if_spppsubr.c revision 1.254
1 /* $NetBSD: if_spppsubr.c,v 1.254 2021/06/01 05:08:46 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.254 2021/06/01 05:08:46 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/netisr.h> 76 #include <net/if_types.h> 77 #include <net/route.h> 78 #include <net/ppp_defs.h> 79 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/in_var.h> 83 #ifdef INET 84 #include <netinet/ip.h> 85 #include <netinet/tcp.h> 86 #endif 87 #include <net/ethertypes.h> 88 89 #ifdef INET6 90 #include <netinet6/scope6_var.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #ifdef NET_MPSAFE 97 #define SPPPSUBR_MPSAFE 1 98 #endif 99 100 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 101 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 #ifndef SPPP_KEEPALIVE_INTERVAL 108 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 109 #endif 110 111 #ifndef SPPP_NORECV_TIME 112 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 113 #endif 114 115 #ifndef SPPP_ALIVE_INTERVAL 116 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 117 #endif 118 119 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 120 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 121 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 122 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 123 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 124 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 125 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 126 127 /* 128 * Interface flags that can be set in an ifconfig command. 129 * 130 * Setting link0 will make the link passive, i.e. it will be marked 131 * as being administrative openable, but won't be opened to begin 132 * with. Incoming calls will be answered, or subsequent calls with 133 * -link1 will cause the administrative open of the LCP layer. 134 * 135 * Setting link1 will cause the link to auto-dial only as packets 136 * arrive to be sent. 137 * 138 * Setting IFF_DEBUG will syslog the option negotiation and state 139 * transitions at level kern.debug. Note: all logs consistently look 140 * like 141 * 142 * <if-name><unit>: <proto-name> <additional info...> 143 * 144 * with <if-name><unit> being something like "bppp0", and <proto-name> 145 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 146 */ 147 148 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 149 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 150 151 #define CONF_REQ 1 /* PPP configure request */ 152 #define CONF_ACK 2 /* PPP configure acknowledge */ 153 #define CONF_NAK 3 /* PPP configure negative ack */ 154 #define CONF_REJ 4 /* PPP configure reject */ 155 #define TERM_REQ 5 /* PPP terminate request */ 156 #define TERM_ACK 6 /* PPP terminate acknowledge */ 157 #define CODE_REJ 7 /* PPP code reject */ 158 #define PROTO_REJ 8 /* PPP protocol reject */ 159 #define ECHO_REQ 9 /* PPP echo request */ 160 #define ECHO_REPLY 10 /* PPP echo reply */ 161 #define DISC_REQ 11 /* PPP discard request */ 162 163 #define LCP_OPT_MRU 1 /* maximum receive unit */ 164 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 165 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 166 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 167 #define LCP_OPT_MAGIC 5 /* magic number */ 168 #define LCP_OPT_RESERVED 6 /* reserved */ 169 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 170 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 171 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 172 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 173 #define LCP_OPT_CALL_BACK 13 /* callback */ 174 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 175 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 176 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 177 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 178 179 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 180 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 181 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 182 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 183 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 184 185 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 186 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 187 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 188 189 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 190 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 191 192 #define PAP_REQ 1 /* PAP name/password request */ 193 #define PAP_ACK 2 /* PAP acknowledge */ 194 #define PAP_NAK 3 /* PAP fail */ 195 196 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 197 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 198 #define CHAP_SUCCESS 3 /* CHAP response ok */ 199 #define CHAP_FAILURE 4 /* CHAP response failed */ 200 201 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 202 203 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 204 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 205 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 206 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 207 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 208 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 209 210 #define PPP_NOPROTO 0 /* no authentication protocol */ 211 212 enum { 213 STATE_INITIAL = SPPP_STATE_INITIAL, 214 STATE_STARTING = SPPP_STATE_STARTING, 215 STATE_CLOSED = SPPP_STATE_CLOSED, 216 STATE_STOPPED = SPPP_STATE_STOPPED, 217 STATE_CLOSING = SPPP_STATE_CLOSING, 218 STATE_STOPPING = SPPP_STATE_STOPPING, 219 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 220 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 221 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 222 STATE_OPENED = SPPP_STATE_OPENED, 223 }; 224 225 enum cp_rcr_type { 226 CP_RCR_NONE = 0, /* initial value */ 227 CP_RCR_ACK, /* RCR+ */ 228 CP_RCR_NAK, /* RCR- */ 229 CP_RCR_REJ, /* RCR- */ 230 CP_RCR_DROP, /* DROP message */ 231 CP_RCR_ERR, /* internal error */ 232 }; 233 234 struct ppp_header { 235 uint8_t address; 236 uint8_t control; 237 uint16_t protocol; 238 } __packed; 239 #define PPP_HEADER_LEN sizeof (struct ppp_header) 240 241 struct lcp_header { 242 uint8_t type; 243 uint8_t ident; 244 uint16_t len; 245 } __packed; 246 #define LCP_HEADER_LEN sizeof (struct lcp_header) 247 248 struct cisco_packet { 249 uint32_t type; 250 uint32_t par1; 251 uint32_t par2; 252 uint16_t rel; 253 uint16_t time0; 254 uint16_t time1; 255 } __packed; 256 #define CISCO_PACKET_LEN 18 257 258 /* 259 * We follow the spelling and capitalization of RFC 1661 here, to make 260 * it easier comparing with the standard. Please refer to this RFC in 261 * case you can't make sense out of these abbreviation; it will also 262 * explain the semantics related to the various events and actions. 263 */ 264 struct cp { 265 u_short proto; /* PPP control protocol number */ 266 u_char protoidx; /* index into state table in struct sppp */ 267 u_char flags; 268 #define CP_LCP 0x01 /* this is the LCP */ 269 #define CP_AUTH 0x02 /* this is an authentication protocol */ 270 #define CP_NCP 0x04 /* this is a NCP */ 271 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 272 const char *name; /* name of this control protocol */ 273 /* event handlers */ 274 void (*Up)(struct sppp *, void *); 275 void (*Down)(struct sppp *, void *); 276 void (*Open)(struct sppp *, void *); 277 void (*Close)(struct sppp *, void *); 278 void (*TO)(struct sppp *, void *); 279 /* actions */ 280 void (*tlu)(struct sppp *); 281 void (*tld)(struct sppp *); 282 void (*tls)(const struct cp *, struct sppp *); 283 void (*tlf)(const struct cp *, struct sppp *); 284 void (*scr)(struct sppp *); 285 void (*screply)(const struct cp *, struct sppp *, u_char, 286 uint8_t, size_t, void *); 287 288 /* message parser */ 289 enum cp_rcr_type 290 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 291 uint8_t **, size_t *, size_t *); 292 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 293 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 294 }; 295 296 enum auth_role { 297 SPPP_AUTH_NOROLE = 0, 298 SPPP_AUTH_SERV = __BIT(0), 299 SPPP_AUTH_PEER = __BIT(1), 300 }; 301 302 static struct sppp *spppq; 303 static kmutex_t *spppq_lock = NULL; 304 static callout_t keepalive_ch; 305 static unsigned int sppp_keepalive_cnt = 0; 306 307 #define SPPPQ_LOCK() if (spppq_lock) \ 308 mutex_enter(spppq_lock); 309 #define SPPPQ_UNLOCK() if (spppq_lock) \ 310 mutex_exit(spppq_lock); 311 312 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 313 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 314 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 315 #define SPPP_UPGRADE(_sp) do{ \ 316 SPPP_UNLOCK(_sp); \ 317 SPPP_LOCK(_sp, RW_WRITER); \ 318 }while (0) 319 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 320 #define SPPP_WQ_SET(_wk, _func, _arg) \ 321 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 322 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \ 323 if (__predict_true((_sp) != NULL)) { \ 324 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \ 325 } \ 326 addlog((_fmt), ##_args); \ 327 } while (0) 328 #define SPPP_DLOG(_sp, _fmt, _args...) do { \ 329 if (!sppp_debug_enabled(_sp)) \ 330 break; \ 331 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \ 332 } while (0) 333 334 #ifdef INET 335 #ifndef SPPPSUBR_MPSAFE 336 /* 337 * The following disgusting hack gets around the problem that IP TOS 338 * can't be set yet. We want to put "interactive" traffic on a high 339 * priority queue. To decide if traffic is interactive, we check that 340 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 341 * 342 * XXX is this really still necessary? - joerg - 343 */ 344 static u_short interactive_ports[8] = { 345 0, 513, 0, 0, 346 0, 21, 0, 23, 347 }; 348 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 349 #endif /* SPPPSUBR_MPSAFE */ 350 #endif 351 352 /* almost every function needs these */ 353 354 static bool sppp_debug_enabled(struct sppp *sp); 355 static int sppp_output(struct ifnet *, struct mbuf *, 356 const struct sockaddr *, const struct rtentry *); 357 358 static void sppp_cp_init(const struct cp *, struct sppp *); 359 static void sppp_cp_fini(const struct cp *, struct sppp *); 360 static void sppp_cp_input(const struct cp *, struct sppp *, 361 struct mbuf *); 362 static void sppp_cp_input(const struct cp *, struct sppp *, 363 struct mbuf *); 364 static void sppp_cp_send(struct sppp *, u_short, u_char, 365 u_char, u_short, void *); 366 /* static void sppp_cp_timeout(void *arg); */ 367 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 368 static struct workqueue * 369 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 370 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 371 static void sppp_wq_set(struct sppp_work *, 372 void (*)(struct sppp *, void *), void *); 373 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 374 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 375 static void sppp_cp_to_lcp(void *); 376 static void sppp_cp_to_ipcp(void *); 377 static void sppp_cp_to_ipv6cp(void *); 378 static void sppp_auth_send(const struct cp *, struct sppp *, 379 unsigned int, unsigned int, ...); 380 static int sppp_auth_role(const struct cp *, struct sppp *); 381 static void sppp_auth_to_event(struct sppp *, void *); 382 static void sppp_auth_screply(const struct cp *, struct sppp *, 383 u_char, uint8_t, size_t, void *); 384 static void sppp_up_event(struct sppp *, void *); 385 static void sppp_down_event(struct sppp *, void *); 386 static void sppp_open_event(struct sppp *, void *); 387 static void sppp_close_event(struct sppp *, void *); 388 static void sppp_to_event(struct sppp *, void *); 389 static void sppp_rcr_event(struct sppp *, void *); 390 static void sppp_rca_event(struct sppp *, void *); 391 static void sppp_rcn_event(struct sppp *, void *); 392 static void sppp_rtr_event(struct sppp *, void *); 393 static void sppp_rta_event(struct sppp *, void *); 394 static void sppp_rxj_event(struct sppp *, void *); 395 396 static void sppp_null(struct sppp *); 397 static void sppp_tls(const struct cp *, struct sppp *); 398 static void sppp_tlf(const struct cp *, struct sppp *); 399 static void sppp_screply(const struct cp *, struct sppp *, 400 u_char, uint8_t, size_t, void *); 401 static void sppp_ifdown(struct sppp *, void *); 402 403 static void sppp_lcp_init(struct sppp *); 404 static void sppp_lcp_up(struct sppp *, void *); 405 static void sppp_lcp_down(struct sppp *, void *); 406 static void sppp_lcp_open(struct sppp *, void *); 407 static enum cp_rcr_type 408 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 409 uint8_t **, size_t *, size_t *); 410 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 411 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 412 static void sppp_lcp_tlu(struct sppp *); 413 static void sppp_lcp_tld(struct sppp *); 414 static void sppp_lcp_tls(const struct cp *, struct sppp *); 415 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 416 static void sppp_lcp_scr(struct sppp *); 417 static void sppp_lcp_check_and_close(struct sppp *); 418 static int sppp_cp_check(struct sppp *, u_char); 419 420 static void sppp_ipcp_init(struct sppp *); 421 static void sppp_ipcp_open(struct sppp *, void *); 422 static void sppp_ipcp_close(struct sppp *, void *); 423 static enum cp_rcr_type 424 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 425 uint8_t **, size_t *, size_t *); 426 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 427 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 428 static void sppp_ipcp_tlu(struct sppp *); 429 static void sppp_ipcp_tld(struct sppp *); 430 static void sppp_ipcp_scr(struct sppp *); 431 432 static void sppp_ipv6cp_init(struct sppp *); 433 static void sppp_ipv6cp_open(struct sppp *, void *); 434 static enum cp_rcr_type 435 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 436 uint8_t **, size_t *, size_t *); 437 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 438 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 439 static void sppp_ipv6cp_tlu(struct sppp *); 440 static void sppp_ipv6cp_tld(struct sppp *); 441 static void sppp_ipv6cp_scr(struct sppp *); 442 443 static void sppp_pap_input(struct sppp *, struct mbuf *); 444 static void sppp_pap_init(struct sppp *); 445 static void sppp_pap_tlu(struct sppp *); 446 static void sppp_pap_scr(struct sppp *); 447 static void sppp_pap_scr(struct sppp *); 448 449 static void sppp_chap_input(struct sppp *, struct mbuf *); 450 static void sppp_chap_init(struct sppp *); 451 static void sppp_chap_open(struct sppp *, void *); 452 static void sppp_chap_tlu(struct sppp *); 453 static void sppp_chap_scr(struct sppp *); 454 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 455 456 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 457 static const char *sppp_cp_type_name(char *, size_t, u_char); 458 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 459 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 460 #ifdef INET6 461 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 462 #endif 463 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 464 static const char *sppp_phase_name(int); 465 static const char *sppp_proto_name(char *, size_t, u_short); 466 static const char *sppp_state_name(int); 467 static int sppp_params(struct sppp *, u_long, void *); 468 #ifdef INET 469 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 470 static void sppp_set_ip_addrs(struct sppp *); 471 static void sppp_clear_ip_addrs(struct sppp *); 472 #endif 473 static void sppp_keepalive(void *); 474 static void sppp_phase_network(struct sppp *); 475 static void sppp_print_bytes(const u_char *, u_short); 476 static void sppp_print_string(const char *, u_short); 477 #ifdef INET6 478 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 479 struct in6_addr *, struct in6_addr *); 480 #ifdef IPV6CP_MYIFID_DYN 481 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 482 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 483 #endif 484 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 485 #endif 486 487 static void sppp_notify_up(struct sppp *); 488 static void sppp_notify_down(struct sppp *); 489 static void sppp_notify_tls_wlocked(struct sppp *); 490 static void sppp_notify_tlf_wlocked(struct sppp *); 491 #ifdef INET6 492 static void sppp_notify_con_wlocked(struct sppp *); 493 #endif 494 static void sppp_notify_con(struct sppp *); 495 496 static void sppp_notify_chg_wlocked(struct sppp *); 497 498 /* our control protocol descriptors */ 499 static const struct cp lcp = { 500 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 501 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 502 sppp_close_event, sppp_to_event, 503 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 504 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 505 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 506 }; 507 508 static const struct cp ipcp = { 509 PPP_IPCP, IDX_IPCP, 510 #ifdef INET 511 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 512 #else 513 0, 514 #endif 515 "ipcp", 516 sppp_up_event, sppp_down_event, sppp_ipcp_open, 517 sppp_ipcp_close, sppp_to_event, 518 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls, 519 sppp_tlf, sppp_ipcp_scr, sppp_screply, 520 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 521 }; 522 523 static const struct cp ipv6cp = { 524 PPP_IPV6CP, IDX_IPV6CP, 525 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 526 CP_NCP, 527 #else 528 0, 529 #endif 530 "ipv6cp", 531 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 532 sppp_close_event, sppp_to_event, 533 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls, 534 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 535 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 536 }; 537 538 static const struct cp pap = { 539 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 540 sppp_up_event, sppp_down_event, sppp_open_event, 541 sppp_close_event, sppp_to_event, 542 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 543 sppp_pap_scr, sppp_auth_screply, 544 NULL, NULL, NULL 545 }; 546 547 static const struct cp chap = { 548 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 549 sppp_up_event, sppp_down_event, sppp_chap_open, 550 sppp_close_event, sppp_auth_to_event, 551 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 552 sppp_chap_scr, sppp_auth_screply, 553 NULL, NULL, NULL 554 }; 555 556 static const struct cp *cps[IDX_COUNT] = { 557 &lcp, /* IDX_LCP */ 558 &ipcp, /* IDX_IPCP */ 559 &ipv6cp, /* IDX_IPV6CP */ 560 &pap, /* IDX_PAP */ 561 &chap, /* IDX_CHAP */ 562 }; 563 564 static inline u_int 565 sppp_proto2authproto(u_short proto) 566 { 567 568 switch (proto) { 569 case PPP_PAP: 570 return SPPP_AUTHPROTO_PAP; 571 case PPP_CHAP: 572 return SPPP_AUTHPROTO_CHAP; 573 } 574 575 return SPPP_AUTHPROTO_NONE; 576 } 577 578 static inline u_short 579 sppp_authproto2proto(u_int authproto) 580 { 581 582 switch (authproto) { 583 case SPPP_AUTHPROTO_PAP: 584 return PPP_PAP; 585 case SPPP_AUTHPROTO_CHAP: 586 return PPP_CHAP; 587 } 588 589 return PPP_NOPROTO; 590 } 591 592 static inline bool 593 sppp_debug_enabled(struct sppp *sp) 594 { 595 596 if (__predict_false(sp == NULL)) 597 return false; 598 599 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0) 600 return false; 601 602 return true; 603 } 604 605 static void 606 sppp_change_phase(struct sppp *sp, int phase) 607 { 608 struct ifnet *ifp; 609 610 KASSERT(SPPP_WLOCKED(sp)); 611 612 ifp = &sp->pp_if; 613 614 if (sp->pp_phase == phase) 615 return; 616 617 sp->pp_phase = phase; 618 619 if (phase == SPPP_PHASE_NETWORK) 620 if_link_state_change(ifp, LINK_STATE_UP); 621 else 622 if_link_state_change(ifp, LINK_STATE_DOWN); 623 624 SPPP_DLOG(sp, "phase %s\n", 625 sppp_phase_name(sp->pp_phase)); 626 } 627 628 /* 629 * Exported functions, comprising our interface to the lower layer. 630 */ 631 632 /* 633 * Process the received packet. 634 */ 635 void 636 sppp_input(struct ifnet *ifp, struct mbuf *m) 637 { 638 struct ppp_header *h = NULL; 639 pktqueue_t *pktq = NULL; 640 struct ifqueue *inq = NULL; 641 uint16_t protocol; 642 struct sppp *sp = (struct sppp *)ifp; 643 int isr = 0; 644 645 SPPP_LOCK(sp, RW_READER); 646 647 if (ifp->if_flags & IFF_UP) { 648 /* Count received bytes, add hardware framing */ 649 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 650 /* Note time of last receive */ 651 sp->pp_last_receive = time_uptime; 652 } 653 654 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 655 /* Too small packet, drop it. */ 656 SPPP_DLOG(sp, "input packet is too small, " 657 "%d bytes\n", m->m_pkthdr.len); 658 goto drop; 659 } 660 661 if (sp->pp_flags & PP_NOFRAMING) { 662 memcpy(&protocol, mtod(m, void *), 2); 663 protocol = ntohs(protocol); 664 m_adj(m, 2); 665 } else { 666 667 /* Get PPP header. */ 668 h = mtod(m, struct ppp_header *); 669 m_adj(m, PPP_HEADER_LEN); 670 671 switch (h->address) { 672 case PPP_ALLSTATIONS: 673 if (h->control != PPP_UI) 674 goto invalid; 675 break; 676 case CISCO_MULTICAST: 677 case CISCO_UNICAST: 678 /* Don't check the control field here (RFC 1547). */ 679 SPPP_DLOG(sp, "Cisco packet in PPP mode " 680 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 681 h->address, h->control, ntohs(h->protocol)); 682 goto drop; 683 default: /* Invalid PPP packet. */ 684 invalid: 685 SPPP_DLOG(sp, "invalid input packet " 686 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 687 h->address, h->control, ntohs(h->protocol)); 688 goto drop; 689 } 690 protocol = ntohs(h->protocol); 691 } 692 693 switch (protocol) { 694 reject_protocol: 695 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 696 uint16_t prot = htons(protocol); 697 698 SPPP_UPGRADE(sp); 699 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 700 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 701 &prot); 702 SPPP_DOWNGRADE(sp); 703 } 704 if_statinc(ifp, if_noproto); 705 goto drop; 706 default: 707 SPPP_DLOG(sp, "invalid input protocol " 708 "<proto=0x%x>\n", protocol); 709 goto reject_protocol; 710 case PPP_LCP: 711 SPPP_UNLOCK(sp); 712 sppp_cp_input(&lcp, sp, m); 713 /* already m_freem(m) */ 714 return; 715 case PPP_PAP: 716 SPPP_UNLOCK(sp); 717 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 718 sppp_pap_input(sp, m); 719 } 720 m_freem(m); 721 return; 722 case PPP_CHAP: 723 SPPP_UNLOCK(sp); 724 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 725 sppp_chap_input(sp, m); 726 } 727 m_freem(m); 728 return; 729 #ifdef INET 730 case PPP_IPCP: 731 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 732 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet " 733 "because IPCP is disabled\n"); 734 goto reject_protocol; 735 } 736 SPPP_UNLOCK(sp); 737 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 738 sppp_cp_input(&ipcp, sp, m); 739 /* already m_freem(m) */ 740 } else { 741 m_freem(m); 742 } 743 return; 744 case PPP_IP: 745 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 746 sp->pp_last_activity = time_uptime; 747 pktq = ip_pktq; 748 } 749 break; 750 #endif 751 #ifdef INET6 752 case PPP_IPV6CP: 753 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 754 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet " 755 "because IPv6CP is disabled\n"); 756 goto reject_protocol; 757 } 758 SPPP_UNLOCK(sp); 759 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 760 sppp_cp_input(&ipv6cp, sp, m); 761 /* already m_freem(m) */ 762 } else { 763 m_freem(m); 764 } 765 return; 766 767 case PPP_IPV6: 768 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 769 sp->pp_last_activity = time_uptime; 770 pktq = ip6_pktq; 771 } 772 break; 773 #endif 774 } 775 776 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 777 goto drop; 778 } 779 780 /* Check queue. */ 781 if (__predict_true(pktq)) { 782 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 783 goto drop; 784 } 785 SPPP_UNLOCK(sp); 786 return; 787 } 788 789 SPPP_UNLOCK(sp); 790 791 IFQ_LOCK(inq); 792 if (IF_QFULL(inq)) { 793 /* Queue overflow. */ 794 IF_DROP(inq); 795 IFQ_UNLOCK(inq); 796 SPPP_DLOG(sp,"protocol queue overflow\n"); 797 SPPP_LOCK(sp, RW_READER); 798 goto drop; 799 } 800 IF_ENQUEUE(inq, m); 801 IFQ_UNLOCK(inq); 802 schednetisr(isr); 803 return; 804 805 drop: 806 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 807 m_freem(m); 808 SPPP_UNLOCK(sp); 809 return; 810 } 811 812 /* 813 * Enqueue transmit packet. 