if_spppsubr.c revision 1.264
1 /* $NetBSD: if_spppsubr.c,v 1.264 2022/08/27 19:25:35 thorpej Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.264 2022/08/27 19:25:35 thorpej Exp $"); 45 46 #if defined(_KERNEL_OPT) 47 #include "opt_inet.h" 48 #include "opt_modular.h" 49 #include "opt_compat_netbsd.h" 50 #include "opt_net_mpsafe.h" 51 #include "opt_sppp.h" 52 #endif 53 54 #include <sys/param.h> 55 #include <sys/proc.h> 56 #include <sys/systm.h> 57 #include <sys/kernel.h> 58 #include <sys/sockio.h> 59 #include <sys/socket.h> 60 #include <sys/syslog.h> 61 #include <sys/malloc.h> 62 #include <sys/mbuf.h> 63 #include <sys/callout.h> 64 #include <sys/md5.h> 65 #include <sys/inttypes.h> 66 #include <sys/kauth.h> 67 #include <sys/cprng.h> 68 #include <sys/module.h> 69 #include <sys/workqueue.h> 70 #include <sys/atomic.h> 71 #include <sys/compat_stub.h> 72 #include <sys/cpu.h> 73 74 #include <net/if.h> 75 #include <net/netisr.h> 76 #include <net/if_types.h> 77 #include <net/route.h> 78 #include <net/ppp_defs.h> 79 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/in_var.h> 83 #ifdef INET 84 #include <netinet/ip.h> 85 #include <netinet/tcp.h> 86 #endif 87 #include <net/ethertypes.h> 88 89 #ifdef INET6 90 #include <netinet6/scope6_var.h> 91 #endif 92 93 #include <net/if_sppp.h> 94 #include <net/if_spppvar.h> 95 96 #ifdef NET_MPSAFE 97 #define SPPPSUBR_MPSAFE 1 98 #endif 99 100 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 101 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 #ifndef SPPP_KEEPALIVE_INTERVAL 108 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL 109 #endif 110 111 #ifndef SPPP_NORECV_TIME 112 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME 113 #endif 114 115 #ifndef SPPP_ALIVE_INTERVAL 116 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL 117 #endif 118 119 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */ 120 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */ 121 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */ 122 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */ 123 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */ 124 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */ 125 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */ 126 127 /* 128 * Interface flags that can be set in an ifconfig command. 129 * 130 * Setting link0 will make the link passive, i.e. it will be marked 131 * as being administrative openable, but won't be opened to begin 132 * with. Incoming calls will be answered, or subsequent calls with 133 * -link1 will cause the administrative open of the LCP layer. 134 * 135 * Setting link1 will cause the link to auto-dial only as packets 136 * arrive to be sent. 137 * 138 * Setting IFF_DEBUG will syslog the option negotiation and state 139 * transitions at level kern.debug. Note: all logs consistently look 140 * like 141 * 142 * <if-name><unit>: <proto-name> <additional info...> 143 * 144 * with <if-name><unit> being something like "bppp0", and <proto-name> 145 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 146 */ 147 148 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 149 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 150 151 #define CONF_REQ 1 /* PPP configure request */ 152 #define CONF_ACK 2 /* PPP configure acknowledge */ 153 #define CONF_NAK 3 /* PPP configure negative ack */ 154 #define CONF_REJ 4 /* PPP configure reject */ 155 #define TERM_REQ 5 /* PPP terminate request */ 156 #define TERM_ACK 6 /* PPP terminate acknowledge */ 157 #define CODE_REJ 7 /* PPP code reject */ 158 #define PROTO_REJ 8 /* PPP protocol reject */ 159 #define ECHO_REQ 9 /* PPP echo request */ 160 #define ECHO_REPLY 10 /* PPP echo reply */ 161 #define DISC_REQ 11 /* PPP discard request */ 162 163 #define LCP_OPT_MRU 1 /* maximum receive unit */ 164 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 165 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 166 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 167 #define LCP_OPT_MAGIC 5 /* magic number */ 168 #define LCP_OPT_RESERVED 6 /* reserved */ 169 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 170 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 171 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */ 172 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */ 173 #define LCP_OPT_CALL_BACK 13 /* callback */ 174 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */ 175 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */ 176 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */ 177 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */ 178 179 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 180 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 181 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 182 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 183 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 184 185 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */ 186 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */ 187 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */ 188 189 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 190 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 191 192 #define PAP_REQ 1 /* PAP name/password request */ 193 #define PAP_ACK 2 /* PAP acknowledge */ 194 #define PAP_NAK 3 /* PAP fail */ 195 196 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 197 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 198 #define CHAP_SUCCESS 3 /* CHAP response ok */ 199 #define CHAP_FAILURE 4 /* CHAP response failed */ 200 201 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 202 203 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 204 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 205 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 206 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 207 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 208 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 209 210 #define PPP_NOPROTO 0 /* no authentication protocol */ 211 212 enum { 213 STATE_INITIAL = SPPP_STATE_INITIAL, 214 STATE_STARTING = SPPP_STATE_STARTING, 215 STATE_CLOSED = SPPP_STATE_CLOSED, 216 STATE_STOPPED = SPPP_STATE_STOPPED, 217 STATE_CLOSING = SPPP_STATE_CLOSING, 218 STATE_STOPPING = SPPP_STATE_STOPPING, 219 STATE_REQ_SENT = SPPP_STATE_REQ_SENT, 220 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD, 221 STATE_ACK_SENT = SPPP_STATE_ACK_SENT, 222 STATE_OPENED = SPPP_STATE_OPENED, 223 }; 224 225 enum cp_rcr_type { 226 CP_RCR_NONE = 0, /* initial value */ 227 CP_RCR_ACK, /* RCR+ */ 228 CP_RCR_NAK, /* RCR- */ 229 CP_RCR_REJ, /* RCR- */ 230 CP_RCR_DROP, /* DROP message */ 231 CP_RCR_ERR, /* internal error */ 232 }; 233 234 struct ppp_header { 235 uint8_t address; 236 uint8_t control; 237 uint16_t protocol; 238 } __packed; 239 #define PPP_HEADER_LEN sizeof (struct ppp_header) 240 241 struct lcp_header { 242 uint8_t type; 243 uint8_t ident; 244 uint16_t len; 245 } __packed; 246 #define LCP_HEADER_LEN sizeof (struct lcp_header) 247 248 struct cisco_packet { 249 uint32_t type; 250 uint32_t par1; 251 uint32_t par2; 252 uint16_t rel; 253 uint16_t time0; 254 uint16_t time1; 255 } __packed; 256 #define CISCO_PACKET_LEN 18 257 258 /* 259 * We follow the spelling and capitalization of RFC 1661 here, to make 260 * it easier comparing with the standard. Please refer to this RFC in 261 * case you can't make sense out of these abbreviation; it will also 262 * explain the semantics related to the various events and actions. 263 */ 264 struct cp { 265 u_short proto; /* PPP control protocol number */ 266 u_char protoidx; /* index into state table in struct sppp */ 267 u_char flags; 268 #define CP_LCP 0x01 /* this is the LCP */ 269 #define CP_AUTH 0x02 /* this is an authentication protocol */ 270 #define CP_NCP 0x04 /* this is a NCP */ 271 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 272 const char *name; /* name of this control protocol */ 273 /* event handlers */ 274 void (*Up)(struct sppp *, void *); 275 void (*Down)(struct sppp *, void *); 276 void (*Open)(struct sppp *, void *); 277 void (*Close)(struct sppp *, void *); 278 void (*TO)(struct sppp *, void *); 279 /* actions */ 280 void (*tlu)(struct sppp *); 281 void (*tld)(struct sppp *); 282 void (*tls)(const struct cp *, struct sppp *); 283 void (*tlf)(const struct cp *, struct sppp *); 284 void (*scr)(struct sppp *); 285 void (*screply)(const struct cp *, struct sppp *, u_char, 286 uint8_t, size_t, void *); 287 288 /* message parser */ 289 enum cp_rcr_type 290 (*parse_confreq)(struct sppp *, struct lcp_header *, int, 291 uint8_t **, size_t *, size_t *); 292 void (*parse_confrej)(struct sppp *, struct lcp_header *, int); 293 void (*parse_confnak)(struct sppp *, struct lcp_header *, int); 294 }; 295 296 enum auth_role { 297 SPPP_AUTH_NOROLE = 0, 298 SPPP_AUTH_SERV = __BIT(0), 299 SPPP_AUTH_PEER = __BIT(1), 300 }; 301 302 static struct sppp *spppq; 303 static kmutex_t *spppq_lock = NULL; 304 static callout_t keepalive_ch; 305 static unsigned int sppp_keepalive_cnt = 0; 306 307 pktq_rps_hash_func_t sppp_pktq_rps_hash_p; 308 309 #define SPPPQ_LOCK() if (spppq_lock) \ 310 mutex_enter(spppq_lock); 311 #define SPPPQ_UNLOCK() if (spppq_lock) \ 312 mutex_exit(spppq_lock); 313 314 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op)) 315 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock) 316 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock) 317 #define SPPP_UPGRADE(_sp) do{ \ 318 SPPP_UNLOCK(_sp); \ 319 SPPP_LOCK(_sp, RW_WRITER); \ 320 }while (0) 321 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock) 322 #define SPPP_WQ_SET(_wk, _func, _arg) \ 323 sppp_wq_set((_wk), (_func), __UNCONST((_arg))) 324 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \ 325 if (__predict_true((_sp) != NULL)) { \ 326 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \ 327 } \ 328 addlog((_fmt), ##_args); \ 329 } while (0) 330 #define SPPP_DLOG(_sp, _fmt, _args...) do { \ 331 if (!sppp_debug_enabled(_sp)) \ 332 break; \ 333 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \ 334 } while (0) 335 336 #ifdef INET 337 #ifndef SPPPSUBR_MPSAFE 338 /* 339 * The following disgusting hack gets around the problem that IP TOS 340 * can't be set yet. We want to put "interactive" traffic on a high 341 * priority queue. To decide if traffic is interactive, we check that 342 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 343 * 344 * XXX is this really still necessary? - joerg - 345 */ 346 static u_short interactive_ports[8] = { 347 0, 513, 0, 0, 348 0, 21, 0, 23, 349 }; 350 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 351 #endif /* SPPPSUBR_MPSAFE */ 352 #endif 353 354 /* almost every function needs these */ 355 356 static bool sppp_debug_enabled(struct sppp *sp); 357 static int sppp_output(struct ifnet *, struct mbuf *, 358 const struct sockaddr *, const struct rtentry *); 359 360 static void sppp_cp_init(const struct cp *, struct sppp *); 361 static void sppp_cp_fini(const struct cp *, struct sppp *); 362 static void sppp_cp_input(const struct cp *, struct sppp *, 363 struct mbuf *); 364 static void sppp_cp_input(const struct cp *, struct sppp *, 365 struct mbuf *); 366 static void sppp_cp_send(struct sppp *, u_short, u_char, 367 u_char, u_short, void *); 368 /* static void sppp_cp_timeout(void *arg); */ 369 static void sppp_cp_change_state(const struct cp *, struct sppp *, int); 370 static struct workqueue * 371 sppp_wq_create(struct sppp *, const char *, pri_t, int, int); 372 static void sppp_wq_destroy(struct sppp *, struct workqueue *); 373 static void sppp_wq_set(struct sppp_work *, 374 void (*)(struct sppp *, void *), void *); 375 static void sppp_wq_add(struct workqueue *, struct sppp_work *); 376 static void sppp_wq_wait(struct workqueue *, struct sppp_work *); 377 static void sppp_cp_to_lcp(void *); 378 static void sppp_cp_to_ipcp(void *); 379 static void sppp_cp_to_ipv6cp(void *); 380 static void sppp_auth_send(const struct cp *, struct sppp *, 381 unsigned int, unsigned int, ...); 382 static int sppp_auth_role(const struct cp *, struct sppp *); 383 static void sppp_auth_to_event(struct sppp *, void *); 384 static void sppp_auth_screply(const struct cp *, struct sppp *, 385 u_char, uint8_t, size_t, void *); 386 static void sppp_up_event(struct sppp *, void *); 387 static void sppp_down_event(struct sppp *, void *); 388 static void sppp_open_event(struct sppp *, void *); 389 static void sppp_close_event(struct sppp *, void *); 390 static void sppp_to_event(struct sppp *, void *); 391 static void sppp_rcr_event(struct sppp *, void *); 392 static void sppp_rca_event(struct sppp *, void *); 393 static void sppp_rcn_event(struct sppp *, void *); 394 static void sppp_rtr_event(struct sppp *, void *); 395 static void sppp_rta_event(struct sppp *, void *); 396 static void sppp_rxj_event(struct sppp *, void *); 397 398 static void sppp_null(struct sppp *); 399 static void sppp_tls(const struct cp *, struct sppp *); 400 static void sppp_tlf(const struct cp *, struct sppp *); 401 static void sppp_screply(const struct cp *, struct sppp *, 402 u_char, uint8_t, size_t, void *); 403 static void sppp_ifdown(struct sppp *, void *); 404 405 static void sppp_lcp_init(struct sppp *); 406 static void sppp_lcp_up(struct sppp *, void *); 407 static void sppp_lcp_down(struct sppp *, void *); 408 static void sppp_lcp_open(struct sppp *, void *); 409 static enum cp_rcr_type 410 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int, 411 uint8_t **, size_t *, size_t *); 412 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int); 413 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int); 414 static void sppp_lcp_tlu(struct sppp *); 415 static void sppp_lcp_tld(struct sppp *); 416 static void sppp_lcp_tls(const struct cp *, struct sppp *); 417 static void sppp_lcp_tlf(const struct cp *, struct sppp *); 418 static void sppp_lcp_scr(struct sppp *); 419 static void sppp_lcp_check_and_close(struct sppp *); 420 static int sppp_cp_check(struct sppp *, u_char); 421 422 static void sppp_ipcp_init(struct sppp *); 423 static void sppp_ipcp_open(struct sppp *, void *); 424 static void sppp_ipcp_close(struct sppp *, void *); 425 static enum cp_rcr_type 426 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int, 427 uint8_t **, size_t *, size_t *); 428 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int); 429 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int); 430 static void sppp_ipcp_tlu(struct sppp *); 431 static void sppp_ipcp_tld(struct sppp *); 432 static void sppp_ipcp_scr(struct sppp *); 433 434 static void sppp_ipv6cp_init(struct sppp *); 435 static void sppp_ipv6cp_open(struct sppp *, void *); 436 static enum cp_rcr_type 437 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int, 438 uint8_t **, size_t *, size_t *); 439 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int); 440 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int); 441 static void sppp_ipv6cp_tlu(struct sppp *); 442 static void sppp_ipv6cp_tld(struct sppp *); 443 static void sppp_ipv6cp_scr(struct sppp *); 444 445 static void sppp_pap_input(struct sppp *, struct mbuf *); 446 static void sppp_pap_init(struct sppp *); 447 static void sppp_pap_tlu(struct sppp *); 448 static void sppp_pap_scr(struct sppp *); 449 static void sppp_pap_scr(struct sppp *); 450 451 static void sppp_chap_input(struct sppp *, struct mbuf *); 452 static void sppp_chap_init(struct sppp *); 453 static void sppp_chap_open(struct sppp *, void *); 454 static void sppp_chap_tlu(struct sppp *); 455 static void sppp_chap_scr(struct sppp *); 456 static void sppp_chap_rcv_challenge_event(struct sppp *, void *); 457 458 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char); 459 static const char *sppp_cp_type_name(char *, size_t, u_char); 460 static const char *sppp_dotted_quad(char *, size_t, uint32_t); 461 static const char *sppp_ipcp_opt_name(char *, size_t, u_char); 462 #ifdef INET6 463 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char); 464 #endif 465 static const char *sppp_lcp_opt_name(char *, size_t, u_char); 466 static const char *sppp_phase_name(int); 467 static const char *sppp_proto_name(char *, size_t, u_short); 468 static const char *sppp_state_name(int); 469 static int sppp_params(struct sppp *, u_long, void *); 470 #ifdef INET 471 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *); 472 static void sppp_set_ip_addrs(struct sppp *); 473 static void sppp_clear_ip_addrs(struct sppp *); 474 #endif 475 static void sppp_keepalive(void *); 476 static void sppp_phase_network(struct sppp *); 477 static void sppp_print_bytes(const u_char *, u_short); 478 static void sppp_print_string(const char *, u_short); 479 #ifdef INET6 480 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *, 481 struct in6_addr *, struct in6_addr *); 482 #ifdef IPV6CP_MYIFID_DYN 483 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *); 484 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *); 485 #endif 486 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *); 487 #endif 488 489 static void sppp_notify_up(struct sppp *); 490 static void sppp_notify_down(struct sppp *); 491 static void sppp_notify_tls_wlocked(struct sppp *); 492 static void sppp_notify_tlf_wlocked(struct sppp *); 493 #ifdef INET6 494 static void sppp_notify_con_wlocked(struct sppp *); 495 #endif 496 static void sppp_notify_con(struct sppp *); 497 498 static void sppp_notify_chg_wlocked(struct sppp *); 499 500 /* our control protocol descriptors */ 501 static const struct cp lcp = { 502 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 503 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, 504 sppp_close_event, sppp_to_event, 505 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, 506 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply, 507 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak 508 }; 509 510 static const struct cp ipcp = { 511 PPP_IPCP, IDX_IPCP, 512 #ifdef INET 513 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 514 #else 515 0, 516 #endif 517 "ipcp", 518 sppp_up_event, sppp_down_event, sppp_ipcp_open, 519 sppp_ipcp_close, sppp_to_event, 520 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls, 521 sppp_tlf, sppp_ipcp_scr, sppp_screply, 522 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak, 523 }; 524 525 static const struct cp ipv6cp = { 526 PPP_IPV6CP, IDX_IPV6CP, 527 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 528 CP_NCP, 529 #else 530 0, 531 #endif 532 "ipv6cp", 533 sppp_up_event, sppp_down_event, sppp_ipv6cp_open, 534 sppp_close_event, sppp_to_event, 535 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls, 536 sppp_tlf, sppp_ipv6cp_scr, sppp_screply, 537 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak, 538 }; 539 540 static const struct cp pap = { 541 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 542 sppp_up_event, sppp_down_event, sppp_open_event, 543 sppp_close_event, sppp_auth_to_event, 544 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf, 545 sppp_pap_scr, sppp_auth_screply, 546 NULL, NULL, NULL 547 }; 548 549 static const struct cp chap = { 550 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 551 sppp_up_event, sppp_down_event, sppp_chap_open, 552 sppp_close_event, sppp_auth_to_event, 553 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf, 554 sppp_chap_scr, sppp_auth_screply, 555 NULL, NULL, NULL 556 }; 557 558 static const struct cp *cps[IDX_COUNT] = { 559 &lcp, /* IDX_LCP */ 560 &ipcp, /* IDX_IPCP */ 561 &ipv6cp, /* IDX_IPV6CP */ 562 &pap, /* IDX_PAP */ 563 &chap, /* IDX_CHAP */ 564 }; 565 566 static inline u_int 567 sppp_proto2authproto(u_short proto) 568 { 569 570 switch (proto) { 571 case PPP_PAP: 572 return SPPP_AUTHPROTO_PAP; 573 case PPP_CHAP: 574 return SPPP_AUTHPROTO_CHAP; 575 } 576 577 return SPPP_AUTHPROTO_NONE; 578 } 579 580 static inline u_short 581 sppp_authproto2proto(u_int authproto) 582 { 583 584 switch (authproto) { 585 case SPPP_AUTHPROTO_PAP: 586 return PPP_PAP; 587 case SPPP_AUTHPROTO_CHAP: 588 return PPP_CHAP; 589 } 590 591 return PPP_NOPROTO; 592 } 593 594 static inline bool 595 sppp_debug_enabled(struct sppp *sp) 596 { 597 598 if (__predict_false(sp == NULL)) 599 return false; 600 601 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0) 602 return false; 603 604 return true; 605 } 606 607 static void 608 sppp_change_phase(struct sppp *sp, int phase) 609 { 610 struct ifnet *ifp; 611 612 KASSERT(SPPP_WLOCKED(sp)); 613 614 ifp = &sp->pp_if; 615 616 if (sp->pp_phase == phase) 617 return; 618 619 sp->pp_phase = phase; 620 621 if (phase == SPPP_PHASE_NETWORK) 622 if_link_state_change(ifp, LINK_STATE_UP); 623 else 624 if_link_state_change(ifp, LINK_STATE_DOWN); 625 626 SPPP_DLOG(sp, "phase %s\n", 627 sppp_phase_name(sp->pp_phase)); 628 } 629 630 /* 631 * Exported functions, comprising our interface to the lower layer. 632 */ 633 634 /* 635 * Process the received packet. 