3066 static void 3067 sppp_lcp_tlu(struct sppp *sp) 3068 { 3069 struct ifnet *ifp = &sp->pp_if; 3070 int i; 3071 3072 KASSERT(SPPP_WLOCKED(sp)); 3073 3074 /* XXX ? */ 3075 if (! (ifp->if_flags & IFF_UP) && 3076 (ifp->if_flags & IFF_RUNNING)) { 3077 /* Coming out of loopback mode. */ 3078 SPPP_UNLOCK(sp); 3079 if_up(ifp); 3080 SPPP_LOCK(sp, RW_WRITER); 3081 } 3082 3083 for (i = 0; i < IDX_COUNT; i++) 3084 if ((cps[i])->flags & CP_QUAL) { 3085 (cps[i])->Open(sp, __UNCONST(&cps[i])); 3086 } 3087 3088 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 3089 (sp->pp_flags & PP_NEEDAUTH) != 0) 3090 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3091 else 3092 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3093 3094 /* 3095 * Open all authentication protocols. This is even required 3096 * if we already proceeded to network phase, since it might be 3097 * that remote wants us to authenticate, so we might have to 3098 * send a PAP request. Undesired authentication protocols 3099 * don't do anything when they get an Open event. 3100 */ 3101 for (i = 0; i < IDX_COUNT; i++) 3102 if ((cps[i])->flags & CP_AUTH) { 3103 sppp_wq_add(sp->wq_cp, 3104 &sp->scp[(cps[i])->protoidx].work_open); 3105 } 3106 3107 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 3108 /* Notify all NCPs. */ 3109 for (i = 0; i < IDX_COUNT; i++) 3110 if ((cps[i])->flags & CP_NCP) { 3111 sppp_wq_add(sp->wq_cp, 3112 &sp->scp[(cps[i])->protoidx].work_open); 3113 } 3114 } 3115 3116 /* notify low-level driver of state change */ 3117 sppp_notify_chg_wlocked(sp); 3118 } 3119 3120 static void 3121 sppp_lcp_tld(struct sppp *sp) 3122 { 3123 int i, pi, phase; 3124 3125 KASSERT(SPPP_WLOCKED(sp)); 3126 3127 phase = sp->pp_phase; 3128 3129 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3130 3131 /* 3132 * Take upper layers down. We send the Down event first and 3133 * the Close second to prevent the upper layers from sending 3134 * ``a flurry of terminate-request packets'', as the RFC 3135 * describes it. 3136 */ 3137 for (i = 0; i < IDX_COUNT; i++) { 3138 pi = (cps[i])->protoidx; 3139 if (((cps[i])->flags & CP_LCP) == 0) { 3140 /* skip if ncp was not started */ 3141 if (phase != SPPP_PHASE_NETWORK && 3142 ((cps[i])->flags & CP_NCP) != 0) 3143 continue; 3144 3145 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_down); 3146 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_close); 3147 } 3148 } 3149 } 3150 3151 static void 3152 sppp_lcp_tls(struct sppp *sp) 3153 { 3154 3155 KASSERT(SPPP_WLOCKED(sp)); 3156 3157 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3158 printf("%s: authentication failed %d times, not retrying again\n", 3159 sp->pp_if.if_xname, sp->pp_auth_failures); 3160 3161 SPPP_UNLOCK(sp); 3162 if_down(&sp->pp_if); 3163 SPPP_LOCK(sp, RW_WRITER); 3164 return; 3165 } 3166 3167 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3168 3169 /* Notify lower layer if desired. */ 3170 sppp_notify_tls_wlocked(sp); 3171 } 3172 3173 static void 3174 sppp_lcp_tlf(struct sppp *sp) 3175 { 3176 3177 KASSERT(SPPP_WLOCKED(sp)); 3178 3179 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3180 3181 /* Notify lower layer if desired. */ 3182 sppp_notify_tlf_wlocked(sp); 3183 } 3184 3185 static void 3186 sppp_lcp_scr(struct sppp *sp) 3187 { 3188 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3189 int i = 0; 3190 u_short authproto; 3191 3192 KASSERT(SPPP_WLOCKED(sp)); 3193 3194 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 3195 if (! sp->lcp.magic) 3196 sp->lcp.magic = cprng_fast32(); 3197 opt[i++] = LCP_OPT_MAGIC; 3198 opt[i++] = 6; 3199 opt[i++] = sp->lcp.magic >> 24; 3200 opt[i++] = sp->lcp.magic >> 16; 3201 opt[i++] = sp->lcp.magic >> 8; 3202 opt[i++] = sp->lcp.magic; 3203 } 3204 3205 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 3206 opt[i++] = LCP_OPT_MRU; 3207 opt[i++] = 4; 3208 opt[i++] = sp->lcp.mru >> 8; 3209 opt[i++] = sp->lcp.mru; 3210 } 3211 3212 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 3213 authproto = sp->hisauth.proto; 3214 opt[i++] = LCP_OPT_AUTH_PROTO; 3215 opt[i++] = authproto == PPP_CHAP? 5: 4; 3216 opt[i++] = authproto >> 8; 3217 opt[i++] = authproto; 3218 if (authproto == PPP_CHAP) 3219 opt[i++] = CHAP_MD5; 3220 } 3221 3222 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3223 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3224 } 3225 3226 /* 3227 * Check the open NCPs, return true if at least one NCP is open. 3228 */ 3229 static int 3230 sppp_ncp_check(struct sppp *sp) 3231 { 3232 int i, mask; 3233 3234 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3235 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 3236 return 1; 3237 return 0; 3238 } 3239 3240 static int 3241 sppp_auth_check(struct sppp *sp) 3242 { 3243 int i, mask; 3244 3245 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3246 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_AUTH) 3247 return 1; 3248 return 0; 3249 } 3250 3251 /* 3252 * Re-check the open NCPs and see if we should terminate the link. 3253 * Called by the NCPs during their tlf action handling. 3254 */ 3255 static void 3256 sppp_lcp_check_and_close(struct sppp *sp) 3257 { 3258 3259 KASSERT(SPPP_WLOCKED(sp)); 3260 3261 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3262 /* don't bother, we are already going down */ 3263 return; 3264 } 3265 3266 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3267 sppp_auth_check(sp)) 3268 return; 3269 3270 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3271 sppp_ncp_check(sp)) 3272 return; 3273 3274 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3275 } 3276 3277 static void 3278 sppp_lcp_uls(const struct cp *cp, struct sppp *sp) 3279 { 3280 3281 sp->lcp.protos |= (1 << cp->protoidx); 3282 if (sp->scp[IDX_LCP].state == STATE_OPENED) 3283 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_up); 3284 } 3285 3286 static void 3287 sppp_lcp_ulf(const struct cp *cp, struct sppp *sp) 3288 { 3289 3290 sp->lcp.protos &= ~(1 << cp->protoidx); 3291 sppp_lcp_check_and_close(sp); 3292 } 3293 3294 /* 3295 *--------------------------------------------------------------------------* 3296 * * 3297 * The IPCP implementation. * 3298 * * 3299 *--------------------------------------------------------------------------* 3300 */ 3301 3302 static void 3303 sppp_ipcp_init(struct sppp *sp) 3304 { 3305 int error; 3306 3307 KASSERT(SPPP_WLOCKED(sp)); 3308 3309 sp->ipcp.opts = 0; 3310 sp->ipcp.flags = 0; 3311 sp->scp[IDX_IPCP].state = STATE_INITIAL; 3312 sp->scp[IDX_IPCP].fail_counter = 0; 3313 sp->scp[IDX_IPCP].seq = 0; 3314 sp->scp[IDX_IPCP].rseq = 0; 3315 sppp_cp_init(&ipcp, sp); 3316 3317 error = workqueue_create(&sp->ipcp.update_addrs_wq, "ipcp_addr", 3318 sppp_update_ip_addrs_work, sp, PRI_SOFTNET, IPL_NET, 0); 3319 if (error) 3320 panic("%s: update_addrs workqueue_create failed (%d)\n", 3321 __func__, error); 3322 sp->ipcp.update_addrs_q = pcq_create(IPCP_UPDATE_LIMIT, KM_SLEEP); 3323 3324 sp->ipcp.update_addrs_enqueued = 0; 3325 } 3326 3327 static void 3328 sppp_ipcp_up(struct sppp *sp, void *xcp) 3329 { 3330 KASSERT(SPPP_WLOCKED(sp)); 3331 sppp_up_event(sp, xcp); 3332 } 3333 3334 static void 3335 sppp_ipcp_down(struct sppp *sp, void *xcp) 3336 { 3337 KASSERT(SPPP_WLOCKED(sp)); 3338 sppp_down_event(sp, xcp); 3339 } 3340 3341 static void 3342 sppp_ipcp_open(struct sppp *sp, void *xcp) 3343 { 3344 STDDCL; 3345 uint32_t myaddr, hisaddr; 3346 3347 KASSERT(SPPP_WLOCKED(sp)); 3348 3349 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3350 sp->ipcp.req_myaddr = 0; 3351 sp->ipcp.req_hisaddr = 0; 3352 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3353 3354 #ifdef INET 3355 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3356 #else 3357 myaddr = hisaddr = 0; 3358 #endif 3359 /* 3360 * If we don't have his address, this probably means our 3361 * interface doesn't want to talk IP at all. (This could 3362 * be the case if somebody wants to speak only IPX, for 3363 * example.) Don't open IPCP in this case. 3364 */ 3365 if (hisaddr == 0) { 3366 /* XXX this message should go away */ 3367 if (debug) 3368 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 3369 ifp->if_xname); 3370 return; 3371 } 3372 3373 if (myaddr == 0) { 3374 /* 3375 * I don't have an assigned address, so i need to 3376 * negotiate my address. 3377 */ 3378 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3379 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3380 } 3381 if (hisaddr == 1) { 3382 /* 3383 * XXX - remove this hack! 3384 * remote has no valid address, we need to get one assigned. 3385 */ 3386 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3387 } 3388 sppp_open_event(sp, xcp); 3389 } 3390 3391 static void 3392 sppp_ipcp_close(struct sppp *sp, void *xcp) 3393 { 3394 3395 KASSERT(SPPP_WLOCKED(sp)); 3396 3397 sppp_close_event(sp, xcp); 3398 3399 #ifdef INET 3400 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 3401 /* 3402 * Some address was dynamic, clear it again. 3403 */ 3404 sppp_clear_ip_addrs(sp); 3405 #endif 3406 } 3407 3408 static void 3409 sppp_ipcp_TO(struct sppp *sp, void *xcp) 3410 { 3411 3412 sppp_to_event(sp, xcp); 3413 } 3414 3415 /* 3416 * Analyze a configure request. Return true if it was agreeable, and 3417 * caused action sca, false if it has been rejected or nak'ed, and 3418 * caused action scn. (The return value is used to make the state 3419 * transition decision in the state automaton.) 3420 */ 3421 static int 3422 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int origlen) 3423 { 3424 u_char *buf, *r, *p, l, blen, type; 3425 struct ifnet *ifp = &sp->pp_if; 3426 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3427 uint32_t hisaddr, desiredaddr; 3428 3429 KASSERT(SPPP_WLOCKED(sp)); 3430 3431 if (origlen < sizeof(*h)) 3432 return 0; 3433 3434 origlen -= sizeof(*h); 3435 type = 0; 3436 3437 /* 3438 * Make sure to allocate a buf that can at least hold a 3439 * conf-nak with an `address' option. We might need it below. 3440 */ 3441 blen = MAX(6, origlen); 3442 3443 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3444 if (buf == NULL) 3445 return 0; 3446 3447 /* pass 1: see if we can recognize them */ 3448 if (debug) 3449 log(LOG_DEBUG, "%s: ipcp parse opts:", 3450 ifp->if_xname); 3451 p = (void *)(h + 1); 3452 r = buf; 3453 rlen = 0; 3454 for (len = origlen; len > 1; len -= l, p += l) { 3455 l = p[1]; 3456 if (l == 0) 3457 break; 3458 3459 /* Sanity check option length */ 3460 if (l > len) { 3461 /* XXX should we just RXJ? */ 3462 addlog("%s: malicious IPCP option received, dropping\n", 3463 ifp->if_xname); 3464 rlen = -1; 3465 goto end; 3466 } 3467 if (debug) 3468 addlog(" %s", sppp_ipcp_opt_name(*p)); 3469 switch (p[0]) { 3470 #ifdef notyet 3471 case IPCP_OPT_COMPRESSION: 3472 if (len >= 6 && l >= 6) { 3473 /* correctly formed compress option */ 3474 continue; 3475 } 3476 if (debug) 3477 addlog(" [invalid]"); 3478 break; 3479 #endif 3480 case IPCP_OPT_ADDRESS: 3481 if (len >= 6 && l == 6) { 3482 /* correctly formed address option */ 3483 continue; 3484 } 3485 if (debug) 3486 addlog(" [invalid]"); 3487 break; 3488 default: 3489 /* Others not supported. */ 3490 if (debug) 3491 addlog(" [rej]"); 3492 break; 3493 } 3494 /* Add the option to rejected list. */ 3495 if (rlen + l > blen) { 3496 if (debug) 3497 addlog(" [overflow]"); 3498 continue; 3499 } 3500 memcpy(r, p, l); 3501 r += l; 3502 rlen += l; 3503 } 3504 3505 if (rlen > 0) { 3506 type = CONF_REJ; 3507 goto end; 3508 } 3509 3510 if (debug) 3511 addlog("\n"); 3512 3513 /* pass 2: parse option values */ 3514 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3515 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3516 else 3517 #ifdef INET 3518 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3519 #else 3520 hisaddr = 0; 3521 #endif 3522 if (debug) 3523 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 3524 ifp->if_xname); 3525 p = (void *)(h + 1); 3526 r = buf; 3527 rlen = 0; 3528 for (len = origlen; len > 1; len -= l, p += l) { 3529 l = p[1]; 3530 if (l == 0) 3531 break; 3532 3533 if (debug) 3534 addlog(" %s", sppp_ipcp_opt_name(*p)); 3535 switch (p[0]) { 3536 #ifdef notyet 3537 case IPCP_OPT_COMPRESSION: 3538 continue; 3539 #endif 3540 case IPCP_OPT_ADDRESS: 3541 desiredaddr = p[2] << 24 | p[3] << 16 | 3542 p[4] << 8 | p[5]; 3543 if (desiredaddr == hisaddr || 3544 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3545 /* 3546 * Peer's address is same as our value, 3547 * this is agreeable. Gonna conf-ack 3548 * it. 3549 */ 3550 if (debug) 3551 addlog(" %s [ack]", 3552 sppp_dotted_quad(hisaddr)); 3553 /* record that we've seen it already */ 3554 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3555 sp->ipcp.req_hisaddr = desiredaddr; 3556 hisaddr = desiredaddr; 3557 continue; 3558 } 3559 /* 3560 * The address wasn't agreeable. This is either 3561 * he sent us 0.0.0.0, asking to assign him an 3562 * address, or he send us another address not 3563 * matching our value. Either case, we gonna 3564 * conf-nak it with our value. 