if_spppsubr.c revision 1.46.4.18
1 /* $NetBSD: if_spppsubr.c,v 1.46.4.18 2003/06/24 08:18:29 grant Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.46.4.18 2003/06/24 08:18:29 grant Exp $"); 45 46 #include "opt_inet.h" 47 #include "opt_ipx.h" 48 #include "opt_iso.h" 49 #include "opt_ns.h" 50 51 #include <sys/param.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/kernel.h> 55 #include <sys/sockio.h> 56 #include <sys/socket.h> 57 #include <sys/syslog.h> 58 #include <sys/malloc.h> 59 #include <sys/mbuf.h> 60 #include <sys/callout.h> 61 #include <sys/md5.h> 62 #include <sys/inttypes.h> 63 64 #include <net/if.h> 65 #include <net/netisr.h> 66 #include <net/if_types.h> 67 #include <net/route.h> 68 #include <net/ppp_defs.h> 69 70 #include <machine/stdarg.h> 71 72 #include <netinet/in.h> 73 #include <netinet/in_systm.h> 74 #include <netinet/in_var.h> 75 #ifdef INET 76 #include <netinet/ip.h> 77 #include <netinet/tcp.h> 78 #endif 79 #include <net/ethertypes.h> 80 81 #ifdef IPX 82 #include <netipx/ipx.h> 83 #include <netipx/ipx_if.h> 84 #endif 85 86 #ifdef NS 87 #include <netns/ns.h> 88 #include <netns/ns_if.h> 89 #endif 90 91 #ifdef ISO 92 #include <netiso/argo_debug.h> 93 #include <netiso/iso.h> 94 #include <netiso/iso_var.h> 95 #include <netiso/iso_snpac.h> 96 #endif 97 98 #include <net/if_sppp.h> 99 #include <net/if_spppvar.h> 100 101 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds */ 102 #define MAXALIVECNT 3 /* max. missed alive packets */ 103 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 104 105 /* 106 * Interface flags that can be set in an ifconfig command. 107 * 108 * Setting link0 will make the link passive, i.e. it will be marked 109 * as being administrative openable, but won't be opened to begin 110 * with. Incoming calls will be answered, or subsequent calls with 111 * -link1 will cause the administrative open of the LCP layer. 112 * 113 * Setting link1 will cause the link to auto-dial only as packets 114 * arrive to be sent. 115 * 116 * Setting IFF_DEBUG will syslog the option negotiation and state 117 * transitions at level kern.debug. Note: all logs consistently look 118 * like 119 * 120 * <if-name><unit>: <proto-name> <additional info...> 121 * 122 * with <if-name><unit> being something like "bppp0", and <proto-name> 123 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 124 */ 125 126 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 127 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 128 129 #define CONF_REQ 1 /* PPP configure request */ 130 #define CONF_ACK 2 /* PPP configure acknowledge */ 131 #define CONF_NAK 3 /* PPP configure negative ack */ 132 #define CONF_REJ 4 /* PPP configure reject */ 133 #define TERM_REQ 5 /* PPP terminate request */ 134 #define TERM_ACK 6 /* PPP terminate acknowledge */ 135 #define CODE_REJ 7 /* PPP code reject */ 136 #define PROTO_REJ 8 /* PPP protocol reject */ 137 #define ECHO_REQ 9 /* PPP echo request */ 138 #define ECHO_REPLY 10 /* PPP echo reply */ 139 #define DISC_REQ 11 /* PPP discard request */ 140 141 #define LCP_OPT_MRU 1 /* maximum receive unit */ 142 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 143 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 144 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 145 #define LCP_OPT_MAGIC 5 /* magic number */ 146 #define LCP_OPT_RESERVED 6 /* reserved */ 147 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 148 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 149 150 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 151 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 152 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 153 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 154 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 155 156 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 157 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 158 159 #define PAP_REQ 1 /* PAP name/password request */ 160 #define PAP_ACK 2 /* PAP acknowledge */ 161 #define PAP_NAK 3 /* PAP fail */ 162 163 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 164 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 165 #define CHAP_SUCCESS 3 /* CHAP response ok */ 166 #define CHAP_FAILURE 4 /* CHAP response failed */ 167 168 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 169 170 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 171 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 172 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 173 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 174 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 175 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 176 177 /* states are named and numbered according to RFC 1661 */ 178 #define STATE_INITIAL 0 179 #define STATE_STARTING 1 180 #define STATE_CLOSED 2 181 #define STATE_STOPPED 3 182 #define STATE_CLOSING 4 183 #define STATE_STOPPING 5 184 #define STATE_REQ_SENT 6 185 #define STATE_ACK_RCVD 7 186 #define STATE_ACK_SENT 8 187 #define STATE_OPENED 9 188 189 struct ppp_header { 190 u_char address; 191 u_char control; 192 u_short protocol; 193 } __attribute__((__packed__)); 194 #define PPP_HEADER_LEN sizeof (struct ppp_header) 195 196 struct lcp_header { 197 u_char type; 198 u_char ident; 199 u_short len; 200 } __attribute__((__packed__)); 201 #define LCP_HEADER_LEN sizeof (struct lcp_header) 202 203 struct cisco_packet { 204 u_int32_t type; 205 u_int32_t par1; 206 u_int32_t par2; 207 u_short rel; 208 u_short time0; 209 u_short time1; 210 } __attribute__((__packed__)); 211 #define CISCO_PACKET_LEN 18 212 213 /* 214 * We follow the spelling and capitalization of RFC 1661 here, to make 215 * it easier comparing with the standard. Please refer to this RFC in 216 * case you can't make sense out of these abbreviation; it will also 217 * explain the semantics related to the various events and actions. 218 */ 219 struct cp { 220 u_short proto; /* PPP control protocol number */ 221 u_char protoidx; /* index into state table in struct sppp */ 222 u_char flags; 223 #define CP_LCP 0x01 /* this is the LCP */ 224 #define CP_AUTH 0x02 /* this is an authentication protocol */ 225 #define CP_NCP 0x04 /* this is a NCP */ 226 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 227 const char *name; /* name of this control protocol */ 228 /* event handlers */ 229 void (*Up)(struct sppp *sp); 230 void (*Down)(struct sppp *sp); 231 void (*Open)(struct sppp *sp); 232 void (*Close)(struct sppp *sp); 233 void (*TO)(void *sp); 234 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 235 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 236 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 237 /* actions */ 238 void (*tlu)(struct sppp *sp); 239 void (*tld)(struct sppp *sp); 240 void (*tls)(struct sppp *sp); 241 void (*tlf)(struct sppp *sp); 242 void (*scr)(struct sppp *sp); 243 }; 244 245 static struct sppp *spppq; 246 static struct callout keepalive_ch; 247 248 #ifdef __FreeBSD__ 249 #define SPP_FMT "%s%d: " 250 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 251 #else 252 #define SPP_FMT "%s: " 253 #define SPP_ARGS(ifp) (ifp)->if_xname 254 #endif 255 256 #ifdef INET 257 /* 258 * The following disgusting hack gets around the problem that IP TOS 259 * can't be set yet. We want to put "interactive" traffic on a high 260 * priority queue. To decide if traffic is interactive, we check that 261 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 262 * 263 * XXX is this really still necessary? - joerg - 264 */ 265 static u_short interactive_ports[8] = { 266 0, 513, 0, 0, 267 0, 21, 0, 23, 268 }; 269 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 270 #endif 271 272 /* almost every function needs these */ 273 #define STDDCL \ 274 struct ifnet *ifp = &sp->pp_if; \ 275 int debug = ifp->if_flags & IFF_DEBUG 276 277 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 278 struct sockaddr *dst, struct rtentry *rt); 279 280 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 281 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 282 283 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 284 struct mbuf *m); 285 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 286 u_char ident, u_short len, void *data); 287 /* static void sppp_cp_timeout(void *arg); */ 288 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 289 int newstate); 290 static void sppp_auth_send(const struct cp *cp, 291 struct sppp *sp, unsigned int type, unsigned int id, 292 ...); 293 294 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 295 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 296 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 297 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 298 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 299 300 static void sppp_null(struct sppp *sp); 301 302 static void sppp_lcp_init(struct sppp *sp); 303 static void sppp_lcp_up(struct sppp *sp); 304 static void sppp_lcp_down(struct sppp *sp); 305 static void sppp_lcp_open(struct sppp *sp); 306 static void sppp_lcp_close(struct sppp *sp); 307 static void sppp_lcp_TO(void *sp); 308 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 309 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 310 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 311 static void sppp_lcp_tlu(struct sppp *sp); 312 static void sppp_lcp_tld(struct sppp *sp); 313 static void sppp_lcp_tls(struct sppp *sp); 314 static void sppp_lcp_tlf(struct sppp *sp); 315 static void sppp_lcp_scr(struct sppp *sp); 316 static void sppp_lcp_check_and_close(struct sppp *sp); 317 static int sppp_ncp_check(struct sppp *sp); 318 319 static void sppp_ipcp_init(struct sppp *sp); 320 static void sppp_ipcp_up(struct sppp *sp); 321 static void sppp_ipcp_down(struct sppp *sp); 322 static void sppp_ipcp_open(struct sppp *sp); 323 static void sppp_ipcp_close(struct sppp *sp); 324 static void sppp_ipcp_TO(void *sp); 325 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 326 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 327 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 328 static void sppp_ipcp_tlu(struct sppp *sp); 329 static void sppp_ipcp_tld(struct sppp *sp); 330 static void sppp_ipcp_tls(struct sppp *sp); 331 static void sppp_ipcp_tlf(struct sppp *sp); 332 static void sppp_ipcp_scr(struct sppp *sp); 333 334 static void sppp_ipv6cp_init(struct sppp *sp); 335 static void sppp_ipv6cp_up(struct sppp *sp); 336 static void sppp_ipv6cp_down(struct sppp *sp); 337 static void sppp_ipv6cp_open(struct sppp *sp); 338 static void sppp_ipv6cp_close(struct sppp *sp); 339 static void sppp_ipv6cp_TO(void *sp); 340 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 341 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 342 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 343 static void sppp_ipv6cp_tlu(struct sppp *sp); 344 static void sppp_ipv6cp_tld(struct sppp *sp); 345 static void sppp_ipv6cp_tls(struct sppp *sp); 346 static void sppp_ipv6cp_tlf(struct sppp *sp); 347 static void sppp_ipv6cp_scr(struct sppp *sp); 348 349 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 350 static void sppp_pap_init(struct sppp *sp); 351 static void sppp_pap_open(struct sppp *sp); 352 static void sppp_pap_close(struct sppp *sp); 353 static void sppp_pap_TO(void *sp); 354 static void sppp_pap_my_TO(void *sp); 355 static void sppp_pap_tlu(struct sppp *sp); 356 static void sppp_pap_tld(struct sppp *sp); 357 static void sppp_pap_scr(struct sppp *sp); 358 359 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 360 static void sppp_chap_init(struct sppp *sp); 361 static void sppp_chap_open(struct sppp *sp); 362 static void sppp_chap_close(struct sppp *sp); 363 static void sppp_chap_TO(void *sp); 364 static void sppp_chap_tlu(struct sppp *sp); 365 static void sppp_chap_tld(struct sppp *sp); 366 static void sppp_chap_scr(struct sppp *sp); 367 368 static const char *sppp_auth_type_name(u_short proto, u_char type); 369 static const char *sppp_cp_type_name(u_char type); 370 static const char *sppp_dotted_quad(u_int32_t addr); 371 static const char *sppp_ipcp_opt_name(u_char opt); 372 #ifdef INET6 373 static const char *sppp_ipv6cp_opt_name(u_char opt); 374 #endif 375 static const char *sppp_lcp_opt_name(u_char opt); 376 static const char *sppp_phase_name(int phase); 377 static const char *sppp_proto_name(u_short proto); 378 static const char *sppp_state_name(int state); 379 static int sppp_params(struct sppp *sp, int cmd, void *data); 380 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 381 u_int32_t *srcmask); 382 static void sppp_keepalive(void *dummy); 383 static void sppp_phase_network(struct sppp *sp); 384 static void sppp_print_bytes(const u_char *p, u_short len); 385 static void sppp_print_string(const char *p, u_short len); 386 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr); 387 static void sppp_clear_ip_addrs(struct sppp *sp); 388 #ifdef INET6 389 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 390 struct in6_addr *dst, struct in6_addr *srcmask); 391 #ifdef IPV6CP_MYIFID_DYN 392 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 393 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 394 #endif 395 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 396 #endif 397 398 /* our control protocol descriptors */ 399 static const struct cp lcp = { 400 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 401 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 402 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 403 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 404 sppp_lcp_scr 405 }; 406 407 static const struct cp ipcp = { 408 PPP_IPCP, IDX_IPCP, 409 #ifdef INET 410 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 411 #else 412 0, 413 #endif 414 "ipcp", 415 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 416 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 417 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 418 sppp_ipcp_scr 419 }; 420 421 static const struct cp ipv6cp = { 422 PPP_IPV6CP, IDX_IPV6CP, 423 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 424 CP_NCP, 425 #else 426 0, 427 #endif 428 "ipv6cp", 429 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 430 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 431 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 432 sppp_ipv6cp_scr 433 }; 434 435 static const struct cp pap = { 436 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 437 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 438 sppp_pap_TO, 0, 0, 0, 439 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 440 sppp_pap_scr 441 }; 442 443 static const struct cp chap = { 444 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 445 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 446 sppp_chap_TO, 0, 0, 0, 447 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 448 sppp_chap_scr 449 }; 450 451 static const struct cp *cps[IDX_COUNT] = { 452 &lcp, /* IDX_LCP */ 453 &ipcp, /* IDX_IPCP */ 454 &ipv6cp, /* IDX_IPV6CP */ 455 &pap, /* IDX_PAP */ 456 &chap, /* IDX_CHAP */ 457 }; 458 459 460 /* 461 * Exported functions, comprising our interface to the lower layer. 462 */ 463 464 /* 465 * Process the received packet. 466 */ 467 void 468 sppp_input(struct ifnet *ifp, struct mbuf *m) 469 { 470 struct ppp_header *h = NULL; 471 struct ifqueue *inq = 0; 472 u_int16_t protocol; 473 int s; 474 struct sppp *sp = (struct sppp *)ifp; 475 int debug = ifp->if_flags & IFF_DEBUG; 476 477 if (ifp->if_flags & IFF_UP) 478 /* Count received bytes, add hardware framing */ 479 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 480 481 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 482 /* Too small packet, drop it. */ 483 if (debug) 484 log(LOG_DEBUG, 485 SPP_FMT "input packet is too small, %d bytes\n", 486 SPP_ARGS(ifp), m->m_pkthdr.len); 487 drop: 488 ++ifp->if_ierrors; 489 ++ifp->if_iqdrops; 490 m_freem(m); 491 return; 492 } 493 494 if (sp->pp_flags & PP_NOFRAMING) { 495 memcpy(&protocol, mtod(m, void *), 2); 496 protocol = ntohs(protocol); 497 m_adj(m, 2); 498 } else { 499 500 /* Get PPP header. */ 501 h = mtod(m, struct ppp_header *); 502 m_adj(m, PPP_HEADER_LEN); 503 504 switch (h->address) { 505 case PPP_ALLSTATIONS: 506 if (h->control != PPP_UI) 507 goto invalid; 508 if (sp->pp_flags & PP_CISCO) { 509 if (debug) 510 log(LOG_DEBUG, 511 SPP_FMT "PPP packet in Cisco mode " 512 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 513 SPP_ARGS(ifp), 514 h->address, h->control, ntohs(h->protocol)); 515 goto drop; 516 } 517 break; 518 case CISCO_MULTICAST: 519 case CISCO_UNICAST: 520 /* Don't check the control field here (RFC 1547). */ 521 if (! (sp->pp_flags & PP_CISCO)) { 522 if (debug) 523 log(LOG_DEBUG, 524 SPP_FMT "Cisco packet in PPP mode " 525 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 526 SPP_ARGS(ifp), 527 h->address, h->control, ntohs(h->protocol)); 528 goto drop; 529 } 530 switch (ntohs(h->protocol)) { 531 default: 532 ++ifp->if_noproto; 533 goto invalid; 534 case CISCO_KEEPALIVE: 535 sppp_cisco_input((struct sppp *) ifp, m); 536 m_freem(m); 537 return; 538 #ifdef INET 539 case ETHERTYPE_IP: 540 schednetisr(NETISR_IP); 541 inq = &ipintrq; 542 break; 543 #endif 544 #ifdef INET6 545 case ETHERTYPE_IPV6: 546 schednetisr(NETISR_IPV6); 547 inq = &ip6intrq; 548 break; 549 #endif 550 #ifdef IPX 551 case ETHERTYPE_IPX: 552 schednetisr(NETISR_IPX); 553 inq = &ipxintrq; 554 break; 555 #endif 556 #ifdef NS 557 case ETHERTYPE_NS: 558 schednetisr(NETISR_NS); 559 inq = &nsintrq; 560 break; 561 #endif 562 } 563 goto queue_pkt; 564 default: /* Invalid PPP packet. */ 565 invalid: 566 if (debug) 567 log(LOG_DEBUG, 568 SPP_FMT "invalid input packet " 569 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 570 SPP_ARGS(ifp), 571 h->address, h->control, ntohs(h->protocol)); 572 goto drop; 573 } 574 protocol = ntohs(h->protocol); 575 } 576 577 switch (protocol) { 578 default: 579 if (sp->state[IDX_LCP] == STATE_OPENED) { 580 u_int16_t prot = htons(protocol); 581 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 582 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 583 &prot); 584 } 585 if (debug) 586 log(LOG_DEBUG, 587 SPP_FMT "invalid input protocol " 588 "<proto=0x%x>\n", SPP_ARGS(ifp), ntohs(protocol)); 589 ++ifp->if_noproto; 590 goto drop; 591 case PPP_LCP: 592 sppp_cp_input(&lcp, sp, m); 593 m_freem(m); 594 return; 595 case PPP_PAP: 596 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 597 sppp_pap_input(sp, m); 598 m_freem(m); 599 return; 600 case PPP_CHAP: 601 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 602 sppp_chap_input(sp, m); 603 m_freem(m); 604 return; 605 #ifdef INET 606 case PPP_IPCP: 607 if (sp->pp_phase == SPPP_PHASE_NETWORK) 608 sppp_cp_input(&ipcp, sp, m); 609 m_freem(m); 610 return; 611 case PPP_IP: 612 if (sp->state[IDX_IPCP] == STATE_OPENED) { 613 schednetisr(NETISR_IP); 614 inq = &ipintrq; 615 sp->pp_last_activity = mono_time.tv_sec; 616 } 617 break; 618 #endif 619 #ifdef INET6 620 case PPP_IPV6CP: 621 if (sp->pp_phase == SPPP_PHASE_NETWORK) 622 sppp_cp_input(&ipv6cp, sp, m); 623 m_freem(m); 624 return; 625 626 case PPP_IPV6: 627 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 628 schednetisr(NETISR_IPV6); 629 inq = &ip6intrq; 630 sp->pp_last_activity = mono_time.tv_sec; 631 } 632 break; 633 #endif 634 #ifdef IPX 635 case PPP_IPX: 636 /* IPX IPXCP not implemented yet */ 637 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 638 schednetisr(NETISR_IPX); 639 inq = &ipxintrq; 640 } 641 break; 642 #endif 643 #ifdef NS 644 case PPP_XNS: 645 /* XNS IDPCP not implemented yet */ 646 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 647 schednetisr(NETISR_NS); 648 inq = &nsintrq; 649 } 650 break; 651 #endif 652 #ifdef ISO 653 case PPP_ISO: 654 /* OSI NLCP not implemented yet */ 655 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 656 schednetisr(NETISR_ISO); 657 inq = &clnlintrq; 658 } 659 break; 660 #endif 661 } 662 663 queue_pkt: 664 if (! (ifp->if_flags & IFF_UP) || ! inq) 665 goto drop; 666 667 /* Check queue. */ 668 s = splnet(); 669 if (IF_QFULL(inq)) { 670 /* Queue overflow. */ 671 IF_DROP(inq); 672 splx(s); 673 if (debug) 674 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 675 SPP_ARGS(ifp)); 676 goto drop; 677 } 678 IF_ENQUEUE(inq, m); 679 splx(s); 680 } 681 682 /* 683 * Enqueue transmit packet. 