if_spppsubr.c revision 1.247
1 /* $NetBSD: if_spppsubr.c,v 1.247 2021/06/01 03:27:23 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.247 2021/06/01 03:27:23 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/netisr.h> 76 #include <net/if_types.h> 77 #include <net/route.h> 78 #include <net/ppp_defs.h> 79 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/in_var.h> 83 #ifdef INET 84 #include <netinet/ip.h> 85 #include <netinet/tcp.h> 86 #endif 87 #include <net/ethertypes.h> 88 89 #ifdef INET6 90 #include <netinet6/scope6_var.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #ifdef NET_MPSAFE 97 #define SPPPSUBR_MPSAFE 1 98 #endif 99 100 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 101 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 #ifndef SPPP_KEEPALIVE_INTERVAL 108 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 109 #endif 110 111 #ifndef SPPP_NORECV_TIME 112 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 113 #endif 114 115 #ifndef SPPP_ALIVE_INTERVAL 116 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 117 #endif 118 119 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 120 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 121 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 122 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 123 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 124 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 125 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 126 127 /* 128 * Interface flags that can be set in an ifconfig command. 129 * 130 * Setting link0 will make the link passive, i.e. it will be marked 131 * as being administrative openable, but won't be opened to begin 132 * with. Incoming calls will be answered, or subsequent calls with 133 * -link1 will cause the administrative open of the LCP layer. 134 * 135 * Setting link1 will cause the link to auto-dial only as packets 136 * arrive to be sent. 137 * 138 * Setting IFF_DEBUG will syslog the option negotiation and state 139 * transitions at level kern.debug. Note: all logs consistently look 140 * like 141 * 142 * <if-name><unit>: <proto-name> <additional info...> 143 * 144 * with <if-name><unit> being something like "bppp0", and <proto-name> 145 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 146 */ 147 148 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 149 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 150 151 #define CONF_REQ 1 /* PPP configure request */ 152 #define CONF_ACK 2 /* PPP configure acknowledge */ 153 #define CONF_NAK 3 /* PPP configure negative ack */ 154 #define CONF_REJ 4 /* PPP configure reject */ 155 #define TERM_REQ 5 /* PPP terminate request */ 156 #define TERM_ACK 6 /* PPP terminate acknowledge */ 157 #define CODE_REJ 7 /* PPP code reject */ 158 #define PROTO_REJ 8 /* PPP protocol reject */ 159 #define ECHO_REQ 9 /* PPP echo request */ 160 #define ECHO_REPLY 10 /* PPP echo reply */ 161 #define DISC_REQ 11 /* PPP discard request */ 162 163 #define LCP_OPT_MRU 1 /* maximum receive unit */ 164 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 165 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 166 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 167 #define LCP_OPT_MAGIC 5 /* magic number */ 168 #define LCP_OPT_RESERVED 6 /* reserved */ 169 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 170 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 171 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 172 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 173 #define LCP_OPT_CALL_BACK 13 /* callback */ 174 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 175 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 176 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 177 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 178 179 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 180 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 181 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 182 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 183 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 184 185 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 186 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 187 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 188 189 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 190 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 191 192 #define PAP_REQ 1 /* PAP name/password request */ 193 #define PAP_ACK 2 /* PAP acknowledge */ 194 #define PAP_NAK 3 /* PAP fail */ 195 196 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 197 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 198 #define CHAP_SUCCESS 3 /* CHAP response ok */ 199 #define CHAP_FAILURE 4 /* CHAP response failed */ 200 201 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 202 203 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 204 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 205 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 206 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 207 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 208 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 209 210 #define PPP_NOPROTO 0 /* no authentication protocol */ 211 212 enum { 213 STATE_INITIAL = SPPP_STATE_INITIAL, 214 STATE_STARTING = SPPP_STATE_STARTING, 215 STATE_CLOSED = SPPP_STATE_CLOSED, 216 STATE_STOPPED = SPPP_STATE_STOPPED, 217 STATE_CLOSING = SPPP_STATE_CLOSING, 218 STATE_STOPPING = SPPP_STATE_STOPPING, 219 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 220 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 221 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 222 STATE_OPENED = SPPP_STATE_OPENED, 223 }; 224 225 enum cp_rcr_type { 226 CP_RCR_NONE = 0, /* initial value */ 227 CP_RCR_ACK, /* RCR+ */ 228 CP_RCR_NAK, /* RCR- */ 229 CP_RCR_REJ, /* RCR- */ 230 CP_RCR_DROP, /* DROP message */ 231 CP_RCR_ERR, /* internal error */ 232 }; 233 234 struct ppp_header { 235 uint8_t address; 236 uint8_t control; 237 uint16_t protocol; 238 } __packed; 239 #define PPP_HEADER_LEN sizeof (struct ppp_header) 240 241 struct lcp_header { 242 uint8_t type; 243 uint8_t ident; 244 uint16_t len; 245 } __packed; 246 #define LCP_HEADER_LEN sizeof (struct lcp_header) 247 248 struct cisco_packet { 249 uint32_t type; 250 uint32_t par1; 251 uint32_t par2; 252 uint16_t rel; 253 uint16_t time0; 254 uint16_t time1; 255 } __packed; 256 #define CISCO_PACKET_LEN 18 257 258 /* 259 * We follow the spelling and capitalization of RFC 1661 here, to make 260 * it easier comparing with the standard. Please refer to this RFC in 261 * case you can't make sense out of these abbreviation; it will also 262 * explain the semantics related to the various events and actions. 263 */ 264 struct cp { 265 u_short proto; /* PPP control protocol number */ 266 u_char protoidx; /* index into state table in struct sppp */ 267 u_char flags; 268 #define CP_LCP 0x01 /* this is the LCP */ 269 #define CP_AUTH 0x02 /* this is an authentication protocol */ 270 #define CP_NCP 0x04 /* this is a NCP */ 271 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 272 const char *name; /* name of this control protocol */ 273 /* event handlers */ 274 void (*Up)(struct sppp *, void *); 275 void (*Down)(struct sppp *, void *); 276 void (*Open)(struct sppp *, void *); 277 void (*Close)(struct sppp *, void *); 278 void (*TO)(struct sppp *, void *); 279 /* actions */ 280 void (*tlu)(struct sppp *); 281 void (*tld)(struct sppp *); 282 void (*tls)(const struct cp *, struct sppp *); 283 void (*tlf)(const struct cp *, struct sppp *); 284 void (*scr)(struct sppp *); 285 void (*screply)(const struct cp *, struct sppp *, u_char, 286 uint8_t, size_t, void *); 287 288 /* message parser */ 289 enum cp_rcr_type 290 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 291 uint8_t **, size_t *, size_t *); 292 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 293 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 294 }; 295 296 enum auth_role { 297 SPPP_AUTH_NOROLE = 0, 298 SPPP_AUTH_SERV = __BIT(0), 299 SPPP_AUTH_PEER = __BIT(1), 300 }; 301 302 static struct sppp *spppq; 303 static kmutex_t *spppq_lock = NULL; 304 static callout_t keepalive_ch; 305 static unsigned int sppp_keepalive_cnt = 0; 306 307 #define SPPPQ_LOCK() if (spppq_lock) \ 308 mutex_enter(spppq_lock); 309 #define SPPPQ_UNLOCK() if (spppq_lock) \ 310 mutex_exit(spppq_lock); 311 312 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 313 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 314 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 315 #define SPPP_UPGRADE(_sp) do{ \ 316 SPPP_UNLOCK(_sp); \ 317 SPPP_LOCK(_sp, RW_WRITER); \ 318 }while (0) 319 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 320 #define SPPP_WQ_SET(_wk, _func, _arg) \ 321 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 322 323 #ifdef INET 324 #ifndef SPPPSUBR_MPSAFE 325 /* 326 * The following disgusting hack gets around the problem that IP TOS 327 * can't be set yet. We want to put "interactive" traffic on a high 328 * priority queue. To decide if traffic is interactive, we check that 329 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 330 * 331 * XXX is this really still necessary? - joerg - 332 */ 333 static u_short interactive_ports[8] = { 334 0, 513, 0, 0, 335 0, 21, 0, 23, 336 }; 337 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 338 #endif /* SPPPSUBR_MPSAFE */ 339 #endif 340 341 /* almost every function needs these */ 342 #define STDDCL \ 343 struct ifnet *ifp = &sp->pp_if; \ 344 int debug = ifp->if_flags & IFF_DEBUG 345 346 static int sppp_output(struct ifnet *, struct mbuf *, 347 const struct sockaddr *, const struct rtentry *); 348 349 static void sppp_cisco_send(struct sppp *, int, int32_t, int32_t); 350 static void sppp_cisco_input(struct sppp *, struct mbuf *); 351 352 static void sppp_cp_init(const struct cp *, struct sppp *); 353 static void sppp_cp_fini(const struct cp *, struct sppp *); 354 static void sppp_cp_input(const struct cp *, struct sppp *, 355 struct mbuf *); 356 static void sppp_cp_input(const struct cp *, struct sppp *, 357 struct mbuf *); 358 static void sppp_cp_send(struct sppp *, u_short, u_char, 359 u_char, u_short, void *); 360 /* static void sppp_cp_timeout(void *arg); */ 361 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 362 static struct workqueue * 363 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 364 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 365 static void sppp_wq_set(struct sppp_work *, 366 void (*)(struct sppp *, void *), void *); 367 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 368 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 369 static void sppp_cp_to_lcp(void *); 370 static void sppp_cp_to_ipcp(void *); 371 static void sppp_cp_to_ipv6cp(void *); 372 static void sppp_auth_send(const struct cp *, struct sppp *, 373 unsigned int, unsigned int, ...); 374 static int sppp_auth_role(const struct cp *, struct sppp *); 375 static void sppp_auth_to_event(struct sppp *, void *); 376 static void sppp_auth_screply(const struct cp *, struct sppp *, 377 u_char, uint8_t, size_t, void *); 378 static void sppp_up_event(struct sppp *, void *); 379 static void sppp_down_event(struct sppp *, void *); 380 static void sppp_open_event(struct sppp *, void *); 381 static void sppp_close_event(struct sppp *, void *); 382 static void sppp_to_event(struct sppp *, void *); 383 static void sppp_rcr_event(struct sppp *, void *); 384 static void sppp_rca_event(struct sppp *, void *); 385 static void sppp_rcn_event(struct sppp *, void *); 386 static void sppp_rtr_event(struct sppp *, void *); 387 static void sppp_rta_event(struct sppp *, void *); 388 static void sppp_rxj_event(struct sppp *, void *); 389 390 static void sppp_null(struct sppp *); 391 static void sppp_tls(const struct cp *, struct sppp *); 392 static void sppp_tlf(const struct cp *, struct sppp *); 393 static void sppp_screply(const struct cp *, struct sppp *, 394 u_char, uint8_t, size_t, void *); 395 static void sppp_ifdown(struct sppp *, void *); 396 397 static void sppp_lcp_init(struct sppp *); 398 static void sppp_lcp_up(struct sppp *, void *); 399 static void sppp_lcp_down(struct sppp *, void *); 400 static void sppp_lcp_open(struct sppp *, void *); 401 static enum cp_rcr_type 402 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 403 uint8_t **, size_t *, size_t *); 404 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 405 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 406 static void sppp_lcp_tlu(struct sppp *); 407 static void sppp_lcp_tld(struct sppp *); 408 static void sppp_lcp_tls(const struct cp *, struct sppp *); 409 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 410 static void sppp_lcp_scr(struct sppp *); 411 static void sppp_lcp_check_and_close(struct sppp *); 412 static int sppp_cp_check(struct sppp *, u_char); 413 414 static void sppp_ipcp_init(struct sppp *); 415 static void sppp_ipcp_open(struct sppp *, void *); 416 static void sppp_ipcp_close(struct sppp *, void *); 417 static enum cp_rcr_type 418 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 419 uint8_t **, size_t *, size_t *); 420 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 421 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 422 static void sppp_ipcp_tlu(struct sppp *); 423 static void sppp_ipcp_scr(struct sppp *); 424 425 static void sppp_ipv6cp_init(struct sppp *); 426 static void sppp_ipv6cp_open(struct sppp *, void *); 427 static enum cp_rcr_type 428 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 429 uint8_t **, size_t *, size_t *); 430 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 431 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 432 static void sppp_ipv6cp_tlu(struct sppp *); 433 static void sppp_ipv6cp_scr(struct sppp *); 434 435 static void sppp_pap_input(struct sppp *, struct mbuf *); 436 static void sppp_pap_init(struct sppp *); 437 static void sppp_pap_tlu(struct sppp *); 438 static void sppp_pap_scr(struct sppp *); 439 static void sppp_pap_scr(struct sppp *); 440 441 static void sppp_chap_input(struct sppp *, struct mbuf *); 442 static void sppp_chap_init(struct sppp *); 443 static void sppp_chap_open(struct sppp *, void *); 444 static void sppp_chap_tlu(struct sppp *); 445 static void sppp_chap_scr(struct sppp *); 446 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 447 448 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 449 static const char *sppp_cp_type_name(char *, size_t, u_char); 450 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 451 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 452 #ifdef INET6 453 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 454 #endif 455 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 456 static const char *sppp_phase_name(int); 457 static const char *sppp_proto_name(char *, size_t, u_short); 458 static const char *sppp_state_name(int); 459 static int sppp_params(struct sppp *, u_long, void *); 460 #ifdef INET 461 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 462 static void sppp_set_ip_addrs(struct sppp *); 463 static void sppp_clear_ip_addrs(struct sppp *); 464 #endif 465 static void sppp_keepalive(void *); 466 static void sppp_phase_network(struct sppp *); 467 static void sppp_print_bytes(const u_char *, u_short); 468 static void sppp_print_string(const char *, u_short); 469 #ifdef INET6 470 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 471 struct in6_addr *, struct in6_addr *); 472 #ifdef IPV6CP_MYIFID_DYN 473 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 474 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 475 #endif 476 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 477 #endif 478 479 static void sppp_notify_up(struct sppp *); 480 static void sppp_notify_down(struct sppp *); 481 static void sppp_notify_tls_wlocked(struct sppp *); 482 static void sppp_notify_tlf_wlocked(struct sppp *); 483 #ifdef INET6 484 static void sppp_notify_con_wlocked(struct sppp *); 485 #endif 486 static void sppp_notify_con(struct sppp *); 487 488 static void sppp_notify_chg_wlocked(struct sppp *); 489 490 /* our control protocol descriptors */ 491 static const struct cp lcp = { 492 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 493 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 494 sppp_close_event, sppp_to_event, 495 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 496 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 497 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 498 }; 499 500 static const struct cp ipcp = { 501 PPP_IPCP, IDX_IPCP, 502 #ifdef INET 503 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 504 #else 505 0, 506 #endif 507 "ipcp", 508 sppp_up_event, sppp_down_event, sppp_ipcp_open, 509 sppp_ipcp_close, sppp_to_event, 510 sppp_ipcp_tlu, sppp_null, sppp_tls, 511 sppp_tlf, sppp_ipcp_scr, sppp_screply, 512 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 513 }; 514 515 static const struct cp ipv6cp = { 516 PPP_IPV6CP, IDX_IPV6CP, 517 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 518 CP_NCP, 519 #else 520 0, 521 #endif 522 "ipv6cp", 523 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 524 sppp_close_event, sppp_to_event, 525 sppp_ipv6cp_tlu, sppp_null, sppp_tls, 526 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 527 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 528 }; 529 530 static const struct cp pap = { 531 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 532 sppp_up_event, sppp_down_event, sppp_open_event, 533 sppp_close_event, sppp_to_event, 534 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 535 sppp_pap_scr, sppp_auth_screply, 536 NULL, NULL, NULL 537 }; 538 539 static const struct cp chap = { 540 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 541 sppp_up_event, sppp_down_event, sppp_chap_open, 542 sppp_close_event, sppp_auth_to_event, 543 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 544 sppp_chap_scr, sppp_auth_screply, 545 NULL, NULL, NULL 546 }; 547 548 static const struct cp *cps[IDX_COUNT] = { 549 &lcp, /* IDX_LCP */ 550 &ipcp, /* IDX_IPCP */ 551 &ipv6cp, /* IDX_IPV6CP */ 552 &pap, /* IDX_PAP */ 553 &chap, /* IDX_CHAP */ 554 }; 555 556 static inline u_int 557 sppp_proto2authproto(u_short proto) 558 { 559 560 switch (proto) { 561 case PPP_PAP: 562 return SPPP_AUTHPROTO_PAP; 563 case PPP_CHAP: 564 return SPPP_AUTHPROTO_CHAP; 565 } 566 567 return SPPP_AUTHPROTO_NONE; 568 } 569 570 static inline u_short 571 sppp_authproto2proto(u_int authproto) 572 { 573 574 switch (authproto) { 575 case SPPP_AUTHPROTO_PAP: 576 return PPP_PAP; 577 case SPPP_AUTHPROTO_CHAP: 578 return PPP_CHAP; 579 } 580 581 return PPP_NOPROTO; 582 } 583 584 static void 585 sppp_change_phase(struct sppp *sp, int phase) 586 { 587 STDDCL; 588 589 KASSERT(SPPP_WLOCKED(sp)); 590 591 if (sp->pp_phase == phase) 592 return; 593 594 sp->pp_phase = phase; 595 596 if (phase == SPPP_PHASE_NETWORK) 597 if_link_state_change(ifp, LINK_STATE_UP); 598 else 599 if_link_state_change(ifp, LINK_STATE_DOWN); 600 601 if (debug) 602 { 603 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 604 sppp_phase_name(sp->pp_phase)); 605 } 606 } 607 608 /* 609 * Exported functions, comprising our interface to the lower layer. 610 */ 611 612 /* 613 * Process the received packet. 614 */ 615 void 616 sppp_input(struct ifnet *ifp, struct mbuf *m) 617 { 618 struct ppp_header *h = NULL; 619 pktqueue_t *pktq = NULL; 620 struct ifqueue *inq = NULL; 621 uint16_t protocol; 622 struct sppp *sp = (struct sppp *)ifp; 623 int debug = ifp->if_flags & IFF_DEBUG; 624 int isr = 0; 625 626 SPPP_LOCK(sp, RW_READER); 627 628 if (ifp->if_flags & IFF_UP) { 629 /* Count received bytes, add hardware framing */ 630 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 631 /* Note time of last receive */ 632 sp->pp_last_receive = time_uptime; 633 } 634 635 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 636 /* Too small packet, drop it. */ 637 if (debug) 638 log(LOG_DEBUG, 639 "%s: input packet is too small, %d bytes\n", 640 ifp->if_xname, m->m_pkthdr.len); 641 goto drop; 642 } 643 644 if (sp->pp_flags & PP_NOFRAMING) { 645 memcpy(&protocol, mtod(m, void *), 2); 646 protocol = ntohs(protocol); 647 m_adj(m, 2); 648 } else { 649 650 /* Get PPP header. */ 651 h = mtod(m, struct ppp_header *); 652 m_adj(m, PPP_HEADER_LEN); 653 654 switch (h->address) { 655 case PPP_ALLSTATIONS: 656 if (h->control != PPP_UI) 657 goto invalid; 658 if (sp->pp_flags & PP_CISCO) { 659 if (debug) 660 log(LOG_DEBUG, 661 "%s: PPP packet in Cisco mode " 662 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 663 ifp->if_xname, 664 h->address, h->control, ntohs(h->protocol)); 665 goto drop; 666 } 667 break; 668 case CISCO_MULTICAST: 669 case CISCO_UNICAST: 670 /* Don't check the control field here (RFC 1547). */ 671 if (! (sp->pp_flags & PP_CISCO)) { 672 if (debug) 673 log(LOG_DEBUG, 674 "%s: Cisco packet in PPP mode " 675 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 676 ifp->if_xname, 677 h->address, h->control, ntohs(h->protocol)); 678 goto drop; 679 } 680 switch (ntohs(h->protocol)) { 681 default: 682 if_statinc(ifp, if_noproto); 683 goto invalid; 684 case CISCO_KEEPALIVE: 685 SPPP_UNLOCK(sp); 686 sppp_cisco_input((struct sppp *) ifp, m); 687 m_freem(m); 688 return; 689 #ifdef INET 690 case ETHERTYPE_IP: 691 pktq = ip_pktq; 692 break; 693 #endif 694 #ifdef INET6 695 case ETHERTYPE_IPV6: 696 pktq = ip6_pktq; 697 break; 698 #endif 699 } 700 goto queue_pkt; 701 default: /* Invalid PPP packet. */ 702 invalid: 703 if (debug) 704 log(LOG_DEBUG, 705 "%s: invalid input packet " 706 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 707 ifp->if_xname, 708 h->address, h->control, ntohs(h->protocol)); 709 goto drop; 710 } 711 protocol = ntohs(h->protocol); 712 } 713 714 switch (protocol) { 715 reject_protocol: 716 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 717 uint16_t prot = htons(protocol); 718 719 SPPP_UPGRADE(sp); 720 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 721 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 722 &prot); 723 SPPP_DOWNGRADE(sp); 724 } 725 if_statinc(ifp, if_noproto); 726 goto drop; 727 default: 728 if (debug) { 729 log(LOG_DEBUG, 730 "%s: invalid input protocol " 731 "<proto=0x%x>\n", ifp->if_xname, protocol); 732 } 733 goto reject_protocol; 734 case PPP_LCP: 735 SPPP_UNLOCK(sp); 736 sppp_cp_input(&lcp, sp, m); 737 /* already m_freem(m) */ 738 return; 739 case PPP_PAP: 740 SPPP_UNLOCK(sp); 741 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 742 sppp_pap_input(sp, m); 743 } 744 m_freem(m); 745 return; 746 case PPP_CHAP: 747 SPPP_UNLOCK(sp); 748 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 749 sppp_chap_input(sp, m); 750 } 751 m_freem(m); 752 return; 753 #ifdef INET 754 case PPP_IPCP: 755 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 756 log(LOG_INFO, "%s: reject IPCP packet " 757 "because IPCP is disabled\n", 758 ifp->if_xname); 759 goto reject_protocol; 760 } 761 SPPP_UNLOCK(sp); 762 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 763 sppp_cp_input(&ipcp, sp, m); 764 /* already m_freem(m) */ 765 } else { 766 m_freem(m); 767 } 768 return; 769 case PPP_IP: 770 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 771 sp->pp_last_activity = time_uptime; 772 pktq = ip_pktq; 773 } 774 break; 775 #endif 776 #ifdef INET6 777 case PPP_IPV6CP: 778 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 779 log(LOG_INFO, "%s: reject IPv6CP packet " 780 "because IPv6CP is disabled\n", 781 ifp->if_xname); 782 goto reject_protocol; 783 } 784 SPPP_UNLOCK(sp); 785 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 786 sppp_cp_input(&ipv6cp, sp, m); 787 /* already m_freem(m) */ 788 } else { 789 m_freem(m); 790 } 791 return; 792 793 case PPP_IPV6: 794 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 795 sp->pp_last_activity = time_uptime; 796 pktq = ip6_pktq; 797 } 798 break; 799 #endif 800 } 801 802 queue_pkt: 803 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 804 goto drop; 805 } 806 807 /* Check queue. */ 808 if (__predict_true(pktq)) { 809 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 810 goto drop; 811 } 812 SPPP_UNLOCK(sp); 813 return; 814 } 815 816 SPPP_UNLOCK(sp); 817 818 IFQ_LOCK(inq); 819 if (IF_QFULL(inq)) { 820 /* Queue overflow. */ 821 IF_DROP(inq); 822 IFQ_UNLOCK(inq); 823 if (debug) 824 log(LOG_DEBUG, "%s: protocol queue overflow\n", 825 ifp->if_xname); 826 827 SPPP_LOCK(sp, RW_READER); 828 goto drop; 829 } 830 IF_ENQUEUE(inq, m); 831 IFQ_UNLOCK(inq); 832 schednetisr(isr); 833 return; 834 835 drop: 836 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 837 m_freem(m); 838 SPPP_UNLOCK(sp); 839 return; 840 } 841 842 /* 843 * Enqueue transmit packet. 