if_spppsubr.c revision 1.256
1 /* $NetBSD: if_spppsubr.c,v 1.256 2021/06/01 05:16:46 yamaguchi Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.256 2021/06/01 05:16:46 yamaguchi Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/netisr.h> 76 #include <net/if_types.h> 77 #include <net/route.h> 78 #include <net/ppp_defs.h> 79 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/in_var.h> 83 #ifdef INET 84 #include <netinet/ip.h> 85 #include <netinet/tcp.h> 86 #endif 87 #include <net/ethertypes.h> 88 89 #ifdef INET6 90 #include <netinet6/scope6_var.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #ifdef NET_MPSAFE 97 #define SPPPSUBR_MPSAFE 1 98 #endif 99 100 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 101 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 #ifndef SPPP_KEEPALIVE_INTERVAL 108 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 109 #endif 110 111 #ifndef SPPP_NORECV_TIME 112 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 113 #endif 114 115 #ifndef SPPP_ALIVE_INTERVAL 116 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 117 #endif 118 119 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 120 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 121 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 122 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 123 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 124 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 125 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 126 127 /* 128 * Interface flags that can be set in an ifconfig command. 129 * 130 * Setting link0 will make the link passive, i.e. it will be marked 131 * as being administrative openable, but won't be opened to begin 132 * with. Incoming calls will be answered, or subsequent calls with 133 * -link1 will cause the administrative open of the LCP layer. 134 * 135 * Setting link1 will cause the link to auto-dial only as packets 136 * arrive to be sent. 137 * 138 * Setting IFF_DEBUG will syslog the option negotiation and state 139 * transitions at level kern.debug. Note: all logs consistently look 140 * like 141 * 142 * <if-name><unit>: <proto-name> <additional info...> 143 * 144 * with <if-name><unit> being something like "bppp0", and <proto-name> 145 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 146 */ 147 148 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 149 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 150 151 #define CONF_REQ 1 /* PPP configure request */ 152 #define CONF_ACK 2 /* PPP configure acknowledge */ 153 #define CONF_NAK 3 /* PPP configure negative ack */ 154 #define CONF_REJ 4 /* PPP configure reject */ 155 #define TERM_REQ 5 /* PPP terminate request */ 156 #define TERM_ACK 6 /* PPP terminate acknowledge */ 157 #define CODE_REJ 7 /* PPP code reject */ 158 #define PROTO_REJ 8 /* PPP protocol reject */ 159 #define ECHO_REQ 9 /* PPP echo request */ 160 #define ECHO_REPLY 10 /* PPP echo reply */ 161 #define DISC_REQ 11 /* PPP discard request */ 162 163 #define LCP_OPT_MRU 1 /* maximum receive unit */ 164 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 165 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 166 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 167 #define LCP_OPT_MAGIC 5 /* magic number */ 168 #define LCP_OPT_RESERVED 6 /* reserved */ 169 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 170 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 171 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 172 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 173 #define LCP_OPT_CALL_BACK 13 /* callback */ 174 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 175 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 176 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 177 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 178 179 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 180 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 181 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 182 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 183 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 184 185 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 186 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 187 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 188 189 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 190 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 191 192 #define PAP_REQ 1 /* PAP name/password request */ 193 #define PAP_ACK 2 /* PAP acknowledge */ 194 #define PAP_NAK 3 /* PAP fail */ 195 196 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 197 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 198 #define CHAP_SUCCESS 3 /* CHAP response ok */ 199 #define CHAP_FAILURE 4 /* CHAP response failed */ 200 201 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 202 203 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 204 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 205 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 206 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 207 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 208 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 209 210 #define PPP_NOPROTO 0 /* no authentication protocol */ 211 212 enum { 213 STATE_INITIAL = SPPP_STATE_INITIAL, 214 STATE_STARTING = SPPP_STATE_STARTING, 215 STATE_CLOSED = SPPP_STATE_CLOSED, 216 STATE_STOPPED = SPPP_STATE_STOPPED, 217 STATE_CLOSING = SPPP_STATE_CLOSING, 218 STATE_STOPPING = SPPP_STATE_STOPPING, 219 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 220 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 221 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 222 STATE_OPENED = SPPP_STATE_OPENED, 223 }; 224 225 enum cp_rcr_type { 226 CP_RCR_NONE = 0, /* initial value */ 227 CP_RCR_ACK, /* RCR+ */ 228 CP_RCR_NAK, /* RCR- */ 229 CP_RCR_REJ, /* RCR- */ 230 CP_RCR_DROP, /* DROP message */ 231 CP_RCR_ERR, /* internal error */ 232 }; 233 234 struct ppp_header { 235 uint8_t address; 236 uint8_t control; 237 uint16_t protocol; 238 } __packed; 239 #define PPP_HEADER_LEN sizeof (struct ppp_header) 240 241 struct lcp_header { 242 uint8_t type; 243 uint8_t ident; 244 uint16_t len; 245 } __packed; 246 #define LCP_HEADER_LEN sizeof (struct lcp_header) 247 248 struct cisco_packet { 249 uint32_t type; 250 uint32_t par1; 251 uint32_t par2; 252 uint16_t rel; 253 uint16_t time0; 254 uint16_t time1; 255 } __packed; 256 #define CISCO_PACKET_LEN 18 257 258 /* 259 * We follow the spelling and capitalization of RFC 1661 here, to make 260 * it easier comparing with the standard. Please refer to this RFC in 261 * case you can't make sense out of these abbreviation; it will also 262 * explain the semantics related to the various events and actions. 263 */ 264 struct cp { 265 u_short proto; /* PPP control protocol number */ 266 u_char protoidx; /* index into state table in struct sppp */ 267 u_char flags; 268 #define CP_LCP 0x01 /* this is the LCP */ 269 #define CP_AUTH 0x02 /* this is an authentication protocol */ 270 #define CP_NCP 0x04 /* this is a NCP */ 271 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 272 const char *name; /* name of this control protocol */ 273 /* event handlers */ 274 void (*Up)(struct sppp *, void *); 275 void (*Down)(struct sppp *, void *); 276 void (*Open)(struct sppp *, void *); 277 void (*Close)(struct sppp *, void *); 278 void (*TO)(struct sppp *, void *); 279 /* actions */ 280 void (*tlu)(struct sppp *); 281 void (*tld)(struct sppp *); 282 void (*tls)(const struct cp *, struct sppp *); 283 void (*tlf)(const struct cp *, struct sppp *); 284 void (*scr)(struct sppp *); 285 void (*screply)(const struct cp *, struct sppp *, u_char, 286 uint8_t, size_t, void *); 287 288 /* message parser */ 289 enum cp_rcr_type 290 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 291 uint8_t **, size_t *, size_t *); 292 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 293 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 294 }; 295 296 enum auth_role { 297 SPPP_AUTH_NOROLE = 0, 298 SPPP_AUTH_SERV = __BIT(0), 299 SPPP_AUTH_PEER = __BIT(1), 300 }; 301 302 static struct sppp *spppq; 303 static kmutex_t *spppq_lock = NULL; 304 static callout_t keepalive_ch; 305 static unsigned int sppp_keepalive_cnt = 0; 306 307 #define SPPPQ_LOCK() if (spppq_lock) \ 308 mutex_enter(spppq_lock); 309 #define SPPPQ_UNLOCK() if (spppq_lock) \ 310 mutex_exit(spppq_lock); 311 312 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 313 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 314 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 315 #define SPPP_UPGRADE(_sp) do{ \ 316 SPPP_UNLOCK(_sp); \ 317 SPPP_LOCK(_sp, RW_WRITER); \ 318 }while (0) 319 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 320 #define SPPP_WQ_SET(_wk, _func, _arg) \ 321 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 322 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \ 323 if (__predict_true((_sp) != NULL)) { \ 324 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \ 325 } \ 326 addlog((_fmt), ##_args); \ 327 } while (0) 328 #define SPPP_DLOG(_sp, _fmt, _args...) do { \ 329 if (!sppp_debug_enabled(_sp)) \ 330 break; \ 331 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \ 332 } while (0) 333 334 #ifdef INET 335 #ifndef SPPPSUBR_MPSAFE 336 /* 337 * The following disgusting hack gets around the problem that IP TOS 338 * can't be set yet. We want to put "interactive" traffic on a high 339 * priority queue. To decide if traffic is interactive, we check that 340 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 341 * 342 * XXX is this really still necessary? - joerg - 343 */ 344 static u_short interactive_ports[8] = { 345 0, 513, 0, 0, 346 0, 21, 0, 23, 347 }; 348 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 349 #endif /* SPPPSUBR_MPSAFE */ 350 #endif 351 352 /* almost every function needs these */ 353 354 static bool sppp_debug_enabled(struct sppp *sp); 355 static int sppp_output(struct ifnet *, struct mbuf *, 356 const struct sockaddr *, const struct rtentry *); 357 358 static void sppp_cp_init(const struct cp *, struct sppp *); 359 static void sppp_cp_fini(const struct cp *, struct sppp *); 360 static void sppp_cp_input(const struct cp *, struct sppp *, 361 struct mbuf *); 362 static void sppp_cp_input(const struct cp *, struct sppp *, 363 struct mbuf *); 364 static void sppp_cp_send(struct sppp *, u_short, u_char, 365 u_char, u_short, void *); 366 /* static void sppp_cp_timeout(void *arg); */ 367 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 368 static struct workqueue * 369 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 370 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 371 static void sppp_wq_set(struct sppp_work *, 372 void (*)(struct sppp *, void *), void *); 373 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 374 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 375 static void sppp_cp_to_lcp(void *); 376 static void sppp_cp_to_ipcp(void *); 377 static void sppp_cp_to_ipv6cp(void *); 378 static void sppp_auth_send(const struct cp *, struct sppp *, 379 unsigned int, unsigned int, ...); 380 static int sppp_auth_role(const struct cp *, struct sppp *); 381 static void sppp_auth_to_event(struct sppp *, void *); 382 static void sppp_auth_screply(const struct cp *, struct sppp *, 383 u_char, uint8_t, size_t, void *); 384 static void sppp_up_event(struct sppp *, void *); 385 static void sppp_down_event(struct sppp *, void *); 386 static void sppp_open_event(struct sppp *, void *); 387 static void sppp_close_event(struct sppp *, void *); 388 static void sppp_to_event(struct sppp *, void *); 389 static void sppp_rcr_event(struct sppp *, void *); 390 static void sppp_rca_event(struct sppp *, void *); 391 static void sppp_rcn_event(struct sppp *, void *); 392 static void sppp_rtr_event(struct sppp *, void *); 393 static void sppp_rta_event(struct sppp *, void *); 394 static void sppp_rxj_event(struct sppp *, void *); 395 396 static void sppp_null(struct sppp *); 397 static void sppp_tls(const struct cp *, struct sppp *); 398 static void sppp_tlf(const struct cp *, struct sppp *); 399 static void sppp_screply(const struct cp *, struct sppp *, 400 u_char, uint8_t, size_t, void *); 401 static void sppp_ifdown(struct sppp *, void *); 402 403 static void sppp_lcp_init(struct sppp *); 404 static void sppp_lcp_up(struct sppp *, void *); 405 static void sppp_lcp_down(struct sppp *, void *); 406 static void sppp_lcp_open(struct sppp *, void *); 407 static enum cp_rcr_type 408 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 409 uint8_t **, size_t *, size_t *); 410 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 411 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 412 static void sppp_lcp_tlu(struct sppp *); 413 static void sppp_lcp_tld(struct sppp *); 414 static void sppp_lcp_tls(const struct cp *, struct sppp *); 415 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 416 static void sppp_lcp_scr(struct sppp *); 417 static void sppp_lcp_check_and_close(struct sppp *); 418 static int sppp_cp_check(struct sppp *, u_char); 419 420 static void sppp_ipcp_init(struct sppp *); 421 static void sppp_ipcp_open(struct sppp *, void *); 422 static void sppp_ipcp_close(struct sppp *, void *); 423 static enum cp_rcr_type 424 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 425 uint8_t **, size_t *, size_t *); 426 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 427 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 428 static void sppp_ipcp_tlu(struct sppp *); 429 static void sppp_ipcp_tld(struct sppp *); 430 static void sppp_ipcp_scr(struct sppp *); 431 432 static void sppp_ipv6cp_init(struct sppp *); 433 static void sppp_ipv6cp_open(struct sppp *, void *); 434 static enum cp_rcr_type 435 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 436 uint8_t **, size_t *, size_t *); 437 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 438 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 439 static void sppp_ipv6cp_tlu(struct sppp *); 440 static void sppp_ipv6cp_tld(struct sppp *); 441 static void sppp_ipv6cp_scr(struct sppp *); 442 443 static void sppp_pap_input(struct sppp *, struct mbuf *); 444 static void sppp_pap_init(struct sppp *); 445 static void sppp_pap_tlu(struct sppp *); 446 static void sppp_pap_scr(struct sppp *); 447 static void sppp_pap_scr(struct sppp *); 448 449 static void sppp_chap_input(struct sppp *, struct mbuf *); 450 static void sppp_chap_init(struct sppp *); 451 static void sppp_chap_open(struct sppp *, void *); 452 static void sppp_chap_tlu(struct sppp *); 453 static void sppp_chap_scr(struct sppp *); 454 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 455 456 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 457 static const char *sppp_cp_type_name(char *, size_t, u_char); 458 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 459 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 460 #ifdef INET6 461 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 462 #endif 463 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 464 static const char *sppp_phase_name(int); 465 static const char *sppp_proto_name(char *, size_t, u_short); 466 static const char *sppp_state_name(int); 467 static int sppp_params(struct sppp *, u_long, void *); 468 #ifdef INET 469 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 470 static void sppp_set_ip_addrs(struct sppp *); 471 static void sppp_clear_ip_addrs(struct sppp *); 472 #endif 473 static void sppp_keepalive(void *); 474 static void sppp_phase_network(struct sppp *); 475 static void sppp_print_bytes(const u_char *, u_short); 476 static void sppp_print_string(const char *, u_short); 477 #ifdef INET6 478 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 479 struct in6_addr *, struct in6_addr *); 480 #ifdef IPV6CP_MYIFID_DYN 481 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 482 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 483 #endif 484 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 485 #endif 486 487 static void sppp_notify_up(struct sppp *); 488 static void sppp_notify_down(struct sppp *); 489 static void sppp_notify_tls_wlocked(struct sppp *); 490 static void sppp_notify_tlf_wlocked(struct sppp *); 491 #ifdef INET6 492 static void sppp_notify_con_wlocked(struct sppp *); 493 #endif 494 static void sppp_notify_con(struct sppp *); 495 496 static void sppp_notify_chg_wlocked(struct sppp *); 497 498 /* our control protocol descriptors */ 499 static const struct cp lcp = { 500 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 501 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 502 sppp_close_event, sppp_to_event, 503 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 504 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 505 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 506 }; 507 508 static const struct cp ipcp = { 509 PPP_IPCP, IDX_IPCP, 510 #ifdef INET 511 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 512 #else 513 0, 514 #endif 515 "ipcp", 516 sppp_up_event, sppp_down_event, sppp_ipcp_open, 517 sppp_ipcp_close, sppp_to_event, 518 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls, 519 sppp_tlf, sppp_ipcp_scr, sppp_screply, 520 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 521 }; 522 523 static const struct cp ipv6cp = { 524 PPP_IPV6CP, IDX_IPV6CP, 525 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 526 CP_NCP, 527 #else 528 0, 529 #endif 530 "ipv6cp", 531 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 532 sppp_close_event, sppp_to_event, 533 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls, 534 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 535 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 536 }; 537 538 static const struct cp pap = { 539 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 540 sppp_up_event, sppp_down_event, sppp_open_event, 541 sppp_close_event, sppp_to_event, 542 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 543 sppp_pap_scr, sppp_auth_screply, 544 NULL, NULL, NULL 545 }; 546 547 static const struct cp chap = { 548 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 549 sppp_up_event, sppp_down_event, sppp_chap_open, 550 sppp_close_event, sppp_auth_to_event, 551 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 552 sppp_chap_scr, sppp_auth_screply, 553 NULL, NULL, NULL 554 }; 555 556 static const struct cp *cps[IDX_COUNT] = { 557 &lcp, /* IDX_LCP */ 558 &ipcp, /* IDX_IPCP */ 559 &ipv6cp, /* IDX_IPV6CP */ 560 &pap, /* IDX_PAP */ 561 &chap, /* IDX_CHAP */ 562 }; 563 564 static inline u_int 565 sppp_proto2authproto(u_short proto) 566 { 567 568 switch (proto) { 569 case PPP_PAP: 570 return SPPP_AUTHPROTO_PAP; 571 case PPP_CHAP: 572 return SPPP_AUTHPROTO_CHAP; 573 } 574 575 return SPPP_AUTHPROTO_NONE; 576 } 577 578 static inline u_short 579 sppp_authproto2proto(u_int authproto) 580 { 581 582 switch (authproto) { 583 case SPPP_AUTHPROTO_PAP: 584 return PPP_PAP; 585 case SPPP_AUTHPROTO_CHAP: 586 return PPP_CHAP; 587 } 588 589 return PPP_NOPROTO; 590 } 591 592 static inline bool 593 sppp_debug_enabled(struct sppp *sp) 594 { 595 596 if (__predict_false(sp == NULL)) 597 return false; 598 599 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0) 600 return false; 601 602 return true; 603 } 604 605 static void 606 sppp_change_phase(struct sppp *sp, int phase) 607 { 608 struct ifnet *ifp; 609 610 KASSERT(SPPP_WLOCKED(sp)); 611 612 ifp = &sp->pp_if; 613 614 if (sp->pp_phase == phase) 615 return; 616 617 sp->pp_phase = phase; 618 619 if (phase == SPPP_PHASE_NETWORK) 620 if_link_state_change(ifp, LINK_STATE_UP); 621 else 622 if_link_state_change(ifp, LINK_STATE_DOWN); 623 624 SPPP_DLOG(sp, "phase %s\n", 625 sppp_phase_name(sp->pp_phase)); 626 } 627 628 /* 629 * Exported functions, comprising our interface to the lower layer. 630 */ 631 632 /* 633 * Process the received packet. 634 */ 635 void 636 sppp_input(struct ifnet *ifp, struct mbuf *m) 637 { 638 struct ppp_header *h = NULL; 639 pktqueue_t *pktq = NULL; 640 struct ifqueue *inq = NULL; 641 uint16_t protocol; 642 struct sppp *sp = (struct sppp *)ifp; 643 int isr = 0; 644 645 SPPP_LOCK(sp, RW_READER); 646 647 if (ifp->if_flags & IFF_UP) { 648 /* Count received bytes, add hardware framing */ 649 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 650 /* Note time of last receive */ 651 sp->pp_last_receive = time_uptime; 652 } 653 654 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 655 /* Too small packet, drop it. */ 656 SPPP_DLOG(sp, "input packet is too small, " 657 "%d bytes\n", m->m_pkthdr.len); 658 goto drop; 659 } 660 661 if (sp->pp_flags & PP_NOFRAMING) { 662 memcpy(&protocol, mtod(m, void *), 2); 663 protocol = ntohs(protocol); 664 m_adj(m, 2); 665 } else { 666 667 /* Get PPP header. */ 668 h = mtod(m, struct ppp_header *); 669 m_adj(m, PPP_HEADER_LEN); 670 671 switch (h->address) { 672 case PPP_ALLSTATIONS: 673 if (h->control != PPP_UI) 674 goto invalid; 675 break; 676 case CISCO_MULTICAST: 677 case CISCO_UNICAST: 678 /* Don't check the control field here (RFC 1547). */ 679 SPPP_DLOG(sp, "Cisco packet in PPP mode " 680 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 681 h->address, h->control, ntohs(h->protocol)); 682 goto drop; 683 default: /* Invalid PPP packet. */ 684 invalid: 685 SPPP_DLOG(sp, "invalid input packet " 686 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 687 h->address, h->control, ntohs(h->protocol)); 688 goto drop; 689 } 690 protocol = ntohs(h->protocol); 691 } 692 693 switch (protocol) { 694 reject_protocol: 695 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 696 uint16_t prot = htons(protocol); 697 698 SPPP_UPGRADE(sp); 699 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 700 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 701 &prot); 702 SPPP_DOWNGRADE(sp); 703 } 704 if_statinc(ifp, if_noproto); 705 goto drop; 706 default: 707 SPPP_DLOG(sp, "invalid input protocol " 708 "<proto=0x%x>\n", protocol); 709 goto reject_protocol; 710 case PPP_LCP: 711 SPPP_UNLOCK(sp); 712 sppp_cp_input(&lcp, sp, m); 713 /* already m_freem(m) */ 714 return; 715 case PPP_PAP: 716 SPPP_UNLOCK(sp); 717 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 718 sppp_pap_input(sp, m); 719 } 720 m_freem(m); 721 return; 722 case PPP_CHAP: 723 SPPP_UNLOCK(sp); 724 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 725 sppp_chap_input(sp, m); 726 } 727 m_freem(m); 728 return; 729 #ifdef INET 730 case PPP_IPCP: 731 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 732 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet " 733 "because IPCP is disabled\n"); 734 goto reject_protocol; 735 } 736 SPPP_UNLOCK(sp); 737 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 738 sppp_cp_input(&ipcp, sp, m); 739 /* already m_freem(m) */ 740 } else { 741 m_freem(m); 742 } 743 return; 744 case PPP_IP: 745 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 746 sp->pp_last_activity = time_uptime; 747 pktq = ip_pktq; 748 } 749 break; 750 #endif 751 #ifdef INET6 752 case PPP_IPV6CP: 753 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 754 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet " 755 "because IPv6CP is disabled\n"); 756 goto reject_protocol; 757 } 758 SPPP_UNLOCK(sp); 759 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 760 sppp_cp_input(&ipv6cp, sp, m); 761 /* already m_freem(m) */ 762 } else { 763 m_freem(m); 764 } 765 return; 766 767 case PPP_IPV6: 768 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 769 sp->pp_last_activity = time_uptime; 770 pktq = ip6_pktq; 771 } 772 break; 773 #endif 774 } 775 776 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 777 goto drop; 778 } 779 780 /* Check queue. */ 781 if (__predict_true(pktq)) { 782 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 783 goto drop; 784 } 785 SPPP_UNLOCK(sp); 786 return; 787 } 788 789 SPPP_UNLOCK(sp); 790 791 IFQ_LOCK(inq); 792 if (IF_QFULL(inq)) { 793 /* Queue overflow. */ 794 IF_DROP(inq); 795 IFQ_UNLOCK(inq); 796 SPPP_DLOG(sp,"protocol queue overflow\n"); 797 SPPP_LOCK(sp, RW_READER); 798 goto drop; 799 } 800 IF_ENQUEUE(inq, m); 801 IFQ_UNLOCK(inq); 802 schednetisr(isr); 803 return; 804 805 drop: 806 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 807 m_freem(m); 808 SPPP_UNLOCK(sp); 809 return; 810 } 811 812 /* 813 * Enqueue transmit packet. 