if_spppsubr.c revision 1.61
1 /* $NetBSD: if_spppsubr.c,v 1.61 2002/12/28 21:09:14 kristerw Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.61 2002/12/28 21:09:14 kristerw Exp $"); 45 46 #include "opt_inet.h" 47 #include "opt_ipx.h" 48 #include "opt_iso.h" 49 #include "opt_ns.h" 50 51 #include <sys/param.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/kernel.h> 55 #include <sys/sockio.h> 56 #include <sys/socket.h> 57 #include <sys/syslog.h> 58 #include <sys/malloc.h> 59 #include <sys/mbuf.h> 60 #include <sys/callout.h> 61 #include <sys/md5.h> 62 63 #include <net/if.h> 64 #include <net/netisr.h> 65 #include <net/if_types.h> 66 #include <net/route.h> 67 #include <net/ppp_defs.h> 68 69 #include <machine/stdarg.h> 70 71 #include <netinet/in.h> 72 #include <netinet/in_systm.h> 73 #include <netinet/in_var.h> 74 #ifdef INET 75 #include <netinet/ip.h> 76 #include <netinet/tcp.h> 77 #endif 78 #include <net/ethertypes.h> 79 80 #ifdef IPX 81 #include <netipx/ipx.h> 82 #include <netipx/ipx_if.h> 83 #endif 84 85 #ifdef NS 86 #include <netns/ns.h> 87 #include <netns/ns_if.h> 88 #endif 89 90 #ifdef ISO 91 #include <netiso/argo_debug.h> 92 #include <netiso/iso.h> 93 #include <netiso/iso_var.h> 94 #include <netiso/iso_snpac.h> 95 #endif 96 97 #include <net/if_sppp.h> 98 #include <net/if_spppvar.h> 99 100 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds */ 101 #define MAXALIVECNT 3 /* max. missed alive packets */ 102 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 103 104 /* 105 * Interface flags that can be set in an ifconfig command. 106 * 107 * Setting link0 will make the link passive, i.e. it will be marked 108 * as being administrative openable, but won't be opened to begin 109 * with. Incoming calls will be answered, or subsequent calls with 110 * -link1 will cause the administrative open of the LCP layer. 111 * 112 * Setting link1 will cause the link to auto-dial only as packets 113 * arrive to be sent. 114 * 115 * Setting IFF_DEBUG will syslog the option negotiation and state 116 * transitions at level kern.debug. Note: all logs consistently look 117 * like 118 * 119 * <if-name><unit>: <proto-name> <additional info...> 120 * 121 * with <if-name><unit> being something like "bppp0", and <proto-name> 122 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 123 */ 124 125 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 126 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 127 128 #define CONF_REQ 1 /* PPP configure request */ 129 #define CONF_ACK 2 /* PPP configure acknowledge */ 130 #define CONF_NAK 3 /* PPP configure negative ack */ 131 #define CONF_REJ 4 /* PPP configure reject */ 132 #define TERM_REQ 5 /* PPP terminate request */ 133 #define TERM_ACK 6 /* PPP terminate acknowledge */ 134 #define CODE_REJ 7 /* PPP code reject */ 135 #define PROTO_REJ 8 /* PPP protocol reject */ 136 #define ECHO_REQ 9 /* PPP echo request */ 137 #define ECHO_REPLY 10 /* PPP echo reply */ 138 #define DISC_REQ 11 /* PPP discard request */ 139 140 #define LCP_OPT_MRU 1 /* maximum receive unit */ 141 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 142 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 143 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 144 #define LCP_OPT_MAGIC 5 /* magic number */ 145 #define LCP_OPT_RESERVED 6 /* reserved */ 146 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 147 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 148 149 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 150 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 151 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 152 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 153 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 154 155 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 156 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 157 158 #define PAP_REQ 1 /* PAP name/password request */ 159 #define PAP_ACK 2 /* PAP acknowledge */ 160 #define PAP_NAK 3 /* PAP fail */ 161 162 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 163 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 164 #define CHAP_SUCCESS 3 /* CHAP response ok */ 165 #define CHAP_FAILURE 4 /* CHAP response failed */ 166 167 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 168 169 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 170 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 171 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 172 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 173 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 174 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 175 176 /* states are named and numbered according to RFC 1661 */ 177 #define STATE_INITIAL 0 178 #define STATE_STARTING 1 179 #define STATE_CLOSED 2 180 #define STATE_STOPPED 3 181 #define STATE_CLOSING 4 182 #define STATE_STOPPING 5 183 #define STATE_REQ_SENT 6 184 #define STATE_ACK_RCVD 7 185 #define STATE_ACK_SENT 8 186 #define STATE_OPENED 9 187 188 struct ppp_header { 189 u_char address; 190 u_char control; 191 u_short protocol; 192 } __attribute__((__packed__)); 193 #define PPP_HEADER_LEN sizeof (struct ppp_header) 194 195 struct lcp_header { 196 u_char type; 197 u_char ident; 198 u_short len; 199 } __attribute__((__packed__)); 200 #define LCP_HEADER_LEN sizeof (struct lcp_header) 201 202 struct cisco_packet { 203 u_int32_t type; 204 u_int32_t par1; 205 u_int32_t par2; 206 u_short rel; 207 u_short time0; 208 u_short time1; 209 } __attribute__((__packed__)); 210 #define CISCO_PACKET_LEN 18 211 212 /* 213 * We follow the spelling and capitalization of RFC 1661 here, to make 214 * it easier comparing with the standard. Please refer to this RFC in 215 * case you can't make sense out of these abbreviation; it will also 216 * explain the semantics related to the various events and actions. 217 */ 218 struct cp { 219 u_short proto; /* PPP control protocol number */ 220 u_char protoidx; /* index into state table in struct sppp */ 221 u_char flags; 222 #define CP_LCP 0x01 /* this is the LCP */ 223 #define CP_AUTH 0x02 /* this is an authentication protocol */ 224 #define CP_NCP 0x04 /* this is a NCP */ 225 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 226 const char *name; /* name of this control protocol */ 227 /* event handlers */ 228 void (*Up)(struct sppp *sp); 229 void (*Down)(struct sppp *sp); 230 void (*Open)(struct sppp *sp); 231 void (*Close)(struct sppp *sp); 232 void (*TO)(void *sp); 233 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 234 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 235 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 236 /* actions */ 237 void (*tlu)(struct sppp *sp); 238 void (*tld)(struct sppp *sp); 239 void (*tls)(struct sppp *sp); 240 void (*tlf)(struct sppp *sp); 241 void (*scr)(struct sppp *sp); 242 }; 243 244 static struct sppp *spppq; 245 static struct callout keepalive_ch; 246 247 #ifdef __FreeBSD__ 248 #define SPP_FMT "%s%d: " 249 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 250 #else 251 #define SPP_FMT "%s: " 252 #define SPP_ARGS(ifp) (ifp)->if_xname 253 #endif 254 255 #ifdef INET 256 /* 257 * The following disgusting hack gets around the problem that IP TOS 258 * can't be set yet. We want to put "interactive" traffic on a high 259 * priority queue. To decide if traffic is interactive, we check that 260 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 261 * 262 * XXX is this really still necessary? - joerg - 263 */ 264 static u_short interactive_ports[8] = { 265 0, 513, 0, 0, 266 0, 21, 0, 23, 267 }; 268 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 269 #endif 270 271 /* almost every function needs these */ 272 #define STDDCL \ 273 struct ifnet *ifp = &sp->pp_if; \ 274 int debug = ifp->if_flags & IFF_DEBUG 275 276 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 277 struct sockaddr *dst, struct rtentry *rt); 278 279 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 280 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 281 282 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 283 struct mbuf *m); 284 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 285 u_char ident, u_short len, void *data); 286 /* static void sppp_cp_timeout(void *arg); */ 287 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 288 int newstate); 289 static void sppp_auth_send(const struct cp *cp, 290 struct sppp *sp, unsigned int type, unsigned int id, 291 ...); 292 293 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 294 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 295 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 296 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 297 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 298 299 static void sppp_null(struct sppp *sp); 300 301 static void sppp_lcp_init(struct sppp *sp); 302 static void sppp_lcp_up(struct sppp *sp); 303 static void sppp_lcp_down(struct sppp *sp); 304 static void sppp_lcp_open(struct sppp *sp); 305 static void sppp_lcp_close(struct sppp *sp); 306 static void sppp_lcp_TO(void *sp); 307 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 308 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 309 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 310 static void sppp_lcp_tlu(struct sppp *sp); 311 static void sppp_lcp_tld(struct sppp *sp); 312 static void sppp_lcp_tls(struct sppp *sp); 313 static void sppp_lcp_tlf(struct sppp *sp); 314 static void sppp_lcp_scr(struct sppp *sp); 315 static void sppp_lcp_check_and_close(struct sppp *sp); 316 static int sppp_ncp_check(struct sppp *sp); 317 318 static void sppp_ipcp_init(struct sppp *sp); 319 static void sppp_ipcp_up(struct sppp *sp); 320 static void sppp_ipcp_down(struct sppp *sp); 321 static void sppp_ipcp_open(struct sppp *sp); 322 static void sppp_ipcp_close(struct sppp *sp); 323 static void sppp_ipcp_TO(void *sp); 324 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 325 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 326 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 327 static void sppp_ipcp_tlu(struct sppp *sp); 328 static void sppp_ipcp_tld(struct sppp *sp); 329 static void sppp_ipcp_tls(struct sppp *sp); 330 static void sppp_ipcp_tlf(struct sppp *sp); 331 static void sppp_ipcp_scr(struct sppp *sp); 332 333 static void sppp_ipv6cp_init(struct sppp *sp); 334 static void sppp_ipv6cp_up(struct sppp *sp); 335 static void sppp_ipv6cp_down(struct sppp *sp); 336 static void sppp_ipv6cp_open(struct sppp *sp); 337 static void sppp_ipv6cp_close(struct sppp *sp); 338 static void sppp_ipv6cp_TO(void *sp); 339 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 340 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 341 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 342 static void sppp_ipv6cp_tlu(struct sppp *sp); 343 static void sppp_ipv6cp_tld(struct sppp *sp); 344 static void sppp_ipv6cp_tls(struct sppp *sp); 345 static void sppp_ipv6cp_tlf(struct sppp *sp); 346 static void sppp_ipv6cp_scr(struct sppp *sp); 347 348 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 349 static void sppp_pap_init(struct sppp *sp); 350 static void sppp_pap_open(struct sppp *sp); 351 static void sppp_pap_close(struct sppp *sp); 352 static void sppp_pap_TO(void *sp); 353 static void sppp_pap_my_TO(void *sp); 354 static void sppp_pap_tlu(struct sppp *sp); 355 static void sppp_pap_tld(struct sppp *sp); 356 static void sppp_pap_scr(struct sppp *sp); 357 358 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 359 static void sppp_chap_init(struct sppp *sp); 360 static void sppp_chap_open(struct sppp *sp); 361 static void sppp_chap_close(struct sppp *sp); 362 static void sppp_chap_TO(void *sp); 363 static void sppp_chap_tlu(struct sppp *sp); 364 static void sppp_chap_tld(struct sppp *sp); 365 static void sppp_chap_scr(struct sppp *sp); 366 367 static const char *sppp_auth_type_name(u_short proto, u_char type); 368 static const char *sppp_cp_type_name(u_char type); 369 static const char *sppp_dotted_quad(u_int32_t addr); 370 static const char *sppp_ipcp_opt_name(u_char opt); 371 #ifdef INET6 372 static const char *sppp_ipv6cp_opt_name(u_char opt); 373 #endif 374 static const char *sppp_lcp_opt_name(u_char opt); 375 static const char *sppp_phase_name(int phase); 376 static const char *sppp_proto_name(u_short proto); 377 static const char *sppp_state_name(int state); 378 static int sppp_params(struct sppp *sp, int cmd, void *data); 379 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 380 u_int32_t *srcmask); 381 static void sppp_keepalive(void *dummy); 382 static void sppp_phase_network(struct sppp *sp); 383 static void sppp_print_bytes(const u_char *p, u_short len); 384 static void sppp_print_string(const char *p, u_short len); 385 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr); 386 static void sppp_clear_ip_addrs(struct sppp *sp); 387 #ifdef INET6 388 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 389 struct in6_addr *dst, struct in6_addr *srcmask); 390 #ifdef IPV6CP_MYIFID_DYN 391 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 392 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 393 #endif 394 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 395 #endif 396 397 /* our control protocol descriptors */ 398 static const struct cp lcp = { 399 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 400 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 401 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 402 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 403 sppp_lcp_scr 404 }; 405 406 static const struct cp ipcp = { 407 PPP_IPCP, IDX_IPCP, 408 #ifdef INET 409 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 410 #else 411 0, 412 #endif 413 "ipcp", 414 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 415 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 416 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 417 sppp_ipcp_scr 418 }; 419 420 static const struct cp ipv6cp = { 421 PPP_IPV6CP, IDX_IPV6CP, 422 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 423 CP_NCP, 424 #else 425 0, 426 #endif 427 "ipv6cp", 428 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 429 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 430 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 431 sppp_ipv6cp_scr 432 }; 433 434 static const struct cp pap = { 435 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 436 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 437 sppp_pap_TO, 0, 0, 0, 438 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 439 sppp_pap_scr 440 }; 441 442 static const struct cp chap = { 443 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 444 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 445 sppp_chap_TO, 0, 0, 0, 446 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 447 sppp_chap_scr 448 }; 449 450 static const struct cp *cps[IDX_COUNT] = { 451 &lcp, /* IDX_LCP */ 452 &ipcp, /* IDX_IPCP */ 453 &ipv6cp, /* IDX_IPV6CP */ 454 &pap, /* IDX_PAP */ 455 &chap, /* IDX_CHAP */ 456 }; 457 458 459 /* 460 * Exported functions, comprising our interface to the lower layer. 461 */ 462 463 /* 464 * Process the received packet. 465 */ 466 void 467 sppp_input(struct ifnet *ifp, struct mbuf *m) 468 { 469 struct ppp_header *h = NULL; 470 struct ifqueue *inq = 0; 471 u_int16_t protocol; 472 int s; 473 struct sppp *sp = (struct sppp *)ifp; 474 int debug = ifp->if_flags & IFF_DEBUG; 475 476 if (ifp->if_flags & IFF_UP) 477 /* Count received bytes, add hardware framing */ 478 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 479 480 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 481 /* Too small packet, drop it. */ 482 if (debug) 483 log(LOG_DEBUG, 484 SPP_FMT "input packet is too small, %d bytes\n", 485 SPP_ARGS(ifp), m->m_pkthdr.len); 486 drop: 487 ++ifp->if_ierrors; 488 ++ifp->if_iqdrops; 489 m_freem(m); 490 return; 491 } 492 493 if (sp->pp_flags & PP_NOFRAMING) { 494 memcpy(&protocol, mtod(m, void *), 2); 495 protocol = ntohs(protocol); 496 m_adj(m, 2); 497 } else { 498 499 /* Get PPP header. */ 500 h = mtod(m, struct ppp_header *); 501 m_adj(m, PPP_HEADER_LEN); 502 503 switch (h->address) { 504 case PPP_ALLSTATIONS: 505 if (h->control != PPP_UI) 506 goto invalid; 507 if (sp->pp_flags & PP_CISCO) { 508 if (debug) 509 log(LOG_DEBUG, 510 SPP_FMT "PPP packet in Cisco mode " 511 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 512 SPP_ARGS(ifp), 513 h->address, h->control, ntohs(h->protocol)); 514 goto drop; 515 } 516 break; 517 case CISCO_MULTICAST: 518 case CISCO_UNICAST: 519 /* Don't check the control field here (RFC 1547). */ 520 if (! (sp->pp_flags & PP_CISCO)) { 521 if (debug) 522 log(LOG_DEBUG, 523 SPP_FMT "Cisco packet in PPP mode " 524 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 525 SPP_ARGS(ifp), 526 h->address, h->control, ntohs(h->protocol)); 527 goto drop; 528 } 529 switch (ntohs(h->protocol)) { 530 default: 531 ++ifp->if_noproto; 532 goto invalid; 533 case CISCO_KEEPALIVE: 534 sppp_cisco_input((struct sppp *) ifp, m); 535 m_freem(m); 536 return; 537 #ifdef INET 538 case ETHERTYPE_IP: 539 schednetisr(NETISR_IP); 540 inq = &ipintrq; 541 break; 542 #endif 543 #ifdef INET6 544 case ETHERTYPE_IPV6: 545 schednetisr(NETISR_IPV6); 546 inq = &ip6intrq; 547 break; 548 #endif 549 #ifdef IPX 550 case ETHERTYPE_IPX: 551 schednetisr(NETISR_IPX); 552 inq = &ipxintrq; 553 break; 554 #endif 555 #ifdef NS 556 case ETHERTYPE_NS: 557 schednetisr(NETISR_NS); 558 inq = &nsintrq; 559 break; 560 #endif 561 } 562 goto queue_pkt; 563 default: /* Invalid PPP packet. */ 564 invalid: 565 if (debug) 566 log(LOG_DEBUG, 567 SPP_FMT "invalid input packet " 568 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 569 SPP_ARGS(ifp), 570 h->address, h->control, ntohs(h->protocol)); 571 goto drop; 572 } 573 protocol = ntohs(h->protocol); 574 } 575 576 switch (protocol) { 577 default: 578 if (sp->state[IDX_LCP] == STATE_OPENED) { 579 u_int16_t prot = htons(protocol); 580 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 581 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 582 &prot); 583 } 584 if (debug) 585 log(LOG_DEBUG, 586 SPP_FMT "invalid input protocol " 587 "<proto=0x%x>\n", SPP_ARGS(ifp), ntohs(protocol)); 588 ++ifp->if_noproto; 589 goto drop; 590 case PPP_LCP: 591 sppp_cp_input(&lcp, sp, m); 592 m_freem(m); 593 return; 594 case PPP_PAP: 595 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 596 sppp_pap_input(sp, m); 597 m_freem(m); 598 return; 599 case PPP_CHAP: 600 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 601 sppp_chap_input(sp, m); 602 m_freem(m); 603 return; 604 #ifdef INET 605 case PPP_IPCP: 606 if (sp->pp_phase == SPPP_PHASE_NETWORK) 607 sppp_cp_input(&ipcp, sp, m); 608 m_freem(m); 609 return; 610 case PPP_IP: 611 if (sp->state[IDX_IPCP] == STATE_OPENED) { 612 schednetisr(NETISR_IP); 613 inq = &ipintrq; 614 sp->pp_last_activity = mono_time.tv_sec; 615 } 616 break; 617 #endif 618 #ifdef INET6 619 case PPP_IPV6CP: 620 if (sp->pp_phase == SPPP_PHASE_NETWORK) 621 sppp_cp_input(&ipv6cp, sp, m); 622 m_freem(m); 623 return; 624 625 case PPP_IPV6: 626 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 627 schednetisr(NETISR_IPV6); 628 inq = &ip6intrq; 629 sp->pp_last_activity = mono_time.tv_sec; 630 } 631 break; 632 #endif 633 #ifdef IPX 634 case PPP_IPX: 635 /* IPX IPXCP not implemented yet */ 636 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 637 schednetisr(NETISR_IPX); 638 inq = &ipxintrq; 639 } 640 break; 641 #endif 642 #ifdef NS 643 case PPP_XNS: 644 /* XNS IDPCP not implemented yet */ 645 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 646 schednetisr(NETISR_NS); 647 inq = &nsintrq; 648 } 649 break; 650 #endif 651 #ifdef ISO 652 case PPP_ISO: 653 /* OSI NLCP not implemented yet */ 654 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 655 schednetisr(NETISR_ISO); 656 inq = &clnlintrq; 657 } 658 break; 659 #endif 660 } 661 662 queue_pkt: 663 if (! (ifp->if_flags & IFF_UP) || ! inq) 664 goto drop; 665 666 /* Check queue. */ 667 s = splnet(); 668 if (IF_QFULL(inq)) { 669 /* Queue overflow. */ 670 IF_DROP(inq); 671 splx(s); 672 if (debug) 673 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 674 SPP_ARGS(ifp)); 675 goto drop; 676 } 677 IF_ENQUEUE(inq, m); 678 splx(s); 679 } 680 681 /* 682 * Enqueue transmit packet. 