3565 */ 3566 if (debug) { 3567 if (desiredaddr == 0) 3568 addlog(" [addr requested]"); 3569 else 3570 addlog(" %s [not agreed]", 3571 sppp_dotted_quad(desiredaddr)); 3572 } 3573 3574 p[2] = hisaddr >> 24; 3575 p[3] = hisaddr >> 16; 3576 p[4] = hisaddr >> 8; 3577 p[5] = hisaddr; 3578 break; 3579 } 3580 if (rlen + l > blen) { 3581 if (debug) 3582 addlog(" [overflow]"); 3583 continue; 3584 } 3585 /* Add the option to nak'ed list. */ 3586 memcpy(r, p, l); 3587 r += l; 3588 rlen += l; 3589 } 3590 3591 if (rlen > 0) { 3592 type = CONF_NAK; 3593 } else { 3594 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3595 /* 3596 * If we are about to conf-ack the request, but haven't seen 3597 * his address so far, gonna conf-nak it instead, with the 3598 * `address' option present and our idea of his address being 3599 * filled in there, to request negotiation of both addresses. 3600 * 3601 * XXX This can result in an endless req - nak loop if peer 3602 * doesn't want to send us his address. Q: What should we do 3603 * about it? XXX A: implement the max-failure counter. 3604 */ 3605 buf[0] = IPCP_OPT_ADDRESS; 3606 buf[1] = 6; 3607 buf[2] = hisaddr >> 24; 3608 buf[3] = hisaddr >> 16; 3609 buf[4] = hisaddr >> 8; 3610 buf[5] = hisaddr; 3611 rlen = 6; 3612 if (debug) 3613 addlog(" still need hisaddr"); 3614 type = CONF_NAK; 3615 } else { 3616 type = CONF_ACK; 3617 rlen = origlen; 3618 memcpy(r, h + 1, rlen); 3619 } 3620 } 3621 3622 end: 3623 if (debug) 3624 addlog("\n"); 3625 3626 if (rlen < 0) { 3627 kmem_intr_free(buf, blen); 3628 return -1; 3629 } 3630 3631 if (sp->scp[IDX_IPCP].rcr_buf != NULL) { 3632 kmem_intr_free(sp->scp[IDX_IPCP].rcr_buf, 3633 sp->scp[IDX_IPCP].rcr_blen); 3634 } 3635 3636 sp->scp[IDX_IPCP].rcr_type = type; 3637 sp->scp[IDX_IPCP].rcr_buf = buf; 3638 sp->scp[IDX_IPCP].rcr_blen = blen; 3639 sp->scp[IDX_IPCP].rcr_rlen = rlen; 3640 3641 if (type != CONF_ACK) 3642 return 0; 3643 return 1; 3644 } 3645 3646 /* 3647 * Analyze the IPCP Configure-Reject option list, and adjust our 3648 * negotiation. 3649 */ 3650 static void 3651 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3652 { 3653 u_char *p, l; 3654 struct ifnet *ifp = &sp->pp_if; 3655 int debug = ifp->if_flags & IFF_DEBUG; 3656 3657 KASSERT(SPPP_WLOCKED(sp)); 3658 3659 if (len <= sizeof(*h)) 3660 return; 3661 3662 len -= sizeof(*h); 3663 3664 if (debug) 3665 log(LOG_DEBUG, "%s: ipcp rej opts:", 3666 ifp->if_xname); 3667 3668 p = (void *)(h + 1); 3669 for (; len > 1; len -= l, p += l) { 3670 l = p[1]; 3671 if (l == 0) 3672 break; 3673 3674 /* Sanity check option length */ 3675 if (l > len) { 3676 /* XXX should we just RXJ? */ 3677 addlog("%s: malicious IPCP option received, dropping\n", 3678 ifp->if_xname); 3679 goto end; 3680 } 3681 if (debug) 3682 addlog(" %s", sppp_ipcp_opt_name(*p)); 3683 switch (p[0]) { 3684 case IPCP_OPT_ADDRESS: 3685 /* 3686 * Peer doesn't grok address option. This is 3687 * bad. XXX Should we better give up here? 3688 */ 3689 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3690 break; 3691 #ifdef notyet 3692 case IPCP_OPT_COMPRESS: 3693 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3694 break; 3695 #endif 3696 } 3697 } 3698 if (debug) 3699 addlog("\n"); 3700 end: 3701 return; 3702 } 3703 3704 /* 3705 * Analyze the IPCP Configure-NAK option list, and adjust our 3706 * negotiation. 3707 */ 3708 static void 3709 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3710 { 3711 u_char *p, l; 3712 struct ifnet *ifp = &sp->pp_if; 3713 int debug = ifp->if_flags & IFF_DEBUG; 3714 uint32_t wantaddr; 3715 3716 KASSERT(SPPP_WLOCKED(sp)); 3717 3718 len -= sizeof(*h); 3719 3720 if (debug) 3721 log(LOG_DEBUG, "%s: ipcp nak opts:", 3722 ifp->if_xname); 3723 3724 p = (void *)(h + 1); 3725 for (; len > 1; len -= l, p += l) { 3726 l = p[1]; 3727 if (l == 0) 3728 break; 3729 3730 /* Sanity check option length */ 3731 if (l > len) { 3732 /* XXX should we just RXJ? */ 3733 addlog("%s: malicious IPCP option received, dropping\n", 3734 ifp->if_xname); 3735 return; 3736 } 3737 if (debug) 3738 addlog(" %s", sppp_ipcp_opt_name(*p)); 3739 switch (*p) { 3740 case IPCP_OPT_ADDRESS: 3741 /* 3742 * Peer doesn't like our local IP address. See 3743 * if we can do something for him. We'll drop 3744 * him our address then. 3745 */ 3746 if (len >= 6 && l == 6) { 3747 wantaddr = p[2] << 24 | p[3] << 16 | 3748 p[4] << 8 | p[5]; 3749 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3750 if (debug) 3751 addlog(" [wantaddr %s]", 3752 sppp_dotted_quad(wantaddr)); 3753 /* 3754 * When doing dynamic address assignment, 3755 * we accept his offer. Otherwise, we 3756 * ignore it and thus continue to negotiate 3757 * our already existing value. 3758 */ 3759 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3760 if (debug) 3761 addlog(" [agree]"); 3762 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3763 sp->ipcp.req_myaddr = wantaddr; 3764 } 3765 } 3766 break; 3767 3768 case IPCP_OPT_PRIMDNS: 3769 if (len >= 6 && l == 6) { 3770 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3771 p[4] << 8 | p[5]; 3772 } 3773 break; 3774 3775 case IPCP_OPT_SECDNS: 3776 if (len >= 6 && l == 6) { 3777 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3778 p[4] << 8 | p[5]; 3779 } 3780 break; 3781 #ifdef notyet 3782 case IPCP_OPT_COMPRESS: 3783 /* 3784 * Peer wants different compression parameters. 3785 */ 3786 break; 3787 #endif 3788 } 3789 } 3790 if (debug) 3791 addlog("\n"); 3792 } 3793 3794 static void 3795 sppp_ipcp_tlu(struct sppp *sp) 3796 { 3797 #ifdef INET 3798 KASSERT(SPPP_WLOCKED(sp)); 3799 /* we are up. Set addresses and notify anyone interested */ 3800 sppp_set_ip_addrs(sp); 3801 #endif 3802 } 3803 3804 static void 3805 sppp_ipcp_tld(struct sppp *sp) 3806 { 3807 3808 KASSERT(SPPP_WLOCKED(sp)); 3809 } 3810 3811 static void 3812 sppp_ipcp_tls(struct sppp *sp) 3813 { 3814 3815 KASSERT(SPPP_WLOCKED(sp)); 3816 sppp_lcp_uls(&ipcp, sp); 3817 } 3818 3819 static void 3820 sppp_ipcp_tlf(struct sppp *sp) 3821 { 3822 3823 KASSERT(SPPP_WLOCKED(sp)); 3824 sppp_lcp_ulf(&ipcp, sp); 3825 } 3826 3827 static void 3828 sppp_ipcp_scr(struct sppp *sp) 3829 { 3830 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3831 #ifdef INET 3832 uint32_t ouraddr; 3833 #endif 3834 int i = 0; 3835 3836 KASSERT(SPPP_WLOCKED(sp)); 3837 3838 #ifdef notyet 3839 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3840 opt[i++] = IPCP_OPT_COMPRESSION; 3841 opt[i++] = 6; 3842 opt[i++] = 0; /* VJ header compression */ 3843 opt[i++] = 0x2d; /* VJ header compression */ 3844 opt[i++] = max_slot_id; 3845 opt[i++] = comp_slot_id; 3846 } 3847 #endif 3848 3849 #ifdef INET 3850 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3851 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3852 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3853 else 3854 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3855 opt[i++] = IPCP_OPT_ADDRESS; 3856 opt[i++] = 6; 3857 opt[i++] = ouraddr >> 24; 3858 opt[i++] = ouraddr >> 16; 3859 opt[i++] = ouraddr >> 8; 3860 opt[i++] = ouraddr; 3861 } 3862 #endif 3863 3864 if (sp->query_dns & 1) { 3865 opt[i++] = IPCP_OPT_PRIMDNS; 3866 opt[i++] = 6; 3867 opt[i++] = sp->dns_addrs[0] >> 24; 3868 opt[i++] = sp->dns_addrs[0] >> 16; 3869 opt[i++] = sp->dns_addrs[0] >> 8; 3870 opt[i++] = sp->dns_addrs[0]; 3871 } 3872 if (sp->query_dns & 2) { 3873 opt[i++] = IPCP_OPT_SECDNS; 3874 opt[i++] = 6; 3875 opt[i++] = sp->dns_addrs[1] >> 24; 3876 opt[i++] = sp->dns_addrs[1] >> 16; 3877 opt[i++] = sp->dns_addrs[1] >> 8; 3878 opt[i++] = sp->dns_addrs[1]; 3879 } 3880 3881 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 3882 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 3883 } 3884 3885 3886 /* 3887 *--------------------------------------------------------------------------* 3888 * * 3889 * The IPv6CP implementation. * 3890 * * 3891 *--------------------------------------------------------------------------* 3892 */ 3893 3894 #ifdef INET6 3895 static void 3896 sppp_ipv6cp_init(struct sppp *sp) 3897 { 3898 3899 KASSERT(SPPP_WLOCKED(sp)); 3900 3901 sp->ipv6cp.opts = 0; 3902 sp->ipv6cp.flags = 0; 3903 sp->scp[IDX_IPV6CP].state = STATE_INITIAL; 3904 sp->scp[IDX_IPV6CP].fail_counter = 0; 3905 sp->scp[IDX_IPV6CP].seq = 0; 3906 sp->scp[IDX_IPV6CP].rseq = 0; 3907 sppp_cp_init(&ipv6cp, sp); 3908 } 3909 3910 static void 3911 sppp_ipv6cp_up(struct sppp *sp, void *xcp) 3912 { 3913 3914 KASSERT(SPPP_WLOCKED(sp)); 3915 sppp_up_event(sp, xcp); 3916 } 3917 3918 static void 3919 sppp_ipv6cp_down(struct sppp *sp, void *xcp) 3920 { 3921 3922 KASSERT(SPPP_WLOCKED(sp)); 3923 sppp_down_event(sp, xcp); 3924 } 3925 3926 static void 3927 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 3928 { 3929 STDDCL; 3930 struct in6_addr myaddr, hisaddr; 3931 3932 KASSERT(SPPP_WLOCKED(sp)); 3933 3934 #ifdef IPV6CP_MYIFID_DYN 3935 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3936 #else 3937 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3938 #endif 3939 3940 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3941 /* 3942 * If we don't have our address, this probably means our 3943 * interface doesn't want to talk IPv6 at all. (This could 3944 * be the case if somebody wants to speak only IPX, for 3945 * example.) Don't open IPv6CP in this case. 3946 */ 3947 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3948 /* XXX this message should go away */ 3949 if (debug) 3950 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3951 ifp->if_xname); 3952 return; 3953 } 3954 3955 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3956 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3957 sppp_open_event(sp, xcp); 3958 } 3959 3960 static void 3961 sppp_ipv6cp_close(struct sppp *sp, void *xcp) 3962 { 3963 3964 KASSERT(SPPP_WLOCKED(sp)); 3965 sppp_close_event(sp, xcp); 3966 } 3967 3968 static void 3969 sppp_ipv6cp_TO(struct sppp *sp, void *xcp) 3970 { 3971 3972 sppp_to_event(sp, xcp); 3973 } 3974 3975 /* 3976 * Analyze a configure request. Return true if it was agreeable, and 3977 * caused action sca, false if it has been rejected or nak'ed, and 3978 * caused action scn. (The return value is used to make the state 3979 * transition decision in the state automaton.) 3980 */ 3981 static int 3982 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int origlen) 3983 { 3984 u_char *buf, *r, *p, l, blen; 3985 struct ifnet *ifp = &sp->pp_if; 3986 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3987 struct in6_addr myaddr, desiredaddr, suggestaddr; 3988 int ifidcount; 3989 int type; 3990 int collision, nohisaddr; 3991 char ip6buf[INET6_ADDRSTRLEN]; 3992 3993 KASSERT(SPPP_WLOCKED(sp)); 3994 3995 if (origlen < sizeof(*h)) 3996 return 0; 3997 3998 origlen -= sizeof(*h); 3999 type = 0; 4000 4001 /* 4002 * Make sure to allocate a buf that can at least hold a 4003 * conf-nak with an `address' option. We might need it below. 