if_spppsubr.c revision 1.62
1 /* $NetBSD: if_spppsubr.c,v 1.62 2003/01/19 23:45:33 simonb Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.62 2003/01/19 23:45:33 simonb Exp $"); 45 46 #include "opt_inet.h" 47 #include "opt_ipx.h" 48 #include "opt_iso.h" 49 #include "opt_ns.h" 50 51 #include <sys/param.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/kernel.h> 55 #include <sys/sockio.h> 56 #include <sys/socket.h> 57 #include <sys/syslog.h> 58 #include <sys/malloc.h> 59 #include <sys/mbuf.h> 60 #include <sys/callout.h> 61 #include <sys/md5.h> 62 63 #include <net/if.h> 64 #include <net/netisr.h> 65 #include <net/if_types.h> 66 #include <net/route.h> 67 #include <net/ppp_defs.h> 68 69 #include <machine/stdarg.h> 70 71 #include <netinet/in.h> 72 #include <netinet/in_systm.h> 73 #include <netinet/in_var.h> 74 #ifdef INET 75 #include <netinet/ip.h> 76 #include <netinet/tcp.h> 77 #endif 78 #include <net/ethertypes.h> 79 80 #ifdef IPX 81 #include <netipx/ipx.h> 82 #include <netipx/ipx_if.h> 83 #endif 84 85 #ifdef NS 86 #include <netns/ns.h> 87 #include <netns/ns_if.h> 88 #endif 89 90 #ifdef ISO 91 #include <netiso/argo_debug.h> 92 #include <netiso/iso.h> 93 #include <netiso/iso_var.h> 94 #include <netiso/iso_snpac.h> 95 #endif 96 97 #include <net/if_sppp.h> 98 #include <net/if_spppvar.h> 99 100 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds */ 101 #define MAXALIVECNT 3 /* max. missed alive packets */ 102 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 103 104 /* 105 * Interface flags that can be set in an ifconfig command. 106 * 107 * Setting link0 will make the link passive, i.e. it will be marked 108 * as being administrative openable, but won't be opened to begin 109 * with. Incoming calls will be answered, or subsequent calls with 110 * -link1 will cause the administrative open of the LCP layer. 111 * 112 * Setting link1 will cause the link to auto-dial only as packets 113 * arrive to be sent. 114 * 115 * Setting IFF_DEBUG will syslog the option negotiation and state 116 * transitions at level kern.debug. Note: all logs consistently look 117 * like 118 * 119 * <if-name><unit>: <proto-name> <additional info...> 120 * 121 * with <if-name><unit> being something like "bppp0", and <proto-name> 122 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 123 */ 124 125 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 126 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 127 128 #define CONF_REQ 1 /* PPP configure request */ 129 #define CONF_ACK 2 /* PPP configure acknowledge */ 130 #define CONF_NAK 3 /* PPP configure negative ack */ 131 #define CONF_REJ 4 /* PPP configure reject */ 132 #define TERM_REQ 5 /* PPP terminate request */ 133 #define TERM_ACK 6 /* PPP terminate acknowledge */ 134 #define CODE_REJ 7 /* PPP code reject */ 135 #define PROTO_REJ 8 /* PPP protocol reject */ 136 #define ECHO_REQ 9 /* PPP echo request */ 137 #define ECHO_REPLY 10 /* PPP echo reply */ 138 #define DISC_REQ 11 /* PPP discard request */ 139 140 #define LCP_OPT_MRU 1 /* maximum receive unit */ 141 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 142 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 143 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 144 #define LCP_OPT_MAGIC 5 /* magic number */ 145 #define LCP_OPT_RESERVED 6 /* reserved */ 146 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 147 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 148 149 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 150 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 151 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 152 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 153 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 154 155 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 156 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 157 158 #define PAP_REQ 1 /* PAP name/password request */ 159 #define PAP_ACK 2 /* PAP acknowledge */ 160 #define PAP_NAK 3 /* PAP fail */ 161 162 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 163 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 164 #define CHAP_SUCCESS 3 /* CHAP response ok */ 165 #define CHAP_FAILURE 4 /* CHAP response failed */ 166 167 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 168 169 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 170 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 171 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 172 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 173 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 174 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 175 176 /* states are named and numbered according to RFC 1661 */ 177 #define STATE_INITIAL 0 178 #define STATE_STARTING 1 179 #define STATE_CLOSED 2 180 #define STATE_STOPPED 3 181 #define STATE_CLOSING 4 182 #define STATE_STOPPING 5 183 #define STATE_REQ_SENT 6 184 #define STATE_ACK_RCVD 7 185 #define STATE_ACK_SENT 8 186 #define STATE_OPENED 9 187 188 struct ppp_header { 189 u_char address; 190 u_char control; 191 u_short protocol; 192 } __attribute__((__packed__)); 193 #define PPP_HEADER_LEN sizeof (struct ppp_header) 194 195 struct lcp_header { 196 u_char type; 197 u_char ident; 198 u_short len; 199 } __attribute__((__packed__)); 200 #define LCP_HEADER_LEN sizeof (struct lcp_header) 201 202 struct cisco_packet { 203 u_int32_t type; 204 u_int32_t par1; 205 u_int32_t par2; 206 u_short rel; 207 u_short time0; 208 u_short time1; 209 } __attribute__((__packed__)); 210 #define CISCO_PACKET_LEN 18 211 212 /* 213 * We follow the spelling and capitalization of RFC 1661 here, to make 214 * it easier comparing with the standard. Please refer to this RFC in 215 * case you can't make sense out of these abbreviation; it will also 216 * explain the semantics related to the various events and actions. 217 */ 218 struct cp { 219 u_short proto; /* PPP control protocol number */ 220 u_char protoidx; /* index into state table in struct sppp */ 221 u_char flags; 222 #define CP_LCP 0x01 /* this is the LCP */ 223 #define CP_AUTH 0x02 /* this is an authentication protocol */ 224 #define CP_NCP 0x04 /* this is a NCP */ 225 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 226 const char *name; /* name of this control protocol */ 227 /* event handlers */ 228 void (*Up)(struct sppp *sp); 229 void (*Down)(struct sppp *sp); 230 void (*Open)(struct sppp *sp); 231 void (*Close)(struct sppp *sp); 232 void (*TO)(void *sp); 233 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 234 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 235 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 236 /* actions */ 237 void (*tlu)(struct sppp *sp); 238 void (*tld)(struct sppp *sp); 239 void (*tls)(struct sppp *sp); 240 void (*tlf)(struct sppp *sp); 241 void (*scr)(struct sppp *sp); 242 }; 243 244 static struct sppp *spppq; 245 static struct callout keepalive_ch; 246 247 #ifdef __FreeBSD__ 248 #define SPP_FMT "%s%d: " 249 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 250 #else 251 #define SPP_FMT "%s: " 252 #define SPP_ARGS(ifp) (ifp)->if_xname 253 #endif 254 255 #ifdef INET 256 /* 257 * The following disgusting hack gets around the problem that IP TOS 258 * can't be set yet. We want to put "interactive" traffic on a high 259 * priority queue. To decide if traffic is interactive, we check that 260 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 261 * 262 * XXX is this really still necessary? - joerg - 263 */ 264 static u_short interactive_ports[8] = { 265 0, 513, 0, 0, 266 0, 21, 0, 23, 267 }; 268 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 269 #endif 270 271 /* almost every function needs these */ 272 #define STDDCL \ 273 struct ifnet *ifp = &sp->pp_if; \ 274 int debug = ifp->if_flags & IFF_DEBUG 275 276 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 277 struct sockaddr *dst, struct rtentry *rt); 278 279 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 280 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 281 282 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 283 struct mbuf *m); 284 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 285 u_char ident, u_short len, void *data); 286 /* static void sppp_cp_timeout(void *arg); */ 287 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 288 int newstate); 289 static void sppp_auth_send(const struct cp *cp, 290 struct sppp *sp, unsigned int type, unsigned int id, 291 ...); 292 293 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 294 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 295 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 296 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 297 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 298 299 static void sppp_null(struct sppp *sp); 300 301 static void sppp_lcp_init(struct sppp *sp); 302 static void sppp_lcp_up(struct sppp *sp); 303 static void sppp_lcp_down(struct sppp *sp); 304 static void sppp_lcp_open(struct sppp *sp); 305 static void sppp_lcp_close(struct sppp *sp); 306 static void sppp_lcp_TO(void *sp); 307 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 308 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 309 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 310 static void sppp_lcp_tlu(struct sppp *sp); 311 static void sppp_lcp_tld(struct sppp *sp); 312 static void sppp_lcp_tls(struct sppp *sp); 313 static void