683 */ 684 static int 685 sppp_output(struct ifnet *ifp, struct mbuf *m, 686 struct sockaddr *dst, struct rtentry *rt) 687 { 688 struct sppp *sp = (struct sppp *) ifp; 689 struct ppp_header *h = NULL; 690 struct ifqueue *ifq = NULL; /* XXX */ 691 int s, len, rv = 0; 692 u_int16_t protocol; 693 ALTQ_DECL(struct altq_pktattr pktattr;) 694 695 s = splnet(); 696 697 sp->pp_last_activity = mono_time.tv_sec; 698 699 if ((ifp->if_flags & IFF_UP) == 0 || 700 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 701 m_freem(m); 702 splx(s); 703 return (ENETDOWN); 704 } 705 706 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 707 /* 708 * Interface is not yet running, but auto-dial. Need 709 * to start LCP for it. 710 */ 711 ifp->if_flags |= IFF_RUNNING; 712 splx(s); 713 lcp.Open(sp); 714 s = splnet(); 715 } 716 717 /* 718 * If the queueing discipline needs packet classification, 719 * do it before prepending link headers. 720 */ 721 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 722 723 #ifdef INET 724 if (dst->sa_family == AF_INET) { 725 struct ip *ip = NULL; 726 struct tcphdr *th = NULL; 727 728 if (m->m_len >= sizeof(struct ip)) { 729 ip = mtod(m, struct ip *); 730 if (ip->ip_p == IPPROTO_TCP && 731 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 732 sizeof(struct tcphdr)) { 733 th = (struct tcphdr *) 734 ((caddr_t)ip + (ip->ip_hl << 2)); 735 } 736 } else 737 ip = NULL; 738 739 /* 740 * When using dynamic local IP address assignment by using 741 * 0.0.0.0 as a local address, the first TCP session will 742 * not connect because the local TCP checksum is computed 743 * using 0.0.0.0 which will later become our real IP address 744 * so the TCP checksum computed at the remote end will 745 * become invalid. So we 746 * - don't let packets with src ip addr 0 thru 747 * - we flag TCP packets with src ip 0 as an error 748 */ 749 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 750 u_int8_t proto = ip->ip_p; 751 752 m_freem(m); 753 splx(s); 754 if (proto == IPPROTO_TCP) 755 return (EADDRNOTAVAIL); 756 else 757 return (0); 758 } 759 760 /* 761 * Put low delay, telnet, rlogin and ftp control packets 762 * in front of the queue. 763 */ 764 765 if (!IF_QFULL(&sp->pp_fastq) && 766 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 767 (th && (INTERACTIVE(ntohs(th->th_sport)) || 768 INTERACTIVE(ntohs(th->th_dport)))))) 769 ifq = &sp->pp_fastq; 770 } 771 #endif 772 773 #ifdef INET6 774 if (dst->sa_family == AF_INET6) { 775 /* XXX do something tricky here? */ 776 } 777 #endif 778 779 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 780 /* 781 * Prepend general data packet PPP header. For now, IP only. 782 */ 783 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 784 if (! m) { 785 if (ifp->if_flags & IFF_DEBUG) 786 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 787 SPP_ARGS(ifp)); 788 ++ifp->if_oerrors; 789 splx(s); 790 return (ENOBUFS); 791 } 792 /* 793 * May want to check size of packet 794 * (albeit due to the implementation it's always enough) 795 */ 796 h = mtod(m, struct ppp_header *); 797 if (sp->pp_flags & PP_CISCO) { 798 h->address = CISCO_UNICAST; /* unicast address */ 799 h->control = 0; 800 } else { 801 h->address = PPP_ALLSTATIONS; /* broadcast address */ 802 h->control = PPP_UI; /* Unnumbered Info */ 803 } 804 } 805 806 switch (dst->sa_family) { 807 #ifdef INET 808 case AF_INET: /* Internet Protocol */ 809 if (sp->pp_flags & PP_CISCO) 810 protocol = htons(ETHERTYPE_IP); 811 else { 812 /* 813 * Don't choke with an ENETDOWN early. It's 814 * possible that we just started dialing out, 815 * so don't drop the packet immediately. If 816 * we notice that we run out of buffer space 817 * below, we will however remember that we are 818 * not ready to carry IP packets, and return 819 * ENETDOWN, as opposed to ENOBUFS. 820 */ 821 protocol = htons(PPP_IP); 822 if (sp->state[IDX_IPCP] != STATE_OPENED) 823 rv = ENETDOWN; 824 } 825 break; 826 #endif 827 #ifdef INET6 828 case AF_INET6: /* Internet Protocol version 6 */ 829 if (sp->pp_flags & PP_CISCO) 830 protocol = htons(ETHERTYPE_IPV6); 831 else { 832 /* 833 * Don't choke with an ENETDOWN early. It's 834 * possible that we just started dialing out, 835 * so don't drop the packet immediately. If 836 * we notice that we run out of buffer space 837 * below, we will however remember that we are 838 * not ready to carry IP packets, and return 839 * ENETDOWN, as opposed to ENOBUFS. 840 */ 841 protocol = htons(PPP_IPV6); 842 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 843 rv = ENETDOWN; 844 } 845 break; 846 #endif 847 #ifdef NS 848 case AF_NS: /* Xerox NS Protocol */ 849 protocol = htons((sp->pp_flags & PP_CISCO) ? 850 ETHERTYPE_NS : PPP_XNS); 851 break; 852 #endif 853 #ifdef IPX 854 case AF_IPX: /* Novell IPX Protocol */ 855 protocol = htons((sp->pp_flags & PP_CISCO) ? 856 ETHERTYPE_IPX : PPP_IPX); 857 break; 858 #endif 859 #ifdef ISO 860 case AF_ISO: /* ISO OSI Protocol */ 861 if (sp->pp_flags & PP_CISCO) 862 goto nosupport; 863 protocol = htons(PPP_ISO); 864 break; 865 nosupport: 866 #endif 867 default: 868 m_freem(m); 869 ++ifp->if_oerrors; 870 splx(s); 871 return (EAFNOSUPPORT); 872 } 873 874 if (sp->pp_flags & PP_NOFRAMING) { 875 M_PREPEND(m, 2, M_DONTWAIT); 876 if (m == NULL) { 877 if (ifp->if_flags & IFF_DEBUG) 878 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 879 SPP_ARGS(ifp)); 880 ++ifp->if_oerrors; 881 splx(s); 882 return (ENOBUFS); 883 } 884 *mtod(m, u_int16_t *) = protocol; 885 } else { 886 h->protocol = protocol; 887 } 888 889 /* 890 * Queue message on interface, and start output if interface 891 * not yet active. 892 */ 893 len = m->m_pkthdr.len; 894 if (ifq != NULL 895 #ifdef ALTQ 896 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 897 #endif 898 ) { 899 if (IF_QFULL(ifq)) { 900 IF_DROP(&ifp->if_snd); 901 m_freem(m); 902 if (rv == 0) 903 rv = ENOBUFS; 904 } 905 else 906 IF_ENQUEUE(ifq, m); 907 } else 908 IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv); 909 if (rv != 0) { 910 ++ifp->if_oerrors; 911 splx(s); 912 return (rv); 913 } 914 915 if (! (ifp->if_flags & IFF_OACTIVE)) 916 (*ifp->if_start)(ifp); 917 918 /* 919 * Count output packets and bytes. 920 * The packet length includes header + additional hardware framing 921 * according to RFC 1333. 922 */ 923 ifp->if_obytes += len + sp->pp_framebytes; 924 splx(s); 925 return (0); 926 } 927 928 void 929 sppp_attach(struct ifnet *ifp) 930 { 931 struct sppp *sp = (struct sppp *) ifp; 932 933 /* Initialize keepalive handler. */ 934 if (! spppq) { 935 callout_init(&keepalive_ch); 936 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 937 } 938 939 /* Insert new entry into the keepalive list. */ 940 sp->pp_next = spppq; 941 spppq = sp; 942 943 sp->pp_if.if_type = IFT_PPP; 944 sp->pp_if.if_output = sppp_output; 945 sp->pp_fastq.ifq_maxlen = 32; 946 sp->pp_cpq.ifq_maxlen = 20; 947 sp->pp_loopcnt = 0; 948 sp->pp_alivecnt = 0; 949 sp->pp_last_activity = 0; 950 sp->pp_idle_timeout = 0; 951 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 952 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 953 sp->pp_auth_failures = 0; 954 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 955 sp->pp_phase = SPPP_PHASE_DEAD; 956 sp->pp_up = lcp.Up; 957 sp->pp_down = lcp.Down; 958 959 if_alloc_sadl(ifp); 960 961 memset(&sp->myauth, 0, sizeof sp->myauth); 962 memset(&sp->hisauth, 0, sizeof sp->hisauth); 963 sppp_lcp_init(sp); 964 sppp_ipcp_init(sp); 965 sppp_ipv6cp_init(sp); 966 sppp_pap_init(sp); 967 sppp_chap_init(sp); 968 } 969 970 void 971 sppp_detach(struct ifnet *ifp) 972 { 973 struct sppp **q, *p, *sp = (struct sppp *) ifp; 974 int i; 975 976 /* Remove the entry from the keepalive list. */ 977 for (q = &spppq; (p = *q); q = &p->pp_next) 978 if (p == sp) { 979 *q = p->pp_next; 980 break; 981 } 982 983 /* Stop keepalive handler. */ 984 if (! spppq) { 985 callout_stop(&keepalive_ch); 986 } 987 988 for (i = 0; i < IDX_COUNT; i++) { 989 callout_stop(&sp->ch[i]); 990 } 991 callout_stop(&sp->pap_my_to_ch); 992 993 /* free authentication info */ 994 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 995 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 996 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 997 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 998 999 if_free_sadl(ifp); 1000 } 1001 1002 /* 1003 * Flush the interface output queue. 1004 */ 1005 void 1006 sppp_flush(struct ifnet *ifp) 1007 { 1008 struct sppp *sp = (struct sppp *) ifp; 1009 1010 IFQ_PURGE(&sp->pp_if.if_snd); 1011 IF_PURGE(&sp->pp_fastq); 1012 IF_PURGE(&sp->pp_cpq); 1013 } 1014 1015 /* 1016 * Check if the output queue is empty. 1017 */ 1018 int 1019 sppp_isempty(struct ifnet *ifp) 1020 { 1021 struct sppp *sp = (struct sppp *) ifp; 1022 int empty, s; 1023 1024 s = splnet(); 1025 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1026 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1027 splx(s); 1028 return (empty); 1029 } 1030 1031 /* 1032 * Get next packet to send. 1033 */ 1034 struct mbuf * 1035 sppp_dequeue(struct ifnet *ifp) 1036 { 1037 struct sppp *sp = (struct sppp *) ifp; 1038 struct mbuf *m; 1039 int s; 1040 1041 s = splnet(); 1042 /* 1043 * Process only the control protocol queue until we have at 1044 * least one NCP open. 1045 * 1046 * Do always serve all three queues in Cisco mode. 1047 */ 1048 IF_DEQUEUE(&sp->pp_cpq, m); 1049 if (m == NULL && 1050 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1051 IF_DEQUEUE(&sp->pp_fastq, m); 1052 if (m == NULL) 1053 IF_DEQUEUE(&sp->pp_if.if_snd, m); 1054 } 1055 splx(s); 1056 return m; 1057 } 1058 1059 /* 1060 * Pick the next packet, do not remove it from the queue. 1061 */ 1062 struct mbuf * 1063 sppp_pick(struct ifnet *ifp) 1064 { 1065 struct sppp *sp = (struct sppp *)ifp; 1066 struct mbuf *m; 1067 int s; 1068 1069 s= splnet(); 1070 1071 m = sp->pp_cpq.ifq_head; 1072 if (m == NULL && 1073 (sp->pp_phase == SPPP_PHASE_NETWORK || 1074 (sp->pp_flags & PP_CISCO) != 0)) 1075 if ((m = sp->pp_fastq.ifq_head) == NULL) 1076 m = sp->pp_if.if_snd.ifq_head; 1077 splx(s); 1078 return (m); 1079 } 1080 1081 /* 1082 * Process an ioctl request. Called on low priority level. 1083 */ 1084 int 1085 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1086 { 1087 struct ifreq *ifr = (struct ifreq *) data; 1088 struct sppp *sp = (struct sppp *) ifp; 1089 int s, error=0, going_up, going_down, newmode; 1090 1091 s = splnet(); 1092 switch (cmd) { 1093 case SIOCAIFADDR: 1094 case SIOCSIFDSTADDR: 1095 break; 1096 1097 case SIOCSIFADDR: 1098 if_up(ifp); 1099 /* fall through... */ 1100 1101 case SIOCSIFFLAGS: 1102 going_up = ifp->if_flags & IFF_UP && 1103 (ifp->if_flags & IFF_RUNNING) == 0; 1104 going_down = (ifp->if_flags & IFF_UP) == 0 && 1105 ifp->if_flags & IFF_RUNNING; 1106 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1107 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1108 /* sanity */ 1109 newmode = IFF_PASSIVE; 1110 ifp->if_flags &= ~IFF_AUTO; 1111 } 1112 1113 if (going_up || going_down) 1114 lcp.Close(sp); 1115 if (going_up && newmode == 0) { 1116 /* neither auto-dial nor passive */ 1117 ifp->if_flags |= IFF_RUNNING; 1118 if (!(sp->pp_flags & PP_CISCO)) 1119 lcp.Open(sp); 1120 } else if (going_down) { 1121 sppp_flush(ifp); 1122 ifp->if_flags &= ~IFF_RUNNING; 1123 } 1124 1125 break; 1126 1127 #ifdef SIOCSIFMTU 1128 #ifndef ifr_mtu 1129 #define ifr_mtu ifr_metric 1130 #endif 1131 case SIOCSIFMTU: 1132 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1133 error = EINVAL; 1134 break; 1135 } 1136 1137 ifp->if_mtu = ifr->ifr_mtu; 1138 break; 1139 #endif 1140 #ifdef SLIOCSETMTU 1141 case SLIOCSETMTU: 1142 if (*(short *)data < 128 || *(short *)data > sp->lcp.their_mru) 1143 { 1144 error = EINVAL; 1145 break; 1146 } 1147 1148 ifp->if_mtu = *(short *)data; 1149 break; 1150 #endif 1151 #ifdef SIOCGIFMTU 1152 case SIOCGIFMTU: 1153 ifr->ifr_mtu = ifp->if_mtu; 1154 break; 1155 #endif 1156 #ifdef SLIOCGETMTU 1157 case SLIOCGETMTU: 1158 *(short *)data = ifp->if_mtu; 1159 break; 1160 #endif 1161 case SIOCADDMULTI: 1162 case SIOCDELMULTI: 1163 break; 1164 1165 case SPPPSETAUTHCFG: 1166 case SPPPSETLCPCFG: 1167 case SPPPSETIDLETO: 1168 case SPPPSETAUTHFAILURE: 1169 case SPPPSETDNSOPTS: 1170 { 1171 struct proc *p = curproc; /* XXX */ 1172 1173 if ((error = suser(p->p_ucred, &p->p_acflag)) != 0) 1174 break; 1175 } 1176 /* FALLTHROUGH */ 1177 case SPPPGETAUTHCFG: 1178 case SPPPGETLCPCFG: 1179 case SPPPGETSTATUS: 1180 case SPPPGETIDLETO: 1181 case SPPPGETAUTHFAILURES: 1182 case SPPPGETDNSOPTS: 1183 case SPPPGETDNSADDRS: 1184 error = sppp_params(sp, cmd, data); 1185 break; 1186 1187 default: 1188 error = ENOTTY; 1189 } 1190 splx(s); 1191 return (error); 1192 } 1193 1194 1195 /* 1196 * Cisco framing implementation. 1197 */ 1198 1199 /* 1200 * Handle incoming Cisco keepalive protocol packets. 1201 */ 1202 static void 1203 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1204 { 1205 STDDCL; 1206 struct cisco_packet *h; 1207 u_int32_t me, mymask; 1208 1209 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1210 if (debug) 1211 log(LOG_DEBUG, 1212 SPP_FMT "cisco invalid packet length: %d bytes\n", 1213 SPP_ARGS(ifp), m->m_pkthdr.len); 1214 return; 1215 } 1216 h = mtod(m, struct cisco_packet *); 1217 if (debug) 1218 log(LOG_DEBUG, 1219 SPP_FMT "cisco input: %d bytes " 1220 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1221 SPP_ARGS(ifp), m->m_pkthdr.len, 1222 ntohl (h->type), h->par1, h->par2, (u_int)h->rel, 1223 (u_int)h->time0, (u_int)h->time1); 1224 switch (ntohl (h->type)) { 1225 default: 1226 if (debug) 1227 addlog(SPP_FMT "cisco unknown packet type: 0x%x\n", 1228 SPP_ARGS(ifp), ntohl (h->type)); 1229 break; 1230 case CISCO_ADDR_REPLY: 1231 /* Reply on address request, ignore */ 1232 break; 1233 case CISCO_KEEPALIVE_REQ: 1234 sp->pp_alivecnt = 0; 1235 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1236 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1237 /* Local and remote sequence numbers are equal. 1238 * Probably, the line is in loopback mode. */ 1239 if (sp->pp_loopcnt >= MAXALIVECNT) { 1240 printf (SPP_FMT "loopback\n", 1241 SPP_ARGS(ifp)); 1242 sp->pp_loopcnt = 0; 1243 if (ifp->if_flags & IFF_UP) { 1244 if_down(ifp); 1245 IF_PURGE(&sp->pp_cpq); 1246 } 1247 } 1248 ++sp->pp_loopcnt; 1249 1250 /* Generate new local sequence number */ 1251 sp->pp_seq[IDX_LCP] = random(); 1252 break; 1253 } 1254 sp->pp_loopcnt = 0; 1255 if (! (ifp->if_flags & IFF_UP) && 1256 (ifp->if_flags & IFF_RUNNING)) { 1257 if_up(ifp); 1258 } 1259 break; 1260 case CISCO_ADDR_REQ: 1261 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1262 if (me != 0L) 1263 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1264 break; 1265 } 1266 } 1267 1268 /* 1269 * Send Cisco keepalive packet. 1270 */ 1271 static void 1272 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1273 { 1274 STDDCL; 1275 struct ppp_header *h; 1276 struct cisco_packet *ch; 1277 struct mbuf *m; 1278 u_int32_t t = (time.tv_sec - boottime.tv_sec) * 1000; 1279 1280 MGETHDR(m, M_DONTWAIT, MT_DATA); 1281 if (! m) 1282 return; 1283 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1284 m->m_pkthdr.rcvif = 0; 1285 1286 h = mtod(m, struct ppp_header *); 1287 h->address = CISCO_MULTICAST; 1288 h->control = 0; 1289 h->protocol = htons(CISCO_KEEPALIVE); 1290 1291 ch = (struct cisco_packet *)(h + 1); 1292 ch->type = htonl(type); 1293 ch->par1 = htonl(par1); 1294 ch->par2 = htonl(par2); 1295 ch->rel = -1; 1296 1297 ch->time0 = htons((u_short)(t >> 16)); 1298 ch->time1 = htons((u_short) t); 1299 1300 if (debug) 1301 log(LOG_DEBUG, 1302 SPP_FMT "cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1303 SPP_ARGS(ifp), ntohl (ch->type), ch->par1, 1304 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1305 (u_int)ch->time1); 1306 1307 if (IF_QFULL(&sp->pp_cpq)) { 1308 IF_DROP(&sp->pp_fastq); 1309 IF_DROP(&ifp->if_snd); 1310 m_freem(m); 1311 ++ifp->if_oerrors; 1312 return; 1313 } else 1314 IF_ENQUEUE(&sp->pp_cpq, m); 1315 if (! (ifp->if_flags & IFF_OACTIVE)) 1316 (*ifp->if_start)(ifp); 1317 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1318 } 1319 1320 /* 1321 * PPP protocol implementation. 1322 */ 1323 1324 /* 1325 * Send PPP control protocol packet. 