if_spppsubr.c revision 1.243
1 /* $NetBSD: if_spppsubr.c,v 1.243 2021/05/19 01:54:09 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.243 2021/05/19 01:54:09 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/netisr.h> 76 #include <net/if_types.h> 77 #include <net/route.h> 78 #include <net/ppp_defs.h> 79 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/in_var.h> 83 #ifdef INET 84 #include <netinet/ip.h> 85 #include <netinet/tcp.h> 86 #endif 87 #include <net/ethertypes.h> 88 89 #ifdef INET6 90 #include <netinet6/scope6_var.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #ifdef NET_MPSAFE 97 #define SPPPSUBR_MPSAFE 1 98 #endif 99 100 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 101 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 #ifndef SPPP_KEEPALIVE_INTERVAL 108 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 109 #endif 110 111 #ifndef SPPP_NORECV_TIME 112 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 113 #endif 114 115 #ifndef SPPP_ALIVE_INTERVAL 116 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 117 #endif 118 119 /* 120 * Interface flags that can be set in an ifconfig command. 121 * 122 * Setting link0 will make the link passive, i.e. it will be marked 123 * as being administrative openable, but won't be opened to begin 124 * with. Incoming calls will be answered, or subsequent calls with 125 * -link1 will cause the administrative open of the LCP layer. 126 * 127 * Setting link1 will cause the link to auto-dial only as packets 128 * arrive to be sent. 129 * 130 * Setting IFF_DEBUG will syslog the option negotiation and state 131 * transitions at level kern.debug. Note: all logs consistently look 132 * like 133 * 134 * <if-name><unit>: <proto-name> <additional info...> 135 * 136 * with <if-name><unit> being something like "bppp0", and <proto-name> 137 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 138 */ 139 140 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 141 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 142 143 #define CONF_REQ 1 /* PPP configure request */ 144 #define CONF_ACK 2 /* PPP configure acknowledge */ 145 #define CONF_NAK 3 /* PPP configure negative ack */ 146 #define CONF_REJ 4 /* PPP configure reject */ 147 #define TERM_REQ 5 /* PPP terminate request */ 148 #define TERM_ACK 6 /* PPP terminate acknowledge */ 149 #define CODE_REJ 7 /* PPP code reject */ 150 #define PROTO_REJ 8 /* PPP protocol reject */ 151 #define ECHO_REQ 9 /* PPP echo request */ 152 #define ECHO_REPLY 10 /* PPP echo reply */ 153 #define DISC_REQ 11 /* PPP discard request */ 154 155 #define LCP_OPT_MRU 1 /* maximum receive unit */ 156 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 157 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 158 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 159 #define LCP_OPT_MAGIC 5 /* magic number */ 160 #define LCP_OPT_RESERVED 6 /* reserved */ 161 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 162 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 163 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 164 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 165 #define LCP_OPT_CALL_BACK 13 /* callback */ 166 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 167 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 168 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 169 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 170 171 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 172 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 173 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 174 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 175 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 176 177 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 178 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 179 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 180 181 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 182 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 183 184 #define PAP_REQ 1 /* PAP name/password request */ 185 #define PAP_ACK 2 /* PAP acknowledge */ 186 #define PAP_NAK 3 /* PAP fail */ 187 188 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 189 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 190 #define CHAP_SUCCESS 3 /* CHAP response ok */ 191 #define CHAP_FAILURE 4 /* CHAP response failed */ 192 193 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 194 195 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 196 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 197 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 198 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 199 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 200 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 201 202 #define PPP_NOPROTO 0 /* no authentication protocol */ 203 204 enum { 205 STATE_INITIAL = SPPP_STATE_INITIAL, 206 STATE_STARTING = SPPP_STATE_STARTING, 207 STATE_CLOSED = SPPP_STATE_CLOSED, 208 STATE_STOPPED = SPPP_STATE_STOPPED, 209 STATE_CLOSING = SPPP_STATE_CLOSING, 210 STATE_STOPPING = SPPP_STATE_STOPPING, 211 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 212 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 213 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 214 STATE_OPENED = SPPP_STATE_OPENED, 215 }; 216 217 enum cp_rcr_type { 218 CP_RCR_NONE = 0, /* initial value */ 219 CP_RCR_ACK, /* RCR+ */ 220 CP_RCR_NAK, /* RCR- */ 221 CP_RCR_REJ, /* RCR- */ 222 CP_RCR_DROP, /* DROP message */ 223 CP_RCR_ERR, /* internal error */ 224 }; 225 226 struct ppp_header { 227 uint8_t address; 228 uint8_t control; 229 uint16_t protocol; 230 } __packed; 231 #define PPP_HEADER_LEN sizeof (struct ppp_header) 232 233 struct lcp_header { 234 uint8_t type; 235 uint8_t ident; 236 uint16_t len; 237 } __packed; 238 #define LCP_HEADER_LEN sizeof (struct lcp_header) 239 240 struct cisco_packet { 241 uint32_t type; 242 uint32_t par1; 243 uint32_t par2; 244 uint16_t rel; 245 uint16_t time0; 246 uint16_t time1; 247 } __packed; 248 #define CISCO_PACKET_LEN 18 249 250 /* 251 * We follow the spelling and capitalization of RFC 1661 here, to make 252 * it easier comparing with the standard. Please refer to this RFC in 253 * case you can't make sense out of these abbreviation; it will also 254 * explain the semantics related to the various events and actions. 255 */ 256 struct cp { 257 u_short proto; /* PPP control protocol number */ 258 u_char protoidx; /* index into state table in struct sppp */ 259 u_char flags; 260 #define CP_LCP 0x01 /* this is the LCP */ 261 #define CP_AUTH 0x02 /* this is an authentication protocol */ 262 #define CP_NCP 0x04 /* this is a NCP */ 263 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 264 const char *name; /* name of this control protocol */ 265 /* event handlers */ 266 void (*Up)(struct sppp *, void *); 267 void (*Down)(struct sppp *, void *); 268 void (*Open)(struct sppp *, void *); 269 void (*Close)(struct sppp *, void *); 270 void (*TO)(struct sppp *, void *); 271 /* actions */ 272 void (*tlu)(struct sppp *); 273 void (*tld)(struct sppp *); 274 void (*tls)(const struct cp *, struct sppp *); 275 void (*tlf)(const struct cp *, struct sppp *); 276 void (*scr)(struct sppp *); 277 void (*screply)(const struct cp *, struct sppp *, u_char, 278 uint8_t, size_t, void *); 279 280 /* message parser */ 281 enum cp_rcr_type 282 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 283 uint8_t **, size_t *, size_t *); 284 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 285 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 286 }; 287 288 enum auth_role { 289 SPPP_AUTH_NOROLE = 0, 290 SPPP_AUTH_SERV = __BIT(0), 291 SPPP_AUTH_PEER = __BIT(1), 292 }; 293 294 static struct sppp *spppq; 295 static kmutex_t *spppq_lock = NULL; 296 static callout_t keepalive_ch; 297 static unsigned int sppp_keepalive_cnt = 0; 298 299 #define SPPPQ_LOCK() if (spppq_lock) \ 300 mutex_enter(spppq_lock); 301 #define SPPPQ_UNLOCK() if (spppq_lock) \ 302 mutex_exit(spppq_lock); 303 304 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 305 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 306 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 307 #define SPPP_UPGRADE(_sp) do{ \ 308 SPPP_UNLOCK(_sp); \ 309 SPPP_LOCK(_sp, RW_WRITER); \ 310 }while (0) 311 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 312 #define SPPP_WQ_SET(_wk, _func, _arg) \ 313 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 314 315 #ifdef INET 316 #ifndef SPPPSUBR_MPSAFE 317 /* 318 * The following disgusting hack gets around the problem that IP TOS 319 * can't be set yet. We want to put "interactive" traffic on a high 320 * priority queue. To decide if traffic is interactive, we check that 321 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 322 * 323 * XXX is this really still necessary? - joerg - 324 */ 325 static u_short interactive_ports[8] = { 326 0, 513, 0, 0, 327 0, 21, 0, 23, 328 }; 329 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 330 #endif /* SPPPSUBR_MPSAFE */ 331 #endif 332 333 /* almost every function needs these */ 334 #define STDDCL \ 335 struct ifnet *ifp = &sp->pp_if; \ 336 int debug = ifp->if_flags & IFF_DEBUG 337 338 static int sppp_output(struct ifnet *, struct mbuf *, 339 const struct sockaddr *, const struct rtentry *); 340 341 static void sppp_cisco_send(struct sppp *, int, int32_t, int32_t); 342 static void sppp_cisco_input(struct sppp *, struct mbuf *); 343 344 static void sppp_cp_init(const struct cp *, struct sppp *); 345 static void sppp_cp_fini(const struct cp *, struct sppp *); 346 static void sppp_cp_input(const struct cp *, struct sppp *, 347 struct mbuf *); 348 static void sppp_cp_input(const struct cp *, struct sppp *, 349 struct mbuf *); 350 static void sppp_cp_send(struct sppp *, u_short, u_char, 351 u_char, u_short, void *); 352 /* static void sppp_cp_timeout(void *arg); */ 353 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 354 static struct workqueue * 355 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 356 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 357 static void sppp_wq_set(struct sppp_work *, 358 void (*)(struct sppp *, void *), void *); 359 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 360 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 361 static void sppp_cp_to_lcp(void *); 362 static void sppp_cp_to_ipcp(void *); 363 static void sppp_cp_to_ipv6cp(void *); 364 static void sppp_auth_send(const struct cp *, struct sppp *, 365 unsigned int, unsigned int, ...); 366 static int sppp_auth_role(const struct cp *, struct sppp *); 367 static void sppp_auth_to_event(struct sppp *, void *); 368 static void sppp_auth_screply(const struct cp *, struct sppp *, 369 u_char, uint8_t, size_t, void *); 370 static void sppp_up_event(struct sppp *, void *); 371 static void sppp_down_event(struct sppp *, void *); 372 static void sppp_open_event(struct sppp *, void *); 373 static void sppp_close_event(struct sppp *, void *); 374 static void sppp_to_event(struct sppp *, void *); 375 static void sppp_rcr_event(struct sppp *, void *); 376 static void sppp_rca_event(struct sppp *, void *); 377 static void sppp_rcn_event(struct sppp *, void *); 378 static void sppp_rtr_event(struct sppp *, void *); 379 static void sppp_rta_event(struct sppp *, void *); 380 static void sppp_rxj_event(struct sppp *, void *); 381 382 static void sppp_null(struct sppp *); 383 static void sppp_tls(const struct cp *, struct sppp *); 384 static void sppp_tlf(const struct cp *, struct sppp *); 385 static void sppp_screply(const struct cp *, struct sppp *, 386 u_char, uint8_t, size_t, void *); 387 static void sppp_ifdown(struct sppp *, void *); 388 389 static void sppp_lcp_init(struct sppp *); 390 static void sppp_lcp_up(struct sppp *, void *); 391 static void sppp_lcp_down(struct sppp *, void *); 392 static void sppp_lcp_open(struct sppp *, void *); 393 static enum cp_rcr_type 394 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 395 uint8_t **, size_t *, size_t *); 396 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 397 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 398 static void sppp_lcp_tlu(struct sppp *); 399 static void sppp_lcp_tld(struct sppp *); 400 static void sppp_lcp_tls(const struct cp *, struct sppp *); 401 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 402 static void sppp_lcp_scr(struct sppp *); 403 static void sppp_lcp_check_and_close(struct sppp *); 404 static int sppp_cp_check(struct sppp *, u_char); 405 406 static void sppp_ipcp_init(struct sppp *); 407 static void sppp_ipcp_open(struct sppp *, void *); 408 static void sppp_ipcp_close(struct sppp *, void *); 409 static enum cp_rcr_type 410 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 411 uint8_t **, size_t *, size_t *); 412 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 413 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 414 static void sppp_ipcp_tlu(struct sppp *); 415 static void sppp_ipcp_scr(struct sppp *); 416 417 static void sppp_ipv6cp_init(struct sppp *); 418 static void sppp_ipv6cp_open(struct sppp *, void *); 419 static enum cp_rcr_type 420 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 421 uint8_t **, size_t *, size_t *); 422 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 423 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 424 static void sppp_ipv6cp_tlu(struct sppp *); 425 static void sppp_ipv6cp_scr(struct sppp *); 426 427 static void sppp_pap_input(struct sppp *, struct mbuf *); 428 static void sppp_pap_init(struct sppp *); 429 static void sppp_pap_tlu(struct sppp *); 430 static void sppp_pap_scr(struct sppp *); 431 static void sppp_pap_scr(struct sppp *); 432 433 static void sppp_chap_input(struct sppp *, struct mbuf *); 434 static void sppp_chap_init(struct sppp *); 435 static void sppp_chap_open(struct sppp *, void *); 436 static void sppp_chap_tlu(struct sppp *); 437 static void sppp_chap_scr(struct sppp *); 438 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 439 440 static const char *sppp_auth_type_name(u_short, u_char); 441 static const char *sppp_cp_type_name(u_char); 442 static const char *sppp_dotted_quad(uint32_t); 443 static const char *sppp_ipcp_opt_name(u_char); 444 #ifdef INET6 445 static const char *sppp_ipv6cp_opt_name(u_char); 446 #endif 447 static const char *sppp_lcp_opt_name(u_char); 448 static const char *sppp_phase_name(int); 449 static const char *sppp_proto_name(u_short); 450 static const char *sppp_state_name(int); 451 static int sppp_params(struct sppp *, u_long, void *); 452 #ifdef INET 453 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 454 static void sppp_set_ip_addrs(struct sppp *); 455 static void sppp_clear_ip_addrs(struct sppp *); 456 #endif 457 static void sppp_keepalive(void *); 458 static void sppp_phase_network(struct sppp *); 459 static void sppp_print_bytes(const u_char *, u_short); 460 static void sppp_print_string(const char *, u_short); 461 #ifdef INET6 462 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 463 struct in6_addr *, struct in6_addr *); 464 #ifdef IPV6CP_MYIFID_DYN 465 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 466 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 467 #endif 468 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 469 #endif 470 471 static void sppp_notify_up(struct sppp *); 472 static void sppp_notify_down(struct sppp *); 473 static void sppp_notify_tls_wlocked(struct sppp *); 474 static void sppp_notify_tlf_wlocked(struct sppp *); 475 #ifdef INET6 476 static void sppp_notify_con_wlocked(struct sppp *); 477 #endif 478 static void sppp_notify_con(struct sppp *); 479 480 static void sppp_notify_chg_wlocked(struct sppp *); 481 482 /* our control protocol descriptors */ 483 static const struct cp lcp = { 484 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 485 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 486 sppp_close_event, sppp_to_event, 487 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 488 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 489 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 490 }; 491 492 static const struct cp ipcp = { 493 PPP_IPCP, IDX_IPCP, 494 #ifdef INET 495 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 496 #else 497 0, 498 #endif 499 "ipcp", 500 sppp_up_event, sppp_down_event, sppp_ipcp_open, 501 sppp_ipcp_close, sppp_to_event, 502 sppp_ipcp_tlu, sppp_null, sppp_tls, 503 sppp_tlf, sppp_ipcp_scr, sppp_screply, 504 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 505 }; 506 507 static const struct cp ipv6cp = { 508 PPP_IPV6CP, IDX_IPV6CP, 509 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 510 CP_NCP, 511 #else 512 0, 513 #endif 514 "ipv6cp", 515 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 516 sppp_close_event, sppp_to_event, 517 sppp_ipv6cp_tlu, sppp_null, sppp_tls, 518 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 519 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 520 }; 521 522 static const struct cp pap = { 523 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 524 sppp_up_event, sppp_down_event, sppp_open_event, 525 sppp_close_event, sppp_to_event, 526 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 527 sppp_pap_scr, sppp_auth_screply, 528 NULL, NULL, NULL 529 }; 530 531 static const struct cp chap = { 532 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 533 sppp_up_event, sppp_down_event, sppp_chap_open, 534 sppp_close_event, sppp_auth_to_event, 535 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 536 sppp_chap_scr, sppp_auth_screply, 537 NULL, NULL, NULL 538 }; 539 540 static const struct cp *cps[IDX_COUNT] = { 541 &lcp, /* IDX_LCP */ 542 &ipcp, /* IDX_IPCP */ 543 &ipv6cp, /* IDX_IPV6CP */ 544 &pap, /* IDX_PAP */ 545 &chap, /* IDX_CHAP */ 546 }; 547 548 static inline u_int 549 sppp_proto2authproto(u_short proto) 550 { 551 552 switch (proto) { 553 case PPP_PAP: 554 return SPPP_AUTHPROTO_PAP; 555 case PPP_CHAP: 556 return SPPP_AUTHPROTO_CHAP; 557 } 558 559 return SPPP_AUTHPROTO_NONE; 560 } 561 562 static inline u_short 563 sppp_authproto2proto(u_int authproto) 564 { 565 566 switch (authproto) { 567 case SPPP_AUTHPROTO_PAP: 568 return PPP_PAP; 569 case SPPP_AUTHPROTO_CHAP: 570 return PPP_CHAP; 571 } 572 573 return PPP_NOPROTO; 574 } 575 576 static void 577 sppp_change_phase(struct sppp *sp, int phase) 578 { 579 STDDCL; 580 581 KASSERT(SPPP_WLOCKED(sp)); 582 583 if (sp->pp_phase == phase) 584 return; 585 586 sp->pp_phase = phase; 587 588 if (phase == SPPP_PHASE_NETWORK) 589 if_link_state_change(ifp, LINK_STATE_UP); 590 else 591 if_link_state_change(ifp, LINK_STATE_DOWN); 592 593 if (debug) 594 { 595 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 596 sppp_phase_name(sp->pp_phase)); 597 } 598 } 599 600 /* 601 * Exported functions, comprising our interface to the lower layer. 602 */ 603 604 /* 605 * Process the received packet. 606 */ 607 void 608 sppp_input(struct ifnet *ifp, struct mbuf *m) 609 { 610 struct ppp_header *h = NULL; 611 pktqueue_t *pktq = NULL; 612 struct ifqueue *inq = NULL; 613 uint16_t protocol; 614 struct sppp *sp = (struct sppp *)ifp; 615 int debug = ifp->if_flags & IFF_DEBUG; 616 int isr = 0; 617 618 SPPP_LOCK(sp, RW_READER); 619 620 if (ifp->if_flags & IFF_UP) { 621 /* Count received bytes, add hardware framing */ 622 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 623 /* Note time of last receive */ 624 sp->pp_last_receive = time_uptime; 625 } 626 627 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 628 /* Too small packet, drop it. */ 629 if (debug) 630 log(LOG_DEBUG, 631 "%s: input packet is too small, %d bytes\n", 632 ifp->if_xname, m->m_pkthdr.len); 633 goto drop; 634 } 635 636 if (sp->pp_flags & PP_NOFRAMING) { 637 memcpy(&protocol, mtod(m, void *), 2); 638 protocol = ntohs(protocol); 639 m_adj(m, 2); 640 } else { 641 642 /* Get PPP header. */ 643 h = mtod(m, struct ppp_header *); 644 m_adj(m, PPP_HEADER_LEN); 645 646 switch (h->address) { 647 case PPP_ALLSTATIONS: 648 if (h->control != PPP_UI) 649 goto invalid; 650 if (sp->pp_flags & PP_CISCO) { 651 if (debug) 652 log(LOG_DEBUG, 653 "%s: PPP packet in Cisco mode " 654 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 655 ifp->if_xname, 656 h->address, h->control, ntohs(h->protocol)); 657 goto drop; 658 } 659 break; 660 case CISCO_MULTICAST: 661 case CISCO_UNICAST: 662 /* Don't check the control field here (RFC 1547). */ 663 if (! (sp->pp_flags & PP_CISCO)) { 664 if (debug) 665 log(LOG_DEBUG, 666 "%s: Cisco packet in PPP mode " 667 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 668 ifp->if_xname, 669 h->address, h->control, ntohs(h->protocol)); 670 goto drop; 671 } 672 switch (ntohs(h->protocol)) { 673 default: 674 if_statinc(ifp, if_noproto); 675 goto invalid; 676 case CISCO_KEEPALIVE: 677 SPPP_UNLOCK(sp); 678 sppp_cisco_input((struct sppp *) ifp, m); 679 m_freem(m); 680 return; 681 #ifdef INET 682 case ETHERTYPE_IP: 683 pktq = ip_pktq; 684 break; 685 #endif 686 #ifdef INET6 687 case ETHERTYPE_IPV6: 688 pktq = ip6_pktq; 689 break; 690 #endif 691 } 692 goto queue_pkt; 693 default: /* Invalid PPP packet. */ 694 invalid: 695 if (debug) 696 log(LOG_DEBUG, 697 "%s: invalid input packet " 698 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 699 ifp->if_xname, 700 h->address, h->control, ntohs(h->protocol)); 701 goto drop; 702 } 703 protocol = ntohs(h->protocol); 704 } 705 706 switch (protocol) { 707 reject_protocol: 708 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 709 uint16_t prot = htons(protocol); 710 711 SPPP_UPGRADE(sp); 712 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 713 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 714 &prot); 715 SPPP_DOWNGRADE(sp); 716 } 717 if (debug) 718 log(LOG_DEBUG, 719 "%s: invalid input protocol " 720 "<proto=0x%x>\n", ifp->if_xname, protocol); 721 if_statinc(ifp, if_noproto); 722 goto drop; 723 default: 724 goto reject_protocol; 725 case PPP_LCP: 726 SPPP_UNLOCK(sp); 727 sppp_cp_input(&lcp, sp, m); 728 /* already m_freem(m) */ 729 return; 730 case PPP_PAP: 731 SPPP_UNLOCK(sp); 732 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 733 sppp_pap_input(sp, m); 734 } 735 m_freem(m); 736 return; 737 case PPP_CHAP: 738 SPPP_UNLOCK(sp); 739 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 740 sppp_chap_input(sp, m); 741 } 742 m_freem(m); 743 return; 744 #ifdef INET 745 case PPP_IPCP: 746 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 747 goto reject_protocol; 748 SPPP_UNLOCK(sp); 749 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 750 sppp_cp_input(&ipcp, sp, m); 751 /* already m_freem(m) */ 752 } else { 753 m_freem(m); 754 } 755 return; 756 case PPP_IP: 757 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 758 sp->pp_last_activity = time_uptime; 759 pktq = ip_pktq; 760 } 761 break; 762 #endif 763 #ifdef INET6 764 case PPP_IPV6CP: 765 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 766 goto reject_protocol; 767 SPPP_UNLOCK(sp); 768 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 769 sppp_cp_input(&ipv6cp, sp, m); 770 /* already m_freem(m) */ 771 } else { 772 m_freem(m); 773 } 774 return; 775 776 case PPP_IPV6: 777 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 778 sp->pp_last_activity = time_uptime; 779 pktq = ip6_pktq; 780 } 781 break; 782 #endif 783 } 784 785 queue_pkt: 786 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 787 goto drop; 788 } 789 790 /* Check queue. */ 791 if (__predict_true(pktq)) { 792 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 793 goto drop; 794 } 795 SPPP_UNLOCK(sp); 796 return; 797 } 798 799 SPPP_UNLOCK(sp); 800 801 IFQ_LOCK(inq); 802 if (IF_QFULL(inq)) { 803 /* Queue overflow. */ 804 IF_DROP(inq); 805 IFQ_UNLOCK(inq); 806 if (debug) 807 log(LOG_DEBUG, "%s: protocol queue overflow\n", 808 ifp->if_xname); 809 810 SPPP_LOCK(sp, RW_READER); 811 goto drop; 812 } 813 IF_ENQUEUE(inq, m); 814 IFQ_UNLOCK(inq); 815 schednetisr(isr); 816 return; 817 818 drop: 819 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 820 m_freem(m); 821 SPPP_UNLOCK(sp); 822 return; 823 } 824 825 /* 826 * Enqueue transmit packet. 