if_spppsubr.c revision 1.28
1 /* $NetBSD: if_spppsubr.c,v 1.28 2001/11/05 18:02:15 matt Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * This software is distributed with NO WARRANTIES, not even the implied 17 * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 18 * 19 * Authors grant any other persons or organisations permission to use 20 * or modify this software as long as this message is kept with the software, 21 * all derivative works or modified versions. 22 * 23 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 24 * 25 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 26 * 27 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 28 */ 29 30 #include "opt_inet.h" 31 #include "opt_ipx.h" 32 #include "opt_iso.h" 33 #include "opt_ns.h" 34 35 #include <sys/param.h> 36 37 #include <sys/systm.h> 38 #include <sys/kernel.h> 39 #include <sys/sockio.h> 40 #include <sys/socket.h> 41 #include <sys/syslog.h> 42 #include <sys/malloc.h> 43 #include <sys/mbuf.h> 44 45 #include <sys/md5.h> 46 47 #include <net/if.h> 48 #include <net/netisr.h> 49 #include <net/if_types.h> 50 #include <net/route.h> 51 #include <net/ppp_defs.h> 52 53 #include <machine/stdarg.h> 54 55 #include <netinet/in.h> 56 #include <netinet/in_systm.h> 57 #include <netinet/in_var.h> 58 #ifdef INET 59 #include <netinet/ip.h> 60 #include <netinet/tcp.h> 61 #endif 62 #include <net/ethertypes.h> 63 64 #ifdef IPX 65 #include <netipx/ipx.h> 66 #include <netipx/ipx_if.h> 67 #endif 68 69 #ifdef NS 70 #include <netns/ns.h> 71 #include <netns/ns_if.h> 72 #endif 73 74 #ifdef ISO 75 #include <netiso/argo_debug.h> 76 #include <netiso/iso.h> 77 #include <netiso/iso_var.h> 78 #include <netiso/iso_snpac.h> 79 #endif 80 81 #include <net/if_sppp.h> 82 83 #define MAXALIVECNT 3 /* max. alive packets */ 84 85 /* 86 * Interface flags that can be set in an ifconfig command. 87 * 88 * Setting link0 will make the link passive, i.e. it will be marked 89 * as being administrative openable, but won't be opened to begin 90 * with. Incoming calls will be answered, or subsequent calls with 91 * -link1 will cause the administrative open of the LCP layer. 92 * 93 * Setting link1 will cause the link to auto-dial only as packets 94 * arrive to be sent. 95 * 96 * Setting IFF_DEBUG will syslog the option negotiation and state 97 * transitions at level kern.debug. Note: all logs consistently look 98 * like 99 * 100 * <if-name><unit>: <proto-name> <additional info...> 101 * 102 * with <if-name><unit> being something like "bppp0", and <proto-name> 103 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 104 */ 105 106 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 107 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 108 109 #define CONF_REQ 1 /* PPP configure request */ 110 #define CONF_ACK 2 /* PPP configure acknowledge */ 111 #define CONF_NAK 3 /* PPP configure negative ack */ 112 #define CONF_REJ 4 /* PPP configure reject */ 113 #define TERM_REQ 5 /* PPP terminate request */ 114 #define TERM_ACK 6 /* PPP terminate acknowledge */ 115 #define CODE_REJ 7 /* PPP code reject */ 116 #define PROTO_REJ 8 /* PPP protocol reject */ 117 #define ECHO_REQ 9 /* PPP echo request */ 118 #define ECHO_REPLY 10 /* PPP echo reply */ 119 #define DISC_REQ 11 /* PPP discard request */ 120 121 #define LCP_OPT_MRU 1 /* maximum receive unit */ 122 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 123 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 124 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 125 #define LCP_OPT_MAGIC 5 /* magic number */ 126 #define LCP_OPT_RESERVED 6 /* reserved */ 127 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 128 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 129 130 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 131 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 132 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 133 134 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 135 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 136 137 #define PAP_REQ 1 /* PAP name/password request */ 138 #define PAP_ACK 2 /* PAP acknowledge */ 139 #define PAP_NAK 3 /* PAP fail */ 140 141 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 142 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 143 #define CHAP_SUCCESS 3 /* CHAP response ok */ 144 #define CHAP_FAILURE 4 /* CHAP response failed */ 145 146 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 147 148 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 149 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 150 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 151 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 152 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 153 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 154 155 /* states are named and numbered according to RFC 1661 */ 156 #define STATE_INITIAL 0 157 #define STATE_STARTING 1 158 #define STATE_CLOSED 2 159 #define STATE_STOPPED 3 160 #define STATE_CLOSING 4 161 #define STATE_STOPPING 5 162 #define STATE_REQ_SENT 6 163 #define STATE_ACK_RCVD 7 164 #define STATE_ACK_SENT 8 165 #define STATE_OPENED 9 166 167 struct ppp_header { 168 u_char address; 169 u_char control; 170 u_short protocol; 171 } __attribute__((__packed__)); 172 #define PPP_HEADER_LEN sizeof (struct ppp_header) 173 174 struct lcp_header { 175 u_char type; 176 u_char ident; 177 u_short len; 178 } __attribute__((__packed__)); 179 #define LCP_HEADER_LEN sizeof (struct lcp_header) 180 181 struct cisco_packet { 182 u_long type; 183 u_long par1; 184 u_long par2; 185 u_short rel; 186 u_short time0; 187 u_short time1; 188 } __attribute__((__packed__)); 189 #define CISCO_PACKET_LEN 18 190 191 /* 192 * We follow the spelling and capitalization of RFC 1661 here, to make 193 * it easier comparing with the standard. Please refer to this RFC in 194 * case you can't make sense out of these abbreviation; it will also 195 * explain the semantics related to the various events and actions. 196 */ 197 struct cp { 198 u_short proto; /* PPP control protocol number */ 199 u_char protoidx; /* index into state table in struct sppp */ 200 u_char flags; 201 #define CP_LCP 0x01 /* this is the LCP */ 202 #define CP_AUTH 0x02 /* this is an authentication protocol */ 203 #define CP_NCP 0x04 /* this is a NCP */ 204 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 205 const char *name; /* name of this control protocol */ 206 /* event handlers */ 207 void (*Up)(struct sppp *sp); 208 void (*Down)(struct sppp *sp); 209 void (*Open)(struct sppp *sp); 210 void (*Close)(struct sppp *sp); 211 void (*TO)(void *sp); 212 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 213 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 214 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 215 /* actions */ 216 void (*tlu)(struct sppp *sp); 217 void (*tld)(struct sppp *sp); 218 void (*tls)(struct sppp *sp); 219 void (*tlf)(struct sppp *sp); 220 void (*scr)(struct sppp *sp); 221 }; 222 223 static struct sppp *spppq; 224 static struct callout keepalive_ch; 225 226 #ifdef __FreeBSD__ 227 #define SPP_FMT "%s%d: " 228 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 229 #else 230 #define SPP_FMT "%s: " 231 #define SPP_ARGS(ifp) (ifp)->if_xname 232 #endif 233 234 #ifdef INET 235 /* 236 * The following disgusting hack gets around the problem that IP TOS 237 * can't be set yet. We want to put "interactive" traffic on a high 238 * priority queue. To decide if traffic is interactive, we check that 239 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 240 * 241 * XXX is this really still necessary? - joerg - 242 */ 243 static u_short interactive_ports[8] = { 244 0, 513, 0, 0, 245 0, 21, 0, 23, 246 }; 247 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 248 #endif 249 250 /* almost every function needs these */ 251 #define STDDCL \ 252 struct ifnet *ifp = &sp->pp_if; \ 253 int debug = ifp->if_flags & IFF_DEBUG 254 255 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 256 struct sockaddr *dst, struct rtentry *rt); 257 258 static void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2); 259 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 260 261 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 262 struct mbuf *m); 263 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 264 u_char ident, u_short len, void *data); 265 /* static void sppp_cp_timeout(void *arg); */ 266 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 267 int newstate); 268 static void sppp_auth_send(const struct cp *cp, 269 struct sppp *sp, unsigned int type, unsigned int id, 270 ...); 271 272 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 273 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 274 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 275 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 276 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 277 278 static void sppp_null(struct sppp *sp); 279 280 static void sppp_lcp_init(struct sppp *sp); 281 static void sppp_lcp_up(struct sppp *sp); 282 static void sppp_lcp_down(struct sppp *sp); 283 static void sppp_lcp_open(struct sppp *sp); 284 static void sppp_lcp_close(struct sppp *sp); 285 static void sppp_lcp_TO(void *sp); 286 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 287 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 288 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 289 static void sppp_lcp_tlu(struct sppp *sp); 290 static void sppp_lcp_tld(struct sppp *sp); 291 static void sppp_lcp_tls(struct sppp *sp); 292 static void sppp_lcp_tlf(struct sppp *sp); 293 static void sppp_lcp_scr(struct sppp *sp); 294 static void sppp_lcp_check_and_close(struct sppp *sp); 295 static int sppp_ncp_check(struct sppp *sp); 296 297 static void sppp_ipcp_init(struct sppp *sp); 298 static void sppp_ipcp_up(struct sppp *sp); 299 static void sppp_ipcp_down(struct sppp *sp); 300 static void sppp_ipcp_open(struct sppp *sp); 301 static void sppp_ipcp_close(struct sppp *sp); 302 static void sppp_ipcp_TO(void *sp); 303 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 304 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 305 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 306 static void sppp_ipcp_tlu(struct sppp *sp); 307 static void sppp_ipcp_tld(struct sppp *sp); 308 static void sppp_ipcp_tls(struct sppp *sp); 309 static void sppp_ipcp_tlf(struct sppp *sp); 310 static void sppp_ipcp_scr(struct sppp *sp); 311 312 static void sppp_ipv6cp_init(struct sppp *sp); 313 static void sppp_ipv6cp_up(struct sppp *sp); 314 static void sppp_ipv6cp_down(struct sppp *sp); 315 static void sppp_ipv6cp_open(struct sppp *sp); 316 static void sppp_ipv6cp_close(struct sppp *sp); 317 static void sppp_ipv6cp_TO(void *sp); 318 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 319 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 320 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 321 static void sppp_ipv6cp_tlu(struct sppp *sp); 322 static void sppp_ipv6cp_tld(struct sppp *sp); 323 static void sppp_ipv6cp_tls(struct sppp *sp); 324 static void sppp_ipv6cp_tlf(struct sppp *sp); 325 static void sppp_ipv6cp_scr(struct sppp *sp); 326 327 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 328 static void sppp_pap_init(struct sppp *sp); 329 static void sppp_pap_open(struct sppp *sp); 330 static void sppp_pap_close(struct sppp *sp); 331 static void sppp_pap_TO(void *sp); 332 static void sppp_pap_my_TO(void *sp); 333 static void sppp_pap_tlu(struct sppp *sp); 334 static void sppp_pap_tld(struct sppp *sp); 335 static void sppp_pap_scr(struct sppp *sp); 336 337 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 338 static void sppp_chap_init(struct sppp *sp); 339 static void sppp_chap_open(struct sppp *sp); 340 static void sppp_chap_close(struct sppp *sp); 341 static void sppp_chap_TO(void *sp); 342 static void sppp_chap_tlu(struct sppp *sp); 343 static void sppp_chap_tld(struct sppp *sp); 344 static void sppp_chap_scr(struct sppp *sp); 345 346 static const char *sppp_auth_type_name(u_short proto, u_char type); 347 static const char *sppp_cp_type_name(u_char type); 348 static const char *sppp_dotted_quad(u_long addr); 349 static const char *sppp_ipcp_opt_name(u_char opt); 350 #ifdef INET6 351 static const char *sppp_ipv6cp_opt_name(u_char opt); 352 #endif 353 static const char *sppp_lcp_opt_name(u_char opt); 354 static const char *sppp_phase_name(enum ppp_phase phase); 355 static const char *sppp_proto_name(u_short proto); 356 static const char *sppp_state_name(int state); 357 static int sppp_params(struct sppp *sp, int cmd, void *data); 358 static int sppp_strnlen(u_char *p, int max); 359 static void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, 360 u_long *srcmask); 361 static void sppp_keepalive(void *dummy); 362 static void sppp_phase_network(struct sppp *sp); 363 static void sppp_print_bytes(const u_char *p, u_short len); 364 static void sppp_print_string(const char *p, u_short len); 365 static void sppp_set_ip_addr(struct sppp *sp, u_long src); 366 #ifdef INET6 367 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 368 struct in6_addr *dst, struct in6_addr *srcmask); 369 #ifdef IPV6CP_MYIFID_DYN 370 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 371 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 372 #endif 373 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 374 #endif 375 376 /* our control protocol descriptors */ 377 static const struct cp lcp = { 378 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 379 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 380 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 381 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 382 sppp_lcp_scr 383 }; 384 385 static const struct cp ipcp = { 386 PPP_IPCP, IDX_IPCP, 387 #ifdef INET 388 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 389 #else 390 0, 391 #endif 392 "ipcp", 393 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 394 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 395 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 396 sppp_ipcp_scr 397 }; 398 399 static const struct cp ipv6cp = { 400 PPP_IPV6CP, IDX_IPV6CP, 401 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 402 CP_NCP, 403 #else 404 0, 405 #endif 406 "ipv6cp", 407 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 408 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 409 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 410 sppp_ipv6cp_scr 411 }; 412 413 static const struct cp pap = { 414 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 415 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 416 sppp_pap_TO, 0, 0, 0, 417 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 418 sppp_pap_scr 419 }; 420 421 static const struct cp chap = { 422 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 423 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 424 sppp_chap_TO, 0, 0, 0, 425 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 426 sppp_chap_scr 427 }; 428 429 static const struct cp *cps[IDX_COUNT] = { 430 &lcp, /* IDX_LCP */ 431 &ipcp, /* IDX_IPCP */ 432 &ipv6cp, /* IDX_IPV6CP */ 433 &pap, /* IDX_PAP */ 434 &chap, /* IDX_CHAP */ 435 }; 436 437 438 /* 440 * Exported functions, comprising our interface to the lower layer. 441 */ 442 443 /* 444 * Process the received packet. 