814 */ 815 static int 816 sppp_output(struct ifnet *ifp, struct mbuf *m, 817 const struct sockaddr *dst, const struct rtentry *rt) 818 { 819 struct sppp *sp = (struct sppp *) ifp; 820 struct ppp_header *h = NULL; 821 #ifndef SPPPSUBR_MPSAFE 822 struct ifqueue *ifq = NULL; /* XXX */ 823 #endif 824 int s, error = 0; 825 uint16_t protocol; 826 size_t pktlen; 827 828 s = splnet(); 829 SPPP_LOCK(sp, RW_READER); 830 831 sp->pp_last_activity = time_uptime; 832 833 if ((ifp->if_flags & IFF_UP) == 0 || 834 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 835 SPPP_UNLOCK(sp); 836 splx(s); 837 838 m_freem(m); 839 if_statinc(ifp, if_oerrors); 840 return (ENETDOWN); 841 } 842 843 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 844 /* ignore packets that have no enabled NCP */ 845 if ((dst->sa_family == AF_INET && 846 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 847 (dst->sa_family == AF_INET6 && 848 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 849 SPPP_UNLOCK(sp); 850 splx(s); 851 852 m_freem(m); 853 if_statinc(ifp, if_oerrors); 854 return (ENETDOWN); 855 } 856 /* 857 * Interface is not yet running, but auto-dial. Need 858 * to start LCP for it. 859 */ 860 ifp->if_flags |= IFF_RUNNING; 861 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 862 } 863 864 /* 865 * If the queueing discipline needs packet classification, 866 * do it before prepending link headers. 867 */ 868 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 869 870 #ifdef INET 871 if (dst->sa_family == AF_INET) { 872 struct ip *ip = NULL; 873 #ifndef SPPPSUBR_MPSAFE 874 struct tcphdr *th = NULL; 875 #endif 876 877 if (m->m_len >= sizeof(struct ip)) { 878 ip = mtod(m, struct ip *); 879 #ifndef SPPPSUBR_MPSAFE 880 if (ip->ip_p == IPPROTO_TCP && 881 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 882 sizeof(struct tcphdr)) { 883 th = (struct tcphdr *) 884 ((char *)ip + (ip->ip_hl << 2)); 885 } 886 #endif 887 } else 888 ip = NULL; 889 890 /* 891 * When using dynamic local IP address assignment by using 892 * 0.0.0.0 as a local address, the first TCP session will 893 * not connect because the local TCP checksum is computed 894 * using 0.0.0.0 which will later become our real IP address 895 * so the TCP checksum computed at the remote end will 896 * become invalid. So we 897 * - don't let packets with src ip addr 0 thru 898 * - we flag TCP packets with src ip 0 as an error 899 */ 900 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 901 uint8_t proto = ip->ip_p; 902 903 SPPP_UNLOCK(sp); 904 splx(s); 905 906 m_freem(m); 907 if (proto == IPPROTO_TCP) 908 return (EADDRNOTAVAIL); 909 else 910 return (0); 911 } 912 913 #ifndef SPPPSUBR_MPSAFE 914 /* 915 * Put low delay, telnet, rlogin and ftp control packets 916 * in front of the queue. 917 */ 918 if (!IF_QFULL(&sp->pp_fastq) && 919 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 920 (th && (INTERACTIVE(ntohs(th->th_sport)) || 921 INTERACTIVE(ntohs(th->th_dport)))))) 922 ifq = &sp->pp_fastq; 923 #endif /* !SPPPSUBR_MPSAFE */ 924 } 925 #endif 926 927 #ifdef INET6 928 if (dst->sa_family == AF_INET6) { 929 /* XXX do something tricky here? */ 930 } 931 #endif 932 933 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 934 /* 935 * Prepend general data packet PPP header. For now, IP only. 936 */ 937 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 938 if (! m) { 939 SPPP_DLOG(sp, "no memory for transmit header\n"); 940 if_statinc(ifp, if_oerrors); 941 SPPP_UNLOCK(sp); 942 splx(s); 943 return (ENOBUFS); 944 } 945 /* 946 * May want to check size of packet 947 * (albeit due to the implementation it's always enough) 948 */ 949 h = mtod(m, struct ppp_header *); 950 h->address = PPP_ALLSTATIONS; /* broadcast address */ 951 h->control = PPP_UI; /* Unnumbered Info */ 952 } 953 954 switch (dst->sa_family) { 955 #ifdef INET 956 case AF_INET: /* Internet Protocol */ 957 /* 958 * Don't choke with an ENETDOWN early. It's 959 * possible that we just started dialing out, 960 * so don't drop the packet immediately. If 961 * we notice that we run out of buffer space 962 * below, we will however remember that we are 963 * not ready to carry IP packets, and return 964 * ENETDOWN, as opposed to ENOBUFS. 965 */ 966 protocol = htons(PPP_IP); 967 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 968 if (ifp->if_flags & IFF_AUTO) { 969 error = ENETDOWN; 970 } else { 971 IF_DROP(&ifp->if_snd); 972 SPPP_UNLOCK(sp); 973 splx(s); 974 975 m_freem(m); 976 if_statinc(ifp, if_oerrors); 977 return (ENETDOWN); 978 } 979 } 980 break; 981 #endif 982 #ifdef INET6 983 case AF_INET6: /* Internet Protocol version 6 */ 984 /* 985 * Don't choke with an ENETDOWN early. It's 986 * possible that we just started dialing out, 987 * so don't drop the packet immediately. If 988 * we notice that we run out of buffer space 989 * below, we will however remember that we are 990 * not ready to carry IP packets, and return 991 * ENETDOWN, as opposed to ENOBUFS. 992 */ 993 protocol = htons(PPP_IPV6); 994 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 995 if (ifp->if_flags & IFF_AUTO) { 996 error = ENETDOWN; 997 } else { 998 IF_DROP(&ifp->if_snd); 999 SPPP_UNLOCK(sp); 1000 splx(s); 1001 1002 m_freem(m); 1003 if_statinc(ifp, if_oerrors); 1004 return (ENETDOWN); 1005 } 1006 } 1007 break; 1008 #endif 1009 default: 1010 m_freem(m); 1011 if_statinc(ifp, if_oerrors); 1012 SPPP_UNLOCK(sp); 1013 splx(s); 1014 return (EAFNOSUPPORT); 1015 } 1016 1017 if (sp->pp_flags & PP_NOFRAMING) { 1018 M_PREPEND(m, 2, M_DONTWAIT); 1019 if (m == NULL) { 1020 SPPP_DLOG(sp, "no memory for transmit header\n"); 1021 if_statinc(ifp, if_oerrors); 1022 SPPP_UNLOCK(sp); 1023 splx(s); 1024 return (ENOBUFS); 1025 } 1026 *mtod(m, uint16_t *) = protocol; 1027 } else { 1028 h->protocol = protocol; 1029 } 1030 1031 pktlen = m->m_pkthdr.len; 1032 #ifdef SPPPSUBR_MPSAFE 1033 SPPP_UNLOCK(sp); 1034 error = if_transmit_lock(ifp, m); 1035 SPPP_LOCK(sp, RW_READER); 1036 if (error == 0) 1037 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1038 #else /* !SPPPSUBR_MPSAFE */ 1039 error = ifq_enqueue2(ifp, ifq, m); 1040 1041 if (error == 0) { 1042 /* 1043 * Count output packets and bytes. 1044 * The packet length includes header + additional hardware 1045 * framing according to RFC 1333. 1046 */ 1047 if (!(ifp->if_flags & IFF_OACTIVE)) { 1048 SPPP_UNLOCK(sp); 1049 if_start_lock(ifp); 1050 SPPP_LOCK(sp, RW_READER); 1051 } 1052 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1053 } 1054 #endif /* !SPPPSUBR_MPSAFE */ 1055 SPPP_UNLOCK(sp); 1056 splx(s); 1057 return error; 1058 } 1059 1060 void 1061 sppp_attach(struct ifnet *ifp) 1062 { 1063 struct sppp *sp = (struct sppp *) ifp; 1064 char xnamebuf[MAXCOMLEN]; 1065 1066 /* Initialize keepalive handler. */ 1067 if (! spppq) { 1068 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1069 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1070 } 1071 1072 if (! spppq_lock) 1073 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1074 1075 sp->pp_if.if_type = IFT_PPP; 1076 sp->pp_if.if_output = sppp_output; 1077 sp->pp_fastq.ifq_maxlen = 32; 1078 sp->pp_cpq.ifq_maxlen = 20; 1079 sp->pp_loopcnt = 0; 1080 sp->pp_alivecnt = 0; 1081 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1082 sp->pp_last_activity = 0; 1083 sp->pp_last_receive = 0; 1084 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1085 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1086 sp->pp_idle_timeout = 0; 1087 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1088 sp->pp_phase = SPPP_PHASE_DEAD; 1089 sp->pp_up = sppp_notify_up; 1090 sp->pp_down = sppp_notify_down; 1091 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1092 #ifdef SPPP_IFDOWN_RECONNECT 1093 sp->pp_flags |= PP_LOOPBACK_IFDOWN | PP_KEEPALIVE_IFDOWN; 1094 #endif 1095 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1096 memset(sp->scp, 0, sizeof(sp->scp)); 1097 rw_init(&sp->pp_lock); 1098 1099 if_alloc_sadl(ifp); 1100 1101 /* Lets not beat about the bush, we know we're down. */ 1102 ifp->if_link_state = LINK_STATE_DOWN; 1103 1104 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1105 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1106 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1107 1108 memset(&sp->myauth, 0, sizeof sp->myauth); 1109 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1110 SPPP_LOCK(sp, RW_WRITER); 1111 sppp_lcp_init(sp); 1112 sppp_ipcp_init(sp); 1113 sppp_ipv6cp_init(sp); 1114 sppp_pap_init(sp); 1115 sppp_chap_init(sp); 1116 SPPP_UNLOCK(sp); 1117 1118 SPPPQ_LOCK(); 1119 /* Insert new entry into the keepalive list. */ 1120 sp->pp_next = spppq; 1121 spppq = sp; 1122 SPPPQ_UNLOCK(); 1123 } 1124 1125 void 1126 sppp_detach(struct ifnet *ifp) 1127 { 1128 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1129 1130 /* Remove the entry from the keepalive list. */ 1131 SPPPQ_LOCK(); 1132 for (q = &spppq; (p = *q); q = &p->pp_next) 1133 if (p == sp) { 1134 *q = p->pp_next; 1135 break; 1136 } 1137 SPPPQ_UNLOCK(); 1138 1139 if (! spppq) { 1140 /* Stop keepalive handler. */ 1141 callout_stop(&keepalive_ch); 1142 mutex_obj_free(spppq_lock); 1143 spppq_lock = NULL; 1144 } 1145 1146 sppp_cp_fini(&lcp, sp); 1147 sppp_cp_fini(&ipcp, sp); 1148 sppp_cp_fini(&pap, sp); 1149 sppp_cp_fini(&chap, sp); 1150 #ifdef INET6 1151 sppp_cp_fini(&ipv6cp, sp); 1152 #endif 1153 sppp_wq_destroy(sp, sp->wq_cp); 1154 1155 /* free authentication info */ 1156 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1157 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1158 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1159 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1160 rw_destroy(&sp->pp_lock); 1161 } 1162 1163 /* 1164 * Flush the interface output queue. 1165 */ 1166 void 1167 sppp_flush(struct ifnet *ifp) 1168 { 1169 struct sppp *sp = (struct sppp *) ifp; 1170 1171 SPPP_LOCK(sp, RW_WRITER); 1172 IFQ_PURGE(&sp->pp_if.if_snd); 1173 IF_PURGE(&sp->pp_fastq); 1174 IF_PURGE(&sp->pp_cpq); 1175 SPPP_UNLOCK(sp); 1176 } 1177 1178 /* 1179 * Check if the output queue is empty. 1180 */ 1181 int 1182 sppp_isempty(struct ifnet *ifp) 1183 { 1184 struct sppp *sp = (struct sppp *) ifp; 1185 int empty, s; 1186 1187 s = splnet(); 1188 SPPP_LOCK(sp, RW_READER); 1189 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1190 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1191 SPPP_UNLOCK(sp); 1192 splx(s); 1193 return (empty); 1194 } 1195 1196 /* 1197 * Get next packet to send. 1198 */ 1199 struct mbuf * 1200 sppp_dequeue(struct ifnet *ifp) 1201 { 1202 struct sppp *sp = (struct sppp *) ifp; 1203 struct mbuf *m; 1204 int s; 1205 1206 s = splnet(); 1207 SPPP_LOCK(sp, RW_WRITER); 1208 /* 1209 * Process only the control protocol queue until we have at 1210 * least one NCP open. 1211 * 1212 * Do always serve all three queues in Cisco mode. 1213 */ 1214 IF_DEQUEUE(&sp->pp_cpq, m); 1215 if (m == NULL && sppp_cp_check(sp, CP_NCP)) { 1216 IF_DEQUEUE(&sp->pp_fastq, m); 1217 if (m == NULL) 1218 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1219 } 1220 SPPP_UNLOCK(sp); 1221 splx(s); 1222 return m; 1223 } 1224 1225 /* 1226 * Process an ioctl request. Called on low priority level. 1227 */ 1228 int 1229 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1230 { 1231 struct lwp *l = curlwp; /* XXX */ 1232 struct ifreq *ifr = (struct ifreq *) data; 1233 struct ifaddr *ifa = (struct ifaddr *) data; 1234 struct sppp *sp = (struct sppp *) ifp; 1235 int s, error=0, going_up, going_down; 1236 u_short newmode; 1237 u_long lcp_mru; 1238 1239 s = splnet(); 1240 switch (cmd) { 1241 case SIOCINITIFADDR: 1242 ifa->ifa_rtrequest = p2p_rtrequest; 1243 break; 1244 1245 case SIOCSIFFLAGS: 1246 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1247 break; 1248 1249 SPPP_LOCK(sp, RW_WRITER); 1250 going_up = ifp->if_flags & IFF_UP && 1251 (ifp->if_flags & IFF_RUNNING) == 0; 1252 going_down = (ifp->if_flags & IFF_UP) == 0 && 1253 ifp->if_flags & IFF_RUNNING; 1254 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1255 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1256 /* sanity */ 1257 newmode = IFF_PASSIVE; 1258 ifp->if_flags &= ~IFF_AUTO; 1259 } 1260 1261 if (ifp->if_flags & IFF_UP) { 1262 sp->pp_flags |= PP_ADMIN_UP; 1263 } else { 1264 sp->pp_flags &= ~PP_ADMIN_UP; 1265 } 1266 1267 if (going_up || going_down) { 1268 sp->lcp.reestablish = false; 1269 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1270 } 1271 if (going_up && newmode == 0) { 1272 /* neither auto-dial nor passive */ 1273 ifp->if_flags |= IFF_RUNNING; 1274 sppp_wq_add(sp->wq_cp, 1275 &sp->scp[IDX_LCP].work_open); 1276 } else if (going_down) { 1277 SPPP_UNLOCK(sp); 1278 sppp_flush(ifp); 1279 SPPP_LOCK(sp, RW_WRITER); 1280 1281 ifp->if_flags &= ~IFF_RUNNING; 1282 } 1283 SPPP_UNLOCK(sp); 1284 break; 1285 1286 case SIOCSIFMTU: 1287 if (ifr->ifr_mtu < PPP_MINMRU || 1288 ifr->ifr_mtu > PP_MTU) { 1289 error = EINVAL; 1290 break; 1291 } 1292 1293 error = ifioctl_common(ifp, cmd, data); 1294 if (error == ENETRESET) 1295 error = 0; 1296 1297 SPPP_LOCK(sp, RW_WRITER); 1298 lcp_mru = sp->lcp.mru; 1299 if (ifp->if_mtu < PP_MTU) { 1300 sp->lcp.mru = ifp->if_mtu; 1301 } else { 1302 sp->lcp.mru = PP_MTU; 1303 } 1304 if (lcp_mru != sp->lcp.mru) 1305 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1306 1307 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1308 ifp->if_mtu > sp->lcp.their_mru) { 1309 sp->pp_saved_mtu = ifp->if_mtu; 1310 ifp->if_mtu = sp->lcp.their_mru; 1311 1312 SPPP_DLOG(sp, "setting MTU " 1313 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 1314 sp->pp_saved_mtu, ifp->if_mtu); 1315 } 1316 SPPP_UNLOCK(sp); 1317 break; 1318 1319 case SIOCGIFMTU: 1320 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1321 error = 0; 1322 break; 1323 case SIOCADDMULTI: 1324 case SIOCDELMULTI: 1325 break; 1326 1327 case SPPPSETAUTHCFG: 1328 case SPPPSETLCPCFG: 1329 case SPPPSETNCPCFG: 1330 case SPPPSETIDLETO: 1331 case SPPPSETAUTHFAILURE: 1332 case SPPPSETDNSOPTS: 1333 case SPPPSETKEEPALIVE: 1334 #if defined(COMPAT_50) || defined(MODULAR) 1335 case __SPPPSETIDLETO50: 1336 case __SPPPSETKEEPALIVE50: 1337 #endif /* COMPAT_50 || MODULAR */ 1338 error = kauth_authorize_network(l->l_cred, 1339 KAUTH_NETWORK_INTERFACE, 1340 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1341 NULL); 1342 if (error) 1343 break; 1344 error = sppp_params(sp, cmd, data); 1345 break; 1346 1347 case SPPPGETAUTHCFG: 1348 case SPPPGETLCPCFG: 1349 case SPPPGETNCPCFG: 1350 case SPPPGETAUTHFAILURES: 1351 error = kauth_authorize_network(l->l_cred, 1352 KAUTH_NETWORK_INTERFACE, 1353 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1354 NULL); 1355 if (error) 1356 break; 1357 error = sppp_params(sp, cmd, data); 1358 break; 1359 1360 case SPPPGETSTATUS: 1361 case SPPPGETSTATUSNCP: 1362 case SPPPGETIDLETO: 1363 case SPPPGETDNSOPTS: 1364 case SPPPGETDNSADDRS: 1365 case SPPPGETKEEPALIVE: 1366 #if defined(COMPAT_50) || defined(MODULAR) 1367 case __SPPPGETIDLETO50: 1368 case __SPPPGETKEEPALIVE50: 1369 #endif /* COMPAT_50 || MODULAR */ 1370 case SPPPGETLCPSTATUS: 1371 case SPPPGETIPCPSTATUS: 1372 case SPPPGETIPV6CPSTATUS: 1373 error = sppp_params(sp, cmd, data); 1374 break; 1375 1376 default: 1377 error = ifioctl_common(ifp, cmd, data); 1378 break; 1379 } 1380 splx(s); 1381 return (error); 1382 } 1383 1384 /* 1385 * PPP protocol implementation. 1386 */ 1387 1388 /* 1389 * Send PPP control protocol packet. 1390 */ 1391 static void 1392 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1393 u_char ident, u_short len, void *data) 1394 { 1395 struct ifnet *ifp; 1396 struct lcp_header *lh; 1397 struct mbuf *m; 1398 size_t pkthdrlen; 1399 1400 KASSERT(SPPP_WLOCKED(sp)); 1401 1402 ifp = &sp->pp_if; 1403 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1404 1405 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1406 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1407 MGETHDR(m, M_DONTWAIT, MT_DATA); 1408 if (! m) { 1409 return; 1410 } 1411 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1412 m_reset_rcvif(m); 1413 1414 if (sp->pp_flags & PP_NOFRAMING) { 1415 *mtod(m, uint16_t *) = htons(proto); 1416 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1417 } else { 1418 struct ppp_header *h; 1419 h = mtod(m, struct ppp_header *); 1420 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1421 h->control = PPP_UI; /* Unnumbered Info */ 1422 h->protocol = htons(proto); /* Link Control Protocol */ 1423 lh = (struct lcp_header *)(h + 1); 1424 } 1425 lh->type = type; 1426 lh->ident = ident; 1427 lh->len = htons(LCP_HEADER_LEN + len); 1428 if (len) 1429 memcpy(lh + 1, data, len); 1430 1431 if (sppp_debug_enabled(sp)) { 1432 char pbuf[SPPP_PROTO_NAMELEN]; 1433 char tbuf[SPPP_CPTYPE_NAMELEN]; 1434 const char *pname, *cpname; 1435 1436 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1437 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1438 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 1439 pname, cpname, lh->ident, ntohs(lh->len)); 1440 if (len) 1441 sppp_print_bytes((u_char *)(lh + 1), len); 1442 addlog(">\n"); 1443 } 1444 if (IF_QFULL(&sp->pp_cpq)) { 1445 IF_DROP(&sp->pp_fastq); 1446 IF_DROP(&ifp->if_snd); 1447 m_freem(m); 1448 if_statinc(ifp, if_oerrors); 1449 return; 1450 } 1451 1452 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1453 IF_ENQUEUE(&sp->pp_cpq, m); 1454 1455 if (! (ifp->if_flags & IFF_OACTIVE)) { 1456 SPPP_UNLOCK(sp); 1457 if_start_lock(ifp); 1458 SPPP_LOCK(sp, RW_WRITER); 1459 } 1460 } 1461 1462 static void 1463 sppp_cp_to_lcp(void *xsp) 1464 { 1465 struct sppp *sp = xsp; 1466 1467 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1468 } 1469 1470 static void 1471 sppp_cp_to_ipcp(void *xsp) 1472 { 1473 struct sppp *sp = xsp; 1474 1475 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1476 } 1477 1478 static void 1479 sppp_cp_to_ipv6cp(void *xsp) 1480 { 1481 struct sppp *sp = xsp; 1482 1483 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1484 } 1485 1486 static void 1487 sppp_cp_to_pap(void *xsp) 1488 { 1489 struct sppp *sp = xsp; 1490 1491 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1492 } 1493 1494 static void 1495 sppp_cp_to_chap(void *xsp) 1496 { 1497 struct sppp *sp = xsp; 1498 1499 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1500 } 1501 1502 static void 1503 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1504 { 1505 struct sppp_cp *scp; 1506 typedef void (*sppp_co_cb_t)(void *); 1507 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1508 [IDX_LCP] = sppp_cp_to_lcp, 1509 [IDX_IPCP] = sppp_cp_to_ipcp, 1510 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1511 [IDX_PAP] = sppp_cp_to_pap, 1512 [IDX_CHAP] = sppp_cp_to_chap, 1513 }; 1514 1515 scp = &sp->scp[cp->protoidx]; 1516 scp->state = STATE_INITIAL; 1517 scp->fail_counter = 0; 1518 scp->seq = 0; 1519 scp->rseq = 0; 1520 1521 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1522 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1523 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1524 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1525 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1526 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1527 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1528 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1529 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1530 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1531 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1532 1533 callout_init(&scp->ch, CALLOUT_MPSAFE); 1534 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1535 } 1536 1537 static void 1538 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1539 { 1540 struct sppp_cp *scp; 1541 scp = &sp->scp[cp->protoidx]; 1542 1543 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1544 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1545 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1546 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1547 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1548 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1549 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1550 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1551 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1552 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1553 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1554 1555 callout_halt(&scp->ch, NULL); 1556 callout_destroy(&scp->ch); 1557 1558 if (scp->mbuf_confreq != NULL) { 1559 m_freem(scp->mbuf_confreq); 1560 scp->mbuf_confreq = NULL; 1561 } 1562 if (scp->mbuf_confnak != NULL) { 1563 m_freem(scp->mbuf_confnak); 1564 scp->mbuf_confnak = NULL; 1565 } 1566 } 1567 1568 /* 1569 * Handle incoming PPP control protocol packets. 