sppp_lcp_tlf(struct sppp *sp); 314 static void sppp_lcp_scr(struct sppp *sp); 315 static void sppp_lcp_check_and_close(struct sppp *sp); 316 static int sppp_ncp_check(struct sppp *sp); 317 318 static void sppp_ipcp_init(struct sppp *sp); 319 static void sppp_ipcp_up(struct sppp *sp); 320 static void sppp_ipcp_down(struct sppp *sp); 321 static void sppp_ipcp_open(struct sppp *sp); 322 static void sppp_ipcp_close(struct sppp *sp); 323 static void sppp_ipcp_TO(void *sp); 324 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 325 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 326 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 327 static void sppp_ipcp_tlu(struct sppp *sp); 328 static void sppp_ipcp_tld(struct sppp *sp); 329 static void sppp_ipcp_tls(struct sppp *sp); 330 static void sppp_ipcp_tlf(struct sppp *sp); 331 static void sppp_ipcp_scr(struct sppp *sp); 332 333 static void sppp_ipv6cp_init(struct sppp *sp); 334 static void sppp_ipv6cp_up(struct sppp *sp); 335 static void sppp_ipv6cp_down(struct sppp *sp); 336 static void sppp_ipv6cp_open(struct sppp *sp); 337 static void sppp_ipv6cp_close(struct sppp *sp); 338 static void sppp_ipv6cp_TO(void *sp); 339 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 340 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 341 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 342 static void sppp_ipv6cp_tlu(struct sppp *sp); 343 static void sppp_ipv6cp_tld(struct sppp *sp); 344 static void sppp_ipv6cp_tls(struct sppp *sp); 345 static void sppp_ipv6cp_tlf(struct sppp *sp); 346 static void sppp_ipv6cp_scr(struct sppp *sp); 347 348 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 349 static void sppp_pap_init(struct sppp *sp); 350 static void sppp_pap_open(struct sppp *sp); 351 static void sppp_pap_close(struct sppp *sp); 352 static void sppp_pap_TO(void *sp); 353 static void sppp_pap_my_TO(void *sp); 354 static void sppp_pap_tlu(struct sppp *sp); 355 static void sppp_pap_tld(struct sppp *sp); 356 static void sppp_pap_scr(struct sppp *sp); 357 358 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 359 static void sppp_chap_init(struct sppp *sp); 360 static void sppp_chap_open(struct sppp *sp); 361 static void sppp_chap_close(struct sppp *sp); 362 static void sppp_chap_TO(void *sp); 363 static void sppp_chap_tlu(struct sppp *sp); 364 static void sppp_chap_tld(struct sppp *sp); 365 static void sppp_chap_scr(struct sppp *sp); 366 367 static const char *sppp_auth_type_name(u_short proto, u_char type); 368 static const char *sppp_cp_type_name(u_char type); 369 static const char *sppp_dotted_quad(u_int32_t addr); 370 static const char *sppp_ipcp_opt_name(u_char opt); 371 #ifdef INET6 372 static const char *sppp_ipv6cp_opt_name(u_char opt); 373 #endif 374 static const char *sppp_lcp_opt_name(u_char opt); 375 static const char *sppp_phase_name(int phase); 376 static const char *sppp_proto_name(u_short proto); 377 static const char *sppp_state_name(int state); 378 static int sppp_params(struct sppp *sp, int cmd, void *data); 379 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 380 u_int32_t *srcmask); 381 static void sppp_keepalive(void *dummy); 382 static void sppp_phase_network(struct sppp *sp); 383 static void sppp_print_bytes(const u_char *p, u_short len); 384 static void sppp_print_string(const char *p, u_short len); 385 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr); 386 static void sppp_clear_ip_addrs(struct sppp *sp); 387 #ifdef INET6 388 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 389 struct in6_addr *dst, struct in6_addr *srcmask); 390 #ifdef IPV6CP_MYIFID_DYN 391 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 392 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 393 #endif 394 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 395 #endif 396 397 /* our control protocol descriptors */ 398 static const struct cp lcp = { 399 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 400 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 401 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 402 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 403 sppp_lcp_scr 404 }; 405 406 static const struct cp ipcp = { 407 PPP_IPCP, IDX_IPCP, 408 #ifdef INET 409 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 410 #else 411 0, 412 #endif 413 "ipcp", 414 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 415 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 416 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 417 sppp_ipcp_scr 418 }; 419 420 static const struct cp ipv6cp = { 421 PPP_IPV6CP, IDX_IPV6CP, 422 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 423 CP_NCP, 424 #else 425 0, 426 #endif 427 "ipv6cp", 428 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 429 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 430 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 431 sppp_ipv6cp_scr 432 }; 433 434 static const struct cp pap = { 435 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 436 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 437 sppp_pap_TO, 0, 0, 0, 438 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 439 sppp_pap_scr 440 }; 441 442 static const struct cp chap = { 443 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 444 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 445 sppp_chap_TO, 0, 0, 0, 446 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 447 sppp_chap_scr 448 }; 449 450 static const struct cp *cps[IDX_COUNT] = { 451 &lcp, /* IDX_LCP */ 452 &ipcp, /* IDX_IPCP */ 453 &ipv6cp, /* IDX_IPV6CP */ 454 &pap, /* IDX_PAP */ 455 &chap, /* IDX_CHAP */ 456 }; 457 458 459 /* 460 * Exported functions, comprising our interface to the lower layer. 461 */ 462 463 /* 464 * Process the received packet. 465 */ 466 void 467 sppp_input(struct ifnet *ifp, struct mbuf *m) 468 { 469 struct ppp_header *h = NULL; 470 struct ifqueue *inq = 0; 471 u_int16_t protocol; 472 int s; 473 struct sppp *sp = (struct sppp *)ifp; 474 int debug = ifp->if_flags & IFF_DEBUG; 475 476 if (ifp->if_flags & IFF_UP) 477 /* Count received bytes, add hardware framing */ 478 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 479 480 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 481 /* Too small packet, drop it. */ 482 if (debug) 483 log(LOG_DEBUG, 484 SPP_FMT "input packet is too small, %d bytes\n", 485 SPP_ARGS(ifp), m->m_pkthdr.len); 486 drop: 487 ++ifp->if_ierrors; 488 ++ifp->if_iqdrops; 489 m_freem(m); 490 return; 491 } 492 493 if (sp->pp_flags & PP_NOFRAMING) { 494 memcpy(&protocol, mtod(m, void *), 2); 495 protocol = ntohs(protocol); 496 m_adj(m, 2); 497 } else { 498 499 /* Get PPP header. */ 500 h = mtod(m, struct ppp_header *); 501 m_adj(m, PPP_HEADER_LEN); 502 503 switch (h->address) { 504 case PPP_ALLSTATIONS: 505 if (h->control != PPP_UI) 506 goto invalid; 507 if (sp->pp_flags & PP_CISCO) { 508 if (debug) 509 log(LOG_DEBUG, 510 SPP_FMT "PPP packet in Cisco mode " 511 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 512 SPP_ARGS(ifp), 513 h->address, h->control, ntohs(h->protocol)); 514 goto drop; 515 } 516 break; 517 case CISCO_MULTICAST: 518 case CISCO_UNICAST: 519 /* Don't check the control field here (RFC 1547). */ 520 if (! (sp->pp_flags & PP_CISCO)) { 521 if (debug) 522 log(LOG_DEBUG, 523 SPP_FMT "Cisco packet in PPP mode " 524 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 525 SPP_ARGS(ifp), 526 h->address, h->control, ntohs(h->protocol)); 527 goto drop; 528 } 529 switch (ntohs(h->protocol)) { 530 default: 531 ++ifp->if_noproto; 532 goto invalid; 533 case CISCO_KEEPALIVE: 534 sppp_cisco_input((struct sppp *) ifp, m); 535 m_freem(m); 536 return; 537 #ifdef INET 538 case ETHERTYPE_IP: 539 schednetisr(NETISR_IP); 540 inq = &ipintrq; 541 break; 542 #endif 543 #ifdef INET6 544 case ETHERTYPE_IPV6: 545 schednetisr(NETISR_IPV6); 546 inq = &ip6intrq; 547 break; 548 #endif 549 #ifdef IPX 550 case ETHERTYPE_IPX: 551 schednetisr(NETISR_IPX); 552 inq = &ipxintrq; 553 break; 554 #endif 555 #ifdef NS 556 case ETHERTYPE_NS: 557 schednetisr(NETISR_NS); 558 inq = &nsintrq; 559 break; 560 #endif 561 } 562 goto queue_pkt; 563 default: /* Invalid PPP packet. */ 564 invalid: 565 if (debug) 566 log(LOG_DEBUG, 567 SPP_FMT "invalid input packet " 568 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 569 SPP_ARGS(ifp), 570 h->address, h->control, ntohs(h->protocol)); 571 goto drop; 572 } 573 protocol = ntohs(h->protocol); 574 } 575 576 switch (protocol) { 577 default: 578 if (sp->state[IDX_LCP] == STATE_OPENED) { 579 u_int16_t prot = htons(protocol); 580 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 581 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 582 &prot); 583 } 584 if (debug) 585 log(LOG_DEBUG, 586 SPP_FMT "invalid input protocol " 587 "<proto=0x%x>\n", SPP_ARGS(ifp), ntohs(protocol)); 588 ++ifp->if_noproto; 589 goto drop; 590 case PPP_LCP: 591 sppp_cp_input(&lcp, sp, m); 592 m_freem(m); 593 return; 594 case PPP_PAP: 595 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 596 sppp_pap_input(sp, m); 597 m_freem(m); 598 return; 599 case PPP_CHAP: 600 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 601 sppp_chap_input(sp, m); 602 m_freem(m); 603 return; 604 #ifdef INET 605 case PPP_IPCP: 606 if (sp->pp_phase == SPPP_PHASE_NETWORK) 607 sppp_cp_input(&ipcp, sp, m); 608 m_freem(m); 609 return; 610 case PPP_IP: 611 if (sp->state[IDX_IPCP] == STATE_OPENED) { 