445 */ 446 void 447 sppp_input(struct ifnet *ifp, struct mbuf *m) 448 { 449 struct ppp_header *h = NULL; 450 struct ifqueue *inq = 0; 451 u_int16_t protocol; 452 int s; 453 struct sppp *sp = (struct sppp *)ifp; 454 int debug = ifp->if_flags & IFF_DEBUG; 455 456 if (ifp->if_flags & IFF_UP) 457 /* Count received bytes, add hardware framing */ 458 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 459 460 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 461 /* Too small packet, drop it. */ 462 if (debug) 463 log(LOG_DEBUG, 464 SPP_FMT "input packet is too small, %d bytes\n", 465 SPP_ARGS(ifp), m->m_pkthdr.len); 466 drop: 467 ++ifp->if_ierrors; 468 ++ifp->if_iqdrops; 469 m_freem (m); 470 return; 471 } 472 473 if (sp->pp_flags & PP_NOFRAMING) { 474 protocol = *(mtod(m, u_int16_t*)); 475 protocol = ntohs(protocol); 476 m_adj(m, 2); 477 } else { 478 479 /* Get PPP header. */ 480 h = mtod (m, struct ppp_header*); 481 m_adj (m, PPP_HEADER_LEN); 482 483 switch (h->address) { 484 case PPP_ALLSTATIONS: 485 if (h->control != PPP_UI) 486 goto invalid; 487 if (sp->pp_flags & PP_CISCO) { 488 if (debug) 489 log(LOG_DEBUG, 490 SPP_FMT "PPP packet in Cisco mode " 491 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 492 SPP_ARGS(ifp), 493 h->address, h->control, ntohs(h->protocol)); 494 goto drop; 495 } 496 break; 497 case CISCO_MULTICAST: 498 case CISCO_UNICAST: 499 /* Don't check the control field here (RFC 1547). */ 500 if (! (sp->pp_flags & PP_CISCO)) { 501 if (debug) 502 log(LOG_DEBUG, 503 SPP_FMT "Cisco packet in PPP mode " 504 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 505 SPP_ARGS(ifp), 506 h->address, h->control, ntohs(h->protocol)); 507 goto drop; 508 } 509 switch (ntohs (h->protocol)) { 510 default: 511 ++ifp->if_noproto; 512 goto invalid; 513 case CISCO_KEEPALIVE: 514 sppp_cisco_input ((struct sppp*) ifp, m); 515 m_freem (m); 516 return; 517 #ifdef INET 518 case ETHERTYPE_IP: 519 schednetisr (NETISR_IP); 520 inq = &ipintrq; 521 break; 522 #endif 523 #ifdef INET6 524 case ETHERTYPE_IPV6: 525 schednetisr (NETISR_IPV6); 526 inq = &ip6intrq; 527 break; 528 #endif 529 #ifdef IPX 530 case ETHERTYPE_IPX: 531 schednetisr (NETISR_IPX); 532 inq = &ipxintrq; 533 break; 534 #endif 535 #ifdef NS 536 case ETHERTYPE_NS: 537 schednetisr (NETISR_NS); 538 inq = &nsintrq; 539 break; 540 #endif 541 } 542 goto queue_pkt; 543 default: /* Invalid PPP packet. */ 544 invalid: 545 if (debug) 546 log(LOG_DEBUG, 547 SPP_FMT "invalid input packet " 548 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 549 SPP_ARGS(ifp), 550 h->address, h->control, ntohs(h->protocol)); 551 goto drop; 552 } 553 protocol = ntohs (h->protocol); 554 } 555 556 switch (protocol) { 557 default: 558 if (sp->state[IDX_LCP] == STATE_OPENED) { 559 u_int16_t prot = htons(protocol); 560 sppp_cp_send (sp, PPP_LCP, PROTO_REJ, 561 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 562 &prot); 563 } 564 if (debug) 565 log(LOG_DEBUG, 566 SPP_FMT "invalid input protocol " 567 "<proto=0x%x>\n", SPP_ARGS(ifp), ntohs(protocol)); 568 ++ifp->if_noproto; 569 goto drop; 570 case PPP_LCP: 571 sppp_cp_input(&lcp, sp, m); 572 m_freem (m); 573 return; 574 case PPP_PAP: 575 if (sp->pp_phase >= PHASE_AUTHENTICATE) 576 sppp_pap_input(sp, m); 577 m_freem (m); 578 return; 579 case PPP_CHAP: 580 if (sp->pp_phase >= PHASE_AUTHENTICATE) 581 sppp_chap_input(sp, m); 582 m_freem (m); 583 return; 584 #ifdef INET 585 case PPP_IPCP: 586 if (sp->pp_phase == PHASE_NETWORK) 587 sppp_cp_input(&ipcp, sp, m); 588 m_freem (m); 589 return; 590 case PPP_IP: 591 if (sp->state[IDX_IPCP] == STATE_OPENED) { 592 schednetisr (NETISR_IP); 593 inq = &ipintrq; 594 } 595 break; 596 #endif 597 #ifdef INET6 598 case PPP_IPV6CP: 599 if (sp->pp_phase == PHASE_NETWORK) 600 sppp_cp_input(&ipv6cp, sp, m); 601 m_freem (m); 602 return; 603 604 case PPP_IPV6: 605 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 606 schednetisr (NETISR_IPV6); 607 inq = &ip6intrq; 608 } 609 break; 610 #endif 611 #ifdef IPX 612 case PPP_IPX: 613 /* IPX IPXCP not implemented yet */ 614 if (sp->pp_phase == PHASE_NETWORK) { 615 schednetisr (NETISR_IPX); 616 inq = &ipxintrq; 617 } 618 break; 619 #endif 620 #ifdef NS 621 case PPP_XNS: 622 /* XNS IDPCP not implemented yet */ 623 if (sp->pp_phase == PHASE_NETWORK) { 624 schednetisr (NETISR_NS); 625 inq = &nsintrq; 626 } 627 break; 628 #endif 629 #ifdef ISO 630 case PPP_ISO: 631 /* OSI NLCP not implemented yet */ 632 if (sp->pp_phase == PHASE_NETWORK) { 633 schednetisr (NETISR_ISO); 634 inq = &clnlintrq; 635 } 636 break; 637 #endif 638 } 639 640 queue_pkt: 641 if (! (ifp->if_flags & IFF_UP) || ! inq) 642 goto drop; 643 644 /* Check queue. */ 645 s = splnet(); 646 if (IF_QFULL (inq)) { 647 /* Queue overflow. */ 648 IF_DROP(inq); 649 splx(s); 650 if (debug) 651 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 652 SPP_ARGS(ifp)); 653 goto drop; 654 } 655 IF_ENQUEUE(inq, m); 656 splx(s); 657 } 658 659 /* 660 * Enqueue transmit packet. 661 */ 662 static int 663 sppp_output(struct ifnet *ifp, struct mbuf *m, 664 struct sockaddr *dst, struct rtentry *rt) 665 { 666 struct sppp *sp = (struct sppp*) ifp; 667 struct ppp_header *h = NULL; 668 struct ifqueue *ifq = NULL; /* XXX */ 669 int s, len, rv = 0; 670 u_int16_t protocol; 671 ALTQ_DECL(struct altq_pktattr pktattr;) 672 673 s = splnet(); 674 675 if ((ifp->if_flags & IFF_UP) == 0 || 676 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 677 m_freem (m); 678 splx (s); 679 return (ENETDOWN); 680 } 681 682 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 683 /* 684 * Interface is not yet running, but auto-dial. Need 685 * to start LCP for it. 686 */ 687 ifp->if_flags |= IFF_RUNNING; 688 splx(s); 689 lcp.Open(sp); 690 s = splnet(); 691 } 692 693 /* 694 * If the queueing discipline needs packet classification, 695 * do it before prepending link headers. 696 */ 697 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 698 699 #ifdef INET 700 if (dst->sa_family == AF_INET) 701 { 702 /* Check mbuf length here??? */ 703 struct ip *ip = mtod (m, struct ip*); 704 struct tcphdr *tcp = (struct tcphdr*) ((long*)ip + ip->ip_hl); 705 706 /* 707 * When using dynamic local IP address assignment by using 708 * 0.0.0.0 as a local address, the first TCP session will 709 * not connect because the local TCP checksum is computed 710 * using 0.0.0.0 which will later become our real IP address 711 * so the TCP checksum computed at the remote end will 712 * become invalid. So we 713 * - don't let packets with src ip addr 0 thru 714 * - we flag TCP packets with src ip 0 as an error 715 */ 716 717 if(ip->ip_src.s_addr == INADDR_ANY) /* -hm */ 718 { 719 m_freem(m); 720 splx(s); 721 if(ip->ip_p == IPPROTO_TCP) 722 return(EADDRNOTAVAIL); 723 else 724 return(0); 725 } 726 727 /* 728 * Put low delay, telnet, rlogin and ftp control packets 729 * in front of the queue. 730 */ 731 732 if (! IF_QFULL (&sp->pp_fastq) && 733 ((ip->ip_tos & IPTOS_LOWDELAY) || 734 ((ip->ip_p == IPPROTO_TCP && 735 m->m_len >= sizeof (struct ip) + sizeof (struct tcphdr) && 736 (INTERACTIVE (ntohs (tcp->th_sport)))) || 737 INTERACTIVE (ntohs (tcp->th_dport))))) 738 ifq = &sp->pp_fastq; 739 } 740 #endif 741 742 #ifdef INET6 743 if (dst->sa_family == AF_INET6) { 744 /* XXX do something tricky here? */ 745 } 746 #endif 747 748 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 749 /* 750 * Prepend general data packet PPP header. For now, IP only. 751 */ 752 M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT); 753 if (! m) { 754 if (ifp->if_flags & IFF_DEBUG) 755 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 756 SPP_ARGS(ifp)); 757 ++ifp->if_oerrors; 758 splx (s); 759 return (ENOBUFS); 760 } 761 /* 762 * May want to check size of packet 763 * (albeit due to the implementation it's always enough) 764 */ 765 h = mtod (m, struct ppp_header*); 766 if (sp->pp_flags & PP_CISCO) { 767 h->address = CISCO_UNICAST; /* unicast address */ 768 h->control = 0; 769 } else { 770 h->address = PPP_ALLSTATIONS; /* broadcast address */ 771 h->control = PPP_UI; /* Unnumbered Info */ 772 } 773 } 774 775 switch (dst->sa_family) { 776 #ifdef INET 777 case AF_INET: /* Internet Protocol */ 778 if (sp->pp_flags & PP_CISCO) 779 protocol = htons (ETHERTYPE_IP); 780 else { 781 /* 782 * Don't choke with an ENETDOWN early. It's 783 * possible that we just started dialing out, 784 * so don't drop the packet immediately. If 785 * we notice that we run out of buffer space 786 * below, we will however remember that we are 787 * not ready to carry IP packets, and return 788 * ENETDOWN, as opposed to ENOBUFS. 789 */ 790 protocol = htons(PPP_IP); 791 if (sp->state[IDX_IPCP] != STATE_OPENED) 792 rv = ENETDOWN; 793 } 794 break; 795 #endif 796 #ifdef INET6 797 case AF_INET6: /* Internet Protocol version 6 */ 798 if (sp->pp_flags & PP_CISCO) 799 protocol = htons (ETHERTYPE_IPV6); 800 else { 801 /* 802 * Don't choke with an ENETDOWN early. It's 803 * possible that we just started dialing out, 804 * so don't drop the packet immediately. If 805 * we notice that we run out of buffer space 806 * below, we will however remember that we are 807 * not ready to carry IP packets, and return 808 * ENETDOWN, as opposed to ENOBUFS. 809 */ 810 protocol = htons(PPP_IPV6); 811 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 812 rv = ENETDOWN; 813 } 814 break; 815 #endif 816 #ifdef NS 817 case AF_NS: /* Xerox NS Protocol */ 818 protocol = htons ((sp->pp_flags & PP_CISCO) ? 819 ETHERTYPE_NS : PPP_XNS); 820 break; 821 #endif 822 #ifdef IPX 823 case AF_IPX: /* Novell IPX Protocol */ 824 protocol = htons ((sp->pp_flags & PP_CISCO) ? 825 ETHERTYPE_IPX : PPP_IPX); 826 break; 827 #endif 828 #ifdef ISO 829 case AF_ISO: /* ISO OSI Protocol */ 830 if (sp->pp_flags & PP_CISCO) 831 goto nosupport; 832 protocol = htons (PPP_ISO); 833 break; 834 nosupport: 835 #endif 836 default: 837 m_freem (m); 838 ++ifp->if_oerrors; 839 splx (s); 840 return (EAFNOSUPPORT); 841 } 842 843 if (sp->pp_flags & PP_NOFRAMING) { 844 M_PREPEND (m, 2, M_DONTWAIT); 845 if (m == NULL) { 846 if (ifp->if_flags & IFF_DEBUG) 847 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 848 SPP_ARGS(ifp)); 849 ++ifp->if_oerrors; 850 splx (s); 851 return (ENOBUFS); 852 } 853 *mtod(m, u_int16_t*) = protocol; 854 } else { 855 h->protocol = protocol; 856 } 857 858 /* 859 * Queue message on interface, and start output if interface 860 * not yet active. 861 */ 862 len = m->m_pkthdr.len; 863 if (ifq != NULL 864 #ifdef ALTQ 865 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 866 #endif 867 ) { 868 if (IF_QFULL (ifq)) { 869 IF_DROP (&ifp->if_snd); 870 m_freem (m); 871 if (rv == 0) 872 rv = ENOBUFS; 873 } 874 IF_ENQUEUE(ifq, m); 875 } else 876 IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv); 877 if (rv != 0) { 878 ++ifp->if_oerrors; 879 splx(s); 880 return (rv); 881 } 882 883 if (! (ifp->if_flags & IFF_OACTIVE)) 884 (*ifp->if_start) (ifp); 885 886 /* 887 * Count output packets and bytes. 888 * The packet length includes header + additional hardware framing 889 * according to RFC 1333. 890 */ 891 ifp->if_obytes += len + sp->pp_framebytes; 892 splx (s); 893 return (0); 894 } 895 896 void 897 sppp_attach(struct ifnet *ifp) 898 { 899 struct sppp *sp = (struct sppp*) ifp; 900 901 /* Initialize keepalive handler. */ 902 if (! spppq) { 903 callout_init(&keepalive_ch); 904 callout_reset(&keepalive_ch, hz * 10, sppp_keepalive, NULL); 905 } 906 907 /* Insert new entry into the keepalive list. */ 908 sp->pp_next = spppq; 909 spppq = sp; 910 911 sp->pp_if.if_type = IFT_PPP; 912 sp->pp_if.if_output = sppp_output; 913 sp->pp_fastq.ifq_maxlen = 32; 914 sp->pp_cpq.ifq_maxlen = 20; 915 sp->pp_loopcnt = 0; 916 sp->pp_alivecnt = 0; 917 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 918 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 919 sp->pp_phase = PHASE_DEAD; 920 sp->pp_up = lcp.Up; 921 sp->pp_down = lcp.Down; 922 923 if_alloc_sadl(ifp); 924 925 sppp_lcp_init(sp); 926 sppp_ipcp_init(sp); 927 sppp_ipv6cp_init(sp); 928 sppp_pap_init(sp); 929 sppp_chap_init(sp); 930 } 931 932 void 933 sppp_detach(struct ifnet *ifp) 934 { 935 struct sppp **q, *p, *sp = (struct sppp*) ifp; 936 int i; 937 938 /* Remove the entry from the keepalive list. */ 939 for (q = &spppq; (p = *q); q = &p->pp_next) 940 if (p == sp) { 941 *q = p->pp_next; 942 break; 943 } 944 945 /* Stop keepalive handler. */ 946 if (! spppq) { 947 callout_stop(&keepalive_ch); 948 } 949 950 for (i = 0; i < IDX_COUNT; i++) { 951 callout_stop(&sp->ch[i]); 952 } 953 callout_stop(&sp->pap_my_to_ch); 954 955 if_free_sadl(ifp); 956 } 957 958 /* 959 * Flush the interface output queue. 960 */ 961 void 962 sppp_flush(struct ifnet *ifp) 963 { 964 struct sppp *sp = (struct sppp*) ifp; 965 966 IFQ_PURGE (&sp->pp_if.if_snd); 967 IF_PURGE (&sp->pp_fastq); 968 IF_PURGE (&sp->pp_cpq); 969 } 970 971 /* 972 * Check if the output queue is empty. 973 */ 974 int 975 sppp_isempty(struct ifnet *ifp) 976 { 977 struct sppp *sp = (struct sppp*) ifp; 978 int empty, s; 979 980 s = splnet(); 981 empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head && 982 !sp->pp_if.if_snd.ifq_head; 983 splx(s); 984 return (empty); 985 } 986 987 /* 988 * Get next packet to send. 989 */ 990 struct mbuf * 991 sppp_dequeue(struct ifnet *ifp) 992 { 993 struct sppp *sp = (struct sppp*) ifp; 994 struct mbuf *m; 995 int s; 996 997 s = splnet(); 998 /* 999 * Process only the control protocol queue until we have at 1000 * least one NCP open. 1001 * 1002 * Do always serve all three queues in Cisco mode. 1003 */ 1004 IF_DEQUEUE(&sp->pp_cpq, m); 1005 if (m == NULL && 1006 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1007 IF_DEQUEUE(&sp->pp_fastq, m); 1008 if (m == NULL) 1009 IF_DEQUEUE (&sp->pp_if.if_snd, m); 1010 } 1011 splx(s); 1012 return m; 1013 } 1014 1015 /* 1016 * Pick the next packet, do not remove it from the queue. 1017 */ 1018 struct mbuf * 1019 sppp_pick(struct ifnet *ifp) 1020 { 1021 struct sppp *sp = (struct sppp*)ifp; 1022 struct mbuf *m; 1023 int s; 1024 1025 s= splnet (); 1026 1027 m = sp->pp_cpq.ifq_head; 1028 if (m == NULL && 1029 (sp->pp_phase == PHASE_NETWORK || 1030 (sp->pp_flags & PP_CISCO) != 0)) 1031 if ((m = sp->pp_fastq.ifq_head) == NULL) 1032 m = sp->pp_if.if_snd.ifq_head; 1033 splx (s); 1034 return (m); 1035 } 1036 1037 /* 1038 * Process an ioctl request. Called on low priority level. 1039 */ 1040 int 1041 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1042 { 1043 struct ifreq *ifr = (struct ifreq*) data; 1044 struct sppp *sp = (struct sppp*) ifp; 1045 int s, rv, going_up, going_down, newmode; 1046 1047 s = splnet(); 1048 rv = 0; 1049 switch (cmd) { 1050 case SIOCAIFADDR: 1051 case SIOCSIFDSTADDR: 1052 break; 1053 1054 case SIOCSIFADDR: 1055 if_up(ifp); 1056 /* fall through... */ 1057 1058 case SIOCSIFFLAGS: 1059 going_up = ifp->if_flags & IFF_UP && 1060 (ifp->if_flags & IFF_RUNNING) == 0; 1061 going_down = (ifp->if_flags & IFF_UP) == 0 && 1062 ifp->if_flags & IFF_RUNNING; 1063 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1064 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1065 /* sanity */ 1066 newmode = IFF_PASSIVE; 1067 ifp->if_flags &= ~IFF_AUTO; 1068 } 1069 1070 if (going_up || going_down) 1071 lcp.Close(sp); 1072 if (going_up && newmode == 0) { 1073 /* neither auto-dial nor passive */ 1074 ifp->if_flags |= IFF_RUNNING; 1075 if (!(sp->pp_flags & PP_CISCO)) 1076 lcp.Open(sp); 1077 } else if (going_down) { 1078 sppp_flush(ifp); 1079 ifp->if_flags &= ~IFF_RUNNING; 1080 } 1081 1082 break; 1083 1084 #ifdef SIOCSIFMTU 1085 #ifndef ifr_mtu 1086 #define ifr_mtu ifr_metric 1087 #endif 1088 case SIOCSIFMTU: 1089 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) 1090 return (EINVAL); 1091 ifp->if_mtu = ifr->ifr_mtu; 1092 break; 1093 #endif 1094 #ifdef SLIOCSETMTU 1095 case SLIOCSETMTU: 1096 if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) 1097 return (EINVAL); 1098 ifp->if_mtu = *(short*)data; 1099 break; 1100 #endif 1101 #ifdef SIOCGIFMTU 1102 case SIOCGIFMTU: 1103 ifr->ifr_mtu = ifp->if_mtu; 1104 break; 1105 #endif 1106 #ifdef SLIOCGETMTU 1107 case SLIOCGETMTU: 1108 *(short*)data = ifp->if_mtu; 1109 break; 1110 #endif 1111 case SIOCADDMULTI: 1112 case SIOCDELMULTI: 1113 break; 1114 1115 case SIOCGIFGENERIC: 1116 case SIOCSIFGENERIC: 1117 rv = sppp_params(sp, cmd, data); 1118 break; 1119 1120 default: 1121 rv = ENOTTY; 1122 } 1123 splx(s); 1124 return rv; 1125 } 1126 1127 1128 /* 1130 * Cisco framing implementation. 1131 */ 1132 1133 /* 1134 * Handle incoming Cisco keepalive protocol packets. 1135 */ 1136 static void 1137 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1138 { 1139 STDDCL; 1140 struct cisco_packet *h; 1141 u_long me, mymask; 1142 1143 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1144 if (debug) 1145 log(LOG_DEBUG, 1146 SPP_FMT "cisco invalid packet length: %d bytes\n", 1147 SPP_ARGS(ifp), m->m_pkthdr.len); 1148 return; 1149 } 1150 h = mtod (m, struct cisco_packet*); 1151 if (debug) 1152 log(LOG_DEBUG, 1153 SPP_FMT "cisco input: %d bytes " 1154 "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n", 1155 SPP_ARGS(ifp), m->m_pkthdr.len, 1156 (u_long)ntohl (h->type), (u_long)h->par1, (u_long)h->par2, (u_int)h->rel, 1157 (u_int)h->time0, (u_int)h->time1); 1158 switch (ntohl (h->type)) { 1159 default: 1160 if (debug) 1161 addlog(SPP_FMT "cisco unknown packet type: 0x%lx\n", 1162 SPP_ARGS(ifp), (u_long)ntohl (h->type)); 1163 break; 1164 case CISCO_ADDR_REPLY: 1165 /* Reply on address request, ignore */ 1166 break; 1167 case CISCO_KEEPALIVE_REQ: 1168 sp->pp_alivecnt = 0; 1169 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1170 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1171 /* Local and remote sequence numbers are equal. 1172 * Probably, the line is in loopback mode. */ 1173 if (sp->pp_loopcnt >= MAXALIVECNT) { 1174 printf (SPP_FMT "loopback\n", 1175 SPP_ARGS(ifp)); 1176 sp->pp_loopcnt = 0; 1177 if (ifp->if_flags & IFF_UP) { 1178 if_down (ifp); 1179 IF_PURGE (&sp->pp_cpq); 1180 } 1181 } 1182 ++sp->pp_loopcnt; 1183 1184 /* Generate new local sequence number */ 1185 sp->pp_seq[IDX_LCP] = random(); 1186 break; 1187 } 1188 sp->pp_loopcnt = 0; 1189 if (! (ifp->if_flags & IFF_UP) && 1190 (ifp->if_flags & IFF_RUNNING)) { 1191 if_up(ifp); 1192 printf (SPP_FMT "up\n", SPP_ARGS(ifp)); 1193 } 1194 break; 1195 case CISCO_ADDR_REQ: 1196 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1197 if (me != 0L) 1198 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1199 break; 1200 } 1201 } 1202 1203 /* 1204 * Send Cisco keepalive packet. 