if_spppsubr.c revision 1.213
1 /* $NetBSD: if_spppsubr.c,v 1.213 2020/11/25 10:30:51 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.213 2020/11/25 10:30:51 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #endif 52 53 #include <sys/param.h> 54 #include <sys/proc.h> 55 #include <sys/systm.h> 56 #include <sys/kernel.h> 57 #include <sys/sockio.h> 58 #include <sys/socket.h> 59 #include <sys/syslog.h> 60 #include <sys/malloc.h> 61 #include <sys/mbuf.h> 62 #include <sys/callout.h> 63 #include <sys/md5.h> 64 #include <sys/inttypes.h> 65 #include <sys/kauth.h> 66 #include <sys/cprng.h> 67 #include <sys/module.h> 68 #include <sys/workqueue.h> 69 #include <sys/atomic.h> 70 #include <sys/compat_stub.h> 71 #include <sys/cpu.h> 72 73 #include <net/if.h> 74 #include <net/netisr.h> 75 #include <net/if_types.h> 76 #include <net/route.h> 77 #include <net/ppp_defs.h> 78 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/in_var.h> 82 #ifdef INET 83 #include <netinet/ip.h> 84 #include <netinet/tcp.h> 85 #endif 86 #include <net/ethertypes.h> 87 88 #ifdef INET6 89 #include <netinet6/scope6_var.h> 90 #endif 91 92 #include <net/if_sppp.h> 93 #include <net/if_spppvar.h> 94 95 #ifdef NET_MPSAFE 96 #define SPPPSUBR_MPSAFE 1 97 #endif 98 99 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 100 #define LOOPALIVECNT 3 /* loopback detection tries */ 101 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 102 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 103 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 104 105 /* 106 * Interface flags that can be set in an ifconfig command. 107 * 108 * Setting link0 will make the link passive, i.e. it will be marked 109 * as being administrative openable, but won't be opened to begin 110 * with. Incoming calls will be answered, or subsequent calls with 111 * -link1 will cause the administrative open of the LCP layer. 112 * 113 * Setting link1 will cause the link to auto-dial only as packets 114 * arrive to be sent. 115 * 116 * Setting IFF_DEBUG will syslog the option negotiation and state 117 * transitions at level kern.debug. Note: all logs consistently look 118 * like 119 * 120 * <if-name><unit>: <proto-name> <additional info...> 121 * 122 * with <if-name><unit> being something like "bppp0", and <proto-name> 123 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 124 */ 125 126 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 127 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 128 129 #define CONF_REQ 1 /* PPP configure request */ 130 #define CONF_ACK 2 /* PPP configure acknowledge */ 131 #define CONF_NAK 3 /* PPP configure negative ack */ 132 #define CONF_REJ 4 /* PPP configure reject */ 133 #define TERM_REQ 5 /* PPP terminate request */ 134 #define TERM_ACK 6 /* PPP terminate acknowledge */ 135 #define CODE_REJ 7 /* PPP code reject */ 136 #define PROTO_REJ 8 /* PPP protocol reject */ 137 #define ECHO_REQ 9 /* PPP echo request */ 138 #define ECHO_REPLY 10 /* PPP echo reply */ 139 #define DISC_REQ 11 /* PPP discard request */ 140 141 #define LCP_OPT_MRU 1 /* maximum receive unit */ 142 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 143 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 144 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 145 #define LCP_OPT_MAGIC 5 /* magic number */ 146 #define LCP_OPT_RESERVED 6 /* reserved */ 147 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 148 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 149 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 150 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 151 #define LCP_OPT_CALL_BACK 13 /* callback */ 152 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 153 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 154 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 155 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 156 157 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 158 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 159 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 160 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 161 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 162 163 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 164 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 165 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 166 167 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 168 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 169 170 #define PAP_REQ 1 /* PAP name/password request */ 171 #define PAP_ACK 2 /* PAP acknowledge */ 172 #define PAP_NAK 3 /* PAP fail */ 173 174 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 175 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 176 #define CHAP_SUCCESS 3 /* CHAP response ok */ 177 #define CHAP_FAILURE 4 /* CHAP response failed */ 178 179 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 180 181 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 182 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 183 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 184 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 185 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 186 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 187 188 enum { 189 STATE_INITIAL = SPPP_STATE_INITIAL, 190 STATE_STARTING = SPPP_STATE_STARTING, 191 STATE_CLOSED = SPPP_STATE_CLOSED, 192 STATE_STOPPED = SPPP_STATE_STOPPED, 193 STATE_CLOSING = SPPP_STATE_CLOSING, 194 STATE_STOPPING = SPPP_STATE_STOPPING, 195 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 196 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 197 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 198 STATE_OPENED = SPPP_STATE_OPENED, 199 }; 200 201 enum cp_rcr_type { 202 CP_RCR_NONE = 0, /* initial value */ 203 CP_RCR_ACK, /* RCR+ */ 204 CP_RCR_NAK, /* RCR- */ 205 CP_RCR_REJ, /* RCR- */ 206 CP_RCR_DROP, /* DROP message */ 207 CP_RCR_ERR, /* internal error */ 208 }; 209 210 struct ppp_header { 211 uint8_t address; 212 uint8_t control; 213 uint16_t protocol; 214 } __packed; 215 #define PPP_HEADER_LEN sizeof (struct ppp_header) 216 217 struct lcp_header { 218 uint8_t type; 219 uint8_t ident; 220 uint16_t len; 221 } __packed; 222 #define LCP_HEADER_LEN sizeof (struct lcp_header) 223 224 struct cisco_packet { 225 uint32_t type; 226 uint32_t par1; 227 uint32_t par2; 228 uint16_t rel; 229 uint16_t time0; 230 uint16_t time1; 231 } __packed; 232 #define CISCO_PACKET_LEN 18 233 234 /* 235 * We follow the spelling and capitalization of RFC 1661 here, to make 236 * it easier comparing with the standard. Please refer to this RFC in 237 * case you can't make sense out of these abbreviation; it will also 238 * explain the semantics related to the various events and actions. 239 */ 240 struct cp { 241 u_short proto; /* PPP control protocol number */ 242 u_char protoidx; /* index into state table in struct sppp */ 243 u_char flags; 244 #define CP_LCP 0x01 /* this is the LCP */ 245 #define CP_AUTH 0x02 /* this is an authentication protocol */ 246 #define CP_NCP 0x04 /* this is a NCP */ 247 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 248 const char *name; /* name of this control protocol */ 249 /* event handlers */ 250 void (*Up)(struct sppp *, void *); 251 void (*Down)(struct sppp *, void *); 252 void (*Open)(struct sppp *, void *); 253 void (*Close)(struct sppp *, void *); 254 void (*TO)(struct sppp *, void *); 255 /* actions */ 256 void (*tlu)(struct sppp *); 257 void (*tld)(struct sppp *); 258 void (*tls)(const struct cp *, struct sppp *); 259 void (*tlf)(const struct cp *, struct sppp *); 260 void (*scr)(struct sppp *); 261 void (*scan)(const struct cp *, struct sppp *); 262 263 /* message parser */ 264 enum cp_rcr_type 265 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 266 uint8_t **, size_t *, size_t *); 267 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 268 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 269 }; 270 271 enum auth_role { 272 SPPP_AUTH_NOROLE = 0, 273 SPPP_AUTH_SERV = __BIT(0), 274 SPPP_AUTH_PEER = __BIT(1), 275 }; 276 277 static struct sppp *spppq; 278 static kmutex_t *spppq_lock = NULL; 279 static callout_t keepalive_ch; 280 281 #define SPPPQ_LOCK() if (spppq_lock) \ 282 mutex_enter(spppq_lock); 283 #define SPPPQ_UNLOCK() if (spppq_lock) \ 284 mutex_exit(spppq_lock); 285 286 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 287 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 288 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 289 #define SPPP_UPGRADE(_sp) do{ \ 290 SPPP_UNLOCK(_sp); \ 291 SPPP_LOCK(_sp, RW_WRITER); \ 292 }while (0) 293 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 294 #define SPPP_WQ_SET(_wk, _func, _arg) \ 295 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 296 297 #ifdef INET 298 #ifndef SPPPSUBR_MPSAFE 299 /* 300 * The following disgusting hack gets around the problem that IP TOS 301 * can't be set yet. We want to put "interactive" traffic on a high 302 * priority queue. To decide if traffic is interactive, we check that 303 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 304 * 305 * XXX is this really still necessary? - joerg - 306 */ 307 static u_short interactive_ports[8] = { 308 0, 513, 0, 0, 309 0, 21, 0, 23, 310 }; 311 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 312 #endif /* SPPPSUBR_MPSAFE */ 313 #endif 314 315 /* almost every function needs these */ 316 #define STDDCL \ 317 struct ifnet *ifp = &sp->pp_if; \ 318 int debug = ifp->if_flags & IFF_DEBUG 319 320 static int sppp_output(struct ifnet *, struct mbuf *, 321 const struct sockaddr *, const struct rtentry *); 322 323 static void sppp_cisco_send(struct sppp *, int, int32_t, int32_t); 324 static void sppp_cisco_input(struct sppp *, struct mbuf *); 325 326 static void sppp_cp_init(const struct cp *, struct sppp *); 327 static void sppp_cp_fini(const struct cp *, struct sppp *); 328 static void sppp_cp_input(const struct cp *, struct sppp *, 329 struct mbuf *); 330 static void sppp_cp_input(const struct cp *, struct sppp *, 331 struct mbuf *); 332 static void sppp_cp_send(struct sppp *, u_short, u_char, 333 u_char, u_short, void *); 334 /* static void sppp_cp_timeout(void *arg); */ 335 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 336 static struct workqueue * 337 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 338 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 339 static void sppp_wq_set(struct sppp_work *, 340 void (*)(struct sppp *, void *), void *); 341 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 342 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 343 static void sppp_cp_to_lcp(void *); 344 static void sppp_cp_to_ipcp(void *); 345 static void sppp_cp_to_ipv6cp(void *); 346 static void sppp_auth_send(const struct cp *, struct sppp *, 347 unsigned int, unsigned int, ...); 348 static int sppp_auth_role(const struct cp *, struct sppp *); 349 static void sppp_auth_to_event(struct sppp *, void *); 350 static void sppp_auth_sca_scn(const struct cp *, struct sppp *); 351 352 static void sppp_up_event(struct sppp *, void *); 353 static void sppp_down_event(struct sppp *, void *); 354 static void sppp_open_event(struct sppp *, void *); 355 static void sppp_close_event(struct sppp *, void *); 356 static void sppp_to_event(struct sppp *, void *); 357 static void sppp_rcr_event(struct sppp *, void *); 358 static void sppp_rca_event(struct sppp *, void *); 359 static void sppp_rcn_event(struct sppp *, void *); 360 static void sppp_rtr_event(struct sppp *, void *); 361 static void sppp_rta_event(struct sppp *, void *); 362 static void sppp_rxj_event(struct sppp *, void *); 363 364 static void sppp_null(struct sppp *); 365 static void sppp_tls(const struct cp *, struct sppp *); 366 static void sppp_tlf(const struct cp *, struct sppp *); 367 static void sppp_sca_scn(const struct cp *, struct sppp *); 368 static void sppp_ifdown(struct sppp *, void *); 369 370 static void sppp_lcp_init(struct sppp *); 371 static void sppp_lcp_up(struct sppp *, void *); 372 static void sppp_lcp_down(struct sppp *, void *); 373 static void sppp_lcp_open(struct sppp *, void *); 374 static enum cp_rcr_type 375 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 376 uint8_t **, size_t *, size_t *); 377 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 378 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 379 static void sppp_lcp_tlu(struct sppp *); 380 static void sppp_lcp_tld(struct sppp *); 381 static void sppp_lcp_tls(const struct cp *, struct sppp *); 382 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 383 static void sppp_lcp_scr(struct sppp *); 384 static void sppp_lcp_check_and_close(struct sppp *); 385 static int sppp_cp_check(struct sppp *, u_char); 386 387 static void sppp_ipcp_init(struct sppp *); 388 static void sppp_ipcp_open(struct sppp *, void *); 389 static void sppp_ipcp_close(struct sppp *, void *); 390 static enum cp_rcr_type 391 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 392 uint8_t **, size_t *, size_t *); 393 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 394 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 395 static void sppp_ipcp_tlu(struct sppp *); 396 static void sppp_ipcp_scr(struct sppp *); 397 398 static void sppp_ipv6cp_init(struct sppp *); 399 static void sppp_ipv6cp_open(struct sppp *, void *); 400 static enum cp_rcr_type 401 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 402 uint8_t **, size_t *, size_t *); 403 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 404 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 405 static void sppp_ipv6cp_tlu(struct sppp *); 406 static void sppp_ipv6cp_scr(struct sppp *); 407 408 static void sppp_pap_input(struct sppp *, struct mbuf *); 409 static void sppp_pap_init(struct sppp *); 410 static void sppp_pap_tlu(struct sppp *); 411 static void sppp_pap_scr(struct sppp *); 412 static void sppp_pap_scr(struct sppp *); 413 414 static void sppp_chap_input(struct sppp *, struct mbuf *); 415 static void sppp_chap_init(struct sppp *); 416 static void sppp_chap_open(struct sppp *, void *); 417 static void sppp_chap_tlu(struct sppp *); 418 static void sppp_chap_scr(struct sppp *); 419 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 420 421 static const char *sppp_auth_type_name(u_short, u_char); 422 static const char *sppp_cp_type_name(u_char); 423 static const char *sppp_dotted_quad(uint32_t); 424 static const char *sppp_ipcp_opt_name(u_char); 425 #ifdef INET6 426 static const char *sppp_ipv6cp_opt_name(u_char); 427 #endif 428 static const char *sppp_lcp_opt_name(u_char); 429 static const char *sppp_phase_name(int); 430 static const char *sppp_proto_name(u_short); 431 static const char *sppp_state_name(int); 432 static int sppp_params(struct sppp *, u_long, void *); 433 #ifdef INET 434 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 435 static void sppp_set_ip_addrs(struct sppp *); 436 static void sppp_clear_ip_addrs(struct sppp *); 437 #endif 438 static void sppp_keepalive(void *); 439 static void sppp_phase_network(struct sppp *); 440 static void sppp_print_bytes(const u_char *, u_short); 441 static void sppp_print_string(const char *, u_short); 442 #ifdef INET6 443 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 444 struct in6_addr *, struct in6_addr *); 445 #ifdef IPV6CP_MYIFID_DYN 446 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 447 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 448 #endif 449 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 450 #endif 451 452 static void sppp_notify_up(struct sppp *); 453 static void sppp_notify_down(struct sppp *); 454 static void sppp_notify_tls_wlocked(struct sppp *); 455 static void sppp_notify_tlf_wlocked(struct sppp *); 456 #ifdef INET6 457 static void sppp_notify_con_wlocked(struct sppp *); 458 #endif 459 static void sppp_notify_con(struct sppp *); 460 461 static void sppp_notify_chg_wlocked(struct sppp *); 462 463 /* our control protocol descriptors */ 464 static const struct cp lcp = { 465 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 466 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 467 sppp_close_event, sppp_to_event, 468 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 469 sppp_lcp_tlf, sppp_lcp_scr, sppp_sca_scn, 470 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 471 }; 472 473 static const struct cp ipcp = { 474 PPP_IPCP, IDX_IPCP, 475 #ifdef INET 476 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 477 #else 478 0, 479 #endif 480 "ipcp", 481 sppp_up_event, sppp_down_event, sppp_ipcp_open, 482 sppp_ipcp_close, sppp_to_event, 483 sppp_ipcp_tlu, sppp_null, sppp_tls, 484 sppp_tlf, sppp_ipcp_scr, sppp_sca_scn, 485 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 486 }; 487 488 static const struct cp ipv6cp = { 489 PPP_IPV6CP, IDX_IPV6CP, 490 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 491 CP_NCP, 492 #else 493 0, 494 #endif 495 "ipv6cp", 496 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 497 sppp_close_event, sppp_to_event, 498 sppp_ipv6cp_tlu, sppp_null, sppp_tls, 499 sppp_tlf, sppp_ipv6cp_scr, sppp_sca_scn, 500 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 501 }; 502 503 static const struct cp pap = { 504 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 505 sppp_up_event, sppp_down_event, sppp_open_event, 506 sppp_close_event, sppp_to_event, 507 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 508 sppp_pap_scr, sppp_auth_sca_scn, 509 NULL, NULL, NULL 510 }; 511 512 static const struct cp chap = { 513 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 514 sppp_up_event, sppp_down_event, sppp_chap_open, 515 sppp_close_event, sppp_auth_to_event, 516 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 517 sppp_chap_scr, sppp_auth_sca_scn, 518 NULL, NULL, NULL 519 }; 520 521 static const struct cp *cps[IDX_COUNT] = { 522 &lcp, /* IDX_LCP */ 523 &ipcp, /* IDX_IPCP */ 524 &ipv6cp, /* IDX_IPV6CP */ 525 &pap, /* IDX_PAP */ 526 &chap, /* IDX_CHAP */ 527 }; 528 529 static void 530 sppp_change_phase(struct sppp *sp, int phase) 531 { 532 STDDCL; 533 534 KASSERT(SPPP_WLOCKED(sp)); 535 536 if (sp->pp_phase == phase) 537 return; 538 539 sp->pp_phase = phase; 540 541 if (phase == SPPP_PHASE_NETWORK) 542 if_link_state_change(ifp, LINK_STATE_UP); 543 else 544 if_link_state_change(ifp, LINK_STATE_DOWN); 545 546 if (debug) 547 { 548 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 549 sppp_phase_name(sp->pp_phase)); 550 } 551 } 552 553 /* 554 * Exported functions, comprising our interface to the lower layer. 555 */ 556 557 /* 558 * Process the received packet. 559 */ 560 void 561 sppp_input(struct ifnet *ifp, struct mbuf *m) 562 { 563 struct ppp_header *h = NULL; 564 pktqueue_t *pktq = NULL; 565 struct ifqueue *inq = NULL; 566 uint16_t protocol; 567 struct sppp *sp = (struct sppp *)ifp; 568 int debug = ifp->if_flags & IFF_DEBUG; 569 int isr = 0; 570 571 SPPP_LOCK(sp, RW_READER); 572 573 if (ifp->if_flags & IFF_UP) { 574 /* Count received bytes, add hardware framing */ 575 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 576 /* Note time of last receive */ 577 sp->pp_last_receive = time_uptime; 578 } 579 580 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 581 /* Too small packet, drop it. */ 582 if (debug) 583 log(LOG_DEBUG, 584 "%s: input packet is too small, %d bytes\n", 585 ifp->if_xname, m->m_pkthdr.len); 586 drop: 587 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 588 m_freem(m); 589 SPPP_UNLOCK(sp); 590 return; 591 } 592 593 if (sp->pp_flags & PP_NOFRAMING) { 594 memcpy(&protocol, mtod(m, void *), 2); 595 protocol = ntohs(protocol); 596 m_adj(m, 2); 597 } else { 598 599 /* Get PPP header. */ 600 h = mtod(m, struct ppp_header *); 601 m_adj(m, PPP_HEADER_LEN); 602 603 switch (h->address) { 604 case PPP_ALLSTATIONS: 605 if (h->control != PPP_UI) 606 goto invalid; 607 if (sp->pp_flags & PP_CISCO) { 608 if (debug) 609 log(LOG_DEBUG, 610 "%s: PPP packet in Cisco mode " 611 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 612 ifp->if_xname, 613 h->address, h->control, ntohs(h->protocol)); 614 goto drop; 615 } 616 break; 617 case CISCO_MULTICAST: 618 case CISCO_UNICAST: 619 /* Don't check the control field here (RFC 1547). */ 620 if (! (sp->pp_flags & PP_CISCO)) { 621 if (debug) 622 log(LOG_DEBUG, 623 "%s: Cisco packet in PPP mode " 624 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 625 ifp->if_xname, 626 h->address, h->control, ntohs(h->protocol)); 627 goto drop; 628 } 629 switch (ntohs(h->protocol)) { 630 default: 631 if_statinc(ifp, if_noproto); 632 goto invalid; 633 case CISCO_KEEPALIVE: 634 SPPP_UNLOCK(sp); 635 sppp_cisco_input((struct sppp *) ifp, m); 636 m_freem(m); 637 return; 638 #ifdef INET 639 case ETHERTYPE_IP: 640 pktq = ip_pktq; 641 break; 642 #endif 643 #ifdef INET6 644 case ETHERTYPE_IPV6: 645 pktq = ip6_pktq; 646 break; 647 #endif 648 } 649 goto queue_pkt; 650 default: /* Invalid PPP packet. */ 651 invalid: 652 if (debug) 653 log(LOG_DEBUG, 654 "%s: invalid input packet " 655 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 656 ifp->if_xname, 657 h->address, h->control, ntohs(h->protocol)); 658 goto drop; 659 } 660 protocol = ntohs(h->protocol); 661 } 662 663 switch (protocol) { 664 default: 665 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 666 uint16_t prot = htons(protocol); 667 668 SPPP_UPGRADE(sp); 669 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 670 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 671 &prot); 672 SPPP_DOWNGRADE(sp); 673 } 674 if (debug) 675 log(LOG_DEBUG, 676 "%s: invalid input protocol " 677 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 678 if_statinc(ifp, if_noproto); 679 goto drop; 680 case PPP_LCP: 681 SPPP_UNLOCK(sp); 682 sppp_cp_input(&lcp, sp, m); 683 m_freem(m); 684 return; 685 case PPP_PAP: 686 SPPP_UNLOCK(sp); 687 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 688 sppp_pap_input(sp, m); 689 } 690 m_freem(m); 691 return; 692 case PPP_CHAP: 693 SPPP_UNLOCK(sp); 694 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 695 sppp_chap_input(sp, m); 696 } 697 m_freem(m); 698 return; 699 #ifdef INET 700 case PPP_IPCP: 701 SPPP_UNLOCK(sp); 702 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 703 sppp_cp_input(&ipcp, sp, m); 704 } 705 m_freem(m); 706 return; 707 case PPP_IP: 708 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 709 sp->pp_last_activity = time_uptime; 710 pktq = ip_pktq; 711 } 712 break; 713 #endif 714 #ifdef INET6 715 case PPP_IPV6CP: 716 SPPP_UNLOCK(sp); 717 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 718 sppp_cp_input(&ipv6cp, sp, m); 719 } 720 m_freem(m); 721 return; 722 723 case PPP_IPV6: 724 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 725 sp->pp_last_activity = time_uptime; 726 pktq = ip6_pktq; 727 } 728 break; 729 #endif 730 } 731 732 queue_pkt: 733 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 734 goto drop; 735 } 736 737 /* Check queue. */ 738 if (__predict_true(pktq)) { 739 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 740 goto drop; 741 } 742 SPPP_UNLOCK(sp); 743 return; 744 } 745 746 SPPP_UNLOCK(sp); 747 748 IFQ_LOCK(inq); 749 if (IF_QFULL(inq)) { 750 /* Queue overflow. */ 751 IF_DROP(inq); 752 IFQ_UNLOCK(inq); 753 if (debug) 754 log(LOG_DEBUG, "%s: protocol queue overflow\n", 755 ifp->if_xname); 756 757 SPPP_LOCK(sp, RW_READER); 758 goto drop; 759 } 760 IF_ENQUEUE(inq, m); 761 IFQ_UNLOCK(inq); 762 schednetisr(isr); 763 } 764 765 /* 766 * Enqueue transmit packet. 