4004 */ 4005 blen = MAX(6, origlen); 4006 4007 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4008 if (buf == NULL) 4009 return 0; 4010 4011 /* pass 1: see if we can recognize them */ 4012 if (debug) 4013 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 4014 ifp->if_xname); 4015 p = (void *)(h + 1); 4016 r = buf; 4017 rlen = 0; 4018 ifidcount = 0; 4019 for (len = origlen; len > 1; len -= l, p += l) { 4020 l = p[1]; 4021 if (l == 0) 4022 break; 4023 4024 /* Sanity check option length */ 4025 if (l > len) { 4026 /* XXX just RXJ? */ 4027 addlog("%s: received malicious IPCPv6 option, " 4028 "dropping\n", ifp->if_xname); 4029 rlen = -1; 4030 goto end; 4031 } 4032 if (debug) 4033 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4034 switch (p[0]) { 4035 case IPV6CP_OPT_IFID: 4036 if (len >= 10 && l == 10 && ifidcount == 0) { 4037 /* correctly formed address option */ 4038 ifidcount++; 4039 continue; 4040 } 4041 if (debug) 4042 addlog(" [invalid]"); 4043 break; 4044 #ifdef notyet 4045 case IPV6CP_OPT_COMPRESSION: 4046 if (len >= 4 && l >= 4) { 4047 /* correctly formed compress option */ 4048 continue; 4049 } 4050 if (debug) 4051 addlog(" [invalid]"); 4052 break; 4053 #endif 4054 default: 4055 /* Others not supported. */ 4056 if (debug) 4057 addlog(" [rej]"); 4058 break; 4059 } 4060 if (rlen + l > blen) { 4061 if (debug) 4062 addlog(" [overflow]"); 4063 continue; 4064 } 4065 /* Add the option to rejected list. */ 4066 memcpy(r, p, l); 4067 r += l; 4068 rlen += l; 4069 } 4070 4071 if (rlen > 0) { 4072 type = CONF_REJ; 4073 goto end; 4074 } 4075 4076 if (debug) 4077 addlog("\n"); 4078 4079 /* pass 2: parse option values */ 4080 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4081 if (debug) 4082 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 4083 ifp->if_xname); 4084 p = (void *)(h + 1); 4085 r = buf; 4086 rlen = 0; 4087 type = CONF_ACK; 4088 for (len = origlen; len > 1; len -= l, p += l) { 4089 l = p[1]; 4090 if (l == 0) 4091 break; 4092 4093 if (debug) 4094 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4095 switch (p[0]) { 4096 #ifdef notyet 4097 case IPV6CP_OPT_COMPRESSION: 4098 continue; 4099 #endif 4100 case IPV6CP_OPT_IFID: 4101 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4102 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4103 collision = (memcmp(&desiredaddr.s6_addr[8], 4104 &myaddr.s6_addr[8], 8) == 0); 4105 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4106 4107 desiredaddr.s6_addr16[0] = htons(0xfe80); 4108 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4109 4110 if (!collision && !nohisaddr) { 4111 /* no collision, hisaddr known - Conf-Ack */ 4112 type = CONF_ACK; 4113 4114 if (debug) { 4115 addlog(" %s [%s]", 4116 IN6_PRINT(ip6buf, &desiredaddr), 4117 sppp_cp_type_name(type)); 4118 } 4119 continue; 4120 } 4121 4122 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4123 if (collision && nohisaddr) { 4124 /* collision, hisaddr unknown - Conf-Rej */ 4125 type = CONF_REJ; 4126 memset(&p[2], 0, 8); 4127 } else { 4128 /* 4129 * - no collision, hisaddr unknown, or 4130 * - collision, hisaddr known 4131 * Conf-Nak, suggest hisaddr 4132 */ 4133 type = CONF_NAK; 4134 sppp_suggest_ip6_addr(sp, &suggestaddr); 4135 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4136 } 4137 if (debug) 4138 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4139 sppp_cp_type_name(type)); 4140 break; 4141 } 4142 if (rlen + l > blen) { 4143 if (debug) 4144 addlog(" [overflow]"); 4145 continue; 4146 } 4147 /* Add the option to nak'ed list. */ 4148 memcpy(r, p, l); 4149 r += l; 4150 rlen += l; 4151 } 4152 4153 if (rlen > 0) { 4154 if (type != CONF_ACK) { 4155 if (debug) { 4156 addlog(" send %s suggest %s\n", 4157 sppp_cp_type_name(type), 4158 IN6_PRINT(ip6buf, &suggestaddr)); 4159 } 4160 } 4161 #ifdef notdef 4162 if (type == CONF_ACK) 4163 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4164 #endif 4165 } else { 4166 if (type == CONF_ACK) { 4167 rlen = origlen; 4168 memcpy(r, h + 1, rlen); 4169 } 4170 } 4171 end: 4172 if (debug) 4173 addlog("\n"); 4174 4175 if (rlen < 0) { 4176 kmem_intr_free(buf, blen); 4177 return -1; 4178 } 4179 4180 if (sp->scp[IDX_IPV6CP].rcr_buf != NULL) { 4181 kmem_intr_free(sp->scp[IDX_IPV6CP].rcr_buf, 4182 sp->scp[IDX_IPV6CP].rcr_blen); 4183 } 4184 4185 sp->scp[IDX_IPV6CP].rcr_type = type; 4186 sp->scp[IDX_IPV6CP].rcr_buf = buf; 4187 sp->scp[IDX_IPV6CP].rcr_blen = blen; 4188 sp->scp[IDX_IPV6CP].rcr_rlen = rlen; 4189 4190 if (type != CONF_ACK) 4191 return 0; 4192 return 0; 4193 } 4194 4195 /* 4196 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4197 * negotiation. 4198 */ 4199 static void 4200 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 4201 { 4202 u_char *p, l; 4203 struct ifnet *ifp = &sp->pp_if; 4204 int debug = ifp->if_flags & IFF_DEBUG; 4205 4206 KASSERT(SPPP_WLOCKED(sp)); 4207 4208 if (len <= sizeof(*h)) 4209 return; 4210 4211 len -= sizeof(*h); 4212 4213 if (debug) 4214 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 4215 ifp->if_xname); 4216 4217 p = (void *)(h + 1); 4218 for (; len > 1; len -= l, p += l) { 4219 l = p[1]; 4220 if (l == 0) 4221 break; 4222 4223 if (l > len) { 4224 /* XXX just RXJ? */ 4225 addlog("%s: received malicious IPCPv6 option, " 4226 "dropping\n", ifp->if_xname); 4227 goto end; 4228 } 4229 if (debug) 4230 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4231 switch (p[0]) { 4232 case IPV6CP_OPT_IFID: 4233 /* 4234 * Peer doesn't grok address option. This is 4235 * bad. XXX Should we better give up here? 4236 */ 4237 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 4238 break; 4239 #ifdef notyet 4240 case IPV6CP_OPT_COMPRESS: 4241 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 4242 break; 4243 #endif 4244 } 4245 } 4246 if (debug) 4247 addlog("\n"); 4248 end: 4249 return; 4250 } 4251 4252 /* 4253 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4254 * negotiation. 4255 */ 4256 static void 4257 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 4258 { 4259 u_char *p, l; 4260 struct ifnet *ifp = &sp->pp_if; 4261 int debug = ifp->if_flags & IFF_DEBUG; 4262 struct in6_addr suggestaddr; 4263 char ip6buf[INET6_ADDRSTRLEN]; 4264 4265 KASSERT(SPPP_WLOCKED(sp)); 4266 4267 if (len <= sizeof(*h)) 4268 return; 4269 4270 len -= sizeof(*h); 4271 4272 if (debug) 4273 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 4274 ifp->if_xname); 4275 4276 p = (void *)(h + 1); 4277 for (; len > 1; len -= l, p += l) { 4278 l = p[1]; 4279 if (l == 0) 4280 break; 4281 4282 if (l > len) { 4283 /* XXX just RXJ? */ 4284 addlog("%s: received malicious IPCPv6 option, " 4285 "dropping\n", ifp->if_xname); 4286 goto end; 4287 } 4288 if (debug) 4289 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4290 switch (p[0]) { 4291 case IPV6CP_OPT_IFID: 4292 /* 4293 * Peer doesn't like our local ifid. See 4294 * if we can do something for him. We'll drop 4295 * him our address then. 4296 */ 4297 if (len < 10 || l != 10) 4298 break; 4299 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4300 suggestaddr.s6_addr16[0] = htons(0xfe80); 4301 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4302 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4303 4304 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 4305 if (debug) 4306 addlog(" [suggestaddr %s]", 4307 IN6_PRINT(ip6buf, &suggestaddr)); 4308 #ifdef IPV6CP_MYIFID_DYN 4309 /* 4310 * When doing dynamic address assignment, 4311 * we accept his offer. 4312 */ 4313 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4314 struct in6_addr lastsuggest; 4315 /* 4316 * If <suggested myaddr from peer> equals to 4317 * <hisaddr we have suggested last time>, 4318 * we have a collision. generate new random 4319 * ifid. 4320 */ 4321 sppp_suggest_ip6_addr(&lastsuggest); 4322 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4323 lastsuggest)) { 4324 if (debug) 4325 addlog(" [random]"); 4326 sppp_gen_ip6_addr(sp, &suggestaddr); 4327 } 4328 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4329 if (debug) 4330 addlog(" [agree]"); 4331 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4332 } 4333 #else 4334 /* 4335 * Since we do not do dynamic address assignment, 4336 * we ignore it and thus continue to negotiate 4337 * our already existing value. This can possibly 4338 * go into infinite request-reject loop. 4339 * 4340 * This is not likely because we normally use 4341 * ifid based on MAC-address. 4342 * If you have no ethernet card on the node, too bad. 4343 * XXX should we use fail_counter? 4344 */ 4345 #endif 4346 break; 4347 #ifdef notyet 4348 case IPV6CP_OPT_COMPRESS: 4349 /* 4350 * Peer wants different compression parameters. 4351 */ 4352 break; 4353 #endif 4354 } 4355 } 4356 if (debug) 4357 addlog("\n"); 4358 end: 4359 return; 4360 } 4361 4362 static void 4363 sppp_ipv6cp_tlu(struct sppp *sp) 4364 { 4365 4366 KASSERT(SPPP_WLOCKED(sp)); 4367 /* we are up - notify isdn daemon */ 4368 sppp_notify_con_wlocked(sp); 4369 } 4370 4371 static void 4372 sppp_ipv6cp_tld(struct sppp *sp) 4373 { 4374 4375 KASSERT(SPPP_WLOCKED(sp)); 4376 } 4377 4378 static void 4379 sppp_ipv6cp_tls(struct sppp *sp) 4380 { 4381 4382 KASSERT(SPPP_WLOCKED(sp)); 4383 sppp_lcp_uls(&ipv6cp, sp); 4384 } 4385 4386 static void 4387 sppp_ipv6cp_tlf(struct sppp *sp) 4388 { 4389 4390 KASSERT(SPPP_WLOCKED(sp)); 4391 sppp_lcp_ulf(&ipv6cp, sp); 4392 } 4393 4394 static void 4395 sppp_ipv6cp_scr(struct sppp *sp) 4396 { 4397 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4398 struct in6_addr ouraddr; 4399 int i = 0; 4400 4401 KASSERT(SPPP_WLOCKED(sp)); 4402 4403 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 4404 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4405 opt[i++] = IPV6CP_OPT_IFID; 4406 opt[i++] = 10; 4407 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4408 i += 8; 4409 } 4410 4411 #ifdef notyet 4412 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 4413 opt[i++] = IPV6CP_OPT_COMPRESSION; 4414 opt[i++] = 4; 4415 opt[i++] = 0; /* TBD */ 4416 opt[i++] = 0; /* TBD */ 4417 /* variable length data may follow */ 4418 } 4419 #endif 4420 4421 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4422 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4423 } 4424 #else /*INET6*/ 4425 static void 4426 sppp_ipv6cp_init(struct sppp *sp) 4427 { 4428 4429 KASSERT(SPPP_WLOCKED(sp)); 4430 } 4431 4432 static void 4433 sppp_ipv6cp_up(struct sppp *sp, void *xcp __unused) 4434 { 4435 4436 KASSERT(SPPP_WLOCKED(sp)); 4437 } 4438 4439 static void 4440 sppp_ipv6cp_down(struct sppp *sp) 4441 { 4442 4443 KASSERT(SPPP_WLOCKED(sp)); 4444 } 4445 4446 static void 4447 sppp_ipv6cp_open(struct sppp *sp, void *xcp __unused) 4448 { 4449 4450 KASSERT(SPPP_WLOCKED(sp)); 4451 } 4452 4453 static void 4454 sppp_ipv6cp_close(struct sppp *sp, void *xcp __unused) 4455 { 4456 4457 KASSERT(SPPP_WLOCKED(sp)); 4458 } 4459 4460 static void 4461 sppp_ipv6cp_TO(struct sppp *sp, void *xcp __unused) 4462 { 4463 4464 KASSERT(SPPP_WLOCKED(sp)); 4465 } 4466 4467 static int 4468 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 4469 int len) 4470 { 4471 4472 KASSERT(SPPP_WLOCKED(sp)); 4473 return 0; 4474 } 4475 4476 static void 4477 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 4478 int len) 4479 { 4480 4481 KASSERT(SPPP_WLOCKED(sp)); 4482 } 4483 4484 static void 4485 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 4486 int len) 4487 { 4488 4489 KASSERT(SPPP_WLOCKED(sp)); 4490 } 4491 4492 static void 4493 sppp_ipv6cp_tlu(struct sppp *sp) 4494 { 4495 4496 KASSERT(SPPP_WLOCKED(sp)); 4497 } 4498 4499 static void 4500 sppp_ipv6cp_tld(struct sppp *sp) 4501 { 4502 4503 KASSERT(SPPP_WLOCKED(sp)); 4504 } 4505 4506 static void 4507 sppp_ipv6cp_tls(struct sppp *sp) 4508 { 4509 4510 KASSERT(SPPP_WLOCKED(sp)); 4511 } 4512 4513 static void 4514 sppp_ipv6cp_tlf(struct sppp *sp) 4515 { 4516 4517 KASSERT(SPPP_WLOCKED(sp)); 4518 } 4519 4520 static void 4521 sppp_ipv6cp_scr(struct sppp *sp) 4522 { 4523 4524 KASSERT(SPPP_WLOCKED(sp)); 4525 } 4526 #endif /*INET6*/ 4527 4528 4529 /* 4530 *--------------------------------------------------------------------------* 4531 * * 4532 * The CHAP implementation. * 4533 * * 4534 *--------------------------------------------------------------------------* 4535 */ 4536 /* 4537 * The authentication protocols is implemented on the state machine for 4538 * control protocols. And it uses following actions and events. 