844 */ 845 static int 846 sppp_output(struct ifnet *ifp, struct mbuf *m, 847 const struct sockaddr *dst, const struct rtentry *rt) 848 { 849 struct sppp *sp = (struct sppp *) ifp; 850 struct ppp_header *h = NULL; 851 #ifndef SPPPSUBR_MPSAFE 852 struct ifqueue *ifq = NULL; /* XXX */ 853 #endif 854 int s, error = 0; 855 uint16_t protocol; 856 size_t pktlen; 857 858 s = splnet(); 859 SPPP_LOCK(sp, RW_READER); 860 861 sp->pp_last_activity = time_uptime; 862 863 if ((ifp->if_flags & IFF_UP) == 0 || 864 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 865 SPPP_UNLOCK(sp); 866 splx(s); 867 868 m_freem(m); 869 if_statinc(ifp, if_oerrors); 870 return (ENETDOWN); 871 } 872 873 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 874 /* ignore packets that have no enabled NCP */ 875 if ((dst->sa_family == AF_INET && 876 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 877 (dst->sa_family == AF_INET6 && 878 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 879 SPPP_UNLOCK(sp); 880 splx(s); 881 882 m_freem(m); 883 if_statinc(ifp, if_oerrors); 884 return (ENETDOWN); 885 } 886 /* 887 * Interface is not yet running, but auto-dial. Need 888 * to start LCP for it. 889 */ 890 ifp->if_flags |= IFF_RUNNING; 891 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 892 } 893 894 /* 895 * If the queueing discipline needs packet classification, 896 * do it before prepending link headers. 897 */ 898 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 899 900 #ifdef INET 901 if (dst->sa_family == AF_INET) { 902 struct ip *ip = NULL; 903 #ifndef SPPPSUBR_MPSAFE 904 struct tcphdr *th = NULL; 905 #endif 906 907 if (m->m_len >= sizeof(struct ip)) { 908 ip = mtod(m, struct ip *); 909 #ifndef SPPPSUBR_MPSAFE 910 if (ip->ip_p == IPPROTO_TCP && 911 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 912 sizeof(struct tcphdr)) { 913 th = (struct tcphdr *) 914 ((char *)ip + (ip->ip_hl << 2)); 915 } 916 #endif 917 } else 918 ip = NULL; 919 920 /* 921 * When using dynamic local IP address assignment by using 922 * 0.0.0.0 as a local address, the first TCP session will 923 * not connect because the local TCP checksum is computed 924 * using 0.0.0.0 which will later become our real IP address 925 * so the TCP checksum computed at the remote end will 926 * become invalid. So we 927 * - don't let packets with src ip addr 0 thru 928 * - we flag TCP packets with src ip 0 as an error 929 */ 930 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 931 uint8_t proto = ip->ip_p; 932 933 SPPP_UNLOCK(sp); 934 splx(s); 935 936 m_freem(m); 937 if (proto == IPPROTO_TCP) 938 return (EADDRNOTAVAIL); 939 else 940 return (0); 941 } 942 943 #ifndef SPPPSUBR_MPSAFE 944 /* 945 * Put low delay, telnet, rlogin and ftp control packets 946 * in front of the queue. 947 */ 948 if (!IF_QFULL(&sp->pp_fastq) && 949 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 950 (th && (INTERACTIVE(ntohs(th->th_sport)) || 951 INTERACTIVE(ntohs(th->th_dport)))))) 952 ifq = &sp->pp_fastq; 953 #endif /* !SPPPSUBR_MPSAFE */ 954 } 955 #endif 956 957 #ifdef INET6 958 if (dst->sa_family == AF_INET6) { 959 /* XXX do something tricky here? */ 960 } 961 #endif 962 963 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 964 /* 965 * Prepend general data packet PPP header. For now, IP only. 966 */ 967 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 968 if (! m) { 969 if (ifp->if_flags & IFF_DEBUG) 970 log(LOG_DEBUG, "%s: no memory for transmit header\n", 971 ifp->if_xname); 972 if_statinc(ifp, if_oerrors); 973 SPPP_UNLOCK(sp); 974 splx(s); 975 return (ENOBUFS); 976 } 977 /* 978 * May want to check size of packet 979 * (albeit due to the implementation it's always enough) 980 */ 981 h = mtod(m, struct ppp_header *); 982 if (sp->pp_flags & PP_CISCO) { 983 h->address = CISCO_UNICAST; /* unicast address */ 984 h->control = 0; 985 } else { 986 h->address = PPP_ALLSTATIONS; /* broadcast address */ 987 h->control = PPP_UI; /* Unnumbered Info */ 988 } 989 } 990 991 switch (dst->sa_family) { 992 #ifdef INET 993 case AF_INET: /* Internet Protocol */ 994 if (sp->pp_flags & PP_CISCO) 995 protocol = htons(ETHERTYPE_IP); 996 else { 997 /* 998 * Don't choke with an ENETDOWN early. It's 999 * possible that we just started dialing out, 1000 * so don't drop the packet immediately. If 1001 * we notice that we run out of buffer space 1002 * below, we will however remember that we are 1003 * not ready to carry IP packets, and return 1004 * ENETDOWN, as opposed to ENOBUFS. 1005 */ 1006 protocol = htons(PPP_IP); 1007 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 1008 if (ifp->if_flags & IFF_AUTO) { 1009 error = ENETDOWN; 1010 } else { 1011 IF_DROP(&ifp->if_snd); 1012 SPPP_UNLOCK(sp); 1013 splx(s); 1014 1015 m_freem(m); 1016 if_statinc(ifp, if_oerrors); 1017 return (ENETDOWN); 1018 } 1019 } 1020 } 1021 break; 1022 #endif 1023 #ifdef INET6 1024 case AF_INET6: /* Internet Protocol version 6 */ 1025 if (sp->pp_flags & PP_CISCO) 1026 protocol = htons(ETHERTYPE_IPV6); 1027 else { 1028 /* 1029 * Don't choke with an ENETDOWN early. It's 1030 * possible that we just started dialing out, 1031 * so don't drop the packet immediately. If 1032 * we notice that we run out of buffer space 1033 * below, we will however remember that we are 1034 * not ready to carry IP packets, and return 1035 * ENETDOWN, as opposed to ENOBUFS. 1036 */ 1037 protocol = htons(PPP_IPV6); 1038 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 1039 if (ifp->if_flags & IFF_AUTO) { 1040 error = ENETDOWN; 1041 } else { 1042 IF_DROP(&ifp->if_snd); 1043 SPPP_UNLOCK(sp); 1044 splx(s); 1045 1046 m_freem(m); 1047 if_statinc(ifp, if_oerrors); 1048 return (ENETDOWN); 1049 } 1050 } 1051 } 1052 break; 1053 #endif 1054 default: 1055 m_freem(m); 1056 if_statinc(ifp, if_oerrors); 1057 SPPP_UNLOCK(sp); 1058 splx(s); 1059 return (EAFNOSUPPORT); 1060 } 1061 1062 if (sp->pp_flags & PP_NOFRAMING) { 1063 M_PREPEND(m, 2, M_DONTWAIT); 1064 if (m == NULL) { 1065 if (ifp->if_flags & IFF_DEBUG) 1066 log(LOG_DEBUG, "%s: no memory for transmit header\n", 1067 ifp->if_xname); 1068 if_statinc(ifp, if_oerrors); 1069 SPPP_UNLOCK(sp); 1070 splx(s); 1071 return (ENOBUFS); 1072 } 1073 *mtod(m, uint16_t *) = protocol; 1074 } else { 1075 h->protocol = protocol; 1076 } 1077 1078 pktlen = m->m_pkthdr.len; 1079 #ifdef SPPPSUBR_MPSAFE 1080 SPPP_UNLOCK(sp); 1081 error = if_transmit_lock(ifp, m); 1082 SPPP_LOCK(sp, RW_READER); 1083 if (error == 0) 1084 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1085 #else /* !SPPPSUBR_MPSAFE */ 1086 error = ifq_enqueue2(ifp, ifq, m); 1087 1088 if (error == 0) { 1089 /* 1090 * Count output packets and bytes. 1091 * The packet length includes header + additional hardware 1092 * framing according to RFC 1333. 1093 */ 1094 if (!(ifp->if_flags & IFF_OACTIVE)) { 1095 SPPP_UNLOCK(sp); 1096 if_start_lock(ifp); 1097 SPPP_LOCK(sp, RW_READER); 1098 } 1099 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1100 } 1101 #endif /* !SPPPSUBR_MPSAFE */ 1102 SPPP_UNLOCK(sp); 1103 splx(s); 1104 return error; 1105 } 1106 1107 void 1108 sppp_attach(struct ifnet *ifp) 1109 { 1110 struct sppp *sp = (struct sppp *) ifp; 1111 char xnamebuf[MAXCOMLEN]; 1112 1113 /* Initialize keepalive handler. */ 1114 if (! spppq) { 1115 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1116 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1117 } 1118 1119 if (! spppq_lock) 1120 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1121 1122 sp->pp_if.if_type = IFT_PPP; 1123 sp->pp_if.if_output = sppp_output; 1124 sp->pp_fastq.ifq_maxlen = 32; 1125 sp->pp_cpq.ifq_maxlen = 20; 1126 sp->pp_loopcnt = 0; 1127 sp->pp_alivecnt = 0; 1128 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1129 sp->pp_last_activity = 0; 1130 sp->pp_last_receive = 0; 1131 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1132 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1133 sp->pp_idle_timeout = 0; 1134 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1135 sp->pp_phase = SPPP_PHASE_DEAD; 1136 sp->pp_up = sppp_notify_up; 1137 sp->pp_down = sppp_notify_down; 1138 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1139 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1140 memset(sp->scp, 0, sizeof(sp->scp)); 1141 rw_init(&sp->pp_lock); 1142 1143 if_alloc_sadl(ifp); 1144 1145 /* Lets not beat about the bush, we know we're down. */ 1146 ifp->if_link_state = LINK_STATE_DOWN; 1147 1148 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1149 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1150 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1151 1152 memset(&sp->myauth, 0, sizeof sp->myauth); 1153 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1154 SPPP_LOCK(sp, RW_WRITER); 1155 sppp_lcp_init(sp); 1156 sppp_ipcp_init(sp); 1157 sppp_ipv6cp_init(sp); 1158 sppp_pap_init(sp); 1159 sppp_chap_init(sp); 1160 SPPP_UNLOCK(sp); 1161 1162 SPPPQ_LOCK(); 1163 /* Insert new entry into the keepalive list. */ 1164 sp->pp_next = spppq; 1165 spppq = sp; 1166 SPPPQ_UNLOCK(); 1167 } 1168 1169 void 1170 sppp_detach(struct ifnet *ifp) 1171 { 1172 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1173 1174 /* Remove the entry from the keepalive list. */ 1175 SPPPQ_LOCK(); 1176 for (q = &spppq; (p = *q); q = &p->pp_next) 1177 if (p == sp) { 1178 *q = p->pp_next; 1179 break; 1180 } 1181 SPPPQ_UNLOCK(); 1182 1183 if (! spppq) { 1184 /* Stop keepalive handler. */ 1185 callout_stop(&keepalive_ch); 1186 mutex_obj_free(spppq_lock); 1187 spppq_lock = NULL; 1188 } 1189 1190 sppp_cp_fini(&lcp, sp); 1191 sppp_cp_fini(&ipcp, sp); 1192 sppp_cp_fini(&pap, sp); 1193 sppp_cp_fini(&chap, sp); 1194 #ifdef INET6 1195 sppp_cp_fini(&ipv6cp, sp); 1196 #endif 1197 sppp_wq_destroy(sp, sp->wq_cp); 1198 1199 /* free authentication info */ 1200 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1201 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1202 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1203 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1204 rw_destroy(&sp->pp_lock); 1205 } 1206 1207 /* 1208 * Flush the interface output queue. 1209 */ 1210 void 1211 sppp_flush(struct ifnet *ifp) 1212 { 1213 struct sppp *sp = (struct sppp *) ifp; 1214 1215 SPPP_LOCK(sp, RW_WRITER); 1216 IFQ_PURGE(&sp->pp_if.if_snd); 1217 IF_PURGE(&sp->pp_fastq); 1218 IF_PURGE(&sp->pp_cpq); 1219 SPPP_UNLOCK(sp); 1220 } 1221 1222 /* 1223 * Check if the output queue is empty. 1224 */ 1225 int 1226 sppp_isempty(struct ifnet *ifp) 1227 { 1228 struct sppp *sp = (struct sppp *) ifp; 1229 int empty, s; 1230 1231 s = splnet(); 1232 SPPP_LOCK(sp, RW_READER); 1233 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1234 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1235 SPPP_UNLOCK(sp); 1236 splx(s); 1237 return (empty); 1238 } 1239 1240 /* 1241 * Get next packet to send. 1242 */ 1243 struct mbuf * 1244 sppp_dequeue(struct ifnet *ifp) 1245 { 1246 struct sppp *sp = (struct sppp *) ifp; 1247 struct mbuf *m; 1248 int s; 1249 1250 s = splnet(); 1251 SPPP_LOCK(sp, RW_WRITER); 1252 /* 1253 * Process only the control protocol queue until we have at 1254 * least one NCP open. 1255 * 1256 * Do always serve all three queues in Cisco mode. 1257 */ 1258 IF_DEQUEUE(&sp->pp_cpq, m); 1259 if (m == NULL && 1260 (sppp_cp_check(sp, CP_NCP) || (sp->pp_flags & PP_CISCO) != 0)) { 1261 IF_DEQUEUE(&sp->pp_fastq, m); 1262 if (m == NULL) 1263 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1264 } 1265 SPPP_UNLOCK(sp); 1266 splx(s); 1267 return m; 1268 } 1269 1270 /* 1271 * Process an ioctl request. Called on low priority level. 1272 */ 1273 int 1274 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1275 { 1276 struct lwp *l = curlwp; /* XXX */ 1277 struct ifreq *ifr = (struct ifreq *) data; 1278 struct ifaddr *ifa = (struct ifaddr *) data; 1279 struct sppp *sp = (struct sppp *) ifp; 1280 int s, error=0, going_up, going_down; 1281 u_short newmode; 1282 u_long lcp_mru; 1283 1284 s = splnet(); 1285 switch (cmd) { 1286 case SIOCINITIFADDR: 1287 ifa->ifa_rtrequest = p2p_rtrequest; 1288 break; 1289 1290 case SIOCSIFFLAGS: 1291 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1292 break; 1293 1294 SPPP_LOCK(sp, RW_WRITER); 1295 going_up = ifp->if_flags & IFF_UP && 1296 (ifp->if_flags & IFF_RUNNING) == 0; 1297 going_down = (ifp->if_flags & IFF_UP) == 0 && 1298 ifp->if_flags & IFF_RUNNING; 1299 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1300 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1301 /* sanity */ 1302 newmode = IFF_PASSIVE; 1303 ifp->if_flags &= ~IFF_AUTO; 1304 } 1305 1306 if (going_up || going_down) { 1307 sp->lcp.reestablish = false; 1308 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1309 } 1310 if (going_up && newmode == 0) { 1311 /* neither auto-dial nor passive */ 1312 ifp->if_flags |= IFF_RUNNING; 1313 if (!(sp->pp_flags & PP_CISCO)) { 1314 sppp_wq_add(sp->wq_cp, 1315 &sp->scp[IDX_LCP].work_open); 1316 } 1317 } else if (going_down) { 1318 SPPP_UNLOCK(sp); 1319 sppp_flush(ifp); 1320 SPPP_LOCK(sp, RW_WRITER); 1321 1322 ifp->if_flags &= ~IFF_RUNNING; 1323 } 1324 SPPP_UNLOCK(sp); 1325 break; 1326 1327 case SIOCSIFMTU: 1328 if (ifr->ifr_mtu < PPP_MINMRU || 1329 ifr->ifr_mtu > PP_MTU) { 1330 error = EINVAL; 1331 break; 1332 } 1333 1334 error = ifioctl_common(ifp, cmd, data); 1335 if (error == ENETRESET) 1336 error = 0; 1337 1338 SPPP_LOCK(sp, RW_WRITER); 1339 lcp_mru = sp->lcp.mru; 1340 if (ifp->if_mtu < PP_MTU) { 1341 sp->lcp.mru = ifp->if_mtu; 1342 } else { 1343 sp->lcp.mru = PP_MTU; 1344 } 1345 if (lcp_mru != sp->lcp.mru) 1346 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1347 1348 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1349 ifp->if_mtu > sp->lcp.their_mru) { 1350 sp->pp_saved_mtu = ifp->if_mtu; 1351 ifp->if_mtu = sp->lcp.their_mru; 1352 1353 if (ifp->if_flags & IFF_DEBUG) { 1354 log(LOG_DEBUG, 1355 "%s: setting MTU " 1356 "from %"PRIu64" bytes " 1357 "to %"PRIu64" bytes\n", 1358 ifp->if_xname, sp->pp_saved_mtu, 1359 ifp->if_mtu); 1360 } 1361 } 1362 SPPP_UNLOCK(sp); 1363 break; 1364 1365 case SIOCGIFMTU: 1366 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1367 error = 0; 1368 break; 1369 case SIOCADDMULTI: 1370 case SIOCDELMULTI: 1371 break; 1372 1373 case SPPPSETAUTHCFG: 1374 case SPPPSETLCPCFG: 1375 case SPPPSETNCPCFG: 1376 case SPPPSETIDLETO: 1377 case SPPPSETAUTHFAILURE: 1378 case SPPPSETDNSOPTS: 1379 case SPPPSETKEEPALIVE: 1380 #if defined(COMPAT_50) || defined(MODULAR) 1381 case __SPPPSETIDLETO50: 1382 case __SPPPSETKEEPALIVE50: 1383 #endif /* COMPAT_50 || MODULAR */ 1384 error = kauth_authorize_network(l->l_cred, 1385 KAUTH_NETWORK_INTERFACE, 1386 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1387 NULL); 1388 if (error) 1389 break; 1390 error = sppp_params(sp, cmd, data); 1391 break; 1392 1393 case SPPPGETAUTHCFG: 1394 case SPPPGETLCPCFG: 1395 case SPPPGETNCPCFG: 1396 case SPPPGETAUTHFAILURES: 1397 error = kauth_authorize_network(l->l_cred, 1398 KAUTH_NETWORK_INTERFACE, 1399 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1400 NULL); 1401 if (error) 1402 break; 1403 error = sppp_params(sp, cmd, data); 1404 break; 1405 1406 case SPPPGETSTATUS: 1407 case SPPPGETSTATUSNCP: 1408 case SPPPGETIDLETO: 1409 case SPPPGETDNSOPTS: 1410 case SPPPGETDNSADDRS: 1411 case SPPPGETKEEPALIVE: 1412 #if defined(COMPAT_50) || defined(MODULAR) 1413 case __SPPPGETIDLETO50: 1414 case __SPPPGETKEEPALIVE50: 1415 #endif /* COMPAT_50 || MODULAR */ 1416 case SPPPGETLCPSTATUS: 1417 case SPPPGETIPCPSTATUS: 1418 case SPPPGETIPV6CPSTATUS: 1419 error = sppp_params(sp, cmd, data); 1420 break; 1421 1422 default: 1423 error = ifioctl_common(ifp, cmd, data); 1424 break; 1425 } 1426 splx(s); 1427 return (error); 1428 } 1429 1430 /* 1431 * Cisco framing implementation. 1432 */ 1433 1434 /* 1435 * Handle incoming Cisco keepalive protocol packets. 1436 */ 1437 static void 1438 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1439 { 1440 STDDCL; 1441 struct cisco_packet *h; 1442 #ifdef INET 1443 uint32_t me, mymask = 0; /* XXX: GCC */ 1444 #endif 1445 1446 SPPP_LOCK(sp, RW_WRITER); 1447 1448 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1449 if (debug) 1450 log(LOG_DEBUG, 1451 "%s: cisco invalid packet length: %d bytes\n", 1452 ifp->if_xname, m->m_pkthdr.len); 1453 SPPP_UNLOCK(sp); 1454 return; 1455 } 1456 h = mtod(m, struct cisco_packet *); 1457 if (debug) 1458 log(LOG_DEBUG, 1459 "%s: cisco input: %d bytes " 1460 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1461 ifp->if_xname, m->m_pkthdr.len, 1462 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1463 (u_int)h->time0, (u_int)h->time1); 1464 switch (ntohl(h->type)) { 1465 default: 1466 if (debug) 1467 addlog("%s: cisco unknown packet type: 0x%x\n", 1468 ifp->if_xname, ntohl(h->type)); 1469 break; 1470 case CISCO_ADDR_REPLY: 1471 /* Reply on address request, ignore */ 1472 break; 1473 case CISCO_KEEPALIVE_REQ: 1474 sp->pp_alivecnt = 0; 1475 sp->scp[IDX_LCP].rseq = ntohl(h->par1); 1476 if (sp->scp[IDX_LCP].seq == sp->scp[IDX_LCP].rseq) { 1477 /* Local and remote sequence numbers are equal. 1478 * Probably, the line is in loopback mode. */ 1479 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1480 printf ("%s: loopback\n", 1481 ifp->if_xname); 1482 sp->pp_loopcnt = 0; 1483 1484 sp->pp_flags |= PP_LOOPBACK; 1485 sppp_wq_add(sp->wq_cp, 1486 &sp->work_ifdown); 1487 1488 sppp_wq_add(sp->wq_cp, 1489 &sp->scp[IDX_LCP].work_close); 1490 sppp_wq_add(sp->wq_cp, 1491 &sp->scp[IDX_LCP].work_open); 1492 } else { 1493 ++sp->pp_loopcnt; 1494 } 1495 1496 /* Generate new local sequence number */ 1497 sp->scp[IDX_LCP].seq = cprng_fast32(); 1498 break; 1499 } 1500 sp->pp_loopcnt = 0; 1501 if (! (ifp->if_flags & IFF_UP) && 1502 (ifp->if_flags & IFF_RUNNING)) { 1503 SPPP_UNLOCK(sp); 1504 if_up(ifp); 1505 SPPP_LOCK(sp, RW_WRITER); 1506 sp->pp_flags &= ~PP_LOOPBACK; 1507 } 1508 break; 1509 case CISCO_ADDR_REQ: 1510 #ifdef INET 1511 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1512 if (me != 0L) 1513 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1514 #endif 1515 break; 1516 } 1517 SPPP_UNLOCK(sp); 1518 } 1519 1520 /* 1521 * Send Cisco keepalive packet. 1522 */ 1523 static void 1524 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1525 { 1526 STDDCL; 1527 struct ppp_header *h; 1528 struct cisco_packet *ch; 1529 struct mbuf *m; 1530 uint32_t t; 1531 1532 KASSERT(SPPP_WLOCKED(sp)); 1533 1534 t = time_uptime * 1000; 1535 MGETHDR(m, M_DONTWAIT, MT_DATA); 1536 if (! m) 1537 return; 1538 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1539 m_reset_rcvif(m); 1540 1541 h = mtod(m, struct ppp_header *); 1542 h->address = CISCO_MULTICAST; 1543 h->control = 0; 1544 h->protocol = htons(CISCO_KEEPALIVE); 1545 1546 ch = (struct cisco_packet *)(h + 1); 1547 ch->type = htonl(type); 1548 ch->par1 = htonl(par1); 1549 ch->par2 = htonl(par2); 1550 ch->rel = -1; 1551 1552 ch->time0 = htons((u_short)(t >> 16)); 1553 ch->time1 = htons((u_short) t); 1554 1555 if (debug) 1556 log(LOG_DEBUG, 1557 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1558 ifp->if_xname, ntohl(ch->type), ch->par1, 1559 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1560 (u_int)ch->time1); 1561 1562 if (IF_QFULL(&sp->pp_cpq)) { 1563 IF_DROP(&sp->pp_fastq); 1564 IF_DROP(&ifp->if_snd); 1565 m_freem(m); 1566 if_statinc(ifp, if_oerrors); 1567 return; 1568 } 1569 1570 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1571 IF_ENQUEUE(&sp->pp_cpq, m); 1572 1573 if (! (ifp->if_flags & IFF_OACTIVE)) { 1574 SPPP_UNLOCK(sp); 1575 if_start_lock(ifp); 1576 SPPP_LOCK(sp, RW_WRITER); 1577 } 1578 } 1579 1580 /* 1581 * PPP protocol implementation. 1582 */ 1583 1584 /* 1585 * Send PPP control protocol packet. 