1326 */ 1327 static void 1328 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1329 u_char ident, u_short len, void *data) 1330 { 1331 STDDCL; 1332 struct lcp_header *lh; 1333 struct mbuf *m; 1334 size_t pkthdrlen; 1335 1336 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1337 1338 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1339 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1340 MGETHDR(m, M_DONTWAIT, MT_DATA); 1341 if (! m) 1342 return; 1343 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1344 m->m_pkthdr.rcvif = 0; 1345 1346 if (sp->pp_flags & PP_NOFRAMING) { 1347 *mtod(m, u_int16_t *) = htons(proto); 1348 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1349 } else { 1350 struct ppp_header *h; 1351 h = mtod(m, struct ppp_header *); 1352 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1353 h->control = PPP_UI; /* Unnumbered Info */ 1354 h->protocol = htons(proto); /* Link Control Protocol */ 1355 lh = (struct lcp_header *)(h + 1); 1356 } 1357 lh->type = type; 1358 lh->ident = ident; 1359 lh->len = htons(LCP_HEADER_LEN + len); 1360 if (len) 1361 bcopy (data, lh + 1, len); 1362 1363 if (debug) { 1364 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1365 SPP_ARGS(ifp), 1366 sppp_proto_name(proto), 1367 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1368 if (len) 1369 sppp_print_bytes((u_char *)(lh + 1), len); 1370 addlog(">\n"); 1371 } 1372 if (IF_QFULL(&sp->pp_cpq)) { 1373 IF_DROP(&sp->pp_fastq); 1374 IF_DROP(&ifp->if_snd); 1375 m_freem(m); 1376 ++ifp->if_oerrors; 1377 return; 1378 } else 1379 IF_ENQUEUE(&sp->pp_cpq, m); 1380 if (! (ifp->if_flags & IFF_OACTIVE)) 1381 (*ifp->if_start)(ifp); 1382 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1383 } 1384 1385 /* 1386 * Handle incoming PPP control protocol packets. 1387 */ 1388 static void 1389 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1390 { 1391 STDDCL; 1392 struct lcp_header *h; 1393 int len = m->m_pkthdr.len; 1394 int rv; 1395 u_char *p; 1396 u_int32_t u32; 1397 1398 if (len < 4) { 1399 if (debug) 1400 log(LOG_DEBUG, 1401 SPP_FMT "%s invalid packet length: %d bytes\n", 1402 SPP_ARGS(ifp), cp->name, len); 1403 return; 1404 } 1405 h = mtod(m, struct lcp_header *); 1406 if (debug) { 1407 log(LOG_DEBUG, 1408 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1409 SPP_ARGS(ifp), cp->name, 1410 sppp_state_name(sp->state[cp->protoidx]), 1411 sppp_cp_type_name(h->type), h->ident, ntohs(h->len)); 1412 if (len > 4) 1413 sppp_print_bytes((u_char *)(h + 1), len - 4); 1414 addlog(">\n"); 1415 } 1416 if (len > ntohs(h->len)) 1417 len = ntohs(h->len); 1418 p = (u_char *)(h + 1); 1419 switch (h->type) { 1420 case CONF_REQ: 1421 if (len < 4) { 1422 if (debug) 1423 addlog(SPP_FMT "%s invalid conf-req length %d\n", 1424 SPP_ARGS(ifp), cp->name, 1425 len); 1426 ++ifp->if_ierrors; 1427 break; 1428 } 1429 /* handle states where RCR doesn't get a SCA/SCN */ 1430 switch (sp->state[cp->protoidx]) { 1431 case STATE_CLOSING: 1432 case STATE_STOPPING: 1433 return; 1434 case STATE_CLOSED: 1435 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1436 0, 0); 1437 return; 1438 } 1439 rv = (cp->RCR)(sp, h, len); 1440 switch (sp->state[cp->protoidx]) { 1441 case STATE_OPENED: 1442 (cp->tld)(sp); 1443 (cp->scr)(sp); 1444 /* fall through... */ 1445 case STATE_ACK_SENT: 1446 case STATE_REQ_SENT: 1447 sppp_cp_change_state(cp, sp, rv? 1448 STATE_ACK_SENT: STATE_REQ_SENT); 1449 break; 1450 case STATE_STOPPED: 1451 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1452 (cp->scr)(sp); 1453 sppp_cp_change_state(cp, sp, rv? 1454 STATE_ACK_SENT: STATE_REQ_SENT); 1455 break; 1456 case STATE_ACK_RCVD: 1457 if (rv) { 1458 sppp_cp_change_state(cp, sp, STATE_OPENED); 1459 if (debug) 1460 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1461 SPP_ARGS(ifp), 1462 cp->name); 1463 (cp->tlu)(sp); 1464 } else 1465 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1466 break; 1467 default: 1468 printf(SPP_FMT "%s illegal %s in state %s\n", 1469 SPP_ARGS(ifp), cp->name, 1470 sppp_cp_type_name(h->type), 1471 sppp_state_name(sp->state[cp->protoidx])); 1472 ++ifp->if_ierrors; 1473 } 1474 break; 1475 case CONF_ACK: 1476 if (h->ident != sp->confid[cp->protoidx]) { 1477 if (debug) 1478 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1479 SPP_ARGS(ifp), cp->name, 1480 h->ident, sp->confid[cp->protoidx]); 1481 ++ifp->if_ierrors; 1482 break; 1483 } 1484 switch (sp->state[cp->protoidx]) { 1485 case STATE_CLOSED: 1486 case STATE_STOPPED: 1487 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1488 break; 1489 case STATE_CLOSING: 1490 case STATE_STOPPING: 1491 break; 1492 case STATE_REQ_SENT: 1493 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1494 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1495 break; 1496 case STATE_OPENED: 1497 (cp->tld)(sp); 1498 /* fall through */ 1499 case STATE_ACK_RCVD: 1500 (cp->scr)(sp); 1501 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1502 break; 1503 case STATE_ACK_SENT: 1504 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1505 sppp_cp_change_state(cp, sp, STATE_OPENED); 1506 if (debug) 1507 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1508 SPP_ARGS(ifp), cp->name); 1509 (cp->tlu)(sp); 1510 break; 1511 default: 1512 printf(SPP_FMT "%s illegal %s in state %s\n", 1513 SPP_ARGS(ifp), cp->name, 1514 sppp_cp_type_name(h->type), 1515 sppp_state_name(sp->state[cp->protoidx])); 1516 ++ifp->if_ierrors; 1517 } 1518 break; 1519 case CONF_NAK: 1520 case CONF_REJ: 1521 if (h->ident != sp->confid[cp->protoidx]) { 1522 if (debug) 1523 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1524 SPP_ARGS(ifp), cp->name, 1525 h->ident, sp->confid[cp->protoidx]); 1526 ++ifp->if_ierrors; 1527 break; 1528 } 1529 if (h->type == CONF_NAK) 1530 (cp->RCN_nak)(sp, h, len); 1531 else /* CONF_REJ */ 1532 (cp->RCN_rej)(sp, h, len); 1533 1534 switch (sp->state[cp->protoidx]) { 1535 case STATE_CLOSED: 1536 case STATE_STOPPED: 1537 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1538 break; 1539 case STATE_REQ_SENT: 1540 case STATE_ACK_SENT: 1541 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1542 (cp->scr)(sp); 1543 break; 1544 case STATE_OPENED: 1545 (cp->tld)(sp); 1546 /* fall through */ 1547 case STATE_ACK_RCVD: 1548 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1549 (cp->scr)(sp); 1550 break; 1551 case STATE_CLOSING: 1552 case STATE_STOPPING: 1553 break; 1554 default: 1555 printf(SPP_FMT "%s illegal %s in state %s\n", 1556 SPP_ARGS(ifp), cp->name, 1557 sppp_cp_type_name(h->type), 1558 sppp_state_name(sp->state[cp->protoidx])); 1559 ++ifp->if_ierrors; 1560 } 1561 break; 1562 1563 case TERM_REQ: 1564 switch (sp->state[cp->protoidx]) { 1565 case STATE_ACK_RCVD: 1566 case STATE_ACK_SENT: 1567 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1568 /* fall through */ 1569 case STATE_CLOSED: 1570 case STATE_STOPPED: 1571 case STATE_CLOSING: 1572 case STATE_STOPPING: 1573 case STATE_REQ_SENT: 1574 sta: 1575 /* Send Terminate-Ack packet. */ 1576 if (debug) 1577 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1578 SPP_ARGS(ifp), cp->name); 1579 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1580 break; 1581 case STATE_OPENED: 1582 (cp->tld)(sp); 1583 sp->rst_counter[cp->protoidx] = 0; 1584 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1585 goto sta; 1586 break; 1587 default: 1588 printf(SPP_FMT "%s illegal %s in state %s\n", 1589 SPP_ARGS(ifp), cp->name, 1590 sppp_cp_type_name(h->type), 1591 sppp_state_name(sp->state[cp->protoidx])); 1592 ++ifp->if_ierrors; 1593 } 1594 break; 1595 case TERM_ACK: 1596 switch (sp->state[cp->protoidx]) { 1597 case STATE_CLOSED: 1598 case STATE_STOPPED: 1599 case STATE_REQ_SENT: 1600 case STATE_ACK_SENT: 1601 break; 1602 case STATE_CLOSING: 1603 (cp->tlf)(sp); 1604 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1605 sppp_lcp_check_and_close(sp); 1606 break; 1607 case STATE_STOPPING: 1608 (cp->tlf)(sp); 1609 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1610 sppp_lcp_check_and_close(sp); 1611 break; 1612 case STATE_ACK_RCVD: 1613 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1614 break; 1615 case STATE_OPENED: 1616 (cp->tld)(sp); 1617 (cp->scr)(sp); 1618 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1619 break; 1620 default: 1621 printf(SPP_FMT "%s illegal %s in state %s\n", 1622 SPP_ARGS(ifp), cp->name, 1623 sppp_cp_type_name(h->type), 1624 sppp_state_name(sp->state[cp->protoidx])); 1625 ++ifp->if_ierrors; 1626 } 1627 break; 1628 case CODE_REJ: 1629 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1630 log(LOG_INFO, 1631 SPP_FMT "%s: ignoring RXJ (%s) for code ?, " 1632 "danger will robinson\n", 1633 SPP_ARGS(ifp), cp->name, 1634 sppp_cp_type_name(h->type)); 1635 switch (sp->state[cp->protoidx]) { 1636 case STATE_CLOSED: 1637 case STATE_STOPPED: 1638 case STATE_REQ_SENT: 1639 case STATE_ACK_SENT: 1640 case STATE_CLOSING: 1641 case STATE_STOPPING: 1642 case STATE_OPENED: 1643 break; 1644 case STATE_ACK_RCVD: 1645 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1646 break; 1647 default: 1648 printf(SPP_FMT "%s illegal %s in state %s\n", 1649 SPP_ARGS(ifp), cp->name, 1650 sppp_cp_type_name(h->type), 1651 sppp_state_name(sp->state[cp->protoidx])); 1652 ++ifp->if_ierrors; 1653 } 1654 break; 1655 case PROTO_REJ: 1656 { 1657 int catastrophic; 1658 const struct cp *upper; 1659 int i; 1660 u_int16_t proto; 1661 1662 catastrophic = 0; 1663 upper = NULL; 1664 proto = p[0] << 8 | p[1]; 1665 for (i = 0; i < IDX_COUNT; i++) { 1666 if (cps[i]->proto == proto) { 1667 upper = cps[i]; 1668 break; 1669 } 1670 } 1671 if (upper == NULL) 1672 catastrophic++; 1673 1674 if (debug) 1675 log(LOG_INFO, 1676 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1677 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1678 sppp_cp_type_name(h->type), proto, 1679 upper ? upper->name : "unknown", 1680 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1681 1682 /* 1683 * if we got RXJ+ against conf-req, the peer does not implement 1684 * this particular protocol type. terminate the protocol. 1685 */ 1686 if (upper && !catastrophic) { 1687 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1688 upper->Close(sp); 1689 break; 1690 } 1691 } 1692 1693 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1694 switch (sp->state[cp->protoidx]) { 1695 case STATE_CLOSED: 1696 case STATE_STOPPED: 1697 case STATE_REQ_SENT: 1698 case STATE_ACK_SENT: 1699 case STATE_CLOSING: 1700 case STATE_STOPPING: 1701 case STATE_OPENED: 1702 break; 1703 case STATE_ACK_RCVD: 1704 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1705 break; 1706 default: 1707 printf(SPP_FMT "%s illegal %s in state %s\n", 1708 SPP_ARGS(ifp), cp->name, 1709 sppp_cp_type_name(h->type), 1710 sppp_state_name(sp->state[cp->protoidx])); 1711 ++ifp->if_ierrors; 1712 } 1713 break; 1714 } 1715 case DISC_REQ: 1716 if (cp->proto != PPP_LCP) 1717 goto illegal; 1718 /* Discard the packet. */ 1719 break; 1720 case ECHO_REQ: 1721 if (cp->proto != PPP_LCP) 1722 goto illegal; 1723 if (sp->state[cp->protoidx] != STATE_OPENED) { 1724 if (debug) 1725 addlog(SPP_FMT "lcp echo req but lcp closed\n", 1726 SPP_ARGS(ifp)); 1727 ++ifp->if_ierrors; 1728 break; 1729 } 1730 if (len < 8) { 1731 if (debug) 1732 addlog(SPP_FMT "invalid lcp echo request " 1733 "packet length: %d bytes\n", 1734 SPP_ARGS(ifp), len); 1735 break; 1736 } 1737 memcpy(&u32, h + 1, sizeof u32); 1738 if (ntohl(u32) == sp->lcp.magic) { 1739 /* Line loopback mode detected. */ 1740 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1741 if_down(ifp); 1742 IF_PURGE(&sp->pp_cpq); 1743 1744 /* Shut down the PPP link. */ 1745 /* XXX */ 1746 lcp.Down(sp); 1747 lcp.Up(sp); 1748 break; 1749 } 1750 u32 = htonl(sp->lcp.magic); 1751 memcpy(h + 1, &u32, sizeof u32); 1752 if (debug) 1753 addlog(SPP_FMT "got lcp echo req, sending echo rep\n", 1754 SPP_ARGS(ifp)); 1755 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1756 h + 1); 1757 break; 1758 case ECHO_REPLY: 1759 if (cp->proto != PPP_LCP) 1760 goto illegal; 1761 if (h->ident != sp->lcp.echoid) { 1762 ++ifp->if_ierrors; 1763 break; 1764 } 1765 if (len < 8) { 1766 if (debug) 1767 addlog(SPP_FMT "lcp invalid echo reply " 1768 "packet length: %d bytes\n", 1769 SPP_ARGS(ifp), len); 1770 break; 1771 } 1772 if (debug) 1773 addlog(SPP_FMT "lcp got echo rep\n", 1774 SPP_ARGS(ifp)); 1775 memcpy(&u32, h + 1, sizeof u32); 1776 if (ntohl(u32) != sp->lcp.magic) 1777 sp->pp_alivecnt = 0; 1778 break; 1779 default: 1780 /* Unknown packet type -- send Code-Reject packet. */ 1781 illegal: 1782 if (debug) 1783 addlog(SPP_FMT "%s send code-rej for 0x%x\n", 1784 SPP_ARGS(ifp), cp->name, h->type); 1785 sppp_cp_send(sp, cp->proto, CODE_REJ, 1786 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1787 ++ifp->if_ierrors; 1788 } 1789 } 1790 1791 1792 /* 1793 * The generic part of all Up/Down/Open/Close/TO event handlers. 1794 * Basically, the state transition handling in the automaton. 1795 */ 1796 static void 1797 sppp_up_event(const struct cp *cp, struct sppp *sp) 1798 { 1799 STDDCL; 1800 1801 if (debug) 1802 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1803 SPP_ARGS(ifp), cp->name, 1804 sppp_state_name(sp->state[cp->protoidx])); 1805 1806 switch (sp->state[cp->protoidx]) { 1807 case STATE_INITIAL: 1808 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1809 break; 1810 case STATE_STARTING: 1811 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1812 (cp->scr)(sp); 1813 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1814 break; 1815 default: 1816 printf(SPP_FMT "%s illegal up in state %s\n", 1817 SPP_ARGS(ifp), cp->name, 1818 sppp_state_name(sp->state[cp->protoidx])); 1819 } 1820 } 1821 1822 static void 1823 sppp_down_event(const struct cp *cp, struct sppp *sp) 1824 { 1825 STDDCL; 1826 1827 if (debug) 1828 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1829 SPP_ARGS(ifp), cp->name, 1830 sppp_state_name(sp->state[cp->protoidx])); 1831 1832 switch (sp->state[cp->protoidx]) { 1833 case STATE_CLOSED: 1834 case STATE_CLOSING: 1835 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1836 break; 1837 case STATE_STOPPED: 1838 (cp->tls)(sp); 1839 /* fall through */ 1840 case STATE_STOPPING: 1841 case STATE_REQ_SENT: 1842 case STATE_ACK_RCVD: 1843 case STATE_ACK_SENT: 1844 sppp_cp_change_state(cp, sp, STATE_STARTING); 1845 break; 1846 case STATE_OPENED: 1847 (cp->tld)(sp); 1848 sppp_cp_change_state(cp, sp, STATE_STARTING); 1849 break; 1850 default: 1851 printf(SPP_FMT "%s illegal down in state %s\n", 1852 SPP_ARGS(ifp), cp->name, 1853 sppp_state_name(sp->state[cp->protoidx])); 1854 } 1855 } 1856 1857 1858 static void 1859 sppp_open_event(const struct cp *cp, struct sppp *sp) 1860 { 1861 STDDCL; 1862 1863 if (debug) 1864 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1865 SPP_ARGS(ifp), cp->name, 1866 sppp_state_name(sp->state[cp->protoidx])); 1867 1868 switch (sp->state[cp->protoidx]) { 1869 case STATE_INITIAL: 1870 (cp->tls)(sp); 1871 sppp_cp_change_state(cp, sp, STATE_STARTING); 1872 break; 1873 case STATE_STARTING: 1874 break; 1875 case STATE_CLOSED: 1876 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1877 (cp->scr)(sp); 1878 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1879 break; 1880 case STATE_STOPPED: 1881 case STATE_STOPPING: 1882 case STATE_REQ_SENT: 1883 case STATE_ACK_RCVD: 1884 case STATE_ACK_SENT: 1885 case STATE_OPENED: 1886 break; 1887 case STATE_CLOSING: 1888 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1889 break; 1890 } 1891 } 1892 1893 1894 static void 1895 sppp_close_event(const struct cp *cp, struct sppp *sp) 1896 { 1897 STDDCL; 1898 1899 if (debug) 1900 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1901 SPP_ARGS(ifp), cp->name, 1902 sppp_state_name(sp->state[cp->protoidx])); 1903 1904 switch (sp->state[cp->protoidx]) { 1905 case STATE_INITIAL: 1906 case STATE_CLOSED: 1907 case STATE_CLOSING: 1908 break; 1909 case STATE_STARTING: 1910 (cp->tlf)(sp); 1911 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1912 break; 1913 case STATE_STOPPED: 1914 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1915 break; 1916 case STATE_STOPPING: 1917 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1918 break; 1919 case STATE_OPENED: 1920 (cp->tld)(sp); 1921 /* fall through */ 1922 case STATE_REQ_SENT: 1923 case STATE_ACK_RCVD: 1924 case STATE_ACK_SENT: 1925 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1926 sppp_cp_send(sp, cp->proto, TERM_REQ, 1927 ++sp->pp_seq[cp->protoidx], 0, 0); 1928 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1929 break; 1930 } 1931 } 1932 1933 static void 1934 sppp_to_event(const struct cp *cp, struct sppp *sp) 1935 { 1936 STDDCL; 1937 int s; 1938 1939 s = splnet(); 1940 if (debug) 1941 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 1942 SPP_ARGS(ifp), cp->name, 1943 sppp_state_name(sp->state[cp->protoidx]), 1944 sp->rst_counter[cp->protoidx]); 1945 1946 if (--sp->rst_counter[cp->protoidx] < 0) 1947 /* TO- event */ 1948 switch (sp->state[cp->protoidx]) { 1949 case STATE_CLOSING: 1950 (cp->tlf)(sp); 1951 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1952 sppp_lcp_check_and_close(sp); 1953 break; 1954 case STATE_STOPPING: 1955 (cp->tlf)(sp); 1956 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1957 sppp_lcp_check_and_close(sp); 1958 break; 1959 case STATE_REQ_SENT: 1960 case STATE_ACK_RCVD: 1961 case STATE_ACK_SENT: 1962 (cp->tlf)(sp); 1963 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1964 sppp_lcp_check_and_close(sp); 1965 break; 1966 } 1967 else 1968 /* TO+ event */ 1969 switch (sp->state[cp->protoidx]) { 1970 case STATE_CLOSING: 1971 case STATE_STOPPING: 1972 sppp_cp_send(sp, cp->proto, TERM_REQ, 1973 ++sp->pp_seq[cp->protoidx], 0, 0); 1974 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1975 cp->TO, sp); 1976 break; 1977 case STATE_REQ_SENT: 1978 case STATE_ACK_RCVD: 1979 (cp->scr)(sp); 1980 /* sppp_cp_change_state() will restart the timer */ 1981 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1982 break; 1983 case STATE_ACK_SENT: 1984 (cp->scr)(sp); 1985 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1986 cp->TO, sp); 1987 break; 1988 } 1989 1990 splx(s); 1991 } 1992 1993 /* 1994 * Change the state of a control protocol in the state automaton. 1995 * Takes care of starting/stopping the restart timer. 