636 */ 637 void 638 sppp_input(struct ifnet *ifp, struct mbuf *m) 639 { 640 struct ppp_header *h = NULL; 641 pktqueue_t *pktq = NULL; 642 struct ifqueue *inq = NULL; 643 uint16_t protocol; 644 struct sppp *sp = (struct sppp *)ifp; 645 int isr = 0; 646 647 SPPP_LOCK(sp, RW_READER); 648 649 if (ifp->if_flags & IFF_UP) { 650 /* Count received bytes, add hardware framing */ 651 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes); 652 /* Note time of last receive */ 653 sp->pp_last_receive = time_uptime; 654 } 655 656 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 657 /* Too small packet, drop it. */ 658 SPPP_DLOG(sp, "input packet is too small, " 659 "%d bytes\n", m->m_pkthdr.len); 660 goto drop; 661 } 662 663 if (sp->pp_flags & PP_NOFRAMING) { 664 memcpy(&protocol, mtod(m, void *), 2); 665 protocol = ntohs(protocol); 666 m_adj(m, 2); 667 } else { 668 669 /* Get PPP header. */ 670 h = mtod(m, struct ppp_header *); 671 m_adj(m, PPP_HEADER_LEN); 672 673 switch (h->address) { 674 case PPP_ALLSTATIONS: 675 if (h->control != PPP_UI) 676 goto invalid; 677 break; 678 case CISCO_MULTICAST: 679 case CISCO_UNICAST: 680 /* Don't check the control field here (RFC 1547). */ 681 SPPP_DLOG(sp, "Cisco packet in PPP mode " 682 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 683 h->address, h->control, ntohs(h->protocol)); 684 goto drop; 685 default: /* Invalid PPP packet. */ 686 invalid: 687 SPPP_DLOG(sp, "invalid input packet " 688 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 689 h->address, h->control, ntohs(h->protocol)); 690 goto drop; 691 } 692 protocol = ntohs(h->protocol); 693 } 694 695 switch (protocol) { 696 reject_protocol: 697 if (sp->scp[IDX_LCP].state == STATE_OPENED) { 698 uint16_t prot = htons(protocol); 699 700 SPPP_UPGRADE(sp); 701 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 702 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2, 703 &prot); 704 SPPP_DOWNGRADE(sp); 705 } 706 if_statinc(ifp, if_noproto); 707 goto drop; 708 default: 709 SPPP_DLOG(sp, "invalid input protocol " 710 "<proto=0x%x>\n", protocol); 711 goto reject_protocol; 712 case PPP_LCP: 713 SPPP_UNLOCK(sp); 714 sppp_cp_input(&lcp, sp, m); 715 /* already m_freem(m) */ 716 return; 717 case PPP_PAP: 718 SPPP_UNLOCK(sp); 719 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 720 sppp_pap_input(sp, m); 721 } 722 m_freem(m); 723 return; 724 case PPP_CHAP: 725 SPPP_UNLOCK(sp); 726 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 727 sppp_chap_input(sp, m); 728 } 729 m_freem(m); 730 return; 731 #ifdef INET 732 case PPP_IPCP: 733 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) { 734 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet " 735 "because IPCP is disabled\n"); 736 goto reject_protocol; 737 } 738 SPPP_UNLOCK(sp); 739 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 740 sppp_cp_input(&ipcp, sp, m); 741 /* already m_freem(m) */ 742 } else { 743 m_freem(m); 744 } 745 return; 746 case PPP_IP: 747 if (sp->scp[IDX_IPCP].state == STATE_OPENED) { 748 sp->pp_last_activity = time_uptime; 749 pktq = ip_pktq; 750 } 751 break; 752 #endif 753 #ifdef INET6 754 case PPP_IPV6CP: 755 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) { 756 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet " 757 "because IPv6CP is disabled\n"); 758 goto reject_protocol; 759 } 760 SPPP_UNLOCK(sp); 761 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 762 sppp_cp_input(&ipv6cp, sp, m); 763 /* already m_freem(m) */ 764 } else { 765 m_freem(m); 766 } 767 return; 768 769 case PPP_IPV6: 770 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) { 771 sp->pp_last_activity = time_uptime; 772 pktq = ip6_pktq; 773 } 774 break; 775 #endif 776 } 777 778 if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) { 779 goto drop; 780 } 781 782 /* Check queue. */ 783 if (__predict_true(pktq)) { 784 uint32_t hash = pktq_rps_hash(&sppp_pktq_rps_hash_p, m); 785 786 if (__predict_false(!pktq_enqueue(pktq, m, hash))) { 787 goto drop; 788 } 789 SPPP_UNLOCK(sp); 790 return; 791 } 792 793 SPPP_UNLOCK(sp); 794 795 IFQ_LOCK(inq); 796 if (IF_QFULL(inq)) { 797 /* Queue overflow. */ 798 IF_DROP(inq); 799 IFQ_UNLOCK(inq); 800 SPPP_DLOG(sp,"protocol queue overflow\n"); 801 SPPP_LOCK(sp, RW_READER); 802 goto drop; 803 } 804 IF_ENQUEUE(inq, m); 805 IFQ_UNLOCK(inq); 806 schednetisr(isr); 807 return; 808 809 drop: 810 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1); 811 m_freem(m); 812 SPPP_UNLOCK(sp); 813 return; 814 } 815 816 /* 817 * Enqueue transmit packet. 818 */ 819 static int 820 sppp_output(struct ifnet *ifp, struct mbuf *m, 821 const struct sockaddr *dst, const struct rtentry *rt) 822 { 823 struct sppp *sp = (struct sppp *) ifp; 824 struct ppp_header *h = NULL; 825 #ifndef SPPPSUBR_MPSAFE 826 struct ifqueue *ifq = NULL; /* XXX */ 827 #endif 828 int s, error = 0; 829 uint16_t protocol; 830 size_t pktlen; 831 832 s = splnet(); 833 SPPP_LOCK(sp, RW_READER); 834 835 sp->pp_last_activity = time_uptime; 836 837 if ((ifp->if_flags & IFF_UP) == 0 || 838 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 839 SPPP_UNLOCK(sp); 840 splx(s); 841 842 m_freem(m); 843 if_statinc(ifp, if_oerrors); 844 return (ENETDOWN); 845 } 846 847 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 848 /* ignore packets that have no enabled NCP */ 849 if ((dst->sa_family == AF_INET && 850 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) || 851 (dst->sa_family == AF_INET6 && 852 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) { 853 SPPP_UNLOCK(sp); 854 splx(s); 855 856 m_freem(m); 857 if_statinc(ifp, if_oerrors); 858 return (ENETDOWN); 859 } 860 /* 861 * Interface is not yet running, but auto-dial. Need 862 * to start LCP for it. 863 */ 864 ifp->if_flags |= IFF_RUNNING; 865 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 866 } 867 868 /* 869 * If the queueing discipline needs packet classification, 870 * do it before prepending link headers. 871 */ 872 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 873 874 #ifdef INET 875 if (dst->sa_family == AF_INET) { 876 struct ip *ip = NULL; 877 #ifndef SPPPSUBR_MPSAFE 878 struct tcphdr *th = NULL; 879 #endif 880 881 if (m->m_len >= sizeof(struct ip)) { 882 ip = mtod(m, struct ip *); 883 #ifndef SPPPSUBR_MPSAFE 884 if (ip->ip_p == IPPROTO_TCP && 885 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 886 sizeof(struct tcphdr)) { 887 th = (struct tcphdr *) 888 ((char *)ip + (ip->ip_hl << 2)); 889 } 890 #endif 891 } else 892 ip = NULL; 893 894 /* 895 * When using dynamic local IP address assignment by using 896 * 0.0.0.0 as a local address, the first TCP session will 897 * not connect because the local TCP checksum is computed 898 * using 0.0.0.0 which will later become our real IP address 899 * so the TCP checksum computed at the remote end will 900 * become invalid. So we 901 * - don't let packets with src ip addr 0 thru 902 * - we flag TCP packets with src ip 0 as an error 903 */ 904 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 905 uint8_t proto = ip->ip_p; 906 907 SPPP_UNLOCK(sp); 908 splx(s); 909 910 m_freem(m); 911 if (proto == IPPROTO_TCP) 912 return (EADDRNOTAVAIL); 913 else 914 return (0); 915 } 916 917 #ifndef SPPPSUBR_MPSAFE 918 /* 919 * Put low delay, telnet, rlogin and ftp control packets 920 * in front of the queue. 921 */ 922 if (!IF_QFULL(&sp->pp_fastq) && 923 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 924 (th && (INTERACTIVE(ntohs(th->th_sport)) || 925 INTERACTIVE(ntohs(th->th_dport)))))) 926 ifq = &sp->pp_fastq; 927 #endif /* !SPPPSUBR_MPSAFE */ 928 } 929 #endif 930 931 #ifdef INET6 932 if (dst->sa_family == AF_INET6) { 933 /* XXX do something tricky here? */ 934 } 935 #endif 936 937 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 938 /* 939 * Prepend general data packet PPP header. For now, IP only. 940 */ 941 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 942 if (! m) { 943 SPPP_DLOG(sp, "no memory for transmit header\n"); 944 if_statinc(ifp, if_oerrors); 945 SPPP_UNLOCK(sp); 946 splx(s); 947 return (ENOBUFS); 948 } 949 /* 950 * May want to check size of packet 951 * (albeit due to the implementation it's always enough) 952 */ 953 h = mtod(m, struct ppp_header *); 954 h->address = PPP_ALLSTATIONS; /* broadcast address */ 955 h->control = PPP_UI; /* Unnumbered Info */ 956 } 957 958 switch (dst->sa_family) { 959 #ifdef INET 960 case AF_INET: /* Internet Protocol */ 961 /* 962 * Don't choke with an ENETDOWN early. It's 963 * possible that we just started dialing out, 964 * so don't drop the packet immediately. If 965 * we notice that we run out of buffer space 966 * below, we will however remember that we are 967 * not ready to carry IP packets, and return 968 * ENETDOWN, as opposed to ENOBUFS. 969 */ 970 protocol = htons(PPP_IP); 971 if (sp->scp[IDX_IPCP].state != STATE_OPENED) { 972 if (ifp->if_flags & IFF_AUTO) { 973 error = ENETDOWN; 974 } else { 975 IF_DROP(&ifp->if_snd); 976 SPPP_UNLOCK(sp); 977 splx(s); 978 979 m_freem(m); 980 if_statinc(ifp, if_oerrors); 981 return (ENETDOWN); 982 } 983 } 984 break; 985 #endif 986 #ifdef INET6 987 case AF_INET6: /* Internet Protocol version 6 */ 988 /* 989 * Don't choke with an ENETDOWN early. It's 990 * possible that we just started dialing out, 991 * so don't drop the packet immediately. If 992 * we notice that we run out of buffer space 993 * below, we will however remember that we are 994 * not ready to carry IP packets, and return 995 * ENETDOWN, as opposed to ENOBUFS. 996 */ 997 protocol = htons(PPP_IPV6); 998 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) { 999 if (ifp->if_flags & IFF_AUTO) { 1000 error = ENETDOWN; 1001 } else { 1002 IF_DROP(&ifp->if_snd); 1003 SPPP_UNLOCK(sp); 1004 splx(s); 1005 1006 m_freem(m); 1007 if_statinc(ifp, if_oerrors); 1008 return (ENETDOWN); 1009 } 1010 } 1011 break; 1012 #endif 1013 default: 1014 m_freem(m); 1015 if_statinc(ifp, if_oerrors); 1016 SPPP_UNLOCK(sp); 1017 splx(s); 1018 return (EAFNOSUPPORT); 1019 } 1020 1021 if (sp->pp_flags & PP_NOFRAMING) { 1022 M_PREPEND(m, 2, M_DONTWAIT); 1023 if (m == NULL) { 1024 SPPP_DLOG(sp, "no memory for transmit header\n"); 1025 if_statinc(ifp, if_oerrors); 1026 SPPP_UNLOCK(sp); 1027 splx(s); 1028 return (ENOBUFS); 1029 } 1030 *mtod(m, uint16_t *) = protocol; 1031 } else { 1032 h->protocol = protocol; 1033 } 1034 1035 pktlen = m->m_pkthdr.len; 1036 #ifdef SPPPSUBR_MPSAFE 1037 SPPP_UNLOCK(sp); 1038 error = if_transmit_lock(ifp, m); 1039 SPPP_LOCK(sp, RW_READER); 1040 if (error == 0) 1041 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1042 #else /* !SPPPSUBR_MPSAFE */ 1043 error = ifq_enqueue2(ifp, ifq, m); 1044 1045 if (error == 0) { 1046 /* 1047 * Count output packets and bytes. 1048 * The packet length includes header + additional hardware 1049 * framing according to RFC 1333. 1050 */ 1051 if (!(ifp->if_flags & IFF_OACTIVE)) { 1052 SPPP_UNLOCK(sp); 1053 if_start_lock(ifp); 1054 SPPP_LOCK(sp, RW_READER); 1055 } 1056 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes); 1057 } 1058 #endif /* !SPPPSUBR_MPSAFE */ 1059 SPPP_UNLOCK(sp); 1060 splx(s); 1061 return error; 1062 } 1063 1064 void 1065 sppp_attach(struct ifnet *ifp) 1066 { 1067 struct sppp *sp = (struct sppp *) ifp; 1068 char xnamebuf[MAXCOMLEN]; 1069 1070 /* Initialize keepalive handler. */ 1071 if (! spppq) { 1072 callout_init(&keepalive_ch, CALLOUT_MPSAFE); 1073 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 1074 } 1075 1076 if (! spppq_lock) 1077 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET); 1078 1079 sp->pp_if.if_type = IFT_PPP; 1080 sp->pp_if.if_output = sppp_output; 1081 IFQ_SET_MAXLEN(&sp->pp_fastq, 32); 1082 IFQ_LOCK_INIT(&sp->pp_fastq); 1083 IFQ_SET_MAXLEN(&sp->pp_cpq, 20); 1084 sp->pp_loopcnt = 0; 1085 sp->pp_alivecnt = 0; 1086 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL; 1087 sp->pp_last_activity = 0; 1088 sp->pp_last_receive = 0; 1089 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 1090 sp->pp_max_noreceive = SPPP_NORECV_TIME; 1091 sp->pp_idle_timeout = 0; 1092 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 1093 sp->pp_phase = SPPP_PHASE_DEAD; 1094 sp->pp_up = sppp_notify_up; 1095 sp->pp_down = sppp_notify_down; 1096 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP; 1097 #ifdef SPPP_IFDOWN_RECONNECT 1098 sp->pp_flags |= PP_LOOPBACK_IFDOWN | PP_KEEPALIVE_IFDOWN; 1099 #endif 1100 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL); 1101 memset(sp->scp, 0, sizeof(sp->scp)); 1102 rw_init(&sp->pp_lock); 1103 1104 if_alloc_sadl(ifp); 1105 1106 /* Lets not beat about the bush, we know we're down. */ 1107 if_link_state_change(ifp, LINK_STATE_DOWN); 1108 1109 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname); 1110 sp->wq_cp = sppp_wq_create(sp, xnamebuf, 1111 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE); 1112 1113 memset(&sp->myauth, 0, sizeof sp->myauth); 1114 memset(&sp->hisauth, 0, sizeof sp->hisauth); 1115 SPPP_LOCK(sp, RW_WRITER); 1116 sppp_lcp_init(sp); 1117 sppp_ipcp_init(sp); 1118 sppp_ipv6cp_init(sp); 1119 sppp_pap_init(sp); 1120 sppp_chap_init(sp); 1121 SPPP_UNLOCK(sp); 1122 1123 SPPPQ_LOCK(); 1124 /* Insert new entry into the keepalive list. */ 1125 sp->pp_next = spppq; 1126 spppq = sp; 1127 SPPPQ_UNLOCK(); 1128 } 1129 1130 void 1131 sppp_detach(struct ifnet *ifp) 1132 { 1133 struct sppp **q, *p, *sp = (struct sppp *) ifp; 1134 1135 /* Remove the entry from the keepalive list. */ 1136 SPPPQ_LOCK(); 1137 for (q = &spppq; (p = *q); q = &p->pp_next) 1138 if (p == sp) { 1139 *q = p->pp_next; 1140 break; 1141 } 1142 SPPPQ_UNLOCK(); 1143 1144 if (! spppq) { 1145 /* Stop keepalive handler. */ 1146 callout_stop(&keepalive_ch); 1147 mutex_obj_free(spppq_lock); 1148 spppq_lock = NULL; 1149 } 1150 1151 sppp_cp_fini(&lcp, sp); 1152 sppp_cp_fini(&ipcp, sp); 1153 sppp_cp_fini(&pap, sp); 1154 sppp_cp_fini(&chap, sp); 1155 #ifdef INET6 1156 sppp_cp_fini(&ipv6cp, sp); 1157 #endif 1158 sppp_wq_destroy(sp, sp->wq_cp); 1159 1160 /* free authentication info */ 1161 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 1162 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 1163 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 1164 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 1165 1166 IFQ_LOCK_DESTROY(&sp->pp_fastq); 1167 rw_destroy(&sp->pp_lock); 1168 } 1169 1170 /* 1171 * Flush the interface output queue. 1172 */ 1173 void 1174 sppp_flush(struct ifnet *ifp) 1175 { 1176 struct sppp *sp = (struct sppp *) ifp; 1177 1178 SPPP_LOCK(sp, RW_WRITER); 1179 IFQ_PURGE(&sp->pp_if.if_snd); 1180 IF_PURGE(&sp->pp_fastq); 1181 IF_PURGE(&sp->pp_cpq); 1182 SPPP_UNLOCK(sp); 1183 } 1184 1185 /* 1186 * Check if the output queue is empty. 1187 */ 1188 int 1189 sppp_isempty(struct ifnet *ifp) 1190 { 1191 struct sppp *sp = (struct sppp *) ifp; 1192 int empty, s; 1193 1194 s = splnet(); 1195 SPPP_LOCK(sp, RW_READER); 1196 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1197 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1198 SPPP_UNLOCK(sp); 1199 splx(s); 1200 return (empty); 1201 } 1202 1203 /* 1204 * Get next packet to send. 1205 */ 1206 struct mbuf * 1207 sppp_dequeue(struct ifnet *ifp) 1208 { 1209 struct sppp *sp = (struct sppp *) ifp; 1210 struct mbuf *m; 1211 int s; 1212 1213 s = splnet(); 1214 SPPP_LOCK(sp, RW_WRITER); 1215 /* 1216 * Process only the control protocol queue until we have at 1217 * least one NCP open. 1218 * 1219 * Do always serve all three queues in Cisco mode. 1220 */ 1221 IF_DEQUEUE(&sp->pp_cpq, m); 1222 if (m == NULL && sppp_cp_check(sp, CP_NCP)) { 1223 IF_DEQUEUE(&sp->pp_fastq, m); 1224 if (m == NULL) 1225 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1226 } 1227 SPPP_UNLOCK(sp); 1228 splx(s); 1229 return m; 1230 } 1231 1232 /* 1233 * Process an ioctl request. Called on low priority level. 1234 */ 1235 int 1236 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1237 { 1238 struct lwp *l = curlwp; /* XXX */ 1239 struct ifreq *ifr = (struct ifreq *) data; 1240 struct ifaddr *ifa = (struct ifaddr *) data; 1241 struct sppp *sp = (struct sppp *) ifp; 1242 int s, error=0, going_up, going_down; 1243 u_short newmode; 1244 u_long lcp_mru; 1245 1246 s = splnet(); 1247 switch (cmd) { 1248 case SIOCINITIFADDR: 1249 ifa->ifa_rtrequest = p2p_rtrequest; 1250 break; 1251 1252 case SIOCSIFFLAGS: 1253 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1254 break; 1255 1256 SPPP_LOCK(sp, RW_WRITER); 1257 going_up = ifp->if_flags & IFF_UP && 1258 (ifp->if_flags & IFF_RUNNING) == 0; 1259 going_down = (ifp->if_flags & IFF_UP) == 0 && 1260 ifp->if_flags & IFF_RUNNING; 1261 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1262 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1263 /* sanity */ 1264 newmode = IFF_PASSIVE; 1265 ifp->if_flags &= ~IFF_AUTO; 1266 } 1267 1268 if (ifp->if_flags & IFF_UP) { 1269 sp->pp_flags |= PP_ADMIN_UP; 1270 } else { 1271 sp->pp_flags &= ~PP_ADMIN_UP; 1272 } 1273 1274 if (going_up || going_down) { 1275 sp->lcp.reestablish = false; 1276 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 1277 } 1278 if (going_up && newmode == 0) { 1279 /* neither auto-dial nor passive */ 1280 ifp->if_flags |= IFF_RUNNING; 1281 sppp_wq_add(sp->wq_cp, 1282 &sp->scp[IDX_LCP].work_open); 1283 } else if (going_down) { 1284 SPPP_UNLOCK(sp); 1285 sppp_flush(ifp); 1286 SPPP_LOCK(sp, RW_WRITER); 1287 1288 ifp->if_flags &= ~IFF_RUNNING; 1289 } 1290 SPPP_UNLOCK(sp); 1291 break; 1292 1293 case SIOCSIFMTU: 1294 if (ifr->ifr_mtu < PPP_MINMRU || 1295 ifr->ifr_mtu > PP_MTU) { 1296 error = EINVAL; 1297 break; 1298 } 1299 1300 error = ifioctl_common(ifp, cmd, data); 1301 if (error == ENETRESET) 1302 error = 0; 1303 1304 SPPP_LOCK(sp, RW_WRITER); 1305 lcp_mru = sp->lcp.mru; 1306 if (ifp->if_mtu < PP_MTU) { 1307 sp->lcp.mru = ifp->if_mtu; 1308 } else { 1309 sp->lcp.mru = PP_MTU; 1310 } 1311 if (lcp_mru != sp->lcp.mru) 1312 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 1313 1314 if (sp->scp[IDX_LCP].state == STATE_OPENED && 1315 ifp->if_mtu > sp->lcp.their_mru) { 1316 sp->pp_saved_mtu = ifp->if_mtu; 1317 ifp->if_mtu = sp->lcp.their_mru; 1318 1319 SPPP_DLOG(sp, "setting MTU " 1320 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 1321 sp->pp_saved_mtu, ifp->if_mtu); 1322 } 1323 SPPP_UNLOCK(sp); 1324 break; 1325 1326 case SIOCGIFMTU: 1327 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 1328 error = 0; 1329 break; 1330 case SIOCADDMULTI: 1331 case SIOCDELMULTI: 1332 break; 1333 1334 case SPPPSETAUTHCFG: 1335 case SPPPSETLCPCFG: 1336 case SPPPSETNCPCFG: 1337 case SPPPSETIDLETO: 1338 case SPPPSETAUTHFAILURE: 1339 case SPPPSETDNSOPTS: 1340 case SPPPSETKEEPALIVE: 1341 #if defined(COMPAT_50) || defined(MODULAR) 1342 case __SPPPSETIDLETO50: 1343 case __SPPPSETKEEPALIVE50: 1344 #endif /* COMPAT_50 || MODULAR */ 1345 error = kauth_authorize_network(l->l_cred, 1346 KAUTH_NETWORK_INTERFACE, 1347 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 1348 NULL); 1349 if (error) 1350 break; 1351 error = sppp_params(sp, cmd, data); 1352 break; 1353 1354 case SPPPGETAUTHCFG: 1355 case SPPPGETLCPCFG: 1356 case SPPPGETNCPCFG: 1357 case SPPPGETAUTHFAILURES: 1358 error = kauth_authorize_network(l->l_cred, 1359 KAUTH_NETWORK_INTERFACE, 1360 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 1361 NULL); 1362 if (error) 1363 break; 1364 error = sppp_params(sp, cmd, data); 1365 break; 1366 1367 case SPPPGETSTATUS: 1368 case SPPPGETSTATUSNCP: 1369 case SPPPGETIDLETO: 1370 case SPPPGETDNSOPTS: 1371 case SPPPGETDNSADDRS: 1372 case SPPPGETKEEPALIVE: 1373 #if defined(COMPAT_50) || defined(MODULAR) 1374 case __SPPPGETIDLETO50: 1375 case __SPPPGETKEEPALIVE50: 1376 #endif /* COMPAT_50 || MODULAR */ 1377 case SPPPGETLCPSTATUS: 1378 case SPPPGETIPCPSTATUS: 1379 case SPPPGETIPV6CPSTATUS: 1380 error = sppp_params(sp, cmd, data); 1381 break; 1382 1383 default: 1384 error = ifioctl_common(ifp, cmd, data); 1385 break; 1386 } 1387 splx(s); 1388 return (error); 1389 } 1390 1391 /* 1392 * PPP protocol implementation. 1393 */ 1394 1395 /* 1396 * Send PPP control protocol packet. 1397 */ 1398 static void 1399 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1400 u_char ident, u_short len, void *data) 1401 { 1402 struct ifnet *ifp; 1403 struct lcp_header *lh; 1404 struct mbuf *m; 1405 size_t pkthdrlen; 1406 1407 KASSERT(SPPP_WLOCKED(sp)); 1408 1409 ifp = &sp->pp_if; 1410 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1411 1412 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1413 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1414 MGETHDR(m, M_DONTWAIT, MT_DATA); 1415 if (! m) { 1416 return; 1417 } 1418 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1419 m_reset_rcvif(m); 1420 1421 if (sp->pp_flags & PP_NOFRAMING) { 1422 *mtod(m, uint16_t *) = htons(proto); 1423 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2); 1424 } else { 1425 struct ppp_header *h; 1426 h = mtod(m, struct ppp_header *); 1427 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1428 h->control = PPP_UI; /* Unnumbered Info */ 1429 h->protocol = htons(proto); /* Link Control Protocol */ 1430 lh = (struct lcp_header *)(h + 1); 1431 } 1432 lh->type = type; 1433 lh->ident = ident; 1434 lh->len = htons(LCP_HEADER_LEN + len); 1435 if (len) 1436 memcpy(lh + 1, data, len); 1437 1438 if (sppp_debug_enabled(sp)) { 1439 char pbuf[SPPP_PROTO_NAMELEN]; 1440 char tbuf[SPPP_CPTYPE_NAMELEN]; 1441 const char *pname, *cpname; 1442 1443 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto); 1444 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type); 1445 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 1446 pname, cpname, lh->ident, ntohs(lh->len)); 1447 if (len) 1448 sppp_print_bytes((u_char *)(lh + 1), len); 1449 addlog(">\n"); 1450 } 1451 if (IF_QFULL(&sp->pp_cpq)) { 1452 IF_DROP(&sp->pp_fastq); 1453 IF_DROP(&ifp->if_snd); 1454 m_freem(m); 1455 if_statinc(ifp, if_oerrors); 1456 return; 1457 } 1458 1459 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 1460 IF_ENQUEUE(&sp->pp_cpq, m); 1461 1462 if (! (ifp->if_flags & IFF_OACTIVE)) { 1463 SPPP_UNLOCK(sp); 1464 if_start_lock(ifp); 1465 SPPP_LOCK(sp, RW_WRITER); 1466 } 1467 } 1468 1469 static void 1470 sppp_cp_to_lcp(void *xsp) 1471 { 1472 struct sppp *sp = xsp; 1473 1474 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to); 1475 } 1476 1477 static void 1478 sppp_cp_to_ipcp(void *xsp) 1479 { 1480 struct sppp *sp = xsp; 1481 1482 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to); 1483 } 1484 1485 static void 1486 sppp_cp_to_ipv6cp(void *xsp) 1487 { 1488 struct sppp *sp = xsp; 1489 1490 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to); 1491 } 1492 1493 static void 1494 sppp_cp_to_pap(void *xsp) 1495 { 1496 struct sppp *sp = xsp; 1497 1498 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to); 1499 } 1500 1501 static void 1502 sppp_cp_to_chap(void *xsp) 1503 { 1504 struct sppp *sp = xsp; 1505 1506 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to); 1507 } 1508 1509 static void 1510 sppp_cp_init(const struct cp *cp, struct sppp *sp) 1511 { 1512 struct sppp_cp *scp; 1513 typedef void (*sppp_co_cb_t)(void *); 1514 static const sppp_co_cb_t to_cb[IDX_COUNT] = { 1515 [IDX_LCP] = sppp_cp_to_lcp, 1516 [IDX_IPCP] = sppp_cp_to_ipcp, 1517 [IDX_IPV6CP] = sppp_cp_to_ipv6cp, 1518 [IDX_PAP] = sppp_cp_to_pap, 1519 [IDX_CHAP] = sppp_cp_to_chap, 1520 }; 1521 1522 scp = &sp->scp[cp->protoidx]; 1523 scp->state = STATE_INITIAL; 1524 scp->fail_counter = 0; 1525 scp->seq = 0; 1526 scp->rseq = 0; 1527 1528 SPPP_WQ_SET(&scp->work_up, cp->Up, cp); 1529 SPPP_WQ_SET(&scp->work_down, cp->Down, cp); 1530 SPPP_WQ_SET(&scp->work_open, cp->Open, cp); 1531 SPPP_WQ_SET(&scp->work_close, cp->Close, cp); 1532 SPPP_WQ_SET(&scp->work_to, cp->TO, cp); 1533 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp); 1534 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp); 1535 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp); 1536 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp); 1537 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp); 1538 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp); 1539 1540 callout_init(&scp->ch, CALLOUT_MPSAFE); 1541 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp); 1542 } 1543 1544 static void 1545 sppp_cp_fini(const struct cp *cp, struct sppp *sp) 1546 { 1547 struct sppp_cp *scp; 1548 scp = &sp->scp[cp->protoidx]; 1549 1550 sppp_wq_wait(sp->wq_cp, &scp->work_up); 1551 sppp_wq_wait(sp->wq_cp, &scp->work_down); 1552 sppp_wq_wait(sp->wq_cp, &scp->work_open); 1553 sppp_wq_wait(sp->wq_cp, &scp->work_close); 1554 sppp_wq_wait(sp->wq_cp, &scp->work_to); 1555 sppp_wq_wait(sp->wq_cp, &scp->work_rcr); 1556 sppp_wq_wait(sp->wq_cp, &scp->work_rca); 1557 sppp_wq_wait(sp->wq_cp, &scp->work_rcn); 1558 sppp_wq_wait(sp->wq_cp, &scp->work_rtr); 1559 sppp_wq_wait(sp->wq_cp, &scp->work_rta); 1560 sppp_wq_wait(sp->wq_cp, &scp->work_rxj); 1561 1562 callout_halt(&scp->ch, NULL); 1563 callout_destroy(&scp->ch); 1564 1565 if (scp->mbuf_confreq != NULL) { 1566 m_freem(scp->mbuf_confreq); 1567 scp->mbuf_confreq = NULL; 1568 } 1569 if (scp->mbuf_confnak != NULL) { 1570 m_freem(scp->mbuf_confnak); 1571 scp->mbuf_confnak = NULL; 1572 } 1573 } 1574 1575 /* 1576 * Handle incoming PPP control protocol packets. 