1586 */ 1587 static void 1588 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1589 u_char ident, u_short len, void *data) 1590 { 1591 STDDCL; 1592 struct lcp_header *lh; 1593 struct mbuf *m; 1594 size_t pkthdrlen; 1595 1596 KASSERT(SPPP_WLOCKED(sp)); 1597 1598 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1599 1600 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1601 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1602 MGETHDR(m, M_DONTWAIT, MT_DATA); 1603 if (! m) { 1604 return; 1605 } 1606 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1607 m_reset_rcvif(m); 1608 1609 if (sp->pp_flags & PP_NOFRAMING) { 1610 *mtod(m, uint16_t *) = htons(proto); 1611 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1612 } else { 1613 struct ppp_header *h; 1614 h = mtod(m, struct ppp_header *); 1615 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1616 h->control = PPP_UI; /* Unnumbered Info */ 1617 h->protocol = htons(proto); /* Link Control Protocol */ 1618 lh = (struct lcp_header *)(h + 1); 1619 } 1620 lh->type = type; 1621 lh->ident = ident; 1622 lh->len = htons(LCP_HEADER_LEN + len); 1623 if (len) 1624 memcpy(lh + 1, data, len); 1625 1626 if (debug) { 1627 char pbuf[SPPP_PROTO_NAMELEN]; 1628 char tbuf[SPPP_CPTYPE_NAMELEN]; 1629 const char *pname, *cpname; 1630 1631 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1632 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1633 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1634 ifp->if_xname, pname, cpname, 1635 lh->ident, ntohs(lh->len)); 1636 if (len) 1637 sppp_print_bytes((u_char *)(lh + 1), len); 1638 addlog(">\n"); 1639 } 1640 if (IF_QFULL(&sp->pp_cpq)) { 1641 IF_DROP(&sp->pp_fastq); 1642 IF_DROP(&ifp->if_snd); 1643 m_freem(m); 1644 if_statinc(ifp, if_oerrors); 1645 return; 1646 } 1647 1648 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1649 IF_ENQUEUE(&sp->pp_cpq, m); 1650 1651 if (! (ifp->if_flags & IFF_OACTIVE)) { 1652 SPPP_UNLOCK(sp); 1653 if_start_lock(ifp); 1654 SPPP_LOCK(sp, RW_WRITER); 1655 } 1656 } 1657 1658 static void 1659 sppp_cp_to_lcp(void *xsp) 1660 { 1661 struct sppp *sp = xsp; 1662 1663 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1664 } 1665 1666 static void 1667 sppp_cp_to_ipcp(void *xsp) 1668 { 1669 struct sppp *sp = xsp; 1670 1671 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1672 } 1673 1674 static void 1675 sppp_cp_to_ipv6cp(void *xsp) 1676 { 1677 struct sppp *sp = xsp; 1678 1679 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1680 } 1681 1682 static void 1683 sppp_cp_to_pap(void *xsp) 1684 { 1685 struct sppp *sp = xsp; 1686 1687 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1688 } 1689 1690 static void 1691 sppp_cp_to_chap(void *xsp) 1692 { 1693 struct sppp *sp = xsp; 1694 1695 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1696 } 1697 1698 static void 1699 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1700 { 1701 struct sppp_cp *scp; 1702 typedef void (*sppp_co_cb_t)(void *); 1703 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1704 [IDX_LCP] = sppp_cp_to_lcp, 1705 [IDX_IPCP] = sppp_cp_to_ipcp, 1706 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1707 [IDX_PAP] = sppp_cp_to_pap, 1708 [IDX_CHAP] = sppp_cp_to_chap, 1709 }; 1710 1711 scp = &sp->scp[cp->protoidx]; 1712 scp->state = STATE_INITIAL; 1713 scp->fail_counter = 0; 1714 scp->seq = 0; 1715 scp->rseq = 0; 1716 1717 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1718 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1719 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1720 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1721 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1722 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1723 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1724 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1725 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1726 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1727 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1728 1729 callout_init(&scp->ch, CALLOUT_MPSAFE); 1730 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1731 } 1732 1733 static void 1734 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1735 { 1736 struct sppp_cp *scp; 1737 scp = &sp->scp[cp->protoidx]; 1738 1739 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1740 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1741 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1742 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1743 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1744 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1745 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1746 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1747 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1748 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1749 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1750 1751 callout_halt(&scp->ch, NULL); 1752 callout_destroy(&scp->ch); 1753 1754 if (scp->mbuf_confreq != NULL) { 1755 m_freem(scp->mbuf_confreq); 1756 scp->mbuf_confreq = NULL; 1757 } 1758 if (scp->mbuf_confnak != NULL) { 1759 m_freem(scp->mbuf_confnak); 1760 scp->mbuf_confnak = NULL; 1761 } 1762 } 1763 1764 /* 1765 * Handle incoming PPP control protocol packets. 1766 */ 1767 static void 1768 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1769 { 1770 STDDCL; 1771 struct lcp_header *h; 1772 struct sppp_cp *scp; 1773 int printlen, len = m->m_pkthdr.len; 1774 u_char *p; 1775 uint32_t u32; 1776 char tbuf[SPPP_CPTYPE_NAMELEN]; 1777 const char *cpname; 1778 1779 SPPP_LOCK(sp, RW_WRITER); 1780 1781 scp = &sp->scp[cp->protoidx]; 1782 1783 if (len < 4) { 1784 if (debug) 1785 log(LOG_DEBUG, 1786 "%s: %s invalid packet length: %d bytes\n", 1787 ifp->if_xname, cp->name, len); 1788 goto out; 1789 } 1790 h = mtod(m, struct lcp_header *); 1791 if (debug) { 1792 printlen = ntohs(h->len); 1793 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1794 log(LOG_DEBUG, 1795 "%s: %s input(%s): <%s id=0x%x len=%d", 1796 ifp->if_xname, cp->name, 1797 sppp_state_name(scp->state), 1798 cpname, h->ident, printlen); 1799 if (len < printlen) 1800 printlen = len; 1801 if (printlen > 4) 1802 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1803 addlog(">\n"); 1804 } 1805 if (len > ntohs(h->len)) 1806 len = ntohs(h->len); 1807 p = (u_char *)(h + 1); 1808 switch (h->type) { 1809 case CONF_REQ: 1810 if (len < 4) { 1811 if (debug) 1812 addlog("%s: %s invalid conf-req length %d\n", 1813 ifp->if_xname, cp->name, 1814 len); 1815 if_statinc(ifp, if_ierrors); 1816 break; 1817 } 1818 1819 scp->rcr_type = CP_RCR_NONE; 1820 scp->rconfid = h->ident; 1821 if (scp->mbuf_confreq != NULL) { 1822 m_freem(scp->mbuf_confreq); 1823 } 1824 scp->mbuf_confreq = m; 1825 m = NULL; 1826 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1827 break; 1828 case CONF_ACK: 1829 if (h->ident != scp->confid) { 1830 if (debug) 1831 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1832 ifp->if_xname, cp->name, 1833 h->ident, scp->confid); 1834 if_statinc(ifp, if_ierrors); 1835 break; 1836 } 1837 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1838 break; 1839 case CONF_NAK: 1840 case CONF_REJ: 1841 if (h->ident != scp->confid) { 1842 if (debug) 1843 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1844 ifp->if_xname, cp->name, 1845 h->ident, scp->confid); 1846 if_statinc(ifp, if_ierrors); 1847 break; 1848 } 1849 1850 if (scp->mbuf_confnak) { 1851 m_freem(scp->mbuf_confnak); 1852 } 1853 scp->mbuf_confnak = m; 1854 m = NULL; 1855 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1856 break; 1857 case TERM_REQ: 1858 scp->rseq = h->ident; 1859 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1860 break; 1861 case TERM_ACK: 1862 if (h->ident != scp->confid && 1863 h->ident != scp->seq) { 1864 if (debug) 1865 addlog("%s: %s id mismatch " 1866 "0x%x != 0x%x and 0x%x != %0lx\n", 1867 ifp->if_xname, cp->name, 1868 h->ident, scp->confid, 1869 h->ident, scp->seq); 1870 if_statinc(ifp, if_ierrors); 1871 break; 1872 } 1873 1874 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1875 break; 1876 case CODE_REJ: 1877 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1878 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1879 log(LOG_INFO, 1880 "%s: %s: ignoring RXJ (%s) for code ?, " 1881 "danger will robinson\n", 1882 ifp->if_xname, cp->name, cpname); 1883 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1884 break; 1885 case PROTO_REJ: 1886 { 1887 int catastrophic; 1888 const struct cp *upper; 1889 int i; 1890 uint16_t proto; 1891 1892 catastrophic = 0; 1893 upper = NULL; 1894 proto = p[0] << 8 | p[1]; 1895 for (i = 0; i < IDX_COUNT; i++) { 1896 if (cps[i]->proto == proto) { 1897 upper = cps[i]; 1898 break; 1899 } 1900 } 1901 if (upper == NULL) 1902 catastrophic++; 1903 1904 if (debug) { 1905 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1906 log(LOG_INFO, 1907 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1908 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1909 cpname, proto, upper ? upper->name : "unknown", 1910 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1911 } 1912 1913 /* 1914 * if we got RXJ+ against conf-req, the peer does not implement 1915 * this particular protocol type. terminate the protocol. 1916 */ 1917 if (upper && !catastrophic) { 1918 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1919 sppp_wq_add(sp->wq_cp, 1920 &sp->scp[upper->protoidx].work_close); 1921 break; 1922 } 1923 } 1924 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1925 break; 1926 } 1927 case DISC_REQ: 1928 if (cp->proto != PPP_LCP) 1929 goto illegal; 1930 /* Discard the packet. */ 1931 break; 1932 case ECHO_REQ: 1933 if (cp->proto != PPP_LCP) 1934 goto illegal; 1935 if (scp->state != STATE_OPENED) { 1936 if (debug) 1937 addlog("%s: lcp echo req but lcp closed\n", 1938 ifp->if_xname); 1939 if_statinc(ifp, if_ierrors); 1940 break; 1941 } 1942 if (len < 8) { 1943 if (debug) 1944 addlog("%s: invalid lcp echo request " 1945 "packet length: %d bytes\n", 1946 ifp->if_xname, len); 1947 break; 1948 } 1949 memcpy(&u32, h + 1, sizeof u32); 1950 if (ntohl(u32) == sp->lcp.magic) { 1951 /* Line loopback mode detected. */ 1952 printf("%s: loopback\n", ifp->if_xname); 1953 1954 sp->pp_flags |= PP_LOOPBACK; 1955 sppp_wq_add(sp->wq_cp, 1956 &sp->work_ifdown); 1957 1958 /* Shut down the PPP link. */ 1959 sppp_wq_add(sp->wq_cp, 1960 &sp->scp[IDX_LCP].work_close); 1961 sppp_wq_add(sp->wq_cp, 1962 &sp->scp[IDX_LCP].work_open); 1963 break; 1964 } 1965 u32 = htonl(sp->lcp.magic); 1966 memcpy(h + 1, &u32, sizeof u32); 1967 if (debug) 1968 addlog("%s: got lcp echo req, sending echo rep\n", 1969 ifp->if_xname); 1970 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1971 h + 1); 1972 break; 1973 case ECHO_REPLY: 1974 if (cp->proto != PPP_LCP) 1975 goto illegal; 1976 if (h->ident != sp->lcp.echoid) { 1977 if_statinc(ifp, if_ierrors); 1978 break; 1979 } 1980 if (len < 8) { 1981 if (debug) 1982 addlog("%s: lcp invalid echo reply " 1983 "packet length: %d bytes\n", 1984 ifp->if_xname, len); 1985 break; 1986 } 1987 if (debug) 1988 addlog("%s: lcp got echo rep\n", 1989 ifp->if_xname); 1990 memcpy(&u32, h + 1, sizeof u32); 1991 if (ntohl(u32) != sp->lcp.magic) 1992 sp->pp_alivecnt = 0; 1993 break; 1994 default: 1995 /* Unknown packet type -- send Code-Reject packet. */ 1996 illegal: 1997 if (debug) 1998 addlog("%s: %s send code-rej for 0x%x\n", 1999 ifp->if_xname, cp->name, h->type); 2000 sppp_cp_send(sp, cp->proto, CODE_REJ, 2001 ++scp->seq, m->m_pkthdr.len, h); 2002 if_statinc(ifp, if_ierrors); 2003 } 2004 2005 out: 2006 SPPP_UNLOCK(sp); 2007 if (m != NULL) 2008 m_freem(m); 2009 } 2010 2011 /* 2012 * The generic part of all Up/Down/Open/Close/TO event handlers. 2013 * Basically, the state transition handling in the automaton. 2014 */ 2015 static void 2016 sppp_up_event(struct sppp *sp, void *xcp) 2017 { 2018 const struct cp *cp = xcp; 2019 STDDCL; 2020 2021 KASSERT(SPPP_WLOCKED(sp)); 2022 KASSERT(!cpu_softintr_p()); 2023 2024 if ((cp->flags & CP_AUTH) != 0 && 2025 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2026 return; 2027 2028 if (debug) 2029 log(LOG_DEBUG, "%s: %s up(%s)\n", 2030 ifp->if_xname, cp->name, 2031 sppp_state_name(sp->scp[cp->protoidx].state)); 2032 2033 switch (sp->scp[cp->protoidx].state) { 2034 case STATE_INITIAL: 2035 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2036 break; 2037 case STATE_STARTING: 2038 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2039 (cp->scr)(sp); 2040 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2041 break; 2042 default: 2043 printf("%s: %s illegal up in state %s\n", 2044 ifp->if_xname, cp->name, 2045 sppp_state_name(sp->scp[cp->protoidx].state)); 2046 } 2047 } 2048 2049 static void 2050 sppp_down_event(struct sppp *sp, void *xcp) 2051 { 2052 const struct cp *cp = xcp; 2053 STDDCL; 2054 2055 KASSERT(SPPP_WLOCKED(sp)); 2056 KASSERT(!cpu_softintr_p()); 2057 2058 if ((cp->flags & CP_AUTH) != 0 && 2059 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2060 return; 2061 2062 if (debug) 2063 log(LOG_DEBUG, "%s: %s down(%s)\n", 2064 ifp->if_xname, cp->name, 2065 sppp_state_name(sp->scp[cp->protoidx].state)); 2066 2067 switch (sp->scp[cp->protoidx].state) { 2068 case STATE_CLOSED: 2069 case STATE_CLOSING: 2070 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2071 break; 2072 case STATE_STOPPED: 2073 (cp->tls)(cp, sp); 2074 /* fall through */ 2075 case STATE_STOPPING: 2076 case STATE_REQ_SENT: 2077 case STATE_ACK_RCVD: 2078 case STATE_ACK_SENT: 2079 sppp_cp_change_state(cp, sp, STATE_STARTING); 2080 break; 2081 case STATE_OPENED: 2082 (cp->tld)(sp); 2083 sppp_cp_change_state(cp, sp, STATE_STARTING); 2084 break; 2085 default: 2086 /* 2087 * a down event may be caused regardless 2088 * of state just in LCP case. 2089 */ 2090 if (cp->proto == PPP_LCP) 2091 break; 2092 2093 printf("%s: %s illegal down in state %s\n", 2094 ifp->if_xname, cp->name, 2095 sppp_state_name(sp->scp[cp->protoidx].state)); 2096 } 2097 } 2098 2099 static void 2100 sppp_open_event(struct sppp *sp, void *xcp) 2101 { 2102 const struct cp *cp = xcp; 2103 STDDCL; 2104 2105 KASSERT(SPPP_WLOCKED(sp)); 2106 KASSERT(!cpu_softintr_p()); 2107 2108 if ((cp->flags & CP_AUTH) != 0 && 2109 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2110 return; 2111 2112 if (debug) 2113 log(LOG_DEBUG, "%s: %s open(%s)\n", 2114 ifp->if_xname, cp->name, 2115 sppp_state_name(sp->scp[cp->protoidx].state)); 2116 2117 switch (sp->scp[cp->protoidx].state) { 2118 case STATE_INITIAL: 2119 sppp_cp_change_state(cp, sp, STATE_STARTING); 2120 (cp->tls)(cp, sp); 2121 break; 2122 case STATE_STARTING: 2123 break; 2124 case STATE_CLOSED: 2125 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2126 (cp->scr)(sp); 2127 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2128 break; 2129 case STATE_STOPPED: 2130 case STATE_STOPPING: 2131 case STATE_REQ_SENT: 2132 case STATE_ACK_RCVD: 2133 case STATE_ACK_SENT: 2134 case STATE_OPENED: 2135 break; 2136 case STATE_CLOSING: 2137 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2138 break; 2139 } 2140 } 2141 2142 static void 2143 sppp_close_event(struct sppp *sp, void *xcp) 2144 { 2145 const struct cp *cp = xcp; 2146 STDDCL; 2147 2148 KASSERT(SPPP_WLOCKED(sp)); 2149 KASSERT(!cpu_softintr_p()); 2150 2151 if ((cp->flags & CP_AUTH) != 0 && 2152 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 2153 return; 2154 2155 if (debug) 2156 log(LOG_DEBUG, "%s: %s close(%s)\n", 2157 ifp->if_xname, cp->name, 2158 sppp_state_name(sp->scp[cp->protoidx].state)); 2159 2160 switch (sp->scp[cp->protoidx].state) { 2161 case STATE_INITIAL: 2162 case STATE_CLOSED: 2163 case STATE_CLOSING: 2164 break; 2165 case STATE_STARTING: 2166 sppp_cp_change_state(cp, sp, STATE_INITIAL); 2167 (cp->tlf)(cp, sp); 2168 break; 2169 case STATE_STOPPED: 2170 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2171 break; 2172 case STATE_STOPPING: 2173 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2174 break; 2175 case STATE_OPENED: 2176 (cp->tld)(sp); 2177 /* fall through */ 2178 case STATE_REQ_SENT: 2179 case STATE_ACK_RCVD: 2180 case STATE_ACK_SENT: 2181 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 2182 if ((cp->flags & CP_AUTH) == 0) { 2183 sppp_cp_send(sp, cp->proto, TERM_REQ, 2184 ++sp->scp[cp->protoidx].seq, 0, 0); 2185 } 2186 sppp_cp_change_state(cp, sp, STATE_CLOSING); 2187 break; 2188 } 2189 } 2190 2191 static void 2192 sppp_to_event(struct sppp *sp, void *xcp) 2193 { 2194 const struct cp *cp = xcp; 2195 int s; 2196 STDDCL; 2197 2198 KASSERT(SPPP_WLOCKED(sp)); 2199 KASSERT(!cpu_softintr_p()); 2200 2201 s = splnet(); 2202 2203 if (debug) 2204 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 2205 ifp->if_xname, cp->name, 2206 sppp_state_name(sp->scp[cp->protoidx].state), 2207 sp->scp[cp->protoidx].rst_counter); 2208 2209 if (--sp->scp[cp->protoidx].rst_counter < 0) 2210 /* TO- event */ 2211 switch (sp->scp[cp->protoidx].state) { 2212 case STATE_CLOSING: 2213 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2214 (cp->tlf)(cp, sp); 2215 break; 2216 case STATE_STOPPING: 2217 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2218 (cp->tlf)(cp, sp); 2219 break; 2220 case STATE_REQ_SENT: 2221 case STATE_ACK_RCVD: 2222 case STATE_ACK_SENT: 2223 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2224 (cp->tlf)(cp, sp); 2225 break; 2226 } 2227 else 2228 /* TO+ event */ 2229 switch (sp->scp[cp->protoidx].state) { 2230 case STATE_CLOSING: 2231 case STATE_STOPPING: 2232 if ((cp->flags & CP_AUTH) == 0) { 2233 sppp_cp_send(sp, cp->proto, TERM_REQ, 2234 ++sp->scp[cp->protoidx].seq, 0, 0); 2235 } 2236 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2237 break; 2238 case STATE_REQ_SENT: 2239 case STATE_ACK_RCVD: 2240 (cp->scr)(sp); 2241 /* sppp_cp_change_state() will restart the timer */ 2242 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2243 break; 2244 case STATE_ACK_SENT: 2245 (cp->scr)(sp); 2246 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2247 break; 2248 } 2249 2250 splx(s); 2251 } 2252 static void 2253 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2254 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2255 { 2256 STDDCL; 2257 u_char ctype; 2258 2259 if (type == CP_RCR_ERR) { 2260 /* parse error, shut down */ 2261 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2262 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2263 } else if (type == CP_RCR_ACK) { 2264 /* RCR+ event */ 2265 ctype = CONF_ACK; 2266 switch (sp->scp[cp->protoidx].state) { 2267 case STATE_OPENED: 2268 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2269 cp->tld(sp); 2270 cp->scr(sp); 2271 cp->screply(cp, sp, ctype, ident, msglen, msg); 2272 break; 2273 case STATE_REQ_SENT: 2274 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2275 /* fall through */ 2276 case STATE_ACK_SENT: 2277 cp->screply(cp, sp, ctype, ident, msglen, msg); 2278 break; 2279 case STATE_STOPPED: 2280 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2281 cp->scr(sp); 2282 cp->screply(cp, sp, ctype, ident, msglen, msg); 2283 break; 2284 case STATE_ACK_RCVD: 2285 sppp_cp_change_state(cp, sp, STATE_OPENED); 2286 if (debug) 2287 log(LOG_DEBUG, "%s: %s tlu\n", 2288 ifp->if_xname, 2289 cp->name); 2290 cp->tlu(sp); 2291 cp->screply(cp, sp, ctype, ident, msglen, msg); 2292 break; 2293 case STATE_CLOSING: 2294 case STATE_STOPPING: 2295 break; 2296 case STATE_CLOSED: 2297 if ((cp->flags & CP_AUTH) == 0) { 2298 sppp_cp_send(sp, cp->proto, TERM_ACK, 2299 ident, 0, 0); 2300 } 2301 break; 2302 default: 2303 printf("%s: %s illegal RCR+ in state %s\n", 2304 ifp->if_xname, cp->name, 2305 sppp_state_name(sp->scp[cp->protoidx].state)); 2306 if_statinc(ifp, if_ierrors); 2307 } 2308 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2309 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2310 /* RCR- event */ 2311 switch (sp->scp[cp->protoidx].state) { 2312 case STATE_OPENED: 2313 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2314 cp->tld(sp); 2315 cp->scr(sp); 2316 cp->screply(cp, sp, ctype, ident, msglen, msg); 2317 break; 2318 case STATE_ACK_SENT: 2319 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2320 /* fall through */ 2321 case STATE_REQ_SENT: 2322 cp->screply(cp, sp, ctype, ident, msglen, msg); 2323 break; 2324 case STATE_STOPPED: 2325 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2326 cp->scr(sp); 2327 cp->screply(cp, sp, ctype, ident, msglen, msg); 2328 break; 2329 case STATE_ACK_RCVD: 2330 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2331 cp->screply(cp, sp, ctype, ident, msglen, msg); 2332 break; 2333 case STATE_CLOSING: 2334 case STATE_STOPPING: 2335 break; 2336 case STATE_CLOSED: 2337 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2338 if ((cp->flags & CP_AUTH) == 0) { 2339 sppp_cp_send(sp, cp->proto, TERM_ACK, 2340 ident, 0, 0); 2341 } 2342 break; 2343 default: 2344 printf("%s: %s illegal RCR- in state %s\n", 2345 ifp->if_xname, cp->name, 2346 sppp_state_name(sp->scp[cp->protoidx].state)); 2347 if_statinc(ifp, if_ierrors); 2348 } 2349 } 2350 } 2351 2352 static void 2353 sppp_rcr_event(struct sppp *sp, void *xcp) 2354 { 2355 const struct cp *cp = xcp; 2356 struct sppp_cp *scp; 2357 struct lcp_header *h; 2358 struct mbuf *m; 2359 enum cp_rcr_type type; 2360 size_t len; 2361 uint8_t *buf; 2362 size_t blen, rlen; 2363 uint8_t ident; 2364 2365 KASSERT(!cpu_softintr_p()); 2366 2367 scp = &sp->scp[cp->protoidx]; 2368 2369 if (cp->parse_confreq != NULL) { 2370 m = scp->mbuf_confreq; 2371 if (m == NULL) 2372 return; 2373 scp->mbuf_confreq = NULL; 2374 2375 h = mtod(m, struct lcp_header *); 2376 if (h->type != CONF_REQ) { 2377 m_freem(m); 2378 return; 2379 } 2380 2381 ident = h->ident; 2382 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2383 2384 type = (cp->parse_confreq)(sp, h, len, 2385 &buf, &blen, &rlen); 2386 m_freem(m); 2387 } else { 2388 /* mbuf_cofreq is already parsed and freed */ 2389 type = scp->rcr_type; 2390 ident = scp->rconfid; 2391 buf = NULL; 2392 blen = rlen = 0; 2393 } 2394 2395 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2396 2397 if (buf != NULL) 2398 kmem_free(buf, blen); 2399 } 2400 2401 static void 2402 sppp_rca_event(struct sppp *sp, void *xcp) 2403 { 2404 const struct cp *cp = xcp; 2405 STDDCL; 2406 2407 KASSERT(!cpu_softintr_p()); 2408 2409 switch (sp->scp[cp->protoidx].state) { 2410 case STATE_CLOSED: 2411 case STATE_STOPPED: 2412 if ((cp->flags & CP_AUTH) == 0) { 2413 sppp_cp_send(sp, cp->proto, TERM_ACK, 2414 sp->scp[cp->protoidx].rconfid, 0, 0); 2415 } 2416 break; 2417 case STATE_CLOSING: 2418 case STATE_STOPPING: 2419 break; 2420 case STATE_REQ_SENT: 2421 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2422 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2423 break; 2424 case STATE_OPENED: 2425 (cp->tld)(sp); 2426 /* fall through */ 2427 case STATE_ACK_RCVD: 2428 (cp->scr)(sp); 2429 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2430 break; 2431 case STATE_ACK_SENT: 2432 sppp_cp_change_state(cp, sp, STATE_OPENED); 2433 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2434 if (debug) 2435 log(LOG_DEBUG, "%s: %s tlu\n", 2436 ifp->if_xname, cp->name); 2437 (cp->tlu)(sp); 2438 break; 2439 default: 2440 printf("%s: %s illegal RCA in state %s\n", 2441 ifp->if_xname, cp->name, 2442 sppp_state_name(sp->scp[cp->protoidx].state)); 2443 if_statinc(ifp, if_ierrors); 2444 } 2445 } 2446 2447 static void 2448 sppp_rcn_event(struct sppp *sp, void *xcp) 2449 { 2450 const struct cp *cp = xcp; 2451 struct sppp_cp *scp; 2452 struct lcp_header *h; 2453 struct mbuf *m; 2454 struct ifnet *ifp = &sp->pp_if; 2455 size_t len; 2456 2457 KASSERT(!cpu_softintr_p()); 2458 2459 scp = &sp->scp[cp->protoidx]; 2460 m = scp->mbuf_confnak; 2461 if (m == NULL) 2462 return; 2463 scp->mbuf_confnak = NULL; 2464 2465 h = mtod(m, struct lcp_header *); 2466 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2467 2468 switch (h->type) { 2469 case CONF_NAK: 2470 (cp->parse_confnak)(sp, h, len); 2471 break; 2472 case CONF_REJ: 2473 (cp->parse_confrej)(sp, h, len); 2474 break; 2475 default: 2476 m_freem(m); 2477 return; 2478 } 2479 2480 m_freem(m); 2481 2482 switch (scp->state) { 2483 case STATE_CLOSED: 2484 case STATE_STOPPED: 2485 if ((cp->flags & CP_AUTH) == 0) { 2486 sppp_cp_send(sp, cp->proto, TERM_ACK, 2487 scp->rconfid, 0, 0); 2488 } 2489 break; 2490 case STATE_REQ_SENT: 2491 case STATE_ACK_SENT: 2492 scp->rst_counter = sp->lcp.max_configure; 2493 (cp->scr)(sp); 2494 break; 2495 case STATE_OPENED: 2496 (cp->tld)(sp); 2497 /* fall through */ 2498 case STATE_ACK_RCVD: 2499 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2500 (cp->scr)(sp); 2501 break; 2502 case STATE_CLOSING: 2503 case STATE_STOPPING: 2504 break; 2505 default: 2506 printf("%s: %s illegal RCN in state %s\n", 2507 ifp->if_xname, cp->name, 2508 sppp_state_name(scp->state)); 2509 if_statinc(ifp, if_ierrors); 2510 } 2511 } 2512 2513 static void 2514 sppp_rtr_event(struct sppp *sp, void *xcp) 2515 { 2516 const struct cp *cp = xcp; 2517 STDDCL; 2518 2519 KASSERT(!cpu_softintr_p()); 2520 2521 switch (sp->scp[cp->protoidx].state) { 2522 case STATE_ACK_RCVD: 2523 case STATE_ACK_SENT: 2524 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2525 break; 2526 case STATE_CLOSED: 2527 case STATE_STOPPED: 2528 case STATE_CLOSING: 2529 case STATE_STOPPING: 2530 case STATE_REQ_SENT: 2531 break; 2532 case STATE_OPENED: 2533 (cp->tld)(sp); 2534 sp->scp[cp->protoidx].rst_counter = 0; 2535 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2536 break; 2537 default: 2538 printf("%s: %s illegal RTR in state %s\n", 2539 ifp->if_xname, cp->name, 2540 sppp_state_name(sp->scp[cp->protoidx].state)); 2541 if_statinc(ifp, if_ierrors); 2542 return; 2543 } 2544 2545 /* Send Terminate-Ack packet. */ 2546 if (debug) 2547 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 2548 ifp->if_xname, cp->name); 2549 if ((cp->flags & CP_AUTH) == 0) { 2550 sppp_cp_send(sp, cp->proto, TERM_ACK, 2551 sp->scp[cp->protoidx].rseq, 0, 0); 2552 } 2553 } 2554 2555 static void 2556 sppp_rta_event(struct sppp *sp, void *xcp) 2557 { 2558 const struct cp *cp = xcp; 2559 struct ifnet *ifp = &sp->pp_if; 2560 2561 KASSERT(!cpu_softintr_p()); 2562 2563 switch (sp->scp[cp->protoidx].state) { 2564 case STATE_CLOSED: 2565 case STATE_STOPPED: 2566 case STATE_REQ_SENT: 2567 case STATE_ACK_SENT: 2568 break; 2569 case STATE_CLOSING: 2570 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2571 (cp->tlf)(cp, sp); 2572 break; 2573 case STATE_STOPPING: 2574 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2575 (cp->tlf)(cp, sp); 2576 break; 2577 case STATE_ACK_RCVD: 2578 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2579 break; 2580 case STATE_OPENED: 2581 (cp->tld)(sp); 2582 (cp->scr)(sp); 2583 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2584 break; 2585 default: 2586 printf("%s: %s illegal RTA in state %s\n", 2587 ifp->if_xname, cp->name, 2588 sppp_state_name(sp->scp[cp->protoidx].state)); 2589 if_statinc(ifp, if_ierrors); 2590 } 2591 } 2592 2593 static void 2594 sppp_rxj_event(struct sppp *sp, void *xcp) 2595 { 2596 const struct cp *cp = xcp; 2597 struct ifnet *ifp = &sp->pp_if; 2598 2599 KASSERT(!cpu_softintr_p()); 2600 2601 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2602 switch (sp->scp[cp->protoidx].state) { 2603 case STATE_CLOSED: 2604 case STATE_STOPPED: 2605 case STATE_REQ_SENT: 2606 case STATE_ACK_SENT: 2607 case STATE_CLOSING: 2608 case STATE_STOPPING: 2609 case STATE_OPENED: 2610 break; 2611 case STATE_ACK_RCVD: 2612 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2613 break; 2614 default: 2615 printf("%s: %s illegal RXJ- in state %s\n", 2616 ifp->if_xname, cp->name, 2617 sppp_state_name(sp->scp[cp->protoidx].state)); 2618 if_statinc(ifp, if_ierrors); 2619 } 2620 } 2621 2622 /* 2623 * Change the state of a control protocol in the state automaton. 