767 */ 768 static int 769 sppp_output(struct ifnet *ifp, struct mbuf *m, 770 const struct sockaddr *dst, const struct rtentry *rt) 771 { 772 struct sppp *sp = (struct sppp *) ifp; 773 struct ppp_header *h = NULL; 774 #ifndef SPPPSUBR_MPSAFE 775 struct ifqueue *ifq = NULL; /* XXX */ 776 #endif 777 int s, error = 0; 778 uint16_t protocol; 779 size_t pktlen; 780 781 s = splnet(); 782 SPPP_LOCK(sp, RW_READER); 783 784 sp->pp_last_activity = time_uptime; 785 786 if ((ifp->if_flags & IFF_UP) == 0 || 787 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 788 SPPP_UNLOCK(sp); 789 splx(s); 790 791 m_freem(m); 792 793 return (ENETDOWN); 794 } 795 796 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 797 /* 798 * Interface is not yet running, but auto-dial. Need 799 * to start LCP for it. 800 */ 801 ifp->if_flags |= IFF_RUNNING; 802 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 803 } 804 805 /* 806 * If the queueing discipline needs packet classification, 807 * do it before prepending link headers. 808 */ 809 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 810 811 #ifdef INET 812 if (dst->sa_family == AF_INET) { 813 struct ip *ip = NULL; 814 #ifndef SPPPSUBR_MPSAFE 815 struct tcphdr *th = NULL; 816 #endif 817 818 if (m->m_len >= sizeof(struct ip)) { 819 ip = mtod(m, struct ip *); 820 #ifndef SPPPSUBR_MPSAFE 821 if (ip->ip_p == IPPROTO_TCP && 822 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 823 sizeof(struct tcphdr)) { 824 th = (struct tcphdr *) 825 ((char *)ip + (ip->ip_hl << 2)); 826 } 827 #endif 828 } else 829 ip = NULL; 830 831 /* 832 * When using dynamic local IP address assignment by using 833 * 0.0.0.0 as a local address, the first TCP session will 834 * not connect because the local TCP checksum is computed 835 * using 0.0.0.0 which will later become our real IP address 836 * so the TCP checksum computed at the remote end will 837 * become invalid. So we 838 * - don't let packets with src ip addr 0 thru 839 * - we flag TCP packets with src ip 0 as an error 840 */ 841 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 842 uint8_t proto = ip->ip_p; 843 844 SPPP_UNLOCK(sp); 845 splx(s); 846 847 m_freem(m); 848 if (proto == IPPROTO_TCP) 849 return (EADDRNOTAVAIL); 850 else 851 return (0); 852 } 853 854 #ifndef SPPPSUBR_MPSAFE 855 /* 856 * Put low delay, telnet, rlogin and ftp control packets 857 * in front of the queue. 858 */ 859 if (!IF_QFULL(&sp->pp_fastq) && 860 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 861 (th && (INTERACTIVE(ntohs(th->th_sport)) || 862 INTERACTIVE(ntohs(th->th_dport)))))) 863 ifq = &sp->pp_fastq; 864 #endif /* !SPPPSUBR_MPSAFE */ 865 } 866 #endif 867 868 #ifdef INET6 869 if (dst->sa_family == AF_INET6) { 870 /* XXX do something tricky here? */ 871 } 872 #endif 873 874 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 875 /* 876 * Prepend general data packet PPP header. For now, IP only. 877 */ 878 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 879 if (! m) { 880 if (ifp->if_flags & IFF_DEBUG) 881 log(LOG_DEBUG, "%s: no memory for transmit header\n", 882 ifp->if_xname); 883 if_statinc(ifp, if_oerrors); 884 SPPP_UNLOCK(sp); 885 splx(s); 886 return (ENOBUFS); 887 } 888 /* 889 * May want to check size of packet 890 * (albeit due to the implementation it's always enough) 891 */ 892 h = mtod(m, struct ppp_header *); 893 if (sp->pp_flags & PP_CISCO) { 894 h->address = CISCO_UNICAST; /* unicast address */ 895 h->control = 0; 896 } else { 897 h->address = PPP_ALLSTATIONS; /* broadcast address */ 898 h->control = PPP_UI; /* Unnumbered Info */ 899 } 900 } 901 902 switch (dst->sa_family) { 903 #ifdef INET 904 case AF_INET: /* Internet Protocol */ 905 if (sp->pp_flags & PP_CISCO) 906 protocol = htons(ETHERTYPE_IP); 907 else { 908 /* 909 * Don't choke with an ENETDOWN early. It's 910 * possible that we just started dialing out, 911 * so don't drop the packet immediately. If 912 * we notice that we run out of buffer space 913 * below, we will however remember that we are 914 * not ready to carry IP packets, and return 915 * ENETDOWN, as opposed to ENOBUFS. 916 */ 917 protocol = htons(PPP_IP); 918 if (sp->scp[IDX_IPCP].state != STATE_OPENED) 919 error = ENETDOWN; 920 } 921 break; 922 #endif 923 #ifdef INET6 924 case AF_INET6: /* Internet Protocol version 6 */ 925 if (sp->pp_flags & PP_CISCO) 926 protocol = htons(ETHERTYPE_IPV6); 927 else { 928 /* 929 * Don't choke with an ENETDOWN early. It's 930 * possible that we just started dialing out, 931 * so don't drop the packet immediately. If 932 * we notice that we run out of buffer space 933 * below, we will however remember that we are 934 * not ready to carry IP packets, and return 935 * ENETDOWN, as opposed to ENOBUFS. 936 */ 937 protocol = htons(PPP_IPV6); 938 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) 939 error = ENETDOWN; 940 } 941 break; 942 #endif 943 default: 944 m_freem(m); 945 if_statinc(ifp, if_oerrors); 946 SPPP_UNLOCK(sp); 947 splx(s); 948 return (EAFNOSUPPORT); 949 } 950 951 if (sp->pp_flags & PP_NOFRAMING) { 952 M_PREPEND(m, 2, M_DONTWAIT); 953 if (m == NULL) { 954 if (ifp->if_flags & IFF_DEBUG) 955 log(LOG_DEBUG, "%s: no memory for transmit header\n", 956 ifp->if_xname); 957 if_statinc(ifp, if_oerrors); 958 SPPP_UNLOCK(sp); 959 splx(s); 960 return (ENOBUFS); 961 } 962 *mtod(m, uint16_t *) = protocol; 963 } else { 964 h->protocol = protocol; 965 } 966 967 pktlen = m->m_pkthdr.len; 968 #ifdef SPPPSUBR_MPSAFE 969 SPPP_UNLOCK(sp); 970 error = if_transmit_lock(ifp, m); 971 SPPP_LOCK(sp, RW_READER); 972 if (error == 0) 973 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 974 #else /* !SPPPSUBR_MPSAFE */ 975 error = ifq_enqueue2(ifp, ifq, m); 976 977 if (error == 0) { 978 /* 979 * Count output packets and bytes. 980 * The packet length includes header + additional hardware 981 * framing according to RFC 1333. 982 */ 983 if (!(ifp->if_flags & IFF_OACTIVE)) { 984 SPPP_UNLOCK(sp); 985 if_start_lock(ifp); 986 SPPP_LOCK(sp, RW_READER); 987 } 988 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 989 } 990 #endif /* !SPPPSUBR_MPSAFE */ 991 SPPP_UNLOCK(sp); 992 splx(s); 993 return error; 994 } 995 996 void 997 sppp_attach(struct ifnet *ifp) 998 { 999 struct sppp *sp = (struct sppp *) ifp; 1000 char xnamebuf[MAXCOMLEN]; 1001 1002 /* Initialize keepalive handler. */ 1003 if (! spppq) { 1004 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1005 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1006 } 1007 1008 if (! spppq_lock) 1009 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1010 1011 sp->pp_if.if_type = IFT_PPP; 1012 sp->pp_if.if_output = sppp_output; 1013 sp->pp_fastq.ifq_maxlen = 32; 1014 sp->pp_cpq.ifq_maxlen = 20; 1015 sp->pp_loopcnt = 0; 1016 sp->pp_alivecnt = 0; 1017 sp->pp_last_activity = 0; 1018 sp->pp_last_receive = 0; 1019 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1020 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 1021 sp->pp_idle_timeout = 0; 1022 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1023 sp->pp_phase = SPPP_PHASE_DEAD; 1024 sp->pp_up = sppp_notify_up; 1025 sp->pp_down = sppp_notify_down; 1026 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1027 memset(sp->scp, 0, sizeof(sp->scp)); 1028 rw_init(&sp->pp_lock); 1029 1030 if_alloc_sadl(ifp); 1031 1032 /* Lets not beat about the bush, we know we're down. */ 1033 ifp->if_link_state = LINK_STATE_DOWN; 1034 1035 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1036 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1037 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1038 1039 memset(&sp->myauth, 0, sizeof sp->myauth); 1040 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1041 SPPP_LOCK(sp, RW_WRITER); 1042 sppp_lcp_init(sp); 1043 sppp_ipcp_init(sp); 1044 sppp_ipv6cp_init(sp); 1045 sppp_pap_init(sp); 1046 sppp_chap_init(sp); 1047 SPPP_UNLOCK(sp); 1048 1049 SPPPQ_LOCK(); 1050 /* Insert new entry into the keepalive list. */ 1051 sp->pp_next = spppq; 1052 spppq = sp; 1053 SPPPQ_UNLOCK(); 1054 } 1055 1056 void 1057 sppp_detach(struct ifnet *ifp) 1058 { 1059 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1060 1061 /* Remove the entry from the keepalive list. */ 1062 SPPPQ_LOCK(); 1063 for (q = &spppq; (p = *q); q = &p->pp_next) 1064 if (p == sp) { 1065 *q = p->pp_next; 1066 break; 1067 } 1068 SPPPQ_UNLOCK(); 1069 1070 if (! spppq) { 1071 /* Stop keepalive handler. */ 1072 callout_stop(&keepalive_ch); 1073 mutex_obj_free(spppq_lock); 1074 spppq_lock = NULL; 1075 } 1076 1077 SPPP_LOCK(sp, RW_WRITER); 1078 1079 sppp_cp_fini(&lcp, sp); 1080 sppp_cp_fini(&ipcp, sp); 1081 sppp_cp_fini(&pap, sp); 1082 sppp_cp_fini(&chap, sp); 1083 #ifdef INET6 1084 sppp_cp_fini(&ipv6cp, sp); 1085 #endif 1086 sppp_wq_destroy(sp, sp->wq_cp); 1087 1088 /* free authentication info */ 1089 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1090 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1091 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1092 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1093 SPPP_UNLOCK(sp); 1094 rw_destroy(&sp->pp_lock); 1095 } 1096 1097 /* 1098 * Flush the interface output queue. 1099 */ 1100 void 1101 sppp_flush(struct ifnet *ifp) 1102 { 1103 struct sppp *sp = (struct sppp *) ifp; 1104 1105 SPPP_LOCK(sp, RW_WRITER); 1106 IFQ_PURGE(&sp->pp_if.if_snd); 1107 IF_PURGE(&sp->pp_fastq); 1108 IF_PURGE(&sp->pp_cpq); 1109 SPPP_UNLOCK(sp); 1110 } 1111 1112 /* 1113 * Check if the output queue is empty. 1114 */ 1115 int 1116 sppp_isempty(struct ifnet *ifp) 1117 { 1118 struct sppp *sp = (struct sppp *) ifp; 1119 int empty, s; 1120 1121 s = splnet(); 1122 SPPP_LOCK(sp, RW_READER); 1123 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1124 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1125 SPPP_UNLOCK(sp); 1126 splx(s); 1127 return (empty); 1128 } 1129 1130 /* 1131 * Get next packet to send. 1132 */ 1133 struct mbuf * 1134 sppp_dequeue(struct ifnet *ifp) 1135 { 1136 struct sppp *sp = (struct sppp *) ifp; 1137 struct mbuf *m; 1138 int s; 1139 1140 s = splnet(); 1141 SPPP_LOCK(sp, RW_WRITER); 1142 /* 1143 * Process only the control protocol queue until we have at 1144 * least one NCP open. 1145 * 1146 * Do always serve all three queues in Cisco mode. 1147 */ 1148 IF_DEQUEUE(&sp->pp_cpq, m); 1149 if (m == NULL && 1150 (sppp_cp_check(sp, CP_NCP) || (sp->pp_flags & PP_CISCO) != 0)) { 1151 IF_DEQUEUE(&sp->pp_fastq, m); 1152 if (m == NULL) 1153 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1154 } 1155 SPPP_UNLOCK(sp); 1156 splx(s); 1157 return m; 1158 } 1159 1160 /* 1161 * Process an ioctl request. Called on low priority level. 1162 */ 1163 int 1164 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1165 { 1166 struct lwp *l = curlwp; /* XXX */ 1167 struct ifreq *ifr = (struct ifreq *) data; 1168 struct ifaddr *ifa = (struct ifaddr *) data; 1169 struct sppp *sp = (struct sppp *) ifp; 1170 int s, error=0, going_up, going_down; 1171 u_short newmode; 1172 1173 s = splnet(); 1174 switch (cmd) { 1175 case SIOCINITIFADDR: 1176 ifa->ifa_rtrequest = p2p_rtrequest; 1177 break; 1178 1179 case SIOCSIFFLAGS: 1180 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1181 break; 1182 1183 SPPP_LOCK(sp, RW_WRITER); 1184 going_up = ifp->if_flags & IFF_UP && 1185 (ifp->if_flags & IFF_RUNNING) == 0; 1186 going_down = (ifp->if_flags & IFF_UP) == 0 && 1187 ifp->if_flags & IFF_RUNNING; 1188 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1189 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1190 /* sanity */ 1191 newmode = IFF_PASSIVE; 1192 ifp->if_flags &= ~IFF_AUTO; 1193 } 1194 1195 if (going_up || going_down) { 1196 sp->lcp.reestablish = false; 1197 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1198 } 1199 if (going_up && newmode == 0) { 1200 /* neither auto-dial nor passive */ 1201 ifp->if_flags |= IFF_RUNNING; 1202 if (!(sp->pp_flags & PP_CISCO)) { 1203 sppp_wq_add(sp->wq_cp, 1204 &sp->scp[IDX_LCP].work_open); 1205 } 1206 } else if (going_down) { 1207 SPPP_UNLOCK(sp); 1208 sppp_flush(ifp); 1209 SPPP_LOCK(sp, RW_WRITER); 1210 1211 ifp->if_flags &= ~IFF_RUNNING; 1212 } 1213 SPPP_UNLOCK(sp); 1214 break; 1215 1216 case SIOCSIFMTU: 1217 if (ifr->ifr_mtu < PPP_MINMRU || 1218 ifr->ifr_mtu > sp->lcp.their_mru) { 1219 error = EINVAL; 1220 break; 1221 } 1222 /*FALLTHROUGH*/ 1223 case SIOCGIFMTU: 1224 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1225 error = 0; 1226 break; 1227 case SIOCADDMULTI: 1228 case SIOCDELMULTI: 1229 break; 1230 1231 case SPPPSETAUTHCFG: 1232 case SPPPSETLCPCFG: 1233 case SPPPSETIDLETO: 1234 case SPPPSETAUTHFAILURE: 1235 case SPPPSETDNSOPTS: 1236 case SPPPSETKEEPALIVE: 1237 #if defined(COMPAT_50) || defined(MODULAR) 1238 case __SPPPSETIDLETO50: 1239 case __SPPPSETKEEPALIVE50: 1240 #endif /* COMPAT_50 || MODULAR */ 1241 error = kauth_authorize_network(l->l_cred, 1242 KAUTH_NETWORK_INTERFACE, 1243 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1244 NULL); 1245 if (error) 1246 break; 1247 error = sppp_params(sp, cmd, data); 1248 break; 1249 1250 case SPPPGETAUTHCFG: 1251 case SPPPGETLCPCFG: 1252 case SPPPGETAUTHFAILURES: 1253 error = kauth_authorize_network(l->l_cred, 1254 KAUTH_NETWORK_INTERFACE, 1255 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1256 NULL); 1257 if (error) 1258 break; 1259 error = sppp_params(sp, cmd, data); 1260 break; 1261 1262 case SPPPGETSTATUS: 1263 case SPPPGETSTATUSNCP: 1264 case SPPPGETIDLETO: 1265 case SPPPGETDNSOPTS: 1266 case SPPPGETDNSADDRS: 1267 case SPPPGETKEEPALIVE: 1268 #if defined(COMPAT_50) || defined(MODULAR) 1269 case __SPPPGETIDLETO50: 1270 case __SPPPGETKEEPALIVE50: 1271 #endif /* COMPAT_50 || MODULAR */ 1272 case SPPPGETLCPSTATUS: 1273 case SPPPGETIPCPSTATUS: 1274 case SPPPGETIPV6CPSTATUS: 1275 error = sppp_params(sp, cmd, data); 1276 break; 1277 1278 default: 1279 error = ifioctl_common(ifp, cmd, data); 1280 break; 1281 } 1282 splx(s); 1283 return (error); 1284 } 1285 1286 /* 1287 * Cisco framing implementation. 1288 */ 1289 1290 /* 1291 * Handle incoming Cisco keepalive protocol packets. 1292 */ 1293 static void 1294 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1295 { 1296 STDDCL; 1297 struct cisco_packet *h; 1298 #ifdef INET 1299 uint32_t me, mymask = 0; /* XXX: GCC */ 1300 #endif 1301 1302 SPPP_LOCK(sp, RW_WRITER); 1303 1304 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1305 if (debug) 1306 log(LOG_DEBUG, 1307 "%s: cisco invalid packet length: %d bytes\n", 1308 ifp->if_xname, m->m_pkthdr.len); 1309 SPPP_UNLOCK(sp); 1310 return; 1311 } 1312 h = mtod(m, struct cisco_packet *); 1313 if (debug) 1314 log(LOG_DEBUG, 1315 "%s: cisco input: %d bytes " 1316 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1317 ifp->if_xname, m->m_pkthdr.len, 1318 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1319 (u_int)h->time0, (u_int)h->time1); 1320 switch (ntohl(h->type)) { 1321 default: 1322 if (debug) 1323 addlog("%s: cisco unknown packet type: 0x%x\n", 1324 ifp->if_xname, ntohl(h->type)); 1325 break; 1326 case CISCO_ADDR_REPLY: 1327 /* Reply on address request, ignore */ 1328 break; 1329 case CISCO_KEEPALIVE_REQ: 1330 sp->pp_alivecnt = 0; 1331 sp->scp[IDX_LCP].rseq = ntohl(h->par1); 1332 if (sp->scp[IDX_LCP].seq == sp->scp[IDX_LCP].rseq) { 1333 /* Local and remote sequence numbers are equal. 1334 * Probably, the line is in loopback mode. */ 1335 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1336 printf ("%s: loopback\n", 1337 ifp->if_xname); 1338 sp->pp_loopcnt = 0; 1339 if (ifp->if_flags & IFF_UP) { 1340 SPPP_UNLOCK(sp); 1341 if_down(ifp); 1342 SPPP_LOCK(sp, RW_WRITER); 1343 1344 IF_PURGE(&sp->pp_cpq); 1345 } 1346 } 1347 ++sp->pp_loopcnt; 1348 1349 /* Generate new local sequence number */ 1350 sp->scp[IDX_LCP].seq = cprng_fast32(); 1351 break; 1352 } 1353 sp->pp_loopcnt = 0; 1354 if (! (ifp->if_flags & IFF_UP) && 1355 (ifp->if_flags & IFF_RUNNING)) { 1356 SPPP_UNLOCK(sp); 1357 if_up(ifp); 1358 SPPP_LOCK(sp, RW_WRITER); 1359 } 1360 break; 1361 case CISCO_ADDR_REQ: 1362 #ifdef INET 1363 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1364 if (me != 0L) 1365 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1366 #endif 1367 break; 1368 } 1369 SPPP_UNLOCK(sp); 1370 } 1371 1372 /* 1373 * Send Cisco keepalive packet. 1374 */ 1375 static void 1376 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1377 { 1378 STDDCL; 1379 struct ppp_header *h; 1380 struct cisco_packet *ch; 1381 struct mbuf *m; 1382 uint32_t t; 1383 1384 KASSERT(SPPP_WLOCKED(sp)); 1385 1386 t = time_uptime * 1000; 1387 MGETHDR(m, M_DONTWAIT, MT_DATA); 1388 if (! m) 1389 return; 1390 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1391 m_reset_rcvif(m); 1392 1393 h = mtod(m, struct ppp_header *); 1394 h->address = CISCO_MULTICAST; 1395 h->control = 0; 1396 h->protocol = htons(CISCO_KEEPALIVE); 1397 1398 ch = (struct cisco_packet *)(h + 1); 1399 ch->type = htonl(type); 1400 ch->par1 = htonl(par1); 1401 ch->par2 = htonl(par2); 1402 ch->rel = -1; 1403 1404 ch->time0 = htons((u_short)(t >> 16)); 1405 ch->time1 = htons((u_short) t); 1406 1407 if (debug) 1408 log(LOG_DEBUG, 1409 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1410 ifp->if_xname, ntohl(ch->type), ch->par1, 1411 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1412 (u_int)ch->time1); 1413 1414 if (IF_QFULL(&sp->pp_cpq)) { 1415 IF_DROP(&sp->pp_fastq); 1416 IF_DROP(&ifp->if_snd); 1417 m_freem(m); 1418 if_statinc(ifp, if_oerrors); 1419 return; 1420 } 1421 1422 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1423 IF_ENQUEUE(&sp->pp_cpq, m); 1424 1425 if (! (ifp->if_flags & IFF_OACTIVE)) { 1426 SPPP_UNLOCK(sp); 1427 if_start_lock(ifp); 1428 SPPP_LOCK(sp, RW_WRITER); 1429 } 1430 } 1431 1432 /* 1433 * PPP protocol implementation. 1434 */ 1435 1436 /* 1437 * Send PPP control protocol packet. 