684 */ 685 static int 686 sppp_output(struct ifnet *ifp, struct mbuf *m, 687 struct sockaddr *dst, struct rtentry *rt) 688 { 689 struct sppp *sp = (struct sppp *) ifp; 690 struct ppp_header *h = NULL; 691 struct ifqueue *ifq = NULL; /* XXX */ 692 int s, len, rv = 0; 693 u_int16_t protocol; 694 ALTQ_DECL(struct altq_pktattr pktattr;) 695 696 s = splnet(); 697 698 sp->pp_last_activity = mono_time.tv_sec; 699 700 if ((ifp->if_flags & IFF_UP) == 0 || 701 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 702 m_freem(m); 703 splx(s); 704 return (ENETDOWN); 705 } 706 707 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 708 /* 709 * Interface is not yet running, but auto-dial. Need 710 * to start LCP for it. 711 */ 712 ifp->if_flags |= IFF_RUNNING; 713 splx(s); 714 lcp.Open(sp); 715 s = splnet(); 716 } 717 718 /* 719 * If the queueing discipline needs packet classification, 720 * do it before prepending link headers. 721 */ 722 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 723 724 #ifdef INET 725 if (dst->sa_family == AF_INET) { 726 struct ip *ip = NULL; 727 struct tcphdr *th = NULL; 728 729 if (m->m_len >= sizeof(struct ip)) { 730 ip = mtod(m, struct ip *); 731 if (ip->ip_p == IPPROTO_TCP && 732 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 733 sizeof(struct tcphdr)) { 734 th = (struct tcphdr *) 735 ((caddr_t)ip + (ip->ip_hl << 2)); 736 } 737 } else 738 ip = NULL; 739 740 /* 741 * When using dynamic local IP address assignment by using 742 * 0.0.0.0 as a local address, the first TCP session will 743 * not connect because the local TCP checksum is computed 744 * using 0.0.0.0 which will later become our real IP address 745 * so the TCP checksum computed at the remote end will 746 * become invalid. So we 747 * - don't let packets with src ip addr 0 thru 748 * - we flag TCP packets with src ip 0 as an error 749 */ 750 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 751 u_int8_t proto = ip->ip_p; 752 753 m_freem(m); 754 splx(s); 755 if (proto == IPPROTO_TCP) 756 return (EADDRNOTAVAIL); 757 else 758 return (0); 759 } 760 761 /* 762 * Put low delay, telnet, rlogin and ftp control packets 763 * in front of the queue. 764 */ 765 766 if (!IF_QFULL(&sp->pp_fastq) && 767 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 768 (th && (INTERACTIVE(ntohs(th->th_sport)) || 769 INTERACTIVE(ntohs(th->th_dport)))))) 770 ifq = &sp->pp_fastq; 771 } 772 #endif 773 774 #ifdef INET6 775 if (dst->sa_family == AF_INET6) { 776 /* XXX do something tricky here? */ 777 } 778 #endif 779 780 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 781 /* 782 * Prepend general data packet PPP header. For now, IP only. 783 */ 784 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 785 if (! m) { 786 if (ifp->if_flags & IFF_DEBUG) 787 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 788 SPP_ARGS(ifp)); 789 ++ifp->if_oerrors; 790 splx(s); 791 return (ENOBUFS); 792 } 793 /* 794 * May want to check size of packet 795 * (albeit due to the implementation it's always enough) 796 */ 797 h = mtod(m, struct ppp_header *); 798 if (sp->pp_flags & PP_CISCO) { 799 h->address = CISCO_UNICAST; /* unicast address */ 800 h->control = 0; 801 } else { 802 h->address = PPP_ALLSTATIONS; /* broadcast address */ 803 h->control = PPP_UI; /* Unnumbered Info */ 804 } 805 } 806 807 switch (dst->sa_family) { 808 #ifdef INET 809 case AF_INET: /* Internet Protocol */ 810 if (sp->pp_flags & PP_CISCO) 811 protocol = htons(ETHERTYPE_IP); 812 else { 813 /* 814 * Don't choke with an ENETDOWN early. It's 815 * possible that we just started dialing out, 816 * so don't drop the packet immediately. If 817 * we notice that we run out of buffer space 818 * below, we will however remember that we are 819 * not ready to carry IP packets, and return 820 * ENETDOWN, as opposed to ENOBUFS. 821 */ 822 protocol = htons(PPP_IP); 823 if (sp->state[IDX_IPCP] != STATE_OPENED) 824 rv = ENETDOWN; 825 } 826 break; 827 #endif 828 #ifdef INET6 829 case AF_INET6: /* Internet Protocol version 6 */ 830 if (sp->pp_flags & PP_CISCO) 831 protocol = htons(ETHERTYPE_IPV6); 832 else { 833 /* 834 * Don't choke with an ENETDOWN early. It's 835 * possible that we just started dialing out, 836 * so don't drop the packet immediately. If 837 * we notice that we run out of buffer space 838 * below, we will however remember that we are 839 * not ready to carry IP packets, and return 840 * ENETDOWN, as opposed to ENOBUFS. 841 */ 842 protocol = htons(PPP_IPV6); 843 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 844 rv = ENETDOWN; 845 } 846 break; 847 #endif 848 #ifdef NS 849 case AF_NS: /* Xerox NS Protocol */ 850 protocol = htons((sp->pp_flags & PP_CISCO) ? 851 ETHERTYPE_NS : PPP_XNS); 852 break; 853 #endif 854 #ifdef IPX 855 case AF_IPX: /* Novell IPX Protocol */ 856 protocol = htons((sp->pp_flags & PP_CISCO) ? 857 ETHERTYPE_IPX : PPP_IPX); 858 break; 859 #endif 860 #ifdef ISO 861 case AF_ISO: /* ISO OSI Protocol */ 862 if (sp->pp_flags & PP_CISCO) 863 goto nosupport; 864 protocol = htons(PPP_ISO); 865 break; 866 nosupport: 867 #endif 868 default: 869 m_freem(m); 870 ++ifp->if_oerrors; 871 splx(s); 872 return (EAFNOSUPPORT); 873 } 874 875 if (sp->pp_flags & PP_NOFRAMING) { 876 M_PREPEND(m, 2, M_DONTWAIT); 877 if (m == NULL) { 878 if (ifp->if_flags & IFF_DEBUG) 879 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 880 SPP_ARGS(ifp)); 881 ++ifp->if_oerrors; 882 splx(s); 883 return (ENOBUFS); 884 } 885 *mtod(m, u_int16_t *) = protocol; 886 } else { 887 h->protocol = protocol; 888 } 889 890 /* 891 * Queue message on interface, and start output if interface 892 * not yet active. 893 */ 894 len = m->m_pkthdr.len; 895 if (ifq != NULL 896 #ifdef ALTQ 897 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 898 #endif 899 ) { 900 if (IF_QFULL(ifq)) { 901 IF_DROP(&ifp->if_snd); 902 m_freem(m); 903 if (rv == 0) 904 rv = ENOBUFS; 905 } 906 else 907 IF_ENQUEUE(ifq, m); 908 } else 909 IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv); 910 if (rv != 0) { 911 ++ifp->if_oerrors; 912 splx(s); 913 return (rv); 914 } 915 916 if (! (ifp->if_flags & IFF_OACTIVE)) 917 (*ifp->if_start)(ifp); 918 919 /* 920 * Count output packets and bytes. 921 * The packet length includes header + additional hardware framing 922 * according to RFC 1333. 923 */ 924 ifp->if_obytes += len + sp->pp_framebytes; 925 splx(s); 926 return (0); 927 } 928 929 void 930 sppp_attach(struct ifnet *ifp) 931 { 932 struct sppp *sp = (struct sppp *) ifp; 933 934 /* Initialize keepalive handler. */ 935 if (! spppq) { 936 callout_init(&keepalive_ch); 937 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 938 } 939 940 /* Insert new entry into the keepalive list. */ 941 sp->pp_next = spppq; 942 spppq = sp; 943 944 sp->pp_if.if_type = IFT_PPP; 945 sp->pp_if.if_output = sppp_output; 946 sp->pp_fastq.ifq_maxlen = 32; 947 sp->pp_cpq.ifq_maxlen = 20; 948 sp->pp_loopcnt = 0; 949 sp->pp_alivecnt = 0; 950 sp->pp_last_activity = 0; 951 sp->pp_idle_timeout = 0; 952 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 953 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 954 sp->pp_auth_failures = 0; 955 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 956 sp->pp_phase = SPPP_PHASE_DEAD; 957 sp->pp_up = lcp.Up; 958 sp->pp_down = lcp.Down; 959 960 if_alloc_sadl(ifp); 961 962 memset(&sp->myauth, 0, sizeof sp->myauth); 963 memset(&sp->hisauth, 0, sizeof sp->hisauth); 964 sppp_lcp_init(sp); 965 sppp_ipcp_init(sp); 966 sppp_ipv6cp_init(sp); 967 sppp_pap_init(sp); 968 sppp_chap_init(sp); 969 } 970 971 void 972 sppp_detach(struct ifnet *ifp) 973 { 974 struct sppp **q, *p, *sp = (struct sppp *) ifp; 975 int i; 976 977 /* Remove the entry from the keepalive list. */ 978 for (q = &spppq; (p = *q); q = &p->pp_next) 979 if (p == sp) { 980 *q = p->pp_next; 981 break; 982 } 983 984 /* Stop keepalive handler. */ 985 if (! spppq) { 986 callout_stop(&keepalive_ch); 987 } 988 989 for (i = 0; i < IDX_COUNT; i++) { 990 callout_stop(&sp->ch[i]); 991 } 992 callout_stop(&sp->pap_my_to_ch); 993 994 /* free authentication info */ 995 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 996 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 997 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 998 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 999 1000 #if 0 /* done in if_detach() */ 1001 if_free_sadl(ifp); 1002 #endif 1003 } 1004 1005 /* 1006 * Flush the interface output queue. 1007 */ 1008 void 1009 sppp_flush(struct ifnet *ifp) 1010 { 1011 struct sppp *sp = (struct sppp *) ifp; 1012 1013 IFQ_PURGE(&sp->pp_if.if_snd); 1014 IF_PURGE(&sp->pp_fastq); 1015 IF_PURGE(&sp->pp_cpq); 1016 } 1017 1018 /* 1019 * Check if the output queue is empty. 1020 */ 1021 int 1022 sppp_isempty(struct ifnet *ifp) 1023 { 1024 struct sppp *sp = (struct sppp *) ifp; 1025 int empty, s; 1026 1027 s = splnet(); 1028 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1029 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1030 splx(s); 1031 return (empty); 1032 } 1033 1034 /* 1035 * Get next packet to send. 1036 */ 1037 struct mbuf * 1038 sppp_dequeue(struct ifnet *ifp) 1039 { 1040 struct sppp *sp = (struct sppp *) ifp; 1041 struct mbuf *m; 1042 int s; 1043 1044 s = splnet(); 1045 /* 1046 * Process only the control protocol queue until we have at 1047 * least one NCP open. 1048 * 1049 * Do always serve all three queues in Cisco mode. 1050 */ 1051 IF_DEQUEUE(&sp->pp_cpq, m); 1052 if (m == NULL && 1053 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1054 IF_DEQUEUE(&sp->pp_fastq, m); 1055 if (m == NULL) 1056 IF_DEQUEUE(&sp->pp_if.if_snd, m); 1057 } 1058 splx(s); 1059 return m; 1060 } 1061 1062 /* 1063 * Pick the next packet, do not remove it from the queue. 1064 */ 1065 struct mbuf * 1066 sppp_pick(struct ifnet *ifp) 1067 { 1068 struct sppp *sp = (struct sppp *)ifp; 1069 struct mbuf *m; 1070 int s; 1071 1072 s= splnet(); 1073 1074 m = sp->pp_cpq.ifq_head; 1075 if (m == NULL && 1076 (sp->pp_phase == SPPP_PHASE_NETWORK || 1077 (sp->pp_flags & PP_CISCO) != 0)) 1078 if ((m = sp->pp_fastq.ifq_head) == NULL) 1079 m = sp->pp_if.if_snd.ifq_head; 1080 splx(s); 1081 return (m); 1082 } 1083 1084 /* 1085 * Process an ioctl request. Called on low priority level. 1086 */ 1087 int 1088 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1089 { 1090 struct ifreq *ifr = (struct ifreq *) data; 1091 struct sppp *sp = (struct sppp *) ifp; 1092 int s, error=0, going_up, going_down, newmode; 1093 1094 s = splnet(); 1095 switch (cmd) { 1096 case SIOCAIFADDR: 1097 case SIOCSIFDSTADDR: 1098 break; 1099 1100 case SIOCSIFADDR: 1101 if_up(ifp); 1102 /* fall through... */ 1103 1104 case SIOCSIFFLAGS: 1105 going_up = ifp->if_flags & IFF_UP && 1106 (ifp->if_flags & IFF_RUNNING) == 0; 1107 going_down = (ifp->if_flags & IFF_UP) == 0 && 1108 ifp->if_flags & IFF_RUNNING; 1109 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1110 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1111 /* sanity */ 1112 newmode = IFF_PASSIVE; 1113 ifp->if_flags &= ~IFF_AUTO; 1114 } 1115 1116 if (going_up || going_down) 1117 lcp.Close(sp); 1118 if (going_up && newmode == 0) { 1119 /* neither auto-dial nor passive */ 1120 ifp->if_flags |= IFF_RUNNING; 1121 if (!(sp->pp_flags & PP_CISCO)) 1122 lcp.Open(sp); 1123 } else if (going_down) { 1124 sppp_flush(ifp); 1125 ifp->if_flags &= ~IFF_RUNNING; 1126 } 1127 1128 break; 1129 1130 #ifdef SIOCSIFMTU 1131 #ifndef ifr_mtu 1132 #define ifr_mtu ifr_metric 1133 #endif 1134 case SIOCSIFMTU: 1135 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1136 error = EINVAL; 1137 break; 1138 } 1139 1140 ifp->if_mtu = ifr->ifr_mtu; 1141 break; 1142 #endif 1143 #ifdef SLIOCSETMTU 1144 case SLIOCSETMTU: 1145 if (*(short *)data < 128 || *(short *)data > sp->lcp.their_mru) 1146 { 1147 error = EINVAL; 1148 break; 1149 } 1150 1151 ifp->if_mtu = *(short *)data; 1152 break; 1153 #endif 1154 #ifdef SIOCGIFMTU 1155 case SIOCGIFMTU: 1156 ifr->ifr_mtu = ifp->if_mtu; 1157 break; 1158 #endif 1159 #ifdef SLIOCGETMTU 1160 case SLIOCGETMTU: 1161 *(short *)data = ifp->if_mtu; 1162 break; 1163 #endif 1164 case SIOCADDMULTI: 1165 case SIOCDELMULTI: 1166 break; 1167 1168 case SPPPSETAUTHCFG: 1169 case SPPPSETLCPCFG: 1170 case SPPPSETIDLETO: 1171 case SPPPSETAUTHFAILURE: 1172 case SPPPSETDNSOPTS: 1173 { 1174 struct proc *p = curproc; /* XXX */ 1175 1176 if ((error = suser(p->p_ucred, &p->p_acflag)) != 0) 1177 break; 1178 } 1179 /* FALLTHROUGH */ 1180 case SPPPGETAUTHCFG: 1181 case SPPPGETLCPCFG: 1182 case SPPPGETSTATUS: 1183 case SPPPGETIDLETO: 1184 case SPPPGETAUTHFAILURES: 1185 case SPPPGETDNSOPTS: 1186 case SPPPGETDNSADDRS: 1187 error = sppp_params(sp, cmd, data); 1188 break; 1189 1190 default: 1191 error = ENOTTY; 1192 } 1193 splx(s); 1194 return (error); 1195 } 1196 1197 1198 /* 1199 * Cisco framing implementation. 1200 */ 1201 1202 /* 1203 * Handle incoming Cisco keepalive protocol packets. 1204 */ 1205 static void 1206 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1207 { 1208 STDDCL; 1209 struct cisco_packet *h; 1210 u_int32_t me, mymask; 1211 1212 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1213 if (debug) 1214 log(LOG_DEBUG, 1215 SPP_FMT "cisco invalid packet length: %d bytes\n", 1216 SPP_ARGS(ifp), m->m_pkthdr.len); 1217 return; 1218 } 1219 h = mtod(m, struct cisco_packet *); 1220 if (debug) 1221 log(LOG_DEBUG, 1222 SPP_FMT "cisco input: %d bytes " 1223 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1224 SPP_ARGS(ifp), m->m_pkthdr.len, 1225 ntohl (h->type), h->par1, h->par2, (u_int)h->rel, 1226 (u_int)h->time0, (u_int)h->time1); 1227 switch (ntohl (h->type)) { 1228 default: 1229 if (debug) 1230 addlog(SPP_FMT "cisco unknown packet type: 0x%x\n", 1231 SPP_ARGS(ifp), ntohl (h->type)); 1232 break; 1233 case CISCO_ADDR_REPLY: 1234 /* Reply on address request, ignore */ 1235 break; 1236 case CISCO_KEEPALIVE_REQ: 1237 sp->pp_alivecnt = 0; 1238 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1239 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1240 /* Local and remote sequence numbers are equal. 1241 * Probably, the line is in loopback mode. */ 1242 if (sp->pp_loopcnt >= MAXALIVECNT) { 1243 printf (SPP_FMT "loopback\n", 1244 SPP_ARGS(ifp)); 1245 sp->pp_loopcnt = 0; 1246 if (ifp->if_flags & IFF_UP) { 1247 if_down(ifp); 1248 IF_PURGE(&sp->pp_cpq); 1249 } 1250 } 1251 ++sp->pp_loopcnt; 1252 1253 /* Generate new local sequence number */ 1254 sp->pp_seq[IDX_LCP] = random(); 1255 break; 1256 } 1257 sp->pp_loopcnt = 0; 1258 if (! (ifp->if_flags & IFF_UP) && 1259 (ifp->if_flags & IFF_RUNNING)) { 1260 if_up(ifp); 1261 } 1262 break; 1263 case CISCO_ADDR_REQ: 1264 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1265 if (me != 0L) 1266 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1267 break; 1268 } 1269 } 1270 1271 /* 1272 * Send Cisco keepalive packet. 1273 */ 1274 static void 1275 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1276 { 1277 STDDCL; 1278 struct ppp_header *h; 1279 struct cisco_packet *ch; 1280 struct mbuf *m; 1281 u_int32_t t = (time.tv_sec - boottime.tv_sec) * 1000; 1282 1283 MGETHDR(m, M_DONTWAIT, MT_DATA); 1284 if (! m) 1285 return; 1286 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1287 m->m_pkthdr.rcvif = 0; 1288 1289 h = mtod(m, struct ppp_header *); 1290 h->address = CISCO_MULTICAST; 1291 h->control = 0; 1292 h->protocol = htons(CISCO_KEEPALIVE); 1293 1294 ch = (struct cisco_packet *)(h + 1); 1295 ch->type = htonl(type); 1296 ch->par1 = htonl(par1); 1297 ch->par2 = htonl(par2); 1298 ch->rel = -1; 1299 1300 ch->time0 = htons((u_short)(t >> 16)); 1301 ch->time1 = htons((u_short) t); 1302 1303 if (debug) 1304 log(LOG_DEBUG, 1305 SPP_FMT "cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1306 SPP_ARGS(ifp), ntohl (ch->type), ch->par1, 1307 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1308 (u_int)ch->time1); 1309 1310 if (IF_QFULL(&sp->pp_cpq)) { 1311 IF_DROP(&sp->pp_fastq); 1312 IF_DROP(&ifp->if_snd); 1313 m_freem(m); 1314 ++ifp->if_oerrors; 1315 return; 1316 } else 1317 IF_ENQUEUE(&sp->pp_cpq, m); 1318 if (! (ifp->if_flags & IFF_OACTIVE)) 1319 (*ifp->if_start)(ifp); 1320 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1321 } 1322 1323 /* 1324 * PPP protocol implementation. 1325 */ 1326 1327 /* 1328 * Send PPP control protocol packet. 