2624 * Takes care of starting/stopping the restart timer. 2625 */ 2626 void 2627 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2628 { 2629 2630 KASSERT(SPPP_WLOCKED(sp)); 2631 2632 sp->scp[cp->protoidx].state = newstate; 2633 callout_stop(&sp->scp[cp->protoidx].ch); 2634 switch (newstate) { 2635 case STATE_INITIAL: 2636 case STATE_STARTING: 2637 case STATE_CLOSED: 2638 case STATE_STOPPED: 2639 case STATE_OPENED: 2640 break; 2641 case STATE_CLOSING: 2642 case STATE_STOPPING: 2643 case STATE_REQ_SENT: 2644 case STATE_ACK_RCVD: 2645 case STATE_ACK_SENT: 2646 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2647 break; 2648 } 2649 } 2650 2651 /* 2652 *--------------------------------------------------------------------------* 2653 * * 2654 * The LCP implementation. * 2655 * * 2656 *--------------------------------------------------------------------------* 2657 */ 2658 static void 2659 sppp_lcp_init(struct sppp *sp) 2660 { 2661 2662 KASSERT(SPPP_WLOCKED(sp)); 2663 2664 sppp_cp_init(&lcp, sp); 2665 2666 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2667 sp->lcp.magic = 0; 2668 sp->lcp.protos = 0; 2669 sp->lcp.max_terminate = 2; 2670 sp->lcp.max_configure = 10; 2671 sp->lcp.max_failure = 10; 2672 sp->lcp.tlf_sent = false; 2673 2674 /* 2675 * Initialize counters and timeout values. Note that we don't 2676 * use the 3 seconds suggested in RFC 1661 since we are likely 2677 * running on a fast link. XXX We should probably implement 2678 * the exponential backoff option. Note that these values are 2679 * relevant for all control protocols, not just LCP only. 2680 */ 2681 sp->lcp.timeout = 1 * hz; 2682 } 2683 2684 static void 2685 sppp_lcp_up(struct sppp *sp, void *xcp) 2686 { 2687 const struct cp *cp = xcp; 2688 int pidx; 2689 STDDCL; 2690 2691 KASSERT(SPPP_WLOCKED(sp)); 2692 2693 pidx = cp->protoidx; 2694 /* Initialize activity timestamp: opening a connection is an activity */ 2695 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2696 2697 /* 2698 * If this interface is passive or dial-on-demand, and we are 2699 * still in Initial state, it means we've got an incoming 2700 * call. Activate the interface. 2701 */ 2702 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2703 if (debug) 2704 log(LOG_DEBUG, 2705 "%s: Up event", ifp->if_xname); 2706 ifp->if_flags |= IFF_RUNNING; 2707 if (sp->scp[pidx].state == STATE_INITIAL) { 2708 if (debug) 2709 addlog("(incoming call)\n"); 2710 sp->pp_flags |= PP_CALLIN; 2711 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2712 } else if (debug) 2713 addlog("\n"); 2714 } 2715 2716 sppp_up_event(sp, xcp); 2717 } 2718 2719 static void 2720 sppp_lcp_down(struct sppp *sp, void *xcp) 2721 { 2722 const struct cp *cp = xcp; 2723 int pidx; 2724 STDDCL; 2725 2726 KASSERT(SPPP_WLOCKED(sp)); 2727 KASSERT(!cpu_softintr_p()); 2728 2729 pidx = cp->protoidx; 2730 sppp_down_event(sp, xcp); 2731 2732 /* 2733 * We need to do tls to restart when a down event is caused 2734 * by the last tlf. 2735 */ 2736 if (sp->scp[pidx].state == STATE_STARTING && 2737 sp->lcp.tlf_sent) { 2738 cp->tls(cp, sp); 2739 sp->lcp.tlf_sent = false; 2740 } 2741 2742 /* 2743 * If this is neither a dial-on-demand nor a passive 2744 * interface, simulate an ``ifconfig down'' action, so the 2745 * administrator can force a redial by another ``ifconfig 2746 * up''. XXX For leased line operation, should we immediately 2747 * try to reopen the connection here? 2748 */ 2749 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2750 if (debug) 2751 log(LOG_INFO, 2752 "%s: Down event (carrier loss), taking interface down.\n", 2753 ifp->if_xname); 2754 SPPP_UNLOCK(sp); 2755 if_down(ifp); 2756 SPPP_LOCK(sp, RW_WRITER); 2757 2758 if (sp->lcp.reestablish) 2759 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2760 } else { 2761 if (debug) 2762 log(LOG_DEBUG, 2763 "%s: Down event (carrier loss)\n", 2764 ifp->if_xname); 2765 2766 sp->pp_flags &= ~PP_CALLIN; 2767 if (sp->scp[pidx].state != STATE_INITIAL) 2768 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2769 ifp->if_flags &= ~IFF_RUNNING; 2770 } 2771 sp->scp[pidx].fail_counter = 0; 2772 } 2773 2774 static void 2775 sppp_lcp_open(struct sppp *sp, void *xcp) 2776 { 2777 2778 KASSERT(SPPP_WLOCKED(sp)); 2779 KASSERT(!cpu_softintr_p()); 2780 2781 sp->lcp.reestablish = false; 2782 sp->scp[IDX_LCP].fail_counter = 0; 2783 2784 if (sp->pp_if.if_mtu < PP_MTU) { 2785 sp->lcp.mru = sp->pp_if.if_mtu; 2786 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2787 } else { 2788 sp->lcp.mru = PP_MTU; 2789 } 2790 sp->lcp.their_mru = PP_MTU; 2791 2792 /* 2793 * If we are authenticator, negotiate LCP_AUTH 2794 */ 2795 if (sp->hisauth.proto != PPP_NOPROTO) 2796 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2797 else 2798 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2799 sp->pp_flags &= ~PP_NEEDAUTH; 2800 sppp_open_event(sp, xcp); 2801 } 2802 2803 2804 /* 2805 * Analyze a configure request. Return true if it was agreeable, and 2806 * caused action sca, false if it has been rejected or nak'ed, and 2807 * caused action scn. (The return value is used to make the state 2808 * transition decision in the state automaton.) 2809 */ 2810 static enum cp_rcr_type 2811 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2812 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2813 { 2814 STDDCL; 2815 u_char *buf, *r, *p, l, blen; 2816 enum cp_rcr_type type; 2817 int len, rlen; 2818 uint32_t nmagic; 2819 u_short authproto; 2820 char lbuf[SPPP_LCPOPT_NAMELEN]; 2821 2822 KASSERT(SPPP_WLOCKED(sp)); 2823 2824 if (origlen < sizeof(*h)) 2825 return CP_RCR_DROP; 2826 2827 origlen -= sizeof(*h); 2828 type = CP_RCR_NONE; 2829 type = 0; 2830 2831 if (origlen <= 0) 2832 return CP_RCR_DROP; 2833 else 2834 blen = origlen; 2835 2836 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2837 if (buf == NULL) 2838 return CP_RCR_DROP; 2839 2840 if (debug) 2841 log(LOG_DEBUG, "%s: lcp parse opts:", 2842 ifp->if_xname); 2843 2844 /* pass 1: check for things that need to be rejected */ 2845 p = (void *)(h + 1); 2846 r = buf; 2847 rlen = 0; 2848 for (len = origlen; len > 1; len-= l, p += l) { 2849 l = p[1]; 2850 if (l == 0) 2851 break; 2852 2853 /* Sanity check option length */ 2854 if (l > len) { 2855 /* 2856 * Malicious option - drop immediately. 2857 * XXX Maybe we should just RXJ it? 2858 */ 2859 addlog("%s: received malicious LCP option 0x%02x, " 2860 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2861 p[0], l, len); 2862 type = CP_RCR_ERR; 2863 goto end; 2864 } 2865 if (debug) 2866 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2867 switch (p[0]) { 2868 case LCP_OPT_MAGIC: 2869 /* Magic number. */ 2870 /* fall through, both are same length */ 2871 case LCP_OPT_ASYNC_MAP: 2872 /* Async control character map. */ 2873 if (len >= 6 || l == 6) 2874 continue; 2875 if (debug) 2876 addlog(" [invalid]"); 2877 break; 2878 case LCP_OPT_MP_EID: 2879 if (len >= l && l >= 3) { 2880 switch (p[2]) { 2881 case 0: if (l==3+ 0) continue;break; 2882 case 2: if (l==3+ 4) continue;break; 2883 case 3: if (l==3+ 6) continue;break; 2884 case 6: if (l==3+16) continue;break; 2885 case 1: /* FALLTHROUGH */ 2886 case 4: if (l<=3+20) continue;break; 2887 case 5: if (l<=3+15) continue;break; 2888 /* XXX should it be default: continue;? */ 2889 } 2890 } 2891 if (debug) 2892 addlog(" [invalid class %d len %d]", p[2], l); 2893 break; 2894 case LCP_OPT_MP_SSNHF: 2895 if (len >= 2 && l == 2) { 2896 if (debug) 2897 addlog(" [rej]"); 2898 break; 2899 } 2900 if (debug) 2901 addlog(" [invalid]"); 2902 break; 2903 case LCP_OPT_MP_MRRU: 2904 /* Multilink maximum received reconstructed unit */ 2905 /* should be fall through, both are same length */ 2906 /* FALLTHROUGH */ 2907 case LCP_OPT_MRU: 2908 /* Maximum receive unit. */ 2909 if (len >= 4 && l == 4) 2910 continue; 2911 if (debug) 2912 addlog(" [invalid]"); 2913 break; 2914 case LCP_OPT_AUTH_PROTO: 2915 if (len < 4) { 2916 if (debug) 2917 addlog(" [invalid]"); 2918 break; 2919 } 2920 authproto = (p[2] << 8) + p[3]; 2921 if (authproto == PPP_CHAP && l != 5) { 2922 if (debug) 2923 addlog(" [invalid chap len]"); 2924 break; 2925 } 2926 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2927 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2928 sp->myauth.proto = authproto; 2929 } 2930 if (sp->myauth.proto == PPP_NOPROTO) { 2931 /* we are not configured to do auth */ 2932 if (debug) 2933 addlog(" [not configured]"); 2934 break; 2935 } 2936 /* 2937 * Remote want us to authenticate, remember this, 2938 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2939 * up. 2940 */ 2941 sp->pp_flags |= PP_NEEDAUTH; 2942 continue; 2943 default: 2944 /* Others not supported. */ 2945 if (debug) 2946 addlog(" [rej]"); 2947 break; 2948 } 2949 if (rlen + l > blen) { 2950 if (debug) 2951 addlog(" [overflow]"); 2952 continue; 2953 } 2954 /* Add the option to rejected list. */ 2955 memcpy(r, p, l); 2956 r += l; 2957 rlen += l; 2958 } 2959 2960 if (rlen > 0) { 2961 type = CP_RCR_REJ; 2962 goto end; 2963 } 2964 2965 if (debug) 2966 addlog("\n"); 2967 2968 /* 2969 * pass 2: check for option values that are unacceptable and 2970 * thus require to be nak'ed. 2971 */ 2972 if (debug) 2973 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2974 ifp->if_xname); 2975 2976 p = (void *)(h + 1); 2977 r = buf; 2978 rlen = 0; 2979 for (len = origlen; len > 0; len -= l, p += l) { 2980 l = p[1]; 2981 if (l == 0) 2982 break; 2983 2984 if (debug) 2985 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2986 switch (p[0]) { 2987 case LCP_OPT_MAGIC: 2988 /* Magic number -- extract. */ 2989 nmagic = (uint32_t)p[2] << 24 | 2990 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2991 if (nmagic != sp->lcp.magic) { 2992 if (debug) 2993 addlog(" 0x%x", nmagic); 2994 continue; 2995 } 2996 /* 2997 * Local and remote magics equal -- loopback? 2998 */ 2999 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 3000 printf ("%s: loopback\n", 3001 ifp->if_xname); 3002 sp->pp_loopcnt = 0; 3003 3004 sp->pp_flags |= PP_LOOPBACK; 3005 sppp_wq_add(sp->wq_cp, 3006 &sp->work_ifdown); 3007 3008 sppp_wq_add(sp->wq_cp, 3009 &sp->scp[IDX_LCP].work_close); 3010 sppp_wq_add(sp->wq_cp, 3011 &sp->scp[IDX_LCP].work_open); 3012 } else { 3013 if (debug) 3014 addlog(" [glitch]"); 3015 ++sp->pp_loopcnt; 3016 } 3017 /* 3018 * We negate our magic here, and NAK it. If 3019 * we see it later in an NAK packet, we 3020 * suggest a new one. 3021 */ 3022 nmagic = ~sp->lcp.magic; 3023 /* Gonna NAK it. */ 3024 p[2] = nmagic >> 24; 3025 p[3] = nmagic >> 16; 3026 p[4] = nmagic >> 8; 3027 p[5] = nmagic; 3028 break; 3029 3030 case LCP_OPT_ASYNC_MAP: 3031 /* 3032 * Async control character map -- just ignore it. 3033 * 3034 * Quote from RFC 1662, chapter 6: 3035 * To enable this functionality, synchronous PPP 3036 * implementations MUST always respond to the 3037 * Async-Control-Character-Map Configuration 3038 * Option with the LCP Configure-Ack. However, 3039 * acceptance of the Configuration Option does 3040 * not imply that the synchronous implementation 3041 * will do any ACCM mapping. Instead, all such 3042 * octet mapping will be performed by the 3043 * asynchronous-to-synchronous converter. 3044 */ 3045 continue; 3046 3047 case LCP_OPT_MRU: 3048 /* 3049 * Maximum receive unit. Always agreeable, 3050 * but ignored by now. 3051 */ 3052 sp->lcp.their_mru = p[2] * 256 + p[3]; 3053 if (debug) 3054 addlog(" %ld", sp->lcp.their_mru); 3055 continue; 3056 3057 case LCP_OPT_AUTH_PROTO: 3058 authproto = (p[2] << 8) + p[3]; 3059 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 3060 if (authproto == PPP_PAP || authproto == PPP_CHAP) 3061 sp->myauth.proto = authproto; 3062 } 3063 if (sp->myauth.proto == authproto) { 3064 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 3065 continue; 3066 } 3067 if (debug) 3068 addlog(" [chap without MD5]"); 3069 } else { 3070 if (debug) { 3071 char pbuf1[SPPP_PROTO_NAMELEN]; 3072 char pbuf2[SPPP_PROTO_NAMELEN]; 3073 const char *pname1, *pname2; 3074 3075 pname1 = sppp_proto_name(pbuf1, 3076 sizeof(pbuf1), sp->myauth.proto); 3077 pname2 = sppp_proto_name(pbuf2, 3078 sizeof(pbuf2), authproto); 3079 addlog(" [mine %s != his %s]", 3080 pname1, pname2); 3081 } 3082 } 3083 /* not agreed, nak */ 3084 if (sp->myauth.proto == PPP_CHAP) { 3085 l = 5; 3086 } else { 3087 l = 4; 3088 } 3089 3090 if (rlen + l > blen) { 3091 if (debug) 3092 addlog(" [overflow]"); 3093 continue; 3094 } 3095 3096 r[0] = LCP_OPT_AUTH_PROTO; 3097 r[1] = l; 3098 r[2] = sp->myauth.proto >> 8; 3099 r[3] = sp->myauth.proto & 0xff; 3100 if (sp->myauth.proto == PPP_CHAP) 3101 r[4] = CHAP_MD5; 3102 rlen += l; 3103 r += l; 3104 continue; 3105 case LCP_OPT_MP_EID: 3106 /* 3107 * Endpoint identification. 3108 * Always agreeable, 3109 * but ignored by now. 3110 */ 3111 if (debug) { 3112 addlog(" type %d", p[2]); 3113 sppp_print_bytes(p+3, p[1]-3); 3114 } 3115 continue; 3116 case LCP_OPT_MP_MRRU: 3117 /* 3118 * Maximum received reconstructed unit. 3119 * Always agreeable, 3120 * but ignored by now. 3121 */ 3122 sp->lcp.their_mrru = p[2] * 256 + p[3]; 3123 if (debug) 3124 addlog(" %ld", sp->lcp.their_mrru); 3125 continue; 3126 } 3127 if (rlen + l > blen) { 3128 if (debug) 3129 addlog(" [overflow]"); 3130 continue; 3131 } 3132 /* Add the option to nak'ed list. */ 3133 memcpy(r, p, l); 3134 r += l; 3135 rlen += l; 3136 } 3137 3138 if (rlen > 0) { 3139 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 3140 if (debug) 3141 addlog(" max_failure (%d) exceeded, ", 3142 sp->lcp.max_failure); 3143 type = CP_RCR_REJ; 3144 } else { 3145 type = CP_RCR_NAK; 3146 } 3147 } else { 3148 type = CP_RCR_ACK; 3149 rlen = origlen; 3150 memcpy(r, h + 1, rlen); 3151 sp->scp[IDX_LCP].fail_counter = 0; 3152 sp->pp_loopcnt = 0; 3153 } 3154 3155 end: 3156 if (debug) 3157 addlog("\n"); 3158 3159 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3160 if (buf != NULL) 3161 kmem_intr_free(buf, blen); 3162 } else { 3163 *msgbuf = buf; 3164 *buflen = blen; 3165 *msglen = rlen; 3166 } 3167 3168 return type; 3169 } 3170 3171 /* 3172 * Analyze the LCP Configure-Reject option list, and adjust our 3173 * negotiation. 3174 */ 3175 static void 3176 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3177 { 3178 STDDCL; 3179 u_char *p, l; 3180 3181 KASSERT(SPPP_WLOCKED(sp)); 3182 3183 if (len <= sizeof(*h)) 3184 return; 3185 3186 len -= sizeof(*h); 3187 3188 if (debug) 3189 log(LOG_DEBUG, "%s: lcp rej opts:", 3190 ifp->if_xname); 3191 3192 p = (void *)(h + 1); 3193 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3194 /* Sanity check option length */ 3195 if (l > len) { 3196 /* 3197 * Malicious option - drop immediately. 3198 * XXX Maybe we should just RXJ it? 3199 */ 3200 addlog("%s: received malicious LCP option, " 3201 "dropping.\n", ifp->if_xname); 3202 goto end; 3203 } 3204 if (debug) { 3205 char lbuf[SPPP_LCPOPT_NAMELEN]; 3206 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 3207 } 3208 switch (p[0]) { 3209 case LCP_OPT_MAGIC: 3210 /* Magic number -- can't use it, use 0 */ 3211 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 3212 sp->lcp.magic = 0; 3213 break; 3214 case LCP_OPT_MRU: 3215 /* 3216 * We try to negotiate a lower MRU if the underlying 3217 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 3218 * peer rejects this lower rate, fallback to the 3219 * default. 3220 */ 3221 if (debug) { 3222 addlog("%s: warning: peer rejected our MRU of " 3223 "%ld bytes. Defaulting to %d bytes\n", 3224 ifp->if_xname, sp->lcp.mru, PP_MTU); 3225 } 3226 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3227 sp->lcp.mru = PP_MTU; 3228 break; 3229 case LCP_OPT_AUTH_PROTO: 3230 /* 3231 * Peer doesn't want to authenticate himself, 3232 * deny unless this is a dialout call, and 3233 * SPPP_AUTHFLAG_NOCALLOUT is set. 3234 */ 3235 if ((sp->pp_flags & PP_CALLIN) == 0 && 3236 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 3237 if (debug) 3238 addlog(" [don't insist on auth " 3239 "for callout]"); 3240 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3241 break; 3242 } 3243 if (debug) 3244 addlog("[access denied]\n"); 3245 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3246 break; 3247 } 3248 } 3249 if (debug) 3250 addlog("\n"); 3251 end: 3252 return; 3253 } 3254 3255 /* 3256 * Analyze the LCP Configure-NAK option list, and adjust our 3257 * negotiation. 3258 */ 3259 static void 3260 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3261 { 3262 STDDCL; 3263 u_char *p, l; 3264 uint32_t magic; 3265 3266 KASSERT(SPPP_WLOCKED(sp)); 3267 3268 if (len <= sizeof(*h)) 3269 return; 3270 len -= sizeof(*h); 3271 3272 if (debug) 3273 log(LOG_DEBUG, "%s: lcp nak opts:", 3274 ifp->if_xname); 3275 3276 p = (void *)(h + 1); 3277 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3278 /* Sanity check option length */ 3279 if (l > len) { 3280 /* 3281 * Malicious option - drop immediately. 3282 * XXX Maybe we should just RXJ it? 3283 */ 3284 addlog("%s: received malicious LCP option, " 3285 "dropping.\n", ifp->if_xname); 3286 goto end; 3287 } 3288 if (debug) { 3289 char lbuf[SPPP_LCPOPT_NAMELEN]; 3290 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 3291 } 3292 switch (p[0]) { 3293 case LCP_OPT_MAGIC: 3294 /* Magic number -- renegotiate */ 3295 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3296 len >= 6 && l == 6) { 3297 magic = (uint32_t)p[2] << 24 | 3298 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3299 /* 3300 * If the remote magic is our negated one, 3301 * this looks like a loopback problem. 3302 * Suggest a new magic to make sure. 3303 */ 3304 if (magic == ~sp->lcp.magic) { 3305 if (debug) 3306 addlog(" magic glitch"); 3307 sp->lcp.magic = cprng_fast32(); 3308 } else { 3309 sp->lcp.magic = magic; 3310 if (debug) 3311 addlog(" %d", magic); 3312 } 3313 } 3314 break; 3315 case LCP_OPT_MRU: 3316 /* 3317 * Peer wants to advise us to negotiate an MRU. 3318 * Agree on it if it's reasonable, or use 3319 * default otherwise. 3320 */ 3321 if (len >= 4 && l == 4) { 3322 u_int mru = p[2] * 256 + p[3]; 3323 if (debug) 3324 addlog(" %d", mru); 3325 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3326 mru = sp->pp_if.if_mtu; 3327 sp->lcp.mru = mru; 3328 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3329 } 3330 break; 3331 case LCP_OPT_AUTH_PROTO: 3332 /* 3333 * Peer doesn't like our authentication method, 3334 * deny. 3335 */ 3336 if (debug) 3337 addlog("[access denied]\n"); 3338 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3339 break; 3340 } 3341 } 3342 if (debug) 3343 addlog("\n"); 3344 end: 3345 return; 3346 } 3347 3348 static void 3349 sppp_lcp_tlu(struct sppp *sp) 3350 { 3351 STDDCL; 3352 int i; 3353 bool going_up; 3354 3355 KASSERT(SPPP_WLOCKED(sp)); 3356 3357 /* unlock for IFNET_LOCK and if_up() */ 3358 SPPP_UNLOCK(sp); 3359 3360 if (! (ifp->if_flags & IFF_UP) && 3361 (ifp->if_flags & IFF_RUNNING)) { 3362 /* Coming out of loopback mode. */ 3363 going_up = true; 3364 if_up(ifp); 3365 } else { 3366 going_up = false; 3367 } 3368 3369 IFNET_LOCK(ifp); 3370 SPPP_LOCK(sp, RW_WRITER); 3371 3372 if (going_up) { 3373 if ((sp->pp_flags & PP_LOOPBACK) == 0) { 3374 log(LOG_DEBUG, "%s: interface is going up, " 3375 "but no loopback packet is deteted\n", 3376 ifp->if_xname); 3377 } 3378 sp->pp_flags &= ~PP_LOOPBACK; 3379 } 3380 3381 if (ifp->if_mtu > sp->lcp.their_mru) { 3382 sp->pp_saved_mtu = ifp->if_mtu; 3383 ifp->if_mtu = sp->lcp.their_mru; 3384 if (debug) { 3385 log(LOG_DEBUG, 3386 "%s: setting MTU " 3387 "from %"PRIu64" bytes " 3388 "to %"PRIu64" bytes\n", 3389 ifp->if_xname, sp->pp_saved_mtu, 3390 ifp->if_mtu); 3391 } 3392 } 3393 IFNET_UNLOCK(ifp); 3394 3395 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3396 (sp->pp_flags & PP_NEEDAUTH) != 0) 3397 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3398 else 3399 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3400 3401 /* 3402 * Open all authentication protocols. This is even required 3403 * if we already proceeded to network phase, since it might be 3404 * that remote wants us to authenticate, so we might have to 3405 * send a PAP request. Undesired authentication protocols 3406 * don't do anything when they get an Open event. 