827 */ 828 static int 829 sppp_output(struct ifnet *ifp, struct mbuf *m, 830 const struct sockaddr *dst, const struct rtentry *rt) 831 { 832 struct sppp *sp = (struct sppp *) ifp; 833 struct ppp_header *h = NULL; 834 #ifndef SPPPSUBR_MPSAFE 835 struct ifqueue *ifq = NULL; /* XXX */ 836 #endif 837 int s, error = 0; 838 uint16_t protocol; 839 size_t pktlen; 840 841 s = splnet(); 842 SPPP_LOCK(sp, RW_READER); 843 844 sp->pp_last_activity = time_uptime; 845 846 if ((ifp->if_flags & IFF_UP) == 0 || 847 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 848 SPPP_UNLOCK(sp); 849 splx(s); 850 851 m_freem(m); 852 if_statinc(ifp, if_oerrors); 853 return (ENETDOWN); 854 } 855 856 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 857 /* ignore packets that have no enabled NCP */ 858 if ((dst->sa_family == AF_INET && 859 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 860 (dst->sa_family == AF_INET6 && 861 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 862 SPPP_UNLOCK(sp); 863 splx(s); 864 865 m_freem(m); 866 if_statinc(ifp, if_oerrors); 867 return (ENETDOWN); 868 } 869 /* 870 * Interface is not yet running, but auto-dial. Need 871 * to start LCP for it. 872 */ 873 ifp->if_flags |= IFF_RUNNING; 874 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 875 } 876 877 /* 878 * If the queueing discipline needs packet classification, 879 * do it before prepending link headers. 880 */ 881 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 882 883 #ifdef INET 884 if (dst->sa_family == AF_INET) { 885 struct ip *ip = NULL; 886 #ifndef SPPPSUBR_MPSAFE 887 struct tcphdr *th = NULL; 888 #endif 889 890 if (m->m_len >= sizeof(struct ip)) { 891 ip = mtod(m, struct ip *); 892 #ifndef SPPPSUBR_MPSAFE 893 if (ip->ip_p == IPPROTO_TCP && 894 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 895 sizeof(struct tcphdr)) { 896 th = (struct tcphdr *) 897 ((char *)ip + (ip->ip_hl << 2)); 898 } 899 #endif 900 } else 901 ip = NULL; 902 903 /* 904 * When using dynamic local IP address assignment by using 905 * 0.0.0.0 as a local address, the first TCP session will 906 * not connect because the local TCP checksum is computed 907 * using 0.0.0.0 which will later become our real IP address 908 * so the TCP checksum computed at the remote end will 909 * become invalid. So we 910 * - don't let packets with src ip addr 0 thru 911 * - we flag TCP packets with src ip 0 as an error 912 */ 913 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 914 uint8_t proto = ip->ip_p; 915 916 SPPP_UNLOCK(sp); 917 splx(s); 918 919 m_freem(m); 920 if (proto == IPPROTO_TCP) 921 return (EADDRNOTAVAIL); 922 else 923 return (0); 924 } 925 926 #ifndef SPPPSUBR_MPSAFE 927 /* 928 * Put low delay, telnet, rlogin and ftp control packets 929 * in front of the queue. 930 */ 931 if (!IF_QFULL(&sp->pp_fastq) && 932 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 933 (th && (INTERACTIVE(ntohs(th->th_sport)) || 934 INTERACTIVE(ntohs(th->th_dport)))))) 935 ifq = &sp->pp_fastq; 936 #endif /* !SPPPSUBR_MPSAFE */ 937 } 938 #endif 939 940 #ifdef INET6 941 if (dst->sa_family == AF_INET6) { 942 /* XXX do something tricky here? */ 943 } 944 #endif 945 946 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 947 /* 948 * Prepend general data packet PPP header. For now, IP only. 949 */ 950 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 951 if (! m) { 952 if (ifp->if_flags & IFF_DEBUG) 953 log(LOG_DEBUG, "%s: no memory for transmit header\n", 954 ifp->if_xname); 955 if_statinc(ifp, if_oerrors); 956 SPPP_UNLOCK(sp); 957 splx(s); 958 return (ENOBUFS); 959 } 960 /* 961 * May want to check size of packet 962 * (albeit due to the implementation it's always enough) 963 */ 964 h = mtod(m, struct ppp_header *); 965 if (sp->pp_flags & PP_CISCO) { 966 h->address = CISCO_UNICAST; /* unicast address */ 967 h->control = 0; 968 } else { 969 h->address = PPP_ALLSTATIONS; /* broadcast address */ 970 h->control = PPP_UI; /* Unnumbered Info */ 971 } 972 } 973 974 switch (dst->sa_family) { 975 #ifdef INET 976 case AF_INET: /* Internet Protocol */ 977 if (sp->pp_flags & PP_CISCO) 978 protocol = htons(ETHERTYPE_IP); 979 else { 980 /* 981 * Don't choke with an ENETDOWN early. It's 982 * possible that we just started dialing out, 983 * so don't drop the packet immediately. If 984 * we notice that we run out of buffer space 985 * below, we will however remember that we are 986 * not ready to carry IP packets, and return 987 * ENETDOWN, as opposed to ENOBUFS. 988 */ 989 protocol = htons(PPP_IP); 990 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 991 if (ifp->if_flags & IFF_AUTO) { 992 error = ENETDOWN; 993 } else { 994 IF_DROP(&ifp->if_snd); 995 SPPP_UNLOCK(sp); 996 splx(s); 997 998 m_freem(m); 999 if_statinc(ifp, if_oerrors); 1000 return (ENETDOWN); 1001 } 1002 } 1003 } 1004 break; 1005 #endif 1006 #ifdef INET6 1007 case AF_INET6: /* Internet Protocol version 6 */ 1008 if (sp->pp_flags & PP_CISCO) 1009 protocol = htons(ETHERTYPE_IPV6); 1010 else { 1011 /* 1012 * Don't choke with an ENETDOWN early. It's 1013 * possible that we just started dialing out, 1014 * so don't drop the packet immediately. If 1015 * we notice that we run out of buffer space 1016 * below, we will however remember that we are 1017 * not ready to carry IP packets, and return 1018 * ENETDOWN, as opposed to ENOBUFS. 1019 */ 1020 protocol = htons(PPP_IPV6); 1021 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 1022 if (ifp->if_flags & IFF_AUTO) { 1023 error = ENETDOWN; 1024 } else { 1025 IF_DROP(&ifp->if_snd); 1026 SPPP_UNLOCK(sp); 1027 splx(s); 1028 1029 m_freem(m); 1030 if_statinc(ifp, if_oerrors); 1031 return (ENETDOWN); 1032 } 1033 } 1034 } 1035 break; 1036 #endif 1037 default: 1038 m_freem(m); 1039 if_statinc(ifp, if_oerrors); 1040 SPPP_UNLOCK(sp); 1041 splx(s); 1042 return (EAFNOSUPPORT); 1043 } 1044 1045 if (sp->pp_flags & PP_NOFRAMING) { 1046 M_PREPEND(m, 2, M_DONTWAIT); 1047 if (m == NULL) { 1048 if (ifp->if_flags & IFF_DEBUG) 1049 log(LOG_DEBUG, "%s: no memory for transmit header\n", 1050 ifp->if_xname); 1051 if_statinc(ifp, if_oerrors); 1052 SPPP_UNLOCK(sp); 1053 splx(s); 1054 return (ENOBUFS); 1055 } 1056 *mtod(m, uint16_t *) = protocol; 1057 } else { 1058 h->protocol = protocol; 1059 } 1060 1061 pktlen = m->m_pkthdr.len; 1062 #ifdef SPPPSUBR_MPSAFE 1063 SPPP_UNLOCK(sp); 1064 error = if_transmit_lock(ifp, m); 1065 SPPP_LOCK(sp, RW_READER); 1066 if (error == 0) 1067 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1068 #else /* !SPPPSUBR_MPSAFE */ 1069 error = ifq_enqueue2(ifp, ifq, m); 1070 1071 if (error == 0) { 1072 /* 1073 * Count output packets and bytes. 1074 * The packet length includes header + additional hardware 1075 * framing according to RFC 1333. 1076 */ 1077 if (!(ifp->if_flags & IFF_OACTIVE)) { 1078 SPPP_UNLOCK(sp); 1079 if_start_lock(ifp); 1080 SPPP_LOCK(sp, RW_READER); 1081 } 1082 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1083 } 1084 #endif /* !SPPPSUBR_MPSAFE */ 1085 SPPP_UNLOCK(sp); 1086 splx(s); 1087 return error; 1088 } 1089 1090 void 1091 sppp_attach(struct ifnet *ifp) 1092 { 1093 struct sppp *sp = (struct sppp *) ifp; 1094 char xnamebuf[MAXCOMLEN]; 1095 1096 /* Initialize keepalive handler. */ 1097 if (! spppq) { 1098 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1099 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1100 } 1101 1102 if (! spppq_lock) 1103 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1104 1105 sp->pp_if.if_type = IFT_PPP; 1106 sp->pp_if.if_output = sppp_output; 1107 sp->pp_fastq.ifq_maxlen = 32; 1108 sp->pp_cpq.ifq_maxlen = 20; 1109 sp->pp_loopcnt = 0; 1110 sp->pp_alivecnt = 0; 1111 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1112 sp->pp_last_activity = 0; 1113 sp->pp_last_receive = 0; 1114 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1115 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1116 sp->pp_idle_timeout = 0; 1117 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1118 sp->pp_phase = SPPP_PHASE_DEAD; 1119 sp->pp_up = sppp_notify_up; 1120 sp->pp_down = sppp_notify_down; 1121 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1122 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1123 memset(sp->scp, 0, sizeof(sp->scp)); 1124 rw_init(&sp->pp_lock); 1125 1126 if_alloc_sadl(ifp); 1127 1128 /* Lets not beat about the bush, we know we're down. */ 1129 ifp->if_link_state = LINK_STATE_DOWN; 1130 1131 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1132 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1133 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1134 1135 memset(&sp->myauth, 0, sizeof sp->myauth); 1136 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1137 SPPP_LOCK(sp, RW_WRITER); 1138 sppp_lcp_init(sp); 1139 sppp_ipcp_init(sp); 1140 sppp_ipv6cp_init(sp); 1141 sppp_pap_init(sp); 1142 sppp_chap_init(sp); 1143 SPPP_UNLOCK(sp); 1144 1145 SPPPQ_LOCK(); 1146 /* Insert new entry into the keepalive list. */ 1147 sp->pp_next = spppq; 1148 spppq = sp; 1149 SPPPQ_UNLOCK(); 1150 } 1151 1152 void 1153 sppp_detach(struct ifnet *ifp) 1154 { 1155 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1156 1157 /* Remove the entry from the keepalive list. */ 1158 SPPPQ_LOCK(); 1159 for (q = &spppq; (p = *q); q = &p->pp_next) 1160 if (p == sp) { 1161 *q = p->pp_next; 1162 break; 1163 } 1164 SPPPQ_UNLOCK(); 1165 1166 if (! spppq) { 1167 /* Stop keepalive handler. */ 1168 callout_stop(&keepalive_ch); 1169 mutex_obj_free(spppq_lock); 1170 spppq_lock = NULL; 1171 } 1172 1173 sppp_cp_fini(&lcp, sp); 1174 sppp_cp_fini(&ipcp, sp); 1175 sppp_cp_fini(&pap, sp); 1176 sppp_cp_fini(&chap, sp); 1177 #ifdef INET6 1178 sppp_cp_fini(&ipv6cp, sp); 1179 #endif 1180 sppp_wq_destroy(sp, sp->wq_cp); 1181 1182 /* free authentication info */ 1183 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1184 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1185 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1186 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1187 rw_destroy(&sp->pp_lock); 1188 } 1189 1190 /* 1191 * Flush the interface output queue. 1192 */ 1193 void 1194 sppp_flush(struct ifnet *ifp) 1195 { 1196 struct sppp *sp = (struct sppp *) ifp; 1197 1198 SPPP_LOCK(sp, RW_WRITER); 1199 IFQ_PURGE(&sp->pp_if.if_snd); 1200 IF_PURGE(&sp->pp_fastq); 1201 IF_PURGE(&sp->pp_cpq); 1202 SPPP_UNLOCK(sp); 1203 } 1204 1205 /* 1206 * Check if the output queue is empty. 1207 */ 1208 int 1209 sppp_isempty(struct ifnet *ifp) 1210 { 1211 struct sppp *sp = (struct sppp *) ifp; 1212 int empty, s; 1213 1214 s = splnet(); 1215 SPPP_LOCK(sp, RW_READER); 1216 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1217 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1218 SPPP_UNLOCK(sp); 1219 splx(s); 1220 return (empty); 1221 } 1222 1223 /* 1224 * Get next packet to send. 1225 */ 1226 struct mbuf * 1227 sppp_dequeue(struct ifnet *ifp) 1228 { 1229 struct sppp *sp = (struct sppp *) ifp; 1230 struct mbuf *m; 1231 int s; 1232 1233 s = splnet(); 1234 SPPP_LOCK(sp, RW_WRITER); 1235 /* 1236 * Process only the control protocol queue until we have at 1237 * least one NCP open. 1238 * 1239 * Do always serve all three queues in Cisco mode. 1240 */ 1241 IF_DEQUEUE(&sp->pp_cpq, m); 1242 if (m == NULL && 1243 (sppp_cp_check(sp, CP_NCP) || (sp->pp_flags & PP_CISCO) != 0)) { 1244 IF_DEQUEUE(&sp->pp_fastq, m); 1245 if (m == NULL) 1246 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1247 } 1248 SPPP_UNLOCK(sp); 1249 splx(s); 1250 return m; 1251 } 1252 1253 /* 1254 * Process an ioctl request. Called on low priority level. 1255 */ 1256 int 1257 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1258 { 1259 struct lwp *l = curlwp; /* XXX */ 1260 struct ifreq *ifr = (struct ifreq *) data; 1261 struct ifaddr *ifa = (struct ifaddr *) data; 1262 struct sppp *sp = (struct sppp *) ifp; 1263 int s, error=0, going_up, going_down; 1264 u_short newmode; 1265 u_long lcp_mru; 1266 1267 s = splnet(); 1268 switch (cmd) { 1269 case SIOCINITIFADDR: 1270 ifa->ifa_rtrequest = p2p_rtrequest; 1271 break; 1272 1273 case SIOCSIFFLAGS: 1274 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1275 break; 1276 1277 SPPP_LOCK(sp, RW_WRITER); 1278 going_up = ifp->if_flags & IFF_UP && 1279 (ifp->if_flags & IFF_RUNNING) == 0; 1280 going_down = (ifp->if_flags & IFF_UP) == 0 && 1281 ifp->if_flags & IFF_RUNNING; 1282 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1283 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1284 /* sanity */ 1285 newmode = IFF_PASSIVE; 1286 ifp->if_flags &= ~IFF_AUTO; 1287 } 1288 1289 if (going_up || going_down) { 1290 sp->lcp.reestablish = false; 1291 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1292 } 1293 if (going_up && newmode == 0) { 1294 /* neither auto-dial nor passive */ 1295 ifp->if_flags |= IFF_RUNNING; 1296 if (!(sp->pp_flags & PP_CISCO)) { 1297 sppp_wq_add(sp->wq_cp, 1298 &sp->scp[IDX_LCP].work_open); 1299 } 1300 } else if (going_down) { 1301 SPPP_UNLOCK(sp); 1302 sppp_flush(ifp); 1303 SPPP_LOCK(sp, RW_WRITER); 1304 1305 ifp->if_flags &= ~IFF_RUNNING; 1306 } 1307 SPPP_UNLOCK(sp); 1308 break; 1309 1310 case SIOCSIFMTU: 1311 if (ifr->ifr_mtu < PPP_MINMRU || 1312 ifr->ifr_mtu > PP_MTU) { 1313 error = EINVAL; 1314 break; 1315 } 1316 1317 error = ifioctl_common(ifp, cmd, data); 1318 if (error == ENETRESET) 1319 error = 0; 1320 1321 SPPP_LOCK(sp, RW_WRITER); 1322 lcp_mru = sp->lcp.mru; 1323 if (ifp->if_mtu < PP_MTU) { 1324 sp->lcp.mru = ifp->if_mtu; 1325 } else { 1326 sp->lcp.mru = PP_MTU; 1327 } 1328 if (lcp_mru != sp->lcp.mru) 1329 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1330 1331 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1332 ifp->if_mtu > sp->lcp.their_mru) { 1333 sp->pp_saved_mtu = ifp->if_mtu; 1334 ifp->if_mtu = sp->lcp.their_mru; 1335 1336 if (ifp->if_flags & IFF_DEBUG) { 1337 log(LOG_DEBUG, 1338 "%s: setting MTU " 1339 "from %"PRIu64" bytes " 1340 "to %"PRIu64" bytes\n", 1341 ifp->if_xname, sp->pp_saved_mtu, 1342 ifp->if_mtu); 1343 } 1344 } 1345 SPPP_UNLOCK(sp); 1346 break; 1347 1348 case SIOCGIFMTU: 1349 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1350 error = 0; 1351 break; 1352 case SIOCADDMULTI: 1353 case SIOCDELMULTI: 1354 break; 1355 1356 case SPPPSETAUTHCFG: 1357 case SPPPSETLCPCFG: 1358 case SPPPSETNCPCFG: 1359 case SPPPSETIDLETO: 1360 case SPPPSETAUTHFAILURE: 1361 case SPPPSETDNSOPTS: 1362 case SPPPSETKEEPALIVE: 1363 #if defined(COMPAT_50) || defined(MODULAR) 1364 case __SPPPSETIDLETO50: 1365 case __SPPPSETKEEPALIVE50: 1366 #endif /* COMPAT_50 || MODULAR */ 1367 error = kauth_authorize_network(l->l_cred, 1368 KAUTH_NETWORK_INTERFACE, 1369 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1370 NULL); 1371 if (error) 1372 break; 1373 error = sppp_params(sp, cmd, data); 1374 break; 1375 1376 case SPPPGETAUTHCFG: 1377 case SPPPGETLCPCFG: 1378 case SPPPGETNCPCFG: 1379 case SPPPGETAUTHFAILURES: 1380 error = kauth_authorize_network(l->l_cred, 1381 KAUTH_NETWORK_INTERFACE, 1382 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1383 NULL); 1384 if (error) 1385 break; 1386 error = sppp_params(sp, cmd, data); 1387 break; 1388 1389 case SPPPGETSTATUS: 1390 case SPPPGETSTATUSNCP: 1391 case SPPPGETIDLETO: 1392 case SPPPGETDNSOPTS: 1393 case SPPPGETDNSADDRS: 1394 case SPPPGETKEEPALIVE: 1395 #if defined(COMPAT_50) || defined(MODULAR) 1396 case __SPPPGETIDLETO50: 1397 case __SPPPGETKEEPALIVE50: 1398 #endif /* COMPAT_50 || MODULAR */ 1399 case SPPPGETLCPSTATUS: 1400 case SPPPGETIPCPSTATUS: 1401 case SPPPGETIPV6CPSTATUS: 1402 error = sppp_params(sp, cmd, data); 1403 break; 1404 1405 default: 1406 error = ifioctl_common(ifp, cmd, data); 1407 break; 1408 } 1409 splx(s); 1410 return (error); 1411 } 1412 1413 /* 1414 * Cisco framing implementation. 1415 */ 1416 1417 /* 1418 * Handle incoming Cisco keepalive protocol packets. 1419 */ 1420 static void 1421 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1422 { 1423 STDDCL; 1424 struct cisco_packet *h; 1425 #ifdef INET 1426 uint32_t me, mymask = 0; /* XXX: GCC */ 1427 #endif 1428 1429 SPPP_LOCK(sp, RW_WRITER); 1430 1431 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1432 if (debug) 1433 log(LOG_DEBUG, 1434 "%s: cisco invalid packet length: %d bytes\n", 1435 ifp->if_xname, m->m_pkthdr.len); 1436 SPPP_UNLOCK(sp); 1437 return; 1438 } 1439 h = mtod(m, struct cisco_packet *); 1440 if (debug) 1441 log(LOG_DEBUG, 1442 "%s: cisco input: %d bytes " 1443 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1444 ifp->if_xname, m->m_pkthdr.len, 1445 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1446 (u_int)h->time0, (u_int)h->time1); 1447 switch (ntohl(h->type)) { 1448 default: 1449 if (debug) 1450 addlog("%s: cisco unknown packet type: 0x%x\n", 1451 ifp->if_xname, ntohl(h->type)); 1452 break; 1453 case CISCO_ADDR_REPLY: 1454 /* Reply on address request, ignore */ 1455 break; 1456 case CISCO_KEEPALIVE_REQ: 1457 sp->pp_alivecnt = 0; 1458 sp->scp[IDX_LCP].rseq = ntohl(h->par1); 1459 if (sp->scp[IDX_LCP].seq == sp->scp[IDX_LCP].rseq) { 1460 /* Local and remote sequence numbers are equal. 1461 * Probably, the line is in loopback mode. */ 1462 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1463 printf ("%s: loopback\n", 1464 ifp->if_xname); 1465 sp->pp_loopcnt = 0; 1466 if (ifp->if_flags & IFF_UP) { 1467 SPPP_UNLOCK(sp); 1468 if_down(ifp); 1469 SPPP_LOCK(sp, RW_WRITER); 1470 1471 IF_PURGE(&sp->pp_cpq); 1472 } 1473 } 1474 ++sp->pp_loopcnt; 1475 1476 /* Generate new local sequence number */ 1477 sp->scp[IDX_LCP].seq = cprng_fast32(); 1478 break; 1479 } 1480 sp->pp_loopcnt = 0; 1481 if (! (ifp->if_flags & IFF_UP) && 1482 (ifp->if_flags & IFF_RUNNING)) { 1483 SPPP_UNLOCK(sp); 1484 if_up(ifp); 1485 SPPP_LOCK(sp, RW_WRITER); 1486 } 1487 break; 1488 case CISCO_ADDR_REQ: 1489 #ifdef INET 1490 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1491 if (me != 0L) 1492 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1493 #endif 1494 break; 1495 } 1496 SPPP_UNLOCK(sp); 1497 } 1498 1499 /* 1500 * Send Cisco keepalive packet. 1501 */ 1502 static void 1503 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1504 { 1505 STDDCL; 1506 struct ppp_header *h; 1507 struct cisco_packet *ch; 1508 struct mbuf *m; 1509 uint32_t t; 1510 1511 KASSERT(SPPP_WLOCKED(sp)); 1512 1513 t = time_uptime * 1000; 1514 MGETHDR(m, M_DONTWAIT, MT_DATA); 1515 if (! m) 1516 return; 1517 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1518 m_reset_rcvif(m); 1519 1520 h = mtod(m, struct ppp_header *); 1521 h->address = CISCO_MULTICAST; 1522 h->control = 0; 1523 h->protocol = htons(CISCO_KEEPALIVE); 1524 1525 ch = (struct cisco_packet *)(h + 1); 1526 ch->type = htonl(type); 1527 ch->par1 = htonl(par1); 1528 ch->par2 = htonl(par2); 1529 ch->rel = -1; 1530 1531 ch->time0 = htons((u_short)(t >> 16)); 1532 ch->time1 = htons((u_short) t); 1533 1534 if (debug) 1535 log(LOG_DEBUG, 1536 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1537 ifp->if_xname, ntohl(ch->type), ch->par1, 1538 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1539 (u_int)ch->time1); 1540 1541 if (IF_QFULL(&sp->pp_cpq)) { 1542 IF_DROP(&sp->pp_fastq); 1543 IF_DROP(&ifp->if_snd); 1544 m_freem(m); 1545 if_statinc(ifp, if_oerrors); 1546 return; 1547 } 1548 1549 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1550 IF_ENQUEUE(&sp->pp_cpq, m); 1551 1552 if (! (ifp->if_flags & IFF_OACTIVE)) { 1553 SPPP_UNLOCK(sp); 1554 if_start_lock(ifp); 1555 SPPP_LOCK(sp, RW_WRITER); 1556 } 1557 } 1558 1559 /* 1560 * PPP protocol implementation. 1561 */ 1562 1563 /* 1564 * Send PPP control protocol packet. 