1329 */ 1330 static void 1331 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1332 u_char ident, u_short len, void *data) 1333 { 1334 STDDCL; 1335 struct lcp_header *lh; 1336 struct mbuf *m; 1337 size_t pkthdrlen; 1338 1339 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1340 1341 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1342 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1343 MGETHDR(m, M_DONTWAIT, MT_DATA); 1344 if (! m) 1345 return; 1346 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1347 m->m_pkthdr.rcvif = 0; 1348 1349 if (sp->pp_flags & PP_NOFRAMING) { 1350 *mtod(m, u_int16_t *) = htons(proto); 1351 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1352 } else { 1353 struct ppp_header *h; 1354 h = mtod(m, struct ppp_header *); 1355 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1356 h->control = PPP_UI; /* Unnumbered Info */ 1357 h->protocol = htons(proto); /* Link Control Protocol */ 1358 lh = (struct lcp_header *)(h + 1); 1359 } 1360 lh->type = type; 1361 lh->ident = ident; 1362 lh->len = htons(LCP_HEADER_LEN + len); 1363 if (len) 1364 bcopy (data, lh + 1, len); 1365 1366 if (debug) { 1367 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1368 SPP_ARGS(ifp), 1369 sppp_proto_name(proto), 1370 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1371 if (len) 1372 sppp_print_bytes((u_char *)(lh + 1), len); 1373 addlog(">\n"); 1374 } 1375 if (IF_QFULL(&sp->pp_cpq)) { 1376 IF_DROP(&sp->pp_fastq); 1377 IF_DROP(&ifp->if_snd); 1378 m_freem(m); 1379 ++ifp->if_oerrors; 1380 return; 1381 } else 1382 IF_ENQUEUE(&sp->pp_cpq, m); 1383 if (! (ifp->if_flags & IFF_OACTIVE)) 1384 (*ifp->if_start)(ifp); 1385 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1386 } 1387 1388 /* 1389 * Handle incoming PPP control protocol packets. 1390 */ 1391 static void 1392 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1393 { 1394 STDDCL; 1395 struct lcp_header *h; 1396 int len = m->m_pkthdr.len; 1397 int rv; 1398 u_char *p; 1399 u_int32_t u32; 1400 1401 if (len < 4) { 1402 if (debug) 1403 log(LOG_DEBUG, 1404 SPP_FMT "%s invalid packet length: %d bytes\n", 1405 SPP_ARGS(ifp), cp->name, len); 1406 return; 1407 } 1408 h = mtod(m, struct lcp_header *); 1409 if (debug) { 1410 log(LOG_DEBUG, 1411 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1412 SPP_ARGS(ifp), cp->name, 1413 sppp_state_name(sp->state[cp->protoidx]), 1414 sppp_cp_type_name(h->type), h->ident, ntohs(h->len)); 1415 if (len > 4) 1416 sppp_print_bytes((u_char *)(h + 1), len - 4); 1417 addlog(">\n"); 1418 } 1419 if (len > ntohs(h->len)) 1420 len = ntohs(h->len); 1421 p = (u_char *)(h + 1); 1422 switch (h->type) { 1423 case CONF_REQ: 1424 if (len < 4) { 1425 if (debug) 1426 addlog(SPP_FMT "%s invalid conf-req length %d\n", 1427 SPP_ARGS(ifp), cp->name, 1428 len); 1429 ++ifp->if_ierrors; 1430 break; 1431 } 1432 /* handle states where RCR doesn't get a SCA/SCN */ 1433 switch (sp->state[cp->protoidx]) { 1434 case STATE_CLOSING: 1435 case STATE_STOPPING: 1436 return; 1437 case STATE_CLOSED: 1438 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1439 0, 0); 1440 return; 1441 } 1442 rv = (cp->RCR)(sp, h, len); 1443 switch (sp->state[cp->protoidx]) { 1444 case STATE_OPENED: 1445 (cp->tld)(sp); 1446 (cp->scr)(sp); 1447 /* fall through... */ 1448 case STATE_ACK_SENT: 1449 case STATE_REQ_SENT: 1450 sppp_cp_change_state(cp, sp, rv? 1451 STATE_ACK_SENT: STATE_REQ_SENT); 1452 break; 1453 case STATE_STOPPED: 1454 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1455 (cp->scr)(sp); 1456 sppp_cp_change_state(cp, sp, rv? 1457 STATE_ACK_SENT: STATE_REQ_SENT); 1458 break; 1459 case STATE_ACK_RCVD: 1460 if (rv) { 1461 sppp_cp_change_state(cp, sp, STATE_OPENED); 1462 if (debug) 1463 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1464 SPP_ARGS(ifp), 1465 cp->name); 1466 (cp->tlu)(sp); 1467 } else 1468 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1469 break; 1470 default: 1471 printf(SPP_FMT "%s illegal %s in state %s\n", 1472 SPP_ARGS(ifp), cp->name, 1473 sppp_cp_type_name(h->type), 1474 sppp_state_name(sp->state[cp->protoidx])); 1475 ++ifp->if_ierrors; 1476 } 1477 break; 1478 case CONF_ACK: 1479 if (h->ident != sp->confid[cp->protoidx]) { 1480 if (debug) 1481 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1482 SPP_ARGS(ifp), cp->name, 1483 h->ident, sp->confid[cp->protoidx]); 1484 ++ifp->if_ierrors; 1485 break; 1486 } 1487 switch (sp->state[cp->protoidx]) { 1488 case STATE_CLOSED: 1489 case STATE_STOPPED: 1490 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1491 break; 1492 case STATE_CLOSING: 1493 case STATE_STOPPING: 1494 break; 1495 case STATE_REQ_SENT: 1496 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1497 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1498 break; 1499 case STATE_OPENED: 1500 (cp->tld)(sp); 1501 /* fall through */ 1502 case STATE_ACK_RCVD: 1503 (cp->scr)(sp); 1504 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1505 break; 1506 case STATE_ACK_SENT: 1507 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1508 sppp_cp_change_state(cp, sp, STATE_OPENED); 1509 if (debug) 1510 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1511 SPP_ARGS(ifp), cp->name); 1512 (cp->tlu)(sp); 1513 break; 1514 default: 1515 printf(SPP_FMT "%s illegal %s in state %s\n", 1516 SPP_ARGS(ifp), cp->name, 1517 sppp_cp_type_name(h->type), 1518 sppp_state_name(sp->state[cp->protoidx])); 1519 ++ifp->if_ierrors; 1520 } 1521 break; 1522 case CONF_NAK: 1523 case CONF_REJ: 1524 if (h->ident != sp->confid[cp->protoidx]) { 1525 if (debug) 1526 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1527 SPP_ARGS(ifp), cp->name, 1528 h->ident, sp->confid[cp->protoidx]); 1529 ++ifp->if_ierrors; 1530 break; 1531 } 1532 if (h->type == CONF_NAK) 1533 (cp->RCN_nak)(sp, h, len); 1534 else /* CONF_REJ */ 1535 (cp->RCN_rej)(sp, h, len); 1536 1537 switch (sp->state[cp->protoidx]) { 1538 case STATE_CLOSED: 1539 case STATE_STOPPED: 1540 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1541 break; 1542 case STATE_REQ_SENT: 1543 case STATE_ACK_SENT: 1544 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1545 (cp->scr)(sp); 1546 break; 1547 case STATE_OPENED: 1548 (cp->tld)(sp); 1549 /* fall through */ 1550 case STATE_ACK_RCVD: 1551 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1552 (cp->scr)(sp); 1553 break; 1554 case STATE_CLOSING: 1555 case STATE_STOPPING: 1556 break; 1557 default: 1558 printf(SPP_FMT "%s illegal %s in state %s\n", 1559 SPP_ARGS(ifp), cp->name, 1560 sppp_cp_type_name(h->type), 1561 sppp_state_name(sp->state[cp->protoidx])); 1562 ++ifp->if_ierrors; 1563 } 1564 break; 1565 1566 case TERM_REQ: 1567 switch (sp->state[cp->protoidx]) { 1568 case STATE_ACK_RCVD: 1569 case STATE_ACK_SENT: 1570 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1571 /* fall through */ 1572 case STATE_CLOSED: 1573 case STATE_STOPPED: 1574 case STATE_CLOSING: 1575 case STATE_STOPPING: 1576 case STATE_REQ_SENT: 1577 sta: 1578 /* Send Terminate-Ack packet. */ 1579 if (debug) 1580 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1581 SPP_ARGS(ifp), cp->name); 1582 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1583 break; 1584 case STATE_OPENED: 1585 (cp->tld)(sp); 1586 sp->rst_counter[cp->protoidx] = 0; 1587 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1588 goto sta; 1589 default: 1590 printf(SPP_FMT "%s illegal %s in state %s\n", 1591 SPP_ARGS(ifp), cp->name, 1592 sppp_cp_type_name(h->type), 1593 sppp_state_name(sp->state[cp->protoidx])); 1594 ++ifp->if_ierrors; 1595 } 1596 break; 1597 case TERM_ACK: 1598 switch (sp->state[cp->protoidx]) { 1599 case STATE_CLOSED: 1600 case STATE_STOPPED: 1601 case STATE_REQ_SENT: 1602 case STATE_ACK_SENT: 1603 break; 1604 case STATE_CLOSING: 1605 (cp->tlf)(sp); 1606 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1607 sppp_lcp_check_and_close(sp); 1608 break; 1609 case STATE_STOPPING: 1610 (cp->tlf)(sp); 1611 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1612 sppp_lcp_check_and_close(sp); 1613 break; 1614 case STATE_ACK_RCVD: 1615 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1616 break; 1617 case STATE_OPENED: 1618 (cp->tld)(sp); 1619 (cp->scr)(sp); 1620 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1621 break; 1622 default: 1623 printf(SPP_FMT "%s illegal %s in state %s\n", 1624 SPP_ARGS(ifp), cp->name, 1625 sppp_cp_type_name(h->type), 1626 sppp_state_name(sp->state[cp->protoidx])); 1627 ++ifp->if_ierrors; 1628 } 1629 break; 1630 case CODE_REJ: 1631 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1632 log(LOG_INFO, 1633 SPP_FMT "%s: ignoring RXJ (%s) for code ?, " 1634 "danger will robinson\n", 1635 SPP_ARGS(ifp), cp->name, 1636 sppp_cp_type_name(h->type)); 1637 switch (sp->state[cp->protoidx]) { 1638 case STATE_CLOSED: 1639 case STATE_STOPPED: 1640 case STATE_REQ_SENT: 1641 case STATE_ACK_SENT: 1642 case STATE_CLOSING: 1643 case STATE_STOPPING: 1644 case STATE_OPENED: 1645 break; 1646 case STATE_ACK_RCVD: 1647 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1648 break; 1649 default: 1650 printf(SPP_FMT "%s illegal %s in state %s\n", 1651 SPP_ARGS(ifp), cp->name, 1652 sppp_cp_type_name(h->type), 1653 sppp_state_name(sp->state[cp->protoidx])); 1654 ++ifp->if_ierrors; 1655 } 1656 break; 1657 case PROTO_REJ: 1658 { 1659 int catastrophic; 1660 const struct cp *upper; 1661 int i; 1662 u_int16_t proto; 1663 1664 catastrophic = 0; 1665 upper = NULL; 1666 proto = p[0] << 8 | p[1]; 1667 for (i = 0; i < IDX_COUNT; i++) { 1668 if (cps[i]->proto == proto) { 1669 upper = cps[i]; 1670 break; 1671 } 1672 } 1673 if (upper == NULL) 1674 catastrophic++; 1675 1676 if (debug) 1677 log(LOG_INFO, 1678 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1679 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1680 sppp_cp_type_name(h->type), proto, 1681 upper ? upper->name : "unknown", 1682 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1683 1684 /* 1685 * if we got RXJ+ against conf-req, the peer does not implement 1686 * this particular protocol type. terminate the protocol. 1687 */ 1688 if (upper && !catastrophic) { 1689 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1690 upper->Close(sp); 1691 break; 1692 } 1693 } 1694 1695 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1696 switch (sp->state[cp->protoidx]) { 1697 case STATE_CLOSED: 1698 case STATE_STOPPED: 1699 case STATE_REQ_SENT: 1700 case STATE_ACK_SENT: 1701 case STATE_CLOSING: 1702 case STATE_STOPPING: 1703 case STATE_OPENED: 1704 break; 1705 case STATE_ACK_RCVD: 1706 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1707 break; 1708 default: 1709 printf(SPP_FMT "%s illegal %s in state %s\n", 1710 SPP_ARGS(ifp), cp->name, 1711 sppp_cp_type_name(h->type), 1712 sppp_state_name(sp->state[cp->protoidx])); 1713 ++ifp->if_ierrors; 1714 } 1715 break; 1716 } 1717 case DISC_REQ: 1718 if (cp->proto != PPP_LCP) 1719 goto illegal; 1720 /* Discard the packet. */ 1721 break; 1722 case ECHO_REQ: 1723 if (cp->proto != PPP_LCP) 1724 goto illegal; 1725 if (sp->state[cp->protoidx] != STATE_OPENED) { 1726 if (debug) 1727 addlog(SPP_FMT "lcp echo req but lcp closed\n", 1728 SPP_ARGS(ifp)); 1729 ++ifp->if_ierrors; 1730 break; 1731 } 1732 if (len < 8) { 1733 if (debug) 1734 addlog(SPP_FMT "invalid lcp echo request " 1735 "packet length: %d bytes\n", 1736 SPP_ARGS(ifp), len); 1737 break; 1738 } 1739 memcpy(&u32, h + 1, sizeof u32); 1740 if (ntohl(u32) == sp->lcp.magic) { 1741 /* Line loopback mode detected. */ 1742 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1743 if_down(ifp); 1744 IF_PURGE(&sp->pp_cpq); 1745 1746 /* Shut down the PPP link. */ 1747 /* XXX */ 1748 lcp.Down(sp); 1749 lcp.Up(sp); 1750 break; 1751 } 1752 u32 = htonl(sp->lcp.magic); 1753 memcpy(h + 1, &u32, sizeof u32); 1754 if (debug) 1755 addlog(SPP_FMT "got lcp echo req, sending echo rep\n", 1756 SPP_ARGS(ifp)); 1757 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1758 h + 1); 1759 break; 1760 case ECHO_REPLY: 1761 if (cp->proto != PPP_LCP) 1762 goto illegal; 1763 if (h->ident != sp->lcp.echoid) { 1764 ++ifp->if_ierrors; 1765 break; 1766 } 1767 if (len < 8) { 1768 if (debug) 1769 addlog(SPP_FMT "lcp invalid echo reply " 1770 "packet length: %d bytes\n", 1771 SPP_ARGS(ifp), len); 1772 break; 1773 } 1774 if (debug) 1775 addlog(SPP_FMT "lcp got echo rep\n", 1776 SPP_ARGS(ifp)); 1777 memcpy(&u32, h + 1, sizeof u32); 1778 if (ntohl(u32) != sp->lcp.magic) 1779 sp->pp_alivecnt = 0; 1780 break; 1781 default: 1782 /* Unknown packet type -- send Code-Reject packet. */ 1783 illegal: 1784 if (debug) 1785 addlog(SPP_FMT "%s send code-rej for 0x%x\n", 1786 SPP_ARGS(ifp), cp->name, h->type); 1787 sppp_cp_send(sp, cp->proto, CODE_REJ, 1788 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1789 ++ifp->if_ierrors; 1790 } 1791 } 1792 1793 1794 /* 1795 * The generic part of all Up/Down/Open/Close/TO event handlers. 1796 * Basically, the state transition handling in the automaton. 1797 */ 1798 static void 1799 sppp_up_event(const struct cp *cp, struct sppp *sp) 1800 { 1801 STDDCL; 1802 1803 if (debug) 1804 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1805 SPP_ARGS(ifp), cp->name, 1806 sppp_state_name(sp->state[cp->protoidx])); 1807 1808 switch (sp->state[cp->protoidx]) { 1809 case STATE_INITIAL: 1810 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1811 break; 1812 case STATE_STARTING: 1813 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1814 (cp->scr)(sp); 1815 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1816 break; 1817 default: 1818 printf(SPP_FMT "%s illegal up in state %s\n", 1819 SPP_ARGS(ifp), cp->name, 1820 sppp_state_name(sp->state[cp->protoidx])); 1821 } 1822 } 1823 1824 static void 1825 sppp_down_event(const struct cp *cp, struct sppp *sp) 1826 { 1827 STDDCL; 1828 1829 if (debug) 1830 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1831 SPP_ARGS(ifp), cp->name, 1832 sppp_state_name(sp->state[cp->protoidx])); 1833 1834 switch (sp->state[cp->protoidx]) { 1835 case STATE_CLOSED: 1836 case STATE_CLOSING: 1837 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1838 break; 1839 case STATE_STOPPED: 1840 (cp->tls)(sp); 1841 /* fall through */ 1842 case STATE_STOPPING: 1843 case STATE_REQ_SENT: 1844 case STATE_ACK_RCVD: 1845 case STATE_ACK_SENT: 1846 sppp_cp_change_state(cp, sp, STATE_STARTING); 1847 break; 1848 case STATE_OPENED: 1849 (cp->tld)(sp); 1850 sppp_cp_change_state(cp, sp, STATE_STARTING); 1851 break; 1852 default: 1853 printf(SPP_FMT "%s illegal down in state %s\n", 1854 SPP_ARGS(ifp), cp->name, 1855 sppp_state_name(sp->state[cp->protoidx])); 1856 } 1857 } 1858 1859 1860 static void 1861 sppp_open_event(const struct cp *cp, struct sppp *sp) 1862 { 1863 STDDCL; 1864 1865 if (debug) 1866 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1867 SPP_ARGS(ifp), cp->name, 1868 sppp_state_name(sp->state[cp->protoidx])); 1869 1870 switch (sp->state[cp->protoidx]) { 1871 case STATE_INITIAL: 1872 (cp->tls)(sp); 1873 sppp_cp_change_state(cp, sp, STATE_STARTING); 1874 break; 1875 case STATE_STARTING: 1876 break; 1877 case STATE_CLOSED: 1878 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1879 (cp->scr)(sp); 1880 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1881 break; 1882 case STATE_STOPPED: 1883 case STATE_STOPPING: 1884 case STATE_REQ_SENT: 1885 case STATE_ACK_RCVD: 1886 case STATE_ACK_SENT: 1887 case STATE_OPENED: 1888 break; 1889 case STATE_CLOSING: 1890 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1891 break; 1892 } 1893 } 1894 1895 1896 static void 1897 sppp_close_event(const struct cp *cp, struct sppp *sp) 1898 { 1899 STDDCL; 1900 1901 if (debug) 1902 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1903 SPP_ARGS(ifp), cp->name, 1904 sppp_state_name(sp->state[cp->protoidx])); 1905 1906 switch (sp->state[cp->protoidx]) { 1907 case STATE_INITIAL: 1908 case STATE_CLOSED: 1909 case STATE_CLOSING: 1910 break; 1911 case STATE_STARTING: 1912 (cp->tlf)(sp); 1913 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1914 break; 1915 case STATE_STOPPED: 1916 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1917 break; 1918 case STATE_STOPPING: 1919 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1920 break; 1921 case STATE_OPENED: 1922 (cp->tld)(sp); 1923 /* fall through */ 1924 case STATE_REQ_SENT: 1925 case STATE_ACK_RCVD: 1926 case STATE_ACK_SENT: 1927 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1928 sppp_cp_send(sp, cp->proto, TERM_REQ, 1929 ++sp->pp_seq[cp->protoidx], 0, 0); 1930 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1931 break; 1932 } 1933 } 1934 1935 static void 1936 sppp_to_event(const struct cp *cp, struct sppp *sp) 1937 { 1938 STDDCL; 1939 int s; 1940 1941 s = splnet(); 1942 if (debug) 1943 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 1944 SPP_ARGS(ifp), cp->name, 1945 sppp_state_name(sp->state[cp->protoidx]), 1946 sp->rst_counter[cp->protoidx]); 1947 1948 if (--sp->rst_counter[cp->protoidx] < 0) 1949 /* TO- event */ 1950 switch (sp->state[cp->protoidx]) { 1951 case STATE_CLOSING: 1952 (cp->tlf)(sp); 1953 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1954 sppp_lcp_check_and_close(sp); 1955 break; 1956 case STATE_STOPPING: 1957 (cp->tlf)(sp); 1958 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1959 sppp_lcp_check_and_close(sp); 1960 break; 1961 case STATE_REQ_SENT: 1962 case STATE_ACK_RCVD: 1963 case STATE_ACK_SENT: 1964 (cp->tlf)(sp); 1965 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1966 sppp_lcp_check_and_close(sp); 1967 break; 1968 } 1969 else 1970 /* TO+ event */ 1971 switch (sp->state[cp->protoidx]) { 1972 case STATE_CLOSING: 1973 case STATE_STOPPING: 1974 sppp_cp_send(sp, cp->proto, TERM_REQ, 1975 ++sp->pp_seq[cp->protoidx], 0, 0); 1976 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1977 cp->TO, sp); 1978 break; 1979 case STATE_REQ_SENT: 1980 case STATE_ACK_RCVD: 1981 (cp->scr)(sp); 1982 /* sppp_cp_change_state() will restart the timer */ 1983 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1984 break; 1985 case STATE_ACK_SENT: 1986 (cp->scr)(sp); 1987 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1988 cp->TO, sp); 1989 break; 1990 } 1991 1992 splx(s); 1993 } 1994 1995 /* 1996 * Change the state of a control protocol in the state automaton. 1997 * Takes care of starting/stopping the restart timer. 