1996 */ 1997 void 1998 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1999 { 2000 sp->state[cp->protoidx] = newstate; 2001 callout_stop(&sp->ch[cp->protoidx]); 2002 switch (newstate) { 2003 case STATE_INITIAL: 2004 case STATE_STARTING: 2005 case STATE_CLOSED: 2006 case STATE_STOPPED: 2007 case STATE_OPENED: 2008 break; 2009 case STATE_CLOSING: 2010 case STATE_STOPPING: 2011 case STATE_REQ_SENT: 2012 case STATE_ACK_RCVD: 2013 case STATE_ACK_SENT: 2014 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2015 cp->TO, sp); 2016 break; 2017 } 2018 } 2019 2020 /* 2021 *--------------------------------------------------------------------------* 2022 * * 2023 * The LCP implementation. * 2024 * * 2025 *--------------------------------------------------------------------------* 2026 */ 2027 static void 2028 sppp_lcp_init(struct sppp *sp) 2029 { 2030 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2031 sp->lcp.magic = 0; 2032 sp->state[IDX_LCP] = STATE_INITIAL; 2033 sp->fail_counter[IDX_LCP] = 0; 2034 sp->pp_seq[IDX_LCP] = 0; 2035 sp->pp_rseq[IDX_LCP] = 0; 2036 sp->lcp.protos = 0; 2037 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2038 2039 /* 2040 * Initialize counters and timeout values. Note that we don't 2041 * use the 3 seconds suggested in RFC 1661 since we are likely 2042 * running on a fast link. XXX We should probably implement 2043 * the exponential backoff option. Note that these values are 2044 * relevant for all control protocols, not just LCP only. 2045 */ 2046 sp->lcp.timeout = 1 * hz; 2047 sp->lcp.max_terminate = 2; 2048 sp->lcp.max_configure = 10; 2049 sp->lcp.max_failure = 10; 2050 callout_init(&sp->ch[IDX_LCP]); 2051 } 2052 2053 static void 2054 sppp_lcp_up(struct sppp *sp) 2055 { 2056 STDDCL; 2057 2058 /* Initialize activity timestamp: opening a connection is an activity */ 2059 sp->pp_last_activity = mono_time.tv_sec; 2060 2061 /* 2062 * If this interface is passive or dial-on-demand, and we are 2063 * still in Initial state, it means we've got an incoming 2064 * call. Activate the interface. 2065 */ 2066 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2067 if (debug) 2068 log(LOG_DEBUG, 2069 SPP_FMT "Up event", SPP_ARGS(ifp)); 2070 ifp->if_flags |= IFF_RUNNING; 2071 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2072 if (debug) 2073 addlog("(incoming call)\n"); 2074 sp->pp_flags |= PP_CALLIN; 2075 lcp.Open(sp); 2076 } else if (debug) 2077 addlog("\n"); 2078 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2079 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2080 ifp->if_flags |= IFF_RUNNING; 2081 lcp.Open(sp); 2082 } 2083 2084 sppp_up_event(&lcp, sp); 2085 } 2086 2087 static void 2088 sppp_lcp_down(struct sppp *sp) 2089 { 2090 STDDCL; 2091 2092 sppp_down_event(&lcp, sp); 2093 2094 /* 2095 * If this is neither a dial-on-demand nor a passive 2096 * interface, simulate an ``ifconfig down'' action, so the 2097 * administrator can force a redial by another ``ifconfig 2098 * up''. XXX For leased line operation, should we immediately 2099 * try to reopen the connection here? 2100 */ 2101 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2102 if (debug) 2103 log(LOG_INFO, 2104 SPP_FMT "Down event (carrier loss), taking interface down.\n", 2105 SPP_ARGS(ifp)); 2106 if_down(ifp); 2107 } else { 2108 if (debug) 2109 log(LOG_DEBUG, 2110 SPP_FMT "Down event (carrier loss)\n", 2111 SPP_ARGS(ifp)); 2112 } 2113 sp->pp_flags &= ~PP_CALLIN; 2114 if (sp->state[IDX_LCP] != STATE_INITIAL) 2115 lcp.Close(sp); 2116 ifp->if_flags &= ~IFF_RUNNING; 2117 } 2118 2119 static void 2120 sppp_lcp_open(struct sppp *sp) 2121 { 2122 /* 2123 * If we are authenticator, negotiate LCP_AUTH 2124 */ 2125 if (sp->hisauth.proto != 0) 2126 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2127 else 2128 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2129 sp->pp_flags &= ~PP_NEEDAUTH; 2130 sppp_open_event(&lcp, sp); 2131 } 2132 2133 static void 2134 sppp_lcp_close(struct sppp *sp) 2135 { 2136 sppp_close_event(&lcp, sp); 2137 } 2138 2139 static void 2140 sppp_lcp_TO(void *cookie) 2141 { 2142 sppp_to_event(&lcp, (struct sppp *)cookie); 2143 } 2144 2145 /* 2146 * Analyze a configure request. Return true if it was agreeable, and 2147 * caused action sca, false if it has been rejected or nak'ed, and 2148 * caused action scn. (The return value is used to make the state 2149 * transition decision in the state automaton.) 2150 */ 2151 static int 2152 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2153 { 2154 STDDCL; 2155 u_char *buf, *r, *p; 2156 int origlen, rlen; 2157 u_int32_t nmagic; 2158 u_short authproto; 2159 2160 len -= 4; 2161 origlen = len; 2162 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2163 if (! buf) 2164 return (0); 2165 2166 if (debug) 2167 log(LOG_DEBUG, SPP_FMT "lcp parse opts:", 2168 SPP_ARGS(ifp)); 2169 2170 /* pass 1: check for things that need to be rejected */ 2171 p = (void *)(h + 1); 2172 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2173 if (debug) 2174 addlog(" %s", sppp_lcp_opt_name(*p)); 2175 switch (*p) { 2176 case LCP_OPT_MAGIC: 2177 /* Magic number. */ 2178 /* fall through, both are same length */ 2179 case LCP_OPT_ASYNC_MAP: 2180 /* Async control character map. */ 2181 if (len >= 6 || p[1] == 6) 2182 continue; 2183 if (debug) 2184 addlog(" [invalid]"); 2185 break; 2186 case LCP_OPT_MRU: 2187 /* Maximum receive unit. */ 2188 if (len >= 4 && p[1] == 4) 2189 continue; 2190 if (debug) 2191 addlog(" [invalid]"); 2192 break; 2193 case LCP_OPT_AUTH_PROTO: 2194 if (len < 4) { 2195 if (debug) 2196 addlog(" [invalid]"); 2197 break; 2198 } 2199 authproto = (p[2] << 8) + p[3]; 2200 if (authproto == PPP_CHAP && p[1] != 5) { 2201 if (debug) 2202 addlog(" [invalid chap len]"); 2203 break; 2204 } 2205 if (sp->myauth.proto == 0) { 2206 /* we are not configured to do auth */ 2207 if (debug) 2208 addlog(" [not configured]"); 2209 break; 2210 } 2211 /* 2212 * Remote want us to authenticate, remember this, 2213 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2214 * up. 2215 */ 2216 sp->pp_flags |= PP_NEEDAUTH; 2217 continue; 2218 default: 2219 /* Others not supported. */ 2220 if (debug) 2221 addlog(" [rej]"); 2222 break; 2223 } 2224 /* Add the option to rejected list. */ 2225 bcopy (p, r, p[1]); 2226 r += p[1]; 2227 rlen += p[1]; 2228 } 2229 if (rlen) { 2230 if (debug) 2231 addlog(" send conf-rej\n"); 2232 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2233 goto end; 2234 } else if (debug) 2235 addlog("\n"); 2236 2237 /* 2238 * pass 2: check for option values that are unacceptable and 2239 * thus require to be nak'ed. 2240 */ 2241 if (debug) 2242 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2243 SPP_ARGS(ifp)); 2244 2245 p = (void *)(h + 1); 2246 len = origlen; 2247 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2248 if (debug) 2249 addlog(" %s", sppp_lcp_opt_name(*p)); 2250 switch (*p) { 2251 case LCP_OPT_MAGIC: 2252 /* Magic number -- extract. */ 2253 nmagic = (u_int32_t)p[2] << 24 | 2254 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2255 if (nmagic != sp->lcp.magic) { 2256 if (debug) 2257 addlog(" 0x%x", nmagic); 2258 continue; 2259 } 2260 /* 2261 * Local and remote magics equal -- loopback? 2262 */ 2263 if (sp->pp_loopcnt >= MAXALIVECNT*5) { 2264 printf (SPP_FMT "loopback\n", 2265 SPP_ARGS(ifp)); 2266 sp->pp_loopcnt = 0; 2267 if (ifp->if_flags & IFF_UP) { 2268 if_down(ifp); 2269 IF_PURGE(&sp->pp_cpq); 2270 /* XXX ? */ 2271 lcp.Down(sp); 2272 lcp.Up(sp); 2273 } 2274 } else if (debug) 2275 addlog(" [glitch]"); 2276 ++sp->pp_loopcnt; 2277 /* 2278 * We negate our magic here, and NAK it. If 2279 * we see it later in an NAK packet, we 2280 * suggest a new one. 2281 */ 2282 nmagic = ~sp->lcp.magic; 2283 /* Gonna NAK it. */ 2284 p[2] = nmagic >> 24; 2285 p[3] = nmagic >> 16; 2286 p[4] = nmagic >> 8; 2287 p[5] = nmagic; 2288 break; 2289 2290 case LCP_OPT_ASYNC_MAP: 2291 /* 2292 * Async control character map -- just ignore it. 2293 * 2294 * Quote from RFC 1662, chapter 6: 2295 * To enable this functionality, synchronous PPP 2296 * implementations MUST always respond to the 2297 * Async-Control-Character-Map Configuration 2298 * Option with the LCP Configure-Ack. However, 2299 * acceptance of the Configuration Option does 2300 * not imply that the synchronous implementation 2301 * will do any ACCM mapping. Instead, all such 2302 * octet mapping will be performed by the 2303 * asynchronous-to-synchronous converter. 2304 */ 2305 continue; 2306 2307 case LCP_OPT_MRU: 2308 /* 2309 * Maximum receive unit. Always agreeable, 2310 * but ignored by now. 2311 */ 2312 sp->lcp.their_mru = p[2] * 256 + p[3]; 2313 if (debug) 2314 addlog(" %ld", sp->lcp.their_mru); 2315 continue; 2316 2317 case LCP_OPT_AUTH_PROTO: 2318 authproto = (p[2] << 8) + p[3]; 2319 if (sp->myauth.proto != authproto) { 2320 /* not agreed, nak */ 2321 if (debug) 2322 addlog(" [mine %s != his %s]", 2323 sppp_proto_name(sp->hisauth.proto), 2324 sppp_proto_name(authproto)); 2325 p[2] = sp->myauth.proto >> 8; 2326 p[3] = sp->myauth.proto; 2327 break; 2328 } 2329 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2330 if (debug) 2331 addlog(" [chap not MD5]"); 2332 p[4] = CHAP_MD5; 2333 break; 2334 } 2335 continue; 2336 } 2337 /* Add the option to nak'ed list. */ 2338 bcopy (p, r, p[1]); 2339 r += p[1]; 2340 rlen += p[1]; 2341 } 2342 if (rlen) { 2343 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2344 if (debug) 2345 addlog(" max_failure (%d) exceeded, " 2346 "send conf-rej\n", 2347 sp->lcp.max_failure); 2348 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2349 } else { 2350 if (debug) 2351 addlog(" send conf-nak\n"); 2352 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2353 } 2354 goto end; 2355 } else { 2356 if (debug) 2357 addlog(" send conf-ack\n"); 2358 sp->fail_counter[IDX_LCP] = 0; 2359 sp->pp_loopcnt = 0; 2360 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2361 } 2362 2363 end: 2364 free(buf, M_TEMP); 2365 return (rlen == 0); 2366 } 2367 2368 /* 2369 * Analyze the LCP Configure-Reject option list, and adjust our 2370 * negotiation. 2371 */ 2372 static void 2373 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2374 { 2375 STDDCL; 2376 u_char *buf, *p; 2377 2378 len -= 4; 2379 buf = malloc (len, M_TEMP, M_NOWAIT); 2380 if (!buf) 2381 return; 2382 2383 if (debug) 2384 log(LOG_DEBUG, SPP_FMT "lcp rej opts:", 2385 SPP_ARGS(ifp)); 2386 2387 p = (void *)(h + 1); 2388 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2389 if (debug) 2390 addlog(" %s", sppp_lcp_opt_name(*p)); 2391 switch (*p) { 2392 case LCP_OPT_MAGIC: 2393 /* Magic number -- can't use it, use 0 */ 2394 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2395 sp->lcp.magic = 0; 2396 break; 2397 case LCP_OPT_MRU: 2398 /* 2399 * Should not be rejected anyway, since we only 2400 * negotiate a MRU if explicitly requested by 2401 * peer. 2402 */ 2403 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2404 break; 2405 case LCP_OPT_AUTH_PROTO: 2406 /* 2407 * Peer doesn't want to authenticate himself, 2408 * deny unless this is a dialout call, and 2409 * SPPP_AUTHFLAG_NOCALLOUT is set. 2410 */ 2411 if ((sp->pp_flags & PP_CALLIN) == 0 && 2412 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2413 if (debug) 2414 addlog(" [don't insist on auth " 2415 "for callout]"); 2416 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2417 break; 2418 } 2419 if (debug) 2420 addlog("[access denied]\n"); 2421 lcp.Close(sp); 2422 break; 2423 } 2424 } 2425 if (debug) 2426 addlog("\n"); 2427 free(buf, M_TEMP); 2428 return; 2429 } 2430 2431 /* 2432 * Analyze the LCP Configure-NAK option list, and adjust our 2433 * negotiation. 2434 */ 2435 static void 2436 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2437 { 2438 STDDCL; 2439 u_char *buf, *p; 2440 u_int32_t magic; 2441 2442 len -= 4; 2443 buf = malloc (len, M_TEMP, M_NOWAIT); 2444 if (!buf) 2445 return; 2446 2447 if (debug) 2448 log(LOG_DEBUG, SPP_FMT "lcp nak opts:", 2449 SPP_ARGS(ifp)); 2450 2451 p = (void *)(h + 1); 2452 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2453 if (debug) 2454 addlog(" %s", sppp_lcp_opt_name(*p)); 2455 switch (*p) { 2456 case LCP_OPT_MAGIC: 2457 /* Magic number -- renegotiate */ 2458 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2459 len >= 6 && p[1] == 6) { 2460 magic = (u_int32_t)p[2] << 24 | 2461 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2462 /* 2463 * If the remote magic is our negated one, 2464 * this looks like a loopback problem. 2465 * Suggest a new magic to make sure. 2466 */ 2467 if (magic == ~sp->lcp.magic) { 2468 if (debug) 2469 addlog(" magic glitch"); 2470 sp->lcp.magic = random(); 2471 } else { 2472 sp->lcp.magic = magic; 2473 if (debug) 2474 addlog(" %d", magic); 2475 } 2476 } 2477 break; 2478 case LCP_OPT_MRU: 2479 /* 2480 * Peer wants to advise us to negotiate an MRU. 2481 * Agree on it if it's reasonable, or use 2482 * default otherwise. 2483 */ 2484 if (len >= 4 && p[1] == 4) { 2485 u_int mru = p[2] * 256 + p[3]; 2486 if (debug) 2487 addlog(" %d", mru); 2488 if (mru < PP_MTU || mru > PP_MAX_MRU) 2489 mru = PP_MTU; 2490 sp->lcp.mru = mru; 2491 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2492 } 2493 break; 2494 case LCP_OPT_AUTH_PROTO: 2495 /* 2496 * Peer doesn't like our authentication method, 2497 * deny. 2498 */ 2499 if (debug) 2500 addlog("[access denied]\n"); 2501 lcp.Close(sp); 2502 break; 2503 } 2504 } 2505 if (debug) 2506 addlog("\n"); 2507 free(buf, M_TEMP); 2508 return; 2509 } 2510 2511 static void 2512 sppp_lcp_tlu(struct sppp *sp) 2513 { 2514 STDDCL; 2515 int i; 2516 u_int32_t mask; 2517 2518 /* XXX ? */ 2519 if (! (ifp->if_flags & IFF_UP) && 2520 (ifp->if_flags & IFF_RUNNING)) { 2521 /* Coming out of loopback mode. */ 2522 if_up(ifp); 2523 } 2524 2525 for (i = 0; i < IDX_COUNT; i++) 2526 if ((cps[i])->flags & CP_QUAL) 2527 (cps[i])->Open(sp); 2528 2529 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2530 (sp->pp_flags & PP_NEEDAUTH) != 0) 2531 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2532 else 2533 sp->pp_phase = SPPP_PHASE_NETWORK; 2534 2535 if(debug) 2536 { 2537 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2538 sppp_phase_name(sp->pp_phase)); 2539 } 2540 2541 /* 2542 * Open all authentication protocols. This is even required 2543 * if we already proceeded to network phase, since it might be 2544 * that remote wants us to authenticate, so we might have to 2545 * send a PAP request. Undesired authentication protocols 2546 * don't do anything when they get an Open event. 2547 */ 2548 for (i = 0; i < IDX_COUNT; i++) 2549 if ((cps[i])->flags & CP_AUTH) 2550 (cps[i])->Open(sp); 2551 2552 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2553 /* Notify all NCPs. */ 2554 for (i = 0; i < IDX_COUNT; i++) 2555 if ((cps[i])->flags & CP_NCP) 2556 (cps[i])->Open(sp); 2557 } 2558 2559 /* Send Up events to all started protos. */ 2560 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2561 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2562 (cps[i])->Up(sp); 2563 2564 /* notify low-level driver of state change */ 2565 if (sp->pp_chg) 2566 sp->pp_chg(sp, (int)sp->pp_phase); 2567 2568 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2569 /* if no NCP is starting, close down */ 2570 sppp_lcp_check_and_close(sp); 2571 } 2572 2573 static void 2574 sppp_lcp_tld(struct sppp *sp) 2575 { 2576 STDDCL; 2577 int i; 2578 u_int32_t mask; 2579 2580 sp->pp_phase = SPPP_PHASE_TERMINATE; 2581 2582 if(debug) 2583 { 2584 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2585 sppp_phase_name(sp->pp_phase)); 2586 } 2587 2588 /* 2589 * Take upper layers down. We send the Down event first and 2590 * the Close second to prevent the upper layers from sending 2591 * ``a flurry of terminate-request packets'', as the RFC 2592 * describes it. 2593 */ 2594 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2595 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2596 (cps[i])->Down(sp); 2597 (cps[i])->Close(sp); 2598 } 2599 } 2600 2601 static void 2602 sppp_lcp_tls(struct sppp *sp) 2603 { 2604 STDDCL; 2605 2606 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2607 printf("%s: authentication failed %d times, not retrying again\n", 2608 sp->pp_if.if_xname, sp->pp_auth_failures); 2609 if_down(&sp->pp_if); 2610 return; 2611 } 2612 2613 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2614 2615 if(debug) 2616 { 2617 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2618 sppp_phase_name(sp->pp_phase)); 2619 } 2620 2621 /* Notify lower layer if desired. */ 2622 if (sp->pp_tls) 2623 (sp->pp_tls)(sp); 2624 } 2625 2626 static void 2627 sppp_lcp_tlf(struct sppp *sp) 2628 { 2629 STDDCL; 2630 2631 sp->pp_phase = SPPP_PHASE_DEAD; 2632 2633 if(debug) 2634 { 2635 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2636 sppp_phase_name(sp->pp_phase)); 2637 } 2638 2639 /* Notify lower layer if desired. */ 2640 if (sp->pp_tlf) 2641 (sp->pp_tlf)(sp); 2642 } 2643 2644 static void 2645 sppp_lcp_scr(struct sppp *sp) 2646 { 2647 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2648 int i = 0; 2649 u_short authproto; 2650 2651 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2652 if (! sp->lcp.magic) 2653 sp->lcp.magic = random(); 2654 opt[i++] = LCP_OPT_MAGIC; 2655 opt[i++] = 6; 2656 opt[i++] = sp->lcp.magic >> 24; 2657 opt[i++] = sp->lcp.magic >> 16; 2658 opt[i++] = sp->lcp.magic >> 8; 2659 opt[i++] = sp->lcp.magic; 2660 } 2661 2662 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2663 opt[i++] = LCP_OPT_MRU; 2664 opt[i++] = 4; 2665 opt[i++] = sp->lcp.mru >> 8; 2666 opt[i++] = sp->lcp.mru; 2667 } 2668 2669 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2670 authproto = sp->hisauth.proto; 2671 opt[i++] = LCP_OPT_AUTH_PROTO; 2672 opt[i++] = authproto == PPP_CHAP? 5: 4; 2673 opt[i++] = authproto >> 8; 2674 opt[i++] = authproto; 2675 if (authproto == PPP_CHAP) 2676 opt[i++] = CHAP_MD5; 2677 } 2678 2679 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2680 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2681 } 2682 2683 /* 2684 * Check the open NCPs, return true if at least one NCP is open. 2685 */ 2686 static int 2687 sppp_ncp_check(struct sppp *sp) 2688 { 2689 int i, mask; 2690 2691 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2692 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2693 return 1; 2694 return 0; 2695 } 2696 2697 /* 2698 * Re-check the open NCPs and see if we should terminate the link. 2699 * Called by the NCPs during their tlf action handling. 