1565 */ 1566 static void 1567 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1568 u_char ident, u_short len, void *data) 1569 { 1570 STDDCL; 1571 struct lcp_header *lh; 1572 struct mbuf *m; 1573 size_t pkthdrlen; 1574 1575 KASSERT(SPPP_WLOCKED(sp)); 1576 1577 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1578 1579 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1580 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1581 MGETHDR(m, M_DONTWAIT, MT_DATA); 1582 if (! m) { 1583 return; 1584 } 1585 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1586 m_reset_rcvif(m); 1587 1588 if (sp->pp_flags & PP_NOFRAMING) { 1589 *mtod(m, uint16_t *) = htons(proto); 1590 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1591 } else { 1592 struct ppp_header *h; 1593 h = mtod(m, struct ppp_header *); 1594 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1595 h->control = PPP_UI; /* Unnumbered Info */ 1596 h->protocol = htons(proto); /* Link Control Protocol */ 1597 lh = (struct lcp_header *)(h + 1); 1598 } 1599 lh->type = type; 1600 lh->ident = ident; 1601 lh->len = htons(LCP_HEADER_LEN + len); 1602 if (len) 1603 memcpy(lh + 1, data, len); 1604 1605 if (debug) { 1606 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1607 ifp->if_xname, 1608 sppp_proto_name(proto), 1609 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1610 if (len) 1611 sppp_print_bytes((u_char *)(lh + 1), len); 1612 addlog(">\n"); 1613 } 1614 if (IF_QFULL(&sp->pp_cpq)) { 1615 IF_DROP(&sp->pp_fastq); 1616 IF_DROP(&ifp->if_snd); 1617 m_freem(m); 1618 if_statinc(ifp, if_oerrors); 1619 return; 1620 } 1621 1622 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1623 IF_ENQUEUE(&sp->pp_cpq, m); 1624 1625 if (! (ifp->if_flags & IFF_OACTIVE)) { 1626 SPPP_UNLOCK(sp); 1627 if_start_lock(ifp); 1628 SPPP_LOCK(sp, RW_WRITER); 1629 } 1630 } 1631 1632 static void 1633 sppp_cp_to_lcp(void *xsp) 1634 { 1635 struct sppp *sp = xsp; 1636 1637 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1638 } 1639 1640 static void 1641 sppp_cp_to_ipcp(void *xsp) 1642 { 1643 struct sppp *sp = xsp; 1644 1645 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1646 } 1647 1648 static void 1649 sppp_cp_to_ipv6cp(void *xsp) 1650 { 1651 struct sppp *sp = xsp; 1652 1653 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1654 } 1655 1656 static void 1657 sppp_cp_to_pap(void *xsp) 1658 { 1659 struct sppp *sp = xsp; 1660 1661 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1662 } 1663 1664 static void 1665 sppp_cp_to_chap(void *xsp) 1666 { 1667 struct sppp *sp = xsp; 1668 1669 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1670 } 1671 1672 static void 1673 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1674 { 1675 struct sppp_cp *scp; 1676 typedef void (*sppp_co_cb_t)(void *); 1677 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1678 [IDX_LCP] = sppp_cp_to_lcp, 1679 [IDX_IPCP] = sppp_cp_to_ipcp, 1680 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1681 [IDX_PAP] = sppp_cp_to_pap, 1682 [IDX_CHAP] = sppp_cp_to_chap, 1683 }; 1684 1685 scp = &sp->scp[cp->protoidx]; 1686 scp->state = STATE_INITIAL; 1687 scp->fail_counter = 0; 1688 scp->seq = 0; 1689 scp->rseq = 0; 1690 1691 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1692 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1693 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1694 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1695 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1696 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1697 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1698 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1699 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1700 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1701 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1702 1703 callout_init(&scp->ch, CALLOUT_MPSAFE); 1704 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1705 } 1706 1707 static void 1708 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1709 { 1710 struct sppp_cp *scp; 1711 scp = &sp->scp[cp->protoidx]; 1712 1713 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1714 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1715 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1716 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1717 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1718 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1719 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1720 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1721 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1722 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1723 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1724 1725 callout_halt(&scp->ch, NULL); 1726 callout_destroy(&scp->ch); 1727 1728 if (scp->mbuf_confreq != NULL) { 1729 m_freem(scp->mbuf_confreq); 1730 scp->mbuf_confreq = NULL; 1731 } 1732 if (scp->mbuf_confnak != NULL) { 1733 m_freem(scp->mbuf_confnak); 1734 scp->mbuf_confnak = NULL; 1735 } 1736 } 1737 1738 /* 1739 * Handle incoming PPP control protocol packets. 1740 */ 1741 static void 1742 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1743 { 1744 STDDCL; 1745 struct lcp_header *h; 1746 struct sppp_cp *scp; 1747 int printlen, len = m->m_pkthdr.len; 1748 u_char *p; 1749 uint32_t u32; 1750 1751 SPPP_LOCK(sp, RW_WRITER); 1752 1753 scp = &sp->scp[cp->protoidx]; 1754 1755 if (len < 4) { 1756 if (debug) 1757 log(LOG_DEBUG, 1758 "%s: %s invalid packet length: %d bytes\n", 1759 ifp->if_xname, cp->name, len); 1760 goto out; 1761 } 1762 h = mtod(m, struct lcp_header *); 1763 if (debug) { 1764 printlen = ntohs(h->len); 1765 log(LOG_DEBUG, 1766 "%s: %s input(%s): <%s id=0x%x len=%d", 1767 ifp->if_xname, cp->name, 1768 sppp_state_name(scp->state), 1769 sppp_cp_type_name(h->type), h->ident, printlen); 1770 if (len < printlen) 1771 printlen = len; 1772 if (printlen > 4) 1773 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1774 addlog(">\n"); 1775 } 1776 if (len > ntohs(h->len)) 1777 len = ntohs(h->len); 1778 p = (u_char *)(h + 1); 1779 switch (h->type) { 1780 case CONF_REQ: 1781 if (len < 4) { 1782 if (debug) 1783 addlog("%s: %s invalid conf-req length %d\n", 1784 ifp->if_xname, cp->name, 1785 len); 1786 if_statinc(ifp, if_ierrors); 1787 break; 1788 } 1789 1790 scp->rcr_type = CP_RCR_NONE; 1791 scp->rconfid = h->ident; 1792 if (scp->mbuf_confreq != NULL) { 1793 m_freem(scp->mbuf_confreq); 1794 } 1795 scp->mbuf_confreq = m; 1796 m = NULL; 1797 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1798 break; 1799 case CONF_ACK: 1800 if (h->ident != scp->confid) { 1801 if (debug) 1802 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1803 ifp->if_xname, cp->name, 1804 h->ident, scp->confid); 1805 if_statinc(ifp, if_ierrors); 1806 break; 1807 } 1808 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1809 break; 1810 case CONF_NAK: 1811 case CONF_REJ: 1812 if (h->ident != scp->confid) { 1813 if (debug) 1814 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1815 ifp->if_xname, cp->name, 1816 h->ident, scp->confid); 1817 if_statinc(ifp, if_ierrors); 1818 break; 1819 } 1820 1821 if (scp->mbuf_confnak) { 1822 m_freem(scp->mbuf_confnak); 1823 } 1824 scp->mbuf_confnak = m; 1825 m = NULL; 1826 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1827 break; 1828 case TERM_REQ: 1829 scp->rseq = h->ident; 1830 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1831 break; 1832 case TERM_ACK: 1833 if (h->ident != scp->confid && 1834 h->ident != scp->seq) { 1835 if (debug) 1836 addlog("%s: %s id mismatch " 1837 "0x%x != 0x%x and 0x%x != %0lx\n", 1838 ifp->if_xname, cp->name, 1839 h->ident, scp->confid, 1840 h->ident, scp->seq); 1841 if_statinc(ifp, if_ierrors); 1842 break; 1843 } 1844 1845 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1846 break; 1847 case CODE_REJ: 1848 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1849 log(LOG_INFO, 1850 "%s: %s: ignoring RXJ (%s) for code ?, " 1851 "danger will robinson\n", 1852 ifp->if_xname, cp->name, 1853 sppp_cp_type_name(h->type)); 1854 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1855 break; 1856 case PROTO_REJ: 1857 { 1858 int catastrophic; 1859 const struct cp *upper; 1860 int i; 1861 uint16_t proto; 1862 1863 catastrophic = 0; 1864 upper = NULL; 1865 proto = p[0] << 8 | p[1]; 1866 for (i = 0; i < IDX_COUNT; i++) { 1867 if (cps[i]->proto == proto) { 1868 upper = cps[i]; 1869 break; 1870 } 1871 } 1872 if (upper == NULL) 1873 catastrophic++; 1874 1875 if (debug) 1876 log(LOG_INFO, 1877 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1878 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1879 sppp_cp_type_name(h->type), proto, 1880 upper ? upper->name : "unknown", 1881 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1882 1883 /* 1884 * if we got RXJ+ against conf-req, the peer does not implement 1885 * this particular protocol type. terminate the protocol. 1886 */ 1887 if (upper && !catastrophic) { 1888 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1889 sppp_wq_add(sp->wq_cp, 1890 &sp->scp[upper->protoidx].work_close); 1891 break; 1892 } 1893 } 1894 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1895 break; 1896 } 1897 case DISC_REQ: 1898 if (cp->proto != PPP_LCP) 1899 goto illegal; 1900 /* Discard the packet. */ 1901 break; 1902 case ECHO_REQ: 1903 if (cp->proto != PPP_LCP) 1904 goto illegal; 1905 if (scp->state != STATE_OPENED) { 1906 if (debug) 1907 addlog("%s: lcp echo req but lcp closed\n", 1908 ifp->if_xname); 1909 if_statinc(ifp, if_ierrors); 1910 break; 1911 } 1912 if (len < 8) { 1913 if (debug) 1914 addlog("%s: invalid lcp echo request " 1915 "packet length: %d bytes\n", 1916 ifp->if_xname, len); 1917 break; 1918 } 1919 memcpy(&u32, h + 1, sizeof u32); 1920 if (ntohl(u32) == sp->lcp.magic) { 1921 /* Line loopback mode detected. */ 1922 printf("%s: loopback\n", ifp->if_xname); 1923 /* 1924 * There is no change for items of sp->scp[cp->protoidx] 1925 * while if_down() even without SPPP_LOCK 1926 */ 1927 SPPP_UNLOCK(sp); 1928 if_down(ifp); 1929 SPPP_LOCK(sp, RW_WRITER); 1930 1931 IF_PURGE(&sp->pp_cpq); 1932 1933 /* Shut down the PPP link. */ 1934 /* XXX */ 1935 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 1936 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 1937 break; 1938 } 1939 u32 = htonl(sp->lcp.magic); 1940 memcpy(h + 1, &u32, sizeof u32); 1941 if (debug) 1942 addlog("%s: got lcp echo req, sending echo rep\n", 1943 ifp->if_xname); 1944 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1945 h + 1); 1946 break; 1947 case ECHO_REPLY: 1948 if (cp->proto != PPP_LCP) 1949 goto illegal; 1950 if (h->ident != sp->lcp.echoid) { 1951 if_statinc(ifp, if_ierrors); 1952 break; 1953 } 1954 if (len < 8) { 1955 if (debug) 1956 addlog("%s: lcp invalid echo reply " 1957 "packet length: %d bytes\n", 1958 ifp->if_xname, len); 1959 break; 1960 } 1961 if (debug) 1962 addlog("%s: lcp got echo rep\n", 1963 ifp->if_xname); 1964 memcpy(&u32, h + 1, sizeof u32); 1965 if (ntohl(u32) != sp->lcp.magic) 1966 sp->pp_alivecnt = 0; 1967 break; 1968 default: 1969 /* Unknown packet type -- send Code-Reject packet. */ 1970 illegal: 1971 if (debug) 1972 addlog("%s: %s send code-rej for 0x%x\n", 1973 ifp->if_xname, cp->name, h->type); 1974 sppp_cp_send(sp, cp->proto, CODE_REJ, 1975 ++scp->seq, m->m_pkthdr.len, h); 1976 if_statinc(ifp, if_ierrors); 1977 } 1978 1979 out: 1980 SPPP_UNLOCK(sp); 1981 if (m != NULL) 1982 m_freem(m); 1983 } 1984 1985 /* 1986 * The generic part of all Up/Down/Open/Close/TO event handlers. 1987 * Basically, the state transition handling in the automaton. 1988 */ 1989 static void 1990 sppp_up_event(struct sppp *sp, void *xcp) 1991 { 1992 const struct cp *cp = xcp; 1993 STDDCL; 1994 1995 KASSERT(SPPP_WLOCKED(sp)); 1996 KASSERT(!cpu_softintr_p()); 1997 1998 if ((cp->flags & CP_AUTH) != 0 && 1999 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2000 return; 2001 2002 if (debug) 2003 log(LOG_DEBUG, "%s: %s up(%s)\n", 2004 ifp->if_xname, cp->name, 2005 sppp_state_name(sp->scp[cp->protoidx].state)); 2006 2007 switch (sp->scp[cp->protoidx].state) { 2008 case STATE_INITIAL: 2009 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2010 break; 2011 case STATE_STARTING: 2012 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2013 (cp->scr)(sp); 2014 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2015 break; 2016 default: 2017 printf("%s: %s illegal up in state %s\n", 2018 ifp->if_xname, cp->name, 2019 sppp_state_name(sp->scp[cp->protoidx].state)); 2020 } 2021 } 2022 2023 static void 2024 sppp_down_event(struct sppp *sp, void *xcp) 2025 { 2026 const struct cp *cp = xcp; 2027 STDDCL; 2028 2029 KASSERT(SPPP_WLOCKED(sp)); 2030 KASSERT(!cpu_softintr_p()); 2031 2032 if ((cp->flags & CP_AUTH) != 0 && 2033 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2034 return; 2035 2036 if (debug) 2037 log(LOG_DEBUG, "%s: %s down(%s)\n", 2038 ifp->if_xname, cp->name, 2039 sppp_state_name(sp->scp[cp->protoidx].state)); 2040 2041 switch (sp->scp[cp->protoidx].state) { 2042 case STATE_CLOSED: 2043 case STATE_CLOSING: 2044 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2045 break; 2046 case STATE_STOPPED: 2047 (cp->tls)(cp, sp); 2048 /* fall through */ 2049 case STATE_STOPPING: 2050 case STATE_REQ_SENT: 2051 case STATE_ACK_RCVD: 2052 case STATE_ACK_SENT: 2053 sppp_cp_change_state(cp, sp, STATE_STARTING); 2054 break; 2055 case STATE_OPENED: 2056 (cp->tld)(sp); 2057 sppp_cp_change_state(cp, sp, STATE_STARTING); 2058 break; 2059 default: 2060 /* 2061 * a down event may be caused regardless 2062 * of state just in LCP case. 2063 */ 2064 if (cp->proto == PPP_LCP) 2065 break; 2066 2067 printf("%s: %s illegal down in state %s\n", 2068 ifp->if_xname, cp->name, 2069 sppp_state_name(sp->scp[cp->protoidx].state)); 2070 } 2071 } 2072 2073 static void 2074 sppp_open_event(struct sppp *sp, void *xcp) 2075 { 2076 const struct cp *cp = xcp; 2077 STDDCL; 2078 2079 KASSERT(SPPP_WLOCKED(sp)); 2080 KASSERT(!cpu_softintr_p()); 2081 2082 if ((cp->flags & CP_AUTH) != 0 && 2083 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2084 return; 2085 2086 if (debug) 2087 log(LOG_DEBUG, "%s: %s open(%s)\n", 2088 ifp->if_xname, cp->name, 2089 sppp_state_name(sp->scp[cp->protoidx].state)); 2090 2091 switch (sp->scp[cp->protoidx].state) { 2092 case STATE_INITIAL: 2093 sppp_cp_change_state(cp, sp, STATE_STARTING); 2094 (cp->tls)(cp, sp); 2095 break; 2096 case STATE_STARTING: 2097 break; 2098 case STATE_CLOSED: 2099 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2100 (cp->scr)(sp); 2101 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2102 break; 2103 case STATE_STOPPED: 2104 case STATE_STOPPING: 2105 case STATE_REQ_SENT: 2106 case STATE_ACK_RCVD: 2107 case STATE_ACK_SENT: 2108 case STATE_OPENED: 2109 break; 2110 case STATE_CLOSING: 2111 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2112 break; 2113 } 2114 } 2115 2116 static void 2117 sppp_close_event(struct sppp *sp, void *xcp) 2118 { 2119 const struct cp *cp = xcp; 2120 STDDCL; 2121 2122 KASSERT(SPPP_WLOCKED(sp)); 2123 KASSERT(!cpu_softintr_p()); 2124 2125 if ((cp->flags & CP_AUTH) != 0 && 2126 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2127 return; 2128 2129 if (debug) 2130 log(LOG_DEBUG, "%s: %s close(%s)\n", 2131 ifp->if_xname, cp->name, 2132 sppp_state_name(sp->scp[cp->protoidx].state)); 2133 2134 switch (sp->scp[cp->protoidx].state) { 2135 case STATE_INITIAL: 2136 case STATE_CLOSED: 2137 case STATE_CLOSING: 2138 break; 2139 case STATE_STARTING: 2140 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2141 (cp->tlf)(cp, sp); 2142 break; 2143 case STATE_STOPPED: 2144 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2145 break; 2146 case STATE_STOPPING: 2147 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2148 break; 2149 case STATE_OPENED: 2150 (cp->tld)(sp); 2151 /* fall through */ 2152 case STATE_REQ_SENT: 2153 case STATE_ACK_RCVD: 2154 case STATE_ACK_SENT: 2155 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 2156 if ((cp->flags & CP_AUTH) == 0) { 2157 sppp_cp_send(sp, cp->proto, TERM_REQ, 2158 ++sp->scp[cp->protoidx].seq, 0, 0); 2159 } 2160 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2161 break; 2162 } 2163 } 2164 2165 static void 2166 sppp_to_event(struct sppp *sp, void *xcp) 2167 { 2168 const struct cp *cp = xcp; 2169 int s; 2170 STDDCL; 2171 2172 KASSERT(SPPP_WLOCKED(sp)); 2173 KASSERT(!cpu_softintr_p()); 2174 2175 s = splnet(); 2176 2177 if (debug) 2178 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 2179 ifp->if_xname, cp->name, 2180 sppp_state_name(sp->scp[cp->protoidx].state), 2181 sp->scp[cp->protoidx].rst_counter); 2182 2183 if (--sp->scp[cp->protoidx].rst_counter < 0) 2184 /* TO- event */ 2185 switch (sp->scp[cp->protoidx].state) { 2186 case STATE_CLOSING: 2187 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2188 (cp->tlf)(cp, sp); 2189 break; 2190 case STATE_STOPPING: 2191 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2192 (cp->tlf)(cp, sp); 2193 break; 2194 case STATE_REQ_SENT: 2195 case STATE_ACK_RCVD: 2196 case STATE_ACK_SENT: 2197 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2198 (cp->tlf)(cp, sp); 2199 break; 2200 } 2201 else 2202 /* TO+ event */ 2203 switch (sp->scp[cp->protoidx].state) { 2204 case STATE_CLOSING: 2205 case STATE_STOPPING: 2206 if ((cp->flags & CP_AUTH) == 0) { 2207 sppp_cp_send(sp, cp->proto, TERM_REQ, 2208 ++sp->scp[cp->protoidx].seq, 0, 0); 2209 } 2210 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2211 break; 2212 case STATE_REQ_SENT: 2213 case STATE_ACK_RCVD: 2214 (cp->scr)(sp); 2215 /* sppp_cp_change_state() will restart the timer */ 2216 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2217 break; 2218 case STATE_ACK_SENT: 2219 (cp->scr)(sp); 2220 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2221 break; 2222 } 2223 2224 splx(s); 2225 } 2226 static void 2227 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2228 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2229 { 2230 STDDCL; 2231 u_char ctype; 2232 2233 if (type == CP_RCR_ERR) { 2234 /* parse error, shut down */ 2235 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2236 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2237 } else if (type == CP_RCR_ACK) { 2238 /* RCR+ event */ 2239 ctype = CONF_ACK; 2240 switch (sp->scp[cp->protoidx].state) { 2241 case STATE_OPENED: 2242 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2243 cp->tld(sp); 2244 cp->scr(sp); 2245 cp->screply(cp, sp, ctype, ident, msglen, msg); 2246 break; 2247 case STATE_REQ_SENT: 2248 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2249 /* fall through */ 2250 case STATE_ACK_SENT: 2251 cp->screply(cp, sp, ctype, ident, msglen, msg); 2252 break; 2253 case STATE_STOPPED: 2254 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2255 cp->scr(sp); 2256 cp->screply(cp, sp, ctype, ident, msglen, msg); 2257 break; 2258 case STATE_ACK_RCVD: 2259 sppp_cp_change_state(cp, sp, STATE_OPENED); 2260 if (debug) 2261 log(LOG_DEBUG, "%s: %s tlu\n", 2262 ifp->if_xname, 2263 cp->name); 2264 cp->tlu(sp); 2265 cp->screply(cp, sp, ctype, ident, msglen, msg); 2266 break; 2267 case STATE_CLOSING: 2268 case STATE_STOPPING: 2269 break; 2270 case STATE_CLOSED: 2271 if ((cp->flags & CP_AUTH) == 0) { 2272 sppp_cp_send(sp, cp->proto, TERM_ACK, 2273 ident, 0, 0); 2274 } 2275 break; 2276 default: 2277 printf("%s: %s illegal RCR+ in state %s\n", 2278 ifp->if_xname, cp->name, 2279 sppp_state_name(sp->scp[cp->protoidx].state)); 2280 if_statinc(ifp, if_ierrors); 2281 } 2282 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2283 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2284 /* RCR- event */ 2285 switch (sp->scp[cp->protoidx].state) { 2286 case STATE_OPENED: 2287 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2288 cp->tld(sp); 2289 cp->scr(sp); 2290 cp->screply(cp, sp, ctype, ident, msglen, msg); 2291 break; 2292 case STATE_ACK_SENT: 2293 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2294 /* fall through */ 2295 case STATE_REQ_SENT: 2296 cp->screply(cp, sp, ctype, ident, msglen, msg); 2297 break; 2298 case STATE_STOPPED: 2299 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2300 cp->scr(sp); 2301 cp->screply(cp, sp, ctype, ident, msglen, msg); 2302 break; 2303 case STATE_ACK_RCVD: 2304 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2305 cp->screply(cp, sp, ctype, ident, msglen, msg); 2306 break; 2307 case STATE_CLOSING: 2308 case STATE_STOPPING: 2309 break; 2310 case STATE_CLOSED: 2311 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2312 if ((cp->flags & CP_AUTH) == 0) { 2313 sppp_cp_send(sp, cp->proto, TERM_ACK, 2314 ident, 0, 0); 2315 } 2316 break; 2317 default: 2318 printf("%s: %s illegal RCR- in state %s\n", 2319 ifp->if_xname, cp->name, 2320 sppp_state_name(sp->scp[cp->protoidx].state)); 2321 if_statinc(ifp, if_ierrors); 2322 } 2323 } 2324 } 2325 2326 static void 2327 sppp_rcr_event(struct sppp *sp, void *xcp) 2328 { 2329 const struct cp *cp = xcp; 2330 struct sppp_cp *scp; 2331 struct lcp_header *h; 2332 struct mbuf *m; 2333 enum cp_rcr_type type; 2334 size_t len; 2335 uint8_t *buf; 2336 size_t blen, rlen; 2337 uint8_t ident; 2338 2339 KASSERT(!cpu_softintr_p()); 2340 2341 scp = &sp->scp[cp->protoidx]; 2342 2343 if (cp->parse_confreq != NULL) { 2344 m = scp->mbuf_confreq; 2345 if (m == NULL) 2346 return; 2347 scp->mbuf_confreq = NULL; 2348 2349 h = mtod(m, struct lcp_header *); 2350 if (h->type != CONF_REQ) { 2351 m_freem(m); 2352 return; 2353 } 2354 2355 ident = h->ident; 2356 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2357 2358 type = (cp->parse_confreq)(sp, h, len, 2359 &buf, &blen, &rlen); 2360 m_freem(m); 2361 } else { 2362 /* mbuf_cofreq is already parsed and freed */ 2363 type = scp->rcr_type; 2364 ident = scp->rconfid; 2365 buf = NULL; 2366 blen = rlen = 0; 2367 } 2368 2369 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2370 2371 if (buf != NULL) 2372 kmem_free(buf, blen); 2373 } 2374 2375 static void 2376 sppp_rca_event(struct sppp *sp, void *xcp) 2377 { 2378 const struct cp *cp = xcp; 2379 STDDCL; 2380 2381 KASSERT(!cpu_softintr_p()); 2382 2383 switch (sp->scp[cp->protoidx].state) { 2384 case STATE_CLOSED: 2385 case STATE_STOPPED: 2386 if ((cp->flags & CP_AUTH) == 0) { 2387 sppp_cp_send(sp, cp->proto, TERM_ACK, 2388 sp->scp[cp->protoidx].rconfid, 0, 0); 2389 } 2390 break; 2391 case STATE_CLOSING: 2392 case STATE_STOPPING: 2393 break; 2394 case STATE_REQ_SENT: 2395 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2396 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2397 break; 2398 case STATE_OPENED: 2399 (cp->tld)(sp); 2400 /* fall through */ 2401 case STATE_ACK_RCVD: 2402 (cp->scr)(sp); 2403 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2404 break; 2405 case STATE_ACK_SENT: 2406 sppp_cp_change_state(cp, sp, STATE_OPENED); 2407 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2408 if (debug) 2409 log(LOG_DEBUG, "%s: %s tlu\n", 2410 ifp->if_xname, cp->name); 2411 (cp->tlu)(sp); 2412 break; 2413 default: 2414 printf("%s: %s illegal RCA in state %s\n", 2415 ifp->if_xname, cp->name, 2416 sppp_state_name(sp->scp[cp->protoidx].state)); 2417 if_statinc(ifp, if_ierrors); 2418 } 2419 } 2420 2421 static void 2422 sppp_rcn_event(struct sppp *sp, void *xcp) 2423 { 2424 const struct cp *cp = xcp; 2425 struct sppp_cp *scp; 2426 struct lcp_header *h; 2427 struct mbuf *m; 2428 struct ifnet *ifp = &sp->pp_if; 2429 size_t len; 2430 2431 KASSERT(!cpu_softintr_p()); 2432 2433 scp = &sp->scp[cp->protoidx]; 2434 m = scp->mbuf_confnak; 2435 if (m == NULL) 2436 return; 2437 scp->mbuf_confnak = NULL; 2438 2439 h = mtod(m, struct lcp_header *); 2440 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2441 2442 switch (h->type) { 2443 case CONF_NAK: 2444 (cp->parse_confnak)(sp, h, len); 2445 break; 2446 case CONF_REJ: 2447 (cp->parse_confrej)(sp, h, len); 2448 break; 2449 default: 2450 m_freem(m); 2451 return; 2452 } 2453 2454 m_freem(m); 2455 2456 switch (scp->state) { 2457 case STATE_CLOSED: 2458 case STATE_STOPPED: 2459 if ((cp->flags & CP_AUTH) == 0) { 2460 sppp_cp_send(sp, cp->proto, TERM_ACK, 2461 scp->rconfid, 0, 0); 2462 } 2463 break; 2464 case STATE_REQ_SENT: 2465 case STATE_ACK_SENT: 2466 scp->rst_counter = sp->lcp.max_configure; 2467 (cp->scr)(sp); 2468 break; 2469 case STATE_OPENED: 2470 (cp->tld)(sp); 2471 /* fall through */ 2472 case STATE_ACK_RCVD: 2473 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2474 (cp->scr)(sp); 2475 break; 2476 case STATE_CLOSING: 2477 case STATE_STOPPING: 2478 break; 2479 default: 2480 printf("%s: %s illegal RCN in state %s\n", 2481 ifp->if_xname, cp->name, 2482 sppp_state_name(scp->state)); 2483 if_statinc(ifp, if_ierrors); 2484 } 2485 } 2486 2487 static void 2488 sppp_rtr_event(struct sppp *sp, void *xcp) 2489 { 2490 const struct cp *cp = xcp; 2491 STDDCL; 2492 2493 KASSERT(!cpu_softintr_p()); 2494 2495 switch (sp->scp[cp->protoidx].state) { 2496 case STATE_ACK_RCVD: 2497 case STATE_ACK_SENT: 2498 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2499 break; 2500 case STATE_CLOSED: 2501 case STATE_STOPPED: 2502 case STATE_CLOSING: 2503 case STATE_STOPPING: 2504 case STATE_REQ_SENT: 2505 break; 2506 case STATE_OPENED: 2507 (cp->tld)(sp); 2508 sp->scp[cp->protoidx].rst_counter = 0; 2509 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2510 break; 2511 default: 2512 printf("%s: %s illegal RTR in state %s\n", 2513 ifp->if_xname, cp->name, 2514 sppp_state_name(sp->scp[cp->protoidx].state)); 2515 if_statinc(ifp, if_ierrors); 2516 return; 2517 } 2518 2519 /* Send Terminate-Ack packet. */ 2520 if (debug) 2521 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 2522 ifp->if_xname, cp->name); 2523 if ((cp->flags & CP_AUTH) == 0) { 2524 sppp_cp_send(sp, cp->proto, TERM_ACK, 2525 sp->scp[cp->protoidx].rseq, 0, 0); 2526 } 2527 } 2528 2529 static void 2530 sppp_rta_event(struct sppp *sp, void *xcp) 2531 { 2532 const struct cp *cp = xcp; 2533 struct ifnet *ifp = &sp->pp_if; 2534 2535 KASSERT(!cpu_softintr_p()); 2536 2537 switch (sp->scp[cp->protoidx].state) { 2538 case STATE_CLOSED: 2539 case STATE_STOPPED: 2540 case STATE_REQ_SENT: 2541 case STATE_ACK_SENT: 2542 break; 2543 case STATE_CLOSING: 2544 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2545 (cp->tlf)(cp, sp); 2546 break; 2547 case STATE_STOPPING: 2548 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2549 (cp->tlf)(cp, sp); 2550 break; 2551 case STATE_ACK_RCVD: 2552 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2553 break; 2554 case STATE_OPENED: 2555 (cp->tld)(sp); 2556 (cp->scr)(sp); 2557 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2558 break; 2559 default: 2560 printf("%s: %s illegal RTA in state %s\n", 2561 ifp->if_xname, cp->name, 2562 sppp_state_name(sp->scp[cp->protoidx].state)); 2563 if_statinc(ifp, if_ierrors); 2564 } 2565 } 2566 2567 static void 2568 sppp_rxj_event(struct sppp *sp, void *xcp) 2569 { 2570 const struct cp *cp = xcp; 2571 struct ifnet *ifp = &sp->pp_if; 2572 2573 KASSERT(!cpu_softintr_p()); 2574 2575 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2576 switch (sp->scp[cp->protoidx].state) { 2577 case STATE_CLOSED: 2578 case STATE_STOPPED: 2579 case STATE_REQ_SENT: 2580 case STATE_ACK_SENT: 2581 case STATE_CLOSING: 2582 case STATE_STOPPING: 2583 case STATE_OPENED: 2584 break; 2585 case STATE_ACK_RCVD: 2586 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2587 break; 2588 default: 2589 printf("%s: %s illegal RXJ- in state %s\n", 2590 ifp->if_xname, cp->name, 2591 sppp_state_name(sp->scp[cp->protoidx].state)); 2592 if_statinc(ifp, if_ierrors); 2593 } 2594 } 2595 2596 /* 2597 * Change the state of a control protocol in the state automaton. 