1998 */ 1999 void 2000 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2001 { 2002 sp->state[cp->protoidx] = newstate; 2003 callout_stop(&sp->ch[cp->protoidx]); 2004 switch (newstate) { 2005 case STATE_INITIAL: 2006 case STATE_STARTING: 2007 case STATE_CLOSED: 2008 case STATE_STOPPED: 2009 case STATE_OPENED: 2010 break; 2011 case STATE_CLOSING: 2012 case STATE_STOPPING: 2013 case STATE_REQ_SENT: 2014 case STATE_ACK_RCVD: 2015 case STATE_ACK_SENT: 2016 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2017 cp->TO, sp); 2018 break; 2019 } 2020 } 2021 2022 /* 2023 *--------------------------------------------------------------------------* 2024 * * 2025 * The LCP implementation. * 2026 * * 2027 *--------------------------------------------------------------------------* 2028 */ 2029 static void 2030 sppp_lcp_init(struct sppp *sp) 2031 { 2032 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2033 sp->lcp.magic = 0; 2034 sp->state[IDX_LCP] = STATE_INITIAL; 2035 sp->fail_counter[IDX_LCP] = 0; 2036 sp->pp_seq[IDX_LCP] = 0; 2037 sp->pp_rseq[IDX_LCP] = 0; 2038 sp->lcp.protos = 0; 2039 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2040 2041 /* 2042 * Initialize counters and timeout values. Note that we don't 2043 * use the 3 seconds suggested in RFC 1661 since we are likely 2044 * running on a fast link. XXX We should probably implement 2045 * the exponential backoff option. Note that these values are 2046 * relevant for all control protocols, not just LCP only. 2047 */ 2048 sp->lcp.timeout = 1 * hz; 2049 sp->lcp.max_terminate = 2; 2050 sp->lcp.max_configure = 10; 2051 sp->lcp.max_failure = 10; 2052 callout_init(&sp->ch[IDX_LCP]); 2053 } 2054 2055 static void 2056 sppp_lcp_up(struct sppp *sp) 2057 { 2058 STDDCL; 2059 2060 /* Initialize activity timestamp: opening a connection is an activity */ 2061 sp->pp_last_activity = mono_time.tv_sec; 2062 2063 /* 2064 * If this interface is passive or dial-on-demand, and we are 2065 * still in Initial state, it means we've got an incoming 2066 * call. Activate the interface. 2067 */ 2068 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2069 if (debug) 2070 log(LOG_DEBUG, 2071 SPP_FMT "Up event", SPP_ARGS(ifp)); 2072 ifp->if_flags |= IFF_RUNNING; 2073 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2074 if (debug) 2075 addlog("(incoming call)\n"); 2076 sp->pp_flags |= PP_CALLIN; 2077 lcp.Open(sp); 2078 } else if (debug) 2079 addlog("\n"); 2080 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2081 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2082 ifp->if_flags |= IFF_RUNNING; 2083 lcp.Open(sp); 2084 } 2085 2086 sppp_up_event(&lcp, sp); 2087 } 2088 2089 static void 2090 sppp_lcp_down(struct sppp *sp) 2091 { 2092 STDDCL; 2093 2094 sppp_down_event(&lcp, sp); 2095 2096 /* 2097 * If this is neither a dial-on-demand nor a passive 2098 * interface, simulate an ``ifconfig down'' action, so the 2099 * administrator can force a redial by another ``ifconfig 2100 * up''. XXX For leased line operation, should we immediately 2101 * try to reopen the connection here? 2102 */ 2103 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2104 if (debug) 2105 log(LOG_INFO, 2106 SPP_FMT "Down event (carrier loss), taking interface down.\n", 2107 SPP_ARGS(ifp)); 2108 if_down(ifp); 2109 } else { 2110 if (debug) 2111 log(LOG_DEBUG, 2112 SPP_FMT "Down event (carrier loss)\n", 2113 SPP_ARGS(ifp)); 2114 } 2115 sp->pp_flags &= ~PP_CALLIN; 2116 if (sp->state[IDX_LCP] != STATE_INITIAL) 2117 lcp.Close(sp); 2118 ifp->if_flags &= ~IFF_RUNNING; 2119 } 2120 2121 static void 2122 sppp_lcp_open(struct sppp *sp) 2123 { 2124 /* 2125 * If we are authenticator, negotiate LCP_AUTH 2126 */ 2127 if (sp->hisauth.proto != 0) 2128 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2129 else 2130 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2131 sp->pp_flags &= ~PP_NEEDAUTH; 2132 sppp_open_event(&lcp, sp); 2133 } 2134 2135 static void 2136 sppp_lcp_close(struct sppp *sp) 2137 { 2138 sppp_close_event(&lcp, sp); 2139 } 2140 2141 static void 2142 sppp_lcp_TO(void *cookie) 2143 { 2144 sppp_to_event(&lcp, (struct sppp *)cookie); 2145 } 2146 2147 /* 2148 * Analyze a configure request. Return true if it was agreeable, and 2149 * caused action sca, false if it has been rejected or nak'ed, and 2150 * caused action scn. (The return value is used to make the state 2151 * transition decision in the state automaton.) 2152 */ 2153 static int 2154 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2155 { 2156 STDDCL; 2157 u_char *buf, *r, *p; 2158 int origlen, rlen; 2159 u_int32_t nmagic; 2160 u_short authproto; 2161 2162 len -= 4; 2163 origlen = len; 2164 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2165 if (! buf) 2166 return (0); 2167 2168 if (debug) 2169 log(LOG_DEBUG, SPP_FMT "lcp parse opts:", 2170 SPP_ARGS(ifp)); 2171 2172 /* pass 1: check for things that need to be rejected */ 2173 p = (void *)(h + 1); 2174 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2175 if (debug) 2176 addlog(" %s", sppp_lcp_opt_name(*p)); 2177 switch (*p) { 2178 case LCP_OPT_MAGIC: 2179 /* Magic number. */ 2180 /* fall through, both are same length */ 2181 case LCP_OPT_ASYNC_MAP: 2182 /* Async control character map. */ 2183 if (len >= 6 || p[1] == 6) 2184 continue; 2185 if (debug) 2186 addlog(" [invalid]"); 2187 break; 2188 case LCP_OPT_MRU: 2189 /* Maximum receive unit. */ 2190 if (len >= 4 && p[1] == 4) 2191 continue; 2192 if (debug) 2193 addlog(" [invalid]"); 2194 break; 2195 case LCP_OPT_AUTH_PROTO: 2196 if (len < 4) { 2197 if (debug) 2198 addlog(" [invalid]"); 2199 break; 2200 } 2201 authproto = (p[2] << 8) + p[3]; 2202 if (authproto == PPP_CHAP && p[1] != 5) { 2203 if (debug) 2204 addlog(" [invalid chap len]"); 2205 break; 2206 } 2207 if (sp->myauth.proto == 0) { 2208 /* we are not configured to do auth */ 2209 if (debug) 2210 addlog(" [not configured]"); 2211 break; 2212 } 2213 /* 2214 * Remote want us to authenticate, remember this, 2215 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2216 * up. 2217 */ 2218 sp->pp_flags |= PP_NEEDAUTH; 2219 continue; 2220 default: 2221 /* Others not supported. */ 2222 if (debug) 2223 addlog(" [rej]"); 2224 break; 2225 } 2226 /* Add the option to rejected list. */ 2227 bcopy (p, r, p[1]); 2228 r += p[1]; 2229 rlen += p[1]; 2230 } 2231 if (rlen) { 2232 if (debug) 2233 addlog(" send conf-rej\n"); 2234 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2235 goto end; 2236 } else if (debug) 2237 addlog("\n"); 2238 2239 /* 2240 * pass 2: check for option values that are unacceptable and 2241 * thus require to be nak'ed. 2242 */ 2243 if (debug) 2244 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2245 SPP_ARGS(ifp)); 2246 2247 p = (void *)(h + 1); 2248 len = origlen; 2249 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2250 if (debug) 2251 addlog(" %s", sppp_lcp_opt_name(*p)); 2252 switch (*p) { 2253 case LCP_OPT_MAGIC: 2254 /* Magic number -- extract. */ 2255 nmagic = (u_int32_t)p[2] << 24 | 2256 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2257 if (nmagic != sp->lcp.magic) { 2258 if (debug) 2259 addlog(" 0x%x", nmagic); 2260 continue; 2261 } 2262 /* 2263 * Local and remote magics equal -- loopback? 2264 */ 2265 if (sp->pp_loopcnt >= MAXALIVECNT*5) { 2266 printf (SPP_FMT "loopback\n", 2267 SPP_ARGS(ifp)); 2268 sp->pp_loopcnt = 0; 2269 if (ifp->if_flags & IFF_UP) { 2270 if_down(ifp); 2271 IF_PURGE(&sp->pp_cpq); 2272 /* XXX ? */ 2273 lcp.Down(sp); 2274 lcp.Up(sp); 2275 } 2276 } else if (debug) 2277 addlog(" [glitch]"); 2278 ++sp->pp_loopcnt; 2279 /* 2280 * We negate our magic here, and NAK it. If 2281 * we see it later in an NAK packet, we 2282 * suggest a new one. 2283 */ 2284 nmagic = ~sp->lcp.magic; 2285 /* Gonna NAK it. */ 2286 p[2] = nmagic >> 24; 2287 p[3] = nmagic >> 16; 2288 p[4] = nmagic >> 8; 2289 p[5] = nmagic; 2290 break; 2291 2292 case LCP_OPT_ASYNC_MAP: 2293 /* 2294 * Async control character map -- just ignore it. 2295 * 2296 * Quote from RFC 1662, chapter 6: 2297 * To enable this functionality, synchronous PPP 2298 * implementations MUST always respond to the 2299 * Async-Control-Character-Map Configuration 2300 * Option with the LCP Configure-Ack. However, 2301 * acceptance of the Configuration Option does 2302 * not imply that the synchronous implementation 2303 * will do any ACCM mapping. Instead, all such 2304 * octet mapping will be performed by the 2305 * asynchronous-to-synchronous converter. 2306 */ 2307 continue; 2308 2309 case LCP_OPT_MRU: 2310 /* 2311 * Maximum receive unit. Always agreeable, 2312 * but ignored by now. 2313 */ 2314 sp->lcp.their_mru = p[2] * 256 + p[3]; 2315 if (debug) 2316 addlog(" %ld", sp->lcp.their_mru); 2317 continue; 2318 2319 case LCP_OPT_AUTH_PROTO: 2320 authproto = (p[2] << 8) + p[3]; 2321 if (sp->myauth.proto != authproto) { 2322 /* not agreed, nak */ 2323 if (debug) 2324 addlog(" [mine %s != his %s]", 2325 sppp_proto_name(sp->hisauth.proto), 2326 sppp_proto_name(authproto)); 2327 p[2] = sp->myauth.proto >> 8; 2328 p[3] = sp->myauth.proto; 2329 break; 2330 } 2331 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2332 if (debug) 2333 addlog(" [chap not MD5]"); 2334 p[4] = CHAP_MD5; 2335 break; 2336 } 2337 continue; 2338 } 2339 /* Add the option to nak'ed list. */ 2340 bcopy (p, r, p[1]); 2341 r += p[1]; 2342 rlen += p[1]; 2343 } 2344 if (rlen) { 2345 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2346 if (debug) 2347 addlog(" max_failure (%d) exceeded, " 2348 "send conf-rej\n", 2349 sp->lcp.max_failure); 2350 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2351 } else { 2352 if (debug) 2353 addlog(" send conf-nak\n"); 2354 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2355 } 2356 goto end; 2357 } else { 2358 if (debug) 2359 addlog(" send conf-ack\n"); 2360 sp->fail_counter[IDX_LCP] = 0; 2361 sp->pp_loopcnt = 0; 2362 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2363 } 2364 2365 end: 2366 free(buf, M_TEMP); 2367 return (rlen == 0); 2368 } 2369 2370 /* 2371 * Analyze the LCP Configure-Reject option list, and adjust our 2372 * negotiation. 2373 */ 2374 static void 2375 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2376 { 2377 STDDCL; 2378 u_char *buf, *p; 2379 2380 len -= 4; 2381 buf = malloc (len, M_TEMP, M_NOWAIT); 2382 if (!buf) 2383 return; 2384 2385 if (debug) 2386 log(LOG_DEBUG, SPP_FMT "lcp rej opts:", 2387 SPP_ARGS(ifp)); 2388 2389 p = (void *)(h + 1); 2390 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2391 if (debug) 2392 addlog(" %s", sppp_lcp_opt_name(*p)); 2393 switch (*p) { 2394 case LCP_OPT_MAGIC: 2395 /* Magic number -- can't use it, use 0 */ 2396 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2397 sp->lcp.magic = 0; 2398 break; 2399 case LCP_OPT_MRU: 2400 /* 2401 * Should not be rejected anyway, since we only 2402 * negotiate a MRU if explicitly requested by 2403 * peer. 2404 */ 2405 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2406 break; 2407 case LCP_OPT_AUTH_PROTO: 2408 /* 2409 * Peer doesn't want to authenticate himself, 2410 * deny unless this is a dialout call, and 2411 * SPPP_AUTHFLAG_NOCALLOUT is set. 2412 */ 2413 if ((sp->pp_flags & PP_CALLIN) == 0 && 2414 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2415 if (debug) 2416 addlog(" [don't insist on auth " 2417 "for callout]"); 2418 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2419 break; 2420 } 2421 if (debug) 2422 addlog("[access denied]\n"); 2423 lcp.Close(sp); 2424 break; 2425 } 2426 } 2427 if (debug) 2428 addlog("\n"); 2429 free(buf, M_TEMP); 2430 return; 2431 } 2432 2433 /* 2434 * Analyze the LCP Configure-NAK option list, and adjust our 2435 * negotiation. 2436 */ 2437 static void 2438 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2439 { 2440 STDDCL; 2441 u_char *buf, *p; 2442 u_int32_t magic; 2443 2444 len -= 4; 2445 buf = malloc (len, M_TEMP, M_NOWAIT); 2446 if (!buf) 2447 return; 2448 2449 if (debug) 2450 log(LOG_DEBUG, SPP_FMT "lcp nak opts:", 2451 SPP_ARGS(ifp)); 2452 2453 p = (void *)(h + 1); 2454 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2455 if (debug) 2456 addlog(" %s", sppp_lcp_opt_name(*p)); 2457 switch (*p) { 2458 case LCP_OPT_MAGIC: 2459 /* Magic number -- renegotiate */ 2460 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2461 len >= 6 && p[1] == 6) { 2462 magic = (u_int32_t)p[2] << 24 | 2463 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2464 /* 2465 * If the remote magic is our negated one, 2466 * this looks like a loopback problem. 2467 * Suggest a new magic to make sure. 2468 */ 2469 if (magic == ~sp->lcp.magic) { 2470 if (debug) 2471 addlog(" magic glitch"); 2472 sp->lcp.magic = random(); 2473 } else { 2474 sp->lcp.magic = magic; 2475 if (debug) 2476 addlog(" %d", magic); 2477 } 2478 } 2479 break; 2480 case LCP_OPT_MRU: 2481 /* 2482 * Peer wants to advise us to negotiate an MRU. 2483 * Agree on it if it's reasonable, or use 2484 * default otherwise. 2485 */ 2486 if (len >= 4 && p[1] == 4) { 2487 u_int mru = p[2] * 256 + p[3]; 2488 if (debug) 2489 addlog(" %d", mru); 2490 if (mru < PP_MTU || mru > PP_MAX_MRU) 2491 mru = PP_MTU; 2492 sp->lcp.mru = mru; 2493 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2494 } 2495 break; 2496 case LCP_OPT_AUTH_PROTO: 2497 /* 2498 * Peer doesn't like our authentication method, 2499 * deny. 2500 */ 2501 if (debug) 2502 addlog("[access denied]\n"); 2503 lcp.Close(sp); 2504 break; 2505 } 2506 } 2507 if (debug) 2508 addlog("\n"); 2509 free(buf, M_TEMP); 2510 return; 2511 } 2512 2513 static void 2514 sppp_lcp_tlu(struct sppp *sp) 2515 { 2516 STDDCL; 2517 int i; 2518 u_int32_t mask; 2519 2520 /* XXX ? */ 2521 if (! (ifp->if_flags & IFF_UP) && 2522 (ifp->if_flags & IFF_RUNNING)) { 2523 /* Coming out of loopback mode. */ 2524 if_up(ifp); 2525 } 2526 2527 for (i = 0; i < IDX_COUNT; i++) 2528 if ((cps[i])->flags & CP_QUAL) 2529 (cps[i])->Open(sp); 2530 2531 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2532 (sp->pp_flags & PP_NEEDAUTH) != 0) 2533 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2534 else 2535 sp->pp_phase = SPPP_PHASE_NETWORK; 2536 2537 if(debug) 2538 { 2539 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2540 sppp_phase_name(sp->pp_phase)); 2541 } 2542 2543 /* 2544 * Open all authentication protocols. This is even required 2545 * if we already proceeded to network phase, since it might be 2546 * that remote wants us to authenticate, so we might have to 2547 * send a PAP request. Undesired authentication protocols 2548 * don't do anything when they get an Open event. 2549 */ 2550 for (i = 0; i < IDX_COUNT; i++) 2551 if ((cps[i])->flags & CP_AUTH) 2552 (cps[i])->Open(sp); 2553 2554 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2555 /* Notify all NCPs. */ 2556 for (i = 0; i < IDX_COUNT; i++) 2557 if ((cps[i])->flags & CP_NCP) 2558 (cps[i])->Open(sp); 2559 } 2560 2561 /* Send Up events to all started protos. */ 2562 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2563 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2564 (cps[i])->Up(sp); 2565 2566 /* notify low-level driver of state change */ 2567 if (sp->pp_chg) 2568 sp->pp_chg(sp, (int)sp->pp_phase); 2569 2570 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2571 /* if no NCP is starting, close down */ 2572 sppp_lcp_check_and_close(sp); 2573 } 2574 2575 static void 2576 sppp_lcp_tld(struct sppp *sp) 2577 { 2578 STDDCL; 2579 int i; 2580 u_int32_t mask; 2581 2582 sp->pp_phase = SPPP_PHASE_TERMINATE; 2583 2584 if(debug) 2585 { 2586 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2587 sppp_phase_name(sp->pp_phase)); 2588 } 2589 2590 /* 2591 * Take upper layers down. We send the Down event first and 2592 * the Close second to prevent the upper layers from sending 2593 * ``a flurry of terminate-request packets'', as the RFC 2594 * describes it. 2595 */ 2596 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2597 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2598 (cps[i])->Down(sp); 2599 (cps[i])->Close(sp); 2600 } 2601 } 2602 2603 static void 2604 sppp_lcp_tls(struct sppp *sp) 2605 { 2606 STDDCL; 2607 2608 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2609 printf("%s: authentication failed %d times, not retrying again\n", 2610 sp->pp_if.if_xname, sp->pp_auth_failures); 2611 if_down(&sp->pp_if); 2612 return; 2613 } 2614 2615 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2616 2617 if(debug) 2618 { 2619 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2620 sppp_phase_name(sp->pp_phase)); 2621 } 2622 2623 /* Notify lower layer if desired. */ 2624 if (sp->pp_tls) 2625 (sp->pp_tls)(sp); 2626 } 2627 2628 static void 2629 sppp_lcp_tlf(struct sppp *sp) 2630 { 2631 STDDCL; 2632 2633 sp->pp_phase = SPPP_PHASE_DEAD; 2634 2635 if(debug) 2636 { 2637 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2638 sppp_phase_name(sp->pp_phase)); 2639 } 2640 2641 /* Notify lower layer if desired. */ 2642 if (sp->pp_tlf) 2643 (sp->pp_tlf)(sp); 2644 } 2645 2646 static void 2647 sppp_lcp_scr(struct sppp *sp) 2648 { 2649 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2650 int i = 0; 2651 u_short authproto; 2652 2653 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2654 if (! sp->lcp.magic) 2655 sp->lcp.magic = random(); 2656 opt[i++] = LCP_OPT_MAGIC; 2657 opt[i++] = 6; 2658 opt[i++] = sp->lcp.magic >> 24; 2659 opt[i++] = sp->lcp.magic >> 16; 2660 opt[i++] = sp->lcp.magic >> 8; 2661 opt[i++] = sp->lcp.magic; 2662 } 2663 2664 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2665 opt[i++] = LCP_OPT_MRU; 2666 opt[i++] = 4; 2667 opt[i++] = sp->lcp.mru >> 8; 2668 opt[i++] = sp->lcp.mru; 2669 } 2670 2671 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2672 authproto = sp->hisauth.proto; 2673 opt[i++] = LCP_OPT_AUTH_PROTO; 2674 opt[i++] = authproto == PPP_CHAP? 5: 4; 2675 opt[i++] = authproto >> 8; 2676 opt[i++] = authproto; 2677 if (authproto == PPP_CHAP) 2678 opt[i++] = CHAP_MD5; 2679 } 2680 2681 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2682 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2683 } 2684 2685 /* 2686 * Check the open NCPs, return true if at least one NCP is open. 2687 */ 2688 static int 2689 sppp_ncp_check(struct sppp *sp) 2690 { 2691 int i, mask; 2692 2693 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2694 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2695 return 1; 2696 return 0; 2697 } 2698 2699 /* 2700 * Re-check the open NCPs and see if we should terminate the link. 2701 * Called by the NCPs during their tlf action handling. 