1205 */ 1206 static void 1207 sppp_cisco_send(struct sppp *sp, int type, long par1, long par2) 1208 { 1209 STDDCL; 1210 struct ppp_header *h; 1211 struct cisco_packet *ch; 1212 struct mbuf *m; 1213 u_long t = (time.tv_sec - boottime.tv_sec) * 1000; 1214 1215 MGETHDR (m, M_DONTWAIT, MT_DATA); 1216 if (! m) 1217 return; 1218 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1219 m->m_pkthdr.rcvif = 0; 1220 1221 h = mtod (m, struct ppp_header*); 1222 h->address = CISCO_MULTICAST; 1223 h->control = 0; 1224 h->protocol = htons (CISCO_KEEPALIVE); 1225 1226 ch = (struct cisco_packet*) (h + 1); 1227 ch->type = htonl (type); 1228 ch->par1 = htonl (par1); 1229 ch->par2 = htonl (par2); 1230 ch->rel = -1; 1231 1232 ch->time0 = htons ((u_short) (t >> 16)); 1233 ch->time1 = htons ((u_short) t); 1234 1235 if (debug) 1236 log(LOG_DEBUG, 1237 SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n", 1238 SPP_ARGS(ifp), (u_long)ntohl (ch->type), (u_long)ch->par1, 1239 (u_long)ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1); 1240 1241 if (IF_QFULL (&sp->pp_cpq)) { 1242 IF_DROP (&sp->pp_fastq); 1243 IF_DROP (&ifp->if_snd); 1244 m_freem (m); 1245 } else 1246 IF_ENQUEUE (&sp->pp_cpq, m); 1247 if (! (ifp->if_flags & IFF_OACTIVE)) 1248 (*ifp->if_start) (ifp); 1249 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1250 } 1251 1252 /* 1254 * PPP protocol implementation. 1255 */ 1256 1257 /* 1258 * Send PPP control protocol packet. 1259 */ 1260 static void 1261 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1262 u_char ident, u_short len, void *data) 1263 { 1264 STDDCL; 1265 struct lcp_header *lh; 1266 struct mbuf *m; 1267 size_t pkthdrlen; 1268 1269 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1270 1271 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1272 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1273 MGETHDR (m, M_DONTWAIT, MT_DATA); 1274 if (! m) 1275 return; 1276 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1277 m->m_pkthdr.rcvif = 0; 1278 1279 if (sp->pp_flags & PP_NOFRAMING) { 1280 *mtod(m, u_int16_t*) = htons(proto); 1281 lh = (struct lcp_header*)(mtod(m, u_int8_t*) + 2); 1282 } else { 1283 struct ppp_header *h; 1284 h = mtod (m, struct ppp_header*); 1285 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1286 h->control = PPP_UI; /* Unnumbered Info */ 1287 h->protocol = htons (proto); /* Link Control Protocol */ 1288 lh = (struct lcp_header*) (h + 1); 1289 } 1290 lh->type = type; 1291 lh->ident = ident; 1292 lh->len = htons (LCP_HEADER_LEN + len); 1293 if (len) 1294 bcopy (data, lh+1, len); 1295 1296 if (debug) { 1297 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1298 SPP_ARGS(ifp), 1299 sppp_proto_name(proto), 1300 sppp_cp_type_name (lh->type), lh->ident, 1301 ntohs (lh->len)); 1302 if (len) 1303 sppp_print_bytes ((u_char*) (lh+1), len); 1304 addlog(">\n"); 1305 } 1306 if (IF_QFULL (&sp->pp_cpq)) { 1307 IF_DROP (&sp->pp_fastq); 1308 IF_DROP (&ifp->if_snd); 1309 m_freem (m); 1310 ++ifp->if_oerrors; 1311 } else 1312 IF_ENQUEUE (&sp->pp_cpq, m); 1313 if (! (ifp->if_flags & IFF_OACTIVE)) 1314 (*ifp->if_start) (ifp); 1315 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1316 } 1317 1318 /* 1319 * Handle incoming PPP control protocol packets. 1320 */ 1321 static void 1322 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1323 { 1324 STDDCL; 1325 struct lcp_header *h; 1326 int len = m->m_pkthdr.len; 1327 int rv; 1328 u_char *p; 1329 1330 if (len < 4) { 1331 if (debug) 1332 log(LOG_DEBUG, 1333 SPP_FMT "%s invalid packet length: %d bytes\n", 1334 SPP_ARGS(ifp), cp->name, len); 1335 return; 1336 } 1337 h = mtod (m, struct lcp_header*); 1338 if (debug) { 1339 log(LOG_DEBUG, 1340 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1341 SPP_ARGS(ifp), cp->name, 1342 sppp_state_name(sp->state[cp->protoidx]), 1343 sppp_cp_type_name (h->type), h->ident, ntohs (h->len)); 1344 if (len > 4) 1345 sppp_print_bytes ((u_char*) (h+1), len-4); 1346 addlog(">\n"); 1347 } 1348 if (len > ntohs (h->len)) 1349 len = ntohs (h->len); 1350 p = (u_char *)(h + 1); 1351 switch (h->type) { 1352 case CONF_REQ: 1353 if (len < 4) { 1354 if (debug) 1355 addlog(SPP_FMT "%s invalid conf-req length %d\n", 1356 SPP_ARGS(ifp), cp->name, 1357 len); 1358 ++ifp->if_ierrors; 1359 break; 1360 } 1361 /* handle states where RCR doesn't get a SCA/SCN */ 1362 switch (sp->state[cp->protoidx]) { 1363 case STATE_CLOSING: 1364 case STATE_STOPPING: 1365 return; 1366 case STATE_CLOSED: 1367 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1368 0, 0); 1369 return; 1370 } 1371 rv = (cp->RCR)(sp, h, len); 1372 switch (sp->state[cp->protoidx]) { 1373 case STATE_OPENED: 1374 (cp->tld)(sp); 1375 (cp->scr)(sp); 1376 /* fall through... */ 1377 case STATE_ACK_SENT: 1378 case STATE_REQ_SENT: 1379 sppp_cp_change_state(cp, sp, rv? 1380 STATE_ACK_SENT: STATE_REQ_SENT); 1381 break; 1382 case STATE_STOPPED: 1383 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1384 (cp->scr)(sp); 1385 sppp_cp_change_state(cp, sp, rv? 1386 STATE_ACK_SENT: STATE_REQ_SENT); 1387 break; 1388 case STATE_ACK_RCVD: 1389 if (rv) { 1390 sppp_cp_change_state(cp, sp, STATE_OPENED); 1391 if (debug) 1392 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1393 SPP_ARGS(ifp), 1394 cp->name); 1395 (cp->tlu)(sp); 1396 } else 1397 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1398 break; 1399 default: 1400 printf(SPP_FMT "%s illegal %s in state %s\n", 1401 SPP_ARGS(ifp), cp->name, 1402 sppp_cp_type_name(h->type), 1403 sppp_state_name(sp->state[cp->protoidx])); 1404 ++ifp->if_ierrors; 1405 } 1406 break; 1407 case CONF_ACK: 1408 if (h->ident != sp->confid[cp->protoidx]) { 1409 if (debug) 1410 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1411 SPP_ARGS(ifp), cp->name, 1412 h->ident, sp->confid[cp->protoidx]); 1413 ++ifp->if_ierrors; 1414 break; 1415 } 1416 switch (sp->state[cp->protoidx]) { 1417 case STATE_CLOSED: 1418 case STATE_STOPPED: 1419 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1420 break; 1421 case STATE_CLOSING: 1422 case STATE_STOPPING: 1423 break; 1424 case STATE_REQ_SENT: 1425 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1426 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1427 break; 1428 case STATE_OPENED: 1429 (cp->tld)(sp); 1430 /* fall through */ 1431 case STATE_ACK_RCVD: 1432 (cp->scr)(sp); 1433 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1434 break; 1435 case STATE_ACK_SENT: 1436 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1437 sppp_cp_change_state(cp, sp, STATE_OPENED); 1438 if (debug) 1439 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1440 SPP_ARGS(ifp), cp->name); 1441 (cp->tlu)(sp); 1442 break; 1443 default: 1444 printf(SPP_FMT "%s illegal %s in state %s\n", 1445 SPP_ARGS(ifp), cp->name, 1446 sppp_cp_type_name(h->type), 1447 sppp_state_name(sp->state[cp->protoidx])); 1448 ++ifp->if_ierrors; 1449 } 1450 break; 1451 case CONF_NAK: 1452 case CONF_REJ: 1453 if (h->ident != sp->confid[cp->protoidx]) { 1454 if (debug) 1455 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1456 SPP_ARGS(ifp), cp->name, 1457 h->ident, sp->confid[cp->protoidx]); 1458 ++ifp->if_ierrors; 1459 break; 1460 } 1461 if (h->type == CONF_NAK) 1462 (cp->RCN_nak)(sp, h, len); 1463 else /* CONF_REJ */ 1464 (cp->RCN_rej)(sp, h, len); 1465 1466 switch (sp->state[cp->protoidx]) { 1467 case STATE_CLOSED: 1468 case STATE_STOPPED: 1469 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1470 break; 1471 case STATE_REQ_SENT: 1472 case STATE_ACK_SENT: 1473 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1474 (cp->scr)(sp); 1475 break; 1476 case STATE_OPENED: 1477 (cp->tld)(sp); 1478 /* fall through */ 1479 case STATE_ACK_RCVD: 1480 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1481 (cp->scr)(sp); 1482 break; 1483 case STATE_CLOSING: 1484 case STATE_STOPPING: 1485 break; 1486 default: 1487 printf(SPP_FMT "%s illegal %s in state %s\n", 1488 SPP_ARGS(ifp), cp->name, 1489 sppp_cp_type_name(h->type), 1490 sppp_state_name(sp->state[cp->protoidx])); 1491 ++ifp->if_ierrors; 1492 } 1493 break; 1494 1495 case TERM_REQ: 1496 switch (sp->state[cp->protoidx]) { 1497 case STATE_ACK_RCVD: 1498 case STATE_ACK_SENT: 1499 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1500 /* fall through */ 1501 case STATE_CLOSED: 1502 case STATE_STOPPED: 1503 case STATE_CLOSING: 1504 case STATE_STOPPING: 1505 case STATE_REQ_SENT: 1506 sta: 1507 /* Send Terminate-Ack packet. */ 1508 if (debug) 1509 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1510 SPP_ARGS(ifp), cp->name); 1511 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1512 break; 1513 case STATE_OPENED: 1514 (cp->tld)(sp); 1515 sp->rst_counter[cp->protoidx] = 0; 1516 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1517 goto sta; 1518 break; 1519 default: 1520 printf(SPP_FMT "%s illegal %s in state %s\n", 1521 SPP_ARGS(ifp), cp->name, 1522 sppp_cp_type_name(h->type), 1523 sppp_state_name(sp->state[cp->protoidx])); 1524 ++ifp->if_ierrors; 1525 } 1526 break; 1527 case TERM_ACK: 1528 switch (sp->state[cp->protoidx]) { 1529 case STATE_CLOSED: 1530 case STATE_STOPPED: 1531 case STATE_REQ_SENT: 1532 case STATE_ACK_SENT: 1533 break; 1534 case STATE_CLOSING: 1535 (cp->tlf)(sp); 1536 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1537 sppp_lcp_check_and_close(sp); 1538 break; 1539 case STATE_STOPPING: 1540 (cp->tlf)(sp); 1541 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1542 sppp_lcp_check_and_close(sp); 1543 break; 1544 case STATE_ACK_RCVD: 1545 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1546 break; 1547 case STATE_OPENED: 1548 (cp->tld)(sp); 1549 (cp->scr)(sp); 1550 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1551 break; 1552 default: 1553 printf(SPP_FMT "%s illegal %s in state %s\n", 1554 SPP_ARGS(ifp), cp->name, 1555 sppp_cp_type_name(h->type), 1556 sppp_state_name(sp->state[cp->protoidx])); 1557 ++ifp->if_ierrors; 1558 } 1559 break; 1560 case CODE_REJ: 1561 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1562 log(LOG_INFO, 1563 SPP_FMT "%s: ignoring RXJ (%s) for code ?, " 1564 "danger will robinson\n", 1565 SPP_ARGS(ifp), cp->name, 1566 sppp_cp_type_name(h->type)); 1567 switch (sp->state[cp->protoidx]) { 1568 case STATE_CLOSED: 1569 case STATE_STOPPED: 1570 case STATE_REQ_SENT: 1571 case STATE_ACK_SENT: 1572 case STATE_CLOSING: 1573 case STATE_STOPPING: 1574 case STATE_OPENED: 1575 break; 1576 case STATE_ACK_RCVD: 1577 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1578 break; 1579 default: 1580 printf(SPP_FMT "%s illegal %s in state %s\n", 1581 SPP_ARGS(ifp), cp->name, 1582 sppp_cp_type_name(h->type), 1583 sppp_state_name(sp->state[cp->protoidx])); 1584 ++ifp->if_ierrors; 1585 } 1586 break; 1587 case PROTO_REJ: 1588 { 1589 int catastrophic; 1590 const struct cp *upper; 1591 int i; 1592 u_int16_t proto; 1593 1594 catastrophic = 0; 1595 upper = NULL; 1596 proto = ntohs(*((u_int16_t *)p)); 1597 for (i = 0; i < IDX_COUNT; i++) { 1598 if (cps[i]->proto == proto) { 1599 upper = cps[i]; 1600 break; 1601 } 1602 } 1603 if (upper == NULL) 1604 catastrophic++; 1605 1606 log(LOG_INFO, 1607 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1608 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1609 sppp_cp_type_name(h->type), proto, 1610 upper ? upper->name : "unknown", 1611 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1612 1613 /* 1614 * if we got RXJ+ against conf-req, the peer does not implement 1615 * this particular protocol type. terminate the protocol. 1616 */ 1617 if (upper && !catastrophic) { 1618 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1619 upper->Close(sp); 1620 break; 1621 } 1622 } 1623 1624 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1625 switch (sp->state[cp->protoidx]) { 1626 case STATE_CLOSED: 1627 case STATE_STOPPED: 1628 case STATE_REQ_SENT: 1629 case STATE_ACK_SENT: 1630 case STATE_CLOSING: 1631 case STATE_STOPPING: 1632 case STATE_OPENED: 1633 break; 1634 case STATE_ACK_RCVD: 1635 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1636 break; 1637 default: 1638 printf(SPP_FMT "%s illegal %s in state %s\n", 1639 SPP_ARGS(ifp), cp->name, 1640 sppp_cp_type_name(h->type), 1641 sppp_state_name(sp->state[cp->protoidx])); 1642 ++ifp->if_ierrors; 1643 } 1644 break; 1645 } 1646 case DISC_REQ: 1647 if (cp->proto != PPP_LCP) 1648 goto illegal; 1649 /* Discard the packet. */ 1650 break; 1651 case ECHO_REQ: 1652 if (cp->proto != PPP_LCP) 1653 goto illegal; 1654 if (sp->state[cp->protoidx] != STATE_OPENED) { 1655 if (debug) 1656 addlog(SPP_FMT "lcp echo req but lcp closed\n", 1657 SPP_ARGS(ifp)); 1658 ++ifp->if_ierrors; 1659 break; 1660 } 1661 if (len < 8) { 1662 if (debug) 1663 addlog(SPP_FMT "invalid lcp echo request " 1664 "packet length: %d bytes\n", 1665 SPP_ARGS(ifp), len); 1666 break; 1667 } 1668 if (ntohl (*(long*)(h+1)) == sp->lcp.magic) { 1669 /* Line loopback mode detected. */ 1670 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1671 if_down (ifp); 1672 IF_PURGE (&sp->pp_cpq); 1673 1674 /* Shut down the PPP link. */ 1675 /* XXX */ 1676 lcp.Down(sp); 1677 lcp.Up(sp); 1678 break; 1679 } 1680 *(long*)(h+1) = htonl (sp->lcp.magic); 1681 if (debug) 1682 addlog(SPP_FMT "got lcp echo req, sending echo rep\n", 1683 SPP_ARGS(ifp)); 1684 sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1); 1685 break; 1686 case ECHO_REPLY: 1687 if (cp->proto != PPP_LCP) 1688 goto illegal; 1689 if (h->ident != sp->lcp.echoid) { 1690 ++ifp->if_ierrors; 1691 break; 1692 } 1693 if (len < 8) { 1694 if (debug) 1695 addlog(SPP_FMT "lcp invalid echo reply " 1696 "packet length: %d bytes\n", 1697 SPP_ARGS(ifp), len); 1698 break; 1699 } 1700 if (debug) 1701 addlog(SPP_FMT "lcp got echo rep\n", 1702 SPP_ARGS(ifp)); 1703 if (ntohl (*(long*)(h+1)) != sp->lcp.magic) 1704 sp->pp_alivecnt = 0; 1705 break; 1706 default: 1707 /* Unknown packet type -- send Code-Reject packet. */ 1708 illegal: 1709 if (debug) 1710 addlog(SPP_FMT "%s send code-rej for 0x%x\n", 1711 SPP_ARGS(ifp), cp->name, h->type); 1712 sppp_cp_send(sp, cp->proto, CODE_REJ, 1713 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1714 ++ifp->if_ierrors; 1715 } 1716 } 1717 1718 1719 /* 1720 * The generic part of all Up/Down/Open/Close/TO event handlers. 1721 * Basically, the state transition handling in the automaton. 1722 */ 1723 static void 1724 sppp_up_event(const struct cp *cp, struct sppp *sp) 1725 { 1726 STDDCL; 1727 1728 if (debug) 1729 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1730 SPP_ARGS(ifp), cp->name, 1731 sppp_state_name(sp->state[cp->protoidx])); 1732 1733 switch (sp->state[cp->protoidx]) { 1734 case STATE_INITIAL: 1735 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1736 break; 1737 case STATE_STARTING: 1738 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1739 (cp->scr)(sp); 1740 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1741 break; 1742 default: 1743 printf(SPP_FMT "%s illegal up in state %s\n", 1744 SPP_ARGS(ifp), cp->name, 1745 sppp_state_name(sp->state[cp->protoidx])); 1746 } 1747 } 1748 1749 static void 1750 sppp_down_event(const struct cp *cp, struct sppp *sp) 1751 { 1752 STDDCL; 1753 1754 if (debug) 1755 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1756 SPP_ARGS(ifp), cp->name, 1757 sppp_state_name(sp->state[cp->protoidx])); 1758 1759 switch (sp->state[cp->protoidx]) { 1760 case STATE_CLOSED: 1761 case STATE_CLOSING: 1762 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1763 break; 1764 case STATE_STOPPED: 1765 (cp->tls)(sp); 1766 /* fall through */ 1767 case STATE_STOPPING: 1768 case STATE_REQ_SENT: 1769 case STATE_ACK_RCVD: 1770 case STATE_ACK_SENT: 1771 sppp_cp_change_state(cp, sp, STATE_STARTING); 1772 break; 1773 case STATE_OPENED: 1774 (cp->tld)(sp); 1775 sppp_cp_change_state(cp, sp, STATE_STARTING); 1776 break; 1777 default: 1778 printf(SPP_FMT "%s illegal down in state %s\n", 1779 SPP_ARGS(ifp), cp->name, 1780 sppp_state_name(sp->state[cp->protoidx])); 1781 } 1782 } 1783 1784 1785 static void 1786 sppp_open_event(const struct cp *cp, struct sppp *sp) 1787 { 1788 STDDCL; 1789 1790 if (debug) 1791 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1792 SPP_ARGS(ifp), cp->name, 1793 sppp_state_name(sp->state[cp->protoidx])); 1794 1795 switch (sp->state[cp->protoidx]) { 1796 case STATE_INITIAL: 1797 (cp->tls)(sp); 1798 sppp_cp_change_state(cp, sp, STATE_STARTING); 1799 break; 1800 case STATE_STARTING: 1801 break; 1802 case STATE_CLOSED: 1803 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1804 (cp->scr)(sp); 1805 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1806 break; 1807 case STATE_STOPPED: 1808 case STATE_STOPPING: 1809 case STATE_REQ_SENT: 1810 case STATE_ACK_RCVD: 1811 case STATE_ACK_SENT: 1812 case STATE_OPENED: 1813 break; 1814 case STATE_CLOSING: 1815 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1816 break; 1817 } 1818 } 1819 1820 1821 static void 1822 sppp_close_event(const struct cp *cp, struct sppp *sp) 1823 { 1824 STDDCL; 1825 1826 if (debug) 1827 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1828 SPP_ARGS(ifp), cp->name, 1829 sppp_state_name(sp->state[cp->protoidx])); 1830 1831 switch (sp->state[cp->protoidx]) { 1832 case STATE_INITIAL: 1833 case STATE_CLOSED: 1834 case STATE_CLOSING: 1835 break; 1836 case STATE_STARTING: 1837 (cp->tlf)(sp); 1838 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1839 break; 1840 case STATE_STOPPED: 1841 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1842 break; 1843 case STATE_STOPPING: 1844 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1845 break; 1846 case STATE_OPENED: 1847 (cp->tld)(sp); 1848 /* fall through */ 1849 case STATE_REQ_SENT: 1850 case STATE_ACK_RCVD: 1851 case STATE_ACK_SENT: 1852 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1853 sppp_cp_send(sp, cp->proto, TERM_REQ, 1854 ++sp->pp_seq[cp->protoidx], 0, 0); 1855 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1856 break; 1857 } 1858 } 1859 1860 static void 1861 sppp_to_event(const struct cp *cp, struct sppp *sp) 1862 { 1863 STDDCL; 1864 int s; 1865 1866 s = splnet(); 1867 if (debug) 1868 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 1869 SPP_ARGS(ifp), cp->name, 1870 sppp_state_name(sp->state[cp->protoidx]), 1871 sp->rst_counter[cp->protoidx]); 1872 1873 if (--sp->rst_counter[cp->protoidx] < 0) 1874 /* TO- event */ 1875 switch (sp->state[cp->protoidx]) { 1876 case STATE_CLOSING: 1877 (cp->tlf)(sp); 1878 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1879 sppp_lcp_check_and_close(sp); 1880 break; 1881 case STATE_STOPPING: 1882 (cp->tlf)(sp); 1883 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1884 sppp_lcp_check_and_close(sp); 1885 break; 1886 case STATE_REQ_SENT: 1887 case STATE_ACK_RCVD: 1888 case STATE_ACK_SENT: 1889 (cp->tlf)(sp); 1890 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1891 sppp_lcp_check_and_close(sp); 1892 break; 1893 } 1894 else 1895 /* TO+ event */ 1896 switch (sp->state[cp->protoidx]) { 1897 case STATE_CLOSING: 1898 case STATE_STOPPING: 1899 sppp_cp_send(sp, cp->proto, TERM_REQ, 1900 ++sp->pp_seq[cp->protoidx], 0, 0); 1901 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1902 cp->TO, sp); 1903 break; 1904 case STATE_REQ_SENT: 1905 case STATE_ACK_RCVD: 1906 (cp->scr)(sp); 1907 /* sppp_cp_change_state() will restart the timer */ 1908 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1909 break; 1910 case STATE_ACK_SENT: 1911 (cp->scr)(sp); 1912 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1913 cp->TO, sp); 1914 break; 1915 } 1916 1917 splx(s); 1918 } 1919 1920 /* 1921 * Change the state of a control protocol in the state automaton. 