1570 */ 1571 static void 1572 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1573 { 1574 struct ifnet *ifp; 1575 struct lcp_header *h; 1576 struct sppp_cp *scp; 1577 int printlen, len = m->m_pkthdr.len; 1578 u_char *p; 1579 uint32_t u32; 1580 char tbuf[SPPP_CPTYPE_NAMELEN]; 1581 const char *cpname; 1582 bool debug; 1583 1584 SPPP_LOCK(sp, RW_WRITER); 1585 1586 ifp = &sp->pp_if; 1587 debug = sppp_debug_enabled(sp); 1588 scp = &sp->scp[cp->protoidx]; 1589 1590 if (len < 4) { 1591 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n", 1592 cp->name, len); 1593 goto out; 1594 } 1595 h = mtod(m, struct lcp_header *); 1596 if (debug) { 1597 printlen = ntohs(h->len); 1598 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1599 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d", 1600 cp->name, sppp_state_name(scp->state), 1601 cpname, h->ident, printlen); 1602 if (len < printlen) 1603 printlen = len; 1604 if (printlen > 4) 1605 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1606 addlog(">\n"); 1607 } 1608 if (len > ntohs(h->len)) 1609 len = ntohs(h->len); 1610 p = (u_char *)(h + 1); 1611 switch (h->type) { 1612 case CONF_REQ: 1613 if (len < 4) { 1614 SPPP_DLOG(sp,"%s invalid conf-req length %d\n", 1615 cp->name, len); 1616 if_statinc(ifp, if_ierrors); 1617 break; 1618 } 1619 1620 scp->rcr_type = CP_RCR_NONE; 1621 scp->rconfid = h->ident; 1622 if (scp->mbuf_confreq != NULL) { 1623 m_freem(scp->mbuf_confreq); 1624 } 1625 scp->mbuf_confreq = m; 1626 m = NULL; 1627 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1628 break; 1629 case CONF_ACK: 1630 if (h->ident != scp->confid) { 1631 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1632 cp->name, h->ident, scp->confid); 1633 if_statinc(ifp, if_ierrors); 1634 break; 1635 } 1636 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1637 break; 1638 case CONF_NAK: 1639 case CONF_REJ: 1640 if (h->ident != scp->confid) { 1641 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1642 cp->name, h->ident, scp->confid); 1643 if_statinc(ifp, if_ierrors); 1644 break; 1645 } 1646 1647 if (scp->mbuf_confnak) { 1648 m_freem(scp->mbuf_confnak); 1649 } 1650 scp->mbuf_confnak = m; 1651 m = NULL; 1652 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1653 break; 1654 case TERM_REQ: 1655 scp->rseq = h->ident; 1656 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1657 break; 1658 case TERM_ACK: 1659 if (h->ident != scp->confid && 1660 h->ident != scp->seq) { 1661 SPPP_DLOG(sp, "%s id mismatch " 1662 "0x%x != 0x%x and 0x%x != %0lx\n", 1663 cp->name, h->ident, scp->confid, 1664 h->ident, scp->seq); 1665 if_statinc(ifp, if_ierrors); 1666 break; 1667 } 1668 1669 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1670 break; 1671 case CODE_REJ: 1672 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1673 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1674 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, " 1675 "danger will robinson\n", cp->name, cpname); 1676 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1677 break; 1678 case PROTO_REJ: 1679 { 1680 int catastrophic; 1681 const struct cp *upper; 1682 int i; 1683 uint16_t proto; 1684 1685 catastrophic = 0; 1686 upper = NULL; 1687 proto = p[0] << 8 | p[1]; 1688 for (i = 0; i < IDX_COUNT; i++) { 1689 if (cps[i]->proto == proto) { 1690 upper = cps[i]; 1691 break; 1692 } 1693 } 1694 if (upper == NULL) 1695 catastrophic++; 1696 1697 if (debug) { 1698 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1699 SPPP_LOG(sp, LOG_INFO, 1700 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1701 cp->name, catastrophic ? '-' : '+', 1702 cpname, proto, upper ? upper->name : "unknown", 1703 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1704 } 1705 1706 /* 1707 * if we got RXJ+ against conf-req, the peer does not implement 1708 * this particular protocol type. terminate the protocol. 1709 */ 1710 if (upper && !catastrophic) { 1711 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1712 sppp_wq_add(sp->wq_cp, 1713 &sp->scp[upper->protoidx].work_close); 1714 break; 1715 } 1716 } 1717 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1718 break; 1719 } 1720 case DISC_REQ: 1721 if (cp->proto != PPP_LCP) 1722 goto illegal; 1723 /* Discard the packet. */ 1724 break; 1725 case ECHO_REQ: 1726 if (cp->proto != PPP_LCP) 1727 goto illegal; 1728 if (scp->state != STATE_OPENED) { 1729 SPPP_DLOG(sp, "lcp echo req but lcp closed\n"); 1730 if_statinc(ifp, if_ierrors); 1731 break; 1732 } 1733 if (len < 8) { 1734 SPPP_DLOG(sp, "invalid lcp echo request " 1735 "packet length: %d bytes\n", len); 1736 break; 1737 } 1738 memcpy(&u32, h + 1, sizeof u32); 1739 if (ntohl(u32) == sp->lcp.magic) { 1740 /* Line loopback mode detected. */ 1741 SPPP_DLOG(sp, "loopback\n"); 1742 1743 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 1744 sp->pp_flags |= PP_LOOPBACK; 1745 sppp_wq_add(sp->wq_cp, 1746 &sp->work_ifdown); 1747 } 1748 1749 /* Shut down the PPP link. */ 1750 sppp_wq_add(sp->wq_cp, 1751 &sp->scp[IDX_LCP].work_close); 1752 sppp_wq_add(sp->wq_cp, 1753 &sp->scp[IDX_LCP].work_open); 1754 break; 1755 } 1756 u32 = htonl(sp->lcp.magic); 1757 memcpy(h + 1, &u32, sizeof u32); 1758 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n"); 1759 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1760 h + 1); 1761 break; 1762 case ECHO_REPLY: 1763 if (cp->proto != PPP_LCP) 1764 goto illegal; 1765 if (h->ident != sp->lcp.echoid) { 1766 if_statinc(ifp, if_ierrors); 1767 break; 1768 } 1769 if (len < 8) { 1770 SPPP_DLOG(sp, "lcp invalid echo reply " 1771 "packet length: %d bytes\n", len); 1772 break; 1773 } 1774 SPPP_DLOG(sp, "lcp got echo rep\n"); 1775 memcpy(&u32, h + 1, sizeof u32); 1776 if (ntohl(u32) != sp->lcp.magic) 1777 sp->pp_alivecnt = 0; 1778 break; 1779 default: 1780 /* Unknown packet type -- send Code-Reject packet. */ 1781 illegal: 1782 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n", 1783 cp->name, h->type); 1784 sppp_cp_send(sp, cp->proto, CODE_REJ, 1785 ++scp->seq, m->m_pkthdr.len, h); 1786 if_statinc(ifp, if_ierrors); 1787 } 1788 1789 out: 1790 SPPP_UNLOCK(sp); 1791 if (m != NULL) 1792 m_freem(m); 1793 } 1794 1795 /* 1796 * The generic part of all Up/Down/Open/Close/TO event handlers. 1797 * Basically, the state transition handling in the automaton. 1798 */ 1799 static void 1800 sppp_up_event(struct sppp *sp, void *xcp) 1801 { 1802 const struct cp *cp = xcp; 1803 1804 KASSERT(SPPP_WLOCKED(sp)); 1805 KASSERT(!cpu_softintr_p()); 1806 1807 if ((cp->flags & CP_AUTH) != 0 && 1808 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1809 return; 1810 1811 SPPP_DLOG(sp, "%s up(%s)\n", cp->name, 1812 sppp_state_name(sp->scp[cp->protoidx].state)); 1813 1814 switch (sp->scp[cp->protoidx].state) { 1815 case STATE_INITIAL: 1816 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1817 break; 1818 case STATE_STARTING: 1819 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1820 (cp->scr)(sp); 1821 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1822 break; 1823 default: 1824 SPPP_LOG(sp, LOG_DEBUG, 1825 "%s illegal up in state %s\n", cp->name, 1826 sppp_state_name(sp->scp[cp->protoidx].state)); 1827 } 1828 } 1829 1830 static void 1831 sppp_down_event(struct sppp *sp, void *xcp) 1832 { 1833 const struct cp *cp = xcp; 1834 1835 KASSERT(SPPP_WLOCKED(sp)); 1836 KASSERT(!cpu_softintr_p()); 1837 1838 if ((cp->flags & CP_AUTH) != 0 && 1839 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1840 return; 1841 1842 SPPP_DLOG(sp, "%s down(%s)\n", cp->name, 1843 sppp_state_name(sp->scp[cp->protoidx].state)); 1844 1845 switch (sp->scp[cp->protoidx].state) { 1846 case STATE_CLOSED: 1847 case STATE_CLOSING: 1848 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1849 break; 1850 case STATE_STOPPED: 1851 (cp->tls)(cp, sp); 1852 /* fall through */ 1853 case STATE_STOPPING: 1854 case STATE_REQ_SENT: 1855 case STATE_ACK_RCVD: 1856 case STATE_ACK_SENT: 1857 sppp_cp_change_state(cp, sp, STATE_STARTING); 1858 break; 1859 case STATE_OPENED: 1860 (cp->tld)(sp); 1861 sppp_cp_change_state(cp, sp, STATE_STARTING); 1862 break; 1863 default: 1864 /* 1865 * a down event may be caused regardless 1866 * of state just in LCP case. 1867 */ 1868 if (cp->proto == PPP_LCP) 1869 break; 1870 1871 SPPP_LOG(sp, LOG_DEBUG, 1872 "%s illegal down in state %s\n", cp->name, 1873 sppp_state_name(sp->scp[cp->protoidx].state)); 1874 } 1875 } 1876 1877 static void 1878 sppp_open_event(struct sppp *sp, void *xcp) 1879 { 1880 const struct cp *cp = xcp; 1881 1882 KASSERT(SPPP_WLOCKED(sp)); 1883 KASSERT(!cpu_softintr_p()); 1884 1885 if ((cp->flags & CP_AUTH) != 0 && 1886 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1887 return; 1888 1889 SPPP_DLOG(sp, "%s open(%s)\n", cp->name, 1890 sppp_state_name(sp->scp[cp->protoidx].state)); 1891 1892 switch (sp->scp[cp->protoidx].state) { 1893 case STATE_INITIAL: 1894 sppp_cp_change_state(cp, sp, STATE_STARTING); 1895 (cp->tls)(cp, sp); 1896 break; 1897 case STATE_STARTING: 1898 break; 1899 case STATE_CLOSED: 1900 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1901 (cp->scr)(sp); 1902 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1903 break; 1904 case STATE_STOPPED: 1905 case STATE_STOPPING: 1906 case STATE_REQ_SENT: 1907 case STATE_ACK_RCVD: 1908 case STATE_ACK_SENT: 1909 case STATE_OPENED: 1910 break; 1911 case STATE_CLOSING: 1912 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1913 break; 1914 } 1915 } 1916 1917 static void 1918 sppp_close_event(struct sppp *sp, void *xcp) 1919 { 1920 const struct cp *cp = xcp; 1921 1922 KASSERT(SPPP_WLOCKED(sp)); 1923 KASSERT(!cpu_softintr_p()); 1924 1925 if ((cp->flags & CP_AUTH) != 0 && 1926 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1927 return; 1928 1929 SPPP_DLOG(sp, "%s close(%s)\n", cp->name, 1930 sppp_state_name(sp->scp[cp->protoidx].state)); 1931 1932 switch (sp->scp[cp->protoidx].state) { 1933 case STATE_INITIAL: 1934 case STATE_CLOSED: 1935 case STATE_CLOSING: 1936 break; 1937 case STATE_STARTING: 1938 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1939 (cp->tlf)(cp, sp); 1940 break; 1941 case STATE_STOPPED: 1942 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1943 break; 1944 case STATE_STOPPING: 1945 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1946 break; 1947 case STATE_OPENED: 1948 (cp->tld)(sp); 1949 /* fall through */ 1950 case STATE_REQ_SENT: 1951 case STATE_ACK_RCVD: 1952 case STATE_ACK_SENT: 1953 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 1954 if ((cp->flags & CP_AUTH) == 0) { 1955 sppp_cp_send(sp, cp->proto, TERM_REQ, 1956 ++sp->scp[cp->protoidx].seq, 0, 0); 1957 } 1958 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1959 break; 1960 } 1961 } 1962 1963 static void 1964 sppp_to_event(struct sppp *sp, void *xcp) 1965 { 1966 const struct cp *cp = xcp; 1967 int s; 1968 1969 KASSERT(SPPP_WLOCKED(sp)); 1970 KASSERT(!cpu_softintr_p()); 1971 1972 s = splnet(); 1973 1974 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name, 1975 sppp_state_name(sp->scp[cp->protoidx].state), 1976 sp->scp[cp->protoidx].rst_counter); 1977 1978 if (--sp->scp[cp->protoidx].rst_counter < 0) 1979 /* TO- event */ 1980 switch (sp->scp[cp->protoidx].state) { 1981 case STATE_CLOSING: 1982 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1983 (cp->tlf)(cp, sp); 1984 break; 1985 case STATE_STOPPING: 1986 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1987 (cp->tlf)(cp, sp); 1988 break; 1989 case STATE_REQ_SENT: 1990 case STATE_ACK_RCVD: 1991 case STATE_ACK_SENT: 1992 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1993 (cp->tlf)(cp, sp); 1994 break; 1995 } 1996 else 1997 /* TO+ event */ 1998 switch (sp->scp[cp->protoidx].state) { 1999 case STATE_CLOSING: 2000 case STATE_STOPPING: 2001 if ((cp->flags & CP_AUTH) == 0) { 2002 sppp_cp_send(sp, cp->proto, TERM_REQ, 2003 ++sp->scp[cp->protoidx].seq, 0, 0); 2004 } 2005 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2006 break; 2007 case STATE_REQ_SENT: 2008 case STATE_ACK_RCVD: 2009 (cp->scr)(sp); 2010 /* sppp_cp_change_state() will restart the timer */ 2011 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2012 break; 2013 case STATE_ACK_SENT: 2014 (cp->scr)(sp); 2015 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2016 break; 2017 } 2018 2019 splx(s); 2020 } 2021 static void 2022 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2023 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2024 { 2025 struct ifnet *ifp; 2026 u_char ctype; 2027 2028 ifp = &sp->pp_if; 2029 2030 if (type == CP_RCR_ERR) { 2031 /* parse error, shut down */ 2032 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2033 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2034 } else if (type == CP_RCR_ACK) { 2035 /* RCR+ event */ 2036 ctype = CONF_ACK; 2037 switch (sp->scp[cp->protoidx].state) { 2038 case STATE_OPENED: 2039 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2040 cp->tld(sp); 2041 cp->scr(sp); 2042 cp->screply(cp, sp, ctype, ident, msglen, msg); 2043 break; 2044 case STATE_REQ_SENT: 2045 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2046 /* fall through */ 2047 case STATE_ACK_SENT: 2048 cp->screply(cp, sp, ctype, ident, msglen, msg); 2049 break; 2050 case STATE_STOPPED: 2051 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2052 cp->scr(sp); 2053 cp->screply(cp, sp, ctype, ident, msglen, msg); 2054 break; 2055 case STATE_ACK_RCVD: 2056 sppp_cp_change_state(cp, sp, STATE_OPENED); 2057 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2058 cp->tlu(sp); 2059 cp->screply(cp, sp, ctype, ident, msglen, msg); 2060 break; 2061 case STATE_CLOSING: 2062 case STATE_STOPPING: 2063 break; 2064 case STATE_CLOSED: 2065 if ((cp->flags & CP_AUTH) == 0) { 2066 sppp_cp_send(sp, cp->proto, TERM_ACK, 2067 ident, 0, 0); 2068 } 2069 break; 2070 default: 2071 SPPP_LOG(sp, LOG_DEBUG, 2072 "%s illegal RCR+ in state %s\n", cp->name, 2073 sppp_state_name(sp->scp[cp->protoidx].state)); 2074 if_statinc(ifp, if_ierrors); 2075 } 2076 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2077 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2078 /* RCR- event */ 2079 switch (sp->scp[cp->protoidx].state) { 2080 case STATE_OPENED: 2081 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2082 cp->tld(sp); 2083 cp->scr(sp); 2084 cp->screply(cp, sp, ctype, ident, msglen, msg); 2085 break; 2086 case STATE_ACK_SENT: 2087 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2088 /* fall through */ 2089 case STATE_REQ_SENT: 2090 cp->screply(cp, sp, ctype, ident, msglen, msg); 2091 break; 2092 case STATE_STOPPED: 2093 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2094 cp->scr(sp); 2095 cp->screply(cp, sp, ctype, ident, msglen, msg); 2096 break; 2097 case STATE_ACK_RCVD: 2098 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2099 cp->screply(cp, sp, ctype, ident, msglen, msg); 2100 break; 2101 case STATE_CLOSING: 2102 case STATE_STOPPING: 2103 break; 2104 case STATE_CLOSED: 2105 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2106 if ((cp->flags & CP_AUTH) == 0) { 2107 sppp_cp_send(sp, cp->proto, TERM_ACK, 2108 ident, 0, 0); 2109 } 2110 break; 2111 default: 2112 SPPP_LOG(sp, LOG_DEBUG, 2113 "%s illegal RCR- in state %s\n", cp->name, 2114 sppp_state_name(sp->scp[cp->protoidx].state)); 2115 if_statinc(ifp, if_ierrors); 2116 } 2117 } 2118 } 2119 2120 static void 2121 sppp_rcr_event(struct sppp *sp, void *xcp) 2122 { 2123 const struct cp *cp = xcp; 2124 struct sppp_cp *scp; 2125 struct lcp_header *h; 2126 struct mbuf *m; 2127 enum cp_rcr_type type; 2128 size_t len; 2129 uint8_t *buf; 2130 size_t blen, rlen; 2131 uint8_t ident; 2132 2133 KASSERT(!cpu_softintr_p()); 2134 2135 scp = &sp->scp[cp->protoidx]; 2136 2137 if (cp->parse_confreq != NULL) { 2138 m = scp->mbuf_confreq; 2139 if (m == NULL) 2140 return; 2141 scp->mbuf_confreq = NULL; 2142 2143 h = mtod(m, struct lcp_header *); 2144 if (h->type != CONF_REQ) { 2145 m_freem(m); 2146 return; 2147 } 2148 2149 ident = h->ident; 2150 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2151 2152 type = (cp->parse_confreq)(sp, h, len, 2153 &buf, &blen, &rlen); 2154 m_freem(m); 2155 } else { 2156 /* mbuf_cofreq is already parsed and freed */ 2157 type = scp->rcr_type; 2158 ident = scp->rconfid; 2159 buf = NULL; 2160 blen = rlen = 0; 2161 } 2162 2163 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2164 2165 if (buf != NULL) 2166 kmem_free(buf, blen); 2167 } 2168 2169 static void 2170 sppp_rca_event(struct sppp *sp, void *xcp) 2171 { 2172 struct ifnet *ifp; 2173 const struct cp *cp = xcp; 2174 2175 KASSERT(!cpu_softintr_p()); 2176 2177 ifp = &sp->pp_if; 2178 2179 switch (sp->scp[cp->protoidx].state) { 2180 case STATE_CLOSED: 2181 case STATE_STOPPED: 2182 if ((cp->flags & CP_AUTH) == 0) { 2183 sppp_cp_send(sp, cp->proto, TERM_ACK, 2184 sp->scp[cp->protoidx].rconfid, 0, 0); 2185 } 2186 break; 2187 case STATE_CLOSING: 2188 case STATE_STOPPING: 2189 break; 2190 case STATE_REQ_SENT: 2191 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2192 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2193 break; 2194 case STATE_OPENED: 2195 (cp->tld)(sp); 2196 /* fall through */ 2197 case STATE_ACK_RCVD: 2198 (cp->scr)(sp); 2199 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2200 break; 2201 case STATE_ACK_SENT: 2202 sppp_cp_change_state(cp, sp, STATE_OPENED); 2203 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2204 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2205 (cp->tlu)(sp); 2206 break; 2207 default: 2208 SPPP_LOG(sp, LOG_DEBUG, 2209 "%s illegal RCA in state %s\n", cp->name, 2210 sppp_state_name(sp->scp[cp->protoidx].state)); 2211 if_statinc(ifp, if_ierrors); 2212 } 2213 } 2214 2215 static void 2216 sppp_rcn_event(struct sppp *sp, void *xcp) 2217 { 2218 const struct cp *cp = xcp; 2219 struct sppp_cp *scp; 2220 struct lcp_header *h; 2221 struct mbuf *m; 2222 struct ifnet *ifp = &sp->pp_if; 2223 size_t len; 2224 2225 KASSERT(!cpu_softintr_p()); 2226 2227 scp = &sp->scp[cp->protoidx]; 2228 m = scp->mbuf_confnak; 2229 if (m == NULL) 2230 return; 2231 scp->mbuf_confnak = NULL; 2232 2233 h = mtod(m, struct lcp_header *); 2234 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2235 2236 switch (h->type) { 2237 case CONF_NAK: 2238 (cp->parse_confnak)(sp, h, len); 2239 break; 2240 case CONF_REJ: 2241 (cp->parse_confrej)(sp, h, len); 2242 break; 2243 default: 2244 m_freem(m); 2245 return; 2246 } 2247 2248 m_freem(m); 2249 2250 switch (scp->state) { 2251 case STATE_CLOSED: 2252 case STATE_STOPPED: 2253 if ((cp->flags & CP_AUTH) == 0) { 2254 sppp_cp_send(sp, cp->proto, TERM_ACK, 2255 scp->rconfid, 0, 0); 2256 } 2257 break; 2258 case STATE_REQ_SENT: 2259 case STATE_ACK_SENT: 2260 scp->rst_counter = sp->lcp.max_configure; 2261 (cp->scr)(sp); 2262 break; 2263 case STATE_OPENED: 2264 (cp->tld)(sp); 2265 /* fall through */ 2266 case STATE_ACK_RCVD: 2267 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2268 (cp->scr)(sp); 2269 break; 2270 case STATE_CLOSING: 2271 case STATE_STOPPING: 2272 break; 2273 default: 2274 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n", 2275 cp->name, sppp_state_name(scp->state)); 2276 if_statinc(ifp, if_ierrors); 2277 } 2278 } 2279 2280 static void 2281 sppp_rtr_event(struct sppp *sp, void *xcp) 2282 { 2283 struct ifnet *ifp; 2284 const struct cp *cp = xcp; 2285 2286 KASSERT(!cpu_softintr_p()); 2287 2288 ifp = &sp->pp_if; 2289 2290 switch (sp->scp[cp->protoidx].state) { 2291 case STATE_ACK_RCVD: 2292 case STATE_ACK_SENT: 2293 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2294 break; 2295 case STATE_CLOSED: 2296 case STATE_STOPPED: 2297 case STATE_CLOSING: 2298 case STATE_STOPPING: 2299 case STATE_REQ_SENT: 2300 break; 2301 case STATE_OPENED: 2302 (cp->tld)(sp); 2303 sp->scp[cp->protoidx].rst_counter = 0; 2304 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2305 break; 2306 default: 2307 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n", 2308 cp->name, 2309 sppp_state_name(sp->scp[cp->protoidx].state)); 2310 if_statinc(ifp, if_ierrors); 2311 return; 2312 } 2313 2314 /* Send Terminate-Ack packet. */ 2315 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name); 2316 if ((cp->flags & CP_AUTH) == 0) { 2317 sppp_cp_send(sp, cp->proto, TERM_ACK, 2318 sp->scp[cp->protoidx].rseq, 0, 0); 2319 } 2320 } 2321 2322 static void 2323 sppp_rta_event(struct sppp *sp, void *xcp) 2324 { 2325 const struct cp *cp = xcp; 2326 struct ifnet *ifp = &sp->pp_if; 2327 2328 KASSERT(!cpu_softintr_p()); 2329 2330 switch (sp->scp[cp->protoidx].state) { 2331 case STATE_CLOSED: 2332 case STATE_STOPPED: 2333 case STATE_REQ_SENT: 2334 case STATE_ACK_SENT: 2335 break; 2336 case STATE_CLOSING: 2337 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2338 (cp->tlf)(cp, sp); 2339 break; 2340 case STATE_STOPPING: 2341 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2342 (cp->tlf)(cp, sp); 2343 break; 2344 case STATE_ACK_RCVD: 2345 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2346 break; 2347 case STATE_OPENED: 2348 (cp->tld)(sp); 2349 (cp->scr)(sp); 2350 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2351 break; 2352 default: 2353 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n", 2354 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2355 if_statinc(ifp, if_ierrors); 2356 } 2357 } 2358 2359 static void 2360 sppp_rxj_event(struct sppp *sp, void *xcp) 2361 { 2362 const struct cp *cp = xcp; 2363 struct ifnet *ifp = &sp->pp_if; 2364 2365 KASSERT(!cpu_softintr_p()); 2366 2367 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2368 switch (sp->scp[cp->protoidx].state) { 2369 case STATE_CLOSED: 2370 case STATE_STOPPED: 2371 case STATE_REQ_SENT: 2372 case STATE_ACK_SENT: 2373 case STATE_CLOSING: 2374 case STATE_STOPPING: 2375 case STATE_OPENED: 2376 break; 2377 case STATE_ACK_RCVD: 2378 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2379 break; 2380 default: 2381 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n", 2382 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2383 if_statinc(ifp, if_ierrors); 2384 } 2385 } 2386 2387 /* 2388 * Change the state of a control protocol in the state automaton. 2389 * Takes care of starting/stopping the restart timer. 