4539 * 4540 * Actions: 4541 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4542 * - sca: send CHAP_SUCCESS 4543 * - scn: send CHAP_FAILURE and shutdown lcp 4544 * Events: 4545 * - RCR+: receive CHAP_RESPONSE containing correct digest 4546 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4547 * - RCA: receive CHAP_SUCCESS 4548 * - RCN: (this event is unused) 4549 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4550 * - TO-: this layer finish 4551 */ 4552 4553 /* 4554 * Handle incoming CHAP packets. 4555 */ 4556 void 4557 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4558 { 4559 STDDCL; 4560 struct lcp_header *h; 4561 int len, x; 4562 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4563 int value_len, name_len; 4564 MD5_CTX ctx; 4565 4566 len = m->m_pkthdr.len; 4567 if (len < 4) { 4568 if (debug) 4569 log(LOG_DEBUG, 4570 "%s: chap invalid packet length: %d bytes\n", 4571 ifp->if_xname, len); 4572 return; 4573 } 4574 h = mtod(m, struct lcp_header *); 4575 if (len > ntohs(h->len)) 4576 len = ntohs(h->len); 4577 4578 SPPP_LOCK(sp, RW_WRITER); 4579 4580 switch (h->type) { 4581 /* challenge, failure and success are his authproto */ 4582 case CHAP_CHALLENGE: 4583 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4584 /* can't do anything useful */ 4585 sp->pp_auth_failures++; 4586 printf("%s: chap input without my name and my secret being set\n", 4587 ifp->if_xname); 4588 break; 4589 } 4590 value = 1 + (u_char *)(h + 1); 4591 value_len = value[-1]; 4592 name = value + value_len; 4593 name_len = len - value_len - 5; 4594 if (name_len < 0) { 4595 if (debug) { 4596 log(LOG_DEBUG, 4597 "%s: chap corrupted challenge " 4598 "<%s id=0x%x len=%d", 4599 ifp->if_xname, 4600 sppp_auth_type_name(PPP_CHAP, h->type), 4601 h->ident, ntohs(h->len)); 4602 if (len > 4) 4603 sppp_print_bytes((u_char *)(h + 1), 4604 len - 4); 4605 addlog(">\n"); 4606 } 4607 break; 4608 } 4609 4610 if (debug) { 4611 log(LOG_DEBUG, 4612 "%s: chap input <%s id=0x%x len=%d name=", 4613 ifp->if_xname, 4614 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 4615 ntohs(h->len)); 4616 sppp_print_string((char *) name, name_len); 4617 addlog(" value-size=%d value=", value_len); 4618 sppp_print_bytes(value, value_len); 4619 addlog(">\n"); 4620 } 4621 4622 /* Compute reply value. */ 4623 MD5Init(&ctx); 4624 MD5Update(&ctx, &h->ident, 1); 4625 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4626 MD5Update(&ctx, value, value_len); 4627 MD5Final(sp->chap.digest, &ctx); 4628 sp->chap.digest_len = sizeof(sp->chap.digest); 4629 sp->scp[IDX_CHAP].rconfid = h->ident; 4630 4631 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4632 break; 4633 4634 case CHAP_SUCCESS: 4635 if (debug) { 4636 log(LOG_DEBUG, "%s: chap success", 4637 ifp->if_xname); 4638 if (len > 4) { 4639 addlog(": "); 4640 sppp_print_string((char *)(h + 1), len - 4); 4641 } 4642 addlog("\n"); 4643 } 4644 4645 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4646 if (debug) { 4647 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4648 ifp->if_xname, chap.name, 4649 h->ident, sp->scp[IDX_CHAP].rconfid); 4650 } 4651 if_statinc(ifp, if_ierrors); 4652 break; 4653 } 4654 4655 if (sp->chap.digest_len == 0) { 4656 if (debug) { 4657 log(LOG_DEBUG, 4658 "%s: receive CHAP success without challenge\n", 4659 ifp->if_xname); 4660 } 4661 if_statinc(ifp, if_ierrors); 4662 break; 4663 } 4664 4665 x = splnet(); 4666 sp->pp_auth_failures = 0; 4667 sp->pp_flags &= ~PP_NEEDAUTH; 4668 splx(x); 4669 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4670 sp->chap.digest_len = 0; 4671 4672 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4673 /* 4674 * we are not authenticator for CHAP, 4675 * generate a dummy RCR+ event without CHAP_RESPONSE 4676 */ 4677 sp->scp[IDX_CHAP].rcr_type = CONF_ACK; 4678 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4679 } 4680 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4681 break; 4682 4683 case CHAP_FAILURE: 4684 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4685 if (debug) { 4686 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4687 ifp->if_xname, chap.name, 4688 h->ident, sp->scp[IDX_CHAP].rconfid); 4689 } 4690 if_statinc(ifp, if_ierrors); 4691 break; 4692 } 4693 4694 if (sp->chap.digest_len == 0) { 4695 if (debug) { 4696 log(LOG_DEBUG, 4697 "%s: receive CHAP failure without challenge\n", 4698 ifp->if_xname); 4699 } 4700 if_statinc(ifp, if_ierrors); 4701 break; 4702 } 4703 4704 x = splnet(); 4705 sp->pp_auth_failures++; 4706 splx(x); 4707 if (debug) { 4708 log(LOG_INFO, "%s: chap failure", 4709 ifp->if_xname); 4710 if (len > 4) { 4711 addlog(": "); 4712 sppp_print_string((char *)(h + 1), len - 4); 4713 } 4714 addlog("\n"); 4715 } else 4716 log(LOG_INFO, "%s: chap failure\n", 4717 ifp->if_xname); 4718 4719 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4720 sp->chap.digest_len = 0; 4721 /* 4722 * await LCP shutdown by authenticator, 4723 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4724 */ 4725 break; 4726 4727 /* response is my authproto */ 4728 case CHAP_RESPONSE: 4729 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4730 /* can't do anything useful */ 4731 printf("%s: chap response" 4732 " without his name and his secret being set\n", 4733 ifp->if_xname); 4734 break; 4735 } 4736 value = 1 + (u_char *)(h + 1); 4737 value_len = value[-1]; 4738 name = value + value_len; 4739 name_len = len - value_len - 5; 4740 if (name_len < 0) { 4741 if (debug) { 4742 log(LOG_DEBUG, 4743 "%s: chap corrupted response " 4744 "<%s id=0x%x len=%d", 4745 ifp->if_xname, 4746 sppp_auth_type_name(PPP_CHAP, h->type), 4747 h->ident, ntohs(h->len)); 4748 if (len > 4) 4749 sppp_print_bytes((u_char *)(h + 1), 4750 len - 4); 4751 addlog(">\n"); 4752 } 4753 break; 4754 } 4755 if (h->ident != sp->scp[IDX_CHAP].confid) { 4756 if (debug) 4757 log(LOG_DEBUG, 4758 "%s: chap dropping response for old ID " 4759 "(got %d, expected %d)\n", 4760 ifp->if_xname, 4761 h->ident, sp->scp[IDX_CHAP].confid); 4762 break; 4763 } else { 4764 sp->scp[IDX_CHAP].rconfid = h->ident; 4765 } 4766 4767 if (sp->hisauth.name != NULL && 4768 (name_len != sp->hisauth.name_len 4769 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4770 log(LOG_INFO, "%s: chap response, his name ", 4771 ifp->if_xname); 4772 sppp_print_string(name, name_len); 4773 addlog(" != expected "); 4774 sppp_print_string(sp->hisauth.name, 4775 sp->hisauth.name_len); 4776 addlog("\n"); 4777 4778 /* generate RCR- event */ 4779 sp->scp[IDX_CHAP].rcr_type = CONF_NAK; 4780 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4781 break; 4782 } 4783 4784 if (debug) { 4785 log(LOG_DEBUG, "%s: chap input(%s) " 4786 "<%s id=0x%x len=%d name=", 4787 ifp->if_xname, 4788 sppp_state_name(sp->scp[IDX_CHAP].state), 4789 sppp_auth_type_name(PPP_CHAP, h->type), 4790 h->ident, ntohs(h->len)); 4791 sppp_print_string((char *)name, name_len); 4792 addlog(" value-size=%d value=", value_len); 4793 sppp_print_bytes(value, value_len); 4794 addlog(">\n"); 4795 } 4796 4797 if (value_len == sizeof(sp->chap.challenge) && 4798 value_len == sizeof(sp->chap.digest)) { 4799 MD5Init(&ctx); 4800 MD5Update(&ctx, &h->ident, 1); 4801 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4802 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4803 MD5Final(digest, &ctx); 4804 4805 if (memcmp(digest, value, value_len) == 0) { 4806 sp->scp[IDX_CHAP].rcr_type = CONF_ACK; 4807 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4808 sp->chap.rechallenging) { 4809 /* generate a dummy RCA event*/ 4810 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4811 } 4812 } else { 4813 sp->scp[IDX_CHAP].rcr_type = CONF_NAK; 4814 } 4815 } else { 4816 if (debug) 4817 log(LOG_DEBUG, 4818 "%s: chap bad hash value length: " 4819 "%d bytes, should be %zu\n", 4820 ifp->if_xname, value_len, 4821 sizeof(sp->chap.challenge)); 4822 4823 sp->scp[IDX_CHAP].rcr_type = CONF_NAK; 4824 } 4825 4826 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4827 break; 4828 4829 default: 4830 /* Unknown CHAP packet type -- ignore. */ 4831 if (debug) { 4832 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4833 "<0x%x id=0x%xh len=%d", 4834 ifp->if_xname, 4835 sppp_state_name(sp->scp[IDX_CHAP].state), 4836 h->type, h->ident, ntohs(h->len)); 4837 if (len > 4) 4838 sppp_print_bytes((u_char *)(h + 1), len - 4); 4839 addlog(">\n"); 4840 } 4841 break; 4842 4843 } 4844 4845 SPPP_UNLOCK(sp); 4846 } 4847 4848 static void 4849 sppp_chap_init(struct sppp *sp) 4850 { 4851 4852 KASSERT(SPPP_WLOCKED(sp)); 4853 4854 sp->scp[IDX_CHAP].state = STATE_INITIAL; 4855 sp->scp[IDX_CHAP].fail_counter = 0; 4856 sp->scp[IDX_CHAP].seq = 0; 4857 sp->scp[IDX_CHAP].rseq = 0; 4858 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4859 sppp_chap_rcv_challenge_event, &chap); 4860 sppp_cp_init(&chap, sp); 4861 } 4862 4863 static void 4864 sppp_chap_up(struct sppp *sp, void *xcp) 4865 { 4866 4867 KASSERT(SPPP_WLOCKED(sp)); 4868 sppp_up_event(sp, xcp); 4869 } 4870 4871 static void 4872 sppp_chap_down(struct sppp *sp, void *xcp) 4873 { 4874 4875 KASSERT(SPPP_WLOCKED(sp)); 4876 sppp_down_event(sp, xcp); 4877 } 4878 4879 static void 4880 sppp_chap_open(struct sppp *sp, void *xcp) 4881 { 4882 4883 KASSERT(SPPP_WLOCKED(sp)); 4884 4885 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4886 sp->chap.digest_len = 0; 4887 sp->chap.rechallenging = false; 4888 sp->chap.response_rcvd = false; 4889 sppp_open_event(sp, xcp); 4890 } 4891 4892 static void 4893 sppp_chap_close(struct sppp *sp, void *xcp) 4894 { 4895 4896 KASSERT(SPPP_WLOCKED(sp)); 4897 sppp_close_event(sp, xcp); 4898 } 4899 4900 static void 4901 sppp_chap_TO(struct sppp *sp, void *xcp) 4902 { 4903 4904 KASSERT(SPPP_WLOCKED(sp)); 4905 sppp_auth_to_event(xcp, sp); 4906 } 4907 4908 static void 4909 sppp_chap_tlu(struct sppp *sp) 4910 { 4911 STDDCL; 4912 int i, x; 4913 4914 KASSERT(SPPP_WLOCKED(sp)); 4915 4916 i = 0; 4917 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4918 x = splnet(); 4919 sp->pp_auth_failures = 0; 4920 splx(x); 4921 4922 log(LOG_DEBUG, "%s: chap %s", ifp->if_xname, 4923 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4924 4925 /* 4926 * Some broken CHAP implementations (Conware CoNet, firmware 4927 * 4.0.?) don't want to re-authenticate their CHAP once the 4928 * initial challenge-response exchange has taken place. 4929 * Provide for an option to avoid rechallenges. 4930 */ 4931 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4932 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4933 /* 4934 * Compute the re-challenge timeout. This will yield 4935 * a number between 300 and 810 seconds. 4936 */ 4937 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4938 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4939 4940 if (debug) { 4941 addlog(", next rechallenge in %d seconds", i); 4942 } 4943 } 4944 4945 addlog("\n"); 4946 4947 /* 4948 * If we are already in phase network, we are done here. This 4949 * is the case if this is a dummy tlu event after a re-challenge. 