1922 * Takes care of starting/stopping the restart timer. 1923 */ 1924 void 1925 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1926 { 1927 sp->state[cp->protoidx] = newstate; 1928 callout_stop(&sp->ch[cp->protoidx]); 1929 switch (newstate) { 1930 case STATE_INITIAL: 1931 case STATE_STARTING: 1932 case STATE_CLOSED: 1933 case STATE_STOPPED: 1934 case STATE_OPENED: 1935 break; 1936 case STATE_CLOSING: 1937 case STATE_STOPPING: 1938 case STATE_REQ_SENT: 1939 case STATE_ACK_RCVD: 1940 case STATE_ACK_SENT: 1941 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1942 cp->TO, sp); 1943 break; 1944 } 1945 } 1946 /* 1948 *--------------------------------------------------------------------------* 1949 * * 1950 * The LCP implementation. * 1951 * * 1952 *--------------------------------------------------------------------------* 1953 */ 1954 static void 1955 sppp_lcp_init(struct sppp *sp) 1956 { 1957 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 1958 sp->lcp.magic = 0; 1959 sp->state[IDX_LCP] = STATE_INITIAL; 1960 sp->fail_counter[IDX_LCP] = 0; 1961 sp->pp_seq[IDX_LCP] = 0; 1962 sp->pp_rseq[IDX_LCP] = 0; 1963 sp->lcp.protos = 0; 1964 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 1965 1966 /* 1967 * Initialize counters and timeout values. Note that we don't 1968 * use the 3 seconds suggested in RFC 1661 since we are likely 1969 * running on a fast link. XXX We should probably implement 1970 * the exponential backoff option. Note that these values are 1971 * relevant for all control protocols, not just LCP only. 1972 */ 1973 sp->lcp.timeout = 1 * hz; 1974 sp->lcp.max_terminate = 2; 1975 sp->lcp.max_configure = 10; 1976 sp->lcp.max_failure = 10; 1977 callout_init(&sp->ch[IDX_LCP]); 1978 } 1979 1980 static void 1981 sppp_lcp_up(struct sppp *sp) 1982 { 1983 STDDCL; 1984 1985 /* 1986 * If this interface is passive or dial-on-demand, and we are 1987 * still in Initial state, it means we've got an incoming 1988 * call. Activate the interface. 1989 */ 1990 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 1991 if (debug) 1992 log(LOG_DEBUG, 1993 SPP_FMT "Up event", SPP_ARGS(ifp)); 1994 ifp->if_flags |= IFF_RUNNING; 1995 if (sp->state[IDX_LCP] == STATE_INITIAL) { 1996 if (debug) 1997 addlog("(incoming call)\n"); 1998 sp->pp_flags |= PP_CALLIN; 1999 lcp.Open(sp); 2000 } else if (debug) 2001 addlog("\n"); 2002 } 2003 2004 sppp_up_event(&lcp, sp); 2005 } 2006 2007 static void 2008 sppp_lcp_down(struct sppp *sp) 2009 { 2010 STDDCL; 2011 2012 sppp_down_event(&lcp, sp); 2013 2014 /* 2015 * If this is neither a dial-on-demand nor a passive 2016 * interface, simulate an ``ifconfig down'' action, so the 2017 * administrator can force a redial by another ``ifconfig 2018 * up''. XXX For leased line operation, should we immediately 2019 * try to reopen the connection here? 2020 */ 2021 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2022 log(LOG_INFO, 2023 SPP_FMT "Down event (carrier loss), taking interface down.\n", 2024 SPP_ARGS(ifp)); 2025 if_down(ifp); 2026 } else { 2027 if (debug) 2028 log(LOG_DEBUG, 2029 SPP_FMT "Down event (carrier loss)\n", 2030 SPP_ARGS(ifp)); 2031 } 2032 sp->pp_flags &= ~PP_CALLIN; 2033 if (sp->state[IDX_LCP] != STATE_INITIAL) 2034 lcp.Close(sp); 2035 ifp->if_flags &= ~IFF_RUNNING; 2036 } 2037 2038 static void 2039 sppp_lcp_open(struct sppp *sp) 2040 { 2041 /* 2042 * If we are authenticator, negotiate LCP_AUTH 2043 */ 2044 if (sp->hisauth.proto != 0) 2045 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2046 else 2047 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2048 sp->pp_flags &= ~PP_NEEDAUTH; 2049 sppp_open_event(&lcp, sp); 2050 } 2051 2052 static void 2053 sppp_lcp_close(struct sppp *sp) 2054 { 2055 sppp_close_event(&lcp, sp); 2056 } 2057 2058 static void 2059 sppp_lcp_TO(void *cookie) 2060 { 2061 sppp_to_event(&lcp, (struct sppp *)cookie); 2062 } 2063 2064 /* 2065 * Analyze a configure request. Return true if it was agreeable, and 2066 * caused action sca, false if it has been rejected or nak'ed, and 2067 * caused action scn. (The return value is used to make the state 2068 * transition decision in the state automaton.) 2069 */ 2070 static int 2071 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2072 { 2073 STDDCL; 2074 u_char *buf, *r, *p; 2075 int origlen, rlen; 2076 u_long nmagic; 2077 u_short authproto; 2078 2079 len -= 4; 2080 origlen = len; 2081 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2082 if (! buf) 2083 return (0); 2084 2085 if (debug) 2086 log(LOG_DEBUG, SPP_FMT "lcp parse opts:", 2087 SPP_ARGS(ifp)); 2088 2089 /* pass 1: check for things that need to be rejected */ 2090 p = (void*) (h+1); 2091 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2092 if (debug) 2093 addlog(" %s", sppp_lcp_opt_name(*p)); 2094 switch (*p) { 2095 case LCP_OPT_MAGIC: 2096 /* Magic number. */ 2097 /* fall through, both are same length */ 2098 case LCP_OPT_ASYNC_MAP: 2099 /* Async control character map. */ 2100 if (len >= 6 || p[1] == 6) 2101 continue; 2102 if (debug) 2103 addlog(" [invalid]"); 2104 break; 2105 case LCP_OPT_MRU: 2106 /* Maximum receive unit. */ 2107 if (len >= 4 && p[1] == 4) 2108 continue; 2109 if (debug) 2110 addlog(" [invalid]"); 2111 break; 2112 case LCP_OPT_AUTH_PROTO: 2113 if (len < 4) { 2114 if (debug) 2115 addlog(" [invalid]"); 2116 break; 2117 } 2118 authproto = (p[2] << 8) + p[3]; 2119 if (authproto == PPP_CHAP && p[1] != 5) { 2120 if (debug) 2121 addlog(" [invalid chap len]"); 2122 break; 2123 } 2124 if (sp->myauth.proto == 0) { 2125 /* we are not configured to do auth */ 2126 if (debug) 2127 addlog(" [not configured]"); 2128 break; 2129 } 2130 /* 2131 * Remote want us to authenticate, remember this, 2132 * so we stay in PHASE_AUTHENTICATE after LCP got 2133 * up. 2134 */ 2135 sp->pp_flags |= PP_NEEDAUTH; 2136 continue; 2137 default: 2138 /* Others not supported. */ 2139 if (debug) 2140 addlog(" [rej]"); 2141 break; 2142 } 2143 /* Add the option to rejected list. */ 2144 bcopy (p, r, p[1]); 2145 r += p[1]; 2146 rlen += p[1]; 2147 } 2148 if (rlen) { 2149 if (debug) 2150 addlog(" send conf-rej\n"); 2151 sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2152 goto end; 2153 } else if (debug) 2154 addlog("\n"); 2155 2156 /* 2157 * pass 2: check for option values that are unacceptable and 2158 * thus require to be nak'ed. 2159 */ 2160 if (debug) 2161 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2162 SPP_ARGS(ifp)); 2163 2164 p = (void*) (h+1); 2165 len = origlen; 2166 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2167 if (debug) 2168 addlog(" %s", sppp_lcp_opt_name(*p)); 2169 switch (*p) { 2170 case LCP_OPT_MAGIC: 2171 /* Magic number -- extract. */ 2172 nmagic = (u_long)p[2] << 24 | 2173 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2174 if (nmagic != sp->lcp.magic) { 2175 if (debug) 2176 addlog(" 0x%lx", nmagic); 2177 continue; 2178 } 2179 /* 2180 * Local and remote magics equal -- loopback? 2181 */ 2182 if (sp->pp_loopcnt >= MAXALIVECNT*5) { 2183 printf (SPP_FMT "loopback\n", 2184 SPP_ARGS(ifp)); 2185 sp->pp_loopcnt = 0; 2186 if (ifp->if_flags & IFF_UP) { 2187 if_down(ifp); 2188 IF_PURGE(&sp->pp_cpq); 2189 /* XXX ? */ 2190 lcp.Down(sp); 2191 lcp.Up(sp); 2192 } 2193 } else if (debug) 2194 addlog(" [glitch]"); 2195 ++sp->pp_loopcnt; 2196 /* 2197 * We negate our magic here, and NAK it. If 2198 * we see it later in an NAK packet, we 2199 * suggest a new one. 2200 */ 2201 nmagic = ~sp->lcp.magic; 2202 /* Gonna NAK it. */ 2203 p[2] = nmagic >> 24; 2204 p[3] = nmagic >> 16; 2205 p[4] = nmagic >> 8; 2206 p[5] = nmagic; 2207 break; 2208 2209 case LCP_OPT_ASYNC_MAP: 2210 /* Async control character map -- check to be zero. */ 2211 if (! p[2] && ! p[3] && ! p[4] && ! p[5]) { 2212 if (debug) 2213 addlog(" [empty]"); 2214 continue; 2215 } 2216 if (debug) 2217 addlog(" [non-empty]"); 2218 /* suggest a zero one */ 2219 p[2] = p[3] = p[4] = p[5] = 0; 2220 break; 2221 2222 case LCP_OPT_MRU: 2223 /* 2224 * Maximum receive unit. Always agreeable, 2225 * but ignored by now. 2226 */ 2227 sp->lcp.their_mru = p[2] * 256 + p[3]; 2228 if (debug) 2229 addlog(" %ld", sp->lcp.their_mru); 2230 continue; 2231 2232 case LCP_OPT_AUTH_PROTO: 2233 authproto = (p[2] << 8) + p[3]; 2234 if (sp->myauth.proto != authproto) { 2235 /* not agreed, nak */ 2236 if (debug) 2237 addlog(" [mine %s != his %s]", 2238 sppp_proto_name(sp->hisauth.proto), 2239 sppp_proto_name(authproto)); 2240 p[2] = sp->myauth.proto >> 8; 2241 p[3] = sp->myauth.proto; 2242 break; 2243 } 2244 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2245 if (debug) 2246 addlog(" [chap not MD5]"); 2247 p[4] = CHAP_MD5; 2248 break; 2249 } 2250 continue; 2251 } 2252 /* Add the option to nak'ed list. */ 2253 bcopy (p, r, p[1]); 2254 r += p[1]; 2255 rlen += p[1]; 2256 } 2257 if (rlen) { 2258 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2259 if (debug) 2260 addlog(" max_failure (%d) exceeded, " 2261 "send conf-rej\n", 2262 sp->lcp.max_failure); 2263 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2264 } else { 2265 if (debug) 2266 addlog(" send conf-nak\n"); 2267 sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2268 } 2269 goto end; 2270 } else { 2271 if (debug) 2272 addlog(" send conf-ack\n"); 2273 sp->fail_counter[IDX_LCP] = 0; 2274 sp->pp_loopcnt = 0; 2275 sppp_cp_send (sp, PPP_LCP, CONF_ACK, 2276 h->ident, origlen, h+1); 2277 } 2278 2279 end: 2280 free (buf, M_TEMP); 2281 return (rlen == 0); 2282 } 2283 2284 /* 2285 * Analyze the LCP Configure-Reject option list, and adjust our 2286 * negotiation. 2287 */ 2288 static void 2289 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2290 { 2291 STDDCL; 2292 u_char *buf, *p; 2293 2294 len -= 4; 2295 buf = malloc (len, M_TEMP, M_NOWAIT); 2296 if (!buf) 2297 return; 2298 2299 if (debug) 2300 log(LOG_DEBUG, SPP_FMT "lcp rej opts:", 2301 SPP_ARGS(ifp)); 2302 2303 p = (void*) (h+1); 2304 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2305 if (debug) 2306 addlog(" %s", sppp_lcp_opt_name(*p)); 2307 switch (*p) { 2308 case LCP_OPT_MAGIC: 2309 /* Magic number -- can't use it, use 0 */ 2310 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2311 sp->lcp.magic = 0; 2312 break; 2313 case LCP_OPT_MRU: 2314 /* 2315 * Should not be rejected anyway, since we only 2316 * negotiate a MRU if explicitly requested by 2317 * peer. 2318 */ 2319 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2320 break; 2321 case LCP_OPT_AUTH_PROTO: 2322 /* 2323 * Peer doesn't want to authenticate himself, 2324 * deny unless this is a dialout call, and 2325 * AUTHFLAG_NOCALLOUT is set. 2326 */ 2327 if ((sp->pp_flags & PP_CALLIN) == 0 && 2328 (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) { 2329 if (debug) 2330 addlog(" [don't insist on auth " 2331 "for callout]"); 2332 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2333 break; 2334 } 2335 if (debug) 2336 addlog("[access denied]\n"); 2337 lcp.Close(sp); 2338 break; 2339 } 2340 } 2341 if (debug) 2342 addlog("\n"); 2343 free (buf, M_TEMP); 2344 return; 2345 } 2346 2347 /* 2348 * Analyze the LCP Configure-NAK option list, and adjust our 2349 * negotiation. 2350 */ 2351 static void 2352 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2353 { 2354 STDDCL; 2355 u_char *buf, *p; 2356 u_long magic; 2357 2358 len -= 4; 2359 buf = malloc (len, M_TEMP, M_NOWAIT); 2360 if (!buf) 2361 return; 2362 2363 if (debug) 2364 log(LOG_DEBUG, SPP_FMT "lcp nak opts:", 2365 SPP_ARGS(ifp)); 2366 2367 p = (void*) (h+1); 2368 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2369 if (debug) 2370 addlog(" %s", sppp_lcp_opt_name(*p)); 2371 switch (*p) { 2372 case LCP_OPT_MAGIC: 2373 /* Magic number -- renegotiate */ 2374 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2375 len >= 6 && p[1] == 6) { 2376 magic = (u_long)p[2] << 24 | 2377 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2378 /* 2379 * If the remote magic is our negated one, 2380 * this looks like a loopback problem. 2381 * Suggest a new magic to make sure. 2382 */ 2383 if (magic == ~sp->lcp.magic) { 2384 if (debug) 2385 addlog(" magic glitch"); 2386 sp->lcp.magic = random(); 2387 } else { 2388 sp->lcp.magic = magic; 2389 if (debug) 2390 addlog(" %ld", magic); 2391 } 2392 } 2393 break; 2394 case LCP_OPT_MRU: 2395 /* 2396 * Peer wants to advise us to negotiate an MRU. 2397 * Agree on it if it's reasonable, or use 2398 * default otherwise. 2399 */ 2400 if (len >= 4 && p[1] == 4) { 2401 u_int mru = p[2] * 256 + p[3]; 2402 if (debug) 2403 addlog(" %d", mru); 2404 if (mru < PP_MTU || mru > PP_MAX_MRU) 2405 mru = PP_MTU; 2406 sp->lcp.mru = mru; 2407 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2408 } 2409 break; 2410 case LCP_OPT_AUTH_PROTO: 2411 /* 2412 * Peer doesn't like our authentication method, 2413 * deny. 2414 */ 2415 if (debug) 2416 addlog("[access denied]\n"); 2417 lcp.Close(sp); 2418 break; 2419 } 2420 } 2421 if (debug) 2422 addlog("\n"); 2423 free (buf, M_TEMP); 2424 return; 2425 } 2426 2427 static void 2428 sppp_lcp_tlu(struct sppp *sp) 2429 { 2430 STDDCL; 2431 int i; 2432 u_long mask; 2433 2434 /* XXX ? */ 2435 if (! (ifp->if_flags & IFF_UP) && 2436 (ifp->if_flags & IFF_RUNNING)) { 2437 /* Coming out of loopback mode. */ 2438 if_up(ifp); 2439 printf (SPP_FMT "up\n", SPP_ARGS(ifp)); 2440 } 2441 2442 for (i = 0; i < IDX_COUNT; i++) 2443 if ((cps[i])->flags & CP_QUAL) 2444 (cps[i])->Open(sp); 2445 2446 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2447 (sp->pp_flags & PP_NEEDAUTH) != 0) 2448 sp->pp_phase = PHASE_AUTHENTICATE; 2449 else 2450 sp->pp_phase = PHASE_NETWORK; 2451 2452 if(debug) 2453 { 2454 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2455 sppp_phase_name(sp->pp_phase)); 2456 } 2457 2458 /* 2459 * Open all authentication protocols. This is even required 2460 * if we already proceeded to network phase, since it might be 2461 * that remote wants us to authenticate, so we might have to 2462 * send a PAP request. Undesired authentication protocols 2463 * don't do anything when they get an Open event. 