814 */ 815 static int 816 sppp_output(struct ifnet *ifp, struct mbuf *m, 817 const struct sockaddr *dst, const struct rtentry *rt) 818 { 819 struct sppp *sp = (struct sppp *) ifp; 820 struct ppp_header *h = NULL; 821 #ifndef SPPPSUBR_MPSAFE 822 struct ifqueue *ifq = NULL; /* XXX */ 823 #endif 824 int s, error = 0; 825 uint16_t protocol; 826 size_t pktlen; 827 828 s = splnet(); 829 SPPP_LOCK(sp, RW_READER); 830 831 sp->pp_last_activity = time_uptime; 832 833 if ((ifp->if_flags & IFF_UP) == 0 || 834 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 835 SPPP_UNLOCK(sp); 836 splx(s); 837 838 m_freem(m); 839 if_statinc(ifp, if_oerrors); 840 return (ENETDOWN); 841 } 842 843 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 844 /* ignore packets that have no enabled NCP */ 845 if ((dst->sa_family == AF_INET && 846 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 847 (dst->sa_family == AF_INET6 && 848 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 849 SPPP_UNLOCK(sp); 850 splx(s); 851 852 m_freem(m); 853 if_statinc(ifp, if_oerrors); 854 return (ENETDOWN); 855 } 856 /* 857 * Interface is not yet running, but auto-dial. Need 858 * to start LCP for it. 859 */ 860 ifp->if_flags |= IFF_RUNNING; 861 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 862 } 863 864 /* 865 * If the queueing discipline needs packet classification, 866 * do it before prepending link headers. 867 */ 868 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 869 870 #ifdef INET 871 if (dst->sa_family == AF_INET) { 872 struct ip *ip = NULL; 873 #ifndef SPPPSUBR_MPSAFE 874 struct tcphdr *th = NULL; 875 #endif 876 877 if (m->m_len >= sizeof(struct ip)) { 878 ip = mtod(m, struct ip *); 879 #ifndef SPPPSUBR_MPSAFE 880 if (ip->ip_p == IPPROTO_TCP && 881 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 882 sizeof(struct tcphdr)) { 883 th = (struct tcphdr *) 884 ((char *)ip + (ip->ip_hl << 2)); 885 } 886 #endif 887 } else 888 ip = NULL; 889 890 /* 891 * When using dynamic local IP address assignment by using 892 * 0.0.0.0 as a local address, the first TCP session will 893 * not connect because the local TCP checksum is computed 894 * using 0.0.0.0 which will later become our real IP address 895 * so the TCP checksum computed at the remote end will 896 * become invalid. So we 897 * - don't let packets with src ip addr 0 thru 898 * - we flag TCP packets with src ip 0 as an error 899 */ 900 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 901 uint8_t proto = ip->ip_p; 902 903 SPPP_UNLOCK(sp); 904 splx(s); 905 906 m_freem(m); 907 if (proto == IPPROTO_TCP) 908 return (EADDRNOTAVAIL); 909 else 910 return (0); 911 } 912 913 #ifndef SPPPSUBR_MPSAFE 914 /* 915 * Put low delay, telnet, rlogin and ftp control packets 916 * in front of the queue. 917 */ 918 if (!IF_QFULL(&sp->pp_fastq) && 919 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 920 (th && (INTERACTIVE(ntohs(th->th_sport)) || 921 INTERACTIVE(ntohs(th->th_dport)))))) 922 ifq = &sp->pp_fastq; 923 #endif /* !SPPPSUBR_MPSAFE */ 924 } 925 #endif 926 927 #ifdef INET6 928 if (dst->sa_family == AF_INET6) { 929 /* XXX do something tricky here? */ 930 } 931 #endif 932 933 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 934 /* 935 * Prepend general data packet PPP header. For now, IP only. 936 */ 937 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 938 if (! m) { 939 SPPP_DLOG(sp, "no memory for transmit header\n"); 940 if_statinc(ifp, if_oerrors); 941 SPPP_UNLOCK(sp); 942 splx(s); 943 return (ENOBUFS); 944 } 945 /* 946 * May want to check size of packet 947 * (albeit due to the implementation it's always enough) 948 */ 949 h = mtod(m, struct ppp_header *); 950 h->address = PPP_ALLSTATIONS; /* broadcast address */ 951 h->control = PPP_UI; /* Unnumbered Info */ 952 } 953 954 switch (dst->sa_family) { 955 #ifdef INET 956 case AF_INET: /* Internet Protocol */ 957 /* 958 * Don't choke with an ENETDOWN early. It's 959 * possible that we just started dialing out, 960 * so don't drop the packet immediately. If 961 * we notice that we run out of buffer space 962 * below, we will however remember that we are 963 * not ready to carry IP packets, and return 964 * ENETDOWN, as opposed to ENOBUFS. 965 */ 966 protocol = htons(PPP_IP); 967 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 968 if (ifp->if_flags & IFF_AUTO) { 969 error = ENETDOWN; 970 } else { 971 IF_DROP(&ifp->if_snd); 972 SPPP_UNLOCK(sp); 973 splx(s); 974 975 m_freem(m); 976 if_statinc(ifp, if_oerrors); 977 return (ENETDOWN); 978 } 979 } 980 break; 981 #endif 982 #ifdef INET6 983 case AF_INET6: /* Internet Protocol version 6 */ 984 /* 985 * Don't choke with an ENETDOWN early. It's 986 * possible that we just started dialing out, 987 * so don't drop the packet immediately. If 988 * we notice that we run out of buffer space 989 * below, we will however remember that we are 990 * not ready to carry IP packets, and return 991 * ENETDOWN, as opposed to ENOBUFS. 992 */ 993 protocol = htons(PPP_IPV6); 994 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 995 if (ifp->if_flags & IFF_AUTO) { 996 error = ENETDOWN; 997 } else { 998 IF_DROP(&ifp->if_snd); 999 SPPP_UNLOCK(sp); 1000 splx(s); 1001 1002 m_freem(m); 1003 if_statinc(ifp, if_oerrors); 1004 return (ENETDOWN); 1005 } 1006 } 1007 break; 1008 #endif 1009 default: 1010 m_freem(m); 1011 if_statinc(ifp, if_oerrors); 1012 SPPP_UNLOCK(sp); 1013 splx(s); 1014 return (EAFNOSUPPORT); 1015 } 1016 1017 if (sp->pp_flags & PP_NOFRAMING) { 1018 M_PREPEND(m, 2, M_DONTWAIT); 1019 if (m == NULL) { 1020 SPPP_DLOG(sp, "no memory for transmit header\n"); 1021 if_statinc(ifp, if_oerrors); 1022 SPPP_UNLOCK(sp); 1023 splx(s); 1024 return (ENOBUFS); 1025 } 1026 *mtod(m, uint16_t *) = protocol; 1027 } else { 1028 h->protocol = protocol; 1029 } 1030 1031 pktlen = m->m_pkthdr.len; 1032 #ifdef SPPPSUBR_MPSAFE 1033 SPPP_UNLOCK(sp); 1034 error = if_transmit_lock(ifp, m); 1035 SPPP_LOCK(sp, RW_READER); 1036 if (error == 0) 1037 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1038 #else /* !SPPPSUBR_MPSAFE */ 1039 error = ifq_enqueue2(ifp, ifq, m); 1040 1041 if (error == 0) { 1042 /* 1043 * Count output packets and bytes. 1044 * The packet length includes header + additional hardware 1045 * framing according to RFC 1333. 1046 */ 1047 if (!(ifp->if_flags & IFF_OACTIVE)) { 1048 SPPP_UNLOCK(sp); 1049 if_start_lock(ifp); 1050 SPPP_LOCK(sp, RW_READER); 1051 } 1052 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1053 } 1054 #endif /* !SPPPSUBR_MPSAFE */ 1055 SPPP_UNLOCK(sp); 1056 splx(s); 1057 return error; 1058 } 1059 1060 void 1061 sppp_attach(struct ifnet *ifp) 1062 { 1063 struct sppp *sp = (struct sppp *) ifp; 1064 char xnamebuf[MAXCOMLEN]; 1065 1066 /* Initialize keepalive handler. */ 1067 if (! spppq) { 1068 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1069 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1070 } 1071 1072 if (! spppq_lock) 1073 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1074 1075 sp->pp_if.if_type = IFT_PPP; 1076 sp->pp_if.if_output = sppp_output; 1077 sp->pp_fastq.ifq_maxlen = 32; 1078 sp->pp_cpq.ifq_maxlen = 20; 1079 sp->pp_loopcnt = 0; 1080 sp->pp_alivecnt = 0; 1081 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1082 sp->pp_last_activity = 0; 1083 sp->pp_last_receive = 0; 1084 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1085 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1086 sp->pp_idle_timeout = 0; 1087 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1088 sp->pp_phase = SPPP_PHASE_DEAD; 1089 sp->pp_up = sppp_notify_up; 1090 sp->pp_down = sppp_notify_down; 1091 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1092 #ifdef SPPP_IFDOWN_RECONNECT 1093 sp->pp_flags |= PP_LOOPBACK_IFDOWN | PP_KEEPALIVE_IFDOWN; 1094 #endif 1095 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1096 memset(sp->scp, 0, sizeof(sp->scp)); 1097 rw_init(&sp->pp_lock); 1098 1099 if_alloc_sadl(ifp); 1100 1101 /* Lets not beat about the bush, we know we're down. */ 1102 ifp->if_link_state = LINK_STATE_DOWN; 1103 1104 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1105 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1106 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1107 1108 memset(&sp->myauth, 0, sizeof sp->myauth); 1109 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1110 SPPP_LOCK(sp, RW_WRITER); 1111 sppp_lcp_init(sp); 1112 sppp_ipcp_init(sp); 1113 sppp_ipv6cp_init(sp); 1114 sppp_pap_init(sp); 1115 sppp_chap_init(sp); 1116 SPPP_UNLOCK(sp); 1117 1118 SPPPQ_LOCK(); 1119 /* Insert new entry into the keepalive list. */ 1120 sp->pp_next = spppq; 1121 spppq = sp; 1122 SPPPQ_UNLOCK(); 1123 } 1124 1125 void 1126 sppp_detach(struct ifnet *ifp) 1127 { 1128 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1129 1130 /* Remove the entry from the keepalive list. */ 1131 SPPPQ_LOCK(); 1132 for (q = &spppq; (p = *q); q = &p->pp_next) 1133 if (p == sp) { 1134 *q = p->pp_next; 1135 break; 1136 } 1137 SPPPQ_UNLOCK(); 1138 1139 if (! spppq) { 1140 /* Stop keepalive handler. */ 1141 callout_stop(&keepalive_ch); 1142 mutex_obj_free(spppq_lock); 1143 spppq_lock = NULL; 1144 } 1145 1146 sppp_cp_fini(&lcp, sp); 1147 sppp_cp_fini(&ipcp, sp); 1148 sppp_cp_fini(&pap, sp); 1149 sppp_cp_fini(&chap, sp); 1150 #ifdef INET6 1151 sppp_cp_fini(&ipv6cp, sp); 1152 #endif 1153 sppp_wq_destroy(sp, sp->wq_cp); 1154 1155 /* free authentication info */ 1156 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1157 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1158 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1159 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1160 rw_destroy(&sp->pp_lock); 1161 } 1162 1163 /* 1164 * Flush the interface output queue. 1165 */ 1166 void 1167 sppp_flush(struct ifnet *ifp) 1168 { 1169 struct sppp *sp = (struct sppp *) ifp; 1170 1171 SPPP_LOCK(sp, RW_WRITER); 1172 IFQ_PURGE(&sp->pp_if.if_snd); 1173 IF_PURGE(&sp->pp_fastq); 1174 IF_PURGE(&sp->pp_cpq); 1175 SPPP_UNLOCK(sp); 1176 } 1177 1178 /* 1179 * Check if the output queue is empty. 1180 */ 1181 int 1182 sppp_isempty(struct ifnet *ifp) 1183 { 1184 struct sppp *sp = (struct sppp *) ifp; 1185 int empty, s; 1186 1187 s = splnet(); 1188 SPPP_LOCK(sp, RW_READER); 1189 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1190 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1191 SPPP_UNLOCK(sp); 1192 splx(s); 1193 return (empty); 1194 } 1195 1196 /* 1197 * Get next packet to send. 1198 */ 1199 struct mbuf * 1200 sppp_dequeue(struct ifnet *ifp) 1201 { 1202 struct sppp *sp = (struct sppp *) ifp; 1203 struct mbuf *m; 1204 int s; 1205 1206 s = splnet(); 1207 SPPP_LOCK(sp, RW_WRITER); 1208 /* 1209 * Process only the control protocol queue until we have at 1210 * least one NCP open. 1211 * 1212 * Do always serve all three queues in Cisco mode. 1213 */ 1214 IF_DEQUEUE(&sp->pp_cpq, m); 1215 if (m == NULL && sppp_cp_check(sp, CP_NCP)) { 1216 IF_DEQUEUE(&sp->pp_fastq, m); 1217 if (m == NULL) 1218 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1219 } 1220 SPPP_UNLOCK(sp); 1221 splx(s); 1222 return m; 1223 } 1224 1225 /* 1226 * Process an ioctl request. Called on low priority level. 1227 */ 1228 int 1229 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1230 { 1231 struct lwp *l = curlwp; /* XXX */ 1232 struct ifreq *ifr = (struct ifreq *) data; 1233 struct ifaddr *ifa = (struct ifaddr *) data; 1234 struct sppp *sp = (struct sppp *) ifp; 1235 int s, error=0, going_up, going_down; 1236 u_short newmode; 1237 u_long lcp_mru; 1238 1239 s = splnet(); 1240 switch (cmd) { 1241 case SIOCINITIFADDR: 1242 ifa->ifa_rtrequest = p2p_rtrequest; 1243 break; 1244 1245 case SIOCSIFFLAGS: 1246 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1247 break; 1248 1249 SPPP_LOCK(sp, RW_WRITER); 1250 going_up = ifp->if_flags & IFF_UP && 1251 (ifp->if_flags & IFF_RUNNING) == 0; 1252 going_down = (ifp->if_flags & IFF_UP) == 0 && 1253 ifp->if_flags & IFF_RUNNING; 1254 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1255 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1256 /* sanity */ 1257 newmode = IFF_PASSIVE; 1258 ifp->if_flags &= ~IFF_AUTO; 1259 } 1260 1261 if (ifp->if_flags & IFF_UP) { 1262 sp->pp_flags |= PP_ADMIN_UP; 1263 } else { 1264 sp->pp_flags &= ~PP_ADMIN_UP; 1265 } 1266 1267 if (going_up || going_down) { 1268 sp->lcp.reestablish = false; 1269 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1270 } 1271 if (going_up && newmode == 0) { 1272 /* neither auto-dial nor passive */ 1273 ifp->if_flags |= IFF_RUNNING; 1274 sppp_wq_add(sp->wq_cp, 1275 &sp->scp[IDX_LCP].work_open); 1276 } else if (going_down) { 1277 SPPP_UNLOCK(sp); 1278 sppp_flush(ifp); 1279 SPPP_LOCK(sp, RW_WRITER); 1280 1281 ifp->if_flags &= ~IFF_RUNNING; 1282 } 1283 SPPP_UNLOCK(sp); 1284 break; 1285 1286 case SIOCSIFMTU: 1287 if (ifr->ifr_mtu < PPP_MINMRU || 1288 ifr->ifr_mtu > PP_MTU) { 1289 error = EINVAL; 1290 break; 1291 } 1292 1293 error = ifioctl_common(ifp, cmd, data); 1294 if (error == ENETRESET) 1295 error = 0; 1296 1297 SPPP_LOCK(sp, RW_WRITER); 1298 lcp_mru = sp->lcp.mru; 1299 if (ifp->if_mtu < PP_MTU) { 1300 sp->lcp.mru = ifp->if_mtu; 1301 } else { 1302 sp->lcp.mru = PP_MTU; 1303 } 1304 if (lcp_mru != sp->lcp.mru) 1305 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1306 1307 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1308 ifp->if_mtu > sp->lcp.their_mru) { 1309 sp->pp_saved_mtu = ifp->if_mtu; 1310 ifp->if_mtu = sp->lcp.their_mru; 1311 1312 SPPP_DLOG(sp, "setting MTU " 1313 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 1314 sp->pp_saved_mtu, ifp->if_mtu); 1315 } 1316 SPPP_UNLOCK(sp); 1317 break; 1318 1319 case SIOCGIFMTU: 1320 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1321 error = 0; 1322 break; 1323 case SIOCADDMULTI: 1324 case SIOCDELMULTI: 1325 break; 1326 1327 case SPPPSETAUTHCFG: 1328 case SPPPSETLCPCFG: 1329 case SPPPSETNCPCFG: 1330 case SPPPSETIDLETO: 1331 case SPPPSETAUTHFAILURE: 1332 case SPPPSETDNSOPTS: 1333 case SPPPSETKEEPALIVE: 1334 #if defined(COMPAT_50) || defined(MODULAR) 1335 case __SPPPSETIDLETO50: 1336 case __SPPPSETKEEPALIVE50: 1337 #endif /* COMPAT_50 || MODULAR */ 1338 error = kauth_authorize_network(l->l_cred, 1339 KAUTH_NETWORK_INTERFACE, 1340 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1341 NULL); 1342 if (error) 1343 break; 1344 error = sppp_params(sp, cmd, data); 1345 break; 1346 1347 case SPPPGETAUTHCFG: 1348 case SPPPGETLCPCFG: 1349 case SPPPGETNCPCFG: 1350 case SPPPGETAUTHFAILURES: 1351 error = kauth_authorize_network(l->l_cred, 1352 KAUTH_NETWORK_INTERFACE, 1353 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1354 NULL); 1355 if (error) 1356 break; 1357 error = sppp_params(sp, cmd, data); 1358 break; 1359 1360 case SPPPGETSTATUS: 1361 case SPPPGETSTATUSNCP: 1362 case SPPPGETIDLETO: 1363 case SPPPGETDNSOPTS: 1364 case SPPPGETDNSADDRS: 1365 case SPPPGETKEEPALIVE: 1366 #if defined(COMPAT_50) || defined(MODULAR) 1367 case __SPPPGETIDLETO50: 1368 case __SPPPGETKEEPALIVE50: 1369 #endif /* COMPAT_50 || MODULAR */ 1370 case SPPPGETLCPSTATUS: 1371 case SPPPGETIPCPSTATUS: 1372 case SPPPGETIPV6CPSTATUS: 1373 error = sppp_params(sp, cmd, data); 1374 break; 1375 1376 default: 1377 error = ifioctl_common(ifp, cmd, data); 1378 break; 1379 } 1380 splx(s); 1381 return (error); 1382 } 1383 1384 /* 1385 * PPP protocol implementation. 1386 */ 1387 1388 /* 1389 * Send PPP control protocol packet. 1390 */ 1391 static void 1392 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1393 u_char ident, u_short len, void *data) 1394 { 1395 struct ifnet *ifp; 1396 struct lcp_header *lh; 1397 struct mbuf *m; 1398 size_t pkthdrlen; 1399 1400 KASSERT(SPPP_WLOCKED(sp)); 1401 1402 ifp = &sp->pp_if; 1403 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1404 1405 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1406 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1407 MGETHDR(m, M_DONTWAIT, MT_DATA); 1408 if (! m) { 1409 return; 1410 } 1411 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1412 m_reset_rcvif(m); 1413 1414 if (sp->pp_flags & PP_NOFRAMING) { 1415 *mtod(m, uint16_t *) = htons(proto); 1416 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1417 } else { 1418 struct ppp_header *h; 1419 h = mtod(m, struct ppp_header *); 1420 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1421 h->control = PPP_UI; /* Unnumbered Info */ 1422 h->protocol = htons(proto); /* Link Control Protocol */ 1423 lh = (struct lcp_header *)(h + 1); 1424 } 1425 lh->type = type; 1426 lh->ident = ident; 1427 lh->len = htons(LCP_HEADER_LEN + len); 1428 if (len) 1429 memcpy(lh + 1, data, len); 1430 1431 if (sppp_debug_enabled(sp)) { 1432 char pbuf[SPPP_PROTO_NAMELEN]; 1433 char tbuf[SPPP_CPTYPE_NAMELEN]; 1434 const char *pname, *cpname; 1435 1436 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1437 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1438 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 1439 pname, cpname, lh->ident, ntohs(lh->len)); 1440 if (len) 1441 sppp_print_bytes((u_char *)(lh + 1), len); 1442 addlog(">\n"); 1443 } 1444 if (IF_QFULL(&sp->pp_cpq)) { 1445 IF_DROP(&sp->pp_fastq); 1446 IF_DROP(&ifp->if_snd); 1447 m_freem(m); 1448 if_statinc(ifp, if_oerrors); 1449 return; 1450 } 1451 1452 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1453 IF_ENQUEUE(&sp->pp_cpq, m); 1454 1455 if (! (ifp->if_flags & IFF_OACTIVE)) { 1456 SPPP_UNLOCK(sp); 1457 if_start_lock(ifp); 1458 SPPP_LOCK(sp, RW_WRITER); 1459 } 1460 } 1461 1462 static void 1463 sppp_cp_to_lcp(void *xsp) 1464 { 1465 struct sppp *sp = xsp; 1466 1467 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1468 } 1469 1470 static void 1471 sppp_cp_to_ipcp(void *xsp) 1472 { 1473 struct sppp *sp = xsp; 1474 1475 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1476 } 1477 1478 static void 1479 sppp_cp_to_ipv6cp(void *xsp) 1480 { 1481 struct sppp *sp = xsp; 1482 1483 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1484 } 1485 1486 static void 1487 sppp_cp_to_pap(void *xsp) 1488 { 1489 struct sppp *sp = xsp; 1490 1491 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1492 } 1493 1494 static void 1495 sppp_cp_to_chap(void *xsp) 1496 { 1497 struct sppp *sp = xsp; 1498 1499 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1500 } 1501 1502 static void 1503 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1504 { 1505 struct sppp_cp *scp; 1506 typedef void (*sppp_co_cb_t)(void *); 1507 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1508 [IDX_LCP] = sppp_cp_to_lcp, 1509 [IDX_IPCP] = sppp_cp_to_ipcp, 1510 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1511 [IDX_PAP] = sppp_cp_to_pap, 1512 [IDX_CHAP] = sppp_cp_to_chap, 1513 }; 1514 1515 scp = &sp->scp[cp->protoidx]; 1516 scp->state = STATE_INITIAL; 1517 scp->fail_counter = 0; 1518 scp->seq = 0; 1519 scp->rseq = 0; 1520 1521 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1522 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1523 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1524 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1525 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1526 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1527 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1528 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1529 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1530 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1531 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1532 1533 callout_init(&scp->ch, CALLOUT_MPSAFE); 1534 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1535 } 1536 1537 static void 1538 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1539 { 1540 struct sppp_cp *scp; 1541 scp = &sp->scp[cp->protoidx]; 1542 1543 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1544 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1545 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1546 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1547 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1548 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1549 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1550 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1551 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1552 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1553 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1554 1555 callout_halt(&scp->ch, NULL); 1556 callout_destroy(&scp->ch); 1557 1558 if (scp->mbuf_confreq != NULL) { 1559 m_freem(scp->mbuf_confreq); 1560 scp->mbuf_confreq = NULL; 1561 } 1562 if (scp->mbuf_confnak != NULL) { 1563 m_freem(scp->mbuf_confnak); 1564 scp->mbuf_confnak = NULL; 1565 } 1566 } 1567 1568 /* 1569 * Handle incoming PPP control protocol packets. 