2598 * Takes care of starting/stopping the restart timer. 2599 */ 2600 void 2601 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2602 { 2603 2604 KASSERT(SPPP_WLOCKED(sp)); 2605 2606 sp->scp[cp->protoidx].state = newstate; 2607 callout_stop(&sp->scp[cp->protoidx].ch); 2608 switch (newstate) { 2609 case STATE_INITIAL: 2610 case STATE_STARTING: 2611 case STATE_CLOSED: 2612 case STATE_STOPPED: 2613 case STATE_OPENED: 2614 break; 2615 case STATE_CLOSING: 2616 case STATE_STOPPING: 2617 case STATE_REQ_SENT: 2618 case STATE_ACK_RCVD: 2619 case STATE_ACK_SENT: 2620 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2621 break; 2622 } 2623 } 2624 2625 /* 2626 *--------------------------------------------------------------------------* 2627 * * 2628 * The LCP implementation. * 2629 * * 2630 *--------------------------------------------------------------------------* 2631 */ 2632 static void 2633 sppp_lcp_init(struct sppp *sp) 2634 { 2635 2636 KASSERT(SPPP_WLOCKED(sp)); 2637 2638 sppp_cp_init(&lcp, sp); 2639 2640 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2641 sp->lcp.magic = 0; 2642 sp->lcp.protos = 0; 2643 sp->lcp.max_terminate = 2; 2644 sp->lcp.max_configure = 10; 2645 sp->lcp.max_failure = 10; 2646 sp->lcp.tlf_sent = false; 2647 2648 /* 2649 * Initialize counters and timeout values. Note that we don't 2650 * use the 3 seconds suggested in RFC 1661 since we are likely 2651 * running on a fast link. XXX We should probably implement 2652 * the exponential backoff option. Note that these values are 2653 * relevant for all control protocols, not just LCP only. 2654 */ 2655 sp->lcp.timeout = 1 * hz; 2656 } 2657 2658 static void 2659 sppp_lcp_up(struct sppp *sp, void *xcp) 2660 { 2661 const struct cp *cp = xcp; 2662 int pidx; 2663 STDDCL; 2664 2665 KASSERT(SPPP_WLOCKED(sp)); 2666 2667 pidx = cp->protoidx; 2668 /* Initialize activity timestamp: opening a connection is an activity */ 2669 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2670 2671 /* 2672 * If this interface is passive or dial-on-demand, and we are 2673 * still in Initial state, it means we've got an incoming 2674 * call. Activate the interface. 2675 */ 2676 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2677 if (debug) 2678 log(LOG_DEBUG, 2679 "%s: Up event", ifp->if_xname); 2680 ifp->if_flags |= IFF_RUNNING; 2681 if (sp->scp[pidx].state == STATE_INITIAL) { 2682 if (debug) 2683 addlog("(incoming call)\n"); 2684 sp->pp_flags |= PP_CALLIN; 2685 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2686 } else if (debug) 2687 addlog("\n"); 2688 } 2689 2690 sppp_up_event(sp, xcp); 2691 } 2692 2693 static void 2694 sppp_lcp_down(struct sppp *sp, void *xcp) 2695 { 2696 const struct cp *cp = xcp; 2697 int pidx; 2698 STDDCL; 2699 2700 KASSERT(SPPP_WLOCKED(sp)); 2701 KASSERT(!cpu_softintr_p()); 2702 2703 pidx = cp->protoidx; 2704 sppp_down_event(sp, xcp); 2705 2706 /* 2707 * We need to do tls to restart when a down event is caused 2708 * by the last tlf. 2709 */ 2710 if (sp->scp[pidx].state == STATE_STARTING && 2711 sp->lcp.tlf_sent) { 2712 cp->tls(cp, sp); 2713 sp->lcp.tlf_sent = false; 2714 } 2715 2716 /* 2717 * If this is neither a dial-on-demand nor a passive 2718 * interface, simulate an ``ifconfig down'' action, so the 2719 * administrator can force a redial by another ``ifconfig 2720 * up''. XXX For leased line operation, should we immediately 2721 * try to reopen the connection here? 2722 */ 2723 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2724 if (debug) 2725 log(LOG_INFO, 2726 "%s: Down event (carrier loss), taking interface down.\n", 2727 ifp->if_xname); 2728 SPPP_UNLOCK(sp); 2729 if_down(ifp); 2730 SPPP_LOCK(sp, RW_WRITER); 2731 2732 if (sp->lcp.reestablish) 2733 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2734 } else { 2735 if (debug) 2736 log(LOG_DEBUG, 2737 "%s: Down event (carrier loss)\n", 2738 ifp->if_xname); 2739 2740 sp->pp_flags &= ~PP_CALLIN; 2741 if (sp->scp[pidx].state != STATE_INITIAL) 2742 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2743 ifp->if_flags &= ~IFF_RUNNING; 2744 } 2745 sp->scp[pidx].fail_counter = 0; 2746 } 2747 2748 static void 2749 sppp_lcp_open(struct sppp *sp, void *xcp) 2750 { 2751 2752 KASSERT(SPPP_WLOCKED(sp)); 2753 KASSERT(!cpu_softintr_p()); 2754 2755 sp->lcp.reestablish = false; 2756 sp->scp[IDX_LCP].fail_counter = 0; 2757 2758 if (sp->pp_if.if_mtu < PP_MTU) { 2759 sp->lcp.mru = sp->pp_if.if_mtu; 2760 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2761 } else { 2762 sp->lcp.mru = PP_MTU; 2763 } 2764 sp->lcp.their_mru = PP_MTU; 2765 2766 /* 2767 * If we are authenticator, negotiate LCP_AUTH 2768 */ 2769 if (sp->hisauth.proto != PPP_NOPROTO) 2770 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2771 else 2772 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2773 sp->pp_flags &= ~PP_NEEDAUTH; 2774 sppp_open_event(sp, xcp); 2775 } 2776 2777 2778 /* 2779 * Analyze a configure request. Return true if it was agreeable, and 2780 * caused action sca, false if it has been rejected or nak'ed, and 2781 * caused action scn. (The return value is used to make the state 2782 * transition decision in the state automaton.) 2783 */ 2784 static enum cp_rcr_type 2785 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2786 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2787 { 2788 STDDCL; 2789 u_char *buf, *r, *p, l, blen; 2790 enum cp_rcr_type type; 2791 int len, rlen; 2792 uint32_t nmagic; 2793 u_short authproto; 2794 2795 KASSERT(SPPP_WLOCKED(sp)); 2796 2797 if (origlen < sizeof(*h)) 2798 return CP_RCR_DROP; 2799 2800 origlen -= sizeof(*h); 2801 type = CP_RCR_NONE; 2802 type = 0; 2803 2804 if (origlen <= 0) 2805 return CP_RCR_DROP; 2806 else 2807 blen = origlen; 2808 2809 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2810 if (buf == NULL) 2811 return CP_RCR_DROP; 2812 2813 if (debug) 2814 log(LOG_DEBUG, "%s: lcp parse opts:", 2815 ifp->if_xname); 2816 2817 /* pass 1: check for things that need to be rejected */ 2818 p = (void *)(h + 1); 2819 r = buf; 2820 rlen = 0; 2821 for (len = origlen; len > 1; len-= l, p += l) { 2822 l = p[1]; 2823 if (l == 0) 2824 break; 2825 2826 /* Sanity check option length */ 2827 if (l > len) { 2828 /* 2829 * Malicious option - drop immediately. 2830 * XXX Maybe we should just RXJ it? 2831 */ 2832 addlog("%s: received malicious LCP option 0x%02x, " 2833 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2834 p[0], l, len); 2835 type = CP_RCR_ERR; 2836 goto end; 2837 } 2838 if (debug) 2839 addlog(" %s", sppp_lcp_opt_name(*p)); 2840 switch (p[0]) { 2841 case LCP_OPT_MAGIC: 2842 /* Magic number. */ 2843 /* fall through, both are same length */ 2844 case LCP_OPT_ASYNC_MAP: 2845 /* Async control character map. */ 2846 if (len >= 6 || l == 6) 2847 continue; 2848 if (debug) 2849 addlog(" [invalid]"); 2850 break; 2851 case LCP_OPT_MP_EID: 2852 if (len >= l && l >= 3) { 2853 switch (p[2]) { 2854 case 0: if (l==3+ 0) continue;break; 2855 case 2: if (l==3+ 4) continue;break; 2856 case 3: if (l==3+ 6) continue;break; 2857 case 6: if (l==3+16) continue;break; 2858 case 1: /* FALLTHROUGH */ 2859 case 4: if (l<=3+20) continue;break; 2860 case 5: if (l<=3+15) continue;break; 2861 /* XXX should it be default: continue;? */ 2862 } 2863 } 2864 if (debug) 2865 addlog(" [invalid class %d len %d]", p[2], l); 2866 break; 2867 case LCP_OPT_MP_SSNHF: 2868 if (len >= 2 && l == 2) { 2869 if (debug) 2870 addlog(" [rej]"); 2871 break; 2872 } 2873 if (debug) 2874 addlog(" [invalid]"); 2875 break; 2876 case LCP_OPT_MP_MRRU: 2877 /* Multilink maximum received reconstructed unit */ 2878 /* should be fall through, both are same length */ 2879 /* FALLTHROUGH */ 2880 case LCP_OPT_MRU: 2881 /* Maximum receive unit. */ 2882 if (len >= 4 && l == 4) 2883 continue; 2884 if (debug) 2885 addlog(" [invalid]"); 2886 break; 2887 case LCP_OPT_AUTH_PROTO: 2888 if (len < 4) { 2889 if (debug) 2890 addlog(" [invalid]"); 2891 break; 2892 } 2893 authproto = (p[2] << 8) + p[3]; 2894 if (authproto == PPP_CHAP && l != 5) { 2895 if (debug) 2896 addlog(" [invalid chap len]"); 2897 break; 2898 } 2899 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2900 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2901 sp->myauth.proto = authproto; 2902 } 2903 if (sp->myauth.proto == PPP_NOPROTO) { 2904 /* we are not configured to do auth */ 2905 if (debug) 2906 addlog(" [not configured]"); 2907 break; 2908 } 2909 /* 2910 * Remote want us to authenticate, remember this, 2911 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2912 * up. 2913 */ 2914 sp->pp_flags |= PP_NEEDAUTH; 2915 continue; 2916 default: 2917 /* Others not supported. */ 2918 if (debug) 2919 addlog(" [rej]"); 2920 break; 2921 } 2922 if (rlen + l > blen) { 2923 if (debug) 2924 addlog(" [overflow]"); 2925 continue; 2926 } 2927 /* Add the option to rejected list. */ 2928 memcpy(r, p, l); 2929 r += l; 2930 rlen += l; 2931 } 2932 2933 if (rlen > 0) { 2934 type = CP_RCR_REJ; 2935 goto end; 2936 } 2937 2938 if (debug) 2939 addlog("\n"); 2940 2941 /* 2942 * pass 2: check for option values that are unacceptable and 2943 * thus require to be nak'ed. 2944 */ 2945 if (debug) 2946 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2947 ifp->if_xname); 2948 2949 p = (void *)(h + 1); 2950 r = buf; 2951 rlen = 0; 2952 for (len = origlen; len > 0; len -= l, p += l) { 2953 l = p[1]; 2954 if (l == 0) 2955 break; 2956 2957 if (debug) 2958 addlog(" %s", sppp_lcp_opt_name(*p)); 2959 switch (p[0]) { 2960 case LCP_OPT_MAGIC: 2961 /* Magic number -- extract. */ 2962 nmagic = (uint32_t)p[2] << 24 | 2963 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2964 if (nmagic != sp->lcp.magic) { 2965 if (debug) 2966 addlog(" 0x%x", nmagic); 2967 continue; 2968 } 2969 /* 2970 * Local and remote magics equal -- loopback? 2971 */ 2972 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2973 printf ("%s: loopback\n", 2974 ifp->if_xname); 2975 sp->pp_loopcnt = 0; 2976 if (ifp->if_flags & IFF_UP) { 2977 SPPP_UNLOCK(sp); 2978 if_down(ifp); 2979 SPPP_LOCK(sp, RW_WRITER); 2980 2981 IF_PURGE(&sp->pp_cpq); 2982 /* XXX ? */ 2983 sppp_wq_add(sp->wq_cp, 2984 &sp->scp[IDX_LCP].work_down); 2985 sppp_wq_add(sp->wq_cp, 2986 &sp->scp[IDX_LCP].work_up); 2987 } 2988 } else if (debug) 2989 addlog(" [glitch]"); 2990 ++sp->pp_loopcnt; 2991 /* 2992 * We negate our magic here, and NAK it. If 2993 * we see it later in an NAK packet, we 2994 * suggest a new one. 2995 */ 2996 nmagic = ~sp->lcp.magic; 2997 /* Gonna NAK it. */ 2998 p[2] = nmagic >> 24; 2999 p[3] = nmagic >> 16; 3000 p[4] = nmagic >> 8; 3001 p[5] = nmagic; 3002 break; 3003 3004 case LCP_OPT_ASYNC_MAP: 3005 /* 3006 * Async control character map -- just ignore it. 3007 * 3008 * Quote from RFC 1662, chapter 6: 3009 * To enable this functionality, synchronous PPP 3010 * implementations MUST always respond to the 3011 * Async-Control-Character-Map Configuration 3012 * Option with the LCP Configure-Ack. However, 3013 * acceptance of the Configuration Option does 3014 * not imply that the synchronous implementation 3015 * will do any ACCM mapping. Instead, all such 3016 * octet mapping will be performed by the 3017 * asynchronous-to-synchronous converter. 3018 */ 3019 continue; 3020 3021 case LCP_OPT_MRU: 3022 /* 3023 * Maximum receive unit. Always agreeable, 3024 * but ignored by now. 3025 */ 3026 sp->lcp.their_mru = p[2] * 256 + p[3]; 3027 if (debug) 3028 addlog(" %ld", sp->lcp.their_mru); 3029 continue; 3030 3031 case LCP_OPT_AUTH_PROTO: 3032 authproto = (p[2] << 8) + p[3]; 3033 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 3034 if (authproto == PPP_PAP || authproto == PPP_CHAP) 3035 sp->myauth.proto = authproto; 3036 } 3037 if (sp->myauth.proto == authproto) { 3038 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 3039 continue; 3040 } 3041 if (debug) 3042 addlog(" [chap without MD5]"); 3043 } else { 3044 if (debug) 3045 addlog(" [mine %s != his %s]", 3046 sppp_proto_name(sp->myauth.proto), 3047 sppp_proto_name(authproto)); 3048 } 3049 /* not agreed, nak */ 3050 if (sp->myauth.proto == PPP_CHAP) { 3051 l = 5; 3052 } else { 3053 l = 4; 3054 } 3055 3056 if (rlen + l > blen) { 3057 if (debug) 3058 addlog(" [overflow]"); 3059 continue; 3060 } 3061 3062 r[0] = LCP_OPT_AUTH_PROTO; 3063 r[1] = l; 3064 r[2] = sp->myauth.proto >> 8; 3065 r[3] = sp->myauth.proto & 0xff; 3066 if (sp->myauth.proto == PPP_CHAP) 3067 r[4] = CHAP_MD5; 3068 rlen += l; 3069 r += l; 3070 continue; 3071 case LCP_OPT_MP_EID: 3072 /* 3073 * Endpoint identification. 3074 * Always agreeable, 3075 * but ignored by now. 3076 */ 3077 if (debug) { 3078 addlog(" type %d", p[2]); 3079 sppp_print_bytes(p+3, p[1]-3); 3080 } 3081 continue; 3082 case LCP_OPT_MP_MRRU: 3083 /* 3084 * Maximum received reconstructed unit. 3085 * Always agreeable, 3086 * but ignored by now. 3087 */ 3088 sp->lcp.their_mrru = p[2] * 256 + p[3]; 3089 if (debug) 3090 addlog(" %ld", sp->lcp.their_mrru); 3091 continue; 3092 } 3093 if (rlen + l > blen) { 3094 if (debug) 3095 addlog(" [overflow]"); 3096 continue; 3097 } 3098 /* Add the option to nak'ed list. */ 3099 memcpy(r, p, l); 3100 r += l; 3101 rlen += l; 3102 } 3103 3104 if (rlen > 0) { 3105 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 3106 if (debug) 3107 addlog(" max_failure (%d) exceeded, ", 3108 sp->lcp.max_failure); 3109 type = CP_RCR_REJ; 3110 } else { 3111 type = CP_RCR_NAK; 3112 } 3113 } else { 3114 type = CP_RCR_ACK; 3115 rlen = origlen; 3116 memcpy(r, h + 1, rlen); 3117 sp->scp[IDX_LCP].fail_counter = 0; 3118 sp->pp_loopcnt = 0; 3119 } 3120 3121 end: 3122 if (debug) 3123 addlog("\n"); 3124 3125 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3126 if (buf != NULL) 3127 kmem_intr_free(buf, blen); 3128 } else { 3129 *msgbuf = buf; 3130 *buflen = blen; 3131 *msglen = rlen; 3132 } 3133 3134 return type; 3135 } 3136 3137 /* 3138 * Analyze the LCP Configure-Reject option list, and adjust our 3139 * negotiation. 3140 */ 3141 static void 3142 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3143 { 3144 STDDCL; 3145 u_char *p, l; 3146 3147 KASSERT(SPPP_WLOCKED(sp)); 3148 3149 if (len <= sizeof(*h)) 3150 return; 3151 3152 len -= sizeof(*h); 3153 3154 if (debug) 3155 log(LOG_DEBUG, "%s: lcp rej opts:", 3156 ifp->if_xname); 3157 3158 p = (void *)(h + 1); 3159 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3160 /* Sanity check option length */ 3161 if (l > len) { 3162 /* 3163 * Malicious option - drop immediately. 3164 * XXX Maybe we should just RXJ it? 3165 */ 3166 addlog("%s: received malicious LCP option, " 3167 "dropping.\n", ifp->if_xname); 3168 goto end; 3169 } 3170 if (debug) 3171 addlog(" %s", sppp_lcp_opt_name(*p)); 3172 switch (p[0]) { 3173 case LCP_OPT_MAGIC: 3174 /* Magic number -- can't use it, use 0 */ 3175 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 3176 sp->lcp.magic = 0; 3177 break; 3178 case LCP_OPT_MRU: 3179 /* 3180 * We try to negotiate a lower MRU if the underlying 3181 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 3182 * peer rejects this lower rate, fallback to the 3183 * default. 3184 */ 3185 if (debug) { 3186 addlog("%s: warning: peer rejected our MRU of " 3187 "%ld bytes. Defaulting to %d bytes\n", 3188 ifp->if_xname, sp->lcp.mru, PP_MTU); 3189 } 3190 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3191 sp->lcp.mru = PP_MTU; 3192 break; 3193 case LCP_OPT_AUTH_PROTO: 3194 /* 3195 * Peer doesn't want to authenticate himself, 3196 * deny unless this is a dialout call, and 3197 * SPPP_AUTHFLAG_NOCALLOUT is set. 3198 */ 3199 if ((sp->pp_flags & PP_CALLIN) == 0 && 3200 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 3201 if (debug) 3202 addlog(" [don't insist on auth " 3203 "for callout]"); 3204 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3205 break; 3206 } 3207 if (debug) 3208 addlog("[access denied]\n"); 3209 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3210 break; 3211 } 3212 } 3213 if (debug) 3214 addlog("\n"); 3215 end: 3216 return; 3217 } 3218 3219 /* 3220 * Analyze the LCP Configure-NAK option list, and adjust our 3221 * negotiation. 3222 */ 3223 static void 3224 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3225 { 3226 STDDCL; 3227 u_char *p, l; 3228 uint32_t magic; 3229 3230 KASSERT(SPPP_WLOCKED(sp)); 3231 3232 if (len <= sizeof(*h)) 3233 return; 3234 len -= sizeof(*h); 3235 3236 if (debug) 3237 log(LOG_DEBUG, "%s: lcp nak opts:", 3238 ifp->if_xname); 3239 3240 p = (void *)(h + 1); 3241 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3242 /* Sanity check option length */ 3243 if (l > len) { 3244 /* 3245 * Malicious option - drop immediately. 3246 * XXX Maybe we should just RXJ it? 3247 */ 3248 addlog("%s: received malicious LCP option, " 3249 "dropping.\n", ifp->if_xname); 3250 goto end; 3251 } 3252 if (debug) 3253 addlog(" %s", sppp_lcp_opt_name(*p)); 3254 switch (p[0]) { 3255 case LCP_OPT_MAGIC: 3256 /* Magic number -- renegotiate */ 3257 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3258 len >= 6 && l == 6) { 3259 magic = (uint32_t)p[2] << 24 | 3260 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3261 /* 3262 * If the remote magic is our negated one, 3263 * this looks like a loopback problem. 3264 * Suggest a new magic to make sure. 3265 */ 3266 if (magic == ~sp->lcp.magic) { 3267 if (debug) 3268 addlog(" magic glitch"); 3269 sp->lcp.magic = cprng_fast32(); 3270 } else { 3271 sp->lcp.magic = magic; 3272 if (debug) 3273 addlog(" %d", magic); 3274 } 3275 } 3276 break; 3277 case LCP_OPT_MRU: 3278 /* 3279 * Peer wants to advise us to negotiate an MRU. 3280 * Agree on it if it's reasonable, or use 3281 * default otherwise. 3282 */ 3283 if (len >= 4 && l == 4) { 3284 u_int mru = p[2] * 256 + p[3]; 3285 if (debug) 3286 addlog(" %d", mru); 3287 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3288 mru = sp->pp_if.if_mtu; 3289 sp->lcp.mru = mru; 3290 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3291 } 3292 break; 3293 case LCP_OPT_AUTH_PROTO: 3294 /* 3295 * Peer doesn't like our authentication method, 3296 * deny. 3297 */ 3298 if (debug) 3299 addlog("[access denied]\n"); 3300 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3301 break; 3302 } 3303 } 3304 if (debug) 3305 addlog("\n"); 3306 end: 3307 return; 3308 } 3309 3310 static void 3311 sppp_lcp_tlu(struct sppp *sp) 3312 { 3313 STDDCL; 3314 int i; 3315 3316 KASSERT(SPPP_WLOCKED(sp)); 3317 3318 /* unlock for IFNET_LOCK and if_up() */ 3319 SPPP_UNLOCK(sp); 3320 3321 /* XXX ? */ 3322 if (! (ifp->if_flags & IFF_UP) && 3323 (ifp->if_flags & IFF_RUNNING)) { 3324 /* Coming out of loopback mode. */ 3325 if_up(ifp); 3326 } 3327 3328 IFNET_LOCK(ifp); 3329 SPPP_LOCK(sp, RW_WRITER); 3330 3331 if (ifp->if_mtu > sp->lcp.their_mru) { 3332 sp->pp_saved_mtu = ifp->if_mtu; 3333 ifp->if_mtu = sp->lcp.their_mru; 3334 if (debug) { 3335 log(LOG_DEBUG, 3336 "%s: setting MTU " 3337 "from %"PRIu64" bytes " 3338 "to %"PRIu64" bytes\n", 3339 ifp->if_xname, sp->pp_saved_mtu, 3340 ifp->if_mtu); 3341 } 3342 } 3343 IFNET_UNLOCK(ifp); 3344 3345 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3346 (sp->pp_flags & PP_NEEDAUTH) != 0) 3347 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3348 else 3349 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3350 3351 /* 3352 * Open all authentication protocols. This is even required 3353 * if we already proceeded to network phase, since it might be 3354 * that remote wants us to authenticate, so we might have to 3355 * send a PAP request. Undesired authentication protocols 3356 * don't do anything when they get an Open event. 