2390 */ 2391 void 2392 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2393 { 2394 2395 KASSERT(SPPP_WLOCKED(sp)); 2396 2397 sp->scp[cp->protoidx].state = newstate; 2398 callout_stop(&sp->scp[cp->protoidx].ch); 2399 switch (newstate) { 2400 case STATE_INITIAL: 2401 case STATE_STARTING: 2402 case STATE_CLOSED: 2403 case STATE_STOPPED: 2404 case STATE_OPENED: 2405 break; 2406 case STATE_CLOSING: 2407 case STATE_STOPPING: 2408 case STATE_REQ_SENT: 2409 case STATE_ACK_RCVD: 2410 case STATE_ACK_SENT: 2411 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2412 break; 2413 } 2414 } 2415 2416 /* 2417 *--------------------------------------------------------------------------* 2418 * * 2419 * The LCP implementation. * 2420 * * 2421 *--------------------------------------------------------------------------* 2422 */ 2423 static void 2424 sppp_lcp_init(struct sppp *sp) 2425 { 2426 2427 KASSERT(SPPP_WLOCKED(sp)); 2428 2429 sppp_cp_init(&lcp, sp); 2430 2431 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2432 sp->lcp.magic = 0; 2433 sp->lcp.protos = 0; 2434 sp->lcp.max_terminate = 2; 2435 sp->lcp.max_configure = 10; 2436 sp->lcp.max_failure = 10; 2437 sp->lcp.tlf_sent = false; 2438 2439 /* 2440 * Initialize counters and timeout values. Note that we don't 2441 * use the 3 seconds suggested in RFC 1661 since we are likely 2442 * running on a fast link. XXX We should probably implement 2443 * the exponential backoff option. Note that these values are 2444 * relevant for all control protocols, not just LCP only. 2445 */ 2446 sp->lcp.timeout = 1 * hz; 2447 } 2448 2449 static void 2450 sppp_lcp_up(struct sppp *sp, void *xcp) 2451 { 2452 struct ifnet *ifp; 2453 const struct cp *cp = xcp; 2454 int pidx; 2455 2456 KASSERT(SPPP_WLOCKED(sp)); 2457 ifp = &sp->pp_if; 2458 2459 pidx = cp->protoidx; 2460 /* Initialize activity timestamp: opening a connection is an activity */ 2461 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2462 2463 /* 2464 * If this interface is passive or dial-on-demand, and we are 2465 * still in Initial state, it means we've got an incoming 2466 * call. Activate the interface. 2467 */ 2468 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2469 ifp->if_flags |= IFF_RUNNING; 2470 if (sp->scp[pidx].state == STATE_INITIAL) { 2471 SPPP_DLOG(sp, "Up event (incoming call)\n"); 2472 sp->pp_flags |= PP_CALLIN; 2473 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2474 } else { 2475 SPPP_DLOG(sp, "Up event\n"); 2476 } 2477 } 2478 2479 sppp_up_event(sp, xcp); 2480 } 2481 2482 static void 2483 sppp_lcp_down(struct sppp *sp, void *xcp) 2484 { 2485 const struct cp *cp = xcp; 2486 struct ifnet *ifp; 2487 int pidx; 2488 2489 KASSERT(SPPP_WLOCKED(sp)); 2490 KASSERT(!cpu_softintr_p()); 2491 2492 ifp = &sp->pp_if; 2493 pidx = cp->protoidx; 2494 sppp_down_event(sp, xcp); 2495 2496 /* 2497 * We need to do tls to restart when a down event is caused 2498 * by the last tlf. 2499 */ 2500 if (sp->scp[pidx].state == STATE_STARTING && 2501 sp->lcp.tlf_sent) { 2502 cp->tls(cp, sp); 2503 sp->lcp.tlf_sent = false; 2504 } 2505 2506 SPPP_DLOG(sp, "Down event (carrier loss)\n"); 2507 2508 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2509 if (sp->lcp.reestablish) 2510 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2511 } else { 2512 sp->pp_flags &= ~PP_CALLIN; 2513 if (sp->scp[pidx].state != STATE_INITIAL) 2514 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2515 ifp->if_flags &= ~IFF_RUNNING; 2516 } 2517 sp->scp[pidx].fail_counter = 0; 2518 } 2519 2520 static void 2521 sppp_lcp_open(struct sppp *sp, void *xcp) 2522 { 2523 2524 KASSERT(SPPP_WLOCKED(sp)); 2525 KASSERT(!cpu_softintr_p()); 2526 2527 sp->lcp.reestablish = false; 2528 sp->scp[IDX_LCP].fail_counter = 0; 2529 2530 /* the interface was down while waiting for reconnection */ 2531 if ((sp->pp_flags & PP_ADMIN_UP) == 0) 2532 return; 2533 2534 if (sp->pp_if.if_mtu < PP_MTU) { 2535 sp->lcp.mru = sp->pp_if.if_mtu; 2536 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2537 } else { 2538 sp->lcp.mru = PP_MTU; 2539 } 2540 sp->lcp.their_mru = PP_MTU; 2541 2542 /* 2543 * If we are authenticator, negotiate LCP_AUTH 2544 */ 2545 if (sp->hisauth.proto != PPP_NOPROTO) 2546 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2547 else 2548 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2549 sp->pp_flags &= ~PP_NEEDAUTH; 2550 sppp_open_event(sp, xcp); 2551 } 2552 2553 2554 /* 2555 * Analyze a configure request. Return true if it was agreeable, and 2556 * caused action sca, false if it has been rejected or nak'ed, and 2557 * caused action scn. (The return value is used to make the state 2558 * transition decision in the state automaton.) 2559 */ 2560 static enum cp_rcr_type 2561 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2562 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2563 { 2564 u_char *buf, *r, *p, l, blen; 2565 enum cp_rcr_type type; 2566 int len, rlen; 2567 uint32_t nmagic; 2568 u_short authproto; 2569 char lbuf[SPPP_LCPOPT_NAMELEN]; 2570 bool debug; 2571 2572 KASSERT(SPPP_WLOCKED(sp)); 2573 2574 debug = sppp_debug_enabled(sp); 2575 2576 if (origlen < sizeof(*h)) 2577 return CP_RCR_DROP; 2578 2579 origlen -= sizeof(*h); 2580 type = CP_RCR_NONE; 2581 type = 0; 2582 2583 if (origlen <= 0) 2584 return CP_RCR_DROP; 2585 else 2586 blen = origlen; 2587 2588 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2589 if (buf == NULL) 2590 return CP_RCR_DROP; 2591 2592 if (debug) 2593 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:"); 2594 2595 /* pass 1: check for things that need to be rejected */ 2596 p = (void *)(h + 1); 2597 r = buf; 2598 rlen = 0; 2599 for (len = origlen; len > 1; len-= l, p += l) { 2600 l = p[1]; 2601 if (l == 0) 2602 break; 2603 2604 /* Sanity check option length */ 2605 if (l > len) { 2606 /* 2607 * Malicious option - drop immediately. 2608 * XXX Maybe we should just RXJ it? 2609 */ 2610 if (debug) 2611 addlog("\n"); 2612 2613 SPPP_LOG(sp, LOG_DEBUG, 2614 "received malicious LCP option 0x%02x, " 2615 "length 0x%02x, (len: 0x%02x) dropping.\n", 2616 p[0], l, len); 2617 type = CP_RCR_ERR; 2618 goto end; 2619 } 2620 if (debug) 2621 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2622 switch (p[0]) { 2623 case LCP_OPT_MAGIC: 2624 /* Magic number. */ 2625 /* fall through, both are same length */ 2626 case LCP_OPT_ASYNC_MAP: 2627 /* Async control character map. */ 2628 if (len >= 6 || l == 6) 2629 continue; 2630 if (debug) 2631 addlog(" [invalid]"); 2632 break; 2633 case LCP_OPT_MP_EID: 2634 if (len >= l && l >= 3) { 2635 switch (p[2]) { 2636 case 0: if (l==3+ 0) continue;break; 2637 case 2: if (l==3+ 4) continue;break; 2638 case 3: if (l==3+ 6) continue;break; 2639 case 6: if (l==3+16) continue;break; 2640 case 1: /* FALLTHROUGH */ 2641 case 4: if (l<=3+20) continue;break; 2642 case 5: if (l<=3+15) continue;break; 2643 /* XXX should it be default: continue;? */ 2644 } 2645 } 2646 if (debug) 2647 addlog(" [invalid class %d len %d]", p[2], l); 2648 break; 2649 case LCP_OPT_MP_SSNHF: 2650 if (len >= 2 && l == 2) { 2651 if (debug) 2652 addlog(" [rej]"); 2653 break; 2654 } 2655 if (debug) 2656 addlog(" [invalid]"); 2657 break; 2658 case LCP_OPT_MP_MRRU: 2659 /* Multilink maximum received reconstructed unit */ 2660 /* should be fall through, both are same length */ 2661 /* FALLTHROUGH */ 2662 case LCP_OPT_MRU: 2663 /* Maximum receive unit. */ 2664 if (len >= 4 && l == 4) 2665 continue; 2666 if (debug) 2667 addlog(" [invalid]"); 2668 break; 2669 case LCP_OPT_AUTH_PROTO: 2670 if (len < 4) { 2671 if (debug) 2672 addlog(" [invalid]"); 2673 break; 2674 } 2675 authproto = (p[2] << 8) + p[3]; 2676 if (authproto == PPP_CHAP && l != 5) { 2677 if (debug) 2678 addlog(" [invalid chap len]"); 2679 break; 2680 } 2681 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2682 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2683 sp->myauth.proto = authproto; 2684 } 2685 if (sp->myauth.proto == PPP_NOPROTO) { 2686 /* we are not configured to do auth */ 2687 if (debug) 2688 addlog(" [not configured]"); 2689 break; 2690 } 2691 /* 2692 * Remote want us to authenticate, remember this, 2693 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2694 * up. 2695 */ 2696 sp->pp_flags |= PP_NEEDAUTH; 2697 continue; 2698 default: 2699 /* Others not supported. */ 2700 if (debug) 2701 addlog(" [rej]"); 2702 break; 2703 } 2704 if (rlen + l > blen) { 2705 if (debug) 2706 addlog(" [overflow]"); 2707 continue; 2708 } 2709 /* Add the option to rejected list. */ 2710 memcpy(r, p, l); 2711 r += l; 2712 rlen += l; 2713 } 2714 2715 if (rlen > 0) { 2716 type = CP_RCR_REJ; 2717 goto end; 2718 } 2719 2720 if (debug) 2721 addlog("\n"); 2722 2723 /* 2724 * pass 2: check for option values that are unacceptable and 2725 * thus require to be nak'ed. 2726 */ 2727 if (debug) 2728 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:"); 2729 2730 p = (void *)(h + 1); 2731 r = buf; 2732 rlen = 0; 2733 for (len = origlen; len > 0; len -= l, p += l) { 2734 l = p[1]; 2735 if (l == 0) 2736 break; 2737 2738 if (debug) 2739 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2740 switch (p[0]) { 2741 case LCP_OPT_MAGIC: 2742 /* Magic number -- extract. */ 2743 nmagic = (uint32_t)p[2] << 24 | 2744 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2745 if (nmagic != sp->lcp.magic) { 2746 if (debug) 2747 addlog(" 0x%x", nmagic); 2748 continue; 2749 } 2750 /* 2751 * Local and remote magics equal -- loopback? 2752 */ 2753 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2754 SPPP_DLOG(sp, "loopback\n"); 2755 sp->pp_loopcnt = 0; 2756 2757 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 2758 sp->pp_flags |= PP_LOOPBACK; 2759 sppp_wq_add(sp->wq_cp, 2760 &sp->work_ifdown); 2761 } 2762 2763 sppp_wq_add(sp->wq_cp, 2764 &sp->scp[IDX_LCP].work_close); 2765 sppp_wq_add(sp->wq_cp, 2766 &sp->scp[IDX_LCP].work_open); 2767 } else { 2768 if (debug) 2769 addlog(" [glitch]"); 2770 ++sp->pp_loopcnt; 2771 } 2772 /* 2773 * We negate our magic here, and NAK it. If 2774 * we see it later in an NAK packet, we 2775 * suggest a new one. 2776 */ 2777 nmagic = ~sp->lcp.magic; 2778 /* Gonna NAK it. */ 2779 p[2] = nmagic >> 24; 2780 p[3] = nmagic >> 16; 2781 p[4] = nmagic >> 8; 2782 p[5] = nmagic; 2783 break; 2784 2785 case LCP_OPT_ASYNC_MAP: 2786 /* 2787 * Async control character map -- just ignore it. 2788 * 2789 * Quote from RFC 1662, chapter 6: 2790 * To enable this functionality, synchronous PPP 2791 * implementations MUST always respond to the 2792 * Async-Control-Character-Map Configuration 2793 * Option with the LCP Configure-Ack. However, 2794 * acceptance of the Configuration Option does 2795 * not imply that the synchronous implementation 2796 * will do any ACCM mapping. Instead, all such 2797 * octet mapping will be performed by the 2798 * asynchronous-to-synchronous converter. 2799 */ 2800 continue; 2801 2802 case LCP_OPT_MRU: 2803 /* 2804 * Maximum receive unit. Always agreeable, 2805 * but ignored by now. 2806 */ 2807 sp->lcp.their_mru = p[2] * 256 + p[3]; 2808 if (debug) 2809 addlog(" %ld", sp->lcp.their_mru); 2810 continue; 2811 2812 case LCP_OPT_AUTH_PROTO: 2813 authproto = (p[2] << 8) + p[3]; 2814 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2815 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2816 sp->myauth.proto = authproto; 2817 } 2818 if (sp->myauth.proto == authproto) { 2819 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 2820 continue; 2821 } 2822 if (debug) 2823 addlog(" [chap without MD5]"); 2824 } else { 2825 if (debug) { 2826 char pbuf1[SPPP_PROTO_NAMELEN]; 2827 char pbuf2[SPPP_PROTO_NAMELEN]; 2828 const char *pname1, *pname2; 2829 2830 pname1 = sppp_proto_name(pbuf1, 2831 sizeof(pbuf1), sp->myauth.proto); 2832 pname2 = sppp_proto_name(pbuf2, 2833 sizeof(pbuf2), authproto); 2834 addlog(" [mine %s != his %s]", 2835 pname1, pname2); 2836 } 2837 } 2838 /* not agreed, nak */ 2839 if (sp->myauth.proto == PPP_CHAP) { 2840 l = 5; 2841 } else { 2842 l = 4; 2843 } 2844 2845 if (rlen + l > blen) { 2846 if (debug) 2847 addlog(" [overflow]"); 2848 continue; 2849 } 2850 2851 r[0] = LCP_OPT_AUTH_PROTO; 2852 r[1] = l; 2853 r[2] = sp->myauth.proto >> 8; 2854 r[3] = sp->myauth.proto & 0xff; 2855 if (sp->myauth.proto == PPP_CHAP) 2856 r[4] = CHAP_MD5; 2857 rlen += l; 2858 r += l; 2859 continue; 2860 case LCP_OPT_MP_EID: 2861 /* 2862 * Endpoint identification. 2863 * Always agreeable, 2864 * but ignored by now. 2865 */ 2866 if (debug) { 2867 addlog(" type %d", p[2]); 2868 sppp_print_bytes(p+3, p[1]-3); 2869 } 2870 continue; 2871 case LCP_OPT_MP_MRRU: 2872 /* 2873 * Maximum received reconstructed unit. 2874 * Always agreeable, 2875 * but ignored by now. 2876 */ 2877 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2878 if (debug) 2879 addlog(" %ld", sp->lcp.their_mrru); 2880 continue; 2881 } 2882 if (rlen + l > blen) { 2883 if (debug) 2884 addlog(" [overflow]"); 2885 continue; 2886 } 2887 /* Add the option to nak'ed list. */ 2888 memcpy(r, p, l); 2889 r += l; 2890 rlen += l; 2891 } 2892 2893 if (rlen > 0) { 2894 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2895 if (debug) 2896 addlog(" max_failure (%d) exceeded, ", 2897 sp->lcp.max_failure); 2898 type = CP_RCR_REJ; 2899 } else { 2900 type = CP_RCR_NAK; 2901 } 2902 } else { 2903 type = CP_RCR_ACK; 2904 rlen = origlen; 2905 memcpy(r, h + 1, rlen); 2906 sp->scp[IDX_LCP].fail_counter = 0; 2907 sp->pp_loopcnt = 0; 2908 } 2909 2910 end: 2911 if (debug) 2912 addlog("\n"); 2913 2914 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 2915 if (buf != NULL) 2916 kmem_intr_free(buf, blen); 2917 } else { 2918 *msgbuf = buf; 2919 *buflen = blen; 2920 *msglen = rlen; 2921 } 2922 2923 return type; 2924 } 2925 2926 /* 2927 * Analyze the LCP Configure-Reject option list, and adjust our 2928 * negotiation. 2929 */ 2930 static void 2931 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 2932 { 2933 u_char *p, l; 2934 bool debug; 2935 2936 KASSERT(SPPP_WLOCKED(sp)); 2937 2938 debug = sppp_debug_enabled(sp); 2939 2940 if (len <= sizeof(*h)) 2941 return; 2942 2943 len -= sizeof(*h); 2944 2945 if (debug) 2946 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:"); 2947 2948 p = (void *)(h + 1); 2949 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2950 /* Sanity check option length */ 2951 if (l > len) { 2952 /* 2953 * Malicious option - drop immediately. 2954 * XXX Maybe we should just RXJ it? 2955 */ 2956 if (debug) 2957 addlog("\n"); 2958 2959 SPPP_LOG(sp, LOG_DEBUG, 2960 "received malicious LCP option, dropping.\n"); 2961 goto end; 2962 } 2963 if (debug) { 2964 char lbuf[SPPP_LCPOPT_NAMELEN]; 2965 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2966 } 2967 switch (p[0]) { 2968 case LCP_OPT_MAGIC: 2969 /* Magic number -- can't use it, use 0 */ 2970 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2971 sp->lcp.magic = 0; 2972 break; 2973 case LCP_OPT_MRU: 2974 /* 2975 * We try to negotiate a lower MRU if the underlying 2976 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2977 * peer rejects this lower rate, fallback to the 2978 * default. 2979 */ 2980 if (!debug) { 2981 SPPP_LOG(sp, LOG_INFO, 2982 "peer rejected our MRU of " 2983 "%ld bytes. Defaulting to %d bytes\n", 2984 sp->lcp.mru, PP_MTU); 2985 } 2986 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2987 sp->lcp.mru = PP_MTU; 2988 break; 2989 case LCP_OPT_AUTH_PROTO: 2990 /* 2991 * Peer doesn't want to authenticate himself, 2992 * deny unless this is a dialout call, and 2993 * SPPP_AUTHFLAG_NOCALLOUT is set. 2994 */ 2995 if ((sp->pp_flags & PP_CALLIN) == 0 && 2996 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2997 if (debug) { 2998 addlog(" [don't insist on auth " 2999 "for callout]"); 3000 } 3001 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3002 break; 3003 } 3004 if (debug) 3005 addlog("[access denied]\n"); 3006 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3007 break; 3008 } 3009 } 3010 if (debug) 3011 addlog("\n"); 3012 end: 3013 return; 3014 } 3015 3016 /* 3017 * Analyze the LCP Configure-NAK option list, and adjust our 3018 * negotiation. 3019 */ 3020 static void 3021 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3022 { 3023 u_char *p, l; 3024 uint32_t magic; 3025 bool debug; 3026 3027 KASSERT(SPPP_WLOCKED(sp)); 3028 3029 if (len <= sizeof(*h)) 3030 return; 3031 3032 debug = sppp_debug_enabled(sp); 3033 len -= sizeof(*h); 3034 3035 if (debug) 3036 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:"); 3037 3038 p = (void *)(h + 1); 3039 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3040 /* Sanity check option length */ 3041 if (l > len) { 3042 /* 3043 * Malicious option - drop immediately. 3044 * XXX Maybe we should just RXJ it? 3045 */ 3046 if (debug) 3047 addlog("\n"); 3048 3049 SPPP_LOG(sp, LOG_DEBUG, 3050 "received malicious LCP option, dropping.\n"); 3051 goto end; 3052 } 3053 if (debug) { 3054 char lbuf[SPPP_LCPOPT_NAMELEN]; 3055 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 3056 } 3057 switch (p[0]) { 3058 case LCP_OPT_MAGIC: 3059 /* Magic number -- renegotiate */ 3060 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3061 len >= 6 && l == 6) { 3062 magic = (uint32_t)p[2] << 24 | 3063 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3064 /* 3065 * If the remote magic is our negated one, 3066 * this looks like a loopback problem. 3067 * Suggest a new magic to make sure. 3068 */ 3069 if (magic == ~sp->lcp.magic) { 3070 if (debug) 3071 addlog(" magic glitch"); 3072 sp->lcp.magic = cprng_fast32(); 3073 } else { 3074 sp->lcp.magic = magic; 3075 if (debug) 3076 addlog(" %d", magic); 3077 } 3078 } 3079 break; 3080 case LCP_OPT_MRU: 3081 /* 3082 * Peer wants to advise us to negotiate an MRU. 3083 * Agree on it if it's reasonable, or use 3084 * default otherwise. 3085 */ 3086 if (len >= 4 && l == 4) { 3087 u_int mru = p[2] * 256 + p[3]; 3088 if (debug) 3089 addlog(" %d", mru); 3090 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3091 mru = sp->pp_if.if_mtu; 3092 sp->lcp.mru = mru; 3093 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3094 } 3095 break; 3096 case LCP_OPT_AUTH_PROTO: 3097 /* 3098 * Peer doesn't like our authentication method, 3099 * deny. 3100 */ 3101 if (debug) 3102 addlog("[access denied]\n"); 3103 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3104 break; 3105 } 3106 } 3107 if (debug) 3108 addlog("\n"); 3109 end: 3110 return; 3111 } 3112 3113 static void 3114 sppp_lcp_tlu(struct sppp *sp) 3115 { 3116 struct ifnet *ifp; 3117 int i; 3118 bool going_up; 3119 3120 KASSERT(SPPP_WLOCKED(sp)); 3121 3122 ifp = &sp->pp_if; 3123 3124 /* unlock for IFNET_LOCK and if_up() */ 3125 SPPP_UNLOCK(sp); 3126 3127 if (! (ifp->if_flags & IFF_UP) && 3128 (ifp->if_flags & IFF_RUNNING)) { 3129 /* Coming out of loopback mode. */ 3130 going_up = true; 3131 if_up(ifp); 3132 } else { 3133 going_up = false; 3134 } 3135 3136 IFNET_LOCK(ifp); 3137 SPPP_LOCK(sp, RW_WRITER); 3138 3139 if (going_up) { 3140 if ((sp->pp_flags & PP_LOOPBACK) == 0) { 3141 SPPP_LOG(sp, LOG_DEBUG, 3142 "interface is going up, " 3143 "but no loopback packet is deteted\n"); 3144 } 3145 sp->pp_flags &= ~PP_LOOPBACK; 3146 } 3147 3148 if (ifp->if_mtu > sp->lcp.their_mru) { 3149 sp->pp_saved_mtu = ifp->if_mtu; 3150 ifp->if_mtu = sp->lcp.their_mru; 3151 SPPP_DLOG(sp, "setting MTU " 3152 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3153 sp->pp_saved_mtu, ifp->if_mtu); 3154 } 3155 IFNET_UNLOCK(ifp); 3156 3157 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3158 (sp->pp_flags & PP_NEEDAUTH) != 0) 3159 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3160 else 3161 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3162 3163 /* 3164 * Open all authentication protocols. This is even required 3165 * if we already proceeded to network phase, since it might be 3166 * that remote wants us to authenticate, so we might have to 3167 * send a PAP request. Undesired authentication protocols 3168 * don't do anything when they get an Open event. 3169 */ 3170 for (i = 0; i < IDX_COUNT; i++) 3171 if ((cps[i])->flags & CP_AUTH) { 3172 sppp_wq_add(sp->wq_cp, 3173 &sp->scp[(cps[i])->protoidx].work_open); 3174 } 3175 3176 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 3177 /* Notify all NCPs. */ 3178 for (i = 0; i < IDX_COUNT; i++) 3179 if ((cps[i])->flags & CP_NCP) { 3180 sppp_wq_add(sp->wq_cp, 3181 &sp->scp[(cps[i])->protoidx].work_open); 3182 } 3183 } 3184 3185 /* notify low-level driver of state change */ 3186 sppp_notify_chg_wlocked(sp); 3187 } 3188 3189 static void 3190 sppp_lcp_tld(struct sppp *sp) 3191 { 3192 struct ifnet *ifp; 3193 int i, pi, phase; 3194 3195 KASSERT(SPPP_WLOCKED(sp)); 3196 3197 phase = sp->pp_phase; 3198 3199 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3200 3201 if (sp->pp_saved_mtu > 0) { 3202 ifp = &sp->pp_if; 3203 3204 SPPP_UNLOCK(sp); 3205 IFNET_LOCK(ifp); 3206 SPPP_LOCK(sp, RW_WRITER); 3207 3208 SPPP_DLOG(sp, "setting MTU " 3209 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3210 ifp->if_mtu, sp->pp_saved_mtu); 3211 3212 ifp->if_mtu = sp->pp_saved_mtu; 3213 sp->pp_saved_mtu = 0; 3214 IFNET_UNLOCK(ifp); 3215 } 3216 3217 /* 3218 * Take upper layers down. We send the Down event first and 3219 * the Close second to prevent the upper layers from sending 3220 * ``a flurry of terminate-request packets'', as the RFC 3221 * describes it. 3222 */ 3223 for (i = 0; i < IDX_COUNT; i++) { 3224 pi = (cps[i])->protoidx; 3225 if (((cps[i])->flags & CP_LCP) == 0) { 3226 /* skip if ncp was not started */ 3227 if (phase != SPPP_PHASE_NETWORK && 3228 ((cps[i])->flags & CP_NCP) != 0) 3229 continue; 3230 3231 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_down); 3232 sppp_wq_add(sp->wq_cp, &sp->scp[pi].work_close); 3233 } 3234 } 3235 } 3236 3237 static void 3238 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3239 { 3240 3241 KASSERT(SPPP_WLOCKED(sp)); 3242 3243 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3244 3245 /* Notify lower layer if desired. */ 3246 sppp_notify_tls_wlocked(sp); 3247 sp->lcp.tlf_sent = false; 3248 } 3249 3250 static void 3251 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3252 { 3253 3254 KASSERT(SPPP_WLOCKED(sp)); 3255 3256 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3257 3258 /* Notify lower layer if desired. */ 3259 sppp_notify_tlf_wlocked(sp); 3260 3261 switch (sp->scp[IDX_LCP].state) { 3262 case STATE_CLOSED: 3263 case STATE_STOPPED: 3264 sp->lcp.tlf_sent = true; 3265 break; 3266 case STATE_INITIAL: 3267 default: 3268 /* just in case */ 3269 sp->lcp.tlf_sent = false; 3270 } 3271 } 3272 3273 static void 3274 sppp_lcp_scr(struct sppp *sp) 3275 { 3276 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3277 int i = 0; 3278 u_short authproto; 3279 3280 KASSERT(SPPP_WLOCKED(sp)); 3281 3282 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3283 if (! sp->lcp.magic) 3284 sp->lcp.magic = cprng_fast32(); 3285 opt[i++] = LCP_OPT_MAGIC; 3286 opt[i++] = 6; 3287 opt[i++] = sp->lcp.magic >> 24; 3288 opt[i++] = sp->lcp.magic >> 16; 3289 opt[i++] = sp->lcp.magic >> 8; 3290 opt[i++] = sp->lcp.magic; 3291 } 3292 3293 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3294 opt[i++] = LCP_OPT_MRU; 3295 opt[i++] = 4; 3296 opt[i++] = sp->lcp.mru >> 8; 3297 opt[i++] = sp->lcp.mru; 3298 } 3299 3300 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3301 authproto = sp->hisauth.proto; 3302 opt[i++] = LCP_OPT_AUTH_PROTO; 3303 opt[i++] = authproto == PPP_CHAP? 5: 4; 3304 opt[i++] = authproto >> 8; 3305 opt[i++] = authproto; 3306 if (authproto == PPP_CHAP) 3307 opt[i++] = CHAP_MD5; 3308 } 3309 3310 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3311 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3312 } 3313 3314 /* 3315 * Check the open NCPs, return true if at least one NCP is open. 3316 */ 3317 3318 static int 3319 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3320 { 3321 int i, mask; 3322 3323 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3324 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3325 return 1; 3326 return 0; 3327 } 3328 3329 /* 3330 * Re-check the open NCPs and see if we should terminate the link. 3331 * Called by the NCPs during their tlf action handling. 