1570 */ 1571 static void 1572 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1573 { 1574 struct ifnet *ifp; 1575 struct lcp_header *h; 1576 struct sppp_cp *scp; 1577 int printlen, len = m->m_pkthdr.len; 1578 u_char *p; 1579 uint32_t u32; 1580 char tbuf[SPPP_CPTYPE_NAMELEN]; 1581 const char *cpname; 1582 bool debug; 1583 1584 SPPP_LOCK(sp, RW_WRITER); 1585 1586 ifp = &sp->pp_if; 1587 debug = sppp_debug_enabled(sp); 1588 scp = &sp->scp[cp->protoidx]; 1589 1590 if (len < 4) { 1591 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n", 1592 cp->name, len); 1593 goto out; 1594 } 1595 h = mtod(m, struct lcp_header *); 1596 if (debug) { 1597 printlen = ntohs(h->len); 1598 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1599 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d", 1600 cp->name, sppp_state_name(scp->state), 1601 cpname, h->ident, printlen); 1602 if (len < printlen) 1603 printlen = len; 1604 if (printlen > 4) 1605 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1606 addlog(">\n"); 1607 } 1608 if (len > ntohs(h->len)) 1609 len = ntohs(h->len); 1610 p = (u_char *)(h + 1); 1611 switch (h->type) { 1612 case CONF_REQ: 1613 if (len < 4) { 1614 SPPP_DLOG(sp,"%s invalid conf-req length %d\n", 1615 cp->name, len); 1616 if_statinc(ifp, if_ierrors); 1617 break; 1618 } 1619 1620 scp->rcr_type = CP_RCR_NONE; 1621 scp->rconfid = h->ident; 1622 if (scp->mbuf_confreq != NULL) { 1623 m_freem(scp->mbuf_confreq); 1624 } 1625 scp->mbuf_confreq = m; 1626 m = NULL; 1627 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1628 break; 1629 case CONF_ACK: 1630 if (h->ident != scp->confid) { 1631 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1632 cp->name, h->ident, scp->confid); 1633 if_statinc(ifp, if_ierrors); 1634 break; 1635 } 1636 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1637 break; 1638 case CONF_NAK: 1639 case CONF_REJ: 1640 if (h->ident != scp->confid) { 1641 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1642 cp->name, h->ident, scp->confid); 1643 if_statinc(ifp, if_ierrors); 1644 break; 1645 } 1646 1647 if (scp->mbuf_confnak) { 1648 m_freem(scp->mbuf_confnak); 1649 } 1650 scp->mbuf_confnak = m; 1651 m = NULL; 1652 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1653 break; 1654 case TERM_REQ: 1655 scp->rseq = h->ident; 1656 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1657 break; 1658 case TERM_ACK: 1659 if (h->ident != scp->confid && 1660 h->ident != scp->seq) { 1661 SPPP_DLOG(sp, "%s id mismatch " 1662 "0x%x != 0x%x and 0x%x != %0lx\n", 1663 cp->name, h->ident, scp->confid, 1664 h->ident, scp->seq); 1665 if_statinc(ifp, if_ierrors); 1666 break; 1667 } 1668 1669 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1670 break; 1671 case CODE_REJ: 1672 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1673 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1674 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, " 1675 "danger will robinson\n", cp->name, cpname); 1676 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1677 break; 1678 case PROTO_REJ: 1679 { 1680 int catastrophic; 1681 const struct cp *upper; 1682 int i; 1683 uint16_t proto; 1684 1685 catastrophic = 0; 1686 upper = NULL; 1687 proto = p[0] << 8 | p[1]; 1688 for (i = 0; i < IDX_COUNT; i++) { 1689 if (cps[i]->proto == proto) { 1690 upper = cps[i]; 1691 break; 1692 } 1693 } 1694 if (upper == NULL) 1695 catastrophic++; 1696 1697 if (debug) { 1698 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1699 SPPP_LOG(sp, LOG_INFO, 1700 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1701 cp->name, catastrophic ? '-' : '+', 1702 cpname, proto, upper ? upper->name : "unknown", 1703 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1704 } 1705 1706 /* 1707 * if we got RXJ+ against conf-req, the peer does not implement 1708 * this particular protocol type. terminate the protocol. 1709 */ 1710 if (upper && !catastrophic) { 1711 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1712 sppp_wq_add(sp->wq_cp, 1713 &sp->scp[upper->protoidx].work_close); 1714 break; 1715 } 1716 } 1717 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1718 break; 1719 } 1720 case DISC_REQ: 1721 if (cp->proto != PPP_LCP) 1722 goto illegal; 1723 /* Discard the packet. */ 1724 break; 1725 case ECHO_REQ: 1726 if (cp->proto != PPP_LCP) 1727 goto illegal; 1728 if (scp->state != STATE_OPENED) { 1729 SPPP_DLOG(sp, "lcp echo req but lcp closed\n"); 1730 if_statinc(ifp, if_ierrors); 1731 break; 1732 } 1733 if (len < 8) { 1734 SPPP_DLOG(sp, "invalid lcp echo request " 1735 "packet length: %d bytes\n", len); 1736 break; 1737 } 1738 memcpy(&u32, h + 1, sizeof u32); 1739 if (ntohl(u32) == sp->lcp.magic) { 1740 /* Line loopback mode detected. */ 1741 SPPP_DLOG(sp, "loopback\n"); 1742 1743 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 1744 sp->pp_flags |= PP_LOOPBACK; 1745 sppp_wq_add(sp->wq_cp, 1746 &sp->work_ifdown); 1747 } 1748 1749 /* Shut down the PPP link. */ 1750 sppp_wq_add(sp->wq_cp, 1751 &sp->scp[IDX_LCP].work_close); 1752 sppp_wq_add(sp->wq_cp, 1753 &sp->scp[IDX_LCP].work_open); 1754 break; 1755 } 1756 u32 = htonl(sp->lcp.magic); 1757 memcpy(h + 1, &u32, sizeof u32); 1758 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n"); 1759 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1760 h + 1); 1761 break; 1762 case ECHO_REPLY: 1763 if (cp->proto != PPP_LCP) 1764 goto illegal; 1765 if (h->ident != sp->lcp.echoid) { 1766 if_statinc(ifp, if_ierrors); 1767 break; 1768 } 1769 if (len < 8) { 1770 SPPP_DLOG(sp, "lcp invalid echo reply " 1771 "packet length: %d bytes\n", len); 1772 break; 1773 } 1774 SPPP_DLOG(sp, "lcp got echo rep\n"); 1775 memcpy(&u32, h + 1, sizeof u32); 1776 if (ntohl(u32) != sp->lcp.magic) 1777 sp->pp_alivecnt = 0; 1778 break; 1779 default: 1780 /* Unknown packet type -- send Code-Reject packet. */ 1781 illegal: 1782 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n", 1783 cp->name, h->type); 1784 sppp_cp_send(sp, cp->proto, CODE_REJ, 1785 ++scp->seq, m->m_pkthdr.len, h); 1786 if_statinc(ifp, if_ierrors); 1787 } 1788 1789 out: 1790 SPPP_UNLOCK(sp); 1791 if (m != NULL) 1792 m_freem(m); 1793 } 1794 1795 /* 1796 * The generic part of all Up/Down/Open/Close/TO event handlers. 1797 * Basically, the state transition handling in the automaton. 1798 */ 1799 static void 1800 sppp_up_event(struct sppp *sp, void *xcp) 1801 { 1802 const struct cp *cp = xcp; 1803 1804 KASSERT(SPPP_WLOCKED(sp)); 1805 KASSERT(!cpu_softintr_p()); 1806 1807 if ((cp->flags & CP_AUTH) != 0 && 1808 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1809 return; 1810 1811 SPPP_DLOG(sp, "%s up(%s)\n", cp->name, 1812 sppp_state_name(sp->scp[cp->protoidx].state)); 1813 1814 switch (sp->scp[cp->protoidx].state) { 1815 case STATE_INITIAL: 1816 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1817 break; 1818 case STATE_STARTING: 1819 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1820 (cp->scr)(sp); 1821 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1822 break; 1823 default: 1824 SPPP_LOG(sp, LOG_DEBUG, 1825 "%s illegal up in state %s\n", cp->name, 1826 sppp_state_name(sp->scp[cp->protoidx].state)); 1827 } 1828 } 1829 1830 static void 1831 sppp_down_event(struct sppp *sp, void *xcp) 1832 { 1833 const struct cp *cp = xcp; 1834 1835 KASSERT(SPPP_WLOCKED(sp)); 1836 KASSERT(!cpu_softintr_p()); 1837 1838 if ((cp->flags & CP_AUTH) != 0 && 1839 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1840 return; 1841 1842 SPPP_DLOG(sp, "%s down(%s)\n", cp->name, 1843 sppp_state_name(sp->scp[cp->protoidx].state)); 1844 1845 switch (sp->scp[cp->protoidx].state) { 1846 case STATE_CLOSED: 1847 case STATE_CLOSING: 1848 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1849 break; 1850 case STATE_STOPPED: 1851 (cp->tls)(cp, sp); 1852 /* fall through */ 1853 case STATE_STOPPING: 1854 case STATE_REQ_SENT: 1855 case STATE_ACK_RCVD: 1856 case STATE_ACK_SENT: 1857 sppp_cp_change_state(cp, sp, STATE_STARTING); 1858 break; 1859 case STATE_OPENED: 1860 (cp->tld)(sp); 1861 sppp_cp_change_state(cp, sp, STATE_STARTING); 1862 break; 1863 default: 1864 /* 1865 * a down event may be caused regardless 1866 * of state just in LCP case. 1867 */ 1868 if (cp->proto == PPP_LCP) 1869 break; 1870 1871 SPPP_LOG(sp, LOG_DEBUG, 1872 "%s illegal down in state %s\n", cp->name, 1873 sppp_state_name(sp->scp[cp->protoidx].state)); 1874 } 1875 } 1876 1877 static void 1878 sppp_open_event(struct sppp *sp, void *xcp) 1879 { 1880 const struct cp *cp = xcp; 1881 1882 KASSERT(SPPP_WLOCKED(sp)); 1883 KASSERT(!cpu_softintr_p()); 1884 1885 if ((cp->flags & CP_AUTH) != 0 && 1886 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1887 return; 1888 1889 SPPP_DLOG(sp, "%s open(%s)\n", cp->name, 1890 sppp_state_name(sp->scp[cp->protoidx].state)); 1891 1892 switch (sp->scp[cp->protoidx].state) { 1893 case STATE_INITIAL: 1894 sppp_cp_change_state(cp, sp, STATE_STARTING); 1895 (cp->tls)(cp, sp); 1896 break; 1897 case STATE_STARTING: 1898 break; 1899 case STATE_CLOSED: 1900 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1901 sp->lcp.protos |= (1 << cp->protoidx); 1902 (cp->scr)(sp); 1903 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1904 break; 1905 case STATE_STOPPED: 1906 case STATE_STOPPING: 1907 case STATE_REQ_SENT: 1908 case STATE_ACK_RCVD: 1909 case STATE_ACK_SENT: 1910 case STATE_OPENED: 1911 break; 1912 case STATE_CLOSING: 1913 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1914 break; 1915 } 1916 } 1917 1918 static void 1919 sppp_close_event(struct sppp *sp, void *xcp) 1920 { 1921 const struct cp *cp = xcp; 1922 1923 KASSERT(SPPP_WLOCKED(sp)); 1924 KASSERT(!cpu_softintr_p()); 1925 1926 if ((cp->flags & CP_AUTH) != 0 && 1927 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1928 return; 1929 1930 SPPP_DLOG(sp, "%s close(%s)\n", cp->name, 1931 sppp_state_name(sp->scp[cp->protoidx].state)); 1932 1933 switch (sp->scp[cp->protoidx].state) { 1934 case STATE_INITIAL: 1935 case STATE_CLOSED: 1936 case STATE_CLOSING: 1937 break; 1938 case STATE_STARTING: 1939 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1940 (cp->tlf)(cp, sp); 1941 break; 1942 case STATE_STOPPED: 1943 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1944 break; 1945 case STATE_STOPPING: 1946 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1947 break; 1948 case STATE_OPENED: 1949 (cp->tld)(sp); 1950 /* fall through */ 1951 case STATE_REQ_SENT: 1952 case STATE_ACK_RCVD: 1953 case STATE_ACK_SENT: 1954 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 1955 if ((cp->flags & CP_AUTH) == 0) { 1956 sppp_cp_send(sp, cp->proto, TERM_REQ, 1957 ++sp->scp[cp->protoidx].seq, 0, 0); 1958 } 1959 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1960 break; 1961 } 1962 } 1963 1964 static void 1965 sppp_to_event(struct sppp *sp, void *xcp) 1966 { 1967 const struct cp *cp = xcp; 1968 int s; 1969 1970 KASSERT(SPPP_WLOCKED(sp)); 1971 KASSERT(!cpu_softintr_p()); 1972 1973 s = splnet(); 1974 1975 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name, 1976 sppp_state_name(sp->scp[cp->protoidx].state), 1977 sp->scp[cp->protoidx].rst_counter); 1978 1979 if (--sp->scp[cp->protoidx].rst_counter < 0) 1980 /* TO- event */ 1981 switch (sp->scp[cp->protoidx].state) { 1982 case STATE_CLOSING: 1983 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1984 (cp->tlf)(cp, sp); 1985 break; 1986 case STATE_STOPPING: 1987 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1988 (cp->tlf)(cp, sp); 1989 break; 1990 case STATE_REQ_SENT: 1991 case STATE_ACK_RCVD: 1992 case STATE_ACK_SENT: 1993 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1994 (cp->tlf)(cp, sp); 1995 break; 1996 } 1997 else 1998 /* TO+ event */ 1999 switch (sp->scp[cp->protoidx].state) { 2000 case STATE_CLOSING: 2001 case STATE_STOPPING: 2002 if ((cp->flags & CP_AUTH) == 0) { 2003 sppp_cp_send(sp, cp->proto, TERM_REQ, 2004 ++sp->scp[cp->protoidx].seq, 0, 0); 2005 } 2006 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2007 break; 2008 case STATE_REQ_SENT: 2009 case STATE_ACK_RCVD: 2010 (cp->scr)(sp); 2011 /* sppp_cp_change_state() will restart the timer */ 2012 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2013 break; 2014 case STATE_ACK_SENT: 2015 (cp->scr)(sp); 2016 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2017 break; 2018 } 2019 2020 splx(s); 2021 } 2022 static void 2023 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2024 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2025 { 2026 struct ifnet *ifp; 2027 u_char ctype; 2028 2029 ifp = &sp->pp_if; 2030 2031 if (type == CP_RCR_ERR) { 2032 /* parse error, shut down */ 2033 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2034 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2035 } else if (type == CP_RCR_ACK) { 2036 /* RCR+ event */ 2037 ctype = CONF_ACK; 2038 switch (sp->scp[cp->protoidx].state) { 2039 case STATE_OPENED: 2040 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2041 cp->tld(sp); 2042 cp->scr(sp); 2043 cp->screply(cp, sp, ctype, ident, msglen, msg); 2044 break; 2045 case STATE_REQ_SENT: 2046 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2047 /* fall through */ 2048 case STATE_ACK_SENT: 2049 cp->screply(cp, sp, ctype, ident, msglen, msg); 2050 break; 2051 case STATE_STOPPED: 2052 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2053 cp->scr(sp); 2054 cp->screply(cp, sp, ctype, ident, msglen, msg); 2055 break; 2056 case STATE_ACK_RCVD: 2057 sppp_cp_change_state(cp, sp, STATE_OPENED); 2058 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2059 cp->tlu(sp); 2060 cp->screply(cp, sp, ctype, ident, msglen, msg); 2061 break; 2062 case STATE_CLOSING: 2063 case STATE_STOPPING: 2064 break; 2065 case STATE_CLOSED: 2066 if ((cp->flags & CP_AUTH) == 0) { 2067 sppp_cp_send(sp, cp->proto, TERM_ACK, 2068 ident, 0, 0); 2069 } 2070 break; 2071 default: 2072 SPPP_LOG(sp, LOG_DEBUG, 2073 "%s illegal RCR+ in state %s\n", cp->name, 2074 sppp_state_name(sp->scp[cp->protoidx].state)); 2075 if_statinc(ifp, if_ierrors); 2076 } 2077 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2078 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2079 /* RCR- event */ 2080 switch (sp->scp[cp->protoidx].state) { 2081 case STATE_OPENED: 2082 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2083 cp->tld(sp); 2084 cp->scr(sp); 2085 cp->screply(cp, sp, ctype, ident, msglen, msg); 2086 break; 2087 case STATE_ACK_SENT: 2088 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2089 /* fall through */ 2090 case STATE_REQ_SENT: 2091 cp->screply(cp, sp, ctype, ident, msglen, msg); 2092 break; 2093 case STATE_STOPPED: 2094 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2095 cp->scr(sp); 2096 cp->screply(cp, sp, ctype, ident, msglen, msg); 2097 break; 2098 case STATE_ACK_RCVD: 2099 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2100 cp->screply(cp, sp, ctype, ident, msglen, msg); 2101 break; 2102 case STATE_CLOSING: 2103 case STATE_STOPPING: 2104 break; 2105 case STATE_CLOSED: 2106 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2107 if ((cp->flags & CP_AUTH) == 0) { 2108 sppp_cp_send(sp, cp->proto, TERM_ACK, 2109 ident, 0, 0); 2110 } 2111 break; 2112 default: 2113 SPPP_LOG(sp, LOG_DEBUG, 2114 "%s illegal RCR- in state %s\n", cp->name, 2115 sppp_state_name(sp->scp[cp->protoidx].state)); 2116 if_statinc(ifp, if_ierrors); 2117 } 2118 } 2119 } 2120 2121 static void 2122 sppp_rcr_event(struct sppp *sp, void *xcp) 2123 { 2124 const struct cp *cp = xcp; 2125 struct sppp_cp *scp; 2126 struct lcp_header *h; 2127 struct mbuf *m; 2128 enum cp_rcr_type type; 2129 size_t len; 2130 uint8_t *buf; 2131 size_t blen, rlen; 2132 uint8_t ident; 2133 2134 KASSERT(!cpu_softintr_p()); 2135 2136 scp = &sp->scp[cp->protoidx]; 2137 2138 if (cp->parse_confreq != NULL) { 2139 m = scp->mbuf_confreq; 2140 if (m == NULL) 2141 return; 2142 scp->mbuf_confreq = NULL; 2143 2144 h = mtod(m, struct lcp_header *); 2145 if (h->type != CONF_REQ) { 2146 m_freem(m); 2147 return; 2148 } 2149 2150 ident = h->ident; 2151 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2152 2153 type = (cp->parse_confreq)(sp, h, len, 2154 &buf, &blen, &rlen); 2155 m_freem(m); 2156 } else { 2157 /* mbuf_cofreq is already parsed and freed */ 2158 type = scp->rcr_type; 2159 ident = scp->rconfid; 2160 buf = NULL; 2161 blen = rlen = 0; 2162 } 2163 2164 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2165 2166 if (buf != NULL) 2167 kmem_free(buf, blen); 2168 } 2169 2170 static void 2171 sppp_rca_event(struct sppp *sp, void *xcp) 2172 { 2173 struct ifnet *ifp; 2174 const struct cp *cp = xcp; 2175 2176 KASSERT(!cpu_softintr_p()); 2177 2178 ifp = &sp->pp_if; 2179 2180 switch (sp->scp[cp->protoidx].state) { 2181 case STATE_CLOSED: 2182 case STATE_STOPPED: 2183 if ((cp->flags & CP_AUTH) == 0) { 2184 sppp_cp_send(sp, cp->proto, TERM_ACK, 2185 sp->scp[cp->protoidx].rconfid, 0, 0); 2186 } 2187 break; 2188 case STATE_CLOSING: 2189 case STATE_STOPPING: 2190 break; 2191 case STATE_REQ_SENT: 2192 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2193 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2194 break; 2195 case STATE_OPENED: 2196 (cp->tld)(sp); 2197 /* fall through */ 2198 case STATE_ACK_RCVD: 2199 (cp->scr)(sp); 2200 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2201 break; 2202 case STATE_ACK_SENT: 2203 sppp_cp_change_state(cp, sp, STATE_OPENED); 2204 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2205 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2206 (cp->tlu)(sp); 2207 break; 2208 default: 2209 SPPP_LOG(sp, LOG_DEBUG, 2210 "%s illegal RCA in state %s\n", cp->name, 2211 sppp_state_name(sp->scp[cp->protoidx].state)); 2212 if_statinc(ifp, if_ierrors); 2213 } 2214 } 2215 2216 static void 2217 sppp_rcn_event(struct sppp *sp, void *xcp) 2218 { 2219 const struct cp *cp = xcp; 2220 struct sppp_cp *scp; 2221 struct lcp_header *h; 2222 struct mbuf *m; 2223 struct ifnet *ifp = &sp->pp_if; 2224 size_t len; 2225 2226 KASSERT(!cpu_softintr_p()); 2227 2228 scp = &sp->scp[cp->protoidx]; 2229 m = scp->mbuf_confnak; 2230 if (m == NULL) 2231 return; 2232 scp->mbuf_confnak = NULL; 2233 2234 h = mtod(m, struct lcp_header *); 2235 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2236 2237 switch (h->type) { 2238 case CONF_NAK: 2239 (cp->parse_confnak)(sp, h, len); 2240 break; 2241 case CONF_REJ: 2242 (cp->parse_confrej)(sp, h, len); 2243 break; 2244 default: 2245 m_freem(m); 2246 return; 2247 } 2248 2249 m_freem(m); 2250 2251 switch (scp->state) { 2252 case STATE_CLOSED: 2253 case STATE_STOPPED: 2254 if ((cp->flags & CP_AUTH) == 0) { 2255 sppp_cp_send(sp, cp->proto, TERM_ACK, 2256 scp->rconfid, 0, 0); 2257 } 2258 break; 2259 case STATE_REQ_SENT: 2260 case STATE_ACK_SENT: 2261 scp->rst_counter = sp->lcp.max_configure; 2262 (cp->scr)(sp); 2263 break; 2264 case STATE_OPENED: 2265 (cp->tld)(sp); 2266 /* fall through */ 2267 case STATE_ACK_RCVD: 2268 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2269 (cp->scr)(sp); 2270 break; 2271 case STATE_CLOSING: 2272 case STATE_STOPPING: 2273 break; 2274 default: 2275 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n", 2276 cp->name, sppp_state_name(scp->state)); 2277 if_statinc(ifp, if_ierrors); 2278 } 2279 } 2280 2281 static void 2282 sppp_rtr_event(struct sppp *sp, void *xcp) 2283 { 2284 struct ifnet *ifp; 2285 const struct cp *cp = xcp; 2286 2287 KASSERT(!cpu_softintr_p()); 2288 2289 ifp = &sp->pp_if; 2290 2291 switch (sp->scp[cp->protoidx].state) { 2292 case STATE_ACK_RCVD: 2293 case STATE_ACK_SENT: 2294 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2295 break; 2296 case STATE_CLOSED: 2297 case STATE_STOPPED: 2298 case STATE_CLOSING: 2299 case STATE_STOPPING: 2300 case STATE_REQ_SENT: 2301 break; 2302 case STATE_OPENED: 2303 (cp->tld)(sp); 2304 sp->scp[cp->protoidx].rst_counter = 0; 2305 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2306 break; 2307 default: 2308 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n", 2309 cp->name, 2310 sppp_state_name(sp->scp[cp->protoidx].state)); 2311 if_statinc(ifp, if_ierrors); 2312 return; 2313 } 2314 2315 /* Send Terminate-Ack packet. */ 2316 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name); 2317 if ((cp->flags & CP_AUTH) == 0) { 2318 sppp_cp_send(sp, cp->proto, TERM_ACK, 2319 sp->scp[cp->protoidx].rseq, 0, 0); 2320 } 2321 } 2322 2323 static void 2324 sppp_rta_event(struct sppp *sp, void *xcp) 2325 { 2326 const struct cp *cp = xcp; 2327 struct ifnet *ifp = &sp->pp_if; 2328 2329 KASSERT(!cpu_softintr_p()); 2330 2331 switch (sp->scp[cp->protoidx].state) { 2332 case STATE_CLOSED: 2333 case STATE_STOPPED: 2334 case STATE_REQ_SENT: 2335 case STATE_ACK_SENT: 2336 break; 2337 case STATE_CLOSING: 2338 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2339 (cp->tlf)(cp, sp); 2340 break; 2341 case STATE_STOPPING: 2342 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2343 (cp->tlf)(cp, sp); 2344 break; 2345 case STATE_ACK_RCVD: 2346 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2347 break; 2348 case STATE_OPENED: 2349 (cp->tld)(sp); 2350 (cp->scr)(sp); 2351 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2352 break; 2353 default: 2354 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n", 2355 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2356 if_statinc(ifp, if_ierrors); 2357 } 2358 } 2359 2360 static void 2361 sppp_rxj_event(struct sppp *sp, void *xcp) 2362 { 2363 const struct cp *cp = xcp; 2364 struct ifnet *ifp = &sp->pp_if; 2365 2366 KASSERT(!cpu_softintr_p()); 2367 2368 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2369 switch (sp->scp[cp->protoidx].state) { 2370 case STATE_CLOSED: 2371 case STATE_STOPPED: 2372 case STATE_REQ_SENT: 2373 case STATE_ACK_SENT: 2374 case STATE_CLOSING: 2375 case STATE_STOPPING: 2376 case STATE_OPENED: 2377 break; 2378 case STATE_ACK_RCVD: 2379 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2380 break; 2381 default: 2382 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n", 2383 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2384 if_statinc(ifp, if_ierrors); 2385 } 2386 } 2387 2388 /* 2389 * Change the state of a control protocol in the state automaton. 2390 * Takes care of starting/stopping the restart timer. 