612 schednetisr(NETISR_IP); 613 inq = &ipintrq; 614 sp->pp_last_activity = mono_time.tv_sec; 615 } 616 break; 617 #endif 618 #ifdef INET6 619 case PPP_IPV6CP: 620 if (sp->pp_phase == SPPP_PHASE_NETWORK) 621 sppp_cp_input(&ipv6cp, sp, m); 622 m_freem(m); 623 return; 624 625 case PPP_IPV6: 626 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 627 schednetisr(NETISR_IPV6); 628 inq = &ip6intrq; 629 sp->pp_last_activity = mono_time.tv_sec; 630 } 631 break; 632 #endif 633 #ifdef IPX 634 case PPP_IPX: 635 /* IPX IPXCP not implemented yet */ 636 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 637 schednetisr(NETISR_IPX); 638 inq = &ipxintrq; 639 } 640 break; 641 #endif 642 #ifdef NS 643 case PPP_XNS: 644 /* XNS IDPCP not implemented yet */ 645 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 646 schednetisr(NETISR_NS); 647 inq = &nsintrq; 648 } 649 break; 650 #endif 651 #ifdef ISO 652 case PPP_ISO: 653 /* OSI NLCP not implemented yet */ 654 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 655 schednetisr(NETISR_ISO); 656 inq = &clnlintrq; 657 } 658 break; 659 #endif 660 } 661 662 queue_pkt: 663 if (! (ifp->if_flags & IFF_UP) || ! inq) 664 goto drop; 665 666 /* Check queue. */ 667 s = splnet(); 668 if (IF_QFULL(inq)) { 669 /* Queue overflow. */ 670 IF_DROP(inq); 671 splx(s); 672 if (debug) 673 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 674 SPP_ARGS(ifp)); 675 goto drop; 676 } 677 IF_ENQUEUE(inq, m); 678 splx(s); 679 } 680 681 /* 682 * Enqueue transmit packet. 683 */ 684 static int 685 sppp_output(struct ifnet *ifp, struct mbuf *m, 686 struct sockaddr *dst, struct rtentry *rt) 687 { 688 struct sppp *sp = (struct sppp *) ifp; 689 struct ppp_header *h = NULL; 690 struct ifqueue *ifq = NULL; /* XXX */ 691 int s, len, rv = 0; 692 u_int16_t protocol; 693 ALTQ_DECL(struct altq_pktattr pktattr;) 694 695 s = splnet(); 696 697 sp->pp_last_activity = mono_time.tv_sec; 698 699 if ((ifp->if_flags & IFF_UP) == 0 || 700 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 701 m_freem(m); 702 splx(s); 703 return (ENETDOWN); 704 } 705 706 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 707 /* 708 * Interface is not yet running, but auto-dial. Need 709 * to start LCP for it. 710 */ 711 ifp->if_flags |= IFF_RUNNING; 712 splx(s); 713 lcp.Open(sp); 714 s = splnet(); 715 } 716 717 /* 718 * If the queueing discipline needs packet classification, 719 * do it before prepending link headers. 720 */ 721 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 722 723 #ifdef INET 724 if (dst->sa_family == AF_INET) { 725 struct ip *ip = NULL; 726 struct tcphdr *th = NULL; 727 728 if (m->m_len >= sizeof(struct ip)) { 729 ip = mtod(m, struct ip *); 730 if (ip->ip_p == IPPROTO_TCP && 731 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 732 sizeof(struct tcphdr)) { 733 th = (struct tcphdr *) 734 ((caddr_t)ip + (ip->ip_hl << 2)); 735 } 736 } else 737 ip = NULL; 738 739 /* 740 * When using dynamic local IP address assignment by using 741 * 0.0.0.0 as a local address, the first TCP session will 742 * not connect because the local TCP checksum is computed 743 * using 0.0.0.0 which will later become our real IP address 744 * so the TCP checksum computed at the remote end will 745 * become invalid. So we 746 * - don't let packets with src ip addr 0 thru 747 * - we flag TCP packets with src ip 0 as an error 748 */ 749 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 750 u_int8_t proto = ip->ip_p; 751 752 m_freem(m); 753 splx(s); 754 if (proto == IPPROTO_TCP) 755 return (EADDRNOTAVAIL); 756 else 757 return (0); 758 } 759 760 /* 761 * Put low delay, telnet, rlogin and ftp control packets 762 * in front of the queue. 763 */ 764 765 if (!IF_QFULL(&sp->pp_fastq) && 766 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 767 (th && (INTERACTIVE(ntohs(th->th_sport)) || 768 INTERACTIVE(ntohs(th->th_dport)))))) 769 ifq = &sp->pp_fastq; 770 } 771 #endif 772 773 #ifdef INET6 774 if (dst->sa_family == AF_INET6) { 775 /* XXX do something tricky here? */ 776 } 777 #endif 778 779 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 780 /* 781 * Prepend general data packet PPP header. For now, IP only. 782 */ 783 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 784 if (! m) { 785 if (ifp->if_flags & IFF_DEBUG) 786 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 787 SPP_ARGS(ifp)); 788 ++ifp->if_oerrors; 789 splx(s); 790 return (ENOBUFS); 791 } 792 /* 793 * May want to check size of packet 794 * (albeit due to the implementation it's always enough) 795 */ 796 h = mtod(m, struct ppp_header *); 797 if (sp->pp_flags & PP_CISCO) { 798 h->address = CISCO_UNICAST; /* unicast address */ 799 h->control = 0; 800 } else { 801 h->address = PPP_ALLSTATIONS; /* broadcast address */ 802 h->control = PPP_UI; /* Unnumbered Info */ 803 } 804 } 805 806 switch (dst->sa_family) { 807 #ifdef INET 808 case AF_INET: /* Internet Protocol */ 809 if (sp->pp_flags & PP_CISCO) 810 protocol = htons(ETHERTYPE_IP); 811 else { 812 /* 813 * Don't choke with an ENETDOWN early. It's 814 * possible that we just started dialing out, 815 * so don't drop the packet immediately. If 816 * we notice that we run out of buffer space 817 * below, we will however remember that we are 818 * not ready to carry IP packets, and return 819 * ENETDOWN, as opposed to ENOBUFS. 820 */ 821 protocol = htons(PPP_IP); 822 if (sp->state[IDX_IPCP] != STATE_OPENED) 823 rv = ENETDOWN; 824 } 825 break; 826 #endif 827 #ifdef INET6 828 case AF_INET6: /* Internet Protocol version 6 */ 829 if (sp->pp_flags & PP_CISCO) 830 protocol = htons(ETHERTYPE_IPV6); 831 else { 832 /* 833 * Don't choke with an ENETDOWN early. It's 834 * possible that we just started dialing out, 835 * so don't drop the packet immediately. If 836 * we notice that we run out of buffer space 837 * below, we will however remember that we are 838 * not ready to carry IP packets, and return 839 * ENETDOWN, as opposed to ENOBUFS. 840 */ 841 protocol = htons(PPP_IPV6); 842 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 843 rv = ENETDOWN; 844 } 845 break; 846 #endif 847 #ifdef NS 848 case AF_NS: /* Xerox NS Protocol */ 849 protocol = htons((sp->pp_flags & PP_CISCO) ? 850 ETHERTYPE_NS : PPP_XNS); 851 break; 852 #endif 853 #ifdef IPX 854 case AF_IPX: /* Novell IPX Protocol */ 855 protocol = htons((sp->pp_flags & PP_CISCO) ? 856 ETHERTYPE_IPX : PPP_IPX); 857 break; 858 #endif 859 #ifdef ISO 860 case AF_ISO: /* ISO OSI Protocol */ 861 if (sp->pp_flags & PP_CISCO) 862 goto nosupport; 863 protocol = htons(PPP_ISO); 864 break; 865 nosupport: 866 #endif 867 default: 868 m_freem(m); 869 ++ifp->if_oerrors; 870 splx(s); 871 return (EAFNOSUPPORT); 872 } 873 874 if (sp->pp_flags & PP_NOFRAMING) { 875 M_PREPEND(m, 2, M_DONTWAIT); 876 if (m == NULL) { 877 if (ifp->if_flags & IFF_DEBUG) 878 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 879 SPP_ARGS(ifp)); 880 ++ifp->if_oerrors; 881 splx(s); 882 return (ENOBUFS); 883 } 884 *mtod(m, u_int16_t *) = protocol; 885 } else { 886 h->protocol = protocol; 887 } 888 889 /* 890 * Queue message on interface, and start output if interface 891 * not yet active. 892 */ 893 len = m->m_pkthdr.len; 894 if (ifq != NULL 895 #ifdef ALTQ 896 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 897 #endif 898 ) { 899 if (IF_QFULL(ifq)) { 900 IF_DROP(&ifp->if_snd); 901 m_freem(m); 902 if (rv == 0) 903 rv = ENOBUFS; 904 } 905 else 906 IF_ENQUEUE(ifq, m); 907 } else 908 IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv); 909 if (rv != 0) { 910 ++ifp->if_oerrors; 911 splx(s); 912 return (rv); 913 } 914 915 if (! (ifp->if_flags & IFF_OACTIVE)) 916 (*ifp->if_start)(ifp); 917 918 /* 919 * Count output packets and bytes. 920 * The packet length includes header + additional hardware framing 921 * according to RFC 1333. 922 */ 923 ifp->if_obytes += len + sp->pp_framebytes; 924 splx(s); 925 return (0); 926 } 927 928 void 929 sppp_attach(struct ifnet *ifp) 930 { 931 struct sppp *sp = (struct sppp *) ifp; 932 933 /* Initialize keepalive handler. */ 934 if (! spppq) { 935 callout_init(&keepalive_ch); 936 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 937 } 938 939 /* Insert new entry into the keepalive list. */ 940 sp->pp_next = spppq; 941 spppq = sp; 942 943 sp->pp_if.if_type = IFT_PPP; 944 sp->pp_if.if_output = sppp_output; 945 sp->pp_fastq.ifq_maxlen = 32; 946 sp->pp_cpq.ifq_maxlen = 20; 947 sp->pp_loopcnt = 0; 948 sp->pp_alivecnt = 0; 949 sp->pp_last_activity = 0; 950 sp->pp_idle_timeout = 0; 951 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 952 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 953 sp->pp_auth_failures = 0; 954 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 955 sp->pp_phase = SPPP_PHASE_DEAD; 956 sp->pp_up = lcp.Up; 957 sp->pp_down = lcp.Down; 958 959 if_alloc_sadl(ifp); 960 961 memset(&sp->myauth, 0, sizeof sp->myauth); 962 memset(&sp->hisauth, 0, sizeof sp->hisauth); 963 sppp_lcp_init(sp); 964 sppp_ipcp_init(sp); 965 sppp_ipv6cp_init(sp); 966 sppp_pap_init(sp); 967 sppp_chap_init(sp); 968 } 969 970 void 971 sppp_detach(struct ifnet *ifp) 972 { 973 struct sppp **q, *p, *sp = (struct sppp *) ifp; 974 int i; 975 976 /* Remove the entry from the keepalive list. */ 977 for (q = &spppq; (p = *q); q = &p->pp_next) 978 if (p == sp) { 979 *q = p->pp_next; 980 break; 981 } 982 983 /* Stop keepalive handler. */ 984 if (! spppq) { 985 callout_stop(&keepalive_ch); 986 } 987 988 for (i = 0; i < IDX_COUNT; i++) { 989 callout_stop(&sp->ch[i]); 990 } 991 callout_stop(&sp->pap_my_to_ch); 992 993 /* free authentication info */ 994 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 995 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 996 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 997 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 998 999 if_free_sadl(ifp); 1000 } 1001 1002 /* 1003 * Flush the interface output queue. 