4950 */ 4951 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4952 sppp_phase_network(sp); 4953 } 4954 4955 static void 4956 sppp_chap_tls(struct sppp *sp) 4957 { 4958 4959 KASSERT(SPPP_WLOCKED(sp)); 4960 sppp_lcp_uls(&chap, sp); 4961 } 4962 4963 static void 4964 sppp_chap_tlf(struct sppp *sp) 4965 { 4966 STDDCL; 4967 4968 KASSERT(SPPP_WLOCKED(sp)); 4969 4970 if (debug) 4971 log(LOG_DEBUG, "%s: chap tlf\n", ifp->if_xname); 4972 4973 sppp_lcp_ulf(&chap, sp); 4974 } 4975 4976 static void 4977 sppp_chap_scr(struct sppp *sp) 4978 { 4979 uint32_t *ch; 4980 u_char clen, dsize; 4981 int role; 4982 4983 KASSERT(SPPP_WLOCKED(sp)); 4984 4985 role = sppp_auth_role(&chap, sp); 4986 4987 if (ISSET(role, SPPP_AUTH_SERV) && 4988 !sp->chap.response_rcvd) { 4989 /* we are authenticator for CHAP, send challenge */ 4990 ch = (uint32_t *)sp->chap.challenge; 4991 clen = sizeof(sp->chap.challenge); 4992 /* Compute random challenge. */ 4993 cprng_strong(kern_cprng, ch, clen, 0); 4994 4995 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4996 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4997 sizeof(clen), (const char *)&clen, 4998 sizeof(sp->chap.challenge), sp->chap.challenge, 4999 0); 5000 } 5001 5002 if (ISSET(role, SPPP_AUTH_PEER) && 5003 sp->chap.digest_len > 0) { 5004 /* we are peer for CHAP, send response */ 5005 dsize = sp->chap.digest_len; 5006 5007 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 5008 sizeof(dsize), (const char *)&dsize, 5009 sp->chap.digest_len, sp->chap.digest, 5010 sp->myauth.name_len, sp->myauth.name, 0); 5011 } 5012 } 5013 5014 static void 5015 sppp_chap_scan(const struct cp *cp __unused, struct sppp *sp) 5016 { 5017 u_char type, rconfid, mlen; 5018 const char *msg; 5019 5020 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) 5021 return; 5022 5023 rconfid = sp->scp[IDX_CHAP].rconfid; 5024 if (sp->scp[IDX_CHAP].rcr_type == CONF_ACK) { 5025 type = CHAP_SUCCESS; 5026 msg = SUCCMSG; 5027 mlen = sizeof(SUCCMSG) - 1; 5028 } else { 5029 type = CHAP_FAILURE; 5030 msg = FAILMSG; 5031 mlen = sizeof(FAILMSG) - 1; 5032 } 5033 5034 sppp_auth_send(&chap, sp, type, rconfid, 5035 mlen, (const u_char *)msg, 0); 5036 sp->chap.response_rcvd = true; 5037 5038 if (type == CHAP_SUCCESS) { 5039 sp->pp_auth_failures = 0; 5040 } else { 5041 sp->pp_auth_failures++; 5042 /* shutdown LCP if auth failed */ 5043 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5044 } 5045 } 5046 5047 static void 5048 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5049 { 5050 const struct cp *cp = xcp; 5051 5052 sp->chap.rechallenging = false; 5053 5054 switch (sp->scp[IDX_CHAP].state) { 5055 case STATE_REQ_SENT: 5056 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5057 cp->scr(sp); 5058 break; 5059 case STATE_OPENED: 5060 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5061 cp->scr(sp); 5062 break; 5063 } 5064 } 5065 5066 /* 5067 *--------------------------------------------------------------------------* 5068 * * 5069 * The PAP implementation. * 5070 * * 5071 *--------------------------------------------------------------------------* 5072 */ 5073 /* 5074 * PAP uses following actions and events. 5075 * Actions: 5076 * - scr: send PAP_REQ 5077 * - sca: send PAP_ACK 5078 * - scn: send PAP_NAK 5079 * Events: 5080 * - RCR+: receive PAP_REQ containing correct username and password 5081 * - RCR-: receive PAP_REQ containing wrong username and password 5082 * - RCA: receive PAP_ACK 5083 * - RCN: (this event is unused) 5084 * - TO+: re-send PAP_REQ 5085 * - TO-: this layer finish 5086 */ 5087 5088 /* 5089 * Handle incoming PAP packets. */ 5090 static void 5091 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5092 { 5093 STDDCL; 5094 struct lcp_header *h; 5095 int len, x; 5096 char *name, *secret; 5097 int name_len, secret_len; 5098 5099 /* 5100 * Malicious input might leave this uninitialized, so 5101 * init to an impossible value. 5102 */ 5103 secret_len = -1; 5104 5105 len = m->m_pkthdr.len; 5106 if (len < 5) { 5107 if (debug) 5108 log(LOG_DEBUG, 5109 "%s: pap invalid packet length: %d bytes\n", 5110 ifp->if_xname, len); 5111 return; 5112 } 5113 h = mtod(m, struct lcp_header *); 5114 if (len > ntohs(h->len)) 5115 len = ntohs(h->len); 5116 5117 SPPP_LOCK(sp, RW_WRITER); 5118 5119 switch (h->type) { 5120 /* PAP request is my authproto */ 5121 case PAP_REQ: 5122 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5123 /* can't do anything useful */ 5124 printf("%s: pap request" 5125 " without his name and his secret being set\n", 5126 ifp->if_xname); 5127 break; 5128 } 5129 name = 1 + (u_char *)(h + 1); 5130 name_len = name[-1]; 5131 secret = name + name_len + 1; 5132 if (name_len > len - 6 || 5133 (secret_len = secret[-1]) > len - 6 - name_len) { 5134 if (debug) { 5135 log(LOG_DEBUG, "%s: pap corrupted input " 5136 "<%s id=0x%x len=%d", 5137 ifp->if_xname, 5138 sppp_auth_type_name(PPP_PAP, h->type), 5139 h->ident, ntohs(h->len)); 5140 if (len > 4) 5141 sppp_print_bytes((u_char *)(h + 1), 5142 len - 4); 5143 addlog(">\n"); 5144 } 5145 break; 5146 } 5147 if (debug) { 5148 log(LOG_DEBUG, "%s: pap input(%s) " 5149 "<%s id=0x%x len=%d name=", 5150 ifp->if_xname, 5151 sppp_state_name(sp->scp[IDX_PAP].state), 5152 sppp_auth_type_name(PPP_PAP, h->type), 5153 h->ident, ntohs(h->len)); 5154 sppp_print_string((char *)name, name_len); 5155 addlog(" secret="); 5156 sppp_print_string((char *)secret, secret_len); 5157 addlog(">\n"); 5158 } 5159 5160 sp->scp[IDX_PAP].rconfid = h->ident; 5161 5162 if (name_len == sp->hisauth.name_len && 5163 memcmp(name, sp->hisauth.name, name_len) == 0 && 5164 secret_len == sp->hisauth.secret_len && 5165 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5166 sp->scp[IDX_PAP].rcr_type = CONF_ACK; 5167 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5168 /* generate a dummy RCA event*/ 5169 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5170 } 5171 } else { 5172 sp->scp[IDX_PAP].rcr_type = CONF_NAK; 5173 } 5174 5175 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5176 break; 5177 5178 /* ack and nak are his authproto */ 5179 case PAP_ACK: 5180 if (debug) { 5181 log(LOG_DEBUG, "%s: pap success", 5182 ifp->if_xname); 5183 name = 1 + (u_char *)(h + 1); 5184 name_len = name[-1]; 5185 if (len > 5 && name_len < len+4) { 5186 addlog(": "); 5187 sppp_print_string(name, name_len); 5188 } 5189 addlog("\n"); 5190 } 5191 5192 if (h->ident != sp->scp[IDX_PAP].confid) { 5193 if (debug) { 5194 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5195 ifp->if_xname, pap.name, 5196 h->ident, sp->scp[IDX_PAP].rconfid); 5197 } 5198 if_statinc(ifp, if_ierrors); 5199 break; 5200 } 5201 5202 x = splnet(); 5203 sp->pp_auth_failures = 0; 5204 sp->pp_flags &= ~PP_NEEDAUTH; 5205 splx(x); 5206 5207 /* we are not authenticator, generate a dummy RCR+ event */ 5208 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5209 sp->scp[IDX_PAP].rcr_type = CONF_ACK; 5210 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5211 } 5212 5213 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5214 break; 5215 5216 case PAP_NAK: 5217 if (debug) { 5218 log(LOG_INFO, "%s: pap failure", 5219 ifp->if_xname); 5220 name = 1 + (u_char *)(h + 1); 5221 name_len = name[-1]; 5222 if (len > 5 && name_len < len+4) { 5223 addlog(": "); 5224 sppp_print_string(name, name_len); 5225 } 5226 addlog("\n"); 5227 } else 5228 log(LOG_INFO, "%s: pap failure\n", 5229 ifp->if_xname); 5230 5231 if (h->ident != sp->scp[IDX_PAP].confid) { 5232 if (debug) { 5233 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5234 ifp->if_xname, pap.name, 5235 h->ident, sp->scp[IDX_PAP].rconfid); 5236 } 5237 if_statinc(ifp, if_ierrors); 5238 break; 5239 } 5240 5241 sp->pp_auth_failures++; 5242 /* 5243 * await LCP shutdown by authenticator, 5244 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5245 */ 5246 break; 5247 5248 default: 5249 /* Unknown PAP packet type -- ignore. */ 5250 if (debug) { 5251 log(LOG_DEBUG, "%s: pap corrupted input " 5252 "<0x%x id=0x%x len=%d", 5253 ifp->if_xname, 5254 h->type, h->ident, ntohs(h->len)); 5255 if (len > 4) 5256 sppp_print_bytes((u_char *)(h + 1), len - 4); 5257 addlog(">\n"); 5258 } 5259 break; 5260 } 5261 5262 SPPP_UNLOCK(sp); 5263 } 5264 5265 static void 5266 sppp_pap_init(struct sppp *sp) 5267 { 5268 5269 KASSERT(SPPP_WLOCKED(sp)); 5270 5271 sp->scp[IDX_PAP].state = STATE_INITIAL; 5272 sp->scp[IDX_PAP].fail_counter = 0; 5273 sp->scp[IDX_PAP].seq = 0; 5274 sp->scp[IDX_PAP].rseq = 0; 5275 sppp_cp_init(&pap, sp); 5276 } 5277 5278 static void 5279 sppp_pap_up(struct sppp *sp, void *xcp) 5280 { 5281 5282 KASSERT(SPPP_WLOCKED(sp)); 5283 sppp_up_event(sp, xcp); 5284 } 5285 5286 static void 5287 sppp_pap_down(struct sppp *sp, void *xcp) 5288 { 5289 5290 KASSERT(SPPP_WLOCKED(sp)); 5291 sppp_down_event(sp, xcp); 5292 } 5293 5294 static void 5295 sppp_pap_open(struct sppp *sp, void *xcp) 5296 { 5297 5298 KASSERT(SPPP_WLOCKED(sp)); 5299 sppp_open_event(sp, xcp); 5300 } 5301 5302 static void 5303 sppp_pap_close(struct sppp *sp, void *xcp) 5304 { 5305 5306 KASSERT(SPPP_WLOCKED(sp)); 5307 sppp_close_event(sp, xcp); 5308 } 5309 5310 static void 5311 sppp_pap_tls(struct sppp *sp) 5312 { 5313 5314 KASSERT(SPPP_WLOCKED(sp)); 5315 sppp_lcp_uls(&pap, sp); 5316 } 5317 5318 static void 5319 sppp_pap_tlf(struct sppp *sp) 5320 { 5321 STDDCL; 5322 5323 KASSERT(SPPP_WLOCKED(sp)); 5324 5325 if (debug) 5326 log(LOG_DEBUG, "%s: pap tlf\n", ifp->if_xname); 5327 sppp_lcp_ulf(&pap, sp); 5328 } 5329 5330 static void 5331 sppp_pap_tlu(struct sppp *sp) 5332 { 5333 STDDCL; 5334 int x; 5335 5336 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5337 5338 if (debug) 5339 log(LOG_DEBUG, "%s: %s tlu\n", 5340 ifp->if_xname, pap.name); 5341 5342 x = splnet(); 5343 sp->pp_auth_failures = 0; 5344 splx(x); 5345 5346 sppp_phase_network(sp); 5347 } 5348 5349 /* 5350 * That's the timeout routine if we are authenticator. Since the 5351 * authenticator is basically passive in PAP, we can't do much here. 5352 */ 5353 static void 5354 sppp_pap_TO(struct sppp *sp, void *xcp) 5355 { 5356 5357 KASSERT(SPPP_WLOCKED(sp)); 5358 sppp_auth_to_event(xcp, sp); 5359 } 5360 5361 static void 5362 sppp_pap_scr(struct sppp *sp) 5363 { 5364 u_char idlen, pwdlen; 5365 5366 KASSERT(SPPP_WLOCKED(sp)); 5367 5368 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5369 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5370 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 5371 log(LOG_DEBUG, "%s: couldn't send PAP_REQ " 5372 "because of no name or no secret\n", 5373 sp->pp_if.if_xname); 5374 } else { 5375 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5376 pwdlen = sp->myauth.secret_len; 5377 idlen = sp->myauth.name_len; 5378 5379 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5380 sizeof idlen, (const char *)&idlen, 5381 idlen, sp->myauth.name, 5382 sizeof pwdlen, (const char *)&pwdlen, 5383 pwdlen, sp->myauth.secret, 5384 0); 5385 } 5386 } 5387 } 5388 5389 static void 5390 sppp_pap_scan(const struct cp *cp __unused, struct sppp *sp) 5391 { 5392 u_char type, rconfid, mlen; 5393 const char *msg; 5394 5395 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) 5396 return; 5397 5398 rconfid = sp->scp[IDX_PAP].rconfid; 5399 if (sp->scp[IDX_PAP].rcr_type == CONF_ACK) { 5400 type = PAP_ACK; 5401 msg = SUCCMSG; 5402 mlen = sizeof(SUCCMSG) - 1; 5403 } else { 5404 type = PAP_NAK; 5405 msg = FAILMSG; 5406 mlen = sizeof(FAILMSG) - 1; 5407 } 5408 5409 sppp_auth_send(&pap, sp, type, rconfid, 5410 mlen, (const u_char *)msg, 0); 5411 5412 if (type == PAP_ACK) { 5413 sp->pp_auth_failures = 0; 5414 } else { 5415 sp->pp_auth_failures++; 5416 /* shutdown LCP if auth failed */ 5417 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5418 } 5419 } 5420 5421 /* 5422 * Random miscellaneous functions. 5423 */ 5424 5425 /* 5426 * Send a PAP or CHAP proto packet. 5427 * 5428 * Varadic function, each of the elements for the ellipsis is of type 5429 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5430 * mlen == 0. 