2391 */ 2392 void 2393 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2394 { 2395 2396 KASSERT(SPPP_WLOCKED(sp)); 2397 2398 sp->scp[cp->protoidx].state = newstate; 2399 callout_stop(&sp->scp[cp->protoidx].ch); 2400 switch (newstate) { 2401 case STATE_INITIAL: 2402 case STATE_STARTING: 2403 case STATE_CLOSED: 2404 case STATE_STOPPED: 2405 case STATE_OPENED: 2406 break; 2407 case STATE_CLOSING: 2408 case STATE_STOPPING: 2409 case STATE_REQ_SENT: 2410 case STATE_ACK_RCVD: 2411 case STATE_ACK_SENT: 2412 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2413 break; 2414 } 2415 } 2416 2417 /* 2418 *--------------------------------------------------------------------------* 2419 * * 2420 * The LCP implementation. * 2421 * * 2422 *--------------------------------------------------------------------------* 2423 */ 2424 static void 2425 sppp_lcp_init(struct sppp *sp) 2426 { 2427 2428 KASSERT(SPPP_WLOCKED(sp)); 2429 2430 sppp_cp_init(&lcp, sp); 2431 2432 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2433 sp->lcp.magic = 0; 2434 sp->lcp.protos = 0; 2435 sp->lcp.max_terminate = 2; 2436 sp->lcp.max_configure = 10; 2437 sp->lcp.max_failure = 10; 2438 sp->lcp.tlf_sent = false; 2439 2440 /* 2441 * Initialize counters and timeout values. Note that we don't 2442 * use the 3 seconds suggested in RFC 1661 since we are likely 2443 * running on a fast link. XXX We should probably implement 2444 * the exponential backoff option. Note that these values are 2445 * relevant for all control protocols, not just LCP only. 2446 */ 2447 sp->lcp.timeout = 1 * hz; 2448 } 2449 2450 static void 2451 sppp_lcp_up(struct sppp *sp, void *xcp) 2452 { 2453 struct ifnet *ifp; 2454 const struct cp *cp = xcp; 2455 int pidx; 2456 2457 KASSERT(SPPP_WLOCKED(sp)); 2458 ifp = &sp->pp_if; 2459 2460 pidx = cp->protoidx; 2461 /* Initialize activity timestamp: opening a connection is an activity */ 2462 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2463 2464 /* 2465 * If this interface is passive or dial-on-demand, and we are 2466 * still in Initial state, it means we've got an incoming 2467 * call. Activate the interface. 2468 */ 2469 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2470 ifp->if_flags |= IFF_RUNNING; 2471 if (sp->scp[pidx].state == STATE_INITIAL) { 2472 SPPP_DLOG(sp, "Up event (incoming call)\n"); 2473 sp->pp_flags |= PP_CALLIN; 2474 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2475 } else { 2476 SPPP_DLOG(sp, "Up event\n"); 2477 } 2478 } 2479 2480 sppp_up_event(sp, xcp); 2481 } 2482 2483 static void 2484 sppp_lcp_down(struct sppp *sp, void *xcp) 2485 { 2486 const struct cp *cp = xcp; 2487 struct ifnet *ifp; 2488 int pidx; 2489 2490 KASSERT(SPPP_WLOCKED(sp)); 2491 KASSERT(!cpu_softintr_p()); 2492 2493 ifp = &sp->pp_if; 2494 pidx = cp->protoidx; 2495 sppp_down_event(sp, xcp); 2496 2497 /* 2498 * We need to do tls to restart when a down event is caused 2499 * by the last tlf. 2500 */ 2501 if (sp->scp[pidx].state == STATE_STARTING && 2502 sp->lcp.tlf_sent) { 2503 cp->tls(cp, sp); 2504 sp->lcp.tlf_sent = false; 2505 } 2506 2507 SPPP_DLOG(sp, "Down event (carrier loss)\n"); 2508 2509 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2510 if (sp->lcp.reestablish) 2511 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2512 } else { 2513 sp->pp_flags &= ~PP_CALLIN; 2514 if (sp->scp[pidx].state != STATE_INITIAL) 2515 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2516 ifp->if_flags &= ~IFF_RUNNING; 2517 } 2518 sp->scp[pidx].fail_counter = 0; 2519 } 2520 2521 static void 2522 sppp_lcp_open(struct sppp *sp, void *xcp) 2523 { 2524 2525 KASSERT(SPPP_WLOCKED(sp)); 2526 KASSERT(!cpu_softintr_p()); 2527 2528 sp->lcp.reestablish = false; 2529 sp->scp[IDX_LCP].fail_counter = 0; 2530 2531 /* the interface was down while waiting for reconnection */ 2532 if ((sp->pp_flags & PP_ADMIN_UP) == 0) 2533 return; 2534 2535 if (sp->pp_if.if_mtu < PP_MTU) { 2536 sp->lcp.mru = sp->pp_if.if_mtu; 2537 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2538 } else { 2539 sp->lcp.mru = PP_MTU; 2540 } 2541 sp->lcp.their_mru = PP_MTU; 2542 2543 /* 2544 * If we are authenticator, negotiate LCP_AUTH 2545 */ 2546 if (sp->hisauth.proto != PPP_NOPROTO) 2547 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2548 else 2549 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2550 sp->pp_flags &= ~PP_NEEDAUTH; 2551 sppp_open_event(sp, xcp); 2552 } 2553 2554 2555 /* 2556 * Analyze a configure request. Return true if it was agreeable, and 2557 * caused action sca, false if it has been rejected or nak'ed, and 2558 * caused action scn. (The return value is used to make the state 2559 * transition decision in the state automaton.) 2560 */ 2561 static enum cp_rcr_type 2562 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2563 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2564 { 2565 u_char *buf, *r, *p, l, blen; 2566 enum cp_rcr_type type; 2567 int len, rlen; 2568 uint32_t nmagic; 2569 u_short authproto; 2570 char lbuf[SPPP_LCPOPT_NAMELEN]; 2571 bool debug; 2572 2573 KASSERT(SPPP_WLOCKED(sp)); 2574 2575 debug = sppp_debug_enabled(sp); 2576 2577 if (origlen < sizeof(*h)) 2578 return CP_RCR_DROP; 2579 2580 origlen -= sizeof(*h); 2581 type = CP_RCR_NONE; 2582 type = 0; 2583 2584 if (origlen <= 0) 2585 return CP_RCR_DROP; 2586 else 2587 blen = origlen; 2588 2589 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2590 if (buf == NULL) 2591 return CP_RCR_DROP; 2592 2593 if (debug) 2594 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:"); 2595 2596 /* pass 1: check for things that need to be rejected */ 2597 p = (void *)(h + 1); 2598 r = buf; 2599 rlen = 0; 2600 for (len = origlen; len > 1; len-= l, p += l) { 2601 l = p[1]; 2602 if (l == 0) 2603 break; 2604 2605 /* Sanity check option length */ 2606 if (l > len) { 2607 /* 2608 * Malicious option - drop immediately. 2609 * XXX Maybe we should just RXJ it? 2610 */ 2611 if (debug) 2612 addlog("\n"); 2613 2614 SPPP_LOG(sp, LOG_DEBUG, 2615 "received malicious LCP option 0x%02x, " 2616 "length 0x%02x, (len: 0x%02x) dropping.\n", 2617 p[0], l, len); 2618 type = CP_RCR_ERR; 2619 goto end; 2620 } 2621 if (debug) 2622 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2623 switch (p[0]) { 2624 case LCP_OPT_MAGIC: 2625 /* Magic number. */ 2626 /* fall through, both are same length */ 2627 case LCP_OPT_ASYNC_MAP: 2628 /* Async control character map. */ 2629 if (len >= 6 || l == 6) 2630 continue; 2631 if (debug) 2632 addlog(" [invalid]"); 2633 break; 2634 case LCP_OPT_MP_EID: 2635 if (len >= l && l >= 3) { 2636 switch (p[2]) { 2637 case 0: if (l==3+ 0) continue;break; 2638 case 2: if (l==3+ 4) continue;break; 2639 case 3: if (l==3+ 6) continue;break; 2640 case 6: if (l==3+16) continue;break; 2641 case 1: /* FALLTHROUGH */ 2642 case 4: if (l<=3+20) continue;break; 2643 case 5: if (l<=3+15) continue;break; 2644 /* XXX should it be default: continue;? */ 2645 } 2646 } 2647 if (debug) 2648 addlog(" [invalid class %d len %d]", p[2], l); 2649 break; 2650 case LCP_OPT_MP_SSNHF: 2651 if (len >= 2 && l == 2) { 2652 if (debug) 2653 addlog(" [rej]"); 2654 break; 2655 } 2656 if (debug) 2657 addlog(" [invalid]"); 2658 break; 2659 case LCP_OPT_MP_MRRU: 2660 /* Multilink maximum received reconstructed unit */ 2661 /* should be fall through, both are same length */ 2662 /* FALLTHROUGH */ 2663 case LCP_OPT_MRU: 2664 /* Maximum receive unit. */ 2665 if (len >= 4 && l == 4) 2666 continue; 2667 if (debug) 2668 addlog(" [invalid]"); 2669 break; 2670 case LCP_OPT_AUTH_PROTO: 2671 if (len < 4) { 2672 if (debug) 2673 addlog(" [invalid]"); 2674 break; 2675 } 2676 authproto = (p[2] << 8) + p[3]; 2677 if (authproto == PPP_CHAP && l != 5) { 2678 if (debug) 2679 addlog(" [invalid chap len]"); 2680 break; 2681 } 2682 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2683 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2684 sp->myauth.proto = authproto; 2685 } 2686 if (sp->myauth.proto == PPP_NOPROTO) { 2687 /* we are not configured to do auth */ 2688 if (debug) 2689 addlog(" [not configured]"); 2690 break; 2691 } 2692 /* 2693 * Remote want us to authenticate, remember this, 2694 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2695 * up. 2696 */ 2697 sp->pp_flags |= PP_NEEDAUTH; 2698 continue; 2699 default: 2700 /* Others not supported. */ 2701 if (debug) 2702 addlog(" [rej]"); 2703 break; 2704 } 2705 if (rlen + l > blen) { 2706 if (debug) 2707 addlog(" [overflow]"); 2708 continue; 2709 } 2710 /* Add the option to rejected list. */ 2711 memcpy(r, p, l); 2712 r += l; 2713 rlen += l; 2714 } 2715 2716 if (rlen > 0) { 2717 type = CP_RCR_REJ; 2718 goto end; 2719 } 2720 2721 if (debug) 2722 addlog("\n"); 2723 2724 /* 2725 * pass 2: check for option values that are unacceptable and 2726 * thus require to be nak'ed. 2727 */ 2728 if (debug) 2729 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:"); 2730 2731 p = (void *)(h + 1); 2732 r = buf; 2733 rlen = 0; 2734 for (len = origlen; len > 0; len -= l, p += l) { 2735 l = p[1]; 2736 if (l == 0) 2737 break; 2738 2739 if (debug) 2740 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2741 switch (p[0]) { 2742 case LCP_OPT_MAGIC: 2743 /* Magic number -- extract. */ 2744 nmagic = (uint32_t)p[2] << 24 | 2745 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2746 if (nmagic != sp->lcp.magic) { 2747 if (debug) 2748 addlog(" 0x%x", nmagic); 2749 continue; 2750 } 2751 /* 2752 * Local and remote magics equal -- loopback? 2753 */ 2754 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2755 SPPP_DLOG(sp, "loopback\n"); 2756 sp->pp_loopcnt = 0; 2757 2758 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 2759 sp->pp_flags |= PP_LOOPBACK; 2760 sppp_wq_add(sp->wq_cp, 2761 &sp->work_ifdown); 2762 } 2763 2764 sppp_wq_add(sp->wq_cp, 2765 &sp->scp[IDX_LCP].work_close); 2766 sppp_wq_add(sp->wq_cp, 2767 &sp->scp[IDX_LCP].work_open); 2768 } else { 2769 if (debug) 2770 addlog(" [glitch]"); 2771 ++sp->pp_loopcnt; 2772 } 2773 /* 2774 * We negate our magic here, and NAK it. If 2775 * we see it later in an NAK packet, we 2776 * suggest a new one. 2777 */ 2778 nmagic = ~sp->lcp.magic; 2779 /* Gonna NAK it. */ 2780 p[2] = nmagic >> 24; 2781 p[3] = nmagic >> 16; 2782 p[4] = nmagic >> 8; 2783 p[5] = nmagic; 2784 break; 2785 2786 case LCP_OPT_ASYNC_MAP: 2787 /* 2788 * Async control character map -- just ignore it. 2789 * 2790 * Quote from RFC 1662, chapter 6: 2791 * To enable this functionality, synchronous PPP 2792 * implementations MUST always respond to the 2793 * Async-Control-Character-Map Configuration 2794 * Option with the LCP Configure-Ack. However, 2795 * acceptance of the Configuration Option does 2796 * not imply that the synchronous implementation 2797 * will do any ACCM mapping. Instead, all such 2798 * octet mapping will be performed by the 2799 * asynchronous-to-synchronous converter. 2800 */ 2801 continue; 2802 2803 case LCP_OPT_MRU: 2804 /* 2805 * Maximum receive unit. Always agreeable, 2806 * but ignored by now. 2807 */ 2808 sp->lcp.their_mru = p[2] * 256 + p[3]; 2809 if (debug) 2810 addlog(" %ld", sp->lcp.their_mru); 2811 continue; 2812 2813 case LCP_OPT_AUTH_PROTO: 2814 authproto = (p[2] << 8) + p[3]; 2815 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2816 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2817 sp->myauth.proto = authproto; 2818 } 2819 if (sp->myauth.proto == authproto) { 2820 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 2821 continue; 2822 } 2823 if (debug) 2824 addlog(" [chap without MD5]"); 2825 } else { 2826 if (debug) { 2827 char pbuf1[SPPP_PROTO_NAMELEN]; 2828 char pbuf2[SPPP_PROTO_NAMELEN]; 2829 const char *pname1, *pname2; 2830 2831 pname1 = sppp_proto_name(pbuf1, 2832 sizeof(pbuf1), sp->myauth.proto); 2833 pname2 = sppp_proto_name(pbuf2, 2834 sizeof(pbuf2), authproto); 2835 addlog(" [mine %s != his %s]", 2836 pname1, pname2); 2837 } 2838 } 2839 /* not agreed, nak */ 2840 if (sp->myauth.proto == PPP_CHAP) { 2841 l = 5; 2842 } else { 2843 l = 4; 2844 } 2845 2846 if (rlen + l > blen) { 2847 if (debug) 2848 addlog(" [overflow]"); 2849 continue; 2850 } 2851 2852 r[0] = LCP_OPT_AUTH_PROTO; 2853 r[1] = l; 2854 r[2] = sp->myauth.proto >> 8; 2855 r[3] = sp->myauth.proto & 0xff; 2856 if (sp->myauth.proto == PPP_CHAP) 2857 r[4] = CHAP_MD5; 2858 rlen += l; 2859 r += l; 2860 continue; 2861 case LCP_OPT_MP_EID: 2862 /* 2863 * Endpoint identification. 2864 * Always agreeable, 2865 * but ignored by now. 2866 */ 2867 if (debug) { 2868 addlog(" type %d", p[2]); 2869 sppp_print_bytes(p+3, p[1]-3); 2870 } 2871 continue; 2872 case LCP_OPT_MP_MRRU: 2873 /* 2874 * Maximum received reconstructed unit. 2875 * Always agreeable, 2876 * but ignored by now. 2877 */ 2878 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2879 if (debug) 2880 addlog(" %ld", sp->lcp.their_mrru); 2881 continue; 2882 } 2883 if (rlen + l > blen) { 2884 if (debug) 2885 addlog(" [overflow]"); 2886 continue; 2887 } 2888 /* Add the option to nak'ed list. */ 2889 memcpy(r, p, l); 2890 r += l; 2891 rlen += l; 2892 } 2893 2894 if (rlen > 0) { 2895 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2896 if (debug) 2897 addlog(" max_failure (%d) exceeded, ", 2898 sp->lcp.max_failure); 2899 type = CP_RCR_REJ; 2900 } else { 2901 type = CP_RCR_NAK; 2902 } 2903 } else { 2904 type = CP_RCR_ACK; 2905 rlen = origlen; 2906 memcpy(r, h + 1, rlen); 2907 sp->scp[IDX_LCP].fail_counter = 0; 2908 sp->pp_loopcnt = 0; 2909 } 2910 2911 end: 2912 if (debug) 2913 addlog("\n"); 2914 2915 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 2916 if (buf != NULL) 2917 kmem_intr_free(buf, blen); 2918 } else { 2919 *msgbuf = buf; 2920 *buflen = blen; 2921 *msglen = rlen; 2922 } 2923 2924 return type; 2925 } 2926 2927 /* 2928 * Analyze the LCP Configure-Reject option list, and adjust our 2929 * negotiation. 2930 */ 2931 static void 2932 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 2933 { 2934 u_char *p, l; 2935 bool debug; 2936 2937 KASSERT(SPPP_WLOCKED(sp)); 2938 2939 debug = sppp_debug_enabled(sp); 2940 2941 if (len <= sizeof(*h)) 2942 return; 2943 2944 len -= sizeof(*h); 2945 2946 if (debug) 2947 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:"); 2948 2949 p = (void *)(h + 1); 2950 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2951 /* Sanity check option length */ 2952 if (l > len) { 2953 /* 2954 * Malicious option - drop immediately. 2955 * XXX Maybe we should just RXJ it? 2956 */ 2957 if (debug) 2958 addlog("\n"); 2959 2960 SPPP_LOG(sp, LOG_DEBUG, 2961 "received malicious LCP option, dropping.\n"); 2962 goto end; 2963 } 2964 if (debug) { 2965 char lbuf[SPPP_LCPOPT_NAMELEN]; 2966 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2967 } 2968 switch (p[0]) { 2969 case LCP_OPT_MAGIC: 2970 /* Magic number -- can't use it, use 0 */ 2971 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2972 sp->lcp.magic = 0; 2973 break; 2974 case LCP_OPT_MRU: 2975 /* 2976 * We try to negotiate a lower MRU if the underlying 2977 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2978 * peer rejects this lower rate, fallback to the 2979 * default. 2980 */ 2981 if (!debug) { 2982 SPPP_LOG(sp, LOG_INFO, 2983 "peer rejected our MRU of " 2984 "%ld bytes. Defaulting to %d bytes\n", 2985 sp->lcp.mru, PP_MTU); 2986 } 2987 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2988 sp->lcp.mru = PP_MTU; 2989 break; 2990 case LCP_OPT_AUTH_PROTO: 2991 /* 2992 * Peer doesn't want to authenticate himself, 2993 * deny unless this is a dialout call, and 2994 * SPPP_AUTHFLAG_NOCALLOUT is set. 2995 */ 2996 if ((sp->pp_flags & PP_CALLIN) == 0 && 2997 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2998 if (debug) { 2999 addlog(" [don't insist on auth " 3000 "for callout]"); 3001 } 3002 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3003 break; 3004 } 3005 if (debug) 3006 addlog("[access denied]\n"); 3007 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3008 break; 3009 } 3010 } 3011 if (debug) 3012 addlog("\n"); 3013 end: 3014 return; 3015 } 3016 3017 /* 3018 * Analyze the LCP Configure-NAK option list, and adjust our 3019 * negotiation. 3020 */ 3021 static void 3022 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3023 { 3024 u_char *p, l; 3025 uint32_t magic; 3026 bool debug; 3027 3028 KASSERT(SPPP_WLOCKED(sp)); 3029 3030 if (len <= sizeof(*h)) 3031 return; 3032 3033 debug = sppp_debug_enabled(sp); 3034 len -= sizeof(*h); 3035 3036 if (debug) 3037 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:"); 3038 3039 p = (void *)(h + 1); 3040 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3041 /* Sanity check option length */ 3042 if (l > len) { 3043 /* 3044 * Malicious option - drop immediately. 3045 * XXX Maybe we should just RXJ it? 3046 */ 3047 if (debug) 3048 addlog("\n"); 3049 3050 SPPP_LOG(sp, LOG_DEBUG, 3051 "received malicious LCP option, dropping.\n"); 3052 goto end; 3053 } 3054 if (debug) { 3055 char lbuf[SPPP_LCPOPT_NAMELEN]; 3056 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 3057 } 3058 switch (p[0]) { 3059 case LCP_OPT_MAGIC: 3060 /* Magic number -- renegotiate */ 3061 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3062 len >= 6 && l == 6) { 3063 magic = (uint32_t)p[2] << 24 | 3064 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3065 /* 3066 * If the remote magic is our negated one, 3067 * this looks like a loopback problem. 3068 * Suggest a new magic to make sure. 3069 */ 3070 if (magic == ~sp->lcp.magic) { 3071 if (debug) 3072 addlog(" magic glitch"); 3073 sp->lcp.magic = cprng_fast32(); 3074 } else { 3075 sp->lcp.magic = magic; 3076 if (debug) 3077 addlog(" %d", magic); 3078 } 3079 } 3080 break; 3081 case LCP_OPT_MRU: 3082 /* 3083 * Peer wants to advise us to negotiate an MRU. 3084 * Agree on it if it's reasonable, or use 3085 * default otherwise. 3086 */ 3087 if (len >= 4 && l == 4) { 3088 u_int mru = p[2] * 256 + p[3]; 3089 if (debug) 3090 addlog(" %d", mru); 3091 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3092 mru = sp->pp_if.if_mtu; 3093 sp->lcp.mru = mru; 3094 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3095 } 3096 break; 3097 case LCP_OPT_AUTH_PROTO: 3098 /* 3099 * Peer doesn't like our authentication method, 3100 * deny. 3101 */ 3102 if (debug) 3103 addlog("[access denied]\n"); 3104 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3105 break; 3106 } 3107 } 3108 if (debug) 3109 addlog("\n"); 3110 end: 3111 return; 3112 } 3113 3114 static void 3115 sppp_lcp_tlu(struct sppp *sp) 3116 { 3117 struct ifnet *ifp; 3118 struct sppp_cp *scp; 3119 int i; 3120 bool going_up; 3121 3122 KASSERT(SPPP_WLOCKED(sp)); 3123 3124 ifp = &sp->pp_if; 3125 3126 /* unlock for IFNET_LOCK and if_up() */ 3127 SPPP_UNLOCK(sp); 3128 3129 if (! (ifp->if_flags & IFF_UP) && 3130 (ifp->if_flags & IFF_RUNNING)) { 3131 /* Coming out of loopback mode. */ 3132 going_up = true; 3133 if_up(ifp); 3134 } else { 3135 going_up = false; 3136 } 3137 3138 IFNET_LOCK(ifp); 3139 SPPP_LOCK(sp, RW_WRITER); 3140 3141 if (going_up) { 3142 if ((sp->pp_flags & PP_LOOPBACK) == 0) { 3143 SPPP_LOG(sp, LOG_DEBUG, 3144 "interface is going up, " 3145 "but no loopback packet is deteted\n"); 3146 } 3147 sp->pp_flags &= ~PP_LOOPBACK; 3148 } 3149 3150 if (ifp->if_mtu > sp->lcp.their_mru) { 3151 sp->pp_saved_mtu = ifp->if_mtu; 3152 ifp->if_mtu = sp->lcp.their_mru; 3153 SPPP_DLOG(sp, "setting MTU " 3154 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3155 sp->pp_saved_mtu, ifp->if_mtu); 3156 } 3157 IFNET_UNLOCK(ifp); 3158 3159 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3160 (sp->pp_flags & PP_NEEDAUTH) != 0) 3161 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3162 else 3163 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3164 3165 3166 for (i = 0; i < IDX_COUNT; i++) { 3167 scp = &sp->scp[(cps[i])->protoidx]; 3168 3169 if (((cps[i])->flags & CP_LCP) == 0) 3170 sppp_wq_add(sp->wq_cp, &scp->work_up); 3171 3172 /* 3173 * Open all authentication protocols. This is even required 3174 * if we already proceeded to network phase, since it might be 3175 * that remote wants us to authenticate, so we might have to 3176 * send a PAP request. Undesired authentication protocols 3177 * don't do anything when they get an Open event. 3178 */ 3179 if ((cps[i])->flags & CP_AUTH) 3180 sppp_wq_add(sp->wq_cp, &scp->work_open); 3181 3182 /* Open all NCPs. */ 3183 if (sp->pp_phase == SPPP_PHASE_NETWORK && 3184 ((cps[i])->flags & CP_NCP) != 0) { 3185 sppp_wq_add(sp->wq_cp, &scp->work_open); 3186 } 3187 } 3188 3189 /* notify low-level driver of state change */ 3190 sppp_notify_chg_wlocked(sp); 3191 } 3192 3193 static void 3194 sppp_lcp_tld(struct sppp *sp) 3195 { 3196 struct ifnet *ifp; 3197 struct sppp_cp *scp; 3198 int i, phase; 3199 3200 KASSERT(SPPP_WLOCKED(sp)); 3201 3202 phase = sp->pp_phase; 3203 3204 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3205 3206 if (sp->pp_saved_mtu > 0) { 3207 ifp = &sp->pp_if; 3208 3209 SPPP_UNLOCK(sp); 3210 IFNET_LOCK(ifp); 3211 SPPP_LOCK(sp, RW_WRITER); 3212 3213 SPPP_DLOG(sp, "setting MTU " 3214 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3215 ifp->if_mtu, sp->pp_saved_mtu); 3216 3217 ifp->if_mtu = sp->pp_saved_mtu; 3218 sp->pp_saved_mtu = 0; 3219 IFNET_UNLOCK(ifp); 3220 } 3221 3222 /* 3223 * Take upper layers down. We send the Down event first and 3224 * the Close second to prevent the upper layers from sending 3225 * ``a flurry of terminate-request packets'', as the RFC 3226 * describes it. 3227 */ 3228 for (i = 0; i < IDX_COUNT; i++) { 3229 scp = &sp->scp[(cps[i])->protoidx]; 3230 3231 if (((cps[i])->flags & CP_LCP) == 0) 3232 sppp_wq_add(sp->wq_cp, &scp->work_down); 3233 3234 if ((cps[i])->flags & CP_AUTH) { 3235 sppp_wq_add(sp->wq_cp, &scp->work_close); 3236 } 3237 3238 /* Close all NCPs. */ 3239 if (phase == SPPP_PHASE_NETWORK && 3240 ((cps[i])->flags & CP_NCP) != 0) { 3241 sppp_wq_add(sp->wq_cp, &scp->work_close); 3242 } 3243 } 3244 } 3245 3246 static void 3247 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3248 { 3249 3250 KASSERT(SPPP_WLOCKED(sp)); 3251 3252 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3253 3254 /* Notify lower layer if desired. */ 3255 sppp_notify_tls_wlocked(sp); 3256 sp->lcp.tlf_sent = false; 3257 } 3258 3259 static void 3260 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3261 { 3262 3263 KASSERT(SPPP_WLOCKED(sp)); 3264 3265 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3266 3267 /* Notify lower layer if desired. */ 3268 sppp_notify_tlf_wlocked(sp); 3269 3270 switch (sp->scp[IDX_LCP].state) { 3271 case STATE_CLOSED: 3272 case STATE_STOPPED: 3273 sp->lcp.tlf_sent = true; 3274 break; 3275 case STATE_INITIAL: 3276 default: 3277 /* just in case */ 3278 sp->lcp.tlf_sent = false; 3279 } 3280 } 3281 3282 static void 3283 sppp_lcp_scr(struct sppp *sp) 3284 { 3285 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3286 int i = 0; 3287 u_short authproto; 3288 3289 KASSERT(SPPP_WLOCKED(sp)); 3290 3291 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3292 if (! sp->lcp.magic) 3293 sp->lcp.magic = cprng_fast32(); 3294 opt[i++] = LCP_OPT_MAGIC; 3295 opt[i++] = 6; 3296 opt[i++] = sp->lcp.magic >> 24; 3297 opt[i++] = sp->lcp.magic >> 16; 3298 opt[i++] = sp->lcp.magic >> 8; 3299 opt[i++] = sp->lcp.magic; 3300 } 3301 3302 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3303 opt[i++] = LCP_OPT_MRU; 3304 opt[i++] = 4; 3305 opt[i++] = sp->lcp.mru >> 8; 3306 opt[i++] = sp->lcp.mru; 3307 } 3308 3309 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3310 authproto = sp->hisauth.proto; 3311 opt[i++] = LCP_OPT_AUTH_PROTO; 3312 opt[i++] = authproto == PPP_CHAP? 5: 4; 3313 opt[i++] = authproto >> 8; 3314 opt[i++] = authproto; 3315 if (authproto == PPP_CHAP) 3316 opt[i++] = CHAP_MD5; 3317 } 3318 3319 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3320 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3321 } 3322 3323 /* 3324 * Check the open NCPs, return true if at least one NCP is open. 3325 */ 3326 3327 static int 3328 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3329 { 3330 int i, mask; 3331 3332 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3333 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3334 return 1; 3335 return 0; 3336 } 3337 3338 /* 3339 * Re-check the open NCPs and see if we should terminate the link. 3340 * Called by the NCPs during their tlf action handling. 