3407 */ 3408 for (i = 0; i < IDX_COUNT; i++) 3409 if ((cps[i])->flags & CP_AUTH) { 3410 sppp_wq_add(sp->wq_cp, 3411 &sp->scp[(cps[i])->protoidx].work_open); 3412 } 3413 3414 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 3415 /* Notify all NCPs. */ 3416 for (i = 0; i < IDX_COUNT; i++) 3417 if ((cps[i])->flags & CP_NCP) { 3418 sppp_wq_add(sp->wq_cp, 3419 &sp->scp[(cps[i])->protoidx].work_open); 3420 } 3421 } 3422 3423 /* notify low-level driver of state change */ 3424 sppp_notify_chg_wlocked(sp); 3425 } 3426 3427 static void 3428 sppp_lcp_tld(struct sppp *sp) 3429 { 3430 STDDCL; 3431 int i, pi, phase; 3432 3433 KASSERT(SPPP_WLOCKED(sp)); 3434 3435 phase = sp->pp_phase; 3436 3437 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3438 3439 if (sp->pp_saved_mtu > 0) { 3440 SPPP_UNLOCK(sp); 3441 IFNET_LOCK(ifp); 3442 SPPP_LOCK(sp, RW_WRITER); 3443 3444 if (debug) { 3445 log(LOG_DEBUG, 3446 "%s: setting MTU " 3447 "from %"PRIu64" bytes " 3448 "to %"PRIu64" bytes\n", 3449 ifp->if_xname, ifp->if_mtu, 3450 sp->pp_saved_mtu); 3451 } 3452 3453 ifp->if_mtu = sp->pp_saved_mtu; 3454 sp->pp_saved_mtu = 0; 3455 IFNET_UNLOCK(ifp); 3456 } 3457 3458 /* 3459 * Take upper layers down. We send the Down event first and 3460 * the Close second to prevent the upper layers from sending 3461 * ``a flurry of terminate-request packets'', as the RFC 3462 * describes it. 3463 */ 3464 for (i = 0; i < IDX_COUNT; i++) { 3465 pi = (cps[i])->protoidx; 3466 if (((cps[i])->flags & CP_LCP) == 0) { 3467 /* skip if ncp was not started */ 3468 if (phase != SPPP_PHASE_NETWORK && 3469 ((cps[i])->flags & CP_NCP) != 0) 3470 continue; 3471 3472 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_down); 3473 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_close); 3474 } 3475 } 3476 } 3477 3478 static void 3479 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3480 { 3481 3482 KASSERT(SPPP_WLOCKED(sp)); 3483 3484 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3485 printf("%s: authentication failed %d times, not retrying again\n", 3486 sp->pp_if.if_xname, sp->pp_auth_failures); 3487 3488 SPPP_UNLOCK(sp); 3489 if_down(&sp->pp_if); 3490 SPPP_LOCK(sp, RW_WRITER); 3491 return; 3492 } 3493 3494 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3495 3496 /* Notify lower layer if desired. */ 3497 sppp_notify_tls_wlocked(sp); 3498 sp->lcp.tlf_sent = false; 3499 } 3500 3501 static void 3502 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3503 { 3504 3505 KASSERT(SPPP_WLOCKED(sp)); 3506 3507 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3508 3509 /* Notify lower layer if desired. */ 3510 sppp_notify_tlf_wlocked(sp); 3511 3512 switch (sp->scp[IDX_LCP].state) { 3513 case STATE_CLOSED: 3514 case STATE_STOPPED: 3515 sp->lcp.tlf_sent = true; 3516 break; 3517 case STATE_INITIAL: 3518 default: 3519 /* just in case */ 3520 sp->lcp.tlf_sent = false; 3521 } 3522 } 3523 3524 static void 3525 sppp_lcp_scr(struct sppp *sp) 3526 { 3527 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3528 int i = 0; 3529 u_short authproto; 3530 3531 KASSERT(SPPP_WLOCKED(sp)); 3532 3533 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3534 if (! sp->lcp.magic) 3535 sp->lcp.magic = cprng_fast32(); 3536 opt[i++] = LCP_OPT_MAGIC; 3537 opt[i++] = 6; 3538 opt[i++] = sp->lcp.magic >> 24; 3539 opt[i++] = sp->lcp.magic >> 16; 3540 opt[i++] = sp->lcp.magic >> 8; 3541 opt[i++] = sp->lcp.magic; 3542 } 3543 3544 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3545 opt[i++] = LCP_OPT_MRU; 3546 opt[i++] = 4; 3547 opt[i++] = sp->lcp.mru >> 8; 3548 opt[i++] = sp->lcp.mru; 3549 } 3550 3551 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3552 authproto = sp->hisauth.proto; 3553 opt[i++] = LCP_OPT_AUTH_PROTO; 3554 opt[i++] = authproto == PPP_CHAP? 5: 4; 3555 opt[i++] = authproto >> 8; 3556 opt[i++] = authproto; 3557 if (authproto == PPP_CHAP) 3558 opt[i++] = CHAP_MD5; 3559 } 3560 3561 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3562 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3563 } 3564 3565 /* 3566 * Check the open NCPs, return true if at least one NCP is open. 3567 */ 3568 3569 static int 3570 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3571 { 3572 int i, mask; 3573 3574 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3575 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3576 return 1; 3577 return 0; 3578 } 3579 3580 /* 3581 * Re-check the open NCPs and see if we should terminate the link. 3582 * Called by the NCPs during their tlf action handling. 3583 */ 3584 static void 3585 sppp_lcp_check_and_close(struct sppp *sp) 3586 { 3587 3588 KASSERT(SPPP_WLOCKED(sp)); 3589 3590 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3591 /* don't bother, we are already going down */ 3592 return; 3593 } 3594 3595 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3596 sppp_cp_check(sp, CP_AUTH)) 3597 return; 3598 3599 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3600 sppp_cp_check(sp, CP_NCP)) 3601 return; 3602 3603 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3604 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3605 } 3606 3607 /* 3608 *--------------------------------------------------------------------------* 3609 * * 3610 * The IPCP implementation. * 3611 * * 3612 *--------------------------------------------------------------------------* 3613 */ 3614 3615 static void 3616 sppp_ipcp_init(struct sppp *sp) 3617 { 3618 3619 KASSERT(SPPP_WLOCKED(sp)); 3620 3621 sppp_cp_init(&ipcp, sp); 3622 3623 sp->ipcp.opts = 0; 3624 sp->ipcp.flags = 0; 3625 } 3626 3627 static void 3628 sppp_ipcp_open(struct sppp *sp, void *xcp) 3629 { 3630 STDDCL; 3631 uint32_t myaddr, hisaddr; 3632 3633 KASSERT(SPPP_WLOCKED(sp)); 3634 KASSERT(!cpu_softintr_p()); 3635 3636 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3637 return; 3638 3639 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3640 sp->ipcp.req_myaddr = 0; 3641 sp->ipcp.req_hisaddr = 0; 3642 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3643 3644 #ifdef INET 3645 kpreempt_disable(); 3646 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3647 kpreempt_enable(); 3648 #else 3649 myaddr = hisaddr = 0; 3650 #endif 3651 /* 3652 * If we don't have his address, this probably means our 3653 * interface doesn't want to talk IP at all. (This could 3654 * be the case if somebody wants to speak only IPX, for 3655 * example.) Don't open IPCP in this case. 3656 */ 3657 if (hisaddr == 0) { 3658 /* XXX this message should go away */ 3659 if (debug) 3660 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 3661 ifp->if_xname); 3662 return; 3663 } 3664 3665 if (myaddr == 0) { 3666 /* 3667 * I don't have an assigned address, so i need to 3668 * negotiate my address. 3669 */ 3670 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3671 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3672 } 3673 if (hisaddr == 1) { 3674 /* 3675 * XXX - remove this hack! 3676 * remote has no valid address, we need to get one assigned. 3677 */ 3678 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3679 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3680 } 3681 3682 if (sp->query_dns & 1) { 3683 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3684 } else { 3685 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3686 } 3687 3688 if (sp->query_dns & 2) { 3689 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3690 } else { 3691 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3692 } 3693 sppp_open_event(sp, xcp); 3694 } 3695 3696 static void 3697 sppp_ipcp_close(struct sppp *sp, void *xcp) 3698 { 3699 3700 KASSERT(SPPP_WLOCKED(sp)); 3701 KASSERT(!cpu_softintr_p()); 3702 3703 sppp_close_event(sp, xcp); 3704 3705 #ifdef INET 3706 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3707 /* 3708 * Some address was dynamic, clear it again. 3709 */ 3710 sppp_clear_ip_addrs(sp); 3711 } 3712 #endif 3713 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3714 } 3715 3716 /* 3717 * Analyze a configure request. Return true if it was agreeable, and 3718 * caused action sca, false if it has been rejected or nak'ed, and 3719 * caused action scn. (The return value is used to make the state 3720 * transition decision in the state automaton.) 3721 */ 3722 static enum cp_rcr_type 3723 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3724 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3725 { 3726 u_char *buf, *r, *p, l, blen; 3727 enum cp_rcr_type type; 3728 struct ifnet *ifp = &sp->pp_if; 3729 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 3730 uint32_t hisaddr, desiredaddr; 3731 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3732 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3733 const char *dq; 3734 3735 KASSERT(SPPP_WLOCKED(sp)); 3736 3737 type = CP_RCR_NONE; 3738 origlen -= sizeof(*h); 3739 3740 if (origlen < 0) 3741 return CP_RCR_DROP; 3742 3743 /* 3744 * Make sure to allocate a buf that can at least hold a 3745 * conf-nak with an `address' option. We might need it below. 3746 */ 3747 blen = MAX(6, origlen); 3748 3749 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3750 if (buf == NULL) 3751 return CP_RCR_DROP; 3752 3753 /* pass 1: see if we can recognize them */ 3754 if (debug) 3755 log(LOG_DEBUG, "%s: ipcp parse opts:", 3756 ifp->if_xname); 3757 p = (void *)(h + 1); 3758 r = buf; 3759 rlen = 0; 3760 for (len = origlen; len > 1; len -= l, p += l) { 3761 l = p[1]; 3762 if (l == 0) 3763 break; 3764 3765 /* Sanity check option length */ 3766 if (l > len) { 3767 /* XXX should we just RXJ? */ 3768 addlog("%s: malicious IPCP option received, dropping\n", 3769 ifp->if_xname); 3770 type = CP_RCR_ERR; 3771 goto end; 3772 } 3773 if (debug) { 3774 addlog(" %s", 3775 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3776 } 3777 switch (p[0]) { 3778 #ifdef notyet 3779 case IPCP_OPT_COMPRESSION: 3780 if (len >= 6 && l >= 6) { 3781 /* correctly formed compress option */ 3782 continue; 3783 } 3784 if (debug) 3785 addlog(" [invalid]"); 3786 break; 3787 #endif 3788 case IPCP_OPT_ADDRESS: 3789 if (len >= 6 && l == 6) { 3790 /* correctly formed address option */ 3791 continue; 3792 } 3793 if (debug) 3794 addlog(" [invalid]"); 3795 break; 3796 default: 3797 /* Others not supported. */ 3798 if (debug) 3799 addlog(" [rej]"); 3800 break; 3801 } 3802 /* Add the option to rejected list. */ 3803 if (rlen + l > blen) { 3804 if (debug) 3805 addlog(" [overflow]"); 3806 continue; 3807 } 3808 memcpy(r, p, l); 3809 r += l; 3810 rlen += l; 3811 } 3812 3813 if (rlen > 0) { 3814 type = CP_RCR_REJ; 3815 goto end; 3816 } 3817 3818 if (debug) 3819 addlog("\n"); 3820 3821 /* pass 2: parse option values */ 3822 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3823 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3824 else 3825 #ifdef INET 3826 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3827 #else 3828 hisaddr = 0; 3829 #endif 3830 if (debug) 3831 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 3832 ifp->if_xname); 3833 p = (void *)(h + 1); 3834 r = buf; 3835 rlen = 0; 3836 for (len = origlen; len > 1; len -= l, p += l) { 3837 l = p[1]; 3838 if (l == 0) 3839 break; 3840 3841 if (debug) { 3842 addlog(" %s", 3843 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3844 } 3845 switch (p[0]) { 3846 #ifdef notyet 3847 case IPCP_OPT_COMPRESSION: 3848 continue; 3849 #endif 3850 case IPCP_OPT_ADDRESS: 3851 desiredaddr = p[2] << 24 | p[3] << 16 | 3852 p[4] << 8 | p[5]; 3853 if (desiredaddr == hisaddr || 3854 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3855 /* 3856 * Peer's address is same as our value, 3857 * this is agreeable. Gonna conf-ack 3858 * it. 3859 */ 3860 if (debug) { 3861 dq = sppp_dotted_quad(dqbuf, 3862 sizeof(dqbuf), hisaddr); 3863 addlog(" %s [ack]", dq); 3864 } 3865 /* record that we've seen it already */ 3866 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3867 sp->ipcp.req_hisaddr = desiredaddr; 3868 hisaddr = desiredaddr; 3869 continue; 3870 } 3871 /* 3872 * The address wasn't agreeable. This is either 3873 * he sent us 0.0.0.0, asking to assign him an 3874 * address, or he send us another address not 3875 * matching our value. Either case, we gonna 3876 * conf-nak it with our value. 3877 */ 3878 if (debug) { 3879 if (desiredaddr == 0) { 3880 addlog(" [addr requested]"); 3881 } else { 3882 dq = sppp_dotted_quad(dqbuf, 3883 sizeof(dqbuf), desiredaddr); 3884 addlog(" %s [not agreed]", dq); 3885 } 3886 } 3887 3888 p[2] = hisaddr >> 24; 3889 p[3] = hisaddr >> 16; 3890 p[4] = hisaddr >> 8; 3891 p[5] = hisaddr; 3892 break; 3893 } 3894 if (rlen + l > blen) { 3895 if (debug) 3896 addlog(" [overflow]"); 3897 continue; 3898 } 3899 /* Add the option to nak'ed list. */ 3900 memcpy(r, p, l); 3901 r += l; 3902 rlen += l; 3903 } 3904 3905 if (rlen > 0) { 3906 type = CP_RCR_NAK; 3907 } else { 3908 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3909 /* 3910 * If we are about to conf-ack the request, but haven't seen 3911 * his address so far, gonna conf-nak it instead, with the 3912 * `address' option present and our idea of his address being 3913 * filled in there, to request negotiation of both addresses. 3914 * 3915 * XXX This can result in an endless req - nak loop if peer 3916 * doesn't want to send us his address. Q: What should we do 3917 * about it? XXX A: implement the max-failure counter. 3918 */ 3919 buf[0] = IPCP_OPT_ADDRESS; 3920 buf[1] = 6; 3921 buf[2] = hisaddr >> 24; 3922 buf[3] = hisaddr >> 16; 3923 buf[4] = hisaddr >> 8; 3924 buf[5] = hisaddr; 3925 rlen = 6; 3926 if (debug) 3927 addlog(" still need hisaddr"); 3928 type = CP_RCR_NAK; 3929 } else { 3930 type = CP_RCR_ACK; 3931 rlen = origlen; 3932 memcpy(r, h + 1, rlen); 3933 } 3934 } 3935 3936 end: 3937 if (debug) 3938 addlog("\n"); 3939 3940 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3941 if (buf != NULL) 3942 kmem_intr_free(buf, blen); 3943 } else { 3944 *msgbuf = buf; 3945 *buflen = blen; 3946 *msglen = rlen; 3947 } 3948 3949 return type; 3950 } 3951 3952 /* 3953 * Analyze the IPCP Configure-Reject option list, and adjust our 3954 * negotiation. 3955 */ 3956 static void 3957 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3958 { 3959 u_char *p, l; 3960 struct ifnet *ifp = &sp->pp_if; 3961 int debug = ifp->if_flags & IFF_DEBUG; 3962 3963 KASSERT(SPPP_WLOCKED(sp)); 3964 3965 if (len <= sizeof(*h)) 3966 return; 3967 3968 len -= sizeof(*h); 3969 3970 if (debug) 3971 log(LOG_DEBUG, "%s: ipcp rej opts:", 3972 ifp->if_xname); 3973 3974 p = (void *)(h + 1); 3975 for (; len > 1; len -= l, p += l) { 3976 l = p[1]; 3977 if (l == 0) 3978 break; 3979 3980 /* Sanity check option length */ 3981 if (l > len) { 3982 /* XXX should we just RXJ? */ 3983 addlog("%s: malicious IPCP option received, dropping\n", 3984 ifp->if_xname); 3985 goto end; 3986 } 3987 if (debug) { 3988 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3989 addlog(" %s", 3990 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3991 } 3992 switch (p[0]) { 3993 case IPCP_OPT_ADDRESS: 3994 /* 3995 * Peer doesn't grok address option. This is 3996 * bad. XXX Should we better give up here? 3997 */ 3998 if (!debug) { 3999 log(LOG_ERR, "%s: " 4000 "IPCP address option rejected\n", 4001 ifp->if_xname); 4002 } 4003 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 4004 break; 4005 #ifdef notyet 4006 case IPCP_OPT_COMPRESS: 4007 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 4008 break; 4009 #endif 4010 case IPCP_OPT_PRIMDNS: 4011 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 4012 break; 4013 4014 case IPCP_OPT_SECDNS: 4015 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 4016 break; 4017 } 4018 } 4019 if (debug) 4020 addlog("\n"); 4021 end: 4022 return; 4023 } 4024 4025 /* 4026 * Analyze the IPCP Configure-NAK option list, and adjust our 4027 * negotiation. 4028 */ 4029 static void 4030 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4031 { 4032 u_char *p, l; 4033 struct ifnet *ifp = &sp->pp_if; 4034 int debug = ifp->if_flags & IFF_DEBUG; 4035 uint32_t wantaddr; 4036 4037 KASSERT(SPPP_WLOCKED(sp)); 4038 4039 len -= sizeof(*h); 4040 4041 if (debug) 4042 log(LOG_DEBUG, "%s: ipcp nak opts:", 4043 ifp->if_xname); 4044 4045 p = (void *)(h + 1); 4046 for (; len > 1; len -= l, p += l) { 4047 l = p[1]; 4048 if (l == 0) 4049 break; 4050 4051 /* Sanity check option length */ 4052 if (l > len) { 4053 /* XXX should we just RXJ? */ 4054 addlog("%s: malicious IPCP option received, dropping\n", 4055 ifp->if_xname); 4056 return; 4057 } 4058 if (debug) { 4059 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 4060 addlog(" %s", 4061 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 4062 } 4063 switch (*p) { 4064 case IPCP_OPT_ADDRESS: 4065 /* 4066 * Peer doesn't like our local IP address. See 4067 * if we can do something for him. We'll drop 4068 * him our address then. 4069 */ 4070 if (len >= 6 && l == 6) { 4071 wantaddr = p[2] << 24 | p[3] << 16 | 4072 p[4] << 8 | p[5]; 4073 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 4074 if (debug) { 4075 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 4076 const char *dq; 4077 4078 dq = sppp_dotted_quad(dqbuf, 4079 sizeof(dqbuf), wantaddr); 4080 addlog(" [wantaddr %s]", dq); 4081 } 4082 /* 4083 * When doing dynamic address assignment, 4084 * we accept his offer. Otherwise, we 4085 * ignore it and thus continue to negotiate 4086 * our already existing value. 4087 */ 4088 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 4089 if (ntohl(wantaddr) != INADDR_ANY) { 4090 if (debug) 4091 addlog(" [agree]"); 4092 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 4093 sp->ipcp.req_myaddr = wantaddr; 4094 } else { 4095 if (debug) 4096 addlog(" [not agreed]"); 4097 } 4098 } 4099 } 4100 break; 4101 4102 case IPCP_OPT_PRIMDNS: 4103 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 4104 len >= 6 && l == 6) { 4105 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 4106 p[4] << 8 | p[5]; 4107 } 4108 break; 4109 4110 case IPCP_OPT_SECDNS: 4111 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 4112 len >= 6 && l == 6) { 4113 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 4114 p[4] << 8 | p[5]; 4115 } 4116 break; 4117 #ifdef notyet 4118 case IPCP_OPT_COMPRESS: 4119 /* 4120 * Peer wants different compression parameters. 4121 */ 4122 break; 4123 #endif 4124 } 4125 } 4126 if (debug) 4127 addlog("\n"); 4128 } 4129 4130 static void 4131 sppp_ipcp_tlu(struct sppp *sp) 4132 { 4133 #ifdef INET 4134 struct ifnet *ifp; 4135 4136 ifp = &sp->pp_if; 4137 KASSERT(SPPP_WLOCKED(sp)); 4138 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 4139 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 4140 log(LOG_WARNING, "%s: no IP address, closing IPCP\n", 4141 ifp->if_xname); 4142 sppp_wq_add(sp->wq_cp, 4143 &sp->scp[IDX_IPCP].work_close); 4144 } else { 4145 /* we are up. Set addresses and notify anyone interested */ 4146 sppp_set_ip_addrs(sp); 4147 } 4148 #endif 4149 } 4150 4151 static void 4152 sppp_ipcp_scr(struct sppp *sp) 4153 { 4154 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 4155 #ifdef INET 4156 uint32_t ouraddr; 4157 #endif 4158 int i = 0; 4159 4160 KASSERT(SPPP_WLOCKED(sp)); 4161 4162 #ifdef notyet 4163 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 4164 opt[i++] = IPCP_OPT_COMPRESSION; 4165 opt[i++] = 6; 4166 opt[i++] = 0; /* VJ header compression */ 4167 opt[i++] = 0x2d; /* VJ header compression */ 4168 opt[i++] = max_slot_id; 4169 opt[i++] = comp_slot_id; 4170 } 4171 #endif 4172 4173 #ifdef INET 4174 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 4175 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 4176 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 4177 } else { 4178 kpreempt_disable(); 4179 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 4180 kpreempt_enable(); 4181 } 4182 opt[i++] = IPCP_OPT_ADDRESS; 4183 opt[i++] = 6; 4184 opt[i++] = ouraddr >> 24; 4185 opt[i++] = ouraddr >> 16; 4186 opt[i++] = ouraddr >> 8; 4187 opt[i++] = ouraddr; 4188 } 4189 #endif 4190 4191 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 4192 opt[i++] = IPCP_OPT_PRIMDNS; 4193 opt[i++] = 6; 4194 opt[i++] = sp->dns_addrs[0] >> 24; 4195 opt[i++] = sp->dns_addrs[0] >> 16; 4196 opt[i++] = sp->dns_addrs[0] >> 8; 4197 opt[i++] = sp->dns_addrs[0]; 4198 } 4199 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 4200 opt[i++] = IPCP_OPT_SECDNS; 4201 opt[i++] = 6; 4202 opt[i++] = sp->dns_addrs[1] >> 24; 4203 opt[i++] = sp->dns_addrs[1] >> 16; 4204 opt[i++] = sp->dns_addrs[1] >> 8; 4205 opt[i++] = sp->dns_addrs[1]; 4206 } 4207 4208 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 4209 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 4210 } 4211 4212 /* 4213 *--------------------------------------------------------------------------* 4214 * * 4215 * The IPv6CP implementation. * 4216 * * 4217 *--------------------------------------------------------------------------* 4218 */ 4219 4220 #ifdef INET6 4221 static void 4222 sppp_ipv6cp_init(struct sppp *sp) 4223 { 4224 4225 KASSERT(SPPP_WLOCKED(sp)); 4226 4227 sppp_cp_init(&ipv6cp, sp); 4228 4229 sp->ipv6cp.opts = 0; 4230 sp->ipv6cp.flags = 0; 4231 } 4232 4233 static void 4234 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4235 { 4236 STDDCL; 4237 struct in6_addr myaddr, hisaddr; 4238 4239 KASSERT(SPPP_WLOCKED(sp)); 4240 KASSERT(!cpu_softintr_p()); 4241 4242 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4243 return; 4244 4245 #ifdef IPV6CP_MYIFID_DYN 4246 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4247 #else 4248 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4249 #endif 4250 4251 kpreempt_disable(); 4252 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4253 kpreempt_enable(); 4254 /* 4255 * If we don't have our address, this probably means our 4256 * interface doesn't want to talk IPv6 at all. (This could 4257 * be the case if somebody wants to speak only IPX, for 4258 * example.) Don't open IPv6CP in this case. 4259 */ 4260 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4261 /* XXX this message should go away */ 4262 if (debug) 4263 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 4264 ifp->if_xname); 4265 return; 4266 } 4267 4268 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4269 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4270 sppp_open_event(sp, xcp); 4271 } 4272 4273 /* 4274 * Analyze a configure request. Return true if it was agreeable, and 4275 * caused action sca, false if it has been rejected or nak'ed, and 4276 * caused action scn. (The return value is used to make the state 4277 * transition decision in the state automaton.) 4278 */ 4279 static enum cp_rcr_type 4280 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4281 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4282 { 4283 u_char *buf, *r, *p, l, blen; 4284 struct ifnet *ifp = &sp->pp_if; 4285 int rlen, len, debug = ifp->if_flags & IFF_DEBUG; 4286 struct in6_addr myaddr, desiredaddr, suggestaddr; 4287 enum cp_rcr_type type; 4288 int ifidcount; 4289 int collision, nohisaddr; 4290 char ip6buf[INET6_ADDRSTRLEN]; 4291 char tbuf[SPPP_CPTYPE_NAMELEN]; 4292 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4293 const char *cpname; 4294 4295 KASSERT(SPPP_WLOCKED(sp)); 4296 4297 type = CP_RCR_NONE; 4298 origlen -= sizeof(*h); 4299 4300 if (origlen < 0) 4301 return CP_RCR_DROP; 4302 4303 /* 4304 * Make sure to allocate a buf that can at least hold a 4305 * conf-nak with an `address' option. We might need it below. 