3357 */ 3358 for (i = 0; i < IDX_COUNT; i++) 3359 if ((cps[i])->flags & CP_AUTH) { 3360 sppp_wq_add(sp->wq_cp, 3361 &sp->scp[(cps[i])->protoidx].work_open); 3362 } 3363 3364 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 3365 /* Notify all NCPs. */ 3366 for (i = 0; i < IDX_COUNT; i++) 3367 if ((cps[i])->flags & CP_NCP) { 3368 sppp_wq_add(sp->wq_cp, 3369 &sp->scp[(cps[i])->protoidx].work_open); 3370 } 3371 } 3372 3373 /* notify low-level driver of state change */ 3374 sppp_notify_chg_wlocked(sp); 3375 } 3376 3377 static void 3378 sppp_lcp_tld(struct sppp *sp) 3379 { 3380 STDDCL; 3381 int i, pi, phase; 3382 3383 KASSERT(SPPP_WLOCKED(sp)); 3384 3385 phase = sp->pp_phase; 3386 3387 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3388 3389 if (sp->pp_saved_mtu > 0) { 3390 SPPP_UNLOCK(sp); 3391 IFNET_LOCK(ifp); 3392 SPPP_LOCK(sp, RW_WRITER); 3393 3394 if (debug) { 3395 log(LOG_DEBUG, 3396 "%s: setting MTU " 3397 "from %"PRIu64" bytes " 3398 "to %"PRIu64" bytes\n", 3399 ifp->if_xname, ifp->if_mtu, 3400 sp->pp_saved_mtu); 3401 } 3402 3403 ifp->if_mtu = sp->pp_saved_mtu; 3404 sp->pp_saved_mtu = 0; 3405 IFNET_UNLOCK(ifp); 3406 } 3407 3408 /* 3409 * Take upper layers down. We send the Down event first and 3410 * the Close second to prevent the upper layers from sending 3411 * ``a flurry of terminate-request packets'', as the RFC 3412 * describes it. 3413 */ 3414 for (i = 0; i < IDX_COUNT; i++) { 3415 pi = (cps[i])->protoidx; 3416 if (((cps[i])->flags & CP_LCP) == 0) { 3417 /* skip if ncp was not started */ 3418 if (phase != SPPP_PHASE_NETWORK && 3419 ((cps[i])->flags & CP_NCP) != 0) 3420 continue; 3421 3422 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_down); 3423 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_close); 3424 } 3425 } 3426 } 3427 3428 static void 3429 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3430 { 3431 3432 KASSERT(SPPP_WLOCKED(sp)); 3433 3434 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3435 printf("%s: authentication failed %d times, not retrying again\n", 3436 sp->pp_if.if_xname, sp->pp_auth_failures); 3437 3438 SPPP_UNLOCK(sp); 3439 if_down(&sp->pp_if); 3440 SPPP_LOCK(sp, RW_WRITER); 3441 return; 3442 } 3443 3444 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3445 3446 /* Notify lower layer if desired. */ 3447 sppp_notify_tls_wlocked(sp); 3448 sp->lcp.tlf_sent = false; 3449 } 3450 3451 static void 3452 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3453 { 3454 3455 KASSERT(SPPP_WLOCKED(sp)); 3456 3457 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3458 3459 /* Notify lower layer if desired. */ 3460 sppp_notify_tlf_wlocked(sp); 3461 3462 switch (sp->scp[IDX_LCP].state) { 3463 case STATE_CLOSED: 3464 case STATE_STOPPED: 3465 sp->lcp.tlf_sent = true; 3466 break; 3467 case STATE_INITIAL: 3468 default: 3469 /* just in case */ 3470 sp->lcp.tlf_sent = false; 3471 } 3472 } 3473 3474 static void 3475 sppp_lcp_scr(struct sppp *sp) 3476 { 3477 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3478 int i = 0; 3479 u_short authproto; 3480 3481 KASSERT(SPPP_WLOCKED(sp)); 3482 3483 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3484 if (! sp->lcp.magic) 3485 sp->lcp.magic = cprng_fast32(); 3486 opt[i++] = LCP_OPT_MAGIC; 3487 opt[i++] = 6; 3488 opt[i++] = sp->lcp.magic >> 24; 3489 opt[i++] = sp->lcp.magic >> 16; 3490 opt[i++] = sp->lcp.magic >> 8; 3491 opt[i++] = sp->lcp.magic; 3492 } 3493 3494 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3495 opt[i++] = LCP_OPT_MRU; 3496 opt[i++] = 4; 3497 opt[i++] = sp->lcp.mru >> 8; 3498 opt[i++] = sp->lcp.mru; 3499 } 3500 3501 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3502 authproto = sp->hisauth.proto; 3503 opt[i++] = LCP_OPT_AUTH_PROTO; 3504 opt[i++] = authproto == PPP_CHAP? 5: 4; 3505 opt[i++] = authproto >> 8; 3506 opt[i++] = authproto; 3507 if (authproto == PPP_CHAP) 3508 opt[i++] = CHAP_MD5; 3509 } 3510 3511 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3512 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3513 } 3514 3515 /* 3516 * Check the open NCPs, return true if at least one NCP is open. 3517 */ 3518 3519 static int 3520 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3521 { 3522 int i, mask; 3523 3524 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3525 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3526 return 1; 3527 return 0; 3528 } 3529 3530 /* 3531 * Re-check the open NCPs and see if we should terminate the link. 3532 * Called by the NCPs during their tlf action handling. 3533 */ 3534 static void 3535 sppp_lcp_check_and_close(struct sppp *sp) 3536 { 3537 3538 KASSERT(SPPP_WLOCKED(sp)); 3539 3540 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3541 /* don't bother, we are already going down */ 3542 return; 3543 } 3544 3545 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3546 sppp_cp_check(sp, CP_AUTH)) 3547 return; 3548 3549 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3550 sppp_cp_check(sp, CP_NCP)) 3551 return; 3552 3553 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3554 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3555 } 3556 3557 /* 3558 *--------------------------------------------------------------------------* 3559 * * 3560 * The IPCP implementation. * 3561 * * 3562 *--------------------------------------------------------------------------* 3563 */ 3564 3565 static void 3566 sppp_ipcp_init(struct sppp *sp) 3567 { 3568 3569 KASSERT(SPPP_WLOCKED(sp)); 3570 3571 sppp_cp_init(&ipcp, sp); 3572 3573 sp->ipcp.opts = 0; 3574 sp->ipcp.flags = 0; 3575 } 3576 3577 static void 3578 sppp_ipcp_open(struct sppp *sp, void *xcp) 3579 { 3580 STDDCL; 3581 uint32_t myaddr, hisaddr; 3582 3583 KASSERT(SPPP_WLOCKED(sp)); 3584 KASSERT(!cpu_softintr_p()); 3585 3586 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3587 return; 3588 3589 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3590 sp->ipcp.req_myaddr = 0; 3591 sp->ipcp.req_hisaddr = 0; 3592 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3593 3594 #ifdef INET 3595 kpreempt_disable(); 3596 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3597 kpreempt_enable(); 3598 #else 3599 myaddr = hisaddr = 0; 3600 #endif 3601 /* 3602 * If we don't have his address, this probably means our 3603 * interface doesn't want to talk IP at all. (This could 3604 * be the case if somebody wants to speak only IPX, for 3605 * example.) Don't open IPCP in this case. 3606 */ 3607 if (hisaddr == 0) { 3608 /* XXX this message should go away */ 3609 if (debug) 3610 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 3611 ifp->if_xname); 3612 return; 3613 } 3614 3615 if (myaddr == 0) { 3616 /* 3617 * I don't have an assigned address, so i need to 3618 * negotiate my address. 3619 */ 3620 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3621 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3622 } 3623 if (hisaddr == 1) { 3624 /* 3625 * XXX - remove this hack! 3626 * remote has no valid address, we need to get one assigned. 3627 */ 3628 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3629 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3630 } 3631 3632 if (sp->query_dns & 1) { 3633 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3634 } else { 3635 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3636 } 3637 3638 if (sp->query_dns & 2) { 3639 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3640 } else { 3641 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3642 } 3643 sppp_open_event(sp, xcp); 3644 } 3645 3646 static void 3647 sppp_ipcp_close(struct sppp *sp, void *xcp) 3648 { 3649 3650 KASSERT(SPPP_WLOCKED(sp)); 3651 KASSERT(!cpu_softintr_p()); 3652 3653 sppp_close_event(sp, xcp); 3654 3655 #ifdef INET 3656 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 3657 /* 3658 * Some address was dynamic, clear it again. 3659 */ 3660 sppp_clear_ip_addrs(sp); 3661 #endif 3662 } 3663 3664 /* 3665 * Analyze a configure request. Return true if it was agreeable, and 3666 * caused action sca, false if it has been rejected or nak'ed, and 3667 * caused action scn. (The return value is used to make the state 3668 * transition decision in the state automaton.) 3669 */ 3670 static enum cp_rcr_type 3671 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3672 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3673 { 3674 u_char *buf, *r, *p, l, blen; 3675 enum cp_rcr_type type; 3676 struct ifnet *ifp = &sp->pp_if; 3677 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3678 uint32_t hisaddr, desiredaddr; 3679 3680 KASSERT(SPPP_WLOCKED(sp)); 3681 3682 type = CP_RCR_NONE; 3683 origlen -= sizeof(*h); 3684 3685 if (origlen < 0) 3686 return CP_RCR_DROP; 3687 3688 /* 3689 * Make sure to allocate a buf that can at least hold a 3690 * conf-nak with an `address' option. We might need it below. 3691 */ 3692 blen = MAX(6, origlen); 3693 3694 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3695 if (buf == NULL) 3696 return CP_RCR_DROP; 3697 3698 /* pass 1: see if we can recognize them */ 3699 if (debug) 3700 log(LOG_DEBUG, "%s: ipcp parse opts:", 3701 ifp->if_xname); 3702 p = (void *)(h + 1); 3703 r = buf; 3704 rlen = 0; 3705 for (len = origlen; len > 1; len -= l, p += l) { 3706 l = p[1]; 3707 if (l == 0) 3708 break; 3709 3710 /* Sanity check option length */ 3711 if (l > len) { 3712 /* XXX should we just RXJ? */ 3713 addlog("%s: malicious IPCP option received, dropping\n", 3714 ifp->if_xname); 3715 type = CP_RCR_ERR; 3716 goto end; 3717 } 3718 if (debug) 3719 addlog(" %s", sppp_ipcp_opt_name(*p)); 3720 switch (p[0]) { 3721 #ifdef notyet 3722 case IPCP_OPT_COMPRESSION: 3723 if (len >= 6 && l >= 6) { 3724 /* correctly formed compress option */ 3725 continue; 3726 } 3727 if (debug) 3728 addlog(" [invalid]"); 3729 break; 3730 #endif 3731 case IPCP_OPT_ADDRESS: 3732 if (len >= 6 && l == 6) { 3733 /* correctly formed address option */ 3734 continue; 3735 } 3736 if (debug) 3737 addlog(" [invalid]"); 3738 break; 3739 default: 3740 /* Others not supported. */ 3741 if (debug) 3742 addlog(" [rej]"); 3743 break; 3744 } 3745 /* Add the option to rejected list. */ 3746 if (rlen + l > blen) { 3747 if (debug) 3748 addlog(" [overflow]"); 3749 continue; 3750 } 3751 memcpy(r, p, l); 3752 r += l; 3753 rlen += l; 3754 } 3755 3756 if (rlen > 0) { 3757 type = CP_RCR_REJ; 3758 goto end; 3759 } 3760 3761 if (debug) 3762 addlog("\n"); 3763 3764 /* pass 2: parse option values */ 3765 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3766 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3767 else 3768 #ifdef INET 3769 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3770 #else 3771 hisaddr = 0; 3772 #endif 3773 if (debug) 3774 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 3775 ifp->if_xname); 3776 p = (void *)(h + 1); 3777 r = buf; 3778 rlen = 0; 3779 for (len = origlen; len > 1; len -= l, p += l) { 3780 l = p[1]; 3781 if (l == 0) 3782 break; 3783 3784 if (debug) 3785 addlog(" %s", sppp_ipcp_opt_name(*p)); 3786 switch (p[0]) { 3787 #ifdef notyet 3788 case IPCP_OPT_COMPRESSION: 3789 continue; 3790 #endif 3791 case IPCP_OPT_ADDRESS: 3792 desiredaddr = p[2] << 24 | p[3] << 16 | 3793 p[4] << 8 | p[5]; 3794 if (desiredaddr == hisaddr || 3795 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3796 /* 3797 * Peer's address is same as our value, 3798 * this is agreeable. Gonna conf-ack 3799 * it. 3800 */ 3801 if (debug) 3802 addlog(" %s [ack]", 3803 sppp_dotted_quad(hisaddr)); 3804 /* record that we've seen it already */ 3805 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3806 sp->ipcp.req_hisaddr = desiredaddr; 3807 hisaddr = desiredaddr; 3808 continue; 3809 } 3810 /* 3811 * The address wasn't agreeable. This is either 3812 * he sent us 0.0.0.0, asking to assign him an 3813 * address, or he send us another address not 3814 * matching our value. Either case, we gonna 3815 * conf-nak it with our value. 3816 */ 3817 if (debug) { 3818 if (desiredaddr == 0) 3819 addlog(" [addr requested]"); 3820 else 3821 addlog(" %s [not agreed]", 3822 sppp_dotted_quad(desiredaddr)); 3823 } 3824 3825 p[2] = hisaddr >> 24; 3826 p[3] = hisaddr >> 16; 3827 p[4] = hisaddr >> 8; 3828 p[5] = hisaddr; 3829 break; 3830 } 3831 if (rlen + l > blen) { 3832 if (debug) 3833 addlog(" [overflow]"); 3834 continue; 3835 } 3836 /* Add the option to nak'ed list. */ 3837 memcpy(r, p, l); 3838 r += l; 3839 rlen += l; 3840 } 3841 3842 if (rlen > 0) { 3843 type = CP_RCR_NAK; 3844 } else { 3845 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3846 /* 3847 * If we are about to conf-ack the request, but haven't seen 3848 * his address so far, gonna conf-nak it instead, with the 3849 * `address' option present and our idea of his address being 3850 * filled in there, to request negotiation of both addresses. 3851 * 3852 * XXX This can result in an endless req - nak loop if peer 3853 * doesn't want to send us his address. Q: What should we do 3854 * about it? XXX A: implement the max-failure counter. 3855 */ 3856 buf[0] = IPCP_OPT_ADDRESS; 3857 buf[1] = 6; 3858 buf[2] = hisaddr >> 24; 3859 buf[3] = hisaddr >> 16; 3860 buf[4] = hisaddr >> 8; 3861 buf[5] = hisaddr; 3862 rlen = 6; 3863 if (debug) 3864 addlog(" still need hisaddr"); 3865 type = CP_RCR_NAK; 3866 } else { 3867 type = CP_RCR_ACK; 3868 rlen = origlen; 3869 memcpy(r, h + 1, rlen); 3870 } 3871 } 3872 3873 end: 3874 if (debug) 3875 addlog("\n"); 3876 3877 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3878 if (buf != NULL) 3879 kmem_intr_free(buf, blen); 3880 } else { 3881 *msgbuf = buf; 3882 *buflen = blen; 3883 *msglen = rlen; 3884 } 3885 3886 return type; 3887 } 3888 3889 /* 3890 * Analyze the IPCP Configure-Reject option list, and adjust our 3891 * negotiation. 3892 */ 3893 static void 3894 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3895 { 3896 u_char *p, l; 3897 struct ifnet *ifp = &sp->pp_if; 3898 int debug = ifp->if_flags & IFF_DEBUG; 3899 3900 KASSERT(SPPP_WLOCKED(sp)); 3901 3902 if (len <= sizeof(*h)) 3903 return; 3904 3905 len -= sizeof(*h); 3906 3907 if (debug) 3908 log(LOG_DEBUG, "%s: ipcp rej opts:", 3909 ifp->if_xname); 3910 3911 p = (void *)(h + 1); 3912 for (; len > 1; len -= l, p += l) { 3913 l = p[1]; 3914 if (l == 0) 3915 break; 3916 3917 /* Sanity check option length */ 3918 if (l > len) { 3919 /* XXX should we just RXJ? */ 3920 addlog("%s: malicious IPCP option received, dropping\n", 3921 ifp->if_xname); 3922 goto end; 3923 } 3924 if (debug) 3925 addlog(" %s", sppp_ipcp_opt_name(*p)); 3926 switch (p[0]) { 3927 case IPCP_OPT_ADDRESS: 3928 /* 3929 * Peer doesn't grok address option. This is 3930 * bad. XXX Should we better give up here? 3931 */ 3932 if (!debug) { 3933 log(LOG_ERR, "%s: " 3934 "IPCP address option rejected\n", 3935 ifp->if_xname); 3936 } 3937 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3938 break; 3939 #ifdef notyet 3940 case IPCP_OPT_COMPRESS: 3941 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3942 break; 3943 #endif 3944 case IPCP_OPT_PRIMDNS: 3945 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3946 break; 3947 3948 case IPCP_OPT_SECDNS: 3949 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3950 break; 3951 } 3952 } 3953 if (debug) 3954 addlog("\n"); 3955 end: 3956 return; 3957 } 3958 3959 /* 3960 * Analyze the IPCP Configure-NAK option list, and adjust our 3961 * negotiation. 3962 */ 3963 static void 3964 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3965 { 3966 u_char *p, l; 3967 struct ifnet *ifp = &sp->pp_if; 3968 int debug = ifp->if_flags & IFF_DEBUG; 3969 uint32_t wantaddr; 3970 3971 KASSERT(SPPP_WLOCKED(sp)); 3972 3973 len -= sizeof(*h); 3974 3975 if (debug) 3976 log(LOG_DEBUG, "%s: ipcp nak opts:", 3977 ifp->if_xname); 3978 3979 p = (void *)(h + 1); 3980 for (; len > 1; len -= l, p += l) { 3981 l = p[1]; 3982 if (l == 0) 3983 break; 3984 3985 /* Sanity check option length */ 3986 if (l > len) { 3987 /* XXX should we just RXJ? */ 3988 addlog("%s: malicious IPCP option received, dropping\n", 3989 ifp->if_xname); 3990 return; 3991 } 3992 if (debug) 3993 addlog(" %s", sppp_ipcp_opt_name(*p)); 3994 switch (*p) { 3995 case IPCP_OPT_ADDRESS: 3996 /* 3997 * Peer doesn't like our local IP address. See 3998 * if we can do something for him. We'll drop 3999 * him our address then. 4000 */ 4001 if (len >= 6 && l == 6) { 4002 wantaddr = p[2] << 24 | p[3] << 16 | 4003 p[4] << 8 | p[5]; 4004 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 4005 if (debug) 4006 addlog(" [wantaddr %s]", 4007 sppp_dotted_quad(wantaddr)); 4008 /* 4009 * When doing dynamic address assignment, 4010 * we accept his offer. Otherwise, we 4011 * ignore it and thus continue to negotiate 4012 * our already existing value. 4013 */ 4014 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 4015 if (ntohl(wantaddr) != INADDR_ANY) { 4016 if (debug) 4017 addlog(" [agree]"); 4018 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 4019 sp->ipcp.req_myaddr = wantaddr; 4020 } else { 4021 if (debug) 4022 addlog(" [not agreed]"); 4023 } 4024 } 4025 } 4026 break; 4027 4028 case IPCP_OPT_PRIMDNS: 4029 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 4030 len >= 6 && l == 6) { 4031 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 4032 p[4] << 8 | p[5]; 4033 } 4034 break; 4035 4036 case IPCP_OPT_SECDNS: 4037 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 4038 len >= 6 && l == 6) { 4039 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 4040 p[4] << 8 | p[5]; 4041 } 4042 break; 4043 #ifdef notyet 4044 case IPCP_OPT_COMPRESS: 4045 /* 4046 * Peer wants different compression parameters. 4047 */ 4048 break; 4049 #endif 4050 } 4051 } 4052 if (debug) 4053 addlog("\n"); 4054 } 4055 4056 static void 4057 sppp_ipcp_tlu(struct sppp *sp) 4058 { 4059 #ifdef INET 4060 struct ifnet *ifp; 4061 4062 ifp = &sp->pp_if; 4063 KASSERT(SPPP_WLOCKED(sp)); 4064 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 4065 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 4066 log(LOG_WARNING, "%s: no IP address, closing IPCP\n", 4067 ifp->if_xname); 4068 sppp_wq_add(sp->wq_cp, 4069 &sp->scp[IDX_IPCP].work_close); 4070 } else { 4071 /* we are up. Set addresses and notify anyone interested */ 4072 sppp_set_ip_addrs(sp); 4073 } 4074 #endif 4075 } 4076 4077 static void 4078 sppp_ipcp_scr(struct sppp *sp) 4079 { 4080 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 4081 #ifdef INET 4082 uint32_t ouraddr; 4083 #endif 4084 int i = 0; 4085 4086 KASSERT(SPPP_WLOCKED(sp)); 4087 4088 #ifdef notyet 4089 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 4090 opt[i++] = IPCP_OPT_COMPRESSION; 4091 opt[i++] = 6; 4092 opt[i++] = 0; /* VJ header compression */ 4093 opt[i++] = 0x2d; /* VJ header compression */ 4094 opt[i++] = max_slot_id; 4095 opt[i++] = comp_slot_id; 4096 } 4097 #endif 4098 4099 #ifdef INET 4100 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 4101 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 4102 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 4103 } else { 4104 kpreempt_disable(); 4105 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 4106 kpreempt_enable(); 4107 } 4108 opt[i++] = IPCP_OPT_ADDRESS; 4109 opt[i++] = 6; 4110 opt[i++] = ouraddr >> 24; 4111 opt[i++] = ouraddr >> 16; 4112 opt[i++] = ouraddr >> 8; 4113 opt[i++] = ouraddr; 4114 } 4115 #endif 4116 4117 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 4118 opt[i++] = IPCP_OPT_PRIMDNS; 4119 opt[i++] = 6; 4120 opt[i++] = sp->dns_addrs[0] >> 24; 4121 opt[i++] = sp->dns_addrs[0] >> 16; 4122 opt[i++] = sp->dns_addrs[0] >> 8; 4123 opt[i++] = sp->dns_addrs[0]; 4124 } 4125 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 4126 opt[i++] = IPCP_OPT_SECDNS; 4127 opt[i++] = 6; 4128 opt[i++] = sp->dns_addrs[1] >> 24; 4129 opt[i++] = sp->dns_addrs[1] >> 16; 4130 opt[i++] = sp->dns_addrs[1] >> 8; 4131 opt[i++] = sp->dns_addrs[1]; 4132 } 4133 4134 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 4135 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 4136 } 4137 4138 /* 4139 *--------------------------------------------------------------------------* 4140 * * 4141 * The IPv6CP implementation. * 4142 * * 4143 *--------------------------------------------------------------------------* 4144 */ 4145 4146 #ifdef INET6 4147 static void 4148 sppp_ipv6cp_init(struct sppp *sp) 4149 { 4150 4151 KASSERT(SPPP_WLOCKED(sp)); 4152 4153 sppp_cp_init(&ipv6cp, sp); 4154 4155 sp->ipv6cp.opts = 0; 4156 sp->ipv6cp.flags = 0; 4157 } 4158 4159 static void 4160 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4161 { 4162 STDDCL; 4163 struct in6_addr myaddr, hisaddr; 4164 4165 KASSERT(SPPP_WLOCKED(sp)); 4166 KASSERT(!cpu_softintr_p()); 4167 4168 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4169 return; 4170 4171 #ifdef IPV6CP_MYIFID_DYN 4172 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4173 #else 4174 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4175 #endif 4176 4177 kpreempt_disable(); 4178 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4179 kpreempt_enable(); 4180 /* 4181 * If we don't have our address, this probably means our 4182 * interface doesn't want to talk IPv6 at all. (This could 4183 * be the case if somebody wants to speak only IPX, for 4184 * example.) Don't open IPv6CP in this case. 4185 */ 4186 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4187 /* XXX this message should go away */ 4188 if (debug) 4189 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 4190 ifp->if_xname); 4191 return; 4192 } 4193 4194 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4195 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4196 sppp_open_event(sp, xcp); 4197 } 4198 4199 /* 4200 * Analyze a configure request. Return true if it was agreeable, and 4201 * caused action sca, false if it has been rejected or nak'ed, and 4202 * caused action scn. (The return value is used to make the state 4203 * transition decision in the state automaton.) 4204 */ 4205 static enum cp_rcr_type 4206 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4207 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4208 { 4209 u_char *buf, *r, *p, l, blen; 4210 struct ifnet *ifp = &sp->pp_if; 4211 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 4212 struct in6_addr myaddr, desiredaddr, suggestaddr; 4213 enum cp_rcr_type type; 4214 int ifidcount; 4215 int collision, nohisaddr; 4216 char ip6buf[INET6_ADDRSTRLEN]; 4217 4218 KASSERT(SPPP_WLOCKED(sp)); 4219 4220 type = CP_RCR_NONE; 4221 origlen -= sizeof(*h); 4222 4223 if (origlen < 0) 4224 return CP_RCR_DROP; 4225 4226 /* 4227 * Make sure to allocate a buf that can at least hold a 4228 * conf-nak with an `address' option. We might need it below. 