3341 */ 3342 static void 3343 sppp_lcp_check_and_close(struct sppp *sp) 3344 { 3345 3346 KASSERT(SPPP_WLOCKED(sp)); 3347 3348 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3349 /* don't bother, we are already going down */ 3350 return; 3351 } 3352 3353 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3354 sppp_cp_check(sp, CP_AUTH)) 3355 return; 3356 3357 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3358 sppp_cp_check(sp, CP_NCP)) 3359 return; 3360 3361 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3362 3363 if (sp->pp_max_auth_fail != 0 && 3364 sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3365 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, " 3366 "not retrying again\n", sp->pp_auth_failures); 3367 3368 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 3369 sp->pp_if.if_flags &= ~IFF_RUNNING; 3370 } else { 3371 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3372 } 3373 } 3374 3375 /* 3376 *--------------------------------------------------------------------------* 3377 * * 3378 * The IPCP implementation. * 3379 * * 3380 *--------------------------------------------------------------------------* 3381 */ 3382 3383 static void 3384 sppp_ipcp_init(struct sppp *sp) 3385 { 3386 3387 KASSERT(SPPP_WLOCKED(sp)); 3388 3389 sppp_cp_init(&ipcp, sp); 3390 3391 sp->ipcp.opts = 0; 3392 sp->ipcp.flags = 0; 3393 } 3394 3395 static void 3396 sppp_ipcp_open(struct sppp *sp, void *xcp) 3397 { 3398 uint32_t myaddr, hisaddr; 3399 3400 KASSERT(SPPP_WLOCKED(sp)); 3401 KASSERT(!cpu_softintr_p()); 3402 3403 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3404 return; 3405 3406 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3407 sp->ipcp.req_myaddr = 0; 3408 sp->ipcp.req_hisaddr = 0; 3409 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3410 3411 #ifdef INET 3412 kpreempt_disable(); 3413 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3414 kpreempt_enable(); 3415 #else 3416 myaddr = hisaddr = 0; 3417 #endif 3418 /* 3419 * If we don't have his address, this probably means our 3420 * interface doesn't want to talk IP at all. (This could 3421 * be the case if somebody wants to speak only IPX, for 3422 * example.) Don't open IPCP in this case. 3423 */ 3424 if (hisaddr == 0) { 3425 /* XXX this message should go away */ 3426 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n"); 3427 return; 3428 } 3429 3430 if (myaddr == 0) { 3431 /* 3432 * I don't have an assigned address, so i need to 3433 * negotiate my address. 3434 */ 3435 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3436 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3437 } 3438 if (hisaddr == 1) { 3439 /* 3440 * XXX - remove this hack! 3441 * remote has no valid address, we need to get one assigned. 3442 */ 3443 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3444 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3445 } 3446 3447 if (sp->query_dns & 1) { 3448 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3449 } else { 3450 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3451 } 3452 3453 if (sp->query_dns & 2) { 3454 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3455 } else { 3456 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3457 } 3458 sppp_open_event(sp, xcp); 3459 } 3460 3461 static void 3462 sppp_ipcp_close(struct sppp *sp, void *xcp) 3463 { 3464 3465 KASSERT(SPPP_WLOCKED(sp)); 3466 KASSERT(!cpu_softintr_p()); 3467 3468 sppp_close_event(sp, xcp); 3469 3470 #ifdef INET 3471 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3472 /* 3473 * Some address was dynamic, clear it again. 3474 */ 3475 sppp_clear_ip_addrs(sp); 3476 } 3477 #endif 3478 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3479 } 3480 3481 /* 3482 * Analyze a configure request. Return true if it was agreeable, and 3483 * caused action sca, false if it has been rejected or nak'ed, and 3484 * caused action scn. (The return value is used to make the state 3485 * transition decision in the state automaton.) 3486 */ 3487 static enum cp_rcr_type 3488 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3489 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3490 { 3491 u_char *buf, *r, *p, l, blen; 3492 enum cp_rcr_type type; 3493 int rlen, len; 3494 uint32_t hisaddr, desiredaddr; 3495 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3496 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3497 const char *dq; 3498 bool debug; 3499 3500 KASSERT(SPPP_WLOCKED(sp)); 3501 3502 type = CP_RCR_NONE; 3503 origlen -= sizeof(*h); 3504 3505 if (origlen < 0) 3506 return CP_RCR_DROP; 3507 3508 debug = sppp_debug_enabled(sp); 3509 3510 /* 3511 * Make sure to allocate a buf that can at least hold a 3512 * conf-nak with an `address' option. We might need it below. 3513 */ 3514 blen = MAX(6, origlen); 3515 3516 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3517 if (buf == NULL) 3518 return CP_RCR_DROP; 3519 3520 /* pass 1: see if we can recognize them */ 3521 if (debug) 3522 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:"); 3523 p = (void *)(h + 1); 3524 r = buf; 3525 rlen = 0; 3526 for (len = origlen; len > 1; len -= l, p += l) { 3527 l = p[1]; 3528 if (l == 0) 3529 break; 3530 3531 /* Sanity check option length */ 3532 if (l > len) { 3533 /* XXX should we just RXJ? */ 3534 if (debug) 3535 addlog("\n"); 3536 3537 SPPP_LOG(sp, LOG_DEBUG, 3538 " malicious IPCP option received, dropping\n"); 3539 type = CP_RCR_ERR; 3540 goto end; 3541 } 3542 if (debug) { 3543 addlog(" %s", 3544 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3545 } 3546 switch (p[0]) { 3547 #ifdef notyet 3548 case IPCP_OPT_COMPRESSION: 3549 if (len >= 6 && l >= 6) { 3550 /* correctly formed compress option */ 3551 continue; 3552 } 3553 if (debug) 3554 addlog(" [invalid]"); 3555 break; 3556 #endif 3557 case IPCP_OPT_ADDRESS: 3558 if (len >= 6 && l == 6) { 3559 /* correctly formed address option */ 3560 continue; 3561 } 3562 if (debug) 3563 addlog(" [invalid]"); 3564 break; 3565 default: 3566 /* Others not supported. */ 3567 if (debug) 3568 addlog(" [rej]"); 3569 break; 3570 } 3571 /* Add the option to rejected list. */ 3572 if (rlen + l > blen) { 3573 if (debug) 3574 addlog(" [overflow]"); 3575 continue; 3576 } 3577 memcpy(r, p, l); 3578 r += l; 3579 rlen += l; 3580 } 3581 3582 if (rlen > 0) { 3583 type = CP_RCR_REJ; 3584 goto end; 3585 } 3586 3587 if (debug) 3588 addlog("\n"); 3589 3590 /* pass 2: parse option values */ 3591 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3592 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3593 else 3594 #ifdef INET 3595 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3596 #else 3597 hisaddr = 0; 3598 #endif 3599 if (debug) 3600 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:"); 3601 p = (void *)(h + 1); 3602 r = buf; 3603 rlen = 0; 3604 for (len = origlen; len > 1; len -= l, p += l) { 3605 l = p[1]; 3606 if (l == 0) 3607 break; 3608 3609 if (debug) { 3610 addlog(" %s", 3611 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3612 } 3613 switch (p[0]) { 3614 #ifdef notyet 3615 case IPCP_OPT_COMPRESSION: 3616 continue; 3617 #endif 3618 case IPCP_OPT_ADDRESS: 3619 desiredaddr = p[2] << 24 | p[3] << 16 | 3620 p[4] << 8 | p[5]; 3621 if (desiredaddr == hisaddr || 3622 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3623 /* 3624 * Peer's address is same as our value, 3625 * this is agreeable. Gonna conf-ack 3626 * it. 3627 */ 3628 if (debug) { 3629 dq = sppp_dotted_quad(dqbuf, 3630 sizeof(dqbuf), hisaddr); 3631 addlog(" %s [ack]", dq); 3632 } 3633 /* record that we've seen it already */ 3634 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3635 sp->ipcp.req_hisaddr = desiredaddr; 3636 hisaddr = desiredaddr; 3637 continue; 3638 } 3639 /* 3640 * The address wasn't agreeable. This is either 3641 * he sent us 0.0.0.0, asking to assign him an 3642 * address, or he send us another address not 3643 * matching our value. Either case, we gonna 3644 * conf-nak it with our value. 3645 */ 3646 if (debug) { 3647 if (desiredaddr == 0) { 3648 addlog(" [addr requested]"); 3649 } else { 3650 dq = sppp_dotted_quad(dqbuf, 3651 sizeof(dqbuf), desiredaddr); 3652 addlog(" %s [not agreed]", dq); 3653 } 3654 } 3655 3656 p[2] = hisaddr >> 24; 3657 p[3] = hisaddr >> 16; 3658 p[4] = hisaddr >> 8; 3659 p[5] = hisaddr; 3660 break; 3661 } 3662 if (rlen + l > blen) { 3663 if (debug) 3664 addlog(" [overflow]"); 3665 continue; 3666 } 3667 /* Add the option to nak'ed list. */ 3668 memcpy(r, p, l); 3669 r += l; 3670 rlen += l; 3671 } 3672 3673 if (rlen > 0) { 3674 type = CP_RCR_NAK; 3675 } else { 3676 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3677 /* 3678 * If we are about to conf-ack the request, but haven't seen 3679 * his address so far, gonna conf-nak it instead, with the 3680 * `address' option present and our idea of his address being 3681 * filled in there, to request negotiation of both addresses. 3682 * 3683 * XXX This can result in an endless req - nak loop if peer 3684 * doesn't want to send us his address. Q: What should we do 3685 * about it? XXX A: implement the max-failure counter. 3686 */ 3687 buf[0] = IPCP_OPT_ADDRESS; 3688 buf[1] = 6; 3689 buf[2] = hisaddr >> 24; 3690 buf[3] = hisaddr >> 16; 3691 buf[4] = hisaddr >> 8; 3692 buf[5] = hisaddr; 3693 rlen = 6; 3694 if (debug) 3695 addlog(" still need hisaddr"); 3696 type = CP_RCR_NAK; 3697 } else { 3698 type = CP_RCR_ACK; 3699 rlen = origlen; 3700 memcpy(r, h + 1, rlen); 3701 } 3702 } 3703 3704 end: 3705 if (debug) 3706 addlog("\n"); 3707 3708 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3709 if (buf != NULL) 3710 kmem_intr_free(buf, blen); 3711 } else { 3712 *msgbuf = buf; 3713 *buflen = blen; 3714 *msglen = rlen; 3715 } 3716 3717 return type; 3718 } 3719 3720 /* 3721 * Analyze the IPCP Configure-Reject option list, and adjust our 3722 * negotiation. 3723 */ 3724 static void 3725 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3726 { 3727 u_char *p, l; 3728 bool debug; 3729 3730 KASSERT(SPPP_WLOCKED(sp)); 3731 3732 if (len <= sizeof(*h)) 3733 return; 3734 3735 len -= sizeof(*h); 3736 debug = sppp_debug_enabled(sp); 3737 3738 if (debug) 3739 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:"); 3740 3741 p = (void *)(h + 1); 3742 for (; len > 1; len -= l, p += l) { 3743 l = p[1]; 3744 if (l == 0) 3745 break; 3746 3747 /* Sanity check option length */ 3748 if (l > len) { 3749 /* XXX should we just RXJ? */ 3750 if (debug) 3751 addlog("\n"); 3752 SPPP_LOG(sp, LOG_DEBUG, 3753 "malicious IPCP option received, dropping\n"); 3754 goto end; 3755 } 3756 if (debug) { 3757 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3758 addlog(" %s", 3759 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3760 } 3761 switch (p[0]) { 3762 case IPCP_OPT_ADDRESS: 3763 /* 3764 * Peer doesn't grok address option. This is 3765 * bad. XXX Should we better give up here? 3766 */ 3767 if (!debug) { 3768 SPPP_LOG(sp, LOG_ERR, 3769 "IPCP address option rejected\n"); 3770 } 3771 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3772 break; 3773 #ifdef notyet 3774 case IPCP_OPT_COMPRESS: 3775 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3776 break; 3777 #endif 3778 case IPCP_OPT_PRIMDNS: 3779 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3780 break; 3781 3782 case IPCP_OPT_SECDNS: 3783 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3784 break; 3785 } 3786 } 3787 if (debug) 3788 addlog("\n"); 3789 end: 3790 return; 3791 } 3792 3793 /* 3794 * Analyze the IPCP Configure-NAK option list, and adjust our 3795 * negotiation. 3796 */ 3797 static void 3798 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3799 { 3800 u_char *p, l; 3801 struct ifnet *ifp = &sp->pp_if; 3802 int debug = ifp->if_flags & IFF_DEBUG; 3803 uint32_t wantaddr; 3804 3805 KASSERT(SPPP_WLOCKED(sp)); 3806 3807 len -= sizeof(*h); 3808 3809 debug = sppp_debug_enabled(sp); 3810 3811 if (debug) 3812 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:"); 3813 3814 p = (void *)(h + 1); 3815 for (; len > 1; len -= l, p += l) { 3816 l = p[1]; 3817 if (l == 0) 3818 break; 3819 3820 /* Sanity check option length */ 3821 if (l > len) { 3822 /* XXX should we just RXJ? */ 3823 if (debug) 3824 addlog("\n"); 3825 SPPP_LOG(sp, LOG_DEBUG, 3826 "malicious IPCP option received, dropping\n"); 3827 return; 3828 } 3829 if (debug) { 3830 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3831 addlog(" %s", 3832 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3833 } 3834 switch (*p) { 3835 case IPCP_OPT_ADDRESS: 3836 /* 3837 * Peer doesn't like our local IP address. See 3838 * if we can do something for him. We'll drop 3839 * him our address then. 3840 */ 3841 if (len >= 6 && l == 6) { 3842 wantaddr = p[2] << 24 | p[3] << 16 | 3843 p[4] << 8 | p[5]; 3844 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3845 if (debug) { 3846 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3847 const char *dq; 3848 3849 dq = sppp_dotted_quad(dqbuf, 3850 sizeof(dqbuf), wantaddr); 3851 addlog(" [wantaddr %s]", dq); 3852 } 3853 /* 3854 * When doing dynamic address assignment, 3855 * we accept his offer. Otherwise, we 3856 * ignore it and thus continue to negotiate 3857 * our already existing value. 3858 */ 3859 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3860 if (ntohl(wantaddr) != INADDR_ANY) { 3861 if (debug) 3862 addlog(" [agree]"); 3863 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3864 sp->ipcp.req_myaddr = wantaddr; 3865 } else { 3866 if (debug) 3867 addlog(" [not agreed]"); 3868 } 3869 } 3870 } 3871 break; 3872 3873 case IPCP_OPT_PRIMDNS: 3874 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 3875 len >= 6 && l == 6) { 3876 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3877 p[4] << 8 | p[5]; 3878 } 3879 break; 3880 3881 case IPCP_OPT_SECDNS: 3882 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 3883 len >= 6 && l == 6) { 3884 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3885 p[4] << 8 | p[5]; 3886 } 3887 break; 3888 #ifdef notyet 3889 case IPCP_OPT_COMPRESS: 3890 /* 3891 * Peer wants different compression parameters. 3892 */ 3893 break; 3894 #endif 3895 } 3896 } 3897 if (debug) 3898 addlog("\n"); 3899 } 3900 3901 static void 3902 sppp_ipcp_tlu(struct sppp *sp) 3903 { 3904 #ifdef INET 3905 struct ifnet *ifp; 3906 3907 KASSERT(SPPP_WLOCKED(sp)); 3908 3909 SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n"); 3910 ifp = &sp->pp_if; 3911 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 3912 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 3913 SPPP_LOG(sp, LOG_WARNING, 3914 "no IP address, closing IPCP\n"); 3915 sppp_wq_add(sp->wq_cp, 3916 &sp->scp[IDX_IPCP].work_close); 3917 } else { 3918 /* we are up. Set addresses and notify anyone interested */ 3919 sppp_set_ip_addrs(sp); 3920 rt_ifmsg(ifp); 3921 } 3922 #endif 3923 } 3924 3925 static void 3926 sppp_ipcp_tld(struct sppp *sp) 3927 { 3928 #ifdef INET 3929 struct ifnet *ifp; 3930 3931 KASSERT(SPPP_WLOCKED(sp)); 3932 3933 SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n"); 3934 ifp = &sp->pp_if; 3935 rt_ifmsg(ifp); 3936 #endif 3937 } 3938 3939 static void 3940 sppp_ipcp_scr(struct sppp *sp) 3941 { 3942 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3943 #ifdef INET 3944 uint32_t ouraddr; 3945 #endif 3946 int i = 0; 3947 3948 KASSERT(SPPP_WLOCKED(sp)); 3949 3950 #ifdef notyet 3951 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 3952 opt[i++] = IPCP_OPT_COMPRESSION; 3953 opt[i++] = 6; 3954 opt[i++] = 0; /* VJ header compression */ 3955 opt[i++] = 0x2d; /* VJ header compression */ 3956 opt[i++] = max_slot_id; 3957 opt[i++] = comp_slot_id; 3958 } 3959 #endif 3960 3961 #ifdef INET 3962 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 3963 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 3964 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3965 } else { 3966 kpreempt_disable(); 3967 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3968 kpreempt_enable(); 3969 } 3970 opt[i++] = IPCP_OPT_ADDRESS; 3971 opt[i++] = 6; 3972 opt[i++] = ouraddr >> 24; 3973 opt[i++] = ouraddr >> 16; 3974 opt[i++] = ouraddr >> 8; 3975 opt[i++] = ouraddr; 3976 } 3977 #endif 3978 3979 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 3980 opt[i++] = IPCP_OPT_PRIMDNS; 3981 opt[i++] = 6; 3982 opt[i++] = sp->dns_addrs[0] >> 24; 3983 opt[i++] = sp->dns_addrs[0] >> 16; 3984 opt[i++] = sp->dns_addrs[0] >> 8; 3985 opt[i++] = sp->dns_addrs[0]; 3986 } 3987 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 3988 opt[i++] = IPCP_OPT_SECDNS; 3989 opt[i++] = 6; 3990 opt[i++] = sp->dns_addrs[1] >> 24; 3991 opt[i++] = sp->dns_addrs[1] >> 16; 3992 opt[i++] = sp->dns_addrs[1] >> 8; 3993 opt[i++] = sp->dns_addrs[1]; 3994 } 3995 3996 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 3997 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 3998 } 3999 4000 /* 4001 *--------------------------------------------------------------------------* 4002 * * 4003 * The IPv6CP implementation. * 4004 * * 4005 *--------------------------------------------------------------------------* 4006 */ 4007 4008 #ifdef INET6 4009 static void 4010 sppp_ipv6cp_init(struct sppp *sp) 4011 { 4012 4013 KASSERT(SPPP_WLOCKED(sp)); 4014 4015 sppp_cp_init(&ipv6cp, sp); 4016 4017 sp->ipv6cp.opts = 0; 4018 sp->ipv6cp.flags = 0; 4019 } 4020 4021 static void 4022 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4023 { 4024 struct in6_addr myaddr, hisaddr; 4025 4026 KASSERT(SPPP_WLOCKED(sp)); 4027 KASSERT(!cpu_softintr_p()); 4028 4029 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4030 return; 4031 4032 #ifdef IPV6CP_MYIFID_DYN 4033 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4034 #else 4035 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4036 #endif 4037 4038 kpreempt_disable(); 4039 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4040 kpreempt_enable(); 4041 /* 4042 * If we don't have our address, this probably means our 4043 * interface doesn't want to talk IPv6 at all. (This could 4044 * be the case if somebody wants to speak only IPX, for 4045 * example.) Don't open IPv6CP in this case. 4046 */ 4047 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4048 /* XXX this message should go away */ 4049 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n"); 4050 return; 4051 } 4052 4053 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4054 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4055 sppp_open_event(sp, xcp); 4056 } 4057 4058 /* 4059 * Analyze a configure request. Return true if it was agreeable, and 4060 * caused action sca, false if it has been rejected or nak'ed, and 4061 * caused action scn. (The return value is used to make the state 4062 * transition decision in the state automaton.) 4063 */ 4064 static enum cp_rcr_type 4065 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4066 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4067 { 4068 u_char *buf, *r, *p, l, blen; 4069 int rlen, len; 4070 struct in6_addr myaddr, desiredaddr, suggestaddr; 4071 enum cp_rcr_type type; 4072 int ifidcount; 4073 int collision, nohisaddr; 4074 char ip6buf[INET6_ADDRSTRLEN]; 4075 char tbuf[SPPP_CPTYPE_NAMELEN]; 4076 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4077 const char *cpname; 4078 bool debug; 4079 4080 KASSERT(SPPP_WLOCKED(sp)); 4081 4082 debug = sppp_debug_enabled(sp); 4083 type = CP_RCR_NONE; 4084 origlen -= sizeof(*h); 4085 4086 if (origlen < 0) 4087 return CP_RCR_DROP; 4088 4089 /* 4090 * Make sure to allocate a buf that can at least hold a 4091 * conf-nak with an `address' option. We might need it below. 