2464 */ 2465 for (i = 0; i < IDX_COUNT; i++) 2466 if ((cps[i])->flags & CP_AUTH) 2467 (cps[i])->Open(sp); 2468 2469 if (sp->pp_phase == PHASE_NETWORK) { 2470 /* Notify all NCPs. */ 2471 for (i = 0; i < IDX_COUNT; i++) 2472 if ((cps[i])->flags & CP_NCP) 2473 (cps[i])->Open(sp); 2474 } 2475 2476 /* Send Up events to all started protos. */ 2477 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2478 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2479 (cps[i])->Up(sp); 2480 2481 /* notify low-level driver of state change */ 2482 if (sp->pp_chg) 2483 sp->pp_chg(sp, (int)sp->pp_phase); 2484 2485 if (sp->pp_phase == PHASE_NETWORK) 2486 /* if no NCP is starting, close down */ 2487 sppp_lcp_check_and_close(sp); 2488 } 2489 2490 static void 2491 sppp_lcp_tld(struct sppp *sp) 2492 { 2493 STDDCL; 2494 int i; 2495 u_long mask; 2496 2497 sp->pp_phase = PHASE_TERMINATE; 2498 2499 if(debug) 2500 { 2501 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2502 sppp_phase_name(sp->pp_phase)); 2503 } 2504 2505 /* 2506 * Take upper layers down. We send the Down event first and 2507 * the Close second to prevent the upper layers from sending 2508 * ``a flurry of terminate-request packets'', as the RFC 2509 * describes it. 2510 */ 2511 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2512 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2513 (cps[i])->Down(sp); 2514 (cps[i])->Close(sp); 2515 } 2516 } 2517 2518 static void 2519 sppp_lcp_tls(struct sppp *sp) 2520 { 2521 STDDCL; 2522 2523 sp->pp_phase = PHASE_ESTABLISH; 2524 2525 if(debug) 2526 { 2527 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2528 sppp_phase_name(sp->pp_phase)); 2529 } 2530 2531 /* Notify lower layer if desired. */ 2532 if (sp->pp_tls) 2533 (sp->pp_tls)(sp); 2534 } 2535 2536 static void 2537 sppp_lcp_tlf(struct sppp *sp) 2538 { 2539 STDDCL; 2540 2541 sp->pp_phase = PHASE_DEAD; 2542 2543 if(debug) 2544 { 2545 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2546 sppp_phase_name(sp->pp_phase)); 2547 } 2548 2549 /* Notify lower layer if desired. */ 2550 if (sp->pp_tlf) 2551 (sp->pp_tlf)(sp); 2552 } 2553 2554 static void 2555 sppp_lcp_scr(struct sppp *sp) 2556 { 2557 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2558 int i = 0; 2559 u_short authproto; 2560 2561 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2562 if (! sp->lcp.magic) 2563 sp->lcp.magic = random(); 2564 opt[i++] = LCP_OPT_MAGIC; 2565 opt[i++] = 6; 2566 opt[i++] = sp->lcp.magic >> 24; 2567 opt[i++] = sp->lcp.magic >> 16; 2568 opt[i++] = sp->lcp.magic >> 8; 2569 opt[i++] = sp->lcp.magic; 2570 } 2571 2572 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2573 opt[i++] = LCP_OPT_MRU; 2574 opt[i++] = 4; 2575 opt[i++] = sp->lcp.mru >> 8; 2576 opt[i++] = sp->lcp.mru; 2577 } 2578 2579 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2580 authproto = sp->hisauth.proto; 2581 opt[i++] = LCP_OPT_AUTH_PROTO; 2582 opt[i++] = authproto == PPP_CHAP? 5: 4; 2583 opt[i++] = authproto >> 8; 2584 opt[i++] = authproto; 2585 if (authproto == PPP_CHAP) 2586 opt[i++] = CHAP_MD5; 2587 } 2588 2589 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2590 sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2591 } 2592 2593 /* 2594 * Check the open NCPs, return true if at least one NCP is open. 2595 */ 2596 static int 2597 sppp_ncp_check(struct sppp *sp) 2598 { 2599 int i, mask; 2600 2601 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2602 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2603 return 1; 2604 return 0; 2605 } 2606 2607 /* 2608 * Re-check the open NCPs and see if we should terminate the link. 2609 * Called by the NCPs during their tlf action handling. 2610 */ 2611 static void 2612 sppp_lcp_check_and_close(struct sppp *sp) 2613 { 2614 2615 if (sp->pp_phase < PHASE_NETWORK) 2616 /* don't bother, we are already going down */ 2617 return; 2618 2619 if (sppp_ncp_check(sp)) 2620 return; 2621 2622 lcp.Close(sp); 2623 } 2624 2625 2626 /* 2628 *--------------------------------------------------------------------------* 2629 * * 2630 * The IPCP implementation. * 2631 * * 2632 *--------------------------------------------------------------------------* 2633 */ 2634 2635 static void 2636 sppp_ipcp_init(struct sppp *sp) 2637 { 2638 sp->ipcp.opts = 0; 2639 sp->ipcp.flags = 0; 2640 sp->state[IDX_IPCP] = STATE_INITIAL; 2641 sp->fail_counter[IDX_IPCP] = 0; 2642 sp->pp_seq[IDX_IPCP] = 0; 2643 sp->pp_rseq[IDX_IPCP] = 0; 2644 callout_init(&sp->ch[IDX_IPCP]); 2645 } 2646 2647 static void 2648 sppp_ipcp_up(struct sppp *sp) 2649 { 2650 sppp_up_event(&ipcp, sp); 2651 } 2652 2653 static void 2654 sppp_ipcp_down(struct sppp *sp) 2655 { 2656 sppp_down_event(&ipcp, sp); 2657 } 2658 2659 static void 2660 sppp_ipcp_open(struct sppp *sp) 2661 { 2662 STDDCL; 2663 u_long myaddr, hisaddr; 2664 2665 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN); 2666 2667 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2668 /* 2669 * If we don't have his address, this probably means our 2670 * interface doesn't want to talk IP at all. (This could 2671 * be the case if somebody wants to speak only IPX, for 2672 * example.) Don't open IPCP in this case. 2673 */ 2674 if (hisaddr == 0L) { 2675 /* XXX this message should go away */ 2676 if (debug) 2677 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 2678 SPP_ARGS(ifp)); 2679 return; 2680 } 2681 2682 if (myaddr == 0L) { 2683 /* 2684 * I don't have an assigned address, so i need to 2685 * negotiate my address. 2686 */ 2687 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2688 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2689 } else 2690 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 2691 sppp_open_event(&ipcp, sp); 2692 } 2693 2694 static void 2695 sppp_ipcp_close(struct sppp *sp) 2696 { 2697 sppp_close_event(&ipcp, sp); 2698 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 2699 /* 2700 * My address was dynamic, clear it again. 2701 */ 2702 sppp_set_ip_addr(sp, 0L); 2703 } 2704 2705 static void 2706 sppp_ipcp_TO(void *cookie) 2707 { 2708 sppp_to_event(&ipcp, (struct sppp *)cookie); 2709 } 2710 2711 /* 2712 * Analyze a configure request. Return true if it was agreeable, and 2713 * caused action sca, false if it has been rejected or nak'ed, and 2714 * caused action scn. (The return value is used to make the state 2715 * transition decision in the state automaton.) 2716 */ 2717 static int 2718 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2719 { 2720 u_char *buf, *r, *p; 2721 struct ifnet *ifp = &sp->pp_if; 2722 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2723 u_long hisaddr, desiredaddr; 2724 int gotmyaddr = 0; 2725 2726 len -= 4; 2727 origlen = len; 2728 /* 2729 * Make sure to allocate a buf that can at least hold a 2730 * conf-nak with an `address' option. We might need it below. 2731 */ 2732 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2733 if (! buf) 2734 return (0); 2735 2736 /* pass 1: see if we can recognize them */ 2737 if (debug) 2738 log(LOG_DEBUG, SPP_FMT "ipcp parse opts:", 2739 SPP_ARGS(ifp)); 2740 p = (void*) (h+1); 2741 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2742 if (debug) 2743 addlog(" %s", sppp_ipcp_opt_name(*p)); 2744 switch (*p) { 2745 #ifdef notyet 2746 case IPCP_OPT_COMPRESSION: 2747 if (len >= 6 && p[1] >= 6) { 2748 /* correctly formed compress option */ 2749 continue; 2750 } 2751 if (debug) 2752 addlog(" [invalid]"); 2753 break; 2754 #endif 2755 case IPCP_OPT_ADDRESS: 2756 if (len >= 6 && p[1] == 6) { 2757 /* correctly formed address option */ 2758 continue; 2759 } 2760 if (debug) 2761 addlog(" [invalid]"); 2762 break; 2763 default: 2764 /* Others not supported. */ 2765 if (debug) 2766 addlog(" [rej]"); 2767 break; 2768 } 2769 /* Add the option to rejected list. */ 2770 bcopy (p, r, p[1]); 2771 r += p[1]; 2772 rlen += p[1]; 2773 } 2774 if (rlen) { 2775 if (debug) 2776 addlog(" send conf-rej\n"); 2777 sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2778 goto end; 2779 } else if (debug) 2780 addlog("\n"); 2781 2782 /* pass 2: parse option values */ 2783 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); 2784 if (debug) 2785 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2786 SPP_ARGS(ifp)); 2787 p = (void*) (h+1); 2788 len = origlen; 2789 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2790 if (debug) 2791 addlog(" %s", sppp_ipcp_opt_name(*p)); 2792 switch (*p) { 2793 #ifdef notyet 2794 case IPCP_OPT_COMPRESSION: 2795 continue; 2796 #endif 2797 case IPCP_OPT_ADDRESS: 2798 desiredaddr = p[2] << 24 | p[3] << 16 | 2799 p[4] << 8 | p[5]; 2800 if (!(sp->ipcp.flags & IPCP_MYADDR_SEEN) && 2801 (sp->ipcp.flags & IPCP_MYADDR_DYN)) { 2802 /* 2803 * hopefully this is our address !! 2804 */ 2805 if (debug) 2806 addlog(" [wantmyaddr %s]", 2807 sppp_dotted_quad(desiredaddr)); 2808 /* 2809 * When doing dynamic address assignment, 2810 * we accept his offer. Otherwise, we 2811 * ignore it and thus continue to negotiate 2812 * our already existing value. 2813 */ 2814 sppp_set_ip_addr(sp, desiredaddr); 2815 if (debug) 2816 addlog(" [agree]"); 2817 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 2818 gotmyaddr++; 2819 continue; 2820 } else { 2821 if (desiredaddr == hisaddr || 2822 (hisaddr == 1 && desiredaddr != 0)) { 2823 /* 2824 * Peer's address is same as our value, 2825 * this is agreeable. Gonna conf-ack 2826 * it. 2827 */ 2828 if (debug) 2829 addlog(" %s [ack]", 2830 sppp_dotted_quad(hisaddr)); 2831 /* record that we've seen it already */ 2832 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2833 continue; 2834 } 2835 /* 2836 * The address wasn't agreeable. This is either 2837 * he sent us 0.0.0.0, asking to assign him an 2838 * address, or he send us another address not 2839 * matching our value. Either case, we gonna 2840 * conf-nak it with our value. 2841 */ 2842 if (debug) { 2843 if (desiredaddr == 0) 2844 addlog(" [addr requested]"); 2845 else 2846 addlog(" %s [not agreed]", 2847 sppp_dotted_quad(desiredaddr)); 2848 } 2849 2850 p[2] = hisaddr >> 24; 2851 p[3] = hisaddr >> 16; 2852 p[4] = hisaddr >> 8; 2853 p[5] = hisaddr; 2854 break; 2855 } 2856 } 2857 /* Add the option to nak'ed list. */ 2858 bcopy (p, r, p[1]); 2859 r += p[1]; 2860 rlen += p[1]; 2861 } 2862 2863 /* 2864 * If we are about to conf-ack the request, but haven't seen 2865 * his address so far, gonna conf-nak it instead, with the 2866 * `address' option present and our idea of his address being 2867 * filled in there, to request negotiation of both addresses. 2868 * 2869 * XXX This can result in an endless req - nak loop if peer 2870 * doesn't want to send us his address. Q: What should we do 2871 * about it? XXX A: implement the max-failure counter. 2872 */ 2873 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN) && !gotmyaddr) { 2874 buf[0] = IPCP_OPT_ADDRESS; 2875 buf[1] = 6; 2876 buf[2] = hisaddr >> 24; 2877 buf[3] = hisaddr >> 16; 2878 buf[4] = hisaddr >> 8; 2879 buf[5] = hisaddr; 2880 rlen = 6; 2881 if (debug) 2882 addlog(" still need hisaddr"); 2883 } 2884 2885 if (rlen) { 2886 if (debug) 2887 addlog(" send conf-nak\n"); 2888 sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2889 } else { 2890 if (debug) 2891 addlog(" send conf-ack\n"); 2892 sppp_cp_send (sp, PPP_IPCP, CONF_ACK, 2893 h->ident, origlen, h+1); 2894 } 2895 2896 end: 2897 free (buf, M_TEMP); 2898 return (rlen == 0); 2899 } 2900 2901 /* 2902 * Analyze the IPCP Configure-Reject option list, and adjust our 2903 * negotiation. 2904 */ 2905 static void 2906 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2907 { 2908 u_char *buf, *p; 2909 struct ifnet *ifp = &sp->pp_if; 2910 int debug = ifp->if_flags & IFF_DEBUG; 2911 2912 len -= 4; 2913 buf = malloc (len, M_TEMP, M_NOWAIT); 2914 if (!buf) 2915 return; 2916 2917 if (debug) 2918 log(LOG_DEBUG, SPP_FMT "ipcp rej opts:", 2919 SPP_ARGS(ifp)); 2920 2921 p = (void*) (h+1); 2922 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2923 if (debug) 2924 addlog(" %s", sppp_ipcp_opt_name(*p)); 2925 switch (*p) { 2926 case IPCP_OPT_ADDRESS: 2927 /* 2928 * Peer doesn't grok address option. This is 2929 * bad. XXX Should we better give up here? 2930 */ 2931 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 2932 break; 2933 #ifdef notyet 2934 case IPCP_OPT_COMPRESS: 2935 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 2936 break; 2937 #endif 2938 } 2939 } 2940 if (debug) 2941 addlog("\n"); 2942 free (buf, M_TEMP); 2943 return; 2944 } 2945 2946 /* 2947 * Analyze the IPCP Configure-NAK option list, and adjust our 2948 * negotiation. 2949 */ 2950 static void 2951 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2952 { 2953 u_char *buf, *p; 2954 struct ifnet *ifp = &sp->pp_if; 2955 int debug = ifp->if_flags & IFF_DEBUG; 2956 u_long wantaddr; 2957 2958 len -= 4; 2959 buf = malloc (len, M_TEMP, M_NOWAIT); 2960 if (!buf) 2961 return; 2962 2963 if (debug) 2964 log(LOG_DEBUG, SPP_FMT "ipcp nak opts:", 2965 SPP_ARGS(ifp)); 2966 2967 p = (void*) (h+1); 2968 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2969 if (debug) 2970 addlog(" %s", sppp_ipcp_opt_name(*p)); 2971 switch (*p) { 2972 case IPCP_OPT_ADDRESS: 2973 /* 2974 * Peer doesn't like our local IP address. See 2975 * if we can do something for him. We'll drop 2976 * him our address then. 2977 */ 2978 if (len >= 6 && p[1] == 6) { 2979 wantaddr = p[2] << 24 | p[3] << 16 | 2980 p[4] << 8 | p[5]; 2981 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2982 if (debug) 2983 addlog(" [wantaddr %s]", 2984 sppp_dotted_quad(wantaddr)); 2985 /* 2986 * When doing dynamic address assignment, 2987 * we accept his offer. Otherwise, we 2988 * ignore it and thus continue to negotiate 2989 * our already existing value. 2990 */ 2991 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 2992 sppp_set_ip_addr(sp, wantaddr); 2993 if (debug) 2994 addlog(" [agree]"); 2995 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 2996 } 2997 } 2998 break; 2999 #ifdef notyet 3000 case IPCP_OPT_COMPRESS: 3001 /* 3002 * Peer wants different compression parameters. 3003 */ 3004 break; 3005 #endif 3006 } 3007 } 3008 if (debug) 3009 addlog("\n"); 3010 free (buf, M_TEMP); 3011 return; 3012 } 3013 3014 static void 3015 sppp_ipcp_tlu(struct sppp *sp) 3016 { 3017 /* we are up - notify isdn daemon */ 3018 if (sp->pp_con) 3019 sp->pp_con(sp); 3020 } 3021 3022 static void 3023 sppp_ipcp_tld(struct sppp *sp) 3024 { 3025 } 3026 3027 static void 3028 sppp_ipcp_tls(struct sppp *sp) 3029 { 3030 /* indicate to LCP that it must stay alive */ 3031 sp->lcp.protos |= (1 << IDX_IPCP); 3032 } 3033 3034 static void 3035 sppp_ipcp_tlf(struct sppp *sp) 3036 { 3037 /* we no longer need LCP */ 3038 sp->lcp.protos &= ~(1 << IDX_IPCP); 3039 } 3040 3041 static void 3042 sppp_ipcp_scr(struct sppp *sp) 3043 { 3044 char opt[6 /* compression */ + 6 /* address */]; 3045 u_long ouraddr; 3046 int i = 0; 3047 3048 #ifdef notyet 3049 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3050 opt[i++] = IPCP_OPT_COMPRESSION; 3051 opt[i++] = 6; 3052 opt[i++] = 0; /* VJ header compression */ 3053 opt[i++] = 0x2d; /* VJ header compression */ 3054 opt[i++] = max_slot_id; 3055 opt[i++] = comp_slot_id; 3056 } 3057 #endif 3058 3059 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3060 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3061 opt[i++] = IPCP_OPT_ADDRESS; 3062 opt[i++] = 6; 3063 opt[i++] = ouraddr >> 24; 3064 opt[i++] = ouraddr >> 16; 3065 opt[i++] = ouraddr >> 8; 3066 opt[i++] = ouraddr; 3067 } 3068 3069 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3070 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3071 } 3072 3073 3074 /* 3076 *--------------------------------------------------------------------------* 3077 * * 3078 * The IPv6CP implementation. * 3079 * * 3080 *--------------------------------------------------------------------------* 3081 */ 3082 3083 #ifdef INET6 3084 static void 3085 sppp_ipv6cp_init(struct sppp *sp) 3086 { 3087 sp->ipv6cp.opts = 0; 3088 sp->ipv6cp.flags = 0; 3089 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3090 sp->fail_counter[IDX_IPV6CP] = 0; 3091 sp->pp_seq[IDX_IPV6CP] = 0; 3092 sp->pp_rseq[IDX_IPV6CP] = 0; 3093 callout_init(&sp->ch[IDX_IPV6CP]); 3094 } 3095 3096 static void 3097 sppp_ipv6cp_up(struct sppp *sp) 3098 { 3099 sppp_up_event(&ipv6cp, sp); 3100 } 3101 3102 static void 3103 sppp_ipv6cp_down(struct sppp *sp) 3104 { 3105 sppp_down_event(&ipv6cp, sp); 3106 } 3107 3108 static void 3109 sppp_ipv6cp_open(struct sppp *sp) 3110 { 3111 STDDCL; 3112 struct in6_addr myaddr, hisaddr; 3113 3114 #ifdef IPV6CP_MYIFID_DYN 3115 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3116 #else 3117 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3118 #endif 3119 3120 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3121 /* 3122 * If we don't have our address, this probably means our 3123 * interface doesn't want to talk IPv6 at all. (This could 3124 * be the case if somebody wants to speak only IPX, for 3125 * example.) Don't open IPv6CP in this case. 3126 */ 3127 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3128 /* XXX this message should go away */ 3129 if (debug) 3130 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3131 SPP_ARGS(ifp)); 3132 return; 3133 } 3134 3135 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3136 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3137 sppp_open_event(&ipv6cp, sp); 3138 } 3139 3140 static void 3141 sppp_ipv6cp_close(struct sppp *sp) 3142 { 3143 sppp_close_event(&ipv6cp, sp); 3144 } 3145 3146 static void 3147 sppp_ipv6cp_TO(void *cookie) 3148 { 3149 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3150 } 3151 3152 /* 3153 * Analyze a configure request. Return true if it was agreeable, and 3154 * caused action sca, false if it has been rejected or nak'ed, and 3155 * caused action scn. (The return value is used to make the state 3156 * transition decision in the state automaton.) 3157 */ 3158 static int 3159 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3160 { 3161 u_char *buf, *r, *p; 3162 struct ifnet *ifp = &sp->pp_if; 3163 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3164 struct in6_addr myaddr, desiredaddr, suggestaddr; 3165 int ifidcount; 3166 int type; 3167 int collision, nohisaddr; 3168 3169 len -= 4; 3170 origlen = len; 3171 /* 3172 * Make sure to allocate a buf that can at least hold a 3173 * conf-nak with an `address' option. We might need it below. 