1577 */ 1578 static void 1579 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1580 { 1581 struct ifnet *ifp; 1582 struct lcp_header *h; 1583 struct sppp_cp *scp; 1584 int printlen, len = m->m_pkthdr.len; 1585 u_char *p; 1586 uint32_t u32; 1587 char tbuf[SPPP_CPTYPE_NAMELEN]; 1588 const char *cpname; 1589 bool debug; 1590 1591 SPPP_LOCK(sp, RW_WRITER); 1592 1593 ifp = &sp->pp_if; 1594 debug = sppp_debug_enabled(sp); 1595 scp = &sp->scp[cp->protoidx]; 1596 1597 if (len < 4) { 1598 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n", 1599 cp->name, len); 1600 goto out; 1601 } 1602 h = mtod(m, struct lcp_header *); 1603 if (debug) { 1604 printlen = ntohs(h->len); 1605 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1606 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d", 1607 cp->name, sppp_state_name(scp->state), 1608 cpname, h->ident, printlen); 1609 if (len < printlen) 1610 printlen = len; 1611 if (printlen > 4) 1612 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1613 addlog(">\n"); 1614 } 1615 if (len > ntohs(h->len)) 1616 len = ntohs(h->len); 1617 p = (u_char *)(h + 1); 1618 switch (h->type) { 1619 case CONF_REQ: 1620 if (len < 4) { 1621 SPPP_DLOG(sp,"%s invalid conf-req length %d\n", 1622 cp->name, len); 1623 if_statinc(ifp, if_ierrors); 1624 break; 1625 } 1626 1627 scp->rcr_type = CP_RCR_NONE; 1628 scp->rconfid = h->ident; 1629 if (scp->mbuf_confreq != NULL) { 1630 m_freem(scp->mbuf_confreq); 1631 } 1632 scp->mbuf_confreq = m; 1633 m = NULL; 1634 sppp_wq_add(sp->wq_cp, &scp->work_rcr); 1635 break; 1636 case CONF_ACK: 1637 if (h->ident != scp->confid) { 1638 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1639 cp->name, h->ident, scp->confid); 1640 if_statinc(ifp, if_ierrors); 1641 break; 1642 } 1643 sppp_wq_add(sp->wq_cp, &scp->work_rca); 1644 break; 1645 case CONF_NAK: 1646 case CONF_REJ: 1647 if (h->ident != scp->confid) { 1648 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 1649 cp->name, h->ident, scp->confid); 1650 if_statinc(ifp, if_ierrors); 1651 break; 1652 } 1653 1654 if (scp->mbuf_confnak) { 1655 m_freem(scp->mbuf_confnak); 1656 } 1657 scp->mbuf_confnak = m; 1658 m = NULL; 1659 sppp_wq_add(sp->wq_cp, &scp->work_rcn); 1660 break; 1661 case TERM_REQ: 1662 scp->rseq = h->ident; 1663 sppp_wq_add(sp->wq_cp, &scp->work_rtr); 1664 break; 1665 case TERM_ACK: 1666 if (h->ident != scp->confid && 1667 h->ident != scp->seq) { 1668 SPPP_DLOG(sp, "%s id mismatch " 1669 "0x%x != 0x%x and 0x%x != %0lx\n", 1670 cp->name, h->ident, scp->confid, 1671 h->ident, scp->seq); 1672 if_statinc(ifp, if_ierrors); 1673 break; 1674 } 1675 1676 sppp_wq_add(sp->wq_cp, &scp->work_rta); 1677 break; 1678 case CODE_REJ: 1679 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1680 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1681 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, " 1682 "danger will robinson\n", cp->name, cpname); 1683 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1684 break; 1685 case PROTO_REJ: 1686 { 1687 int catastrophic; 1688 const struct cp *upper; 1689 int i; 1690 uint16_t proto; 1691 1692 catastrophic = 0; 1693 upper = NULL; 1694 proto = p[0] << 8 | p[1]; 1695 for (i = 0; i < IDX_COUNT; i++) { 1696 if (cps[i]->proto == proto) { 1697 upper = cps[i]; 1698 break; 1699 } 1700 } 1701 if (upper == NULL) 1702 catastrophic++; 1703 1704 if (debug) { 1705 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type); 1706 SPPP_LOG(sp, LOG_INFO, 1707 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1708 cp->name, catastrophic ? '-' : '+', 1709 cpname, proto, upper ? upper->name : "unknown", 1710 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?"); 1711 } 1712 1713 /* 1714 * if we got RXJ+ against conf-req, the peer does not implement 1715 * this particular protocol type. terminate the protocol. 1716 */ 1717 if (upper && !catastrophic) { 1718 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) { 1719 sppp_wq_add(sp->wq_cp, 1720 &sp->scp[upper->protoidx].work_close); 1721 break; 1722 } 1723 } 1724 sppp_wq_add(sp->wq_cp, &scp->work_rxj); 1725 break; 1726 } 1727 case DISC_REQ: 1728 if (cp->proto != PPP_LCP) 1729 goto illegal; 1730 /* Discard the packet. */ 1731 break; 1732 case ECHO_REQ: 1733 if (cp->proto != PPP_LCP) 1734 goto illegal; 1735 if (scp->state != STATE_OPENED) { 1736 SPPP_DLOG(sp, "lcp echo req but lcp closed\n"); 1737 if_statinc(ifp, if_ierrors); 1738 break; 1739 } 1740 if (len < 8) { 1741 SPPP_DLOG(sp, "invalid lcp echo request " 1742 "packet length: %d bytes\n", len); 1743 break; 1744 } 1745 memcpy(&u32, h + 1, sizeof u32); 1746 if (ntohl(u32) == sp->lcp.magic) { 1747 /* Line loopback mode detected. */ 1748 SPPP_DLOG(sp, "loopback\n"); 1749 1750 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 1751 sp->pp_flags |= PP_LOOPBACK; 1752 sppp_wq_add(sp->wq_cp, 1753 &sp->work_ifdown); 1754 } 1755 1756 /* Shut down the PPP link. */ 1757 sppp_wq_add(sp->wq_cp, 1758 &sp->scp[IDX_LCP].work_close); 1759 sppp_wq_add(sp->wq_cp, 1760 &sp->scp[IDX_LCP].work_open); 1761 break; 1762 } 1763 u32 = htonl(sp->lcp.magic); 1764 memcpy(h + 1, &u32, sizeof u32); 1765 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n"); 1766 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1767 h + 1); 1768 break; 1769 case ECHO_REPLY: 1770 if (cp->proto != PPP_LCP) 1771 goto illegal; 1772 if (h->ident != sp->lcp.echoid) { 1773 if_statinc(ifp, if_ierrors); 1774 break; 1775 } 1776 if (len < 8) { 1777 SPPP_DLOG(sp, "lcp invalid echo reply " 1778 "packet length: %d bytes\n", len); 1779 break; 1780 } 1781 SPPP_DLOG(sp, "lcp got echo rep\n"); 1782 memcpy(&u32, h + 1, sizeof u32); 1783 if (ntohl(u32) != sp->lcp.magic) 1784 sp->pp_alivecnt = 0; 1785 break; 1786 default: 1787 /* Unknown packet type -- send Code-Reject packet. */ 1788 illegal: 1789 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n", 1790 cp->name, h->type); 1791 sppp_cp_send(sp, cp->proto, CODE_REJ, 1792 ++scp->seq, m->m_pkthdr.len, h); 1793 if_statinc(ifp, if_ierrors); 1794 } 1795 1796 out: 1797 SPPP_UNLOCK(sp); 1798 if (m != NULL) 1799 m_freem(m); 1800 } 1801 1802 /* 1803 * The generic part of all Up/Down/Open/Close/TO event handlers. 1804 * Basically, the state transition handling in the automaton. 1805 */ 1806 static void 1807 sppp_up_event(struct sppp *sp, void *xcp) 1808 { 1809 const struct cp *cp = xcp; 1810 1811 KASSERT(SPPP_WLOCKED(sp)); 1812 KASSERT(!cpu_softintr_p()); 1813 1814 if ((cp->flags & CP_AUTH) != 0 && 1815 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1816 return; 1817 1818 SPPP_DLOG(sp, "%s up(%s)\n", cp->name, 1819 sppp_state_name(sp->scp[cp->protoidx].state)); 1820 1821 switch (sp->scp[cp->protoidx].state) { 1822 case STATE_INITIAL: 1823 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1824 break; 1825 case STATE_STARTING: 1826 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1827 (cp->scr)(sp); 1828 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1829 break; 1830 default: 1831 SPPP_LOG(sp, LOG_DEBUG, 1832 "%s illegal up in state %s\n", cp->name, 1833 sppp_state_name(sp->scp[cp->protoidx].state)); 1834 } 1835 } 1836 1837 static void 1838 sppp_down_event(struct sppp *sp, void *xcp) 1839 { 1840 const struct cp *cp = xcp; 1841 1842 KASSERT(SPPP_WLOCKED(sp)); 1843 KASSERT(!cpu_softintr_p()); 1844 1845 if ((cp->flags & CP_AUTH) != 0 && 1846 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1847 return; 1848 1849 SPPP_DLOG(sp, "%s down(%s)\n", cp->name, 1850 sppp_state_name(sp->scp[cp->protoidx].state)); 1851 1852 switch (sp->scp[cp->protoidx].state) { 1853 case STATE_CLOSED: 1854 case STATE_CLOSING: 1855 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1856 break; 1857 case STATE_STOPPED: 1858 (cp->tls)(cp, sp); 1859 /* fall through */ 1860 case STATE_STOPPING: 1861 case STATE_REQ_SENT: 1862 case STATE_ACK_RCVD: 1863 case STATE_ACK_SENT: 1864 sppp_cp_change_state(cp, sp, STATE_STARTING); 1865 break; 1866 case STATE_OPENED: 1867 (cp->tld)(sp); 1868 sppp_cp_change_state(cp, sp, STATE_STARTING); 1869 break; 1870 default: 1871 /* 1872 * a down event may be caused regardless 1873 * of state just in LCP case. 1874 */ 1875 if (cp->proto == PPP_LCP) 1876 break; 1877 1878 SPPP_LOG(sp, LOG_DEBUG, 1879 "%s illegal down in state %s\n", cp->name, 1880 sppp_state_name(sp->scp[cp->protoidx].state)); 1881 } 1882 } 1883 1884 static void 1885 sppp_open_event(struct sppp *sp, void *xcp) 1886 { 1887 const struct cp *cp = xcp; 1888 1889 KASSERT(SPPP_WLOCKED(sp)); 1890 KASSERT(!cpu_softintr_p()); 1891 1892 if ((cp->flags & CP_AUTH) != 0 && 1893 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1894 return; 1895 1896 SPPP_DLOG(sp, "%s open(%s)\n", cp->name, 1897 sppp_state_name(sp->scp[cp->protoidx].state)); 1898 1899 switch (sp->scp[cp->protoidx].state) { 1900 case STATE_INITIAL: 1901 sppp_cp_change_state(cp, sp, STATE_STARTING); 1902 (cp->tls)(cp, sp); 1903 break; 1904 case STATE_STARTING: 1905 break; 1906 case STATE_CLOSED: 1907 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 1908 sp->lcp.protos |= (1 << cp->protoidx); 1909 (cp->scr)(sp); 1910 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1911 break; 1912 case STATE_STOPPED: 1913 case STATE_STOPPING: 1914 case STATE_REQ_SENT: 1915 case STATE_ACK_RCVD: 1916 case STATE_ACK_SENT: 1917 case STATE_OPENED: 1918 break; 1919 case STATE_CLOSING: 1920 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1921 break; 1922 } 1923 } 1924 1925 static void 1926 sppp_close_event(struct sppp *sp, void *xcp) 1927 { 1928 const struct cp *cp = xcp; 1929 1930 KASSERT(SPPP_WLOCKED(sp)); 1931 KASSERT(!cpu_softintr_p()); 1932 1933 if ((cp->flags & CP_AUTH) != 0 && 1934 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE) 1935 return; 1936 1937 SPPP_DLOG(sp, "%s close(%s)\n", cp->name, 1938 sppp_state_name(sp->scp[cp->protoidx].state)); 1939 1940 switch (sp->scp[cp->protoidx].state) { 1941 case STATE_INITIAL: 1942 case STATE_CLOSED: 1943 case STATE_CLOSING: 1944 break; 1945 case STATE_STARTING: 1946 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1947 (cp->tlf)(cp, sp); 1948 break; 1949 case STATE_STOPPED: 1950 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1951 break; 1952 case STATE_STOPPING: 1953 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1954 break; 1955 case STATE_OPENED: 1956 (cp->tld)(sp); 1957 /* fall through */ 1958 case STATE_REQ_SENT: 1959 case STATE_ACK_RCVD: 1960 case STATE_ACK_SENT: 1961 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate; 1962 if ((cp->flags & CP_AUTH) == 0) { 1963 sppp_cp_send(sp, cp->proto, TERM_REQ, 1964 ++sp->scp[cp->protoidx].seq, 0, 0); 1965 } 1966 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1967 break; 1968 } 1969 } 1970 1971 static void 1972 sppp_to_event(struct sppp *sp, void *xcp) 1973 { 1974 const struct cp *cp = xcp; 1975 int s; 1976 1977 KASSERT(SPPP_WLOCKED(sp)); 1978 KASSERT(!cpu_softintr_p()); 1979 1980 s = splnet(); 1981 1982 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name, 1983 sppp_state_name(sp->scp[cp->protoidx].state), 1984 sp->scp[cp->protoidx].rst_counter); 1985 1986 if (--sp->scp[cp->protoidx].rst_counter < 0) 1987 /* TO- event */ 1988 switch (sp->scp[cp->protoidx].state) { 1989 case STATE_CLOSING: 1990 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1991 (cp->tlf)(cp, sp); 1992 break; 1993 case STATE_STOPPING: 1994 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1995 (cp->tlf)(cp, sp); 1996 break; 1997 case STATE_REQ_SENT: 1998 case STATE_ACK_RCVD: 1999 case STATE_ACK_SENT: 2000 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2001 (cp->tlf)(cp, sp); 2002 break; 2003 } 2004 else 2005 /* TO+ event */ 2006 switch (sp->scp[cp->protoidx].state) { 2007 case STATE_CLOSING: 2008 case STATE_STOPPING: 2009 if ((cp->flags & CP_AUTH) == 0) { 2010 sppp_cp_send(sp, cp->proto, TERM_REQ, 2011 ++sp->scp[cp->protoidx].seq, 0, 0); 2012 } 2013 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2014 break; 2015 case STATE_REQ_SENT: 2016 case STATE_ACK_RCVD: 2017 (cp->scr)(sp); 2018 /* sppp_cp_change_state() will restart the timer */ 2019 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2020 break; 2021 case STATE_ACK_SENT: 2022 (cp->scr)(sp); 2023 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2024 break; 2025 } 2026 2027 splx(s); 2028 } 2029 static void 2030 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp, 2031 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg) 2032 { 2033 struct ifnet *ifp; 2034 u_char ctype; 2035 2036 ifp = &sp->pp_if; 2037 2038 if (type == CP_RCR_ERR) { 2039 /* parse error, shut down */ 2040 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 2041 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2042 } else if (type == CP_RCR_ACK) { 2043 /* RCR+ event */ 2044 ctype = CONF_ACK; 2045 switch (sp->scp[cp->protoidx].state) { 2046 case STATE_OPENED: 2047 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2048 cp->tld(sp); 2049 cp->scr(sp); 2050 cp->screply(cp, sp, ctype, ident, msglen, msg); 2051 break; 2052 case STATE_REQ_SENT: 2053 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2054 /* fall through */ 2055 case STATE_ACK_SENT: 2056 cp->screply(cp, sp, ctype, ident, msglen, msg); 2057 break; 2058 case STATE_STOPPED: 2059 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2060 cp->scr(sp); 2061 cp->screply(cp, sp, ctype, ident, msglen, msg); 2062 break; 2063 case STATE_ACK_RCVD: 2064 sppp_cp_change_state(cp, sp, STATE_OPENED); 2065 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2066 cp->tlu(sp); 2067 cp->screply(cp, sp, ctype, ident, msglen, msg); 2068 break; 2069 case STATE_CLOSING: 2070 case STATE_STOPPING: 2071 break; 2072 case STATE_CLOSED: 2073 if ((cp->flags & CP_AUTH) == 0) { 2074 sppp_cp_send(sp, cp->proto, TERM_ACK, 2075 ident, 0, 0); 2076 } 2077 break; 2078 default: 2079 SPPP_LOG(sp, LOG_DEBUG, 2080 "%s illegal RCR+ in state %s\n", cp->name, 2081 sppp_state_name(sp->scp[cp->protoidx].state)); 2082 if_statinc(ifp, if_ierrors); 2083 } 2084 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) { 2085 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ; 2086 /* RCR- event */ 2087 switch (sp->scp[cp->protoidx].state) { 2088 case STATE_OPENED: 2089 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2090 cp->tld(sp); 2091 cp->scr(sp); 2092 cp->screply(cp, sp, ctype, ident, msglen, msg); 2093 break; 2094 case STATE_ACK_SENT: 2095 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2096 /* fall through */ 2097 case STATE_REQ_SENT: 2098 cp->screply(cp, sp, ctype, ident, msglen, msg); 2099 break; 2100 case STATE_STOPPED: 2101 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2102 cp->scr(sp); 2103 cp->screply(cp, sp, ctype, ident, msglen, msg); 2104 break; 2105 case STATE_ACK_RCVD: 2106 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2107 cp->screply(cp, sp, ctype, ident, msglen, msg); 2108 break; 2109 case STATE_CLOSING: 2110 case STATE_STOPPING: 2111 break; 2112 case STATE_CLOSED: 2113 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2114 if ((cp->flags & CP_AUTH) == 0) { 2115 sppp_cp_send(sp, cp->proto, TERM_ACK, 2116 ident, 0, 0); 2117 } 2118 break; 2119 default: 2120 SPPP_LOG(sp, LOG_DEBUG, 2121 "%s illegal RCR- in state %s\n", cp->name, 2122 sppp_state_name(sp->scp[cp->protoidx].state)); 2123 if_statinc(ifp, if_ierrors); 2124 } 2125 } 2126 } 2127 2128 static void 2129 sppp_rcr_event(struct sppp *sp, void *xcp) 2130 { 2131 const struct cp *cp = xcp; 2132 struct sppp_cp *scp; 2133 struct lcp_header *h; 2134 struct mbuf *m; 2135 enum cp_rcr_type type; 2136 size_t len; 2137 uint8_t *buf; 2138 size_t blen, rlen; 2139 uint8_t ident; 2140 2141 KASSERT(!cpu_softintr_p()); 2142 2143 scp = &sp->scp[cp->protoidx]; 2144 2145 if (cp->parse_confreq != NULL) { 2146 m = scp->mbuf_confreq; 2147 if (m == NULL) 2148 return; 2149 scp->mbuf_confreq = NULL; 2150 2151 h = mtod(m, struct lcp_header *); 2152 if (h->type != CONF_REQ) { 2153 m_freem(m); 2154 return; 2155 } 2156 2157 ident = h->ident; 2158 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2159 2160 type = (cp->parse_confreq)(sp, h, len, 2161 &buf, &blen, &rlen); 2162 m_freem(m); 2163 } else { 2164 /* mbuf_cofreq is already parsed and freed */ 2165 type = scp->rcr_type; 2166 ident = scp->rconfid; 2167 buf = NULL; 2168 blen = rlen = 0; 2169 } 2170 2171 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf); 2172 2173 if (buf != NULL) 2174 kmem_free(buf, blen); 2175 } 2176 2177 static void 2178 sppp_rca_event(struct sppp *sp, void *xcp) 2179 { 2180 struct ifnet *ifp; 2181 const struct cp *cp = xcp; 2182 2183 KASSERT(!cpu_softintr_p()); 2184 2185 ifp = &sp->pp_if; 2186 2187 switch (sp->scp[cp->protoidx].state) { 2188 case STATE_CLOSED: 2189 case STATE_STOPPED: 2190 if ((cp->flags & CP_AUTH) == 0) { 2191 sppp_cp_send(sp, cp->proto, TERM_ACK, 2192 sp->scp[cp->protoidx].rconfid, 0, 0); 2193 } 2194 break; 2195 case STATE_CLOSING: 2196 case STATE_STOPPING: 2197 break; 2198 case STATE_REQ_SENT: 2199 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2200 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2201 break; 2202 case STATE_OPENED: 2203 (cp->tld)(sp); 2204 /* fall through */ 2205 case STATE_ACK_RCVD: 2206 (cp->scr)(sp); 2207 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2208 break; 2209 case STATE_ACK_SENT: 2210 sppp_cp_change_state(cp, sp, STATE_OPENED); 2211 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure; 2212 SPPP_DLOG(sp, "%s tlu\n", cp->name); 2213 (cp->tlu)(sp); 2214 break; 2215 default: 2216 SPPP_LOG(sp, LOG_DEBUG, 2217 "%s illegal RCA in state %s\n", cp->name, 2218 sppp_state_name(sp->scp[cp->protoidx].state)); 2219 if_statinc(ifp, if_ierrors); 2220 } 2221 } 2222 2223 static void 2224 sppp_rcn_event(struct sppp *sp, void *xcp) 2225 { 2226 const struct cp *cp = xcp; 2227 struct sppp_cp *scp; 2228 struct lcp_header *h; 2229 struct mbuf *m; 2230 struct ifnet *ifp = &sp->pp_if; 2231 size_t len; 2232 2233 KASSERT(!cpu_softintr_p()); 2234 2235 scp = &sp->scp[cp->protoidx]; 2236 m = scp->mbuf_confnak; 2237 if (m == NULL) 2238 return; 2239 scp->mbuf_confnak = NULL; 2240 2241 h = mtod(m, struct lcp_header *); 2242 len = MIN(m->m_pkthdr.len, ntohs(h->len)); 2243 2244 switch (h->type) { 2245 case CONF_NAK: 2246 (cp->parse_confnak)(sp, h, len); 2247 break; 2248 case CONF_REJ: 2249 (cp->parse_confrej)(sp, h, len); 2250 break; 2251 default: 2252 m_freem(m); 2253 return; 2254 } 2255 2256 m_freem(m); 2257 2258 switch (scp->state) { 2259 case STATE_CLOSED: 2260 case STATE_STOPPED: 2261 if ((cp->flags & CP_AUTH) == 0) { 2262 sppp_cp_send(sp, cp->proto, TERM_ACK, 2263 scp->rconfid, 0, 0); 2264 } 2265 break; 2266 case STATE_REQ_SENT: 2267 case STATE_ACK_SENT: 2268 scp->rst_counter = sp->lcp.max_configure; 2269 (cp->scr)(sp); 2270 break; 2271 case STATE_OPENED: 2272 (cp->tld)(sp); 2273 /* fall through */ 2274 case STATE_ACK_RCVD: 2275 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 2276 (cp->scr)(sp); 2277 break; 2278 case STATE_CLOSING: 2279 case STATE_STOPPING: 2280 break; 2281 default: 2282 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n", 2283 cp->name, sppp_state_name(scp->state)); 2284 if_statinc(ifp, if_ierrors); 2285 } 2286 } 2287 2288 static void 2289 sppp_rtr_event(struct sppp *sp, void *xcp) 2290 { 2291 struct ifnet *ifp; 2292 const struct cp *cp = xcp; 2293 2294 KASSERT(!cpu_softintr_p()); 2295 2296 ifp = &sp->pp_if; 2297 2298 switch (sp->scp[cp->protoidx].state) { 2299 case STATE_ACK_RCVD: 2300 case STATE_ACK_SENT: 2301 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2302 break; 2303 case STATE_CLOSED: 2304 case STATE_STOPPED: 2305 case STATE_CLOSING: 2306 case STATE_STOPPING: 2307 case STATE_REQ_SENT: 2308 break; 2309 case STATE_OPENED: 2310 (cp->tld)(sp); 2311 sp->scp[cp->protoidx].rst_counter = 0; 2312 sppp_cp_change_state(cp, sp, STATE_STOPPING); 2313 break; 2314 default: 2315 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n", 2316 cp->name, 2317 sppp_state_name(sp->scp[cp->protoidx].state)); 2318 if_statinc(ifp, if_ierrors); 2319 return; 2320 } 2321 2322 /* Send Terminate-Ack packet. */ 2323 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name); 2324 if ((cp->flags & CP_AUTH) == 0) { 2325 sppp_cp_send(sp, cp->proto, TERM_ACK, 2326 sp->scp[cp->protoidx].rseq, 0, 0); 2327 } 2328 } 2329 2330 static void 2331 sppp_rta_event(struct sppp *sp, void *xcp) 2332 { 2333 const struct cp *cp = xcp; 2334 struct ifnet *ifp = &sp->pp_if; 2335 2336 KASSERT(!cpu_softintr_p()); 2337 2338 switch (sp->scp[cp->protoidx].state) { 2339 case STATE_CLOSED: 2340 case STATE_STOPPED: 2341 case STATE_REQ_SENT: 2342 case STATE_ACK_SENT: 2343 break; 2344 case STATE_CLOSING: 2345 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2346 (cp->tlf)(cp, sp); 2347 break; 2348 case STATE_STOPPING: 2349 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2350 (cp->tlf)(cp, sp); 2351 break; 2352 case STATE_ACK_RCVD: 2353 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2354 break; 2355 case STATE_OPENED: 2356 (cp->tld)(sp); 2357 (cp->scr)(sp); 2358 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 2359 break; 2360 default: 2361 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n", 2362 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2363 if_statinc(ifp, if_ierrors); 2364 } 2365 } 2366 2367 static void 2368 sppp_rxj_event(struct sppp *sp, void *xcp) 2369 { 2370 const struct cp *cp = xcp; 2371 struct ifnet *ifp = &sp->pp_if; 2372 2373 KASSERT(!cpu_softintr_p()); 2374 2375 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 2376 switch (sp->scp[cp->protoidx].state) { 2377 case STATE_CLOSED: 2378 case STATE_STOPPED: 2379 case STATE_REQ_SENT: 2380 case STATE_ACK_SENT: 2381 case STATE_CLOSING: 2382 case STATE_STOPPING: 2383 case STATE_OPENED: 2384 break; 2385 case STATE_ACK_RCVD: 2386 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2387 break; 2388 default: 2389 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n", 2390 cp->name, sppp_state_name(sp->scp[cp->protoidx].state)); 2391 if_statinc(ifp, if_ierrors); 2392 } 2393 } 2394 2395 /* 2396 * Change the state of a control protocol in the state automaton. 