2702 */ 2703 static void 2704 sppp_lcp_check_and_close(struct sppp *sp) 2705 { 2706 2707 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2708 /* don't bother, we are already going down */ 2709 return; 2710 2711 if (sppp_ncp_check(sp)) 2712 return; 2713 2714 lcp.Close(sp); 2715 } 2716 2717 2718 /* 2719 *--------------------------------------------------------------------------* 2720 * * 2721 * The IPCP implementation. * 2722 * * 2723 *--------------------------------------------------------------------------* 2724 */ 2725 2726 static void 2727 sppp_ipcp_init(struct sppp *sp) 2728 { 2729 sp->ipcp.opts = 0; 2730 sp->ipcp.flags = 0; 2731 sp->state[IDX_IPCP] = STATE_INITIAL; 2732 sp->fail_counter[IDX_IPCP] = 0; 2733 sp->pp_seq[IDX_IPCP] = 0; 2734 sp->pp_rseq[IDX_IPCP] = 0; 2735 callout_init(&sp->ch[IDX_IPCP]); 2736 } 2737 2738 static void 2739 sppp_ipcp_up(struct sppp *sp) 2740 { 2741 sppp_up_event(&ipcp, sp); 2742 } 2743 2744 static void 2745 sppp_ipcp_down(struct sppp *sp) 2746 { 2747 sppp_down_event(&ipcp, sp); 2748 } 2749 2750 static void 2751 sppp_ipcp_open(struct sppp *sp) 2752 { 2753 STDDCL; 2754 u_int32_t myaddr, hisaddr; 2755 2756 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2757 sp->ipcp.req_myaddr = 0; 2758 sp->ipcp.req_hisaddr = 0; 2759 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2760 2761 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2762 /* 2763 * If we don't have his address, this probably means our 2764 * interface doesn't want to talk IP at all. (This could 2765 * be the case if somebody wants to speak only IPX, for 2766 * example.) Don't open IPCP in this case. 2767 */ 2768 if (hisaddr == 0L) { 2769 /* XXX this message should go away */ 2770 if (debug) 2771 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 2772 SPP_ARGS(ifp)); 2773 return; 2774 } 2775 2776 if (myaddr == 0) { 2777 /* 2778 * I don't have an assigned address, so i need to 2779 * negotiate my address. 2780 */ 2781 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2782 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2783 } 2784 if (hisaddr == 1) { 2785 /* 2786 * XXX - remove this hack! 2787 * remote has no valid adress, we need to get one assigned. 2788 */ 2789 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2790 } 2791 sppp_open_event(&ipcp, sp); 2792 } 2793 2794 static void 2795 sppp_ipcp_close(struct sppp *sp) 2796 { 2797 STDDCL; 2798 2799 sppp_close_event(&ipcp, sp); 2800 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2801 /* 2802 * Some address was dynamic, clear it again. 2803 */ 2804 sppp_clear_ip_addrs(sp); 2805 2806 if (sp->pp_saved_mtu > 0) { 2807 ifp->if_mtu = sp->pp_saved_mtu; 2808 sp->pp_saved_mtu = 0; 2809 if (debug) 2810 log(LOG_DEBUG, 2811 SPP_FMT "resetting MTU to %" PRIu64 " bytes\n", 2812 SPP_ARGS(ifp), ifp->if_mtu); 2813 } 2814 } 2815 2816 static void 2817 sppp_ipcp_TO(void *cookie) 2818 { 2819 sppp_to_event(&ipcp, (struct sppp *)cookie); 2820 } 2821 2822 /* 2823 * Analyze a configure request. Return true if it was agreeable, and 2824 * caused action sca, false if it has been rejected or nak'ed, and 2825 * caused action scn. (The return value is used to make the state 2826 * transition decision in the state automaton.) 2827 */ 2828 static int 2829 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2830 { 2831 u_char *buf, *r, *p; 2832 struct ifnet *ifp = &sp->pp_if; 2833 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2834 u_int32_t hisaddr, desiredaddr; 2835 2836 len -= 4; 2837 origlen = len; 2838 /* 2839 * Make sure to allocate a buf that can at least hold a 2840 * conf-nak with an `address' option. We might need it below. 2841 */ 2842 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2843 if (! buf) 2844 return (0); 2845 2846 /* pass 1: see if we can recognize them */ 2847 if (debug) 2848 log(LOG_DEBUG, SPP_FMT "ipcp parse opts:", 2849 SPP_ARGS(ifp)); 2850 p = (void *)(h + 1); 2851 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2852 if (debug) 2853 addlog(" %s", sppp_ipcp_opt_name(*p)); 2854 switch (*p) { 2855 #ifdef notyet 2856 case IPCP_OPT_COMPRESSION: 2857 if (len >= 6 && p[1] >= 6) { 2858 /* correctly formed compress option */ 2859 continue; 2860 } 2861 if (debug) 2862 addlog(" [invalid]"); 2863 break; 2864 #endif 2865 case IPCP_OPT_ADDRESS: 2866 if (len >= 6 && p[1] == 6) { 2867 /* correctly formed address option */ 2868 continue; 2869 } 2870 if (debug) 2871 addlog(" [invalid]"); 2872 break; 2873 default: 2874 /* Others not supported. */ 2875 if (debug) 2876 addlog(" [rej]"); 2877 break; 2878 } 2879 /* Add the option to rejected list. */ 2880 bcopy (p, r, p[1]); 2881 r += p[1]; 2882 rlen += p[1]; 2883 } 2884 if (rlen) { 2885 if (debug) 2886 addlog(" send conf-rej\n"); 2887 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2888 goto end; 2889 } else if (debug) 2890 addlog("\n"); 2891 2892 /* pass 2: parse option values */ 2893 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2894 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2895 else 2896 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2897 if (debug) 2898 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2899 SPP_ARGS(ifp)); 2900 p = (void *)(h + 1); 2901 len = origlen; 2902 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2903 if (debug) 2904 addlog(" %s", sppp_ipcp_opt_name(*p)); 2905 switch (*p) { 2906 #ifdef notyet 2907 case IPCP_OPT_COMPRESSION: 2908 continue; 2909 #endif 2910 case IPCP_OPT_ADDRESS: 2911 desiredaddr = p[2] << 24 | p[3] << 16 | 2912 p[4] << 8 | p[5]; 2913 if (desiredaddr == hisaddr || 2914 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2915 /* 2916 * Peer's address is same as our value, 2917 * this is agreeable. Gonna conf-ack 2918 * it. 2919 */ 2920 if (debug) 2921 addlog(" %s [ack]", 2922 sppp_dotted_quad(hisaddr)); 2923 /* record that we've seen it already */ 2924 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2925 sp->ipcp.req_hisaddr = desiredaddr; 2926 hisaddr = desiredaddr; 2927 continue; 2928 } 2929 /* 2930 * The address wasn't agreeable. This is either 2931 * he sent us 0.0.0.0, asking to assign him an 2932 * address, or he send us another address not 2933 * matching our value. Either case, we gonna 2934 * conf-nak it with our value. 2935 */ 2936 if (debug) { 2937 if (desiredaddr == 0) 2938 addlog(" [addr requested]"); 2939 else 2940 addlog(" %s [not agreed]", 2941 sppp_dotted_quad(desiredaddr)); 2942 } 2943 2944 p[2] = hisaddr >> 24; 2945 p[3] = hisaddr >> 16; 2946 p[4] = hisaddr >> 8; 2947 p[5] = hisaddr; 2948 break; 2949 } 2950 /* Add the option to nak'ed list. */ 2951 bcopy (p, r, p[1]); 2952 r += p[1]; 2953 rlen += p[1]; 2954 } 2955 2956 /* 2957 * If we are about to conf-ack the request, but haven't seen 2958 * his address so far, gonna conf-nak it instead, with the 2959 * `address' option present and our idea of his address being 2960 * filled in there, to request negotiation of both addresses. 2961 * 2962 * XXX This can result in an endless req - nak loop if peer 2963 * doesn't want to send us his address. Q: What should we do 2964 * about it? XXX A: implement the max-failure counter. 2965 */ 2966 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2967 buf[0] = IPCP_OPT_ADDRESS; 2968 buf[1] = 6; 2969 buf[2] = hisaddr >> 24; 2970 buf[3] = hisaddr >> 16; 2971 buf[4] = hisaddr >> 8; 2972 buf[5] = hisaddr; 2973 rlen = 6; 2974 if (debug) 2975 addlog(" still need hisaddr"); 2976 } 2977 2978 if (rlen) { 2979 if (debug) 2980 addlog(" send conf-nak\n"); 2981 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2982 } else { 2983 if (debug) 2984 addlog(" send conf-ack\n"); 2985 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 2986 } 2987 2988 end: 2989 free(buf, M_TEMP); 2990 return (rlen == 0); 2991 } 2992 2993 /* 2994 * Analyze the IPCP Configure-Reject option list, and adjust our 2995 * negotiation. 2996 */ 2997 static void 2998 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2999 { 3000 u_char *buf, *p; 3001 struct ifnet *ifp = &sp->pp_if; 3002 int debug = ifp->if_flags & IFF_DEBUG; 3003 3004 len -= 4; 3005 buf = malloc (len, M_TEMP, M_NOWAIT); 3006 if (!buf) 3007 return; 3008 3009 if (debug) 3010 log(LOG_DEBUG, SPP_FMT "ipcp rej opts:", 3011 SPP_ARGS(ifp)); 3012 3013 p = (void *)(h + 1); 3014 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3015 if (debug) 3016 addlog(" %s", sppp_ipcp_opt_name(*p)); 3017 switch (*p) { 3018 case IPCP_OPT_ADDRESS: 3019 /* 3020 * Peer doesn't grok address option. This is 3021 * bad. XXX Should we better give up here? 3022 */ 3023 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3024 break; 3025 #ifdef notyet 3026 case IPCP_OPT_COMPRESS: 3027 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3028 break; 3029 #endif 3030 } 3031 } 3032 if (debug) 3033 addlog("\n"); 3034 free(buf, M_TEMP); 3035 return; 3036 } 3037 3038 /* 3039 * Analyze the IPCP Configure-NAK option list, and adjust our 3040 * negotiation. 3041 */ 3042 static void 3043 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3044 { 3045 u_char *p; 3046 struct ifnet *ifp = &sp->pp_if; 3047 int debug = ifp->if_flags & IFF_DEBUG; 3048 u_int32_t wantaddr; 3049 3050 len -= 4; 3051 3052 if (debug) 3053 log(LOG_DEBUG, SPP_FMT "ipcp nak opts:", 3054 SPP_ARGS(ifp)); 3055 3056 p = (void *)(h + 1); 3057 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3058 if (debug) 3059 addlog(" %s", sppp_ipcp_opt_name(*p)); 3060 switch (*p) { 3061 case IPCP_OPT_ADDRESS: 3062 /* 3063 * Peer doesn't like our local IP address. See 3064 * if we can do something for him. We'll drop 3065 * him our address then. 3066 */ 3067 if (len >= 6 && p[1] == 6) { 3068 wantaddr = p[2] << 24 | p[3] << 16 | 3069 p[4] << 8 | p[5]; 3070 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3071 if (debug) 3072 addlog(" [wantaddr %s]", 3073 sppp_dotted_quad(wantaddr)); 3074 /* 3075 * When doing dynamic address assignment, 3076 * we accept his offer. Otherwise, we 3077 * ignore it and thus continue to negotiate 3078 * our already existing value. 3079 */ 3080 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3081 if (debug) 3082 addlog(" [agree]"); 3083 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3084 sp->ipcp.req_myaddr = wantaddr; 3085 } 3086 } 3087 break; 3088 3089 case IPCP_OPT_PRIMDNS: 3090 if (len >= 6 && p[1] == 6) { 3091 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3092 p[4] << 8 | p[5]; 3093 } 3094 break; 3095 3096 case IPCP_OPT_SECDNS: 3097 if (len >= 6 && p[1] == 6) { 3098 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3099 p[4] << 8 | p[5]; 3100 } 3101 break; 3102 #ifdef notyet 3103 case IPCP_OPT_COMPRESS: 3104 /* 3105 * Peer wants different compression parameters. 3106 */ 3107 break; 3108 #endif 3109 } 3110 } 3111 if (debug) 3112 addlog("\n"); 3113 return; 3114 } 3115 3116 static void 3117 sppp_ipcp_tlu(struct sppp *sp) 3118 { 3119 /* we are up. Set addresses and notify anyone interested */ 3120 STDDCL; 3121 u_int32_t myaddr, hisaddr; 3122 3123 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3124 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3125 myaddr = sp->ipcp.req_myaddr; 3126 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3127 hisaddr = sp->ipcp.req_hisaddr; 3128 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3129 3130 if (ifp->if_mtu > sp->lcp.their_mru) { 3131 sp->pp_saved_mtu = ifp->if_mtu; 3132 ifp->if_mtu = sp->lcp.their_mru; 3133 if (debug) 3134 log(LOG_DEBUG, 3135 SPP_FMT "setting MTU to %" PRIu64 " bytes\n", 3136 SPP_ARGS(ifp), ifp->if_mtu); 3137 } 3138 3139 if (sp->pp_con) 3140 sp->pp_con(sp); 3141 } 3142 3143 static void 3144 sppp_ipcp_tld(struct sppp *sp) 3145 { 3146 } 3147 3148 static void 3149 sppp_ipcp_tls(struct sppp *sp) 3150 { 3151 /* indicate to LCP that it must stay alive */ 3152 sp->lcp.protos |= (1 << IDX_IPCP); 3153 } 3154 3155 static void 3156 sppp_ipcp_tlf(struct sppp *sp) 3157 { 3158 /* we no longer need LCP */ 3159 sp->lcp.protos &= ~(1 << IDX_IPCP); 3160 } 3161 3162 static void 3163 sppp_ipcp_scr(struct sppp *sp) 3164 { 3165 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3166 u_int32_t ouraddr; 3167 int i = 0; 3168 3169 #ifdef notyet 3170 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3171 opt[i++] = IPCP_OPT_COMPRESSION; 3172 opt[i++] = 6; 3173 opt[i++] = 0; /* VJ header compression */ 3174 opt[i++] = 0x2d; /* VJ header compression */ 3175 opt[i++] = max_slot_id; 3176 opt[i++] = comp_slot_id; 3177 } 3178 #endif 3179 3180 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3181 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3182 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3183 else 3184 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3185 opt[i++] = IPCP_OPT_ADDRESS; 3186 opt[i++] = 6; 3187 opt[i++] = ouraddr >> 24; 3188 opt[i++] = ouraddr >> 16; 3189 opt[i++] = ouraddr >> 8; 3190 opt[i++] = ouraddr; 3191 } 3192 3193 if (sp->query_dns & 1) { 3194 opt[i++] = IPCP_OPT_PRIMDNS; 3195 opt[i++] = 6; 3196 opt[i++] = sp->dns_addrs[0] >> 24; 3197 opt[i++] = sp->dns_addrs[0] >> 16; 3198 opt[i++] = sp->dns_addrs[0] >> 8; 3199 opt[i++] = sp->dns_addrs[0]; 3200 } 3201 if (sp->query_dns & 2) { 3202 opt[i++] = IPCP_OPT_SECDNS; 3203 opt[i++] = 6; 3204 opt[i++] = sp->dns_addrs[1] >> 24; 3205 opt[i++] = sp->dns_addrs[1] >> 16; 3206 opt[i++] = sp->dns_addrs[1] >> 8; 3207 opt[i++] = sp->dns_addrs[1]; 3208 } 3209 3210 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3211 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3212 } 3213 3214 3215 /* 3216 *--------------------------------------------------------------------------* 3217 * * 3218 * The IPv6CP implementation. * 3219 * * 3220 *--------------------------------------------------------------------------* 3221 */ 3222 3223 #ifdef INET6 3224 static void 3225 sppp_ipv6cp_init(struct sppp *sp) 3226 { 3227 sp->ipv6cp.opts = 0; 3228 sp->ipv6cp.flags = 0; 3229 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3230 sp->fail_counter[IDX_IPV6CP] = 0; 3231 sp->pp_seq[IDX_IPV6CP] = 0; 3232 sp->pp_rseq[IDX_IPV6CP] = 0; 3233 callout_init(&sp->ch[IDX_IPV6CP]); 3234 } 3235 3236 static void 3237 sppp_ipv6cp_up(struct sppp *sp) 3238 { 3239 sppp_up_event(&ipv6cp, sp); 3240 } 3241 3242 static void 3243 sppp_ipv6cp_down(struct sppp *sp) 3244 { 3245 sppp_down_event(&ipv6cp, sp); 3246 } 3247 3248 static void 3249 sppp_ipv6cp_open(struct sppp *sp) 3250 { 3251 STDDCL; 3252 struct in6_addr myaddr, hisaddr; 3253 3254 #ifdef IPV6CP_MYIFID_DYN 3255 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3256 #else 3257 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3258 #endif 3259 3260 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3261 /* 3262 * If we don't have our address, this probably means our 3263 * interface doesn't want to talk IPv6 at all. (This could 3264 * be the case if somebody wants to speak only IPX, for 3265 * example.) Don't open IPv6CP in this case. 3266 */ 3267 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3268 /* XXX this message should go away */ 3269 if (debug) 3270 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3271 SPP_ARGS(ifp)); 3272 return; 3273 } 3274 3275 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3276 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3277 sppp_open_event(&ipv6cp, sp); 3278 } 3279 3280 static void 3281 sppp_ipv6cp_close(struct sppp *sp) 3282 { 3283 sppp_close_event(&ipv6cp, sp); 3284 } 3285 3286 static void 3287 sppp_ipv6cp_TO(void *cookie) 3288 { 3289 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3290 } 3291 3292 /* 3293 * Analyze a configure request. Return true if it was agreeable, and 3294 * caused action sca, false if it has been rejected or nak'ed, and 3295 * caused action scn. (The return value is used to make the state 3296 * transition decision in the state automaton.) 3297 */ 3298 static int 3299 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3300 { 3301 u_char *buf, *r, *p; 3302 struct ifnet *ifp = &sp->pp_if; 3303 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3304 struct in6_addr myaddr, desiredaddr, suggestaddr; 3305 int ifidcount; 3306 int type; 3307 int collision, nohisaddr; 3308 3309 len -= 4; 3310 origlen = len; 3311 /* 3312 * Make sure to allocate a buf that can at least hold a 3313 * conf-nak with an `address' option. We might need it below. 3314 */ 3315 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3316 if (! buf) 3317 return (0); 3318 3319 /* pass 1: see if we can recognize them */ 3320 if (debug) 3321 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:", 3322 SPP_ARGS(ifp)); 3323 p = (void *)(h + 1); 3324 ifidcount = 0; 3325 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3326 if (debug) 3327 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3328 switch (*p) { 3329 case IPV6CP_OPT_IFID: 3330 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3331 /* correctly formed address option */ 3332 ifidcount++; 3333 continue; 3334 } 3335 if (debug) 3336 addlog(" [invalid]"); 3337 break; 3338 #ifdef notyet 3339 case IPV6CP_OPT_COMPRESSION: 3340 if (len >= 4 && p[1] >= 4) { 3341 /* correctly formed compress option */ 3342 continue; 3343 } 3344 if (debug) 3345 addlog(" [invalid]"); 3346 break; 3347 #endif 3348 default: 3349 /* Others not supported. */ 3350 if (debug) 3351 addlog(" [rej]"); 3352 break; 3353 } 3354 /* Add the option to rejected list. */ 3355 bcopy (p, r, p[1]); 3356 r += p[1]; 3357 rlen += p[1]; 3358 } 3359 if (rlen) { 3360 if (debug) 3361 addlog(" send conf-rej\n"); 3362 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3363 goto end; 3364 } else if (debug) 3365 addlog("\n"); 3366 3367 /* pass 2: parse option values */ 3368 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3369 if (debug) 3370 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ", 3371 SPP_ARGS(ifp)); 3372 p = (void *)(h + 1); 3373 len = origlen; 3374 type = CONF_ACK; 3375 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3376 if (debug) 3377 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3378 switch (*p) { 3379 #ifdef notyet 3380 case IPV6CP_OPT_COMPRESSION: 3381 continue; 3382 #endif 3383 case IPV6CP_OPT_IFID: 3384 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3385 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3386 collision = (memcmp(&desiredaddr.s6_addr[8], 3387 &myaddr.s6_addr[8], 8) == 0); 3388 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3389 3390 desiredaddr.s6_addr16[0] = htons(0xfe80); 3391 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3392 3393 if (!collision && !nohisaddr) { 3394 /* no collision, hisaddr known - Conf-Ack */ 3395 type = CONF_ACK; 3396 3397 if (debug) { 3398 addlog(" %s [%s]", 3399 ip6_sprintf(&desiredaddr), 3400 sppp_cp_type_name(type)); 3401 } 3402 continue; 3403 } 3404 3405 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3406 if (collision && nohisaddr) { 3407 /* collision, hisaddr unknown - Conf-Rej */ 3408 type = CONF_REJ; 3409 memset(&p[2], 0, 8); 3410 } else { 3411 /* 3412 * - no collision, hisaddr unknown, or 3413 * - collision, hisaddr known 3414 * Conf-Nak, suggest hisaddr 3415 */ 3416 type = CONF_NAK; 3417 sppp_suggest_ip6_addr(sp, &suggestaddr); 3418 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3419 } 3420 if (debug) 3421 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3422 sppp_cp_type_name(type)); 3423 break; 3424 } 3425 /* Add the option to nak'ed list. */ 3426 bcopy (p, r, p[1]); 3427 r += p[1]; 3428 rlen += p[1]; 3429 } 3430 3431 if (rlen == 0 && type == CONF_ACK) { 3432 if (debug) 3433 addlog(" send %s\n", sppp_cp_type_name(type)); 3434 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3435 } else { 3436 #ifdef notdef 3437 if (type == CONF_ACK) 3438 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3439 #endif 3440 3441 if (debug) { 3442 addlog(" send %s suggest %s\n", 3443 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3444 } 3445 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3446 } 3447 3448 end: 3449 free(buf, M_TEMP); 3450 return (rlen == 0); 3451 } 3452 3453 /* 3454 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3455 * negotiation. 