4306 */ 4307 blen = MAX(6, origlen); 4308 4309 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4310 if (buf == NULL) 4311 return CP_RCR_DROP; 4312 4313 /* pass 1: see if we can recognize them */ 4314 if (debug) 4315 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 4316 ifp->if_xname); 4317 p = (void *)(h + 1); 4318 r = buf; 4319 rlen = 0; 4320 ifidcount = 0; 4321 for (len = origlen; len > 1; len -= l, p += l) { 4322 l = p[1]; 4323 if (l == 0) 4324 break; 4325 4326 /* Sanity check option length */ 4327 if (l > len) { 4328 /* XXX just RXJ? */ 4329 addlog("%s: received malicious IPCPv6 option, " 4330 "dropping\n", ifp->if_xname); 4331 type = CP_RCR_ERR; 4332 goto end; 4333 } 4334 if (debug) { 4335 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4336 sizeof(ipv6buf),*p)); 4337 } 4338 switch (p[0]) { 4339 case IPV6CP_OPT_IFID: 4340 if (len >= 10 && l == 10 && ifidcount == 0) { 4341 /* correctly formed address option */ 4342 ifidcount++; 4343 continue; 4344 } 4345 if (debug) 4346 addlog(" [invalid]"); 4347 break; 4348 #ifdef notyet 4349 case IPV6CP_OPT_COMPRESSION: 4350 if (len >= 4 && l >= 4) { 4351 /* correctly formed compress option */ 4352 continue; 4353 } 4354 if (debug) 4355 addlog(" [invalid]"); 4356 break; 4357 #endif 4358 default: 4359 /* Others not supported. */ 4360 if (debug) 4361 addlog(" [rej]"); 4362 break; 4363 } 4364 if (rlen + l > blen) { 4365 if (debug) 4366 addlog(" [overflow]"); 4367 continue; 4368 } 4369 /* Add the option to rejected list. */ 4370 memcpy(r, p, l); 4371 r += l; 4372 rlen += l; 4373 } 4374 4375 if (rlen > 0) { 4376 type = CP_RCR_REJ; 4377 goto end; 4378 } 4379 4380 if (debug) 4381 addlog("\n"); 4382 4383 /* pass 2: parse option values */ 4384 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4385 if (debug) 4386 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 4387 ifp->if_xname); 4388 p = (void *)(h + 1); 4389 r = buf; 4390 rlen = 0; 4391 type = CP_RCR_ACK; 4392 for (len = origlen; len > 1; len -= l, p += l) { 4393 l = p[1]; 4394 if (l == 0) 4395 break; 4396 4397 if (debug) { 4398 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4399 sizeof(ipv6buf), *p)); 4400 } 4401 switch (p[0]) { 4402 #ifdef notyet 4403 case IPV6CP_OPT_COMPRESSION: 4404 continue; 4405 #endif 4406 case IPV6CP_OPT_IFID: 4407 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4408 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4409 collision = (memcmp(&desiredaddr.s6_addr[8], 4410 &myaddr.s6_addr[8], 8) == 0); 4411 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4412 4413 desiredaddr.s6_addr16[0] = htons(0xfe80); 4414 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4415 4416 if (!collision && !nohisaddr) { 4417 /* no collision, hisaddr known - Conf-Ack */ 4418 type = CP_RCR_ACK; 4419 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4420 sizeof(sp->ipv6cp.my_ifid)); 4421 memcpy(sp->ipv6cp.his_ifid, 4422 &desiredaddr.s6_addr[8], 4423 sizeof(sp->ipv6cp.my_ifid)); 4424 4425 if (debug) { 4426 cpname = sppp_cp_type_name(tbuf, 4427 sizeof(tbuf), CONF_ACK); 4428 addlog(" %s [%s]", 4429 IN6_PRINT(ip6buf, &desiredaddr), 4430 cpname); 4431 } 4432 continue; 4433 } 4434 4435 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4436 if (collision && nohisaddr) { 4437 /* collision, hisaddr unknown - Conf-Rej */ 4438 type = CP_RCR_REJ; 4439 memset(&p[2], 0, 8); 4440 } else { 4441 /* 4442 * - no collision, hisaddr unknown, or 4443 * - collision, hisaddr known 4444 * Conf-Nak, suggest hisaddr 4445 */ 4446 type = CP_RCR_NAK; 4447 sppp_suggest_ip6_addr(sp, &suggestaddr); 4448 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4449 } 4450 if (debug) { 4451 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4452 4453 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4454 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4455 cpname); 4456 } 4457 break; 4458 } 4459 if (rlen + l > blen) { 4460 if (debug) 4461 addlog(" [overflow]"); 4462 continue; 4463 } 4464 /* Add the option to nak'ed list. */ 4465 memcpy(r, p, l); 4466 r += l; 4467 rlen += l; 4468 } 4469 4470 if (rlen > 0) { 4471 if (type != CP_RCR_ACK) { 4472 if (debug) { 4473 int ctype ; 4474 ctype = type == CP_RCR_REJ ? 4475 CONF_REJ : CONF_NAK; 4476 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4477 addlog(" send %s suggest %s\n", 4478 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4479 } 4480 } 4481 #ifdef notdef 4482 if (type == CP_RCR_ACK) 4483 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4484 #endif 4485 } else { 4486 if (type == CP_RCR_ACK) { 4487 rlen = origlen; 4488 memcpy(r, h + 1, rlen); 4489 } 4490 } 4491 end: 4492 if (debug) 4493 addlog("\n"); 4494 4495 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4496 if (buf != NULL) 4497 kmem_intr_free(buf, blen); 4498 } else { 4499 *msgbuf = buf; 4500 *buflen = blen; 4501 *msglen = rlen; 4502 } 4503 4504 return type; 4505 } 4506 4507 /* 4508 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4509 * negotiation. 4510 */ 4511 static void 4512 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4513 { 4514 u_char *p, l; 4515 struct ifnet *ifp = &sp->pp_if; 4516 int debug = ifp->if_flags & IFF_DEBUG; 4517 4518 KASSERT(SPPP_WLOCKED(sp)); 4519 4520 if (len <= sizeof(*h)) 4521 return; 4522 4523 len -= sizeof(*h); 4524 4525 if (debug) 4526 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 4527 ifp->if_xname); 4528 4529 p = (void *)(h + 1); 4530 for (; len > 1; len -= l, p += l) { 4531 l = p[1]; 4532 if (l == 0) 4533 break; 4534 4535 if (l > len) { 4536 /* XXX just RXJ? */ 4537 addlog("%s: received malicious IPCPv6 option, " 4538 "dropping\n", ifp->if_xname); 4539 goto end; 4540 } 4541 if (debug) { 4542 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4543 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4544 sizeof(ipv6buf), *p)); 4545 } 4546 switch (p[0]) { 4547 case IPV6CP_OPT_IFID: 4548 /* 4549 * Peer doesn't grok address option. This is 4550 * bad. XXX Should we better give up here? 4551 */ 4552 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4553 break; 4554 #ifdef notyet 4555 case IPV6CP_OPT_COMPRESS: 4556 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4557 break; 4558 #endif 4559 } 4560 } 4561 if (debug) 4562 addlog("\n"); 4563 end: 4564 return; 4565 } 4566 4567 /* 4568 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4569 * negotiation. 4570 */ 4571 static void 4572 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4573 { 4574 u_char *p, l; 4575 struct ifnet *ifp = &sp->pp_if; 4576 int debug = ifp->if_flags & IFF_DEBUG; 4577 struct in6_addr suggestaddr; 4578 char ip6buf[INET6_ADDRSTRLEN]; 4579 4580 KASSERT(SPPP_WLOCKED(sp)); 4581 4582 if (len <= sizeof(*h)) 4583 return; 4584 4585 len -= sizeof(*h); 4586 4587 if (debug) 4588 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 4589 ifp->if_xname); 4590 4591 p = (void *)(h + 1); 4592 for (; len > 1; len -= l, p += l) { 4593 l = p[1]; 4594 if (l == 0) 4595 break; 4596 4597 if (l > len) { 4598 /* XXX just RXJ? */ 4599 addlog("%s: received malicious IPCPv6 option, " 4600 "dropping\n", ifp->if_xname); 4601 goto end; 4602 } 4603 if (debug) { 4604 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4605 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4606 sizeof(ipv6buf), *p)); 4607 } 4608 switch (p[0]) { 4609 case IPV6CP_OPT_IFID: 4610 /* 4611 * Peer doesn't like our local ifid. See 4612 * if we can do something for him. We'll drop 4613 * him our address then. 4614 */ 4615 if (len < 10 || l != 10) 4616 break; 4617 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4618 suggestaddr.s6_addr16[0] = htons(0xfe80); 4619 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4620 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4621 4622 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4623 if (debug) 4624 addlog(" [suggestaddr %s]", 4625 IN6_PRINT(ip6buf, &suggestaddr)); 4626 #ifdef IPV6CP_MYIFID_DYN 4627 /* 4628 * When doing dynamic address assignment, 4629 * we accept his offer. 4630 */ 4631 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4632 struct in6_addr lastsuggest; 4633 /* 4634 * If <suggested myaddr from peer> equals to 4635 * <hisaddr we have suggested last time>, 4636 * we have a collision. generate new random 4637 * ifid. 4638 */ 4639 sppp_suggest_ip6_addr(&lastsuggest); 4640 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4641 lastsuggest)) { 4642 if (debug) 4643 addlog(" [random]"); 4644 sppp_gen_ip6_addr(sp, &suggestaddr); 4645 } 4646 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4647 if (debug) 4648 addlog(" [agree]"); 4649 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4650 } 4651 #else 4652 /* 4653 * Since we do not do dynamic address assignment, 4654 * we ignore it and thus continue to negotiate 4655 * our already existing value. This can possibly 4656 * go into infinite request-reject loop. 4657 * 4658 * This is not likely because we normally use 4659 * ifid based on MAC-address. 4660 * If you have no ethernet card on the node, too bad. 4661 * XXX should we use fail_counter? 4662 */ 4663 #endif 4664 break; 4665 #ifdef notyet 4666 case IPV6CP_OPT_COMPRESS: 4667 /* 4668 * Peer wants different compression parameters. 4669 */ 4670 break; 4671 #endif 4672 } 4673 } 4674 if (debug) 4675 addlog("\n"); 4676 end: 4677 return; 4678 } 4679 4680 static void 4681 sppp_ipv6cp_tlu(struct sppp *sp) 4682 { 4683 4684 KASSERT(SPPP_WLOCKED(sp)); 4685 /* we are up - notify isdn daemon */ 4686 sppp_notify_con_wlocked(sp); 4687 } 4688 4689 static void 4690 sppp_ipv6cp_scr(struct sppp *sp) 4691 { 4692 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4693 struct in6_addr ouraddr; 4694 int i = 0; 4695 4696 KASSERT(SPPP_WLOCKED(sp)); 4697 4698 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4699 kpreempt_disable(); 4700 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4701 kpreempt_enable(); 4702 4703 opt[i++] = IPV6CP_OPT_IFID; 4704 opt[i++] = 10; 4705 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4706 i += 8; 4707 } 4708 4709 #ifdef notyet 4710 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4711 opt[i++] = IPV6CP_OPT_COMPRESSION; 4712 opt[i++] = 4; 4713 opt[i++] = 0; /* TBD */ 4714 opt[i++] = 0; /* TBD */ 4715 /* variable length data may follow */ 4716 } 4717 #endif 4718 4719 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4720 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4721 } 4722 #else /*INET6*/ 4723 static void 4724 sppp_ipv6cp_init(struct sppp *sp) 4725 { 4726 4727 KASSERT(SPPP_WLOCKED(sp)); 4728 } 4729 4730 static void 4731 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4732 { 4733 4734 KASSERT(SPPP_WLOCKED(sp)); 4735 } 4736 4737 static enum cp_rcr_type 4738 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4739 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4740 { 4741 4742 KASSERT(SPPP_WLOCKED(sp)); 4743 return 0; 4744 } 4745 4746 static void 4747 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4748 int len) 4749 { 4750 4751 KASSERT(SPPP_WLOCKED(sp)); 4752 } 4753 4754 static void 4755 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4756 int len) 4757 { 4758 4759 KASSERT(SPPP_WLOCKED(sp)); 4760 } 4761 4762 static void 4763 sppp_ipv6cp_tlu(struct sppp *sp) 4764 { 4765 4766 KASSERT(SPPP_WLOCKED(sp)); 4767 } 4768 4769 static void 4770 sppp_ipv6cp_scr(struct sppp *sp) 4771 { 4772 4773 KASSERT(SPPP_WLOCKED(sp)); 4774 } 4775 #endif /*INET6*/ 4776 4777 /* 4778 *--------------------------------------------------------------------------* 4779 * * 4780 * The CHAP implementation. * 4781 * * 4782 *--------------------------------------------------------------------------* 4783 */ 4784 /* 4785 * The authentication protocols is implemented on the state machine for 4786 * control protocols. And it uses following actions and events. 4787 * 4788 * Actions: 4789 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4790 * - sca: send CHAP_SUCCESS 4791 * - scn: send CHAP_FAILURE and shutdown lcp 4792 * Events: 4793 * - RCR+: receive CHAP_RESPONSE containing correct digest 4794 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4795 * - RCA: receive CHAP_SUCCESS 4796 * - RCN: (this event is unused) 4797 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4798 * - TO-: this layer finish 4799 */ 4800 4801 /* 4802 * Handle incoming CHAP packets. 4803 */ 4804 void 4805 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4806 { 4807 STDDCL; 4808 struct lcp_header *h; 4809 int len, x; 4810 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4811 int value_len, name_len; 4812 MD5_CTX ctx; 4813 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4814 const char *authname; 4815 4816 len = m->m_pkthdr.len; 4817 if (len < 4) { 4818 if (debug) 4819 log(LOG_DEBUG, 4820 "%s: chap invalid packet length: %d bytes\n", 4821 ifp->if_xname, len); 4822 return; 4823 } 4824 h = mtod(m, struct lcp_header *); 4825 if (len > ntohs(h->len)) 4826 len = ntohs(h->len); 4827 4828 SPPP_LOCK(sp, RW_WRITER); 4829 4830 switch (h->type) { 4831 /* challenge, failure and success are his authproto */ 4832 case CHAP_CHALLENGE: 4833 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4834 /* can't do anything useful */ 4835 sp->pp_auth_failures++; 4836 printf("%s: chap input without my name and my secret being set\n", 4837 ifp->if_xname); 4838 break; 4839 } 4840 value = 1 + (u_char *)(h + 1); 4841 value_len = value[-1]; 4842 name = value + value_len; 4843 name_len = len - value_len - 5; 4844 if (name_len < 0) { 4845 if (debug) { 4846 authname = sppp_auth_type_name(abuf, 4847 sizeof(abuf), PPP_CHAP, h->type); 4848 log(LOG_DEBUG, 4849 "%s: chap corrupted challenge " 4850 "<%s id=0x%x len=%d", 4851 ifp->if_xname, authname, 4852 h->ident, ntohs(h->len)); 4853 if (len > 4) 4854 sppp_print_bytes((u_char *)(h + 1), 4855 len - 4); 4856 addlog(">\n"); 4857 } 4858 break; 4859 } 4860 4861 if (debug) { 4862 authname = sppp_auth_type_name(abuf, 4863 sizeof(abuf), PPP_CHAP, h->type); 4864 log(LOG_DEBUG, 4865 "%s: chap input <%s id=0x%x len=%d name=", 4866 ifp->if_xname, authname, h->ident, 4867 ntohs(h->len)); 4868 sppp_print_string((char *) name, name_len); 4869 addlog(" value-size=%d value=", value_len); 4870 sppp_print_bytes(value, value_len); 4871 addlog(">\n"); 4872 } 4873 4874 /* Compute reply value. */ 4875 MD5Init(&ctx); 4876 MD5Update(&ctx, &h->ident, 1); 4877 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4878 MD5Update(&ctx, value, value_len); 4879 MD5Final(sp->chap.digest, &ctx); 4880 sp->chap.digest_len = sizeof(sp->chap.digest); 4881 sp->scp[IDX_CHAP].rconfid = h->ident; 4882 4883 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4884 break; 4885 4886 case CHAP_SUCCESS: 4887 if (debug) { 4888 log(LOG_DEBUG, "%s: chap success", 4889 ifp->if_xname); 4890 if (len > 4) { 4891 addlog(": "); 4892 sppp_print_string((char *)(h + 1), len - 4); 4893 } 4894 addlog("\n"); 4895 } 4896 4897 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4898 if (debug) { 4899 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4900 ifp->if_xname, chap.name, 4901 h->ident, sp->scp[IDX_CHAP].rconfid); 4902 } 4903 if_statinc(ifp, if_ierrors); 4904 break; 4905 } 4906 4907 if (sp->chap.digest_len == 0) { 4908 if (debug) { 4909 log(LOG_DEBUG, 4910 "%s: receive CHAP success without challenge\n", 4911 ifp->if_xname); 4912 } 4913 if_statinc(ifp, if_ierrors); 4914 break; 4915 } 4916 4917 x = splnet(); 4918 sp->pp_auth_failures = 0; 4919 sp->pp_flags &= ~PP_NEEDAUTH; 4920 splx(x); 4921 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4922 sp->chap.digest_len = 0; 4923 4924 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4925 /* 4926 * we are not authenticator for CHAP, 4927 * generate a dummy RCR+ event without CHAP_RESPONSE 4928 */ 4929 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4930 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4931 } 4932 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4933 break; 4934 4935 case CHAP_FAILURE: 4936 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4937 if (debug) { 4938 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 4939 ifp->if_xname, chap.name, 4940 h->ident, sp->scp[IDX_CHAP].rconfid); 4941 } 4942 if_statinc(ifp, if_ierrors); 4943 break; 4944 } 4945 4946 if (sp->chap.digest_len == 0) { 4947 if (debug) { 4948 log(LOG_DEBUG, 4949 "%s: receive CHAP failure without challenge\n", 4950 ifp->if_xname); 4951 } 4952 if_statinc(ifp, if_ierrors); 4953 break; 4954 } 4955 4956 x = splnet(); 4957 sp->pp_auth_failures++; 4958 splx(x); 4959 if (debug) { 4960 log(LOG_INFO, "%s: chap failure", 4961 ifp->if_xname); 4962 if (len > 4) { 4963 addlog(": "); 4964 sppp_print_string((char *)(h + 1), len - 4); 4965 } 4966 addlog("\n"); 4967 } else 4968 log(LOG_INFO, "%s: chap failure\n", 4969 ifp->if_xname); 4970 4971 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4972 sp->chap.digest_len = 0; 4973 /* 4974 * await LCP shutdown by authenticator, 4975 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4976 */ 4977 break; 4978 4979 /* response is my authproto */ 4980 case CHAP_RESPONSE: 4981 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4982 /* can't do anything useful */ 4983 printf("%s: chap response" 4984 " without his name and his secret being set\n", 4985 ifp->if_xname); 4986 break; 4987 } 4988 value = 1 + (u_char *)(h + 1); 4989 value_len = value[-1]; 4990 name = value + value_len; 4991 name_len = len - value_len - 5; 4992 if (name_len < 0) { 4993 if (debug) { 4994 authname = sppp_auth_type_name(abuf, 4995 sizeof(abuf), PPP_CHAP, h->type); 4996 log(LOG_DEBUG, 4997 "%s: chap corrupted response " 4998 "<%s id=0x%x len=%d", 4999 ifp->if_xname, authname, 5000 h->ident, ntohs(h->len)); 5001 if (len > 4) 5002 sppp_print_bytes((u_char *)(h + 1), 5003 len - 4); 5004 addlog(">\n"); 5005 } 5006 break; 5007 } 5008 if (h->ident != sp->scp[IDX_CHAP].confid) { 5009 if (debug) 5010 log(LOG_DEBUG, 5011 "%s: chap dropping response for old ID " 5012 "(got %d, expected %d)\n", 5013 ifp->if_xname, 5014 h->ident, sp->scp[IDX_CHAP].confid); 5015 break; 5016 } else { 5017 sp->scp[IDX_CHAP].rconfid = h->ident; 5018 } 5019 5020 if (sp->hisauth.name != NULL && 5021 (name_len != sp->hisauth.name_len 5022 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 5023 log(LOG_INFO, "%s: chap response, his name ", 5024 ifp->if_xname); 5025 sppp_print_string(name, name_len); 5026 addlog(" != expected "); 5027 sppp_print_string(sp->hisauth.name, 5028 sp->hisauth.name_len); 5029 addlog("\n"); 5030 5031 /* generate RCR- event */ 5032 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 5033 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 5034 break; 5035 } 5036 5037 if (debug) { 5038 authname = sppp_auth_type_name(abuf, 5039 sizeof(abuf), PPP_CHAP, h->type); 5040 log(LOG_DEBUG, "%s: chap input(%s) " 5041 "<%s id=0x%x len=%d name=", 5042 ifp->if_xname, 5043 sppp_state_name(sp->scp[IDX_CHAP].state), 5044 authname, h->ident, ntohs(h->len)); 5045 sppp_print_string((char *)name, name_len); 5046 addlog(" value-size=%d value=", value_len); 5047 sppp_print_bytes(value, value_len); 5048 addlog(">\n"); 5049 } 5050 5051 if (value_len == sizeof(sp->chap.challenge) && 5052 value_len == sizeof(sp->chap.digest)) { 5053 MD5Init(&ctx); 5054 MD5Update(&ctx, &h->ident, 1); 5055 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 5056 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 5057 MD5Final(digest, &ctx); 5058 5059 if (memcmp(digest, value, value_len) == 0) { 5060 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 5061 } else { 5062 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 5063 } 5064 } else { 5065 if (debug) 5066 log(LOG_DEBUG, 5067 "%s: chap bad hash value length: " 5068 "%d bytes, should be %zu\n", 5069 ifp->if_xname, value_len, 5070 sizeof(sp->chap.challenge)); 5071 5072 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 5073 } 5074 5075 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 5076 5077 /* generate a dummy RCA event */ 5078 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 5079 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 5080 sp->chap.rechallenging)) { 5081 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 5082 } 5083 break; 5084 5085 default: 5086 /* Unknown CHAP packet type -- ignore. */ 5087 if (debug) { 5088 log(LOG_DEBUG, "%s: chap unknown input(%s) " 5089 "<0x%x id=0x%xh len=%d", 5090 ifp->if_xname, 5091 sppp_state_name(sp->scp[IDX_CHAP].state), 5092 h->type, h->ident, ntohs(h->len)); 5093 if (len > 4) 5094 sppp_print_bytes((u_char *)(h + 1), len - 4); 5095 addlog(">\n"); 5096 } 5097 break; 5098 5099 } 5100 5101 SPPP_UNLOCK(sp); 5102 } 5103 5104 static void 5105 sppp_chap_init(struct sppp *sp) 5106 { 5107 5108 KASSERT(SPPP_WLOCKED(sp)); 5109 5110 sppp_cp_init(&chap, sp); 5111 5112 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 5113 sppp_chap_rcv_challenge_event, &chap); 5114 } 5115 5116 static void 5117 sppp_chap_open(struct sppp *sp, void *xcp) 5118 { 5119 5120 KASSERT(SPPP_WLOCKED(sp)); 5121 5122 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 5123 sp->chap.digest_len = 0; 5124 sp->chap.rechallenging = false; 5125 sp->chap.response_rcvd = false; 5126 sppp_open_event(sp, xcp); 5127 } 5128 5129 static void 5130 sppp_chap_tlu(struct sppp *sp) 5131 { 5132 STDDCL; 5133 int i, x; 5134 5135 KASSERT(SPPP_WLOCKED(sp)); 5136 5137 i = 0; 5138 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 5139 x = splnet(); 5140 sp->pp_auth_failures = 0; 5141 splx(x); 5142 5143 log(LOG_DEBUG, "%s: chap %s", ifp->if_xname, 5144 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 5145 5146 /* 5147 * Some broken CHAP implementations (Conware CoNet, firmware 5148 * 4.0.?) don't want to re-authenticate their CHAP once the 5149 * initial challenge-response exchange has taken place. 5150 * Provide for an option to avoid rechallenges. 5151 */ 5152 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 5153 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5154 /* 5155 * Compute the re-challenge timeout. This will yield 5156 * a number between 300 and 810 seconds. 5157 */ 5158 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 5159 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 5160 5161 if (debug) { 5162 addlog(", next rechallenge in %d seconds", i); 5163 } 5164 } 5165 5166 addlog("\n"); 5167 5168 /* 5169 * If we are already in phase network, we are done here. This 5170 * is the case if this is a dummy tlu event after a re-challenge. 