1004 */ 1005 void 1006 sppp_flush(struct ifnet *ifp) 1007 { 1008 struct sppp *sp = (struct sppp *) ifp; 1009 1010 IFQ_PURGE(&sp->pp_if.if_snd); 1011 IF_PURGE(&sp->pp_fastq); 1012 IF_PURGE(&sp->pp_cpq); 1013 } 1014 1015 /* 1016 * Check if the output queue is empty. 1017 */ 1018 int 1019 sppp_isempty(struct ifnet *ifp) 1020 { 1021 struct sppp *sp = (struct sppp *) ifp; 1022 int empty, s; 1023 1024 s = splnet(); 1025 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1026 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1027 splx(s); 1028 return (empty); 1029 } 1030 1031 /* 1032 * Get next packet to send. 1033 */ 1034 struct mbuf * 1035 sppp_dequeue(struct ifnet *ifp) 1036 { 1037 struct sppp *sp = (struct sppp *) ifp; 1038 struct mbuf *m; 1039 int s; 1040 1041 s = splnet(); 1042 /* 1043 * Process only the control protocol queue until we have at 1044 * least one NCP open. 1045 * 1046 * Do always serve all three queues in Cisco mode. 1047 */ 1048 IF_DEQUEUE(&sp->pp_cpq, m); 1049 if (m == NULL && 1050 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1051 IF_DEQUEUE(&sp->pp_fastq, m); 1052 if (m == NULL) 1053 IF_DEQUEUE(&sp->pp_if.if_snd, m); 1054 } 1055 splx(s); 1056 return m; 1057 } 1058 1059 /* 1060 * Pick the next packet, do not remove it from the queue. 1061 */ 1062 struct mbuf * 1063 sppp_pick(struct ifnet *ifp) 1064 { 1065 struct sppp *sp = (struct sppp *)ifp; 1066 struct mbuf *m; 1067 int s; 1068 1069 s= splnet(); 1070 1071 m = sp->pp_cpq.ifq_head; 1072 if (m == NULL && 1073 (sp->pp_phase == SPPP_PHASE_NETWORK || 1074 (sp->pp_flags & PP_CISCO) != 0)) 1075 if ((m = sp->pp_fastq.ifq_head) == NULL) 1076 m = sp->pp_if.if_snd.ifq_head; 1077 splx(s); 1078 return (m); 1079 } 1080 1081 /* 1082 * Process an ioctl request. Called on low priority level. 1083 */ 1084 int 1085 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1086 { 1087 struct ifreq *ifr = (struct ifreq *) data; 1088 struct sppp *sp = (struct sppp *) ifp; 1089 int s, error=0, going_up, going_down, newmode; 1090 1091 s = splnet(); 1092 switch (cmd) { 1093 case SIOCAIFADDR: 1094 case SIOCSIFDSTADDR: 1095 break; 1096 1097 case SIOCSIFADDR: 1098 if_up(ifp); 1099 /* fall through... */ 1100 1101 case SIOCSIFFLAGS: 1102 going_up = ifp->if_flags & IFF_UP && 1103 (ifp->if_flags & IFF_RUNNING) == 0; 1104 going_down = (ifp->if_flags & IFF_UP) == 0 && 1105 ifp->if_flags & IFF_RUNNING; 1106 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1107 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1108 /* sanity */ 1109 newmode = IFF_PASSIVE; 1110 ifp->if_flags &= ~IFF_AUTO; 1111 } 1112 1113 if (going_up || going_down) 1114 lcp.Close(sp); 1115 if (going_up && newmode == 0) { 1116 /* neither auto-dial nor passive */ 1117 ifp->if_flags |= IFF_RUNNING; 1118 if (!(sp->pp_flags & PP_CISCO)) 1119 lcp.Open(sp); 1120 } else if (going_down) { 1121 sppp_flush(ifp); 1122 ifp->if_flags &= ~IFF_RUNNING; 1123 } 1124 1125 break; 1126 1127 #ifdef SIOCSIFMTU 1128 #ifndef ifr_mtu 1129 #define ifr_mtu ifr_metric 1130 #endif 1131 case SIOCSIFMTU: 1132 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1133 error = EINVAL; 1134 break; 1135 } 1136 1137 ifp->if_mtu = ifr->ifr_mtu; 1138 break; 1139 #endif 1140 #ifdef SLIOCSETMTU 1141 case SLIOCSETMTU: 1142 if (*(short *)data < 128 || *(short *)data > sp->lcp.their_mru) 1143 { 1144 error = EINVAL; 1145 break; 1146 } 1147 1148 ifp->if_mtu = *(short *)data; 1149 break; 1150 #endif 1151 #ifdef SIOCGIFMTU 1152 case SIOCGIFMTU: 1153 ifr->ifr_mtu = ifp->if_mtu; 1154 break; 1155 #endif 1156 #ifdef SLIOCGETMTU 1157 case SLIOCGETMTU: 1158 *(short *)data = ifp->if_mtu; 1159 break; 1160 #endif 1161 case SIOCADDMULTI: 1162 case SIOCDELMULTI: 1163 break; 1164 1165 case SPPPSETAUTHCFG: 1166 case SPPPSETLCPCFG: 1167 case SPPPSETIDLETO: 1168 case SPPPSETAUTHFAILURE: 1169 case SPPPSETDNSOPTS: 1170 { 1171 struct proc *p = curproc; /* XXX */ 1172 1173 if ((error = suser(p->p_ucred, &p->p_acflag)) != 0) 1174 break; 1175 } 1176 /* FALLTHROUGH */ 1177 case SPPPGETAUTHCFG: 1178 case SPPPGETLCPCFG: 1179 case SPPPGETSTATUS: 1180 case SPPPGETIDLETO: 1181 case SPPPGETAUTHFAILURES: 1182 case SPPPGETDNSOPTS: 1183 case SPPPGETDNSADDRS: 1184 error = sppp_params(sp, cmd, data); 1185 break; 1186 1187 default: 1188 error = ENOTTY; 1189 } 1190 splx(s); 1191 return (error); 1192 } 1193 1194 1195 /* 1196 * Cisco framing implementation. 1197 */ 1198 1199 /* 1200 * Handle incoming Cisco keepalive protocol packets. 1201 */ 1202 static void 1203 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1204 { 1205 STDDCL; 1206 struct cisco_packet *h; 1207 u_int32_t me, mymask; 1208 1209 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1210 if (debug) 1211 log(LOG_DEBUG, 1212 SPP_FMT "cisco invalid packet length: %d bytes\n", 1213 SPP_ARGS(ifp), m->m_pkthdr.len); 1214 return; 1215 } 1216 h = mtod(m, struct cisco_packet *); 1217 if (debug) 1218 log(LOG_DEBUG, 1219 SPP_FMT "cisco input: %d bytes " 1220 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1221 SPP_ARGS(ifp), m->m_pkthdr.len, 1222 ntohl (h->type), h->par1, h->par2, (u_int)h->rel, 1223 (u_int)h->time0, (u_int)h->time1); 1224 switch (ntohl (h->type)) { 1225 default: 1226 if (debug) 1227 addlog(SPP_FMT "cisco unknown packet type: 0x%x\n", 1228 SPP_ARGS(ifp), ntohl (h->type)); 1229 break; 1230 case CISCO_ADDR_REPLY: 1231 /* Reply on address request, ignore */ 1232 break; 1233 case CISCO_KEEPALIVE_REQ: 1234 sp->pp_alivecnt = 0; 1235 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1236 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1237 /* Local and remote sequence numbers are equal. 1238 * Probably, the line is in loopback mode. */ 1239 if (sp->pp_loopcnt >= MAXALIVECNT) { 1240 printf (SPP_FMT "loopback\n", 1241 SPP_ARGS(ifp)); 1242 sp->pp_loopcnt = 0; 1243 if (ifp->if_flags & IFF_UP) { 1244 if_down(ifp); 1245 IF_PURGE(&sp->pp_cpq); 1246 } 1247 } 1248 ++sp->pp_loopcnt; 1249 1250 /* Generate new local sequence number */ 1251 sp->pp_seq[IDX_LCP] = random(); 1252 break; 1253 } 1254 sp->pp_loopcnt = 0; 1255 if (! (ifp->if_flags & IFF_UP) && 1256 (ifp->if_flags & IFF_RUNNING)) { 1257 if_up(ifp); 1258 } 1259 break; 1260 case CISCO_ADDR_REQ: 1261 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1262 if (me != 0L) 1263 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1264 break; 1265 } 1266 } 1267 1268 /* 1269 * Send Cisco keepalive packet. 1270 */ 1271 static void 1272 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1273 { 1274 STDDCL; 1275 struct ppp_header *h; 1276 struct cisco_packet *ch; 1277 struct mbuf *m; 1278 u_int32_t t = (time.tv_sec - boottime.tv_sec) * 1000; 1279 1280 MGETHDR(m, M_DONTWAIT, MT_DATA); 1281 if (! m) 1282 return; 1283 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1284 m->m_pkthdr.rcvif = 0; 1285 1286 h = mtod(m, struct ppp_header *); 1287 h->address = CISCO_MULTICAST; 1288 h->control = 0; 1289 h->protocol = htons(CISCO_KEEPALIVE); 1290 1291 ch = (struct cisco_packet *)(h + 1); 1292 ch->type = htonl(type); 1293 ch->par1 = htonl(par1); 1294 ch->par2 = htonl(par2); 1295 ch->rel = -1; 1296 1297 ch->time0 = htons((u_short)(t >> 16)); 1298 ch->time1 = htons((u_short) t); 1299 1300 if (debug) 1301 log(LOG_DEBUG, 1302 SPP_FMT "cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1303 SPP_ARGS(ifp), ntohl (ch->type), ch->par1, 1304 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1305 (u_int)ch->time1); 1306 1307 if (IF_QFULL(&sp->pp_cpq)) { 1308 IF_DROP(&sp->pp_fastq); 1309 IF_DROP(&ifp->if_snd); 1310 m_freem(m); 1311 ++ifp->if_oerrors; 1312 return; 1313 } else 1314 IF_ENQUEUE(&sp->pp_cpq, m); 1315 if (! (ifp->if_flags & IFF_OACTIVE)) 1316 (*ifp->if_start)(ifp); 1317 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1318 } 1319 1320 /* 1321 * PPP protocol implementation. 1322 */ 1323 1324 /* 1325 * Send PPP control protocol packet. 1326 */ 1327 static void 1328 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1329 u_char ident, u_short len, void *data) 1330 { 1331 STDDCL; 1332 struct lcp_header *lh; 1333 struct mbuf *m; 1334 size_t pkthdrlen; 1335 1336 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1337 1338 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1339 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1340 MGETHDR(m, M_DONTWAIT, MT_DATA); 1341 if (! m) 1342 return; 1343 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1344 m->m_pkthdr.rcvif = 0; 1345 1346 if (sp->pp_flags & PP_NOFRAMING) { 1347 *mtod(m, u_int16_t *) = htons(proto); 1348 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1349 } else { 1350 struct ppp_header *h; 1351 h = mtod(m, struct ppp_header *); 1352 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1353 h->control = PPP_UI; /* Unnumbered Info */ 1354 h->protocol = htons(proto); /* Link Control Protocol */ 1355 lh = (struct lcp_header *)(h + 1); 1356 } 1357 lh->type = type; 1358 lh->ident = ident; 1359 lh->len = htons(LCP_HEADER_LEN + len); 1360 if (len) 1361 bcopy (data, lh + 1, len); 1362 1363 if (debug) { 1364 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1365 SPP_ARGS(ifp), 1366 sppp_proto_name(proto), 1367 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1368 if (len) 1369 sppp_print_bytes((u_char *)(lh + 1), len); 1370 addlog(">\n"); 1371 } 1372 if (IF_QFULL(&sp->pp_cpq)) { 1373 IF_DROP(&sp->pp_fastq); 1374 IF_DROP(&ifp->if_snd); 1375 m_freem(m); 1376 ++ifp->if_oerrors; 1377 return; 1378 } else 1379 IF_ENQUEUE(&sp->pp_cpq, m); 1380 if (! (ifp->if_flags & IFF_OACTIVE)) 1381 (*ifp->if_start)(ifp); 1382 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1383 } 1384 1385 /* 1386 * Handle incoming PPP control protocol packets. 