3456 */ 3457 static void 3458 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3459 { 3460 u_char *buf, *p; 3461 struct ifnet *ifp = &sp->pp_if; 3462 int debug = ifp->if_flags & IFF_DEBUG; 3463 3464 len -= 4; 3465 buf = malloc (len, M_TEMP, M_NOWAIT); 3466 if (!buf) 3467 return; 3468 3469 if (debug) 3470 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:", 3471 SPP_ARGS(ifp)); 3472 3473 p = (void *)(h + 1); 3474 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3475 if (debug) 3476 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3477 switch (*p) { 3478 case IPV6CP_OPT_IFID: 3479 /* 3480 * Peer doesn't grok address option. This is 3481 * bad. XXX Should we better give up here? 3482 */ 3483 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3484 break; 3485 #ifdef notyet 3486 case IPV6CP_OPT_COMPRESS: 3487 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3488 break; 3489 #endif 3490 } 3491 } 3492 if (debug) 3493 addlog("\n"); 3494 free(buf, M_TEMP); 3495 return; 3496 } 3497 3498 /* 3499 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3500 * negotiation. 3501 */ 3502 static void 3503 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3504 { 3505 u_char *buf, *p; 3506 struct ifnet *ifp = &sp->pp_if; 3507 int debug = ifp->if_flags & IFF_DEBUG; 3508 struct in6_addr suggestaddr; 3509 3510 len -= 4; 3511 buf = malloc (len, M_TEMP, M_NOWAIT); 3512 if (!buf) 3513 return; 3514 3515 if (debug) 3516 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:", 3517 SPP_ARGS(ifp)); 3518 3519 p = (void *)(h + 1); 3520 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3521 if (debug) 3522 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3523 switch (*p) { 3524 case IPV6CP_OPT_IFID: 3525 /* 3526 * Peer doesn't like our local ifid. See 3527 * if we can do something for him. We'll drop 3528 * him our address then. 3529 */ 3530 if (len < 10 || p[1] != 10) 3531 break; 3532 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3533 suggestaddr.s6_addr16[0] = htons(0xfe80); 3534 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3535 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3536 3537 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3538 if (debug) 3539 addlog(" [suggestaddr %s]", 3540 ip6_sprintf(&suggestaddr)); 3541 #ifdef IPV6CP_MYIFID_DYN 3542 /* 3543 * When doing dynamic address assignment, 3544 * we accept his offer. 3545 */ 3546 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3547 struct in6_addr lastsuggest; 3548 /* 3549 * If <suggested myaddr from peer> equals to 3550 * <hisaddr we have suggested last time>, 3551 * we have a collision. generate new random 3552 * ifid. 3553 */ 3554 sppp_suggest_ip6_addr(&lastsuggest); 3555 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3556 lastsuggest)) { 3557 if (debug) 3558 addlog(" [random]"); 3559 sppp_gen_ip6_addr(sp, &suggestaddr); 3560 } 3561 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3562 if (debug) 3563 addlog(" [agree]"); 3564 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3565 } 3566 #else 3567 /* 3568 * Since we do not do dynamic address assignment, 3569 * we ignore it and thus continue to negotiate 3570 * our already existing value. This can possibly 3571 * go into infinite request-reject loop. 3572 * 3573 * This is not likely because we normally use 3574 * ifid based on MAC-address. 3575 * If you have no ethernet card on the node, too bad. 3576 * XXX should we use fail_counter? 3577 */ 3578 #endif 3579 break; 3580 #ifdef notyet 3581 case IPV6CP_OPT_COMPRESS: 3582 /* 3583 * Peer wants different compression parameters. 3584 */ 3585 break; 3586 #endif 3587 } 3588 } 3589 if (debug) 3590 addlog("\n"); 3591 free(buf, M_TEMP); 3592 return; 3593 } 3594 3595 static void 3596 sppp_ipv6cp_tlu(struct sppp *sp) 3597 { 3598 /* we are up - notify isdn daemon */ 3599 if (sp->pp_con) 3600 sp->pp_con(sp); 3601 } 3602 3603 static void 3604 sppp_ipv6cp_tld(struct sppp *sp) 3605 { 3606 } 3607 3608 static void 3609 sppp_ipv6cp_tls(struct sppp *sp) 3610 { 3611 /* indicate to LCP that it must stay alive */ 3612 sp->lcp.protos |= (1 << IDX_IPV6CP); 3613 } 3614 3615 static void 3616 sppp_ipv6cp_tlf(struct sppp *sp) 3617 { 3618 /* we no longer need LCP */ 3619 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3620 } 3621 3622 static void 3623 sppp_ipv6cp_scr(struct sppp *sp) 3624 { 3625 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3626 struct in6_addr ouraddr; 3627 int i = 0; 3628 3629 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3630 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3631 opt[i++] = IPV6CP_OPT_IFID; 3632 opt[i++] = 10; 3633 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3634 i += 8; 3635 } 3636 3637 #ifdef notyet 3638 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3639 opt[i++] = IPV6CP_OPT_COMPRESSION; 3640 opt[i++] = 4; 3641 opt[i++] = 0; /* TBD */ 3642 opt[i++] = 0; /* TBD */ 3643 /* variable length data may follow */ 3644 } 3645 #endif 3646 3647 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3648 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3649 } 3650 #else /*INET6*/ 3651 static void sppp_ipv6cp_init(struct sppp *sp) 3652 { 3653 } 3654 3655 static void sppp_ipv6cp_up(struct sppp *sp) 3656 { 3657 } 3658 3659 static void sppp_ipv6cp_down(struct sppp *sp) 3660 { 3661 } 3662 3663 3664 static void sppp_ipv6cp_open(struct sppp *sp) 3665 { 3666 } 3667 3668 static void sppp_ipv6cp_close(struct sppp *sp) 3669 { 3670 } 3671 3672 static void sppp_ipv6cp_TO(void *sp) 3673 { 3674 } 3675 3676 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3677 { 3678 return 0; 3679 } 3680 3681 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3682 { 3683 } 3684 3685 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3686 { 3687 } 3688 3689 static void sppp_ipv6cp_tlu(struct sppp *sp) 3690 { 3691 } 3692 3693 static void sppp_ipv6cp_tld(struct sppp *sp) 3694 { 3695 } 3696 3697 static void sppp_ipv6cp_tls(struct sppp *sp) 3698 { 3699 } 3700 3701 static void sppp_ipv6cp_tlf(struct sppp *sp) 3702 { 3703 } 3704 3705 static void sppp_ipv6cp_scr(struct sppp *sp) 3706 { 3707 } 3708 #endif /*INET6*/ 3709 3710 3711 /* 3712 *--------------------------------------------------------------------------* 3713 * * 3714 * The CHAP implementation. * 3715 * * 3716 *--------------------------------------------------------------------------* 3717 */ 3718 3719 /* 3720 * The authentication protocols don't employ a full-fledged state machine as 3721 * the control protocols do, since they do have Open and Close events, but 3722 * not Up and Down, nor are they explicitly terminated. Also, use of the 3723 * authentication protocols may be different in both directions (this makes 3724 * sense, think of a machine that never accepts incoming calls but only 3725 * calls out, it doesn't require the called party to authenticate itself). 3726 * 3727 * Our state machine for the local authentication protocol (we are requesting 3728 * the peer to authenticate) looks like: 3729 * 3730 * RCA- 3731 * +--------------------------------------------+ 3732 * V scn,tld| 3733 * +--------+ Close +---------+ RCA+ 3734 * | |<----------------------------------| |------+ 3735 * +--->| Closed | TO* | Opened | sca | 3736 * | | |-----+ +-------| |<-----+ 3737 * | +--------+ irc | | +---------+ 3738 * | ^ | | ^ 3739 * | | | | | 3740 * | | | | | 3741 * | TO-| | | | 3742 * | |tld TO+ V | | 3743 * | | +------->+ | | 3744 * | | | | | | 3745 * | +--------+ V | | 3746 * | | |<----+<--------------------+ | 3747 * | | Req- | scr | 3748 * | | Sent | | 3749 * | | | | 3750 * | +--------+ | 3751 * | RCA- | | RCA+ | 3752 * +------+ +------------------------------------------+ 3753 * scn,tld sca,irc,ict,tlu 3754 * 3755 * 3756 * with: 3757 * 3758 * Open: LCP reached authentication phase 3759 * Close: LCP reached terminate phase 3760 * 3761 * RCA+: received reply (pap-req, chap-response), acceptable 3762 * RCN: received reply (pap-req, chap-response), not acceptable 3763 * TO+: timeout with restart counter >= 0 3764 * TO-: timeout with restart counter < 0 3765 * TO*: reschedule timeout for CHAP 3766 * 3767 * scr: send request packet (none for PAP, chap-challenge) 3768 * sca: send ack packet (pap-ack, chap-success) 3769 * scn: send nak packet (pap-nak, chap-failure) 3770 * ict: initialize re-challenge timer (CHAP only) 3771 * 3772 * tlu: this-layer-up, LCP reaches network phase 3773 * tld: this-layer-down, LCP enters terminate phase 3774 * 3775 * Note that in CHAP mode, after sending a new challenge, while the state 3776 * automaton falls back into Req-Sent state, it doesn't signal a tld 3777 * event to LCP, so LCP remains in network phase. Only after not getting 3778 * any response (or after getting an unacceptable response), CHAP closes, 3779 * causing LCP to enter terminate phase. 3780 * 3781 * With PAP, there is no initial request that can be sent. The peer is 3782 * expected to send one based on the successful negotiation of PAP as 3783 * the authentication protocol during the LCP option negotiation. 3784 * 3785 * Incoming authentication protocol requests (remote requests 3786 * authentication, we are peer) don't employ a state machine at all, 3787 * they are simply answered. Some peers [Ascend P50 firmware rev 3788 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3789 * still in authentication phase (thereby violating the standard that 3790 * demands that these NCP packets are to be discarded), so we keep 3791 * track of the peer demanding us to authenticate, and only proceed to 3792 * phase network once we've seen a positive acknowledge for the 3793 * authentication. 3794 */ 3795 3796 /* 3797 * Handle incoming CHAP packets. 3798 */ 3799 void 3800 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3801 { 3802 STDDCL; 3803 struct lcp_header *h; 3804 int len, x; 3805 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3806 int value_len, name_len; 3807 MD5_CTX ctx; 3808 3809 len = m->m_pkthdr.len; 3810 if (len < 4) { 3811 if (debug) 3812 log(LOG_DEBUG, 3813 SPP_FMT "chap invalid packet length: %d bytes\n", 3814 SPP_ARGS(ifp), len); 3815 return; 3816 } 3817 h = mtod(m, struct lcp_header *); 3818 if (len > ntohs(h->len)) 3819 len = ntohs(h->len); 3820 3821 switch (h->type) { 3822 /* challenge, failure and success are his authproto */ 3823 case CHAP_CHALLENGE: 3824 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3825 /* can't do anything usefull */ 3826 sp->pp_auth_failures++; 3827 printf(SPP_FMT "chap input without my name and my secret being set\n", 3828 SPP_ARGS(ifp)); 3829 break; 3830 } 3831 value = 1 + (u_char *)(h + 1); 3832 value_len = value[-1]; 3833 name = value + value_len; 3834 name_len = len - value_len - 5; 3835 if (name_len < 0) { 3836 if (debug) { 3837 log(LOG_DEBUG, 3838 SPP_FMT "chap corrupted challenge " 3839 "<%s id=0x%x len=%d", 3840 SPP_ARGS(ifp), 3841 sppp_auth_type_name(PPP_CHAP, h->type), 3842 h->ident, ntohs(h->len)); 3843 if (len > 4) 3844 sppp_print_bytes((u_char *)(h + 1), 3845 len - 4); 3846 addlog(">\n"); 3847 } 3848 break; 3849 } 3850 3851 if (debug) { 3852 log(LOG_DEBUG, 3853 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3854 SPP_ARGS(ifp), 3855 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3856 ntohs(h->len)); 3857 sppp_print_string((char *) name, name_len); 3858 addlog(" value-size=%d value=", value_len); 3859 sppp_print_bytes(value, value_len); 3860 addlog(">\n"); 3861 } 3862 3863 /* Compute reply value. */ 3864 MD5Init(&ctx); 3865 MD5Update(&ctx, &h->ident, 1); 3866 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3867 MD5Update(&ctx, value, value_len); 3868 MD5Final(digest, &ctx); 3869 dsize = sizeof digest; 3870 3871 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3872 sizeof dsize, (const char *)&dsize, 3873 sizeof digest, digest, 3874 sp->myauth.name_len, 3875 sp->myauth.name, 3876 0); 3877 break; 3878 3879 case CHAP_SUCCESS: 3880 if (debug) { 3881 log(LOG_DEBUG, SPP_FMT "chap success", 3882 SPP_ARGS(ifp)); 3883 if (len > 4) { 3884 addlog(": "); 3885 sppp_print_string((char *)(h + 1), len - 4); 3886 } 3887 addlog("\n"); 3888 } 3889 x = splnet(); 3890 sp->pp_auth_failures = 0; 3891 sp->pp_flags &= ~PP_NEEDAUTH; 3892 if (sp->myauth.proto == PPP_CHAP && 3893 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3894 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3895 /* 3896 * We are authenticator for CHAP but didn't 3897 * complete yet. Leave it to tlu to proceed 3898 * to network phase. 3899 */ 3900 splx(x); 3901 break; 3902 } 3903 splx(x); 3904 sppp_phase_network(sp); 3905 break; 3906 3907 case CHAP_FAILURE: 3908 x = splnet(); 3909 sp->pp_auth_failures++; 3910 splx(x); 3911 if (debug) { 3912 log(LOG_INFO, SPP_FMT "chap failure", 3913 SPP_ARGS(ifp)); 3914 if (len > 4) { 3915 addlog(": "); 3916 sppp_print_string((char *)(h + 1), len - 4); 3917 } 3918 addlog("\n"); 3919 } else 3920 log(LOG_INFO, SPP_FMT "chap failure\n", 3921 SPP_ARGS(ifp)); 3922 /* await LCP shutdown by authenticator */ 3923 break; 3924 3925 /* response is my authproto */ 3926 case CHAP_RESPONSE: 3927 if (sp->hisauth.secret == NULL) { 3928 /* can't do anything usefull */ 3929 printf(SPP_FMT "chap input without his secret being set\n", 3930 SPP_ARGS(ifp)); 3931 break; 3932 } 3933 value = 1 + (u_char *)(h + 1); 3934 value_len = value[-1]; 3935 name = value + value_len; 3936 name_len = len - value_len - 5; 3937 if (name_len < 0) { 3938 if (debug) { 3939 log(LOG_DEBUG, 3940 SPP_FMT "chap corrupted response " 3941 "<%s id=0x%x len=%d", 3942 SPP_ARGS(ifp), 3943 sppp_auth_type_name(PPP_CHAP, h->type), 3944 h->ident, ntohs(h->len)); 3945 if (len > 4) 3946 sppp_print_bytes((u_char *)(h + 1), 3947 len - 4); 3948 addlog(">\n"); 3949 } 3950 break; 3951 } 3952 if (h->ident != sp->confid[IDX_CHAP]) { 3953 if (debug) 3954 log(LOG_DEBUG, 3955 SPP_FMT "chap dropping response for old ID " 3956 "(got %d, expected %d)\n", 3957 SPP_ARGS(ifp), 3958 h->ident, sp->confid[IDX_CHAP]); 3959 break; 3960 } 3961 if (sp->hisauth.name != NULL && 3962 (name_len != sp->hisauth.name_len 3963 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 3964 log(LOG_INFO, SPP_FMT "chap response, his name ", 3965 SPP_ARGS(ifp)); 3966 sppp_print_string(name, name_len); 3967 addlog(" != expected "); 3968 sppp_print_string(sp->hisauth.name, 3969 sp->hisauth.name_len); 3970 addlog("\n"); 3971 goto chap_failure; 3972 } 3973 if (debug) { 3974 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 3975 "<%s id=0x%x len=%d name=", 3976 SPP_ARGS(ifp), 3977 sppp_state_name(sp->state[IDX_CHAP]), 3978 sppp_auth_type_name(PPP_CHAP, h->type), 3979 h->ident, ntohs(h->len)); 3980 sppp_print_string((char *)name, name_len); 3981 addlog(" value-size=%d value=", value_len); 3982 sppp_print_bytes(value, value_len); 3983 addlog(">\n"); 3984 } 3985 if (value_len != sizeof(sp->myauth.challenge)) { 3986 if (debug) 3987 log(LOG_DEBUG, 3988 SPP_FMT "chap bad hash value length: " 3989 "%d bytes, should be %ld\n", 3990 SPP_ARGS(ifp), value_len, 3991 (long) sizeof(sp->myauth.challenge)); 3992 goto chap_failure; 3993 } 3994 3995 MD5Init(&ctx); 3996 MD5Update(&ctx, &h->ident, 1); 3997 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 3998 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 3999 MD5Final(digest, &ctx); 4000 4001 #define FAILMSG "Failed..." 4002 #define SUCCMSG "Welcome!" 4003 4004 if (value_len != sizeof digest || 4005 memcmp(digest, value, value_len) != 0) { 4006 chap_failure: 4007 /* action scn, tld */ 4008 x = splnet(); 4009 sp->pp_auth_failures++; 4010 splx(x); 4011 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4012 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4013 0); 4014 chap.tld(sp); 4015 break; 4016 } 4017 sp->pp_auth_failures = 0; 4018 /* action sca, perhaps tlu */ 4019 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4020 sp->state[IDX_CHAP] == STATE_OPENED) 4021 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4022 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4023 0); 4024 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4025 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4026 chap.tlu(sp); 4027 } 4028 break; 4029 4030 default: 4031 /* Unknown CHAP packet type -- ignore. */ 4032 if (debug) { 4033 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 4034 "<0x%x id=0x%xh len=%d", 4035 SPP_ARGS(ifp), 4036 sppp_state_name(sp->state[IDX_CHAP]), 4037 h->type, h->ident, ntohs(h->len)); 4038 if (len > 4) 4039 sppp_print_bytes((u_char *)(h + 1), len - 4); 4040 addlog(">\n"); 4041 } 4042 break; 4043 4044 } 4045 } 4046 4047 static void 4048 sppp_chap_init(struct sppp *sp) 4049 { 4050 /* Chap doesn't have STATE_INITIAL at all. */ 4051 sp->state[IDX_CHAP] = STATE_CLOSED; 4052 sp->fail_counter[IDX_CHAP] = 0; 4053 sp->pp_seq[IDX_CHAP] = 0; 4054 sp->pp_rseq[IDX_CHAP] = 0; 4055 callout_init(&sp->ch[IDX_CHAP]); 4056 } 4057 4058 static void 4059 sppp_chap_open(struct sppp *sp) 4060 { 4061 if (sp->myauth.proto == PPP_CHAP && 4062 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4063 /* we are authenticator for CHAP, start it */ 4064 chap.scr(sp); 4065 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4066 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4067 } 4068 /* nothing to be done if we are peer, await a challenge */ 4069 } 4070 4071 static void 4072 sppp_chap_close(struct sppp *sp) 4073 { 4074 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4075 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4076 } 4077 4078 static void 4079 sppp_chap_TO(void *cookie) 4080 { 4081 struct sppp *sp = (struct sppp *)cookie; 4082 STDDCL; 4083 int s; 4084 4085 s = splnet(); 4086 if (debug) 4087 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 4088 SPP_ARGS(ifp), 4089 sppp_state_name(sp->state[IDX_CHAP]), 4090 sp->rst_counter[IDX_CHAP]); 4091 4092 if (--sp->rst_counter[IDX_CHAP] < 0) 4093 /* TO- event */ 4094 switch (sp->state[IDX_CHAP]) { 4095 case STATE_REQ_SENT: 4096 chap.tld(sp); 4097 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4098 break; 4099 } 4100 else 4101 /* TO+ (or TO*) event */ 4102 switch (sp->state[IDX_CHAP]) { 4103 case STATE_OPENED: 4104 /* TO* event */ 4105 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4106 /* fall through */ 4107 case STATE_REQ_SENT: 4108 chap.scr(sp); 4109 /* sppp_cp_change_state() will restart the timer */ 4110 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4111 break; 4112 } 4113 4114 splx(s); 4115 } 4116 4117 static void 4118 sppp_chap_tlu(struct sppp *sp) 4119 { 4120 STDDCL; 4121 int i, x; 4122 4123 i = 0; 4124 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4125 4126 /* 4127 * Some broken CHAP implementations (Conware CoNet, firmware 4128 * 4.0.?) don't want to re-authenticate their CHAP once the 4129 * initial challenge-response exchange has taken place. 