3174 */ 3175 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3176 if (! buf) 3177 return (0); 3178 3179 /* pass 1: see if we can recognize them */ 3180 if (debug) 3181 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:", 3182 SPP_ARGS(ifp)); 3183 p = (void*) (h+1); 3184 ifidcount = 0; 3185 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3186 if (debug) 3187 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3188 switch (*p) { 3189 case IPV6CP_OPT_IFID: 3190 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3191 /* correctly formed address option */ 3192 ifidcount++; 3193 continue; 3194 } 3195 if (debug) 3196 addlog(" [invalid]"); 3197 break; 3198 #ifdef notyet 3199 case IPV6CP_OPT_COMPRESSION: 3200 if (len >= 4 && p[1] >= 4) { 3201 /* correctly formed compress option */ 3202 continue; 3203 } 3204 if (debug) 3205 addlog(" [invalid]"); 3206 break; 3207 #endif 3208 default: 3209 /* Others not supported. */ 3210 if (debug) 3211 addlog(" [rej]"); 3212 break; 3213 } 3214 /* Add the option to rejected list. */ 3215 bcopy (p, r, p[1]); 3216 r += p[1]; 3217 rlen += p[1]; 3218 } 3219 if (rlen) { 3220 if (debug) 3221 addlog(" send conf-rej\n"); 3222 sppp_cp_send (sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3223 goto end; 3224 } else if (debug) 3225 addlog("\n"); 3226 3227 /* pass 2: parse option values */ 3228 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3229 if (debug) 3230 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ", 3231 SPP_ARGS(ifp)); 3232 p = (void*) (h+1); 3233 len = origlen; 3234 type = CONF_ACK; 3235 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3236 if (debug) 3237 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3238 switch (*p) { 3239 #ifdef notyet 3240 case IPV6CP_OPT_COMPRESSION: 3241 continue; 3242 #endif 3243 case IPV6CP_OPT_IFID: 3244 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3245 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3246 collision = (bcmp(&desiredaddr.s6_addr[8], 3247 &myaddr.s6_addr[8], 8) == 0); 3248 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3249 3250 desiredaddr.s6_addr16[0] = htons(0xfe80); 3251 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3252 3253 if (!collision && !nohisaddr) { 3254 /* no collision, hisaddr known - Conf-Ack */ 3255 type = CONF_ACK; 3256 3257 if (debug) { 3258 addlog(" %s [%s]", 3259 ip6_sprintf(&desiredaddr), 3260 sppp_cp_type_name(type)); 3261 } 3262 continue; 3263 } 3264 3265 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3266 if (collision && nohisaddr) { 3267 /* collision, hisaddr unknown - Conf-Rej */ 3268 type = CONF_REJ; 3269 memset(&p[2], 0, 8); 3270 } else { 3271 /* 3272 * - no collision, hisaddr unknown, or 3273 * - collision, hisaddr known 3274 * Conf-Nak, suggest hisaddr 3275 */ 3276 type = CONF_NAK; 3277 sppp_suggest_ip6_addr(sp, &suggestaddr); 3278 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3279 } 3280 if (debug) 3281 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3282 sppp_cp_type_name(type)); 3283 break; 3284 } 3285 /* Add the option to nak'ed list. */ 3286 bcopy (p, r, p[1]); 3287 r += p[1]; 3288 rlen += p[1]; 3289 } 3290 3291 if (rlen == 0 && type == CONF_ACK) { 3292 if (debug) 3293 addlog(" send %s\n", sppp_cp_type_name(type)); 3294 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, origlen, h+1); 3295 } else { 3296 #ifdef DIAGNOSTIC 3297 if (type == CONF_ACK) 3298 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3299 #endif 3300 3301 if (debug) { 3302 addlog(" send %s suggest %s\n", 3303 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3304 } 3305 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3306 } 3307 3308 end: 3309 free (buf, M_TEMP); 3310 return (rlen == 0); 3311 } 3312 3313 /* 3314 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3315 * negotiation. 3316 */ 3317 static void 3318 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3319 { 3320 u_char *buf, *p; 3321 struct ifnet *ifp = &sp->pp_if; 3322 int debug = ifp->if_flags & IFF_DEBUG; 3323 3324 len -= 4; 3325 buf = malloc (len, M_TEMP, M_NOWAIT); 3326 if (!buf) 3327 return; 3328 3329 if (debug) 3330 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:", 3331 SPP_ARGS(ifp)); 3332 3333 p = (void*) (h+1); 3334 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3335 if (debug) 3336 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3337 switch (*p) { 3338 case IPV6CP_OPT_IFID: 3339 /* 3340 * Peer doesn't grok address option. This is 3341 * bad. XXX Should we better give up here? 3342 */ 3343 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3344 break; 3345 #ifdef notyet 3346 case IPV6CP_OPT_COMPRESS: 3347 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3348 break; 3349 #endif 3350 } 3351 } 3352 if (debug) 3353 addlog("\n"); 3354 free (buf, M_TEMP); 3355 return; 3356 } 3357 3358 /* 3359 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3360 * negotiation. 3361 */ 3362 static void 3363 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3364 { 3365 u_char *buf, *p; 3366 struct ifnet *ifp = &sp->pp_if; 3367 int debug = ifp->if_flags & IFF_DEBUG; 3368 struct in6_addr suggestaddr; 3369 3370 len -= 4; 3371 buf = malloc (len, M_TEMP, M_NOWAIT); 3372 if (!buf) 3373 return; 3374 3375 if (debug) 3376 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:", 3377 SPP_ARGS(ifp)); 3378 3379 p = (void*) (h+1); 3380 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3381 if (debug) 3382 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3383 switch (*p) { 3384 case IPV6CP_OPT_IFID: 3385 /* 3386 * Peer doesn't like our local ifid. See 3387 * if we can do something for him. We'll drop 3388 * him our address then. 3389 */ 3390 if (len < 10 || p[1] != 10) 3391 break; 3392 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3393 suggestaddr.s6_addr16[0] = htons(0xfe80); 3394 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3395 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3396 3397 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3398 if (debug) 3399 addlog(" [suggestaddr %s]", 3400 ip6_sprintf(&suggestaddr)); 3401 #ifdef IPV6CP_MYIFID_DYN 3402 /* 3403 * When doing dynamic address assignment, 3404 * we accept his offer. 3405 */ 3406 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3407 struct in6_addr lastsuggest; 3408 /* 3409 * If <suggested myaddr from peer> equals to 3410 * <hisaddr we have suggested last time>, 3411 * we have a collision. generate new random 3412 * ifid. 3413 */ 3414 sppp_suggest_ip6_addr(&lastsuggest); 3415 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3416 lastsuggest)) { 3417 if (debug) 3418 addlog(" [random]"); 3419 sppp_gen_ip6_addr(sp, &suggestaddr); 3420 } 3421 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3422 if (debug) 3423 addlog(" [agree]"); 3424 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3425 } 3426 #else 3427 /* 3428 * Since we do not do dynamic address assignment, 3429 * we ignore it and thus continue to negotiate 3430 * our already existing value. This can possibly 3431 * go into infinite request-reject loop. 3432 * 3433 * This is not likely because we normally use 3434 * ifid based on MAC-address. 3435 * If you have no ethernet card on the node, too bad. 3436 * XXX should we use fail_counter? 3437 */ 3438 #endif 3439 break; 3440 #ifdef notyet 3441 case IPV6CP_OPT_COMPRESS: 3442 /* 3443 * Peer wants different compression parameters. 3444 */ 3445 break; 3446 #endif 3447 } 3448 } 3449 if (debug) 3450 addlog("\n"); 3451 free (buf, M_TEMP); 3452 return; 3453 } 3454 3455 static void 3456 sppp_ipv6cp_tlu(struct sppp *sp) 3457 { 3458 /* we are up - notify isdn daemon */ 3459 if (sp->pp_con) 3460 sp->pp_con(sp); 3461 } 3462 3463 static void 3464 sppp_ipv6cp_tld(struct sppp *sp) 3465 { 3466 } 3467 3468 static void 3469 sppp_ipv6cp_tls(struct sppp *sp) 3470 { 3471 /* indicate to LCP that it must stay alive */ 3472 sp->lcp.protos |= (1 << IDX_IPV6CP); 3473 } 3474 3475 static void 3476 sppp_ipv6cp_tlf(struct sppp *sp) 3477 { 3478 /* we no longer need LCP */ 3479 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3480 } 3481 3482 static void 3483 sppp_ipv6cp_scr(struct sppp *sp) 3484 { 3485 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3486 struct in6_addr ouraddr; 3487 int i = 0; 3488 3489 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3490 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3491 opt[i++] = IPV6CP_OPT_IFID; 3492 opt[i++] = 10; 3493 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3494 i += 8; 3495 } 3496 3497 #ifdef notyet 3498 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3499 opt[i++] = IPV6CP_OPT_COMPRESSION; 3500 opt[i++] = 4; 3501 opt[i++] = 0; /* TBD */ 3502 opt[i++] = 0; /* TBD */ 3503 /* variable length data may follow */ 3504 } 3505 #endif 3506 3507 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3508 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3509 } 3510 #else /*INET6*/ 3511 static void sppp_ipv6cp_init(struct sppp *sp) 3512 { 3513 } 3514 3515 static void sppp_ipv6cp_up(struct sppp *sp) 3516 { 3517 } 3518 3519 static void sppp_ipv6cp_down(struct sppp *sp) 3520 { 3521 } 3522 3523 3524 static void sppp_ipv6cp_open(struct sppp *sp) 3525 { 3526 } 3527 3528 static void sppp_ipv6cp_close(struct sppp *sp) 3529 { 3530 } 3531 3532 static void sppp_ipv6cp_TO(void *sp) 3533 { 3534 } 3535 3536 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3537 { 3538 return 0; 3539 } 3540 3541 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3542 { 3543 } 3544 3545 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3546 { 3547 } 3548 3549 static void sppp_ipv6cp_tlu(struct sppp *sp) 3550 { 3551 } 3552 3553 static void sppp_ipv6cp_tld(struct sppp *sp) 3554 { 3555 } 3556 3557 static void sppp_ipv6cp_tls(struct sppp *sp) 3558 { 3559 } 3560 3561 static void sppp_ipv6cp_tlf(struct sppp *sp) 3562 { 3563 } 3564 3565 static void sppp_ipv6cp_scr(struct sppp *sp) 3566 { 3567 } 3568 #endif /*INET6*/ 3569 3570 3571 /* 3573 *--------------------------------------------------------------------------* 3574 * * 3575 * The CHAP implementation. * 3576 * * 3577 *--------------------------------------------------------------------------* 3578 */ 3579 3580 /* 3581 * The authentication protocols don't employ a full-fledged state machine as 3582 * the control protocols do, since they do have Open and Close events, but 3583 * not Up and Down, nor are they explicitly terminated. Also, use of the 3584 * authentication protocols may be different in both directions (this makes 3585 * sense, think of a machine that never accepts incoming calls but only 3586 * calls out, it doesn't require the called party to authenticate itself). 3587 * 3588 * Our state machine for the local authentication protocol (we are requesting 3589 * the peer to authenticate) looks like: 3590 * 3591 * RCA- 3592 * +--------------------------------------------+ 3593 * V scn,tld| 3594 * +--------+ Close +---------+ RCA+ 3595 * | |<----------------------------------| |------+ 3596 * +--->| Closed | TO* | Opened | sca | 3597 * | | |-----+ +-------| |<-----+ 3598 * | +--------+ irc | | +---------+ 3599 * | ^ | | ^ 3600 * | | | | | 3601 * | | | | | 3602 * | TO-| | | | 3603 * | |tld TO+ V | | 3604 * | | +------->+ | | 3605 * | | | | | | 3606 * | +--------+ V | | 3607 * | | |<----+<--------------------+ | 3608 * | | Req- | scr | 3609 * | | Sent | | 3610 * | | | | 3611 * | +--------+ | 3612 * | RCA- | | RCA+ | 3613 * +------+ +------------------------------------------+ 3614 * scn,tld sca,irc,ict,tlu 3615 * 3616 * 3617 * with: 3618 * 3619 * Open: LCP reached authentication phase 3620 * Close: LCP reached terminate phase 3621 * 3622 * RCA+: received reply (pap-req, chap-response), acceptable 3623 * RCN: received reply (pap-req, chap-response), not acceptable 3624 * TO+: timeout with restart counter >= 0 3625 * TO-: timeout with restart counter < 0 3626 * TO*: reschedule timeout for CHAP 3627 * 3628 * scr: send request packet (none for PAP, chap-challenge) 3629 * sca: send ack packet (pap-ack, chap-success) 3630 * scn: send nak packet (pap-nak, chap-failure) 3631 * ict: initialize re-challenge timer (CHAP only) 3632 * 3633 * tlu: this-layer-up, LCP reaches network phase 3634 * tld: this-layer-down, LCP enters terminate phase 3635 * 3636 * Note that in CHAP mode, after sending a new challenge, while the state 3637 * automaton falls back into Req-Sent state, it doesn't signal a tld 3638 * event to LCP, so LCP remains in network phase. Only after not getting 3639 * any response (or after getting an unacceptable response), CHAP closes, 3640 * causing LCP to enter terminate phase. 3641 * 3642 * With PAP, there is no initial request that can be sent. The peer is 3643 * expected to send one based on the successful negotiation of PAP as 3644 * the authentication protocol during the LCP option negotiation. 3645 * 3646 * Incoming authentication protocol requests (remote requests 3647 * authentication, we are peer) don't employ a state machine at all, 3648 * they are simply answered. Some peers [Ascend P50 firmware rev 3649 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3650 * still in authentication phase (thereby violating the standard that 3651 * demands that these NCP packets are to be discarded), so we keep 3652 * track of the peer demanding us to authenticate, and only proceed to 3653 * phase network once we've seen a positive acknowledge for the 3654 * authentication. 3655 */ 3656 3657 /* 3658 * Handle incoming CHAP packets. 3659 */ 3660 void 3661 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3662 { 3663 STDDCL; 3664 struct lcp_header *h; 3665 int len, x; 3666 u_char *value, *name, digest[AUTHKEYLEN], dsize; 3667 int value_len, name_len; 3668 MD5_CTX ctx; 3669 3670 len = m->m_pkthdr.len; 3671 if (len < 4) { 3672 if (debug) 3673 log(LOG_DEBUG, 3674 SPP_FMT "chap invalid packet length: %d bytes\n", 3675 SPP_ARGS(ifp), len); 3676 return; 3677 } 3678 h = mtod (m, struct lcp_header*); 3679 if (len > ntohs (h->len)) 3680 len = ntohs (h->len); 3681 3682 switch (h->type) { 3683 /* challenge, failure and success are his authproto */ 3684 case CHAP_CHALLENGE: 3685 value = 1 + (u_char*)(h+1); 3686 value_len = value[-1]; 3687 name = value + value_len; 3688 name_len = len - value_len - 5; 3689 if (name_len < 0) { 3690 if (debug) { 3691 log(LOG_DEBUG, 3692 SPP_FMT "chap corrupted challenge " 3693 "<%s id=0x%x len=%d", 3694 SPP_ARGS(ifp), 3695 sppp_auth_type_name(PPP_CHAP, h->type), 3696 h->ident, ntohs(h->len)); 3697 if (len > 4) 3698 sppp_print_bytes((u_char*) (h+1), len-4); 3699 addlog(">\n"); 3700 } 3701 break; 3702 } 3703 3704 if (debug) { 3705 log(LOG_DEBUG, 3706 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3707 SPP_ARGS(ifp), 3708 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3709 ntohs(h->len)); 3710 sppp_print_string((char*) name, name_len); 3711 addlog(" value-size=%d value=", value_len); 3712 sppp_print_bytes(value, value_len); 3713 addlog(">\n"); 3714 } 3715 3716 /* Compute reply value. */ 3717 MD5Init(&ctx); 3718 MD5Update(&ctx, &h->ident, 1); 3719 MD5Update(&ctx, sp->myauth.secret, 3720 sppp_strnlen(sp->myauth.secret, AUTHKEYLEN)); 3721 MD5Update(&ctx, value, value_len); 3722 MD5Final(digest, &ctx); 3723 dsize = sizeof digest; 3724 3725 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3726 sizeof dsize, (const char *)&dsize, 3727 sizeof digest, digest, 3728 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN), 3729 sp->myauth.name, 3730 0); 3731 break; 3732 3733 case CHAP_SUCCESS: 3734 if (debug) { 3735 log(LOG_DEBUG, SPP_FMT "chap success", 3736 SPP_ARGS(ifp)); 3737 if (len > 4) { 3738 addlog(": "); 3739 sppp_print_string((char*)(h + 1), len - 4); 3740 } 3741 addlog("\n"); 3742 } 3743 x = splnet(); 3744 sp->pp_flags &= ~PP_NEEDAUTH; 3745 if (sp->myauth.proto == PPP_CHAP && 3746 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3747 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3748 /* 3749 * We are authenticator for CHAP but didn't 3750 * complete yet. Leave it to tlu to proceed 3751 * to network phase. 