2397 * Takes care of starting/stopping the restart timer. 2398 */ 2399 void 2400 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2401 { 2402 2403 KASSERT(SPPP_WLOCKED(sp)); 2404 2405 sp->scp[cp->protoidx].state = newstate; 2406 callout_stop(&sp->scp[cp->protoidx].ch); 2407 switch (newstate) { 2408 case STATE_INITIAL: 2409 case STATE_STARTING: 2410 case STATE_CLOSED: 2411 case STATE_STOPPED: 2412 case STATE_OPENED: 2413 break; 2414 case STATE_CLOSING: 2415 case STATE_STOPPING: 2416 case STATE_REQ_SENT: 2417 case STATE_ACK_RCVD: 2418 case STATE_ACK_SENT: 2419 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 2420 break; 2421 } 2422 } 2423 2424 /* 2425 *--------------------------------------------------------------------------* 2426 * * 2427 * The LCP implementation. * 2428 * * 2429 *--------------------------------------------------------------------------* 2430 */ 2431 static void 2432 sppp_lcp_init(struct sppp *sp) 2433 { 2434 2435 KASSERT(SPPP_WLOCKED(sp)); 2436 2437 sppp_cp_init(&lcp, sp); 2438 2439 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2440 sp->lcp.magic = 0; 2441 sp->lcp.protos = 0; 2442 sp->lcp.max_terminate = 2; 2443 sp->lcp.max_configure = 10; 2444 sp->lcp.max_failure = 10; 2445 sp->lcp.tlf_sent = false; 2446 2447 /* 2448 * Initialize counters and timeout values. Note that we don't 2449 * use the 3 seconds suggested in RFC 1661 since we are likely 2450 * running on a fast link. XXX We should probably implement 2451 * the exponential backoff option. Note that these values are 2452 * relevant for all control protocols, not just LCP only. 2453 */ 2454 sp->lcp.timeout = 1 * hz; 2455 } 2456 2457 static void 2458 sppp_lcp_up(struct sppp *sp, void *xcp) 2459 { 2460 struct ifnet *ifp; 2461 const struct cp *cp = xcp; 2462 int pidx; 2463 2464 KASSERT(SPPP_WLOCKED(sp)); 2465 ifp = &sp->pp_if; 2466 2467 pidx = cp->protoidx; 2468 /* Initialize activity timestamp: opening a connection is an activity */ 2469 sp->pp_last_receive = sp->pp_last_activity = time_uptime; 2470 2471 /* 2472 * If this interface is passive or dial-on-demand, and we are 2473 * still in Initial state, it means we've got an incoming 2474 * call. Activate the interface. 2475 */ 2476 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2477 ifp->if_flags |= IFF_RUNNING; 2478 if (sp->scp[pidx].state == STATE_INITIAL) { 2479 SPPP_DLOG(sp, "Up event (incoming call)\n"); 2480 sp->pp_flags |= PP_CALLIN; 2481 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open); 2482 } else { 2483 SPPP_DLOG(sp, "Up event\n"); 2484 } 2485 } 2486 2487 sppp_up_event(sp, xcp); 2488 } 2489 2490 static void 2491 sppp_lcp_down(struct sppp *sp, void *xcp) 2492 { 2493 const struct cp *cp = xcp; 2494 struct ifnet *ifp; 2495 int pidx; 2496 2497 KASSERT(SPPP_WLOCKED(sp)); 2498 KASSERT(!cpu_softintr_p()); 2499 2500 ifp = &sp->pp_if; 2501 pidx = cp->protoidx; 2502 sppp_down_event(sp, xcp); 2503 2504 /* 2505 * We need to do tls to restart when a down event is caused 2506 * by the last tlf. 2507 */ 2508 if (sp->scp[pidx].state == STATE_STARTING && 2509 sp->lcp.tlf_sent) { 2510 cp->tls(cp, sp); 2511 sp->lcp.tlf_sent = false; 2512 } 2513 2514 SPPP_DLOG(sp, "Down event (carrier loss)\n"); 2515 2516 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2517 if (sp->lcp.reestablish) 2518 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 2519 } else { 2520 sp->pp_flags &= ~PP_CALLIN; 2521 if (sp->scp[pidx].state != STATE_INITIAL) 2522 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close); 2523 ifp->if_flags &= ~IFF_RUNNING; 2524 } 2525 sp->scp[pidx].fail_counter = 0; 2526 } 2527 2528 static void 2529 sppp_lcp_open(struct sppp *sp, void *xcp) 2530 { 2531 2532 KASSERT(SPPP_WLOCKED(sp)); 2533 KASSERT(!cpu_softintr_p()); 2534 2535 sp->lcp.reestablish = false; 2536 sp->scp[IDX_LCP].fail_counter = 0; 2537 2538 /* the interface was down while waiting for reconnection */ 2539 if ((sp->pp_flags & PP_ADMIN_UP) == 0) 2540 return; 2541 2542 if (sp->pp_if.if_mtu < PP_MTU) { 2543 sp->lcp.mru = sp->pp_if.if_mtu; 2544 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2545 } else { 2546 sp->lcp.mru = PP_MTU; 2547 } 2548 sp->lcp.their_mru = PP_MTU; 2549 2550 /* 2551 * If we are authenticator, negotiate LCP_AUTH 2552 */ 2553 if (sp->hisauth.proto != PPP_NOPROTO) 2554 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2555 else 2556 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 2557 sp->pp_flags &= ~PP_NEEDAUTH; 2558 sppp_open_event(sp, xcp); 2559 } 2560 2561 2562 /* 2563 * Analyze a configure request. Return true if it was agreeable, and 2564 * caused action sca, false if it has been rejected or nak'ed, and 2565 * caused action scn. (The return value is used to make the state 2566 * transition decision in the state automaton.) 2567 */ 2568 static enum cp_rcr_type 2569 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 2570 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 2571 { 2572 u_char *buf, *r, *p, l, blen; 2573 enum cp_rcr_type type; 2574 int len, rlen; 2575 uint32_t nmagic; 2576 u_short authproto; 2577 char lbuf[SPPP_LCPOPT_NAMELEN]; 2578 bool debug; 2579 2580 KASSERT(SPPP_WLOCKED(sp)); 2581 2582 debug = sppp_debug_enabled(sp); 2583 2584 if (origlen < sizeof(*h)) 2585 return CP_RCR_DROP; 2586 2587 origlen -= sizeof(*h); 2588 type = CP_RCR_NONE; 2589 type = 0; 2590 2591 if (origlen <= 0) 2592 return CP_RCR_DROP; 2593 else 2594 blen = origlen; 2595 2596 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 2597 if (buf == NULL) 2598 return CP_RCR_DROP; 2599 2600 if (debug) 2601 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:"); 2602 2603 /* pass 1: check for things that need to be rejected */ 2604 p = (void *)(h + 1); 2605 r = buf; 2606 rlen = 0; 2607 for (len = origlen; len > 1; len-= l, p += l) { 2608 l = p[1]; 2609 if (l == 0) 2610 break; 2611 2612 /* Sanity check option length */ 2613 if (l > len) { 2614 /* 2615 * Malicious option - drop immediately. 2616 * XXX Maybe we should just RXJ it? 2617 */ 2618 if (debug) 2619 addlog("\n"); 2620 2621 SPPP_LOG(sp, LOG_DEBUG, 2622 "received malicious LCP option 0x%02x, " 2623 "length 0x%02x, (len: 0x%02x) dropping.\n", 2624 p[0], l, len); 2625 type = CP_RCR_ERR; 2626 goto end; 2627 } 2628 if (debug) 2629 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2630 switch (p[0]) { 2631 case LCP_OPT_MAGIC: 2632 /* Magic number. */ 2633 /* fall through, both are same length */ 2634 case LCP_OPT_ASYNC_MAP: 2635 /* Async control character map. */ 2636 if (len >= 6 || l == 6) 2637 continue; 2638 if (debug) 2639 addlog(" [invalid]"); 2640 break; 2641 case LCP_OPT_MP_EID: 2642 if (len >= l && l >= 3) { 2643 switch (p[2]) { 2644 case 0: if (l==3+ 0) continue;break; 2645 case 2: if (l==3+ 4) continue;break; 2646 case 3: if (l==3+ 6) continue;break; 2647 case 6: if (l==3+16) continue;break; 2648 case 1: /* FALLTHROUGH */ 2649 case 4: if (l<=3+20) continue;break; 2650 case 5: if (l<=3+15) continue;break; 2651 /* XXX should it be default: continue;? */ 2652 } 2653 } 2654 if (debug) 2655 addlog(" [invalid class %d len %d]", p[2], l); 2656 break; 2657 case LCP_OPT_MP_SSNHF: 2658 if (len >= 2 && l == 2) { 2659 if (debug) 2660 addlog(" [rej]"); 2661 break; 2662 } 2663 if (debug) 2664 addlog(" [invalid]"); 2665 break; 2666 case LCP_OPT_MP_MRRU: 2667 /* Multilink maximum received reconstructed unit */ 2668 /* should be fall through, both are same length */ 2669 /* FALLTHROUGH */ 2670 case LCP_OPT_MRU: 2671 /* Maximum receive unit. */ 2672 if (len >= 4 && l == 4) 2673 continue; 2674 if (debug) 2675 addlog(" [invalid]"); 2676 break; 2677 case LCP_OPT_AUTH_PROTO: 2678 if (len < 4) { 2679 if (debug) 2680 addlog(" [invalid]"); 2681 break; 2682 } 2683 authproto = (p[2] << 8) + p[3]; 2684 if (authproto == PPP_CHAP && l != 5) { 2685 if (debug) 2686 addlog(" [invalid chap len]"); 2687 break; 2688 } 2689 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2690 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2691 sp->myauth.proto = authproto; 2692 } 2693 if (sp->myauth.proto == PPP_NOPROTO) { 2694 /* we are not configured to do auth */ 2695 if (debug) 2696 addlog(" [not configured]"); 2697 break; 2698 } 2699 /* 2700 * Remote want us to authenticate, remember this, 2701 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2702 * up. 2703 */ 2704 sp->pp_flags |= PP_NEEDAUTH; 2705 continue; 2706 default: 2707 /* Others not supported. */ 2708 if (debug) 2709 addlog(" [rej]"); 2710 break; 2711 } 2712 if (rlen + l > blen) { 2713 if (debug) 2714 addlog(" [overflow]"); 2715 continue; 2716 } 2717 /* Add the option to rejected list. */ 2718 memcpy(r, p, l); 2719 r += l; 2720 rlen += l; 2721 } 2722 2723 if (rlen > 0) { 2724 type = CP_RCR_REJ; 2725 goto end; 2726 } 2727 2728 if (debug) 2729 addlog("\n"); 2730 2731 /* 2732 * pass 2: check for option values that are unacceptable and 2733 * thus require to be nak'ed. 2734 */ 2735 if (debug) 2736 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:"); 2737 2738 p = (void *)(h + 1); 2739 r = buf; 2740 rlen = 0; 2741 for (len = origlen; len > 0; len -= l, p += l) { 2742 l = p[1]; 2743 if (l == 0) 2744 break; 2745 2746 if (debug) 2747 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2748 switch (p[0]) { 2749 case LCP_OPT_MAGIC: 2750 /* Magic number -- extract. */ 2751 nmagic = (uint32_t)p[2] << 24 | 2752 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 2753 if (nmagic != sp->lcp.magic) { 2754 if (debug) 2755 addlog(" 0x%x", nmagic); 2756 continue; 2757 } 2758 /* 2759 * Local and remote magics equal -- loopback? 2760 */ 2761 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2762 SPPP_DLOG(sp, "loopback\n"); 2763 sp->pp_loopcnt = 0; 2764 2765 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) { 2766 sp->pp_flags |= PP_LOOPBACK; 2767 sppp_wq_add(sp->wq_cp, 2768 &sp->work_ifdown); 2769 } 2770 2771 sppp_wq_add(sp->wq_cp, 2772 &sp->scp[IDX_LCP].work_close); 2773 sppp_wq_add(sp->wq_cp, 2774 &sp->scp[IDX_LCP].work_open); 2775 } else { 2776 if (debug) 2777 addlog(" [glitch]"); 2778 ++sp->pp_loopcnt; 2779 } 2780 /* 2781 * We negate our magic here, and NAK it. If 2782 * we see it later in an NAK packet, we 2783 * suggest a new one. 2784 */ 2785 nmagic = ~sp->lcp.magic; 2786 /* Gonna NAK it. */ 2787 p[2] = nmagic >> 24; 2788 p[3] = nmagic >> 16; 2789 p[4] = nmagic >> 8; 2790 p[5] = nmagic; 2791 break; 2792 2793 case LCP_OPT_ASYNC_MAP: 2794 /* 2795 * Async control character map -- just ignore it. 2796 * 2797 * Quote from RFC 1662, chapter 6: 2798 * To enable this functionality, synchronous PPP 2799 * implementations MUST always respond to the 2800 * Async-Control-Character-Map Configuration 2801 * Option with the LCP Configure-Ack. However, 2802 * acceptance of the Configuration Option does 2803 * not imply that the synchronous implementation 2804 * will do any ACCM mapping. Instead, all such 2805 * octet mapping will be performed by the 2806 * asynchronous-to-synchronous converter. 2807 */ 2808 continue; 2809 2810 case LCP_OPT_MRU: 2811 /* 2812 * Maximum receive unit. Always agreeable, 2813 * but ignored by now. 2814 */ 2815 sp->lcp.their_mru = p[2] * 256 + p[3]; 2816 if (debug) 2817 addlog(" %ld", sp->lcp.their_mru); 2818 continue; 2819 2820 case LCP_OPT_AUTH_PROTO: 2821 authproto = (p[2] << 8) + p[3]; 2822 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) { 2823 if (authproto == PPP_PAP || authproto == PPP_CHAP) 2824 sp->myauth.proto = authproto; 2825 } 2826 if (sp->myauth.proto == authproto) { 2827 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) { 2828 continue; 2829 } 2830 if (debug) 2831 addlog(" [chap without MD5]"); 2832 } else { 2833 if (debug) { 2834 char pbuf1[SPPP_PROTO_NAMELEN]; 2835 char pbuf2[SPPP_PROTO_NAMELEN]; 2836 const char *pname1, *pname2; 2837 2838 pname1 = sppp_proto_name(pbuf1, 2839 sizeof(pbuf1), sp->myauth.proto); 2840 pname2 = sppp_proto_name(pbuf2, 2841 sizeof(pbuf2), authproto); 2842 addlog(" [mine %s != his %s]", 2843 pname1, pname2); 2844 } 2845 } 2846 /* not agreed, nak */ 2847 if (sp->myauth.proto == PPP_CHAP) { 2848 l = 5; 2849 } else { 2850 l = 4; 2851 } 2852 2853 if (rlen + l > blen) { 2854 if (debug) 2855 addlog(" [overflow]"); 2856 continue; 2857 } 2858 2859 r[0] = LCP_OPT_AUTH_PROTO; 2860 r[1] = l; 2861 r[2] = sp->myauth.proto >> 8; 2862 r[3] = sp->myauth.proto & 0xff; 2863 if (sp->myauth.proto == PPP_CHAP) 2864 r[4] = CHAP_MD5; 2865 rlen += l; 2866 r += l; 2867 continue; 2868 case LCP_OPT_MP_EID: 2869 /* 2870 * Endpoint identification. 2871 * Always agreeable, 2872 * but ignored by now. 2873 */ 2874 if (debug) { 2875 addlog(" type %d", p[2]); 2876 sppp_print_bytes(p+3, p[1]-3); 2877 } 2878 continue; 2879 case LCP_OPT_MP_MRRU: 2880 /* 2881 * Maximum received reconstructed unit. 2882 * Always agreeable, 2883 * but ignored by now. 2884 */ 2885 sp->lcp.their_mrru = p[2] * 256 + p[3]; 2886 if (debug) 2887 addlog(" %ld", sp->lcp.their_mrru); 2888 continue; 2889 } 2890 if (rlen + l > blen) { 2891 if (debug) 2892 addlog(" [overflow]"); 2893 continue; 2894 } 2895 /* Add the option to nak'ed list. */ 2896 memcpy(r, p, l); 2897 r += l; 2898 rlen += l; 2899 } 2900 2901 if (rlen > 0) { 2902 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) { 2903 if (debug) 2904 addlog(" max_failure (%d) exceeded, ", 2905 sp->lcp.max_failure); 2906 type = CP_RCR_REJ; 2907 } else { 2908 type = CP_RCR_NAK; 2909 } 2910 } else { 2911 type = CP_RCR_ACK; 2912 rlen = origlen; 2913 memcpy(r, h + 1, rlen); 2914 sp->scp[IDX_LCP].fail_counter = 0; 2915 sp->pp_loopcnt = 0; 2916 } 2917 2918 end: 2919 if (debug) 2920 addlog("\n"); 2921 2922 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 2923 if (buf != NULL) 2924 kmem_intr_free(buf, blen); 2925 } else { 2926 *msgbuf = buf; 2927 *buflen = blen; 2928 *msglen = rlen; 2929 } 2930 2931 return type; 2932 } 2933 2934 /* 2935 * Analyze the LCP Configure-Reject option list, and adjust our 2936 * negotiation. 2937 */ 2938 static void 2939 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 2940 { 2941 u_char *p, l; 2942 bool debug; 2943 2944 KASSERT(SPPP_WLOCKED(sp)); 2945 2946 debug = sppp_debug_enabled(sp); 2947 2948 if (len <= sizeof(*h)) 2949 return; 2950 2951 len -= sizeof(*h); 2952 2953 if (debug) 2954 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:"); 2955 2956 p = (void *)(h + 1); 2957 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 2958 /* Sanity check option length */ 2959 if (l > len) { 2960 /* 2961 * Malicious option - drop immediately. 2962 * XXX Maybe we should just RXJ it? 2963 */ 2964 if (debug) 2965 addlog("\n"); 2966 2967 SPPP_LOG(sp, LOG_DEBUG, 2968 "received malicious LCP option, dropping.\n"); 2969 goto end; 2970 } 2971 if (debug) { 2972 char lbuf[SPPP_LCPOPT_NAMELEN]; 2973 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p)); 2974 } 2975 switch (p[0]) { 2976 case LCP_OPT_MAGIC: 2977 /* Magic number -- can't use it, use 0 */ 2978 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC); 2979 sp->lcp.magic = 0; 2980 break; 2981 case LCP_OPT_MRU: 2982 /* 2983 * We try to negotiate a lower MRU if the underlying 2984 * link's MTU is less than PP_MTU (e.g. PPPoE). If the 2985 * peer rejects this lower rate, fallback to the 2986 * default. 2987 */ 2988 if (!debug) { 2989 SPPP_LOG(sp, LOG_INFO, 2990 "peer rejected our MRU of " 2991 "%ld bytes. Defaulting to %d bytes\n", 2992 sp->lcp.mru, PP_MTU); 2993 } 2994 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU); 2995 sp->lcp.mru = PP_MTU; 2996 break; 2997 case LCP_OPT_AUTH_PROTO: 2998 /* 2999 * Peer doesn't want to authenticate himself, 3000 * deny unless this is a dialout call, and 3001 * SPPP_AUTHFLAG_NOCALLOUT is set. 3002 */ 3003 if ((sp->pp_flags & PP_CALLIN) == 0 && 3004 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 3005 if (debug) { 3006 addlog(" [don't insist on auth " 3007 "for callout]"); 3008 } 3009 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 3010 break; 3011 } 3012 if (debug) 3013 addlog("[access denied]\n"); 3014 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3015 break; 3016 } 3017 } 3018 if (debug) 3019 addlog("\n"); 3020 end: 3021 return; 3022 } 3023 3024 /* 3025 * Analyze the LCP Configure-NAK option list, and adjust our 3026 * negotiation. 3027 */ 3028 static void 3029 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3030 { 3031 u_char *p, l; 3032 uint32_t magic; 3033 bool debug; 3034 3035 KASSERT(SPPP_WLOCKED(sp)); 3036 3037 if (len <= sizeof(*h)) 3038 return; 3039 3040 debug = sppp_debug_enabled(sp); 3041 len -= sizeof(*h); 3042 3043 if (debug) 3044 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:"); 3045 3046 p = (void *)(h + 1); 3047 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) { 3048 /* Sanity check option length */ 3049 if (l > len) { 3050 /* 3051 * Malicious option - drop immediately. 3052 * XXX Maybe we should just RXJ it? 3053 */ 3054 if (debug) 3055 addlog("\n"); 3056 3057 SPPP_LOG(sp, LOG_DEBUG, 3058 "received malicious LCP option, dropping.\n"); 3059 goto end; 3060 } 3061 if (debug) { 3062 char lbuf[SPPP_LCPOPT_NAMELEN]; 3063 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p)); 3064 } 3065 switch (p[0]) { 3066 case LCP_OPT_MAGIC: 3067 /* Magic number -- renegotiate */ 3068 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) && 3069 len >= 6 && l == 6) { 3070 magic = (uint32_t)p[2] << 24 | 3071 (uint32_t)p[3] << 16 | p[4] << 8 | p[5]; 3072 /* 3073 * If the remote magic is our negated one, 3074 * this looks like a loopback problem. 3075 * Suggest a new magic to make sure. 3076 */ 3077 if (magic == ~sp->lcp.magic) { 3078 if (debug) 3079 addlog(" magic glitch"); 3080 sp->lcp.magic = cprng_fast32(); 3081 } else { 3082 sp->lcp.magic = magic; 3083 if (debug) 3084 addlog(" %d", magic); 3085 } 3086 } 3087 break; 3088 case LCP_OPT_MRU: 3089 /* 3090 * Peer wants to advise us to negotiate an MRU. 3091 * Agree on it if it's reasonable, or use 3092 * default otherwise. 3093 */ 3094 if (len >= 4 && l == 4) { 3095 u_int mru = p[2] * 256 + p[3]; 3096 if (debug) 3097 addlog(" %d", mru); 3098 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu) 3099 mru = sp->pp_if.if_mtu; 3100 sp->lcp.mru = mru; 3101 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU); 3102 } 3103 break; 3104 case LCP_OPT_AUTH_PROTO: 3105 /* 3106 * Peer doesn't like our authentication method, 3107 * deny. 3108 */ 3109 if (debug) 3110 addlog("[access denied]\n"); 3111 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3112 break; 3113 } 3114 } 3115 if (debug) 3116 addlog("\n"); 3117 end: 3118 return; 3119 } 3120 3121 static void 3122 sppp_lcp_tlu(struct sppp *sp) 3123 { 3124 struct ifnet *ifp; 3125 struct sppp_cp *scp; 3126 int i; 3127 bool going_up; 3128 3129 KASSERT(SPPP_WLOCKED(sp)); 3130 3131 ifp = &sp->pp_if; 3132 3133 /* unlock for IFNET_LOCK and if_up() */ 3134 SPPP_UNLOCK(sp); 3135 3136 if (! (ifp->if_flags & IFF_UP) && 3137 (ifp->if_flags & IFF_RUNNING)) { 3138 /* Coming out of loopback mode. */ 3139 going_up = true; 3140 if_up(ifp); 3141 } else { 3142 going_up = false; 3143 } 3144 3145 IFNET_LOCK(ifp); 3146 SPPP_LOCK(sp, RW_WRITER); 3147 3148 if (going_up) { 3149 if ((sp->pp_flags & PP_LOOPBACK) == 0) { 3150 SPPP_LOG(sp, LOG_DEBUG, 3151 "interface is going up, " 3152 "but no loopback packet is deteted\n"); 3153 } 3154 sp->pp_flags &= ~PP_LOOPBACK; 3155 } 3156 3157 if (ifp->if_mtu > sp->lcp.their_mru) { 3158 sp->pp_saved_mtu = ifp->if_mtu; 3159 ifp->if_mtu = sp->lcp.their_mru; 3160 SPPP_DLOG(sp, "setting MTU " 3161 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3162 sp->pp_saved_mtu, ifp->if_mtu); 3163 } 3164 IFNET_UNLOCK(ifp); 3165 3166 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) || 3167 (sp->pp_flags & PP_NEEDAUTH) != 0) 3168 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE); 3169 else 3170 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 3171 3172 3173 for (i = 0; i < IDX_COUNT; i++) { 3174 scp = &sp->scp[(cps[i])->protoidx]; 3175 3176 if (((cps[i])->flags & CP_LCP) == 0) 3177 sppp_wq_add(sp->wq_cp, &scp->work_up); 3178 3179 /* 3180 * Open all authentication protocols. This is even required 3181 * if we already proceeded to network phase, since it might be 3182 * that remote wants us to authenticate, so we might have to 3183 * send a PAP request. Undesired authentication protocols 3184 * don't do anything when they get an Open event. 3185 */ 3186 if ((cps[i])->flags & CP_AUTH) 3187 sppp_wq_add(sp->wq_cp, &scp->work_open); 3188 3189 /* Open all NCPs. */ 3190 if (sp->pp_phase == SPPP_PHASE_NETWORK && 3191 ((cps[i])->flags & CP_NCP) != 0) { 3192 sppp_wq_add(sp->wq_cp, &scp->work_open); 3193 } 3194 } 3195 3196 /* notify low-level driver of state change */ 3197 sppp_notify_chg_wlocked(sp); 3198 } 3199 3200 static void 3201 sppp_lcp_tld(struct sppp *sp) 3202 { 3203 struct ifnet *ifp; 3204 struct sppp_cp *scp; 3205 int i, phase; 3206 3207 KASSERT(SPPP_WLOCKED(sp)); 3208 3209 phase = sp->pp_phase; 3210 3211 sppp_change_phase(sp, SPPP_PHASE_TERMINATE); 3212 3213 if (sp->pp_saved_mtu > 0) { 3214 ifp = &sp->pp_if; 3215 3216 SPPP_UNLOCK(sp); 3217 IFNET_LOCK(ifp); 3218 SPPP_LOCK(sp, RW_WRITER); 3219 3220 SPPP_DLOG(sp, "setting MTU " 3221 "from %"PRIu64" bytes to %"PRIu64" bytes\n", 3222 ifp->if_mtu, sp->pp_saved_mtu); 3223 3224 ifp->if_mtu = sp->pp_saved_mtu; 3225 sp->pp_saved_mtu = 0; 3226 IFNET_UNLOCK(ifp); 3227 } 3228 3229 /* 3230 * Take upper layers down. We send the Down event first and 3231 * the Close second to prevent the upper layers from sending 3232 * ``a flurry of terminate-request packets'', as the RFC 3233 * describes it. 3234 */ 3235 for (i = 0; i < IDX_COUNT; i++) { 3236 scp = &sp->scp[(cps[i])->protoidx]; 3237 3238 if (((cps[i])->flags & CP_LCP) == 0) 3239 sppp_wq_add(sp->wq_cp, &scp->work_down); 3240 3241 if ((cps[i])->flags & CP_AUTH) { 3242 sppp_wq_add(sp->wq_cp, &scp->work_close); 3243 } 3244 3245 /* Close all NCPs. */ 3246 if (phase == SPPP_PHASE_NETWORK && 3247 ((cps[i])->flags & CP_NCP) != 0) { 3248 sppp_wq_add(sp->wq_cp, &scp->work_close); 3249 } 3250 } 3251 } 3252 3253 static void 3254 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp) 3255 { 3256 3257 KASSERT(SPPP_WLOCKED(sp)); 3258 3259 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH); 3260 3261 /* Notify lower layer if desired. */ 3262 sppp_notify_tls_wlocked(sp); 3263 sp->lcp.tlf_sent = false; 3264 } 3265 3266 static void 3267 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp) 3268 { 3269 3270 KASSERT(SPPP_WLOCKED(sp)); 3271 3272 sppp_change_phase(sp, SPPP_PHASE_DEAD); 3273 3274 /* Notify lower layer if desired. */ 3275 sppp_notify_tlf_wlocked(sp); 3276 3277 switch (sp->scp[IDX_LCP].state) { 3278 case STATE_CLOSED: 3279 case STATE_STOPPED: 3280 sp->lcp.tlf_sent = true; 3281 break; 3282 case STATE_INITIAL: 3283 default: 3284 /* just in case */ 3285 sp->lcp.tlf_sent = false; 3286 } 3287 } 3288 3289 static void 3290 sppp_lcp_scr(struct sppp *sp) 3291 { 3292 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 3293 int i = 0; 3294 u_short authproto; 3295 3296 KASSERT(SPPP_WLOCKED(sp)); 3297 3298 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) { 3299 if (! sp->lcp.magic) 3300 sp->lcp.magic = cprng_fast32(); 3301 opt[i++] = LCP_OPT_MAGIC; 3302 opt[i++] = 6; 3303 opt[i++] = sp->lcp.magic >> 24; 3304 opt[i++] = sp->lcp.magic >> 16; 3305 opt[i++] = sp->lcp.magic >> 8; 3306 opt[i++] = sp->lcp.magic; 3307 } 3308 3309 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) { 3310 opt[i++] = LCP_OPT_MRU; 3311 opt[i++] = 4; 3312 opt[i++] = sp->lcp.mru >> 8; 3313 opt[i++] = sp->lcp.mru; 3314 } 3315 3316 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) { 3317 authproto = sp->hisauth.proto; 3318 opt[i++] = LCP_OPT_AUTH_PROTO; 3319 opt[i++] = authproto == PPP_CHAP? 5: 4; 3320 opt[i++] = authproto >> 8; 3321 opt[i++] = authproto; 3322 if (authproto == PPP_CHAP) 3323 opt[i++] = CHAP_MD5; 3324 } 3325 3326 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq; 3327 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt); 3328 } 3329 3330 /* 3331 * Check the open NCPs, return true if at least one NCP is open. 3332 */ 3333 3334 static int 3335 sppp_cp_check(struct sppp *sp, u_char cp_flags) 3336 { 3337 int i, mask; 3338 3339 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 3340 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags) 3341 return 1; 3342 return 0; 3343 } 3344 3345 /* 3346 * Re-check the open NCPs and see if we should terminate the link. 3347 * Called by the NCPs during their tlf action handling. 