4092 */ 4093 blen = MAX(6, origlen); 4094 4095 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4096 if (buf == NULL) 4097 return CP_RCR_DROP; 4098 4099 /* pass 1: see if we can recognize them */ 4100 if (debug) 4101 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:"); 4102 p = (void *)(h + 1); 4103 r = buf; 4104 rlen = 0; 4105 ifidcount = 0; 4106 for (len = origlen; len > 1; len -= l, p += l) { 4107 l = p[1]; 4108 if (l == 0) 4109 break; 4110 4111 /* Sanity check option length */ 4112 if (l > len) { 4113 /* XXX just RXJ? */ 4114 if (debug) 4115 addlog("\n"); 4116 SPPP_LOG(sp, LOG_DEBUG, 4117 "received malicious IPCPv6 option, " 4118 "dropping\n"); 4119 type = CP_RCR_ERR; 4120 goto end; 4121 } 4122 if (debug) { 4123 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4124 sizeof(ipv6buf),*p)); 4125 } 4126 switch (p[0]) { 4127 case IPV6CP_OPT_IFID: 4128 if (len >= 10 && l == 10 && ifidcount == 0) { 4129 /* correctly formed address option */ 4130 ifidcount++; 4131 continue; 4132 } 4133 if (debug) 4134 addlog(" [invalid]"); 4135 break; 4136 #ifdef notyet 4137 case IPV6CP_OPT_COMPRESSION: 4138 if (len >= 4 && l >= 4) { 4139 /* correctly formed compress option */ 4140 continue; 4141 } 4142 if (debug) 4143 addlog(" [invalid]"); 4144 break; 4145 #endif 4146 default: 4147 /* Others not supported. */ 4148 if (debug) 4149 addlog(" [rej]"); 4150 break; 4151 } 4152 if (rlen + l > blen) { 4153 if (debug) 4154 addlog(" [overflow]"); 4155 continue; 4156 } 4157 /* Add the option to rejected list. */ 4158 memcpy(r, p, l); 4159 r += l; 4160 rlen += l; 4161 } 4162 4163 if (rlen > 0) { 4164 type = CP_RCR_REJ; 4165 goto end; 4166 } 4167 4168 if (debug) 4169 addlog("\n"); 4170 4171 /* pass 2: parse option values */ 4172 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4173 if (debug) 4174 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:"); 4175 p = (void *)(h + 1); 4176 r = buf; 4177 rlen = 0; 4178 type = CP_RCR_ACK; 4179 for (len = origlen; len > 1; len -= l, p += l) { 4180 l = p[1]; 4181 if (l == 0) 4182 break; 4183 4184 if (debug) { 4185 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4186 sizeof(ipv6buf), *p)); 4187 } 4188 switch (p[0]) { 4189 #ifdef notyet 4190 case IPV6CP_OPT_COMPRESSION: 4191 continue; 4192 #endif 4193 case IPV6CP_OPT_IFID: 4194 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4195 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4196 collision = (memcmp(&desiredaddr.s6_addr[8], 4197 &myaddr.s6_addr[8], 8) == 0); 4198 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4199 4200 desiredaddr.s6_addr16[0] = htons(0xfe80); 4201 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4202 4203 if (!collision && !nohisaddr) { 4204 /* no collision, hisaddr known - Conf-Ack */ 4205 type = CP_RCR_ACK; 4206 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4207 sizeof(sp->ipv6cp.my_ifid)); 4208 memcpy(sp->ipv6cp.his_ifid, 4209 &desiredaddr.s6_addr[8], 4210 sizeof(sp->ipv6cp.my_ifid)); 4211 4212 if (debug) { 4213 cpname = sppp_cp_type_name(tbuf, 4214 sizeof(tbuf), CONF_ACK); 4215 addlog(" %s [%s]", 4216 IN6_PRINT(ip6buf, &desiredaddr), 4217 cpname); 4218 } 4219 continue; 4220 } 4221 4222 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4223 if (collision && nohisaddr) { 4224 /* collision, hisaddr unknown - Conf-Rej */ 4225 type = CP_RCR_REJ; 4226 memset(&p[2], 0, 8); 4227 } else { 4228 /* 4229 * - no collision, hisaddr unknown, or 4230 * - collision, hisaddr known 4231 * Conf-Nak, suggest hisaddr 4232 */ 4233 type = CP_RCR_NAK; 4234 sppp_suggest_ip6_addr(sp, &suggestaddr); 4235 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4236 } 4237 if (debug) { 4238 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4239 4240 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4241 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4242 cpname); 4243 } 4244 break; 4245 } 4246 if (rlen + l > blen) { 4247 if (debug) 4248 addlog(" [overflow]"); 4249 continue; 4250 } 4251 /* Add the option to nak'ed list. */ 4252 memcpy(r, p, l); 4253 r += l; 4254 rlen += l; 4255 } 4256 4257 if (rlen > 0) { 4258 if (type != CP_RCR_ACK) { 4259 if (debug) { 4260 int ctype ; 4261 ctype = type == CP_RCR_REJ ? 4262 CONF_REJ : CONF_NAK; 4263 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4264 addlog(" send %s suggest %s\n", 4265 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4266 } 4267 } 4268 #ifdef notdef 4269 if (type == CP_RCR_ACK) 4270 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4271 #endif 4272 } else { 4273 if (type == CP_RCR_ACK) { 4274 rlen = origlen; 4275 memcpy(r, h + 1, rlen); 4276 } 4277 } 4278 end: 4279 if (debug) 4280 addlog("\n"); 4281 4282 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4283 if (buf != NULL) 4284 kmem_intr_free(buf, blen); 4285 } else { 4286 *msgbuf = buf; 4287 *buflen = blen; 4288 *msglen = rlen; 4289 } 4290 4291 return type; 4292 } 4293 4294 /* 4295 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4296 * negotiation. 4297 */ 4298 static void 4299 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4300 { 4301 u_char *p, l; 4302 bool debug; 4303 4304 KASSERT(SPPP_WLOCKED(sp)); 4305 4306 if (len <= sizeof(*h)) 4307 return; 4308 4309 len -= sizeof(*h); 4310 debug = sppp_debug_enabled(sp); 4311 4312 if (debug) 4313 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:"); 4314 4315 p = (void *)(h + 1); 4316 for (; len > 1; len -= l, p += l) { 4317 l = p[1]; 4318 if (l == 0) 4319 break; 4320 4321 if (l > len) { 4322 /* XXX just RXJ? */ 4323 if (debug) 4324 addlog("\n"); 4325 SPPP_LOG(sp, LOG_DEBUG, 4326 "received malicious IPCPv6 option, " 4327 "dropping\n"); 4328 goto end; 4329 } 4330 if (debug) { 4331 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4332 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4333 sizeof(ipv6buf), *p)); 4334 } 4335 switch (p[0]) { 4336 case IPV6CP_OPT_IFID: 4337 /* 4338 * Peer doesn't grok address option. This is 4339 * bad. XXX Should we better give up here? 4340 */ 4341 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4342 break; 4343 #ifdef notyet 4344 case IPV6CP_OPT_COMPRESS: 4345 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4346 break; 4347 #endif 4348 } 4349 } 4350 if (debug) 4351 addlog("\n"); 4352 end: 4353 return; 4354 } 4355 4356 /* 4357 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4358 * negotiation. 4359 */ 4360 static void 4361 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4362 { 4363 u_char *p, l; 4364 struct in6_addr suggestaddr; 4365 char ip6buf[INET6_ADDRSTRLEN]; 4366 bool debug; 4367 4368 KASSERT(SPPP_WLOCKED(sp)); 4369 4370 if (len <= sizeof(*h)) 4371 return; 4372 4373 len -= sizeof(*h); 4374 debug = sppp_debug_enabled(sp); 4375 4376 if (debug) 4377 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:"); 4378 4379 p = (void *)(h + 1); 4380 for (; len > 1; len -= l, p += l) { 4381 l = p[1]; 4382 if (l == 0) 4383 break; 4384 4385 if (l > len) { 4386 /* XXX just RXJ? */ 4387 if (debug) 4388 addlog("\n"); 4389 SPPP_LOG(sp, LOG_DEBUG, 4390 "received malicious IPCPv6 option, " 4391 "dropping\n"); 4392 goto end; 4393 } 4394 if (debug) { 4395 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4396 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4397 sizeof(ipv6buf), *p)); 4398 } 4399 switch (p[0]) { 4400 case IPV6CP_OPT_IFID: 4401 /* 4402 * Peer doesn't like our local ifid. See 4403 * if we can do something for him. We'll drop 4404 * him our address then. 4405 */ 4406 if (len < 10 || l != 10) 4407 break; 4408 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4409 suggestaddr.s6_addr16[0] = htons(0xfe80); 4410 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4411 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4412 4413 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4414 if (debug) 4415 addlog(" [suggestaddr %s]", 4416 IN6_PRINT(ip6buf, &suggestaddr)); 4417 #ifdef IPV6CP_MYIFID_DYN 4418 /* 4419 * When doing dynamic address assignment, 4420 * we accept his offer. 4421 */ 4422 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4423 struct in6_addr lastsuggest; 4424 /* 4425 * If <suggested myaddr from peer> equals to 4426 * <hisaddr we have suggested last time>, 4427 * we have a collision. generate new random 4428 * ifid. 4429 */ 4430 sppp_suggest_ip6_addr(&lastsuggest); 4431 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4432 lastsuggest)) { 4433 if (debug) 4434 addlog(" [random]"); 4435 sppp_gen_ip6_addr(sp, &suggestaddr); 4436 } 4437 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4438 if (debug) 4439 addlog(" [agree]"); 4440 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4441 } 4442 #else 4443 /* 4444 * Since we do not do dynamic address assignment, 4445 * we ignore it and thus continue to negotiate 4446 * our already existing value. This can possibly 4447 * go into infinite request-reject loop. 4448 * 4449 * This is not likely because we normally use 4450 * ifid based on MAC-address. 4451 * If you have no ethernet card on the node, too bad. 4452 * XXX should we use fail_counter? 4453 */ 4454 #endif 4455 break; 4456 #ifdef notyet 4457 case IPV6CP_OPT_COMPRESS: 4458 /* 4459 * Peer wants different compression parameters. 4460 */ 4461 break; 4462 #endif 4463 } 4464 } 4465 if (debug) 4466 addlog("\n"); 4467 end: 4468 return; 4469 } 4470 4471 static void 4472 sppp_ipv6cp_tlu(struct sppp *sp) 4473 { 4474 struct ifnet *ifp; 4475 4476 KASSERT(SPPP_WLOCKED(sp)); 4477 4478 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n"); 4479 ifp = &sp->pp_if; 4480 /* we are up - notify isdn daemon */ 4481 sppp_notify_con_wlocked(sp); 4482 rt_ifmsg(ifp); 4483 } 4484 4485 static void 4486 sppp_ipv6cp_tld(struct sppp *sp) 4487 { 4488 struct ifnet *ifp; 4489 4490 KASSERT(SPPP_WLOCKED(sp)); 4491 4492 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n"); 4493 ifp = &sp->pp_if; 4494 rt_ifmsg(ifp); 4495 } 4496 4497 static void 4498 sppp_ipv6cp_scr(struct sppp *sp) 4499 { 4500 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4501 struct in6_addr ouraddr; 4502 int i = 0; 4503 4504 KASSERT(SPPP_WLOCKED(sp)); 4505 4506 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4507 kpreempt_disable(); 4508 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4509 kpreempt_enable(); 4510 4511 opt[i++] = IPV6CP_OPT_IFID; 4512 opt[i++] = 10; 4513 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4514 i += 8; 4515 } 4516 4517 #ifdef notyet 4518 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4519 opt[i++] = IPV6CP_OPT_COMPRESSION; 4520 opt[i++] = 4; 4521 opt[i++] = 0; /* TBD */ 4522 opt[i++] = 0; /* TBD */ 4523 /* variable length data may follow */ 4524 } 4525 #endif 4526 4527 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4528 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4529 } 4530 #else /*INET6*/ 4531 static void 4532 sppp_ipv6cp_init(struct sppp *sp) 4533 { 4534 4535 KASSERT(SPPP_WLOCKED(sp)); 4536 } 4537 4538 static void 4539 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4540 { 4541 4542 KASSERT(SPPP_WLOCKED(sp)); 4543 } 4544 4545 static enum cp_rcr_type 4546 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4547 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4548 { 4549 4550 KASSERT(SPPP_WLOCKED(sp)); 4551 return 0; 4552 } 4553 4554 static void 4555 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4556 int len) 4557 { 4558 4559 KASSERT(SPPP_WLOCKED(sp)); 4560 } 4561 4562 static void 4563 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4564 int len) 4565 { 4566 4567 KASSERT(SPPP_WLOCKED(sp)); 4568 } 4569 4570 static void 4571 sppp_ipv6cp_tlu(struct sppp *sp) 4572 { 4573 4574 KASSERT(SPPP_WLOCKED(sp)); 4575 } 4576 4577 static void 4578 sppp_ipv6cp_scr(struct sppp *sp) 4579 { 4580 4581 KASSERT(SPPP_WLOCKED(sp)); 4582 } 4583 #endif /*INET6*/ 4584 4585 /* 4586 *--------------------------------------------------------------------------* 4587 * * 4588 * The CHAP implementation. * 4589 * * 4590 *--------------------------------------------------------------------------* 4591 */ 4592 /* 4593 * The authentication protocols is implemented on the state machine for 4594 * control protocols. And it uses following actions and events. 4595 * 4596 * Actions: 4597 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4598 * - sca: send CHAP_SUCCESS 4599 * - scn: send CHAP_FAILURE and shutdown lcp 4600 * Events: 4601 * - RCR+: receive CHAP_RESPONSE containing correct digest 4602 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4603 * - RCA: receive CHAP_SUCCESS 4604 * - RCN: (this event is unused) 4605 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4606 * - TO-: this layer finish 4607 */ 4608 4609 /* 4610 * Handle incoming CHAP packets. 4611 */ 4612 void 4613 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4614 { 4615 struct ifnet *ifp; 4616 struct lcp_header *h; 4617 int len, x; 4618 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4619 int value_len, name_len; 4620 MD5_CTX ctx; 4621 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4622 const char *authname; 4623 bool debug; 4624 4625 ifp = &sp->pp_if; 4626 debug = sppp_debug_enabled(sp); 4627 len = m->m_pkthdr.len; 4628 if (len < 4) { 4629 SPPP_DLOG(sp, "chap invalid packet length: " 4630 "%d bytes\n", len); 4631 return; 4632 } 4633 h = mtod(m, struct lcp_header *); 4634 if (len > ntohs(h->len)) 4635 len = ntohs(h->len); 4636 4637 SPPP_LOCK(sp, RW_WRITER); 4638 4639 switch (h->type) { 4640 /* challenge, failure and success are his authproto */ 4641 case CHAP_CHALLENGE: 4642 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4643 /* can't do anything useful */ 4644 sp->pp_auth_failures++; 4645 SPPP_DLOG(sp, "chap input " 4646 "without my name and my secret being set\n"); 4647 break; 4648 } 4649 value = 1 + (u_char *)(h + 1); 4650 value_len = value[-1]; 4651 name = value + value_len; 4652 name_len = len - value_len - 5; 4653 if (name_len < 0) { 4654 if (debug) { 4655 authname = sppp_auth_type_name(abuf, 4656 sizeof(abuf), PPP_CHAP, h->type); 4657 SPPP_LOG(sp, LOG_DEBUG, 4658 "chap corrupted challenge " 4659 "<%s id=0x%x len=%d", 4660 authname, h->ident, ntohs(h->len)); 4661 if (len > 4) 4662 sppp_print_bytes((u_char *)(h + 1), 4663 len - 4); 4664 addlog(">\n"); 4665 } 4666 break; 4667 } 4668 4669 if (debug) { 4670 authname = sppp_auth_type_name(abuf, 4671 sizeof(abuf), PPP_CHAP, h->type); 4672 SPPP_LOG(sp, LOG_DEBUG, 4673 "chap input <%s id=0x%x len=%d name=", 4674 authname, h->ident, ntohs(h->len)); 4675 sppp_print_string((char *) name, name_len); 4676 addlog(" value-size=%d value=", value_len); 4677 sppp_print_bytes(value, value_len); 4678 addlog(">\n"); 4679 } 4680 4681 /* Compute reply value. */ 4682 MD5Init(&ctx); 4683 MD5Update(&ctx, &h->ident, 1); 4684 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4685 MD5Update(&ctx, value, value_len); 4686 MD5Final(sp->chap.digest, &ctx); 4687 sp->chap.digest_len = sizeof(sp->chap.digest); 4688 sp->scp[IDX_CHAP].rconfid = h->ident; 4689 4690 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4691 break; 4692 4693 case CHAP_SUCCESS: 4694 if (debug) { 4695 SPPP_LOG(sp, LOG_DEBUG, "chap success"); 4696 if (len > 4) { 4697 addlog(": "); 4698 sppp_print_string((char *)(h + 1), len - 4); 4699 } 4700 addlog("\n"); 4701 } 4702 4703 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4704 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4705 chap.name, h->ident, 4706 sp->scp[IDX_CHAP].rconfid); 4707 if_statinc(ifp, if_ierrors); 4708 break; 4709 } 4710 4711 if (sp->chap.digest_len == 0) { 4712 SPPP_DLOG(sp, "receive CHAP success" 4713 " without challenge\n"); 4714 if_statinc(ifp, if_ierrors); 4715 break; 4716 } 4717 4718 x = splnet(); 4719 sp->pp_auth_failures = 0; 4720 sp->pp_flags &= ~PP_NEEDAUTH; 4721 splx(x); 4722 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4723 sp->chap.digest_len = 0; 4724 4725 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4726 /* 4727 * we are not authenticator for CHAP, 4728 * generate a dummy RCR+ event without CHAP_RESPONSE 4729 */ 4730 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4731 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4732 } 4733 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4734 break; 4735 4736 case CHAP_FAILURE: 4737 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4738 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4739 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid); 4740 if_statinc(ifp, if_ierrors); 4741 break; 4742 } 4743 4744 if (sp->chap.digest_len == 0) { 4745 SPPP_DLOG(sp, "receive CHAP failure " 4746 "without challenge\n"); 4747 if_statinc(ifp, if_ierrors); 4748 break; 4749 } 4750 4751 x = splnet(); 4752 sp->pp_auth_failures++; 4753 splx(x); 4754 SPPP_LOG(sp, LOG_INFO, "chap failure"); 4755 if (debug) { 4756 if (len > 4) { 4757 addlog(": "); 4758 sppp_print_string((char *)(h + 1), len - 4); 4759 } 4760 } 4761 addlog("\n"); 4762 4763 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4764 sp->chap.digest_len = 0; 4765 /* 4766 * await LCP shutdown by authenticator, 4767 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4768 */ 4769 break; 4770 4771 /* response is my authproto */ 4772 case CHAP_RESPONSE: 4773 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4774 /* can't do anything useful */ 4775 SPPP_DLOG(sp, "chap response " 4776 "without his name and his secret being set\n"); 4777 break; 4778 } 4779 value = 1 + (u_char *)(h + 1); 4780 value_len = value[-1]; 4781 name = value + value_len; 4782 name_len = len - value_len - 5; 4783 if (name_len < 0) { 4784 if (debug) { 4785 authname = sppp_auth_type_name(abuf, 4786 sizeof(abuf), PPP_CHAP, h->type); 4787 SPPP_LOG(sp, LOG_DEBUG, 4788 "chap corrupted response " 4789 "<%s id=0x%x len=%d", 4790 authname, h->ident, ntohs(h->len)); 4791 if (len > 4) 4792 sppp_print_bytes((u_char *)(h + 1), 4793 len - 4); 4794 addlog(">\n"); 4795 } 4796 break; 4797 } 4798 if (h->ident != sp->scp[IDX_CHAP].confid) { 4799 SPPP_DLOG(sp, "chap dropping response for old ID " 4800 "(got %d, expected %d)\n", 4801 h->ident, sp->scp[IDX_CHAP].confid); 4802 break; 4803 } else { 4804 sp->scp[IDX_CHAP].rconfid = h->ident; 4805 } 4806 4807 if (sp->hisauth.name != NULL && 4808 (name_len != sp->hisauth.name_len 4809 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4810 SPPP_LOG(sp, LOG_INFO, 4811 "chap response, his name "); 4812 sppp_print_string(name, name_len); 4813 addlog(" != expected "); 4814 sppp_print_string(sp->hisauth.name, 4815 sp->hisauth.name_len); 4816 addlog("\n"); 4817 4818 /* generate RCR- event */ 4819 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4820 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4821 break; 4822 } 4823 4824 if (debug) { 4825 authname = sppp_auth_type_name(abuf, 4826 sizeof(abuf), PPP_CHAP, h->type); 4827 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) " 4828 "<%s id=0x%x len=%d name=", 4829 sppp_state_name(sp->scp[IDX_CHAP].state), 4830 authname, h->ident, ntohs(h->len)); 4831 sppp_print_string((char *)name, name_len); 4832 addlog(" value-size=%d value=", value_len); 4833 sppp_print_bytes(value, value_len); 4834 addlog(">\n"); 4835 } 4836 4837 if (value_len == sizeof(sp->chap.challenge) && 4838 value_len == sizeof(sp->chap.digest)) { 4839 MD5Init(&ctx); 4840 MD5Update(&ctx, &h->ident, 1); 4841 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4842 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4843 MD5Final(digest, &ctx); 4844 4845 if (memcmp(digest, value, value_len) == 0) { 4846 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4847 } else { 4848 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4849 } 4850 } else { 4851 if (debug) { 4852 SPPP_LOG(sp, LOG_DEBUG, 4853 "chap bad hash value length: " 4854 "%d bytes, should be %zu\n", 4855 value_len, sizeof(sp->chap.challenge)); 4856 } 4857 4858 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4859 } 4860 4861 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4862 4863 /* generate a dummy RCA event */ 4864 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4865 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4866 sp->chap.rechallenging)) { 4867 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4868 } 4869 break; 4870 4871 default: 4872 /* Unknown CHAP packet type -- ignore. */ 4873 if (debug) { 4874 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) " 4875 "<0x%x id=0x%xh len=%d", 4876 sppp_state_name(sp->scp[IDX_CHAP].state), 4877 h->type, h->ident, ntohs(h->len)); 4878 if (len > 4) 4879 sppp_print_bytes((u_char *)(h + 1), len - 4); 4880 addlog(">\n"); 4881 } 4882 break; 4883 4884 } 4885 4886 SPPP_UNLOCK(sp); 4887 } 4888 4889 static void 4890 sppp_chap_init(struct sppp *sp) 4891 { 4892 4893 KASSERT(SPPP_WLOCKED(sp)); 4894 4895 sppp_cp_init(&chap, sp); 4896 4897 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4898 sppp_chap_rcv_challenge_event, &chap); 4899 } 4900 4901 static void 4902 sppp_chap_open(struct sppp *sp, void *xcp) 4903 { 4904 4905 KASSERT(SPPP_WLOCKED(sp)); 4906 4907 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4908 sp->chap.digest_len = 0; 4909 sp->chap.rechallenging = false; 4910 sp->chap.response_rcvd = false; 4911 sppp_open_event(sp, xcp); 4912 } 4913 4914 static void 4915 sppp_chap_tlu(struct sppp *sp) 4916 { 4917 int i, x; 4918 4919 KASSERT(SPPP_WLOCKED(sp)); 4920 4921 i = 0; 4922 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4923 x = splnet(); 4924 sp->pp_auth_failures = 0; 4925 splx(x); 4926 4927 SPPP_LOG(sp, LOG_DEBUG, "chap %s", 4928 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4929 4930 /* 4931 * Some broken CHAP implementations (Conware CoNet, firmware 4932 * 4.0.?) don't want to re-authenticate their CHAP once the 4933 * initial challenge-response exchange has taken place. 4934 * Provide for an option to avoid rechallenges. 4935 */ 4936 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4937 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4938 /* 4939 * Compute the re-challenge timeout. This will yield 4940 * a number between 300 and 810 seconds. 4941 */ 4942 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4943 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4944 4945 if (sppp_debug_enabled(sp)) { 4946 addlog(", next rechallenge in %d seconds", i); 4947 } 4948 } 4949 4950 addlog("\n"); 4951 4952 /* 4953 * If we are already in phase network, we are done here. This 4954 * is the case if this is a dummy tlu event after a re-challenge. 4955 */ 4956 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4957 sppp_phase_network(sp); 4958 } 4959 4960 static void 4961 sppp_chap_scr(struct sppp *sp) 4962 { 4963 uint32_t *ch; 4964 u_char clen, dsize; 4965 int role; 4966 4967 KASSERT(SPPP_WLOCKED(sp)); 4968 4969 role = sppp_auth_role(&chap, sp); 4970 4971 if (ISSET(role, SPPP_AUTH_SERV) && 4972 !sp->chap.response_rcvd) { 4973 /* we are authenticator for CHAP, send challenge */ 4974 ch = (uint32_t *)sp->chap.challenge; 4975 clen = sizeof(sp->chap.challenge); 4976 /* Compute random challenge. */ 4977 cprng_strong(kern_cprng, ch, clen, 0); 4978 4979 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4980 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4981 sizeof(clen), (const char *)&clen, 4982 sizeof(sp->chap.challenge), sp->chap.challenge, 4983 0); 4984 } 4985 4986 if (ISSET(role, SPPP_AUTH_PEER) && 4987 sp->chap.digest_len > 0) { 4988 /* we are peer for CHAP, send response */ 4989 dsize = sp->chap.digest_len; 4990 4991 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 4992 sizeof(dsize), (const char *)&dsize, 4993 sp->chap.digest_len, sp->chap.digest, 4994 sp->myauth.name_len, sp->myauth.name, 0); 4995 } 4996 } 4997 4998 static void 4999 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5000 { 5001 const struct cp *cp = xcp; 5002 5003 KASSERT(!cpu_softintr_p()); 5004 5005 sp->chap.rechallenging = false; 5006 5007 switch (sp->scp[IDX_CHAP].state) { 5008 case STATE_REQ_SENT: 5009 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5010 cp->scr(sp); 5011 break; 5012 case STATE_OPENED: 5013 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5014 cp->scr(sp); 5015 break; 5016 } 5017 } 5018 5019 /* 5020 *--------------------------------------------------------------------------* 5021 * * 5022 * The PAP implementation. * 5023 * * 5024 *--------------------------------------------------------------------------* 5025 */ 5026 /* 5027 * PAP uses following actions and events. 