5171 */ 5172 if (sp->pp_phase != SPPP_PHASE_NETWORK) 5173 sppp_phase_network(sp); 5174 } 5175 5176 static void 5177 sppp_chap_scr(struct sppp *sp) 5178 { 5179 uint32_t *ch; 5180 u_char clen, dsize; 5181 int role; 5182 5183 KASSERT(SPPP_WLOCKED(sp)); 5184 5185 role = sppp_auth_role(&chap, sp); 5186 5187 if (ISSET(role, SPPP_AUTH_SERV) && 5188 !sp->chap.response_rcvd) { 5189 /* we are authenticator for CHAP, send challenge */ 5190 ch = (uint32_t *)sp->chap.challenge; 5191 clen = sizeof(sp->chap.challenge); 5192 /* Compute random challenge. */ 5193 cprng_strong(kern_cprng, ch, clen, 0); 5194 5195 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 5196 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 5197 sizeof(clen), (const char *)&clen, 5198 sizeof(sp->chap.challenge), sp->chap.challenge, 5199 0); 5200 } 5201 5202 if (ISSET(role, SPPP_AUTH_PEER) && 5203 sp->chap.digest_len > 0) { 5204 /* we are peer for CHAP, send response */ 5205 dsize = sp->chap.digest_len; 5206 5207 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 5208 sizeof(dsize), (const char *)&dsize, 5209 sp->chap.digest_len, sp->chap.digest, 5210 sp->myauth.name_len, sp->myauth.name, 0); 5211 } 5212 } 5213 5214 static void 5215 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5216 { 5217 const struct cp *cp = xcp; 5218 5219 KASSERT(!cpu_softintr_p()); 5220 5221 sp->chap.rechallenging = false; 5222 5223 switch (sp->scp[IDX_CHAP].state) { 5224 case STATE_REQ_SENT: 5225 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5226 cp->scr(sp); 5227 break; 5228 case STATE_OPENED: 5229 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5230 cp->scr(sp); 5231 break; 5232 } 5233 } 5234 5235 /* 5236 *--------------------------------------------------------------------------* 5237 * * 5238 * The PAP implementation. * 5239 * * 5240 *--------------------------------------------------------------------------* 5241 */ 5242 /* 5243 * PAP uses following actions and events. 5244 * Actions: 5245 * - scr: send PAP_REQ 5246 * - sca: send PAP_ACK 5247 * - scn: send PAP_NAK 5248 * Events: 5249 * - RCR+: receive PAP_REQ containing correct username and password 5250 * - RCR-: receive PAP_REQ containing wrong username and password 5251 * - RCA: receive PAP_ACK 5252 * - RCN: (this event is unused) 5253 * - TO+: re-send PAP_REQ 5254 * - TO-: this layer finish 5255 */ 5256 5257 /* 5258 * Handle incoming PAP packets. */ 5259 static void 5260 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5261 { 5262 STDDCL; 5263 struct lcp_header *h; 5264 int len, x; 5265 char *name, *secret; 5266 int name_len, secret_len; 5267 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5268 const char *authname; 5269 5270 /* 5271 * Malicious input might leave this uninitialized, so 5272 * init to an impossible value. 5273 */ 5274 secret_len = -1; 5275 5276 len = m->m_pkthdr.len; 5277 if (len < 5) { 5278 if (debug) 5279 log(LOG_DEBUG, 5280 "%s: pap invalid packet length: %d bytes\n", 5281 ifp->if_xname, len); 5282 return; 5283 } 5284 h = mtod(m, struct lcp_header *); 5285 if (len > ntohs(h->len)) 5286 len = ntohs(h->len); 5287 5288 SPPP_LOCK(sp, RW_WRITER); 5289 5290 switch (h->type) { 5291 /* PAP request is my authproto */ 5292 case PAP_REQ: 5293 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5294 /* can't do anything useful */ 5295 printf("%s: pap request" 5296 " without his name and his secret being set\n", 5297 ifp->if_xname); 5298 break; 5299 } 5300 name = 1 + (u_char *)(h + 1); 5301 name_len = name[-1]; 5302 secret = name + name_len + 1; 5303 if (name_len > len - 6 || 5304 (secret_len = secret[-1]) > len - 6 - name_len) { 5305 if (debug) { 5306 authname = sppp_auth_type_name(abuf, 5307 sizeof(abuf), PPP_PAP, h->type); 5308 log(LOG_DEBUG, "%s: pap corrupted input " 5309 "<%s id=0x%x len=%d", 5310 ifp->if_xname, authname, 5311 h->ident, ntohs(h->len)); 5312 if (len > 4) 5313 sppp_print_bytes((u_char *)(h + 1), 5314 len - 4); 5315 addlog(">\n"); 5316 } 5317 break; 5318 } 5319 if (debug) { 5320 authname = sppp_auth_type_name(abuf, 5321 sizeof(abuf), PPP_PAP, h->type); 5322 log(LOG_DEBUG, "%s: pap input(%s) " 5323 "<%s id=0x%x len=%d name=", 5324 ifp->if_xname, 5325 sppp_state_name(sp->scp[IDX_PAP].state), 5326 authname, h->ident, ntohs(h->len)); 5327 sppp_print_string((char *)name, name_len); 5328 addlog(" secret="); 5329 sppp_print_string((char *)secret, secret_len); 5330 addlog(">\n"); 5331 } 5332 5333 sp->scp[IDX_PAP].rconfid = h->ident; 5334 5335 if (name_len == sp->hisauth.name_len && 5336 memcmp(name, sp->hisauth.name, name_len) == 0 && 5337 secret_len == sp->hisauth.secret_len && 5338 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5339 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5340 } else { 5341 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5342 } 5343 5344 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5345 5346 /* generate a dummy RCA event */ 5347 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5348 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5349 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5350 } 5351 break; 5352 5353 /* ack and nak are his authproto */ 5354 case PAP_ACK: 5355 if (debug) { 5356 log(LOG_DEBUG, "%s: pap success", 5357 ifp->if_xname); 5358 name = 1 + (u_char *)(h + 1); 5359 name_len = name[-1]; 5360 if (len > 5 && name_len < len+4) { 5361 addlog(": "); 5362 sppp_print_string(name, name_len); 5363 } 5364 addlog("\n"); 5365 } 5366 5367 if (h->ident != sp->scp[IDX_PAP].confid) { 5368 if (debug) { 5369 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5370 ifp->if_xname, pap.name, 5371 h->ident, sp->scp[IDX_PAP].rconfid); 5372 } 5373 if_statinc(ifp, if_ierrors); 5374 break; 5375 } 5376 5377 x = splnet(); 5378 sp->pp_auth_failures = 0; 5379 sp->pp_flags &= ~PP_NEEDAUTH; 5380 splx(x); 5381 5382 /* we are not authenticator, generate a dummy RCR+ event */ 5383 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5384 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5385 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5386 } 5387 5388 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5389 break; 5390 5391 case PAP_NAK: 5392 if (debug) { 5393 log(LOG_INFO, "%s: pap failure", 5394 ifp->if_xname); 5395 name = 1 + (u_char *)(h + 1); 5396 name_len = name[-1]; 5397 if (len > 5 && name_len < len+4) { 5398 addlog(": "); 5399 sppp_print_string(name, name_len); 5400 } 5401 addlog("\n"); 5402 } else 5403 log(LOG_INFO, "%s: pap failure\n", 5404 ifp->if_xname); 5405 5406 if (h->ident != sp->scp[IDX_PAP].confid) { 5407 if (debug) { 5408 log(LOG_DEBUG, "%s: %s id mismatch 0x%x != 0x%x\n", 5409 ifp->if_xname, pap.name, 5410 h->ident, sp->scp[IDX_PAP].rconfid); 5411 } 5412 if_statinc(ifp, if_ierrors); 5413 break; 5414 } 5415 5416 sp->pp_auth_failures++; 5417 /* 5418 * await LCP shutdown by authenticator, 5419 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5420 */ 5421 break; 5422 5423 default: 5424 /* Unknown PAP packet type -- ignore. */ 5425 if (debug) { 5426 log(LOG_DEBUG, "%s: pap corrupted input " 5427 "<0x%x id=0x%x len=%d", 5428 ifp->if_xname, 5429 h->type, h->ident, ntohs(h->len)); 5430 if (len > 4) 5431 sppp_print_bytes((u_char *)(h + 1), len - 4); 5432 addlog(">\n"); 5433 } 5434 break; 5435 } 5436 5437 SPPP_UNLOCK(sp); 5438 } 5439 5440 static void 5441 sppp_pap_init(struct sppp *sp) 5442 { 5443 5444 KASSERT(SPPP_WLOCKED(sp)); 5445 sppp_cp_init(&pap, sp); 5446 } 5447 5448 static void 5449 sppp_pap_tlu(struct sppp *sp) 5450 { 5451 STDDCL; 5452 int x; 5453 5454 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5455 5456 if (debug) 5457 log(LOG_DEBUG, "%s: %s tlu\n", 5458 ifp->if_xname, pap.name); 5459 5460 x = splnet(); 5461 sp->pp_auth_failures = 0; 5462 splx(x); 5463 5464 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5465 sppp_phase_network(sp); 5466 } 5467 5468 static void 5469 sppp_pap_scr(struct sppp *sp) 5470 { 5471 u_char idlen, pwdlen; 5472 5473 KASSERT(SPPP_WLOCKED(sp)); 5474 5475 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5476 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5477 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 5478 log(LOG_DEBUG, "%s: couldn't send PAP_REQ " 5479 "because of no name or no secret\n", 5480 sp->pp_if.if_xname); 5481 } else { 5482 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5483 pwdlen = sp->myauth.secret_len; 5484 idlen = sp->myauth.name_len; 5485 5486 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5487 sizeof idlen, (const char *)&idlen, 5488 idlen, sp->myauth.name, 5489 sizeof pwdlen, (const char *)&pwdlen, 5490 pwdlen, sp->myauth.secret, 5491 0); 5492 } 5493 } 5494 } 5495 5496 /* 5497 * Random miscellaneous functions. 5498 */ 5499 5500 /* 5501 * Send a PAP or CHAP proto packet. 5502 * 5503 * Varadic function, each of the elements for the ellipsis is of type 5504 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5505 * mlen == 0. 5506 * NOTE: never declare variadic functions with types subject to type 5507 * promotion (i.e. u_char). This is asking for big trouble depending 5508 * on the architecture you are on... 5509 */ 5510 5511 static void 5512 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5513 unsigned int type, unsigned int id, 5514 ...) 5515 { 5516 STDDCL; 5517 struct lcp_header *lh; 5518 struct mbuf *m; 5519 u_char *p; 5520 int len; 5521 size_t pkthdrlen; 5522 unsigned int mlen; 5523 const char *msg; 5524 va_list ap; 5525 5526 KASSERT(SPPP_WLOCKED(sp)); 5527 5528 MGETHDR(m, M_DONTWAIT, MT_DATA); 5529 if (! m) 5530 return; 5531 m_reset_rcvif(m); 5532 5533 if (sp->pp_flags & PP_NOFRAMING) { 5534 *mtod(m, uint16_t *) = htons(cp->proto); 5535 pkthdrlen = 2; 5536 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5537 } else { 5538 struct ppp_header *h; 5539 h = mtod(m, struct ppp_header *); 5540 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5541 h->control = PPP_UI; /* Unnumbered Info */ 5542 h->protocol = htons(cp->proto); 5543 pkthdrlen = PPP_HEADER_LEN; 5544 5545 lh = (struct lcp_header *)(h + 1); 5546 } 5547 5548 lh->type = type; 5549 lh->ident = id; 5550 p = (u_char *)(lh + 1); 5551 5552 va_start(ap, id); 5553 len = 0; 5554 5555 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5556 msg = va_arg(ap, const char *); 5557 len += mlen; 5558 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5559 va_end(ap); 5560 m_freem(m); 5561 return; 5562 } 5563 5564 memcpy(p, msg, mlen); 5565 p += mlen; 5566 } 5567 va_end(ap); 5568 5569 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5570 lh->len = htons(LCP_HEADER_LEN + len); 5571 5572 if (debug) { 5573 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5574 const char *authname; 5575 5576 authname = sppp_auth_type_name(abuf, 5577 sizeof(abuf), cp->proto, lh->type); 5578 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 5579 ifp->if_xname, cp->name, authname, 5580 lh->ident, ntohs(lh->len)); 5581 if (len) 5582 sppp_print_bytes((u_char *)(lh + 1), len); 5583 addlog(">\n"); 5584 } 5585 if (IF_QFULL(&sp->pp_cpq)) { 5586 IF_DROP(&sp->pp_fastq); 5587 IF_DROP(&ifp->if_snd); 5588 m_freem(m); 5589 if_statinc(ifp, if_oerrors); 5590 return; 5591 } 5592 5593 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5594 IF_ENQUEUE(&sp->pp_cpq, m); 5595 5596 if (! (ifp->if_flags & IFF_OACTIVE)) { 5597 SPPP_UNLOCK(sp); 5598 if_start_lock(ifp); 5599 SPPP_LOCK(sp, RW_WRITER); 5600 } 5601 } 5602 5603 static int 5604 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5605 { 5606 int role; 5607 5608 role = SPPP_AUTH_NOROLE; 5609 5610 if (sp->hisauth.proto == cp->proto && 5611 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5612 SET(role, SPPP_AUTH_SERV); 5613 5614 if (sp->myauth.proto == cp->proto) 5615 SET(role, SPPP_AUTH_PEER); 5616 5617 return role; 5618 } 5619 5620 static void 5621 sppp_auth_to_event(struct sppp *sp, void *xcp) 5622 { 5623 const struct cp *cp = xcp; 5624 bool override; 5625 int state; 5626 STDDCL; 5627 5628 KASSERT(SPPP_WLOCKED(sp)); 5629 KASSERT(!cpu_softintr_p()); 5630 5631 override = false; 5632 state = sp->scp[cp->protoidx].state; 5633 5634 if (sp->scp[cp->protoidx].rst_counter > 0) { 5635 /* override TO+ event */ 5636 switch (state) { 5637 case STATE_OPENED: 5638 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5639 override = true; 5640 sp->chap.rechallenging = true; 5641 sp->chap.response_rcvd = false; 5642 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5643 cp->scr(sp); 5644 } 5645 break; 5646 5647 case STATE_ACK_RCVD: 5648 override = true; 5649 cp->scr(sp); 5650 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5651 break; 5652 } 5653 } 5654 5655 if (override) { 5656 if (debug) 5657 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 5658 ifp->if_xname, cp->name, 5659 sppp_state_name(state), 5660 sp->scp[cp->protoidx].rst_counter); 5661 sp->scp[cp->protoidx].rst_counter--; 5662 } else { 5663 sppp_to_event(sp, xcp); 5664 } 5665 } 5666 5667 static void 5668 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5669 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5670 { 5671 static const char *succmsg = "Welcome!"; 5672 static const char *failmsg = "Failed..."; 5673 const char *msg; 5674 u_char type, mlen; 5675 5676 KASSERT(SPPP_WLOCKED(sp)); 5677 5678 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5679 return; 5680 5681 if (ctype == CONF_ACK) { 5682 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5683 msg = succmsg; 5684 mlen = sizeof(succmsg) - 1; 5685 5686 sp->pp_auth_failures = 0; 5687 } else { 5688 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5689 msg = failmsg; 5690 mlen = sizeof(failmsg) - 1; 5691 5692 /* shutdown LCP if auth failed */ 5693 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5694 sp->pp_auth_failures++; 5695 } 5696 5697 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5698 } 5699 5700 /* 5701 * Send keepalive packets, every 10 seconds. 5702 */ 5703 static void 5704 sppp_keepalive(void *dummy) 5705 { 5706 struct sppp *sp; 5707 int s; 5708 time_t now; 5709 5710 SPPPQ_LOCK(); 5711 5712 s = splnet(); 5713 now = time_uptime; 5714 for (sp=spppq; sp; sp=sp->pp_next) { 5715 struct ifnet *ifp = NULL; 5716 5717 SPPP_LOCK(sp, RW_WRITER); 5718 ifp = &sp->pp_if; 5719 5720 /* check idle timeout */ 5721 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5722 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5723 /* idle timeout is enabled for this interface */ 5724 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5725 if (ifp->if_flags & IFF_DEBUG) 5726 printf("%s: no activity for %lu seconds\n", 5727 sp->pp_if.if_xname, 5728 (unsigned long)(now-sp->pp_last_activity)); 5729 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5730 SPPP_UNLOCK(sp); 5731 continue; 5732 } 5733 } 5734 5735 /* Keepalive mode disabled or channel down? */ 5736 if (! (sp->pp_flags & PP_KEEPALIVE) || 5737 ! (ifp->if_flags & IFF_RUNNING)) { 5738 SPPP_UNLOCK(sp); 5739 continue; 5740 } 5741 5742 /* No keepalive in PPP mode if LCP not opened yet. */ 5743 if (! (sp->pp_flags & PP_CISCO) && 5744 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5745 SPPP_UNLOCK(sp); 5746 continue; 5747 } 5748 5749 /* No echo reply, but maybe user data passed through? */ 5750 if (sp->pp_max_noreceive != 0 && 5751 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5752 sp->pp_alivecnt = 0; 5753 SPPP_UNLOCK(sp); 5754 continue; 5755 } 5756 5757 /* No echo request */ 5758 if (sp->pp_alive_interval == 0) { 5759 SPPP_UNLOCK(sp); 5760 continue; 5761 } 5762 5763 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5764 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5765 SPPP_UNLOCK(sp); 5766 continue; 5767 } 5768 5769 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5770 /* No keepalive packets got. Stop the interface. */ 5771 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5772 5773 if (! (sp->pp_flags & PP_CISCO)) { 5774 printf("%s: LCP keepalive timed out, going to restart the connection\n", 5775 ifp->if_xname); 5776 sp->pp_alivecnt = 0; 5777 5778 /* we are down, close all open protocols */ 5779 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5780 5781 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5782 sp->lcp.reestablish = true; 5783 5784 SPPP_UNLOCK(sp); 5785 continue; 5786 } 5787 } 5788 if (sp->pp_alivecnt < sp->pp_maxalive) 5789 ++sp->pp_alivecnt; 5790 if (sp->pp_flags & PP_CISCO) 5791 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 5792 ++sp->scp[IDX_LCP].seq, sp->scp[IDX_LCP].rseq); 5793 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5794 int32_t nmagic = htonl(sp->lcp.magic); 5795 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5796 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5797 sp->lcp.echoid, 4, &nmagic); 5798 } 5799 5800 SPPP_UNLOCK(sp); 5801 } 5802 splx(s); 5803 sppp_keepalive_cnt++; 5804 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5805 5806 SPPPQ_UNLOCK(); 5807 } 5808 5809 #ifdef INET 5810 /* 5811 * Get both IP addresses. 5812 */ 5813 static void 5814 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5815 { 5816 struct ifnet *ifp = &sp->pp_if; 5817 struct ifaddr *ifa; 5818 struct sockaddr_in *si, *sm; 5819 uint32_t ssrc, ddst; 5820 int s; 5821 struct psref psref; 5822 5823 sm = NULL; 5824 ssrc = ddst = 0; 5825 /* 5826 * Pick the first AF_INET address from the list, 5827 * aliases don't make any sense on a p2p link anyway. 5828 */ 5829 si = 0; 5830 s = pserialize_read_enter(); 5831 IFADDR_READER_FOREACH(ifa, ifp) { 5832 if (ifa->ifa_addr->sa_family == AF_INET) { 5833 si = (struct sockaddr_in *)ifa->ifa_addr; 5834 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5835 if (si) { 5836 ifa_acquire(ifa, &psref); 5837 break; 5838 } 5839 } 5840 } 5841 pserialize_read_exit(s); 5842 if (ifa) { 5843 if (si && si->sin_addr.s_addr) { 5844 ssrc = si->sin_addr.s_addr; 5845 if (srcmask) 5846 *srcmask = ntohl(sm->sin_addr.s_addr); 5847 } 5848 5849 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5850 if (si && si->sin_addr.s_addr) 5851 ddst = si->sin_addr.s_addr; 5852 ifa_release(ifa, &psref); 5853 } 5854 5855 if (dst) *dst = ntohl(ddst); 5856 if (src) *src = ntohl(ssrc); 5857 } 5858 5859 /* 5860 * Set IP addresses. Must be called at splnet. 5861 * If an address is 0, leave it the way it is. 5862 */ 5863 static void 5864 sppp_set_ip_addrs(struct sppp *sp) 5865 { 5866 STDDCL; 5867 struct ifaddr *ifa; 5868 struct sockaddr_in *si, *dest; 5869 uint32_t myaddr = 0, hisaddr = 0; 5870 int s; 5871 5872 KASSERT(SPPP_WLOCKED(sp)); 5873 SPPP_UNLOCK(sp); 5874 IFNET_LOCK(ifp); 5875 SPPP_LOCK(sp, RW_WRITER); 5876 5877 /* 5878 * Pick the first AF_INET address from the list, 5879 * aliases don't make any sense on a p2p link anyway. 5880 */ 5881 si = dest = NULL; 5882 s = pserialize_read_enter(); 5883 IFADDR_READER_FOREACH(ifa, ifp) { 5884 if (ifa->ifa_addr->sa_family == AF_INET) { 5885 si = (struct sockaddr_in *)ifa->ifa_addr; 5886 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5887 break; 5888 } 5889 } 5890 pserialize_read_exit(s); 5891 5892 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5893 myaddr = sp->ipcp.req_myaddr; 5894 else if (si != NULL) 5895 myaddr = ntohl(si->sin_addr.s_addr); 5896 5897 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5898 hisaddr = sp->ipcp.req_hisaddr; 5899 else if (dest != NULL) 5900 hisaddr = ntohl(dest->sin_addr.s_addr); 5901 5902 if (si != NULL && dest != NULL) { 5903 int error; 5904 struct sockaddr_in new_sin = *si; 5905 struct sockaddr_in new_dst = *dest; 5906 5907 if (myaddr != 0) 5908 new_sin.sin_addr.s_addr = htonl(myaddr); 5909 if (hisaddr != 0) { 5910 new_dst.sin_addr.s_addr = htonl(hisaddr); 5911 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5912 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5913 } 5914 5915 in_addrhash_remove(ifatoia(ifa)); 5916 5917 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5918 5919 in_addrhash_insert(ifatoia(ifa)); 5920 5921 if (debug && error) 5922 { 5923 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5924 ifp->if_xname, __func__, error); 5925 } 5926 if (!error) { 5927 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5928 } 5929 } 5930 5931 IFNET_UNLOCK(ifp); 5932 5933 sppp_notify_con(sp); 5934 } 5935 5936 /* 5937 * Clear IP addresses. Must be called at splnet. 5938 */ 5939 static void 5940 sppp_clear_ip_addrs(struct sppp *sp) 5941 { 5942 STDDCL; 5943 struct ifaddr *ifa; 5944 struct sockaddr_in *si, *dest; 5945 int s; 5946 5947 KASSERT(SPPP_WLOCKED(sp)); 5948 SPPP_UNLOCK(sp); 5949 IFNET_LOCK(ifp); 5950 SPPP_LOCK(sp, RW_WRITER); 5951 5952 /* 5953 * Pick the first AF_INET address from the list, 5954 * aliases don't make any sense on a p2p link anyway. 5955 */ 5956 si = dest = NULL; 5957 s = pserialize_read_enter(); 5958 IFADDR_READER_FOREACH(ifa, ifp) { 5959 if (ifa->ifa_addr->sa_family == AF_INET) { 5960 si = (struct sockaddr_in *)ifa->ifa_addr; 5961 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5962 break; 5963 } 5964 } 5965 pserialize_read_exit(s); 5966 5967 if (si != NULL) { 5968 struct sockaddr_in new_sin = *si; 5969 struct sockaddr_in new_dst = *dest; 5970 int error; 5971 5972 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5973 new_sin.sin_addr.s_addr = 0; 5974 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5975 ntohl(sp->ipcp.saved_hisaddr) != 0) 5976 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5977 5978 in_addrhash_remove(ifatoia(ifa)); 5979 5980 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5981 5982 in_addrhash_insert(ifatoia(ifa)); 5983 5984 if (debug && error) 5985 { 5986 log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n", 5987 ifp->if_xname, __func__, error); 5988 } 5989 if (!error) { 5990 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5991 } 5992 } 5993 5994 IFNET_UNLOCK(ifp); 5995 } 5996 #endif 5997 5998 #ifdef INET6 5999 /* 6000 * Get both IPv6 addresses. 6001 */ 6002 static void 6003 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 6004 struct in6_addr *srcmask) 6005 { 6006 struct ifnet *ifp = &sp->pp_if; 6007 struct ifaddr *ifa; 6008 struct sockaddr_in6 *si, *sm; 6009 struct in6_addr ssrc, ddst; 6010 int s; 6011 struct psref psref; 6012 6013 sm = NULL; 6014 memset(&ssrc, 0, sizeof(ssrc)); 6015 memset(&ddst, 0, sizeof(ddst)); 6016 /* 6017 * Pick the first link-local AF_INET6 address from the list, 6018 * aliases don't make any sense on a p2p link anyway. 6019 */ 6020 si = 0; 6021 s = pserialize_read_enter(); 6022 IFADDR_READER_FOREACH(ifa, ifp) { 6023 if (ifa->ifa_addr->sa_family == AF_INET6) { 6024 si = (struct sockaddr_in6 *)ifa->ifa_addr; 6025 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 6026 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 6027 ifa_acquire(ifa, &psref); 6028 break; 6029 } 6030 } 6031 } 6032 pserialize_read_exit(s); 6033 6034 if (ifa) { 6035 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 6036 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 6037 if (srcmask) { 6038 memcpy(srcmask, &sm->sin6_addr, 6039 sizeof(*srcmask)); 6040 } 6041 } 6042 6043 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 6044 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 6045 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 6046 ifa_release(ifa, &psref); 6047 } 6048 6049 if (dst) 6050 memcpy(dst, &ddst, sizeof(*dst)); 6051 if (src) 6052 memcpy(src, &ssrc, sizeof(*src)); 6053 } 6054 6055 #ifdef IPV6CP_MYIFID_DYN 6056 /* 6057 * Generate random ifid. 6058 */ 6059 static void 6060 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 6061 { 6062 /* TBD */ 6063 } 6064 6065 /* 6066 * Set my IPv6 address. Must be called at splnet. 6067 */ 6068 static void 6069 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 6070 { 6071 STDDCL; 6072 struct ifaddr *ifa; 6073 struct sockaddr_in6 *sin6; 6074 int s; 6075 struct psref psref; 6076 6077 KASSERT(SPPP_WLOCKED(sp)); 6078 SPPP_UNLOCK(sp); 6079 IFNET_LOCK(ifp); 6080 SPPP_LOCK(sp, RW_WRITER); 6081 6082 /* 6083 * Pick the first link-local AF_INET6 address from the list, 6084 * aliases don't make any sense on a p2p link anyway. 