3348 */ 3349 static void 3350 sppp_lcp_check_and_close(struct sppp *sp) 3351 { 3352 3353 KASSERT(SPPP_WLOCKED(sp)); 3354 3355 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 3356 /* don't bother, we are already going down */ 3357 return; 3358 } 3359 3360 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE && 3361 sppp_cp_check(sp, CP_AUTH)) 3362 return; 3363 3364 if (sp->pp_phase >= SPPP_PHASE_NETWORK && 3365 sppp_cp_check(sp, CP_NCP)) 3366 return; 3367 3368 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 3369 3370 if (sp->pp_max_auth_fail != 0 && 3371 sp->pp_auth_failures >= sp->pp_max_auth_fail) { 3372 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, " 3373 "not retrying again\n", sp->pp_auth_failures); 3374 3375 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 3376 sp->pp_if.if_flags &= ~IFF_RUNNING; 3377 } else { 3378 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open); 3379 } 3380 } 3381 3382 /* 3383 *--------------------------------------------------------------------------* 3384 * * 3385 * The IPCP implementation. * 3386 * * 3387 *--------------------------------------------------------------------------* 3388 */ 3389 3390 static void 3391 sppp_ipcp_init(struct sppp *sp) 3392 { 3393 3394 KASSERT(SPPP_WLOCKED(sp)); 3395 3396 sppp_cp_init(&ipcp, sp); 3397 3398 sp->ipcp.opts = 0; 3399 sp->ipcp.flags = 0; 3400 } 3401 3402 static void 3403 sppp_ipcp_open(struct sppp *sp, void *xcp) 3404 { 3405 uint32_t myaddr, hisaddr; 3406 3407 KASSERT(SPPP_WLOCKED(sp)); 3408 KASSERT(!cpu_softintr_p()); 3409 3410 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) 3411 return; 3412 3413 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3414 sp->ipcp.req_myaddr = 0; 3415 sp->ipcp.req_hisaddr = 0; 3416 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3417 3418 #ifdef INET 3419 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3420 #else 3421 myaddr = hisaddr = 0; 3422 #endif 3423 /* 3424 * If we don't have his address, this probably means our 3425 * interface doesn't want to talk IP at all. (This could 3426 * be the case if somebody wants to speak only IPX, for 3427 * example.) Don't open IPCP in this case. 3428 */ 3429 if (hisaddr == 0) { 3430 /* XXX this message should go away */ 3431 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n"); 3432 return; 3433 } 3434 3435 if (myaddr == 0) { 3436 /* 3437 * I don't have an assigned address, so i need to 3438 * negotiate my address. 3439 */ 3440 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3441 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3442 } 3443 if (hisaddr == 1) { 3444 /* 3445 * XXX - remove this hack! 3446 * remote has no valid address, we need to get one assigned. 3447 */ 3448 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3449 sp->ipcp.saved_hisaddr = htonl(hisaddr); 3450 } 3451 3452 if (sp->query_dns & 1) { 3453 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3454 } else { 3455 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3456 } 3457 3458 if (sp->query_dns & 2) { 3459 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3460 } else { 3461 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3462 } 3463 sppp_open_event(sp, xcp); 3464 } 3465 3466 static void 3467 sppp_ipcp_close(struct sppp *sp, void *xcp) 3468 { 3469 3470 KASSERT(SPPP_WLOCKED(sp)); 3471 KASSERT(!cpu_softintr_p()); 3472 3473 sppp_close_event(sp, xcp); 3474 3475 #ifdef INET 3476 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) { 3477 /* 3478 * Some address was dynamic, clear it again. 3479 */ 3480 sppp_clear_ip_addrs(sp); 3481 } 3482 #endif 3483 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 3484 } 3485 3486 /* 3487 * Analyze a configure request. Return true if it was agreeable, and 3488 * caused action sca, false if it has been rejected or nak'ed, and 3489 * caused action scn. (The return value is used to make the state 3490 * transition decision in the state automaton.) 3491 */ 3492 static enum cp_rcr_type 3493 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 3494 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 3495 { 3496 u_char *buf, *r, *p, l, blen; 3497 enum cp_rcr_type type; 3498 int rlen, len; 3499 uint32_t hisaddr, desiredaddr; 3500 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3501 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3502 const char *dq; 3503 bool debug; 3504 3505 KASSERT(SPPP_WLOCKED(sp)); 3506 3507 type = CP_RCR_NONE; 3508 origlen -= sizeof(*h); 3509 3510 if (origlen < 0) 3511 return CP_RCR_DROP; 3512 3513 debug = sppp_debug_enabled(sp); 3514 3515 /* 3516 * Make sure to allocate a buf that can at least hold a 3517 * conf-nak with an `address' option. We might need it below. 3518 */ 3519 blen = MAX(6, origlen); 3520 3521 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 3522 if (buf == NULL) 3523 return CP_RCR_DROP; 3524 3525 /* pass 1: see if we can recognize them */ 3526 if (debug) 3527 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:"); 3528 p = (void *)(h + 1); 3529 r = buf; 3530 rlen = 0; 3531 for (len = origlen; len > 1; len -= l, p += l) { 3532 l = p[1]; 3533 if (l == 0) 3534 break; 3535 3536 /* Sanity check option length */ 3537 if (l > len) { 3538 /* XXX should we just RXJ? */ 3539 if (debug) 3540 addlog("\n"); 3541 3542 SPPP_LOG(sp, LOG_DEBUG, 3543 " malicious IPCP option received, dropping\n"); 3544 type = CP_RCR_ERR; 3545 goto end; 3546 } 3547 if (debug) { 3548 addlog(" %s", 3549 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3550 } 3551 switch (p[0]) { 3552 #ifdef notyet 3553 case IPCP_OPT_COMPRESSION: 3554 if (len >= 6 && l >= 6) { 3555 /* correctly formed compress option */ 3556 continue; 3557 } 3558 if (debug) 3559 addlog(" [invalid]"); 3560 break; 3561 #endif 3562 case IPCP_OPT_ADDRESS: 3563 if (len >= 6 && l == 6) { 3564 /* correctly formed address option */ 3565 continue; 3566 } 3567 if (debug) 3568 addlog(" [invalid]"); 3569 break; 3570 default: 3571 /* Others not supported. */ 3572 if (debug) 3573 addlog(" [rej]"); 3574 break; 3575 } 3576 /* Add the option to rejected list. */ 3577 if (rlen + l > blen) { 3578 if (debug) 3579 addlog(" [overflow]"); 3580 continue; 3581 } 3582 memcpy(r, p, l); 3583 r += l; 3584 rlen += l; 3585 } 3586 3587 if (rlen > 0) { 3588 type = CP_RCR_REJ; 3589 goto end; 3590 } 3591 3592 if (debug) 3593 addlog("\n"); 3594 3595 /* pass 2: parse option values */ 3596 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 3597 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 3598 else 3599 #ifdef INET 3600 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 3601 #else 3602 hisaddr = 0; 3603 #endif 3604 if (debug) 3605 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:"); 3606 p = (void *)(h + 1); 3607 r = buf; 3608 rlen = 0; 3609 for (len = origlen; len > 1; len -= l, p += l) { 3610 l = p[1]; 3611 if (l == 0) 3612 break; 3613 3614 if (debug) { 3615 addlog(" %s", 3616 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3617 } 3618 switch (p[0]) { 3619 #ifdef notyet 3620 case IPCP_OPT_COMPRESSION: 3621 continue; 3622 #endif 3623 case IPCP_OPT_ADDRESS: 3624 desiredaddr = p[2] << 24 | p[3] << 16 | 3625 p[4] << 8 | p[5]; 3626 if (desiredaddr == hisaddr || 3627 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 3628 /* 3629 * Peer's address is same as our value, 3630 * this is agreeable. Gonna conf-ack 3631 * it. 3632 */ 3633 if (debug) { 3634 dq = sppp_dotted_quad(dqbuf, 3635 sizeof(dqbuf), hisaddr); 3636 addlog(" %s [ack]", dq); 3637 } 3638 /* record that we've seen it already */ 3639 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3640 sp->ipcp.req_hisaddr = desiredaddr; 3641 hisaddr = desiredaddr; 3642 continue; 3643 } 3644 /* 3645 * The address wasn't agreeable. This is either 3646 * he sent us 0.0.0.0, asking to assign him an 3647 * address, or he send us another address not 3648 * matching our value. Either case, we gonna 3649 * conf-nak it with our value. 3650 */ 3651 if (debug) { 3652 if (desiredaddr == 0) { 3653 addlog(" [addr requested]"); 3654 } else { 3655 dq = sppp_dotted_quad(dqbuf, 3656 sizeof(dqbuf), desiredaddr); 3657 addlog(" %s [not agreed]", dq); 3658 } 3659 } 3660 3661 p[2] = hisaddr >> 24; 3662 p[3] = hisaddr >> 16; 3663 p[4] = hisaddr >> 8; 3664 p[5] = hisaddr; 3665 break; 3666 } 3667 if (rlen + l > blen) { 3668 if (debug) 3669 addlog(" [overflow]"); 3670 continue; 3671 } 3672 /* Add the option to nak'ed list. */ 3673 memcpy(r, p, l); 3674 r += l; 3675 rlen += l; 3676 } 3677 3678 if (rlen > 0) { 3679 type = CP_RCR_NAK; 3680 } else { 3681 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) { 3682 /* 3683 * If we are about to conf-ack the request, but haven't seen 3684 * his address so far, gonna conf-nak it instead, with the 3685 * `address' option present and our idea of his address being 3686 * filled in there, to request negotiation of both addresses. 3687 * 3688 * XXX This can result in an endless req - nak loop if peer 3689 * doesn't want to send us his address. Q: What should we do 3690 * about it? XXX A: implement the max-failure counter. 3691 */ 3692 buf[0] = IPCP_OPT_ADDRESS; 3693 buf[1] = 6; 3694 buf[2] = hisaddr >> 24; 3695 buf[3] = hisaddr >> 16; 3696 buf[4] = hisaddr >> 8; 3697 buf[5] = hisaddr; 3698 rlen = 6; 3699 if (debug) 3700 addlog(" still need hisaddr"); 3701 type = CP_RCR_NAK; 3702 } else { 3703 type = CP_RCR_ACK; 3704 rlen = origlen; 3705 memcpy(r, h + 1, rlen); 3706 } 3707 } 3708 3709 end: 3710 if (debug) 3711 addlog("\n"); 3712 3713 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 3714 if (buf != NULL) 3715 kmem_intr_free(buf, blen); 3716 } else { 3717 *msgbuf = buf; 3718 *buflen = blen; 3719 *msglen = rlen; 3720 } 3721 3722 return type; 3723 } 3724 3725 /* 3726 * Analyze the IPCP Configure-Reject option list, and adjust our 3727 * negotiation. 3728 */ 3729 static void 3730 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len) 3731 { 3732 u_char *p, l; 3733 bool debug; 3734 3735 KASSERT(SPPP_WLOCKED(sp)); 3736 3737 if (len <= sizeof(*h)) 3738 return; 3739 3740 len -= sizeof(*h); 3741 debug = sppp_debug_enabled(sp); 3742 3743 if (debug) 3744 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:"); 3745 3746 p = (void *)(h + 1); 3747 for (; len > 1; len -= l, p += l) { 3748 l = p[1]; 3749 if (l == 0) 3750 break; 3751 3752 /* Sanity check option length */ 3753 if (l > len) { 3754 /* XXX should we just RXJ? */ 3755 if (debug) 3756 addlog("\n"); 3757 SPPP_LOG(sp, LOG_DEBUG, 3758 "malicious IPCP option received, dropping\n"); 3759 goto end; 3760 } 3761 if (debug) { 3762 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3763 addlog(" %s", 3764 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3765 } 3766 switch (p[0]) { 3767 case IPCP_OPT_ADDRESS: 3768 /* 3769 * Peer doesn't grok address option. This is 3770 * bad. XXX Should we better give up here? 3771 */ 3772 if (!debug) { 3773 SPPP_LOG(sp, LOG_ERR, 3774 "IPCP address option rejected\n"); 3775 } 3776 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3777 break; 3778 #ifdef notyet 3779 case IPCP_OPT_COMPRESS: 3780 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS); 3781 break; 3782 #endif 3783 case IPCP_OPT_PRIMDNS: 3784 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS); 3785 break; 3786 3787 case IPCP_OPT_SECDNS: 3788 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS); 3789 break; 3790 } 3791 } 3792 if (debug) 3793 addlog("\n"); 3794 end: 3795 return; 3796 } 3797 3798 /* 3799 * Analyze the IPCP Configure-NAK option list, and adjust our 3800 * negotiation. 3801 */ 3802 static void 3803 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len) 3804 { 3805 u_char *p, l; 3806 struct ifnet *ifp = &sp->pp_if; 3807 int debug = ifp->if_flags & IFF_DEBUG; 3808 uint32_t wantaddr; 3809 3810 KASSERT(SPPP_WLOCKED(sp)); 3811 3812 len -= sizeof(*h); 3813 3814 debug = sppp_debug_enabled(sp); 3815 3816 if (debug) 3817 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:"); 3818 3819 p = (void *)(h + 1); 3820 for (; len > 1; len -= l, p += l) { 3821 l = p[1]; 3822 if (l == 0) 3823 break; 3824 3825 /* Sanity check option length */ 3826 if (l > len) { 3827 /* XXX should we just RXJ? */ 3828 if (debug) 3829 addlog("\n"); 3830 SPPP_LOG(sp, LOG_DEBUG, 3831 "malicious IPCP option received, dropping\n"); 3832 return; 3833 } 3834 if (debug) { 3835 char ipbuf[SPPP_IPCPOPT_NAMELEN]; 3836 addlog(" %s", 3837 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p)); 3838 } 3839 switch (*p) { 3840 case IPCP_OPT_ADDRESS: 3841 /* 3842 * Peer doesn't like our local IP address. See 3843 * if we can do something for him. We'll drop 3844 * him our address then. 3845 */ 3846 if (len >= 6 && l == 6) { 3847 wantaddr = p[2] << 24 | p[3] << 16 | 3848 p[4] << 8 | p[5]; 3849 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS); 3850 if (debug) { 3851 char dqbuf[SPPP_DOTQUAD_BUFLEN]; 3852 const char *dq; 3853 3854 dq = sppp_dotted_quad(dqbuf, 3855 sizeof(dqbuf), wantaddr); 3856 addlog(" [wantaddr %s]", dq); 3857 } 3858 /* 3859 * When doing dynamic address assignment, 3860 * we accept his offer. Otherwise, we 3861 * ignore it and thus continue to negotiate 3862 * our already existing value. 3863 */ 3864 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3865 if (ntohl(wantaddr) != INADDR_ANY) { 3866 if (debug) 3867 addlog(" [agree]"); 3868 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3869 sp->ipcp.req_myaddr = wantaddr; 3870 } else { 3871 if (debug) 3872 addlog(" [not agreed]"); 3873 } 3874 } 3875 } 3876 break; 3877 3878 case IPCP_OPT_PRIMDNS: 3879 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) && 3880 len >= 6 && l == 6) { 3881 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3882 p[4] << 8 | p[5]; 3883 } 3884 break; 3885 3886 case IPCP_OPT_SECDNS: 3887 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) && 3888 len >= 6 && l == 6) { 3889 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3890 p[4] << 8 | p[5]; 3891 } 3892 break; 3893 #ifdef notyet 3894 case IPCP_OPT_COMPRESS: 3895 /* 3896 * Peer wants different compression parameters. 3897 */ 3898 break; 3899 #endif 3900 } 3901 } 3902 if (debug) 3903 addlog("\n"); 3904 } 3905 3906 static void 3907 sppp_ipcp_tlu(struct sppp *sp) 3908 { 3909 #ifdef INET 3910 struct ifnet *ifp; 3911 3912 KASSERT(SPPP_WLOCKED(sp)); 3913 3914 SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n"); 3915 ifp = &sp->pp_if; 3916 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 3917 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) { 3918 SPPP_LOG(sp, LOG_WARNING, 3919 "no IP address, closing IPCP\n"); 3920 sppp_wq_add(sp->wq_cp, 3921 &sp->scp[IDX_IPCP].work_close); 3922 } else { 3923 /* we are up. Set addresses and notify anyone interested */ 3924 sppp_set_ip_addrs(sp); 3925 rt_ifmsg(ifp); 3926 } 3927 #endif 3928 } 3929 3930 static void 3931 sppp_ipcp_tld(struct sppp *sp) 3932 { 3933 #ifdef INET 3934 struct ifnet *ifp; 3935 3936 KASSERT(SPPP_WLOCKED(sp)); 3937 3938 SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n"); 3939 ifp = &sp->pp_if; 3940 rt_ifmsg(ifp); 3941 #endif 3942 } 3943 3944 static void 3945 sppp_ipcp_scr(struct sppp *sp) 3946 { 3947 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3948 #ifdef INET 3949 uint32_t ouraddr; 3950 #endif 3951 int i = 0; 3952 3953 KASSERT(SPPP_WLOCKED(sp)); 3954 3955 #ifdef notyet 3956 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) { 3957 opt[i++] = IPCP_OPT_COMPRESSION; 3958 opt[i++] = 6; 3959 opt[i++] = 0; /* VJ header compression */ 3960 opt[i++] = 0x2d; /* VJ header compression */ 3961 opt[i++] = max_slot_id; 3962 opt[i++] = comp_slot_id; 3963 } 3964 #endif 3965 3966 #ifdef INET 3967 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) { 3968 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) { 3969 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3970 } else { 3971 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3972 } 3973 opt[i++] = IPCP_OPT_ADDRESS; 3974 opt[i++] = 6; 3975 opt[i++] = ouraddr >> 24; 3976 opt[i++] = ouraddr >> 16; 3977 opt[i++] = ouraddr >> 8; 3978 opt[i++] = ouraddr; 3979 } 3980 #endif 3981 3982 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) { 3983 opt[i++] = IPCP_OPT_PRIMDNS; 3984 opt[i++] = 6; 3985 opt[i++] = sp->dns_addrs[0] >> 24; 3986 opt[i++] = sp->dns_addrs[0] >> 16; 3987 opt[i++] = sp->dns_addrs[0] >> 8; 3988 opt[i++] = sp->dns_addrs[0]; 3989 } 3990 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) { 3991 opt[i++] = IPCP_OPT_SECDNS; 3992 opt[i++] = 6; 3993 opt[i++] = sp->dns_addrs[1] >> 24; 3994 opt[i++] = sp->dns_addrs[1] >> 16; 3995 opt[i++] = sp->dns_addrs[1] >> 8; 3996 opt[i++] = sp->dns_addrs[1]; 3997 } 3998 3999 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq; 4000 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt); 4001 } 4002 4003 /* 4004 *--------------------------------------------------------------------------* 4005 * * 4006 * The IPv6CP implementation. * 4007 * * 4008 *--------------------------------------------------------------------------* 4009 */ 4010 4011 #ifdef INET6 4012 static void 4013 sppp_ipv6cp_init(struct sppp *sp) 4014 { 4015 4016 KASSERT(SPPP_WLOCKED(sp)); 4017 4018 sppp_cp_init(&ipv6cp, sp); 4019 4020 sp->ipv6cp.opts = 0; 4021 sp->ipv6cp.flags = 0; 4022 } 4023 4024 static void 4025 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4026 { 4027 struct in6_addr myaddr, hisaddr; 4028 4029 KASSERT(SPPP_WLOCKED(sp)); 4030 KASSERT(!cpu_softintr_p()); 4031 4032 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) 4033 return; 4034 4035 #ifdef IPV6CP_MYIFID_DYN 4036 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 4037 #else 4038 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 4039 #endif 4040 4041 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 4042 /* 4043 * If we don't have our address, this probably means our 4044 * interface doesn't want to talk IPv6 at all. (This could 4045 * be the case if somebody wants to speak only IPX, for 4046 * example.) Don't open IPv6CP in this case. 4047 */ 4048 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 4049 /* XXX this message should go away */ 4050 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n"); 4051 return; 4052 } 4053 4054 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4055 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4056 sppp_open_event(sp, xcp); 4057 } 4058 4059 /* 4060 * Analyze a configure request. Return true if it was agreeable, and 4061 * caused action sca, false if it has been rejected or nak'ed, and 4062 * caused action scn. (The return value is used to make the state 4063 * transition decision in the state automaton.) 4064 */ 4065 static enum cp_rcr_type 4066 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen, 4067 uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4068 { 4069 u_char *buf, *r, *p, l, blen; 4070 int rlen, len; 4071 struct in6_addr myaddr, desiredaddr, suggestaddr; 4072 enum cp_rcr_type type; 4073 int ifidcount; 4074 int collision, nohisaddr; 4075 char ip6buf[INET6_ADDRSTRLEN]; 4076 char tbuf[SPPP_CPTYPE_NAMELEN]; 4077 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4078 const char *cpname; 4079 bool debug; 4080 4081 KASSERT(SPPP_WLOCKED(sp)); 4082 4083 debug = sppp_debug_enabled(sp); 4084 type = CP_RCR_NONE; 4085 origlen -= sizeof(*h); 4086 4087 if (origlen < 0) 4088 return CP_RCR_DROP; 4089 4090 /* 4091 * Make sure to allocate a buf that can at least hold a 4092 * conf-nak with an `address' option. We might need it below. 