3752 */ 3753 splx(x); 3754 break; 3755 } 3756 splx(x); 3757 sppp_phase_network(sp); 3758 break; 3759 3760 case CHAP_FAILURE: 3761 if (debug) { 3762 log(LOG_INFO, SPP_FMT "chap failure", 3763 SPP_ARGS(ifp)); 3764 if (len > 4) { 3765 addlog(": "); 3766 sppp_print_string((char*)(h + 1), len - 4); 3767 } 3768 addlog("\n"); 3769 } else 3770 log(LOG_INFO, SPP_FMT "chap failure\n", 3771 SPP_ARGS(ifp)); 3772 /* await LCP shutdown by authenticator */ 3773 break; 3774 3775 /* response is my authproto */ 3776 case CHAP_RESPONSE: 3777 value = 1 + (u_char*)(h+1); 3778 value_len = value[-1]; 3779 name = value + value_len; 3780 name_len = len - value_len - 5; 3781 if (name_len < 0) { 3782 if (debug) { 3783 log(LOG_DEBUG, 3784 SPP_FMT "chap corrupted response " 3785 "<%s id=0x%x len=%d", 3786 SPP_ARGS(ifp), 3787 sppp_auth_type_name(PPP_CHAP, h->type), 3788 h->ident, ntohs(h->len)); 3789 if (len > 4) 3790 sppp_print_bytes((u_char*)(h+1), len-4); 3791 addlog(">\n"); 3792 } 3793 break; 3794 } 3795 if (h->ident != sp->confid[IDX_CHAP]) { 3796 if (debug) 3797 log(LOG_DEBUG, 3798 SPP_FMT "chap dropping response for old ID " 3799 "(got %d, expected %d)\n", 3800 SPP_ARGS(ifp), 3801 h->ident, sp->confid[IDX_CHAP]); 3802 break; 3803 } 3804 if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN) 3805 || bcmp(name, sp->hisauth.name, name_len) != 0) { 3806 log(LOG_INFO, SPP_FMT "chap response, his name ", 3807 SPP_ARGS(ifp)); 3808 sppp_print_string(name, name_len); 3809 addlog(" != expected "); 3810 sppp_print_string(sp->hisauth.name, 3811 sppp_strnlen(sp->hisauth.name, AUTHNAMELEN)); 3812 addlog("\n"); 3813 } 3814 if (debug) { 3815 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 3816 "<%s id=0x%x len=%d name=", 3817 SPP_ARGS(ifp), 3818 sppp_state_name(sp->state[IDX_CHAP]), 3819 sppp_auth_type_name(PPP_CHAP, h->type), 3820 h->ident, ntohs (h->len)); 3821 sppp_print_string((char*)name, name_len); 3822 addlog(" value-size=%d value=", value_len); 3823 sppp_print_bytes(value, value_len); 3824 addlog(">\n"); 3825 } 3826 if (value_len != AUTHKEYLEN) { 3827 if (debug) 3828 log(LOG_DEBUG, 3829 SPP_FMT "chap bad hash value length: " 3830 "%d bytes, should be %d\n", 3831 SPP_ARGS(ifp), value_len, 3832 AUTHKEYLEN); 3833 break; 3834 } 3835 3836 MD5Init(&ctx); 3837 MD5Update(&ctx, &h->ident, 1); 3838 MD5Update(&ctx, sp->hisauth.secret, 3839 sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN)); 3840 MD5Update(&ctx, sp->myauth.challenge, AUTHKEYLEN); 3841 MD5Final(digest, &ctx); 3842 3843 #define FAILMSG "Failed..." 3844 #define SUCCMSG "Welcome!" 3845 3846 if (value_len != sizeof digest || 3847 bcmp(digest, value, value_len) != 0) { 3848 /* action scn, tld */ 3849 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 3850 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 3851 0); 3852 chap.tld(sp); 3853 break; 3854 } 3855 /* action sca, perhaps tlu */ 3856 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 3857 sp->state[IDX_CHAP] == STATE_OPENED) 3858 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 3859 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 3860 0); 3861 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 3862 sppp_cp_change_state(&chap, sp, STATE_OPENED); 3863 chap.tlu(sp); 3864 } 3865 break; 3866 3867 default: 3868 /* Unknown CHAP packet type -- ignore. */ 3869 if (debug) { 3870 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 3871 "<0x%x id=0x%xh len=%d", 3872 SPP_ARGS(ifp), 3873 sppp_state_name(sp->state[IDX_CHAP]), 3874 h->type, h->ident, ntohs(h->len)); 3875 if (len > 4) 3876 sppp_print_bytes((u_char*)(h+1), len-4); 3877 addlog(">\n"); 3878 } 3879 break; 3880 3881 } 3882 } 3883 3884 static void 3885 sppp_chap_init(struct sppp *sp) 3886 { 3887 /* Chap doesn't have STATE_INITIAL at all. */ 3888 sp->state[IDX_CHAP] = STATE_CLOSED; 3889 sp->fail_counter[IDX_CHAP] = 0; 3890 sp->pp_seq[IDX_CHAP] = 0; 3891 sp->pp_rseq[IDX_CHAP] = 0; 3892 callout_init(&sp->ch[IDX_CHAP]); 3893 } 3894 3895 static void 3896 sppp_chap_open(struct sppp *sp) 3897 { 3898 if (sp->myauth.proto == PPP_CHAP && 3899 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 3900 /* we are authenticator for CHAP, start it */ 3901 chap.scr(sp); 3902 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 3903 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 3904 } 3905 /* nothing to be done if we are peer, await a challenge */ 3906 } 3907 3908 static void 3909 sppp_chap_close(struct sppp *sp) 3910 { 3911 if (sp->state[IDX_CHAP] != STATE_CLOSED) 3912 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 3913 } 3914 3915 static void 3916 sppp_chap_TO(void *cookie) 3917 { 3918 struct sppp *sp = (struct sppp *)cookie; 3919 STDDCL; 3920 int s; 3921 3922 s = splnet(); 3923 if (debug) 3924 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 3925 SPP_ARGS(ifp), 3926 sppp_state_name(sp->state[IDX_CHAP]), 3927 sp->rst_counter[IDX_CHAP]); 3928 3929 if (--sp->rst_counter[IDX_CHAP] < 0) 3930 /* TO- event */ 3931 switch (sp->state[IDX_CHAP]) { 3932 case STATE_REQ_SENT: 3933 chap.tld(sp); 3934 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 3935 break; 3936 } 3937 else 3938 /* TO+ (or TO*) event */ 3939 switch (sp->state[IDX_CHAP]) { 3940 case STATE_OPENED: 3941 /* TO* event */ 3942 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 3943 /* fall through */ 3944 case STATE_REQ_SENT: 3945 chap.scr(sp); 3946 /* sppp_cp_change_state() will restart the timer */ 3947 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 3948 break; 3949 } 3950 3951 splx(s); 3952 } 3953 3954 static void 3955 sppp_chap_tlu(struct sppp *sp) 3956 { 3957 STDDCL; 3958 int i, x; 3959 3960 i = 0; 3961 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 3962 3963 /* 3964 * Some broken CHAP implementations (Conware CoNet, firmware 3965 * 4.0.?) don't want to re-authenticate their CHAP once the 3966 * initial challenge-response exchange has taken place. 3967 * Provide for an option to avoid rechallenges. 3968 */ 3969 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) { 3970 /* 3971 * Compute the re-challenge timeout. This will yield 3972 * a number between 300 and 810 seconds. 3973 */ 3974 i = 300 + ((unsigned)(random() & 0xff00) >> 7); 3975 3976 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 3977 } 3978 3979 if (debug) { 3980 log(LOG_DEBUG, 3981 SPP_FMT "chap %s, ", 3982 SPP_ARGS(ifp), 3983 sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu"); 3984 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) 3985 addlog("next re-challenge in %d seconds\n", i); 3986 else 3987 addlog("re-challenging supressed\n"); 3988 } 3989 3990 x = splnet(); 3991 /* indicate to LCP that we need to be closed down */ 3992 sp->lcp.protos |= (1 << IDX_CHAP); 3993 3994 if (sp->pp_flags & PP_NEEDAUTH) { 3995 /* 3996 * Remote is authenticator, but his auth proto didn't 3997 * complete yet. Defer the transition to network 3998 * phase. 3999 */ 4000 splx(x); 4001 return; 4002 } 4003 splx(x); 4004 4005 /* 4006 * If we are already in phase network, we are done here. This 4007 * is the case if this is a dummy tlu event after a re-challenge. 4008 */ 4009 if (sp->pp_phase != PHASE_NETWORK) 4010 sppp_phase_network(sp); 4011 } 4012 4013 static void 4014 sppp_chap_tld(struct sppp *sp) 4015 { 4016 STDDCL; 4017 4018 if (debug) 4019 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4020 callout_stop(&sp->ch[IDX_CHAP]); 4021 sp->lcp.protos &= ~(1 << IDX_CHAP); 4022 4023 lcp.Close(sp); 4024 } 4025 4026 static void 4027 sppp_chap_scr(struct sppp *sp) 4028 { 4029 struct timeval tv; 4030 u_long *ch, seed; 4031 u_char clen; 4032 4033 /* Compute random challenge. */ 4034 ch = (u_long *)sp->myauth.challenge; 4035 microtime(&tv); 4036 seed = tv.tv_sec ^ tv.tv_usec; 4037 ch[0] = seed ^ random(); 4038 ch[1] = seed ^ random(); 4039 ch[2] = seed ^ random(); 4040 ch[3] = seed ^ random(); 4041 clen = AUTHKEYLEN; 4042 4043 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4044 4045 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4046 sizeof clen, (const char *)&clen, 4047 (size_t)AUTHKEYLEN, sp->myauth.challenge, 4048 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN), 4049 sp->myauth.name, 4050 0); 4051 } 4052 /* 4054 *--------------------------------------------------------------------------* 4055 * * 4056 * The PAP implementation. * 4057 * * 4058 *--------------------------------------------------------------------------* 4059 */ 4060 /* 4061 * For PAP, we need to keep a little state also if we are the peer, not the 4062 * authenticator. This is since we don't get a request to authenticate, but 4063 * have to repeatedly authenticate ourself until we got a response (or the 4064 * retry counter is expired). 4065 */ 4066 4067 /* 4068 * Handle incoming PAP packets. */ 4069 static void 4070 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4071 { 4072 STDDCL; 4073 struct lcp_header *h; 4074 int len, x; 4075 u_char *name, *passwd, mlen; 4076 int name_len, passwd_len; 4077 4078 len = m->m_pkthdr.len; 4079 if (len < 5) { 4080 if (debug) 4081 log(LOG_DEBUG, 4082 SPP_FMT "pap invalid packet length: %d bytes\n", 4083 SPP_ARGS(ifp), len); 4084 return; 4085 } 4086 h = mtod (m, struct lcp_header*); 4087 if (len > ntohs (h->len)) 4088 len = ntohs (h->len); 4089 switch (h->type) { 4090 /* PAP request is my authproto */ 4091 case PAP_REQ: 4092 name = 1 + (u_char*)(h+1); 4093 name_len = name[-1]; 4094 passwd = name + name_len + 1; 4095 if (name_len > len - 6 || 4096 (passwd_len = passwd[-1]) > len - 6 - name_len) { 4097 if (debug) { 4098 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4099 "<%s id=0x%x len=%d", 4100 SPP_ARGS(ifp), 4101 sppp_auth_type_name(PPP_PAP, h->type), 4102 h->ident, ntohs(h->len)); 4103 if (len > 4) 4104 sppp_print_bytes((u_char*)(h+1), len-4); 4105 addlog(">\n"); 4106 } 4107 break; 4108 } 4109 if (debug) { 4110 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4111 "<%s id=0x%x len=%d name=", 4112 SPP_ARGS(ifp), 4113 sppp_state_name(sp->state[IDX_PAP]), 4114 sppp_auth_type_name(PPP_PAP, h->type), 4115 h->ident, ntohs(h->len)); 4116 sppp_print_string((char*)name, name_len); 4117 addlog(" passwd="); 4118 sppp_print_string((char*)passwd, passwd_len); 4119 addlog(">\n"); 4120 } 4121 if (name_len > AUTHNAMELEN || 4122 passwd_len > AUTHKEYLEN || 4123 bcmp(name, sp->hisauth.name, name_len) != 0 || 4124 bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) { 4125 /* action scn, tld */ 4126 mlen = sizeof(FAILMSG) - 1; 4127 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4128 sizeof mlen, (const char *)&mlen, 4129 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4130 0); 4131 pap.tld(sp); 4132 break; 4133 } 4134 /* action sca, perhaps tlu */ 4135 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4136 sp->state[IDX_PAP] == STATE_OPENED) { 4137 mlen = sizeof(SUCCMSG) - 1; 4138 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4139 sizeof mlen, (const char *)&mlen, 4140 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4141 0); 4142 } 4143 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4144 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4145 pap.tlu(sp); 4146 } 4147 break; 4148 4149 /* ack and nak are his authproto */ 4150 case PAP_ACK: 4151 callout_stop(&sp->pap_my_to_ch); 4152 if (debug) { 4153 log(LOG_DEBUG, SPP_FMT "pap success", 4154 SPP_ARGS(ifp)); 4155 name_len = *((char *)h); 4156 if (len > 5 && name_len) { 4157 addlog(": "); 4158 sppp_print_string((char*)(h+1), name_len); 4159 } 4160 addlog("\n"); 4161 } 4162 x = splnet(); 4163 sp->pp_flags &= ~PP_NEEDAUTH; 4164 if (sp->myauth.proto == PPP_PAP && 4165 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4166 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4167 /* 4168 * We are authenticator for PAP but didn't 4169 * complete yet. Leave it to tlu to proceed 4170 * to network phase. 4171 */ 4172 splx(x); 4173 break; 4174 } 4175 splx(x); 4176 sppp_phase_network(sp); 4177 break; 4178 4179 case PAP_NAK: 4180 callout_stop(&sp->pap_my_to_ch); 4181 if (debug) { 4182 log(LOG_INFO, SPP_FMT "pap failure", 4183 SPP_ARGS(ifp)); 4184 name_len = *((char *)h); 4185 if (len > 5 && name_len) { 4186 addlog(": "); 4187 sppp_print_string((char*)(h+1), name_len); 4188 } 4189 addlog("\n"); 4190 } else 4191 log(LOG_INFO, SPP_FMT "pap failure\n", 4192 SPP_ARGS(ifp)); 4193 /* await LCP shutdown by authenticator */ 4194 break; 4195 4196 default: 4197 /* Unknown PAP packet type -- ignore. */ 4198 if (debug) { 4199 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4200 "<0x%x id=0x%x len=%d", 4201 SPP_ARGS(ifp), 4202 h->type, h->ident, ntohs(h->len)); 4203 if (len > 4) 4204 sppp_print_bytes((u_char*)(h+1), len-4); 4205 addlog(">\n"); 4206 } 4207 break; 4208 4209 } 4210 } 4211 4212 static void 4213 sppp_pap_init(struct sppp *sp) 4214 { 4215 /* PAP doesn't have STATE_INITIAL at all. */ 4216 sp->state[IDX_PAP] = STATE_CLOSED; 4217 sp->fail_counter[IDX_PAP] = 0; 4218 sp->pp_seq[IDX_PAP] = 0; 4219 sp->pp_rseq[IDX_PAP] = 0; 4220 callout_init(&sp->ch[IDX_PAP]); 4221 callout_init(&sp->pap_my_to_ch); 4222 } 4223 4224 static void 4225 sppp_pap_open(struct sppp *sp) 4226 { 4227 if (sp->hisauth.proto == PPP_PAP && 4228 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4229 /* we are authenticator for PAP, start our timer */ 4230 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4231 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4232 } 4233 if (sp->myauth.proto == PPP_PAP) { 4234 /* we are peer, send a request, and start a timer */ 4235 pap.scr(sp); 4236 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4237 sppp_pap_my_TO, sp); 4238 } 4239 } 4240 4241 static void 4242 sppp_pap_close(struct sppp *sp) 4243 { 4244 if (sp->state[IDX_PAP] != STATE_CLOSED) 4245 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4246 } 4247 4248 /* 4249 * That's the timeout routine if we are authenticator. Since the 4250 * authenticator is basically passive in PAP, we can't do much here. 4251 */ 4252 static void 4253 sppp_pap_TO(void *cookie) 4254 { 4255 struct sppp *sp = (struct sppp *)cookie; 4256 STDDCL; 4257 int s; 4258 4259 s = splnet(); 4260 if (debug) 4261 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4262 SPP_ARGS(ifp), 4263 sppp_state_name(sp->state[IDX_PAP]), 4264 sp->rst_counter[IDX_PAP]); 4265 4266 if (--sp->rst_counter[IDX_PAP] < 0) 4267 /* TO- event */ 4268 switch (sp->state[IDX_PAP]) { 4269 case STATE_REQ_SENT: 4270 pap.tld(sp); 4271 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4272 break; 4273 } 4274 else 4275 /* TO+ event, not very much we could do */ 4276 switch (sp->state[IDX_PAP]) { 4277 case STATE_REQ_SENT: 4278 /* sppp_cp_change_state() will restart the timer */ 4279 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4280 break; 4281 } 4282 4283 splx(s); 4284 } 4285 4286 /* 4287 * That's the timeout handler if we are peer. Since the peer is active, 4288 * we need to retransmit our PAP request since it is apparently lost. 4289 * XXX We should impose a max counter. 4290 */ 4291 static void 4292 sppp_pap_my_TO(void *cookie) 4293 { 4294 struct sppp *sp = (struct sppp *)cookie; 4295 STDDCL; 4296 4297 if (debug) 4298 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4299 SPP_ARGS(ifp)); 4300 4301 pap.scr(sp); 4302 } 4303 4304 static void 4305 sppp_pap_tlu(struct sppp *sp) 4306 { 4307 STDDCL; 4308 int x; 4309 4310 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4311 4312 if (debug) 4313 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4314 SPP_ARGS(ifp), pap.name); 4315 4316 x = splnet(); 4317 /* indicate to LCP that we need to be closed down */ 4318 sp->lcp.protos |= (1 << IDX_PAP); 4319 4320 if (sp->pp_flags & PP_NEEDAUTH) { 4321 /* 4322 * Remote is authenticator, but his auth proto didn't 4323 * complete yet. Defer the transition to network 4324 * phase. 4325 */ 4326 splx(x); 4327 return; 4328 } 4329 splx(x); 4330 sppp_phase_network(sp); 4331 } 4332 4333 static void 4334 sppp_pap_tld(struct sppp *sp) 4335 { 4336 STDDCL; 4337 4338 if (debug) 4339 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4340 callout_stop(&sp->ch[IDX_PAP]); 4341 callout_stop(&sp->pap_my_to_ch); 4342 sp->lcp.protos &= ~(1 << IDX_PAP); 4343 4344 lcp.Close(sp); 4345 } 4346 4347 static void 4348 sppp_pap_scr(struct sppp *sp) 4349 { 4350 u_char idlen, pwdlen; 4351 4352 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4353 pwdlen = sppp_strnlen(sp->myauth.secret, AUTHKEYLEN); 4354 idlen = sppp_strnlen(sp->myauth.name, AUTHNAMELEN); 4355 4356 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4357 sizeof idlen, (const char *)&idlen, 4358 (size_t)idlen, sp->myauth.name, 4359 sizeof pwdlen, (const char *)&pwdlen, 4360 (size_t)pwdlen, sp->myauth.secret, 4361 0); 4362 } 4363 /* 4365 * Random miscellaneous functions. 4366 */ 4367 4368 /* 4369 * Send a PAP or CHAP proto packet. 4370 * 4371 * Varadic function, each of the elements for the ellipsis is of type 4372 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4373 * mlen == 0. 4374 * NOTE: never declare variadic functions with types subject to type 4375 * promotion (i.e. u_char). This is asking for big trouble depending 4376 * on the architecture you are on... 4377 */ 4378 4379 static void 4380 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4381 unsigned int type, unsigned int id, 4382 ...) 