1387 */ 1388 static void 1389 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1390 { 1391 STDDCL; 1392 struct lcp_header *h; 1393 int len = m->m_pkthdr.len; 1394 int rv; 1395 u_char *p; 1396 u_int32_t u32; 1397 1398 if (len < 4) { 1399 if (debug) 1400 log(LOG_DEBUG, 1401 SPP_FMT "%s invalid packet length: %d bytes\n", 1402 SPP_ARGS(ifp), cp->name, len); 1403 return; 1404 } 1405 h = mtod(m, struct lcp_header *); 1406 if (debug) { 1407 log(LOG_DEBUG, 1408 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1409 SPP_ARGS(ifp), cp->name, 1410 sppp_state_name(sp->state[cp->protoidx]), 1411 sppp_cp_type_name(h->type), h->ident, ntohs(h->len)); 1412 if (len > 4) 1413 sppp_print_bytes((u_char *)(h + 1), len - 4); 1414 addlog(">\n"); 1415 } 1416 if (len > ntohs(h->len)) 1417 len = ntohs(h->len); 1418 p = (u_char *)(h + 1); 1419 switch (h->type) { 1420 case CONF_REQ: 1421 if (len < 4) { 1422 if (debug) 1423 addlog(SPP_FMT "%s invalid conf-req length %d\n", 1424 SPP_ARGS(ifp), cp->name, 1425 len); 1426 ++ifp->if_ierrors; 1427 break; 1428 } 1429 /* handle states where RCR doesn't get a SCA/SCN */ 1430 switch (sp->state[cp->protoidx]) { 1431 case STATE_CLOSING: 1432 case STATE_STOPPING: 1433 return; 1434 case STATE_CLOSED: 1435 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1436 0, 0); 1437 return; 1438 } 1439 rv = (cp->RCR)(sp, h, len); 1440 switch (sp->state[cp->protoidx]) { 1441 case STATE_OPENED: 1442 (cp->tld)(sp); 1443 (cp->scr)(sp); 1444 /* fall through... */ 1445 case STATE_ACK_SENT: 1446 case STATE_REQ_SENT: 1447 sppp_cp_change_state(cp, sp, rv? 1448 STATE_ACK_SENT: STATE_REQ_SENT); 1449 break; 1450 case STATE_STOPPED: 1451 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1452 (cp->scr)(sp); 1453 sppp_cp_change_state(cp, sp, rv? 1454 STATE_ACK_SENT: STATE_REQ_SENT); 1455 break; 1456 case STATE_ACK_RCVD: 1457 if (rv) { 1458 sppp_cp_change_state(cp, sp, STATE_OPENED); 1459 if (debug) 1460 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1461 SPP_ARGS(ifp), 1462 cp->name); 1463 (cp->tlu)(sp); 1464 } else 1465 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1466 break; 1467 default: 1468 printf(SPP_FMT "%s illegal %s in state %s\n", 1469 SPP_ARGS(ifp), cp->name, 1470 sppp_cp_type_name(h->type), 1471 sppp_state_name(sp->state[cp->protoidx])); 1472 ++ifp->if_ierrors; 1473 } 1474 break; 1475 case CONF_ACK: 1476 if (h->ident != sp->confid[cp->protoidx]) { 1477 if (debug) 1478 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1479 SPP_ARGS(ifp), cp->name, 1480 h->ident, sp->confid[cp->protoidx]); 1481 ++ifp->if_ierrors; 1482 break; 1483 } 1484 switch (sp->state[cp->protoidx]) { 1485 case STATE_CLOSED: 1486 case STATE_STOPPED: 1487 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1488 break; 1489 case STATE_CLOSING: 1490 case STATE_STOPPING: 1491 break; 1492 case STATE_REQ_SENT: 1493 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1494 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1495 break; 1496 case STATE_OPENED: 1497 (cp->tld)(sp); 1498 /* fall through */ 1499 case STATE_ACK_RCVD: 1500 (cp->scr)(sp); 1501 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1502 break; 1503 case STATE_ACK_SENT: 1504 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1505 sppp_cp_change_state(cp, sp, STATE_OPENED); 1506 if (debug) 1507 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1508 SPP_ARGS(ifp), cp->name); 1509 (cp->tlu)(sp); 1510 break; 1511 default: 1512 printf(SPP_FMT "%s illegal %s in state %s\n", 1513 SPP_ARGS(ifp), cp->name, 1514 sppp_cp_type_name(h->type), 1515 sppp_state_name(sp->state[cp->protoidx])); 1516 ++ifp->if_ierrors; 1517 } 1518 break; 1519 case CONF_NAK: 1520 case CONF_REJ: 1521 if (h->ident != sp->confid[cp->protoidx]) { 1522 if (debug) 1523 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1524 SPP_ARGS(ifp), cp->name, 1525 h->ident, sp->confid[cp->protoidx]); 1526 ++ifp->if_ierrors; 1527 break; 1528 } 1529 if (h->type == CONF_NAK) 1530 (cp->RCN_nak)(sp, h, len); 1531 else /* CONF_REJ */ 1532 (cp->RCN_rej)(sp, h, len); 1533 1534 switch (sp->state[cp->protoidx]) { 1535 case STATE_CLOSED: 1536 case STATE_STOPPED: 1537 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1538 break; 1539 case STATE_REQ_SENT: 1540 case STATE_ACK_SENT: 1541 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1542 (cp->scr)(sp); 1543 break; 1544 case STATE_OPENED: 1545 (cp->tld)(sp); 1546 /* fall through */ 1547 case STATE_ACK_RCVD: 1548 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1549 (cp->scr)(sp); 1550 break; 1551 case STATE_CLOSING: 1552 case STATE_STOPPING: 1553 break; 1554 default: 1555 printf(SPP_FMT "%s illegal %s in state %s\n", 1556 SPP_ARGS(ifp), cp->name, 1557 sppp_cp_type_name(h->type), 1558 sppp_state_name(sp->state[cp->protoidx])); 1559 ++ifp->if_ierrors; 1560 } 1561 break; 1562 1563 case TERM_REQ: 1564 switch (sp->state[cp->protoidx]) { 1565 case STATE_ACK_RCVD: 1566 case STATE_ACK_SENT: 1567 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1568 /* fall through */ 1569 case STATE_CLOSED: 1570 case STATE_STOPPED: 1571 case STATE_CLOSING: 1572 case STATE_STOPPING: 1573 case STATE_REQ_SENT: 1574 sta: 1575 /* Send Terminate-Ack packet. */ 1576 if (debug) 1577 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1578 SPP_ARGS(ifp), cp->name); 1579 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1580 break; 1581 case STATE_OPENED: 1582 (cp->tld)(sp); 1583 sp->rst_counter[cp->protoidx] = 0; 1584 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1585 goto sta; 1586 default: 1587 printf(SPP_FMT "%s illegal %s in state %s\n", 1588 SPP_ARGS(ifp), cp->name, 1589 sppp_cp_type_name(h->type), 1590 sppp_state_name(sp->state[cp->protoidx])); 1591 ++ifp->if_ierrors; 1592 } 1593 break; 1594 case TERM_ACK: 1595 switch (sp->state[cp->protoidx]) { 1596 case STATE_CLOSED: 1597 case STATE_STOPPED: 1598 case STATE_REQ_SENT: 1599 case STATE_ACK_SENT: 1600 break; 1601 case STATE_CLOSING: 1602 (cp->tlf)(sp); 1603 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1604 sppp_lcp_check_and_close(sp); 1605 break; 1606 case STATE_STOPPING: 1607 (cp->tlf)(sp); 1608 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1609 sppp_lcp_check_and_close(sp); 1610 break; 1611 case STATE_ACK_RCVD: 1612 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1613 break; 1614 case STATE_OPENED: 1615 (cp->tld)(sp); 1616 (cp->scr)(sp); 1617 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1618 break; 1619 default: 1620 printf(SPP_FMT "%s illegal %s in state %s\n", 1621 SPP_ARGS(ifp), cp->name, 1622 sppp_cp_type_name(h->type), 1623 sppp_state_name(sp->state[cp->protoidx])); 1624 ++ifp->if_ierrors; 1625 } 1626 break; 1627 case CODE_REJ: 1628 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1629 log(LOG_INFO, 1630 SPP_FMT "%s: ignoring RXJ (%s) for code ?, " 1631 "danger will robinson\n", 1632 SPP_ARGS(ifp), cp->name, 1633 sppp_cp_type_name(h->type)); 1634 switch (sp->state[cp->protoidx]) { 1635 case STATE_CLOSED: 1636 case STATE_STOPPED: 1637 case STATE_REQ_SENT: 1638 case STATE_ACK_SENT: 1639 case STATE_CLOSING: 1640 case STATE_STOPPING: 1641 case STATE_OPENED: 1642 break; 1643 case STATE_ACK_RCVD: 1644 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1645 break; 1646 default: 1647 printf(SPP_FMT "%s illegal %s in state %s\n", 1648 SPP_ARGS(ifp), cp->name, 1649 sppp_cp_type_name(h->type), 1650 sppp_state_name(sp->state[cp->protoidx])); 1651 ++ifp->if_ierrors; 1652 } 1653 break; 1654 case PROTO_REJ: 1655 { 1656 int catastrophic; 1657 const struct cp *upper; 1658 int i; 1659 u_int16_t proto; 1660 1661 catastrophic = 0; 1662 upper = NULL; 1663 proto = p[0] << 8 | p[1]; 1664 for (i = 0; i < IDX_COUNT; i++) { 1665 if (cps[i]->proto == proto) { 1666 upper = cps[i]; 1667 break; 1668 } 1669 } 1670 if (upper == NULL) 1671 catastrophic++; 1672 1673 if (debug) 1674 log(LOG_INFO, 1675 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1676 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1677 sppp_cp_type_name(h->type), proto, 1678 upper ? upper->name : "unknown", 1679 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1680 1681 /* 1682 * if we got RXJ+ against conf-req, the peer does not implement 1683 * this particular protocol type. terminate the protocol. 