4093 */ 4094 blen = MAX(6, origlen); 4095 4096 buf = kmem_intr_alloc(blen, KM_NOSLEEP); 4097 if (buf == NULL) 4098 return CP_RCR_DROP; 4099 4100 /* pass 1: see if we can recognize them */ 4101 if (debug) 4102 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:"); 4103 p = (void *)(h + 1); 4104 r = buf; 4105 rlen = 0; 4106 ifidcount = 0; 4107 for (len = origlen; len > 1; len -= l, p += l) { 4108 l = p[1]; 4109 if (l == 0) 4110 break; 4111 4112 /* Sanity check option length */ 4113 if (l > len) { 4114 /* XXX just RXJ? */ 4115 if (debug) 4116 addlog("\n"); 4117 SPPP_LOG(sp, LOG_DEBUG, 4118 "received malicious IPCPv6 option, " 4119 "dropping\n"); 4120 type = CP_RCR_ERR; 4121 goto end; 4122 } 4123 if (debug) { 4124 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4125 sizeof(ipv6buf),*p)); 4126 } 4127 switch (p[0]) { 4128 case IPV6CP_OPT_IFID: 4129 if (len >= 10 && l == 10 && ifidcount == 0) { 4130 /* correctly formed address option */ 4131 ifidcount++; 4132 continue; 4133 } 4134 if (debug) 4135 addlog(" [invalid]"); 4136 break; 4137 #ifdef notyet 4138 case IPV6CP_OPT_COMPRESSION: 4139 if (len >= 4 && l >= 4) { 4140 /* correctly formed compress option */ 4141 continue; 4142 } 4143 if (debug) 4144 addlog(" [invalid]"); 4145 break; 4146 #endif 4147 default: 4148 /* Others not supported. */ 4149 if (debug) 4150 addlog(" [rej]"); 4151 break; 4152 } 4153 if (rlen + l > blen) { 4154 if (debug) 4155 addlog(" [overflow]"); 4156 continue; 4157 } 4158 /* Add the option to rejected list. */ 4159 memcpy(r, p, l); 4160 r += l; 4161 rlen += l; 4162 } 4163 4164 if (rlen > 0) { 4165 type = CP_RCR_REJ; 4166 goto end; 4167 } 4168 4169 if (debug) 4170 addlog("\n"); 4171 4172 /* pass 2: parse option values */ 4173 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4174 if (debug) 4175 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:"); 4176 p = (void *)(h + 1); 4177 r = buf; 4178 rlen = 0; 4179 type = CP_RCR_ACK; 4180 for (len = origlen; len > 1; len -= l, p += l) { 4181 l = p[1]; 4182 if (l == 0) 4183 break; 4184 4185 if (debug) { 4186 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4187 sizeof(ipv6buf), *p)); 4188 } 4189 switch (p[0]) { 4190 #ifdef notyet 4191 case IPV6CP_OPT_COMPRESSION: 4192 continue; 4193 #endif 4194 case IPV6CP_OPT_IFID: 4195 memset(&desiredaddr, 0, sizeof(desiredaddr)); 4196 memcpy(&desiredaddr.s6_addr[8], &p[2], 8); 4197 collision = (memcmp(&desiredaddr.s6_addr[8], 4198 &myaddr.s6_addr[8], 8) == 0); 4199 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 4200 4201 desiredaddr.s6_addr16[0] = htons(0xfe80); 4202 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL); 4203 4204 if (!collision && !nohisaddr) { 4205 /* no collision, hisaddr known - Conf-Ack */ 4206 type = CP_RCR_ACK; 4207 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8], 4208 sizeof(sp->ipv6cp.my_ifid)); 4209 memcpy(sp->ipv6cp.his_ifid, 4210 &desiredaddr.s6_addr[8], 4211 sizeof(sp->ipv6cp.my_ifid)); 4212 4213 if (debug) { 4214 cpname = sppp_cp_type_name(tbuf, 4215 sizeof(tbuf), CONF_ACK); 4216 addlog(" %s [%s]", 4217 IN6_PRINT(ip6buf, &desiredaddr), 4218 cpname); 4219 } 4220 continue; 4221 } 4222 4223 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4224 if (collision && nohisaddr) { 4225 /* collision, hisaddr unknown - Conf-Rej */ 4226 type = CP_RCR_REJ; 4227 memset(&p[2], 0, 8); 4228 } else { 4229 /* 4230 * - no collision, hisaddr unknown, or 4231 * - collision, hisaddr known 4232 * Conf-Nak, suggest hisaddr 4233 */ 4234 type = CP_RCR_NAK; 4235 sppp_suggest_ip6_addr(sp, &suggestaddr); 4236 memcpy(&p[2], &suggestaddr.s6_addr[8], 8); 4237 } 4238 if (debug) { 4239 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK; 4240 4241 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4242 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr), 4243 cpname); 4244 } 4245 break; 4246 } 4247 if (rlen + l > blen) { 4248 if (debug) 4249 addlog(" [overflow]"); 4250 continue; 4251 } 4252 /* Add the option to nak'ed list. */ 4253 memcpy(r, p, l); 4254 r += l; 4255 rlen += l; 4256 } 4257 4258 if (rlen > 0) { 4259 if (type != CP_RCR_ACK) { 4260 if (debug) { 4261 int ctype ; 4262 ctype = type == CP_RCR_REJ ? 4263 CONF_REJ : CONF_NAK; 4264 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype); 4265 addlog(" send %s suggest %s\n", 4266 cpname, IN6_PRINT(ip6buf, &suggestaddr)); 4267 } 4268 } 4269 #ifdef notdef 4270 if (type == CP_RCR_ACK) 4271 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 4272 #endif 4273 } else { 4274 if (type == CP_RCR_ACK) { 4275 rlen = origlen; 4276 memcpy(r, h + 1, rlen); 4277 } 4278 } 4279 end: 4280 if (debug) 4281 addlog("\n"); 4282 4283 if (type == CP_RCR_ERR || type == CP_RCR_DROP) { 4284 if (buf != NULL) 4285 kmem_intr_free(buf, blen); 4286 } else { 4287 *msgbuf = buf; 4288 *buflen = blen; 4289 *msglen = rlen; 4290 } 4291 4292 return type; 4293 } 4294 4295 /* 4296 * Analyze the IPv6CP Configure-Reject option list, and adjust our 4297 * negotiation. 4298 */ 4299 static void 4300 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len) 4301 { 4302 u_char *p, l; 4303 bool debug; 4304 4305 KASSERT(SPPP_WLOCKED(sp)); 4306 4307 if (len <= sizeof(*h)) 4308 return; 4309 4310 len -= sizeof(*h); 4311 debug = sppp_debug_enabled(sp); 4312 4313 if (debug) 4314 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:"); 4315 4316 p = (void *)(h + 1); 4317 for (; len > 1; len -= l, p += l) { 4318 l = p[1]; 4319 if (l == 0) 4320 break; 4321 4322 if (l > len) { 4323 /* XXX just RXJ? */ 4324 if (debug) 4325 addlog("\n"); 4326 SPPP_LOG(sp, LOG_DEBUG, 4327 "received malicious IPCPv6 option, " 4328 "dropping\n"); 4329 goto end; 4330 } 4331 if (debug) { 4332 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4333 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4334 sizeof(ipv6buf), *p)); 4335 } 4336 switch (p[0]) { 4337 case IPV6CP_OPT_IFID: 4338 /* 4339 * Peer doesn't grok address option. This is 4340 * bad. XXX Should we better give up here? 4341 */ 4342 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4343 break; 4344 #ifdef notyet 4345 case IPV6CP_OPT_COMPRESS: 4346 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS); 4347 break; 4348 #endif 4349 } 4350 } 4351 if (debug) 4352 addlog("\n"); 4353 end: 4354 return; 4355 } 4356 4357 /* 4358 * Analyze the IPv6CP Configure-NAK option list, and adjust our 4359 * negotiation. 4360 */ 4361 static void 4362 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len) 4363 { 4364 u_char *p, l; 4365 struct in6_addr suggestaddr; 4366 char ip6buf[INET6_ADDRSTRLEN]; 4367 bool debug; 4368 4369 KASSERT(SPPP_WLOCKED(sp)); 4370 4371 if (len <= sizeof(*h)) 4372 return; 4373 4374 len -= sizeof(*h); 4375 debug = sppp_debug_enabled(sp); 4376 4377 if (debug) 4378 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:"); 4379 4380 p = (void *)(h + 1); 4381 for (; len > 1; len -= l, p += l) { 4382 l = p[1]; 4383 if (l == 0) 4384 break; 4385 4386 if (l > len) { 4387 /* XXX just RXJ? */ 4388 if (debug) 4389 addlog("\n"); 4390 SPPP_LOG(sp, LOG_DEBUG, 4391 "received malicious IPCPv6 option, " 4392 "dropping\n"); 4393 goto end; 4394 } 4395 if (debug) { 4396 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN]; 4397 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf, 4398 sizeof(ipv6buf), *p)); 4399 } 4400 switch (p[0]) { 4401 case IPV6CP_OPT_IFID: 4402 /* 4403 * Peer doesn't like our local ifid. See 4404 * if we can do something for him. We'll drop 4405 * him our address then. 4406 */ 4407 if (len < 10 || l != 10) 4408 break; 4409 memset(&suggestaddr, 0, sizeof(suggestaddr)); 4410 suggestaddr.s6_addr16[0] = htons(0xfe80); 4411 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL); 4412 memcpy(&suggestaddr.s6_addr[8], &p[2], 8); 4413 4414 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID); 4415 if (debug) 4416 addlog(" [suggestaddr %s]", 4417 IN6_PRINT(ip6buf, &suggestaddr)); 4418 #ifdef IPV6CP_MYIFID_DYN 4419 /* 4420 * When doing dynamic address assignment, 4421 * we accept his offer. 4422 */ 4423 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 4424 struct in6_addr lastsuggest; 4425 /* 4426 * If <suggested myaddr from peer> equals to 4427 * <hisaddr we have suggested last time>, 4428 * we have a collision. generate new random 4429 * ifid. 4430 */ 4431 sppp_suggest_ip6_addr(&lastsuggest); 4432 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 4433 lastsuggest)) { 4434 if (debug) 4435 addlog(" [random]"); 4436 sppp_gen_ip6_addr(sp, &suggestaddr); 4437 } 4438 sppp_set_ip6_addr(sp, &suggestaddr, 0); 4439 if (debug) 4440 addlog(" [agree]"); 4441 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 4442 } 4443 #else 4444 /* 4445 * Since we do not do dynamic address assignment, 4446 * we ignore it and thus continue to negotiate 4447 * our already existing value. This can possibly 4448 * go into infinite request-reject loop. 4449 * 4450 * This is not likely because we normally use 4451 * ifid based on MAC-address. 4452 * If you have no ethernet card on the node, too bad. 4453 * XXX should we use fail_counter? 4454 */ 4455 #endif 4456 break; 4457 #ifdef notyet 4458 case IPV6CP_OPT_COMPRESS: 4459 /* 4460 * Peer wants different compression parameters. 4461 */ 4462 break; 4463 #endif 4464 } 4465 } 4466 if (debug) 4467 addlog("\n"); 4468 end: 4469 return; 4470 } 4471 4472 static void 4473 sppp_ipv6cp_tlu(struct sppp *sp) 4474 { 4475 struct ifnet *ifp; 4476 4477 KASSERT(SPPP_WLOCKED(sp)); 4478 4479 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n"); 4480 ifp = &sp->pp_if; 4481 /* we are up - notify isdn daemon */ 4482 sppp_notify_con_wlocked(sp); 4483 rt_ifmsg(ifp); 4484 } 4485 4486 static void 4487 sppp_ipv6cp_tld(struct sppp *sp) 4488 { 4489 struct ifnet *ifp; 4490 4491 KASSERT(SPPP_WLOCKED(sp)); 4492 4493 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n"); 4494 ifp = &sp->pp_if; 4495 rt_ifmsg(ifp); 4496 } 4497 4498 static void 4499 sppp_ipv6cp_scr(struct sppp *sp) 4500 { 4501 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 4502 struct in6_addr ouraddr; 4503 int i = 0; 4504 4505 KASSERT(SPPP_WLOCKED(sp)); 4506 4507 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) { 4508 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 4509 4510 opt[i++] = IPV6CP_OPT_IFID; 4511 opt[i++] = 10; 4512 memcpy(&opt[i], &ouraddr.s6_addr[8], 8); 4513 i += 8; 4514 } 4515 4516 #ifdef notyet 4517 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) { 4518 opt[i++] = IPV6CP_OPT_COMPRESSION; 4519 opt[i++] = 4; 4520 opt[i++] = 0; /* TBD */ 4521 opt[i++] = 0; /* TBD */ 4522 /* variable length data may follow */ 4523 } 4524 #endif 4525 4526 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq; 4527 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt); 4528 } 4529 #else /*INET6*/ 4530 static void 4531 sppp_ipv6cp_init(struct sppp *sp) 4532 { 4533 4534 KASSERT(SPPP_WLOCKED(sp)); 4535 } 4536 4537 static void 4538 sppp_ipv6cp_open(struct sppp *sp, void *xcp) 4539 { 4540 4541 KASSERT(SPPP_WLOCKED(sp)); 4542 } 4543 4544 static enum cp_rcr_type 4545 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, 4546 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen) 4547 { 4548 4549 KASSERT(SPPP_WLOCKED(sp)); 4550 return 0; 4551 } 4552 4553 static void 4554 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, 4555 int len) 4556 { 4557 4558 KASSERT(SPPP_WLOCKED(sp)); 4559 } 4560 4561 static void 4562 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, 4563 int len) 4564 { 4565 4566 KASSERT(SPPP_WLOCKED(sp)); 4567 } 4568 4569 static void 4570 sppp_ipv6cp_tlu(struct sppp *sp) 4571 { 4572 4573 KASSERT(SPPP_WLOCKED(sp)); 4574 } 4575 4576 static void 4577 sppp_ipv6cp_tld(struct sppp *sp) 4578 { 4579 4580 KASSERT(SPPP_WLOCKED(sp)); 4581 } 4582 4583 static void 4584 sppp_ipv6cp_scr(struct sppp *sp) 4585 { 4586 4587 KASSERT(SPPP_WLOCKED(sp)); 4588 } 4589 #endif /*INET6*/ 4590 4591 /* 4592 *--------------------------------------------------------------------------* 4593 * * 4594 * The CHAP implementation. * 4595 * * 4596 *--------------------------------------------------------------------------* 4597 */ 4598 /* 4599 * The authentication protocols is implemented on the state machine for 4600 * control protocols. And it uses following actions and events. 4601 * 4602 * Actions: 4603 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE 4604 * - sca: send CHAP_SUCCESS 4605 * - scn: send CHAP_FAILURE and shutdown lcp 4606 * Events: 4607 * - RCR+: receive CHAP_RESPONSE containing correct digest 4608 * - RCR-: receive CHAP_RESPONSE containing wrong digest 4609 * - RCA: receive CHAP_SUCCESS 4610 * - RCN: (this event is unused) 4611 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE 4612 * - TO-: this layer finish 4613 */ 4614 4615 /* 4616 * Handle incoming CHAP packets. 4617 */ 4618 void 4619 sppp_chap_input(struct sppp *sp, struct mbuf *m) 4620 { 4621 struct ifnet *ifp; 4622 struct lcp_header *h; 4623 int len, x; 4624 u_char *value, *name, digest[sizeof(sp->chap.challenge)]; 4625 int value_len, name_len; 4626 MD5_CTX ctx; 4627 char abuf[SPPP_AUTHTYPE_NAMELEN]; 4628 const char *authname; 4629 bool debug; 4630 4631 ifp = &sp->pp_if; 4632 debug = sppp_debug_enabled(sp); 4633 len = m->m_pkthdr.len; 4634 if (len < 4) { 4635 SPPP_DLOG(sp, "chap invalid packet length: " 4636 "%d bytes\n", len); 4637 return; 4638 } 4639 h = mtod(m, struct lcp_header *); 4640 if (len > ntohs(h->len)) 4641 len = ntohs(h->len); 4642 4643 SPPP_LOCK(sp, RW_WRITER); 4644 4645 switch (h->type) { 4646 /* challenge, failure and success are his authproto */ 4647 case CHAP_CHALLENGE: 4648 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4649 /* can't do anything useful */ 4650 sp->pp_auth_failures++; 4651 SPPP_DLOG(sp, "chap input " 4652 "without my name and my secret being set\n"); 4653 break; 4654 } 4655 value = 1 + (u_char *)(h + 1); 4656 value_len = value[-1]; 4657 name = value + value_len; 4658 name_len = len - value_len - 5; 4659 if (name_len < 0) { 4660 if (debug) { 4661 authname = sppp_auth_type_name(abuf, 4662 sizeof(abuf), PPP_CHAP, h->type); 4663 SPPP_LOG(sp, LOG_DEBUG, 4664 "chap corrupted challenge " 4665 "<%s id=0x%x len=%d", 4666 authname, h->ident, ntohs(h->len)); 4667 if (len > 4) 4668 sppp_print_bytes((u_char *)(h + 1), 4669 len - 4); 4670 addlog(">\n"); 4671 } 4672 break; 4673 } 4674 4675 if (debug) { 4676 authname = sppp_auth_type_name(abuf, 4677 sizeof(abuf), PPP_CHAP, h->type); 4678 SPPP_LOG(sp, LOG_DEBUG, 4679 "chap input <%s id=0x%x len=%d name=", 4680 authname, h->ident, ntohs(h->len)); 4681 sppp_print_string((char *) name, name_len); 4682 addlog(" value-size=%d value=", value_len); 4683 sppp_print_bytes(value, value_len); 4684 addlog(">\n"); 4685 } 4686 4687 /* Compute reply value. */ 4688 MD5Init(&ctx); 4689 MD5Update(&ctx, &h->ident, 1); 4690 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 4691 MD5Update(&ctx, value, value_len); 4692 MD5Final(sp->chap.digest, &ctx); 4693 sp->chap.digest_len = sizeof(sp->chap.digest); 4694 sp->scp[IDX_CHAP].rconfid = h->ident; 4695 4696 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd); 4697 break; 4698 4699 case CHAP_SUCCESS: 4700 if (debug) { 4701 SPPP_LOG(sp, LOG_DEBUG, "chap success"); 4702 if (len > 4) { 4703 addlog(": "); 4704 sppp_print_string((char *)(h + 1), len - 4); 4705 } 4706 addlog("\n"); 4707 } 4708 4709 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4710 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4711 chap.name, h->ident, 4712 sp->scp[IDX_CHAP].rconfid); 4713 if_statinc(ifp, if_ierrors); 4714 break; 4715 } 4716 4717 if (sp->chap.digest_len == 0) { 4718 SPPP_DLOG(sp, "receive CHAP success" 4719 " without challenge\n"); 4720 if_statinc(ifp, if_ierrors); 4721 break; 4722 } 4723 4724 x = splnet(); 4725 sp->pp_auth_failures = 0; 4726 sp->pp_flags &= ~PP_NEEDAUTH; 4727 splx(x); 4728 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4729 sp->chap.digest_len = 0; 4730 4731 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) { 4732 /* 4733 * we are not authenticator for CHAP, 4734 * generate a dummy RCR+ event without CHAP_RESPONSE 4735 */ 4736 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4737 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4738 } 4739 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4740 break; 4741 4742 case CHAP_FAILURE: 4743 if (h->ident != sp->scp[IDX_CHAP].rconfid) { 4744 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 4745 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid); 4746 if_statinc(ifp, if_ierrors); 4747 break; 4748 } 4749 4750 if (sp->chap.digest_len == 0) { 4751 SPPP_DLOG(sp, "receive CHAP failure " 4752 "without challenge\n"); 4753 if_statinc(ifp, if_ierrors); 4754 break; 4755 } 4756 4757 x = splnet(); 4758 sp->pp_auth_failures++; 4759 splx(x); 4760 SPPP_LOG(sp, LOG_INFO, "chap failure"); 4761 if (debug) { 4762 if (len > 4) { 4763 addlog(": "); 4764 sppp_print_string((char *)(h + 1), len - 4); 4765 } 4766 } 4767 addlog("\n"); 4768 4769 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4770 sp->chap.digest_len = 0; 4771 /* 4772 * await LCP shutdown by authenticator, 4773 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn 4774 */ 4775 break; 4776 4777 /* response is my authproto */ 4778 case CHAP_RESPONSE: 4779 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4780 /* can't do anything useful */ 4781 SPPP_DLOG(sp, "chap response " 4782 "without his name and his secret being set\n"); 4783 break; 4784 } 4785 value = 1 + (u_char *)(h + 1); 4786 value_len = value[-1]; 4787 name = value + value_len; 4788 name_len = len - value_len - 5; 4789 if (name_len < 0) { 4790 if (debug) { 4791 authname = sppp_auth_type_name(abuf, 4792 sizeof(abuf), PPP_CHAP, h->type); 4793 SPPP_LOG(sp, LOG_DEBUG, 4794 "chap corrupted response " 4795 "<%s id=0x%x len=%d", 4796 authname, h->ident, ntohs(h->len)); 4797 if (len > 4) 4798 sppp_print_bytes((u_char *)(h + 1), 4799 len - 4); 4800 addlog(">\n"); 4801 } 4802 break; 4803 } 4804 if (h->ident != sp->scp[IDX_CHAP].confid) { 4805 SPPP_DLOG(sp, "chap dropping response for old ID " 4806 "(got %d, expected %d)\n", 4807 h->ident, sp->scp[IDX_CHAP].confid); 4808 break; 4809 } else { 4810 sp->scp[IDX_CHAP].rconfid = h->ident; 4811 } 4812 4813 if (sp->hisauth.name != NULL && 4814 (name_len != sp->hisauth.name_len 4815 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4816 SPPP_LOG(sp, LOG_INFO, 4817 "chap response, his name "); 4818 sppp_print_string(name, name_len); 4819 addlog(" != expected "); 4820 sppp_print_string(sp->hisauth.name, 4821 sp->hisauth.name_len); 4822 addlog("\n"); 4823 4824 /* generate RCR- event */ 4825 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4826 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4827 break; 4828 } 4829 4830 if (debug) { 4831 authname = sppp_auth_type_name(abuf, 4832 sizeof(abuf), PPP_CHAP, h->type); 4833 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) " 4834 "<%s id=0x%x len=%d name=", 4835 sppp_state_name(sp->scp[IDX_CHAP].state), 4836 authname, h->ident, ntohs(h->len)); 4837 sppp_print_string((char *)name, name_len); 4838 addlog(" value-size=%d value=", value_len); 4839 sppp_print_bytes(value, value_len); 4840 addlog(">\n"); 4841 } 4842 4843 if (value_len == sizeof(sp->chap.challenge) && 4844 value_len == sizeof(sp->chap.digest)) { 4845 MD5Init(&ctx); 4846 MD5Update(&ctx, &h->ident, 1); 4847 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4848 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge)); 4849 MD5Final(digest, &ctx); 4850 4851 if (memcmp(digest, value, value_len) == 0) { 4852 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK; 4853 } else { 4854 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4855 } 4856 } else { 4857 if (debug) { 4858 SPPP_LOG(sp, LOG_DEBUG, 4859 "chap bad hash value length: " 4860 "%d bytes, should be %zu\n", 4861 value_len, sizeof(sp->chap.challenge)); 4862 } 4863 4864 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK; 4865 } 4866 4867 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr); 4868 4869 /* generate a dummy RCA event */ 4870 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK && 4871 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) || 4872 sp->chap.rechallenging)) { 4873 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca); 4874 } 4875 break; 4876 4877 default: 4878 /* Unknown CHAP packet type -- ignore. */ 4879 if (debug) { 4880 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) " 4881 "<0x%x id=0x%xh len=%d", 4882 sppp_state_name(sp->scp[IDX_CHAP].state), 4883 h->type, h->ident, ntohs(h->len)); 4884 if (len > 4) 4885 sppp_print_bytes((u_char *)(h + 1), len - 4); 4886 addlog(">\n"); 4887 } 4888 break; 4889 4890 } 4891 4892 SPPP_UNLOCK(sp); 4893 } 4894 4895 static void 4896 sppp_chap_init(struct sppp *sp) 4897 { 4898 4899 KASSERT(SPPP_WLOCKED(sp)); 4900 4901 sppp_cp_init(&chap, sp); 4902 4903 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd, 4904 sppp_chap_rcv_challenge_event, &chap); 4905 } 4906 4907 static void 4908 sppp_chap_open(struct sppp *sp, void *xcp) 4909 { 4910 4911 KASSERT(SPPP_WLOCKED(sp)); 4912 4913 memset(sp->chap.digest, 0, sizeof(sp->chap.digest)); 4914 sp->chap.digest_len = 0; 4915 sp->chap.rechallenging = false; 4916 sp->chap.response_rcvd = false; 4917 sppp_open_event(sp, xcp); 4918 } 4919 4920 static void 4921 sppp_chap_tlu(struct sppp *sp) 4922 { 4923 int i, x; 4924 4925 KASSERT(SPPP_WLOCKED(sp)); 4926 4927 i = 0; 4928 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure; 4929 x = splnet(); 4930 sp->pp_auth_failures = 0; 4931 splx(x); 4932 4933 SPPP_LOG(sp, LOG_DEBUG, "chap %s", 4934 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu"); 4935 4936 /* 4937 * Some broken CHAP implementations (Conware CoNet, firmware 4938 * 4.0.?) don't want to re-authenticate their CHAP once the 4939 * initial challenge-response exchange has taken place. 4940 * Provide for an option to avoid rechallenges. 4941 */ 4942 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) && 4943 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4944 /* 4945 * Compute the re-challenge timeout. This will yield 4946 * a number between 300 and 810 seconds. 4947 */ 4948 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7); 4949 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz); 4950 4951 if (sppp_debug_enabled(sp)) { 4952 addlog(", next rechallenge in %d seconds", i); 4953 } 4954 } 4955 4956 addlog("\n"); 4957 4958 /* 4959 * If we are already in phase network, we are done here. This 4960 * is the case if this is a dummy tlu event after a re-challenge. 4961 */ 4962 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4963 sppp_phase_network(sp); 4964 } 4965 4966 static void 4967 sppp_chap_scr(struct sppp *sp) 4968 { 4969 uint32_t *ch; 4970 u_char clen, dsize; 4971 int role; 4972 4973 KASSERT(SPPP_WLOCKED(sp)); 4974 4975 role = sppp_auth_role(&chap, sp); 4976 4977 if (ISSET(role, SPPP_AUTH_SERV) && 4978 !sp->chap.response_rcvd) { 4979 /* we are authenticator for CHAP, send challenge */ 4980 ch = (uint32_t *)sp->chap.challenge; 4981 clen = sizeof(sp->chap.challenge); 4982 /* Compute random challenge. */ 4983 cprng_strong(kern_cprng, ch, clen, 0); 4984 4985 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq; 4986 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid, 4987 sizeof(clen), (const char *)&clen, 4988 sizeof(sp->chap.challenge), sp->chap.challenge, 4989 0); 4990 } 4991 4992 if (ISSET(role, SPPP_AUTH_PEER) && 4993 sp->chap.digest_len > 0) { 4994 /* we are peer for CHAP, send response */ 4995 dsize = sp->chap.digest_len; 4996 4997 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid, 4998 sizeof(dsize), (const char *)&dsize, 4999 sp->chap.digest_len, sp->chap.digest, 5000 sp->myauth.name_len, sp->myauth.name, 0); 5001 } 5002 } 5003 5004 static void 5005 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp) 5006 { 5007 const struct cp *cp = xcp; 5008 5009 KASSERT(!cpu_softintr_p()); 5010 5011 sp->chap.rechallenging = false; 5012 5013 switch (sp->scp[IDX_CHAP].state) { 5014 case STATE_REQ_SENT: 5015 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5016 cp->scr(sp); 5017 break; 5018 case STATE_OPENED: 5019 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 5020 cp->scr(sp); 5021 break; 5022 } 5023 } 5024 5025 /* 5026 *--------------------------------------------------------------------------* 5027 * * 5028 * The PAP implementation. * 5029 * * 5030 *--------------------------------------------------------------------------* 5031 */ 5032 /* 5033 * PAP uses following actions and events. 