3332 */ 3333 static void 3334 sppp_lcp_check_and_close(struct sppp *sp) 3335 { 3336 3337 KASSERT(SPPP_WLOCKED(sp)); 3338 3339 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3340 /* don't bother, we are already going down */ 3341 return; 3342 } 3343 3344 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3345 sppp_cp_check(sp, CP_AUTH)) 3346 return; 3347 3348 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3349 sppp_cp_check(sp, CP_NCP)) 3350 return; 3351 3352 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3353 3354 if (sp->pp_max_auth_fail != 0 && 3355 sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3356 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, " 3357 "not retrying again\n", sp->pp_auth_failures); 3358 3359 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 3360 sp->pp_if.if_flags &= ~IFF_RUNNING; 3361 } else { 3362 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3363 } 3364 } 3365 3366 /* 3367 *--------------------------------------------------------------------------* 3368 * * 3369 * The IPCP implementation. * 3370 * * 3371 *--------------------------------------------------------------------------* 3372 */ 3373 3374 static void 3375 sppp_ipcp_init(struct sppp *sp) 3376 { 3377 3378 KASSERT(SPPP_WLOCKED(sp)); 3379 3380 sppp_cp_init(&ipcp, sp); 3381 3382 sp->ipcp.opts = 0; 3383 sp->ipcp.flags = 0; 3384 } 3385 3386 static void 3387 sppp_ipcp_open(struct sppp *sp, void *xcp) 3388 { 3389 uint32_t myaddr, hisaddr; 3390 3391 KASSERT(SPPP_WLOCKED(sp)); 3392 KASSERT(!cpu_softintr_p()); 3393 3394 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3395 return; 3396 3397 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3398 sp->ipcp.req_myaddr = 0; 3399 sp->ipcp.req_hisaddr = 0; 3400 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3401 3402 #ifdef INET 3403 kpreempt_disable(); 3404 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3405 kpreempt_enable(); 3406 #else 3407 myaddr = hisaddr = 0; 3408 #endif 3409 /* 3410 * If we don't have his address, this probably means our 3411 * interface doesn't want to talk IP at all. (This could 3412 * be the case if somebody wants to speak only IPX, for 3413 * example.) Don't open IPCP in this case. 3414 */ 3415 if (hisaddr == 0) { 3416 /* XXX this message should go away */ 3417 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n"); 3418 return; 3419 } 3420 3421 if (myaddr == 0) { 3422 /* 3423 * I don't have an assigned address, so i need to 3424 * negotiate my address. 3425 */ 3426 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3427 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3428 } 3429 if (hisaddr == 1) { 3430 /* 3431 * XXX - remove this hack! 3432 * remote has no valid address, we need to get one assigned. 3433 */ 3434 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3435 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3436 } 3437 3438 if (sp->query_dns & 1) { 3439 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3440 } else { 3441 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3442 } 3443 3444 if (sp->query_dns & 2) { 3445 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3446 } else { 3447 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3448 } 3449 sppp_open_event(sp, xcp); 3450 } 3451 3452 static void 3453 sppp_ipcp_close(struct sppp *sp, void *xcp) 3454 { 3455 3456 KASSERT(SPPP_WLOCKED(sp)); 3457 KASSERT(!cpu_softintr_p()); 3458 3459 sppp_close_event(sp, xcp); 3460 3461 #ifdef INET 3462 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3463 /* 3464 * Some address was dynamic, clear it again. 3465 */ 3466 sppp_clear_ip_addrs(sp); 3467 } 3468 #endif 3469 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3470 } 3471 3472 /* 3473 * Analyze a configure request. Return true if it was agreeable, and 3474 * caused action sca, false if it has been rejected or nak'ed, and 3475 * caused action scn. (The return value is used to make the state 3476 * transition decision in the state automaton.) 3477 */ 3478 static enum cp_rcr_type 3479 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3480 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3481 { 3482 u_char *buf, *r, *p, l, blen; 3483 enum cp_rcr_type type; 3484 int rlen, len; 3485 uint32_t hisaddr, desiredaddr; 3486 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3487 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3488 const char *dq; 3489 bool debug; 3490 3491 KASSERT(SPPP_WLOCKED(sp)); 3492 3493 type = CP_RCR_NONE; 3494 origlen -= sizeof(*h); 3495 3496 if (origlen < 0) 3497 return CP_RCR_DROP; 3498 3499 debug = sppp_debug_enabled(sp); 3500 3501 /* 3502 * Make sure to allocate a buf that can at least hold a 3503 * conf-nak with an `address' option. We might need it below. 3504 */ 3505 blen = MAX(6, origlen); 3506 3507 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3508 if (buf == NULL) 3509 return CP_RCR_DROP; 3510 3511 /* pass 1: see if we can recognize them */ 3512 if (debug) 3513 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:"); 3514 p = (void *)(h + 1); 3515 r = buf; 3516 rlen = 0; 3517 for (len = origlen; len > 1; len -= l, p += l) { 3518 l = p[1]; 3519 if (l == 0) 3520 break; 3521 3522 /* Sanity check option length */ 3523 if (l > len) { 3524 /* XXX should we just RXJ? */ 3525 if (debug) 3526 addlog("\n"); 3527 3528 SPPP_LOG(sp, LOG_DEBUG, 3529 " malicious IPCP option received, dropping\n"); 3530 type = CP_RCR_ERR; 3531 goto end; 3532 } 3533 if (debug) { 3534 addlog(" %s", 3535 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3536 } 3537 switch (p[0]) { 3538 #ifdef notyet 3539 case IPCP_OPT_COMPRESSION: 3540 if (len >= 6 && l >= 6) { 3541 /* correctly formed compress option */ 3542 continue; 3543 } 3544 if (debug) 3545 addlog(" [invalid]"); 3546 break; 3547 #endif 3548 case IPCP_OPT_ADDRESS: 3549 if (len >= 6 && l == 6) { 3550 /* correctly formed address option */ 3551 continue; 3552 } 3553 if (debug) 3554 addlog(" [invalid]"); 3555 break; 3556 default: 3557 /* Others not supported. */ 3558 if (debug) 3559 addlog(" [rej]"); 3560 break; 3561 } 3562 /* Add the option to rejected list. */ 3563 if (rlen + l > blen) { 3564 if (debug) 3565 addlog(" [overflow]"); 3566 continue; 3567 } 3568 memcpy(r, p, l); 3569 r += l; 3570 rlen += l; 3571 } 3572 3573 if (rlen > 0) { 3574 type = CP_RCR_REJ; 3575 goto end; 3576 } 3577 3578 if (debug) 3579 addlog("\n"); 3580 3581 /* pass 2: parse option values */ 3582 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3583 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3584 else 3585 #ifdef INET 3586 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3587 #else 3588 hisaddr = 0; 3589 #endif 3590 if (debug) 3591 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:"); 3592 p = (void *)(h + 1); 3593 r = buf; 3594 rlen = 0; 3595 for (len = origlen; len > 1; len -= l, p += l) { 3596 l = p[1]; 3597 if (l == 0) 3598 break; 3599 3600 if (debug) { 3601 addlog(" %s", 3602 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3603 } 3604 switch (p[0]) { 3605 #ifdef notyet 3606 case IPCP_OPT_COMPRESSION: 3607 continue; 3608 #endif 3609 case IPCP_OPT_ADDRESS: 3610 desiredaddr = p[2] << 24 | p[3] << 16 | 3611 p[4] << 8 | p[5]; 3612 if (desiredaddr == hisaddr || 3613 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3614 /* 3615 * Peer's address is same as our value, 3616 * this is agreeable. Gonna conf-ack 3617 * it. 3618 */ 3619 if (debug) { 3620 dq = sppp_dotted_quad(dqbuf, 3621 sizeof(dqbuf), hisaddr); 3622 addlog(" %s [ack]", dq); 3623 } 3624 /* record that we've seen it already */ 3625 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3626 sp->ipcp.req_hisaddr = desiredaddr; 3627 hisaddr = desiredaddr; 3628 continue; 3629 } 3630 /* 3631 * The address wasn't agreeable. This is either 3632 * he sent us 0.0.0.0, asking to assign him an 3633 * address, or he send us another address not 3634 * matching our value. Either case, we gonna 3635 * conf-nak it with our value. 3636 */ 3637 if (debug) { 3638 if (desiredaddr == 0) { 3639 addlog(" [addr requested]"); 3640 } else { 3641 dq = sppp_dotted_quad(dqbuf, 3642 sizeof(dqbuf), desiredaddr); 3643 addlog(" %s [not agreed]", dq); 3644 } 3645 } 3646 3647 p[2] = hisaddr >> 24; 3648 p[3] = hisaddr >> 16; 3649 p[4] = hisaddr >> 8; 3650 p[5] = hisaddr; 3651 break; 3652 } 3653 if (rlen + l > blen) { 3654 if (debug) 3655 addlog(" [overflow]"); 3656 continue; 3657 } 3658 /* Add the option to nak'ed list. */ 3659 memcpy(r, p, l); 3660 r += l; 3661 rlen += l; 3662 } 3663 3664 if (rlen > 0) { 3665 type = CP_RCR_NAK; 3666 } else { 3667 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3668 /* 3669 * If we are about to conf-ack the request, but haven't seen 3670 * his address so far, gonna conf-nak it instead, with the 3671 * `address' option present and our idea of his address being 3672 * filled in there, to request negotiation of both addresses. 3673 * 3674 * XXX This can result in an endless req - nak loop if peer 3675 * doesn't want to send us his address. Q: What should we do 3676 * about it? XXX A: implement the max-failure counter. 3677 */ 3678 buf[0] = IPCP_OPT_ADDRESS; 3679 buf[1] = 6; 3680 buf[2] = hisaddr >> 24; 3681 buf[3] = hisaddr >> 16; 3682 buf[4] = hisaddr >> 8; 3683 buf[5] = hisaddr; 3684 rlen = 6; 3685 if (debug) 3686 addlog(" still need hisaddr"); 3687 type = CP_RCR_NAK; 3688 } else { 3689 type = CP_RCR_ACK; 3690 rlen = origlen; 3691 memcpy(r, h + 1, rlen); 3692 } 3693 } 3694 3695 end: 3696 if (debug) 3697 addlog("\n"); 3698 3699 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3700 if (buf != NULL) 3701 kmem_intr_free(buf, blen); 3702 } else { 3703 *msgbuf = buf; 3704 *buflen = blen; 3705 *msglen = rlen; 3706 } 3707 3708 return type; 3709 } 3710 3711 /* 3712 * Analyze the IPCP Configure-Reject option list, and adjust our 3713 * negotiation. 3714 */ 3715 static void 3716 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3717 { 3718 u_char *p, l; 3719 bool debug; 3720 3721 KASSERT(SPPP_WLOCKED(sp)); 3722 3723 if (len <= sizeof(*h)) 3724 return; 3725 3726 len -= sizeof(*h); 3727 debug = sppp_debug_enabled(sp); 3728 3729 if (debug) 3730 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:"); 3731 3732 p = (void *)(h + 1); 3733 for (; len > 1; len -= l, p += l) { 3734 l = p[1]; 3735 if (l == 0) 3736 break; 3737 3738 /* Sanity check option length */ 3739 if (l > len) { 3740 /* XXX should we just RXJ? */ 3741 if (debug) 3742 addlog("\n"); 3743 SPPP_LOG(sp, LOG_DEBUG, 3744 "malicious IPCP option received, dropping\n"); 3745 goto end; 3746 } 3747 if (debug) { 3748 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3749 addlog(" %s", 3750 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3751 } 3752 switch (p[0]) { 3753 case IPCP_OPT_ADDRESS: 3754 /* 3755 * Peer doesn't grok address option. This is 3756 * bad. XXX Should we better give up here? 3757 */ 3758 if (!debug) { 3759 SPPP_LOG(sp, LOG_ERR, 3760 "IPCP address option rejected\n"); 3761 } 3762 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3763 break; 3764 #ifdef notyet 3765 case IPCP_OPT_COMPRESS: 3766 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3767 break; 3768 #endif 3769 case IPCP_OPT_PRIMDNS: 3770 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3771 break; 3772 3773 case IPCP_OPT_SECDNS: 3774 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3775 break; 3776 } 3777 } 3778 if (debug) 3779 addlog("\n"); 3780 end: 3781 return; 3782 } 3783 3784 /* 3785 * Analyze the IPCP Configure-NAK option list, and adjust our 3786 * negotiation. 3787 */ 3788 static void 3789 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3790 { 3791 u_char *p, l; 3792 struct ifnet *ifp = &sp->pp_if; 3793 int debug = ifp->if_flags & IFF_DEBUG; 3794 uint32_t wantaddr; 3795 3796 KASSERT(SPPP_WLOCKED(sp)); 3797 3798 len -= sizeof(*h); 3799 3800 debug = sppp_debug_enabled(sp); 3801 3802 if (debug) 3803 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:"); 3804 3805 p = (void *)(h + 1); 3806 for (; len > 1; len -= l, p += l) { 3807 l = p[1]; 3808 if (l == 0) 3809 break; 3810 3811 /* Sanity check option length */ 3812 if (l > len) { 3813 /* XXX should we just RXJ? */ 3814 if (debug) 3815 addlog("\n"); 3816 SPPP_LOG(sp, LOG_DEBUG, 3817 "malicious IPCP option received, dropping\n"); 3818 return; 3819 } 3820 if (debug) { 3821 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3822 addlog(" %s", 3823 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3824 } 3825 switch (*p) { 3826 case IPCP_OPT_ADDRESS: 3827 /* 3828 * Peer doesn't like our local IP address. See 3829 * if we can do something for him. We'll drop 3830 * him our address then. 3831 */ 3832 if (len >= 6 && l == 6) { 3833 wantaddr = p[2] << 24 | p[3] << 16 | 3834 p[4] << 8 | p[5]; 3835 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3836 if (debug) { 3837 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3838 const char *dq; 3839 3840 dq = sppp_dotted_quad(dqbuf, 3841 sizeof(dqbuf), wantaddr); 3842 addlog(" [wantaddr %s]", dq); 3843 } 3844 /* 3845 * When doing dynamic address assignment, 3846 * we accept his offer. Otherwise, we 3847 * ignore it and thus continue to negotiate 3848 * our already existing value. 3849 */ 3850 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3851 if (ntohl(wantaddr) != INADDR_ANY) { 3852 if (debug) 3853 addlog(" [agree]"); 3854 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3855 sp->ipcp.req_myaddr = wantaddr; 3856 } else { 3857 if (debug) 3858 addlog(" [not agreed]"); 3859 } 3860 } 3861 } 3862 break; 3863 3864 case IPCP_OPT_PRIMDNS: 3865 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 3866 len >= 6 && l == 6) { 3867 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3868 p[4] << 8 | p[5]; 3869 } 3870 break; 3871 3872 case IPCP_OPT_SECDNS: 3873 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 3874 len >= 6 && l == 6) { 3875 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3876 p[4] << 8 | p[5]; 3877 } 3878 break; 3879 #ifdef notyet 3880 case IPCP_OPT_COMPRESS: 3881 /* 3882 * Peer wants different compression parameters. 3883 */ 3884 break; 3885 #endif 3886 } 3887 } 3888 if (debug) 3889 addlog("\n"); 3890 } 3891 3892 static void 3893 sppp_ipcp_tlu(struct sppp *sp) 3894 { 3895 #ifdef INET 3896 struct ifnet *ifp; 3897 3898 KASSERT(SPPP_WLOCKED(sp)); 3899 3900 ifp = &sp->pp_if; 3901 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 3902 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 3903 SPPP_LOG(sp, LOG_WARNING, 3904 "no IP address, closing IPCP\n"); 3905 sppp_wq_add(sp->wq_cp, 3906 &sp->scp[IDX_IPCP].work_close); 3907 } else { 3908 /* we are up. Set addresses and notify anyone interested */ 3909 sppp_set_ip_addrs(sp); 3910 rt_ifmsg(ifp); 3911 } 3912 #endif 3913 } 3914 3915 static void 3916 sppp_ipcp_tld(struct sppp *sp) 3917 { 3918 #ifdef INET 3919 struct ifnet *ifp; 3920 3921 KASSERT(SPPP_WLOCKED(sp)); 3922 3923 ifp = &sp->pp_if; 3924 rt_ifmsg(ifp); 3925 #endif 3926 } 3927 3928 static void 3929 sppp_ipcp_scr(struct sppp *sp) 3930 { 3931 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3932 #ifdef INET 3933 uint32_t ouraddr; 3934 #endif 3935 int i = 0; 3936 3937 KASSERT(SPPP_WLOCKED(sp)); 3938 3939 #ifdef notyet 3940 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 3941 opt[i++] = IPCP_OPT_COMPRESSION; 3942 opt[i++] = 6; 3943 opt[i++] = 0; /* VJ header compression */ 3944 opt[i++] = 0x2d; /* VJ header compression */ 3945 opt[i++] = max_slot_id; 3946 opt[i++] = comp_slot_id; 3947 } 3948 #endif 3949 3950 #ifdef INET 3951 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 3952 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 3953 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3954 } else { 3955 kpreempt_disable(); 3956 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3957 kpreempt_enable(); 3958 } 3959 opt[i++] = IPCP_OPT_ADDRESS; 3960 opt[i++] = 6; 3961 opt[i++] = ouraddr >> 24; 3962 opt[i++] = ouraddr >> 16; 3963 opt[i++] = ouraddr >> 8; 3964 opt[i++] = ouraddr; 3965 } 3966 #endif 3967 3968 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 3969 opt[i++] = IPCP_OPT_PRIMDNS; 3970 opt[i++] = 6; 3971 opt[i++] = sp->dns_addrs[0] >> 24; 3972 opt[i++] = sp->dns_addrs[0] >> 16; 3973 opt[i++] = sp->dns_addrs[0] >> 8; 3974 opt[i++] = sp->dns_addrs[0]; 3975 } 3976 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 3977 opt[i++] = IPCP_OPT_SECDNS; 3978 opt[i++] = 6; 3979 opt[i++] = sp->dns_addrs[1] >> 24; 3980 opt[i++] = sp->dns_addrs[1] >> 16; 3981 opt[i++] = sp->dns_addrs[1] >> 8; 3982 opt[i++] = sp->dns_addrs[1]; 3983 } 3984 3985 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 3986 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 3987 } 3988 3989 /* 3990 *--------------------------------------------------------------------------* 3991 * * 3992 * The IPv6CP implementation. * 3993 * * 3994 *--------------------------------------------------------------------------* 3995 */ 3996 3997 #ifdef INET6 3998 static void 3999 sppp_ipv6cp_init(struct sppp *sp) 4000 { 4001 4002 KASSERT(SPPP_WLOCKED(sp)); 4003 4004 sppp_cp_init(&ipv6cp, sp); 4005 4006 sp->ipv6cp.opts = 0; 4007 sp->ipv6cp.flags = 0; 4008 } 4009 4010 static void 4011 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4012 { 4013 struct in6_addr myaddr, hisaddr; 4014 4015 KASSERT(SPPP_WLOCKED(sp)); 4016 KASSERT(!cpu_softintr_p()); 4017 4018 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4019 return; 4020 4021 #ifdef IPV6CP_MYIFID_DYN 4022 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4023 #else 4024 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4025 #endif 4026 4027 kpreempt_disable(); 4028 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4029 kpreempt_enable(); 4030 /* 4031 * If we don't have our address, this probably means our 4032 * interface doesn't want to talk IPv6 at all. (This could 4033 * be the case if somebody wants to speak only IPX, for 4034 * example.) Don't open IPv6CP in this case. 4035 */ 4036 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4037 /* XXX this message should go away */ 4038 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n"); 4039 return; 4040 } 4041 4042 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4043 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4044 sppp_open_event(sp, xcp); 4045 } 4046 4047 /* 4048 * Analyze a configure request. Return true if it was agreeable, and 4049 * caused action sca, false if it has been rejected or nak'ed, and 4050 * caused action scn. (The return value is used to make the state 4051 * transition decision in the state automaton.) 4052 */ 4053 static enum cp_rcr_type 4054 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4055 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4056 { 4057 u_char *buf, *r, *p, l, blen; 4058 int rlen, len; 4059 struct in6_addr myaddr, desiredaddr, suggestaddr; 4060 enum cp_rcr_type type; 4061 int ifidcount; 4062 int collision, nohisaddr; 4063 char ip6buf[INET6_ADDRSTRLEN]; 4064 char tbuf[SPPP_CPTYPE_NAMELEN]; 4065 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4066 const char *cpname; 4067 bool debug; 4068 4069 KASSERT(SPPP_WLOCKED(sp)); 4070 4071 debug = sppp_debug_enabled(sp); 4072 type = CP_RCR_NONE; 4073 origlen -= sizeof(*h); 4074 4075 if (origlen < 0) 4076 return CP_RCR_DROP; 4077 4078 /* 4079 * Make sure to allocate a buf that can at least hold a 4080 * conf-nak with an `address' option. We might need it below. 