4229 */ 4230 blen = MAX(6, origlen); 4231 4232 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4233 if (buf == NULL) 4234 return CP_RCR_DROP; 4235 4236 /* pass 1: see if we can recognize them */ 4237 if (debug) 4238 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 4239 ifp->if_xname); 4240 p = (void *)(h + 1); 4241 r = buf; 4242 rlen = 0; 4243 ifidcount = 0; 4244 for (len = origlen; len > 1; len -= l, p += l) { 4245 l = p[1]; 4246 if (l == 0) 4247 break; 4248 4249 /* Sanity check option length */ 4250 if (l > len) { 4251 /* XXX just RXJ? */ 4252 addlog("%s: received malicious IPCPv6 option, " 4253 "dropping\n", ifp->if_xname); 4254 type = CP_RCR_ERR; 4255 goto end; 4256 } 4257 if (debug) 4258 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4259 switch (p[0]) { 4260 case IPV6CP_OPT_IFID: 4261 if (len >= 10 && l == 10 && ifidcount == 0) { 4262 /* correctly formed address option */ 4263 ifidcount++; 4264 continue; 4265 } 4266 if (debug) 4267 addlog(" [invalid]"); 4268 break; 4269 #ifdef notyet 4270 case IPV6CP_OPT_COMPRESSION: 4271 if (len >= 4 && l >= 4) { 4272 /* correctly formed compress option */ 4273 continue; 4274 } 4275 if (debug) 4276 addlog(" [invalid]"); 4277 break; 4278 #endif 4279 default: 4280 /* Others not supported. */ 4281 if (debug) 4282 addlog(" [rej]"); 4283 break; 4284 } 4285 if (rlen + l > blen) { 4286 if (debug) 4287 addlog(" [overflow]"); 4288 continue; 4289 } 4290 /* Add the option to rejected list. */ 4291 memcpy(r, p, l); 4292 r += l; 4293 rlen += l; 4294 } 4295 4296 if (rlen > 0) { 4297 type = CP_RCR_REJ; 4298 goto end; 4299 } 4300 4301 if (debug) 4302 addlog("\n"); 4303 4304 /* pass 2: parse option values */ 4305 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4306 if (debug) 4307 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 4308 ifp->if_xname); 4309 p = (void *)(h + 1); 4310 r = buf; 4311 rlen = 0; 4312 type = CP_RCR_ACK; 4313 for (len = origlen; len > 1; len -= l, p += l) { 4314 l = p[1]; 4315 if (l == 0) 4316 break; 4317 4318 if (debug) 4319 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4320 switch (p[0]) { 4321 #ifdef notyet 4322 case IPV6CP_OPT_COMPRESSION: 4323 continue; 4324 #endif 4325 case IPV6CP_OPT_IFID: 4326 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4327 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4328 collision = (memcmp(&desiredaddr.s6_addr[8], 4329 &myaddr.s6_addr[8], 8) == 0); 4330 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4331 4332 desiredaddr.s6_addr16[0] = htons(0xfe80); 4333 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4334 4335 if (!collision && !nohisaddr) { 4336 /* no collision, hisaddr known - Conf-Ack */ 4337 type = CP_RCR_ACK; 4338 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4339 sizeof(sp->ipv6cp.my_ifid)); 4340 memcpy(sp->ipv6cp.his_ifid, 4341 &desiredaddr.s6_addr[8], 4342 sizeof(sp->ipv6cp.my_ifid)); 4343 4344 if (debug) { 4345 addlog(" %s [%s]", 4346 IN6_PRINT(ip6buf, &desiredaddr), 4347 sppp_cp_type_name(CONF_ACK)); 4348 } 4349 continue; 4350 } 4351 4352 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4353 if (collision && nohisaddr) { 4354 /* collision, hisaddr unknown - Conf-Rej */ 4355 type = CP_RCR_REJ; 4356 memset(&p[2], 0, 8); 4357 } else { 4358 /* 4359 * - no collision, hisaddr unknown, or 4360 * - collision, hisaddr known 4361 * Conf-Nak, suggest hisaddr 4362 */ 4363 type = CP_RCR_NAK; 4364 sppp_suggest_ip6_addr(sp, &suggestaddr); 4365 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4366 } 4367 if (debug) { 4368 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4369 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4370 sppp_cp_type_name(ctype)); 4371 } 4372 break; 4373 } 4374 if (rlen + l > blen) { 4375 if (debug) 4376 addlog(" [overflow]"); 4377 continue; 4378 } 4379 /* Add the option to nak'ed list. */ 4380 memcpy(r, p, l); 4381 r += l; 4382 rlen += l; 4383 } 4384 4385 if (rlen > 0) { 4386 if (type != CP_RCR_ACK) { 4387 if (debug) { 4388 int ctype ; 4389 ctype = type == CP_RCR_REJ ? 4390 CONF_REJ : CONF_NAK; 4391 addlog(" send %s suggest %s\n", 4392 sppp_cp_type_name(ctype), 4393 IN6_PRINT(ip6buf, &suggestaddr)); 4394 } 4395 } 4396 #ifdef notdef 4397 if (type == CP_RCR_ACK) 4398 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4399 #endif 4400 } else { 4401 if (type == CP_RCR_ACK) { 4402 rlen = origlen; 4403 memcpy(r, h + 1, rlen); 4404 } 4405 } 4406 end: 4407 if (debug) 4408 addlog("\n"); 4409 4410 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4411 if (buf != NULL) 4412 kmem_intr_free(buf, blen); 4413 } else { 4414 *msgbuf = buf; 4415 *buflen = blen; 4416 *msglen = rlen; 4417 } 4418 4419 return type; 4420 } 4421 4422 /* 4423 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4424 * negotiation. 4425 */ 4426 static void 4427 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4428 { 4429 u_char *p, l; 4430 struct ifnet *ifp = &sp->pp_if; 4431 int debug = ifp->if_flags & IFF_DEBUG; 4432 4433 KASSERT(SPPP_WLOCKED(sp)); 4434 4435 if (len <= sizeof(*h)) 4436 return; 4437 4438 len -= sizeof(*h); 4439 4440 if (debug) 4441 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 4442 ifp->if_xname); 4443 4444 p = (void *)(h + 1); 4445 for (; len > 1; len -= l, p += l) { 4446 l = p[1]; 4447 if (l == 0) 4448 break; 4449 4450 if (l > len) { 4451 /* XXX just RXJ? */ 4452 addlog("%s: received malicious IPCPv6 option, " 4453 "dropping\n", ifp->if_xname); 4454 goto end; 4455 } 4456 if (debug) 4457 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4458 switch (p[0]) { 4459 case IPV6CP_OPT_IFID: 4460 /* 4461 * Peer doesn't grok address option. This is 4462 * bad. XXX Should we better give up here? 4463 */ 4464 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4465 break; 4466 #ifdef notyet 4467 case IPV6CP_OPT_COMPRESS: 4468 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4469 break; 4470 #endif 4471 } 4472 } 4473 if (debug) 4474 addlog("\n"); 4475 end: 4476 return; 4477 } 4478 4479 /* 4480 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4481 * negotiation. 4482 */ 4483 static void 4484 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4485 { 4486 u_char *p, l; 4487 struct ifnet *ifp = &sp->pp_if; 4488 int debug = ifp->if_flags & IFF_DEBUG; 4489 struct in6_addr suggestaddr; 4490 char ip6buf[INET6_ADDRSTRLEN]; 4491 4492 KASSERT(SPPP_WLOCKED(sp)); 4493 4494 if (len <= sizeof(*h)) 4495 return; 4496 4497 len -= sizeof(*h); 4498 4499 if (debug) 4500 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 4501 ifp->if_xname); 4502 4503 p = (void *)(h + 1); 4504 for (; len > 1; len -= l, p += l) { 4505 l = p[1]; 4506 if (l == 0) 4507 break; 4508 4509 if (l > len) { 4510 /* XXX just RXJ? */ 4511 addlog("%s: received malicious IPCPv6 option, " 4512 "dropping\n", ifp->if_xname); 4513 goto end; 4514 } 4515 if (debug) 4516 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 4517 switch (p[0]) { 4518 case IPV6CP_OPT_IFID: 4519 /* 4520 * Peer doesn't like our local ifid. See 4521 * if we can do something for him. We'll drop 4522 * him our address then. 4523 */ 4524 if (len < 10 || l != 10) 4525 break; 4526 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4527 suggestaddr.s6_addr16[0] = htons(0xfe80); 4528 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4529 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4530 4531 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4532 if (debug) 4533 addlog(" [suggestaddr %s]", 4534 IN6_PRINT(ip6buf, &suggestaddr)); 4535 #ifdef IPV6CP_MYIFID_DYN 4536 /* 4537 * When doing dynamic address assignment, 4538 * we accept his offer. 4539 */ 4540 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4541 struct in6_addr lastsuggest; 4542 /* 4543 * If <suggested myaddr from peer> equals to 4544 * <hisaddr we have suggested last time>, 4545 * we have a collision. generate new random 4546 * ifid. 4547 */ 4548 sppp_suggest_ip6_addr(&lastsuggest); 4549 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4550 lastsuggest)) { 4551 if (debug) 4552 addlog(" [random]"); 4553 sppp_gen_ip6_addr(sp, &suggestaddr); 4554 } 4555 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4556 if (debug) 4557 addlog(" [agree]"); 4558 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4559 } 4560 #else 4561 /* 4562 * Since we do not do dynamic address assignment, 4563 * we ignore it and thus continue to negotiate 4564 * our already existing value. This can possibly 4565 * go into infinite request-reject loop. 4566 * 4567 * This is not likely because we normally use 4568 * ifid based on MAC-address. 4569 * If you have no ethernet card on the node, too bad. 4570 * XXX should we use fail_counter? 4571 */ 4572 #endif 4573 break; 4574 #ifdef notyet 4575 case IPV6CP_OPT_COMPRESS: 4576 /* 4577 * Peer wants different compression parameters. 4578 */ 4579 break; 4580 #endif 4581 } 4582 } 4583 if (debug) 4584 addlog("\n"); 4585 end: 4586 return; 4587 } 4588 4589 static void 4590 sppp_ipv6cp_tlu(struct sppp *sp) 4591 { 4592 4593 KASSERT(SPPP_WLOCKED(sp)); 4594 /* we are up - notify isdn daemon */ 4595 sppp_notify_con_wlocked(sp); 4596 } 4597 4598 static void 4599 sppp_ipv6cp_scr(struct sppp *sp) 4600 { 4601 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4602 struct in6_addr ouraddr; 4603 int i = 0; 4604 4605 KASSERT(SPPP_WLOCKED(sp)); 4606 4607 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4608 kpreempt_disable(); 4609 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4610 kpreempt_enable(); 4611 4612 opt[i++] = IPV6CP_OPT_IFID; 4613 opt[i++] = 10; 4614 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4615 i += 8; 4616 } 4617 4618 #ifdef notyet 4619 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4620 opt[i++] = IPV6CP_OPT_COMPRESSION; 4621 opt[i++] = 4; 4622 opt[i++] = 0; /* TBD */ 4623 opt[i++] = 0; /* TBD */ 4624 /* variable length data may follow */ 4625 } 4626 #endif 4627 4628 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4629 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4630 } 4631 #else /*INET6*/ 4632 static void 4633 sppp_ipv6cp_init(struct sppp *sp) 4634 { 4635 4636 KASSERT(SPPP_WLOCKED(sp)); 4637 } 4638 4639 static void 4640 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4641 { 4642 4643 KASSERT(SPPP_WLOCKED(sp)); 4644 } 4645 4646 static enum cp_rcr_type 4647 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4648 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4649 { 4650 4651 KASSERT(SPPP_WLOCKED(sp)); 4652 return 0; 4653 } 4654 4655 static void 4656 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4657 int len) 4658 { 4659 4660 KASSERT(SPPP_WLOCKED(sp)); 4661 } 4662 4663 static void 4664 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4665 int len) 4666 { 4667 4668 KASSERT(SPPP_WLOCKED(sp)); 4669 } 4670 4671 static void 4672 sppp_ipv6cp_tlu(struct sppp *sp) 4673 { 4674 4675 KASSERT(SPPP_WLOCKED(sp)); 4676 } 4677 4678 static void 4679 sppp_ipv6cp_scr(struct sppp *sp) 4680 { 4681 4682 KASSERT(SPPP_WLOCKED(sp)); 4683 } 4684 #endif /*INET6*/ 4685 4686 /* 4687 *--------------------------------------------------------------------------* 4688 * * 4689 * The CHAP implementation. * 4690 * * 4691 *--------------------------------------------------------------------------* 4692 */ 4693 /* 4694 * The authentication protocols is implemented on the state machine for 4695 * control protocols. And it uses following actions and events. 4696 * 4697 * Actions: 4698 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4699 * - sca: send CHAP_SUCCESS 4700 * - scn: send CHAP_FAILURE and shutdown lcp 4701 * Events: 4702 * - RCR+: receive CHAP_RESPONSE containing correct digest 4703 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4704 * - RCA: receive CHAP_SUCCESS 4705 * - RCN: (this event is unused) 4706 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4707 * - TO-: this layer finish 4708 */ 4709 4710 /* 4711 * Handle incoming CHAP packets. 4712 */ 4713 void 4714 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4715 { 4716 STDDCL; 4717 struct lcp_header *h; 4718 int len, x; 4719 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4720 int value_len, name_len; 4721 MD5_CTX ctx; 4722 4723 len = m->m_pkthdr.len; 4724 if (len < 4) { 4725 if (debug) 4726 log(LOG_DEBUG, 4727 "%s: chap invalid packet length: %d bytes\n", 4728 ifp->if_xname, len); 4729 return; 4730 } 4731 h = mtod(m, struct lcp_header *); 4732 if (len > ntohs(h->len)) 4733 len = ntohs(h->len); 4734 4735 SPPP_LOCK(sp, RW_WRITER); 4736 4737 switch (h->type) { 4738 /* challenge, failure and success are his authproto */ 4739 case CHAP_CHALLENGE: 4740 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4741 /* can't do anything useful */ 4742 sp->pp_auth_failures++; 4743 printf("%s: chap input without my name and my secret being set\n", 4744 ifp->if_xname); 4745 break; 4746 } 4747 value = 1 + (u_char *)(h + 1); 4748 value_len = value[-1]; 4749 name = value + value_len; 4750 name_len = len - value_len - 5; 4751 if (name_len < 0) { 4752 if (debug) { 4753 log(LOG_DEBUG, 4754 "%s: chap corrupted challenge " 4755 "<%s id=0x%x len=%d", 4756 ifp->if_xname, 4757 sppp_auth_type_name(PPP_CHAP, h->type), 4758 h->ident, ntohs(h->len)); 4759 if (len > 4) 4760 sppp_print_bytes((u_char *)(h + 1), 4761 len - 4); 4762 addlog(">\n"); 4763 } 4764 break; 4765 } 4766 4767 if (debug) { 4768 log(LOG_DEBUG, 4769 "%s: chap input <%s id=0x%x len=%d name=", 4770 ifp->if_xname, 4771 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 4772 ntohs(h->len)); 4773 sppp_print_string((char *) name, name_len); 4774 addlog(" value-size=%d value=", value_len); 4775 sppp_print_bytes(value, value_len); 4776 addlog(">\n"); 4777 } 4778 4779 /* Compute reply value. */ 4780 MD5Init(&ctx); 4781 MD5Update(&ctx, &h->ident, 1); 4782 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4783 MD5Update(&ctx, value, value_len); 4784 MD5Final(sp->chap.digest, &ctx); 4785 sp->chap.digest_len = sizeof(sp->chap.digest); 4786 sp->scp[IDX_CHAP].rconfid = h->ident; 4787 4788 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4789 break; 4790 4791 case CHAP_SUCCESS: 4792 if (debug) { 4793 log(LOG_DEBUG, "%s: chap success", 4794 ifp->if_xname); 4795 if (len > 4) { 4796 addlog(": "); 4797 sppp_print_string((char *)(h + 1), len - 4); 4798 } 4799 addlog("\n"); 4800 } 4801 4802 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4803 if (debug) { 4804 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4805 ifp->if_xname, chap.name, 4806 h->ident, sp->scp[IDX_CHAP].rconfid); 4807 } 4808 if_statinc(ifp, if_ierrors); 4809 break; 4810 } 4811 4812 if (sp->chap.digest_len == 0) { 4813 if (debug) { 4814 log(LOG_DEBUG, 4815 "%s: receive CHAP success without challenge\n", 4816 ifp->if_xname); 4817 } 4818 if_statinc(ifp, if_ierrors); 4819 break; 4820 } 4821 4822 x = splnet(); 4823 sp->pp_auth_failures = 0; 4824 sp->pp_flags &= ~PP_NEEDAUTH; 4825 splx(x); 4826 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4827 sp->chap.digest_len = 0; 4828 4829 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4830 /* 4831 * we are not authenticator for CHAP, 4832 * generate a dummy RCR+ event without CHAP_RESPONSE 4833 */ 4834 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4835 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4836 } 4837 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4838 break; 4839 4840 case CHAP_FAILURE: 4841 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4842 if (debug) { 4843 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4844 ifp->if_xname, chap.name, 4845 h->ident, sp->scp[IDX_CHAP].rconfid); 4846 } 4847 if_statinc(ifp, if_ierrors); 4848 break; 4849 } 4850 4851 if (sp->chap.digest_len == 0) { 4852 if (debug) { 4853 log(LOG_DEBUG, 4854 "%s: receive CHAP failure without challenge\n", 4855 ifp->if_xname); 4856 } 4857 if_statinc(ifp, if_ierrors); 4858 break; 4859 } 4860 4861 x = splnet(); 4862 sp->pp_auth_failures++; 4863 splx(x); 4864 if (debug) { 4865 log(LOG_INFO, "%s: chap failure", 4866 ifp->if_xname); 4867 if (len > 4) { 4868 addlog(": "); 4869 sppp_print_string((char *)(h + 1), len - 4); 4870 } 4871 addlog("\n"); 4872 } else 4873 log(LOG_INFO, "%s: chap failure\n", 4874 ifp->if_xname); 4875 4876 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4877 sp->chap.digest_len = 0; 4878 /* 4879 * await LCP shutdown by authenticator, 4880 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4881 */ 4882 break; 4883 4884 /* response is my authproto */ 4885 case CHAP_RESPONSE: 4886 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4887 /* can't do anything useful */ 4888 printf("%s: chap response" 4889 " without his name and his secret being set\n", 4890 ifp->if_xname); 4891 break; 4892 } 4893 value = 1 + (u_char *)(h + 1); 4894 value_len = value[-1]; 4895 name = value + value_len; 4896 name_len = len - value_len - 5; 4897 if (name_len < 0) { 4898 if (debug) { 4899 log(LOG_DEBUG, 4900 "%s: chap corrupted response " 4901 "<%s id=0x%x len=%d", 4902 ifp->if_xname, 4903 sppp_auth_type_name(PPP_CHAP, h->type), 4904 h->ident, ntohs(h->len)); 4905 if (len > 4) 4906 sppp_print_bytes((u_char *)(h + 1), 4907 len - 4); 4908 addlog(">\n"); 4909 } 4910 break; 4911 } 4912 if (h->ident != sp->scp[IDX_CHAP].confid) { 4913 if (debug) 4914 log(LOG_DEBUG, 4915 "%s: chap dropping response for old ID " 4916 "(got %d, expected %d)\n", 4917 ifp->if_xname, 4918 h->ident, sp->scp[IDX_CHAP].confid); 4919 break; 4920 } else { 4921 sp->scp[IDX_CHAP].rconfid = h->ident; 4922 } 4923 4924 if (sp->hisauth.name != NULL && 4925 (name_len != sp->hisauth.name_len 4926 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4927 log(LOG_INFO, "%s: chap response, his name ", 4928 ifp->if_xname); 4929 sppp_print_string(name, name_len); 4930 addlog(" != expected "); 4931 sppp_print_string(sp->hisauth.name, 4932 sp->hisauth.name_len); 4933 addlog("\n"); 4934 4935 /* generate RCR- event */ 4936 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4937 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4938 break; 4939 } 4940 4941 if (debug) { 4942 log(LOG_DEBUG, "%s: chap input(%s) " 4943 "<%s id=0x%x len=%d name=", 4944 ifp->if_xname, 4945 sppp_state_name(sp->scp[IDX_CHAP].state), 4946 sppp_auth_type_name(PPP_CHAP, h->type), 4947 h->ident, ntohs(h->len)); 4948 sppp_print_string((char *)name, name_len); 4949 addlog(" value-size=%d value=", value_len); 4950 sppp_print_bytes(value, value_len); 4951 addlog(">\n"); 4952 } 4953 4954 if (value_len == sizeof(sp->chap.challenge) && 4955 value_len == sizeof(sp->chap.digest)) { 4956 MD5Init(&ctx); 4957 MD5Update(&ctx, &h->ident, 1); 4958 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4959 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4960 MD5Final(digest, &ctx); 4961 4962 if (memcmp(digest, value, value_len) == 0) { 4963 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4964 } else { 4965 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4966 } 4967 } else { 4968 if (debug) 4969 log(LOG_DEBUG, 4970 "%s: chap bad hash value length: " 4971 "%d bytes, should be %zu\n", 4972 ifp->if_xname, value_len, 4973 sizeof(sp->chap.challenge)); 4974 4975 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4976 } 4977 4978 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4979 4980 /* generate a dummy RCA event */ 4981 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4982 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4983 sp->chap.rechallenging)) { 4984 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4985 } 4986 break; 4987 4988 default: 4989 /* Unknown CHAP packet type -- ignore. */ 4990 if (debug) { 4991 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4992 "<0x%x id=0x%xh len=%d", 4993 ifp->if_xname, 4994 sppp_state_name(sp->scp[IDX_CHAP].state), 4995 h->type, h->ident, ntohs(h->len)); 4996 if (len > 4) 4997 sppp_print_bytes((u_char *)(h + 1), len - 4); 4998 addlog(">\n"); 4999 } 5000 break; 5001 5002 } 5003 5004 SPPP_UNLOCK(sp); 5005 } 5006 5007 static void 5008 sppp_chap_init(struct sppp *sp) 5009 { 5010 5011 KASSERT(SPPP_WLOCKED(sp)); 5012 5013 sppp_cp_init(&chap, sp); 5014 5015 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 5016 sppp_chap_rcv_challenge_event, &chap); 5017 } 5018 5019 static void 5020 sppp_chap_open(struct sppp *sp, void *xcp) 5021 { 5022 5023 KASSERT(SPPP_WLOCKED(sp)); 5024 5025 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 5026 sp->chap.digest_len = 0; 5027 sp->chap.rechallenging = false; 5028 sp->chap.response_rcvd = false; 5029 sppp_open_event(sp, xcp); 5030 } 5031 5032 static void 5033 sppp_chap_tlu(struct sppp *sp) 5034 { 5035 STDDCL; 5036 int i, x; 5037 5038 KASSERT(SPPP_WLOCKED(sp)); 5039 5040 i = 0; 5041 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 5042 x = splnet(); 5043 sp->pp_auth_failures = 0; 5044 splx(x); 5045 5046 log(LOG_DEBUG, "%s: chap %s", ifp->if_xname, 5047 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 5048 5049 /* 5050 * Some broken CHAP implementations (Conware CoNet, firmware 5051 * 4.0.?) don't want to re-authenticate their CHAP once the 5052 * initial challenge-response exchange has taken place. 5053 * Provide for an option to avoid rechallenges. 5054 */ 5055 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 5056 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5057 /* 5058 * Compute the re-challenge timeout. This will yield 5059 * a number between 300 and 810 seconds. 5060 */ 5061 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 5062 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 5063 5064 if (debug) { 5065 addlog(", next rechallenge in %d seconds", i); 5066 } 5067 } 5068 5069 addlog("\n"); 5070 5071 /* 5072 * If we are already in phase network, we are done here. This 5073 * is the case if this is a dummy tlu event after a re-challenge. 5074 */ 5075 if (sp->pp_phase != SPPP_PHASE_NETWORK) 5076 sppp_phase_network(sp); 5077 } 5078 5079 static void 5080 sppp_chap_scr(struct sppp *sp) 5081 { 5082 uint32_t *ch; 5083 u_char clen, dsize; 5084 int role; 5085 5086 KASSERT(SPPP_WLOCKED(sp)); 5087 5088 role = sppp_auth_role(&chap, sp); 5089 5090 if (ISSET(role, SPPP_AUTH_SERV) && 5091 !sp->chap.response_rcvd) { 5092 /* we are authenticator for CHAP, send challenge */ 5093 ch = (uint32_t *)sp->chap.challenge; 5094 clen = sizeof(sp->chap.challenge); 5095 /* Compute random challenge. */ 5096 cprng_strong(kern_cprng, ch, clen, 0); 5097 5098 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 5099 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 5100 sizeof(clen), (const char *)&clen, 5101 sizeof(sp->chap.challenge), sp->chap.challenge, 5102 0); 5103 } 5104 5105 if (ISSET(role, SPPP_AUTH_PEER) && 5106 sp->chap.digest_len > 0) { 5107 /* we are peer for CHAP, send response */ 5108 dsize = sp->chap.digest_len; 5109 5110 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 5111 sizeof(dsize), (const char *)&dsize, 5112 sp->chap.digest_len, sp->chap.digest, 5113 sp->myauth.name_len, sp->myauth.name, 0); 5114 } 5115 } 5116 5117 static void 5118 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5119 { 5120 const struct cp *cp = xcp; 5121 5122 KASSERT(!cpu_softintr_p()); 5123 5124 sp->chap.rechallenging = false; 5125 5126 switch (sp->scp[IDX_CHAP].state) { 5127 case STATE_REQ_SENT: 5128 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5129 cp->scr(sp); 5130 break; 5131 case STATE_OPENED: 5132 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5133 cp->scr(sp); 5134 break; 5135 } 5136 } 5137 5138 /* 5139 *--------------------------------------------------------------------------* 5140 * * 5141 * The PAP implementation. * 5142 * * 5143 *--------------------------------------------------------------------------* 5144 */ 5145 /* 5146 * PAP uses following actions and events. 