2700 */ 2701 static void 2702 sppp_lcp_check_and_close(struct sppp *sp) 2703 { 2704 2705 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2706 /* don't bother, we are already going down */ 2707 return; 2708 2709 if (sppp_ncp_check(sp)) 2710 return; 2711 2712 lcp.Close(sp); 2713 } 2714 2715 2716 /* 2717 *--------------------------------------------------------------------------* 2718 * * 2719 * The IPCP implementation. * 2720 * * 2721 *--------------------------------------------------------------------------* 2722 */ 2723 2724 static void 2725 sppp_ipcp_init(struct sppp *sp) 2726 { 2727 sp->ipcp.opts = 0; 2728 sp->ipcp.flags = 0; 2729 sp->state[IDX_IPCP] = STATE_INITIAL; 2730 sp->fail_counter[IDX_IPCP] = 0; 2731 sp->pp_seq[IDX_IPCP] = 0; 2732 sp->pp_rseq[IDX_IPCP] = 0; 2733 callout_init(&sp->ch[IDX_IPCP]); 2734 } 2735 2736 static void 2737 sppp_ipcp_up(struct sppp *sp) 2738 { 2739 sppp_up_event(&ipcp, sp); 2740 } 2741 2742 static void 2743 sppp_ipcp_down(struct sppp *sp) 2744 { 2745 sppp_down_event(&ipcp, sp); 2746 } 2747 2748 static void 2749 sppp_ipcp_open(struct sppp *sp) 2750 { 2751 STDDCL; 2752 u_int32_t myaddr, hisaddr; 2753 2754 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2755 sp->ipcp.req_myaddr = 0; 2756 sp->ipcp.req_hisaddr = 0; 2757 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2758 2759 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2760 /* 2761 * If we don't have his address, this probably means our 2762 * interface doesn't want to talk IP at all. (This could 2763 * be the case if somebody wants to speak only IPX, for 2764 * example.) Don't open IPCP in this case. 2765 */ 2766 if (hisaddr == 0L) { 2767 /* XXX this message should go away */ 2768 if (debug) 2769 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 2770 SPP_ARGS(ifp)); 2771 return; 2772 } 2773 2774 if (myaddr == 0) { 2775 /* 2776 * I don't have an assigned address, so i need to 2777 * negotiate my address. 2778 */ 2779 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2780 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2781 } 2782 if (hisaddr == 1) { 2783 /* 2784 * XXX - remove this hack! 2785 * remote has no valid adress, we need to get one assigned. 2786 */ 2787 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2788 } 2789 sppp_open_event(&ipcp, sp); 2790 } 2791 2792 static void 2793 sppp_ipcp_close(struct sppp *sp) 2794 { 2795 sppp_close_event(&ipcp, sp); 2796 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2797 /* 2798 * Some address was dynamic, clear it again. 2799 */ 2800 sppp_clear_ip_addrs(sp); 2801 } 2802 2803 static void 2804 sppp_ipcp_TO(void *cookie) 2805 { 2806 sppp_to_event(&ipcp, (struct sppp *)cookie); 2807 } 2808 2809 /* 2810 * Analyze a configure request. Return true if it was agreeable, and 2811 * caused action sca, false if it has been rejected or nak'ed, and 2812 * caused action scn. (The return value is used to make the state 2813 * transition decision in the state automaton.) 2814 */ 2815 static int 2816 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2817 { 2818 u_char *buf, *r, *p; 2819 struct ifnet *ifp = &sp->pp_if; 2820 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2821 u_int32_t hisaddr, desiredaddr; 2822 2823 len -= 4; 2824 origlen = len; 2825 /* 2826 * Make sure to allocate a buf that can at least hold a 2827 * conf-nak with an `address' option. We might need it below. 2828 */ 2829 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2830 if (! buf) 2831 return (0); 2832 2833 /* pass 1: see if we can recognize them */ 2834 if (debug) 2835 log(LOG_DEBUG, SPP_FMT "ipcp parse opts:", 2836 SPP_ARGS(ifp)); 2837 p = (void *)(h + 1); 2838 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2839 if (debug) 2840 addlog(" %s", sppp_ipcp_opt_name(*p)); 2841 switch (*p) { 2842 #ifdef notyet 2843 case IPCP_OPT_COMPRESSION: 2844 if (len >= 6 && p[1] >= 6) { 2845 /* correctly formed compress option */ 2846 continue; 2847 } 2848 if (debug) 2849 addlog(" [invalid]"); 2850 break; 2851 #endif 2852 case IPCP_OPT_ADDRESS: 2853 if (len >= 6 && p[1] == 6) { 2854 /* correctly formed address option */ 2855 continue; 2856 } 2857 if (debug) 2858 addlog(" [invalid]"); 2859 break; 2860 default: 2861 /* Others not supported. */ 2862 if (debug) 2863 addlog(" [rej]"); 2864 break; 2865 } 2866 /* Add the option to rejected list. */ 2867 bcopy (p, r, p[1]); 2868 r += p[1]; 2869 rlen += p[1]; 2870 } 2871 if (rlen) { 2872 if (debug) 2873 addlog(" send conf-rej\n"); 2874 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2875 goto end; 2876 } else if (debug) 2877 addlog("\n"); 2878 2879 /* pass 2: parse option values */ 2880 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2881 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2882 else 2883 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2884 if (debug) 2885 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2886 SPP_ARGS(ifp)); 2887 p = (void *)(h + 1); 2888 len = origlen; 2889 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2890 if (debug) 2891 addlog(" %s", sppp_ipcp_opt_name(*p)); 2892 switch (*p) { 2893 #ifdef notyet 2894 case IPCP_OPT_COMPRESSION: 2895 continue; 2896 #endif 2897 case IPCP_OPT_ADDRESS: 2898 desiredaddr = p[2] << 24 | p[3] << 16 | 2899 p[4] << 8 | p[5]; 2900 if (desiredaddr == hisaddr || 2901 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2902 /* 2903 * Peer's address is same as our value, 2904 * this is agreeable. Gonna conf-ack 2905 * it. 2906 */ 2907 if (debug) 2908 addlog(" %s [ack]", 2909 sppp_dotted_quad(hisaddr)); 2910 /* record that we've seen it already */ 2911 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2912 sp->ipcp.req_hisaddr = desiredaddr; 2913 hisaddr = desiredaddr; 2914 continue; 2915 } 2916 /* 2917 * The address wasn't agreeable. This is either 2918 * he sent us 0.0.0.0, asking to assign him an 2919 * address, or he send us another address not 2920 * matching our value. Either case, we gonna 2921 * conf-nak it with our value. 2922 */ 2923 if (debug) { 2924 if (desiredaddr == 0) 2925 addlog(" [addr requested]"); 2926 else 2927 addlog(" %s [not agreed]", 2928 sppp_dotted_quad(desiredaddr)); 2929 } 2930 2931 p[2] = hisaddr >> 24; 2932 p[3] = hisaddr >> 16; 2933 p[4] = hisaddr >> 8; 2934 p[5] = hisaddr; 2935 break; 2936 } 2937 /* Add the option to nak'ed list. */ 2938 bcopy (p, r, p[1]); 2939 r += p[1]; 2940 rlen += p[1]; 2941 } 2942 2943 /* 2944 * If we are about to conf-ack the request, but haven't seen 2945 * his address so far, gonna conf-nak it instead, with the 2946 * `address' option present and our idea of his address being 2947 * filled in there, to request negotiation of both addresses. 2948 * 2949 * XXX This can result in an endless req - nak loop if peer 2950 * doesn't want to send us his address. Q: What should we do 2951 * about it? XXX A: implement the max-failure counter. 2952 */ 2953 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2954 buf[0] = IPCP_OPT_ADDRESS; 2955 buf[1] = 6; 2956 buf[2] = hisaddr >> 24; 2957 buf[3] = hisaddr >> 16; 2958 buf[4] = hisaddr >> 8; 2959 buf[5] = hisaddr; 2960 rlen = 6; 2961 if (debug) 2962 addlog(" still need hisaddr"); 2963 } 2964 2965 if (rlen) { 2966 if (debug) 2967 addlog(" send conf-nak\n"); 2968 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2969 } else { 2970 if (debug) 2971 addlog(" send conf-ack\n"); 2972 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 2973 } 2974 2975 end: 2976 free(buf, M_TEMP); 2977 return (rlen == 0); 2978 } 2979 2980 /* 2981 * Analyze the IPCP Configure-Reject option list, and adjust our 2982 * negotiation. 2983 */ 2984 static void 2985 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2986 { 2987 u_char *buf, *p; 2988 struct ifnet *ifp = &sp->pp_if; 2989 int debug = ifp->if_flags & IFF_DEBUG; 2990 2991 len -= 4; 2992 buf = malloc (len, M_TEMP, M_NOWAIT); 2993 if (!buf) 2994 return; 2995 2996 if (debug) 2997 log(LOG_DEBUG, SPP_FMT "ipcp rej opts:", 2998 SPP_ARGS(ifp)); 2999 3000 p = (void *)(h + 1); 3001 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3002 if (debug) 3003 addlog(" %s", sppp_ipcp_opt_name(*p)); 3004 switch (*p) { 3005 case IPCP_OPT_ADDRESS: 3006 /* 3007 * Peer doesn't grok address option. This is 3008 * bad. XXX Should we better give up here? 3009 */ 3010 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3011 break; 3012 #ifdef notyet 3013 case IPCP_OPT_COMPRESS: 3014 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3015 break; 3016 #endif 3017 } 3018 } 3019 if (debug) 3020 addlog("\n"); 3021 free(buf, M_TEMP); 3022 return; 3023 } 3024 3025 /* 3026 * Analyze the IPCP Configure-NAK option list, and adjust our 3027 * negotiation. 3028 */ 3029 static void 3030 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3031 { 3032 u_char *p; 3033 struct ifnet *ifp = &sp->pp_if; 3034 int debug = ifp->if_flags & IFF_DEBUG; 3035 u_int32_t wantaddr; 3036 3037 len -= 4; 3038 3039 if (debug) 3040 log(LOG_DEBUG, SPP_FMT "ipcp nak opts:", 3041 SPP_ARGS(ifp)); 3042 3043 p = (void *)(h + 1); 3044 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3045 if (debug) 3046 addlog(" %s", sppp_ipcp_opt_name(*p)); 3047 switch (*p) { 3048 case IPCP_OPT_ADDRESS: 3049 /* 3050 * Peer doesn't like our local IP address. See 3051 * if we can do something for him. We'll drop 3052 * him our address then. 3053 */ 3054 if (len >= 6 && p[1] == 6) { 3055 wantaddr = p[2] << 24 | p[3] << 16 | 3056 p[4] << 8 | p[5]; 3057 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3058 if (debug) 3059 addlog(" [wantaddr %s]", 3060 sppp_dotted_quad(wantaddr)); 3061 /* 3062 * When doing dynamic address assignment, 3063 * we accept his offer. Otherwise, we 3064 * ignore it and thus continue to negotiate 3065 * our already existing value. 3066 */ 3067 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3068 if (debug) 3069 addlog(" [agree]"); 3070 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3071 sp->ipcp.req_myaddr = wantaddr; 3072 } 3073 } 3074 break; 3075 3076 case IPCP_OPT_PRIMDNS: 3077 if (len >= 6 && p[1] == 6) { 3078 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3079 p[4] << 8 | p[5]; 3080 } 3081 break; 3082 3083 case IPCP_OPT_SECDNS: 3084 if (len >= 6 && p[1] == 6) { 3085 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3086 p[4] << 8 | p[5]; 3087 } 3088 break; 3089 #ifdef notyet 3090 case IPCP_OPT_COMPRESS: 3091 /* 3092 * Peer wants different compression parameters. 3093 */ 3094 break; 3095 #endif 3096 } 3097 } 3098 if (debug) 3099 addlog("\n"); 3100 return; 3101 } 3102 3103 static void 3104 sppp_ipcp_tlu(struct sppp *sp) 3105 { 3106 /* we are up. Set addresses and notify anyone interested */ 3107 u_int32_t myaddr, hisaddr; 3108 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3109 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3110 myaddr = sp->ipcp.req_myaddr; 3111 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3112 hisaddr = sp->ipcp.req_hisaddr; 3113 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3114 if (sp->pp_con) 3115 sp->pp_con(sp); 3116 } 3117 3118 static void 3119 sppp_ipcp_tld(struct sppp *sp) 3120 { 3121 } 3122 3123 static void 3124 sppp_ipcp_tls(struct sppp *sp) 3125 { 3126 /* indicate to LCP that it must stay alive */ 3127 sp->lcp.protos |= (1 << IDX_IPCP); 3128 } 3129 3130 static void 3131 sppp_ipcp_tlf(struct sppp *sp) 3132 { 3133 /* we no longer need LCP */ 3134 sp->lcp.protos &= ~(1 << IDX_IPCP); 3135 } 3136 3137 static void 3138 sppp_ipcp_scr(struct sppp *sp) 3139 { 3140 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3141 u_int32_t ouraddr; 3142 int i = 0; 3143 3144 #ifdef notyet 3145 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3146 opt[i++] = IPCP_OPT_COMPRESSION; 3147 opt[i++] = 6; 3148 opt[i++] = 0; /* VJ header compression */ 3149 opt[i++] = 0x2d; /* VJ header compression */ 3150 opt[i++] = max_slot_id; 3151 opt[i++] = comp_slot_id; 3152 } 3153 #endif 3154 3155 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3156 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3157 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3158 else 3159 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3160 opt[i++] = IPCP_OPT_ADDRESS; 3161 opt[i++] = 6; 3162 opt[i++] = ouraddr >> 24; 3163 opt[i++] = ouraddr >> 16; 3164 opt[i++] = ouraddr >> 8; 3165 opt[i++] = ouraddr; 3166 } 3167 3168 if (sp->query_dns & 1) { 3169 opt[i++] = IPCP_OPT_PRIMDNS; 3170 opt[i++] = 6; 3171 opt[i++] = sp->dns_addrs[0] >> 24; 3172 opt[i++] = sp->dns_addrs[0] >> 16; 3173 opt[i++] = sp->dns_addrs[0] >> 8; 3174 opt[i++] = sp->dns_addrs[0]; 3175 } 3176 if (sp->query_dns & 2) { 3177 opt[i++] = IPCP_OPT_SECDNS; 3178 opt[i++] = 6; 3179 opt[i++] = sp->dns_addrs[1] >> 24; 3180 opt[i++] = sp->dns_addrs[1] >> 16; 3181 opt[i++] = sp->dns_addrs[1] >> 8; 3182 opt[i++] = sp->dns_addrs[1]; 3183 } 3184 3185 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3186 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3187 } 3188 3189 3190 /* 3191 *--------------------------------------------------------------------------* 3192 * * 3193 * The IPv6CP implementation. * 3194 * * 3195 *--------------------------------------------------------------------------* 3196 */ 3197 3198 #ifdef INET6 3199 static void 3200 sppp_ipv6cp_init(struct sppp *sp) 3201 { 3202 sp->ipv6cp.opts = 0; 3203 sp->ipv6cp.flags = 0; 3204 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3205 sp->fail_counter[IDX_IPV6CP] = 0; 3206 sp->pp_seq[IDX_IPV6CP] = 0; 3207 sp->pp_rseq[IDX_IPV6CP] = 0; 3208 callout_init(&sp->ch[IDX_IPV6CP]); 3209 } 3210 3211 static void 3212 sppp_ipv6cp_up(struct sppp *sp) 3213 { 3214 sppp_up_event(&ipv6cp, sp); 3215 } 3216 3217 static void 3218 sppp_ipv6cp_down(struct sppp *sp) 3219 { 3220 sppp_down_event(&ipv6cp, sp); 3221 } 3222 3223 static void 3224 sppp_ipv6cp_open(struct sppp *sp) 3225 { 3226 STDDCL; 3227 struct in6_addr myaddr, hisaddr; 3228 3229 #ifdef IPV6CP_MYIFID_DYN 3230 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3231 #else 3232 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3233 #endif 3234 3235 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3236 /* 3237 * If we don't have our address, this probably means our 3238 * interface doesn't want to talk IPv6 at all. (This could 3239 * be the case if somebody wants to speak only IPX, for 3240 * example.) Don't open IPv6CP in this case. 3241 */ 3242 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3243 /* XXX this message should go away */ 3244 if (debug) 3245 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3246 SPP_ARGS(ifp)); 3247 return; 3248 } 3249 3250 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3251 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3252 sppp_open_event(&ipv6cp, sp); 3253 } 3254 3255 static void 3256 sppp_ipv6cp_close(struct sppp *sp) 3257 { 3258 sppp_close_event(&ipv6cp, sp); 3259 } 3260 3261 static void 3262 sppp_ipv6cp_TO(void *cookie) 3263 { 3264 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3265 } 3266 3267 /* 3268 * Analyze a configure request. Return true if it was agreeable, and 3269 * caused action sca, false if it has been rejected or nak'ed, and 3270 * caused action scn. (The return value is used to make the state 3271 * transition decision in the state automaton.) 3272 */ 3273 static int 3274 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3275 { 3276 u_char *buf, *r, *p; 3277 struct ifnet *ifp = &sp->pp_if; 3278 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3279 struct in6_addr myaddr, desiredaddr, suggestaddr; 3280 int ifidcount; 3281 int type; 3282 int collision, nohisaddr; 3283 3284 len -= 4; 3285 origlen = len; 3286 /* 3287 * Make sure to allocate a buf that can at least hold a 3288 * conf-nak with an `address' option. We might need it below. 3289 */ 3290 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3291 if (! buf) 3292 return (0); 3293 3294 /* pass 1: see if we can recognize them */ 3295 if (debug) 3296 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:", 3297 SPP_ARGS(ifp)); 3298 p = (void *)(h + 1); 3299 ifidcount = 0; 3300 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3301 if (debug) 3302 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3303 switch (*p) { 3304 case IPV6CP_OPT_IFID: 3305 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3306 /* correctly formed address option */ 3307 ifidcount++; 3308 continue; 3309 } 3310 if (debug) 3311 addlog(" [invalid]"); 3312 break; 3313 #ifdef notyet 3314 case IPV6CP_OPT_COMPRESSION: 3315 if (len >= 4 && p[1] >= 4) { 3316 /* correctly formed compress option */ 3317 continue; 3318 } 3319 if (debug) 3320 addlog(" [invalid]"); 3321 break; 3322 #endif 3323 default: 3324 /* Others not supported. */ 3325 if (debug) 3326 addlog(" [rej]"); 3327 break; 3328 } 3329 /* Add the option to rejected list. */ 3330 bcopy (p, r, p[1]); 3331 r += p[1]; 3332 rlen += p[1]; 3333 } 3334 if (rlen) { 3335 if (debug) 3336 addlog(" send conf-rej\n"); 3337 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3338 goto end; 3339 } else if (debug) 3340 addlog("\n"); 3341 3342 /* pass 2: parse option values */ 3343 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3344 if (debug) 3345 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ", 3346 SPP_ARGS(ifp)); 3347 p = (void *)(h + 1); 3348 len = origlen; 3349 type = CONF_ACK; 3350 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3351 if (debug) 3352 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3353 switch (*p) { 3354 #ifdef notyet 3355 case IPV6CP_OPT_COMPRESSION: 3356 continue; 3357 #endif 3358 case IPV6CP_OPT_IFID: 3359 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3360 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3361 collision = (memcmp(&desiredaddr.s6_addr[8], 3362 &myaddr.s6_addr[8], 8) == 0); 3363 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3364 3365 desiredaddr.s6_addr16[0] = htons(0xfe80); 3366 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3367 3368 if (!collision && !nohisaddr) { 3369 /* no collision, hisaddr known - Conf-Ack */ 3370 type = CONF_ACK; 3371 3372 if (debug) { 3373 addlog(" %s [%s]", 3374 ip6_sprintf(&desiredaddr), 3375 sppp_cp_type_name(type)); 3376 } 3377 continue; 3378 } 3379 3380 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3381 if (collision && nohisaddr) { 3382 /* collision, hisaddr unknown - Conf-Rej */ 3383 type = CONF_REJ; 3384 memset(&p[2], 0, 8); 3385 } else { 3386 /* 3387 * - no collision, hisaddr unknown, or 3388 * - collision, hisaddr known 3389 * Conf-Nak, suggest hisaddr 3390 */ 3391 type = CONF_NAK; 3392 sppp_suggest_ip6_addr(sp, &suggestaddr); 3393 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3394 } 3395 if (debug) 3396 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3397 sppp_cp_type_name(type)); 3398 break; 3399 } 3400 /* Add the option to nak'ed list. */ 3401 bcopy (p, r, p[1]); 3402 r += p[1]; 3403 rlen += p[1]; 3404 } 3405 3406 if (rlen == 0 && type == CONF_ACK) { 3407 if (debug) 3408 addlog(" send %s\n", sppp_cp_type_name(type)); 3409 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3410 } else { 3411 #ifdef notdef 3412 if (type == CONF_ACK) 3413 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3414 #endif 3415 3416 if (debug) { 3417 addlog(" send %s suggest %s\n", 3418 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3419 } 3420 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3421 } 3422 3423 end: 3424 free(buf, M_TEMP); 3425 return (rlen == 0); 3426 } 3427 3428 /* 3429 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3430 * negotiation. 