5431 * NOTE: never declare variadic functions with types subject to type 5432 * promotion (i.e. u_char). This is asking for big trouble depending 5433 * on the architecture you are on... 5434 */ 5435 5436 static void 5437 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5438 unsigned int type, unsigned int id, 5439 ...) 5440 { 5441 STDDCL; 5442 struct lcp_header *lh; 5443 struct mbuf *m; 5444 u_char *p; 5445 int len; 5446 size_t pkthdrlen; 5447 unsigned int mlen; 5448 const char *msg; 5449 va_list ap; 5450 5451 KASSERT(SPPP_WLOCKED(sp)); 5452 5453 MGETHDR(m, M_DONTWAIT, MT_DATA); 5454 if (! m) 5455 return; 5456 m_reset_rcvif(m); 5457 5458 if (sp->pp_flags & PP_NOFRAMING) { 5459 *mtod(m, uint16_t *) = htons(cp->proto); 5460 pkthdrlen = 2; 5461 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5462 } else { 5463 struct ppp_header *h; 5464 h = mtod(m, struct ppp_header *); 5465 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5466 h->control = PPP_UI; /* Unnumbered Info */ 5467 h->protocol = htons(cp->proto); 5468 pkthdrlen = PPP_HEADER_LEN; 5469 5470 lh = (struct lcp_header *)(h + 1); 5471 } 5472 5473 lh->type = type; 5474 lh->ident = id; 5475 p = (u_char *)(lh + 1); 5476 5477 va_start(ap, id); 5478 len = 0; 5479 5480 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5481 msg = va_arg(ap, const char *); 5482 len += mlen; 5483 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5484 va_end(ap); 5485 m_freem(m); 5486 return; 5487 } 5488 5489 memcpy(p, msg, mlen); 5490 p += mlen; 5491 } 5492 va_end(ap); 5493 5494 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5495 lh->len = htons(LCP_HEADER_LEN + len); 5496 5497 if (debug) { 5498 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 5499 ifp->if_xname, cp->name, 5500 sppp_auth_type_name(cp->proto, lh->type), 5501 lh->ident, ntohs(lh->len)); 5502 if (len) 5503 sppp_print_bytes((u_char *)(lh + 1), len); 5504 addlog(">\n"); 5505 } 5506 if (IF_QFULL(&sp->pp_cpq)) { 5507 IF_DROP(&sp->pp_fastq); 5508 IF_DROP(&ifp->if_snd); 5509 m_freem(m); 5510 if_statinc(ifp, if_oerrors); 5511 return; 5512 } 5513 5514 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5515 IF_ENQUEUE(&sp->pp_cpq, m); 5516 5517 if (! (ifp->if_flags & IFF_OACTIVE)) { 5518 SPPP_UNLOCK(sp); 5519 if_start_lock(ifp); 5520 SPPP_LOCK(sp, RW_WRITER); 5521 } 5522 } 5523 5524 static int 5525 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5526 { 5527 int role; 5528 5529 role = SPPP_AUTH_NOROLE; 5530 5531 if (sp->hisauth.proto == cp->proto && 5532 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) 5533 SET(role, SPPP_AUTH_SERV); 5534 5535 if (sp->myauth.proto == cp->proto) 5536 SET(role, SPPP_AUTH_PEER); 5537 5538 return role; 5539 } 5540 5541 static void 5542 sppp_auth_to_event(const struct cp *cp, struct sppp *sp) 5543 { 5544 STDDCL; 5545 bool override; 5546 int state; 5547 5548 KASSERT(SPPP_WLOCKED(sp)); 5549 5550 override = false; 5551 state = sp->scp[cp->protoidx].state; 5552 5553 if (sp->scp[cp->protoidx].rst_counter > 0) { 5554 /* override TO+ event */ 5555 switch (state) { 5556 case STATE_OPENED: 5557 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5558 override = true; 5559 sp->chap.rechallenging = true; 5560 sp->chap.response_rcvd = false; 5561 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5562 cp->scr(sp); 5563 } 5564 break; 5565 5566 case STATE_ACK_RCVD: 5567 override = true; 5568 cp->scr(sp); 5569 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5570 break; 5571 } 5572 } 5573 5574 if (override) { 5575 if (debug) 5576 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 5577 ifp->if_xname, cp->name, 5578 sppp_state_name(state), 5579 sp->scp[cp->protoidx].rst_counter); 5580 sp->scp[cp->protoidx].rst_counter--; 5581 } else { 5582 sppp_to_event(sp, __UNCONST(cp)); 5583 } 5584 } 5585 5586 /* 5587 * Send keepalive packets, every 10 seconds. 5588 */ 5589 static void 5590 sppp_keepalive(void *dummy) 5591 { 5592 struct sppp *sp; 5593 int s; 5594 time_t now; 5595 5596 SPPPQ_LOCK(); 5597 5598 s = splnet(); 5599 now = time_uptime; 5600 for (sp=spppq; sp; sp=sp->pp_next) { 5601 struct ifnet *ifp = NULL; 5602 5603 SPPP_LOCK(sp, RW_WRITER); 5604 ifp = &sp->pp_if; 5605 5606 /* check idle timeout */ 5607 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5608 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5609 /* idle timeout is enabled for this interface */ 5610 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5611 if (ifp->if_flags & IFF_DEBUG) 5612 printf("%s: no activity for %lu seconds\n", 5613 sp->pp_if.if_xname, 5614 (unsigned long)(now-sp->pp_last_activity)); 5615 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5616 SPPP_UNLOCK(sp); 5617 continue; 5618 } 5619 } 5620 5621 /* Keepalive mode disabled or channel down? */ 5622 if (! (sp->pp_flags & PP_KEEPALIVE) || 5623 ! (ifp->if_flags & IFF_RUNNING)) { 5624 SPPP_UNLOCK(sp); 5625 continue; 5626 } 5627 5628 5629 /* No keepalive in PPP mode if LCP not opened yet. */ 5630 if (! (sp->pp_flags & PP_CISCO) && 5631 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5632 SPPP_UNLOCK(sp); 5633 continue; 5634 } 5635 5636 /* No echo reply, but maybe user data passed through? */ 5637 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5638 sp->pp_alivecnt = 0; 5639 SPPP_UNLOCK(sp); 5640 continue; 5641 } 5642 5643 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5644 /* No keepalive packets got. Stop the interface. */ 5645 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5646 5647 if (! (sp->pp_flags & PP_CISCO)) { 5648 printf("%s: LCP keepalive timed out, going to restart the connection\n", 5649 ifp->if_xname); 5650 sp->pp_alivecnt = 0; 5651 5652 /* we are down, close all open protocols */ 5653 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5654 5655 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5656 sp->lcp.reestablish = true; 5657 5658 SPPP_UNLOCK(sp); 5659 continue; 5660 } 5661 } 5662 if (sp->pp_alivecnt < sp->pp_maxalive) 5663 ++sp->pp_alivecnt; 5664 if (sp->pp_flags & PP_CISCO) 5665 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 5666 ++sp->scp[IDX_LCP].seq, sp->scp[IDX_LCP].rseq); 5667 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5668 int32_t nmagic = htonl(sp->lcp.magic); 5669 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5670 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5671 sp->lcp.echoid, 4, &nmagic); 5672 } 5673 5674 SPPP_UNLOCK(sp); 5675 } 5676 splx(s); 5677 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5678 5679 SPPPQ_UNLOCK(); 5680 } 5681 5682 #ifdef INET 5683 /* 5684 * Get both IP addresses. 5685 */ 5686 static void 5687 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5688 { 5689 struct ifnet *ifp = &sp->pp_if; 5690 struct ifaddr *ifa; 5691 struct sockaddr_in *si, *sm; 5692 uint32_t ssrc, ddst; 5693 int s; 5694 struct psref psref; 5695 5696 sm = NULL; 5697 ssrc = ddst = 0; 5698 /* 5699 * Pick the first AF_INET address from the list, 5700 * aliases don't make any sense on a p2p link anyway. 5701 */ 5702 si = 0; 5703 s = pserialize_read_enter(); 5704 IFADDR_READER_FOREACH(ifa, ifp) { 5705 if (ifa->ifa_addr->sa_family == AF_INET) { 5706 si = (struct sockaddr_in *)ifa->ifa_addr; 5707 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5708 if (si) { 5709 ifa_acquire(ifa, &psref); 5710 break; 5711 } 5712 } 5713 } 5714 pserialize_read_exit(s); 5715 if (ifa) { 5716 if (si && si->sin_addr.s_addr) { 5717 ssrc = si->sin_addr.s_addr; 5718 if (srcmask) 5719 *srcmask = ntohl(sm->sin_addr.s_addr); 5720 } 5721 5722 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5723 if (si && si->sin_addr.s_addr) 5724 ddst = si->sin_addr.s_addr; 5725 ifa_release(ifa, &psref); 5726 } 5727 5728 if (dst) *dst = ntohl(ddst); 5729 if (src) *src = ntohl(ssrc); 5730 } 5731 5732 /* 5733 * Set IP addresses. Must be called at splnet. 5734 * If an address is 0, leave it the way it is. 5735 */ 5736 static void 5737 sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp) 5738 { 5739 STDDCL; 5740 struct ifaddr *ifa; 5741 struct sockaddr_in *si, *dest; 5742 uint32_t myaddr = 0, hisaddr = 0; 5743 int s; 5744 5745 IFNET_LOCK(ifp); 5746 5747 /* 5748 * Pick the first AF_INET address from the list, 5749 * aliases don't make any sense on a p2p link anyway. 5750 */ 5751 si = dest = NULL; 5752 s = pserialize_read_enter(); 5753 IFADDR_READER_FOREACH(ifa, ifp) { 5754 if (ifa->ifa_addr->sa_family == AF_INET) { 5755 si = (struct sockaddr_in *)ifa->ifa_addr; 5756 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5757 break; 5758 } 5759 } 5760 pserialize_read_exit(s); 5761 5762 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5763 myaddr = sp->ipcp.req_myaddr; 5764 else if (si != NULL) 5765 myaddr = ntohl(si->sin_addr.s_addr); 5766 5767 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5768 hisaddr = sp->ipcp.req_hisaddr; 5769 else if (dest != NULL) 5770 hisaddr = ntohl(dest->sin_addr.s_addr); 5771 5772 if (si != NULL && dest != NULL) { 5773 int error; 5774 struct sockaddr_in new_sin = *si; 5775 struct sockaddr_in new_dst = *dest; 5776 5777 if (myaddr != 0) 5778 new_sin.sin_addr.s_addr = htonl(myaddr); 5779 if (hisaddr != 0) { 5780 new_dst.sin_addr.s_addr = htonl(hisaddr); 5781 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5782 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5783 } 5784 5785 in_addrhash_remove(ifatoia(ifa)); 5786 5787 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5788 5789 in_addrhash_insert(ifatoia(ifa)); 5790 5791 if (debug && error) 5792 { 5793 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5794 ifp->if_xname, __func__, error); 5795 } 5796 if (!error) { 5797 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5798 } 5799 } 5800 5801 if (ifp->if_mtu > sp->lcp.their_mru) { 5802 sp->pp_saved_mtu = ifp->if_mtu; 5803 ifp->if_mtu = sp->lcp.their_mru; 5804 if (debug) 5805 log(LOG_DEBUG, 5806 "%s: setting MTU to %" PRIu64 " bytes\n", 5807 ifp->if_xname, ifp->if_mtu); 5808 } 5809 5810 IFNET_UNLOCK(ifp); 5811 5812 sppp_notify_con(sp); 5813 } 5814 5815 static void 5816 sppp_set_ip_addrs(struct sppp *sp) 5817 { 5818 struct ifnet *ifp = &sp->pp_if; 5819 5820 if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_SET_ADDRS)) { 5821 log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n", 5822 ifp->if_xname); 5823 return; 5824 } 5825 5826 if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1) 5827 return; 5828 5829 workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL); 5830 } 5831 5832 /* 5833 * Clear IP addresses. Must be called at splnet. 5834 */ 5835 static void 5836 sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp) 5837 { 5838 STDDCL; 5839 struct ifaddr *ifa; 5840 struct sockaddr_in *si, *dest; 5841 int s; 5842 5843 IFNET_LOCK(ifp); 5844 5845 /* 5846 * Pick the first AF_INET address from the list, 5847 * aliases don't make any sense on a p2p link anyway. 5848 */ 5849 si = dest = NULL; 5850 s = pserialize_read_enter(); 5851 IFADDR_READER_FOREACH(ifa, ifp) { 5852 if (ifa->ifa_addr->sa_family == AF_INET) { 5853 si = (struct sockaddr_in *)ifa->ifa_addr; 5854 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5855 break; 5856 } 5857 } 5858 pserialize_read_exit(s); 5859 5860 if (si != NULL) { 5861 struct sockaddr_in new_sin = *si; 5862 struct sockaddr_in new_dst = *dest; 5863 int error; 5864 5865 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5866 new_sin.sin_addr.s_addr = 0; 5867 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 5868 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5869 5870 in_addrhash_remove(ifatoia(ifa)); 5871 5872 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5873 5874 in_addrhash_insert(ifatoia(ifa)); 5875 5876 if (debug && error) 5877 { 5878 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5879 ifp->if_xname, __func__, error); 5880 } 5881 if (!error) { 5882 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5883 } 5884 } 5885 5886 if (sp->pp_saved_mtu > 0) { 5887 ifp->if_mtu = sp->pp_saved_mtu; 5888 sp->pp_saved_mtu = 0; 5889 if (debug) 5890 log(LOG_DEBUG, 5891 "%s: resetting MTU to %" PRIu64 " bytes\n", 5892 ifp->if_xname, ifp->if_mtu); 5893 } 5894 5895 IFNET_UNLOCK(ifp); 5896 } 5897 5898 static void 5899 sppp_clear_ip_addrs(struct sppp *sp) 5900 { 5901 struct ifnet *ifp = &sp->pp_if; 5902 5903 if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_CLEAR_ADDRS)) { 5904 log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n", 5905 ifp->if_xname); 5906 return; 5907 } 5908 5909 if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1) 5910 return; 5911 5912 workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL); 5913 } 5914 5915 static void 5916 sppp_update_ip_addrs_work(struct work *wk, void *arg) 5917 { 5918 struct sppp *sp = arg; 5919 void *work; 5920 5921 atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 0); 5922 5923 while ((work = pcq_get(sp->ipcp.update_addrs_q)) != NULL) { 5924 int update = (intptr_t)work; 5925 5926 if (update == IPCP_SET_ADDRS) 5927 sppp_set_ip_addrs_work(wk, sp); 5928 else if (update == IPCP_CLEAR_ADDRS) 5929 sppp_clear_ip_addrs_work(wk, sp); 5930 } 5931 } 5932 #endif 5933 5934 #ifdef INET6 5935 /* 5936 * Get both IPv6 addresses. 