5147 * Actions: 5148 * - scr: send PAP_REQ 5149 * - sca: send PAP_ACK 5150 * - scn: send PAP_NAK 5151 * Events: 5152 * - RCR+: receive PAP_REQ containing correct username and password 5153 * - RCR-: receive PAP_REQ containing wrong username and password 5154 * - RCA: receive PAP_ACK 5155 * - RCN: (this event is unused) 5156 * - TO+: re-send PAP_REQ 5157 * - TO-: this layer finish 5158 */ 5159 5160 /* 5161 * Handle incoming PAP packets. */ 5162 static void 5163 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5164 { 5165 STDDCL; 5166 struct lcp_header *h; 5167 int len, x; 5168 char *name, *secret; 5169 int name_len, secret_len; 5170 5171 /* 5172 * Malicious input might leave this uninitialized, so 5173 * init to an impossible value. 5174 */ 5175 secret_len = -1; 5176 5177 len = m->m_pkthdr.len; 5178 if (len < 5) { 5179 if (debug) 5180 log(LOG_DEBUG, 5181 "%s: pap invalid packet length: %d bytes\n", 5182 ifp->if_xname, len); 5183 return; 5184 } 5185 h = mtod(m, struct lcp_header *); 5186 if (len > ntohs(h->len)) 5187 len = ntohs(h->len); 5188 5189 SPPP_LOCK(sp, RW_WRITER); 5190 5191 switch (h->type) { 5192 /* PAP request is my authproto */ 5193 case PAP_REQ: 5194 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5195 /* can't do anything useful */ 5196 printf("%s: pap request" 5197 " without his name and his secret being set\n", 5198 ifp->if_xname); 5199 break; 5200 } 5201 name = 1 + (u_char *)(h + 1); 5202 name_len = name[-1]; 5203 secret = name + name_len + 1; 5204 if (name_len > len - 6 || 5205 (secret_len = secret[-1]) > len - 6 - name_len) { 5206 if (debug) { 5207 log(LOG_DEBUG, "%s: pap corrupted input " 5208 "<%s id=0x%x len=%d", 5209 ifp->if_xname, 5210 sppp_auth_type_name(PPP_PAP, h->type), 5211 h->ident, ntohs(h->len)); 5212 if (len > 4) 5213 sppp_print_bytes((u_char *)(h + 1), 5214 len - 4); 5215 addlog(">\n"); 5216 } 5217 break; 5218 } 5219 if (debug) { 5220 log(LOG_DEBUG, "%s: pap input(%s) " 5221 "<%s id=0x%x len=%d name=", 5222 ifp->if_xname, 5223 sppp_state_name(sp->scp[IDX_PAP].state), 5224 sppp_auth_type_name(PPP_PAP, h->type), 5225 h->ident, ntohs(h->len)); 5226 sppp_print_string((char *)name, name_len); 5227 addlog(" secret="); 5228 sppp_print_string((char *)secret, secret_len); 5229 addlog(">\n"); 5230 } 5231 5232 sp->scp[IDX_PAP].rconfid = h->ident; 5233 5234 if (name_len == sp->hisauth.name_len && 5235 memcmp(name, sp->hisauth.name, name_len) == 0 && 5236 secret_len == sp->hisauth.secret_len && 5237 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5238 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5239 } else { 5240 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5241 } 5242 5243 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5244 5245 /* generate a dummy RCA event */ 5246 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5247 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5248 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5249 } 5250 break; 5251 5252 /* ack and nak are his authproto */ 5253 case PAP_ACK: 5254 if (debug) { 5255 log(LOG_DEBUG, "%s: pap success", 5256 ifp->if_xname); 5257 name = 1 + (u_char *)(h + 1); 5258 name_len = name[-1]; 5259 if (len > 5 && name_len < len+4) { 5260 addlog(": "); 5261 sppp_print_string(name, name_len); 5262 } 5263 addlog("\n"); 5264 } 5265 5266 if (h->ident != sp->scp[IDX_PAP].confid) { 5267 if (debug) { 5268 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5269 ifp->if_xname, pap.name, 5270 h->ident, sp->scp[IDX_PAP].rconfid); 5271 } 5272 if_statinc(ifp, if_ierrors); 5273 break; 5274 } 5275 5276 x = splnet(); 5277 sp->pp_auth_failures = 0; 5278 sp->pp_flags &= ~PP_NEEDAUTH; 5279 splx(x); 5280 5281 /* we are not authenticator, generate a dummy RCR+ event */ 5282 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5283 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5284 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5285 } 5286 5287 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5288 break; 5289 5290 case PAP_NAK: 5291 if (debug) { 5292 log(LOG_INFO, "%s: pap failure", 5293 ifp->if_xname); 5294 name = 1 + (u_char *)(h + 1); 5295 name_len = name[-1]; 5296 if (len > 5 && name_len < len+4) { 5297 addlog(": "); 5298 sppp_print_string(name, name_len); 5299 } 5300 addlog("\n"); 5301 } else 5302 log(LOG_INFO, "%s: pap failure\n", 5303 ifp->if_xname); 5304 5305 if (h->ident != sp->scp[IDX_PAP].confid) { 5306 if (debug) { 5307 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5308 ifp->if_xname, pap.name, 5309 h->ident, sp->scp[IDX_PAP].rconfid); 5310 } 5311 if_statinc(ifp, if_ierrors); 5312 break; 5313 } 5314 5315 sp->pp_auth_failures++; 5316 /* 5317 * await LCP shutdown by authenticator, 5318 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5319 */ 5320 break; 5321 5322 default: 5323 /* Unknown PAP packet type -- ignore. */ 5324 if (debug) { 5325 log(LOG_DEBUG, "%s: pap corrupted input " 5326 "<0x%x id=0x%x len=%d", 5327 ifp->if_xname, 5328 h->type, h->ident, ntohs(h->len)); 5329 if (len > 4) 5330 sppp_print_bytes((u_char *)(h + 1), len - 4); 5331 addlog(">\n"); 5332 } 5333 break; 5334 } 5335 5336 SPPP_UNLOCK(sp); 5337 } 5338 5339 static void 5340 sppp_pap_init(struct sppp *sp) 5341 { 5342 5343 KASSERT(SPPP_WLOCKED(sp)); 5344 sppp_cp_init(&pap, sp); 5345 } 5346 5347 static void 5348 sppp_pap_tlu(struct sppp *sp) 5349 { 5350 STDDCL; 5351 int x; 5352 5353 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5354 5355 if (debug) 5356 log(LOG_DEBUG, "%s: %s tlu\n", 5357 ifp->if_xname, pap.name); 5358 5359 x = splnet(); 5360 sp->pp_auth_failures = 0; 5361 splx(x); 5362 5363 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5364 sppp_phase_network(sp); 5365 } 5366 5367 static void 5368 sppp_pap_scr(struct sppp *sp) 5369 { 5370 u_char idlen, pwdlen; 5371 5372 KASSERT(SPPP_WLOCKED(sp)); 5373 5374 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5375 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5376 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 5377 log(LOG_DEBUG, "%s: couldn't send PAP_REQ " 5378 "because of no name or no secret\n", 5379 sp->pp_if.if_xname); 5380 } else { 5381 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5382 pwdlen = sp->myauth.secret_len; 5383 idlen = sp->myauth.name_len; 5384 5385 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5386 sizeof idlen, (const char *)&idlen, 5387 idlen, sp->myauth.name, 5388 sizeof pwdlen, (const char *)&pwdlen, 5389 pwdlen, sp->myauth.secret, 5390 0); 5391 } 5392 } 5393 } 5394 5395 /* 5396 * Random miscellaneous functions. 5397 */ 5398 5399 /* 5400 * Send a PAP or CHAP proto packet. 5401 * 5402 * Varadic function, each of the elements for the ellipsis is of type 5403 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5404 * mlen == 0. 5405 * NOTE: never declare variadic functions with types subject to type 5406 * promotion (i.e. u_char). This is asking for big trouble depending 5407 * on the architecture you are on... 5408 */ 5409 5410 static void 5411 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5412 unsigned int type, unsigned int id, 5413 ...) 5414 { 5415 STDDCL; 5416 struct lcp_header *lh; 5417 struct mbuf *m; 5418 u_char *p; 5419 int len; 5420 size_t pkthdrlen; 5421 unsigned int mlen; 5422 const char *msg; 5423 va_list ap; 5424 5425 KASSERT(SPPP_WLOCKED(sp)); 5426 5427 MGETHDR(m, M_DONTWAIT, MT_DATA); 5428 if (! m) 5429 return; 5430 m_reset_rcvif(m); 5431 5432 if (sp->pp_flags & PP_NOFRAMING) { 5433 *mtod(m, uint16_t *) = htons(cp->proto); 5434 pkthdrlen = 2; 5435 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5436 } else { 5437 struct ppp_header *h; 5438 h = mtod(m, struct ppp_header *); 5439 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5440 h->control = PPP_UI; /* Unnumbered Info */ 5441 h->protocol = htons(cp->proto); 5442 pkthdrlen = PPP_HEADER_LEN; 5443 5444 lh = (struct lcp_header *)(h + 1); 5445 } 5446 5447 lh->type = type; 5448 lh->ident = id; 5449 p = (u_char *)(lh + 1); 5450 5451 va_start(ap, id); 5452 len = 0; 5453 5454 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5455 msg = va_arg(ap, const char *); 5456 len += mlen; 5457 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5458 va_end(ap); 5459 m_freem(m); 5460 return; 5461 } 5462 5463 memcpy(p, msg, mlen); 5464 p += mlen; 5465 } 5466 va_end(ap); 5467 5468 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5469 lh->len = htons(LCP_HEADER_LEN + len); 5470 5471 if (debug) { 5472 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 5473 ifp->if_xname, cp->name, 5474 sppp_auth_type_name(cp->proto, lh->type), 5475 lh->ident, ntohs(lh->len)); 5476 if (len) 5477 sppp_print_bytes((u_char *)(lh + 1), len); 5478 addlog(">\n"); 5479 } 5480 if (IF_QFULL(&sp->pp_cpq)) { 5481 IF_DROP(&sp->pp_fastq); 5482 IF_DROP(&ifp->if_snd); 5483 m_freem(m); 5484 if_statinc(ifp, if_oerrors); 5485 return; 5486 } 5487 5488 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5489 IF_ENQUEUE(&sp->pp_cpq, m); 5490 5491 if (! (ifp->if_flags & IFF_OACTIVE)) { 5492 SPPP_UNLOCK(sp); 5493 if_start_lock(ifp); 5494 SPPP_LOCK(sp, RW_WRITER); 5495 } 5496 } 5497 5498 static int 5499 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5500 { 5501 int role; 5502 5503 role = SPPP_AUTH_NOROLE; 5504 5505 if (sp->hisauth.proto == cp->proto && 5506 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5507 SET(role, SPPP_AUTH_SERV); 5508 5509 if (sp->myauth.proto == cp->proto) 5510 SET(role, SPPP_AUTH_PEER); 5511 5512 return role; 5513 } 5514 5515 static void 5516 sppp_auth_to_event(struct sppp *sp, void *xcp) 5517 { 5518 const struct cp *cp = xcp; 5519 bool override; 5520 int state; 5521 STDDCL; 5522 5523 KASSERT(SPPP_WLOCKED(sp)); 5524 KASSERT(!cpu_softintr_p()); 5525 5526 override = false; 5527 state = sp->scp[cp->protoidx].state; 5528 5529 if (sp->scp[cp->protoidx].rst_counter > 0) { 5530 /* override TO+ event */ 5531 switch (state) { 5532 case STATE_OPENED: 5533 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5534 override = true; 5535 sp->chap.rechallenging = true; 5536 sp->chap.response_rcvd = false; 5537 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5538 cp->scr(sp); 5539 } 5540 break; 5541 5542 case STATE_ACK_RCVD: 5543 override = true; 5544 cp->scr(sp); 5545 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5546 break; 5547 } 5548 } 5549 5550 if (override) { 5551 if (debug) 5552 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 5553 ifp->if_xname, cp->name, 5554 sppp_state_name(state), 5555 sp->scp[cp->protoidx].rst_counter); 5556 sp->scp[cp->protoidx].rst_counter--; 5557 } else { 5558 sppp_to_event(sp, xcp); 5559 } 5560 } 5561 5562 static void 5563 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5564 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5565 { 5566 static const char *succmsg = "Welcome!"; 5567 static const char *failmsg = "Failed..."; 5568 const char *msg; 5569 u_char type, mlen; 5570 5571 KASSERT(SPPP_WLOCKED(sp)); 5572 5573 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5574 return; 5575 5576 if (ctype == CONF_ACK) { 5577 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5578 msg = succmsg; 5579 mlen = sizeof(succmsg) - 1; 5580 5581 sp->pp_auth_failures = 0; 5582 } else { 5583 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5584 msg = failmsg; 5585 mlen = sizeof(failmsg) - 1; 5586 5587 /* shutdown LCP if auth failed */ 5588 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5589 sp->pp_auth_failures++; 5590 } 5591 5592 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5593 } 5594 5595 /* 5596 * Send keepalive packets, every 10 seconds. 5597 */ 5598 static void 5599 sppp_keepalive(void *dummy) 5600 { 5601 struct sppp *sp; 5602 int s; 5603 time_t now; 5604 5605 SPPPQ_LOCK(); 5606 5607 s = splnet(); 5608 now = time_uptime; 5609 for (sp=spppq; sp; sp=sp->pp_next) { 5610 struct ifnet *ifp = NULL; 5611 5612 SPPP_LOCK(sp, RW_WRITER); 5613 ifp = &sp->pp_if; 5614 5615 /* check idle timeout */ 5616 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5617 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5618 /* idle timeout is enabled for this interface */ 5619 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5620 if (ifp->if_flags & IFF_DEBUG) 5621 printf("%s: no activity for %lu seconds\n", 5622 sp->pp_if.if_xname, 5623 (unsigned long)(now-sp->pp_last_activity)); 5624 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5625 SPPP_UNLOCK(sp); 5626 continue; 5627 } 5628 } 5629 5630 /* Keepalive mode disabled or channel down? */ 5631 if (! (sp->pp_flags & PP_KEEPALIVE) || 5632 ! (ifp->if_flags & IFF_RUNNING)) { 5633 SPPP_UNLOCK(sp); 5634 continue; 5635 } 5636 5637 /* No keepalive in PPP mode if LCP not opened yet. */ 5638 if (! (sp->pp_flags & PP_CISCO) && 5639 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5640 SPPP_UNLOCK(sp); 5641 continue; 5642 } 5643 5644 /* No echo reply, but maybe user data passed through? */ 5645 if (sp->pp_max_noreceive != 0 && 5646 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5647 sp->pp_alivecnt = 0; 5648 SPPP_UNLOCK(sp); 5649 continue; 5650 } 5651 5652 /* No echo request */ 5653 if (sp->pp_alive_interval == 0) { 5654 SPPP_UNLOCK(sp); 5655 continue; 5656 } 5657 5658 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5659 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5660 SPPP_UNLOCK(sp); 5661 continue; 5662 } 5663 5664 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5665 /* No keepalive packets got. Stop the interface. */ 5666 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5667 5668 if (! (sp->pp_flags & PP_CISCO)) { 5669 printf("%s: LCP keepalive timed out, going to restart the connection\n", 5670 ifp->if_xname); 5671 sp->pp_alivecnt = 0; 5672 5673 /* we are down, close all open protocols */ 5674 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5675 5676 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5677 sp->lcp.reestablish = true; 5678 5679 SPPP_UNLOCK(sp); 5680 continue; 5681 } 5682 } 5683 if (sp->pp_alivecnt < sp->pp_maxalive) 5684 ++sp->pp_alivecnt; 5685 if (sp->pp_flags & PP_CISCO) 5686 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 5687 ++sp->scp[IDX_LCP].seq, sp->scp[IDX_LCP].rseq); 5688 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5689 int32_t nmagic = htonl(sp->lcp.magic); 5690 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5691 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5692 sp->lcp.echoid, 4, &nmagic); 5693 } 5694 5695 SPPP_UNLOCK(sp); 5696 } 5697 splx(s); 5698 sppp_keepalive_cnt++; 5699 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5700 5701 SPPPQ_UNLOCK(); 5702 } 5703 5704 #ifdef INET 5705 /* 5706 * Get both IP addresses. 5707 */ 5708 static void 5709 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5710 { 5711 struct ifnet *ifp = &sp->pp_if; 5712 struct ifaddr *ifa; 5713 struct sockaddr_in *si, *sm; 5714 uint32_t ssrc, ddst; 5715 int s; 5716 struct psref psref; 5717 5718 sm = NULL; 5719 ssrc = ddst = 0; 5720 /* 5721 * Pick the first AF_INET address from the list, 5722 * aliases don't make any sense on a p2p link anyway. 5723 */ 5724 si = 0; 5725 s = pserialize_read_enter(); 5726 IFADDR_READER_FOREACH(ifa, ifp) { 5727 if (ifa->ifa_addr->sa_family == AF_INET) { 5728 si = (struct sockaddr_in *)ifa->ifa_addr; 5729 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5730 if (si) { 5731 ifa_acquire(ifa, &psref); 5732 break; 5733 } 5734 } 5735 } 5736 pserialize_read_exit(s); 5737 if (ifa) { 5738 if (si && si->sin_addr.s_addr) { 5739 ssrc = si->sin_addr.s_addr; 5740 if (srcmask) 5741 *srcmask = ntohl(sm->sin_addr.s_addr); 5742 } 5743 5744 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5745 if (si && si->sin_addr.s_addr) 5746 ddst = si->sin_addr.s_addr; 5747 ifa_release(ifa, &psref); 5748 } 5749 5750 if (dst) *dst = ntohl(ddst); 5751 if (src) *src = ntohl(ssrc); 5752 } 5753 5754 /* 5755 * Set IP addresses. Must be called at splnet. 5756 * If an address is 0, leave it the way it is. 5757 */ 5758 static void 5759 sppp_set_ip_addrs(struct sppp *sp) 5760 { 5761 STDDCL; 5762 struct ifaddr *ifa; 5763 struct sockaddr_in *si, *dest; 5764 uint32_t myaddr = 0, hisaddr = 0; 5765 int s; 5766 5767 KASSERT(SPPP_WLOCKED(sp)); 5768 SPPP_UNLOCK(sp); 5769 IFNET_LOCK(ifp); 5770 SPPP_LOCK(sp, RW_WRITER); 5771 5772 /* 5773 * Pick the first AF_INET address from the list, 5774 * aliases don't make any sense on a p2p link anyway. 5775 */ 5776 si = dest = NULL; 5777 s = pserialize_read_enter(); 5778 IFADDR_READER_FOREACH(ifa, ifp) { 5779 if (ifa->ifa_addr->sa_family == AF_INET) { 5780 si = (struct sockaddr_in *)ifa->ifa_addr; 5781 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5782 break; 5783 } 5784 } 5785 pserialize_read_exit(s); 5786 5787 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5788 myaddr = sp->ipcp.req_myaddr; 5789 else if (si != NULL) 5790 myaddr = ntohl(si->sin_addr.s_addr); 5791 5792 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5793 hisaddr = sp->ipcp.req_hisaddr; 5794 else if (dest != NULL) 5795 hisaddr = ntohl(dest->sin_addr.s_addr); 5796 5797 if (si != NULL && dest != NULL) { 5798 int error; 5799 struct sockaddr_in new_sin = *si; 5800 struct sockaddr_in new_dst = *dest; 5801 5802 if (myaddr != 0) 5803 new_sin.sin_addr.s_addr = htonl(myaddr); 5804 if (hisaddr != 0) { 5805 new_dst.sin_addr.s_addr = htonl(hisaddr); 5806 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5807 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5808 } 5809 5810 in_addrhash_remove(ifatoia(ifa)); 5811 5812 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5813 5814 in_addrhash_insert(ifatoia(ifa)); 5815 5816 if (debug && error) 5817 { 5818 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5819 ifp->if_xname, __func__, error); 5820 } 5821 if (!error) { 5822 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5823 } 5824 } 5825 5826 IFNET_UNLOCK(ifp); 5827 5828 sppp_notify_con(sp); 5829 } 5830 5831 /* 5832 * Clear IP addresses. Must be called at splnet. 5833 */ 5834 static void 5835 sppp_clear_ip_addrs(struct sppp *sp) 5836 { 5837 STDDCL; 5838 struct ifaddr *ifa; 5839 struct sockaddr_in *si, *dest; 5840 int s; 5841 5842 KASSERT(SPPP_WLOCKED(sp)); 5843 SPPP_UNLOCK(sp); 5844 IFNET_LOCK(ifp); 5845 SPPP_LOCK(sp, RW_WRITER); 5846 5847 /* 5848 * Pick the first AF_INET address from the list, 5849 * aliases don't make any sense on a p2p link anyway. 5850 */ 5851 si = dest = NULL; 5852 s = pserialize_read_enter(); 5853 IFADDR_READER_FOREACH(ifa, ifp) { 5854 if (ifa->ifa_addr->sa_family == AF_INET) { 5855 si = (struct sockaddr_in *)ifa->ifa_addr; 5856 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5857 break; 5858 } 5859 } 5860 pserialize_read_exit(s); 5861 5862 if (si != NULL) { 5863 struct sockaddr_in new_sin = *si; 5864 struct sockaddr_in new_dst = *dest; 5865 int error; 5866 5867 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5868 new_sin.sin_addr.s_addr = 0; 5869 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5870 ntohl(sp->ipcp.saved_hisaddr) != 0) 5871 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5872 5873 in_addrhash_remove(ifatoia(ifa)); 5874 5875 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5876 5877 in_addrhash_insert(ifatoia(ifa)); 5878 5879 if (debug && error) 5880 { 5881 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5882 ifp->if_xname, __func__, error); 5883 } 5884 if (!error) { 5885 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5886 } 5887 } 5888 5889 IFNET_UNLOCK(ifp); 5890 } 5891 #endif 5892 5893 #ifdef INET6 5894 /* 5895 * Get both IPv6 addresses. 5896 */ 5897 static void 5898 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5899 struct in6_addr *srcmask) 5900 { 5901 struct ifnet *ifp = &sp->pp_if; 5902 struct ifaddr *ifa; 5903 struct sockaddr_in6 *si, *sm; 5904 struct in6_addr ssrc, ddst; 5905 int s; 5906 struct psref psref; 5907 5908 sm = NULL; 5909 memset(&ssrc, 0, sizeof(ssrc)); 5910 memset(&ddst, 0, sizeof(ddst)); 5911 /* 5912 * Pick the first link-local AF_INET6 address from the list, 5913 * aliases don't make any sense on a p2p link anyway. 5914 */ 5915 si = 0; 5916 s = pserialize_read_enter(); 5917 IFADDR_READER_FOREACH(ifa, ifp) { 5918 if (ifa->ifa_addr->sa_family == AF_INET6) { 5919 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5920 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5921 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5922 ifa_acquire(ifa, &psref); 5923 break; 5924 } 5925 } 5926 } 5927 pserialize_read_exit(s); 5928 5929 if (ifa) { 5930 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5931 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5932 if (srcmask) { 5933 memcpy(srcmask, &sm->sin6_addr, 5934 sizeof(*srcmask)); 5935 } 5936 } 5937 5938 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5939 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5940 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5941 ifa_release(ifa, &psref); 5942 } 5943 5944 if (dst) 5945 memcpy(dst, &ddst, sizeof(*dst)); 5946 if (src) 5947 memcpy(src, &ssrc, sizeof(*src)); 5948 } 5949 5950 #ifdef IPV6CP_MYIFID_DYN 5951 /* 5952 * Generate random ifid. 5953 */ 5954 static void 5955 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5956 { 5957 /* TBD */ 5958 } 5959 5960 /* 5961 * Set my IPv6 address. Must be called at splnet. 5962 */ 5963 static void 5964 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5965 { 5966 STDDCL; 5967 struct ifaddr *ifa; 5968 struct sockaddr_in6 *sin6; 5969 int s; 5970 struct psref psref; 5971 5972 KASSERT(SPPP_WLOCKED(sp)); 5973 SPPP_UNLOCK(sp); 5974 IFNET_LOCK(ifp); 5975 SPPP_LOCK(sp, RW_WRITER); 5976 5977 /* 5978 * Pick the first link-local AF_INET6 address from the list, 5979 * aliases don't make any sense on a p2p link anyway. 