1438 */ 1439 static void 1440 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1441 u_char ident, u_short len, void *data) 1442 { 1443 STDDCL; 1444 struct lcp_header *lh; 1445 struct mbuf *m; 1446 size_t pkthdrlen; 1447 1448 KASSERT(SPPP_WLOCKED(sp)); 1449 1450 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1451 1452 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1453 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1454 MGETHDR(m, M_DONTWAIT, MT_DATA); 1455 if (! m) { 1456 return; 1457 } 1458 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1459 m_reset_rcvif(m); 1460 1461 if (sp->pp_flags & PP_NOFRAMING) { 1462 *mtod(m, uint16_t *) = htons(proto); 1463 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1464 } else { 1465 struct ppp_header *h; 1466 h = mtod(m, struct ppp_header *); 1467 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1468 h->control = PPP_UI; /* Unnumbered Info */ 1469 h->protocol = htons(proto); /* Link Control Protocol */ 1470 lh = (struct lcp_header *)(h + 1); 1471 } 1472 lh->type = type; 1473 lh->ident = ident; 1474 lh->len = htons(LCP_HEADER_LEN + len); 1475 if (len) 1476 memcpy(lh + 1, data, len); 1477 1478 if (debug) { 1479 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1480 ifp->if_xname, 1481 sppp_proto_name(proto), 1482 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1483 if (len) 1484 sppp_print_bytes((u_char *)(lh + 1), len); 1485 addlog(">\n"); 1486 } 1487 if (IF_QFULL(&sp->pp_cpq)) { 1488 IF_DROP(&sp->pp_fastq); 1489 IF_DROP(&ifp->if_snd); 1490 m_freem(m); 1491 if_statinc(ifp, if_oerrors); 1492 return; 1493 } 1494 1495 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1496 IF_ENQUEUE(&sp->pp_cpq, m); 1497 1498 if (! (ifp->if_flags & IFF_OACTIVE)) { 1499 SPPP_UNLOCK(sp); 1500 if_start_lock(ifp); 1501 SPPP_LOCK(sp, RW_WRITER); 1502 } 1503 } 1504 1505 static void 1506 sppp_cp_to_lcp(void *xsp) 1507 { 1508 struct sppp *sp = xsp; 1509 1510 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1511 } 1512 1513 static void 1514 sppp_cp_to_ipcp(void *xsp) 1515 { 1516 struct sppp *sp = xsp; 1517 1518 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1519 } 1520 1521 static void 1522 sppp_cp_to_ipv6cp(void *xsp) 1523 { 1524 struct sppp *sp = xsp; 1525 1526 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1527 } 1528 1529 static void 1530 sppp_cp_to_pap(void *xsp) 1531 { 1532 struct sppp *sp = xsp; 1533 1534 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1535 } 1536 1537 static void 1538 sppp_cp_to_chap(void *xsp) 1539 { 1540 struct sppp *sp = xsp; 1541 1542 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1543 } 1544 1545 static void 1546 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1547 { 1548 struct sppp_cp *scp; 1549 typedef void (*sppp_co_cb_t)(void *); 1550 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1551 [IDX_LCP] = sppp_cp_to_lcp, 1552 [IDX_IPCP] = sppp_cp_to_ipcp, 1553 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1554 [IDX_PAP] = sppp_cp_to_pap, 1555 [IDX_CHAP] = sppp_cp_to_chap, 1556 }; 1557 1558 scp = &sp->scp[cp->protoidx]; 1559 scp->state = STATE_INITIAL; 1560 scp->fail_counter = 0; 1561 scp->seq = 0; 1562 scp->rseq = 0; 1563 1564 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1565 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1566 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1567 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1568 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1569 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1570 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1571 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1572 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1573 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1574 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1575 1576 callout_init(&scp->ch, CALLOUT_MPSAFE); 1577 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1578 } 1579 1580 static void 1581 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1582 { 1583 struct sppp_cp *scp; 1584 scp = &sp->scp[cp->protoidx]; 1585 1586 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1587 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1588 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1589 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1590 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1591 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1592 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1593 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1594 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1595 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1596 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1597 1598 callout_halt(&scp->ch, NULL); 1599 callout_destroy(&scp->ch); 1600 } 1601 1602 /* 1603 * Handle incoming PPP control protocol packets. 1604 */ 1605 static void 1606 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1607 { 1608 STDDCL; 1609 struct lcp_header *h; 1610 int printlen, len = m->m_pkthdr.len; 1611 enum cp_rcr_type type; 1612 size_t blen, rlen; 1613 u_char *p; 1614 uint32_t u32; 1615 uint8_t *buf; 1616 1617 SPPP_LOCK(sp, RW_WRITER); 1618 1619 if (len < 4) { 1620 if (debug) 1621 log(LOG_DEBUG, 1622 "%s: %s invalid packet length: %d bytes\n", 1623 ifp->if_xname, cp->name, len); 1624 SPPP_UNLOCK(sp); 1625 return; 1626 } 1627 h = mtod(m, struct lcp_header *); 1628 if (debug) { 1629 printlen = ntohs(h->len); 1630 log(LOG_DEBUG, 1631 "%s: %s input(%s): <%s id=0x%x len=%d", 1632 ifp->if_xname, cp->name, 1633 sppp_state_name(sp->scp[cp->protoidx].state), 1634 sppp_cp_type_name(h->type), h->ident, printlen); 1635 if (len < printlen) 1636 printlen = len; 1637 if (printlen > 4) 1638 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1639 addlog(">\n"); 1640 } 1641 if (len > ntohs(h->len)) 1642 len = ntohs(h->len); 1643 p = (u_char *)(h + 1); 1644 switch (h->type) { 1645 case CONF_REQ: 1646 if (len < 4) { 1647 if (debug) 1648 addlog("%s: %s invalid conf-req length %d\n", 1649 ifp->if_xname, cp->name, 1650 len); 1651 if_statinc(ifp, if_ierrors); 1652 break; 1653 } 1654 1655 buf = NULL; 1656 blen = 0; 1657 rlen = 0; 1658 1659 type = (cp->parse_confreq)(sp, h, len, 1660 &buf, &blen, &rlen); 1661 1662 if (type == CP_RCR_ERR) { 1663 /* fatal error, shut down */ 1664 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1665 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 1666 } else if (buf != NULL) { 1667 if (sp->scp[cp->protoidx].rcr_buf != NULL) { 1668 kmem_intr_free(sp->scp[cp->protoidx].rcr_buf, 1669 sp->scp[cp->protoidx].rcr_blen); 1670 } 1671 1672 sp->scp[cp->protoidx].rcr_buf = (void *)buf; 1673 buf = NULL; 1674 1675 sp->scp[cp->protoidx].rcr_blen = blen; 1676 sp->scp[cp->protoidx].rcr_rlen = rlen; 1677 sp->scp[cp->protoidx].rcr_type = type; 1678 sp->scp[cp->protoidx].rconfid = h->ident; 1679 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rcr); 1680 } 1681 break; 1682 case CONF_ACK: 1683 if (h->ident != sp->scp[cp->protoidx].confid) { 1684 if (debug) 1685 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1686 ifp->if_xname, cp->name, 1687 h->ident, sp->scp[cp->protoidx].confid); 1688 if_statinc(ifp, if_ierrors); 1689 break; 1690 } 1691 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rca); 1692 break; 1693 case CONF_NAK: 1694 case CONF_REJ: 1695 if (h->ident != sp->scp[cp->protoidx].confid) { 1696 if (debug) 1697 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1698 ifp->if_xname, cp->name, 1699 h->ident, sp->scp[cp->protoidx].confid); 1700 if_statinc(ifp, if_ierrors); 1701 break; 1702 } 1703 if (h->type == CONF_NAK) 1704 (cp->parse_confnak)(sp, h, len); 1705 else /* CONF_REJ */ 1706 (cp->parse_confrej)(sp, h, len); 1707 1708 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rcn); 1709 break; 1710 1711 case TERM_REQ: 1712 sp->scp[cp->protoidx].rseq = h->ident; 1713 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rtr); 1714 break; 1715 case TERM_ACK: 1716 if (h->ident != sp->scp[cp->protoidx].confid && 1717 h->ident != sp->scp[cp->protoidx].seq) { 1718 if (debug) 1719 addlog("%s: %s id mismatch " 1720 "0x%x != 0x%x and 0x%x != %0lx\n", 1721 ifp->if_xname, cp->name, 1722 h->ident, sp->scp[cp->protoidx].confid, 1723 h->ident, sp->scp[cp->protoidx].seq); 1724 if_statinc(ifp, if_ierrors); 1725 break; 1726 } 1727 1728 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rta); 1729 break; 1730 case CODE_REJ: 1731 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1732 log(LOG_INFO, 1733 "%s: %s: ignoring RXJ (%s) for code ?, " 1734 "danger will robinson\n", 1735 ifp->if_xname, cp->name, 1736 sppp_cp_type_name(h->type)); 1737 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rxj); 1738 break; 1739 case PROTO_REJ: 1740 { 1741 int catastrophic; 1742 const struct cp *upper; 1743 int i; 1744 uint16_t proto; 1745 1746 catastrophic = 0; 1747 upper = NULL; 1748 proto = p[0] << 8 | p[1]; 1749 for (i = 0; i < IDX_COUNT; i++) { 1750 if (cps[i]->proto == proto) { 1751 upper = cps[i]; 1752 break; 1753 } 1754 } 1755 if (upper == NULL) 1756 catastrophic++; 1757 1758 if (debug) 1759 log(LOG_INFO, 1760 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1761 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1762 sppp_cp_type_name(h->type), proto, 1763 upper ? upper->name : "unknown", 1764 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1765 1766 /* 1767 * if we got RXJ+ against conf-req, the peer does not implement 1768 * this particular protocol type. terminate the protocol. 1769 */ 1770 if (upper && !catastrophic) { 1771 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1772 sppp_wq_add(sp->wq_cp, 1773 &sp->scp[upper->protoidx].work_close); 1774 break; 1775 } 1776 } 1777 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_rxj); 1778 break; 1779 } 1780 case DISC_REQ: 1781 if (cp->proto != PPP_LCP) 1782 goto illegal; 1783 /* Discard the packet. */ 1784 break; 1785 case ECHO_REQ: 1786 if (cp->proto != PPP_LCP) 1787 goto illegal; 1788 if (sp->scp[cp->protoidx].state != STATE_OPENED) { 1789 if (debug) 1790 addlog("%s: lcp echo req but lcp closed\n", 1791 ifp->if_xname); 1792 if_statinc(ifp, if_ierrors); 1793 break; 1794 } 1795 if (len < 8) { 1796 if (debug) 1797 addlog("%s: invalid lcp echo request " 1798 "packet length: %d bytes\n", 1799 ifp->if_xname, len); 1800 break; 1801 } 1802 memcpy(&u32, h + 1, sizeof u32); 1803 if (ntohl(u32) == sp->lcp.magic) { 1804 /* Line loopback mode detected. */ 1805 printf("%s: loopback\n", ifp->if_xname); 1806 SPPP_UNLOCK(sp); 1807 if_down(ifp); 1808 SPPP_LOCK(sp, RW_WRITER); 1809 1810 IF_PURGE(&sp->pp_cpq); 1811 1812 /* Shut down the PPP link. */ 1813 /* XXX */ 1814 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 1815 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 1816 break; 1817 } 1818 u32 = htonl(sp->lcp.magic); 1819 memcpy(h + 1, &u32, sizeof u32); 1820 if (debug) 1821 addlog("%s: got lcp echo req, sending echo rep\n", 1822 ifp->if_xname); 1823 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1824 h + 1); 1825 break; 1826 case ECHO_REPLY: 1827 if (cp->proto != PPP_LCP) 1828 goto illegal; 1829 if (h->ident != sp->lcp.echoid) { 1830 if_statinc(ifp, if_ierrors); 1831 break; 1832 } 1833 if (len < 8) { 1834 if (debug) 1835 addlog("%s: lcp invalid echo reply " 1836 "packet length: %d bytes\n", 1837 ifp->if_xname, len); 1838 break; 1839 } 1840 if (debug) 1841 addlog("%s: lcp got echo rep\n", 1842 ifp->if_xname); 1843 memcpy(&u32, h + 1, sizeof u32); 1844 if (ntohl(u32) != sp->lcp.magic) 1845 sp->pp_alivecnt = 0; 1846 break; 1847 default: 1848 /* Unknown packet type -- send Code-Reject packet. */ 1849 illegal: 1850 if (debug) 1851 addlog("%s: %s send code-rej for 0x%x\n", 1852 ifp->if_xname, cp->name, h->type); 1853 sppp_cp_send(sp, cp->proto, CODE_REJ, 1854 ++sp->scp[cp->protoidx].seq, m->m_pkthdr.len, h); 1855 if_statinc(ifp, if_ierrors); 1856 } 1857 1858 SPPP_UNLOCK(sp); 1859 } 1860 1861 /* 1862 * The generic part of all Up/Down/Open/Close/TO event handlers. 1863 * Basically, the state transition handling in the automaton. 1864 */ 1865 static void 1866 sppp_up_event(struct sppp *sp, void *xcp) 1867 { 1868 const struct cp *cp = xcp; 1869 STDDCL; 1870 1871 KASSERT(SPPP_WLOCKED(sp)); 1872 1873 if ((cp->flags & CP_AUTH) != 0 && 1874 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1875 return; 1876 1877 if (debug) 1878 log(LOG_DEBUG, "%s: %s up(%s)\n", 1879 ifp->if_xname, cp->name, 1880 sppp_state_name(sp->scp[cp->protoidx].state)); 1881 1882 switch (sp->scp[cp->protoidx].state) { 1883 case STATE_INITIAL: 1884 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1885 break; 1886 case STATE_STARTING: 1887 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1888 (cp->scr)(sp); 1889 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1890 break; 1891 default: 1892 printf("%s: %s illegal up in state %s\n", 1893 ifp->if_xname, cp->name, 1894 sppp_state_name(sp->scp[cp->protoidx].state)); 1895 } 1896 } 1897 1898 static void 1899 sppp_down_event(struct sppp *sp, void *xcp) 1900 { 1901 const struct cp *cp = xcp; 1902 STDDCL; 1903 1904 KASSERT(SPPP_WLOCKED(sp)); 1905 1906 if ((cp->flags & CP_AUTH) != 0 && 1907 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1908 return; 1909 1910 if (debug) 1911 log(LOG_DEBUG, "%s: %s down(%s)\n", 1912 ifp->if_xname, cp->name, 1913 sppp_state_name(sp->scp[cp->protoidx].state)); 1914 1915 switch (sp->scp[cp->protoidx].state) { 1916 case STATE_CLOSED: 1917 case STATE_CLOSING: 1918 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1919 break; 1920 case STATE_STOPPED: 1921 (cp->tls)(cp, sp); 1922 /* fall through */ 1923 case STATE_STOPPING: 1924 case STATE_REQ_SENT: 1925 case STATE_ACK_RCVD: 1926 case STATE_ACK_SENT: 1927 sppp_cp_change_state(cp, sp, STATE_STARTING); 1928 break; 1929 case STATE_OPENED: 1930 (cp->tld)(sp); 1931 sppp_cp_change_state(cp, sp, STATE_STARTING); 1932 break; 1933 default: 1934 printf("%s: %s illegal down in state %s\n", 1935 ifp->if_xname, cp->name, 1936 sppp_state_name(sp->scp[cp->protoidx].state)); 1937 } 1938 } 1939 1940 static void 1941 sppp_open_event(struct sppp *sp, void *xcp) 1942 { 1943 const struct cp *cp = xcp; 1944 STDDCL; 1945 1946 KASSERT(SPPP_WLOCKED(sp)); 1947 1948 if ((cp->flags & CP_AUTH) != 0 && 1949 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1950 return; 1951 1952 if (debug) 1953 log(LOG_DEBUG, "%s: %s open(%s)\n", 1954 ifp->if_xname, cp->name, 1955 sppp_state_name(sp->scp[cp->protoidx].state)); 1956 1957 switch (sp->scp[cp->protoidx].state) { 1958 case STATE_INITIAL: 1959 sppp_cp_change_state(cp, sp, STATE_STARTING); 1960 (cp->tls)(cp, sp); 1961 break; 1962 case STATE_STARTING: 1963 break; 1964 case STATE_CLOSED: 1965 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1966 (cp->scr)(sp); 1967 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1968 break; 1969 case STATE_STOPPED: 1970 case STATE_STOPPING: 1971 case STATE_REQ_SENT: 1972 case STATE_ACK_RCVD: 1973 case STATE_ACK_SENT: 1974 case STATE_OPENED: 1975 break; 1976 case STATE_CLOSING: 1977 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1978 break; 1979 } 1980 } 1981 1982 static void 1983 sppp_close_event(struct sppp *sp, void *xcp) 1984 { 1985 const struct cp *cp = xcp; 1986 STDDCL; 1987 1988 KASSERT(SPPP_WLOCKED(sp)); 1989 1990 if ((cp->flags & CP_AUTH) != 0 && 1991 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1992 return; 1993 1994 if (debug) 1995 log(LOG_DEBUG, "%s: %s close(%s)\n", 1996 ifp->if_xname, cp->name, 1997 sppp_state_name(sp->scp[cp->protoidx].state)); 1998 1999 switch (sp->scp[cp->protoidx].state) { 2000 case STATE_INITIAL: 2001 case STATE_CLOSED: 2002 case STATE_CLOSING: 2003 break; 2004 case STATE_STARTING: 2005 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2006 (cp->tlf)(cp, sp); 2007 break; 2008 case STATE_STOPPED: 2009 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2010 break; 2011 case STATE_STOPPING: 2012 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2013 break; 2014 case STATE_OPENED: 2015 (cp->tld)(sp); 2016 /* fall through */ 2017 case STATE_REQ_SENT: 2018 case STATE_ACK_RCVD: 2019 case STATE_ACK_SENT: 2020 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 2021 if ((cp->flags & CP_AUTH) == 0) { 2022 sppp_cp_send(sp, cp->proto, TERM_REQ, 2023 ++sp->scp[cp->protoidx].seq, 0, 0); 2024 } 2025 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2026 break; 2027 } 2028 } 2029 2030 static void 2031 sppp_to_event(struct sppp *sp, void *xcp) 2032 { 2033 const struct cp *cp = xcp; 2034 int s; 2035 STDDCL; 2036 2037 KASSERT(SPPP_WLOCKED(sp)); 2038 2039 s = splnet(); 2040 2041 if (debug) 2042 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 2043 ifp->if_xname, cp->name, 2044 sppp_state_name(sp->scp[cp->protoidx].state), 2045 sp->scp[cp->protoidx].rst_counter); 2046 2047 if (--sp->scp[cp->protoidx].rst_counter < 0) 2048 /* TO- event */ 2049 switch (sp->scp[cp->protoidx].state) { 2050 case STATE_CLOSING: 2051 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2052 (cp->tlf)(cp, sp); 2053 break; 2054 case STATE_STOPPING: 2055 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2056 (cp->tlf)(cp, sp); 2057 break; 2058 case STATE_REQ_SENT: 2059 case STATE_ACK_RCVD: 2060 case STATE_ACK_SENT: 2061 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2062 (cp->tlf)(cp, sp); 2063 break; 2064 } 2065 else 2066 /* TO+ event */ 2067 switch (sp->scp[cp->protoidx].state) { 2068 case STATE_CLOSING: 2069 case STATE_STOPPING: 2070 if ((cp->flags & CP_AUTH) == 0) { 2071 sppp_cp_send(sp, cp->proto, TERM_REQ, 2072 ++sp->scp[cp->protoidx].seq, 0, 0); 2073 } 2074 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2075 break; 2076 case STATE_REQ_SENT: 2077 case STATE_ACK_RCVD: 2078 (cp->scr)(sp); 2079 /* sppp_cp_change_state() will restart the timer */ 2080 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2081 break; 2082 case STATE_ACK_SENT: 2083 (cp->scr)(sp); 2084 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2085 break; 2086 } 2087 2088 splx(s); 2089 } 2090 2091 static void 2092 sppp_rcr_event(struct sppp *sp, void *xcp) 2093 { 2094 const struct cp *cp = xcp; 2095 enum cp_rcr_type type; 2096 void *buf; 2097 size_t blen; 2098 STDDCL; 2099 2100 type = sp->scp[cp->protoidx].rcr_type; 2101 buf = sp->scp[cp->protoidx].rcr_buf; 2102 blen = sp->scp[cp->protoidx].rcr_blen; 2103 2104 if (type == CP_RCR_ACK) { 2105 /* RCR+ event */ 2106 switch (sp->scp[cp->protoidx].state) { 2107 case STATE_OPENED: 2108 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2109 cp->tld(sp); 2110 cp->scr(sp); 2111 cp->scan(cp, sp); 2112 break; 2113 case STATE_ACK_SENT: 2114 case STATE_REQ_SENT: 2115 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2116 cp->scan(cp, sp); 2117 break; 2118 case STATE_STOPPED: 2119 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2120 cp->scr(sp); 2121 cp->scan(cp, sp); 2122 break; 2123 case STATE_ACK_RCVD: 2124 sppp_cp_change_state(cp, sp, STATE_OPENED); 2125 if (debug) 2126 log(LOG_DEBUG, "%s: %s tlu\n", 2127 ifp->if_xname, 2128 cp->name); 2129 cp->tlu(sp); 2130 cp->scan(cp, sp); 2131 break; 2132 case STATE_CLOSING: 2133 case STATE_STOPPING: 2134 if (buf != NULL) { 2135 sp->scp[cp->protoidx].rcr_buf = NULL; 2136 sp->scp[cp->protoidx].rcr_blen = 0; 2137 kmem_free(buf, blen); 2138 } 2139 break; 2140 case STATE_CLOSED: 2141 if ((cp->flags & CP_AUTH) == 0) { 2142 sppp_cp_send(sp, cp->proto, TERM_ACK, 2143 sp->scp[cp->protoidx].rconfid, 0, 0); 2144 } 2145 break; 2146 default: 2147 printf("%s: %s illegal RCR+ in state %s\n", 2148 ifp->if_xname, cp->name, 2149 sppp_state_name(sp->scp[cp->protoidx].state)); 2150 if_statinc(ifp, if_ierrors); 2151 } 2152 } else { 2153 /* RCR- event */ 2154 switch (sp->scp[cp->protoidx].state) { 2155 case STATE_OPENED: 2156 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2157 cp->tld(sp); 2158 cp->scr(sp); 2159 cp->scan(cp, sp); 2160 break; 2161 case STATE_ACK_SENT: 2162 case STATE_REQ_SENT: 2163 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2164 cp->scan(cp, sp); 2165 break; 2166 case STATE_STOPPED: 2167 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2168 cp->scr(sp); 2169 cp->scan(cp, sp); 2170 break; 2171 case STATE_ACK_RCVD: 2172 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2173 cp->scan(cp, sp); 2174 break; 2175 case STATE_CLOSING: 2176 case STATE_STOPPING: 2177 if (buf != NULL) { 2178 sp->scp[cp->protoidx].rcr_buf = NULL; 2179 sp->scp[cp->protoidx].rcr_blen = 0; 2180 kmem_free(buf, blen); 2181 } 2182 break; 2183 case STATE_CLOSED: 2184 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2185 if ((cp->flags & CP_AUTH) == 0) { 2186 sppp_cp_send(sp, cp->proto, TERM_ACK, 2187 sp->scp[cp->protoidx].rconfid, 0, 0); 2188 } 2189 break; 2190 default: 2191 printf("%s: %s illegal RCR- in state %s\n", 2192 ifp->if_xname, cp->name, 2193 sppp_state_name(sp->scp[cp->protoidx].state)); 2194 if_statinc(ifp, if_ierrors); 2195 } 2196 } 2197 } 2198 2199 static void 2200 sppp_rca_event(struct sppp *sp, void *xcp) 2201 { 2202 const struct cp *cp = xcp; 2203 STDDCL; 2204 2205 switch (sp->scp[cp->protoidx].state) { 2206 case STATE_CLOSED: 2207 case STATE_STOPPED: 2208 if ((cp->flags & CP_AUTH) == 0) { 2209 sppp_cp_send(sp, cp->proto, TERM_ACK, 2210 sp->scp[cp->protoidx].rconfid, 0, 0); 2211 } 2212 break; 2213 case STATE_CLOSING: 2214 case STATE_STOPPING: 2215 break; 2216 case STATE_REQ_SENT: 2217 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2218 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2219 break; 2220 case STATE_OPENED: 2221 (cp->tld)(sp); 2222 /* fall through */ 2223 case STATE_ACK_RCVD: 2224 (cp->scr)(sp); 2225 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2226 break; 2227 case STATE_ACK_SENT: 2228 sppp_cp_change_state(cp, sp, STATE_OPENED); 2229 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2230 if (debug) 2231 log(LOG_DEBUG, "%s: %s tlu\n", 2232 ifp->if_xname, cp->name); 2233 (cp->tlu)(sp); 2234 break; 2235 default: 2236 printf("%s: %s illegal RCA in state %s\n", 2237 ifp->if_xname, cp->name, 2238 sppp_state_name(sp->scp[cp->protoidx].state)); 2239 if_statinc(ifp, if_ierrors); 2240 } 2241 } 2242 2243 static void 2244 sppp_rcn_event(struct sppp *sp, void *xcp) 2245 { 2246 const struct cp *cp = xcp; 2247 struct ifnet *ifp = &sp->pp_if; 2248 2249 switch (sp->scp[cp->protoidx].state) { 2250 case STATE_CLOSED: 2251 case STATE_STOPPED: 2252 if ((cp->flags & CP_AUTH) == 0) { 2253 sppp_cp_send(sp, cp->proto, TERM_ACK, 2254 sp->scp[cp->protoidx].rconfid, 0, 0); 2255 } 2256 break; 2257 case STATE_REQ_SENT: 2258 case STATE_ACK_SENT: 2259 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2260 (cp->scr)(sp); 2261 break; 2262 case STATE_OPENED: 2263 (cp->tld)(sp); 2264 /* fall through */ 2265 case STATE_ACK_RCVD: 2266 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2267 (cp->scr)(sp); 2268 break; 2269 case STATE_CLOSING: 2270 case STATE_STOPPING: 2271 break; 2272 default: 2273 printf("%s: %s illegal RCN in state %s\n", 2274 ifp->if_xname, cp->name, 2275 sppp_state_name(sp->scp[cp->protoidx].state)); 2276 if_statinc(ifp, if_ierrors); 2277 } 2278 } 2279 2280 static void 2281 sppp_rtr_event(struct sppp *sp, void *xcp) 2282 { 2283 const struct cp *cp = xcp; 2284 STDDCL; 2285 2286 switch (sp->scp[cp->protoidx].state) { 2287 case STATE_ACK_RCVD: 2288 case STATE_ACK_SENT: 2289 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2290 break; 2291 case STATE_CLOSED: 2292 case STATE_STOPPED: 2293 case STATE_CLOSING: 2294 case STATE_STOPPING: 2295 case STATE_REQ_SENT: 2296 break; 2297 case STATE_OPENED: 2298 (cp->tld)(sp); 2299 sp->scp[cp->protoidx].rst_counter = 0; 2300 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2301 break; 2302 default: 2303 printf("%s: %s illegal RTR in state %s\n", 2304 ifp->if_xname, cp->name, 2305 sppp_state_name(sp->scp[cp->protoidx].state)); 2306 if_statinc(ifp, if_ierrors); 2307 return; 2308 } 2309 2310 /* Send Terminate-Ack packet. */ 2311 if (debug) 2312 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 2313 ifp->if_xname, cp->name); 2314 if ((cp->flags & CP_AUTH) == 0) { 2315 sppp_cp_send(sp, cp->proto, TERM_ACK, 2316 sp->scp[cp->protoidx].rseq, 0, 0); 2317 } 2318 } 2319 2320 static void 2321 sppp_rta_event(struct sppp *sp, void *xcp) 2322 { 2323 const struct cp *cp = xcp; 2324 struct ifnet *ifp = &sp->pp_if; 2325 2326 switch (sp->scp[cp->protoidx].state) { 2327 case STATE_CLOSED: 2328 case STATE_STOPPED: 2329 case STATE_REQ_SENT: 2330 case STATE_ACK_SENT: 2331 break; 2332 case STATE_CLOSING: 2333 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2334 (cp->tlf)(cp, sp); 2335 break; 2336 case STATE_STOPPING: 2337 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2338 (cp->tlf)(cp, sp); 2339 break; 2340 case STATE_ACK_RCVD: 2341 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2342 break; 2343 case STATE_OPENED: 2344 (cp->tld)(sp); 2345 (cp->scr)(sp); 2346 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2347 break; 2348 default: 2349 printf("%s: %s illegal RTA in state %s\n", 2350 ifp->if_xname, cp->name, 2351 sppp_state_name(sp->scp[cp->protoidx].state)); 2352 if_statinc(ifp, if_ierrors); 2353 } 2354 } 2355 2356 static void 2357 sppp_rxj_event(struct sppp *sp, void *xcp) 2358 { 2359 const struct cp *cp = xcp; 2360 struct ifnet *ifp = &sp->pp_if; 2361 2362 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2363 switch (sp->scp[cp->protoidx].state) { 2364 case STATE_CLOSED: 2365 case STATE_STOPPED: 2366 case STATE_REQ_SENT: 2367 case STATE_ACK_SENT: 2368 case STATE_CLOSING: 2369 case STATE_STOPPING: 2370 case STATE_OPENED: 2371 break; 2372 case STATE_ACK_RCVD: 2373 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2374 break; 2375 default: 2376 printf("%s: %s illegal RXJ- in state %s\n", 2377 ifp->if_xname, cp->name, 2378 sppp_state_name(sp->scp[cp->protoidx].state)); 2379 if_statinc(ifp, if_ierrors); 2380 } 2381 } 2382 2383 /* 2384 * Change the state of a control protocol in the state automaton. 