5937 */ 5938 static void 5939 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5940 struct in6_addr *srcmask) 5941 { 5942 struct ifnet *ifp = &sp->pp_if; 5943 struct ifaddr *ifa; 5944 struct sockaddr_in6 *si, *sm; 5945 struct in6_addr ssrc, ddst; 5946 int s; 5947 struct psref psref; 5948 5949 sm = NULL; 5950 memset(&ssrc, 0, sizeof(ssrc)); 5951 memset(&ddst, 0, sizeof(ddst)); 5952 /* 5953 * Pick the first link-local AF_INET6 address from the list, 5954 * aliases don't make any sense on a p2p link anyway. 5955 */ 5956 si = 0; 5957 s = pserialize_read_enter(); 5958 IFADDR_READER_FOREACH(ifa, ifp) { 5959 if (ifa->ifa_addr->sa_family == AF_INET6) { 5960 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5961 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5962 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5963 ifa_acquire(ifa, &psref); 5964 break; 5965 } 5966 } 5967 } 5968 pserialize_read_exit(s); 5969 5970 if (ifa) { 5971 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5972 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5973 if (srcmask) { 5974 memcpy(srcmask, &sm->sin6_addr, 5975 sizeof(*srcmask)); 5976 } 5977 } 5978 5979 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5980 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5981 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5982 ifa_release(ifa, &psref); 5983 } 5984 5985 if (dst) 5986 memcpy(dst, &ddst, sizeof(*dst)); 5987 if (src) 5988 memcpy(src, &ssrc, sizeof(*src)); 5989 } 5990 5991 #ifdef IPV6CP_MYIFID_DYN 5992 /* 5993 * Generate random ifid. 5994 */ 5995 static void 5996 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5997 { 5998 /* TBD */ 5999 } 6000 6001 /* 6002 * Set my IPv6 address. Must be called at splnet. 6003 */ 6004 static void 6005 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 6006 { 6007 STDDCL; 6008 struct ifaddr *ifa; 6009 struct sockaddr_in6 *sin6; 6010 int s; 6011 struct psref psref; 6012 6013 IFNET_LOCK(ifp); 6014 6015 /* 6016 * Pick the first link-local AF_INET6 address from the list, 6017 * aliases don't make any sense on a p2p link anyway. 6018 */ 6019 6020 sin6 = NULL; 6021 s = pserialize_read_enter(); 6022 IFADDR_READER_FOREACH(ifa, ifp) 6023 { 6024 if (ifa->ifa_addr->sa_family == AF_INET6) 6025 { 6026 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 6027 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 6028 ifa_acquire(ifa, &psref); 6029 break; 6030 } 6031 } 6032 } 6033 pserialize_read_exit(s); 6034 6035 if (ifa && sin6) 6036 { 6037 int error; 6038 struct sockaddr_in6 new_sin6 = *sin6; 6039 6040 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 6041 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 6042 if (debug && error) 6043 { 6044 log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n", 6045 ifp->if_xname, __func__, error); 6046 } 6047 if (!error) { 6048 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 6049 } 6050 ifa_release(ifa, &psref); 6051 } 6052 6053 IFNET_UNLOCK(ifp); 6054 } 6055 #endif 6056 6057 /* 6058 * Suggest a candidate address to be used by peer. 6059 */ 6060 static void 6061 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 6062 { 6063 struct in6_addr myaddr; 6064 struct timeval tv; 6065 6066 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 6067 6068 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 6069 microtime(&tv); 6070 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 6071 myaddr.s6_addr[14] ^= 0xff; 6072 myaddr.s6_addr[15] ^= 0xff; 6073 } else { 6074 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 6075 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 6076 } 6077 if (suggest) 6078 memcpy(suggest, &myaddr, sizeof(myaddr)); 6079 } 6080 #endif /*INET6*/ 6081 6082 /* 6083 * Process ioctl requests specific to the PPP interface. 6084 * Permissions have already been checked. 6085 */ 6086 static int 6087 sppp_params(struct sppp *sp, u_long cmd, void *data) 6088 { 6089 switch (cmd) { 6090 case SPPPGETAUTHCFG: 6091 { 6092 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6093 int error; 6094 size_t len; 6095 6096 SPPP_LOCK(sp, RW_READER); 6097 6098 cfg->myauthflags = sp->myauth.flags; 6099 cfg->hisauthflags = sp->hisauth.flags; 6100 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 6101 cfg->hisauth = 0; 6102 if (sp->hisauth.proto) 6103 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 6104 cfg->myauth = 0; 6105 if (sp->myauth.proto) 6106 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 6107 if (cfg->myname_length == 0) { 6108 if (sp->myauth.name != NULL) 6109 cfg->myname_length = sp->myauth.name_len + 1; 6110 } else { 6111 if (sp->myauth.name == NULL) { 6112 cfg->myname_length = 0; 6113 } else { 6114 len = sp->myauth.name_len + 1; 6115 6116 6117 if (cfg->myname_length < len) { 6118 SPPP_UNLOCK(sp); 6119 return (ENAMETOOLONG); 6120 } 6121 error = copyout(sp->myauth.name, cfg->myname, len); 6122 if (error) { 6123 SPPP_UNLOCK(sp); 6124 return error; 6125 } 6126 } 6127 } 6128 if (cfg->hisname_length == 0) { 6129 if (sp->hisauth.name != NULL) 6130 cfg->hisname_length = sp->hisauth.name_len + 1; 6131 } else { 6132 if (sp->hisauth.name == NULL) { 6133 cfg->hisname_length = 0; 6134 } else { 6135 len = sp->hisauth.name_len + 1; 6136 6137 if (cfg->hisname_length < len) { 6138 SPPP_UNLOCK(sp); 6139 return (ENAMETOOLONG); 6140 } 6141 error = copyout(sp->hisauth.name, cfg->hisname, len); 6142 if (error) { 6143 SPPP_UNLOCK(sp); 6144 return error; 6145 } 6146 } 6147 } 6148 SPPP_UNLOCK(sp); 6149 } 6150 break; 6151 case SPPPSETAUTHCFG: 6152 { 6153 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6154 int error; 6155 6156 SPPP_LOCK(sp, RW_WRITER); 6157 6158 if (sp->myauth.name) { 6159 free(sp->myauth.name, M_DEVBUF); 6160 sp->myauth.name = NULL; 6161 } 6162 if (sp->myauth.secret) { 6163 free(sp->myauth.secret, M_DEVBUF); 6164 sp->myauth.secret = NULL; 6165 } 6166 if (sp->hisauth.name) { 6167 free(sp->hisauth.name, M_DEVBUF); 6168 sp->hisauth.name = NULL; 6169 } 6170 if (sp->hisauth.secret) { 6171 free(sp->hisauth.secret, M_DEVBUF); 6172 sp->hisauth.secret = NULL; 6173 } 6174 6175 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6176 if (cfg->hisname_length >= MCLBYTES) { 6177 SPPP_UNLOCK(sp); 6178 return (ENAMETOOLONG); 6179 } 6180 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6181 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6182 if (error) { 6183 free(sp->hisauth.name, M_DEVBUF); 6184 sp->hisauth.name = NULL; 6185 SPPP_UNLOCK(sp); 6186 return error; 6187 } 6188 sp->hisauth.name_len = cfg->hisname_length - 1; 6189 sp->hisauth.name[sp->hisauth.name_len] = 0; 6190 } 6191 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6192 if (cfg->hissecret_length >= MCLBYTES) { 6193 SPPP_UNLOCK(sp); 6194 return (ENAMETOOLONG); 6195 } 6196 sp->hisauth.secret = malloc(cfg->hissecret_length, 6197 M_DEVBUF, M_WAITOK); 6198 error = copyin(cfg->hissecret, sp->hisauth.secret, 6199 cfg->hissecret_length); 6200 if (error) { 6201 free(sp->hisauth.secret, M_DEVBUF); 6202 sp->hisauth.secret = NULL; 6203 SPPP_UNLOCK(sp); 6204 return error; 6205 } 6206 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6207 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6208 } 6209 if (cfg->myname != NULL && cfg->myname_length > 0) { 6210 if (cfg->myname_length >= MCLBYTES) { 6211 SPPP_UNLOCK(sp); 6212 return (ENAMETOOLONG); 6213 } 6214 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6215 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6216 if (error) { 6217 free(sp->myauth.name, M_DEVBUF); 6218 sp->myauth.name = NULL; 6219 SPPP_UNLOCK(sp); 6220 return error; 6221 } 6222 sp->myauth.name_len = cfg->myname_length - 1; 6223 sp->myauth.name[sp->myauth.name_len] = 0; 6224 } 6225 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6226 if (cfg->mysecret_length >= MCLBYTES) { 6227 SPPP_UNLOCK(sp); 6228 return (ENAMETOOLONG); 6229 } 6230 sp->myauth.secret = malloc(cfg->mysecret_length, 6231 M_DEVBUF, M_WAITOK); 6232 error = copyin(cfg->mysecret, sp->myauth.secret, 6233 cfg->mysecret_length); 6234 if (error) { 6235 free(sp->myauth.secret, M_DEVBUF); 6236 sp->myauth.secret = NULL; 6237 SPPP_UNLOCK(sp); 6238 return error; 6239 } 6240 sp->myauth.secret_len = cfg->mysecret_length - 1; 6241 sp->myauth.secret[sp->myauth.secret_len] = 0; 6242 } 6243 sp->myauth.flags = cfg->myauthflags; 6244 if (cfg->myauth) 6245 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 6246 sp->hisauth.flags = cfg->hisauthflags; 6247 if (cfg->hisauth) 6248 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 6249 sp->pp_auth_failures = 0; 6250 if (sp->hisauth.proto != 0) 6251 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 6252 else 6253 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 6254 6255 SPPP_UNLOCK(sp); 6256 } 6257 break; 6258 case SPPPGETLCPCFG: 6259 { 6260 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6261 6262 SPPP_LOCK(sp, RW_READER); 6263 lcpp->lcp_timeout = sp->lcp.timeout; 6264 SPPP_UNLOCK(sp); 6265 } 6266 break; 6267 case SPPPSETLCPCFG: 6268 { 6269 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6270 6271 SPPP_LOCK(sp, RW_WRITER); 6272 sp->lcp.timeout = lcpp->lcp_timeout; 6273 SPPP_UNLOCK(sp); 6274 } 6275 break; 6276 case SPPPGETSTATUS: 6277 { 6278 struct spppstatus *status = (struct spppstatus *)data; 6279 6280 SPPP_LOCK(sp, RW_READER); 6281 status->phase = sp->pp_phase; 6282 SPPP_UNLOCK(sp); 6283 } 6284 break; 6285 case SPPPGETSTATUSNCP: 6286 { 6287 struct spppstatusncp *status = (struct spppstatusncp *)data; 6288 6289 SPPP_LOCK(sp, RW_READER); 6290 status->phase = sp->pp_phase; 6291 status->ncpup = sppp_ncp_check(sp); 6292 SPPP_UNLOCK(sp); 6293 } 6294 break; 6295 case SPPPGETIDLETO: 6296 { 6297 struct spppidletimeout *to = (struct spppidletimeout *)data; 6298 6299 SPPP_LOCK(sp, RW_READER); 6300 to->idle_seconds = sp->pp_idle_timeout; 6301 SPPP_UNLOCK(sp); 6302 } 6303 break; 6304 case SPPPSETIDLETO: 6305 { 6306 struct spppidletimeout *to = (struct spppidletimeout *)data; 6307 6308 SPPP_LOCK(sp, RW_WRITER); 6309 sp->pp_idle_timeout = to->idle_seconds; 6310 SPPP_UNLOCK(sp); 6311 } 6312 break; 6313 case SPPPSETAUTHFAILURE: 6314 { 6315 struct spppauthfailuresettings *afsettings = 6316 (struct spppauthfailuresettings *)data; 6317 6318 SPPP_LOCK(sp, RW_WRITER); 6319 sp->pp_max_auth_fail = afsettings->max_failures; 6320 sp->pp_auth_failures = 0; 6321 SPPP_UNLOCK(sp); 6322 } 6323 break; 6324 case SPPPGETAUTHFAILURES: 6325 { 6326 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6327 6328 SPPP_LOCK(sp, RW_READER); 6329 stats->auth_failures = sp->pp_auth_failures; 6330 stats->max_failures = sp->pp_max_auth_fail; 6331 SPPP_UNLOCK(sp); 6332 } 6333 break; 6334 case SPPPSETDNSOPTS: 6335 { 6336 struct spppdnssettings *req = (struct spppdnssettings *)data; 6337 6338 SPPP_LOCK(sp, RW_WRITER); 6339 sp->query_dns = req->query_dns & 3; 6340 SPPP_UNLOCK(sp); 6341 } 6342 break; 6343 case SPPPGETDNSOPTS: 6344 { 6345 struct spppdnssettings *req = (struct spppdnssettings *)data; 6346 6347 SPPP_LOCK(sp, RW_READER); 6348 req->query_dns = sp->query_dns; 6349 SPPP_UNLOCK(sp); 6350 } 6351 break; 6352 case SPPPGETDNSADDRS: 6353 { 6354 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6355 6356 SPPP_LOCK(sp, RW_READER); 6357 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6358 SPPP_UNLOCK(sp); 6359 } 6360 break; 6361 case SPPPGETKEEPALIVE: 6362 { 6363 struct spppkeepalivesettings *settings = 6364 (struct spppkeepalivesettings*)data; 6365 6366 SPPP_LOCK(sp, RW_READER); 6367 settings->maxalive = sp->pp_maxalive; 6368 settings->max_noreceive = sp->pp_max_noreceive; 6369 SPPP_UNLOCK(sp); 6370 } 6371 break; 6372 case SPPPSETKEEPALIVE: 6373 { 6374 struct spppkeepalivesettings *settings = 6375 (struct spppkeepalivesettings*)data; 6376 6377 SPPP_LOCK(sp, RW_WRITER); 6378 sp->pp_maxalive = settings->maxalive; 6379 sp->pp_max_noreceive = settings->max_noreceive; 6380 SPPP_UNLOCK(sp); 6381 } 6382 break; 6383 default: 6384 { 6385 int ret; 6386 6387 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6388 enosys(), ret); 6389 if (ret != ENOSYS) 6390 return ret; 6391 return (EINVAL); 6392 } 6393 } 6394 return (0); 6395 } 6396 6397 static void 6398 sppp_phase_network(struct sppp *sp) 6399 { 6400 int i; 6401 uint32_t mask; 6402 6403 KASSERT(SPPP_WLOCKED(sp)); 6404 6405 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6406 6407 /* Notify NCPs now. */ 6408 for (i = 0; i < IDX_COUNT; i++) 6409 if ((cps[i])->flags & CP_NCP) 6410 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6411 6412 /* Send Up events to all NCPs. */ 6413 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 6414 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) { 6415 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_up); 6416 } 6417 6418 /* if no NCP is starting, all this was in vain, close down */ 6419 sppp_lcp_check_and_close(sp); 6420 } 6421 6422 6423 static const char * 6424 sppp_cp_type_name(u_char type) 6425 { 6426 static char buf[12]; 6427 switch (type) { 6428 case CONF_REQ: return "conf-req"; 6429 case CONF_ACK: return "conf-ack"; 6430 case CONF_NAK: return "conf-nak"; 6431 case CONF_REJ: return "conf-rej"; 6432 case TERM_REQ: return "term-req"; 6433 case TERM_ACK: return "term-ack"; 6434 case CODE_REJ: return "code-rej"; 6435 case PROTO_REJ: return "proto-rej"; 6436 case ECHO_REQ: return "echo-req"; 6437 case ECHO_REPLY: return "echo-reply"; 6438 case DISC_REQ: return "discard-req"; 6439 } 6440 snprintf(buf, sizeof(buf), "0x%x", type); 6441 return buf; 6442 } 6443 6444 static const char * 6445 sppp_auth_type_name(u_short proto, u_char type) 6446 { 6447 static char buf[32]; 6448 const char *name; 6449 6450 switch (proto) { 6451 case PPP_CHAP: 6452 switch (type) { 6453 case CHAP_CHALLENGE: return "challenge"; 6454 case CHAP_RESPONSE: return "response"; 6455 case CHAP_SUCCESS: return "success"; 6456 case CHAP_FAILURE: return "failure"; 6457 default: name = "chap"; break; 6458 } 6459 break; 6460 6461 case PPP_PAP: 6462 switch (type) { 6463 case PAP_REQ: return "req"; 6464 case PAP_ACK: return "ack"; 6465 case PAP_NAK: return "nak"; 6466 default: name = "pap"; break; 6467 } 6468 break; 6469 6470 default: 6471 name = "bad"; 6472 break; 6473 } 6474 6475 snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type); 6476 return buf; 6477 } 6478 6479 static const char * 6480 sppp_lcp_opt_name(u_char opt) 6481 { 6482 static char buf[12]; 6483 switch (opt) { 6484 case LCP_OPT_MRU: return "mru"; 6485 case LCP_OPT_ASYNC_MAP: return "async-map"; 6486 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6487 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6488 case LCP_OPT_MAGIC: return "magic"; 6489 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6490 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6491 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6492 case LCP_OPT_CALL_BACK: return "callback"; 6493 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6494 case LCP_OPT_MP_MRRU: return "mrru"; 6495 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6496 case LCP_OPT_MP_EID: return "mp-eid"; 6497 } 6498 snprintf(buf, sizeof(buf), "0x%x", opt); 6499 return buf; 6500 } 6501 6502 static const char * 6503 sppp_ipcp_opt_name(u_char opt) 6504 { 6505 static char buf[12]; 6506 switch (opt) { 6507 case IPCP_OPT_ADDRESSES: return "addresses"; 6508 case IPCP_OPT_COMPRESSION: return "compression"; 6509 case IPCP_OPT_ADDRESS: return "address"; 6510 } 6511 snprintf(buf, sizeof(buf), "0x%x", opt); 6512 return buf; 6513 } 6514 6515 #ifdef INET6 6516 static const char * 6517 sppp_ipv6cp_opt_name(u_char opt) 6518 { 6519 static char buf[12]; 6520 switch (opt) { 6521 case IPV6CP_OPT_IFID: return "ifid"; 6522 case IPV6CP_OPT_COMPRESSION: return "compression"; 6523 } 6524 snprintf(buf, sizeof(buf), "0x%x", opt); 6525 return buf; 6526 } 6527 #endif 6528 6529 static const char * 6530 sppp_state_name(int state) 6531 { 6532 switch (state) { 6533 case STATE_INITIAL: return "initial"; 6534 case STATE_STARTING: return "starting"; 6535 case STATE_CLOSED: return "closed"; 6536 case STATE_STOPPED: return "stopped"; 6537 case STATE_CLOSING: return "closing"; 6538 case STATE_STOPPING: return "stopping"; 6539 case STATE_REQ_SENT: return "req-sent"; 6540 case STATE_ACK_RCVD: return "ack-rcvd"; 6541 case STATE_ACK_SENT: return "ack-sent"; 6542 case STATE_OPENED: return "opened"; 6543 } 6544 return "illegal"; 6545 } 6546 6547 static const char * 6548 sppp_phase_name(int phase) 6549 { 6550 switch (phase) { 6551 case SPPP_PHASE_DEAD: return "dead"; 6552 case SPPP_PHASE_ESTABLISH: return "establish"; 6553 case SPPP_PHASE_TERMINATE: return "terminate"; 6554 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6555 case SPPP_PHASE_NETWORK: return "network"; 6556 } 6557 return "illegal"; 6558 } 6559 6560 static const char * 6561 sppp_proto_name(u_short proto) 6562 { 6563 static char buf[12]; 6564 switch (proto) { 6565 case PPP_LCP: return "lcp"; 6566 case PPP_IPCP: return "ipcp"; 6567 case PPP_PAP: return "pap"; 6568 case PPP_CHAP: return "chap"; 6569 case PPP_IPV6CP: return "ipv6cp"; 6570 } 6571 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 6572 return buf; 6573 } 6574 6575 static void 6576 sppp_print_bytes(const u_char *p, u_short len) 6577 { 6578 addlog(" %02x", *p++); 6579 while (--len > 0) 6580 addlog("-%02x", *p++); 6581 } 6582 6583 static void 6584 sppp_print_string(const char *p, u_short len) 6585 { 6586 u_char c; 6587 6588 while (len-- > 0) { 6589 c = *p++; 6590 /* 6591 * Print only ASCII chars directly. RFC 1994 recommends 6592 * using only them, but we don't rely on it. */ 6593 if (c < ' ' || c > '~') 6594 addlog("\\x%x", c); 6595 else 6596 addlog("%c", c); 6597 } 6598 } 6599 6600 static const char * 6601 sppp_dotted_quad(uint32_t addr) 6602 { 6603 static char s[16]; 6604 snprintf(s, sizeof(s), "%d.%d.%d.%d", 6605 (int)((addr >> 24) & 0xff), 6606 (int)((addr >> 16) & 0xff), 6607 (int)((addr >> 8) & 0xff), 6608 (int)(addr & 0xff)); 6609 return s; 6610 } 6611 6612 /* a dummy, used to drop uninteresting events */ 6613 static void 6614 sppp_null(struct sppp *unused) 6615 { 6616 /* do just nothing */ 6617 } 6618 6619 static void 6620 sppp_sca_scn(const struct cp *cp, struct sppp *sp) 6621 { 6622 STDDCL; 6623 u_char rconfid, type, rlen; 6624 void *buf; 6625 size_t blen; 6626 6627 rconfid = sp->scp[cp->protoidx].rconfid; 6628 type = sp->scp[cp->protoidx].rcr_type; 6629 buf = sp->scp[cp->protoidx].rcr_buf; 6630 rlen = sp->scp[cp->protoidx].rcr_rlen; 6631 blen = sp->scp[cp->protoidx].rcr_blen; 6632 6633 sp->scp[cp->protoidx].rcr_buf = NULL; 6634 sp->scp[cp->protoidx].rcr_blen = 0; 6635 6636 if (buf != NULL) { 6637 if (rlen > 0) { 6638 if (debug) { 6639 log(LOG_DEBUG, "%s: send %s\n", 6640 ifp->if_xname, sppp_cp_type_name(type)); 6641 } 6642 sppp_cp_send(sp, cp->proto, type, rconfid, rlen, buf); 6643 } 6644 kmem_free(buf, blen); 6645 } 6646 } 6647 6648 static void 6649 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6650 { 6651 6652 SPPP_UNLOCK(sp); 6653 if_down(&sp->pp_if); 6654 IF_PURGE(&sp->pp_cpq); 6655 SPPP_LOCK(sp, RW_WRITER); 6656 } 6657 6658 /* 6659 * This file is large. Tell emacs to highlight it nevertheless. 6660 * 6661 * Local Variables: 6662 * hilit-auto-highlight-maxout: 120000 6663 * End: 6664 */ 6665 6666 /* 6667 * Module glue 6668 */ 6669 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6670 6671 static int 6672 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6673 { 6674 switch (cmd) { 6675 case MODULE_CMD_INIT: 6676 case MODULE_CMD_FINI: 6677 return 0; 6678 case MODULE_CMD_STAT: 6679 case MODULE_CMD_AUTOUNLOAD: 6680 default: 6681 return ENOTTY; 6682 } 6683 } 6684 6685 static void 6686 sppp_notify_up(struct sppp *sp) 6687 { 6688 6689 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6690 } 6691 6692 static void 6693 sppp_notify_down(struct sppp *sp) 6694 { 6695 6696 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6697 } 6698 6699 static void 6700 sppp_notify_tls_wlocked(struct sppp *sp) 6701 { 6702 6703 KASSERT(SPPP_WLOCKED(sp)); 6704 6705 if (!sp->pp_tls) 6706 return; 6707 6708 SPPP_UNLOCK(sp); 6709 sp->pp_tls(sp); 6710 SPPP_LOCK(sp, RW_WRITER); 6711 } 6712 6713 static void 6714 sppp_notify_tlf_wlocked(struct sppp *sp) 6715 { 6716 6717 KASSERT(SPPP_WLOCKED(sp)); 6718 6719 if (!sp->pp_tlf) 6720 return; 6721 6722 SPPP_UNLOCK(sp); 6723 sp->pp_tlf(sp); 6724 SPPP_LOCK(sp, RW_WRITER); 6725 } 6726 6727 static void 6728 sppp_notify_con(struct sppp *sp) 6729 { 6730 6731 if (!sp->pp_con) 6732 return; 6733 6734 sp->pp_con(sp); 6735 } 6736 6737 #ifdef INET6 6738 static void 6739 sppp_notify_con_wlocked(struct sppp *sp) 6740 { 6741 6742 KASSERT(SPPP_WLOCKED(sp)); 6743 6744 SPPP_UNLOCK(sp); 6745 sppp_notify_con(sp); 6746 SPPP_LOCK(sp, RW_WRITER); 6747 6748 } 6749 #endif 6750 6751 static void 6752 sppp_notify_chg_wlocked(struct sppp *sp) 6753 { 6754 6755 KASSERT(SPPP_WLOCKED(sp)); 6756 6757 if (!sp->pp_chg) 6758 return; 6759 6760 SPPP_UNLOCK(sp); 6761 sp->pp_chg(sp, sp->pp_phase); 6762 SPPP_LOCK(sp, RW_WRITER); 6763 } 6764 6765 static void 6766 sppp_wq_work(struct work *wk, void *xsp) 6767 { 6768 struct sppp *sp; 6769 struct sppp_work *work; 6770 6771 sp = xsp; 6772 work = container_of(wk, struct sppp_work, work); 6773 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6774 6775 SPPP_LOCK(sp, RW_WRITER); 6776 work->func(sp, work->arg); 6777 SPPP_UNLOCK(sp); 6778 } 6779 6780 static struct workqueue * 6781 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6782 { 6783 struct workqueue *wq; 6784 int error; 6785 6786 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6787 (void *)sp, prio, ipl, flags); 6788 if (error) { 6789 panic("%s: workqueue_create failed [%s, %d]\n", 6790 sp->pp_if.if_xname, xnamebuf, error); 6791 } 6792 6793 return wq; 6794 } 6795 6796 static void 6797 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6798 { 6799 6800 workqueue_destroy(wq); 6801 } 6802 6803 static void 6804 sppp_wq_set(struct sppp_work *work, 6805 void (*func)(struct sppp *, void *), void *arg) 6806 { 6807 6808 work->func = func; 6809 work->arg = arg; 6810 } 6811 6812 static void 6813 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6814 { 6815 6816 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6817 != SPPP_WK_FREE) 6818 return; 6819 6820 KASSERT(work->func != NULL); 6821 kpreempt_disable(); 6822 workqueue_enqueue(wq, &work->work, NULL); 6823 kpreempt_enable(); 6824 } 6825 static void 6826 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6827 { 6828 6829 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6830 workqueue_wait(wq, &work->work); 6831 } 6832
Indexes created Fri Sep 26 20:09:58 GMT 2025