1684 */ 1685 if (upper && !catastrophic) { 1686 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1687 upper->Close(sp); 1688 break; 1689 } 1690 } 1691 1692 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1693 switch (sp->state[cp->protoidx]) { 1694 case STATE_CLOSED: 1695 case STATE_STOPPED: 1696 case STATE_REQ_SENT: 1697 case STATE_ACK_SENT: 1698 case STATE_CLOSING: 1699 case STATE_STOPPING: 1700 case STATE_OPENED: 1701 break; 1702 case STATE_ACK_RCVD: 1703 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1704 break; 1705 default: 1706 printf(SPP_FMT "%s illegal %s in state %s\n", 1707 SPP_ARGS(ifp), cp->name, 1708 sppp_cp_type_name(h->type), 1709 sppp_state_name(sp->state[cp->protoidx])); 1710 ++ifp->if_ierrors; 1711 } 1712 break; 1713 } 1714 case DISC_REQ: 1715 if (cp->proto != PPP_LCP) 1716 goto illegal; 1717 /* Discard the packet. */ 1718 break; 1719 case ECHO_REQ: 1720 if (cp->proto != PPP_LCP) 1721 goto illegal; 1722 if (sp->state[cp->protoidx] != STATE_OPENED) { 1723 if (debug) 1724 addlog(SPP_FMT "lcp echo req but lcp closed\n", 1725 SPP_ARGS(ifp)); 1726 ++ifp->if_ierrors; 1727 break; 1728 } 1729 if (len < 8) { 1730 if (debug) 1731 addlog(SPP_FMT "invalid lcp echo request " 1732 "packet length: %d bytes\n", 1733 SPP_ARGS(ifp), len); 1734 break; 1735 } 1736 memcpy(&u32, h + 1, sizeof u32); 1737 if (ntohl(u32) == sp->lcp.magic) { 1738 /* Line loopback mode detected. */ 1739 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1740 if_down(ifp); 1741 IF_PURGE(&sp->pp_cpq); 1742 1743 /* Shut down the PPP link. */ 1744 /* XXX */ 1745 lcp.Down(sp); 1746 lcp.Up(sp); 1747 break; 1748 } 1749 u32 = htonl(sp->lcp.magic); 1750 memcpy(h + 1, &u32, sizeof u32); 1751 if (debug) 1752 addlog(SPP_FMT "got lcp echo req, sending echo rep\n", 1753 SPP_ARGS(ifp)); 1754 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1755 h + 1); 1756 break; 1757 case ECHO_REPLY: 1758 if (cp->proto != PPP_LCP) 1759 goto illegal; 1760 if (h->ident != sp->lcp.echoid) { 1761 ++ifp->if_ierrors; 1762 break; 1763 } 1764 if (len < 8) { 1765 if (debug) 1766 addlog(SPP_FMT "lcp invalid echo reply " 1767 "packet length: %d bytes\n", 1768 SPP_ARGS(ifp), len); 1769 break; 1770 } 1771 if (debug) 1772 addlog(SPP_FMT "lcp got echo rep\n", 1773 SPP_ARGS(ifp)); 1774 memcpy(&u32, h + 1, sizeof u32); 1775 if (ntohl(u32) != sp->lcp.magic) 1776 sp->pp_alivecnt = 0; 1777 break; 1778 default: 1779 /* Unknown packet type -- send Code-Reject packet. */ 1780 illegal: 1781 if (debug) 1782 addlog(SPP_FMT "%s send code-rej for 0x%x\n", 1783 SPP_ARGS(ifp), cp->name, h->type); 1784 sppp_cp_send(sp, cp->proto, CODE_REJ, 1785 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1786 ++ifp->if_ierrors; 1787 } 1788 } 1789 1790 1791 /* 1792 * The generic part of all Up/Down/Open/Close/TO event handlers. 1793 * Basically, the state transition handling in the automaton. 1794 */ 1795 static void 1796 sppp_up_event(const struct cp *cp, struct sppp *sp) 1797 { 1798 STDDCL; 1799 1800 if (debug) 1801 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1802 SPP_ARGS(ifp), cp->name, 1803 sppp_state_name(sp->state[cp->protoidx])); 1804 1805 switch (sp->state[cp->protoidx]) { 1806 case STATE_INITIAL: 1807 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1808 break; 1809 case STATE_STARTING: 1810 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1811 (cp->scr)(sp); 1812 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1813 break; 1814 default: 1815 printf(SPP_FMT "%s illegal up in state %s\n", 1816 SPP_ARGS(ifp), cp->name, 1817 sppp_state_name(sp->state[cp->protoidx])); 1818 } 1819 } 1820 1821 static void 1822 sppp_down_event(const struct cp *cp, struct sppp *sp) 1823 { 1824 STDDCL; 1825 1826 if (debug) 1827 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1828 SPP_ARGS(ifp), cp->name, 1829 sppp_state_name(sp->state[cp->protoidx])); 1830 1831 switch (sp->state[cp->protoidx]) { 1832 case STATE_CLOSED: 1833 case STATE_CLOSING: 1834 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1835 break; 1836 case STATE_STOPPED: 1837 (cp->tls)(sp); 1838 /* fall through */ 1839 case STATE_STOPPING: 1840 case STATE_REQ_SENT: 1841 case STATE_ACK_RCVD: 1842 case STATE_ACK_SENT: 1843 sppp_cp_change_state(cp, sp, STATE_STARTING); 1844 break; 1845 case STATE_OPENED: 1846 (cp->tld)(sp); 1847 sppp_cp_change_state(cp, sp, STATE_STARTING); 1848 break; 1849 default: 1850 printf(SPP_FMT "%s illegal down in state %s\n", 1851 SPP_ARGS(ifp), cp->name, 1852 sppp_state_name(sp->state[cp->protoidx])); 1853 } 1854 } 1855 1856 1857 static void 1858 sppp_open_event(const struct cp *cp, struct sppp *sp) 1859 { 1860 STDDCL; 1861 1862 if (debug) 1863 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1864 SPP_ARGS(ifp), cp->name, 1865 sppp_state_name(sp->state[cp->protoidx])); 1866 1867 switch (sp->state[cp->protoidx]) { 1868 case STATE_INITIAL: 1869 (cp->tls)(sp); 1870 sppp_cp_change_state(cp, sp, STATE_STARTING); 1871 break; 1872 case STATE_STARTING: 1873 break; 1874 case STATE_CLOSED: 1875 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1876 (cp->scr)(sp); 1877 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1878 break; 1879 case STATE_STOPPED: 1880 case STATE_STOPPING: 1881 case STATE_REQ_SENT: 1882 case STATE_ACK_RCVD: 1883 case STATE_ACK_SENT: 1884 case STATE_OPENED: 1885 break; 1886 case STATE_CLOSING: 1887 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1888 break; 1889 } 1890 } 1891 1892 1893 static void 1894 sppp_close_event(const struct cp *cp, struct sppp *sp) 1895 { 1896 STDDCL; 1897 1898 if (debug) 1899 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1900 SPP_ARGS(ifp), cp->name, 1901 sppp_state_name(sp->state[cp->protoidx])); 1902 1903 switch (sp->state[cp->protoidx]) { 1904 case STATE_INITIAL: 1905 case STATE_CLOSED: 1906 case STATE_CLOSING: 1907 break; 1908 case STATE_STARTING: 1909 (cp->tlf)(sp); 1910 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1911 break; 1912 case STATE_STOPPED: 1913 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1914 break; 1915 case STATE_STOPPING: 1916 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1917 break; 1918 case STATE_OPENED: 1919 (cp->tld)(sp); 1920 /* fall through */ 1921 case STATE_REQ_SENT: 1922 case STATE_ACK_RCVD: 1923 case STATE_ACK_SENT: 1924 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1925 sppp_cp_send(sp, cp->proto, TERM_REQ, 1926 ++sp->pp_seq[cp->protoidx], 0, 0); 1927 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1928 break; 1929 } 1930 } 1931 1932 static void 1933 sppp_to_event(const struct cp *cp, struct sppp *sp) 1934 { 1935 STDDCL; 1936 int s; 1937 1938 s = splnet(); 1939 if (debug) 1940 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 1941 SPP_ARGS(ifp), cp->name, 1942 sppp_state_name(sp->state[cp->protoidx]), 1943 sp->rst_counter[cp->protoidx]); 1944 1945 if (--sp->rst_counter[cp->protoidx] < 0) 1946 /* TO- event */ 1947 switch (sp->state[cp->protoidx]) { 1948 case STATE_CLOSING: 1949 (cp->tlf)(sp); 1950 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1951 sppp_lcp_check_and_close(sp); 1952 break; 1953 case STATE_STOPPING: 1954 (cp->tlf)(sp); 1955 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1956 sppp_lcp_check_and_close(sp); 1957 break; 1958 case STATE_REQ_SENT: 1959 case STATE_ACK_RCVD: 1960 case STATE_ACK_SENT: 1961 (cp->tlf)(sp); 1962 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1963 sppp_lcp_check_and_close(sp); 1964 break; 1965 } 1966 else 1967 /* TO+ event */ 1968 switch (sp->state[cp->protoidx]) { 1969 case STATE_CLOSING: 1970 case STATE_STOPPING: 1971 sppp_cp_send(sp, cp->proto, TERM_REQ, 1972 ++sp->pp_seq[cp->protoidx], 0, 0); 1973 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1974 cp->TO, sp); 1975 break; 1976 case STATE_REQ_SENT: 1977 case STATE_ACK_RCVD: 1978 (cp->scr)(sp); 1979 /* sppp_cp_change_state() will restart the timer */ 1980 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1981 break; 1982 case STATE_ACK_SENT: 1983 (cp->scr)(sp); 1984 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1985 cp->TO, sp); 1986 break; 1987 } 1988 1989 splx(s); 1990 } 1991 1992 /* 1993 * Change the state of a control protocol in the state automaton. 1994 * Takes care of starting/stopping the restart timer. 1995 */ 1996 void 1997 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1998 { 1999 sp->state[cp->protoidx] = newstate; 2000 callout_stop(&sp->ch[cp->protoidx]); 2001 switch (newstate) { 2002 case STATE_INITIAL: 2003 case STATE_STARTING: 2004 case STATE_CLOSED: 2005 case STATE_STOPPED: 2006 case STATE_OPENED: 2007 break; 2008 case STATE_CLOSING: 2009 case STATE_STOPPING: 2010 case STATE_REQ_SENT: 2011 case STATE_ACK_RCVD: 2012 case STATE_ACK_SENT: 2013 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2014 cp->TO, sp); 2015 break; 2016 } 2017 } 2018 2019 /* 2020 *--------------------------------------------------------------------------* 2021 * * 2022 * The LCP implementation. * 2023 * * 2024 *--------------------------------------------------------------------------* 2025 */ 2026 static void 2027 sppp_lcp_init(struct sppp *sp) 2028 { 2029 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2030 sp->lcp.magic = 0; 2031 sp->state[IDX_LCP] = STATE_INITIAL; 2032 sp->fail_counter[IDX_LCP] = 0; 2033 sp->pp_seq[IDX_LCP] = 0; 2034 sp->pp_rseq[IDX_LCP] = 0; 2035 sp->lcp.protos = 0; 2036 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2037 2038 /* 2039 * Initialize counters and timeout values. Note that we don't 2040 * use the 3 seconds suggested in RFC 1661 since we are likely 2041 * running on a fast link. XXX We should probably implement 2042 * the exponential backoff option. Note that these values are 2043 * relevant for all control protocols, not just LCP only. 2044 */ 2045 sp->lcp.timeout = 1 * hz; 2046 sp->lcp.max_terminate = 2; 2047 sp->lcp.max_configure = 10; 2048 sp->lcp.max_failure = 10; 2049 callout_init(&sp->ch[IDX_LCP]); 2050 } 2051 2052 static void 2053 sppp_lcp_up(struct sppp *sp) 2054 { 2055 STDDCL; 2056 2057 /* Initialize activity timestamp: opening a connection is an activity */ 2058 sp->pp_last_activity = mono_time.tv_sec; 2059 2060 /* 2061 * If this interface is passive or dial-on-demand, and we are 2062 * still in Initial state, it means we've got an incoming 2063 * call. Activate the interface. 