2385 * Takes care of starting/stopping the restart timer. 2386 */ 2387 void 2388 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2389 { 2390 2391 KASSERT(SPPP_WLOCKED(sp)); 2392 2393 sp->scp[cp->protoidx].state = newstate; 2394 callout_stop(&sp->scp[cp->protoidx].ch); 2395 switch (newstate) { 2396 case STATE_INITIAL: 2397 case STATE_STARTING: 2398 case STATE_CLOSED: 2399 case STATE_STOPPED: 2400 case STATE_OPENED: 2401 break; 2402 case STATE_CLOSING: 2403 case STATE_STOPPING: 2404 case STATE_REQ_SENT: 2405 case STATE_ACK_RCVD: 2406 case STATE_ACK_SENT: 2407 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2408 break; 2409 } 2410 } 2411 2412 /* 2413 *--------------------------------------------------------------------------* 2414 * * 2415 * The LCP implementation. * 2416 * * 2417 *--------------------------------------------------------------------------* 2418 */ 2419 static void 2420 sppp_lcp_init(struct sppp *sp) 2421 { 2422 2423 KASSERT(SPPP_WLOCKED(sp)); 2424 2425 sppp_cp_init(&lcp, sp); 2426 2427 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2428 sp->lcp.magic = 0; 2429 sp->lcp.protos = 0; 2430 sp->lcp.max_terminate = 2; 2431 sp->lcp.max_configure = 10; 2432 sp->lcp.max_failure = 10; 2433 sp->lcp.tlf_sent = false; 2434 2435 /* 2436 * Initialize counters and timeout values. Note that we don't 2437 * use the 3 seconds suggested in RFC 1661 since we are likely 2438 * running on a fast link. XXX We should probably implement 2439 * the exponential backoff option. Note that these values are 2440 * relevant for all control protocols, not just LCP only. 2441 */ 2442 sp->lcp.timeout = 1 * hz; 2443 } 2444 2445 static void 2446 sppp_lcp_up(struct sppp *sp, void *xcp) 2447 { 2448 const struct cp *cp = xcp; 2449 int pidx; 2450 STDDCL; 2451 2452 KASSERT(SPPP_WLOCKED(sp)); 2453 2454 pidx = cp->protoidx; 2455 /* Initialize activity timestamp: opening a connection is an activity */ 2456 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2457 2458 /* 2459 * If this interface is passive or dial-on-demand, and we are 2460 * still in Initial state, it means we've got an incoming 2461 * call. Activate the interface. 2462 */ 2463 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2464 if (debug) 2465 log(LOG_DEBUG, 2466 "%s: Up event", ifp->if_xname); 2467 ifp->if_flags |= IFF_RUNNING; 2468 if (sp->scp[pidx].state == STATE_INITIAL) { 2469 if (debug) 2470 addlog("(incoming call)\n"); 2471 sp->pp_flags |= PP_CALLIN; 2472 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2473 } else if (debug) 2474 addlog("\n"); 2475 } 2476 2477 sppp_up_event(sp, xcp); 2478 } 2479 2480 static void 2481 sppp_lcp_down(struct sppp *sp, void *xcp) 2482 { 2483 const struct cp *cp = xcp; 2484 int pidx; 2485 STDDCL; 2486 2487 KASSERT(SPPP_WLOCKED(sp)); 2488 2489 pidx = cp->protoidx; 2490 sppp_down_event(sp, xcp); 2491 2492 /* 2493 * We need to do tls to restart when a down event is caused 2494 * by the last tlf. 2495 */ 2496 if (sp->scp[pidx].state == STATE_STARTING && 2497 sp->lcp.tlf_sent) { 2498 cp->tls(cp, sp); 2499 sp->lcp.tlf_sent = false; 2500 } 2501 2502 /* 2503 * If this is neither a dial-on-demand nor a passive 2504 * interface, simulate an ``ifconfig down'' action, so the 2505 * administrator can force a redial by another ``ifconfig 2506 * up''. XXX For leased line operation, should we immediately 2507 * try to reopen the connection here? 2508 */ 2509 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2510 if (debug) 2511 log(LOG_INFO, 2512 "%s: Down event (carrier loss), taking interface down.\n", 2513 ifp->if_xname); 2514 SPPP_UNLOCK(sp); 2515 if_down(ifp); 2516 SPPP_LOCK(sp, RW_WRITER); 2517 2518 if (sp->lcp.reestablish) 2519 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2520 } else { 2521 if (debug) 2522 log(LOG_DEBUG, 2523 "%s: Down event (carrier loss)\n", 2524 ifp->if_xname); 2525 2526 sp->pp_flags &= ~PP_CALLIN; 2527 if (sp->scp[pidx].state != STATE_INITIAL) 2528 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2529 ifp->if_flags &= ~IFF_RUNNING; 2530 } 2531 sp->scp[pidx].fail_counter = 0; 2532 } 2533 2534 static void 2535 sppp_lcp_open(struct sppp *sp, void *xcp) 2536 { 2537 2538 KASSERT(SPPP_WLOCKED(sp)); 2539 2540 sp->lcp.reestablish = false; 2541 2542 if (sp->pp_if.if_mtu < PP_MTU) { 2543 sp->lcp.mru = sp->pp_if.if_mtu; 2544 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2545 } else 2546 sp->lcp.mru = PP_MTU; 2547 sp->lcp.their_mru = PP_MTU; 2548 2549 /* 2550 * If we are authenticator, negotiate LCP_AUTH 2551 */ 2552 if (sp->hisauth.proto != 0) 2553 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2554 else 2555 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2556 sp->pp_flags &= ~PP_NEEDAUTH; 2557 sppp_open_event(sp, xcp); 2558 } 2559 2560 /* 2561 * Analyze a configure request. Return true if it was agreeable, and 2562 * caused action sca, false if it has been rejected or nak'ed, and 2563 * caused action scn. (The return value is used to make the state 2564 * transition decision in the state automaton.) 2565 */ 2566 static enum cp_rcr_type 2567 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2568 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2569 { 2570 STDDCL; 2571 u_char *buf, *r, *p, l, blen; 2572 enum cp_rcr_type type; 2573 int len, rlen; 2574 uint32_t nmagic; 2575 u_short authproto; 2576 2577 KASSERT(SPPP_WLOCKED(sp)); 2578 2579 if (origlen < sizeof(*h)) 2580 return CP_RCR_DROP; 2581 2582 origlen -= sizeof(*h); 2583 type = CP_RCR_NONE; 2584 type = 0; 2585 2586 if (origlen <= 0) 2587 return CP_RCR_DROP; 2588 else 2589 blen = origlen; 2590 2591 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2592 if (buf == NULL) 2593 return CP_RCR_DROP; 2594 2595 if (debug) 2596 log(LOG_DEBUG, "%s: lcp parse opts:", 2597 ifp->if_xname); 2598 2599 /* pass 1: check for things that need to be rejected */ 2600 p = (void *)(h + 1); 2601 r = buf; 2602 rlen = 0; 2603 for (len = origlen; len > 1; len-= l, p += l) { 2604 l = p[1]; 2605 if (l == 0) 2606 break; 2607 2608 /* Sanity check option length */ 2609 if (l > len) { 2610 /* 2611 * Malicious option - drop immediately. 2612 * XXX Maybe we should just RXJ it? 2613 */ 2614 addlog("%s: received malicious LCP option 0x%02x, " 2615 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2616 p[0], l, len); 2617 type = CP_RCR_ERR; 2618 goto end; 2619 } 2620 if (debug) 2621 addlog(" %s", sppp_lcp_opt_name(*p)); 2622 switch (p[0]) { 2623 case LCP_OPT_MAGIC: 2624 /* Magic number. */ 2625 /* fall through, both are same length */ 2626 case LCP_OPT_ASYNC_MAP: 2627 /* Async control character map. */ 2628 if (len >= 6 || l == 6) 2629 continue; 2630 if (debug) 2631 addlog(" [invalid]"); 2632 break; 2633 case LCP_OPT_MP_EID: 2634 if (len >= l && l >= 3) { 2635 switch (p[2]) { 2636 case 0: if (l==3+ 0) continue;break; 2637 case 2: if (l==3+ 4) continue;break; 2638 case 3: if (l==3+ 6) continue;break; 2639 case 6: if (l==3+16) continue;break; 2640 case 1: /* FALLTHROUGH */ 2641 case 4: if (l<=3+20) continue;break; 2642 case 5: if (l<=3+15) continue;break; 2643 /* XXX should it be default: continue;? */ 2644 } 2645 } 2646 if (debug) 2647 addlog(" [invalid class %d len %d]", p[2], l); 2648 break; 2649 case LCP_OPT_MP_SSNHF: 2650 if (len >= 2 && l == 2) { 2651 if (debug) 2652 addlog(" [rej]"); 2653 break; 2654 } 2655 if (debug) 2656 addlog(" [invalid]"); 2657 break; 2658 case LCP_OPT_MP_MRRU: 2659 /* Multilink maximum received reconstructed unit */ 2660 /* should be fall through, both are same length */ 2661 /* FALLTHROUGH */ 2662 case LCP_OPT_MRU: 2663 /* Maximum receive unit. */ 2664 if (len >= 4 && l == 4) 2665 continue; 2666 if (debug) 2667 addlog(" [invalid]"); 2668 break; 2669 case LCP_OPT_AUTH_PROTO: 2670 if (len < 4) { 2671 if (debug) 2672 addlog(" [invalid]"); 2673 break; 2674 } 2675 authproto = (p[2] << 8) + p[3]; 2676 if (authproto == PPP_CHAP && l != 5) { 2677 if (debug) 2678 addlog(" [invalid chap len]"); 2679 break; 2680 } 2681 if (sp->myauth.proto == 0) { 2682 /* we are not configured to do auth */ 2683 if (debug) 2684 addlog(" [not configured]"); 2685 break; 2686 } 2687 /* 2688 * Remote want us to authenticate, remember this, 2689 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2690 * up. 2691 */ 2692 sp->pp_flags |= PP_NEEDAUTH; 2693 continue; 2694 default: 2695 /* Others not supported. */ 2696 if (debug) 2697 addlog(" [rej]"); 2698 break; 2699 } 2700 if (rlen + l > blen) { 2701 if (debug) 2702 addlog(" [overflow]"); 2703 continue; 2704 } 2705 /* Add the option to rejected list. */ 2706 memcpy(r, p, l); 2707 r += l; 2708 rlen += l; 2709 } 2710 2711 if (rlen > 0) { 2712 type = CP_RCR_REJ; 2713 goto end; 2714 } 2715 2716 if (debug) 2717 addlog("\n"); 2718 2719 /* 2720 * pass 2: check for option values that are unacceptable and 2721 * thus require to be nak'ed. 2722 */ 2723 if (debug) 2724 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2725 ifp->if_xname); 2726 2727 p = (void *)(h + 1); 2728 r = buf; 2729 rlen = 0; 2730 for (len = origlen; len > 0; len -= l, p += l) { 2731 l = p[1]; 2732 if (l == 0) 2733 break; 2734 2735 if (debug) 2736 addlog(" %s", sppp_lcp_opt_name(*p)); 2737 switch (p[0]) { 2738 case LCP_OPT_MAGIC: 2739 /* Magic number -- extract. */ 2740 nmagic = (uint32_t)p[2] << 24 | 2741 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2742 if (nmagic != sp->lcp.magic) { 2743 if (debug) 2744 addlog(" 0x%x", nmagic); 2745 continue; 2746 } 2747 /* 2748 * Local and remote magics equal -- loopback? 2749 */ 2750 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2751 printf ("%s: loopback\n", 2752 ifp->if_xname); 2753 sp->pp_loopcnt = 0; 2754 if (ifp->if_flags & IFF_UP) { 2755 SPPP_UNLOCK(sp); 2756 if_down(ifp); 2757 SPPP_LOCK(sp, RW_WRITER); 2758 2759 IF_PURGE(&sp->pp_cpq); 2760 /* XXX ? */ 2761 sppp_wq_add(sp->wq_cp, 2762 &sp->scp[IDX_LCP].work_down); 2763 sppp_wq_add(sp->wq_cp, 2764 &sp->scp[IDX_LCP].work_up); 2765 } 2766 } else if (debug) 2767 addlog(" [glitch]"); 2768 ++sp->pp_loopcnt; 2769 /* 2770 * We negate our magic here, and NAK it. If 2771 * we see it later in an NAK packet, we 2772 * suggest a new one. 2773 */ 2774 nmagic = ~sp->lcp.magic; 2775 /* Gonna NAK it. */ 2776 p[2] = nmagic >> 24; 2777 p[3] = nmagic >> 16; 2778 p[4] = nmagic >> 8; 2779 p[5] = nmagic; 2780 break; 2781 2782 case LCP_OPT_ASYNC_MAP: 2783 /* 2784 * Async control character map -- just ignore it. 2785 * 2786 * Quote from RFC 1662, chapter 6: 2787 * To enable this functionality, synchronous PPP 2788 * implementations MUST always respond to the 2789 * Async-Control-Character-Map Configuration 2790 * Option with the LCP Configure-Ack. However, 2791 * acceptance of the Configuration Option does 2792 * not imply that the synchronous implementation 2793 * will do any ACCM mapping. Instead, all such 2794 * octet mapping will be performed by the 2795 * asynchronous-to-synchronous converter. 2796 */ 2797 continue; 2798 2799 case LCP_OPT_MRU: 2800 /* 2801 * Maximum receive unit. Always agreeable, 2802 * but ignored by now. 2803 */ 2804 sp->lcp.their_mru = p[2] * 256 + p[3]; 2805 if (debug) 2806 addlog(" %ld", sp->lcp.their_mru); 2807 continue; 2808 2809 case LCP_OPT_AUTH_PROTO: 2810 authproto = (p[2] << 8) + p[3]; 2811 if (sp->myauth.proto != authproto) { 2812 /* not agreed, nak */ 2813 if (debug) 2814 addlog(" [mine %s != his %s]", 2815 sppp_proto_name(sp->myauth.proto), 2816 sppp_proto_name(authproto)); 2817 p[2] = sp->myauth.proto >> 8; 2818 p[3] = sp->myauth.proto; 2819 break; 2820 } 2821 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2822 if (debug) 2823 addlog(" [chap not MD5]"); 2824 p[4] = CHAP_MD5; 2825 break; 2826 } 2827 continue; 2828 case LCP_OPT_MP_EID: 2829 /* 2830 * Endpoint identification. 2831 * Always agreeable, 2832 * but ignored by now. 2833 */ 2834 if (debug) { 2835 addlog(" type %d", p[2]); 2836 sppp_print_bytes(p+3, p[1]-3); 2837 } 2838 continue; 2839 case LCP_OPT_MP_MRRU: 2840 /* 2841 * Maximum received reconstructed unit. 2842 * Always agreeable, 2843 * but ignored by now. 2844 */ 2845 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2846 if (debug) 2847 addlog(" %ld", sp->lcp.their_mrru); 2848 continue; 2849 } 2850 if (rlen + l > blen) { 2851 if (debug) 2852 addlog(" [overflow]"); 2853 continue; 2854 } 2855 /* Add the option to nak'ed list. */ 2856 memcpy(r, p, l); 2857 r += l; 2858 rlen += l; 2859 } 2860 2861 if (rlen > 0) { 2862 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2863 if (debug) 2864 addlog(" max_failure (%d) exceeded, ", 2865 sp->lcp.max_failure); 2866 type = CP_RCR_REJ; 2867 } else { 2868 type = CP_RCR_NAK; 2869 } 2870 } else { 2871 type = CP_RCR_ACK; 2872 rlen = origlen; 2873 memcpy(r, h + 1, rlen); 2874 sp->scp[IDX_LCP].fail_counter = 0; 2875 sp->pp_loopcnt = 0; 2876 } 2877 2878 end: 2879 if (debug) 2880 addlog("\n"); 2881 2882 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 2883 if (buf != NULL) 2884 kmem_intr_free(buf, blen); 2885 } else { 2886 *msgbuf = buf; 2887 *buflen = blen; 2888 *msglen = rlen; 2889 } 2890 2891 return type; 2892 } 2893 2894 /* 2895 * Analyze the LCP Configure-Reject option list, and adjust our 2896 * negotiation. 2897 */ 2898 static void 2899 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 2900 { 2901 STDDCL; 2902 u_char *p, l; 2903 2904 KASSERT(SPPP_WLOCKED(sp)); 2905 2906 if (len <= sizeof(*h)) 2907 return; 2908 2909 len -= sizeof(*h); 2910 2911 if (debug) 2912 log(LOG_DEBUG, "%s: lcp rej opts:", 2913 ifp->if_xname); 2914 2915 p = (void *)(h + 1); 2916 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2917 /* Sanity check option length */ 2918 if (l > len) { 2919 /* 2920 * Malicious option - drop immediately. 2921 * XXX Maybe we should just RXJ it? 2922 */ 2923 addlog("%s: received malicious LCP option, " 2924 "dropping.\n", ifp->if_xname); 2925 goto end; 2926 } 2927 if (debug) 2928 addlog(" %s", sppp_lcp_opt_name(*p)); 2929 switch (p[0]) { 2930 case LCP_OPT_MAGIC: 2931 /* Magic number -- can't use it, use 0 */ 2932 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2933 sp->lcp.magic = 0; 2934 break; 2935 case LCP_OPT_MRU: 2936 /* 2937 * We try to negotiate a lower MRU if the underlying 2938 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2939 * peer rejects this lower rate, fallback to the 2940 * default. 2941 */ 2942 if (debug) { 2943 addlog("%s: warning: peer rejected our MRU of " 2944 "%ld bytes. Defaulting to %d bytes\n", 2945 ifp->if_xname, sp->lcp.mru, PP_MTU); 2946 } 2947 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2948 sp->lcp.mru = PP_MTU; 2949 break; 2950 case LCP_OPT_AUTH_PROTO: 2951 /* 2952 * Peer doesn't want to authenticate himself, 2953 * deny unless this is a dialout call, and 2954 * SPPP_AUTHFLAG_NOCALLOUT is set. 2955 */ 2956 if ((sp->pp_flags & PP_CALLIN) == 0 && 2957 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2958 if (debug) 2959 addlog(" [don't insist on auth " 2960 "for callout]"); 2961 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2962 break; 2963 } 2964 if (debug) 2965 addlog("[access denied]\n"); 2966 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2967 break; 2968 } 2969 } 2970 if (debug) 2971 addlog("\n"); 2972 end: 2973 return; 2974 } 2975 2976 /* 2977 * Analyze the LCP Configure-NAK option list, and adjust our 2978 * negotiation. 2979 */ 2980 static void 2981 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 2982 { 2983 STDDCL; 2984 u_char *p, l; 2985 uint32_t magic; 2986 2987 KASSERT(SPPP_WLOCKED(sp)); 2988 2989 if (len <= sizeof(*h)) 2990 return; 2991 len -= sizeof(*h); 2992 2993 if (debug) 2994 log(LOG_DEBUG, "%s: lcp nak opts:", 2995 ifp->if_xname); 2996 2997 p = (void *)(h + 1); 2998 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2999 /* Sanity check option length */ 3000 if (l > len) { 3001 /* 3002 * Malicious option - drop immediately. 3003 * XXX Maybe we should just RXJ it? 3004 */ 3005 addlog("%s: received malicious LCP option, " 3006 "dropping.\n", ifp->if_xname); 3007 goto end; 3008 } 3009 if (debug) 3010 addlog(" %s", sppp_lcp_opt_name(*p)); 3011 switch (p[0]) { 3012 case LCP_OPT_MAGIC: 3013 /* Magic number -- renegotiate */ 3014 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3015 len >= 6 && l == 6) { 3016 magic = (uint32_t)p[2] << 24 | 3017 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3018 /* 3019 * If the remote magic is our negated one, 3020 * this looks like a loopback problem. 3021 * Suggest a new magic to make sure. 3022 */ 3023 if (magic == ~sp->lcp.magic) { 3024 if (debug) 3025 addlog(" magic glitch"); 3026 sp->lcp.magic = cprng_fast32(); 3027 } else { 3028 sp->lcp.magic = magic; 3029 if (debug) 3030 addlog(" %d", magic); 3031 } 3032 } 3033 break; 3034 case LCP_OPT_MRU: 3035 /* 3036 * Peer wants to advise us to negotiate an MRU. 3037 * Agree on it if it's reasonable, or use 3038 * default otherwise. 3039 */ 3040 if (len >= 4 && l == 4) { 3041 u_int mru = p[2] * 256 + p[3]; 3042 if (debug) 3043 addlog(" %d", mru); 3044 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3045 mru = sp->pp_if.if_mtu; 3046 sp->lcp.mru = mru; 3047 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3048 } 3049 break; 3050 case LCP_OPT_AUTH_PROTO: 3051 /* 3052 * Peer doesn't like our authentication method, 3053 * deny. 3054 */ 3055 if (debug) 3056 addlog("[access denied]\n"); 3057 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3058 break; 3059 } 3060 } 3061 if (debug) 3062 addlog("\n"); 3063 end: 3064 return; 3065 } 3066 3067 static void 3068 sppp_lcp_tlu(struct sppp *sp) 3069 { 3070 struct ifnet *ifp = &sp->pp_if; 3071 int i; 3072 3073 KASSERT(SPPP_WLOCKED(sp)); 3074 3075 /* XXX ? */ 3076 if (! (ifp->if_flags & IFF_UP) && 3077 (ifp->if_flags & IFF_RUNNING)) { 3078 /* Coming out of loopback mode. */ 3079 SPPP_UNLOCK(sp); 3080 if_up(ifp); 3081 SPPP_LOCK(sp, RW_WRITER); 3082 } 3083 3084 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3085 (sp->pp_flags & PP_NEEDAUTH) != 0) 3086 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3087 else 3088 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3089 3090 /* 3091 * Open all authentication protocols. This is even required 3092 * if we already proceeded to network phase, since it might be 3093 * that remote wants us to authenticate, so we might have to 3094 * send a PAP request. Undesired authentication protocols 3095 * don't do anything when they get an Open event. 