5028 * Actions: 5029 * - scr: send PAP_REQ 5030 * - sca: send PAP_ACK 5031 * - scn: send PAP_NAK 5032 * Events: 5033 * - RCR+: receive PAP_REQ containing correct username and password 5034 * - RCR-: receive PAP_REQ containing wrong username and password 5035 * - RCA: receive PAP_ACK 5036 * - RCN: (this event is unused) 5037 * - TO+: re-send PAP_REQ 5038 * - TO-: this layer finish 5039 */ 5040 5041 /* 5042 * Handle incoming PAP packets. */ 5043 static void 5044 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5045 { 5046 struct ifnet *ifp; 5047 struct lcp_header *h; 5048 int len, x; 5049 char *name, *secret; 5050 int name_len, secret_len; 5051 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5052 const char *authname; 5053 bool debug; 5054 5055 ifp = &sp->pp_if; 5056 debug = sppp_debug_enabled(sp); 5057 5058 /* 5059 * Malicious input might leave this uninitialized, so 5060 * init to an impossible value. 5061 */ 5062 secret_len = -1; 5063 5064 len = m->m_pkthdr.len; 5065 if (len < 5) { 5066 SPPP_DLOG(sp, "pap invalid packet length: " 5067 "%d bytes\n", len); 5068 return; 5069 } 5070 h = mtod(m, struct lcp_header *); 5071 if (len > ntohs(h->len)) 5072 len = ntohs(h->len); 5073 5074 SPPP_LOCK(sp, RW_WRITER); 5075 5076 switch (h->type) { 5077 /* PAP request is my authproto */ 5078 case PAP_REQ: 5079 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5080 /* can't do anything useful */ 5081 SPPP_DLOG(sp, "pap request" 5082 " without his name and his secret being set\n"); 5083 break; 5084 } 5085 name = 1 + (u_char *)(h + 1); 5086 name_len = name[-1]; 5087 secret = name + name_len + 1; 5088 if (name_len > len - 6 || 5089 (secret_len = secret[-1]) > len - 6 - name_len) { 5090 if (debug) { 5091 authname = sppp_auth_type_name(abuf, 5092 sizeof(abuf), PPP_PAP, h->type); 5093 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5094 "<%s id=0x%x len=%d", 5095 authname, h->ident, ntohs(h->len)); 5096 if (len > 4) 5097 sppp_print_bytes((u_char *)(h + 1), 5098 len - 4); 5099 addlog(">\n"); 5100 } 5101 break; 5102 } 5103 if (debug) { 5104 authname = sppp_auth_type_name(abuf, 5105 sizeof(abuf), PPP_PAP, h->type); 5106 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) " 5107 "<%s id=0x%x len=%d name=", 5108 sppp_state_name(sp->scp[IDX_PAP].state), 5109 authname, h->ident, ntohs(h->len)); 5110 sppp_print_string((char *)name, name_len); 5111 addlog(" secret="); 5112 sppp_print_string((char *)secret, secret_len); 5113 addlog(">\n"); 5114 } 5115 5116 sp->scp[IDX_PAP].rconfid = h->ident; 5117 5118 if (name_len == sp->hisauth.name_len && 5119 memcmp(name, sp->hisauth.name, name_len) == 0 && 5120 secret_len == sp->hisauth.secret_len && 5121 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5122 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5123 } else { 5124 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5125 } 5126 5127 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5128 5129 /* generate a dummy RCA event */ 5130 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5131 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5132 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5133 } 5134 break; 5135 5136 /* ack and nak are his authproto */ 5137 case PAP_ACK: 5138 if (debug) { 5139 SPPP_LOG(sp, LOG_DEBUG, "pap success"); 5140 name = 1 + (u_char *)(h + 1); 5141 name_len = name[-1]; 5142 if (len > 5 && name_len < len+4) { 5143 addlog(": "); 5144 sppp_print_string(name, name_len); 5145 } 5146 addlog("\n"); 5147 } 5148 5149 if (h->ident != sp->scp[IDX_PAP].confid) { 5150 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5151 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5152 if_statinc(ifp, if_ierrors); 5153 break; 5154 } 5155 5156 x = splnet(); 5157 sp->pp_auth_failures = 0; 5158 sp->pp_flags &= ~PP_NEEDAUTH; 5159 splx(x); 5160 5161 /* we are not authenticator, generate a dummy RCR+ event */ 5162 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5163 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5164 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5165 } 5166 5167 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5168 break; 5169 5170 case PAP_NAK: 5171 if (debug) { 5172 SPPP_LOG(sp, LOG_INFO, "pap failure"); 5173 name = 1 + (u_char *)(h + 1); 5174 name_len = name[-1]; 5175 if (len > 5 && name_len < len+4) { 5176 addlog(": "); 5177 sppp_print_string(name, name_len); 5178 } 5179 addlog("\n"); 5180 } else { 5181 SPPP_LOG(sp, LOG_INFO, "pap failure\n"); 5182 } 5183 5184 if (h->ident != sp->scp[IDX_PAP].confid) { 5185 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5186 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5187 if_statinc(ifp, if_ierrors); 5188 break; 5189 } 5190 5191 sp->pp_auth_failures++; 5192 /* 5193 * await LCP shutdown by authenticator, 5194 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5195 */ 5196 break; 5197 5198 default: 5199 /* Unknown PAP packet type -- ignore. */ 5200 if (debug) { 5201 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5202 "<0x%x id=0x%x len=%d", 5203 h->type, h->ident, ntohs(h->len)); 5204 if (len > 4) 5205 sppp_print_bytes((u_char *)(h + 1), len - 4); 5206 addlog(">\n"); 5207 } 5208 break; 5209 } 5210 5211 SPPP_UNLOCK(sp); 5212 } 5213 5214 static void 5215 sppp_pap_init(struct sppp *sp) 5216 { 5217 5218 KASSERT(SPPP_WLOCKED(sp)); 5219 sppp_cp_init(&pap, sp); 5220 } 5221 5222 static void 5223 sppp_pap_tlu(struct sppp *sp) 5224 { 5225 int x; 5226 5227 SPPP_DLOG(sp, "%s tlu\n", pap.name); 5228 5229 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5230 x = splnet(); 5231 sp->pp_auth_failures = 0; 5232 splx(x); 5233 5234 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5235 sppp_phase_network(sp); 5236 } 5237 5238 static void 5239 sppp_pap_scr(struct sppp *sp) 5240 { 5241 u_char idlen, pwdlen; 5242 5243 KASSERT(SPPP_WLOCKED(sp)); 5244 5245 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5246 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5247 if (sp->myauth.secret == NULL || 5248 sp->myauth.name == NULL) { 5249 SPPP_LOG(sp, LOG_DEBUG, 5250 "couldn't send PAP_REQ " 5251 "because of no name or no secret\n"); 5252 } else { 5253 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5254 pwdlen = sp->myauth.secret_len; 5255 idlen = sp->myauth.name_len; 5256 5257 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5258 sizeof idlen, (const char *)&idlen, 5259 idlen, sp->myauth.name, 5260 sizeof pwdlen, (const char *)&pwdlen, 5261 pwdlen, sp->myauth.secret, 5262 0); 5263 } 5264 } 5265 } 5266 5267 /* 5268 * Random miscellaneous functions. 5269 */ 5270 5271 /* 5272 * Send a PAP or CHAP proto packet. 5273 * 5274 * Varadic function, each of the elements for the ellipsis is of type 5275 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5276 * mlen == 0. 5277 * NOTE: never declare variadic functions with types subject to type 5278 * promotion (i.e. u_char). This is asking for big trouble depending 5279 * on the architecture you are on... 5280 */ 5281 5282 static void 5283 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5284 unsigned int type, unsigned int id, 5285 ...) 5286 { 5287 struct ifnet *ifp; 5288 struct lcp_header *lh; 5289 struct mbuf *m; 5290 u_char *p; 5291 int len; 5292 size_t pkthdrlen; 5293 unsigned int mlen; 5294 const char *msg; 5295 va_list ap; 5296 5297 KASSERT(SPPP_WLOCKED(sp)); 5298 5299 ifp = &sp->pp_if; 5300 5301 MGETHDR(m, M_DONTWAIT, MT_DATA); 5302 if (! m) 5303 return; 5304 m_reset_rcvif(m); 5305 5306 if (sp->pp_flags & PP_NOFRAMING) { 5307 *mtod(m, uint16_t *) = htons(cp->proto); 5308 pkthdrlen = 2; 5309 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5310 } else { 5311 struct ppp_header *h; 5312 h = mtod(m, struct ppp_header *); 5313 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5314 h->control = PPP_UI; /* Unnumbered Info */ 5315 h->protocol = htons(cp->proto); 5316 pkthdrlen = PPP_HEADER_LEN; 5317 5318 lh = (struct lcp_header *)(h + 1); 5319 } 5320 5321 lh->type = type; 5322 lh->ident = id; 5323 p = (u_char *)(lh + 1); 5324 5325 va_start(ap, id); 5326 len = 0; 5327 5328 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5329 msg = va_arg(ap, const char *); 5330 len += mlen; 5331 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5332 va_end(ap); 5333 m_freem(m); 5334 return; 5335 } 5336 5337 memcpy(p, msg, mlen); 5338 p += mlen; 5339 } 5340 va_end(ap); 5341 5342 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5343 lh->len = htons(LCP_HEADER_LEN + len); 5344 5345 if (sppp_debug_enabled(sp)) { 5346 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5347 const char *authname; 5348 5349 authname = sppp_auth_type_name(abuf, 5350 sizeof(abuf), cp->proto, lh->type); 5351 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 5352 cp->name, authname, 5353 lh->ident, ntohs(lh->len)); 5354 if (len) 5355 sppp_print_bytes((u_char *)(lh + 1), len); 5356 addlog(">\n"); 5357 } 5358 if (IF_QFULL(&sp->pp_cpq)) { 5359 IF_DROP(&sp->pp_fastq); 5360 IF_DROP(&ifp->if_snd); 5361 m_freem(m); 5362 if_statinc(ifp, if_oerrors); 5363 return; 5364 } 5365 5366 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5367 IF_ENQUEUE(&sp->pp_cpq, m); 5368 5369 if (! (ifp->if_flags & IFF_OACTIVE)) { 5370 SPPP_UNLOCK(sp); 5371 if_start_lock(ifp); 5372 SPPP_LOCK(sp, RW_WRITER); 5373 } 5374 } 5375 5376 static int 5377 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5378 { 5379 int role; 5380 5381 role = SPPP_AUTH_NOROLE; 5382 5383 if (sp->hisauth.proto == cp->proto && 5384 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5385 SET(role, SPPP_AUTH_SERV); 5386 5387 if (sp->myauth.proto == cp->proto) 5388 SET(role, SPPP_AUTH_PEER); 5389 5390 return role; 5391 } 5392 5393 static void 5394 sppp_auth_to_event(struct sppp *sp, void *xcp) 5395 { 5396 const struct cp *cp = xcp; 5397 bool override; 5398 int state; 5399 5400 KASSERT(SPPP_WLOCKED(sp)); 5401 KASSERT(!cpu_softintr_p()); 5402 5403 override = false; 5404 state = sp->scp[cp->protoidx].state; 5405 5406 if (sp->scp[cp->protoidx].rst_counter > 0) { 5407 /* override TO+ event */ 5408 switch (state) { 5409 case STATE_OPENED: 5410 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5411 override = true; 5412 sp->chap.rechallenging = true; 5413 sp->chap.response_rcvd = false; 5414 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5415 cp->scr(sp); 5416 } 5417 break; 5418 5419 case STATE_ACK_RCVD: 5420 override = true; 5421 cp->scr(sp); 5422 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5423 break; 5424 } 5425 } 5426 5427 if (override) { 5428 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", 5429 cp->name, sppp_state_name(state), 5430 sp->scp[cp->protoidx].rst_counter); 5431 sp->scp[cp->protoidx].rst_counter--; 5432 } else { 5433 sppp_to_event(sp, xcp); 5434 } 5435 } 5436 5437 static void 5438 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5439 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5440 { 5441 static const char *succmsg = "Welcome!"; 5442 static const char *failmsg = "Failed..."; 5443 const char *msg; 5444 u_char type, mlen; 5445 5446 KASSERT(SPPP_WLOCKED(sp)); 5447 5448 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5449 return; 5450 5451 if (ctype == CONF_ACK) { 5452 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5453 msg = succmsg; 5454 mlen = sizeof(succmsg) - 1; 5455 5456 sp->pp_auth_failures = 0; 5457 } else { 5458 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5459 msg = failmsg; 5460 mlen = sizeof(failmsg) - 1; 5461 5462 /* shutdown LCP if auth failed */ 5463 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5464 sp->pp_auth_failures++; 5465 } 5466 5467 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5468 } 5469 5470 /* 5471 * Send keepalive packets, every 10 seconds. 5472 */ 5473 static void 5474 sppp_keepalive(void *dummy) 5475 { 5476 struct sppp *sp; 5477 int s; 5478 time_t now; 5479 5480 SPPPQ_LOCK(); 5481 5482 s = splnet(); 5483 now = time_uptime; 5484 for (sp=spppq; sp; sp=sp->pp_next) { 5485 struct ifnet *ifp = NULL; 5486 5487 SPPP_LOCK(sp, RW_WRITER); 5488 ifp = &sp->pp_if; 5489 5490 /* check idle timeout */ 5491 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5492 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5493 /* idle timeout is enabled for this interface */ 5494 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5495 SPPP_DLOG(sp, "no activity for %lu seconds\n", 5496 (unsigned long)(now-sp->pp_last_activity)); 5497 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5498 SPPP_UNLOCK(sp); 5499 continue; 5500 } 5501 } 5502 5503 /* Keepalive mode disabled or channel down? */ 5504 if (! (sp->pp_flags & PP_KEEPALIVE) || 5505 ! (ifp->if_flags & IFF_RUNNING)) { 5506 SPPP_UNLOCK(sp); 5507 continue; 5508 } 5509 5510 /* No keepalive in PPP mode if LCP not opened yet. */ 5511 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5512 SPPP_UNLOCK(sp); 5513 continue; 5514 } 5515 5516 /* No echo reply, but maybe user data passed through? */ 5517 if (sp->pp_max_noreceive != 0 && 5518 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5519 sp->pp_alivecnt = 0; 5520 SPPP_UNLOCK(sp); 5521 continue; 5522 } 5523 5524 /* No echo request */ 5525 if (sp->pp_alive_interval == 0) { 5526 SPPP_UNLOCK(sp); 5527 continue; 5528 } 5529 5530 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5531 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5532 SPPP_UNLOCK(sp); 5533 continue; 5534 } 5535 5536 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5537 /* No keepalive packets got. Stop the interface. */ 5538 if (sp->pp_flags & PP_KEEPALIVE_IFDOWN) 5539 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5540 5541 SPPP_LOG(sp, LOG_INFO,"LCP keepalive timed out, " 5542 "going to restart the connection\n"); 5543 sp->pp_alivecnt = 0; 5544 5545 /* we are down, close all open protocols */ 5546 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5547 5548 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5549 sp->lcp.reestablish = true; 5550 5551 SPPP_UNLOCK(sp); 5552 continue; 5553 } 5554 if (sp->pp_alivecnt < sp->pp_maxalive) 5555 ++sp->pp_alivecnt; 5556 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5557 int32_t nmagic = htonl(sp->lcp.magic); 5558 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5559 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5560 sp->lcp.echoid, 4, &nmagic); 5561 } 5562 5563 SPPP_UNLOCK(sp); 5564 } 5565 splx(s); 5566 sppp_keepalive_cnt++; 5567 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5568 5569 SPPPQ_UNLOCK(); 5570 } 5571 5572 #ifdef INET 5573 /* 5574 * Get both IP addresses. 5575 */ 5576 static void 5577 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5578 { 5579 struct ifnet *ifp = &sp->pp_if; 5580 struct ifaddr *ifa; 5581 struct sockaddr_in *si, *sm; 5582 uint32_t ssrc, ddst; 5583 int s; 5584 struct psref psref; 5585 5586 sm = NULL; 5587 ssrc = ddst = 0; 5588 /* 5589 * Pick the first AF_INET address from the list, 5590 * aliases don't make any sense on a p2p link anyway. 5591 */ 5592 si = 0; 5593 s = pserialize_read_enter(); 5594 IFADDR_READER_FOREACH(ifa, ifp) { 5595 if (ifa->ifa_addr->sa_family == AF_INET) { 5596 si = (struct sockaddr_in *)ifa->ifa_addr; 5597 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5598 if (si) { 5599 ifa_acquire(ifa, &psref); 5600 break; 5601 } 5602 } 5603 } 5604 pserialize_read_exit(s); 5605 if (ifa) { 5606 if (si && si->sin_addr.s_addr) { 5607 ssrc = si->sin_addr.s_addr; 5608 if (srcmask) 5609 *srcmask = ntohl(sm->sin_addr.s_addr); 5610 } 5611 5612 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5613 if (si && si->sin_addr.s_addr) 5614 ddst = si->sin_addr.s_addr; 5615 ifa_release(ifa, &psref); 5616 } 5617 5618 if (dst) *dst = ntohl(ddst); 5619 if (src) *src = ntohl(ssrc); 5620 } 5621 5622 /* 5623 * Set IP addresses. Must be called at splnet. 5624 * If an address is 0, leave it the way it is. 5625 */ 5626 static void 5627 sppp_set_ip_addrs(struct sppp *sp) 5628 { 5629 struct ifnet *ifp; 5630 struct ifaddr *ifa; 5631 struct sockaddr_in *si, *dest; 5632 uint32_t myaddr = 0, hisaddr = 0; 5633 int s; 5634 5635 KASSERT(SPPP_WLOCKED(sp)); 5636 5637 ifp = &sp->pp_if; 5638 5639 SPPP_UNLOCK(sp); 5640 IFNET_LOCK(ifp); 5641 SPPP_LOCK(sp, RW_WRITER); 5642 5643 /* 5644 * Pick the first AF_INET address from the list, 5645 * aliases don't make any sense on a p2p link anyway. 5646 */ 5647 si = dest = NULL; 5648 s = pserialize_read_enter(); 5649 IFADDR_READER_FOREACH(ifa, ifp) { 5650 if (ifa->ifa_addr->sa_family == AF_INET) { 5651 si = (struct sockaddr_in *)ifa->ifa_addr; 5652 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5653 break; 5654 } 5655 } 5656 pserialize_read_exit(s); 5657 5658 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5659 myaddr = sp->ipcp.req_myaddr; 5660 else if (si != NULL) 5661 myaddr = ntohl(si->sin_addr.s_addr); 5662 5663 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5664 hisaddr = sp->ipcp.req_hisaddr; 5665 else if (dest != NULL) 5666 hisaddr = ntohl(dest->sin_addr.s_addr); 5667 5668 if (si != NULL && dest != NULL) { 5669 int error; 5670 struct sockaddr_in new_sin = *si; 5671 struct sockaddr_in new_dst = *dest; 5672 5673 if (myaddr != 0) 5674 new_sin.sin_addr.s_addr = htonl(myaddr); 5675 if (hisaddr != 0) { 5676 new_dst.sin_addr.s_addr = htonl(hisaddr); 5677 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5678 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5679 } 5680 5681 in_addrhash_remove(ifatoia(ifa)); 5682 5683 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5684 5685 in_addrhash_insert(ifatoia(ifa)); 5686 5687 if (error) { 5688 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5689 __func__, error); 5690 } else { 5691 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5692 } 5693 } 5694 5695 IFNET_UNLOCK(ifp); 5696 5697 sppp_notify_con(sp); 5698 } 5699 5700 /* 5701 * Clear IP addresses. Must be called at splnet. 5702 */ 5703 static void 5704 sppp_clear_ip_addrs(struct sppp *sp) 5705 { 5706 struct ifnet *ifp; 5707 struct ifaddr *ifa; 5708 struct sockaddr_in *si, *dest; 5709 int s; 5710 5711 KASSERT(SPPP_WLOCKED(sp)); 5712 5713 ifp = &sp->pp_if; 5714 5715 SPPP_UNLOCK(sp); 5716 IFNET_LOCK(ifp); 5717 SPPP_LOCK(sp, RW_WRITER); 5718 5719 /* 5720 * Pick the first AF_INET address from the list, 5721 * aliases don't make any sense on a p2p link anyway. 5722 */ 5723 si = dest = NULL; 5724 s = pserialize_read_enter(); 5725 IFADDR_READER_FOREACH(ifa, ifp) { 5726 if (ifa->ifa_addr->sa_family == AF_INET) { 5727 si = (struct sockaddr_in *)ifa->ifa_addr; 5728 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5729 break; 5730 } 5731 } 5732 pserialize_read_exit(s); 5733 5734 if (si != NULL) { 5735 struct sockaddr_in new_sin = *si; 5736 struct sockaddr_in new_dst = *dest; 5737 int error; 5738 5739 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5740 new_sin.sin_addr.s_addr = 0; 5741 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5742 ntohl(sp->ipcp.saved_hisaddr) != 0) 5743 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5744 5745 in_addrhash_remove(ifatoia(ifa)); 5746 5747 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5748 5749 in_addrhash_insert(ifatoia(ifa)); 5750 5751 if (error) { 5752 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5753 __func__, error); 5754 } else { 5755 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5756 } 5757 } 5758 5759 IFNET_UNLOCK(ifp); 5760 } 5761 #endif 5762 5763 #ifdef INET6 5764 /* 5765 * Get both IPv6 addresses. 5766 */ 5767 static void 5768 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5769 struct in6_addr *srcmask) 5770 { 5771 struct ifnet *ifp = &sp->pp_if; 5772 struct ifaddr *ifa; 5773 struct sockaddr_in6 *si, *sm; 5774 struct in6_addr ssrc, ddst; 5775 int s; 5776 struct psref psref; 5777 5778 sm = NULL; 5779 memset(&ssrc, 0, sizeof(ssrc)); 5780 memset(&ddst, 0, sizeof(ddst)); 5781 /* 5782 * Pick the first link-local AF_INET6 address from the list, 5783 * aliases don't make any sense on a p2p link anyway. 5784 */ 5785 si = 0; 5786 s = pserialize_read_enter(); 5787 IFADDR_READER_FOREACH(ifa, ifp) { 5788 if (ifa->ifa_addr->sa_family == AF_INET6) { 5789 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5790 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5791 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5792 ifa_acquire(ifa, &psref); 5793 break; 5794 } 5795 } 5796 } 5797 pserialize_read_exit(s); 5798 5799 if (ifa) { 5800 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5801 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5802 if (srcmask) { 5803 memcpy(srcmask, &sm->sin6_addr, 5804 sizeof(*srcmask)); 5805 } 5806 } 5807 5808 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5809 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5810 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5811 ifa_release(ifa, &psref); 5812 } 5813 5814 if (dst) 5815 memcpy(dst, &ddst, sizeof(*dst)); 5816 if (src) 5817 memcpy(src, &ssrc, sizeof(*src)); 5818 } 5819 5820 #ifdef IPV6CP_MYIFID_DYN 5821 /* 5822 * Generate random ifid. 5823 */ 5824 static void 5825 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5826 { 5827 /* TBD */ 5828 } 5829 5830 /* 5831 * Set my IPv6 address. Must be called at splnet. 5832 */ 5833 static void 5834 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5835 { 5836 struct ifnet *ifp; 5837 struct ifaddr *ifa; 5838 struct sockaddr_in6 *sin6; 5839 int s; 5840 struct psref psref; 5841 5842 KASSERT(SPPP_WLOCKED(sp)); 5843 5844 ifp = &sp->pp_if; 5845 5846 SPPP_UNLOCK(sp); 5847 IFNET_LOCK(ifp); 5848 SPPP_LOCK(sp, RW_WRITER); 5849 5850 /* 5851 * Pick the first link-local AF_INET6 address from the list, 5852 * aliases don't make any sense on a p2p link anyway. 