6085 */ 6086 6087 sin6 = NULL; 6088 s = pserialize_read_enter(); 6089 IFADDR_READER_FOREACH(ifa, ifp) 6090 { 6091 if (ifa->ifa_addr->sa_family == AF_INET6) 6092 { 6093 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 6094 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 6095 ifa_acquire(ifa, &psref); 6096 break; 6097 } 6098 } 6099 } 6100 pserialize_read_exit(s); 6101 6102 if (ifa && sin6) 6103 { 6104 int error; 6105 struct sockaddr_in6 new_sin6 = *sin6; 6106 6107 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 6108 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 6109 if (debug && error) 6110 { 6111 log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n", 6112 ifp->if_xname, __func__, error); 6113 } 6114 if (!error) { 6115 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 6116 } 6117 ifa_release(ifa, &psref); 6118 } 6119 6120 IFNET_UNLOCK(ifp); 6121 } 6122 #endif 6123 6124 /* 6125 * Suggest a candidate address to be used by peer. 6126 */ 6127 static void 6128 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 6129 { 6130 struct in6_addr myaddr; 6131 struct timeval tv; 6132 6133 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 6134 6135 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 6136 microtime(&tv); 6137 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 6138 myaddr.s6_addr[14] ^= 0xff; 6139 myaddr.s6_addr[15] ^= 0xff; 6140 } else { 6141 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 6142 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 6143 } 6144 if (suggest) 6145 memcpy(suggest, &myaddr, sizeof(myaddr)); 6146 } 6147 #endif /*INET6*/ 6148 6149 /* 6150 * Process ioctl requests specific to the PPP interface. 6151 * Permissions have already been checked. 6152 */ 6153 static int 6154 sppp_params(struct sppp *sp, u_long cmd, void *data) 6155 { 6156 switch (cmd) { 6157 case SPPPGETAUTHCFG: 6158 { 6159 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6160 int error; 6161 size_t len; 6162 6163 SPPP_LOCK(sp, RW_READER); 6164 6165 cfg->myauthflags = sp->myauth.flags; 6166 cfg->hisauthflags = sp->hisauth.flags; 6167 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 6168 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 6169 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 6170 if (cfg->myname_length == 0) { 6171 if (sp->myauth.name != NULL) 6172 cfg->myname_length = sp->myauth.name_len + 1; 6173 } else { 6174 if (sp->myauth.name == NULL) { 6175 cfg->myname_length = 0; 6176 } else { 6177 len = sp->myauth.name_len + 1; 6178 6179 if (cfg->myname_length < len) { 6180 SPPP_UNLOCK(sp); 6181 return (ENAMETOOLONG); 6182 } 6183 error = copyout(sp->myauth.name, cfg->myname, len); 6184 if (error) { 6185 SPPP_UNLOCK(sp); 6186 return error; 6187 } 6188 } 6189 } 6190 if (cfg->hisname_length == 0) { 6191 if (sp->hisauth.name != NULL) 6192 cfg->hisname_length = sp->hisauth.name_len + 1; 6193 } else { 6194 if (sp->hisauth.name == NULL) { 6195 cfg->hisname_length = 0; 6196 } else { 6197 len = sp->hisauth.name_len + 1; 6198 6199 if (cfg->hisname_length < len) { 6200 SPPP_UNLOCK(sp); 6201 return (ENAMETOOLONG); 6202 } 6203 error = copyout(sp->hisauth.name, cfg->hisname, len); 6204 if (error) { 6205 SPPP_UNLOCK(sp); 6206 return error; 6207 } 6208 } 6209 } 6210 SPPP_UNLOCK(sp); 6211 } 6212 break; 6213 case SPPPSETAUTHCFG: 6214 { 6215 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 6216 int error; 6217 6218 SPPP_LOCK(sp, RW_WRITER); 6219 6220 if (sp->myauth.name) { 6221 free(sp->myauth.name, M_DEVBUF); 6222 sp->myauth.name = NULL; 6223 } 6224 if (sp->myauth.secret) { 6225 free(sp->myauth.secret, M_DEVBUF); 6226 sp->myauth.secret = NULL; 6227 } 6228 if (sp->hisauth.name) { 6229 free(sp->hisauth.name, M_DEVBUF); 6230 sp->hisauth.name = NULL; 6231 } 6232 if (sp->hisauth.secret) { 6233 free(sp->hisauth.secret, M_DEVBUF); 6234 sp->hisauth.secret = NULL; 6235 } 6236 6237 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6238 if (cfg->hisname_length >= MCLBYTES) { 6239 SPPP_UNLOCK(sp); 6240 return (ENAMETOOLONG); 6241 } 6242 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6243 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6244 if (error) { 6245 free(sp->hisauth.name, M_DEVBUF); 6246 sp->hisauth.name = NULL; 6247 SPPP_UNLOCK(sp); 6248 return error; 6249 } 6250 sp->hisauth.name_len = cfg->hisname_length - 1; 6251 sp->hisauth.name[sp->hisauth.name_len] = 0; 6252 } 6253 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6254 if (cfg->hissecret_length >= MCLBYTES) { 6255 SPPP_UNLOCK(sp); 6256 return (ENAMETOOLONG); 6257 } 6258 sp->hisauth.secret = malloc(cfg->hissecret_length, 6259 M_DEVBUF, M_WAITOK); 6260 error = copyin(cfg->hissecret, sp->hisauth.secret, 6261 cfg->hissecret_length); 6262 if (error) { 6263 free(sp->hisauth.secret, M_DEVBUF); 6264 sp->hisauth.secret = NULL; 6265 SPPP_UNLOCK(sp); 6266 return error; 6267 } 6268 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6269 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6270 } 6271 if (cfg->myname != NULL && cfg->myname_length > 0) { 6272 if (cfg->myname_length >= MCLBYTES) { 6273 SPPP_UNLOCK(sp); 6274 return (ENAMETOOLONG); 6275 } 6276 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6277 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6278 if (error) { 6279 free(sp->myauth.name, M_DEVBUF); 6280 sp->myauth.name = NULL; 6281 SPPP_UNLOCK(sp); 6282 return error; 6283 } 6284 sp->myauth.name_len = cfg->myname_length - 1; 6285 sp->myauth.name[sp->myauth.name_len] = 0; 6286 } 6287 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6288 if (cfg->mysecret_length >= MCLBYTES) { 6289 SPPP_UNLOCK(sp); 6290 return (ENAMETOOLONG); 6291 } 6292 sp->myauth.secret = malloc(cfg->mysecret_length, 6293 M_DEVBUF, M_WAITOK); 6294 error = copyin(cfg->mysecret, sp->myauth.secret, 6295 cfg->mysecret_length); 6296 if (error) { 6297 free(sp->myauth.secret, M_DEVBUF); 6298 sp->myauth.secret = NULL; 6299 SPPP_UNLOCK(sp); 6300 return error; 6301 } 6302 sp->myauth.secret_len = cfg->mysecret_length - 1; 6303 sp->myauth.secret[sp->myauth.secret_len] = 0; 6304 } 6305 sp->myauth.flags = cfg->myauthflags; 6306 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6307 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6308 } 6309 sp->hisauth.flags = cfg->hisauthflags; 6310 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6311 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6312 } 6313 sp->pp_auth_failures = 0; 6314 if (sp->hisauth.proto != PPP_NOPROTO) 6315 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6316 else 6317 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6318 6319 SPPP_UNLOCK(sp); 6320 } 6321 break; 6322 case SPPPGETLCPCFG: 6323 { 6324 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6325 6326 SPPP_LOCK(sp, RW_READER); 6327 lcpp->lcp_timeout = sp->lcp.timeout; 6328 SPPP_UNLOCK(sp); 6329 } 6330 break; 6331 case SPPPSETLCPCFG: 6332 { 6333 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6334 6335 SPPP_LOCK(sp, RW_WRITER); 6336 sp->lcp.timeout = lcpp->lcp_timeout; 6337 SPPP_UNLOCK(sp); 6338 } 6339 break; 6340 case SPPPGETNCPCFG: 6341 { 6342 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6343 6344 SPPP_LOCK(sp, RW_READER); 6345 ncpp->ncp_flags = sp->pp_ncpflags; 6346 SPPP_UNLOCK(sp); 6347 } 6348 break; 6349 case SPPPSETNCPCFG: 6350 { 6351 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6352 6353 SPPP_LOCK(sp, RW_WRITER); 6354 sp->pp_ncpflags = ncpp->ncp_flags; 6355 SPPP_UNLOCK(sp); 6356 } 6357 break; 6358 case SPPPGETSTATUS: 6359 { 6360 struct spppstatus *status = (struct spppstatus *)data; 6361 6362 SPPP_LOCK(sp, RW_READER); 6363 status->phase = sp->pp_phase; 6364 SPPP_UNLOCK(sp); 6365 } 6366 break; 6367 case SPPPGETSTATUSNCP: 6368 { 6369 struct spppstatusncp *status = (struct spppstatusncp *)data; 6370 6371 SPPP_LOCK(sp, RW_READER); 6372 status->phase = sp->pp_phase; 6373 status->ncpup = sppp_cp_check(sp, CP_NCP); 6374 SPPP_UNLOCK(sp); 6375 } 6376 break; 6377 case SPPPGETIDLETO: 6378 { 6379 struct spppidletimeout *to = (struct spppidletimeout *)data; 6380 6381 SPPP_LOCK(sp, RW_READER); 6382 to->idle_seconds = sp->pp_idle_timeout; 6383 SPPP_UNLOCK(sp); 6384 } 6385 break; 6386 case SPPPSETIDLETO: 6387 { 6388 struct spppidletimeout *to = (struct spppidletimeout *)data; 6389 6390 SPPP_LOCK(sp, RW_WRITER); 6391 sp->pp_idle_timeout = to->idle_seconds; 6392 SPPP_UNLOCK(sp); 6393 } 6394 break; 6395 case SPPPSETAUTHFAILURE: 6396 { 6397 struct spppauthfailuresettings *afsettings = 6398 (struct spppauthfailuresettings *)data; 6399 6400 SPPP_LOCK(sp, RW_WRITER); 6401 sp->pp_max_auth_fail = afsettings->max_failures; 6402 sp->pp_auth_failures = 0; 6403 SPPP_UNLOCK(sp); 6404 } 6405 break; 6406 case SPPPGETAUTHFAILURES: 6407 { 6408 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6409 6410 SPPP_LOCK(sp, RW_READER); 6411 stats->auth_failures = sp->pp_auth_failures; 6412 stats->max_failures = sp->pp_max_auth_fail; 6413 SPPP_UNLOCK(sp); 6414 } 6415 break; 6416 case SPPPSETDNSOPTS: 6417 { 6418 struct spppdnssettings *req = (struct spppdnssettings *)data; 6419 6420 SPPP_LOCK(sp, RW_WRITER); 6421 sp->query_dns = req->query_dns & 3; 6422 SPPP_UNLOCK(sp); 6423 } 6424 break; 6425 case SPPPGETDNSOPTS: 6426 { 6427 struct spppdnssettings *req = (struct spppdnssettings *)data; 6428 6429 SPPP_LOCK(sp, RW_READER); 6430 req->query_dns = sp->query_dns; 6431 SPPP_UNLOCK(sp); 6432 } 6433 break; 6434 case SPPPGETDNSADDRS: 6435 { 6436 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6437 6438 SPPP_LOCK(sp, RW_READER); 6439 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6440 SPPP_UNLOCK(sp); 6441 } 6442 break; 6443 case SPPPGETKEEPALIVE: 6444 { 6445 struct spppkeepalivesettings *settings = 6446 (struct spppkeepalivesettings*)data; 6447 6448 SPPP_LOCK(sp, RW_READER); 6449 settings->maxalive = sp->pp_maxalive; 6450 settings->max_noreceive = sp->pp_max_noreceive; 6451 settings->alive_interval = sp->pp_alive_interval; 6452 SPPP_UNLOCK(sp); 6453 } 6454 break; 6455 case SPPPSETKEEPALIVE: 6456 { 6457 struct spppkeepalivesettings *settings = 6458 (struct spppkeepalivesettings*)data; 6459 6460 SPPP_LOCK(sp, RW_WRITER); 6461 sp->pp_maxalive = settings->maxalive; 6462 sp->pp_max_noreceive = settings->max_noreceive; 6463 sp->pp_alive_interval = settings->alive_interval; 6464 SPPP_UNLOCK(sp); 6465 } 6466 break; 6467 case SPPPGETLCPSTATUS: 6468 { 6469 struct sppplcpstatus *status = 6470 (struct sppplcpstatus *)data; 6471 6472 SPPP_LOCK(sp, RW_READER); 6473 status->state = sp->scp[IDX_LCP].state; 6474 status->opts = sp->lcp.opts; 6475 status->magic = sp->lcp.magic; 6476 status->mru = sp->lcp.mru; 6477 SPPP_UNLOCK(sp); 6478 } 6479 break; 6480 case SPPPGETIPCPSTATUS: 6481 { 6482 struct spppipcpstatus *status = 6483 (struct spppipcpstatus *)data; 6484 u_int32_t myaddr; 6485 6486 SPPP_LOCK(sp, RW_READER); 6487 status->state = sp->scp[IDX_IPCP].state; 6488 status->opts = sp->ipcp.opts; 6489 #ifdef INET 6490 kpreempt_disable(); 6491 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6492 kpreempt_enable(); 6493 #else 6494 myaddr = 0; 6495 #endif 6496 status->myaddr = ntohl(myaddr); 6497 SPPP_UNLOCK(sp); 6498 } 6499 break; 6500 case SPPPGETIPV6CPSTATUS: 6501 { 6502 struct spppipv6cpstatus *status = 6503 (struct spppipv6cpstatus *)data; 6504 6505 SPPP_LOCK(sp, RW_READER); 6506 status->state = sp->scp[IDX_IPV6CP].state; 6507 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6508 sizeof(status->my_ifid)); 6509 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6510 sizeof(status->his_ifid)); 6511 SPPP_UNLOCK(sp); 6512 } 6513 break; 6514 default: 6515 { 6516 int ret; 6517 6518 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6519 enosys(), ret); 6520 if (ret != ENOSYS) 6521 return ret; 6522 return (EINVAL); 6523 } 6524 } 6525 return (0); 6526 } 6527 6528 static void 6529 sppp_phase_network(struct sppp *sp) 6530 { 6531 int i; 6532 6533 KASSERT(SPPP_WLOCKED(sp)); 6534 6535 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6536 6537 /* Notify NCPs now. */ 6538 for (i = 0; i < IDX_COUNT; i++) 6539 if ((cps[i])->flags & CP_NCP) 6540 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6541 } 6542 6543 static const char * 6544 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6545 { 6546 6547 switch (type) { 6548 case CONF_REQ: return "conf-req"; 6549 case CONF_ACK: return "conf-ack"; 6550 case CONF_NAK: return "conf-nak"; 6551 case CONF_REJ: return "conf-rej"; 6552 case TERM_REQ: return "term-req"; 6553 case TERM_ACK: return "term-ack"; 6554 case CODE_REJ: return "code-rej"; 6555 case PROTO_REJ: return "proto-rej"; 6556 case ECHO_REQ: return "echo-req"; 6557 case ECHO_REPLY: return "echo-reply"; 6558 case DISC_REQ: return "discard-req"; 6559 } 6560 if (buf != NULL) 6561 snprintf(buf, buflen, "0x%02x", type); 6562 return buf; 6563 } 6564 6565 static const char * 6566 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6567 { 6568 const char *name; 6569 6570 switch (proto) { 6571 case PPP_CHAP: 6572 switch (type) { 6573 case CHAP_CHALLENGE: return "challenge"; 6574 case CHAP_RESPONSE: return "response"; 6575 case CHAP_SUCCESS: return "success"; 6576 case CHAP_FAILURE: return "failure"; 6577 default: name = "chap"; break; 6578 } 6579 break; 6580 6581 case PPP_PAP: 6582 switch (type) { 6583 case PAP_REQ: return "req"; 6584 case PAP_ACK: return "ack"; 6585 case PAP_NAK: return "nak"; 6586 default: name = "pap"; break; 6587 } 6588 break; 6589 6590 default: 6591 name = "bad"; 6592 break; 6593 } 6594 6595 if (buf != NULL) 6596 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6597 return buf; 6598 } 6599 6600 static const char * 6601 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6602 { 6603 6604 switch (opt) { 6605 case LCP_OPT_MRU: return "mru"; 6606 case LCP_OPT_ASYNC_MAP: return "async-map"; 6607 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6608 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6609 case LCP_OPT_MAGIC: return "magic"; 6610 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6611 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6612 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6613 case LCP_OPT_CALL_BACK: return "callback"; 6614 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6615 case LCP_OPT_MP_MRRU: return "mrru"; 6616 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6617 case LCP_OPT_MP_EID: return "mp-eid"; 6618 } 6619 if (buf != NULL) 6620 snprintf(buf, buflen, "0x%02x", opt); 6621 return buf; 6622 } 6623 6624 static const char * 6625 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6626 { 6627 6628 switch (opt) { 6629 case IPCP_OPT_ADDRESSES: return "addresses"; 6630 case IPCP_OPT_COMPRESSION: return "compression"; 6631 case IPCP_OPT_ADDRESS: return "address"; 6632 case IPCP_OPT_PRIMDNS: return "primdns"; 6633 case IPCP_OPT_SECDNS: return "secdns"; 6634 } 6635 if (buf != NULL) 6636 snprintf(buf, buflen, "0x%02x", opt); 6637 return buf; 6638 } 6639 6640 #ifdef INET6 6641 static const char * 6642 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6643 { 6644 6645 switch (opt) { 6646 case IPV6CP_OPT_IFID: return "ifid"; 6647 case IPV6CP_OPT_COMPRESSION: return "compression"; 6648 } 6649 if (buf != NULL) 6650 snprintf(buf, buflen, "0x%02x", opt); 6651 return buf; 6652 } 6653 #endif 6654 6655 static const char * 6656 sppp_state_name(int state) 6657 { 6658 6659 switch (state) { 6660 case STATE_INITIAL: return "initial"; 6661 case STATE_STARTING: return "starting"; 6662 case STATE_CLOSED: return "closed"; 6663 case STATE_STOPPED: return "stopped"; 6664 case STATE_CLOSING: return "closing"; 6665 case STATE_STOPPING: return "stopping"; 6666 case STATE_REQ_SENT: return "req-sent"; 6667 case STATE_ACK_RCVD: return "ack-rcvd"; 6668 case STATE_ACK_SENT: return "ack-sent"; 6669 case STATE_OPENED: return "opened"; 6670 } 6671 return "illegal"; 6672 } 6673 6674 static const char * 6675 sppp_phase_name(int phase) 6676 { 6677 6678 switch (phase) { 6679 case SPPP_PHASE_DEAD: return "dead"; 6680 case SPPP_PHASE_ESTABLISH: return "establish"; 6681 case SPPP_PHASE_TERMINATE: return "terminate"; 6682 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6683 case SPPP_PHASE_NETWORK: return "network"; 6684 } 6685 return "illegal"; 6686 } 6687 6688 static const char * 6689 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6690 { 6691 6692 switch (proto) { 6693 case PPP_LCP: return "lcp"; 6694 case PPP_IPCP: return "ipcp"; 6695 case PPP_PAP: return "pap"; 6696 case PPP_CHAP: return "chap"; 6697 case PPP_IPV6CP: return "ipv6cp"; 6698 } 6699 if (buf != NULL) { 6700 snprintf(buf, sizeof(buf), "0x%04x", 6701 (unsigned)proto); 6702 } 6703 return buf; 6704 } 6705 6706 static void 6707 sppp_print_bytes(const u_char *p, u_short len) 6708 { 6709 addlog(" %02x", *p++); 6710 while (--len > 0) 6711 addlog("-%02x", *p++); 6712 } 6713 6714 static void 6715 sppp_print_string(const char *p, u_short len) 6716 { 6717 u_char c; 6718 6719 while (len-- > 0) { 6720 c = *p++; 6721 /* 6722 * Print only ASCII chars directly. RFC 1994 recommends 6723 * using only them, but we don't rely on it. */ 6724 if (c < ' ' || c > '~') 6725 addlog("\\x%x", c); 6726 else 6727 addlog("%c", c); 6728 } 6729 } 6730 6731 static const char * 6732 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6733 { 6734 6735 if (buf != NULL) { 6736 snprintf(buf, buflen, "%u.%u.%u.%u", 6737 (unsigned int)((addr >> 24) & 0xff), 6738 (unsigned int)((addr >> 16) & 0xff), 6739 (unsigned int)((addr >> 8) & 0xff), 6740 (unsigned int)(addr & 0xff)); 6741 } 6742 return buf; 6743 } 6744 6745 /* a dummy, used to drop uninteresting events */ 6746 static void 6747 sppp_null(struct sppp *unused) 6748 { 6749 /* do just nothing */ 6750 } 6751 6752 static void 6753 sppp_tls(const struct cp *cp, struct sppp *sp) 6754 { 6755 6756 /* notify lcp that is lower layer */ 6757 sp->lcp.protos |= (1 << cp->protoidx); 6758 6759 if (sp->scp[IDX_LCP].state == STATE_OPENED) 6760 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_up); 6761 } 6762 6763 static void 6764 sppp_tlf(const struct cp *cp, struct sppp *sp) 6765 { 6766 STDDCL; 6767 6768 if (debug) 6769 log(LOG_DEBUG, "%s: %s tlf\n", ifp->if_xname, cp->name); 6770 6771 /* notify lcp that is lower layer */ 6772 sp->lcp.protos &= ~(1 << cp->protoidx); 6773 6774 /* cleanup */ 6775 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) { 6776 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6777 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6778 } 6779 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) { 6780 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6781 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6782 } 6783 6784 sppp_lcp_check_and_close(sp); 6785 } 6786 6787 static void 6788 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6789 uint8_t ident, size_t msglen, void *msg) 6790 { 6791 STDDCL; 6792 6793 if (msglen == 0) 6794 return; 6795 6796 switch (type) { 6797 case CONF_ACK: 6798 case CONF_NAK: 6799 case CONF_REJ: 6800 break; 6801 default: 6802 return; 6803 } 6804 6805 if (debug) { 6806 char tbuf[SPPP_CPTYPE_NAMELEN]; 6807 const char *cpname; 6808 6809 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6810 log(LOG_DEBUG, "%s: send %s\n", ifp->if_xname, cpname); 6811 } 6812 6813 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6814 } 6815 6816 static void 6817 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6818 { 6819 6820 SPPP_UNLOCK(sp); 6821 if_down(&sp->pp_if); 6822 IF_PURGE(&sp->pp_cpq); 6823 SPPP_LOCK(sp, RW_WRITER); 6824 } 6825 6826 static void 6827 sppp_notify_up(struct sppp *sp) 6828 { 6829 6830 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6831 } 6832 6833 static void 6834 sppp_notify_down(struct sppp *sp) 6835 { 6836 6837 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6838 } 6839 6840 static void 6841 sppp_notify_tls_wlocked(struct sppp *sp) 6842 { 6843 6844 KASSERT(SPPP_WLOCKED(sp)); 6845 6846 if (!sp->pp_tls) 6847 return; 6848 6849 SPPP_UNLOCK(sp); 6850 sp->pp_tls(sp); 6851 SPPP_LOCK(sp, RW_WRITER); 6852 } 6853 6854 static void 6855 sppp_notify_tlf_wlocked(struct sppp *sp) 6856 { 6857 6858 KASSERT(SPPP_WLOCKED(sp)); 6859 6860 if (!sp->pp_tlf) 6861 return; 6862 6863 SPPP_UNLOCK(sp); 6864 sp->pp_tlf(sp); 6865 SPPP_LOCK(sp, RW_WRITER); 6866 } 6867 6868 static void 6869 sppp_notify_con(struct sppp *sp) 6870 { 6871 6872 if (!sp->pp_con) 6873 return; 6874 6875 sp->pp_con(sp); 6876 } 6877 6878 #ifdef INET6 6879 static void 6880 sppp_notify_con_wlocked(struct sppp *sp) 6881 { 6882 6883 KASSERT(SPPP_WLOCKED(sp)); 6884 6885 SPPP_UNLOCK(sp); 6886 sppp_notify_con(sp); 6887 SPPP_LOCK(sp, RW_WRITER); 6888 6889 } 6890 #endif 6891 6892 static void 6893 sppp_notify_chg_wlocked(struct sppp *sp) 6894 { 6895 6896 KASSERT(SPPP_WLOCKED(sp)); 6897 6898 if (!sp->pp_chg) 6899 return; 6900 6901 SPPP_UNLOCK(sp); 6902 sp->pp_chg(sp, sp->pp_phase); 6903 SPPP_LOCK(sp, RW_WRITER); 6904 } 6905 6906 static void 6907 sppp_wq_work(struct work *wk, void *xsp) 6908 { 6909 struct sppp *sp; 6910 struct sppp_work *work; 6911 6912 sp = xsp; 6913 work = container_of(wk, struct sppp_work, work); 6914 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6915 6916 SPPP_LOCK(sp, RW_WRITER); 6917 work->func(sp, work->arg); 6918 SPPP_UNLOCK(sp); 6919 } 6920 6921 static struct workqueue * 6922 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6923 { 6924 struct workqueue *wq; 6925 int error; 6926 6927 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6928 (void *)sp, prio, ipl, flags); 6929 if (error) { 6930 panic("%s: workqueue_create failed [%s, %d]\n", 6931 sp->pp_if.if_xname, xnamebuf, error); 6932 } 6933 6934 return wq; 6935 } 6936 6937 static void 6938 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6939 { 6940 6941 workqueue_destroy(wq); 6942 } 6943 6944 static void 6945 sppp_wq_set(struct sppp_work *work, 6946 void (*func)(struct sppp *, void *), void *arg) 6947 { 6948 6949 work->func = func; 6950 work->arg = arg; 6951 } 6952 6953 static void 6954 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6955 { 6956 6957 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6958 != SPPP_WK_FREE) 6959 return; 6960 6961 KASSERT(work->func != NULL); 6962 kpreempt_disable(); 6963 workqueue_enqueue(wq, &work->work, NULL); 6964 kpreempt_enable(); 6965 } 6966 static void 6967 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6968 { 6969 6970 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6971 workqueue_wait(wq, &work->work); 6972 } 6973 6974 /* 6975 * This file is large. Tell emacs to highlight it nevertheless. 6976 * 6977 * Local Variables: 6978 * hilit-auto-highlight-maxout: 120000 6979 * End: 6980 */ 6981 6982 /* 6983 * Module glue 6984 */ 6985 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6986 6987 static int 6988 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6989 { 6990 6991 switch (cmd) { 6992 case MODULE_CMD_INIT: 6993 case MODULE_CMD_FINI: 6994 return 0; 6995 case MODULE_CMD_STAT: 6996 case MODULE_CMD_AUTOUNLOAD: 6997 default: 6998 return ENOTTY; 6999 } 7000 } 7001
Indexes created Fri Sep 26 20:09:58 GMT 2025