5980 */ 5981 5982 sin6 = NULL; 5983 s = pserialize_read_enter(); 5984 IFADDR_READER_FOREACH(ifa, ifp) 5985 { 5986 if (ifa->ifa_addr->sa_family == AF_INET6) 5987 { 5988 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5989 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5990 ifa_acquire(ifa, &psref); 5991 break; 5992 } 5993 } 5994 } 5995 pserialize_read_exit(s); 5996 5997 if (ifa && sin6) 5998 { 5999 int error; 6000 struct sockaddr_in6 new_sin6 = *sin6; 6001 6002 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 6003 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 6004 if (debug && error) 6005 { 6006 log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n", 6007 ifp->if_xname, __func__, error); 6008 } 6009 if (!error) { 6010 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 6011 } 6012 ifa_release(ifa, &psref); 6013 } 6014 6015 IFNET_UNLOCK(ifp); 6016 } 6017 #endif 6018 6019 /* 6020 * Suggest a candidate address to be used by peer. 6021 */ 6022 static void 6023 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 6024 { 6025 struct in6_addr myaddr; 6026 struct timeval tv; 6027 6028 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 6029 6030 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 6031 microtime(&tv); 6032 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 6033 myaddr.s6_addr[14] ^= 0xff; 6034 myaddr.s6_addr[15] ^= 0xff; 6035 } else { 6036 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 6037 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 6038 } 6039 if (suggest) 6040 memcpy(suggest, &myaddr, sizeof(myaddr)); 6041 } 6042 #endif /*INET6*/ 6043 6044 /* 6045 * Process ioctl requests specific to the PPP interface. 6046 * Permissions have already been checked. 6047 */ 6048 static int 6049 sppp_params(struct sppp *sp, u_long cmd, void *data) 6050 { 6051 switch (cmd) { 6052 case SPPPGETAUTHCFG: 6053 { 6054 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6055 int error; 6056 size_t len; 6057 6058 SPPP_LOCK(sp, RW_READER); 6059 6060 cfg->myauthflags = sp->myauth.flags; 6061 cfg->hisauthflags = sp->hisauth.flags; 6062 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 6063 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 6064 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 6065 if (cfg->myname_length == 0) { 6066 if (sp->myauth.name != NULL) 6067 cfg->myname_length = sp->myauth.name_len + 1; 6068 } else { 6069 if (sp->myauth.name == NULL) { 6070 cfg->myname_length = 0; 6071 } else { 6072 len = sp->myauth.name_len + 1; 6073 6074 if (cfg->myname_length < len) { 6075 SPPP_UNLOCK(sp); 6076 return (ENAMETOOLONG); 6077 } 6078 error = copyout(sp->myauth.name, cfg->myname, len); 6079 if (error) { 6080 SPPP_UNLOCK(sp); 6081 return error; 6082 } 6083 } 6084 } 6085 if (cfg->hisname_length == 0) { 6086 if (sp->hisauth.name != NULL) 6087 cfg->hisname_length = sp->hisauth.name_len + 1; 6088 } else { 6089 if (sp->hisauth.name == NULL) { 6090 cfg->hisname_length = 0; 6091 } else { 6092 len = sp->hisauth.name_len + 1; 6093 6094 if (cfg->hisname_length < len) { 6095 SPPP_UNLOCK(sp); 6096 return (ENAMETOOLONG); 6097 } 6098 error = copyout(sp->hisauth.name, cfg->hisname, len); 6099 if (error) { 6100 SPPP_UNLOCK(sp); 6101 return error; 6102 } 6103 } 6104 } 6105 SPPP_UNLOCK(sp); 6106 } 6107 break; 6108 case SPPPSETAUTHCFG: 6109 { 6110 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6111 int error; 6112 6113 SPPP_LOCK(sp, RW_WRITER); 6114 6115 if (sp->myauth.name) { 6116 free(sp->myauth.name, M_DEVBUF); 6117 sp->myauth.name = NULL; 6118 } 6119 if (sp->myauth.secret) { 6120 free(sp->myauth.secret, M_DEVBUF); 6121 sp->myauth.secret = NULL; 6122 } 6123 if (sp->hisauth.name) { 6124 free(sp->hisauth.name, M_DEVBUF); 6125 sp->hisauth.name = NULL; 6126 } 6127 if (sp->hisauth.secret) { 6128 free(sp->hisauth.secret, M_DEVBUF); 6129 sp->hisauth.secret = NULL; 6130 } 6131 6132 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6133 if (cfg->hisname_length >= MCLBYTES) { 6134 SPPP_UNLOCK(sp); 6135 return (ENAMETOOLONG); 6136 } 6137 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6138 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6139 if (error) { 6140 free(sp->hisauth.name, M_DEVBUF); 6141 sp->hisauth.name = NULL; 6142 SPPP_UNLOCK(sp); 6143 return error; 6144 } 6145 sp->hisauth.name_len = cfg->hisname_length - 1; 6146 sp->hisauth.name[sp->hisauth.name_len] = 0; 6147 } 6148 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6149 if (cfg->hissecret_length >= MCLBYTES) { 6150 SPPP_UNLOCK(sp); 6151 return (ENAMETOOLONG); 6152 } 6153 sp->hisauth.secret = malloc(cfg->hissecret_length, 6154 M_DEVBUF, M_WAITOK); 6155 error = copyin(cfg->hissecret, sp->hisauth.secret, 6156 cfg->hissecret_length); 6157 if (error) { 6158 free(sp->hisauth.secret, M_DEVBUF); 6159 sp->hisauth.secret = NULL; 6160 SPPP_UNLOCK(sp); 6161 return error; 6162 } 6163 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6164 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6165 } 6166 if (cfg->myname != NULL && cfg->myname_length > 0) { 6167 if (cfg->myname_length >= MCLBYTES) { 6168 SPPP_UNLOCK(sp); 6169 return (ENAMETOOLONG); 6170 } 6171 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6172 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6173 if (error) { 6174 free(sp->myauth.name, M_DEVBUF); 6175 sp->myauth.name = NULL; 6176 SPPP_UNLOCK(sp); 6177 return error; 6178 } 6179 sp->myauth.name_len = cfg->myname_length - 1; 6180 sp->myauth.name[sp->myauth.name_len] = 0; 6181 } 6182 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6183 if (cfg->mysecret_length >= MCLBYTES) { 6184 SPPP_UNLOCK(sp); 6185 return (ENAMETOOLONG); 6186 } 6187 sp->myauth.secret = malloc(cfg->mysecret_length, 6188 M_DEVBUF, M_WAITOK); 6189 error = copyin(cfg->mysecret, sp->myauth.secret, 6190 cfg->mysecret_length); 6191 if (error) { 6192 free(sp->myauth.secret, M_DEVBUF); 6193 sp->myauth.secret = NULL; 6194 SPPP_UNLOCK(sp); 6195 return error; 6196 } 6197 sp->myauth.secret_len = cfg->mysecret_length - 1; 6198 sp->myauth.secret[sp->myauth.secret_len] = 0; 6199 } 6200 sp->myauth.flags = cfg->myauthflags; 6201 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6202 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6203 } 6204 sp->hisauth.flags = cfg->hisauthflags; 6205 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6206 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6207 } 6208 sp->pp_auth_failures = 0; 6209 if (sp->hisauth.proto != PPP_NOPROTO) 6210 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6211 else 6212 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6213 6214 SPPP_UNLOCK(sp); 6215 } 6216 break; 6217 case SPPPGETLCPCFG: 6218 { 6219 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6220 6221 SPPP_LOCK(sp, RW_READER); 6222 lcpp->lcp_timeout = sp->lcp.timeout; 6223 SPPP_UNLOCK(sp); 6224 } 6225 break; 6226 case SPPPSETLCPCFG: 6227 { 6228 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6229 6230 SPPP_LOCK(sp, RW_WRITER); 6231 sp->lcp.timeout = lcpp->lcp_timeout; 6232 SPPP_UNLOCK(sp); 6233 } 6234 break; 6235 case SPPPGETNCPCFG: 6236 { 6237 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6238 6239 SPPP_LOCK(sp, RW_READER); 6240 ncpp->ncp_flags = sp->pp_ncpflags; 6241 SPPP_UNLOCK(sp); 6242 } 6243 break; 6244 case SPPPSETNCPCFG: 6245 { 6246 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6247 6248 SPPP_LOCK(sp, RW_WRITER); 6249 sp->pp_ncpflags = ncpp->ncp_flags; 6250 SPPP_UNLOCK(sp); 6251 } 6252 break; 6253 case SPPPGETSTATUS: 6254 { 6255 struct spppstatus *status = (struct spppstatus *)data; 6256 6257 SPPP_LOCK(sp, RW_READER); 6258 status->phase = sp->pp_phase; 6259 SPPP_UNLOCK(sp); 6260 } 6261 break; 6262 case SPPPGETSTATUSNCP: 6263 { 6264 struct spppstatusncp *status = (struct spppstatusncp *)data; 6265 6266 SPPP_LOCK(sp, RW_READER); 6267 status->phase = sp->pp_phase; 6268 status->ncpup = sppp_cp_check(sp, CP_NCP); 6269 SPPP_UNLOCK(sp); 6270 } 6271 break; 6272 case SPPPGETIDLETO: 6273 { 6274 struct spppidletimeout *to = (struct spppidletimeout *)data; 6275 6276 SPPP_LOCK(sp, RW_READER); 6277 to->idle_seconds = sp->pp_idle_timeout; 6278 SPPP_UNLOCK(sp); 6279 } 6280 break; 6281 case SPPPSETIDLETO: 6282 { 6283 struct spppidletimeout *to = (struct spppidletimeout *)data; 6284 6285 SPPP_LOCK(sp, RW_WRITER); 6286 sp->pp_idle_timeout = to->idle_seconds; 6287 SPPP_UNLOCK(sp); 6288 } 6289 break; 6290 case SPPPSETAUTHFAILURE: 6291 { 6292 struct spppauthfailuresettings *afsettings = 6293 (struct spppauthfailuresettings *)data; 6294 6295 SPPP_LOCK(sp, RW_WRITER); 6296 sp->pp_max_auth_fail = afsettings->max_failures; 6297 sp->pp_auth_failures = 0; 6298 SPPP_UNLOCK(sp); 6299 } 6300 break; 6301 case SPPPGETAUTHFAILURES: 6302 { 6303 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6304 6305 SPPP_LOCK(sp, RW_READER); 6306 stats->auth_failures = sp->pp_auth_failures; 6307 stats->max_failures = sp->pp_max_auth_fail; 6308 SPPP_UNLOCK(sp); 6309 } 6310 break; 6311 case SPPPSETDNSOPTS: 6312 { 6313 struct spppdnssettings *req = (struct spppdnssettings *)data; 6314 6315 SPPP_LOCK(sp, RW_WRITER); 6316 sp->query_dns = req->query_dns & 3; 6317 SPPP_UNLOCK(sp); 6318 } 6319 break; 6320 case SPPPGETDNSOPTS: 6321 { 6322 struct spppdnssettings *req = (struct spppdnssettings *)data; 6323 6324 SPPP_LOCK(sp, RW_READER); 6325 req->query_dns = sp->query_dns; 6326 SPPP_UNLOCK(sp); 6327 } 6328 break; 6329 case SPPPGETDNSADDRS: 6330 { 6331 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6332 6333 SPPP_LOCK(sp, RW_READER); 6334 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6335 SPPP_UNLOCK(sp); 6336 } 6337 break; 6338 case SPPPGETKEEPALIVE: 6339 { 6340 struct spppkeepalivesettings *settings = 6341 (struct spppkeepalivesettings*)data; 6342 6343 SPPP_LOCK(sp, RW_READER); 6344 settings->maxalive = sp->pp_maxalive; 6345 settings->max_noreceive = sp->pp_max_noreceive; 6346 settings->alive_interval = sp->pp_alive_interval; 6347 SPPP_UNLOCK(sp); 6348 } 6349 break; 6350 case SPPPSETKEEPALIVE: 6351 { 6352 struct spppkeepalivesettings *settings = 6353 (struct spppkeepalivesettings*)data; 6354 6355 SPPP_LOCK(sp, RW_WRITER); 6356 sp->pp_maxalive = settings->maxalive; 6357 sp->pp_max_noreceive = settings->max_noreceive; 6358 sp->pp_alive_interval = settings->alive_interval; 6359 SPPP_UNLOCK(sp); 6360 } 6361 break; 6362 case SPPPGETLCPSTATUS: 6363 { 6364 struct sppplcpstatus *status = 6365 (struct sppplcpstatus *)data; 6366 6367 SPPP_LOCK(sp, RW_READER); 6368 status->state = sp->scp[IDX_LCP].state; 6369 status->opts = sp->lcp.opts; 6370 status->magic = sp->lcp.magic; 6371 status->mru = sp->lcp.mru; 6372 SPPP_UNLOCK(sp); 6373 } 6374 break; 6375 case SPPPGETIPCPSTATUS: 6376 { 6377 struct spppipcpstatus *status = 6378 (struct spppipcpstatus *)data; 6379 u_int32_t myaddr; 6380 6381 SPPP_LOCK(sp, RW_READER); 6382 status->state = sp->scp[IDX_IPCP].state; 6383 status->opts = sp->ipcp.opts; 6384 #ifdef INET 6385 kpreempt_disable(); 6386 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6387 kpreempt_enable(); 6388 #else 6389 myaddr = 0; 6390 #endif 6391 status->myaddr = ntohl(myaddr); 6392 SPPP_UNLOCK(sp); 6393 } 6394 break; 6395 case SPPPGETIPV6CPSTATUS: 6396 { 6397 struct spppipv6cpstatus *status = 6398 (struct spppipv6cpstatus *)data; 6399 6400 SPPP_LOCK(sp, RW_READER); 6401 status->state = sp->scp[IDX_IPV6CP].state; 6402 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6403 sizeof(status->my_ifid)); 6404 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6405 sizeof(status->his_ifid)); 6406 SPPP_UNLOCK(sp); 6407 } 6408 break; 6409 default: 6410 { 6411 int ret; 6412 6413 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6414 enosys(), ret); 6415 if (ret != ENOSYS) 6416 return ret; 6417 return (EINVAL); 6418 } 6419 } 6420 return (0); 6421 } 6422 6423 static void 6424 sppp_phase_network(struct sppp *sp) 6425 { 6426 int i; 6427 6428 KASSERT(SPPP_WLOCKED(sp)); 6429 6430 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6431 6432 /* Notify NCPs now. */ 6433 for (i = 0; i < IDX_COUNT; i++) 6434 if ((cps[i])->flags & CP_NCP) 6435 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6436 } 6437 6438 static const char * 6439 sppp_cp_type_name(u_char type) 6440 { 6441 static char buf[12]; 6442 switch (type) { 6443 case CONF_REQ: return "conf-req"; 6444 case CONF_ACK: return "conf-ack"; 6445 case CONF_NAK: return "conf-nak"; 6446 case CONF_REJ: return "conf-rej"; 6447 case TERM_REQ: return "term-req"; 6448 case TERM_ACK: return "term-ack"; 6449 case CODE_REJ: return "code-rej"; 6450 case PROTO_REJ: return "proto-rej"; 6451 case ECHO_REQ: return "echo-req"; 6452 case ECHO_REPLY: return "echo-reply"; 6453 case DISC_REQ: return "discard-req"; 6454 } 6455 snprintf(buf, sizeof(buf), "0x%x", type); 6456 return buf; 6457 } 6458 6459 static const char * 6460 sppp_auth_type_name(u_short proto, u_char type) 6461 { 6462 static char buf[32]; 6463 const char *name; 6464 6465 switch (proto) { 6466 case PPP_CHAP: 6467 switch (type) { 6468 case CHAP_CHALLENGE: return "challenge"; 6469 case CHAP_RESPONSE: return "response"; 6470 case CHAP_SUCCESS: return "success"; 6471 case CHAP_FAILURE: return "failure"; 6472 default: name = "chap"; break; 6473 } 6474 break; 6475 6476 case PPP_PAP: 6477 switch (type) { 6478 case PAP_REQ: return "req"; 6479 case PAP_ACK: return "ack"; 6480 case PAP_NAK: return "nak"; 6481 default: name = "pap"; break; 6482 } 6483 break; 6484 6485 default: 6486 name = "bad"; 6487 break; 6488 } 6489 6490 snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type); 6491 return buf; 6492 } 6493 6494 static const char * 6495 sppp_lcp_opt_name(u_char opt) 6496 { 6497 static char buf[12]; 6498 switch (opt) { 6499 case LCP_OPT_MRU: return "mru"; 6500 case LCP_OPT_ASYNC_MAP: return "async-map"; 6501 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6502 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6503 case LCP_OPT_MAGIC: return "magic"; 6504 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6505 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6506 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6507 case LCP_OPT_CALL_BACK: return "callback"; 6508 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6509 case LCP_OPT_MP_MRRU: return "mrru"; 6510 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6511 case LCP_OPT_MP_EID: return "mp-eid"; 6512 } 6513 snprintf(buf, sizeof(buf), "0x%x", opt); 6514 return buf; 6515 } 6516 6517 static const char * 6518 sppp_ipcp_opt_name(u_char opt) 6519 { 6520 static char buf[12]; 6521 switch (opt) { 6522 case IPCP_OPT_ADDRESSES: return "addresses"; 6523 case IPCP_OPT_COMPRESSION: return "compression"; 6524 case IPCP_OPT_ADDRESS: return "address"; 6525 case IPCP_OPT_PRIMDNS: return "primdns"; 6526 case IPCP_OPT_SECDNS: return "secdns"; 6527 } 6528 snprintf(buf, sizeof(buf), "0x%x", opt); 6529 return buf; 6530 } 6531 6532 #ifdef INET6 6533 static const char * 6534 sppp_ipv6cp_opt_name(u_char opt) 6535 { 6536 static char buf[12]; 6537 switch (opt) { 6538 case IPV6CP_OPT_IFID: return "ifid"; 6539 case IPV6CP_OPT_COMPRESSION: return "compression"; 6540 } 6541 snprintf(buf, sizeof(buf), "0x%x", opt); 6542 return buf; 6543 } 6544 #endif 6545 6546 static const char * 6547 sppp_state_name(int state) 6548 { 6549 switch (state) { 6550 case STATE_INITIAL: return "initial"; 6551 case STATE_STARTING: return "starting"; 6552 case STATE_CLOSED: return "closed"; 6553 case STATE_STOPPED: return "stopped"; 6554 case STATE_CLOSING: return "closing"; 6555 case STATE_STOPPING: return "stopping"; 6556 case STATE_REQ_SENT: return "req-sent"; 6557 case STATE_ACK_RCVD: return "ack-rcvd"; 6558 case STATE_ACK_SENT: return "ack-sent"; 6559 case STATE_OPENED: return "opened"; 6560 } 6561 return "illegal"; 6562 } 6563 6564 static const char * 6565 sppp_phase_name(int phase) 6566 { 6567 switch (phase) { 6568 case SPPP_PHASE_DEAD: return "dead"; 6569 case SPPP_PHASE_ESTABLISH: return "establish"; 6570 case SPPP_PHASE_TERMINATE: return "terminate"; 6571 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6572 case SPPP_PHASE_NETWORK: return "network"; 6573 } 6574 return "illegal"; 6575 } 6576 6577 static const char * 6578 sppp_proto_name(u_short proto) 6579 { 6580 static char buf[12]; 6581 switch (proto) { 6582 case PPP_LCP: return "lcp"; 6583 case PPP_IPCP: return "ipcp"; 6584 case PPP_PAP: return "pap"; 6585 case PPP_CHAP: return "chap"; 6586 case PPP_IPV6CP: return "ipv6cp"; 6587 } 6588 snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto); 6589 return buf; 6590 } 6591 6592 static void 6593 sppp_print_bytes(const u_char *p, u_short len) 6594 { 6595 addlog(" %02x", *p++); 6596 while (--len > 0) 6597 addlog("-%02x", *p++); 6598 } 6599 6600 static void 6601 sppp_print_string(const char *p, u_short len) 6602 { 6603 u_char c; 6604 6605 while (len-- > 0) { 6606 c = *p++; 6607 /* 6608 * Print only ASCII chars directly. RFC 1994 recommends 6609 * using only them, but we don't rely on it. */ 6610 if (c < ' ' || c > '~') 6611 addlog("\\x%x", c); 6612 else 6613 addlog("%c", c); 6614 } 6615 } 6616 6617 static const char * 6618 sppp_dotted_quad(uint32_t addr) 6619 { 6620 static char s[16]; 6621 snprintf(s, sizeof(s), "%d.%d.%d.%d", 6622 (int)((addr >> 24) & 0xff), 6623 (int)((addr >> 16) & 0xff), 6624 (int)((addr >> 8) & 0xff), 6625 (int)(addr & 0xff)); 6626 return s; 6627 } 6628 6629 /* a dummy, used to drop uninteresting events */ 6630 static void 6631 sppp_null(struct sppp *unused) 6632 { 6633 /* do just nothing */ 6634 } 6635 6636 static void 6637 sppp_tls(const struct cp *cp, struct sppp *sp) 6638 { 6639 6640 /* notify lcp that is lower layer */ 6641 sp->lcp.protos |= (1 << cp->protoidx); 6642 6643 if (sp->scp[IDX_LCP].state == STATE_OPENED) 6644 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_up); 6645 } 6646 6647 static void 6648 sppp_tlf(const struct cp *cp, struct sppp *sp) 6649 { 6650 STDDCL; 6651 6652 if (debug) 6653 log(LOG_DEBUG, "%s: %s tlf\n", ifp->if_xname, cp->name); 6654 6655 /* notify lcp that is lower layer */ 6656 sp->lcp.protos &= ~(1 << cp->protoidx); 6657 6658 /* cleanup */ 6659 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) { 6660 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6661 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6662 } 6663 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) { 6664 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6665 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6666 } 6667 6668 sppp_lcp_check_and_close(sp); 6669 } 6670 6671 static void 6672 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6673 uint8_t ident, size_t msglen, void *msg) 6674 { 6675 STDDCL; 6676 6677 if (msglen == 0) 6678 return; 6679 6680 switch (type) { 6681 case CONF_ACK: 6682 case CONF_NAK: 6683 case CONF_REJ: 6684 break; 6685 default: 6686 return; 6687 } 6688 6689 if (debug) { 6690 log(LOG_DEBUG, "%s: send %s\n", 6691 ifp->if_xname, sppp_cp_type_name(type)); 6692 } 6693 6694 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6695 } 6696 6697 static void 6698 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6699 { 6700 6701 SPPP_UNLOCK(sp); 6702 if_down(&sp->pp_if); 6703 IF_PURGE(&sp->pp_cpq); 6704 SPPP_LOCK(sp, RW_WRITER); 6705 } 6706 6707 static void 6708 sppp_notify_up(struct sppp *sp) 6709 { 6710 6711 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6712 } 6713 6714 static void 6715 sppp_notify_down(struct sppp *sp) 6716 { 6717 6718 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6719 } 6720 6721 static void 6722 sppp_notify_tls_wlocked(struct sppp *sp) 6723 { 6724 6725 KASSERT(SPPP_WLOCKED(sp)); 6726 6727 if (!sp->pp_tls) 6728 return; 6729 6730 SPPP_UNLOCK(sp); 6731 sp->pp_tls(sp); 6732 SPPP_LOCK(sp, RW_WRITER); 6733 } 6734 6735 static void 6736 sppp_notify_tlf_wlocked(struct sppp *sp) 6737 { 6738 6739 KASSERT(SPPP_WLOCKED(sp)); 6740 6741 if (!sp->pp_tlf) 6742 return; 6743 6744 SPPP_UNLOCK(sp); 6745 sp->pp_tlf(sp); 6746 SPPP_LOCK(sp, RW_WRITER); 6747 } 6748 6749 static void 6750 sppp_notify_con(struct sppp *sp) 6751 { 6752 6753 if (!sp->pp_con) 6754 return; 6755 6756 sp->pp_con(sp); 6757 } 6758 6759 #ifdef INET6 6760 static void 6761 sppp_notify_con_wlocked(struct sppp *sp) 6762 { 6763 6764 KASSERT(SPPP_WLOCKED(sp)); 6765 6766 SPPP_UNLOCK(sp); 6767 sppp_notify_con(sp); 6768 SPPP_LOCK(sp, RW_WRITER); 6769 6770 } 6771 #endif 6772 6773 static void 6774 sppp_notify_chg_wlocked(struct sppp *sp) 6775 { 6776 6777 KASSERT(SPPP_WLOCKED(sp)); 6778 6779 if (!sp->pp_chg) 6780 return; 6781 6782 SPPP_UNLOCK(sp); 6783 sp->pp_chg(sp, sp->pp_phase); 6784 SPPP_LOCK(sp, RW_WRITER); 6785 } 6786 6787 static void 6788 sppp_wq_work(struct work *wk, void *xsp) 6789 { 6790 struct sppp *sp; 6791 struct sppp_work *work; 6792 6793 sp = xsp; 6794 work = container_of(wk, struct sppp_work, work); 6795 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6796 6797 SPPP_LOCK(sp, RW_WRITER); 6798 work->func(sp, work->arg); 6799 SPPP_UNLOCK(sp); 6800 } 6801 6802 static struct workqueue * 6803 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6804 { 6805 struct workqueue *wq; 6806 int error; 6807 6808 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6809 (void *)sp, prio, ipl, flags); 6810 if (error) { 6811 panic("%s: workqueue_create failed [%s, %d]\n", 6812 sp->pp_if.if_xname, xnamebuf, error); 6813 } 6814 6815 return wq; 6816 } 6817 6818 static void 6819 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6820 { 6821 6822 workqueue_destroy(wq); 6823 } 6824 6825 static void 6826 sppp_wq_set(struct sppp_work *work, 6827 void (*func)(struct sppp *, void *), void *arg) 6828 { 6829 6830 work->func = func; 6831 work->arg = arg; 6832 } 6833 6834 static void 6835 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6836 { 6837 6838 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6839 != SPPP_WK_FREE) 6840 return; 6841 6842 KASSERT(work->func != NULL); 6843 kpreempt_disable(); 6844 workqueue_enqueue(wq, &work->work, NULL); 6845 kpreempt_enable(); 6846 } 6847 static void 6848 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6849 { 6850 6851 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6852 workqueue_wait(wq, &work->work); 6853 } 6854 6855 /* 6856 * This file is large. Tell emacs to highlight it nevertheless. 6857 * 6858 * Local Variables: 6859 * hilit-auto-highlight-maxout: 120000 6860 * End: 6861 */ 6862 6863 /* 6864 * Module glue 6865 */ 6866 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6867 6868 static int 6869 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6870 { 6871 6872 switch (cmd) { 6873 case MODULE_CMD_INIT: 6874 case MODULE_CMD_FINI: 6875 return 0; 6876 case MODULE_CMD_STAT: 6877 case MODULE_CMD_AUTOUNLOAD: 6878 default: 6879 return ENOTTY; 6880 } 6881 } 6882
Indexes created Fri Sep 26 20:09:58 GMT 2025