4081 */ 4082 blen = MAX(6, origlen); 4083 4084 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4085 if (buf == NULL) 4086 return CP_RCR_DROP; 4087 4088 /* pass 1: see if we can recognize them */ 4089 if (debug) 4090 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:"); 4091 p = (void *)(h + 1); 4092 r = buf; 4093 rlen = 0; 4094 ifidcount = 0; 4095 for (len = origlen; len > 1; len -= l, p += l) { 4096 l = p[1]; 4097 if (l == 0) 4098 break; 4099 4100 /* Sanity check option length */ 4101 if (l > len) { 4102 /* XXX just RXJ? */ 4103 if (debug) 4104 addlog("\n"); 4105 SPPP_LOG(sp, LOG_DEBUG, 4106 "received malicious IPCPv6 option, " 4107 "dropping\n"); 4108 type = CP_RCR_ERR; 4109 goto end; 4110 } 4111 if (debug) { 4112 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4113 sizeof(ipv6buf),*p)); 4114 } 4115 switch (p[0]) { 4116 case IPV6CP_OPT_IFID: 4117 if (len >= 10 && l == 10 && ifidcount == 0) { 4118 /* correctly formed address option */ 4119 ifidcount++; 4120 continue; 4121 } 4122 if (debug) 4123 addlog(" [invalid]"); 4124 break; 4125 #ifdef notyet 4126 case IPV6CP_OPT_COMPRESSION: 4127 if (len >= 4 && l >= 4) { 4128 /* correctly formed compress option */ 4129 continue; 4130 } 4131 if (debug) 4132 addlog(" [invalid]"); 4133 break; 4134 #endif 4135 default: 4136 /* Others not supported. */ 4137 if (debug) 4138 addlog(" [rej]"); 4139 break; 4140 } 4141 if (rlen + l > blen) { 4142 if (debug) 4143 addlog(" [overflow]"); 4144 continue; 4145 } 4146 /* Add the option to rejected list. */ 4147 memcpy(r, p, l); 4148 r += l; 4149 rlen += l; 4150 } 4151 4152 if (rlen > 0) { 4153 type = CP_RCR_REJ; 4154 goto end; 4155 } 4156 4157 if (debug) 4158 addlog("\n"); 4159 4160 /* pass 2: parse option values */ 4161 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4162 if (debug) 4163 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:"); 4164 p = (void *)(h + 1); 4165 r = buf; 4166 rlen = 0; 4167 type = CP_RCR_ACK; 4168 for (len = origlen; len > 1; len -= l, p += l) { 4169 l = p[1]; 4170 if (l == 0) 4171 break; 4172 4173 if (debug) { 4174 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4175 sizeof(ipv6buf), *p)); 4176 } 4177 switch (p[0]) { 4178 #ifdef notyet 4179 case IPV6CP_OPT_COMPRESSION: 4180 continue; 4181 #endif 4182 case IPV6CP_OPT_IFID: 4183 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4184 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4185 collision = (memcmp(&desiredaddr.s6_addr[8], 4186 &myaddr.s6_addr[8], 8) == 0); 4187 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4188 4189 desiredaddr.s6_addr16[0] = htons(0xfe80); 4190 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4191 4192 if (!collision && !nohisaddr) { 4193 /* no collision, hisaddr known - Conf-Ack */ 4194 type = CP_RCR_ACK; 4195 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4196 sizeof(sp->ipv6cp.my_ifid)); 4197 memcpy(sp->ipv6cp.his_ifid, 4198 &desiredaddr.s6_addr[8], 4199 sizeof(sp->ipv6cp.my_ifid)); 4200 4201 if (debug) { 4202 cpname = sppp_cp_type_name(tbuf, 4203 sizeof(tbuf), CONF_ACK); 4204 addlog(" %s [%s]", 4205 IN6_PRINT(ip6buf, &desiredaddr), 4206 cpname); 4207 } 4208 continue; 4209 } 4210 4211 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4212 if (collision && nohisaddr) { 4213 /* collision, hisaddr unknown - Conf-Rej */ 4214 type = CP_RCR_REJ; 4215 memset(&p[2], 0, 8); 4216 } else { 4217 /* 4218 * - no collision, hisaddr unknown, or 4219 * - collision, hisaddr known 4220 * Conf-Nak, suggest hisaddr 4221 */ 4222 type = CP_RCR_NAK; 4223 sppp_suggest_ip6_addr(sp, &suggestaddr); 4224 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4225 } 4226 if (debug) { 4227 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4228 4229 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4230 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4231 cpname); 4232 } 4233 break; 4234 } 4235 if (rlen + l > blen) { 4236 if (debug) 4237 addlog(" [overflow]"); 4238 continue; 4239 } 4240 /* Add the option to nak'ed list. */ 4241 memcpy(r, p, l); 4242 r += l; 4243 rlen += l; 4244 } 4245 4246 if (rlen > 0) { 4247 if (type != CP_RCR_ACK) { 4248 if (debug) { 4249 int ctype ; 4250 ctype = type == CP_RCR_REJ ? 4251 CONF_REJ : CONF_NAK; 4252 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4253 addlog(" send %s suggest %s\n", 4254 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4255 } 4256 } 4257 #ifdef notdef 4258 if (type == CP_RCR_ACK) 4259 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4260 #endif 4261 } else { 4262 if (type == CP_RCR_ACK) { 4263 rlen = origlen; 4264 memcpy(r, h + 1, rlen); 4265 } 4266 } 4267 end: 4268 if (debug) 4269 addlog("\n"); 4270 4271 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4272 if (buf != NULL) 4273 kmem_intr_free(buf, blen); 4274 } else { 4275 *msgbuf = buf; 4276 *buflen = blen; 4277 *msglen = rlen; 4278 } 4279 4280 return type; 4281 } 4282 4283 /* 4284 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4285 * negotiation. 4286 */ 4287 static void 4288 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4289 { 4290 u_char *p, l; 4291 bool debug; 4292 4293 KASSERT(SPPP_WLOCKED(sp)); 4294 4295 if (len <= sizeof(*h)) 4296 return; 4297 4298 len -= sizeof(*h); 4299 debug = sppp_debug_enabled(sp); 4300 4301 if (debug) 4302 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:"); 4303 4304 p = (void *)(h + 1); 4305 for (; len > 1; len -= l, p += l) { 4306 l = p[1]; 4307 if (l == 0) 4308 break; 4309 4310 if (l > len) { 4311 /* XXX just RXJ? */ 4312 if (debug) 4313 addlog("\n"); 4314 SPPP_LOG(sp, LOG_DEBUG, 4315 "received malicious IPCPv6 option, " 4316 "dropping\n"); 4317 goto end; 4318 } 4319 if (debug) { 4320 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4321 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4322 sizeof(ipv6buf), *p)); 4323 } 4324 switch (p[0]) { 4325 case IPV6CP_OPT_IFID: 4326 /* 4327 * Peer doesn't grok address option. This is 4328 * bad. XXX Should we better give up here? 4329 */ 4330 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4331 break; 4332 #ifdef notyet 4333 case IPV6CP_OPT_COMPRESS: 4334 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4335 break; 4336 #endif 4337 } 4338 } 4339 if (debug) 4340 addlog("\n"); 4341 end: 4342 return; 4343 } 4344 4345 /* 4346 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4347 * negotiation. 4348 */ 4349 static void 4350 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4351 { 4352 u_char *p, l; 4353 struct in6_addr suggestaddr; 4354 char ip6buf[INET6_ADDRSTRLEN]; 4355 bool debug; 4356 4357 KASSERT(SPPP_WLOCKED(sp)); 4358 4359 if (len <= sizeof(*h)) 4360 return; 4361 4362 len -= sizeof(*h); 4363 debug = sppp_debug_enabled(sp); 4364 4365 if (debug) 4366 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:"); 4367 4368 p = (void *)(h + 1); 4369 for (; len > 1; len -= l, p += l) { 4370 l = p[1]; 4371 if (l == 0) 4372 break; 4373 4374 if (l > len) { 4375 /* XXX just RXJ? */ 4376 if (debug) 4377 addlog("\n"); 4378 SPPP_LOG(sp, LOG_DEBUG, 4379 "received malicious IPCPv6 option, " 4380 "dropping\n"); 4381 goto end; 4382 } 4383 if (debug) { 4384 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4385 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4386 sizeof(ipv6buf), *p)); 4387 } 4388 switch (p[0]) { 4389 case IPV6CP_OPT_IFID: 4390 /* 4391 * Peer doesn't like our local ifid. See 4392 * if we can do something for him. We'll drop 4393 * him our address then. 4394 */ 4395 if (len < 10 || l != 10) 4396 break; 4397 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4398 suggestaddr.s6_addr16[0] = htons(0xfe80); 4399 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4400 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4401 4402 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4403 if (debug) 4404 addlog(" [suggestaddr %s]", 4405 IN6_PRINT(ip6buf, &suggestaddr)); 4406 #ifdef IPV6CP_MYIFID_DYN 4407 /* 4408 * When doing dynamic address assignment, 4409 * we accept his offer. 4410 */ 4411 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4412 struct in6_addr lastsuggest; 4413 /* 4414 * If <suggested myaddr from peer> equals to 4415 * <hisaddr we have suggested last time>, 4416 * we have a collision. generate new random 4417 * ifid. 4418 */ 4419 sppp_suggest_ip6_addr(&lastsuggest); 4420 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4421 lastsuggest)) { 4422 if (debug) 4423 addlog(" [random]"); 4424 sppp_gen_ip6_addr(sp, &suggestaddr); 4425 } 4426 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4427 if (debug) 4428 addlog(" [agree]"); 4429 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4430 } 4431 #else 4432 /* 4433 * Since we do not do dynamic address assignment, 4434 * we ignore it and thus continue to negotiate 4435 * our already existing value. This can possibly 4436 * go into infinite request-reject loop. 4437 * 4438 * This is not likely because we normally use 4439 * ifid based on MAC-address. 4440 * If you have no ethernet card on the node, too bad. 4441 * XXX should we use fail_counter? 4442 */ 4443 #endif 4444 break; 4445 #ifdef notyet 4446 case IPV6CP_OPT_COMPRESS: 4447 /* 4448 * Peer wants different compression parameters. 4449 */ 4450 break; 4451 #endif 4452 } 4453 } 4454 if (debug) 4455 addlog("\n"); 4456 end: 4457 return; 4458 } 4459 4460 static void 4461 sppp_ipv6cp_tlu(struct sppp *sp) 4462 { 4463 struct ifnet *ifp; 4464 4465 KASSERT(SPPP_WLOCKED(sp)); 4466 4467 ifp = &sp->pp_if; 4468 /* we are up - notify isdn daemon */ 4469 sppp_notify_con_wlocked(sp); 4470 rt_ifmsg(ifp); 4471 } 4472 4473 static void 4474 sppp_ipv6cp_tld(struct sppp *sp) 4475 { 4476 struct ifnet *ifp; 4477 4478 KASSERT(SPPP_WLOCKED(sp)); 4479 4480 ifp = &sp->pp_if; 4481 rt_ifmsg(ifp); 4482 } 4483 4484 static void 4485 sppp_ipv6cp_scr(struct sppp *sp) 4486 { 4487 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4488 struct in6_addr ouraddr; 4489 int i = 0; 4490 4491 KASSERT(SPPP_WLOCKED(sp)); 4492 4493 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4494 kpreempt_disable(); 4495 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4496 kpreempt_enable(); 4497 4498 opt[i++] = IPV6CP_OPT_IFID; 4499 opt[i++] = 10; 4500 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4501 i += 8; 4502 } 4503 4504 #ifdef notyet 4505 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4506 opt[i++] = IPV6CP_OPT_COMPRESSION; 4507 opt[i++] = 4; 4508 opt[i++] = 0; /* TBD */ 4509 opt[i++] = 0; /* TBD */ 4510 /* variable length data may follow */ 4511 } 4512 #endif 4513 4514 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4515 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4516 } 4517 #else /*INET6*/ 4518 static void 4519 sppp_ipv6cp_init(struct sppp *sp) 4520 { 4521 4522 KASSERT(SPPP_WLOCKED(sp)); 4523 } 4524 4525 static void 4526 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4527 { 4528 4529 KASSERT(SPPP_WLOCKED(sp)); 4530 } 4531 4532 static enum cp_rcr_type 4533 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4534 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4535 { 4536 4537 KASSERT(SPPP_WLOCKED(sp)); 4538 return 0; 4539 } 4540 4541 static void 4542 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4543 int len) 4544 { 4545 4546 KASSERT(SPPP_WLOCKED(sp)); 4547 } 4548 4549 static void 4550 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4551 int len) 4552 { 4553 4554 KASSERT(SPPP_WLOCKED(sp)); 4555 } 4556 4557 static void 4558 sppp_ipv6cp_tlu(struct sppp *sp) 4559 { 4560 4561 KASSERT(SPPP_WLOCKED(sp)); 4562 } 4563 4564 static void 4565 sppp_ipv6cp_scr(struct sppp *sp) 4566 { 4567 4568 KASSERT(SPPP_WLOCKED(sp)); 4569 } 4570 #endif /*INET6*/ 4571 4572 /* 4573 *--------------------------------------------------------------------------* 4574 * * 4575 * The CHAP implementation. * 4576 * * 4577 *--------------------------------------------------------------------------* 4578 */ 4579 /* 4580 * The authentication protocols is implemented on the state machine for 4581 * control protocols. And it uses following actions and events. 4582 * 4583 * Actions: 4584 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4585 * - sca: send CHAP_SUCCESS 4586 * - scn: send CHAP_FAILURE and shutdown lcp 4587 * Events: 4588 * - RCR+: receive CHAP_RESPONSE containing correct digest 4589 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4590 * - RCA: receive CHAP_SUCCESS 4591 * - RCN: (this event is unused) 4592 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4593 * - TO-: this layer finish 4594 */ 4595 4596 /* 4597 * Handle incoming CHAP packets. 4598 */ 4599 void 4600 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4601 { 4602 struct ifnet *ifp; 4603 struct lcp_header *h; 4604 int len, x; 4605 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4606 int value_len, name_len; 4607 MD5_CTX ctx; 4608 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4609 const char *authname; 4610 bool debug; 4611 4612 ifp = &sp->pp_if; 4613 debug = sppp_debug_enabled(sp); 4614 len = m->m_pkthdr.len; 4615 if (len < 4) { 4616 SPPP_DLOG(sp, "chap invalid packet length: " 4617 "%d bytes\n", len); 4618 return; 4619 } 4620 h = mtod(m, struct lcp_header *); 4621 if (len > ntohs(h->len)) 4622 len = ntohs(h->len); 4623 4624 SPPP_LOCK(sp, RW_WRITER); 4625 4626 switch (h->type) { 4627 /* challenge, failure and success are his authproto */ 4628 case CHAP_CHALLENGE: 4629 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4630 /* can't do anything useful */ 4631 sp->pp_auth_failures++; 4632 SPPP_DLOG(sp, "chap input " 4633 "without my name and my secret being set\n"); 4634 break; 4635 } 4636 value = 1 + (u_char *)(h + 1); 4637 value_len = value[-1]; 4638 name = value + value_len; 4639 name_len = len - value_len - 5; 4640 if (name_len < 0) { 4641 if (debug) { 4642 authname = sppp_auth_type_name(abuf, 4643 sizeof(abuf), PPP_CHAP, h->type); 4644 SPPP_LOG(sp, LOG_DEBUG, 4645 "chap corrupted challenge " 4646 "<%s id=0x%x len=%d", 4647 authname, h->ident, ntohs(h->len)); 4648 if (len > 4) 4649 sppp_print_bytes((u_char *)(h + 1), 4650 len - 4); 4651 addlog(">\n"); 4652 } 4653 break; 4654 } 4655 4656 if (debug) { 4657 authname = sppp_auth_type_name(abuf, 4658 sizeof(abuf), PPP_CHAP, h->type); 4659 SPPP_LOG(sp, LOG_DEBUG, 4660 "chap input <%s id=0x%x len=%d name=", 4661 authname, h->ident, ntohs(h->len)); 4662 sppp_print_string((char *) name, name_len); 4663 addlog(" value-size=%d value=", value_len); 4664 sppp_print_bytes(value, value_len); 4665 addlog(">\n"); 4666 } 4667 4668 /* Compute reply value. */ 4669 MD5Init(&ctx); 4670 MD5Update(&ctx, &h->ident, 1); 4671 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4672 MD5Update(&ctx, value, value_len); 4673 MD5Final(sp->chap.digest, &ctx); 4674 sp->chap.digest_len = sizeof(sp->chap.digest); 4675 sp->scp[IDX_CHAP].rconfid = h->ident; 4676 4677 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4678 break; 4679 4680 case CHAP_SUCCESS: 4681 if (debug) { 4682 SPPP_LOG(sp, LOG_DEBUG, "chap success"); 4683 if (len > 4) { 4684 addlog(": "); 4685 sppp_print_string((char *)(h + 1), len - 4); 4686 } 4687 addlog("\n"); 4688 } 4689 4690 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4691 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4692 chap.name, h->ident, 4693 sp->scp[IDX_CHAP].rconfid); 4694 if_statinc(ifp, if_ierrors); 4695 break; 4696 } 4697 4698 if (sp->chap.digest_len == 0) { 4699 SPPP_DLOG(sp, "receive CHAP success" 4700 " without challenge\n"); 4701 if_statinc(ifp, if_ierrors); 4702 break; 4703 } 4704 4705 x = splnet(); 4706 sp->pp_auth_failures = 0; 4707 sp->pp_flags &= ~PP_NEEDAUTH; 4708 splx(x); 4709 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4710 sp->chap.digest_len = 0; 4711 4712 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4713 /* 4714 * we are not authenticator for CHAP, 4715 * generate a dummy RCR+ event without CHAP_RESPONSE 4716 */ 4717 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4718 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4719 } 4720 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4721 break; 4722 4723 case CHAP_FAILURE: 4724 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4725 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4726 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid); 4727 if_statinc(ifp, if_ierrors); 4728 break; 4729 } 4730 4731 if (sp->chap.digest_len == 0) { 4732 SPPP_DLOG(sp, "receive CHAP failure " 4733 "without challenge\n"); 4734 if_statinc(ifp, if_ierrors); 4735 break; 4736 } 4737 4738 x = splnet(); 4739 sp->pp_auth_failures++; 4740 splx(x); 4741 SPPP_LOG(sp, LOG_INFO, "chap failure"); 4742 if (debug) { 4743 if (len > 4) { 4744 addlog(": "); 4745 sppp_print_string((char *)(h + 1), len - 4); 4746 } 4747 } 4748 addlog("\n"); 4749 4750 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4751 sp->chap.digest_len = 0; 4752 /* 4753 * await LCP shutdown by authenticator, 4754 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4755 */ 4756 break; 4757 4758 /* response is my authproto */ 4759 case CHAP_RESPONSE: 4760 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4761 /* can't do anything useful */ 4762 SPPP_DLOG(sp, "chap response " 4763 "without his name and his secret being set\n"); 4764 break; 4765 } 4766 value = 1 + (u_char *)(h + 1); 4767 value_len = value[-1]; 4768 name = value + value_len; 4769 name_len = len - value_len - 5; 4770 if (name_len < 0) { 4771 if (debug) { 4772 authname = sppp_auth_type_name(abuf, 4773 sizeof(abuf), PPP_CHAP, h->type); 4774 SPPP_LOG(sp, LOG_DEBUG, 4775 "chap corrupted response " 4776 "<%s id=0x%x len=%d", 4777 authname, h->ident, ntohs(h->len)); 4778 if (len > 4) 4779 sppp_print_bytes((u_char *)(h + 1), 4780 len - 4); 4781 addlog(">\n"); 4782 } 4783 break; 4784 } 4785 if (h->ident != sp->scp[IDX_CHAP].confid) { 4786 SPPP_DLOG(sp, "chap dropping response for old ID " 4787 "(got %d, expected %d)\n", 4788 h->ident, sp->scp[IDX_CHAP].confid); 4789 break; 4790 } else { 4791 sp->scp[IDX_CHAP].rconfid = h->ident; 4792 } 4793 4794 if (sp->hisauth.name != NULL && 4795 (name_len != sp->hisauth.name_len 4796 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4797 SPPP_LOG(sp, LOG_INFO, 4798 "chap response, his name "); 4799 sppp_print_string(name, name_len); 4800 addlog(" != expected "); 4801 sppp_print_string(sp->hisauth.name, 4802 sp->hisauth.name_len); 4803 addlog("\n"); 4804 4805 /* generate RCR- event */ 4806 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4807 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4808 break; 4809 } 4810 4811 if (debug) { 4812 authname = sppp_auth_type_name(abuf, 4813 sizeof(abuf), PPP_CHAP, h->type); 4814 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) " 4815 "<%s id=0x%x len=%d name=", 4816 sppp_state_name(sp->scp[IDX_CHAP].state), 4817 authname, h->ident, ntohs(h->len)); 4818 sppp_print_string((char *)name, name_len); 4819 addlog(" value-size=%d value=", value_len); 4820 sppp_print_bytes(value, value_len); 4821 addlog(">\n"); 4822 } 4823 4824 if (value_len == sizeof(sp->chap.challenge) && 4825 value_len == sizeof(sp->chap.digest)) { 4826 MD5Init(&ctx); 4827 MD5Update(&ctx, &h->ident, 1); 4828 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4829 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4830 MD5Final(digest, &ctx); 4831 4832 if (memcmp(digest, value, value_len) == 0) { 4833 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4834 } else { 4835 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4836 } 4837 } else { 4838 if (debug) { 4839 SPPP_LOG(sp, LOG_DEBUG, 4840 "chap bad hash value length: " 4841 "%d bytes, should be %zu\n", 4842 value_len, sizeof(sp->chap.challenge)); 4843 } 4844 4845 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4846 } 4847 4848 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4849 4850 /* generate a dummy RCA event */ 4851 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4852 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4853 sp->chap.rechallenging)) { 4854 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4855 } 4856 break; 4857 4858 default: 4859 /* Unknown CHAP packet type -- ignore. */ 4860 if (debug) { 4861 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) " 4862 "<0x%x id=0x%xh len=%d", 4863 sppp_state_name(sp->scp[IDX_CHAP].state), 4864 h->type, h->ident, ntohs(h->len)); 4865 if (len > 4) 4866 sppp_print_bytes((u_char *)(h + 1), len - 4); 4867 addlog(">\n"); 4868 } 4869 break; 4870 4871 } 4872 4873 SPPP_UNLOCK(sp); 4874 } 4875 4876 static void 4877 sppp_chap_init(struct sppp *sp) 4878 { 4879 4880 KASSERT(SPPP_WLOCKED(sp)); 4881 4882 sppp_cp_init(&chap, sp); 4883 4884 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4885 sppp_chap_rcv_challenge_event, &chap); 4886 } 4887 4888 static void 4889 sppp_chap_open(struct sppp *sp, void *xcp) 4890 { 4891 4892 KASSERT(SPPP_WLOCKED(sp)); 4893 4894 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4895 sp->chap.digest_len = 0; 4896 sp->chap.rechallenging = false; 4897 sp->chap.response_rcvd = false; 4898 sppp_open_event(sp, xcp); 4899 } 4900 4901 static void 4902 sppp_chap_tlu(struct sppp *sp) 4903 { 4904 int i, x; 4905 4906 KASSERT(SPPP_WLOCKED(sp)); 4907 4908 i = 0; 4909 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4910 x = splnet(); 4911 sp->pp_auth_failures = 0; 4912 splx(x); 4913 4914 SPPP_LOG(sp, LOG_DEBUG, "chap %s", 4915 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4916 4917 /* 4918 * Some broken CHAP implementations (Conware CoNet, firmware 4919 * 4.0.?) don't want to re-authenticate their CHAP once the 4920 * initial challenge-response exchange has taken place. 4921 * Provide for an option to avoid rechallenges. 4922 */ 4923 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4924 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4925 /* 4926 * Compute the re-challenge timeout. This will yield 4927 * a number between 300 and 810 seconds. 4928 */ 4929 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4930 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4931 4932 if (sppp_debug_enabled(sp)) { 4933 addlog(", next rechallenge in %d seconds", i); 4934 } 4935 } 4936 4937 addlog("\n"); 4938 4939 /* 4940 * If we are already in phase network, we are done here. This 4941 * is the case if this is a dummy tlu event after a re-challenge. 4942 */ 4943 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4944 sppp_phase_network(sp); 4945 } 4946 4947 static void 4948 sppp_chap_scr(struct sppp *sp) 4949 { 4950 uint32_t *ch; 4951 u_char clen, dsize; 4952 int role; 4953 4954 KASSERT(SPPP_WLOCKED(sp)); 4955 4956 role = sppp_auth_role(&chap, sp); 4957 4958 if (ISSET(role, SPPP_AUTH_SERV) && 4959 !sp->chap.response_rcvd) { 4960 /* we are authenticator for CHAP, send challenge */ 4961 ch = (uint32_t *)sp->chap.challenge; 4962 clen = sizeof(sp->chap.challenge); 4963 /* Compute random challenge. */ 4964 cprng_strong(kern_cprng, ch, clen, 0); 4965 4966 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4967 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4968 sizeof(clen), (const char *)&clen, 4969 sizeof(sp->chap.challenge), sp->chap.challenge, 4970 0); 4971 } 4972 4973 if (ISSET(role, SPPP_AUTH_PEER) && 4974 sp->chap.digest_len > 0) { 4975 /* we are peer for CHAP, send response */ 4976 dsize = sp->chap.digest_len; 4977 4978 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 4979 sizeof(dsize), (const char *)&dsize, 4980 sp->chap.digest_len, sp->chap.digest, 4981 sp->myauth.name_len, sp->myauth.name, 0); 4982 } 4983 } 4984 4985 static void 4986 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 4987 { 4988 const struct cp *cp = xcp; 4989 4990 KASSERT(!cpu_softintr_p()); 4991 4992 sp->chap.rechallenging = false; 4993 4994 switch (sp->scp[IDX_CHAP].state) { 4995 case STATE_REQ_SENT: 4996 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 4997 cp->scr(sp); 4998 break; 4999 case STATE_OPENED: 5000 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5001 cp->scr(sp); 5002 break; 5003 } 5004 } 5005 5006 /* 5007 *--------------------------------------------------------------------------* 5008 * * 5009 * The PAP implementation. * 5010 * * 5011 *--------------------------------------------------------------------------* 5012 */ 5013 /* 5014 * PAP uses following actions and events. 