3431 */ 3432 static void 3433 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3434 { 3435 u_char *buf, *p; 3436 struct ifnet *ifp = &sp->pp_if; 3437 int debug = ifp->if_flags & IFF_DEBUG; 3438 3439 len -= 4; 3440 buf = malloc (len, M_TEMP, M_NOWAIT); 3441 if (!buf) 3442 return; 3443 3444 if (debug) 3445 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:", 3446 SPP_ARGS(ifp)); 3447 3448 p = (void *)(h + 1); 3449 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3450 if (debug) 3451 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3452 switch (*p) { 3453 case IPV6CP_OPT_IFID: 3454 /* 3455 * Peer doesn't grok address option. This is 3456 * bad. XXX Should we better give up here? 3457 */ 3458 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3459 break; 3460 #ifdef notyet 3461 case IPV6CP_OPT_COMPRESS: 3462 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3463 break; 3464 #endif 3465 } 3466 } 3467 if (debug) 3468 addlog("\n"); 3469 free(buf, M_TEMP); 3470 return; 3471 } 3472 3473 /* 3474 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3475 * negotiation. 3476 */ 3477 static void 3478 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3479 { 3480 u_char *buf, *p; 3481 struct ifnet *ifp = &sp->pp_if; 3482 int debug = ifp->if_flags & IFF_DEBUG; 3483 struct in6_addr suggestaddr; 3484 3485 len -= 4; 3486 buf = malloc (len, M_TEMP, M_NOWAIT); 3487 if (!buf) 3488 return; 3489 3490 if (debug) 3491 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:", 3492 SPP_ARGS(ifp)); 3493 3494 p = (void *)(h + 1); 3495 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3496 if (debug) 3497 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3498 switch (*p) { 3499 case IPV6CP_OPT_IFID: 3500 /* 3501 * Peer doesn't like our local ifid. See 3502 * if we can do something for him. We'll drop 3503 * him our address then. 3504 */ 3505 if (len < 10 || p[1] != 10) 3506 break; 3507 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3508 suggestaddr.s6_addr16[0] = htons(0xfe80); 3509 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3510 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3511 3512 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3513 if (debug) 3514 addlog(" [suggestaddr %s]", 3515 ip6_sprintf(&suggestaddr)); 3516 #ifdef IPV6CP_MYIFID_DYN 3517 /* 3518 * When doing dynamic address assignment, 3519 * we accept his offer. 3520 */ 3521 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3522 struct in6_addr lastsuggest; 3523 /* 3524 * If <suggested myaddr from peer> equals to 3525 * <hisaddr we have suggested last time>, 3526 * we have a collision. generate new random 3527 * ifid. 3528 */ 3529 sppp_suggest_ip6_addr(&lastsuggest); 3530 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3531 lastsuggest)) { 3532 if (debug) 3533 addlog(" [random]"); 3534 sppp_gen_ip6_addr(sp, &suggestaddr); 3535 } 3536 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3537 if (debug) 3538 addlog(" [agree]"); 3539 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3540 } 3541 #else 3542 /* 3543 * Since we do not do dynamic address assignment, 3544 * we ignore it and thus continue to negotiate 3545 * our already existing value. This can possibly 3546 * go into infinite request-reject loop. 3547 * 3548 * This is not likely because we normally use 3549 * ifid based on MAC-address. 3550 * If you have no ethernet card on the node, too bad. 3551 * XXX should we use fail_counter? 3552 */ 3553 #endif 3554 break; 3555 #ifdef notyet 3556 case IPV6CP_OPT_COMPRESS: 3557 /* 3558 * Peer wants different compression parameters. 3559 */ 3560 break; 3561 #endif 3562 } 3563 } 3564 if (debug) 3565 addlog("\n"); 3566 free(buf, M_TEMP); 3567 return; 3568 } 3569 3570 static void 3571 sppp_ipv6cp_tlu(struct sppp *sp) 3572 { 3573 /* we are up - notify isdn daemon */ 3574 if (sp->pp_con) 3575 sp->pp_con(sp); 3576 } 3577 3578 static void 3579 sppp_ipv6cp_tld(struct sppp *sp) 3580 { 3581 } 3582 3583 static void 3584 sppp_ipv6cp_tls(struct sppp *sp) 3585 { 3586 /* indicate to LCP that it must stay alive */ 3587 sp->lcp.protos |= (1 << IDX_IPV6CP); 3588 } 3589 3590 static void 3591 sppp_ipv6cp_tlf(struct sppp *sp) 3592 { 3593 /* we no longer need LCP */ 3594 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3595 } 3596 3597 static void 3598 sppp_ipv6cp_scr(struct sppp *sp) 3599 { 3600 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3601 struct in6_addr ouraddr; 3602 int i = 0; 3603 3604 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3605 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3606 opt[i++] = IPV6CP_OPT_IFID; 3607 opt[i++] = 10; 3608 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3609 i += 8; 3610 } 3611 3612 #ifdef notyet 3613 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3614 opt[i++] = IPV6CP_OPT_COMPRESSION; 3615 opt[i++] = 4; 3616 opt[i++] = 0; /* TBD */ 3617 opt[i++] = 0; /* TBD */ 3618 /* variable length data may follow */ 3619 } 3620 #endif 3621 3622 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3623 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3624 } 3625 #else /*INET6*/ 3626 static void sppp_ipv6cp_init(struct sppp *sp) 3627 { 3628 } 3629 3630 static void sppp_ipv6cp_up(struct sppp *sp) 3631 { 3632 } 3633 3634 static void sppp_ipv6cp_down(struct sppp *sp) 3635 { 3636 } 3637 3638 3639 static void sppp_ipv6cp_open(struct sppp *sp) 3640 { 3641 } 3642 3643 static void sppp_ipv6cp_close(struct sppp *sp) 3644 { 3645 } 3646 3647 static void sppp_ipv6cp_TO(void *sp) 3648 { 3649 } 3650 3651 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3652 { 3653 return 0; 3654 } 3655 3656 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3657 { 3658 } 3659 3660 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3661 { 3662 } 3663 3664 static void sppp_ipv6cp_tlu(struct sppp *sp) 3665 { 3666 } 3667 3668 static void sppp_ipv6cp_tld(struct sppp *sp) 3669 { 3670 } 3671 3672 static void sppp_ipv6cp_tls(struct sppp *sp) 3673 { 3674 } 3675 3676 static void sppp_ipv6cp_tlf(struct sppp *sp) 3677 { 3678 } 3679 3680 static void sppp_ipv6cp_scr(struct sppp *sp) 3681 { 3682 } 3683 #endif /*INET6*/ 3684 3685 3686 /* 3687 *--------------------------------------------------------------------------* 3688 * * 3689 * The CHAP implementation. * 3690 * * 3691 *--------------------------------------------------------------------------* 3692 */ 3693 3694 /* 3695 * The authentication protocols don't employ a full-fledged state machine as 3696 * the control protocols do, since they do have Open and Close events, but 3697 * not Up and Down, nor are they explicitly terminated. Also, use of the 3698 * authentication protocols may be different in both directions (this makes 3699 * sense, think of a machine that never accepts incoming calls but only 3700 * calls out, it doesn't require the called party to authenticate itself). 3701 * 3702 * Our state machine for the local authentication protocol (we are requesting 3703 * the peer to authenticate) looks like: 3704 * 3705 * RCA- 3706 * +--------------------------------------------+ 3707 * V scn,tld| 3708 * +--------+ Close +---------+ RCA+ 3709 * | |<----------------------------------| |------+ 3710 * +--->| Closed | TO* | Opened | sca | 3711 * | | |-----+ +-------| |<-----+ 3712 * | +--------+ irc | | +---------+ 3713 * | ^ | | ^ 3714 * | | | | | 3715 * | | | | | 3716 * | TO-| | | | 3717 * | |tld TO+ V | | 3718 * | | +------->+ | | 3719 * | | | | | | 3720 * | +--------+ V | | 3721 * | | |<----+<--------------------+ | 3722 * | | Req- | scr | 3723 * | | Sent | | 3724 * | | | | 3725 * | +--------+ | 3726 * | RCA- | | RCA+ | 3727 * +------+ +------------------------------------------+ 3728 * scn,tld sca,irc,ict,tlu 3729 * 3730 * 3731 * with: 3732 * 3733 * Open: LCP reached authentication phase 3734 * Close: LCP reached terminate phase 3735 * 3736 * RCA+: received reply (pap-req, chap-response), acceptable 3737 * RCN: received reply (pap-req, chap-response), not acceptable 3738 * TO+: timeout with restart counter >= 0 3739 * TO-: timeout with restart counter < 0 3740 * TO*: reschedule timeout for CHAP 3741 * 3742 * scr: send request packet (none for PAP, chap-challenge) 3743 * sca: send ack packet (pap-ack, chap-success) 3744 * scn: send nak packet (pap-nak, chap-failure) 3745 * ict: initialize re-challenge timer (CHAP only) 3746 * 3747 * tlu: this-layer-up, LCP reaches network phase 3748 * tld: this-layer-down, LCP enters terminate phase 3749 * 3750 * Note that in CHAP mode, after sending a new challenge, while the state 3751 * automaton falls back into Req-Sent state, it doesn't signal a tld 3752 * event to LCP, so LCP remains in network phase. Only after not getting 3753 * any response (or after getting an unacceptable response), CHAP closes, 3754 * causing LCP to enter terminate phase. 3755 * 3756 * With PAP, there is no initial request that can be sent. The peer is 3757 * expected to send one based on the successful negotiation of PAP as 3758 * the authentication protocol during the LCP option negotiation. 3759 * 3760 * Incoming authentication protocol requests (remote requests 3761 * authentication, we are peer) don't employ a state machine at all, 3762 * they are simply answered. Some peers [Ascend P50 firmware rev 3763 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3764 * still in authentication phase (thereby violating the standard that 3765 * demands that these NCP packets are to be discarded), so we keep 3766 * track of the peer demanding us to authenticate, and only proceed to 3767 * phase network once we've seen a positive acknowledge for the 3768 * authentication. 3769 */ 3770 3771 /* 3772 * Handle incoming CHAP packets. 3773 */ 3774 void 3775 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3776 { 3777 STDDCL; 3778 struct lcp_header *h; 3779 int len, x; 3780 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3781 int value_len, name_len; 3782 MD5_CTX ctx; 3783 3784 len = m->m_pkthdr.len; 3785 if (len < 4) { 3786 if (debug) 3787 log(LOG_DEBUG, 3788 SPP_FMT "chap invalid packet length: %d bytes\n", 3789 SPP_ARGS(ifp), len); 3790 return; 3791 } 3792 h = mtod(m, struct lcp_header *); 3793 if (len > ntohs(h->len)) 3794 len = ntohs(h->len); 3795 3796 switch (h->type) { 3797 /* challenge, failure and success are his authproto */ 3798 case CHAP_CHALLENGE: 3799 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3800 /* can't do anything usefull */ 3801 sp->pp_auth_failures++; 3802 printf(SPP_FMT "chap input without my name and my secret being set\n", 3803 SPP_ARGS(ifp)); 3804 break; 3805 } 3806 value = 1 + (u_char *)(h + 1); 3807 value_len = value[-1]; 3808 name = value + value_len; 3809 name_len = len - value_len - 5; 3810 if (name_len < 0) { 3811 if (debug) { 3812 log(LOG_DEBUG, 3813 SPP_FMT "chap corrupted challenge " 3814 "<%s id=0x%x len=%d", 3815 SPP_ARGS(ifp), 3816 sppp_auth_type_name(PPP_CHAP, h->type), 3817 h->ident, ntohs(h->len)); 3818 if (len > 4) 3819 sppp_print_bytes((u_char *)(h + 1), 3820 len - 4); 3821 addlog(">\n"); 3822 } 3823 break; 3824 } 3825 3826 if (debug) { 3827 log(LOG_DEBUG, 3828 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3829 SPP_ARGS(ifp), 3830 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3831 ntohs(h->len)); 3832 sppp_print_string((char *) name, name_len); 3833 addlog(" value-size=%d value=", value_len); 3834 sppp_print_bytes(value, value_len); 3835 addlog(">\n"); 3836 } 3837 3838 /* Compute reply value. */ 3839 MD5Init(&ctx); 3840 MD5Update(&ctx, &h->ident, 1); 3841 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3842 MD5Update(&ctx, value, value_len); 3843 MD5Final(digest, &ctx); 3844 dsize = sizeof digest; 3845 3846 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3847 sizeof dsize, (const char *)&dsize, 3848 sizeof digest, digest, 3849 sp->myauth.name_len, 3850 sp->myauth.name, 3851 0); 3852 break; 3853 3854 case CHAP_SUCCESS: 3855 if (debug) { 3856 log(LOG_DEBUG, SPP_FMT "chap success", 3857 SPP_ARGS(ifp)); 3858 if (len > 4) { 3859 addlog(": "); 3860 sppp_print_string((char *)(h + 1), len - 4); 3861 } 3862 addlog("\n"); 3863 } 3864 x = splnet(); 3865 sp->pp_auth_failures = 0; 3866 sp->pp_flags &= ~PP_NEEDAUTH; 3867 if (sp->myauth.proto == PPP_CHAP && 3868 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3869 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3870 /* 3871 * We are authenticator for CHAP but didn't 3872 * complete yet. Leave it to tlu to proceed 3873 * to network phase. 3874 */ 3875 splx(x); 3876 break; 3877 } 3878 splx(x); 3879 sppp_phase_network(sp); 3880 break; 3881 3882 case CHAP_FAILURE: 3883 x = splnet(); 3884 sp->pp_auth_failures++; 3885 splx(x); 3886 if (debug) { 3887 log(LOG_INFO, SPP_FMT "chap failure", 3888 SPP_ARGS(ifp)); 3889 if (len > 4) { 3890 addlog(": "); 3891 sppp_print_string((char *)(h + 1), len - 4); 3892 } 3893 addlog("\n"); 3894 } else 3895 log(LOG_INFO, SPP_FMT "chap failure\n", 3896 SPP_ARGS(ifp)); 3897 /* await LCP shutdown by authenticator */ 3898 break; 3899 3900 /* response is my authproto */ 3901 case CHAP_RESPONSE: 3902 if (sp->hisauth.secret == NULL) { 3903 /* can't do anything usefull */ 3904 printf(SPP_FMT "chap input without his secret being set\n", 3905 SPP_ARGS(ifp)); 3906 break; 3907 } 3908 value = 1 + (u_char *)(h + 1); 3909 value_len = value[-1]; 3910 name = value + value_len; 3911 name_len = len - value_len - 5; 3912 if (name_len < 0) { 3913 if (debug) { 3914 log(LOG_DEBUG, 3915 SPP_FMT "chap corrupted response " 3916 "<%s id=0x%x len=%d", 3917 SPP_ARGS(ifp), 3918 sppp_auth_type_name(PPP_CHAP, h->type), 3919 h->ident, ntohs(h->len)); 3920 if (len > 4) 3921 sppp_print_bytes((u_char *)(h + 1), 3922 len - 4); 3923 addlog(">\n"); 3924 } 3925 break; 3926 } 3927 if (h->ident != sp->confid[IDX_CHAP]) { 3928 if (debug) 3929 log(LOG_DEBUG, 3930 SPP_FMT "chap dropping response for old ID " 3931 "(got %d, expected %d)\n", 3932 SPP_ARGS(ifp), 3933 h->ident, sp->confid[IDX_CHAP]); 3934 break; 3935 } 3936 if (sp->hisauth.name != NULL && 3937 (name_len != sp->hisauth.name_len 3938 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 3939 log(LOG_INFO, SPP_FMT "chap response, his name ", 3940 SPP_ARGS(ifp)); 3941 sppp_print_string(name, name_len); 3942 addlog(" != expected "); 3943 sppp_print_string(sp->hisauth.name, 3944 sp->hisauth.name_len); 3945 addlog("\n"); 3946 goto chap_failure; 3947 } 3948 if (debug) { 3949 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 3950 "<%s id=0x%x len=%d name=", 3951 SPP_ARGS(ifp), 3952 sppp_state_name(sp->state[IDX_CHAP]), 3953 sppp_auth_type_name(PPP_CHAP, h->type), 3954 h->ident, ntohs(h->len)); 3955 sppp_print_string((char *)name, name_len); 3956 addlog(" value-size=%d value=", value_len); 3957 sppp_print_bytes(value, value_len); 3958 addlog(">\n"); 3959 } 3960 if (value_len != sizeof(sp->myauth.challenge)) { 3961 if (debug) 3962 log(LOG_DEBUG, 3963 SPP_FMT "chap bad hash value length: " 3964 "%d bytes, should be %ld\n", 3965 SPP_ARGS(ifp), value_len, 3966 (long) sizeof(sp->myauth.challenge)); 3967 goto chap_failure; 3968 } 3969 3970 MD5Init(&ctx); 3971 MD5Update(&ctx, &h->ident, 1); 3972 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 3973 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 3974 MD5Final(digest, &ctx); 3975 3976 #define FAILMSG "Failed..." 3977 #define SUCCMSG "Welcome!" 3978 3979 if (value_len != sizeof digest || 3980 memcmp(digest, value, value_len) != 0) { 3981 chap_failure: 3982 /* action scn, tld */ 3983 x = splnet(); 3984 sp->pp_auth_failures++; 3985 splx(x); 3986 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 3987 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 3988 0); 3989 chap.tld(sp); 3990 break; 3991 } 3992 sp->pp_auth_failures = 0; 3993 /* action sca, perhaps tlu */ 3994 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 3995 sp->state[IDX_CHAP] == STATE_OPENED) 3996 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 3997 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 3998 0); 3999 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4000 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4001 chap.tlu(sp); 4002 } 4003 break; 4004 4005 default: 4006 /* Unknown CHAP packet type -- ignore. */ 4007 if (debug) { 4008 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 4009 "<0x%x id=0x%xh len=%d", 4010 SPP_ARGS(ifp), 4011 sppp_state_name(sp->state[IDX_CHAP]), 4012 h->type, h->ident, ntohs(h->len)); 4013 if (len > 4) 4014 sppp_print_bytes((u_char *)(h + 1), len - 4); 4015 addlog(">\n"); 4016 } 4017 break; 4018 4019 } 4020 } 4021 4022 static void 4023 sppp_chap_init(struct sppp *sp) 4024 { 4025 /* Chap doesn't have STATE_INITIAL at all. */ 4026 sp->state[IDX_CHAP] = STATE_CLOSED; 4027 sp->fail_counter[IDX_CHAP] = 0; 4028 sp->pp_seq[IDX_CHAP] = 0; 4029 sp->pp_rseq[IDX_CHAP] = 0; 4030 callout_init(&sp->ch[IDX_CHAP]); 4031 } 4032 4033 static void 4034 sppp_chap_open(struct sppp *sp) 4035 { 4036 if (sp->myauth.proto == PPP_CHAP && 4037 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4038 /* we are authenticator for CHAP, start it */ 4039 chap.scr(sp); 4040 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4041 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4042 } 4043 /* nothing to be done if we are peer, await a challenge */ 4044 } 4045 4046 static void 4047 sppp_chap_close(struct sppp *sp) 4048 { 4049 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4050 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4051 } 4052 4053 static void 4054 sppp_chap_TO(void *cookie) 4055 { 4056 struct sppp *sp = (struct sppp *)cookie; 4057 STDDCL; 4058 int s; 4059 4060 s = splnet(); 4061 if (debug) 4062 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 4063 SPP_ARGS(ifp), 4064 sppp_state_name(sp->state[IDX_CHAP]), 4065 sp->rst_counter[IDX_CHAP]); 4066 4067 if (--sp->rst_counter[IDX_CHAP] < 0) 4068 /* TO- event */ 4069 switch (sp->state[IDX_CHAP]) { 4070 case STATE_REQ_SENT: 4071 chap.tld(sp); 4072 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4073 break; 4074 } 4075 else 4076 /* TO+ (or TO*) event */ 4077 switch (sp->state[IDX_CHAP]) { 4078 case STATE_OPENED: 4079 /* TO* event */ 4080 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4081 /* fall through */ 4082 case STATE_REQ_SENT: 4083 chap.scr(sp); 4084 /* sppp_cp_change_state() will restart the timer */ 4085 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4086 break; 4087 } 4088 4089 splx(s); 4090 } 4091 4092 static void 4093 sppp_chap_tlu(struct sppp *sp) 4094 { 4095 STDDCL; 4096 int i, x; 4097 4098 i = 0; 4099 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4100 4101 /* 4102 * Some broken CHAP implementations (Conware CoNet, firmware 4103 * 4.0.?) don't want to re-authenticate their CHAP once the 4104 * initial challenge-response exchange has taken place. 