4130 * Provide for an option to avoid rechallenges. 4131 */ 4132 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4133 /* 4134 * Compute the re-challenge timeout. This will yield 4135 * a number between 300 and 810 seconds. 4136 */ 4137 i = 300 + ((unsigned)(random() & 0xff00) >> 7); 4138 4139 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4140 } 4141 4142 if (debug) { 4143 log(LOG_DEBUG, 4144 SPP_FMT "chap %s, ", 4145 SPP_ARGS(ifp), 4146 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4147 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4148 addlog("next re-challenge in %d seconds\n", i); 4149 else 4150 addlog("re-challenging supressed\n"); 4151 } 4152 4153 x = splnet(); 4154 sp->pp_auth_failures = 0; 4155 /* indicate to LCP that we need to be closed down */ 4156 sp->lcp.protos |= (1 << IDX_CHAP); 4157 4158 if (sp->pp_flags & PP_NEEDAUTH) { 4159 /* 4160 * Remote is authenticator, but his auth proto didn't 4161 * complete yet. Defer the transition to network 4162 * phase. 4163 */ 4164 splx(x); 4165 return; 4166 } 4167 splx(x); 4168 4169 /* 4170 * If we are already in phase network, we are done here. This 4171 * is the case if this is a dummy tlu event after a re-challenge. 4172 */ 4173 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4174 sppp_phase_network(sp); 4175 } 4176 4177 static void 4178 sppp_chap_tld(struct sppp *sp) 4179 { 4180 STDDCL; 4181 4182 if (debug) 4183 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4184 callout_stop(&sp->ch[IDX_CHAP]); 4185 sp->lcp.protos &= ~(1 << IDX_CHAP); 4186 4187 lcp.Close(sp); 4188 } 4189 4190 static void 4191 sppp_chap_scr(struct sppp *sp) 4192 { 4193 struct timeval tv; 4194 u_int32_t *ch, seed; 4195 u_char clen; 4196 4197 if (sp->myauth.name == NULL) { 4198 /* can't do anything usefull */ 4199 printf(SPP_FMT "chap starting without my name being set\n", 4200 SPP_ARGS(&sp->pp_if)); 4201 return; 4202 } 4203 4204 /* Compute random challenge. */ 4205 ch = (u_int32_t *)sp->myauth.challenge; 4206 microtime(&tv); 4207 seed = tv.tv_sec ^ tv.tv_usec; 4208 ch[0] = seed ^ random(); 4209 ch[1] = seed ^ random(); 4210 ch[2] = seed ^ random(); 4211 ch[3] = seed ^ random(); 4212 clen = 16; /* 4 * sizeof(u_int32_t) */ 4213 4214 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4215 4216 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4217 sizeof clen, (const char *)&clen, 4218 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4219 sp->myauth.name_len, 4220 sp->myauth.name, 4221 0); 4222 } 4223 4224 /* 4225 *--------------------------------------------------------------------------* 4226 * * 4227 * The PAP implementation. * 4228 * * 4229 *--------------------------------------------------------------------------* 4230 */ 4231 /* 4232 * For PAP, we need to keep a little state also if we are the peer, not the 4233 * authenticator. This is since we don't get a request to authenticate, but 4234 * have to repeatedly authenticate ourself until we got a response (or the 4235 * retry counter is expired). 4236 */ 4237 4238 /* 4239 * Handle incoming PAP packets. */ 4240 static void 4241 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4242 { 4243 STDDCL; 4244 struct lcp_header *h; 4245 int len, x; 4246 u_char mlen; 4247 char *name, *secret; 4248 int name_len, secret_len; 4249 4250 len = m->m_pkthdr.len; 4251 if (len < 5) { 4252 if (debug) 4253 log(LOG_DEBUG, 4254 SPP_FMT "pap invalid packet length: %d bytes\n", 4255 SPP_ARGS(ifp), len); 4256 return; 4257 } 4258 h = mtod(m, struct lcp_header *); 4259 if (len > ntohs(h->len)) 4260 len = ntohs(h->len); 4261 switch (h->type) { 4262 /* PAP request is my authproto */ 4263 case PAP_REQ: 4264 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4265 /* can't do anything usefull */ 4266 printf(SPP_FMT "pap request without his name and his secret being set\n", 4267 SPP_ARGS(ifp)); 4268 break; 4269 } 4270 name = 1 + (u_char *)(h + 1); 4271 name_len = name[-1]; 4272 secret = name + name_len + 1; 4273 if (name_len > len - 6 || 4274 (secret_len = secret[-1]) > len - 6 - name_len) { 4275 if (debug) { 4276 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4277 "<%s id=0x%x len=%d", 4278 SPP_ARGS(ifp), 4279 sppp_auth_type_name(PPP_PAP, h->type), 4280 h->ident, ntohs(h->len)); 4281 if (len > 4) 4282 sppp_print_bytes((u_char *)(h + 1), 4283 len - 4); 4284 addlog(">\n"); 4285 } 4286 break; 4287 } 4288 if (debug) { 4289 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4290 "<%s id=0x%x len=%d name=", 4291 SPP_ARGS(ifp), 4292 sppp_state_name(sp->state[IDX_PAP]), 4293 sppp_auth_type_name(PPP_PAP, h->type), 4294 h->ident, ntohs(h->len)); 4295 sppp_print_string((char *)name, name_len); 4296 addlog(" secret="); 4297 sppp_print_string((char *)secret, secret_len); 4298 addlog(">\n"); 4299 } 4300 if (name_len != sp->hisauth.name_len || 4301 secret_len != sp->hisauth.secret_len || 4302 memcmp(name, sp->hisauth.name, name_len) != 0 || 4303 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4304 /* action scn, tld */ 4305 sp->pp_auth_failures++; 4306 mlen = sizeof(FAILMSG) - 1; 4307 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4308 sizeof mlen, (const char *)&mlen, 4309 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4310 0); 4311 pap.tld(sp); 4312 break; 4313 } 4314 /* action sca, perhaps tlu */ 4315 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4316 sp->state[IDX_PAP] == STATE_OPENED) { 4317 mlen = sizeof(SUCCMSG) - 1; 4318 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4319 sizeof mlen, (const char *)&mlen, 4320 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4321 0); 4322 } 4323 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4324 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4325 pap.tlu(sp); 4326 } 4327 break; 4328 4329 /* ack and nak are his authproto */ 4330 case PAP_ACK: 4331 callout_stop(&sp->pap_my_to_ch); 4332 if (debug) { 4333 log(LOG_DEBUG, SPP_FMT "pap success", 4334 SPP_ARGS(ifp)); 4335 name_len = *(char *)h; 4336 if (len > 5 && name_len) { 4337 addlog(": "); 4338 sppp_print_string((char *)(h + 1), name_len); 4339 } 4340 addlog("\n"); 4341 } 4342 x = splnet(); 4343 sp->pp_auth_failures = 0; 4344 sp->pp_flags &= ~PP_NEEDAUTH; 4345 if (sp->myauth.proto == PPP_PAP && 4346 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4347 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4348 /* 4349 * We are authenticator for PAP but didn't 4350 * complete yet. Leave it to tlu to proceed 4351 * to network phase. 4352 */ 4353 splx(x); 4354 break; 4355 } 4356 splx(x); 4357 sppp_phase_network(sp); 4358 break; 4359 4360 case PAP_NAK: 4361 callout_stop(&sp->pap_my_to_ch); 4362 sp->pp_auth_failures++; 4363 if (debug) { 4364 log(LOG_INFO, SPP_FMT "pap failure", 4365 SPP_ARGS(ifp)); 4366 name_len = *(char *)h; 4367 if (len > 5 && name_len) { 4368 addlog(": "); 4369 sppp_print_string((char *)(h + 1), name_len); 4370 } 4371 addlog("\n"); 4372 } else 4373 log(LOG_INFO, SPP_FMT "pap failure\n", 4374 SPP_ARGS(ifp)); 4375 /* await LCP shutdown by authenticator */ 4376 break; 4377 4378 default: 4379 /* Unknown PAP packet type -- ignore. */ 4380 if (debug) { 4381 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4382 "<0x%x id=0x%x len=%d", 4383 SPP_ARGS(ifp), 4384 h->type, h->ident, ntohs(h->len)); 4385 if (len > 4) 4386 sppp_print_bytes((u_char *)(h + 1), len - 4); 4387 addlog(">\n"); 4388 } 4389 break; 4390 4391 } 4392 } 4393 4394 static void 4395 sppp_pap_init(struct sppp *sp) 4396 { 4397 /* PAP doesn't have STATE_INITIAL at all. */ 4398 sp->state[IDX_PAP] = STATE_CLOSED; 4399 sp->fail_counter[IDX_PAP] = 0; 4400 sp->pp_seq[IDX_PAP] = 0; 4401 sp->pp_rseq[IDX_PAP] = 0; 4402 callout_init(&sp->ch[IDX_PAP]); 4403 callout_init(&sp->pap_my_to_ch); 4404 } 4405 4406 static void 4407 sppp_pap_open(struct sppp *sp) 4408 { 4409 if (sp->hisauth.proto == PPP_PAP && 4410 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4411 /* we are authenticator for PAP, start our timer */ 4412 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4413 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4414 } 4415 if (sp->myauth.proto == PPP_PAP) { 4416 /* we are peer, send a request, and start a timer */ 4417 pap.scr(sp); 4418 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4419 sppp_pap_my_TO, sp); 4420 } 4421 } 4422 4423 static void 4424 sppp_pap_close(struct sppp *sp) 4425 { 4426 if (sp->state[IDX_PAP] != STATE_CLOSED) 4427 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4428 } 4429 4430 /* 4431 * That's the timeout routine if we are authenticator. Since the 4432 * authenticator is basically passive in PAP, we can't do much here. 4433 */ 4434 static void 4435 sppp_pap_TO(void *cookie) 4436 { 4437 struct sppp *sp = (struct sppp *)cookie; 4438 STDDCL; 4439 int s; 4440 4441 s = splnet(); 4442 if (debug) 4443 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4444 SPP_ARGS(ifp), 4445 sppp_state_name(sp->state[IDX_PAP]), 4446 sp->rst_counter[IDX_PAP]); 4447 4448 if (--sp->rst_counter[IDX_PAP] < 0) 4449 /* TO- event */ 4450 switch (sp->state[IDX_PAP]) { 4451 case STATE_REQ_SENT: 4452 pap.tld(sp); 4453 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4454 break; 4455 } 4456 else 4457 /* TO+ event, not very much we could do */ 4458 switch (sp->state[IDX_PAP]) { 4459 case STATE_REQ_SENT: 4460 /* sppp_cp_change_state() will restart the timer */ 4461 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4462 break; 4463 } 4464 4465 splx(s); 4466 } 4467 4468 /* 4469 * That's the timeout handler if we are peer. Since the peer is active, 4470 * we need to retransmit our PAP request since it is apparently lost. 4471 * XXX We should impose a max counter. 4472 */ 4473 static void 4474 sppp_pap_my_TO(void *cookie) 4475 { 4476 struct sppp *sp = (struct sppp *)cookie; 4477 STDDCL; 4478 4479 if (debug) 4480 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4481 SPP_ARGS(ifp)); 4482 4483 pap.scr(sp); 4484 } 4485 4486 static void 4487 sppp_pap_tlu(struct sppp *sp) 4488 { 4489 STDDCL; 4490 int x; 4491 4492 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4493 4494 if (debug) 4495 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4496 SPP_ARGS(ifp), pap.name); 4497 4498 x = splnet(); 4499 sp->pp_auth_failures = 0; 4500 /* indicate to LCP that we need to be closed down */ 4501 sp->lcp.protos |= (1 << IDX_PAP); 4502 4503 if (sp->pp_flags & PP_NEEDAUTH) { 4504 /* 4505 * Remote is authenticator, but his auth proto didn't 4506 * complete yet. Defer the transition to network 4507 * phase. 4508 */ 4509 splx(x); 4510 return; 4511 } 4512 splx(x); 4513 sppp_phase_network(sp); 4514 } 4515 4516 static void 4517 sppp_pap_tld(struct sppp *sp) 4518 { 4519 STDDCL; 4520 4521 if (debug) 4522 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4523 callout_stop(&sp->ch[IDX_PAP]); 4524 callout_stop(&sp->pap_my_to_ch); 4525 sp->lcp.protos &= ~(1 << IDX_PAP); 4526 4527 lcp.Close(sp); 4528 } 4529 4530 static void 4531 sppp_pap_scr(struct sppp *sp) 4532 { 4533 u_char idlen, pwdlen; 4534 4535 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4536 /* can't do anything usefull */ 4537 printf(SPP_FMT "pap starting without my name and secret being set\n", 4538 SPP_ARGS(&sp->pp_if)); 4539 return; 4540 } 4541 4542 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4543 pwdlen = sp->myauth.secret_len; 4544 idlen = sp->myauth.name_len; 4545 4546 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4547 sizeof idlen, (const char *)&idlen, 4548 idlen, sp->myauth.name, 4549 sizeof pwdlen, (const char *)&pwdlen, 4550 pwdlen, sp->myauth.secret, 4551 0); 4552 } 4553 4554 /* 4555 * Random miscellaneous functions. 4556 */ 4557 4558 /* 4559 * Send a PAP or CHAP proto packet. 4560 * 4561 * Varadic function, each of the elements for the ellipsis is of type 4562 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4563 * mlen == 0. 4564 * NOTE: never declare variadic functions with types subject to type 4565 * promotion (i.e. u_char). This is asking for big trouble depending 4566 * on the architecture you are on... 4567 */ 4568 4569 static void 4570 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4571 unsigned int type, unsigned int id, 4572 ...) 4573 { 4574 STDDCL; 4575 struct lcp_header *lh; 4576 struct mbuf *m; 4577 u_char *p; 4578 int len; 4579 size_t pkthdrlen; 4580 unsigned int mlen; 4581 const char *msg; 4582 va_list ap; 4583 4584 MGETHDR(m, M_DONTWAIT, MT_DATA); 4585 if (! m) 4586 return; 4587 m->m_pkthdr.rcvif = 0; 4588 4589 if (sp->pp_flags & PP_NOFRAMING) { 4590 *mtod(m, u_int16_t *) = htons(cp->proto); 4591 pkthdrlen = 2; 4592 lh = (struct lcp_header *)(mtod(m, u_int8_t *)+2); 4593 } else { 4594 struct ppp_header *h; 4595 h = mtod(m, struct ppp_header *); 4596 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4597 h->control = PPP_UI; /* Unnumbered Info */ 4598 h->protocol = htons(cp->proto); 4599 pkthdrlen = PPP_HEADER_LEN; 4600 4601 lh = (struct lcp_header *)(h + 1); 4602 } 4603 4604 lh->type = type; 4605 lh->ident = id; 4606 p = (u_char *)(lh + 1); 4607 4608 va_start(ap, id); 4609 len = 0; 4610 4611 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4612 msg = va_arg(ap, const char *); 4613 len += mlen; 4614 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4615 va_end(ap); 4616 m_freem(m); 4617 return; 4618 } 4619 4620 bcopy(msg, p, mlen); 4621 p += mlen; 4622 } 4623 va_end(ap); 4624 4625 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4626 lh->len = htons(LCP_HEADER_LEN + len); 4627 4628 if (debug) { 4629 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4630 SPP_ARGS(ifp), cp->name, 4631 sppp_auth_type_name(cp->proto, lh->type), 4632 lh->ident, ntohs(lh->len)); 4633 if (len) 4634 sppp_print_bytes((u_char *)(lh + 1), len); 4635 addlog(">\n"); 4636 } 4637 if (IF_QFULL(&sp->pp_cpq)) { 4638 IF_DROP(&sp->pp_fastq); 4639 IF_DROP(&ifp->if_snd); 4640 m_freem(m); 4641 ++ifp->if_oerrors; 4642 return; 4643 } else 4644 IF_ENQUEUE(&sp->pp_cpq, m); 4645 if (! (ifp->if_flags & IFF_OACTIVE)) 4646 (*ifp->if_start)(ifp); 4647 ifp->if_obytes += m->m_pkthdr.len + 3; 4648 } 4649 4650 /* 4651 * Send keepalive packets, every 10 seconds. 4652 */ 4653 static void 4654 sppp_keepalive(void *dummy) 4655 { 4656 struct sppp *sp; 4657 int s; 4658 time_t now; 4659 4660 s = splnet(); 4661 now = mono_time.tv_sec; 4662 for (sp=spppq; sp; sp=sp->pp_next) { 4663 struct ifnet *ifp = &sp->pp_if; 4664 4665 /* check idle timeout */ 4666 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4667 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4668 /* idle timeout is enabled for this interface */ 4669 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4670 if (ifp->if_flags & IFF_DEBUG) 4671 printf("%s: no activitiy for %lu seconds\n", 4672 sp->pp_if.if_xname, 4673 (unsigned long)(now-sp->pp_last_activity)); 4674 lcp.Close(sp); 4675 continue; 4676 } 4677 } 4678 4679 /* Keepalive mode disabled or channel down? */ 4680 if (! (sp->pp_flags & PP_KEEPALIVE) || 4681 ! (ifp->if_flags & IFF_RUNNING)) 4682 continue; 4683 4684 /* No keepalive in PPP mode if LCP not opened yet. */ 4685 if (! (sp->pp_flags & PP_CISCO) && 4686 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4687 continue; 4688 4689 /* No echo reply, but maybe user data passed through? */ 4690 if ((now - sp->pp_last_activity) < LCP_KEEPALIVE_INTERVAL) { 4691 sp->pp_alivecnt = 0; 4692 continue; 4693 } 4694 4695 if (sp->pp_alivecnt == MAXALIVECNT) { 4696 /* No keepalive packets got. Stop the interface. */ 4697 if_down (ifp); 4698 IF_PURGE(&sp->pp_cpq); 4699 if (! (sp->pp_flags & PP_CISCO)) { 4700 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4701 ifp->if_xname); 4702 sp->pp_alivecnt = 0; 4703 4704 /* we are down, close all open protocols */ 4705 lcp.Close(sp); 4706 4707 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4708 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4709 4710 /* Close connection imediatly, completition of this 4711 * will summon the magic needed to reestablish it. */ 4712 sp->pp_tlf(sp); 4713 continue; 4714 } 4715 } 4716 if (sp->pp_alivecnt <= MAXALIVECNT) 4717 ++sp->pp_alivecnt; 4718 if (sp->pp_flags & PP_CISCO) 4719 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4720 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4721 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4722 int32_t nmagic = htonl(sp->lcp.magic); 4723 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4724 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4725 sp->lcp.echoid, 4, &nmagic); 4726 } 4727 } 4728 splx(s); 4729 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4730 } 4731 4732 /* 4733 * Get both IP addresses. 4734 */ 4735 static void 4736 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask) 4737 { 4738 struct ifnet *ifp = &sp->pp_if; 4739 struct ifaddr *ifa; 4740 struct sockaddr_in *si, *sm; 4741 u_int32_t ssrc, ddst; 4742 4743 sm = NULL; 4744 ssrc = ddst = 0; 4745 /* 4746 * Pick the first AF_INET address from the list, 4747 * aliases don't make any sense on a p2p link anyway. 