3096 */ 3097 for (i = 0; i < IDX_COUNT; i++) 3098 if ((cps[i])->flags & CP_AUTH) { 3099 sppp_wq_add(sp->wq_cp, 3100 &sp->scp[(cps[i])->protoidx].work_open); 3101 } 3102 3103 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 3104 /* Notify all NCPs. */ 3105 for (i = 0; i < IDX_COUNT; i++) 3106 if ((cps[i])->flags & CP_NCP) { 3107 sppp_wq_add(sp->wq_cp, 3108 &sp->scp[(cps[i])->protoidx].work_open); 3109 } 3110 } 3111 3112 /* notify low-level driver of state change */ 3113 sppp_notify_chg_wlocked(sp); 3114 } 3115 3116 static void 3117 sppp_lcp_tld(struct sppp *sp) 3118 { 3119 int i, pi, phase; 3120 3121 KASSERT(SPPP_WLOCKED(sp)); 3122 3123 phase = sp->pp_phase; 3124 3125 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3126 3127 /* 3128 * Take upper layers down. We send the Down event first and 3129 * the Close second to prevent the upper layers from sending 3130 * ``a flurry of terminate-request packets'', as the RFC 3131 * describes it. 3132 */ 3133 for (i = 0; i < IDX_COUNT; i++) { 3134 pi = (cps[i])->protoidx; 3135 if (((cps[i])->flags & CP_LCP) == 0) { 3136 /* skip if ncp was not started */ 3137 if (phase != SPPP_PHASE_NETWORK && 3138 ((cps[i])->flags & CP_NCP) != 0) 3139 continue; 3140 3141 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_down); 3142 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_close); 3143 } 3144 } 3145 } 3146 3147 static void 3148 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3149 { 3150 3151 KASSERT(SPPP_WLOCKED(sp)); 3152 3153 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3154 printf("%s: authentication failed %d times, not retrying again\n", 3155 sp->pp_if.if_xname, sp->pp_auth_failures); 3156 3157 SPPP_UNLOCK(sp); 3158 if_down(&sp->pp_if); 3159 SPPP_LOCK(sp, RW_WRITER); 3160 return; 3161 } 3162 3163 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3164 3165 /* Notify lower layer if desired. */ 3166 sppp_notify_tls_wlocked(sp); 3167 sp->lcp.tlf_sent = false; 3168 } 3169 3170 static void 3171 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3172 { 3173 3174 KASSERT(SPPP_WLOCKED(sp)); 3175 3176 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3177 3178 /* Notify lower layer if desired. */ 3179 sppp_notify_tlf_wlocked(sp); 3180 3181 switch (sp->scp[IDX_LCP].state) { 3182 case STATE_CLOSED: 3183 case STATE_STOPPED: 3184 sp->lcp.tlf_sent = true; 3185 break; 3186 case STATE_INITIAL: 3187 default: 3188 /* just in case */ 3189 sp->lcp.tlf_sent = false; 3190 } 3191 } 3192 3193 static void 3194 sppp_lcp_scr(struct sppp *sp) 3195 { 3196 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3197 int i = 0; 3198 u_short authproto; 3199 3200 KASSERT(SPPP_WLOCKED(sp)); 3201 3202 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3203 if (! sp->lcp.magic) 3204 sp->lcp.magic = cprng_fast32(); 3205 opt[i++] = LCP_OPT_MAGIC; 3206 opt[i++] = 6; 3207 opt[i++] = sp->lcp.magic >> 24; 3208 opt[i++] = sp->lcp.magic >> 16; 3209 opt[i++] = sp->lcp.magic >> 8; 3210 opt[i++] = sp->lcp.magic; 3211 } 3212 3213 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3214 opt[i++] = LCP_OPT_MRU; 3215 opt[i++] = 4; 3216 opt[i++] = sp->lcp.mru >> 8; 3217 opt[i++] = sp->lcp.mru; 3218 } 3219 3220 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3221 authproto = sp->hisauth.proto; 3222 opt[i++] = LCP_OPT_AUTH_PROTO; 3223 opt[i++] = authproto == PPP_CHAP? 5: 4; 3224 opt[i++] = authproto >> 8; 3225 opt[i++] = authproto; 3226 if (authproto == PPP_CHAP) 3227 opt[i++] = CHAP_MD5; 3228 } 3229 3230 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3231 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3232 } 3233 3234 /* 3235 * Check the open NCPs, return true if at least one NCP is open. 3236 */ 3237 3238 static int 3239 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3240 { 3241 int i, mask; 3242 3243 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3244 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3245 return 1; 3246 return 0; 3247 } 3248 3249 /* 3250 * Re-check the open NCPs and see if we should terminate the link. 3251 * Called by the NCPs during their tlf action handling. 3252 */ 3253 static void 3254 sppp_lcp_check_and_close(struct sppp *sp) 3255 { 3256 3257 KASSERT(SPPP_WLOCKED(sp)); 3258 3259 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3260 /* don't bother, we are already going down */ 3261 return; 3262 } 3263 3264 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3265 sppp_cp_check(sp, CP_AUTH)) 3266 return; 3267 3268 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3269 sppp_cp_check(sp, CP_NCP)) 3270 return; 3271 3272 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3273 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3274 } 3275 3276 /* 3277 *--------------------------------------------------------------------------* 3278 * * 3279 * The IPCP implementation. * 3280 * * 3281 *--------------------------------------------------------------------------* 3282 */ 3283 3284 static void 3285 sppp_ipcp_init(struct sppp *sp) 3286 { 3287 3288 KASSERT(SPPP_WLOCKED(sp)); 3289 3290 sppp_cp_init(&ipcp, sp); 3291 3292 sp->ipcp.opts = 0; 3293 sp->ipcp.flags = 0; 3294 } 3295 3296 static void 3297 sppp_ipcp_open(struct sppp *sp, void *xcp) 3298 { 3299 STDDCL; 3300 uint32_t myaddr, hisaddr; 3301 3302 KASSERT(SPPP_WLOCKED(sp)); 3303 3304 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3305 sp->ipcp.req_myaddr = 0; 3306 sp->ipcp.req_hisaddr = 0; 3307 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3308 3309 #ifdef INET 3310 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3311 #else 3312 myaddr = hisaddr = 0; 3313 #endif 3314 /* 3315 * If we don't have his address, this probably means our 3316 * interface doesn't want to talk IP at all. (This could 3317 * be the case if somebody wants to speak only IPX, for 3318 * example.) Don't open IPCP in this case. 3319 */ 3320 if (hisaddr == 0) { 3321 /* XXX this message should go away */ 3322 if (debug) 3323 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 3324 ifp->if_xname); 3325 return; 3326 } 3327 3328 if (myaddr == 0) { 3329 /* 3330 * I don't have an assigned address, so i need to 3331 * negotiate my address. 3332 */ 3333 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3334 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3335 } 3336 if (hisaddr == 1) { 3337 /* 3338 * XXX - remove this hack! 3339 * remote has no valid address, we need to get one assigned. 3340 */ 3341 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3342 } 3343 3344 if (sp->query_dns & 1) { 3345 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3346 } else { 3347 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3348 } 3349 3350 if (sp->query_dns & 2) { 3351 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3352 } else { 3353 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3354 } 3355 sppp_open_event(sp, xcp); 3356 } 3357 3358 static void 3359 sppp_ipcp_close(struct sppp *sp, void *xcp) 3360 { 3361 3362 KASSERT(SPPP_WLOCKED(sp)); 3363 3364 sppp_close_event(sp, xcp); 3365 3366 #ifdef INET 3367 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 3368 /* 3369 * Some address was dynamic, clear it again. 3370 */ 3371 sppp_clear_ip_addrs(sp); 3372 #endif 3373 } 3374 3375 /* 3376 * Analyze a configure request. Return true if it was agreeable, and 3377 * caused action sca, false if it has been rejected or nak'ed, and 3378 * caused action scn. (The return value is used to make the state 3379 * transition decision in the state automaton.) 3380 */ 3381 static enum cp_rcr_type 3382 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3383 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3384 { 3385 u_char *buf, *r, *p, l, blen; 3386 enum cp_rcr_type type; 3387 struct ifnet *ifp = &sp->pp_if; 3388 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3389 uint32_t hisaddr, desiredaddr; 3390 3391 KASSERT(SPPP_WLOCKED(sp)); 3392 3393 type = CP_RCR_NONE; 3394 origlen -= sizeof(*h); 3395 3396 if (origlen < 0) 3397 return CP_RCR_DROP; 3398 3399 /* 3400 * Make sure to allocate a buf that can at least hold a 3401 * conf-nak with an `address' option. We might need it below. 3402 */ 3403 blen = MAX(6, origlen); 3404 3405 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3406 if (buf == NULL) 3407 return CP_RCR_DROP; 3408 3409 /* pass 1: see if we can recognize them */ 3410 if (debug) 3411 log(LOG_DEBUG, "%s: ipcp parse opts:", 3412 ifp->if_xname); 3413 p = (void *)(h + 1); 3414 r = buf; 3415 rlen = 0; 3416 for (len = origlen; len > 1; len -= l, p += l) { 3417 l = p[1]; 3418 if (l == 0) 3419 break; 3420 3421 /* Sanity check option length */ 3422 if (l > len) { 3423 /* XXX should we just RXJ? */ 3424 addlog("%s: malicious IPCP option received, dropping\n", 3425 ifp->if_xname); 3426 type = CP_RCR_ERR; 3427 goto end; 3428 } 3429 if (debug) 3430 addlog(" %s", sppp_ipcp_opt_name(*p)); 3431 switch (p[0]) { 3432 #ifdef notyet 3433 case IPCP_OPT_COMPRESSION: 3434 if (len >= 6 && l >= 6) { 3435 /* correctly formed compress option */ 3436 continue; 3437 } 3438 if (debug) 3439 addlog(" [invalid]"); 3440 break; 3441 #endif 3442 case IPCP_OPT_ADDRESS: 3443 if (len >= 6 && l == 6) { 3444 /* correctly formed address option */ 3445 continue; 3446 } 3447 if (debug) 3448 addlog(" [invalid]"); 3449 break; 3450 default: 3451 /* Others not supported. */ 3452 if (debug) 3453 addlog(" [rej]"); 3454 break; 3455 } 3456 /* Add the option to rejected list. */ 3457 if (rlen + l > blen) { 3458 if (debug) 3459 addlog(" [overflow]"); 3460 continue; 3461 } 3462 memcpy(r, p, l); 3463 r += l; 3464 rlen += l; 3465 } 3466 3467 if (rlen > 0) { 3468 type = CP_RCR_REJ; 3469 goto end; 3470 } 3471 3472 if (debug) 3473 addlog("\n"); 3474 3475 /* pass 2: parse option values */ 3476 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3477 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3478 else 3479 #ifdef INET 3480 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3481 #else 3482 hisaddr = 0; 3483 #endif 3484 if (debug) 3485 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 3486 ifp->if_xname); 3487 p = (void *)(h + 1); 3488 r = buf; 3489 rlen = 0; 3490 for (len = origlen; len > 1; len -= l, p += l) { 3491 l = p[1]; 3492 if (l == 0) 3493 break; 3494 3495 if (debug) 3496 addlog(" %s", sppp_ipcp_opt_name(*p)); 3497 switch (p[0]) { 3498 #ifdef notyet 3499 case IPCP_OPT_COMPRESSION: 3500 continue; 3501 #endif 3502 case IPCP_OPT_ADDRESS: 3503 desiredaddr = p[2] << 24 | p[3] << 16 | 3504 p[4] << 8 | p[5]; 3505 if (desiredaddr == hisaddr || 3506 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3507 /* 3508 * Peer's address is same as our value, 3509 * this is agreeable. Gonna conf-ack 3510 * it. 3511 */ 3512 if (debug) 3513 addlog(" %s [ack]", 3514 sppp_dotted_quad(hisaddr)); 3515 /* record that we've seen it already */ 3516 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3517 sp->ipcp.req_hisaddr = desiredaddr; 3518 hisaddr = desiredaddr; 3519 continue; 3520 } 3521 /* 3522 * The address wasn't agreeable. This is either 3523 * he sent us 0.0.0.0, asking to assign him an 3524 * address, or he send us another address not 3525 * matching our value. Either case, we gonna 3526 * conf-nak it with our value. 3527 */ 3528 if (debug) { 3529 if (desiredaddr == 0) 3530 addlog(" [addr requested]"); 3531 else 3532 addlog(" %s [not agreed]", 3533 sppp_dotted_quad(desiredaddr)); 3534 } 3535 3536 p[2] = hisaddr >> 24; 3537 p[3] = hisaddr >> 16; 3538 p[4] = hisaddr >> 8; 3539 p[5] = hisaddr; 3540 break; 3541 } 3542 if (rlen + l > blen) { 3543 if (debug) 3544 addlog(" [overflow]"); 3545 continue; 3546 } 3547 /* Add the option to nak'ed list. */ 3548 memcpy(r, p, l); 3549 r += l; 3550 rlen += l; 3551 } 3552 3553 if (rlen > 0) { 3554 type = CP_RCR_NAK; 3555 } else { 3556 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3557 /* 3558 * If we are about to conf-ack the request, but haven't seen 3559 * his address so far, gonna conf-nak it instead, with the 3560 * `address' option present and our idea of his address being 3561 * filled in there, to request negotiation of both addresses. 3562 * 3563 * XXX This can result in an endless req - nak loop if peer 3564 * doesn't want to send us his address. Q: What should we do 3565 * about it? XXX A: implement the max-failure counter. 3566 */ 3567 buf[0] = IPCP_OPT_ADDRESS; 3568 buf[1] = 6; 3569 buf[2] = hisaddr >> 24; 3570 buf[3] = hisaddr >> 16; 3571 buf[4] = hisaddr >> 8; 3572 buf[5] = hisaddr; 3573 rlen = 6; 3574 if (debug) 3575 addlog(" still need hisaddr"); 3576 type = CP_RCR_NAK; 3577 } else { 3578 type = CP_RCR_ACK; 3579 rlen = origlen; 3580 memcpy(r, h + 1, rlen); 3581 } 3582 } 3583 3584 end: 3585 if (debug) 3586 addlog("\n"); 3587 3588 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3589 if (buf != NULL) 3590 kmem_intr_free(buf, blen); 3591 } else { 3592 *msgbuf = buf; 3593 *buflen = blen; 3594 *msglen = rlen; 3595 } 3596 3597 return type; 3598 } 3599 3600 /* 3601 * Analyze the IPCP Configure-Reject option list, and adjust our 3602 * negotiation. 3603 */ 3604 static void 3605 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3606 { 3607 u_char *p, l; 3608 struct ifnet *ifp = &sp->pp_if; 3609 int debug = ifp->if_flags & IFF_DEBUG; 3610 3611 KASSERT(SPPP_WLOCKED(sp)); 3612 3613 if (len <= sizeof(*h)) 3614 return; 3615 3616 len -= sizeof(*h); 3617 3618 if (debug) 3619 log(LOG_DEBUG, "%s: ipcp rej opts:", 3620 ifp->if_xname); 3621 3622 p = (void *)(h + 1); 3623 for (; len > 1; len -= l, p += l) { 3624 l = p[1]; 3625 if (l == 0) 3626 break; 3627 3628 /* Sanity check option length */ 3629 if (l > len) { 3630 /* XXX should we just RXJ? */ 3631 addlog("%s: malicious IPCP option received, dropping\n", 3632 ifp->if_xname); 3633 goto end; 3634 } 3635 if (debug) 3636 addlog(" %s", sppp_ipcp_opt_name(*p)); 3637 switch (p[0]) { 3638 case IPCP_OPT_ADDRESS: 3639 /* 3640 * Peer doesn't grok address option. This is 3641 * bad. XXX Should we better give up here? 3642 */ 3643 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3644 break; 3645 #ifdef notyet 3646 case IPCP_OPT_COMPRESS: 3647 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3648 break; 3649 #endif 3650 case IPCP_OPT_PRIMDNS: 3651 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3652 break; 3653 3654 case IPCP_OPT_SECDNS: 3655 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3656 break; 3657 } 3658 } 3659 if (debug) 3660 addlog("\n"); 3661 end: 3662 return; 3663 } 3664 3665 /* 3666 * Analyze the IPCP Configure-NAK option list, and adjust our 3667 * negotiation. 3668 */ 3669 static void 3670 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3671 { 3672 u_char *p, l; 3673 struct ifnet *ifp = &sp->pp_if; 3674 int debug = ifp->if_flags & IFF_DEBUG; 3675 uint32_t wantaddr; 3676 3677 KASSERT(SPPP_WLOCKED(sp)); 3678 3679 len -= sizeof(*h); 3680 3681 if (debug) 3682 log(LOG_DEBUG, "%s: ipcp nak opts:", 3683 ifp->if_xname); 3684 3685 p = (void *)(h + 1); 3686 for (; len > 1; len -= l, p += l) { 3687 l = p[1]; 3688 if (l == 0) 3689 break; 3690 3691 /* Sanity check option length */ 3692 if (l > len) { 3693 /* XXX should we just RXJ? */ 3694 addlog("%s: malicious IPCP option received, dropping\n", 3695 ifp->if_xname); 3696 return; 3697 } 3698 if (debug) 3699 addlog(" %s", sppp_ipcp_opt_name(*p)); 3700 switch (*p) { 3701 case IPCP_OPT_ADDRESS: 3702 /* 3703 * Peer doesn't like our local IP address. See 3704 * if we can do something for him. We'll drop 3705 * him our address then. 3706 */ 3707 if (len >= 6 && l == 6) { 3708 wantaddr = p[2] << 24 | p[3] << 16 | 3709 p[4] << 8 | p[5]; 3710 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3711 if (debug) 3712 addlog(" [wantaddr %s]", 3713 sppp_dotted_quad(wantaddr)); 3714 /* 3715 * When doing dynamic address assignment, 3716 * we accept his offer. Otherwise, we 3717 * ignore it and thus continue to negotiate 3718 * our already existing value. 3719 */ 3720 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3721 if (debug) 3722 addlog(" [agree]"); 3723 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3724 sp->ipcp.req_myaddr = wantaddr; 3725 } 3726 } 3727 break; 3728 3729 case IPCP_OPT_PRIMDNS: 3730 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 3731 len >= 6 && l == 6) { 3732 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3733 p[4] << 8 | p[5]; 3734 } 3735 break; 3736 3737 case IPCP_OPT_SECDNS: 3738 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 3739 len >= 6 && l == 6) { 3740 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3741 p[4] << 8 | p[5]; 3742 } 3743 break; 3744 #ifdef notyet 3745 case IPCP_OPT_COMPRESS: 3746 /* 3747 * Peer wants different compression parameters. 3748 */ 3749 break; 3750 #endif 3751 } 3752 } 3753 if (debug) 3754 addlog("\n"); 3755 } 3756 3757 static void 3758 sppp_ipcp_tlu(struct sppp *sp) 3759 { 3760 #ifdef INET 3761 KASSERT(SPPP_WLOCKED(sp)); 3762 /* we are up. Set addresses and notify anyone interested */ 3763 sppp_set_ip_addrs(sp); 3764 #endif 3765 } 3766 3767 static void 3768 sppp_ipcp_scr(struct sppp *sp) 3769 { 3770 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3771 #ifdef INET 3772 uint32_t ouraddr; 3773 #endif 3774 int i = 0; 3775 3776 KASSERT(SPPP_WLOCKED(sp)); 3777 3778 #ifdef notyet 3779 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 3780 opt[i++] = IPCP_OPT_COMPRESSION; 3781 opt[i++] = 6; 3782 opt[i++] = 0; /* VJ header compression */ 3783 opt[i++] = 0x2d; /* VJ header compression */ 3784 opt[i++] = max_slot_id; 3785 opt[i++] = comp_slot_id; 3786 } 3787 #endif 3788 3789 #ifdef INET 3790 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 3791 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3792 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3793 else 3794 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3795 opt[i++] = IPCP_OPT_ADDRESS; 3796 opt[i++] = 6; 3797 opt[i++] = ouraddr >> 24; 3798 opt[i++] = ouraddr >> 16; 3799 opt[i++] = ouraddr >> 8; 3800 opt[i++] = ouraddr; 3801 } 3802 #endif 3803 3804 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 3805 opt[i++] = IPCP_OPT_PRIMDNS; 3806 opt[i++] = 6; 3807 opt[i++] = sp->dns_addrs[0] >> 24; 3808 opt[i++] = sp->dns_addrs[0] >> 16; 3809 opt[i++] = sp->dns_addrs[0] >> 8; 3810 opt[i++] = sp->dns_addrs[0]; 3811 } 3812 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 3813 opt[i++] = IPCP_OPT_SECDNS; 3814 opt[i++] = 6; 3815 opt[i++] = sp->dns_addrs[1] >> 24; 3816 opt[i++] = sp->dns_addrs[1] >> 16; 3817 opt[i++] = sp->dns_addrs[1] >> 8; 3818 opt[i++] = sp->dns_addrs[1]; 3819 } 3820 3821 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 3822 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 3823 } 3824 3825 /* 3826 *--------------------------------------------------------------------------* 3827 * * 3828 * The IPv6CP implementation. * 3829 * * 3830 *--------------------------------------------------------------------------* 3831 */ 3832 3833 #ifdef INET6 3834 static void 3835 sppp_ipv6cp_init(struct sppp *sp) 3836 { 3837 3838 KASSERT(SPPP_WLOCKED(sp)); 3839 3840 sppp_cp_init(&ipv6cp, sp); 3841 3842 sp->ipv6cp.opts = 0; 3843 sp->ipv6cp.flags = 0; 3844 } 3845 3846 static void 3847 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 3848 { 3849 STDDCL; 3850 struct in6_addr myaddr, hisaddr; 3851 3852 KASSERT(SPPP_WLOCKED(sp)); 3853 3854 #ifdef IPV6CP_MYIFID_DYN 3855 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3856 #else 3857 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3858 #endif 3859 3860 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3861 /* 3862 * If we don't have our address, this probably means our 3863 * interface doesn't want to talk IPv6 at all. (This could 3864 * be the case if somebody wants to speak only IPX, for 3865 * example.) Don't open IPv6CP in this case. 3866 */ 3867 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3868 /* XXX this message should go away */ 3869 if (debug) 3870 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3871 ifp->if_xname); 3872 return; 3873 } 3874 3875 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3876 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 3877 sppp_open_event(sp, xcp); 3878 } 3879 3880 /* 3881 * Analyze a configure request. Return true if it was agreeable, and 3882 * caused action sca, false if it has been rejected or nak'ed, and 3883 * caused action scn. (The return value is used to make the state 3884 * transition decision in the state automaton.) 3885 */ 3886 static enum cp_rcr_type 3887 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3888 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3889 { 3890 u_char *buf, *r, *p, l, blen; 3891 struct ifnet *ifp = &sp->pp_if; 3892 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3893 struct in6_addr myaddr, desiredaddr, suggestaddr; 3894 enum cp_rcr_type type; 3895 int ifidcount; 3896 int collision, nohisaddr; 3897 char ip6buf[INET6_ADDRSTRLEN]; 3898 3899 KASSERT(SPPP_WLOCKED(sp)); 3900 3901 type = CP_RCR_NONE; 3902 origlen -= sizeof(*h); 3903 3904 if (origlen < 0) 3905 return CP_RCR_DROP; 3906 3907 /* 3908 * Make sure to allocate a buf that can at least hold a 3909 * conf-nak with an `address' option. We might need it below. 3910 */ 3911 blen = MAX(6, origlen); 3912 3913 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3914 if (buf == NULL) 3915 return CP_RCR_DROP; 3916 3917 /* pass 1: see if we can recognize them */ 3918 if (debug) 3919 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3920 ifp->if_xname); 3921 p = (void *)(h + 1); 3922 r = buf; 3923 rlen = 0; 3924 ifidcount = 0; 3925 for (len = origlen; len > 1; len -= l, p += l) { 3926 l = p[1]; 3927 if (l == 0) 3928 break; 3929 3930 /* Sanity check option length */ 3931 if (l > len) { 3932 /* XXX just RXJ? */ 3933 addlog("%s: received malicious IPCPv6 option, " 3934 "dropping\n", ifp->if_xname); 3935 type = CP_RCR_ERR; 3936 goto end; 3937 } 3938 if (debug) 3939 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3940 switch (p[0]) { 3941 case IPV6CP_OPT_IFID: 3942 if (len >= 10 && l == 10 && ifidcount == 0) { 3943 /* correctly formed address option */ 3944 ifidcount++; 3945 continue; 3946 } 3947 if (debug) 3948 addlog(" [invalid]"); 3949 break; 3950 #ifdef notyet 3951 case IPV6CP_OPT_COMPRESSION: 3952 if (len >= 4 && l >= 4) { 3953 /* correctly formed compress option */ 3954 continue; 3955 } 3956 if (debug) 3957 addlog(" [invalid]"); 3958 break; 3959 #endif 3960 default: 3961 /* Others not supported. */ 3962 if (debug) 3963 addlog(" [rej]"); 3964 break; 3965 } 3966 if (rlen + l > blen) { 3967 if (debug) 3968 addlog(" [overflow]"); 3969 continue; 3970 } 3971 /* Add the option to rejected list. */ 3972 memcpy(r, p, l); 3973 r += l; 3974 rlen += l; 3975 } 3976 3977 if (rlen > 0) { 3978 type = CP_RCR_REJ; 3979 goto end; 3980 } 3981 3982 if (debug) 3983 addlog("\n"); 3984 3985 /* pass 2: parse option values */ 3986 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3987 if (debug) 3988 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3989 ifp->if_xname); 3990 p = (void *)(h + 1); 3991 r = buf; 3992 rlen = 0; 3993 type = CP_RCR_ACK; 3994 for (len = origlen; len > 1; len -= l, p += l) { 3995 l = p[1]; 3996 if (l == 0) 3997 break; 3998 3999 if (debug) 4000 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4001 switch (p[0]) { 4002 #ifdef notyet 4003 case IPV6CP_OPT_COMPRESSION: 4004 continue; 4005 #endif 4006 case IPV6CP_OPT_IFID: 4007 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4008 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4009 collision = (memcmp(&desiredaddr.s6_addr[8], 4010 &myaddr.s6_addr[8], 8) == 0); 4011 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4012 4013 desiredaddr.s6_addr16[0] = htons(0xfe80); 4014 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4015 4016 if (!collision && !nohisaddr) { 4017 /* no collision, hisaddr known - Conf-Ack */ 4018 type = CP_RCR_ACK; 4019 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4020 sizeof(sp->ipv6cp.my_ifid)); 4021 memcpy(sp->ipv6cp.his_ifid, 4022 &desiredaddr.s6_addr[8], 4023 sizeof(sp->ipv6cp.my_ifid)); 4024 4025 if (debug) { 4026 addlog(" %s [%s]", 4027 IN6_PRINT(ip6buf, &desiredaddr), 4028 sppp_cp_type_name(CONF_ACK)); 4029 } 4030 continue; 4031 } 4032 4033 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4034 if (collision && nohisaddr) { 4035 /* collision, hisaddr unknown - Conf-Rej */ 4036 type = CP_RCR_REJ; 4037 memset(&p[2], 0, 8); 4038 } else { 4039 /* 4040 * - no collision, hisaddr unknown, or 4041 * - collision, hisaddr known 4042 * Conf-Nak, suggest hisaddr 4043 */ 4044 type = CP_RCR_NAK; 4045 sppp_suggest_ip6_addr(sp, &suggestaddr); 4046 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4047 } 4048 if (debug) { 4049 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4050 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4051 sppp_cp_type_name(ctype)); 4052 } 4053 break; 4054 } 4055 if (rlen + l > blen) { 4056 if (debug) 4057 addlog(" [overflow]"); 4058 continue; 4059 } 4060 /* Add the option to nak'ed list. */ 4061 memcpy(r, p, l); 4062 r += l; 4063 rlen += l; 4064 } 4065 4066 if (rlen > 0) { 4067 if (type != CP_RCR_ACK) { 4068 if (debug) { 4069 int ctype ; 4070 ctype = type == CP_RCR_REJ ? 