4105 * Provide for an option to avoid rechallenges. 4106 */ 4107 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4108 /* 4109 * Compute the re-challenge timeout. This will yield 4110 * a number between 300 and 810 seconds. 4111 */ 4112 i = 300 + ((unsigned)(random() & 0xff00) >> 7); 4113 4114 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4115 } 4116 4117 if (debug) { 4118 log(LOG_DEBUG, 4119 SPP_FMT "chap %s, ", 4120 SPP_ARGS(ifp), 4121 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4122 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4123 addlog("next re-challenge in %d seconds\n", i); 4124 else 4125 addlog("re-challenging supressed\n"); 4126 } 4127 4128 x = splnet(); 4129 sp->pp_auth_failures = 0; 4130 /* indicate to LCP that we need to be closed down */ 4131 sp->lcp.protos |= (1 << IDX_CHAP); 4132 4133 if (sp->pp_flags & PP_NEEDAUTH) { 4134 /* 4135 * Remote is authenticator, but his auth proto didn't 4136 * complete yet. Defer the transition to network 4137 * phase. 4138 */ 4139 splx(x); 4140 return; 4141 } 4142 splx(x); 4143 4144 /* 4145 * If we are already in phase network, we are done here. This 4146 * is the case if this is a dummy tlu event after a re-challenge. 4147 */ 4148 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4149 sppp_phase_network(sp); 4150 } 4151 4152 static void 4153 sppp_chap_tld(struct sppp *sp) 4154 { 4155 STDDCL; 4156 4157 if (debug) 4158 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4159 callout_stop(&sp->ch[IDX_CHAP]); 4160 sp->lcp.protos &= ~(1 << IDX_CHAP); 4161 4162 lcp.Close(sp); 4163 } 4164 4165 static void 4166 sppp_chap_scr(struct sppp *sp) 4167 { 4168 struct timeval tv; 4169 u_int32_t *ch, seed; 4170 u_char clen; 4171 4172 if (sp->myauth.name == NULL) { 4173 /* can't do anything usefull */ 4174 printf(SPP_FMT "chap starting without my name being set\n", 4175 SPP_ARGS(&sp->pp_if)); 4176 return; 4177 } 4178 4179 /* Compute random challenge. */ 4180 ch = (u_int32_t *)sp->myauth.challenge; 4181 microtime(&tv); 4182 seed = tv.tv_sec ^ tv.tv_usec; 4183 ch[0] = seed ^ random(); 4184 ch[1] = seed ^ random(); 4185 ch[2] = seed ^ random(); 4186 ch[3] = seed ^ random(); 4187 clen = 16; /* 4 * sizeof(u_int32_t) */ 4188 4189 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4190 4191 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4192 sizeof clen, (const char *)&clen, 4193 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4194 sp->myauth.name_len, 4195 sp->myauth.name, 4196 0); 4197 } 4198 4199 /* 4200 *--------------------------------------------------------------------------* 4201 * * 4202 * The PAP implementation. * 4203 * * 4204 *--------------------------------------------------------------------------* 4205 */ 4206 /* 4207 * For PAP, we need to keep a little state also if we are the peer, not the 4208 * authenticator. This is since we don't get a request to authenticate, but 4209 * have to repeatedly authenticate ourself until we got a response (or the 4210 * retry counter is expired). 4211 */ 4212 4213 /* 4214 * Handle incoming PAP packets. */ 4215 static void 4216 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4217 { 4218 STDDCL; 4219 struct lcp_header *h; 4220 int len, x; 4221 u_char mlen; 4222 char *name, *secret; 4223 int name_len, secret_len; 4224 4225 len = m->m_pkthdr.len; 4226 if (len < 5) { 4227 if (debug) 4228 log(LOG_DEBUG, 4229 SPP_FMT "pap invalid packet length: %d bytes\n", 4230 SPP_ARGS(ifp), len); 4231 return; 4232 } 4233 h = mtod(m, struct lcp_header *); 4234 if (len > ntohs(h->len)) 4235 len = ntohs(h->len); 4236 switch (h->type) { 4237 /* PAP request is my authproto */ 4238 case PAP_REQ: 4239 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4240 /* can't do anything usefull */ 4241 printf(SPP_FMT "pap request without his name and his secret being set\n", 4242 SPP_ARGS(ifp)); 4243 break; 4244 } 4245 name = 1 + (u_char *)(h + 1); 4246 name_len = name[-1]; 4247 secret = name + name_len + 1; 4248 if (name_len > len - 6 || 4249 (secret_len = secret[-1]) > len - 6 - name_len) { 4250 if (debug) { 4251 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4252 "<%s id=0x%x len=%d", 4253 SPP_ARGS(ifp), 4254 sppp_auth_type_name(PPP_PAP, h->type), 4255 h->ident, ntohs(h->len)); 4256 if (len > 4) 4257 sppp_print_bytes((u_char *)(h + 1), 4258 len - 4); 4259 addlog(">\n"); 4260 } 4261 break; 4262 } 4263 if (debug) { 4264 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4265 "<%s id=0x%x len=%d name=", 4266 SPP_ARGS(ifp), 4267 sppp_state_name(sp->state[IDX_PAP]), 4268 sppp_auth_type_name(PPP_PAP, h->type), 4269 h->ident, ntohs(h->len)); 4270 sppp_print_string((char *)name, name_len); 4271 addlog(" secret="); 4272 sppp_print_string((char *)secret, secret_len); 4273 addlog(">\n"); 4274 } 4275 if (name_len != sp->hisauth.name_len || 4276 secret_len != sp->hisauth.secret_len || 4277 memcmp(name, sp->hisauth.name, name_len) != 0 || 4278 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4279 /* action scn, tld */ 4280 sp->pp_auth_failures++; 4281 mlen = sizeof(FAILMSG) - 1; 4282 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4283 sizeof mlen, (const char *)&mlen, 4284 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4285 0); 4286 pap.tld(sp); 4287 break; 4288 } 4289 /* action sca, perhaps tlu */ 4290 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4291 sp->state[IDX_PAP] == STATE_OPENED) { 4292 mlen = sizeof(SUCCMSG) - 1; 4293 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4294 sizeof mlen, (const char *)&mlen, 4295 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4296 0); 4297 } 4298 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4299 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4300 pap.tlu(sp); 4301 } 4302 break; 4303 4304 /* ack and nak are his authproto */ 4305 case PAP_ACK: 4306 callout_stop(&sp->pap_my_to_ch); 4307 if (debug) { 4308 log(LOG_DEBUG, SPP_FMT "pap success", 4309 SPP_ARGS(ifp)); 4310 name_len = *(char *)h; 4311 if (len > 5 && name_len) { 4312 addlog(": "); 4313 sppp_print_string((char *)(h + 1), name_len); 4314 } 4315 addlog("\n"); 4316 } 4317 x = splnet(); 4318 sp->pp_auth_failures = 0; 4319 sp->pp_flags &= ~PP_NEEDAUTH; 4320 if (sp->myauth.proto == PPP_PAP && 4321 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4322 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4323 /* 4324 * We are authenticator for PAP but didn't 4325 * complete yet. Leave it to tlu to proceed 4326 * to network phase. 4327 */ 4328 splx(x); 4329 break; 4330 } 4331 splx(x); 4332 sppp_phase_network(sp); 4333 break; 4334 4335 case PAP_NAK: 4336 callout_stop(&sp->pap_my_to_ch); 4337 sp->pp_auth_failures++; 4338 if (debug) { 4339 log(LOG_INFO, SPP_FMT "pap failure", 4340 SPP_ARGS(ifp)); 4341 name_len = *(char *)h; 4342 if (len > 5 && name_len) { 4343 addlog(": "); 4344 sppp_print_string((char *)(h + 1), name_len); 4345 } 4346 addlog("\n"); 4347 } else 4348 log(LOG_INFO, SPP_FMT "pap failure\n", 4349 SPP_ARGS(ifp)); 4350 /* await LCP shutdown by authenticator */ 4351 break; 4352 4353 default: 4354 /* Unknown PAP packet type -- ignore. */ 4355 if (debug) { 4356 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4357 "<0x%x id=0x%x len=%d", 4358 SPP_ARGS(ifp), 4359 h->type, h->ident, ntohs(h->len)); 4360 if (len > 4) 4361 sppp_print_bytes((u_char *)(h + 1), len - 4); 4362 addlog(">\n"); 4363 } 4364 break; 4365 4366 } 4367 } 4368 4369 static void 4370 sppp_pap_init(struct sppp *sp) 4371 { 4372 /* PAP doesn't have STATE_INITIAL at all. */ 4373 sp->state[IDX_PAP] = STATE_CLOSED; 4374 sp->fail_counter[IDX_PAP] = 0; 4375 sp->pp_seq[IDX_PAP] = 0; 4376 sp->pp_rseq[IDX_PAP] = 0; 4377 callout_init(&sp->ch[IDX_PAP]); 4378 callout_init(&sp->pap_my_to_ch); 4379 } 4380 4381 static void 4382 sppp_pap_open(struct sppp *sp) 4383 { 4384 if (sp->hisauth.proto == PPP_PAP && 4385 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4386 /* we are authenticator for PAP, start our timer */ 4387 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4388 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4389 } 4390 if (sp->myauth.proto == PPP_PAP) { 4391 /* we are peer, send a request, and start a timer */ 4392 pap.scr(sp); 4393 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4394 sppp_pap_my_TO, sp); 4395 } 4396 } 4397 4398 static void 4399 sppp_pap_close(struct sppp *sp) 4400 { 4401 if (sp->state[IDX_PAP] != STATE_CLOSED) 4402 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4403 } 4404 4405 /* 4406 * That's the timeout routine if we are authenticator. Since the 4407 * authenticator is basically passive in PAP, we can't do much here. 4408 */ 4409 static void 4410 sppp_pap_TO(void *cookie) 4411 { 4412 struct sppp *sp = (struct sppp *)cookie; 4413 STDDCL; 4414 int s; 4415 4416 s = splnet(); 4417 if (debug) 4418 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4419 SPP_ARGS(ifp), 4420 sppp_state_name(sp->state[IDX_PAP]), 4421 sp->rst_counter[IDX_PAP]); 4422 4423 if (--sp->rst_counter[IDX_PAP] < 0) 4424 /* TO- event */ 4425 switch (sp->state[IDX_PAP]) { 4426 case STATE_REQ_SENT: 4427 pap.tld(sp); 4428 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4429 break; 4430 } 4431 else 4432 /* TO+ event, not very much we could do */ 4433 switch (sp->state[IDX_PAP]) { 4434 case STATE_REQ_SENT: 4435 /* sppp_cp_change_state() will restart the timer */ 4436 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4437 break; 4438 } 4439 4440 splx(s); 4441 } 4442 4443 /* 4444 * That's the timeout handler if we are peer. Since the peer is active, 4445 * we need to retransmit our PAP request since it is apparently lost. 4446 * XXX We should impose a max counter. 4447 */ 4448 static void 4449 sppp_pap_my_TO(void *cookie) 4450 { 4451 struct sppp *sp = (struct sppp *)cookie; 4452 STDDCL; 4453 4454 if (debug) 4455 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4456 SPP_ARGS(ifp)); 4457 4458 pap.scr(sp); 4459 } 4460 4461 static void 4462 sppp_pap_tlu(struct sppp *sp) 4463 { 4464 STDDCL; 4465 int x; 4466 4467 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4468 4469 if (debug) 4470 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4471 SPP_ARGS(ifp), pap.name); 4472 4473 x = splnet(); 4474 sp->pp_auth_failures = 0; 4475 /* indicate to LCP that we need to be closed down */ 4476 sp->lcp.protos |= (1 << IDX_PAP); 4477 4478 if (sp->pp_flags & PP_NEEDAUTH) { 4479 /* 4480 * Remote is authenticator, but his auth proto didn't 4481 * complete yet. Defer the transition to network 4482 * phase. 4483 */ 4484 splx(x); 4485 return; 4486 } 4487 splx(x); 4488 sppp_phase_network(sp); 4489 } 4490 4491 static void 4492 sppp_pap_tld(struct sppp *sp) 4493 { 4494 STDDCL; 4495 4496 if (debug) 4497 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4498 callout_stop(&sp->ch[IDX_PAP]); 4499 callout_stop(&sp->pap_my_to_ch); 4500 sp->lcp.protos &= ~(1 << IDX_PAP); 4501 4502 lcp.Close(sp); 4503 } 4504 4505 static void 4506 sppp_pap_scr(struct sppp *sp) 4507 { 4508 u_char idlen, pwdlen; 4509 4510 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4511 /* can't do anything usefull */ 4512 printf(SPP_FMT "pap starting without my name and secret being set\n", 4513 SPP_ARGS(&sp->pp_if)); 4514 return; 4515 } 4516 4517 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4518 pwdlen = sp->myauth.secret_len; 4519 idlen = sp->myauth.name_len; 4520 4521 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4522 sizeof idlen, (const char *)&idlen, 4523 idlen, sp->myauth.name, 4524 sizeof pwdlen, (const char *)&pwdlen, 4525 pwdlen, sp->myauth.secret, 4526 0); 4527 } 4528 4529 /* 4530 * Random miscellaneous functions. 4531 */ 4532 4533 /* 4534 * Send a PAP or CHAP proto packet. 4535 * 4536 * Varadic function, each of the elements for the ellipsis is of type 4537 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4538 * mlen == 0. 4539 * NOTE: never declare variadic functions with types subject to type 4540 * promotion (i.e. u_char). This is asking for big trouble depending 4541 * on the architecture you are on... 4542 */ 4543 4544 static void 4545 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4546 unsigned int type, unsigned int id, 4547 ...) 4548 { 4549 STDDCL; 4550 struct lcp_header *lh; 4551 struct mbuf *m; 4552 u_char *p; 4553 int len; 4554 size_t pkthdrlen; 4555 unsigned int mlen; 4556 const char *msg; 4557 va_list ap; 4558 4559 MGETHDR(m, M_DONTWAIT, MT_DATA); 4560 if (! m) 4561 return; 4562 m->m_pkthdr.rcvif = 0; 4563 4564 if (sp->pp_flags & PP_NOFRAMING) { 4565 *mtod(m, u_int16_t *) = htons(cp->proto); 4566 pkthdrlen = 2; 4567 lh = (struct lcp_header *)(mtod(m, u_int8_t *)+2); 4568 } else { 4569 struct ppp_header *h; 4570 h = mtod(m, struct ppp_header *); 4571 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4572 h->control = PPP_UI; /* Unnumbered Info */ 4573 h->protocol = htons(cp->proto); 4574 pkthdrlen = PPP_HEADER_LEN; 4575 4576 lh = (struct lcp_header *)(h + 1); 4577 } 4578 4579 lh->type = type; 4580 lh->ident = id; 4581 p = (u_char *)(lh + 1); 4582 4583 va_start(ap, id); 4584 len = 0; 4585 4586 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4587 msg = va_arg(ap, const char *); 4588 len += mlen; 4589 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4590 va_end(ap); 4591 m_freem(m); 4592 return; 4593 } 4594 4595 bcopy(msg, p, mlen); 4596 p += mlen; 4597 } 4598 va_end(ap); 4599 4600 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4601 lh->len = htons(LCP_HEADER_LEN + len); 4602 4603 if (debug) { 4604 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4605 SPP_ARGS(ifp), cp->name, 4606 sppp_auth_type_name(cp->proto, lh->type), 4607 lh->ident, ntohs(lh->len)); 4608 if (len) 4609 sppp_print_bytes((u_char *)(lh + 1), len); 4610 addlog(">\n"); 4611 } 4612 if (IF_QFULL(&sp->pp_cpq)) { 4613 IF_DROP(&sp->pp_fastq); 4614 IF_DROP(&ifp->if_snd); 4615 m_freem(m); 4616 ++ifp->if_oerrors; 4617 return; 4618 } else 4619 IF_ENQUEUE(&sp->pp_cpq, m); 4620 if (! (ifp->if_flags & IFF_OACTIVE)) 4621 (*ifp->if_start)(ifp); 4622 ifp->if_obytes += m->m_pkthdr.len + 3; 4623 } 4624 4625 /* 4626 * Send keepalive packets, every 10 seconds. 4627 */ 4628 static void 4629 sppp_keepalive(void *dummy) 4630 { 4631 struct sppp *sp; 4632 int s; 4633 time_t now; 4634 4635 s = splnet(); 4636 now = mono_time.tv_sec; 4637 for (sp=spppq; sp; sp=sp->pp_next) { 4638 struct ifnet *ifp = &sp->pp_if; 4639 4640 /* check idle timeout */ 4641 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4642 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4643 /* idle timeout is enabled for this interface */ 4644 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4645 if (ifp->if_flags & IFF_DEBUG) 4646 printf("%s: no activitiy for %lu seconds\n", 4647 sp->pp_if.if_xname, 4648 (unsigned long)(now-sp->pp_last_activity)); 4649 lcp.Close(sp); 4650 continue; 4651 } 4652 } 4653 4654 /* Keepalive mode disabled or channel down? */ 4655 if (! (sp->pp_flags & PP_KEEPALIVE) || 4656 ! (ifp->if_flags & IFF_RUNNING)) 4657 continue; 4658 4659 /* No keepalive in PPP mode if LCP not opened yet. */ 4660 if (! (sp->pp_flags & PP_CISCO) && 4661 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4662 continue; 4663 4664 /* No echo reply, but maybe user data passed through? */ 4665 if ((now - sp->pp_last_activity) < LCP_KEEPALIVE_INTERVAL) { 4666 sp->pp_alivecnt = 0; 4667 continue; 4668 } 4669 4670 if (sp->pp_alivecnt == MAXALIVECNT) { 4671 /* No keepalive packets got. Stop the interface. */ 4672 if_down (ifp); 4673 IF_PURGE(&sp->pp_cpq); 4674 if (! (sp->pp_flags & PP_CISCO)) { 4675 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4676 ifp->if_xname); 4677 sp->pp_alivecnt = 0; 4678 4679 /* we are down, close all open protocols */ 4680 lcp.Close(sp); 4681 4682 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4683 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4684 4685 /* Close connection imediatly, completition of this 4686 * will summon the magic needed to reestablish it. */ 4687 sp->pp_tlf(sp); 4688 continue; 4689 } 4690 } 4691 if (sp->pp_alivecnt <= MAXALIVECNT) 4692 ++sp->pp_alivecnt; 4693 if (sp->pp_flags & PP_CISCO) 4694 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4695 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4696 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4697 int32_t nmagic = htonl(sp->lcp.magic); 4698 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4699 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4700 sp->lcp.echoid, 4, &nmagic); 4701 } 4702 } 4703 splx(s); 4704 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4705 } 4706 4707 /* 4708 * Get both IP addresses. 4709 */ 4710 static void 4711 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask) 4712 { 4713 struct ifnet *ifp = &sp->pp_if; 4714 struct ifaddr *ifa; 4715 struct sockaddr_in *si, *sm; 4716 u_int32_t ssrc, ddst; 4717 4718 sm = NULL; 4719 ssrc = ddst = 0; 4720 /* 4721 * Pick the first AF_INET address from the list, 4722 * aliases don't make any sense on a p2p link anyway. 