2064 */ 2065 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2066 if (debug) 2067 log(LOG_DEBUG, 2068 SPP_FMT "Up event", SPP_ARGS(ifp)); 2069 ifp->if_flags |= IFF_RUNNING; 2070 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2071 if (debug) 2072 addlog("(incoming call)\n"); 2073 sp->pp_flags |= PP_CALLIN; 2074 lcp.Open(sp); 2075 } else if (debug) 2076 addlog("\n"); 2077 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2078 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2079 ifp->if_flags |= IFF_RUNNING; 2080 lcp.Open(sp); 2081 } 2082 2083 sppp_up_event(&lcp, sp); 2084 } 2085 2086 static void 2087 sppp_lcp_down(struct sppp *sp) 2088 { 2089 STDDCL; 2090 2091 sppp_down_event(&lcp, sp); 2092 2093 /* 2094 * If this is neither a dial-on-demand nor a passive 2095 * interface, simulate an ``ifconfig down'' action, so the 2096 * administrator can force a redial by another ``ifconfig 2097 * up''. XXX For leased line operation, should we immediately 2098 * try to reopen the connection here? 2099 */ 2100 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2101 if (debug) 2102 log(LOG_INFO, 2103 SPP_FMT "Down event (carrier loss), taking interface down.\n", 2104 SPP_ARGS(ifp)); 2105 if_down(ifp); 2106 } else { 2107 if (debug) 2108 log(LOG_DEBUG, 2109 SPP_FMT "Down event (carrier loss)\n", 2110 SPP_ARGS(ifp)); 2111 } 2112 sp->pp_flags &= ~PP_CALLIN; 2113 if (sp->state[IDX_LCP] != STATE_INITIAL) 2114 lcp.Close(sp); 2115 ifp->if_flags &= ~IFF_RUNNING; 2116 } 2117 2118 static void 2119 sppp_lcp_open(struct sppp *sp) 2120 { 2121 /* 2122 * If we are authenticator, negotiate LCP_AUTH 2123 */ 2124 if (sp->hisauth.proto != 0) 2125 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2126 else 2127 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2128 sp->pp_flags &= ~PP_NEEDAUTH; 2129 sppp_open_event(&lcp, sp); 2130 } 2131 2132 static void 2133 sppp_lcp_close(struct sppp *sp) 2134 { 2135 sppp_close_event(&lcp, sp); 2136 } 2137 2138 static void 2139 sppp_lcp_TO(void *cookie) 2140 { 2141 sppp_to_event(&lcp, (struct sppp *)cookie); 2142 } 2143 2144 /* 2145 * Analyze a configure request. Return true if it was agreeable, and 2146 * caused action sca, false if it has been rejected or nak'ed, and 2147 * caused action scn. (The return value is used to make the state 2148 * transition decision in the state automaton.) 2149 */ 2150 static int 2151 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2152 { 2153 STDDCL; 2154 u_char *buf, *r, *p; 2155 int origlen, rlen; 2156 u_int32_t nmagic; 2157 u_short authproto; 2158 2159 len -= 4; 2160 origlen = len; 2161 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2162 if (! buf) 2163 return (0); 2164 2165 if (debug) 2166 log(LOG_DEBUG, SPP_FMT "lcp parse opts:", 2167 SPP_ARGS(ifp)); 2168 2169 /* pass 1: check for things that need to be rejected */ 2170 p = (void *)(h + 1); 2171 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2172 if (debug) 2173 addlog(" %s", sppp_lcp_opt_name(*p)); 2174 switch (*p) { 2175 case LCP_OPT_MAGIC: 2176 /* Magic number. */ 2177 /* fall through, both are same length */ 2178 case LCP_OPT_ASYNC_MAP: 2179 /* Async control character map. */ 2180 if (len >= 6 || p[1] == 6) 2181 continue; 2182 if (debug) 2183 addlog(" [invalid]"); 2184 break; 2185 case LCP_OPT_MRU: 2186 /* Maximum receive unit. */ 2187 if (len >= 4 && p[1] == 4) 2188 continue; 2189 if (debug) 2190 addlog(" [invalid]"); 2191 break; 2192 case LCP_OPT_AUTH_PROTO: 2193 if (len < 4) { 2194 if (debug) 2195 addlog(" [invalid]"); 2196 break; 2197 } 2198 authproto = (p[2] << 8) + p[3]; 2199 if (authproto == PPP_CHAP && p[1] != 5) { 2200 if (debug) 2201 addlog(" [invalid chap len]"); 2202 break; 2203 } 2204 if (sp->myauth.proto == 0) { 2205 /* we are not configured to do auth */ 2206 if (debug) 2207 addlog(" [not configured]"); 2208 break; 2209 } 2210 /* 2211 * Remote want us to authenticate, remember this, 2212 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2213 * up. 2214 */ 2215 sp->pp_flags |= PP_NEEDAUTH; 2216 continue; 2217 default: 2218 /* Others not supported. */ 2219 if (debug) 2220 addlog(" [rej]"); 2221 break; 2222 } 2223 /* Add the option to rejected list. */ 2224 bcopy (p, r, p[1]); 2225 r += p[1]; 2226 rlen += p[1]; 2227 } 2228 if (rlen) { 2229 if (debug) 2230 addlog(" send conf-rej\n"); 2231 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2232 goto end; 2233 } else if (debug) 2234 addlog("\n"); 2235 2236 /* 2237 * pass 2: check for option values that are unacceptable and 2238 * thus require to be nak'ed. 2239 */ 2240 if (debug) 2241 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2242 SPP_ARGS(ifp)); 2243 2244 p = (void *)(h + 1); 2245 len = origlen; 2246 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2247 if (debug) 2248 addlog(" %s", sppp_lcp_opt_name(*p)); 2249 switch (*p) { 2250 case LCP_OPT_MAGIC: 2251 /* Magic number -- extract. */ 2252 nmagic = (u_int32_t)p[2] << 24 | 2253 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2254 if (nmagic != sp->lcp.magic) { 2255 if (debug) 2256 addlog(" 0x%x", nmagic); 2257 continue; 2258 } 2259 /* 2260 * Local and remote magics equal -- loopback? 2261 */ 2262 if (sp->pp_loopcnt >= MAXALIVECNT*5) { 2263 printf (SPP_FMT "loopback\n", 2264 SPP_ARGS(ifp)); 2265 sp->pp_loopcnt = 0; 2266 if (ifp->if_flags & IFF_UP) { 2267 if_down(ifp); 2268 IF_PURGE(&sp->pp_cpq); 2269 /* XXX ? */ 2270 lcp.Down(sp); 2271 lcp.Up(sp); 2272 } 2273 } else if (debug) 2274 addlog(" [glitch]"); 2275 ++sp->pp_loopcnt; 2276 /* 2277 * We negate our magic here, and NAK it. If 2278 * we see it later in an NAK packet, we 2279 * suggest a new one. 2280 */ 2281 nmagic = ~sp->lcp.magic; 2282 /* Gonna NAK it. */ 2283 p[2] = nmagic >> 24; 2284 p[3] = nmagic >> 16; 2285 p[4] = nmagic >> 8; 2286 p[5] = nmagic; 2287 break; 2288 2289 case LCP_OPT_ASYNC_MAP: 2290 /* 2291 * Async control character map -- just ignore it. 2292 * 2293 * Quote from RFC 1662, chapter 6: 2294 * To enable this functionality, synchronous PPP 2295 * implementations MUST always respond to the 2296 * Async-Control-Character-Map Configuration 2297 * Option with the LCP Configure-Ack. However, 2298 * acceptance of the Configuration Option does 2299 * not imply that the synchronous implementation 2300 * will do any ACCM mapping. Instead, all such 2301 * octet mapping will be performed by the 2302 * asynchronous-to-synchronous converter. 2303 */ 2304 continue; 2305 2306 case LCP_OPT_MRU: 2307 /* 2308 * Maximum receive unit. Always agreeable, 2309 * but ignored by now. 2310 */ 2311 sp->lcp.their_mru = p[2] * 256 + p[3]; 2312 if (debug) 2313 addlog(" %ld", sp->lcp.their_mru); 2314 continue; 2315 2316 case LCP_OPT_AUTH_PROTO: 2317 authproto = (p[2] << 8) + p[3]; 2318 if (sp->myauth.proto != authproto) { 2319 /* not agreed, nak */ 2320 if (debug) 2321 addlog(" [mine %s != his %s]", 2322 sppp_proto_name(sp->hisauth.proto), 2323 sppp_proto_name(authproto)); 2324 p[2] = sp->myauth.proto >> 8; 2325 p[3] = sp->myauth.proto; 2326 break; 2327 } 2328 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2329 if (debug) 2330 addlog(" [chap not MD5]"); 2331 p[4] = CHAP_MD5; 2332 break; 2333 } 2334 continue; 2335 } 2336 /* Add the option to nak'ed list. */ 2337 bcopy (p, r, p[1]); 2338 r += p[1]; 2339 rlen += p[1]; 2340 } 2341 if (rlen) { 2342 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2343 if (debug) 2344 addlog(" max_failure (%d) exceeded, " 2345 "send conf-rej\n", 2346 sp->lcp.max_failure); 2347 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2348 } else { 2349 if (debug) 2350 addlog(" send conf-nak\n"); 2351 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2352 } 2353 goto end; 2354 } else { 2355 if (debug) 2356 addlog(" send conf-ack\n"); 2357 sp->fail_counter[IDX_LCP] = 0; 2358 sp->pp_loopcnt = 0; 2359 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2360 } 2361 2362 end: 2363 free(buf, M_TEMP); 2364 return (rlen == 0); 2365 } 2366 2367 /* 2368 * Analyze the LCP Configure-Reject option list, and adjust our 2369 * negotiation. 2370 */ 2371 static void 2372 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2373 { 2374 STDDCL; 2375 u_char *buf, *p; 2376 2377 len -= 4; 2378 buf = malloc (len, M_TEMP, M_NOWAIT); 2379 if (!buf) 2380 return; 2381 2382 if (debug) 2383 log(LOG_DEBUG, SPP_FMT "lcp rej opts:", 2384 SPP_ARGS(ifp)); 2385 2386 p = (void *)(h + 1); 2387 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2388 if (debug) 2389 addlog(" %s", sppp_lcp_opt_name(*p)); 2390 switch (*p) { 2391 case LCP_OPT_MAGIC: 2392 /* Magic number -- can't use it, use 0 */ 2393 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2394 sp->lcp.magic = 0; 2395 break; 2396 case LCP_OPT_MRU: 2397 /* 2398 * Should not be rejected anyway, since we only 2399 * negotiate a MRU if explicitly requested by 2400 * peer. 2401 */ 2402 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2403 break; 2404 case LCP_OPT_AUTH_PROTO: 2405 /* 2406 * Peer doesn't want to authenticate himself, 2407 * deny unless this is a dialout call, and 2408 * SPPP_AUTHFLAG_NOCALLOUT is set. 2409 */ 2410 if ((sp->pp_flags & PP_CALLIN) == 0 && 2411 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2412 if (debug) 2413 addlog(" [don't insist on auth " 2414 "for callout]"); 2415 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2416 break; 2417 } 2418 if (debug) 2419 addlog("[access denied]\n"); 2420 lcp.Close(sp); 2421 break; 2422 } 2423 } 2424 if (debug) 2425 addlog("\n"); 2426 free(buf, M_TEMP); 2427 return; 2428 } 2429 2430 /* 2431 * Analyze the LCP Configure-NAK option list, and adjust our 2432 * negotiation. 