4071 CONF_REJ : CONF_NAK; 4072 addlog(" send %s suggest %s\n", 4073 sppp_cp_type_name(ctype), 4074 IN6_PRINT(ip6buf, &suggestaddr)); 4075 } 4076 } 4077 #ifdef notdef 4078 if (type == CP_RCR_ACK) 4079 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4080 #endif 4081 } else { 4082 if (type == CP_RCR_ACK) { 4083 rlen = origlen; 4084 memcpy(r, h + 1, rlen); 4085 } 4086 } 4087 end: 4088 if (debug) 4089 addlog("\n"); 4090 4091 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4092 if (buf != NULL) 4093 kmem_intr_free(buf, blen); 4094 } else { 4095 *msgbuf = buf; 4096 *buflen = blen; 4097 *msglen = rlen; 4098 } 4099 4100 return type; 4101 } 4102 4103 /* 4104 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4105 * negotiation. 4106 */ 4107 static void 4108 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4109 { 4110 u_char *p, l; 4111 struct ifnet *ifp = &sp->pp_if; 4112 int debug = ifp->if_flags & IFF_DEBUG; 4113 4114 KASSERT(SPPP_WLOCKED(sp)); 4115 4116 if (len <= sizeof(*h)) 4117 return; 4118 4119 len -= sizeof(*h); 4120 4121 if (debug) 4122 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 4123 ifp->if_xname); 4124 4125 p = (void *)(h + 1); 4126 for (; len > 1; len -= l, p += l) { 4127 l = p[1]; 4128 if (l == 0) 4129 break; 4130 4131 if (l > len) { 4132 /* XXX just RXJ? */ 4133 addlog("%s: received malicious IPCPv6 option, " 4134 "dropping\n", ifp->if_xname); 4135 goto end; 4136 } 4137 if (debug) 4138 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4139 switch (p[0]) { 4140 case IPV6CP_OPT_IFID: 4141 /* 4142 * Peer doesn't grok address option. This is 4143 * bad. XXX Should we better give up here? 4144 */ 4145 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4146 break; 4147 #ifdef notyet 4148 case IPV6CP_OPT_COMPRESS: 4149 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4150 break; 4151 #endif 4152 } 4153 } 4154 if (debug) 4155 addlog("\n"); 4156 end: 4157 return; 4158 } 4159 4160 /* 4161 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4162 * negotiation. 4163 */ 4164 static void 4165 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4166 { 4167 u_char *p, l; 4168 struct ifnet *ifp = &sp->pp_if; 4169 int debug = ifp->if_flags & IFF_DEBUG; 4170 struct in6_addr suggestaddr; 4171 char ip6buf[INET6_ADDRSTRLEN]; 4172 4173 KASSERT(SPPP_WLOCKED(sp)); 4174 4175 if (len <= sizeof(*h)) 4176 return; 4177 4178 len -= sizeof(*h); 4179 4180 if (debug) 4181 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 4182 ifp->if_xname); 4183 4184 p = (void *)(h + 1); 4185 for (; len > 1; len -= l, p += l) { 4186 l = p[1]; 4187 if (l == 0) 4188 break; 4189 4190 if (l > len) { 4191 /* XXX just RXJ? */ 4192 addlog("%s: received malicious IPCPv6 option, " 4193 "dropping\n", ifp->if_xname); 4194 goto end; 4195 } 4196 if (debug) 4197 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4198 switch (p[0]) { 4199 case IPV6CP_OPT_IFID: 4200 /* 4201 * Peer doesn't like our local ifid. See 4202 * if we can do something for him. We'll drop 4203 * him our address then. 4204 */ 4205 if (len < 10 || l != 10) 4206 break; 4207 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4208 suggestaddr.s6_addr16[0] = htons(0xfe80); 4209 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4210 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4211 4212 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4213 if (debug) 4214 addlog(" [suggestaddr %s]", 4215 IN6_PRINT(ip6buf, &suggestaddr)); 4216 #ifdef IPV6CP_MYIFID_DYN 4217 /* 4218 * When doing dynamic address assignment, 4219 * we accept his offer. 4220 */ 4221 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4222 struct in6_addr lastsuggest; 4223 /* 4224 * If <suggested myaddr from peer> equals to 4225 * <hisaddr we have suggested last time>, 4226 * we have a collision. generate new random 4227 * ifid. 4228 */ 4229 sppp_suggest_ip6_addr(&lastsuggest); 4230 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4231 lastsuggest)) { 4232 if (debug) 4233 addlog(" [random]"); 4234 sppp_gen_ip6_addr(sp, &suggestaddr); 4235 } 4236 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4237 if (debug) 4238 addlog(" [agree]"); 4239 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4240 } 4241 #else 4242 /* 4243 * Since we do not do dynamic address assignment, 4244 * we ignore it and thus continue to negotiate 4245 * our already existing value. This can possibly 4246 * go into infinite request-reject loop. 4247 * 4248 * This is not likely because we normally use 4249 * ifid based on MAC-address. 4250 * If you have no ethernet card on the node, too bad. 4251 * XXX should we use fail_counter? 4252 */ 4253 #endif 4254 break; 4255 #ifdef notyet 4256 case IPV6CP_OPT_COMPRESS: 4257 /* 4258 * Peer wants different compression parameters. 4259 */ 4260 break; 4261 #endif 4262 } 4263 } 4264 if (debug) 4265 addlog("\n"); 4266 end: 4267 return; 4268 } 4269 4270 static void 4271 sppp_ipv6cp_tlu(struct sppp *sp) 4272 { 4273 4274 KASSERT(SPPP_WLOCKED(sp)); 4275 /* we are up - notify isdn daemon */ 4276 sppp_notify_con_wlocked(sp); 4277 } 4278 4279 static void 4280 sppp_ipv6cp_scr(struct sppp *sp) 4281 { 4282 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4283 struct in6_addr ouraddr; 4284 int i = 0; 4285 4286 KASSERT(SPPP_WLOCKED(sp)); 4287 4288 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4289 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4290 opt[i++] = IPV6CP_OPT_IFID; 4291 opt[i++] = 10; 4292 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4293 i += 8; 4294 } 4295 4296 #ifdef notyet 4297 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4298 opt[i++] = IPV6CP_OPT_COMPRESSION; 4299 opt[i++] = 4; 4300 opt[i++] = 0; /* TBD */ 4301 opt[i++] = 0; /* TBD */ 4302 /* variable length data may follow */ 4303 } 4304 #endif 4305 4306 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4307 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4308 } 4309 #else /*INET6*/ 4310 static void 4311 sppp_ipv6cp_init(struct sppp *sp) 4312 { 4313 4314 KASSERT(SPPP_WLOCKED(sp)); 4315 } 4316 4317 static void 4318 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4319 { 4320 4321 KASSERT(SPPP_WLOCKED(sp)); 4322 } 4323 4324 static enum cp_rcr_type 4325 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4326 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4327 { 4328 4329 KASSERT(SPPP_WLOCKED(sp)); 4330 return 0; 4331 } 4332 4333 static void 4334 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4335 int len) 4336 { 4337 4338 KASSERT(SPPP_WLOCKED(sp)); 4339 } 4340 4341 static void 4342 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4343 int len) 4344 { 4345 4346 KASSERT(SPPP_WLOCKED(sp)); 4347 } 4348 4349 static void 4350 sppp_ipv6cp_tlu(struct sppp *sp) 4351 { 4352 4353 KASSERT(SPPP_WLOCKED(sp)); 4354 } 4355 4356 static void 4357 sppp_ipv6cp_scr(struct sppp *sp) 4358 { 4359 4360 KASSERT(SPPP_WLOCKED(sp)); 4361 } 4362 #endif /*INET6*/ 4363 4364 /* 4365 *--------------------------------------------------------------------------* 4366 * * 4367 * The CHAP implementation. * 4368 * * 4369 *--------------------------------------------------------------------------* 4370 */ 4371 /* 4372 * The authentication protocols is implemented on the state machine for 4373 * control protocols. And it uses following actions and events. 4374 * 4375 * Actions: 4376 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4377 * - sca: send CHAP_SUCCESS 4378 * - scn: send CHAP_FAILURE and shutdown lcp 4379 * Events: 4380 * - RCR+: receive CHAP_RESPONSE containing correct digest 4381 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4382 * - RCA: receive CHAP_SUCCESS 4383 * - RCN: (this event is unused) 4384 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4385 * - TO-: this layer finish 4386 */ 4387 4388 /* 4389 * Handle incoming CHAP packets. 4390 */ 4391 void 4392 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4393 { 4394 STDDCL; 4395 struct lcp_header *h; 4396 int len, x; 4397 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4398 int value_len, name_len; 4399 MD5_CTX ctx; 4400 4401 len = m->m_pkthdr.len; 4402 if (len < 4) { 4403 if (debug) 4404 log(LOG_DEBUG, 4405 "%s: chap invalid packet length: %d bytes\n", 4406 ifp->if_xname, len); 4407 return; 4408 } 4409 h = mtod(m, struct lcp_header *); 4410 if (len > ntohs(h->len)) 4411 len = ntohs(h->len); 4412 4413 SPPP_LOCK(sp, RW_WRITER); 4414 4415 switch (h->type) { 4416 /* challenge, failure and success are his authproto */ 4417 case CHAP_CHALLENGE: 4418 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4419 /* can't do anything useful */ 4420 sp->pp_auth_failures++; 4421 printf("%s: chap input without my name and my secret being set\n", 4422 ifp->if_xname); 4423 break; 4424 } 4425 value = 1 + (u_char *)(h + 1); 4426 value_len = value[-1]; 4427 name = value + value_len; 4428 name_len = len - value_len - 5; 4429 if (name_len < 0) { 4430 if (debug) { 4431 log(LOG_DEBUG, 4432 "%s: chap corrupted challenge " 4433 "<%s id=0x%x len=%d", 4434 ifp->if_xname, 4435 sppp_auth_type_name(PPP_CHAP, h->type), 4436 h->ident, ntohs(h->len)); 4437 if (len > 4) 4438 sppp_print_bytes((u_char *)(h + 1), 4439 len - 4); 4440 addlog(">\n"); 4441 } 4442 break; 4443 } 4444 4445 if (debug) { 4446 log(LOG_DEBUG, 4447 "%s: chap input <%s id=0x%x len=%d name=", 4448 ifp->if_xname, 4449 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 4450 ntohs(h->len)); 4451 sppp_print_string((char *) name, name_len); 4452 addlog(" value-size=%d value=", value_len); 4453 sppp_print_bytes(value, value_len); 4454 addlog(">\n"); 4455 } 4456 4457 /* Compute reply value. */ 4458 MD5Init(&ctx); 4459 MD5Update(&ctx, &h->ident, 1); 4460 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4461 MD5Update(&ctx, value, value_len); 4462 MD5Final(sp->chap.digest, &ctx); 4463 sp->chap.digest_len = sizeof(sp->chap.digest); 4464 sp->scp[IDX_CHAP].rconfid = h->ident; 4465 4466 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4467 break; 4468 4469 case CHAP_SUCCESS: 4470 if (debug) { 4471 log(LOG_DEBUG, "%s: chap success", 4472 ifp->if_xname); 4473 if (len > 4) { 4474 addlog(": "); 4475 sppp_print_string((char *)(h + 1), len - 4); 4476 } 4477 addlog("\n"); 4478 } 4479 4480 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4481 if (debug) { 4482 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4483 ifp->if_xname, chap.name, 4484 h->ident, sp->scp[IDX_CHAP].rconfid); 4485 } 4486 if_statinc(ifp, if_ierrors); 4487 break; 4488 } 4489 4490 if (sp->chap.digest_len == 0) { 4491 if (debug) { 4492 log(LOG_DEBUG, 4493 "%s: receive CHAP success without challenge\n", 4494 ifp->if_xname); 4495 } 4496 if_statinc(ifp, if_ierrors); 4497 break; 4498 } 4499 4500 x = splnet(); 4501 sp->pp_auth_failures = 0; 4502 sp->pp_flags &= ~PP_NEEDAUTH; 4503 splx(x); 4504 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4505 sp->chap.digest_len = 0; 4506 4507 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4508 /* 4509 * we are not authenticator for CHAP, 4510 * generate a dummy RCR+ event without CHAP_RESPONSE 4511 */ 4512 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4513 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4514 } 4515 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4516 break; 4517 4518 case CHAP_FAILURE: 4519 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4520 if (debug) { 4521 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4522 ifp->if_xname, chap.name, 4523 h->ident, sp->scp[IDX_CHAP].rconfid); 4524 } 4525 if_statinc(ifp, if_ierrors); 4526 break; 4527 } 4528 4529 if (sp->chap.digest_len == 0) { 4530 if (debug) { 4531 log(LOG_DEBUG, 4532 "%s: receive CHAP failure without challenge\n", 4533 ifp->if_xname); 4534 } 4535 if_statinc(ifp, if_ierrors); 4536 break; 4537 } 4538 4539 x = splnet(); 4540 sp->pp_auth_failures++; 4541 splx(x); 4542 if (debug) { 4543 log(LOG_INFO, "%s: chap failure", 4544 ifp->if_xname); 4545 if (len > 4) { 4546 addlog(": "); 4547 sppp_print_string((char *)(h + 1), len - 4); 4548 } 4549 addlog("\n"); 4550 } else 4551 log(LOG_INFO, "%s: chap failure\n", 4552 ifp->if_xname); 4553 4554 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4555 sp->chap.digest_len = 0; 4556 /* 4557 * await LCP shutdown by authenticator, 4558 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4559 */ 4560 break; 4561 4562 /* response is my authproto */ 4563 case CHAP_RESPONSE: 4564 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4565 /* can't do anything useful */ 4566 printf("%s: chap response" 4567 " without his name and his secret being set\n", 4568 ifp->if_xname); 4569 break; 4570 } 4571 value = 1 + (u_char *)(h + 1); 4572 value_len = value[-1]; 4573 name = value + value_len; 4574 name_len = len - value_len - 5; 4575 if (name_len < 0) { 4576 if (debug) { 4577 log(LOG_DEBUG, 4578 "%s: chap corrupted response " 4579 "<%s id=0x%x len=%d", 4580 ifp->if_xname, 4581 sppp_auth_type_name(PPP_CHAP, h->type), 4582 h->ident, ntohs(h->len)); 4583 if (len > 4) 4584 sppp_print_bytes((u_char *)(h + 1), 4585 len - 4); 4586 addlog(">\n"); 4587 } 4588 break; 4589 } 4590 if (h->ident != sp->scp[IDX_CHAP].confid) { 4591 if (debug) 4592 log(LOG_DEBUG, 4593 "%s: chap dropping response for old ID " 4594 "(got %d, expected %d)\n", 4595 ifp->if_xname, 4596 h->ident, sp->scp[IDX_CHAP].confid); 4597 break; 4598 } else { 4599 sp->scp[IDX_CHAP].rconfid = h->ident; 4600 } 4601 4602 if (sp->hisauth.name != NULL && 4603 (name_len != sp->hisauth.name_len 4604 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4605 log(LOG_INFO, "%s: chap response, his name ", 4606 ifp->if_xname); 4607 sppp_print_string(name, name_len); 4608 addlog(" != expected "); 4609 sppp_print_string(sp->hisauth.name, 4610 sp->hisauth.name_len); 4611 addlog("\n"); 4612 4613 /* generate RCR- event */ 4614 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4615 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4616 break; 4617 } 4618 4619 if (debug) { 4620 log(LOG_DEBUG, "%s: chap input(%s) " 4621 "<%s id=0x%x len=%d name=", 4622 ifp->if_xname, 4623 sppp_state_name(sp->scp[IDX_CHAP].state), 4624 sppp_auth_type_name(PPP_CHAP, h->type), 4625 h->ident, ntohs(h->len)); 4626 sppp_print_string((char *)name, name_len); 4627 addlog(" value-size=%d value=", value_len); 4628 sppp_print_bytes(value, value_len); 4629 addlog(">\n"); 4630 } 4631 4632 if (value_len == sizeof(sp->chap.challenge) && 4633 value_len == sizeof(sp->chap.digest)) { 4634 MD5Init(&ctx); 4635 MD5Update(&ctx, &h->ident, 1); 4636 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4637 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4638 MD5Final(digest, &ctx); 4639 4640 if (memcmp(digest, value, value_len) == 0) { 4641 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4642 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4643 sp->chap.rechallenging) { 4644 /* generate a dummy RCA event*/ 4645 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4646 } 4647 } else { 4648 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4649 } 4650 } else { 4651 if (debug) 4652 log(LOG_DEBUG, 4653 "%s: chap bad hash value length: " 4654 "%d bytes, should be %zu\n", 4655 ifp->if_xname, value_len, 4656 sizeof(sp->chap.challenge)); 4657 4658 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4659 } 4660 4661 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4662 break; 4663 4664 default: 4665 /* Unknown CHAP packet type -- ignore. */ 4666 if (debug) { 4667 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4668 "<0x%x id=0x%xh len=%d", 4669 ifp->if_xname, 4670 sppp_state_name(sp->scp[IDX_CHAP].state), 4671 h->type, h->ident, ntohs(h->len)); 4672 if (len > 4) 4673 sppp_print_bytes((u_char *)(h + 1), len - 4); 4674 addlog(">\n"); 4675 } 4676 break; 4677 4678 } 4679 4680 SPPP_UNLOCK(sp); 4681 } 4682 4683 static void 4684 sppp_chap_init(struct sppp *sp) 4685 { 4686 4687 KASSERT(SPPP_WLOCKED(sp)); 4688 4689 sppp_cp_init(&chap, sp); 4690 4691 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4692 sppp_chap_rcv_challenge_event, &chap); 4693 } 4694 4695 static void 4696 sppp_chap_open(struct sppp *sp, void *xcp) 4697 { 4698 4699 KASSERT(SPPP_WLOCKED(sp)); 4700 4701 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4702 sp->chap.digest_len = 0; 4703 sp->chap.rechallenging = false; 4704 sp->chap.response_rcvd = false; 4705 sppp_open_event(sp, xcp); 4706 } 4707 4708 static void 4709 sppp_chap_tlu(struct sppp *sp) 4710 { 4711 STDDCL; 4712 int i, x; 4713 4714 KASSERT(SPPP_WLOCKED(sp)); 4715 4716 i = 0; 4717 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4718 x = splnet(); 4719 sp->pp_auth_failures = 0; 4720 splx(x); 4721 4722 log(LOG_DEBUG, "%s: chap %s", ifp->if_xname, 4723 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4724 4725 /* 4726 * Some broken CHAP implementations (Conware CoNet, firmware 4727 * 4.0.?) don't want to re-authenticate their CHAP once the 4728 * initial challenge-response exchange has taken place. 4729 * Provide for an option to avoid rechallenges. 4730 */ 4731 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4732 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4733 /* 4734 * Compute the re-challenge timeout. This will yield 4735 * a number between 300 and 810 seconds. 4736 */ 4737 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4738 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4739 4740 if (debug) { 4741 addlog(", next rechallenge in %d seconds", i); 4742 } 4743 } 4744 4745 addlog("\n"); 4746 4747 /* 4748 * If we are already in phase network, we are done here. This 4749 * is the case if this is a dummy tlu event after a re-challenge. 4750 */ 4751 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4752 sppp_phase_network(sp); 4753 } 4754 4755 static void 4756 sppp_chap_scr(struct sppp *sp) 4757 { 4758 uint32_t *ch; 4759 u_char clen, dsize; 4760 int role; 4761 4762 KASSERT(SPPP_WLOCKED(sp)); 4763 4764 role = sppp_auth_role(&chap, sp); 4765 4766 if (ISSET(role, SPPP_AUTH_SERV) && 4767 !sp->chap.response_rcvd) { 4768 /* we are authenticator for CHAP, send challenge */ 4769 ch = (uint32_t *)sp->chap.challenge; 4770 clen = sizeof(sp->chap.challenge); 4771 /* Compute random challenge. */ 4772 cprng_strong(kern_cprng, ch, clen, 0); 4773 4774 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4775 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4776 sizeof(clen), (const char *)&clen, 4777 sizeof(sp->chap.challenge), sp->chap.challenge, 4778 0); 4779 } 4780 4781 if (ISSET(role, SPPP_AUTH_PEER) && 4782 sp->chap.digest_len > 0) { 4783 /* we are peer for CHAP, send response */ 4784 dsize = sp->chap.digest_len; 4785 4786 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 4787 sizeof(dsize), (const char *)&dsize, 4788 sp->chap.digest_len, sp->chap.digest, 4789 sp->myauth.name_len, sp->myauth.name, 0); 4790 } 4791 } 4792 4793 static void 4794 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 4795 { 4796 const struct cp *cp = xcp; 4797 4798 sp->chap.rechallenging = false; 4799 4800 switch (sp->scp[IDX_CHAP].state) { 4801 case STATE_REQ_SENT: 4802 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 4803 cp->scr(sp); 4804 break; 4805 case STATE_OPENED: 4806 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 4807 cp->scr(sp); 4808 break; 4809 } 4810 } 4811 4812 /* 4813 *--------------------------------------------------------------------------* 4814 * * 4815 * The PAP implementation. * 4816 * * 4817 *--------------------------------------------------------------------------* 4818 */ 4819 /* 4820 * PAP uses following actions and events. 4821 * Actions: 4822 * - scr: send PAP_REQ 4823 * - sca: send PAP_ACK 4824 * - scn: send PAP_NAK 4825 * Events: 4826 * - RCR+: receive PAP_REQ containing correct username and password 4827 * - RCR-: receive PAP_REQ containing wrong username and password 4828 * - RCA: receive PAP_ACK 4829 * - RCN: (this event is unused) 4830 * - TO+: re-send PAP_REQ 4831 * - TO-: this layer finish 4832 */ 4833 4834 /* 4835 * Handle incoming PAP packets. */ 4836 static void 4837 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4838 { 4839 STDDCL; 4840 struct lcp_header *h; 4841 int len, x; 4842 char *name, *secret; 4843 int name_len, secret_len; 4844 4845 /* 4846 * Malicious input might leave this uninitialized, so 4847 * init to an impossible value. 