4723 */ 4724 si = 0; 4725 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4726 if (ifa->ifa_addr->sa_family == AF_INET) { 4727 si = (struct sockaddr_in *)ifa->ifa_addr; 4728 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4729 if (si) 4730 break; 4731 } 4732 } 4733 if (ifa) { 4734 if (si && si->sin_addr.s_addr) { 4735 ssrc = si->sin_addr.s_addr; 4736 if (srcmask) 4737 *srcmask = ntohl(sm->sin_addr.s_addr); 4738 } 4739 4740 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4741 if (si && si->sin_addr.s_addr) 4742 ddst = si->sin_addr.s_addr; 4743 } 4744 4745 if (dst) *dst = ntohl(ddst); 4746 if (src) *src = ntohl(ssrc); 4747 } 4748 4749 /* 4750 * Set IP addresses. Must be called at splnet. 4751 * If an address is 0, leave it the way it is. 4752 */ 4753 static void 4754 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4755 { 4756 STDDCL; 4757 struct ifaddr *ifa; 4758 struct sockaddr_in *si; 4759 struct sockaddr_in *dest; 4760 4761 /* 4762 * Pick the first AF_INET address from the list, 4763 * aliases don't make any sense on a p2p link anyway. 4764 */ 4765 4766 si = 0; 4767 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4768 { 4769 if (ifa->ifa_addr->sa_family == AF_INET) 4770 { 4771 si = (struct sockaddr_in *)ifa->ifa_addr; 4772 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4773 if (si) 4774 break; 4775 } 4776 } 4777 4778 if (ifa && si) 4779 { 4780 int error; 4781 struct sockaddr_in new_sin = *si; 4782 struct sockaddr_in new_dst = *dest; 4783 4784 /* 4785 * Scrub old routes now instead of calling in_ifinit with 4786 * scrub=1, because we may change the dstaddr 4787 * before the call to in_ifinit. 4788 */ 4789 in_ifscrub(ifp, ifatoia(ifa)); 4790 4791 if (myaddr != 0) 4792 new_sin.sin_addr.s_addr = htonl(myaddr); 4793 if (hisaddr != 0) { 4794 new_dst.sin_addr.s_addr = htonl(hisaddr); 4795 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4796 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4797 *dest = new_dst; /* fix dstaddr in place */ 4798 } 4799 } 4800 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4801 if(debug && error) 4802 { 4803 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit " 4804 " failed, error=%d\n", SPP_ARGS(ifp), error); 4805 } 4806 } 4807 } 4808 4809 /* 4810 * Clear IP addresses. Must be called at splnet. 4811 */ 4812 static void 4813 sppp_clear_ip_addrs(struct sppp *sp) 4814 { 4815 struct ifnet *ifp = &sp->pp_if; 4816 struct ifaddr *ifa; 4817 struct sockaddr_in *si; 4818 struct sockaddr_in *dest; 4819 4820 u_int32_t remote; 4821 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4822 remote = sp->ipcp.saved_hisaddr; 4823 else 4824 sppp_get_ip_addrs(sp, 0, &remote, 0); 4825 4826 /* 4827 * Pick the first AF_INET address from the list, 4828 * aliases don't make any sense on a p2p link anyway. 4829 */ 4830 4831 si = 0; 4832 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4833 { 4834 if (ifa->ifa_addr->sa_family == AF_INET) 4835 { 4836 si = (struct sockaddr_in *)ifa->ifa_addr; 4837 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4838 if (si) 4839 break; 4840 } 4841 } 4842 4843 if (ifa && si) 4844 { 4845 struct sockaddr_in new_sin = *si; 4846 4847 in_ifscrub(ifp, ifatoia(ifa)); 4848 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4849 new_sin.sin_addr.s_addr = 0; 4850 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4851 /* replace peer addr in place */ 4852 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4853 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4854 } 4855 } 4856 4857 #ifdef INET6 4858 /* 4859 * Get both IPv6 addresses. 4860 */ 4861 static void 4862 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4863 struct in6_addr *srcmask) 4864 { 4865 struct ifnet *ifp = &sp->pp_if; 4866 struct ifaddr *ifa; 4867 struct sockaddr_in6 *si, *sm; 4868 struct in6_addr ssrc, ddst; 4869 4870 sm = NULL; 4871 memset(&ssrc, 0, sizeof(ssrc)); 4872 memset(&ddst, 0, sizeof(ddst)); 4873 /* 4874 * Pick the first link-local AF_INET6 address from the list, 4875 * aliases don't make any sense on a p2p link anyway. 4876 */ 4877 si = 0; 4878 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4879 if (ifa->ifa_addr->sa_family == AF_INET6) { 4880 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4881 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4882 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4883 break; 4884 } 4885 if (ifa) { 4886 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4887 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4888 if (srcmask) { 4889 bcopy(&sm->sin6_addr, srcmask, 4890 sizeof(*srcmask)); 4891 } 4892 } 4893 4894 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4895 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4896 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4897 } 4898 4899 if (dst) 4900 bcopy(&ddst, dst, sizeof(*dst)); 4901 if (src) 4902 bcopy(&ssrc, src, sizeof(*src)); 4903 } 4904 4905 #ifdef IPV6CP_MYIFID_DYN 4906 /* 4907 * Generate random ifid. 4908 */ 4909 static void 4910 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4911 { 4912 /* TBD */ 4913 } 4914 4915 /* 4916 * Set my IPv6 address. Must be called at splnet. 4917 */ 4918 static void 4919 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4920 { 4921 STDDCL; 4922 struct ifaddr *ifa; 4923 struct sockaddr_in6 *sin6; 4924 4925 /* 4926 * Pick the first link-local AF_INET6 address from the list, 4927 * aliases don't make any sense on a p2p link anyway. 4928 */ 4929 4930 sin6 = NULL; 4931 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4932 { 4933 if (ifa->ifa_addr->sa_family == AF_INET6) 4934 { 4935 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4936 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4937 break; 4938 } 4939 } 4940 4941 if (ifa && sin6) 4942 { 4943 int error; 4944 struct sockaddr_in6 new_sin6 = *sin6; 4945 4946 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4947 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 4948 if (debug && error) 4949 { 4950 log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit " 4951 " failed, error=%d\n", SPP_ARGS(ifp), error); 4952 } 4953 } 4954 } 4955 #endif 4956 4957 /* 4958 * Suggest a candidate address to be used by peer. 4959 */ 4960 static void 4961 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4962 { 4963 struct in6_addr myaddr; 4964 struct timeval tv; 4965 4966 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4967 4968 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4969 microtime(&tv); 4970 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4971 myaddr.s6_addr[14] ^= 0xff; 4972 myaddr.s6_addr[15] ^= 0xff; 4973 } else { 4974 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 4975 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 4976 } 4977 if (suggest) 4978 bcopy(&myaddr, suggest, sizeof(myaddr)); 4979 } 4980 #endif /*INET6*/ 4981 4982 /* 4983 * Process ioctl requests specific to the PPP interface. 4984 * Permissions have already been checked. 4985 */ 4986 static int 4987 sppp_params(struct sppp *sp, int cmd, void *data) 4988 { 4989 switch (cmd) { 4990 case SPPPGETAUTHCFG: 4991 { 4992 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 4993 int error; 4994 size_t len; 4995 4996 cfg->myauthflags = sp->myauth.flags; 4997 cfg->hisauthflags = sp->hisauth.flags; 4998 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 4999 cfg->hisauth = 0; 5000 if (sp->hisauth.proto) 5001 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5002 cfg->myauth = 0; 5003 if (sp->myauth.proto) 5004 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5005 if (cfg->myname_length == 0) { 5006 if (sp->myauth.name != NULL) 5007 cfg->myname_length = sp->myauth.name_len + 1; 5008 } else { 5009 if (sp->myauth.name == NULL) { 5010 cfg->myname_length = 0; 5011 } else { 5012 len = sp->myauth.name_len + 1; 5013 if (cfg->myname_length < len) 5014 return (ENAMETOOLONG); 5015 error = copyout(sp->myauth.name, cfg->myname, len); 5016 if (error) return error; 5017 } 5018 } 5019 if (cfg->hisname_length == 0) { 5020 if(sp->hisauth.name != NULL) 5021 cfg->hisname_length = sp->hisauth.name_len + 1; 5022 } else { 5023 if (sp->hisauth.name == NULL) { 5024 cfg->hisname_length = 0; 5025 } else { 5026 len = sp->hisauth.name_len + 1; 5027 if (cfg->hisname_length < len) 5028 return (ENAMETOOLONG); 5029 error = copyout(sp->hisauth.name, cfg->hisname, len); 5030 if (error) return error; 5031 } 5032 } 5033 } 5034 break; 5035 case SPPPSETAUTHCFG: 5036 { 5037 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5038 int error; 5039 5040 if (sp->myauth.name) { 5041 free(sp->myauth.name, M_DEVBUF); 5042 sp->myauth.name = NULL; 5043 } 5044 if (sp->myauth.secret) { 5045 free(sp->myauth.secret, M_DEVBUF); 5046 sp->myauth.secret = NULL; 5047 } 5048 if (sp->hisauth.name) { 5049 free(sp->hisauth.name, M_DEVBUF); 5050 sp->hisauth.name = NULL; 5051 } 5052 if (sp->hisauth.secret) { 5053 free(sp->hisauth.secret, M_DEVBUF); 5054 sp->hisauth.secret = NULL; 5055 } 5056 5057 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5058 if (cfg->hisname_length >= MCLBYTES) 5059 return (ENAMETOOLONG); 5060 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5061 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5062 if (error) { 5063 free(sp->hisauth.name, M_DEVBUF); 5064 sp->hisauth.name = NULL; 5065 return error; 5066 } 5067 sp->hisauth.name_len = cfg->hisname_length - 1; 5068 sp->hisauth.name[sp->hisauth.name_len] = 0; 5069 } 5070 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5071 if (cfg->hissecret_length >= MCLBYTES) 5072 return (ENAMETOOLONG); 5073 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5074 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5075 if (error) { 5076 free(sp->hisauth.secret, M_DEVBUF); 5077 sp->hisauth.secret = NULL; 5078 return error; 5079 } 5080 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5081 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5082 } 5083 if (cfg->myname != NULL && cfg->myname_length > 0) { 5084 if (cfg->myname_length >= MCLBYTES) 5085 return (ENAMETOOLONG); 5086 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5087 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5088 if (error) { 5089 free(sp->myauth.name, M_DEVBUF); 5090 sp->myauth.name = NULL; 5091 return error; 5092 } 5093 sp->myauth.name_len = cfg->myname_length - 1; 5094 sp->myauth.name[sp->myauth.name_len] = 0; 5095 } 5096 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5097 if (cfg->mysecret_length >= MCLBYTES) 5098 return (ENAMETOOLONG); 5099 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5100 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5101 if (error) { 5102 free(sp->myauth.secret, M_DEVBUF); 5103 sp->myauth.secret = NULL; 5104 return error; 5105 } 5106 sp->myauth.secret_len = cfg->mysecret_length - 1; 5107 sp->myauth.secret[sp->myauth.secret_len] = 0; 5108 } 5109 sp->myauth.flags = cfg->myauthflags; 5110 if (cfg->myauth) 5111 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5112 sp->hisauth.flags = cfg->hisauthflags; 5113 if (cfg->hisauth) 5114 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5115 sp->pp_auth_failures = 0; 5116 if (sp->hisauth.proto != 0) 5117 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5118 else 5119 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5120 } 5121 break; 5122 case SPPPGETLCPCFG: 5123 { 5124 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5125 lcp->lcp_timeout = sp->lcp.timeout; 5126 } 5127 break; 5128 case SPPPSETLCPCFG: 5129 { 5130 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5131 sp->lcp.timeout = lcp->lcp_timeout; 5132 } 5133 break; 5134 case SPPPGETSTATUS: 5135 { 5136 struct spppstatus *status = (struct spppstatus *)data; 5137 status->phase = sp->pp_phase; 5138 } 5139 break; 5140 case SPPPGETIDLETO: 5141 { 5142 struct spppidletimeout *to = (struct spppidletimeout *)data; 5143 to->idle_seconds = sp->pp_idle_timeout; 5144 } 5145 break; 5146 case SPPPSETIDLETO: 5147 { 5148 struct spppidletimeout *to = (struct spppidletimeout *)data; 5149 sp->pp_idle_timeout = to->idle_seconds; 5150 } 5151 break; 5152 case SPPPSETAUTHFAILURE: 5153 { 5154 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5155 sp->pp_max_auth_fail = afsettings->max_failures; 5156 sp->pp_auth_failures = 0; 5157 } 5158 break; 5159 case SPPPGETAUTHFAILURES: 5160 { 5161 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5162 stats->auth_failures = sp->pp_auth_failures; 5163 stats->max_failures = sp->pp_max_auth_fail; 5164 } 5165 break; 5166 case SPPPSETDNSOPTS: 5167 { 5168 struct spppdnssettings *req = (struct spppdnssettings *)data; 5169 sp->query_dns = req->query_dns & 3; 5170 } 5171 break; 5172 case SPPPGETDNSOPTS: 5173 { 5174 struct spppdnssettings *req = (struct spppdnssettings *)data; 5175 req->query_dns = sp->query_dns; 5176 } 5177 break; 5178 case SPPPGETDNSADDRS: 5179 { 5180 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5181 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5182 } 5183 break; 5184 default: 5185 return (EINVAL); 5186 } 5187 5188 return (0); 5189 } 5190 5191 static void 5192 sppp_phase_network(struct sppp *sp) 5193 { 5194 STDDCL; 5195 int i; 5196 u_int32_t mask; 5197 5198 sp->pp_phase = SPPP_PHASE_NETWORK; 5199 5200 if(debug) 5201 { 5202 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 5203 sppp_phase_name(sp->pp_phase)); 5204 } 5205 5206 /* Notify NCPs now. */ 5207 for (i = 0; i < IDX_COUNT; i++) 5208 if ((cps[i])->flags & CP_NCP) 5209 (cps[i])->Open(sp); 5210 5211 /* Send Up events to all NCPs. */ 5212 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5213 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5214 (cps[i])->Up(sp); 5215 5216 /* if no NCP is starting, all this was in vain, close down */ 5217 sppp_lcp_check_and_close(sp); 5218 } 5219 5220 5221 static const char * 5222 sppp_cp_type_name(u_char type) 5223 { 5224 static char buf[12]; 5225 switch (type) { 5226 case CONF_REQ: return "conf-req"; 5227 case CONF_ACK: return "conf-ack"; 5228 case CONF_NAK: return "conf-nak"; 5229 case CONF_REJ: return "conf-rej"; 5230 case TERM_REQ: return "term-req"; 5231 case TERM_ACK: return "term-ack"; 5232 case CODE_REJ: return "code-rej"; 5233 case PROTO_REJ: return "proto-rej"; 5234 case ECHO_REQ: return "echo-req"; 5235 case ECHO_REPLY: return "echo-reply"; 5236 case DISC_REQ: return "discard-req"; 5237 } 5238 sprintf (buf, "0x%x", type); 5239 return buf; 5240 } 5241 5242 static const char * 5243 sppp_auth_type_name(u_short proto, u_char type) 5244 { 5245 static char buf[12]; 5246 switch (proto) { 5247 case PPP_CHAP: 5248 switch (type) { 5249 case CHAP_CHALLENGE: return "challenge"; 5250 case CHAP_RESPONSE: return "response"; 5251 case CHAP_SUCCESS: return "success"; 5252 case CHAP_FAILURE: return "failure"; 5253 } 5254 case PPP_PAP: 5255 switch (type) { 5256 case PAP_REQ: return "req"; 5257 case PAP_ACK: return "ack"; 5258 case PAP_NAK: return "nak"; 5259 } 5260 } 5261 sprintf (buf, "0x%x", type); 5262 return buf; 5263 } 5264 5265 static const char * 5266 sppp_lcp_opt_name(u_char opt) 5267 { 5268 static char buf[12]; 5269 switch (opt) { 5270 case LCP_OPT_MRU: return "mru"; 5271 case LCP_OPT_ASYNC_MAP: return "async-map"; 5272 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5273 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5274 case LCP_OPT_MAGIC: return "magic"; 5275 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5276 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5277 } 5278 sprintf (buf, "0x%x", opt); 5279 return buf; 5280 } 5281 5282 static const char * 5283 sppp_ipcp_opt_name(u_char opt) 5284 { 5285 static char buf[12]; 5286 switch (opt) { 5287 case IPCP_OPT_ADDRESSES: return "addresses"; 5288 case IPCP_OPT_COMPRESSION: return "compression"; 5289 case IPCP_OPT_ADDRESS: return "address"; 5290 } 5291 sprintf (buf, "0x%x", opt); 5292 return buf; 5293 } 5294 5295 #ifdef INET6 5296 static const char * 5297 sppp_ipv6cp_opt_name(u_char opt) 5298 { 5299 static char buf[12]; 5300 switch (opt) { 5301 case IPV6CP_OPT_IFID: return "ifid"; 5302 case IPV6CP_OPT_COMPRESSION: return "compression"; 5303 } 5304 sprintf (buf, "0x%x", opt); 5305 return buf; 5306 } 5307 #endif 5308 5309 static const char * 5310 sppp_state_name(int state) 5311 { 5312 switch (state) { 5313 case STATE_INITIAL: return "initial"; 5314 case STATE_STARTING: return "starting"; 5315 case STATE_CLOSED: return "closed"; 5316 case STATE_STOPPED: return "stopped"; 5317 case STATE_CLOSING: return "closing"; 5318 case STATE_STOPPING: return "stopping"; 5319 case STATE_REQ_SENT: return "req-sent"; 5320 case STATE_ACK_RCVD: return "ack-rcvd"; 5321 case STATE_ACK_SENT: return "ack-sent"; 5322 case STATE_OPENED: return "opened"; 5323 } 5324 return "illegal"; 5325 } 5326 5327 static const char * 5328 sppp_phase_name(int phase) 5329 { 5330 switch (phase) { 5331 case SPPP_PHASE_DEAD: return "dead"; 5332 case SPPP_PHASE_ESTABLISH: return "establish"; 5333 case SPPP_PHASE_TERMINATE: return "terminate"; 5334 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5335 case SPPP_PHASE_NETWORK: return "network"; 5336 } 5337 return "illegal"; 5338 } 5339 5340 static const char * 5341 sppp_proto_name(u_short proto) 5342 { 5343 static char buf[12]; 5344 switch (proto) { 5345 case PPP_LCP: return "lcp"; 5346 case PPP_IPCP: return "ipcp"; 5347 case PPP_PAP: return "pap"; 5348 case PPP_CHAP: return "chap"; 5349 case PPP_IPV6CP: return "ipv6cp"; 5350 } 5351 sprintf(buf, "0x%x", (unsigned)proto); 5352 return buf; 5353 } 5354 5355 static void 5356 sppp_print_bytes(const u_char *p, u_short len) 5357 { 5358 addlog(" %02x", *p++); 5359 while (--len > 0) 5360 addlog("-%02x", *p++); 5361 } 5362 5363 static void 5364 sppp_print_string(const char *p, u_short len) 5365 { 5366 u_char c; 5367 5368 while (len-- > 0) { 5369 c = *p++; 5370 /* 5371 * Print only ASCII chars directly. RFC 1994 recommends 5372 * using only them, but we don't rely on it. */ 5373 if (c < ' ' || c > '~') 5374 addlog("\\x%x", c); 5375 else 5376 addlog("%c", c); 5377 } 5378 } 5379 5380 static const char * 5381 sppp_dotted_quad(u_int32_t addr) 5382 { 5383 static char s[16]; 5384 sprintf(s, "%d.%d.%d.%d", 5385 (int)((addr >> 24) & 0xff), 5386 (int)((addr >> 16) & 0xff), 5387 (int)((addr >> 8) & 0xff), 5388 (int)(addr & 0xff)); 5389 return s; 5390 } 5391 5392 /* a dummy, used to drop uninteresting events */ 5393 static void 5394 sppp_null(struct sppp *unused) 5395 { 5396 /* do just nothing */ 5397 } 5398 /* 5399 * This file is large. Tell emacs to highlight it nevertheless. 5400 * 5401 * Local Variables: 5402 * hilit-auto-highlight-maxout: 120000 5403 * End: 5404 */ 5405
Indexes created Mon Sep 29 21:09:56 GMT 2025