5034 * Actions: 5035 * - scr: send PAP_REQ 5036 * - sca: send PAP_ACK 5037 * - scn: send PAP_NAK 5038 * Events: 5039 * - RCR+: receive PAP_REQ containing correct username and password 5040 * - RCR-: receive PAP_REQ containing wrong username and password 5041 * - RCA: receive PAP_ACK 5042 * - RCN: (this event is unused) 5043 * - TO+: re-send PAP_REQ 5044 * - TO-: this layer finish 5045 */ 5046 5047 /* 5048 * Handle incoming PAP packets. */ 5049 static void 5050 sppp_pap_input(struct sppp *sp, struct mbuf *m) 5051 { 5052 struct ifnet *ifp; 5053 struct lcp_header *h; 5054 int len, x; 5055 char *name, *secret; 5056 int name_len, secret_len; 5057 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5058 const char *authname; 5059 bool debug; 5060 5061 ifp = &sp->pp_if; 5062 debug = sppp_debug_enabled(sp); 5063 5064 /* 5065 * Malicious input might leave this uninitialized, so 5066 * init to an impossible value. 5067 */ 5068 secret_len = -1; 5069 5070 len = m->m_pkthdr.len; 5071 if (len < 5) { 5072 SPPP_DLOG(sp, "pap invalid packet length: " 5073 "%d bytes\n", len); 5074 return; 5075 } 5076 h = mtod(m, struct lcp_header *); 5077 if (len > ntohs(h->len)) 5078 len = ntohs(h->len); 5079 5080 SPPP_LOCK(sp, RW_WRITER); 5081 5082 switch (h->type) { 5083 /* PAP request is my authproto */ 5084 case PAP_REQ: 5085 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 5086 /* can't do anything useful */ 5087 SPPP_DLOG(sp, "pap request" 5088 " without his name and his secret being set\n"); 5089 break; 5090 } 5091 name = 1 + (u_char *)(h + 1); 5092 name_len = name[-1]; 5093 secret = name + name_len + 1; 5094 if (name_len > len - 6 || 5095 (secret_len = secret[-1]) > len - 6 - name_len) { 5096 if (debug) { 5097 authname = sppp_auth_type_name(abuf, 5098 sizeof(abuf), PPP_PAP, h->type); 5099 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5100 "<%s id=0x%x len=%d", 5101 authname, h->ident, ntohs(h->len)); 5102 if (len > 4) 5103 sppp_print_bytes((u_char *)(h + 1), 5104 len - 4); 5105 addlog(">\n"); 5106 } 5107 break; 5108 } 5109 if (debug) { 5110 authname = sppp_auth_type_name(abuf, 5111 sizeof(abuf), PPP_PAP, h->type); 5112 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) " 5113 "<%s id=0x%x len=%d name=", 5114 sppp_state_name(sp->scp[IDX_PAP].state), 5115 authname, h->ident, ntohs(h->len)); 5116 sppp_print_string((char *)name, name_len); 5117 addlog(" secret="); 5118 sppp_print_string((char *)secret, secret_len); 5119 addlog(">\n"); 5120 } 5121 5122 sp->scp[IDX_PAP].rconfid = h->ident; 5123 5124 if (name_len == sp->hisauth.name_len && 5125 memcmp(name, sp->hisauth.name, name_len) == 0 && 5126 secret_len == sp->hisauth.secret_len && 5127 memcmp(secret, sp->hisauth.secret, secret_len) == 0) { 5128 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5129 } else { 5130 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK; 5131 } 5132 5133 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5134 5135 /* generate a dummy RCA event */ 5136 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK && 5137 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) { 5138 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5139 } 5140 break; 5141 5142 /* ack and nak are his authproto */ 5143 case PAP_ACK: 5144 if (debug) { 5145 SPPP_LOG(sp, LOG_DEBUG, "pap success"); 5146 name = 1 + (u_char *)(h + 1); 5147 name_len = name[-1]; 5148 if (len > 5 && name_len < len+4) { 5149 addlog(": "); 5150 sppp_print_string(name, name_len); 5151 } 5152 addlog("\n"); 5153 } 5154 5155 if (h->ident != sp->scp[IDX_PAP].confid) { 5156 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5157 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5158 if_statinc(ifp, if_ierrors); 5159 break; 5160 } 5161 5162 x = splnet(); 5163 sp->pp_auth_failures = 0; 5164 sp->pp_flags &= ~PP_NEEDAUTH; 5165 splx(x); 5166 5167 /* we are not authenticator, generate a dummy RCR+ event */ 5168 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) { 5169 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK; 5170 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr); 5171 } 5172 5173 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca); 5174 break; 5175 5176 case PAP_NAK: 5177 if (debug) { 5178 SPPP_LOG(sp, LOG_INFO, "pap failure"); 5179 name = 1 + (u_char *)(h + 1); 5180 name_len = name[-1]; 5181 if (len > 5 && name_len < len+4) { 5182 addlog(": "); 5183 sppp_print_string(name, name_len); 5184 } 5185 addlog("\n"); 5186 } else { 5187 SPPP_LOG(sp, LOG_INFO, "pap failure\n"); 5188 } 5189 5190 if (h->ident != sp->scp[IDX_PAP].confid) { 5191 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n", 5192 pap.name, h->ident, sp->scp[IDX_PAP].rconfid); 5193 if_statinc(ifp, if_ierrors); 5194 break; 5195 } 5196 5197 sp->pp_auth_failures++; 5198 /* 5199 * await LCP shutdown by authenticator, 5200 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn 5201 */ 5202 break; 5203 5204 default: 5205 /* Unknown PAP packet type -- ignore. */ 5206 if (debug) { 5207 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input " 5208 "<0x%x id=0x%x len=%d", 5209 h->type, h->ident, ntohs(h->len)); 5210 if (len > 4) 5211 sppp_print_bytes((u_char *)(h + 1), len - 4); 5212 addlog(">\n"); 5213 } 5214 break; 5215 } 5216 5217 SPPP_UNLOCK(sp); 5218 } 5219 5220 static void 5221 sppp_pap_init(struct sppp *sp) 5222 { 5223 5224 KASSERT(SPPP_WLOCKED(sp)); 5225 sppp_cp_init(&pap, sp); 5226 } 5227 5228 static void 5229 sppp_pap_tlu(struct sppp *sp) 5230 { 5231 int x; 5232 5233 SPPP_DLOG(sp, "%s tlu\n", pap.name); 5234 5235 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure; 5236 x = splnet(); 5237 sp->pp_auth_failures = 0; 5238 splx(x); 5239 5240 if (sp->pp_phase < SPPP_PHASE_NETWORK) 5241 sppp_phase_network(sp); 5242 } 5243 5244 static void 5245 sppp_pap_scr(struct sppp *sp) 5246 { 5247 u_char idlen, pwdlen; 5248 5249 KASSERT(SPPP_WLOCKED(sp)); 5250 5251 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) && 5252 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) { 5253 if (sp->myauth.secret == NULL || 5254 sp->myauth.name == NULL) { 5255 SPPP_LOG(sp, LOG_DEBUG, 5256 "couldn't send PAP_REQ " 5257 "because of no name or no secret\n"); 5258 } else { 5259 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq; 5260 pwdlen = sp->myauth.secret_len; 5261 idlen = sp->myauth.name_len; 5262 5263 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid, 5264 sizeof idlen, (const char *)&idlen, 5265 idlen, sp->myauth.name, 5266 sizeof pwdlen, (const char *)&pwdlen, 5267 pwdlen, sp->myauth.secret, 5268 0); 5269 } 5270 } 5271 } 5272 5273 /* 5274 * Random miscellaneous functions. 5275 */ 5276 5277 /* 5278 * Send a PAP or CHAP proto packet. 5279 * 5280 * Varadic function, each of the elements for the ellipsis is of type 5281 * ``size_t mlen, const u_char *msg''. Processing will stop iff 5282 * mlen == 0. 5283 * NOTE: never declare variadic functions with types subject to type 5284 * promotion (i.e. u_char). This is asking for big trouble depending 5285 * on the architecture you are on... 5286 */ 5287 5288 static void 5289 sppp_auth_send(const struct cp *cp, struct sppp *sp, 5290 unsigned int type, unsigned int id, 5291 ...) 5292 { 5293 struct ifnet *ifp; 5294 struct lcp_header *lh; 5295 struct mbuf *m; 5296 u_char *p; 5297 int len; 5298 size_t pkthdrlen; 5299 unsigned int mlen; 5300 const char *msg; 5301 va_list ap; 5302 5303 KASSERT(SPPP_WLOCKED(sp)); 5304 5305 ifp = &sp->pp_if; 5306 5307 MGETHDR(m, M_DONTWAIT, MT_DATA); 5308 if (! m) 5309 return; 5310 m_reset_rcvif(m); 5311 5312 if (sp->pp_flags & PP_NOFRAMING) { 5313 *mtod(m, uint16_t *) = htons(cp->proto); 5314 pkthdrlen = 2; 5315 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2); 5316 } else { 5317 struct ppp_header *h; 5318 h = mtod(m, struct ppp_header *); 5319 h->address = PPP_ALLSTATIONS; /* broadcast address */ 5320 h->control = PPP_UI; /* Unnumbered Info */ 5321 h->protocol = htons(cp->proto); 5322 pkthdrlen = PPP_HEADER_LEN; 5323 5324 lh = (struct lcp_header *)(h + 1); 5325 } 5326 5327 lh->type = type; 5328 lh->ident = id; 5329 p = (u_char *)(lh + 1); 5330 5331 va_start(ap, id); 5332 len = 0; 5333 5334 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 5335 msg = va_arg(ap, const char *); 5336 len += mlen; 5337 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 5338 va_end(ap); 5339 m_freem(m); 5340 return; 5341 } 5342 5343 memcpy(p, msg, mlen); 5344 p += mlen; 5345 } 5346 va_end(ap); 5347 5348 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 5349 lh->len = htons(LCP_HEADER_LEN + len); 5350 5351 if (sppp_debug_enabled(sp)) { 5352 char abuf[SPPP_AUTHTYPE_NAMELEN]; 5353 const char *authname; 5354 5355 authname = sppp_auth_type_name(abuf, 5356 sizeof(abuf), cp->proto, lh->type); 5357 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d", 5358 cp->name, authname, 5359 lh->ident, ntohs(lh->len)); 5360 if (len) 5361 sppp_print_bytes((u_char *)(lh + 1), len); 5362 addlog(">\n"); 5363 } 5364 if (IF_QFULL(&sp->pp_cpq)) { 5365 IF_DROP(&sp->pp_fastq); 5366 IF_DROP(&ifp->if_snd); 5367 m_freem(m); 5368 if_statinc(ifp, if_oerrors); 5369 return; 5370 } 5371 5372 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes); 5373 IF_ENQUEUE(&sp->pp_cpq, m); 5374 5375 if (! (ifp->if_flags & IFF_OACTIVE)) { 5376 SPPP_UNLOCK(sp); 5377 if_start_lock(ifp); 5378 SPPP_LOCK(sp, RW_WRITER); 5379 } 5380 } 5381 5382 static int 5383 sppp_auth_role(const struct cp *cp, struct sppp *sp) 5384 { 5385 int role; 5386 5387 role = SPPP_AUTH_NOROLE; 5388 5389 if (sp->hisauth.proto == cp->proto && 5390 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) 5391 SET(role, SPPP_AUTH_SERV); 5392 5393 if (sp->myauth.proto == cp->proto) 5394 SET(role, SPPP_AUTH_PEER); 5395 5396 return role; 5397 } 5398 5399 static void 5400 sppp_auth_to_event(struct sppp *sp, void *xcp) 5401 { 5402 const struct cp *cp = xcp; 5403 bool override; 5404 int state; 5405 5406 KASSERT(SPPP_WLOCKED(sp)); 5407 KASSERT(!cpu_softintr_p()); 5408 5409 override = false; 5410 state = sp->scp[cp->protoidx].state; 5411 5412 if (sp->scp[cp->protoidx].rst_counter > 0) { 5413 /* override TO+ event */ 5414 switch (state) { 5415 case STATE_OPENED: 5416 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 5417 override = true; 5418 sp->chap.rechallenging = true; 5419 sp->chap.response_rcvd = false; 5420 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 5421 cp->scr(sp); 5422 } 5423 break; 5424 5425 case STATE_ACK_RCVD: 5426 override = true; 5427 cp->scr(sp); 5428 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout); 5429 break; 5430 } 5431 } 5432 5433 if (override) { 5434 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", 5435 cp->name, sppp_state_name(state), 5436 sp->scp[cp->protoidx].rst_counter); 5437 sp->scp[cp->protoidx].rst_counter--; 5438 } else { 5439 sppp_to_event(sp, xcp); 5440 } 5441 } 5442 5443 static void 5444 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype, 5445 uint8_t ident, size_t _mlen __unused, void *_msg __unused) 5446 { 5447 static const char *succmsg = "Welcome!"; 5448 static const char *failmsg = "Failed..."; 5449 const char *msg; 5450 u_char type, mlen; 5451 5452 KASSERT(SPPP_WLOCKED(sp)); 5453 5454 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV)) 5455 return; 5456 5457 if (ctype == CONF_ACK) { 5458 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK; 5459 msg = succmsg; 5460 mlen = sizeof(succmsg) - 1; 5461 5462 sp->pp_auth_failures = 0; 5463 } else { 5464 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK; 5465 msg = failmsg; 5466 mlen = sizeof(failmsg) - 1; 5467 5468 /* shutdown LCP if auth failed */ 5469 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5470 sp->pp_auth_failures++; 5471 } 5472 5473 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0); 5474 } 5475 5476 /* 5477 * Send keepalive packets, every 10 seconds. 5478 */ 5479 static void 5480 sppp_keepalive(void *dummy) 5481 { 5482 struct sppp *sp; 5483 int s; 5484 time_t now; 5485 5486 SPPPQ_LOCK(); 5487 5488 s = splnet(); 5489 now = time_uptime; 5490 for (sp=spppq; sp; sp=sp->pp_next) { 5491 struct ifnet *ifp = NULL; 5492 5493 SPPP_LOCK(sp, RW_WRITER); 5494 ifp = &sp->pp_if; 5495 5496 /* check idle timeout */ 5497 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 5498 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 5499 /* idle timeout is enabled for this interface */ 5500 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 5501 SPPP_DLOG(sp, "no activity for %lu seconds\n", 5502 (unsigned long)(now-sp->pp_last_activity)); 5503 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5504 SPPP_UNLOCK(sp); 5505 continue; 5506 } 5507 } 5508 5509 /* Keepalive mode disabled or channel down? */ 5510 if (! (sp->pp_flags & PP_KEEPALIVE) || 5511 ! (ifp->if_flags & IFF_RUNNING)) { 5512 SPPP_UNLOCK(sp); 5513 continue; 5514 } 5515 5516 /* No keepalive in PPP mode if LCP not opened yet. */ 5517 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) { 5518 SPPP_UNLOCK(sp); 5519 continue; 5520 } 5521 5522 /* No echo reply, but maybe user data passed through? */ 5523 if (sp->pp_max_noreceive != 0 && 5524 (now - sp->pp_last_receive) < sp->pp_max_noreceive) { 5525 sp->pp_alivecnt = 0; 5526 SPPP_UNLOCK(sp); 5527 continue; 5528 } 5529 5530 /* No echo request */ 5531 if (sp->pp_alive_interval == 0) { 5532 SPPP_UNLOCK(sp); 5533 continue; 5534 } 5535 5536 /* send a ECHO_REQ once in sp->pp_alive_interval times */ 5537 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) { 5538 SPPP_UNLOCK(sp); 5539 continue; 5540 } 5541 5542 if (sp->pp_alivecnt >= sp->pp_maxalive) { 5543 /* No keepalive packets got. Stop the interface. */ 5544 if (sp->pp_flags & PP_KEEPALIVE_IFDOWN) 5545 sppp_wq_add(sp->wq_cp, &sp->work_ifdown); 5546 5547 SPPP_LOG(sp, LOG_INFO,"LCP keepalive timed out, " 5548 "going to restart the connection\n"); 5549 sp->pp_alivecnt = 0; 5550 5551 /* we are down, close all open protocols */ 5552 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close); 5553 5554 /* And now prepare LCP to reestablish the link, if configured to do so. */ 5555 sp->lcp.reestablish = true; 5556 5557 SPPP_UNLOCK(sp); 5558 continue; 5559 } 5560 if (sp->pp_alivecnt < sp->pp_maxalive) 5561 ++sp->pp_alivecnt; 5562 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 5563 int32_t nmagic = htonl(sp->lcp.magic); 5564 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq; 5565 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 5566 sp->lcp.echoid, 4, &nmagic); 5567 } 5568 5569 SPPP_UNLOCK(sp); 5570 } 5571 splx(s); 5572 sppp_keepalive_cnt++; 5573 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 5574 5575 SPPPQ_UNLOCK(); 5576 } 5577 5578 #ifdef INET 5579 /* 5580 * Get both IP addresses. 5581 */ 5582 static void 5583 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask) 5584 { 5585 struct ifnet *ifp = &sp->pp_if; 5586 struct ifaddr *ifa; 5587 struct sockaddr_in *si, *sm; 5588 uint32_t ssrc, ddst; 5589 int bound, s; 5590 struct psref psref; 5591 5592 sm = NULL; 5593 ssrc = ddst = 0; 5594 /* 5595 * Pick the first AF_INET address from the list, 5596 * aliases don't make any sense on a p2p link anyway. 5597 */ 5598 si = 0; 5599 bound = curlwp_bind(); 5600 s = pserialize_read_enter(); 5601 IFADDR_READER_FOREACH(ifa, ifp) { 5602 if (ifa->ifa_addr->sa_family == AF_INET) { 5603 si = (struct sockaddr_in *)ifa->ifa_addr; 5604 sm = (struct sockaddr_in *)ifa->ifa_netmask; 5605 if (si) { 5606 ifa_acquire(ifa, &psref); 5607 break; 5608 } 5609 } 5610 } 5611 pserialize_read_exit(s); 5612 if (ifa) { 5613 if (si && si->sin_addr.s_addr) { 5614 ssrc = si->sin_addr.s_addr; 5615 if (srcmask) 5616 *srcmask = ntohl(sm->sin_addr.s_addr); 5617 } 5618 5619 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 5620 if (si && si->sin_addr.s_addr) 5621 ddst = si->sin_addr.s_addr; 5622 ifa_release(ifa, &psref); 5623 } 5624 curlwp_bindx(bound); 5625 5626 if (dst) *dst = ntohl(ddst); 5627 if (src) *src = ntohl(ssrc); 5628 } 5629 5630 /* 5631 * Set IP addresses. Must be called at splnet. 5632 * If an address is 0, leave it the way it is. 5633 */ 5634 static void 5635 sppp_set_ip_addrs(struct sppp *sp) 5636 { 5637 struct ifnet *ifp; 5638 struct ifaddr *ifa; 5639 struct sockaddr_in *si, *dest; 5640 uint32_t myaddr = 0, hisaddr = 0; 5641 int s; 5642 5643 KASSERT(SPPP_WLOCKED(sp)); 5644 5645 ifp = &sp->pp_if; 5646 5647 SPPP_UNLOCK(sp); 5648 IFNET_LOCK(ifp); 5649 SPPP_LOCK(sp, RW_WRITER); 5650 5651 /* 5652 * Pick the first AF_INET address from the list, 5653 * aliases don't make any sense on a p2p link anyway. 5654 */ 5655 si = dest = NULL; 5656 s = pserialize_read_enter(); 5657 IFADDR_READER_FOREACH(ifa, ifp) { 5658 if (ifa->ifa_addr->sa_family == AF_INET) { 5659 si = (struct sockaddr_in *)ifa->ifa_addr; 5660 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5661 break; 5662 } 5663 } 5664 pserialize_read_exit(s); 5665 5666 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 5667 myaddr = sp->ipcp.req_myaddr; 5668 else if (si != NULL) 5669 myaddr = ntohl(si->sin_addr.s_addr); 5670 5671 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 5672 hisaddr = sp->ipcp.req_hisaddr; 5673 else if (dest != NULL) 5674 hisaddr = ntohl(dest->sin_addr.s_addr); 5675 5676 if (si != NULL && dest != NULL) { 5677 int error; 5678 struct sockaddr_in new_sin = *si; 5679 struct sockaddr_in new_dst = *dest; 5680 5681 if (myaddr != 0) 5682 new_sin.sin_addr.s_addr = htonl(myaddr); 5683 if (hisaddr != 0) { 5684 new_dst.sin_addr.s_addr = htonl(hisaddr); 5685 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) 5686 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 5687 } 5688 5689 in_addrhash_remove(ifatoia(ifa)); 5690 5691 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5692 5693 in_addrhash_insert(ifatoia(ifa)); 5694 5695 if (error) { 5696 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5697 __func__, error); 5698 } else { 5699 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5700 } 5701 } 5702 5703 IFNET_UNLOCK(ifp); 5704 5705 sppp_notify_con(sp); 5706 } 5707 5708 /* 5709 * Clear IP addresses. Must be called at splnet. 5710 */ 5711 static void 5712 sppp_clear_ip_addrs(struct sppp *sp) 5713 { 5714 struct ifnet *ifp; 5715 struct ifaddr *ifa; 5716 struct sockaddr_in *si, *dest; 5717 int s; 5718 5719 KASSERT(SPPP_WLOCKED(sp)); 5720 5721 ifp = &sp->pp_if; 5722 5723 SPPP_UNLOCK(sp); 5724 IFNET_LOCK(ifp); 5725 SPPP_LOCK(sp, RW_WRITER); 5726 5727 /* 5728 * Pick the first AF_INET address from the list, 5729 * aliases don't make any sense on a p2p link anyway. 5730 */ 5731 si = dest = NULL; 5732 s = pserialize_read_enter(); 5733 IFADDR_READER_FOREACH(ifa, ifp) { 5734 if (ifa->ifa_addr->sa_family == AF_INET) { 5735 si = (struct sockaddr_in *)ifa->ifa_addr; 5736 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 5737 break; 5738 } 5739 } 5740 pserialize_read_exit(s); 5741 5742 if (si != NULL) { 5743 struct sockaddr_in new_sin = *si; 5744 struct sockaddr_in new_dst = *dest; 5745 int error; 5746 5747 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 5748 new_sin.sin_addr.s_addr = 0; 5749 if (sp->ipcp.flags & IPCP_HISADDR_DYN && 5750 ntohl(sp->ipcp.saved_hisaddr) != 0) 5751 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr; 5752 5753 in_addrhash_remove(ifatoia(ifa)); 5754 5755 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0); 5756 5757 in_addrhash_insert(ifatoia(ifa)); 5758 5759 if (error) { 5760 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n", 5761 __func__, error); 5762 } else { 5763 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa); 5764 } 5765 } 5766 5767 IFNET_UNLOCK(ifp); 5768 } 5769 #endif 5770 5771 #ifdef INET6 5772 /* 5773 * Get both IPv6 addresses. 5774 */ 5775 static void 5776 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 5777 struct in6_addr *srcmask) 5778 { 5779 struct ifnet *ifp = &sp->pp_if; 5780 struct ifaddr *ifa; 5781 struct sockaddr_in6 *si, *sm; 5782 struct in6_addr ssrc, ddst; 5783 int bound, s; 5784 struct psref psref; 5785 5786 sm = NULL; 5787 memset(&ssrc, 0, sizeof(ssrc)); 5788 memset(&ddst, 0, sizeof(ddst)); 5789 /* 5790 * Pick the first link-local AF_INET6 address from the list, 5791 * aliases don't make any sense on a p2p link anyway. 5792 */ 5793 si = 0; 5794 bound = curlwp_bind(); 5795 s = pserialize_read_enter(); 5796 IFADDR_READER_FOREACH(ifa, ifp) { 5797 if (ifa->ifa_addr->sa_family == AF_INET6) { 5798 si = (struct sockaddr_in6 *)ifa->ifa_addr; 5799 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 5800 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) { 5801 ifa_acquire(ifa, &psref); 5802 break; 5803 } 5804 } 5805 } 5806 pserialize_read_exit(s); 5807 5808 if (ifa) { 5809 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 5810 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc)); 5811 if (srcmask) { 5812 memcpy(srcmask, &sm->sin6_addr, 5813 sizeof(*srcmask)); 5814 } 5815 } 5816 5817 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 5818 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 5819 memcpy(&ddst, &si->sin6_addr, sizeof(ddst)); 5820 ifa_release(ifa, &psref); 5821 } 5822 curlwp_bindx(bound); 5823 5824 if (dst) 5825 memcpy(dst, &ddst, sizeof(*dst)); 5826 if (src) 5827 memcpy(src, &ssrc, sizeof(*src)); 5828 } 5829 5830 #ifdef IPV6CP_MYIFID_DYN 5831 /* 5832 * Generate random ifid. 5833 */ 5834 static void 5835 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5836 { 5837 /* TBD */ 5838 } 5839 5840 /* 5841 * Set my IPv6 address. Must be called at splnet. 5842 */ 5843 static void 5844 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5845 { 5846 struct ifnet *ifp; 5847 struct ifaddr *ifa; 5848 struct sockaddr_in6 *sin6; 5849 int s; 5850 struct psref psref; 5851 5852 KASSERT(SPPP_WLOCKED(sp)); 5853 5854 ifp = &sp->pp_if; 5855 5856 SPPP_UNLOCK(sp); 5857 IFNET_LOCK(ifp); 5858 SPPP_LOCK(sp, RW_WRITER); 5859 5860 /* 5861 * Pick the first link-local AF_INET6 address from the list, 5862 * aliases don't make any sense on a p2p link anyway. 