4848 */ 4849 secret_len = -1; 4850 4851 len = m->m_pkthdr.len; 4852 if (len < 5) { 4853 if (debug) 4854 log(LOG_DEBUG, 4855 "%s: pap invalid packet length: %d bytes\n", 4856 ifp->if_xname, len); 4857 return; 4858 } 4859 h = mtod(m, struct lcp_header *); 4860 if (len > ntohs(h->len)) 4861 len = ntohs(h->len); 4862 4863 SPPP_LOCK(sp, RW_WRITER); 4864 4865 switch (h->type) { 4866 /* PAP request is my authproto */ 4867 case PAP_REQ: 4868 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4869 /* can't do anything useful */ 4870 printf("%s: pap request" 4871 " without his name and his secret being set\n", 4872 ifp->if_xname); 4873 break; 4874 } 4875 name = 1 + (u_char *)(h + 1); 4876 name_len = name[-1]; 4877 secret = name + name_len + 1; 4878 if (name_len > len - 6 || 4879 (secret_len = secret[-1]) > len - 6 - name_len) { 4880 if (debug) { 4881 log(LOG_DEBUG, "%s: pap corrupted input " 4882 "<%s id=0x%x len=%d", 4883 ifp->if_xname, 4884 sppp_auth_type_name(PPP_PAP, h->type), 4885 h->ident, ntohs(h->len)); 4886 if (len > 4) 4887 sppp_print_bytes((u_char *)(h + 1), 4888 len - 4); 4889 addlog(">\n"); 4890 } 4891 break; 4892 } 4893 if (debug) { 4894 log(LOG_DEBUG, "%s: pap input(%s) " 4895 "<%s id=0x%x len=%d name=", 4896 ifp->if_xname, 4897 sppp_state_name(sp->scp[IDX_PAP].state), 4898 sppp_auth_type_name(PPP_PAP, h->type), 4899 h->ident, ntohs(h->len)); 4900 sppp_print_string((char *)name, name_len); 4901 addlog(" secret="); 4902 sppp_print_string((char *)secret, secret_len); 4903 addlog(">\n"); 4904 } 4905 4906 sp->scp[IDX_PAP].rconfid = h->ident; 4907 4908 if (name_len == sp->hisauth.name_len && 4909 memcmp(name, sp->hisauth.name, name_len) == 0 && 4910 secret_len == sp->hisauth.secret_len && 4911 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 4912 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 4913 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 4914 /* generate a dummy RCA event*/ 4915 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 4916 } 4917 } else { 4918 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 4919 } 4920 4921 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 4922 break; 4923 4924 /* ack and nak are his authproto */ 4925 case PAP_ACK: 4926 if (debug) { 4927 log(LOG_DEBUG, "%s: pap success", 4928 ifp->if_xname); 4929 name = 1 + (u_char *)(h + 1); 4930 name_len = name[-1]; 4931 if (len > 5 && name_len < len+4) { 4932 addlog(": "); 4933 sppp_print_string(name, name_len); 4934 } 4935 addlog("\n"); 4936 } 4937 4938 if (h->ident != sp->scp[IDX_PAP].confid) { 4939 if (debug) { 4940 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4941 ifp->if_xname, pap.name, 4942 h->ident, sp->scp[IDX_PAP].rconfid); 4943 } 4944 if_statinc(ifp, if_ierrors); 4945 break; 4946 } 4947 4948 x = splnet(); 4949 sp->pp_auth_failures = 0; 4950 sp->pp_flags &= ~PP_NEEDAUTH; 4951 splx(x); 4952 4953 /* we are not authenticator, generate a dummy RCR+ event */ 4954 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 4955 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 4956 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 4957 } 4958 4959 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 4960 break; 4961 4962 case PAP_NAK: 4963 if (debug) { 4964 log(LOG_INFO, "%s: pap failure", 4965 ifp->if_xname); 4966 name = 1 + (u_char *)(h + 1); 4967 name_len = name[-1]; 4968 if (len > 5 && name_len < len+4) { 4969 addlog(": "); 4970 sppp_print_string(name, name_len); 4971 } 4972 addlog("\n"); 4973 } else 4974 log(LOG_INFO, "%s: pap failure\n", 4975 ifp->if_xname); 4976 4977 if (h->ident != sp->scp[IDX_PAP].confid) { 4978 if (debug) { 4979 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4980 ifp->if_xname, pap.name, 4981 h->ident, sp->scp[IDX_PAP].rconfid); 4982 } 4983 if_statinc(ifp, if_ierrors); 4984 break; 4985 } 4986 4987 sp->pp_auth_failures++; 4988 /* 4989 * await LCP shutdown by authenticator, 4990 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 4991 */ 4992 break; 4993 4994 default: 4995 /* Unknown PAP packet type -- ignore. */ 4996 if (debug) { 4997 log(LOG_DEBUG, "%s: pap corrupted input " 4998 "<0x%x id=0x%x len=%d", 4999 ifp->if_xname, 5000 h->type, h->ident, ntohs(h->len)); 5001 if (len > 4) 5002 sppp_print_bytes((u_char *)(h + 1), len - 4); 5003 addlog(">\n"); 5004 } 5005 break; 5006 } 5007 5008 SPPP_UNLOCK(sp); 5009 } 5010 5011 static void 5012 sppp_pap_init(struct sppp *sp) 5013 { 5014 5015 KASSERT(SPPP_WLOCKED(sp)); 5016 sppp_cp_init(&pap, sp); 5017 } 5018 5019 static void 5020 sppp_pap_tlu(struct sppp *sp) 5021 { 5022 STDDCL; 5023 int x; 5024 5025 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5026 5027 if (debug) 5028 log(LOG_DEBUG, "%s: %s tlu\n", 5029 ifp->if_xname, pap.name); 5030 5031 x = splnet(); 5032 sp->pp_auth_failures = 0; 5033 splx(x); 5034 5035 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5036 sppp_phase_network(sp); 5037 } 5038 5039 static void 5040 sppp_pap_scr(struct sppp *sp) 5041 { 5042 u_char idlen, pwdlen; 5043 5044 KASSERT(SPPP_WLOCKED(sp)); 5045 5046 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5047 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5048 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 5049 log(LOG_DEBUG, "%s: couldn't send PAP_REQ " 5050 "because of no name or no secret\n", 5051 sp->pp_if.if_xname); 5052 } else { 5053 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5054 pwdlen = sp->myauth.secret_len; 5055 idlen = sp->myauth.name_len; 5056 5057 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5058 sizeof idlen, (const char *)&idlen, 5059 idlen, sp->myauth.name, 5060 sizeof pwdlen, (const char *)&pwdlen, 5061 pwdlen, sp->myauth.secret, 5062 0); 5063 } 5064 } 5065 } 5066 5067 /* 5068 * Random miscellaneous functions. 5069 */ 5070 5071 /* 5072 * Send a PAP or CHAP proto packet. 5073 * 5074 * Varadic function, each of the elements for the ellipsis is of type 5075 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5076 * mlen == 0. 5077 * NOTE: never declare variadic functions with types subject to type 5078 * promotion (i.e. u_char). This is asking for big trouble depending 5079 * on the architecture you are on... 5080 */ 5081 5082 static void 5083 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5084 unsigned int type, unsigned int id, 5085 ...) 5086 { 5087 STDDCL; 5088 struct lcp_header *lh; 5089 struct mbuf *m; 5090 u_char *p; 5091 int len; 5092 size_t pkthdrlen; 5093 unsigned int mlen; 5094 const char *msg; 5095 va_list ap; 5096 5097 KASSERT(SPPP_WLOCKED(sp)); 5098 5099 MGETHDR(m, M_DONTWAIT, MT_DATA); 5100 if (! m) 5101 return; 5102 m_reset_rcvif(m); 5103 5104 if (sp->pp_flags & PP_NOFRAMING) { 5105 *mtod(m, uint16_t *) = htons(cp->proto); 5106 pkthdrlen = 2; 5107 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5108 } else { 5109 struct ppp_header *h; 5110 h = mtod(m, struct ppp_header *); 5111 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5112 h->control = PPP_UI; /* Unnumbered Info */ 5113 h->protocol = htons(cp->proto); 5114 pkthdrlen = PPP_HEADER_LEN; 5115 5116 lh = (struct lcp_header *)(h + 1); 5117 } 5118 5119 lh->type = type; 5120 lh->ident = id; 5121 p = (u_char *)(lh + 1); 5122 5123 va_start(ap, id); 5124 len = 0; 5125 5126 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5127 msg = va_arg(ap, const char *); 5128 len += mlen; 5129 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5130 va_end(ap); 5131 m_freem(m); 5132 return; 5133 } 5134 5135 memcpy(p, msg, mlen); 5136 p += mlen; 5137 } 5138 va_end(ap); 5139 5140 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5141 lh->len = htons(LCP_HEADER_LEN + len); 5142 5143 if (debug) { 5144 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 5145 ifp->if_xname, cp->name, 5146 sppp_auth_type_name(cp->proto, lh->type), 5147 lh->ident, ntohs(lh->len)); 5148 if (len) 5149 sppp_print_bytes((u_char *)(lh + 1), len); 5150 addlog(">\n"); 5151 } 5152 if (IF_QFULL(&sp->pp_cpq)) { 5153 IF_DROP(&sp->pp_fastq); 5154 IF_DROP(&ifp->if_snd); 5155 m_freem(m); 5156 if_statinc(ifp, if_oerrors); 5157 return; 5158 } 5159 5160 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5161 IF_ENQUEUE(&sp->pp_cpq, m); 5162 5163 if (! (ifp->if_flags & IFF_OACTIVE)) { 5164 SPPP_UNLOCK(sp); 5165 if_start_lock(ifp); 5166 SPPP_LOCK(sp, RW_WRITER); 5167 } 5168 } 5169 5170 static int 5171 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5172 { 5173 int role; 5174 5175 role = SPPP_AUTH_NOROLE; 5176 5177 if (sp->hisauth.proto == cp->proto && 5178 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5179 SET(role, SPPP_AUTH_SERV); 5180 5181 if (sp->myauth.proto == cp->proto) 5182 SET(role, SPPP_AUTH_PEER); 5183 5184 return role; 5185 } 5186 5187 static void 5188 sppp_auth_to_event(struct sppp *sp, void *xcp) 5189 { 5190 const struct cp *cp = xcp; 5191 bool override; 5192 int state; 5193 STDDCL; 5194 5195 KASSERT(SPPP_WLOCKED(sp)); 5196 5197 override = false; 5198 state = sp->scp[cp->protoidx].state; 5199 5200 if (sp->scp[cp->protoidx].rst_counter > 0) { 5201 /* override TO+ event */ 5202 switch (state) { 5203 case STATE_OPENED: 5204 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5205 override = true; 5206 sp->chap.rechallenging = true; 5207 sp->chap.response_rcvd = false; 5208 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5209 cp->scr(sp); 5210 } 5211 break; 5212 5213 case STATE_ACK_RCVD: 5214 override = true; 5215 cp->scr(sp); 5216 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5217 break; 5218 } 5219 } 5220 5221 if (override) { 5222 if (debug) 5223 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 5224 ifp->if_xname, cp->name, 5225 sppp_state_name(state), 5226 sp->scp[cp->protoidx].rst_counter); 5227 sp->scp[cp->protoidx].rst_counter--; 5228 } else { 5229 sppp_to_event(sp, xcp); 5230 } 5231 } 5232 5233 static void 5234 sppp_auth_sca_scn(const struct cp *cp, struct sppp *sp) 5235 { 5236 static const char *succmsg = "Welcome!"; 5237 static const char *failmsg = "Failed..."; 5238 const char *msg; 5239 u_char type, rconfid, mlen; 5240 5241 KASSERT(SPPP_WLOCKED(sp)); 5242 5243 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5244 return; 5245 5246 rconfid = sp->scp[cp->protoidx].rconfid; 5247 5248 if (sp->scp[cp->protoidx].rcr_type == CP_RCR_ACK) { 5249 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5250 msg = succmsg; 5251 mlen = sizeof(succmsg) - 1; 5252 5253 sp->pp_auth_failures = 0; 5254 } else { 5255 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5256 msg = failmsg; 5257 mlen = sizeof(failmsg) - 1; 5258 5259 /* shutdown LCP if auth failed */ 5260 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5261 sp->pp_auth_failures++; 5262 } 5263 5264 sppp_auth_send(cp, sp, type, rconfid, 5265 mlen, (const u_char *)msg, 0); 5266 } 5267 5268 /* 5269 * Send keepalive packets, every 10 seconds. 5270 */ 5271 static void 5272 sppp_keepalive(void *dummy) 5273 { 5274 struct sppp *sp; 5275 int s; 5276 time_t now; 5277 5278 SPPPQ_LOCK(); 5279 5280 s = splnet(); 5281 now = time_uptime; 5282 for (sp=spppq; sp; sp=sp->pp_next) { 5283 struct ifnet *ifp = NULL; 5284 5285 SPPP_LOCK(sp, RW_WRITER); 5286 ifp = &sp->pp_if; 5287 5288 /* check idle timeout */ 5289 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5290 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5291 /* idle timeout is enabled for this interface */ 5292 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5293 if (ifp->if_flags & IFF_DEBUG) 5294 printf("%s: no activity for %lu seconds\n", 5295 sp->pp_if.if_xname, 5296 (unsigned long)(now-sp->pp_last_activity)); 5297 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5298 SPPP_UNLOCK(sp); 5299 continue; 5300 } 5301 } 5302 5303 /* Keepalive mode disabled or channel down? */ 5304 if (! (sp->pp_flags & PP_KEEPALIVE) || 5305 ! (ifp->if_flags & IFF_RUNNING)) { 5306 SPPP_UNLOCK(sp); 5307 continue; 5308 } 5309 5310 /* No keepalive in PPP mode if LCP not opened yet. */ 5311 if (! (sp->pp_flags & PP_CISCO) && 5312 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5313 SPPP_UNLOCK(sp); 5314 continue; 5315 } 5316 5317 /* No echo reply, but maybe user data passed through? */ 5318 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5319 sp->pp_alivecnt = 0; 5320 SPPP_UNLOCK(sp); 5321 continue; 5322 } 5323 5324 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5325 /* No keepalive packets got. Stop the interface. */ 5326 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5327 5328 if (! (sp->pp_flags & PP_CISCO)) { 5329 printf("%s: LCP keepalive timed out, going to restart the connection\n", 5330 ifp->if_xname); 5331 sp->pp_alivecnt = 0; 5332 5333 /* we are down, close all open protocols */ 5334 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5335 5336 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5337 sp->lcp.reestablish = true; 5338 5339 SPPP_UNLOCK(sp); 5340 continue; 5341 } 5342 } 5343 if (sp->pp_alivecnt < sp->pp_maxalive) 5344 ++sp->pp_alivecnt; 5345 if (sp->pp_flags & PP_CISCO) 5346 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 5347 ++sp->scp[IDX_LCP].seq, sp->scp[IDX_LCP].rseq); 5348 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5349 int32_t nmagic = htonl(sp->lcp.magic); 5350 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5351 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5352 sp->lcp.echoid, 4, &nmagic); 5353 } 5354 5355 SPPP_UNLOCK(sp); 5356 } 5357 splx(s); 5358 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5359 5360 SPPPQ_UNLOCK(); 5361 } 5362 5363 #ifdef INET 5364 /* 5365 * Get both IP addresses. 5366 */ 5367 static void 5368 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5369 { 5370 struct ifnet *ifp = &sp->pp_if; 5371 struct ifaddr *ifa; 5372 struct sockaddr_in *si, *sm; 5373 uint32_t ssrc, ddst; 5374 int s; 5375 struct psref psref; 5376 5377 sm = NULL; 5378 ssrc = ddst = 0; 5379 /* 5380 * Pick the first AF_INET address from the list, 5381 * aliases don't make any sense on a p2p link anyway. 5382 */ 5383 si = 0; 5384 s = pserialize_read_enter(); 5385 IFADDR_READER_FOREACH(ifa, ifp) { 5386 if (ifa->ifa_addr->sa_family == AF_INET) { 5387 si = (struct sockaddr_in *)ifa->ifa_addr; 5388 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5389 if (si) { 5390 ifa_acquire(ifa, &psref); 5391 break; 5392 } 5393 } 5394 } 5395 pserialize_read_exit(s); 5396 if (ifa) { 5397 if (si && si->sin_addr.s_addr) { 5398 ssrc = si->sin_addr.s_addr; 5399 if (srcmask) 5400 *srcmask = ntohl(sm->sin_addr.s_addr); 5401 } 5402 5403 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5404 if (si && si->sin_addr.s_addr) 5405 ddst = si->sin_addr.s_addr; 5406 ifa_release(ifa, &psref); 5407 } 5408 5409 if (dst) *dst = ntohl(ddst); 5410 if (src) *src = ntohl(ssrc); 5411 } 5412 5413 /* 5414 * Set IP addresses. Must be called at splnet. 5415 * If an address is 0, leave it the way it is. 5416 */ 5417 static void 5418 sppp_set_ip_addrs(struct sppp *sp) 5419 { 5420 STDDCL; 5421 struct ifaddr *ifa; 5422 struct sockaddr_in *si, *dest; 5423 uint32_t myaddr = 0, hisaddr = 0; 5424 int s; 5425 5426 IFNET_LOCK(ifp); 5427 5428 /* 5429 * Pick the first AF_INET address from the list, 5430 * aliases don't make any sense on a p2p link anyway. 5431 */ 5432 si = dest = NULL; 5433 s = pserialize_read_enter(); 5434 IFADDR_READER_FOREACH(ifa, ifp) { 5435 if (ifa->ifa_addr->sa_family == AF_INET) { 5436 si = (struct sockaddr_in *)ifa->ifa_addr; 5437 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5438 break; 5439 } 5440 } 5441 pserialize_read_exit(s); 5442 5443 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5444 myaddr = sp->ipcp.req_myaddr; 5445 else if (si != NULL) 5446 myaddr = ntohl(si->sin_addr.s_addr); 5447 5448 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5449 hisaddr = sp->ipcp.req_hisaddr; 5450 else if (dest != NULL) 5451 hisaddr = ntohl(dest->sin_addr.s_addr); 5452 5453 if (si != NULL && dest != NULL) { 5454 int error; 5455 struct sockaddr_in new_sin = *si; 5456 struct sockaddr_in new_dst = *dest; 5457 5458 if (myaddr != 0) 5459 new_sin.sin_addr.s_addr = htonl(myaddr); 5460 if (hisaddr != 0) { 5461 new_dst.sin_addr.s_addr = htonl(hisaddr); 5462 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5463 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5464 } 5465 5466 in_addrhash_remove(ifatoia(ifa)); 5467 5468 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5469 5470 in_addrhash_insert(ifatoia(ifa)); 5471 5472 if (debug && error) 5473 { 5474 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5475 ifp->if_xname, __func__, error); 5476 } 5477 if (!error) { 5478 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5479 } 5480 } 5481 5482 if (ifp->if_mtu > sp->lcp.their_mru) { 5483 sp->pp_saved_mtu = ifp->if_mtu; 5484 ifp->if_mtu = sp->lcp.their_mru; 5485 if (debug) 5486 log(LOG_DEBUG, 5487 "%s: setting MTU to %" PRIu64 " bytes\n", 5488 ifp->if_xname, ifp->if_mtu); 5489 } 5490 5491 IFNET_UNLOCK(ifp); 5492 5493 sppp_notify_con(sp); 5494 } 5495 5496 /* 5497 * Clear IP addresses. Must be called at splnet. 5498 */ 5499 static void 5500 sppp_clear_ip_addrs(struct sppp *sp) 5501 { 5502 STDDCL; 5503 struct ifaddr *ifa; 5504 struct sockaddr_in *si, *dest; 5505 int s; 5506 5507 IFNET_LOCK(ifp); 5508 5509 /* 5510 * Pick the first AF_INET address from the list, 5511 * aliases don't make any sense on a p2p link anyway. 5512 */ 5513 si = dest = NULL; 5514 s = pserialize_read_enter(); 5515 IFADDR_READER_FOREACH(ifa, ifp) { 5516 if (ifa->ifa_addr->sa_family == AF_INET) { 5517 si = (struct sockaddr_in *)ifa->ifa_addr; 5518 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5519 break; 5520 } 5521 } 5522 pserialize_read_exit(s); 5523 5524 if (si != NULL) { 5525 struct sockaddr_in new_sin = *si; 5526 struct sockaddr_in new_dst = *dest; 5527 int error; 5528 5529 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5530 new_sin.sin_addr.s_addr = 0; 5531 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 5532 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5533 5534 in_addrhash_remove(ifatoia(ifa)); 5535 5536 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5537 5538 in_addrhash_insert(ifatoia(ifa)); 5539 5540 if (debug && error) 5541 { 5542 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5543 ifp->if_xname, __func__, error); 5544 } 5545 if (!error) { 5546 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5547 } 5548 } 5549 5550 if (sp->pp_saved_mtu > 0) { 5551 ifp->if_mtu = sp->pp_saved_mtu; 5552 sp->pp_saved_mtu = 0; 5553 if (debug) 5554 log(LOG_DEBUG, 5555 "%s: resetting MTU to %" PRIu64 " bytes\n", 5556 ifp->if_xname, ifp->if_mtu); 5557 } 5558 5559 IFNET_UNLOCK(ifp); 5560 } 5561 #endif 5562 5563 #ifdef INET6 5564 /* 5565 * Get both IPv6 addresses. 5566 */ 5567 static void 5568 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5569 struct in6_addr *srcmask) 5570 { 5571 struct ifnet *ifp = &sp->pp_if; 5572 struct ifaddr *ifa; 5573 struct sockaddr_in6 *si, *sm; 5574 struct in6_addr ssrc, ddst; 5575 int s; 5576 struct psref psref; 5577 5578 sm = NULL; 5579 memset(&ssrc, 0, sizeof(ssrc)); 5580 memset(&ddst, 0, sizeof(ddst)); 5581 /* 5582 * Pick the first link-local AF_INET6 address from the list, 5583 * aliases don't make any sense on a p2p link anyway. 5584 */ 5585 si = 0; 5586 s = pserialize_read_enter(); 5587 IFADDR_READER_FOREACH(ifa, ifp) { 5588 if (ifa->ifa_addr->sa_family == AF_INET6) { 5589 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5590 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5591 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5592 ifa_acquire(ifa, &psref); 5593 break; 5594 } 5595 } 5596 } 5597 pserialize_read_exit(s); 5598 5599 if (ifa) { 5600 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5601 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5602 if (srcmask) { 5603 memcpy(srcmask, &sm->sin6_addr, 5604 sizeof(*srcmask)); 5605 } 5606 } 5607 5608 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5609 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5610 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5611 ifa_release(ifa, &psref); 5612 } 5613 5614 if (dst) 5615 memcpy(dst, &ddst, sizeof(*dst)); 5616 if (src) 5617 memcpy(src, &ssrc, sizeof(*src)); 5618 } 5619 5620 #ifdef IPV6CP_MYIFID_DYN 5621 /* 5622 * Generate random ifid. 5623 */ 5624 static void 5625 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5626 { 5627 /* TBD */ 5628 } 5629 5630 /* 5631 * Set my IPv6 address. Must be called at splnet. 5632 */ 5633 static void 5634 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5635 { 5636 STDDCL; 5637 struct ifaddr *ifa; 5638 struct sockaddr_in6 *sin6; 5639 int s; 5640 struct psref psref; 5641 5642 IFNET_LOCK(ifp); 5643 5644 /* 5645 * Pick the first link-local AF_INET6 address from the list, 5646 * aliases don't make any sense on a p2p link anyway. 