4383 { 4384 STDDCL; 4385 struct lcp_header *lh; 4386 struct mbuf *m; 4387 u_char *p; 4388 int len; 4389 size_t pkthdrlen; 4390 unsigned int mlen; 4391 const char *msg; 4392 va_list ap; 4393 4394 MGETHDR (m, M_DONTWAIT, MT_DATA); 4395 if (! m) 4396 return; 4397 m->m_pkthdr.rcvif = 0; 4398 4399 if (sp->pp_flags & PP_NOFRAMING) { 4400 *mtod(m, u_int16_t*) = htons(cp->proto); 4401 pkthdrlen = 2; 4402 lh = (struct lcp_header*)(mtod(m, u_int8_t*)+2); 4403 } else { 4404 struct ppp_header *h; 4405 h = mtod (m, struct ppp_header*); 4406 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4407 h->control = PPP_UI; /* Unnumbered Info */ 4408 h->protocol = htons(cp->proto); 4409 pkthdrlen = PPP_HEADER_LEN; 4410 4411 lh = (struct lcp_header*)(h + 1); 4412 } 4413 4414 lh->type = type; 4415 lh->ident = id; 4416 p = (u_char*) (lh+1); 4417 4418 va_start(ap, id); 4419 len = 0; 4420 4421 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4422 msg = va_arg(ap, const char *); 4423 len += mlen; 4424 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4425 va_end(ap); 4426 m_freem(m); 4427 return; 4428 } 4429 4430 bcopy(msg, p, mlen); 4431 p += mlen; 4432 } 4433 va_end(ap); 4434 4435 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4436 lh->len = htons (LCP_HEADER_LEN + len); 4437 4438 if (debug) { 4439 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4440 SPP_ARGS(ifp), cp->name, 4441 sppp_auth_type_name(cp->proto, lh->type), 4442 lh->ident, ntohs(lh->len)); 4443 if (len) 4444 sppp_print_bytes((u_char*) (lh+1), len); 4445 addlog(">\n"); 4446 } 4447 if (IF_QFULL (&sp->pp_cpq)) { 4448 IF_DROP (&sp->pp_fastq); 4449 IF_DROP (&ifp->if_snd); 4450 m_freem (m); 4451 ++ifp->if_oerrors; 4452 } else 4453 IF_ENQUEUE (&sp->pp_cpq, m); 4454 if (! (ifp->if_flags & IFF_OACTIVE)) 4455 (*ifp->if_start) (ifp); 4456 ifp->if_obytes += m->m_pkthdr.len + 3; 4457 } 4458 4459 /* 4460 * Send keepalive packets, every 10 seconds. 4461 */ 4462 static void 4463 sppp_keepalive(void *dummy) 4464 { 4465 struct sppp *sp; 4466 int s; 4467 4468 s = splnet(); 4469 for (sp=spppq; sp; sp=sp->pp_next) { 4470 struct ifnet *ifp = &sp->pp_if; 4471 4472 /* Keepalive mode disabled or channel down? */ 4473 if (! (sp->pp_flags & PP_KEEPALIVE) || 4474 ! (ifp->if_flags & IFF_RUNNING)) 4475 continue; 4476 4477 /* No keepalive in PPP mode if LCP not opened yet. */ 4478 if (! (sp->pp_flags & PP_CISCO) && 4479 sp->pp_phase < PHASE_AUTHENTICATE) 4480 continue; 4481 4482 if (sp->pp_alivecnt == MAXALIVECNT) { 4483 /* No keepalive packets got. Stop the interface. */ 4484 printf (SPP_FMT "down\n", SPP_ARGS(ifp)); 4485 if_down (ifp); 4486 IF_PURGE (&sp->pp_cpq); 4487 if (! (sp->pp_flags & PP_CISCO)) { 4488 /* XXX */ 4489 /* Shut down the PPP link. */ 4490 lcp.Down(sp); 4491 /* Initiate negotiation. XXX */ 4492 lcp.Up(sp); 4493 } 4494 } 4495 if (sp->pp_alivecnt <= MAXALIVECNT) 4496 ++sp->pp_alivecnt; 4497 if (sp->pp_flags & PP_CISCO) 4498 sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, 4499 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4500 else if (sp->pp_phase >= PHASE_AUTHENTICATE) { 4501 long nmagic = htonl (sp->lcp.magic); 4502 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4503 sppp_cp_send (sp, PPP_LCP, ECHO_REQ, 4504 sp->lcp.echoid, 4, &nmagic); 4505 } 4506 } 4507 splx(s); 4508 callout_reset(&keepalive_ch, hz * 10, sppp_keepalive, NULL); 4509 } 4510 4511 /* 4512 * Get both IP addresses. 4513 */ 4514 static void 4515 sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask) 4516 { 4517 struct ifnet *ifp = &sp->pp_if; 4518 struct ifaddr *ifa; 4519 struct sockaddr_in *si, *sm; 4520 u_long ssrc, ddst; 4521 4522 sm = NULL; 4523 ssrc = ddst = 0L; 4524 /* 4525 * Pick the first AF_INET address from the list, 4526 * aliases don't make any sense on a p2p link anyway. 4527 */ 4528 si = 0; 4529 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4530 if (ifa->ifa_addr->sa_family == AF_INET) { 4531 si = (struct sockaddr_in *)ifa->ifa_addr; 4532 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4533 if (si) 4534 break; 4535 } 4536 } 4537 if (ifa) { 4538 if (si && si->sin_addr.s_addr) { 4539 ssrc = si->sin_addr.s_addr; 4540 if (srcmask) 4541 *srcmask = ntohl(sm->sin_addr.s_addr); 4542 } 4543 4544 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4545 if (si && si->sin_addr.s_addr) 4546 ddst = si->sin_addr.s_addr; 4547 } 4548 4549 if (dst) *dst = ntohl(ddst); 4550 if (src) *src = ntohl(ssrc); 4551 } 4552 4553 /* 4554 * Set my IP address. Must be called at splnet. 4555 */ 4556 static void 4557 sppp_set_ip_addr(struct sppp *sp, u_long src) 4558 { 4559 STDDCL; 4560 struct ifaddr *ifa; 4561 struct sockaddr_in *si; 4562 4563 /* 4564 * Pick the first AF_INET address from the list, 4565 * aliases don't make any sense on a p2p link anyway. 4566 */ 4567 4568 si = 0; 4569 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4570 { 4571 if (ifa->ifa_addr->sa_family == AF_INET) 4572 { 4573 si = (struct sockaddr_in *)ifa->ifa_addr; 4574 if (si) 4575 break; 4576 } 4577 } 4578 4579 if (ifa && si) 4580 { 4581 int error; 4582 struct sockaddr_in new_sin = *si; 4583 4584 new_sin.sin_addr.s_addr = htonl(src); 4585 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 1); 4586 if(debug && error) 4587 { 4588 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: in_ifinit " 4589 " failed, error=%d\n", SPP_ARGS(ifp), error); 4590 } 4591 } 4592 } 4593 4594 #ifdef INET6 4595 /* 4596 * Get both IPv6 addresses. 4597 */ 4598 static void 4599 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4600 struct in6_addr *srcmask) 4601 { 4602 struct ifnet *ifp = &sp->pp_if; 4603 struct ifaddr *ifa; 4604 struct sockaddr_in6 *si, *sm; 4605 struct in6_addr ssrc, ddst; 4606 4607 sm = NULL; 4608 memset(&ssrc, 0, sizeof(ssrc)); 4609 memset(&ddst, 0, sizeof(ddst)); 4610 /* 4611 * Pick the first link-local AF_INET6 address from the list, 4612 * aliases don't make any sense on a p2p link anyway. 4613 */ 4614 si = 0; 4615 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4616 if (ifa->ifa_addr->sa_family == AF_INET6) { 4617 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4618 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4619 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4620 break; 4621 } 4622 if (ifa) { 4623 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4624 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4625 if (srcmask) { 4626 bcopy(&sm->sin6_addr, srcmask, 4627 sizeof(*srcmask)); 4628 } 4629 } 4630 4631 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4632 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4633 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4634 } 4635 4636 if (dst) 4637 bcopy(&ddst, dst, sizeof(*dst)); 4638 if (src) 4639 bcopy(&ssrc, src, sizeof(*src)); 4640 } 4641 4642 #ifdef IPV6CP_MYIFID_DYN 4643 /* 4644 * Generate random ifid. 4645 */ 4646 static void 4647 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4648 { 4649 /* TBD */ 4650 } 4651 4652 /* 4653 * Set my IPv6 address. Must be called at splnet. 4654 */ 4655 static void 4656 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4657 { 4658 STDDCL; 4659 struct ifaddr *ifa; 4660 struct sockaddr_in6 *sin6; 4661 4662 /* 4663 * Pick the first link-local AF_INET6 address from the list, 4664 * aliases don't make any sense on a p2p link anyway. 4665 */ 4666 4667 sin6 = NULL; 4668 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4669 { 4670 if (ifa->ifa_addr->sa_family == AF_INET6) 4671 { 4672 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4673 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4674 break; 4675 } 4676 } 4677 4678 if (ifa && sin6) 4679 { 4680 int error; 4681 struct sockaddr_in6 new_sin6 = *sin6; 4682 4683 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4684 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 4685 if (debug && error) 4686 { 4687 log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit " 4688 " failed, error=%d\n", SPP_ARGS(ifp), error); 4689 } 4690 } 4691 } 4692 #endif 4693 4694 /* 4695 * Suggest a candidate address to be used by peer. 4696 */ 4697 static void 4698 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4699 { 4700 struct in6_addr myaddr; 4701 struct timeval tv; 4702 4703 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4704 4705 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4706 microtime(&tv); 4707 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4708 myaddr.s6_addr[14] ^= 0xff; 4709 myaddr.s6_addr[15] ^= 0xff; 4710 } else { 4711 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 4712 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 4713 } 4714 if (suggest) 4715 bcopy(&myaddr, suggest, sizeof(myaddr)); 4716 } 4717 #endif /*INET6*/ 4718 4719 static int 4720 sppp_params(struct sppp *sp, int cmd, void *data) 4721 { 4722 struct ifreq *ifr = (struct ifreq *)data; 4723 struct spppreq spr; 4724 4725 #if 0 4726 /* 4727 * ifr->ifr_data is supposed to point to a struct spppreq. 4728 * Check the cmd word first before attempting to fetch all the 4729 * data. 4730 */ 4731 if ((subcmd = fuword(ifr->ifr_data)) == -1) 4732 return EFAULT; 4733 #endif 4734 4735 if (copyin((caddr_t)ifr->ifr_data, &spr, sizeof spr) != 0) 4736 return EFAULT; 4737 4738 switch (spr.cmd) { 4739 case SPPPIOGDEFS: 4740 if (cmd != (int)SIOCGIFGENERIC) 4741 return EINVAL; 4742 /* 4743 * We copy over the entire current state, but clean 4744 * out some of the stuff we don't wanna pass up. 4745 * Remember, SIOCGIFGENERIC is unprotected, and can be 4746 * called by any user. No need to ever get PAP or 4747 * CHAP secrets back to userland anyway. 4748 */ 4749 bcopy(sp, &spr.defs, sizeof(struct sppp)); 4750 memset(spr.defs.myauth.secret, 0, AUTHKEYLEN); 4751 memset(spr.defs.myauth.challenge, 0, AUTHKEYLEN); 4752 memset(spr.defs.hisauth.secret, 0, AUTHKEYLEN); 4753 memset(spr.defs.hisauth.challenge, 0, AUTHKEYLEN); 4754 return copyout(&spr, (caddr_t)ifr->ifr_data, sizeof spr); 4755 4756 case SPPPIOSDEFS: 4757 if (cmd != (int)SIOCSIFGENERIC) 4758 return EINVAL; 4759 /* 4760 * We have a very specific idea of which fields we allow 4761 * being passed back from userland, so to not clobber our 4762 * current state. For one, we only allow setting 4763 * anything if LCP is in dead phase. Once the LCP 4764 * negotiations started, the authentication settings must 4765 * not be changed again. (The administrator can force an 4766 * ifconfig down in order to get LCP back into dead 4767 * phase.) 4768 * 4769 * Also, we only allow for authentication parameters to be 4770 * specified. 4771 * 4772 * XXX Should allow to set or clear pp_flags. 4773 * 4774 * Finally, if the respective authentication protocol to 4775 * be used is set differently than 0, but the secret is 4776 * passed as all zeros, we don't trash the existing secret. 4777 * This allows an administrator to change the system name 4778 * only without clobbering the secret (which he didn't get 4779 * back in a previous SPPPIOGDEFS call). However, the 4780 * secrets are cleared if the authentication protocol is 4781 * reset to 0. 4782 */ 4783 if (sp->pp_phase != PHASE_DEAD) 4784 return EBUSY; 4785 4786 if ((spr.defs.myauth.proto != 0 && spr.defs.myauth.proto != PPP_PAP && 4787 spr.defs.myauth.proto != PPP_CHAP) || 4788 (spr.defs.hisauth.proto != 0 && spr.defs.hisauth.proto != PPP_PAP && 4789 spr.defs.hisauth.proto != PPP_CHAP)) 4790 return EINVAL; 4791 4792 if (spr.defs.myauth.proto == 0) 4793 /* resetting myauth */ 4794 memset(&sp->myauth, 0, sizeof sp->myauth); 4795 else { 4796 /* setting/changing myauth */ 4797 sp->myauth.proto = spr.defs.myauth.proto; 4798 bcopy(spr.defs.myauth.name, sp->myauth.name, AUTHNAMELEN); 4799 if (spr.defs.myauth.secret[0] != '\0') 4800 bcopy(spr.defs.myauth.secret, sp->myauth.secret, 4801 AUTHKEYLEN); 4802 } 4803 if (spr.defs.hisauth.proto == 0) 4804 /* resetting hisauth */ 4805 memset(&sp->hisauth, 0, sizeof sp->hisauth); 4806 else { 4807 /* setting/changing hisauth */ 4808 sp->hisauth.proto = spr.defs.hisauth.proto; 4809 sp->hisauth.flags = spr.defs.hisauth.flags; 4810 bcopy(spr.defs.hisauth.name, sp->hisauth.name, AUTHNAMELEN); 4811 if (spr.defs.hisauth.secret[0] != '\0') 4812 bcopy(spr.defs.hisauth.secret, sp->hisauth.secret, 4813 AUTHKEYLEN); 4814 } 4815 break; 4816 4817 default: 4818 return EINVAL; 4819 } 4820 4821 return 0; 4822 } 4823 4824 static void 4825 sppp_phase_network(struct sppp *sp) 4826 { 4827 STDDCL; 4828 int i; 4829 u_long mask; 4830 4831 sp->pp_phase = PHASE_NETWORK; 4832 4833 if(debug) 4834 { 4835 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 4836 sppp_phase_name(sp->pp_phase)); 4837 } 4838 4839 /* Notify NCPs now. */ 4840 for (i = 0; i < IDX_COUNT; i++) 4841 if ((cps[i])->flags & CP_NCP) 4842 (cps[i])->Open(sp); 4843 4844 /* Send Up events to all NCPs. */ 4845 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 4846 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 4847 (cps[i])->Up(sp); 4848 4849 /* if no NCP is starting, all this was in vain, close down */ 4850 sppp_lcp_check_and_close(sp); 4851 } 4852 4853 4854 static const char * 4855 sppp_cp_type_name(u_char type) 4856 { 4857 static char buf[12]; 4858 switch (type) { 4859 case CONF_REQ: return "conf-req"; 4860 case CONF_ACK: return "conf-ack"; 4861 case CONF_NAK: return "conf-nak"; 4862 case CONF_REJ: return "conf-rej"; 4863 case TERM_REQ: return "term-req"; 4864 case TERM_ACK: return "term-ack"; 4865 case CODE_REJ: return "code-rej"; 4866 case PROTO_REJ: return "proto-rej"; 4867 case ECHO_REQ: return "echo-req"; 4868 case ECHO_REPLY: return "echo-reply"; 4869 case DISC_REQ: return "discard-req"; 4870 } 4871 sprintf (buf, "0x%x", type); 4872 return buf; 4873 } 4874 4875 static const char * 4876 sppp_auth_type_name(u_short proto, u_char type) 4877 { 4878 static char buf[12]; 4879 switch (proto) { 4880 case PPP_CHAP: 4881 switch (type) { 4882 case CHAP_CHALLENGE: return "challenge"; 4883 case CHAP_RESPONSE: return "response"; 4884 case CHAP_SUCCESS: return "success"; 4885 case CHAP_FAILURE: return "failure"; 4886 } 4887 case PPP_PAP: 4888 switch (type) { 4889 case PAP_REQ: return "req"; 4890 case PAP_ACK: return "ack"; 4891 case PAP_NAK: return "nak"; 4892 } 4893 } 4894 sprintf (buf, "0x%x", type); 4895 return buf; 4896 } 4897 4898 static const char * 4899 sppp_lcp_opt_name(u_char opt) 4900 { 4901 static char buf[12]; 4902 switch (opt) { 4903 case LCP_OPT_MRU: return "mru"; 4904 case LCP_OPT_ASYNC_MAP: return "async-map"; 4905 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 4906 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 4907 case LCP_OPT_MAGIC: return "magic"; 4908 case LCP_OPT_PROTO_COMP: return "proto-comp"; 4909 case LCP_OPT_ADDR_COMP: return "addr-comp"; 4910 } 4911 sprintf (buf, "0x%x", opt); 4912 return buf; 4913 } 4914 4915 static const char * 4916 sppp_ipcp_opt_name(u_char opt) 4917 { 4918 static char buf[12]; 4919 switch (opt) { 4920 case IPCP_OPT_ADDRESSES: return "addresses"; 4921 case IPCP_OPT_COMPRESSION: return "compression"; 4922 case IPCP_OPT_ADDRESS: return "address"; 4923 } 4924 sprintf (buf, "0x%x", opt); 4925 return buf; 4926 } 4927 4928 #ifdef INET6 4929 static const char * 4930 sppp_ipv6cp_opt_name(u_char opt) 4931 { 4932 static char buf[12]; 4933 switch (opt) { 4934 case IPV6CP_OPT_IFID: return "ifid"; 4935 case IPV6CP_OPT_COMPRESSION: return "compression"; 4936 } 4937 sprintf (buf, "0x%x", opt); 4938 return buf; 4939 } 4940 #endif 4941 4942 static const char * 4943 sppp_state_name(int state) 4944 { 4945 switch (state) { 4946 case STATE_INITIAL: return "initial"; 4947 case STATE_STARTING: return "starting"; 4948 case STATE_CLOSED: return "closed"; 4949 case STATE_STOPPED: return "stopped"; 4950 case STATE_CLOSING: return "closing"; 4951 case STATE_STOPPING: return "stopping"; 4952 case STATE_REQ_SENT: return "req-sent"; 4953 case STATE_ACK_RCVD: return "ack-rcvd"; 4954 case STATE_ACK_SENT: return "ack-sent"; 4955 case STATE_OPENED: return "opened"; 4956 } 4957 return "illegal"; 4958 } 4959 4960 static const char * 4961 sppp_phase_name(enum ppp_phase phase) 4962 { 4963 switch (phase) { 4964 case PHASE_DEAD: return "dead"; 4965 case PHASE_ESTABLISH: return "establish"; 4966 case PHASE_TERMINATE: return "terminate"; 4967 case PHASE_AUTHENTICATE: return "authenticate"; 4968 case PHASE_NETWORK: return "network"; 4969 } 4970 return "illegal"; 4971 } 4972 4973 static const char * 4974 sppp_proto_name(u_short proto) 4975 { 4976 static char buf[12]; 4977 switch (proto) { 4978 case PPP_LCP: return "lcp"; 4979 case PPP_IPCP: return "ipcp"; 4980 case PPP_PAP: return "pap"; 4981 case PPP_CHAP: return "chap"; 4982 case PPP_IPV6CP: return "ipv6cp"; 4983 } 4984 sprintf(buf, "0x%x", (unsigned)proto); 4985 return buf; 4986 } 4987 4988 static void 4989 sppp_print_bytes(const u_char *p, u_short len) 4990 { 4991 addlog(" %02x", *p++); 4992 while (--len > 0) 4993 addlog("-%02x", *p++); 4994 } 4995 4996 static void 4997 sppp_print_string(const char *p, u_short len) 4998 { 4999 u_char c; 5000 5001 while (len-- > 0) { 5002 c = *p++; 5003 /* 5004 * Print only ASCII chars directly. RFC 1994 recommends 5005 * using only them, but we don't rely on it. */ 5006 if (c < ' ' || c > '~') 5007 addlog("\\x%x", c); 5008 else 5009 addlog("%c", c); 5010 } 5011 } 5012 5013 static const char * 5014 sppp_dotted_quad(u_long addr) 5015 { 5016 static char s[16]; 5017 sprintf(s, "%d.%d.%d.%d", 5018 (int)((addr >> 24) & 0xff), 5019 (int)((addr >> 16) & 0xff), 5020 (int)((addr >> 8) & 0xff), 5021 (int)(addr & 0xff)); 5022 return s; 5023 } 5024 5025 static int 5026 sppp_strnlen(u_char *p, int max) 5027 { 5028 int len; 5029 5030 for (len = 0; len < max && *p; ++p) 5031 ++len; 5032 return len; 5033 } 5034 5035 /* a dummy, used to drop uninteresting events */ 5036 static void 5037 sppp_null(struct sppp *unused) 5038 { 5039 /* do just nothing */ 5040 } 5041 /* 5042 * This file is large. Tell emacs to highlight it nevertheless. 5043 * 5044 * Local Variables: 5045 * hilit-auto-highlight-maxout: 120000 5046 * End: 5047 */ 5048
Indexes created Fri Sep 26 08:10:20 GMT 2025