5863 */ 5864 5865 sin6 = NULL; 5866 s = pserialize_read_enter(); 5867 IFADDR_READER_FOREACH(ifa, ifp) 5868 { 5869 if (ifa->ifa_addr->sa_family == AF_INET6) 5870 { 5871 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5872 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 5873 ifa_acquire(ifa, &psref); 5874 break; 5875 } 5876 } 5877 } 5878 pserialize_read_exit(s); 5879 5880 if (ifa && sin6) 5881 { 5882 int error; 5883 struct sockaddr_in6 new_sin6 = *sin6; 5884 5885 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr)); 5886 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5887 if (error) { 5888 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n", 5889 __func__, error); 5890 } else { 5891 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa); 5892 } 5893 ifa_release(ifa, &psref); 5894 } 5895 5896 IFNET_UNLOCK(ifp); 5897 } 5898 #endif 5899 5900 /* 5901 * Suggest a candidate address to be used by peer. 5902 */ 5903 static void 5904 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5905 { 5906 struct in6_addr myaddr; 5907 struct timeval tv; 5908 5909 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5910 5911 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5912 microtime(&tv); 5913 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5914 myaddr.s6_addr[14] ^= 0xff; 5915 myaddr.s6_addr[15] ^= 0xff; 5916 } else { 5917 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5918 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5919 } 5920 if (suggest) 5921 memcpy(suggest, &myaddr, sizeof(myaddr)); 5922 } 5923 #endif /*INET6*/ 5924 5925 /* 5926 * Process ioctl requests specific to the PPP interface. 5927 * Permissions have already been checked. 5928 */ 5929 static int 5930 sppp_params(struct sppp *sp, u_long cmd, void *data) 5931 { 5932 switch (cmd) { 5933 case SPPPGETAUTHCFG: 5934 { 5935 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5936 int error; 5937 size_t len; 5938 5939 SPPP_LOCK(sp, RW_READER); 5940 5941 cfg->myauthflags = sp->myauth.flags; 5942 cfg->hisauthflags = sp->hisauth.flags; 5943 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname)); 5944 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto); 5945 cfg->myauth = sppp_proto2authproto(sp->myauth.proto); 5946 if (cfg->myname_length == 0) { 5947 if (sp->myauth.name != NULL) 5948 cfg->myname_length = sp->myauth.name_len + 1; 5949 } else { 5950 if (sp->myauth.name == NULL) { 5951 cfg->myname_length = 0; 5952 } else { 5953 len = sp->myauth.name_len + 1; 5954 5955 if (cfg->myname_length < len) { 5956 SPPP_UNLOCK(sp); 5957 return (ENAMETOOLONG); 5958 } 5959 error = copyout(sp->myauth.name, cfg->myname, len); 5960 if (error) { 5961 SPPP_UNLOCK(sp); 5962 return error; 5963 } 5964 } 5965 } 5966 if (cfg->hisname_length == 0) { 5967 if (sp->hisauth.name != NULL) 5968 cfg->hisname_length = sp->hisauth.name_len + 1; 5969 } else { 5970 if (sp->hisauth.name == NULL) { 5971 cfg->hisname_length = 0; 5972 } else { 5973 len = sp->hisauth.name_len + 1; 5974 5975 if (cfg->hisname_length < len) { 5976 SPPP_UNLOCK(sp); 5977 return (ENAMETOOLONG); 5978 } 5979 error = copyout(sp->hisauth.name, cfg->hisname, len); 5980 if (error) { 5981 SPPP_UNLOCK(sp); 5982 return error; 5983 } 5984 } 5985 } 5986 SPPP_UNLOCK(sp); 5987 } 5988 break; 5989 case SPPPSETAUTHCFG: 5990 { 5991 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5992 int error; 5993 5994 SPPP_LOCK(sp, RW_WRITER); 5995 5996 if (sp->myauth.name) { 5997 free(sp->myauth.name, M_DEVBUF); 5998 sp->myauth.name = NULL; 5999 } 6000 if (sp->myauth.secret) { 6001 free(sp->myauth.secret, M_DEVBUF); 6002 sp->myauth.secret = NULL; 6003 } 6004 if (sp->hisauth.name) { 6005 free(sp->hisauth.name, M_DEVBUF); 6006 sp->hisauth.name = NULL; 6007 } 6008 if (sp->hisauth.secret) { 6009 free(sp->hisauth.secret, M_DEVBUF); 6010 sp->hisauth.secret = NULL; 6011 } 6012 6013 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 6014 if (cfg->hisname_length >= MCLBYTES) { 6015 SPPP_UNLOCK(sp); 6016 return (ENAMETOOLONG); 6017 } 6018 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 6019 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 6020 if (error) { 6021 free(sp->hisauth.name, M_DEVBUF); 6022 sp->hisauth.name = NULL; 6023 SPPP_UNLOCK(sp); 6024 return error; 6025 } 6026 sp->hisauth.name_len = cfg->hisname_length - 1; 6027 sp->hisauth.name[sp->hisauth.name_len] = 0; 6028 } 6029 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 6030 if (cfg->hissecret_length >= MCLBYTES) { 6031 SPPP_UNLOCK(sp); 6032 return (ENAMETOOLONG); 6033 } 6034 sp->hisauth.secret = malloc(cfg->hissecret_length, 6035 M_DEVBUF, M_WAITOK); 6036 error = copyin(cfg->hissecret, sp->hisauth.secret, 6037 cfg->hissecret_length); 6038 if (error) { 6039 free(sp->hisauth.secret, M_DEVBUF); 6040 sp->hisauth.secret = NULL; 6041 SPPP_UNLOCK(sp); 6042 return error; 6043 } 6044 sp->hisauth.secret_len = cfg->hissecret_length - 1; 6045 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 6046 } 6047 if (cfg->myname != NULL && cfg->myname_length > 0) { 6048 if (cfg->myname_length >= MCLBYTES) { 6049 SPPP_UNLOCK(sp); 6050 return (ENAMETOOLONG); 6051 } 6052 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 6053 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 6054 if (error) { 6055 free(sp->myauth.name, M_DEVBUF); 6056 sp->myauth.name = NULL; 6057 SPPP_UNLOCK(sp); 6058 return error; 6059 } 6060 sp->myauth.name_len = cfg->myname_length - 1; 6061 sp->myauth.name[sp->myauth.name_len] = 0; 6062 } 6063 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 6064 if (cfg->mysecret_length >= MCLBYTES) { 6065 SPPP_UNLOCK(sp); 6066 return (ENAMETOOLONG); 6067 } 6068 sp->myauth.secret = malloc(cfg->mysecret_length, 6069 M_DEVBUF, M_WAITOK); 6070 error = copyin(cfg->mysecret, sp->myauth.secret, 6071 cfg->mysecret_length); 6072 if (error) { 6073 free(sp->myauth.secret, M_DEVBUF); 6074 sp->myauth.secret = NULL; 6075 SPPP_UNLOCK(sp); 6076 return error; 6077 } 6078 sp->myauth.secret_len = cfg->mysecret_length - 1; 6079 sp->myauth.secret[sp->myauth.secret_len] = 0; 6080 } 6081 sp->myauth.flags = cfg->myauthflags; 6082 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) { 6083 sp->myauth.proto = sppp_authproto2proto(cfg->myauth); 6084 } 6085 sp->hisauth.flags = cfg->hisauthflags; 6086 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) { 6087 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth); 6088 } 6089 sp->pp_auth_failures = 0; 6090 if (sp->hisauth.proto != PPP_NOPROTO) 6091 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6092 else 6093 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO); 6094 6095 SPPP_UNLOCK(sp); 6096 } 6097 break; 6098 case SPPPGETLCPCFG: 6099 { 6100 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6101 6102 SPPP_LOCK(sp, RW_READER); 6103 lcpp->lcp_timeout = sp->lcp.timeout; 6104 SPPP_UNLOCK(sp); 6105 } 6106 break; 6107 case SPPPSETLCPCFG: 6108 { 6109 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data; 6110 6111 SPPP_LOCK(sp, RW_WRITER); 6112 sp->lcp.timeout = lcpp->lcp_timeout; 6113 SPPP_UNLOCK(sp); 6114 } 6115 break; 6116 case SPPPGETNCPCFG: 6117 { 6118 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6119 6120 SPPP_LOCK(sp, RW_READER); 6121 ncpp->ncp_flags = sp->pp_ncpflags; 6122 SPPP_UNLOCK(sp); 6123 } 6124 break; 6125 case SPPPSETNCPCFG: 6126 { 6127 struct spppncpcfg *ncpp = (struct spppncpcfg *) data; 6128 6129 SPPP_LOCK(sp, RW_WRITER); 6130 sp->pp_ncpflags = ncpp->ncp_flags; 6131 SPPP_UNLOCK(sp); 6132 } 6133 break; 6134 case SPPPGETSTATUS: 6135 { 6136 struct spppstatus *status = (struct spppstatus *)data; 6137 6138 SPPP_LOCK(sp, RW_READER); 6139 status->phase = sp->pp_phase; 6140 SPPP_UNLOCK(sp); 6141 } 6142 break; 6143 case SPPPGETSTATUSNCP: 6144 { 6145 struct spppstatusncp *status = (struct spppstatusncp *)data; 6146 6147 SPPP_LOCK(sp, RW_READER); 6148 status->phase = sp->pp_phase; 6149 status->ncpup = sppp_cp_check(sp, CP_NCP); 6150 SPPP_UNLOCK(sp); 6151 } 6152 break; 6153 case SPPPGETIDLETO: 6154 { 6155 struct spppidletimeout *to = (struct spppidletimeout *)data; 6156 6157 SPPP_LOCK(sp, RW_READER); 6158 to->idle_seconds = sp->pp_idle_timeout; 6159 SPPP_UNLOCK(sp); 6160 } 6161 break; 6162 case SPPPSETIDLETO: 6163 { 6164 struct spppidletimeout *to = (struct spppidletimeout *)data; 6165 6166 SPPP_LOCK(sp, RW_WRITER); 6167 sp->pp_idle_timeout = to->idle_seconds; 6168 SPPP_UNLOCK(sp); 6169 } 6170 break; 6171 case SPPPSETAUTHFAILURE: 6172 { 6173 struct spppauthfailuresettings *afsettings = 6174 (struct spppauthfailuresettings *)data; 6175 6176 SPPP_LOCK(sp, RW_WRITER); 6177 sp->pp_max_auth_fail = afsettings->max_failures; 6178 sp->pp_auth_failures = 0; 6179 SPPP_UNLOCK(sp); 6180 } 6181 break; 6182 case SPPPGETAUTHFAILURES: 6183 { 6184 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 6185 6186 SPPP_LOCK(sp, RW_READER); 6187 stats->auth_failures = sp->pp_auth_failures; 6188 stats->max_failures = sp->pp_max_auth_fail; 6189 SPPP_UNLOCK(sp); 6190 } 6191 break; 6192 case SPPPSETDNSOPTS: 6193 { 6194 struct spppdnssettings *req = (struct spppdnssettings *)data; 6195 6196 SPPP_LOCK(sp, RW_WRITER); 6197 sp->query_dns = req->query_dns & 3; 6198 SPPP_UNLOCK(sp); 6199 } 6200 break; 6201 case SPPPGETDNSOPTS: 6202 { 6203 struct spppdnssettings *req = (struct spppdnssettings *)data; 6204 6205 SPPP_LOCK(sp, RW_READER); 6206 req->query_dns = sp->query_dns; 6207 SPPP_UNLOCK(sp); 6208 } 6209 break; 6210 case SPPPGETDNSADDRS: 6211 { 6212 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 6213 6214 SPPP_LOCK(sp, RW_READER); 6215 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 6216 SPPP_UNLOCK(sp); 6217 } 6218 break; 6219 case SPPPGETKEEPALIVE: 6220 { 6221 struct spppkeepalivesettings *settings = 6222 (struct spppkeepalivesettings*)data; 6223 6224 SPPP_LOCK(sp, RW_READER); 6225 settings->maxalive = sp->pp_maxalive; 6226 settings->max_noreceive = sp->pp_max_noreceive; 6227 settings->alive_interval = sp->pp_alive_interval; 6228 SPPP_UNLOCK(sp); 6229 } 6230 break; 6231 case SPPPSETKEEPALIVE: 6232 { 6233 struct spppkeepalivesettings *settings = 6234 (struct spppkeepalivesettings*)data; 6235 6236 SPPP_LOCK(sp, RW_WRITER); 6237 sp->pp_maxalive = settings->maxalive; 6238 sp->pp_max_noreceive = settings->max_noreceive; 6239 sp->pp_alive_interval = settings->alive_interval; 6240 SPPP_UNLOCK(sp); 6241 } 6242 break; 6243 case SPPPGETLCPSTATUS: 6244 { 6245 struct sppplcpstatus *status = 6246 (struct sppplcpstatus *)data; 6247 6248 SPPP_LOCK(sp, RW_READER); 6249 status->state = sp->scp[IDX_LCP].state; 6250 status->opts = sp->lcp.opts; 6251 status->magic = sp->lcp.magic; 6252 status->mru = sp->lcp.mru; 6253 SPPP_UNLOCK(sp); 6254 } 6255 break; 6256 case SPPPGETIPCPSTATUS: 6257 { 6258 struct spppipcpstatus *status = 6259 (struct spppipcpstatus *)data; 6260 u_int32_t myaddr; 6261 6262 SPPP_LOCK(sp, RW_READER); 6263 status->state = sp->scp[IDX_IPCP].state; 6264 status->opts = sp->ipcp.opts; 6265 #ifdef INET 6266 sppp_get_ip_addrs(sp, &myaddr, 0, 0); 6267 #else 6268 myaddr = 0; 6269 #endif 6270 status->myaddr = ntohl(myaddr); 6271 SPPP_UNLOCK(sp); 6272 } 6273 break; 6274 case SPPPGETIPV6CPSTATUS: 6275 { 6276 struct spppipv6cpstatus *status = 6277 (struct spppipv6cpstatus *)data; 6278 6279 SPPP_LOCK(sp, RW_READER); 6280 status->state = sp->scp[IDX_IPV6CP].state; 6281 memcpy(status->my_ifid, sp->ipv6cp.my_ifid, 6282 sizeof(status->my_ifid)); 6283 memcpy(status->his_ifid, sp->ipv6cp.his_ifid, 6284 sizeof(status->his_ifid)); 6285 SPPP_UNLOCK(sp); 6286 } 6287 break; 6288 default: 6289 { 6290 int ret; 6291 6292 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data), 6293 enosys(), ret); 6294 if (ret != ENOSYS) 6295 return ret; 6296 return (EINVAL); 6297 } 6298 } 6299 return (0); 6300 } 6301 6302 static void 6303 sppp_phase_network(struct sppp *sp) 6304 { 6305 int i; 6306 6307 KASSERT(SPPP_WLOCKED(sp)); 6308 6309 sppp_change_phase(sp, SPPP_PHASE_NETWORK); 6310 6311 /* Notify NCPs now. */ 6312 for (i = 0; i < IDX_COUNT; i++) 6313 if ((cps[i])->flags & CP_NCP) 6314 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open); 6315 } 6316 6317 static const char * 6318 sppp_cp_type_name(char *buf, size_t buflen, u_char type) 6319 { 6320 6321 switch (type) { 6322 case CONF_REQ: return "conf-req"; 6323 case CONF_ACK: return "conf-ack"; 6324 case CONF_NAK: return "conf-nak"; 6325 case CONF_REJ: return "conf-rej"; 6326 case TERM_REQ: return "term-req"; 6327 case TERM_ACK: return "term-ack"; 6328 case CODE_REJ: return "code-rej"; 6329 case PROTO_REJ: return "proto-rej"; 6330 case ECHO_REQ: return "echo-req"; 6331 case ECHO_REPLY: return "echo-reply"; 6332 case DISC_REQ: return "discard-req"; 6333 } 6334 if (buf != NULL) 6335 snprintf(buf, buflen, "0x%02x", type); 6336 return buf; 6337 } 6338 6339 static const char * 6340 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type) 6341 { 6342 const char *name; 6343 6344 switch (proto) { 6345 case PPP_CHAP: 6346 switch (type) { 6347 case CHAP_CHALLENGE: return "challenge"; 6348 case CHAP_RESPONSE: return "response"; 6349 case CHAP_SUCCESS: return "success"; 6350 case CHAP_FAILURE: return "failure"; 6351 default: name = "chap"; break; 6352 } 6353 break; 6354 6355 case PPP_PAP: 6356 switch (type) { 6357 case PAP_REQ: return "req"; 6358 case PAP_ACK: return "ack"; 6359 case PAP_NAK: return "nak"; 6360 default: name = "pap"; break; 6361 } 6362 break; 6363 6364 default: 6365 name = "bad"; 6366 break; 6367 } 6368 6369 if (buf != NULL) 6370 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type); 6371 return buf; 6372 } 6373 6374 static const char * 6375 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt) 6376 { 6377 6378 switch (opt) { 6379 case LCP_OPT_MRU: return "mru"; 6380 case LCP_OPT_ASYNC_MAP: return "async-map"; 6381 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 6382 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 6383 case LCP_OPT_MAGIC: return "magic"; 6384 case LCP_OPT_PROTO_COMP: return "proto-comp"; 6385 case LCP_OPT_ADDR_COMP: return "addr-comp"; 6386 case LCP_OPT_SELF_DESC_PAD: return "sdpad"; 6387 case LCP_OPT_CALL_BACK: return "callback"; 6388 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms"; 6389 case LCP_OPT_MP_MRRU: return "mrru"; 6390 case LCP_OPT_MP_SSNHF: return "mp-ssnhf"; 6391 case LCP_OPT_MP_EID: return "mp-eid"; 6392 } 6393 if (buf != NULL) 6394 snprintf(buf, buflen, "0x%02x", opt); 6395 return buf; 6396 } 6397 6398 static const char * 6399 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt) 6400 { 6401 6402 switch (opt) { 6403 case IPCP_OPT_ADDRESSES: return "addresses"; 6404 case IPCP_OPT_COMPRESSION: return "compression"; 6405 case IPCP_OPT_ADDRESS: return "address"; 6406 case IPCP_OPT_PRIMDNS: return "primdns"; 6407 case IPCP_OPT_SECDNS: return "secdns"; 6408 } 6409 if (buf != NULL) 6410 snprintf(buf, buflen, "0x%02x", opt); 6411 return buf; 6412 } 6413 6414 #ifdef INET6 6415 static const char * 6416 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt) 6417 { 6418 6419 switch (opt) { 6420 case IPV6CP_OPT_IFID: return "ifid"; 6421 case IPV6CP_OPT_COMPRESSION: return "compression"; 6422 } 6423 if (buf != NULL) 6424 snprintf(buf, buflen, "0x%02x", opt); 6425 return buf; 6426 } 6427 #endif 6428 6429 static const char * 6430 sppp_state_name(int state) 6431 { 6432 6433 switch (state) { 6434 case STATE_INITIAL: return "initial"; 6435 case STATE_STARTING: return "starting"; 6436 case STATE_CLOSED: return "closed"; 6437 case STATE_STOPPED: return "stopped"; 6438 case STATE_CLOSING: return "closing"; 6439 case STATE_STOPPING: return "stopping"; 6440 case STATE_REQ_SENT: return "req-sent"; 6441 case STATE_ACK_RCVD: return "ack-rcvd"; 6442 case STATE_ACK_SENT: return "ack-sent"; 6443 case STATE_OPENED: return "opened"; 6444 } 6445 return "illegal"; 6446 } 6447 6448 static const char * 6449 sppp_phase_name(int phase) 6450 { 6451 6452 switch (phase) { 6453 case SPPP_PHASE_DEAD: return "dead"; 6454 case SPPP_PHASE_ESTABLISH: return "establish"; 6455 case SPPP_PHASE_TERMINATE: return "terminate"; 6456 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 6457 case SPPP_PHASE_NETWORK: return "network"; 6458 } 6459 return "illegal"; 6460 } 6461 6462 static const char * 6463 sppp_proto_name(char *buf, size_t buflen, u_short proto) 6464 { 6465 6466 switch (proto) { 6467 case PPP_LCP: return "lcp"; 6468 case PPP_IPCP: return "ipcp"; 6469 case PPP_PAP: return "pap"; 6470 case PPP_CHAP: return "chap"; 6471 case PPP_IPV6CP: return "ipv6cp"; 6472 } 6473 if (buf != NULL) { 6474 snprintf(buf, sizeof(buf), "0x%04x", 6475 (unsigned)proto); 6476 } 6477 return buf; 6478 } 6479 6480 static void 6481 sppp_print_bytes(const u_char *p, u_short len) 6482 { 6483 addlog(" %02x", *p++); 6484 while (--len > 0) 6485 addlog("-%02x", *p++); 6486 } 6487 6488 static void 6489 sppp_print_string(const char *p, u_short len) 6490 { 6491 u_char c; 6492 6493 while (len-- > 0) { 6494 c = *p++; 6495 /* 6496 * Print only ASCII chars directly. RFC 1994 recommends 6497 * using only them, but we don't rely on it. */ 6498 if (c < ' ' || c > '~') 6499 addlog("\\x%x", c); 6500 else 6501 addlog("%c", c); 6502 } 6503 } 6504 6505 static const char * 6506 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr) 6507 { 6508 6509 if (buf != NULL) { 6510 snprintf(buf, buflen, "%u.%u.%u.%u", 6511 (unsigned int)((addr >> 24) & 0xff), 6512 (unsigned int)((addr >> 16) & 0xff), 6513 (unsigned int)((addr >> 8) & 0xff), 6514 (unsigned int)(addr & 0xff)); 6515 } 6516 return buf; 6517 } 6518 6519 /* a dummy, used to drop uninteresting events */ 6520 static void 6521 sppp_null(struct sppp *unused) 6522 { 6523 /* do just nothing */ 6524 } 6525 6526 static void 6527 sppp_tls(const struct cp *cp, struct sppp *sp) 6528 { 6529 6530 SPPP_DLOG(sp, "%s tls\n", cp->name); 6531 6532 /* notify lcp that is lower layer */ 6533 sp->lcp.protos |= (1 << cp->protoidx); 6534 } 6535 6536 static void 6537 sppp_tlf(const struct cp *cp, struct sppp *sp) 6538 { 6539 6540 SPPP_DLOG(sp, "%s tlf\n", cp->name); 6541 6542 /* notify lcp that is lower layer */ 6543 sp->lcp.protos &= ~(1 << cp->protoidx); 6544 6545 /* cleanup */ 6546 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) { 6547 m_freem(sp->scp[cp->protoidx].mbuf_confreq); 6548 sp->scp[cp->protoidx].mbuf_confreq = NULL; 6549 } 6550 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) { 6551 m_freem(sp->scp[cp->protoidx].mbuf_confnak); 6552 sp->scp[cp->protoidx].mbuf_confnak = NULL; 6553 } 6554 6555 sppp_lcp_check_and_close(sp); 6556 } 6557 6558 static void 6559 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type, 6560 uint8_t ident, size_t msglen, void *msg) 6561 { 6562 6563 if (msglen == 0) 6564 return; 6565 6566 switch (type) { 6567 case CONF_ACK: 6568 case CONF_NAK: 6569 case CONF_REJ: 6570 break; 6571 default: 6572 return; 6573 } 6574 6575 if (sppp_debug_enabled(sp)) { 6576 char tbuf[SPPP_CPTYPE_NAMELEN]; 6577 const char *cpname; 6578 6579 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type); 6580 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname); 6581 } 6582 6583 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg); 6584 } 6585 6586 static void 6587 sppp_ifdown(struct sppp *sp, void *xcp __unused) 6588 { 6589 6590 SPPP_UNLOCK(sp); 6591 if_down(&sp->pp_if); 6592 IF_PURGE(&sp->pp_cpq); 6593 SPPP_LOCK(sp, RW_WRITER); 6594 } 6595 6596 static void 6597 sppp_notify_up(struct sppp *sp) 6598 { 6599 6600 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up); 6601 } 6602 6603 static void 6604 sppp_notify_down(struct sppp *sp) 6605 { 6606 6607 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down); 6608 } 6609 6610 static void 6611 sppp_notify_tls_wlocked(struct sppp *sp) 6612 { 6613 6614 KASSERT(SPPP_WLOCKED(sp)); 6615 6616 if (!sp->pp_tls) 6617 return; 6618 6619 SPPP_UNLOCK(sp); 6620 sp->pp_tls(sp); 6621 SPPP_LOCK(sp, RW_WRITER); 6622 } 6623 6624 static void 6625 sppp_notify_tlf_wlocked(struct sppp *sp) 6626 { 6627 6628 KASSERT(SPPP_WLOCKED(sp)); 6629 6630 if (!sp->pp_tlf) 6631 return; 6632 6633 SPPP_UNLOCK(sp); 6634 sp->pp_tlf(sp); 6635 SPPP_LOCK(sp, RW_WRITER); 6636 } 6637 6638 static void 6639 sppp_notify_con(struct sppp *sp) 6640 { 6641 6642 if (!sp->pp_con) 6643 return; 6644 6645 sp->pp_con(sp); 6646 } 6647 6648 #ifdef INET6 6649 static void 6650 sppp_notify_con_wlocked(struct sppp *sp) 6651 { 6652 6653 KASSERT(SPPP_WLOCKED(sp)); 6654 6655 SPPP_UNLOCK(sp); 6656 sppp_notify_con(sp); 6657 SPPP_LOCK(sp, RW_WRITER); 6658 6659 } 6660 #endif 6661 6662 static void 6663 sppp_notify_chg_wlocked(struct sppp *sp) 6664 { 6665 6666 KASSERT(SPPP_WLOCKED(sp)); 6667 6668 if (!sp->pp_chg) 6669 return; 6670 6671 SPPP_UNLOCK(sp); 6672 sp->pp_chg(sp, sp->pp_phase); 6673 SPPP_LOCK(sp, RW_WRITER); 6674 } 6675 6676 static void 6677 sppp_wq_work(struct work *wk, void *xsp) 6678 { 6679 struct sppp *sp; 6680 struct sppp_work *work; 6681 6682 sp = xsp; 6683 work = container_of(wk, struct sppp_work, work); 6684 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE); 6685 6686 SPPP_LOCK(sp, RW_WRITER); 6687 work->func(sp, work->arg); 6688 SPPP_UNLOCK(sp); 6689 } 6690 6691 static struct workqueue * 6692 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags) 6693 { 6694 struct workqueue *wq; 6695 int error; 6696 6697 error = workqueue_create(&wq, xnamebuf, sppp_wq_work, 6698 (void *)sp, prio, ipl, flags); 6699 if (error) { 6700 panic("%s: workqueue_create failed [%s, %d]\n", 6701 sp->pp_if.if_xname, xnamebuf, error); 6702 } 6703 6704 return wq; 6705 } 6706 6707 static void 6708 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq) 6709 { 6710 6711 workqueue_destroy(wq); 6712 } 6713 6714 static void 6715 sppp_wq_set(struct sppp_work *work, 6716 void (*func)(struct sppp *, void *), void *arg) 6717 { 6718 6719 work->func = func; 6720 work->arg = arg; 6721 } 6722 6723 static void 6724 sppp_wq_add(struct workqueue *wq, struct sppp_work *work) 6725 { 6726 6727 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY) 6728 != SPPP_WK_FREE) 6729 return; 6730 6731 KASSERT(work->func != NULL); 6732 kpreempt_disable(); 6733 workqueue_enqueue(wq, &work->work, NULL); 6734 kpreempt_enable(); 6735 } 6736 static void 6737 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work) 6738 { 6739 6740 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL); 6741 workqueue_wait(wq, &work->work); 6742 } 6743 6744 /* 6745 * This file is large. Tell emacs to highlight it nevertheless. 6746 * 6747 * Local Variables: 6748 * hilit-auto-highlight-maxout: 120000 6749 * End: 6750 */ 6751 6752 /* 6753 * Module glue 6754 */ 6755 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL); 6756 6757 static int 6758 sppp_subr_modcmd(modcmd_t cmd, void *arg) 6759 { 6760 6761 switch (cmd) { 6762 case MODULE_CMD_INIT: 6763 case MODULE_CMD_FINI: 6764 return 0; 6765 case MODULE_CMD_STAT: 6766 case MODULE_CMD_AUTOUNLOAD: 6767 default: 6768 return ENOTTY; 6769 } 6770 } 6771
Indexes created Fri Sep 26 20:09:58 GMT 2025