5647 */ 5648 5649 sin6 = NULL; 5650 s = pserialize_read_enter(); 5651 IFADDR_READER_FOREACH(ifa, ifp) 5652 { 5653 if (ifa->ifa_addr->sa_family == AF_INET6) 5654 { 5655 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5656 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5657 ifa_acquire(ifa, &psref); 5658 break; 5659 } 5660 } 5661 } 5662 pserialize_read_exit(s); 5663 5664 if (ifa && sin6) 5665 { 5666 int error; 5667 struct sockaddr_in6 new_sin6 = *sin6; 5668 5669 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5670 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5671 if (debug && error) 5672 { 5673 log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n", 5674 ifp->if_xname, __func__, error); 5675 } 5676 if (!error) { 5677 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5678 } 5679 ifa_release(ifa, &psref); 5680 } 5681 5682 IFNET_UNLOCK(ifp); 5683 } 5684 #endif 5685 5686 /* 5687 * Suggest a candidate address to be used by peer. 5688 */ 5689 static void 5690 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5691 { 5692 struct in6_addr myaddr; 5693 struct timeval tv; 5694 5695 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5696 5697 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5698 microtime(&tv); 5699 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5700 myaddr.s6_addr[14] ^= 0xff; 5701 myaddr.s6_addr[15] ^= 0xff; 5702 } else { 5703 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5704 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5705 } 5706 if (suggest) 5707 memcpy(suggest, &myaddr, sizeof(myaddr)); 5708 } 5709 #endif /*INET6*/ 5710 5711 /* 5712 * Process ioctl requests specific to the PPP interface. 5713 * Permissions have already been checked. 5714 */ 5715 static int 5716 sppp_params(struct sppp *sp, u_long cmd, void *data) 5717 { 5718 switch (cmd) { 5719 case SPPPGETAUTHCFG: 5720 { 5721 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5722 int error; 5723 size_t len; 5724 5725 SPPP_LOCK(sp, RW_READER); 5726 5727 cfg->myauthflags = sp->myauth.flags; 5728 cfg->hisauthflags = sp->hisauth.flags; 5729 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5730 cfg->hisauth = 0; 5731 if (sp->hisauth.proto) 5732 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5733 cfg->myauth = 0; 5734 if (sp->myauth.proto) 5735 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5736 if (cfg->myname_length == 0) { 5737 if (sp->myauth.name != NULL) 5738 cfg->myname_length = sp->myauth.name_len + 1; 5739 } else { 5740 if (sp->myauth.name == NULL) { 5741 cfg->myname_length = 0; 5742 } else { 5743 len = sp->myauth.name_len + 1; 5744 5745 if (cfg->myname_length < len) { 5746 SPPP_UNLOCK(sp); 5747 return (ENAMETOOLONG); 5748 } 5749 error = copyout(sp->myauth.name, cfg->myname, len); 5750 if (error) { 5751 SPPP_UNLOCK(sp); 5752 return error; 5753 } 5754 } 5755 } 5756 if (cfg->hisname_length == 0) { 5757 if (sp->hisauth.name != NULL) 5758 cfg->hisname_length = sp->hisauth.name_len + 1; 5759 } else { 5760 if (sp->hisauth.name == NULL) { 5761 cfg->hisname_length = 0; 5762 } else { 5763 len = sp->hisauth.name_len + 1; 5764 5765 if (cfg->hisname_length < len) { 5766 SPPP_UNLOCK(sp); 5767 return (ENAMETOOLONG); 5768 } 5769 error = copyout(sp->hisauth.name, cfg->hisname, len); 5770 if (error) { 5771 SPPP_UNLOCK(sp); 5772 return error; 5773 } 5774 } 5775 } 5776 SPPP_UNLOCK(sp); 5777 } 5778 break; 5779 case SPPPSETAUTHCFG: 5780 { 5781 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5782 int error; 5783 5784 SPPP_LOCK(sp, RW_WRITER); 5785 5786 if (sp->myauth.name) { 5787 free(sp->myauth.name, M_DEVBUF); 5788 sp->myauth.name = NULL; 5789 } 5790 if (sp->myauth.secret) { 5791 free(sp->myauth.secret, M_DEVBUF); 5792 sp->myauth.secret = NULL; 5793 } 5794 if (sp->hisauth.name) { 5795 free(sp->hisauth.name, M_DEVBUF); 5796 sp->hisauth.name = NULL; 5797 } 5798 if (sp->hisauth.secret) { 5799 free(sp->hisauth.secret, M_DEVBUF); 5800 sp->hisauth.secret = NULL; 5801 } 5802 5803 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5804 if (cfg->hisname_length >= MCLBYTES) { 5805 SPPP_UNLOCK(sp); 5806 return (ENAMETOOLONG); 5807 } 5808 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5809 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5810 if (error) { 5811 free(sp->hisauth.name, M_DEVBUF); 5812 sp->hisauth.name = NULL; 5813 SPPP_UNLOCK(sp); 5814 return error; 5815 } 5816 sp->hisauth.name_len = cfg->hisname_length - 1; 5817 sp->hisauth.name[sp->hisauth.name_len] = 0; 5818 } 5819 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5820 if (cfg->hissecret_length >= MCLBYTES) { 5821 SPPP_UNLOCK(sp); 5822 return (ENAMETOOLONG); 5823 } 5824 sp->hisauth.secret = malloc(cfg->hissecret_length, 5825 M_DEVBUF, M_WAITOK); 5826 error = copyin(cfg->hissecret, sp->hisauth.secret, 5827 cfg->hissecret_length); 5828 if (error) { 5829 free(sp->hisauth.secret, M_DEVBUF); 5830 sp->hisauth.secret = NULL; 5831 SPPP_UNLOCK(sp); 5832 return error; 5833 } 5834 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5835 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5836 } 5837 if (cfg->myname != NULL && cfg->myname_length > 0) { 5838 if (cfg->myname_length >= MCLBYTES) { 5839 SPPP_UNLOCK(sp); 5840 return (ENAMETOOLONG); 5841 } 5842 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5843 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5844 if (error) { 5845 free(sp->myauth.name, M_DEVBUF); 5846 sp->myauth.name = NULL; 5847 SPPP_UNLOCK(sp); 5848 return error; 5849 } 5850 sp->myauth.name_len = cfg->myname_length - 1; 5851 sp->myauth.name[sp->myauth.name_len] = 0; 5852 } 5853 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5854 if (cfg->mysecret_length >= MCLBYTES) { 5855 SPPP_UNLOCK(sp); 5856 return (ENAMETOOLONG); 5857 } 5858 sp->myauth.secret = malloc(cfg->mysecret_length, 5859 M_DEVBUF, M_WAITOK); 5860 error = copyin(cfg->mysecret, sp->myauth.secret, 5861 cfg->mysecret_length); 5862 if (error) { 5863 free(sp->myauth.secret, M_DEVBUF); 5864 sp->myauth.secret = NULL; 5865 SPPP_UNLOCK(sp); 5866 return error; 5867 } 5868 sp->myauth.secret_len = cfg->mysecret_length - 1; 5869 sp->myauth.secret[sp->myauth.secret_len] = 0; 5870 } 5871 sp->myauth.flags = cfg->myauthflags; 5872 if (cfg->myauth) 5873 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5874 sp->hisauth.flags = cfg->hisauthflags; 5875 if (cfg->hisauth) 5876 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5877 sp->pp_auth_failures = 0; 5878 if (sp->hisauth.proto != 0) 5879 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 5880 else 5881 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 5882 5883 SPPP_UNLOCK(sp); 5884 } 5885 break; 5886 case SPPPGETLCPCFG: 5887 { 5888 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5889 5890 SPPP_LOCK(sp, RW_READER); 5891 lcpp->lcp_timeout = sp->lcp.timeout; 5892 SPPP_UNLOCK(sp); 5893 } 5894 break; 5895 case SPPPSETLCPCFG: 5896 { 5897 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 5898 5899 SPPP_LOCK(sp, RW_WRITER); 5900 sp->lcp.timeout = lcpp->lcp_timeout; 5901 SPPP_UNLOCK(sp); 5902 } 5903 break; 5904 case SPPPGETSTATUS: 5905 { 5906 struct spppstatus *status = (struct spppstatus *)data; 5907 5908 SPPP_LOCK(sp, RW_READER); 5909 status->phase = sp->pp_phase; 5910 SPPP_UNLOCK(sp); 5911 } 5912 break; 5913 case SPPPGETSTATUSNCP: 5914 { 5915 struct spppstatusncp *status = (struct spppstatusncp *)data; 5916 5917 SPPP_LOCK(sp, RW_READER); 5918 status->phase = sp->pp_phase; 5919 status->ncpup = sppp_cp_check(sp, CP_NCP); 5920 SPPP_UNLOCK(sp); 5921 } 5922 break; 5923 case SPPPGETIDLETO: 5924 { 5925 struct spppidletimeout *to = (struct spppidletimeout *)data; 5926 5927 SPPP_LOCK(sp, RW_READER); 5928 to->idle_seconds = sp->pp_idle_timeout; 5929 SPPP_UNLOCK(sp); 5930 } 5931 break; 5932 case SPPPSETIDLETO: 5933 { 5934 struct spppidletimeout *to = (struct spppidletimeout *)data; 5935 5936 SPPP_LOCK(sp, RW_WRITER); 5937 sp->pp_idle_timeout = to->idle_seconds; 5938 SPPP_UNLOCK(sp); 5939 } 5940 break; 5941 case SPPPSETAUTHFAILURE: 5942 { 5943 struct spppauthfailuresettings *afsettings = 5944 (struct spppauthfailuresettings *)data; 5945 5946 SPPP_LOCK(sp, RW_WRITER); 5947 sp->pp_max_auth_fail = afsettings->max_failures; 5948 sp->pp_auth_failures = 0; 5949 SPPP_UNLOCK(sp); 5950 } 5951 break; 5952 case SPPPGETAUTHFAILURES: 5953 { 5954 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5955 5956 SPPP_LOCK(sp, RW_READER); 5957 stats->auth_failures = sp->pp_auth_failures; 5958 stats->max_failures = sp->pp_max_auth_fail; 5959 SPPP_UNLOCK(sp); 5960 } 5961 break; 5962 case SPPPSETDNSOPTS: 5963 { 5964 struct spppdnssettings *req = (struct spppdnssettings *)data; 5965 5966 SPPP_LOCK(sp, RW_WRITER); 5967 sp->query_dns = req->query_dns & 3; 5968 SPPP_UNLOCK(sp); 5969 } 5970 break; 5971 case SPPPGETDNSOPTS: 5972 { 5973 struct spppdnssettings *req = (struct spppdnssettings *)data; 5974 5975 SPPP_LOCK(sp, RW_READER); 5976 req->query_dns = sp->query_dns; 5977 SPPP_UNLOCK(sp); 5978 } 5979 break; 5980 case SPPPGETDNSADDRS: 5981 { 5982 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5983 5984 SPPP_LOCK(sp, RW_READER); 5985 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5986 SPPP_UNLOCK(sp); 5987 } 5988 break; 5989 case SPPPGETKEEPALIVE: 5990 { 5991 struct spppkeepalivesettings *settings = 5992 (struct spppkeepalivesettings*)data; 5993 5994 SPPP_LOCK(sp, RW_READER); 5995 settings->maxalive = sp->pp_maxalive; 5996 settings->max_noreceive = sp->pp_max_noreceive; 5997 SPPP_UNLOCK(sp); 5998 } 5999 break; 6000 case SPPPSETKEEPALIVE: 6001 { 6002 struct spppkeepalivesettings *settings = 6003 (struct spppkeepalivesettings*)data; 6004 6005 SPPP_LOCK(sp, RW_WRITER); 6006 sp->pp_maxalive = settings->maxalive; 6007 sp->pp_max_noreceive = settings->max_noreceive; 6008 SPPP_UNLOCK(sp); 6009 } 6010 break; 6011 case SPPPGETLCPSTATUS: 6012 { 6013 struct sppplcpstatus *status = 6014 (struct sppplcpstatus *)data; 6015 6016 SPPP_LOCK(sp, RW_READER); 6017 status->state = sp->scp[IDX_LCP].state; 6018 status->opts = sp->lcp.opts; 6019 status->magic = sp->lcp.magic; 6020 status->mru = sp->lcp.mru; 6021 SPPP_UNLOCK(sp); 6022 } 6023 break; 6024 case SPPPGETIPCPSTATUS: 6025 { 6026 struct spppipcpstatus *status = 6027 (struct spppipcpstatus *)data; 6028 u_int32_t myaddr; 6029 6030 SPPP_LOCK(sp, RW_READER); 6031 status->state = sp->scp[IDX_IPCP].state; 6032 status->opts = sp->ipcp.opts; 6033 #ifdef INET 6034 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6035 #else 6036 myaddr = 0; 6037 #endif 6038 status->myaddr = ntohl(myaddr); 6039 SPPP_UNLOCK(sp); 6040 } 6041 break; 6042 case SPPPGETIPV6CPSTATUS: 6043 { 6044 struct spppipv6cpstatus *status = 6045 (struct spppipv6cpstatus *)data; 6046 6047 SPPP_LOCK(sp, RW_READER); 6048 status->state = sp->scp[IDX_IPV6CP].state; 6049 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6050 sizeof(status->my_ifid)); 6051 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6052 sizeof(status->his_ifid)); 6053 SPPP_UNLOCK(sp); 6054 } 6055 break; 6056 default: 6057 { 6058 int ret; 6059 6060 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6061 enosys(), ret); 6062 if (ret != ENOSYS) 6063 return ret; 6064 return (EINVAL); 6065 } 6066 } 6067 return (0); 6068 } 6069 6070 static void 6071 sppp_phase_network(struct sppp *sp) 6072 { 6073 int i; 6074 6075 KASSERT(SPPP_WLOCKED(sp)); 6076 6077 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6078 6079 /* Notify NCPs now. */ 6080 for (i = 0; i < IDX_COUNT; i++) 6081 if ((cps[i])->flags & CP_NCP) 6082 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6083 } 6084 6085 static const char * 6086 sppp_cp_type_name(u_char type) 6087 { 6088 static char buf[12]; 6089 switch (type) { 6090 case CONF_REQ: return "conf-req"; 6091 case CONF_ACK: return "conf-ack"; 6092 case CONF_NAK: return "conf-nak"; 6093 case CONF_REJ: return "conf-rej"; 6094 case TERM_REQ: return "term-req"; 6095 case TERM_ACK: return "term-ack"; 6096 case CODE_REJ: return "code-rej"; 6097 case PROTO_REJ: return "proto-rej"; 6098 case ECHO_REQ: return "echo-req"; 6099 case ECHO_REPLY: return "echo-reply"; 6100 case DISC_REQ: return "discard-req"; 6101 } 6102 snprintf(buf, sizeof(buf), "0x%x", type); 6103 return buf; 6104 } 6105 6106 static const char * 6107 sppp_auth_type_name(u_short proto, u_char type) 6108 { 6109 static char buf[32]; 6110 const char *name; 6111 6112 switch (proto) { 6113 case PPP_CHAP: 6114 switch (type) { 6115 case CHAP_CHALLENGE: return "challenge"; 6116 case CHAP_RESPONSE: return "response"; 6117 case CHAP_SUCCESS: return "success"; 6118 case CHAP_FAILURE: return "failure"; 6119 default: name = "chap"; break; 6120 } 6121 break; 6122 6123 case PPP_PAP: 6124 switch (type) { 6125 case PAP_REQ: return "req"; 6126 case PAP_ACK: return "ack"; 6127 case PAP_NAK: return "nak"; 6128 default: name = "pap"; break; 6129 } 6130 break; 6131 6132 default: 6133 name = "bad"; 6134 break; 6135 } 6136 6137 snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type); 6138 return buf; 6139 } 6140 6141 static const char * 6142 sppp_lcp_opt_name(u_char opt) 6143 { 6144 static char buf[12]; 6145 switch (opt) { 6146 case LCP_OPT_MRU: return "mru"; 6147 case LCP_OPT_ASYNC_MAP: return "async-map"; 6148 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6149 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6150 case LCP_OPT_MAGIC: return "magic"; 6151 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6152 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6153 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6154 case LCP_OPT_CALL_BACK: return "callback"; 6155 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6156 case LCP_OPT_MP_MRRU: return "mrru"; 6157 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6158 case LCP_OPT_MP_EID: return "mp-eid"; 6159 } 6160 snprintf(buf, sizeof(buf), "0x%x", opt); 6161 return buf; 6162 } 6163 6164 static const char * 6165 sppp_ipcp_opt_name(u_char opt) 6166 { 6167 static char buf[12]; 6168 switch (opt) { 6169 case IPCP_OPT_ADDRESSES: return "addresses"; 6170 case IPCP_OPT_COMPRESSION: return "compression"; 6171 case IPCP_OPT_ADDRESS: return "address"; 6172 } 6173 snprintf(buf, sizeof(buf), "0x%x", opt); 6174 return buf; 6175 } 6176 6177 #ifdef INET6 6178 static const char * 6179 sppp_ipv6cp_opt_name(u_char opt) 6180 { 6181 static char buf[12]; 6182 switch (opt) { 6183 case IPV6CP_OPT_IFID: return "ifid"; 6184 case IPV6CP_OPT_COMPRESSION: return "compression"; 6185 } 6186 snprintf(buf, sizeof(buf), "0x%x", opt); 6187 return buf; 6188 } 6189 #endif 6190 6191 static const char * 6192 sppp_state_name(int state) 6193 { 6194 switch (state) { 6195 case STATE_INITIAL: return "initial"; 6196 case STATE_STARTING: return "starting"; 6197 case STATE_CLOSED: return "closed"; 6198 case STATE_STOPPED: return "stopped"; 6199 case STATE_CLOSING: return "closing"; 6200 case STATE_STOPPING: return "stopping"; 6201 case STATE_REQ_SENT: return "req-sent"; 6202 case STATE_ACK_RCVD: return "ack-rcvd"; 6203 case STATE_ACK_SENT: return "ack-sent"; 6204 case STATE_OPENED: return "opened"; 6205 } 6206 return "illegal"; 6207 } 6208 6209 static const char * 6210 sppp_phase_name(int phase) 6211 { 6212 switch (phase) { 6213 case SPPP_PHASE_DEAD: return "dead"; 6214 case SPPP_PHASE_ESTABLISH: return "establish"; 6215 case SPPP_PHASE_TERMINATE: return "terminate"; 6216 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6217 case SPPP_PHASE_NETWORK: return "network"; 6218 } 6219 return "illegal"; 6220 } 6221 6222 static const char * 6223 sppp_proto_name(u_short proto) 6224 { 6225 static char buf[12]; 6226 switch (proto) { 6227 case PPP_LCP: return "lcp"; 6228 case PPP_IPCP: return "ipcp"; 6229 case PPP_PAP: return "pap"; 6230 case PPP_CHAP: return "chap"; 6231 case PPP_IPV6CP: return "ipv6cp"; 6232 } 6233 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 6234 return buf; 6235 } 6236 6237 static void 6238 sppp_print_bytes(const u_char *p, u_short len) 6239 { 6240 addlog(" %02x", *p++); 6241 while (--len > 0) 6242 addlog("-%02x", *p++); 6243 } 6244 6245 static void 6246 sppp_print_string(const char *p, u_short len) 6247 { 6248 u_char c; 6249 6250 while (len-- > 0) { 6251 c = *p++; 6252 /* 6253 * Print only ASCII chars directly. RFC 1994 recommends 6254 * using only them, but we don't rely on it. */ 6255 if (c < ' ' || c > '~') 6256 addlog("\\x%x", c); 6257 else 6258 addlog("%c", c); 6259 } 6260 } 6261 6262 static const char * 6263 sppp_dotted_quad(uint32_t addr) 6264 { 6265 static char s[16]; 6266 snprintf(s, sizeof(s), "%d.%d.%d.%d", 6267 (int)((addr >> 24) & 0xff), 6268 (int)((addr >> 16) & 0xff), 6269 (int)((addr >> 8) & 0xff), 6270 (int)(addr & 0xff)); 6271 return s; 6272 } 6273 6274 /* a dummy, used to drop uninteresting events */ 6275 static void 6276 sppp_null(struct sppp *unused) 6277 { 6278 /* do just nothing */ 6279 } 6280 6281 static void 6282 sppp_tls(const struct cp *cp, struct sppp *sp) 6283 { 6284 6285 /* notify lcp that is lower layer */ 6286 sp->lcp.protos |= (1 << cp->protoidx); 6287 6288 if (sp->scp[IDX_LCP].state == STATE_OPENED) 6289 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_up); 6290 } 6291 6292 static void 6293 sppp_tlf(const struct cp *cp, struct sppp *sp) 6294 { 6295 STDDCL; 6296 6297 if (debug) 6298 log(LOG_DEBUG, "%s: %s tlf\n", ifp->if_xname, cp->name); 6299 6300 /* notify lcp that is lower layer */ 6301 sp->lcp.protos &= ~(1 << cp->protoidx); 6302 6303 /* cleanup */ 6304 if (sp->scp[cp->protoidx].rcr_buf != NULL) { 6305 kmem_free(sp->scp[cp->protoidx].rcr_buf, 6306 sp->scp[cp->protoidx].rcr_blen); 6307 } 6308 6309 sp->scp[cp->protoidx].rcr_buf = NULL; 6310 sp->scp[cp->protoidx].rcr_blen = 0; 6311 sp->scp[cp->protoidx].rcr_rlen = 0; 6312 6313 sppp_lcp_check_and_close(sp); 6314 } 6315 6316 static void 6317 sppp_sca_scn(const struct cp *cp, struct sppp *sp) 6318 { 6319 STDDCL; 6320 u_char rconfid, rlen; 6321 int type; 6322 void *buf; 6323 size_t blen; 6324 6325 rconfid = sp->scp[cp->protoidx].rconfid; 6326 buf = sp->scp[cp->protoidx].rcr_buf; 6327 rlen = sp->scp[cp->protoidx].rcr_rlen; 6328 blen = sp->scp[cp->protoidx].rcr_blen; 6329 6330 sp->scp[cp->protoidx].rcr_buf = NULL; 6331 sp->scp[cp->protoidx].rcr_blen = 0; 6332 6333 switch (sp->scp[cp->protoidx].rcr_type) { 6334 case CP_RCR_ACK: 6335 type = CONF_ACK; 6336 break; 6337 case CP_RCR_REJ: 6338 type = CONF_REJ; 6339 break; 6340 case CP_RCR_NAK: 6341 type = CONF_NAK; 6342 break; 6343 default: 6344 type = -1; 6345 break; 6346 } 6347 6348 sp->scp[cp->protoidx].rcr_type = CP_RCR_NONE; 6349 6350 if (buf != NULL) { 6351 if (rlen > 0 && type != -1) { 6352 if (debug) { 6353 log(LOG_DEBUG, "%s: send %s\n", 6354 ifp->if_xname, sppp_cp_type_name(type)); 6355 } 6356 sppp_cp_send(sp, cp->proto, type, rconfid, rlen, buf); 6357 } 6358 kmem_free(buf, blen); 6359 } 6360 } 6361 6362 static void 6363 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6364 { 6365 6366 SPPP_UNLOCK(sp); 6367 if_down(&sp->pp_if); 6368 IF_PURGE(&sp->pp_cpq); 6369 SPPP_LOCK(sp, RW_WRITER); 6370 } 6371 6372 static void 6373 sppp_notify_up(struct sppp *sp) 6374 { 6375 6376 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6377 } 6378 6379 static void 6380 sppp_notify_down(struct sppp *sp) 6381 { 6382 6383 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6384 } 6385 6386 static void 6387 sppp_notify_tls_wlocked(struct sppp *sp) 6388 { 6389 6390 KASSERT(SPPP_WLOCKED(sp)); 6391 6392 if (!sp->pp_tls) 6393 return; 6394 6395 SPPP_UNLOCK(sp); 6396 sp->pp_tls(sp); 6397 SPPP_LOCK(sp, RW_WRITER); 6398 } 6399 6400 static void 6401 sppp_notify_tlf_wlocked(struct sppp *sp) 6402 { 6403 6404 KASSERT(SPPP_WLOCKED(sp)); 6405 6406 if (!sp->pp_tlf) 6407 return; 6408 6409 SPPP_UNLOCK(sp); 6410 sp->pp_tlf(sp); 6411 SPPP_LOCK(sp, RW_WRITER); 6412 } 6413 6414 static void 6415 sppp_notify_con(struct sppp *sp) 6416 { 6417 6418 if (!sp->pp_con) 6419 return; 6420 6421 sp->pp_con(sp); 6422 } 6423 6424 #ifdef INET6 6425 static void 6426 sppp_notify_con_wlocked(struct sppp *sp) 6427 { 6428 6429 KASSERT(SPPP_WLOCKED(sp)); 6430 6431 SPPP_UNLOCK(sp); 6432 sppp_notify_con(sp); 6433 SPPP_LOCK(sp, RW_WRITER); 6434 6435 } 6436 #endif 6437 6438 static void 6439 sppp_notify_chg_wlocked(struct sppp *sp) 6440 { 6441 6442 KASSERT(SPPP_WLOCKED(sp)); 6443 6444 if (!sp->pp_chg) 6445 return; 6446 6447 SPPP_UNLOCK(sp); 6448 sp->pp_chg(sp, sp->pp_phase); 6449 SPPP_LOCK(sp, RW_WRITER); 6450 } 6451 6452 static void 6453 sppp_wq_work(struct work *wk, void *xsp) 6454 { 6455 struct sppp *sp; 6456 struct sppp_work *work; 6457 6458 sp = xsp; 6459 work = container_of(wk, struct sppp_work, work); 6460 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6461 6462 SPPP_LOCK(sp, RW_WRITER); 6463 work->func(sp, work->arg); 6464 SPPP_UNLOCK(sp); 6465 } 6466 6467 static struct workqueue * 6468 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6469 { 6470 struct workqueue *wq; 6471 int error; 6472 6473 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6474 (void *)sp, prio, ipl, flags); 6475 if (error) { 6476 panic("%s: workqueue_create failed [%s, %d]\n", 6477 sp->pp_if.if_xname, xnamebuf, error); 6478 } 6479 6480 return wq; 6481 } 6482 6483 static void 6484 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6485 { 6486 6487 workqueue_destroy(wq); 6488 } 6489 6490 static void 6491 sppp_wq_set(struct sppp_work *work, 6492 void (*func)(struct sppp *, void *), void *arg) 6493 { 6494 6495 work->func = func; 6496 work->arg = arg; 6497 } 6498 6499 static void 6500 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6501 { 6502 6503 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6504 != SPPP_WK_FREE) 6505 return; 6506 6507 KASSERT(work->func != NULL); 6508 kpreempt_disable(); 6509 workqueue_enqueue(wq, &work->work, NULL); 6510 kpreempt_enable(); 6511 } 6512 static void 6513 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6514 { 6515 6516 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6517 workqueue_wait(wq, &work->work); 6518 } 6519 6520 /* 6521 * This file is large. Tell emacs to highlight it nevertheless. 6522 * 6523 * Local Variables: 6524 * hilit-auto-highlight-maxout: 120000 6525 * End: 6526 */ 6527 6528 /* 6529 * Module glue 6530 */ 6531 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6532 6533 static int 6534 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6535 { 6536 6537 switch (cmd) { 6538 case MODULE_CMD_INIT: 6539 case MODULE_CMD_FINI: 6540 return 0; 6541 case MODULE_CMD_STAT: 6542 case MODULE_CMD_AUTOUNLOAD: 6543 default: 6544 return ENOTTY; 6545 } 6546 } 6547
Indexes created Sat Sep 27 21:09:56 GMT 2025