5015 * Actions: 5016 * - scr: send PAP_REQ 5017 * - sca: send PAP_ACK 5018 * - scn: send PAP_NAK 5019 * Events: 5020 * - RCR+: receive PAP_REQ containing correct username and password 5021 * - RCR-: receive PAP_REQ containing wrong username and password 5022 * - RCA: receive PAP_ACK 5023 * - RCN: (this event is unused) 5024 * - TO+: re-send PAP_REQ 5025 * - TO-: this layer finish 5026 */ 5027 5028 /* 5029 * Handle incoming PAP packets. */ 5030 static void 5031 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5032 { 5033 struct ifnet *ifp; 5034 struct lcp_header *h; 5035 int len, x; 5036 char *name, *secret; 5037 int name_len, secret_len; 5038 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5039 const char *authname; 5040 bool debug; 5041 5042 ifp = &sp->pp_if; 5043 debug = sppp_debug_enabled(sp); 5044 5045 /* 5046 * Malicious input might leave this uninitialized, so 5047 * init to an impossible value. 5048 */ 5049 secret_len = -1; 5050 5051 len = m->m_pkthdr.len; 5052 if (len < 5) { 5053 SPPP_DLOG(sp, "pap invalid packet length: " 5054 "%d bytes\n", len); 5055 return; 5056 } 5057 h = mtod(m, struct lcp_header *); 5058 if (len > ntohs(h->len)) 5059 len = ntohs(h->len); 5060 5061 SPPP_LOCK(sp, RW_WRITER); 5062 5063 switch (h->type) { 5064 /* PAP request is my authproto */ 5065 case PAP_REQ: 5066 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5067 /* can't do anything useful */ 5068 SPPP_DLOG(sp, "pap request" 5069 " without his name and his secret being set\n"); 5070 break; 5071 } 5072 name = 1 + (u_char *)(h + 1); 5073 name_len = name[-1]; 5074 secret = name + name_len + 1; 5075 if (name_len > len - 6 || 5076 (secret_len = secret[-1]) > len - 6 - name_len) { 5077 if (debug) { 5078 authname = sppp_auth_type_name(abuf, 5079 sizeof(abuf), PPP_PAP, h->type); 5080 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5081 "<%s id=0x%x len=%d", 5082 authname, h->ident, ntohs(h->len)); 5083 if (len > 4) 5084 sppp_print_bytes((u_char *)(h + 1), 5085 len - 4); 5086 addlog(">\n"); 5087 } 5088 break; 5089 } 5090 if (debug) { 5091 authname = sppp_auth_type_name(abuf, 5092 sizeof(abuf), PPP_PAP, h->type); 5093 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) " 5094 "<%s id=0x%x len=%d name=", 5095 sppp_state_name(sp->scp[IDX_PAP].state), 5096 authname, h->ident, ntohs(h->len)); 5097 sppp_print_string((char *)name, name_len); 5098 addlog(" secret="); 5099 sppp_print_string((char *)secret, secret_len); 5100 addlog(">\n"); 5101 } 5102 5103 sp->scp[IDX_PAP].rconfid = h->ident; 5104 5105 if (name_len == sp->hisauth.name_len && 5106 memcmp(name, sp->hisauth.name, name_len) == 0 && 5107 secret_len == sp->hisauth.secret_len && 5108 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5109 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5110 } else { 5111 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5112 } 5113 5114 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5115 5116 /* generate a dummy RCA event */ 5117 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5118 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5119 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5120 } 5121 break; 5122 5123 /* ack and nak are his authproto */ 5124 case PAP_ACK: 5125 if (debug) { 5126 SPPP_LOG(sp, LOG_DEBUG, "pap success"); 5127 name = 1 + (u_char *)(h + 1); 5128 name_len = name[-1]; 5129 if (len > 5 && name_len < len+4) { 5130 addlog(": "); 5131 sppp_print_string(name, name_len); 5132 } 5133 addlog("\n"); 5134 } 5135 5136 if (h->ident != sp->scp[IDX_PAP].confid) { 5137 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5138 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5139 if_statinc(ifp, if_ierrors); 5140 break; 5141 } 5142 5143 x = splnet(); 5144 sp->pp_auth_failures = 0; 5145 sp->pp_flags &= ~PP_NEEDAUTH; 5146 splx(x); 5147 5148 /* we are not authenticator, generate a dummy RCR+ event */ 5149 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5150 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5151 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5152 } 5153 5154 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5155 break; 5156 5157 case PAP_NAK: 5158 if (debug) { 5159 SPPP_LOG(sp, LOG_INFO, "pap failure"); 5160 name = 1 + (u_char *)(h + 1); 5161 name_len = name[-1]; 5162 if (len > 5 && name_len < len+4) { 5163 addlog(": "); 5164 sppp_print_string(name, name_len); 5165 } 5166 addlog("\n"); 5167 } else { 5168 SPPP_LOG(sp, LOG_INFO, "pap failure\n"); 5169 } 5170 5171 if (h->ident != sp->scp[IDX_PAP].confid) { 5172 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5173 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5174 if_statinc(ifp, if_ierrors); 5175 break; 5176 } 5177 5178 sp->pp_auth_failures++; 5179 /* 5180 * await LCP shutdown by authenticator, 5181 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5182 */ 5183 break; 5184 5185 default: 5186 /* Unknown PAP packet type -- ignore. */ 5187 if (debug) { 5188 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5189 "<0x%x id=0x%x len=%d", 5190 h->type, h->ident, ntohs(h->len)); 5191 if (len > 4) 5192 sppp_print_bytes((u_char *)(h + 1), len - 4); 5193 addlog(">\n"); 5194 } 5195 break; 5196 } 5197 5198 SPPP_UNLOCK(sp); 5199 } 5200 5201 static void 5202 sppp_pap_init(struct sppp *sp) 5203 { 5204 5205 KASSERT(SPPP_WLOCKED(sp)); 5206 sppp_cp_init(&pap, sp); 5207 } 5208 5209 static void 5210 sppp_pap_tlu(struct sppp *sp) 5211 { 5212 int x; 5213 5214 SPPP_DLOG(sp, "%s tlu\n", pap.name); 5215 5216 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5217 x = splnet(); 5218 sp->pp_auth_failures = 0; 5219 splx(x); 5220 5221 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5222 sppp_phase_network(sp); 5223 } 5224 5225 static void 5226 sppp_pap_scr(struct sppp *sp) 5227 { 5228 u_char idlen, pwdlen; 5229 5230 KASSERT(SPPP_WLOCKED(sp)); 5231 5232 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5233 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5234 if (sp->myauth.secret == NULL || 5235 sp->myauth.name == NULL) { 5236 SPPP_LOG(sp, LOG_DEBUG, 5237 "couldn't send PAP_REQ " 5238 "because of no name or no secret\n"); 5239 } else { 5240 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5241 pwdlen = sp->myauth.secret_len; 5242 idlen = sp->myauth.name_len; 5243 5244 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5245 sizeof idlen, (const char *)&idlen, 5246 idlen, sp->myauth.name, 5247 sizeof pwdlen, (const char *)&pwdlen, 5248 pwdlen, sp->myauth.secret, 5249 0); 5250 } 5251 } 5252 } 5253 5254 /* 5255 * Random miscellaneous functions. 5256 */ 5257 5258 /* 5259 * Send a PAP or CHAP proto packet. 5260 * 5261 * Varadic function, each of the elements for the ellipsis is of type 5262 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5263 * mlen == 0. 5264 * NOTE: never declare variadic functions with types subject to type 5265 * promotion (i.e. u_char). This is asking for big trouble depending 5266 * on the architecture you are on... 5267 */ 5268 5269 static void 5270 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5271 unsigned int type, unsigned int id, 5272 ...) 5273 { 5274 struct ifnet *ifp; 5275 struct lcp_header *lh; 5276 struct mbuf *m; 5277 u_char *p; 5278 int len; 5279 size_t pkthdrlen; 5280 unsigned int mlen; 5281 const char *msg; 5282 va_list ap; 5283 5284 KASSERT(SPPP_WLOCKED(sp)); 5285 5286 ifp = &sp->pp_if; 5287 5288 MGETHDR(m, M_DONTWAIT, MT_DATA); 5289 if (! m) 5290 return; 5291 m_reset_rcvif(m); 5292 5293 if (sp->pp_flags & PP_NOFRAMING) { 5294 *mtod(m, uint16_t *) = htons(cp->proto); 5295 pkthdrlen = 2; 5296 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5297 } else { 5298 struct ppp_header *h; 5299 h = mtod(m, struct ppp_header *); 5300 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5301 h->control = PPP_UI; /* Unnumbered Info */ 5302 h->protocol = htons(cp->proto); 5303 pkthdrlen = PPP_HEADER_LEN; 5304 5305 lh = (struct lcp_header *)(h + 1); 5306 } 5307 5308 lh->type = type; 5309 lh->ident = id; 5310 p = (u_char *)(lh + 1); 5311 5312 va_start(ap, id); 5313 len = 0; 5314 5315 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5316 msg = va_arg(ap, const char *); 5317 len += mlen; 5318 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5319 va_end(ap); 5320 m_freem(m); 5321 return; 5322 } 5323 5324 memcpy(p, msg, mlen); 5325 p += mlen; 5326 } 5327 va_end(ap); 5328 5329 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5330 lh->len = htons(LCP_HEADER_LEN + len); 5331 5332 if (sppp_debug_enabled(sp)) { 5333 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5334 const char *authname; 5335 5336 authname = sppp_auth_type_name(abuf, 5337 sizeof(abuf), cp->proto, lh->type); 5338 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 5339 cp->name, authname, 5340 lh->ident, ntohs(lh->len)); 5341 if (len) 5342 sppp_print_bytes((u_char *)(lh + 1), len); 5343 addlog(">\n"); 5344 } 5345 if (IF_QFULL(&sp->pp_cpq)) { 5346 IF_DROP(&sp->pp_fastq); 5347 IF_DROP(&ifp->if_snd); 5348 m_freem(m); 5349 if_statinc(ifp, if_oerrors); 5350 return; 5351 } 5352 5353 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5354 IF_ENQUEUE(&sp->pp_cpq, m); 5355 5356 if (! (ifp->if_flags & IFF_OACTIVE)) { 5357 SPPP_UNLOCK(sp); 5358 if_start_lock(ifp); 5359 SPPP_LOCK(sp, RW_WRITER); 5360 } 5361 } 5362 5363 static int 5364 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5365 { 5366 int role; 5367 5368 role = SPPP_AUTH_NOROLE; 5369 5370 if (sp->hisauth.proto == cp->proto && 5371 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5372 SET(role, SPPP_AUTH_SERV); 5373 5374 if (sp->myauth.proto == cp->proto) 5375 SET(role, SPPP_AUTH_PEER); 5376 5377 return role; 5378 } 5379 5380 static void 5381 sppp_auth_to_event(struct sppp *sp, void *xcp) 5382 { 5383 const struct cp *cp = xcp; 5384 bool override; 5385 int state; 5386 5387 KASSERT(SPPP_WLOCKED(sp)); 5388 KASSERT(!cpu_softintr_p()); 5389 5390 override = false; 5391 state = sp->scp[cp->protoidx].state; 5392 5393 if (sp->scp[cp->protoidx].rst_counter > 0) { 5394 /* override TO+ event */ 5395 switch (state) { 5396 case STATE_OPENED: 5397 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5398 override = true; 5399 sp->chap.rechallenging = true; 5400 sp->chap.response_rcvd = false; 5401 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5402 cp->scr(sp); 5403 } 5404 break; 5405 5406 case STATE_ACK_RCVD: 5407 override = true; 5408 cp->scr(sp); 5409 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5410 break; 5411 } 5412 } 5413 5414 if (override) { 5415 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", 5416 cp->name, sppp_state_name(state), 5417 sp->scp[cp->protoidx].rst_counter); 5418 sp->scp[cp->protoidx].rst_counter--; 5419 } else { 5420 sppp_to_event(sp, xcp); 5421 } 5422 } 5423 5424 static void 5425 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5426 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5427 { 5428 static const char *succmsg = "Welcome!"; 5429 static const char *failmsg = "Failed..."; 5430 const char *msg; 5431 u_char type, mlen; 5432 5433 KASSERT(SPPP_WLOCKED(sp)); 5434 5435 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5436 return; 5437 5438 if (ctype == CONF_ACK) { 5439 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5440 msg = succmsg; 5441 mlen = sizeof(succmsg) - 1; 5442 5443 sp->pp_auth_failures = 0; 5444 } else { 5445 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5446 msg = failmsg; 5447 mlen = sizeof(failmsg) - 1; 5448 5449 /* shutdown LCP if auth failed */ 5450 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5451 sp->pp_auth_failures++; 5452 } 5453 5454 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5455 } 5456 5457 /* 5458 * Send keepalive packets, every 10 seconds. 5459 */ 5460 static void 5461 sppp_keepalive(void *dummy) 5462 { 5463 struct sppp *sp; 5464 int s; 5465 time_t now; 5466 5467 SPPPQ_LOCK(); 5468 5469 s = splnet(); 5470 now = time_uptime; 5471 for (sp=spppq; sp; sp=sp->pp_next) { 5472 struct ifnet *ifp = NULL; 5473 5474 SPPP_LOCK(sp, RW_WRITER); 5475 ifp = &sp->pp_if; 5476 5477 /* check idle timeout */ 5478 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5479 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5480 /* idle timeout is enabled for this interface */ 5481 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5482 SPPP_DLOG(sp, "no activity for %lu seconds\n", 5483 (unsigned long)(now-sp->pp_last_activity)); 5484 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5485 SPPP_UNLOCK(sp); 5486 continue; 5487 } 5488 } 5489 5490 /* Keepalive mode disabled or channel down? */ 5491 if (! (sp->pp_flags & PP_KEEPALIVE) || 5492 ! (ifp->if_flags & IFF_RUNNING)) { 5493 SPPP_UNLOCK(sp); 5494 continue; 5495 } 5496 5497 /* No keepalive in PPP mode if LCP not opened yet. */ 5498 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5499 SPPP_UNLOCK(sp); 5500 continue; 5501 } 5502 5503 /* No echo reply, but maybe user data passed through? */ 5504 if (sp->pp_max_noreceive != 0 && 5505 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5506 sp->pp_alivecnt = 0; 5507 SPPP_UNLOCK(sp); 5508 continue; 5509 } 5510 5511 /* No echo request */ 5512 if (sp->pp_alive_interval == 0) { 5513 SPPP_UNLOCK(sp); 5514 continue; 5515 } 5516 5517 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5518 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5519 SPPP_UNLOCK(sp); 5520 continue; 5521 } 5522 5523 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5524 /* No keepalive packets got. Stop the interface. */ 5525 if (sp->pp_flags & PP_KEEPALIVE_IFDOWN) 5526 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5527 5528 SPPP_LOG(sp, LOG_INFO,"LCP keepalive timed out, " 5529 "going to restart the connection\n"); 5530 sp->pp_alivecnt = 0; 5531 5532 /* we are down, close all open protocols */ 5533 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5534 5535 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5536 sp->lcp.reestablish = true; 5537 5538 SPPP_UNLOCK(sp); 5539 continue; 5540 } 5541 if (sp->pp_alivecnt < sp->pp_maxalive) 5542 ++sp->pp_alivecnt; 5543 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5544 int32_t nmagic = htonl(sp->lcp.magic); 5545 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5546 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5547 sp->lcp.echoid, 4, &nmagic); 5548 } 5549 5550 SPPP_UNLOCK(sp); 5551 } 5552 splx(s); 5553 sppp_keepalive_cnt++; 5554 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5555 5556 SPPPQ_UNLOCK(); 5557 } 5558 5559 #ifdef INET 5560 /* 5561 * Get both IP addresses. 5562 */ 5563 static void 5564 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5565 { 5566 struct ifnet *ifp = &sp->pp_if; 5567 struct ifaddr *ifa; 5568 struct sockaddr_in *si, *sm; 5569 uint32_t ssrc, ddst; 5570 int s; 5571 struct psref psref; 5572 5573 sm = NULL; 5574 ssrc = ddst = 0; 5575 /* 5576 * Pick the first AF_INET address from the list, 5577 * aliases don't make any sense on a p2p link anyway. 5578 */ 5579 si = 0; 5580 s = pserialize_read_enter(); 5581 IFADDR_READER_FOREACH(ifa, ifp) { 5582 if (ifa->ifa_addr->sa_family == AF_INET) { 5583 si = (struct sockaddr_in *)ifa->ifa_addr; 5584 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5585 if (si) { 5586 ifa_acquire(ifa, &psref); 5587 break; 5588 } 5589 } 5590 } 5591 pserialize_read_exit(s); 5592 if (ifa) { 5593 if (si && si->sin_addr.s_addr) { 5594 ssrc = si->sin_addr.s_addr; 5595 if (srcmask) 5596 *srcmask = ntohl(sm->sin_addr.s_addr); 5597 } 5598 5599 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5600 if (si && si->sin_addr.s_addr) 5601 ddst = si->sin_addr.s_addr; 5602 ifa_release(ifa, &psref); 5603 } 5604 5605 if (dst) *dst = ntohl(ddst); 5606 if (src) *src = ntohl(ssrc); 5607 } 5608 5609 /* 5610 * Set IP addresses. Must be called at splnet. 5611 * If an address is 0, leave it the way it is. 5612 */ 5613 static void 5614 sppp_set_ip_addrs(struct sppp *sp) 5615 { 5616 struct ifnet *ifp; 5617 struct ifaddr *ifa; 5618 struct sockaddr_in *si, *dest; 5619 uint32_t myaddr = 0, hisaddr = 0; 5620 int s; 5621 5622 KASSERT(SPPP_WLOCKED(sp)); 5623 5624 ifp = &sp->pp_if; 5625 5626 SPPP_UNLOCK(sp); 5627 IFNET_LOCK(ifp); 5628 SPPP_LOCK(sp, RW_WRITER); 5629 5630 /* 5631 * Pick the first AF_INET address from the list, 5632 * aliases don't make any sense on a p2p link anyway. 5633 */ 5634 si = dest = NULL; 5635 s = pserialize_read_enter(); 5636 IFADDR_READER_FOREACH(ifa, ifp) { 5637 if (ifa->ifa_addr->sa_family == AF_INET) { 5638 si = (struct sockaddr_in *)ifa->ifa_addr; 5639 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5640 break; 5641 } 5642 } 5643 pserialize_read_exit(s); 5644 5645 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5646 myaddr = sp->ipcp.req_myaddr; 5647 else if (si != NULL) 5648 myaddr = ntohl(si->sin_addr.s_addr); 5649 5650 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5651 hisaddr = sp->ipcp.req_hisaddr; 5652 else if (dest != NULL) 5653 hisaddr = ntohl(dest->sin_addr.s_addr); 5654 5655 if (si != NULL && dest != NULL) { 5656 int error; 5657 struct sockaddr_in new_sin = *si; 5658 struct sockaddr_in new_dst = *dest; 5659 5660 if (myaddr != 0) 5661 new_sin.sin_addr.s_addr = htonl(myaddr); 5662 if (hisaddr != 0) { 5663 new_dst.sin_addr.s_addr = htonl(hisaddr); 5664 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5665 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5666 } 5667 5668 in_addrhash_remove(ifatoia(ifa)); 5669 5670 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5671 5672 in_addrhash_insert(ifatoia(ifa)); 5673 5674 if (error) { 5675 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5676 __func__, error); 5677 } else { 5678 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5679 } 5680 } 5681 5682 IFNET_UNLOCK(ifp); 5683 5684 sppp_notify_con(sp); 5685 } 5686 5687 /* 5688 * Clear IP addresses. Must be called at splnet. 5689 */ 5690 static void 5691 sppp_clear_ip_addrs(struct sppp *sp) 5692 { 5693 struct ifnet *ifp; 5694 struct ifaddr *ifa; 5695 struct sockaddr_in *si, *dest; 5696 int s; 5697 5698 KASSERT(SPPP_WLOCKED(sp)); 5699 5700 ifp = &sp->pp_if; 5701 5702 SPPP_UNLOCK(sp); 5703 IFNET_LOCK(ifp); 5704 SPPP_LOCK(sp, RW_WRITER); 5705 5706 /* 5707 * Pick the first AF_INET address from the list, 5708 * aliases don't make any sense on a p2p link anyway. 5709 */ 5710 si = dest = NULL; 5711 s = pserialize_read_enter(); 5712 IFADDR_READER_FOREACH(ifa, ifp) { 5713 if (ifa->ifa_addr->sa_family == AF_INET) { 5714 si = (struct sockaddr_in *)ifa->ifa_addr; 5715 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5716 break; 5717 } 5718 } 5719 pserialize_read_exit(s); 5720 5721 if (si != NULL) { 5722 struct sockaddr_in new_sin = *si; 5723 struct sockaddr_in new_dst = *dest; 5724 int error; 5725 5726 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5727 new_sin.sin_addr.s_addr = 0; 5728 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5729 ntohl(sp->ipcp.saved_hisaddr) != 0) 5730 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5731 5732 in_addrhash_remove(ifatoia(ifa)); 5733 5734 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5735 5736 in_addrhash_insert(ifatoia(ifa)); 5737 5738 if (error) { 5739 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5740 __func__, error); 5741 } else { 5742 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5743 } 5744 } 5745 5746 IFNET_UNLOCK(ifp); 5747 } 5748 #endif 5749 5750 #ifdef INET6 5751 /* 5752 * Get both IPv6 addresses. 5753 */ 5754 static void 5755 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5756 struct in6_addr *srcmask) 5757 { 5758 struct ifnet *ifp = &sp->pp_if; 5759 struct ifaddr *ifa; 5760 struct sockaddr_in6 *si, *sm; 5761 struct in6_addr ssrc, ddst; 5762 int s; 5763 struct psref psref; 5764 5765 sm = NULL; 5766 memset(&ssrc, 0, sizeof(ssrc)); 5767 memset(&ddst, 0, sizeof(ddst)); 5768 /* 5769 * Pick the first link-local AF_INET6 address from the list, 5770 * aliases don't make any sense on a p2p link anyway. 5771 */ 5772 si = 0; 5773 s = pserialize_read_enter(); 5774 IFADDR_READER_FOREACH(ifa, ifp) { 5775 if (ifa->ifa_addr->sa_family == AF_INET6) { 5776 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5777 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5778 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5779 ifa_acquire(ifa, &psref); 5780 break; 5781 } 5782 } 5783 } 5784 pserialize_read_exit(s); 5785 5786 if (ifa) { 5787 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5788 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5789 if (srcmask) { 5790 memcpy(srcmask, &sm->sin6_addr, 5791 sizeof(*srcmask)); 5792 } 5793 } 5794 5795 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5796 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5797 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5798 ifa_release(ifa, &psref); 5799 } 5800 5801 if (dst) 5802 memcpy(dst, &ddst, sizeof(*dst)); 5803 if (src) 5804 memcpy(src, &ssrc, sizeof(*src)); 5805 } 5806 5807 #ifdef IPV6CP_MYIFID_DYN 5808 /* 5809 * Generate random ifid. 5810 */ 5811 static void 5812 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5813 { 5814 /* TBD */ 5815 } 5816 5817 /* 5818 * Set my IPv6 address. Must be called at splnet. 5819 */ 5820 static void 5821 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5822 { 5823 struct ifnet *ifp; 5824 struct ifaddr *ifa; 5825 struct sockaddr_in6 *sin6; 5826 int s; 5827 struct psref psref; 5828 5829 KASSERT(SPPP_WLOCKED(sp)); 5830 5831 ifp = &sp->pp_if; 5832 5833 SPPP_UNLOCK(sp); 5834 IFNET_LOCK(ifp); 5835 SPPP_LOCK(sp, RW_WRITER); 5836 5837 /* 5838 * Pick the first link-local AF_INET6 address from the list, 5839 * aliases don't make any sense on a p2p link anyway. 