4748 */ 4749 si = 0; 4750 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4751 if (ifa->ifa_addr->sa_family == AF_INET) { 4752 si = (struct sockaddr_in *)ifa->ifa_addr; 4753 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4754 if (si) 4755 break; 4756 } 4757 } 4758 if (ifa) { 4759 if (si && si->sin_addr.s_addr) { 4760 ssrc = si->sin_addr.s_addr; 4761 if (srcmask) 4762 *srcmask = ntohl(sm->sin_addr.s_addr); 4763 } 4764 4765 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4766 if (si && si->sin_addr.s_addr) 4767 ddst = si->sin_addr.s_addr; 4768 } 4769 4770 if (dst) *dst = ntohl(ddst); 4771 if (src) *src = ntohl(ssrc); 4772 } 4773 4774 /* 4775 * Set IP addresses. Must be called at splnet. 4776 * If an address is 0, leave it the way it is. 4777 */ 4778 static void 4779 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4780 { 4781 STDDCL; 4782 struct ifaddr *ifa; 4783 struct sockaddr_in *si; 4784 struct sockaddr_in *dest; 4785 4786 /* 4787 * Pick the first AF_INET address from the list, 4788 * aliases don't make any sense on a p2p link anyway. 4789 */ 4790 4791 si = 0; 4792 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4793 { 4794 if (ifa->ifa_addr->sa_family == AF_INET) 4795 { 4796 si = (struct sockaddr_in *)ifa->ifa_addr; 4797 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4798 if (si) 4799 break; 4800 } 4801 } 4802 4803 if (ifa && si) 4804 { 4805 int error; 4806 struct sockaddr_in new_sin = *si; 4807 struct sockaddr_in new_dst = *dest; 4808 4809 /* 4810 * Scrub old routes now instead of calling in_ifinit with 4811 * scrub=1, because we may change the dstaddr 4812 * before the call to in_ifinit. 4813 */ 4814 in_ifscrub(ifp, ifatoia(ifa)); 4815 4816 if (myaddr != 0) 4817 new_sin.sin_addr.s_addr = htonl(myaddr); 4818 if (hisaddr != 0) { 4819 new_dst.sin_addr.s_addr = htonl(hisaddr); 4820 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4821 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4822 *dest = new_dst; /* fix dstaddr in place */ 4823 } 4824 } 4825 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4826 if(debug && error) 4827 { 4828 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit " 4829 " failed, error=%d\n", SPP_ARGS(ifp), error); 4830 } 4831 } 4832 } 4833 4834 /* 4835 * Clear IP addresses. Must be called at splnet. 4836 */ 4837 static void 4838 sppp_clear_ip_addrs(struct sppp *sp) 4839 { 4840 struct ifnet *ifp = &sp->pp_if; 4841 struct ifaddr *ifa; 4842 struct sockaddr_in *si; 4843 struct sockaddr_in *dest; 4844 4845 u_int32_t remote; 4846 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4847 remote = sp->ipcp.saved_hisaddr; 4848 else 4849 sppp_get_ip_addrs(sp, 0, &remote, 0); 4850 4851 /* 4852 * Pick the first AF_INET address from the list, 4853 * aliases don't make any sense on a p2p link anyway. 4854 */ 4855 4856 si = 0; 4857 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4858 { 4859 if (ifa->ifa_addr->sa_family == AF_INET) 4860 { 4861 si = (struct sockaddr_in *)ifa->ifa_addr; 4862 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4863 if (si) 4864 break; 4865 } 4866 } 4867 4868 if (ifa && si) 4869 { 4870 struct sockaddr_in new_sin = *si; 4871 4872 in_ifscrub(ifp, ifatoia(ifa)); 4873 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4874 new_sin.sin_addr.s_addr = 0; 4875 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4876 /* replace peer addr in place */ 4877 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4878 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4879 } 4880 } 4881 4882 #ifdef INET6 4883 /* 4884 * Get both IPv6 addresses. 4885 */ 4886 static void 4887 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4888 struct in6_addr *srcmask) 4889 { 4890 struct ifnet *ifp = &sp->pp_if; 4891 struct ifaddr *ifa; 4892 struct sockaddr_in6 *si, *sm; 4893 struct in6_addr ssrc, ddst; 4894 4895 sm = NULL; 4896 memset(&ssrc, 0, sizeof(ssrc)); 4897 memset(&ddst, 0, sizeof(ddst)); 4898 /* 4899 * Pick the first link-local AF_INET6 address from the list, 4900 * aliases don't make any sense on a p2p link anyway. 4901 */ 4902 si = 0; 4903 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4904 if (ifa->ifa_addr->sa_family == AF_INET6) { 4905 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4906 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4907 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4908 break; 4909 } 4910 if (ifa) { 4911 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4912 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4913 if (srcmask) { 4914 bcopy(&sm->sin6_addr, srcmask, 4915 sizeof(*srcmask)); 4916 } 4917 } 4918 4919 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4920 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4921 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4922 } 4923 4924 if (dst) 4925 bcopy(&ddst, dst, sizeof(*dst)); 4926 if (src) 4927 bcopy(&ssrc, src, sizeof(*src)); 4928 } 4929 4930 #ifdef IPV6CP_MYIFID_DYN 4931 /* 4932 * Generate random ifid. 4933 */ 4934 static void 4935 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4936 { 4937 /* TBD */ 4938 } 4939 4940 /* 4941 * Set my IPv6 address. Must be called at splnet. 4942 */ 4943 static void 4944 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4945 { 4946 STDDCL; 4947 struct ifaddr *ifa; 4948 struct sockaddr_in6 *sin6; 4949 4950 /* 4951 * Pick the first link-local AF_INET6 address from the list, 4952 * aliases don't make any sense on a p2p link anyway. 4953 */ 4954 4955 sin6 = NULL; 4956 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4957 { 4958 if (ifa->ifa_addr->sa_family == AF_INET6) 4959 { 4960 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4961 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4962 break; 4963 } 4964 } 4965 4966 if (ifa && sin6) 4967 { 4968 int error; 4969 struct sockaddr_in6 new_sin6 = *sin6; 4970 4971 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4972 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 4973 if (debug && error) 4974 { 4975 log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit " 4976 " failed, error=%d\n", SPP_ARGS(ifp), error); 4977 } 4978 } 4979 } 4980 #endif 4981 4982 /* 4983 * Suggest a candidate address to be used by peer. 4984 */ 4985 static void 4986 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4987 { 4988 struct in6_addr myaddr; 4989 struct timeval tv; 4990 4991 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4992 4993 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4994 microtime(&tv); 4995 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4996 myaddr.s6_addr[14] ^= 0xff; 4997 myaddr.s6_addr[15] ^= 0xff; 4998 } else { 4999 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5000 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5001 } 5002 if (suggest) 5003 bcopy(&myaddr, suggest, sizeof(myaddr)); 5004 } 5005 #endif /*INET6*/ 5006 5007 /* 5008 * Process ioctl requests specific to the PPP interface. 5009 * Permissions have already been checked. 5010 */ 5011 static int 5012 sppp_params(struct sppp *sp, int cmd, void *data) 5013 { 5014 switch (cmd) { 5015 case SPPPGETAUTHCFG: 5016 { 5017 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5018 int error; 5019 size_t len; 5020 5021 cfg->myauthflags = sp->myauth.flags; 5022 cfg->hisauthflags = sp->hisauth.flags; 5023 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 5024 cfg->hisauth = 0; 5025 if (sp->hisauth.proto) 5026 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5027 cfg->myauth = 0; 5028 if (sp->myauth.proto) 5029 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5030 if (cfg->myname_length == 0) { 5031 if (sp->myauth.name != NULL) 5032 cfg->myname_length = sp->myauth.name_len + 1; 5033 } else { 5034 if (sp->myauth.name == NULL) { 5035 cfg->myname_length = 0; 5036 } else { 5037 len = sp->myauth.name_len + 1; 5038 if (cfg->myname_length < len) 5039 return (ENAMETOOLONG); 5040 error = copyout(sp->myauth.name, cfg->myname, len); 5041 if (error) return error; 5042 } 5043 } 5044 if (cfg->hisname_length == 0) { 5045 if(sp->hisauth.name != NULL) 5046 cfg->hisname_length = sp->hisauth.name_len + 1; 5047 } else { 5048 if (sp->hisauth.name == NULL) { 5049 cfg->hisname_length = 0; 5050 } else { 5051 len = sp->hisauth.name_len + 1; 5052 if (cfg->hisname_length < len) 5053 return (ENAMETOOLONG); 5054 error = copyout(sp->hisauth.name, cfg->hisname, len); 5055 if (error) return error; 5056 } 5057 } 5058 } 5059 break; 5060 case SPPPSETAUTHCFG: 5061 { 5062 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5063 int error; 5064 5065 if (sp->myauth.name) { 5066 free(sp->myauth.name, M_DEVBUF); 5067 sp->myauth.name = NULL; 5068 } 5069 if (sp->myauth.secret) { 5070 free(sp->myauth.secret, M_DEVBUF); 5071 sp->myauth.secret = NULL; 5072 } 5073 if (sp->hisauth.name) { 5074 free(sp->hisauth.name, M_DEVBUF); 5075 sp->hisauth.name = NULL; 5076 } 5077 if (sp->hisauth.secret) { 5078 free(sp->hisauth.secret, M_DEVBUF); 5079 sp->hisauth.secret = NULL; 5080 } 5081 5082 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5083 if (cfg->hisname_length >= MCLBYTES) 5084 return (ENAMETOOLONG); 5085 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5086 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5087 if (error) { 5088 free(sp->hisauth.name, M_DEVBUF); 5089 sp->hisauth.name = NULL; 5090 return error; 5091 } 5092 sp->hisauth.name_len = cfg->hisname_length - 1; 5093 sp->hisauth.name[sp->hisauth.name_len] = 0; 5094 } 5095 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5096 if (cfg->hissecret_length >= MCLBYTES) 5097 return (ENAMETOOLONG); 5098 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5099 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5100 if (error) { 5101 free(sp->hisauth.secret, M_DEVBUF); 5102 sp->hisauth.secret = NULL; 5103 return error; 5104 } 5105 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5106 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5107 } 5108 if (cfg->myname != NULL && cfg->myname_length > 0) { 5109 if (cfg->myname_length >= MCLBYTES) 5110 return (ENAMETOOLONG); 5111 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5112 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5113 if (error) { 5114 free(sp->myauth.name, M_DEVBUF); 5115 sp->myauth.name = NULL; 5116 return error; 5117 } 5118 sp->myauth.name_len = cfg->myname_length - 1; 5119 sp->myauth.name[sp->myauth.name_len] = 0; 5120 } 5121 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5122 if (cfg->mysecret_length >= MCLBYTES) 5123 return (ENAMETOOLONG); 5124 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5125 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5126 if (error) { 5127 free(sp->myauth.secret, M_DEVBUF); 5128 sp->myauth.secret = NULL; 5129 return error; 5130 } 5131 sp->myauth.secret_len = cfg->mysecret_length - 1; 5132 sp->myauth.secret[sp->myauth.secret_len] = 0; 5133 } 5134 sp->myauth.flags = cfg->myauthflags; 5135 if (cfg->myauth) 5136 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5137 sp->hisauth.flags = cfg->hisauthflags; 5138 if (cfg->hisauth) 5139 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5140 sp->pp_auth_failures = 0; 5141 if (sp->hisauth.proto != 0) 5142 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5143 else 5144 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5145 } 5146 break; 5147 case SPPPGETLCPCFG: 5148 { 5149 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5150 lcp->lcp_timeout = sp->lcp.timeout; 5151 } 5152 break; 5153 case SPPPSETLCPCFG: 5154 { 5155 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5156 sp->lcp.timeout = lcp->lcp_timeout; 5157 } 5158 break; 5159 case SPPPGETSTATUS: 5160 { 5161 struct spppstatus *status = (struct spppstatus *)data; 5162 status->phase = sp->pp_phase; 5163 } 5164 break; 5165 case SPPPGETIDLETO: 5166 { 5167 struct spppidletimeout *to = (struct spppidletimeout *)data; 5168 to->idle_seconds = sp->pp_idle_timeout; 5169 } 5170 break; 5171 case SPPPSETIDLETO: 5172 { 5173 struct spppidletimeout *to = (struct spppidletimeout *)data; 5174 sp->pp_idle_timeout = to->idle_seconds; 5175 } 5176 break; 5177 case SPPPSETAUTHFAILURE: 5178 { 5179 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5180 sp->pp_max_auth_fail = afsettings->max_failures; 5181 sp->pp_auth_failures = 0; 5182 } 5183 break; 5184 case SPPPGETAUTHFAILURES: 5185 { 5186 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5187 stats->auth_failures = sp->pp_auth_failures; 5188 stats->max_failures = sp->pp_max_auth_fail; 5189 } 5190 break; 5191 case SPPPSETDNSOPTS: 5192 { 5193 struct spppdnssettings *req = (struct spppdnssettings *)data; 5194 sp->query_dns = req->query_dns & 3; 5195 } 5196 break; 5197 case SPPPGETDNSOPTS: 5198 { 5199 struct spppdnssettings *req = (struct spppdnssettings *)data; 5200 req->query_dns = sp->query_dns; 5201 } 5202 break; 5203 case SPPPGETDNSADDRS: 5204 { 5205 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5206 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5207 } 5208 break; 5209 default: 5210 return (EINVAL); 5211 } 5212 5213 return (0); 5214 } 5215 5216 static void 5217 sppp_phase_network(struct sppp *sp) 5218 { 5219 STDDCL; 5220 int i; 5221 u_int32_t mask; 5222 5223 sp->pp_phase = SPPP_PHASE_NETWORK; 5224 5225 if(debug) 5226 { 5227 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 5228 sppp_phase_name(sp->pp_phase)); 5229 } 5230 5231 /* Notify NCPs now. */ 5232 for (i = 0; i < IDX_COUNT; i++) 5233 if ((cps[i])->flags & CP_NCP) 5234 (cps[i])->Open(sp); 5235 5236 /* Send Up events to all NCPs. */ 5237 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5238 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5239 (cps[i])->Up(sp); 5240 5241 /* if no NCP is starting, all this was in vain, close down */ 5242 sppp_lcp_check_and_close(sp); 5243 } 5244 5245 5246 static const char * 5247 sppp_cp_type_name(u_char type) 5248 { 5249 static char buf[12]; 5250 switch (type) { 5251 case CONF_REQ: return "conf-req"; 5252 case CONF_ACK: return "conf-ack"; 5253 case CONF_NAK: return "conf-nak"; 5254 case CONF_REJ: return "conf-rej"; 5255 case TERM_REQ: return "term-req"; 5256 case TERM_ACK: return "term-ack"; 5257 case CODE_REJ: return "code-rej"; 5258 case PROTO_REJ: return "proto-rej"; 5259 case ECHO_REQ: return "echo-req"; 5260 case ECHO_REPLY: return "echo-reply"; 5261 case DISC_REQ: return "discard-req"; 5262 } 5263 sprintf (buf, "0x%x", type); 5264 return buf; 5265 } 5266 5267 static const char * 5268 sppp_auth_type_name(u_short proto, u_char type) 5269 { 5270 static char buf[12]; 5271 switch (proto) { 5272 case PPP_CHAP: 5273 switch (type) { 5274 case CHAP_CHALLENGE: return "challenge"; 5275 case CHAP_RESPONSE: return "response"; 5276 case CHAP_SUCCESS: return "success"; 5277 case CHAP_FAILURE: return "failure"; 5278 } 5279 case PPP_PAP: 5280 switch (type) { 5281 case PAP_REQ: return "req"; 5282 case PAP_ACK: return "ack"; 5283 case PAP_NAK: return "nak"; 5284 } 5285 } 5286 sprintf (buf, "0x%x", type); 5287 return buf; 5288 } 5289 5290 static const char * 5291 sppp_lcp_opt_name(u_char opt) 5292 { 5293 static char buf[12]; 5294 switch (opt) { 5295 case LCP_OPT_MRU: return "mru"; 5296 case LCP_OPT_ASYNC_MAP: return "async-map"; 5297 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5298 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5299 case LCP_OPT_MAGIC: return "magic"; 5300 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5301 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5302 } 5303 sprintf (buf, "0x%x", opt); 5304 return buf; 5305 } 5306 5307 static const char * 5308 sppp_ipcp_opt_name(u_char opt) 5309 { 5310 static char buf[12]; 5311 switch (opt) { 5312 case IPCP_OPT_ADDRESSES: return "addresses"; 5313 case IPCP_OPT_COMPRESSION: return "compression"; 5314 case IPCP_OPT_ADDRESS: return "address"; 5315 } 5316 sprintf (buf, "0x%x", opt); 5317 return buf; 5318 } 5319 5320 #ifdef INET6 5321 static const char * 5322 sppp_ipv6cp_opt_name(u_char opt) 5323 { 5324 static char buf[12]; 5325 switch (opt) { 5326 case IPV6CP_OPT_IFID: return "ifid"; 5327 case IPV6CP_OPT_COMPRESSION: return "compression"; 5328 } 5329 sprintf (buf, "0x%x", opt); 5330 return buf; 5331 } 5332 #endif 5333 5334 static const char * 5335 sppp_state_name(int state) 5336 { 5337 switch (state) { 5338 case STATE_INITIAL: return "initial"; 5339 case STATE_STARTING: return "starting"; 5340 case STATE_CLOSED: return "closed"; 5341 case STATE_STOPPED: return "stopped"; 5342 case STATE_CLOSING: return "closing"; 5343 case STATE_STOPPING: return "stopping"; 5344 case STATE_REQ_SENT: return "req-sent"; 5345 case STATE_ACK_RCVD: return "ack-rcvd"; 5346 case STATE_ACK_SENT: return "ack-sent"; 5347 case STATE_OPENED: return "opened"; 5348 } 5349 return "illegal"; 5350 } 5351 5352 static const char * 5353 sppp_phase_name(int phase) 5354 { 5355 switch (phase) { 5356 case SPPP_PHASE_DEAD: return "dead"; 5357 case SPPP_PHASE_ESTABLISH: return "establish"; 5358 case SPPP_PHASE_TERMINATE: return "terminate"; 5359 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5360 case SPPP_PHASE_NETWORK: return "network"; 5361 } 5362 return "illegal"; 5363 } 5364 5365 static const char * 5366 sppp_proto_name(u_short proto) 5367 { 5368 static char buf[12]; 5369 switch (proto) { 5370 case PPP_LCP: return "lcp"; 5371 case PPP_IPCP: return "ipcp"; 5372 case PPP_PAP: return "pap"; 5373 case PPP_CHAP: return "chap"; 5374 case PPP_IPV6CP: return "ipv6cp"; 5375 } 5376 sprintf(buf, "0x%x", (unsigned)proto); 5377 return buf; 5378 } 5379 5380 static void 5381 sppp_print_bytes(const u_char *p, u_short len) 5382 { 5383 addlog(" %02x", *p++); 5384 while (--len > 0) 5385 addlog("-%02x", *p++); 5386 } 5387 5388 static void 5389 sppp_print_string(const char *p, u_short len) 5390 { 5391 u_char c; 5392 5393 while (len-- > 0) { 5394 c = *p++; 5395 /* 5396 * Print only ASCII chars directly. RFC 1994 recommends 5397 * using only them, but we don't rely on it. */ 5398 if (c < ' ' || c > '~') 5399 addlog("\\x%x", c); 5400 else 5401 addlog("%c", c); 5402 } 5403 } 5404 5405 static const char * 5406 sppp_dotted_quad(u_int32_t addr) 5407 { 5408 static char s[16]; 5409 sprintf(s, "%d.%d.%d.%d", 5410 (int)((addr >> 24) & 0xff), 5411 (int)((addr >> 16) & 0xff), 5412 (int)((addr >> 8) & 0xff), 5413 (int)(addr & 0xff)); 5414 return s; 5415 } 5416 5417 /* a dummy, used to drop uninteresting events */ 5418 static void 5419 sppp_null(struct sppp *unused) 5420 { 5421 /* do just nothing */ 5422 } 5423 /* 5424 * This file is large. Tell emacs to highlight it nevertheless. 5425 * 5426 * Local Variables: 5427 * hilit-auto-highlight-maxout: 120000 5428 * End: 5429 */ 5430
Indexes created Tue Oct 14 21:09:58 GMT 2025