5853 */ 5854 5855 sin6 = NULL; 5856 s = pserialize_read_enter(); 5857 IFADDR_READER_FOREACH(ifa, ifp) 5858 { 5859 if (ifa->ifa_addr->sa_family == AF_INET6) 5860 { 5861 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5862 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5863 ifa_acquire(ifa, &psref); 5864 break; 5865 } 5866 } 5867 } 5868 pserialize_read_exit(s); 5869 5870 if (ifa && sin6) 5871 { 5872 int error; 5873 struct sockaddr_in6 new_sin6 = *sin6; 5874 5875 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5876 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5877 if (error) { 5878 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n", 5879 __func__, error); 5880 } else { 5881 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5882 } 5883 ifa_release(ifa, &psref); 5884 } 5885 5886 IFNET_UNLOCK(ifp); 5887 } 5888 #endif 5889 5890 /* 5891 * Suggest a candidate address to be used by peer. 5892 */ 5893 static void 5894 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5895 { 5896 struct in6_addr myaddr; 5897 struct timeval tv; 5898 5899 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5900 5901 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5902 microtime(&tv); 5903 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5904 myaddr.s6_addr[14] ^= 0xff; 5905 myaddr.s6_addr[15] ^= 0xff; 5906 } else { 5907 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5908 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5909 } 5910 if (suggest) 5911 memcpy(suggest, &myaddr, sizeof(myaddr)); 5912 } 5913 #endif /*INET6*/ 5914 5915 /* 5916 * Process ioctl requests specific to the PPP interface. 5917 * Permissions have already been checked. 5918 */ 5919 static int 5920 sppp_params(struct sppp *sp, u_long cmd, void *data) 5921 { 5922 switch (cmd) { 5923 case SPPPGETAUTHCFG: 5924 { 5925 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5926 int error; 5927 size_t len; 5928 5929 SPPP_LOCK(sp, RW_READER); 5930 5931 cfg->myauthflags = sp->myauth.flags; 5932 cfg->hisauthflags = sp->hisauth.flags; 5933 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5934 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 5935 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 5936 if (cfg->myname_length == 0) { 5937 if (sp->myauth.name != NULL) 5938 cfg->myname_length = sp->myauth.name_len + 1; 5939 } else { 5940 if (sp->myauth.name == NULL) { 5941 cfg->myname_length = 0; 5942 } else { 5943 len = sp->myauth.name_len + 1; 5944 5945 if (cfg->myname_length < len) { 5946 SPPP_UNLOCK(sp); 5947 return (ENAMETOOLONG); 5948 } 5949 error = copyout(sp->myauth.name, cfg->myname, len); 5950 if (error) { 5951 SPPP_UNLOCK(sp); 5952 return error; 5953 } 5954 } 5955 } 5956 if (cfg->hisname_length == 0) { 5957 if (sp->hisauth.name != NULL) 5958 cfg->hisname_length = sp->hisauth.name_len + 1; 5959 } else { 5960 if (sp->hisauth.name == NULL) { 5961 cfg->hisname_length = 0; 5962 } else { 5963 len = sp->hisauth.name_len + 1; 5964 5965 if (cfg->hisname_length < len) { 5966 SPPP_UNLOCK(sp); 5967 return (ENAMETOOLONG); 5968 } 5969 error = copyout(sp->hisauth.name, cfg->hisname, len); 5970 if (error) { 5971 SPPP_UNLOCK(sp); 5972 return error; 5973 } 5974 } 5975 } 5976 SPPP_UNLOCK(sp); 5977 } 5978 break; 5979 case SPPPSETAUTHCFG: 5980 { 5981 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5982 int error; 5983 5984 SPPP_LOCK(sp, RW_WRITER); 5985 5986 if (sp->myauth.name) { 5987 free(sp->myauth.name, M_DEVBUF); 5988 sp->myauth.name = NULL; 5989 } 5990 if (sp->myauth.secret) { 5991 free(sp->myauth.secret, M_DEVBUF); 5992 sp->myauth.secret = NULL; 5993 } 5994 if (sp->hisauth.name) { 5995 free(sp->hisauth.name, M_DEVBUF); 5996 sp->hisauth.name = NULL; 5997 } 5998 if (sp->hisauth.secret) { 5999 free(sp->hisauth.secret, M_DEVBUF); 6000 sp->hisauth.secret = NULL; 6001 } 6002 6003 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6004 if (cfg->hisname_length >= MCLBYTES) { 6005 SPPP_UNLOCK(sp); 6006 return (ENAMETOOLONG); 6007 } 6008 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6009 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6010 if (error) { 6011 free(sp->hisauth.name, M_DEVBUF); 6012 sp->hisauth.name = NULL; 6013 SPPP_UNLOCK(sp); 6014 return error; 6015 } 6016 sp->hisauth.name_len = cfg->hisname_length - 1; 6017 sp->hisauth.name[sp->hisauth.name_len] = 0; 6018 } 6019 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6020 if (cfg->hissecret_length >= MCLBYTES) { 6021 SPPP_UNLOCK(sp); 6022 return (ENAMETOOLONG); 6023 } 6024 sp->hisauth.secret = malloc(cfg->hissecret_length, 6025 M_DEVBUF, M_WAITOK); 6026 error = copyin(cfg->hissecret, sp->hisauth.secret, 6027 cfg->hissecret_length); 6028 if (error) { 6029 free(sp->hisauth.secret, M_DEVBUF); 6030 sp->hisauth.secret = NULL; 6031 SPPP_UNLOCK(sp); 6032 return error; 6033 } 6034 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6035 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6036 } 6037 if (cfg->myname != NULL && cfg->myname_length > 0) { 6038 if (cfg->myname_length >= MCLBYTES) { 6039 SPPP_UNLOCK(sp); 6040 return (ENAMETOOLONG); 6041 } 6042 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6043 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6044 if (error) { 6045 free(sp->myauth.name, M_DEVBUF); 6046 sp->myauth.name = NULL; 6047 SPPP_UNLOCK(sp); 6048 return error; 6049 } 6050 sp->myauth.name_len = cfg->myname_length - 1; 6051 sp->myauth.name[sp->myauth.name_len] = 0; 6052 } 6053 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6054 if (cfg->mysecret_length >= MCLBYTES) { 6055 SPPP_UNLOCK(sp); 6056 return (ENAMETOOLONG); 6057 } 6058 sp->myauth.secret = malloc(cfg->mysecret_length, 6059 M_DEVBUF, M_WAITOK); 6060 error = copyin(cfg->mysecret, sp->myauth.secret, 6061 cfg->mysecret_length); 6062 if (error) { 6063 free(sp->myauth.secret, M_DEVBUF); 6064 sp->myauth.secret = NULL; 6065 SPPP_UNLOCK(sp); 6066 return error; 6067 } 6068 sp->myauth.secret_len = cfg->mysecret_length - 1; 6069 sp->myauth.secret[sp->myauth.secret_len] = 0; 6070 } 6071 sp->myauth.flags = cfg->myauthflags; 6072 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6073 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6074 } 6075 sp->hisauth.flags = cfg->hisauthflags; 6076 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6077 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6078 } 6079 sp->pp_auth_failures = 0; 6080 if (sp->hisauth.proto != PPP_NOPROTO) 6081 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6082 else 6083 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6084 6085 SPPP_UNLOCK(sp); 6086 } 6087 break; 6088 case SPPPGETLCPCFG: 6089 { 6090 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6091 6092 SPPP_LOCK(sp, RW_READER); 6093 lcpp->lcp_timeout = sp->lcp.timeout; 6094 SPPP_UNLOCK(sp); 6095 } 6096 break; 6097 case SPPPSETLCPCFG: 6098 { 6099 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6100 6101 SPPP_LOCK(sp, RW_WRITER); 6102 sp->lcp.timeout = lcpp->lcp_timeout; 6103 SPPP_UNLOCK(sp); 6104 } 6105 break; 6106 case SPPPGETNCPCFG: 6107 { 6108 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6109 6110 SPPP_LOCK(sp, RW_READER); 6111 ncpp->ncp_flags = sp->pp_ncpflags; 6112 SPPP_UNLOCK(sp); 6113 } 6114 break; 6115 case SPPPSETNCPCFG: 6116 { 6117 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6118 6119 SPPP_LOCK(sp, RW_WRITER); 6120 sp->pp_ncpflags = ncpp->ncp_flags; 6121 SPPP_UNLOCK(sp); 6122 } 6123 break; 6124 case SPPPGETSTATUS: 6125 { 6126 struct spppstatus *status = (struct spppstatus *)data; 6127 6128 SPPP_LOCK(sp, RW_READER); 6129 status->phase = sp->pp_phase; 6130 SPPP_UNLOCK(sp); 6131 } 6132 break; 6133 case SPPPGETSTATUSNCP: 6134 { 6135 struct spppstatusncp *status = (struct spppstatusncp *)data; 6136 6137 SPPP_LOCK(sp, RW_READER); 6138 status->phase = sp->pp_phase; 6139 status->ncpup = sppp_cp_check(sp, CP_NCP); 6140 SPPP_UNLOCK(sp); 6141 } 6142 break; 6143 case SPPPGETIDLETO: 6144 { 6145 struct spppidletimeout *to = (struct spppidletimeout *)data; 6146 6147 SPPP_LOCK(sp, RW_READER); 6148 to->idle_seconds = sp->pp_idle_timeout; 6149 SPPP_UNLOCK(sp); 6150 } 6151 break; 6152 case SPPPSETIDLETO: 6153 { 6154 struct spppidletimeout *to = (struct spppidletimeout *)data; 6155 6156 SPPP_LOCK(sp, RW_WRITER); 6157 sp->pp_idle_timeout = to->idle_seconds; 6158 SPPP_UNLOCK(sp); 6159 } 6160 break; 6161 case SPPPSETAUTHFAILURE: 6162 { 6163 struct spppauthfailuresettings *afsettings = 6164 (struct spppauthfailuresettings *)data; 6165 6166 SPPP_LOCK(sp, RW_WRITER); 6167 sp->pp_max_auth_fail = afsettings->max_failures; 6168 sp->pp_auth_failures = 0; 6169 SPPP_UNLOCK(sp); 6170 } 6171 break; 6172 case SPPPGETAUTHFAILURES: 6173 { 6174 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6175 6176 SPPP_LOCK(sp, RW_READER); 6177 stats->auth_failures = sp->pp_auth_failures; 6178 stats->max_failures = sp->pp_max_auth_fail; 6179 SPPP_UNLOCK(sp); 6180 } 6181 break; 6182 case SPPPSETDNSOPTS: 6183 { 6184 struct spppdnssettings *req = (struct spppdnssettings *)data; 6185 6186 SPPP_LOCK(sp, RW_WRITER); 6187 sp->query_dns = req->query_dns & 3; 6188 SPPP_UNLOCK(sp); 6189 } 6190 break; 6191 case SPPPGETDNSOPTS: 6192 { 6193 struct spppdnssettings *req = (struct spppdnssettings *)data; 6194 6195 SPPP_LOCK(sp, RW_READER); 6196 req->query_dns = sp->query_dns; 6197 SPPP_UNLOCK(sp); 6198 } 6199 break; 6200 case SPPPGETDNSADDRS: 6201 { 6202 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6203 6204 SPPP_LOCK(sp, RW_READER); 6205 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6206 SPPP_UNLOCK(sp); 6207 } 6208 break; 6209 case SPPPGETKEEPALIVE: 6210 { 6211 struct spppkeepalivesettings *settings = 6212 (struct spppkeepalivesettings*)data; 6213 6214 SPPP_LOCK(sp, RW_READER); 6215 settings->maxalive = sp->pp_maxalive; 6216 settings->max_noreceive = sp->pp_max_noreceive; 6217 settings->alive_interval = sp->pp_alive_interval; 6218 SPPP_UNLOCK(sp); 6219 } 6220 break; 6221 case SPPPSETKEEPALIVE: 6222 { 6223 struct spppkeepalivesettings *settings = 6224 (struct spppkeepalivesettings*)data; 6225 6226 SPPP_LOCK(sp, RW_WRITER); 6227 sp->pp_maxalive = settings->maxalive; 6228 sp->pp_max_noreceive = settings->max_noreceive; 6229 sp->pp_alive_interval = settings->alive_interval; 6230 SPPP_UNLOCK(sp); 6231 } 6232 break; 6233 case SPPPGETLCPSTATUS: 6234 { 6235 struct sppplcpstatus *status = 6236 (struct sppplcpstatus *)data; 6237 6238 SPPP_LOCK(sp, RW_READER); 6239 status->state = sp->scp[IDX_LCP].state; 6240 status->opts = sp->lcp.opts; 6241 status->magic = sp->lcp.magic; 6242 status->mru = sp->lcp.mru; 6243 SPPP_UNLOCK(sp); 6244 } 6245 break; 6246 case SPPPGETIPCPSTATUS: 6247 { 6248 struct spppipcpstatus *status = 6249 (struct spppipcpstatus *)data; 6250 u_int32_t myaddr; 6251 6252 SPPP_LOCK(sp, RW_READER); 6253 status->state = sp->scp[IDX_IPCP].state; 6254 status->opts = sp->ipcp.opts; 6255 #ifdef INET 6256 kpreempt_disable(); 6257 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6258 kpreempt_enable(); 6259 #else 6260 myaddr = 0; 6261 #endif 6262 status->myaddr = ntohl(myaddr); 6263 SPPP_UNLOCK(sp); 6264 } 6265 break; 6266 case SPPPGETIPV6CPSTATUS: 6267 { 6268 struct spppipv6cpstatus *status = 6269 (struct spppipv6cpstatus *)data; 6270 6271 SPPP_LOCK(sp, RW_READER); 6272 status->state = sp->scp[IDX_IPV6CP].state; 6273 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6274 sizeof(status->my_ifid)); 6275 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6276 sizeof(status->his_ifid)); 6277 SPPP_UNLOCK(sp); 6278 } 6279 break; 6280 default: 6281 { 6282 int ret; 6283 6284 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6285 enosys(), ret); 6286 if (ret != ENOSYS) 6287 return ret; 6288 return (EINVAL); 6289 } 6290 } 6291 return (0); 6292 } 6293 6294 static void 6295 sppp_phase_network(struct sppp *sp) 6296 { 6297 int i; 6298 6299 KASSERT(SPPP_WLOCKED(sp)); 6300 6301 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6302 6303 /* Notify NCPs now. */ 6304 for (i = 0; i < IDX_COUNT; i++) 6305 if ((cps[i])->flags & CP_NCP) 6306 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6307 } 6308 6309 static const char * 6310 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6311 { 6312 6313 switch (type) { 6314 case CONF_REQ: return "conf-req"; 6315 case CONF_ACK: return "conf-ack"; 6316 case CONF_NAK: return "conf-nak"; 6317 case CONF_REJ: return "conf-rej"; 6318 case TERM_REQ: return "term-req"; 6319 case TERM_ACK: return "term-ack"; 6320 case CODE_REJ: return "code-rej"; 6321 case PROTO_REJ: return "proto-rej"; 6322 case ECHO_REQ: return "echo-req"; 6323 case ECHO_REPLY: return "echo-reply"; 6324 case DISC_REQ: return "discard-req"; 6325 } 6326 if (buf != NULL) 6327 snprintf(buf, buflen, "0x%02x", type); 6328 return buf; 6329 } 6330 6331 static const char * 6332 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6333 { 6334 const char *name; 6335 6336 switch (proto) { 6337 case PPP_CHAP: 6338 switch (type) { 6339 case CHAP_CHALLENGE: return "challenge"; 6340 case CHAP_RESPONSE: return "response"; 6341 case CHAP_SUCCESS: return "success"; 6342 case CHAP_FAILURE: return "failure"; 6343 default: name = "chap"; break; 6344 } 6345 break; 6346 6347 case PPP_PAP: 6348 switch (type) { 6349 case PAP_REQ: return "req"; 6350 case PAP_ACK: return "ack"; 6351 case PAP_NAK: return "nak"; 6352 default: name = "pap"; break; 6353 } 6354 break; 6355 6356 default: 6357 name = "bad"; 6358 break; 6359 } 6360 6361 if (buf != NULL) 6362 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6363 return buf; 6364 } 6365 6366 static const char * 6367 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6368 { 6369 6370 switch (opt) { 6371 case LCP_OPT_MRU: return "mru"; 6372 case LCP_OPT_ASYNC_MAP: return "async-map"; 6373 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6374 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6375 case LCP_OPT_MAGIC: return "magic"; 6376 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6377 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6378 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6379 case LCP_OPT_CALL_BACK: return "callback"; 6380 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6381 case LCP_OPT_MP_MRRU: return "mrru"; 6382 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6383 case LCP_OPT_MP_EID: return "mp-eid"; 6384 } 6385 if (buf != NULL) 6386 snprintf(buf, buflen, "0x%02x", opt); 6387 return buf; 6388 } 6389 6390 static const char * 6391 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6392 { 6393 6394 switch (opt) { 6395 case IPCP_OPT_ADDRESSES: return "addresses"; 6396 case IPCP_OPT_COMPRESSION: return "compression"; 6397 case IPCP_OPT_ADDRESS: return "address"; 6398 case IPCP_OPT_PRIMDNS: return "primdns"; 6399 case IPCP_OPT_SECDNS: return "secdns"; 6400 } 6401 if (buf != NULL) 6402 snprintf(buf, buflen, "0x%02x", opt); 6403 return buf; 6404 } 6405 6406 #ifdef INET6 6407 static const char * 6408 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6409 { 6410 6411 switch (opt) { 6412 case IPV6CP_OPT_IFID: return "ifid"; 6413 case IPV6CP_OPT_COMPRESSION: return "compression"; 6414 } 6415 if (buf != NULL) 6416 snprintf(buf, buflen, "0x%02x", opt); 6417 return buf; 6418 } 6419 #endif 6420 6421 static const char * 6422 sppp_state_name(int state) 6423 { 6424 6425 switch (state) { 6426 case STATE_INITIAL: return "initial"; 6427 case STATE_STARTING: return "starting"; 6428 case STATE_CLOSED: return "closed"; 6429 case STATE_STOPPED: return "stopped"; 6430 case STATE_CLOSING: return "closing"; 6431 case STATE_STOPPING: return "stopping"; 6432 case STATE_REQ_SENT: return "req-sent"; 6433 case STATE_ACK_RCVD: return "ack-rcvd"; 6434 case STATE_ACK_SENT: return "ack-sent"; 6435 case STATE_OPENED: return "opened"; 6436 } 6437 return "illegal"; 6438 } 6439 6440 static const char * 6441 sppp_phase_name(int phase) 6442 { 6443 6444 switch (phase) { 6445 case SPPP_PHASE_DEAD: return "dead"; 6446 case SPPP_PHASE_ESTABLISH: return "establish"; 6447 case SPPP_PHASE_TERMINATE: return "terminate"; 6448 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6449 case SPPP_PHASE_NETWORK: return "network"; 6450 } 6451 return "illegal"; 6452 } 6453 6454 static const char * 6455 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6456 { 6457 6458 switch (proto) { 6459 case PPP_LCP: return "lcp"; 6460 case PPP_IPCP: return "ipcp"; 6461 case PPP_PAP: return "pap"; 6462 case PPP_CHAP: return "chap"; 6463 case PPP_IPV6CP: return "ipv6cp"; 6464 } 6465 if (buf != NULL) { 6466 snprintf(buf, sizeof(buf), "0x%04x", 6467 (unsigned)proto); 6468 } 6469 return buf; 6470 } 6471 6472 static void 6473 sppp_print_bytes(const u_char *p, u_short len) 6474 { 6475 addlog(" %02x", *p++); 6476 while (--len > 0) 6477 addlog("-%02x", *p++); 6478 } 6479 6480 static void 6481 sppp_print_string(const char *p, u_short len) 6482 { 6483 u_char c; 6484 6485 while (len-- > 0) { 6486 c = *p++; 6487 /* 6488 * Print only ASCII chars directly. RFC 1994 recommends 6489 * using only them, but we don't rely on it. */ 6490 if (c < ' ' || c > '~') 6491 addlog("\\x%x", c); 6492 else 6493 addlog("%c", c); 6494 } 6495 } 6496 6497 static const char * 6498 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6499 { 6500 6501 if (buf != NULL) { 6502 snprintf(buf, buflen, "%u.%u.%u.%u", 6503 (unsigned int)((addr >> 24) & 0xff), 6504 (unsigned int)((addr >> 16) & 0xff), 6505 (unsigned int)((addr >> 8) & 0xff), 6506 (unsigned int)(addr & 0xff)); 6507 } 6508 return buf; 6509 } 6510 6511 /* a dummy, used to drop uninteresting events */ 6512 static void 6513 sppp_null(struct sppp *unused) 6514 { 6515 /* do just nothing */ 6516 } 6517 6518 static void 6519 sppp_tls(const struct cp *cp, struct sppp *sp) 6520 { 6521 6522 SPPP_DLOG(sp, "%s tls\n", cp->name); 6523 6524 /* notify lcp that is lower layer */ 6525 sp->lcp.protos |= (1 << cp->protoidx); 6526 } 6527 6528 static void 6529 sppp_tlf(const struct cp *cp, struct sppp *sp) 6530 { 6531 6532 SPPP_DLOG(sp, "%s tlf\n", cp->name); 6533 6534 /* notify lcp that is lower layer */ 6535 sp->lcp.protos &= ~(1 << cp->protoidx); 6536 6537 /* cleanup */ 6538 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) { 6539 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6540 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6541 } 6542 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) { 6543 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6544 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6545 } 6546 6547 sppp_lcp_check_and_close(sp); 6548 } 6549 6550 static void 6551 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6552 uint8_t ident, size_t msglen, void *msg) 6553 { 6554 6555 if (msglen == 0) 6556 return; 6557 6558 switch (type) { 6559 case CONF_ACK: 6560 case CONF_NAK: 6561 case CONF_REJ: 6562 break; 6563 default: 6564 return; 6565 } 6566 6567 if (sppp_debug_enabled(sp)) { 6568 char tbuf[SPPP_CPTYPE_NAMELEN]; 6569 const char *cpname; 6570 6571 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6572 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname); 6573 } 6574 6575 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6576 } 6577 6578 static void 6579 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6580 { 6581 6582 SPPP_UNLOCK(sp); 6583 if_down(&sp->pp_if); 6584 IF_PURGE(&sp->pp_cpq); 6585 SPPP_LOCK(sp, RW_WRITER); 6586 } 6587 6588 static void 6589 sppp_notify_up(struct sppp *sp) 6590 { 6591 6592 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6593 } 6594 6595 static void 6596 sppp_notify_down(struct sppp *sp) 6597 { 6598 6599 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6600 } 6601 6602 static void 6603 sppp_notify_tls_wlocked(struct sppp *sp) 6604 { 6605 6606 KASSERT(SPPP_WLOCKED(sp)); 6607 6608 if (!sp->pp_tls) 6609 return; 6610 6611 SPPP_UNLOCK(sp); 6612 sp->pp_tls(sp); 6613 SPPP_LOCK(sp, RW_WRITER); 6614 } 6615 6616 static void 6617 sppp_notify_tlf_wlocked(struct sppp *sp) 6618 { 6619 6620 KASSERT(SPPP_WLOCKED(sp)); 6621 6622 if (!sp->pp_tlf) 6623 return; 6624 6625 SPPP_UNLOCK(sp); 6626 sp->pp_tlf(sp); 6627 SPPP_LOCK(sp, RW_WRITER); 6628 } 6629 6630 static void 6631 sppp_notify_con(struct sppp *sp) 6632 { 6633 6634 if (!sp->pp_con) 6635 return; 6636 6637 sp->pp_con(sp); 6638 } 6639 6640 #ifdef INET6 6641 static void 6642 sppp_notify_con_wlocked(struct sppp *sp) 6643 { 6644 6645 KASSERT(SPPP_WLOCKED(sp)); 6646 6647 SPPP_UNLOCK(sp); 6648 sppp_notify_con(sp); 6649 SPPP_LOCK(sp, RW_WRITER); 6650 6651 } 6652 #endif 6653 6654 static void 6655 sppp_notify_chg_wlocked(struct sppp *sp) 6656 { 6657 6658 KASSERT(SPPP_WLOCKED(sp)); 6659 6660 if (!sp->pp_chg) 6661 return; 6662 6663 SPPP_UNLOCK(sp); 6664 sp->pp_chg(sp, sp->pp_phase); 6665 SPPP_LOCK(sp, RW_WRITER); 6666 } 6667 6668 static void 6669 sppp_wq_work(struct work *wk, void *xsp) 6670 { 6671 struct sppp *sp; 6672 struct sppp_work *work; 6673 6674 sp = xsp; 6675 work = container_of(wk, struct sppp_work, work); 6676 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6677 6678 SPPP_LOCK(sp, RW_WRITER); 6679 work->func(sp, work->arg); 6680 SPPP_UNLOCK(sp); 6681 } 6682 6683 static struct workqueue * 6684 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6685 { 6686 struct workqueue *wq; 6687 int error; 6688 6689 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6690 (void *)sp, prio, ipl, flags); 6691 if (error) { 6692 panic("%s: workqueue_create failed [%s, %d]\n", 6693 sp->pp_if.if_xname, xnamebuf, error); 6694 } 6695 6696 return wq; 6697 } 6698 6699 static void 6700 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6701 { 6702 6703 workqueue_destroy(wq); 6704 } 6705 6706 static void 6707 sppp_wq_set(struct sppp_work *work, 6708 void (*func)(struct sppp *, void *), void *arg) 6709 { 6710 6711 work->func = func; 6712 work->arg = arg; 6713 } 6714 6715 static void 6716 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6717 { 6718 6719 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6720 != SPPP_WK_FREE) 6721 return; 6722 6723 KASSERT(work->func != NULL); 6724 kpreempt_disable(); 6725 workqueue_enqueue(wq, &work->work, NULL); 6726 kpreempt_enable(); 6727 } 6728 static void 6729 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6730 { 6731 6732 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6733 workqueue_wait(wq, &work->work); 6734 } 6735 6736 /* 6737 * This file is large. Tell emacs to highlight it nevertheless. 6738 * 6739 * Local Variables: 6740 * hilit-auto-highlight-maxout: 120000 6741 * End: 6742 */ 6743 6744 /* 6745 * Module glue 6746 */ 6747 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6748 6749 static int 6750 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6751 { 6752 6753 switch (cmd) { 6754 case MODULE_CMD_INIT: 6755 case MODULE_CMD_FINI: 6756 return 0; 6757 case MODULE_CMD_STAT: 6758 case MODULE_CMD_AUTOUNLOAD: 6759 default: 6760 return ENOTTY; 6761 } 6762 } 6763
Indexes created Sun Sep 28 16:09:52 GMT 2025