5840 */ 5841 5842 sin6 = NULL; 5843 s = pserialize_read_enter(); 5844 IFADDR_READER_FOREACH(ifa, ifp) 5845 { 5846 if (ifa->ifa_addr->sa_family == AF_INET6) 5847 { 5848 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5849 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5850 ifa_acquire(ifa, &psref); 5851 break; 5852 } 5853 } 5854 } 5855 pserialize_read_exit(s); 5856 5857 if (ifa && sin6) 5858 { 5859 int error; 5860 struct sockaddr_in6 new_sin6 = *sin6; 5861 5862 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5863 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5864 if (error) { 5865 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n", 5866 __func__, error); 5867 } else { 5868 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5869 } 5870 ifa_release(ifa, &psref); 5871 } 5872 5873 IFNET_UNLOCK(ifp); 5874 } 5875 #endif 5876 5877 /* 5878 * Suggest a candidate address to be used by peer. 5879 */ 5880 static void 5881 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5882 { 5883 struct in6_addr myaddr; 5884 struct timeval tv; 5885 5886 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5887 5888 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5889 microtime(&tv); 5890 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5891 myaddr.s6_addr[14] ^= 0xff; 5892 myaddr.s6_addr[15] ^= 0xff; 5893 } else { 5894 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5895 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5896 } 5897 if (suggest) 5898 memcpy(suggest, &myaddr, sizeof(myaddr)); 5899 } 5900 #endif /*INET6*/ 5901 5902 /* 5903 * Process ioctl requests specific to the PPP interface. 5904 * Permissions have already been checked. 5905 */ 5906 static int 5907 sppp_params(struct sppp *sp, u_long cmd, void *data) 5908 { 5909 switch (cmd) { 5910 case SPPPGETAUTHCFG: 5911 { 5912 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5913 int error; 5914 size_t len; 5915 5916 SPPP_LOCK(sp, RW_READER); 5917 5918 cfg->myauthflags = sp->myauth.flags; 5919 cfg->hisauthflags = sp->hisauth.flags; 5920 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5921 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 5922 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 5923 if (cfg->myname_length == 0) { 5924 if (sp->myauth.name != NULL) 5925 cfg->myname_length = sp->myauth.name_len + 1; 5926 } else { 5927 if (sp->myauth.name == NULL) { 5928 cfg->myname_length = 0; 5929 } else { 5930 len = sp->myauth.name_len + 1; 5931 5932 if (cfg->myname_length < len) { 5933 SPPP_UNLOCK(sp); 5934 return (ENAMETOOLONG); 5935 } 5936 error = copyout(sp->myauth.name, cfg->myname, len); 5937 if (error) { 5938 SPPP_UNLOCK(sp); 5939 return error; 5940 } 5941 } 5942 } 5943 if (cfg->hisname_length == 0) { 5944 if (sp->hisauth.name != NULL) 5945 cfg->hisname_length = sp->hisauth.name_len + 1; 5946 } else { 5947 if (sp->hisauth.name == NULL) { 5948 cfg->hisname_length = 0; 5949 } else { 5950 len = sp->hisauth.name_len + 1; 5951 5952 if (cfg->hisname_length < len) { 5953 SPPP_UNLOCK(sp); 5954 return (ENAMETOOLONG); 5955 } 5956 error = copyout(sp->hisauth.name, cfg->hisname, len); 5957 if (error) { 5958 SPPP_UNLOCK(sp); 5959 return error; 5960 } 5961 } 5962 } 5963 SPPP_UNLOCK(sp); 5964 } 5965 break; 5966 case SPPPSETAUTHCFG: 5967 { 5968 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5969 int error; 5970 5971 SPPP_LOCK(sp, RW_WRITER); 5972 5973 if (sp->myauth.name) { 5974 free(sp->myauth.name, M_DEVBUF); 5975 sp->myauth.name = NULL; 5976 } 5977 if (sp->myauth.secret) { 5978 free(sp->myauth.secret, M_DEVBUF); 5979 sp->myauth.secret = NULL; 5980 } 5981 if (sp->hisauth.name) { 5982 free(sp->hisauth.name, M_DEVBUF); 5983 sp->hisauth.name = NULL; 5984 } 5985 if (sp->hisauth.secret) { 5986 free(sp->hisauth.secret, M_DEVBUF); 5987 sp->hisauth.secret = NULL; 5988 } 5989 5990 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5991 if (cfg->hisname_length >= MCLBYTES) { 5992 SPPP_UNLOCK(sp); 5993 return (ENAMETOOLONG); 5994 } 5995 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5996 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5997 if (error) { 5998 free(sp->hisauth.name, M_DEVBUF); 5999 sp->hisauth.name = NULL; 6000 SPPP_UNLOCK(sp); 6001 return error; 6002 } 6003 sp->hisauth.name_len = cfg->hisname_length - 1; 6004 sp->hisauth.name[sp->hisauth.name_len] = 0; 6005 } 6006 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6007 if (cfg->hissecret_length >= MCLBYTES) { 6008 SPPP_UNLOCK(sp); 6009 return (ENAMETOOLONG); 6010 } 6011 sp->hisauth.secret = malloc(cfg->hissecret_length, 6012 M_DEVBUF, M_WAITOK); 6013 error = copyin(cfg->hissecret, sp->hisauth.secret, 6014 cfg->hissecret_length); 6015 if (error) { 6016 free(sp->hisauth.secret, M_DEVBUF); 6017 sp->hisauth.secret = NULL; 6018 SPPP_UNLOCK(sp); 6019 return error; 6020 } 6021 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6022 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6023 } 6024 if (cfg->myname != NULL && cfg->myname_length > 0) { 6025 if (cfg->myname_length >= MCLBYTES) { 6026 SPPP_UNLOCK(sp); 6027 return (ENAMETOOLONG); 6028 } 6029 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6030 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6031 if (error) { 6032 free(sp->myauth.name, M_DEVBUF); 6033 sp->myauth.name = NULL; 6034 SPPP_UNLOCK(sp); 6035 return error; 6036 } 6037 sp->myauth.name_len = cfg->myname_length - 1; 6038 sp->myauth.name[sp->myauth.name_len] = 0; 6039 } 6040 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6041 if (cfg->mysecret_length >= MCLBYTES) { 6042 SPPP_UNLOCK(sp); 6043 return (ENAMETOOLONG); 6044 } 6045 sp->myauth.secret = malloc(cfg->mysecret_length, 6046 M_DEVBUF, M_WAITOK); 6047 error = copyin(cfg->mysecret, sp->myauth.secret, 6048 cfg->mysecret_length); 6049 if (error) { 6050 free(sp->myauth.secret, M_DEVBUF); 6051 sp->myauth.secret = NULL; 6052 SPPP_UNLOCK(sp); 6053 return error; 6054 } 6055 sp->myauth.secret_len = cfg->mysecret_length - 1; 6056 sp->myauth.secret[sp->myauth.secret_len] = 0; 6057 } 6058 sp->myauth.flags = cfg->myauthflags; 6059 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6060 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6061 } 6062 sp->hisauth.flags = cfg->hisauthflags; 6063 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6064 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6065 } 6066 sp->pp_auth_failures = 0; 6067 if (sp->hisauth.proto != PPP_NOPROTO) 6068 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6069 else 6070 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6071 6072 SPPP_UNLOCK(sp); 6073 } 6074 break; 6075 case SPPPGETLCPCFG: 6076 { 6077 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6078 6079 SPPP_LOCK(sp, RW_READER); 6080 lcpp->lcp_timeout = sp->lcp.timeout; 6081 SPPP_UNLOCK(sp); 6082 } 6083 break; 6084 case SPPPSETLCPCFG: 6085 { 6086 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6087 6088 SPPP_LOCK(sp, RW_WRITER); 6089 sp->lcp.timeout = lcpp->lcp_timeout; 6090 SPPP_UNLOCK(sp); 6091 } 6092 break; 6093 case SPPPGETNCPCFG: 6094 { 6095 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6096 6097 SPPP_LOCK(sp, RW_READER); 6098 ncpp->ncp_flags = sp->pp_ncpflags; 6099 SPPP_UNLOCK(sp); 6100 } 6101 break; 6102 case SPPPSETNCPCFG: 6103 { 6104 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6105 6106 SPPP_LOCK(sp, RW_WRITER); 6107 sp->pp_ncpflags = ncpp->ncp_flags; 6108 SPPP_UNLOCK(sp); 6109 } 6110 break; 6111 case SPPPGETSTATUS: 6112 { 6113 struct spppstatus *status = (struct spppstatus *)data; 6114 6115 SPPP_LOCK(sp, RW_READER); 6116 status->phase = sp->pp_phase; 6117 SPPP_UNLOCK(sp); 6118 } 6119 break; 6120 case SPPPGETSTATUSNCP: 6121 { 6122 struct spppstatusncp *status = (struct spppstatusncp *)data; 6123 6124 SPPP_LOCK(sp, RW_READER); 6125 status->phase = sp->pp_phase; 6126 status->ncpup = sppp_cp_check(sp, CP_NCP); 6127 SPPP_UNLOCK(sp); 6128 } 6129 break; 6130 case SPPPGETIDLETO: 6131 { 6132 struct spppidletimeout *to = (struct spppidletimeout *)data; 6133 6134 SPPP_LOCK(sp, RW_READER); 6135 to->idle_seconds = sp->pp_idle_timeout; 6136 SPPP_UNLOCK(sp); 6137 } 6138 break; 6139 case SPPPSETIDLETO: 6140 { 6141 struct spppidletimeout *to = (struct spppidletimeout *)data; 6142 6143 SPPP_LOCK(sp, RW_WRITER); 6144 sp->pp_idle_timeout = to->idle_seconds; 6145 SPPP_UNLOCK(sp); 6146 } 6147 break; 6148 case SPPPSETAUTHFAILURE: 6149 { 6150 struct spppauthfailuresettings *afsettings = 6151 (struct spppauthfailuresettings *)data; 6152 6153 SPPP_LOCK(sp, RW_WRITER); 6154 sp->pp_max_auth_fail = afsettings->max_failures; 6155 sp->pp_auth_failures = 0; 6156 SPPP_UNLOCK(sp); 6157 } 6158 break; 6159 case SPPPGETAUTHFAILURES: 6160 { 6161 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6162 6163 SPPP_LOCK(sp, RW_READER); 6164 stats->auth_failures = sp->pp_auth_failures; 6165 stats->max_failures = sp->pp_max_auth_fail; 6166 SPPP_UNLOCK(sp); 6167 } 6168 break; 6169 case SPPPSETDNSOPTS: 6170 { 6171 struct spppdnssettings *req = (struct spppdnssettings *)data; 6172 6173 SPPP_LOCK(sp, RW_WRITER); 6174 sp->query_dns = req->query_dns & 3; 6175 SPPP_UNLOCK(sp); 6176 } 6177 break; 6178 case SPPPGETDNSOPTS: 6179 { 6180 struct spppdnssettings *req = (struct spppdnssettings *)data; 6181 6182 SPPP_LOCK(sp, RW_READER); 6183 req->query_dns = sp->query_dns; 6184 SPPP_UNLOCK(sp); 6185 } 6186 break; 6187 case SPPPGETDNSADDRS: 6188 { 6189 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6190 6191 SPPP_LOCK(sp, RW_READER); 6192 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6193 SPPP_UNLOCK(sp); 6194 } 6195 break; 6196 case SPPPGETKEEPALIVE: 6197 { 6198 struct spppkeepalivesettings *settings = 6199 (struct spppkeepalivesettings*)data; 6200 6201 SPPP_LOCK(sp, RW_READER); 6202 settings->maxalive = sp->pp_maxalive; 6203 settings->max_noreceive = sp->pp_max_noreceive; 6204 settings->alive_interval = sp->pp_alive_interval; 6205 SPPP_UNLOCK(sp); 6206 } 6207 break; 6208 case SPPPSETKEEPALIVE: 6209 { 6210 struct spppkeepalivesettings *settings = 6211 (struct spppkeepalivesettings*)data; 6212 6213 SPPP_LOCK(sp, RW_WRITER); 6214 sp->pp_maxalive = settings->maxalive; 6215 sp->pp_max_noreceive = settings->max_noreceive; 6216 sp->pp_alive_interval = settings->alive_interval; 6217 SPPP_UNLOCK(sp); 6218 } 6219 break; 6220 case SPPPGETLCPSTATUS: 6221 { 6222 struct sppplcpstatus *status = 6223 (struct sppplcpstatus *)data; 6224 6225 SPPP_LOCK(sp, RW_READER); 6226 status->state = sp->scp[IDX_LCP].state; 6227 status->opts = sp->lcp.opts; 6228 status->magic = sp->lcp.magic; 6229 status->mru = sp->lcp.mru; 6230 SPPP_UNLOCK(sp); 6231 } 6232 break; 6233 case SPPPGETIPCPSTATUS: 6234 { 6235 struct spppipcpstatus *status = 6236 (struct spppipcpstatus *)data; 6237 u_int32_t myaddr; 6238 6239 SPPP_LOCK(sp, RW_READER); 6240 status->state = sp->scp[IDX_IPCP].state; 6241 status->opts = sp->ipcp.opts; 6242 #ifdef INET 6243 kpreempt_disable(); 6244 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6245 kpreempt_enable(); 6246 #else 6247 myaddr = 0; 6248 #endif 6249 status->myaddr = ntohl(myaddr); 6250 SPPP_UNLOCK(sp); 6251 } 6252 break; 6253 case SPPPGETIPV6CPSTATUS: 6254 { 6255 struct spppipv6cpstatus *status = 6256 (struct spppipv6cpstatus *)data; 6257 6258 SPPP_LOCK(sp, RW_READER); 6259 status->state = sp->scp[IDX_IPV6CP].state; 6260 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6261 sizeof(status->my_ifid)); 6262 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6263 sizeof(status->his_ifid)); 6264 SPPP_UNLOCK(sp); 6265 } 6266 break; 6267 default: 6268 { 6269 int ret; 6270 6271 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6272 enosys(), ret); 6273 if (ret != ENOSYS) 6274 return ret; 6275 return (EINVAL); 6276 } 6277 } 6278 return (0); 6279 } 6280 6281 static void 6282 sppp_phase_network(struct sppp *sp) 6283 { 6284 int i; 6285 6286 KASSERT(SPPP_WLOCKED(sp)); 6287 6288 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6289 6290 /* Notify NCPs now. */ 6291 for (i = 0; i < IDX_COUNT; i++) 6292 if ((cps[i])->flags & CP_NCP) 6293 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6294 } 6295 6296 static const char * 6297 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6298 { 6299 6300 switch (type) { 6301 case CONF_REQ: return "conf-req"; 6302 case CONF_ACK: return "conf-ack"; 6303 case CONF_NAK: return "conf-nak"; 6304 case CONF_REJ: return "conf-rej"; 6305 case TERM_REQ: return "term-req"; 6306 case TERM_ACK: return "term-ack"; 6307 case CODE_REJ: return "code-rej"; 6308 case PROTO_REJ: return "proto-rej"; 6309 case ECHO_REQ: return "echo-req"; 6310 case ECHO_REPLY: return "echo-reply"; 6311 case DISC_REQ: return "discard-req"; 6312 } 6313 if (buf != NULL) 6314 snprintf(buf, buflen, "0x%02x", type); 6315 return buf; 6316 } 6317 6318 static const char * 6319 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6320 { 6321 const char *name; 6322 6323 switch (proto) { 6324 case PPP_CHAP: 6325 switch (type) { 6326 case CHAP_CHALLENGE: return "challenge"; 6327 case CHAP_RESPONSE: return "response"; 6328 case CHAP_SUCCESS: return "success"; 6329 case CHAP_FAILURE: return "failure"; 6330 default: name = "chap"; break; 6331 } 6332 break; 6333 6334 case PPP_PAP: 6335 switch (type) { 6336 case PAP_REQ: return "req"; 6337 case PAP_ACK: return "ack"; 6338 case PAP_NAK: return "nak"; 6339 default: name = "pap"; break; 6340 } 6341 break; 6342 6343 default: 6344 name = "bad"; 6345 break; 6346 } 6347 6348 if (buf != NULL) 6349 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6350 return buf; 6351 } 6352 6353 static const char * 6354 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6355 { 6356 6357 switch (opt) { 6358 case LCP_OPT_MRU: return "mru"; 6359 case LCP_OPT_ASYNC_MAP: return "async-map"; 6360 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6361 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6362 case LCP_OPT_MAGIC: return "magic"; 6363 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6364 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6365 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6366 case LCP_OPT_CALL_BACK: return "callback"; 6367 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6368 case LCP_OPT_MP_MRRU: return "mrru"; 6369 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6370 case LCP_OPT_MP_EID: return "mp-eid"; 6371 } 6372 if (buf != NULL) 6373 snprintf(buf, buflen, "0x%02x", opt); 6374 return buf; 6375 } 6376 6377 static const char * 6378 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6379 { 6380 6381 switch (opt) { 6382 case IPCP_OPT_ADDRESSES: return "addresses"; 6383 case IPCP_OPT_COMPRESSION: return "compression"; 6384 case IPCP_OPT_ADDRESS: return "address"; 6385 case IPCP_OPT_PRIMDNS: return "primdns"; 6386 case IPCP_OPT_SECDNS: return "secdns"; 6387 } 6388 if (buf != NULL) 6389 snprintf(buf, buflen, "0x%02x", opt); 6390 return buf; 6391 } 6392 6393 #ifdef INET6 6394 static const char * 6395 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6396 { 6397 6398 switch (opt) { 6399 case IPV6CP_OPT_IFID: return "ifid"; 6400 case IPV6CP_OPT_COMPRESSION: return "compression"; 6401 } 6402 if (buf != NULL) 6403 snprintf(buf, buflen, "0x%02x", opt); 6404 return buf; 6405 } 6406 #endif 6407 6408 static const char * 6409 sppp_state_name(int state) 6410 { 6411 6412 switch (state) { 6413 case STATE_INITIAL: return "initial"; 6414 case STATE_STARTING: return "starting"; 6415 case STATE_CLOSED: return "closed"; 6416 case STATE_STOPPED: return "stopped"; 6417 case STATE_CLOSING: return "closing"; 6418 case STATE_STOPPING: return "stopping"; 6419 case STATE_REQ_SENT: return "req-sent"; 6420 case STATE_ACK_RCVD: return "ack-rcvd"; 6421 case STATE_ACK_SENT: return "ack-sent"; 6422 case STATE_OPENED: return "opened"; 6423 } 6424 return "illegal"; 6425 } 6426 6427 static const char * 6428 sppp_phase_name(int phase) 6429 { 6430 6431 switch (phase) { 6432 case SPPP_PHASE_DEAD: return "dead"; 6433 case SPPP_PHASE_ESTABLISH: return "establish"; 6434 case SPPP_PHASE_TERMINATE: return "terminate"; 6435 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6436 case SPPP_PHASE_NETWORK: return "network"; 6437 } 6438 return "illegal"; 6439 } 6440 6441 static const char * 6442 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6443 { 6444 6445 switch (proto) { 6446 case PPP_LCP: return "lcp"; 6447 case PPP_IPCP: return "ipcp"; 6448 case PPP_PAP: return "pap"; 6449 case PPP_CHAP: return "chap"; 6450 case PPP_IPV6CP: return "ipv6cp"; 6451 } 6452 if (buf != NULL) { 6453 snprintf(buf, sizeof(buf), "0x%04x", 6454 (unsigned)proto); 6455 } 6456 return buf; 6457 } 6458 6459 static void 6460 sppp_print_bytes(const u_char *p, u_short len) 6461 { 6462 addlog(" %02x", *p++); 6463 while (--len > 0) 6464 addlog("-%02x", *p++); 6465 } 6466 6467 static void 6468 sppp_print_string(const char *p, u_short len) 6469 { 6470 u_char c; 6471 6472 while (len-- > 0) { 6473 c = *p++; 6474 /* 6475 * Print only ASCII chars directly. RFC 1994 recommends 6476 * using only them, but we don't rely on it. */ 6477 if (c < ' ' || c > '~') 6478 addlog("\\x%x", c); 6479 else 6480 addlog("%c", c); 6481 } 6482 } 6483 6484 static const char * 6485 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6486 { 6487 6488 if (buf != NULL) { 6489 snprintf(buf, buflen, "%u.%u.%u.%u", 6490 (unsigned int)((addr >> 24) & 0xff), 6491 (unsigned int)((addr >> 16) & 0xff), 6492 (unsigned int)((addr >> 8) & 0xff), 6493 (unsigned int)(addr & 0xff)); 6494 } 6495 return buf; 6496 } 6497 6498 /* a dummy, used to drop uninteresting events */ 6499 static void 6500 sppp_null(struct sppp *unused) 6501 { 6502 /* do just nothing */ 6503 } 6504 6505 static void 6506 sppp_tls(const struct cp *cp, struct sppp *sp) 6507 { 6508 6509 /* notify lcp that is lower layer */ 6510 sp->lcp.protos |= (1 << cp->protoidx); 6511 6512 if (sp->scp[IDX_LCP].state == STATE_OPENED) 6513 sppp_wq_add(sp->wq_cp, &sp->scp[cp->protoidx].work_up); 6514 } 6515 6516 static void 6517 sppp_tlf(const struct cp *cp, struct sppp *sp) 6518 { 6519 6520 SPPP_DLOG(sp, "%s tlf\n", cp->name); 6521 6522 /* notify lcp that is lower layer */ 6523 sp->lcp.protos &= ~(1 << cp->protoidx); 6524 6525 /* cleanup */ 6526 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) { 6527 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6528 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6529 } 6530 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) { 6531 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6532 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6533 } 6534 6535 sppp_lcp_check_and_close(sp); 6536 } 6537 6538 static void 6539 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6540 uint8_t ident, size_t msglen, void *msg) 6541 { 6542 6543 if (msglen == 0) 6544 return; 6545 6546 switch (type) { 6547 case CONF_ACK: 6548 case CONF_NAK: 6549 case CONF_REJ: 6550 break; 6551 default: 6552 return; 6553 } 6554 6555 if (sppp_debug_enabled(sp)) { 6556 char tbuf[SPPP_CPTYPE_NAMELEN]; 6557 const char *cpname; 6558 6559 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6560 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname); 6561 } 6562 6563 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6564 } 6565 6566 static void 6567 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6568 { 6569 6570 SPPP_UNLOCK(sp); 6571 if_down(&sp->pp_if); 6572 IF_PURGE(&sp->pp_cpq); 6573 SPPP_LOCK(sp, RW_WRITER); 6574 } 6575 6576 static void 6577 sppp_notify_up(struct sppp *sp) 6578 { 6579 6580 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6581 } 6582 6583 static void 6584 sppp_notify_down(struct sppp *sp) 6585 { 6586 6587 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6588 } 6589 6590 static void 6591 sppp_notify_tls_wlocked(struct sppp *sp) 6592 { 6593 6594 KASSERT(SPPP_WLOCKED(sp)); 6595 6596 if (!sp->pp_tls) 6597 return; 6598 6599 SPPP_UNLOCK(sp); 6600 sp->pp_tls(sp); 6601 SPPP_LOCK(sp, RW_WRITER); 6602 } 6603 6604 static void 6605 sppp_notify_tlf_wlocked(struct sppp *sp) 6606 { 6607 6608 KASSERT(SPPP_WLOCKED(sp)); 6609 6610 if (!sp->pp_tlf) 6611 return; 6612 6613 SPPP_UNLOCK(sp); 6614 sp->pp_tlf(sp); 6615 SPPP_LOCK(sp, RW_WRITER); 6616 } 6617 6618 static void 6619 sppp_notify_con(struct sppp *sp) 6620 { 6621 6622 if (!sp->pp_con) 6623 return; 6624 6625 sp->pp_con(sp); 6626 } 6627 6628 #ifdef INET6 6629 static void 6630 sppp_notify_con_wlocked(struct sppp *sp) 6631 { 6632 6633 KASSERT(SPPP_WLOCKED(sp)); 6634 6635 SPPP_UNLOCK(sp); 6636 sppp_notify_con(sp); 6637 SPPP_LOCK(sp, RW_WRITER); 6638 6639 } 6640 #endif 6641 6642 static void 6643 sppp_notify_chg_wlocked(struct sppp *sp) 6644 { 6645 6646 KASSERT(SPPP_WLOCKED(sp)); 6647 6648 if (!sp->pp_chg) 6649 return; 6650 6651 SPPP_UNLOCK(sp); 6652 sp->pp_chg(sp, sp->pp_phase); 6653 SPPP_LOCK(sp, RW_WRITER); 6654 } 6655 6656 static void 6657 sppp_wq_work(struct work *wk, void *xsp) 6658 { 6659 struct sppp *sp; 6660 struct sppp_work *work; 6661 6662 sp = xsp; 6663 work = container_of(wk, struct sppp_work, work); 6664 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6665 6666 SPPP_LOCK(sp, RW_WRITER); 6667 work->func(sp, work->arg); 6668 SPPP_UNLOCK(sp); 6669 } 6670 6671 static struct workqueue * 6672 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6673 { 6674 struct workqueue *wq; 6675 int error; 6676 6677 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6678 (void *)sp, prio, ipl, flags); 6679 if (error) { 6680 panic("%s: workqueue_create failed [%s, %d]\n", 6681 sp->pp_if.if_xname, xnamebuf, error); 6682 } 6683 6684 return wq; 6685 } 6686 6687 static void 6688 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6689 { 6690 6691 workqueue_destroy(wq); 6692 } 6693 6694 static void 6695 sppp_wq_set(struct sppp_work *work, 6696 void (*func)(struct sppp *, void *), void *arg) 6697 { 6698 6699 work->func = func; 6700 work->arg = arg; 6701 } 6702 6703 static void 6704 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6705 { 6706 6707 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6708 != SPPP_WK_FREE) 6709 return; 6710 6711 KASSERT(work->func != NULL); 6712 kpreempt_disable(); 6713 workqueue_enqueue(wq, &work->work, NULL); 6714 kpreempt_enable(); 6715 } 6716 static void 6717 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6718 { 6719 6720 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6721 workqueue_wait(wq, &work->work); 6722 } 6723 6724 /* 6725 * This file is large. Tell emacs to highlight it nevertheless. 6726 * 6727 * Local Variables: 6728 * hilit-auto-highlight-maxout: 120000 6729 * End: 6730 */ 6731 6732 /* 6733 * Module glue 6734 */ 6735 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6736 6737 static int 6738 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6739 { 6740 6741 switch (cmd) { 6742 case MODULE_CMD_INIT: 6743 case MODULE_CMD_FINI: 6744 return 0; 6745 case MODULE_CMD_STAT: 6746 case MODULE_CMD_AUTOUNLOAD: 6747 default: 6748 return ENOTTY; 6749 } 6750 } 6751
Indexes created Sat Sep 27 14:09:57 GMT 2025