2433 */ 2434 static void 2435 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2436 { 2437 STDDCL; 2438 u_char *buf, *p; 2439 u_int32_t magic; 2440 2441 len -= 4; 2442 buf = malloc (len, M_TEMP, M_NOWAIT); 2443 if (!buf) 2444 return; 2445 2446 if (debug) 2447 log(LOG_DEBUG, SPP_FMT "lcp nak opts:", 2448 SPP_ARGS(ifp)); 2449 2450 p = (void *)(h + 1); 2451 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2452 if (debug) 2453 addlog(" %s", sppp_lcp_opt_name(*p)); 2454 switch (*p) { 2455 case LCP_OPT_MAGIC: 2456 /* Magic number -- renegotiate */ 2457 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2458 len >= 6 && p[1] == 6) { 2459 magic = (u_int32_t)p[2] << 24 | 2460 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2461 /* 2462 * If the remote magic is our negated one, 2463 * this looks like a loopback problem. 2464 * Suggest a new magic to make sure. 2465 */ 2466 if (magic == ~sp->lcp.magic) { 2467 if (debug) 2468 addlog(" magic glitch"); 2469 sp->lcp.magic = random(); 2470 } else { 2471 sp->lcp.magic = magic; 2472 if (debug) 2473 addlog(" %d", magic); 2474 } 2475 } 2476 break; 2477 case LCP_OPT_MRU: 2478 /* 2479 * Peer wants to advise us to negotiate an MRU. 2480 * Agree on it if it's reasonable, or use 2481 * default otherwise. 2482 */ 2483 if (len >= 4 && p[1] == 4) { 2484 u_int mru = p[2] * 256 + p[3]; 2485 if (debug) 2486 addlog(" %d", mru); 2487 if (mru < PP_MTU || mru > PP_MAX_MRU) 2488 mru = PP_MTU; 2489 sp->lcp.mru = mru; 2490 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2491 } 2492 break; 2493 case LCP_OPT_AUTH_PROTO: 2494 /* 2495 * Peer doesn't like our authentication method, 2496 * deny. 2497 */ 2498 if (debug) 2499 addlog("[access denied]\n"); 2500 lcp.Close(sp); 2501 break; 2502 } 2503 } 2504 if (debug) 2505 addlog("\n"); 2506 free(buf, M_TEMP); 2507 return; 2508 } 2509 2510 static void 2511 sppp_lcp_tlu(struct sppp *sp) 2512 { 2513 STDDCL; 2514 int i; 2515 u_int32_t mask; 2516 2517 /* XXX ? */ 2518 if (! (ifp->if_flags & IFF_UP) && 2519 (ifp->if_flags & IFF_RUNNING)) { 2520 /* Coming out of loopback mode. */ 2521 if_up(ifp); 2522 } 2523 2524 for (i = 0; i < IDX_COUNT; i++) 2525 if ((cps[i])->flags & CP_QUAL) 2526 (cps[i])->Open(sp); 2527 2528 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2529 (sp->pp_flags & PP_NEEDAUTH) != 0) 2530 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2531 else 2532 sp->pp_phase = SPPP_PHASE_NETWORK; 2533 2534 if(debug) 2535 { 2536 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2537 sppp_phase_name(sp->pp_phase)); 2538 } 2539 2540 /* 2541 * Open all authentication protocols. This is even required 2542 * if we already proceeded to network phase, since it might be 2543 * that remote wants us to authenticate, so we might have to 2544 * send a PAP request. Undesired authentication protocols 2545 * don't do anything when they get an Open event. 2546 */ 2547 for (i = 0; i < IDX_COUNT; i++) 2548 if ((cps[i])->flags & CP_AUTH) 2549 (cps[i])->Open(sp); 2550 2551 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2552 /* Notify all NCPs. */ 2553 for (i = 0; i < IDX_COUNT; i++) 2554 if ((cps[i])->flags & CP_NCP) 2555 (cps[i])->Open(sp); 2556 } 2557 2558 /* Send Up events to all started protos. */ 2559 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2560 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2561 (cps[i])->Up(sp); 2562 2563 /* notify low-level driver of state change */ 2564 if (sp->pp_chg) 2565 sp->pp_chg(sp, (int)sp->pp_phase); 2566 2567 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2568 /* if no NCP is starting, close down */ 2569 sppp_lcp_check_and_close(sp); 2570 } 2571 2572 static void 2573 sppp_lcp_tld(struct sppp *sp) 2574 { 2575 STDDCL; 2576 int i; 2577 u_int32_t mask; 2578 2579 sp->pp_phase = SPPP_PHASE_TERMINATE; 2580 2581 if(debug) 2582 { 2583 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2584 sppp_phase_name(sp->pp_phase)); 2585 } 2586 2587 /* 2588 * Take upper layers down. We send the Down event first and 2589 * the Close second to prevent the upper layers from sending 2590 * ``a flurry of terminate-request packets'', as the RFC 2591 * describes it. 2592 */ 2593 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2594 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2595 (cps[i])->Down(sp); 2596 (cps[i])->Close(sp); 2597 } 2598 } 2599 2600 static void 2601 sppp_lcp_tls(struct sppp *sp) 2602 { 2603 STDDCL; 2604 2605 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2606 printf("%s: authentication failed %d times, not retrying again\n", 2607 sp->pp_if.if_xname, sp->pp_auth_failures); 2608 if_down(&sp->pp_if); 2609 return; 2610 } 2611 2612 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2613 2614 if(debug) 2615 { 2616 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2617 sppp_phase_name(sp->pp_phase)); 2618 } 2619 2620 /* Notify lower layer if desired. */ 2621 if (sp->pp_tls) 2622 (sp->pp_tls)(sp); 2623 } 2624 2625 static void 2626 sppp_lcp_tlf(struct sppp *sp) 2627 { 2628 STDDCL; 2629 2630 sp->pp_phase = SPPP_PHASE_DEAD; 2631 2632 if(debug) 2633 { 2634 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2635 sppp_phase_name(sp->pp_phase)); 2636 } 2637 2638 /* Notify lower layer if desired. */ 2639 if (sp->pp_tlf) 2640 (sp->pp_tlf)(sp); 2641 } 2642 2643 static void 2644 sppp_lcp_scr(struct sppp *sp) 2645 { 2646 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2647 int i = 0; 2648 u_short authproto; 2649 2650 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2651 if (! sp->lcp.magic) 2652 sp->lcp.magic = random(); 2653 opt[i++] = LCP_OPT_MAGIC; 2654 opt[i++] = 6; 2655 opt[i++] = sp->lcp.magic >> 24; 2656 opt[i++] = sp->lcp.magic >> 16; 2657 opt[i++] = sp->lcp.magic >> 8; 2658 opt[i++] = sp->lcp.magic; 2659 } 2660 2661 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2662 opt[i++] = LCP_OPT_MRU; 2663 opt[i++] = 4; 2664 opt[i++] = sp->lcp.mru >> 8; 2665 opt[i++] = sp->lcp.mru; 2666 } 2667 2668 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2669 authproto = sp->hisauth.proto; 2670 opt[i++] = LCP_OPT_AUTH_PROTO; 2671 opt[i++] = authproto == PPP_CHAP? 5: 4; 2672 opt[i++] = authproto >> 8; 2673 opt[i++] = authproto; 2674 if (authproto == PPP_CHAP) 2675 opt[i++] = CHAP_MD5; 2676 } 2677 2678 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2679 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2680 } 2681 2682 /* 2683 * Check the open NCPs, return true if at least one NCP is open. 2684 */ 2685 static int 2686 sppp_ncp_check(struct sppp *sp) 2687 { 2688 int i, mask; 2689 2690 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2691 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2692 return 1; 2693 return 0; 2694 } 2695 2696 /* 2697 * Re-check the open NCPs and see if we should terminate the link. 2698 * Called by the NCPs during their tlf action handling. 2699 */ 2700 static void 2701 sppp_lcp_check_and_close(struct sppp *sp) 2702 { 2703 2704 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2705 /* don't bother, we are already going down */ 2706 return; 2707 2708 if (sppp_ncp_check(sp)) 2709 return; 2710 2711 lcp.Close(sp); 2712 } 2713 2714 2715 /* 2716 *--------------------------------------------------------------------------* 2717 * * 2718 * The IPCP implementation. * 2719 * * 2720 *--------------------------------------------------------------------------* 2721 */ 2722 2723 static void 2724 sppp_ipcp_init(struct sppp *sp) 2725 { 2726 sp->ipcp.opts = 0; 2727 sp->ipcp.flags = 0; 2728 sp->state[IDX_IPCP] = STATE_INITIAL; 2729 sp->fail_counter[IDX_IPCP] = 0; 2730 sp->pp_seq[IDX_IPCP] = 0; 2731 sp->pp_rseq[IDX_IPCP] = 0; 2732 callout_init(&sp->ch[IDX_IPCP]); 2733 } 2734 2735 static void 2736 sppp_ipcp_up(struct sppp *sp) 2737 { 2738 sppp_up_event(&ipcp, sp); 2739 } 2740 2741 static void 2742 sppp_ipcp_down(struct sppp *sp) 2743 { 2744 sppp_down_event(&ipcp, sp); 2745 } 2746 2747 static void 2748 sppp_ipcp_open(struct sppp *sp) 2749 { 2750 STDDCL; 2751 u_int32_t myaddr, hisaddr; 2752 2753 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2754 sp->ipcp.req_myaddr = 0; 2755 sp->ipcp.req_hisaddr = 0; 2756 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2757 2758 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2759 /* 2760 * If we don't have his address, this probably means our 2761 * interface doesn't want to talk IP at all. (This could 2762 * be the case if somebody wants to speak only IPX, for 2763 * example.) Don't open IPCP in this case. 2764 */ 2765 if (hisaddr == 0L) { 2766 /* XXX this message should go away */ 2767 if (debug) 2768 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 2769 SPP_ARGS(ifp)); 2770 return; 2771 } 2772 2773 if (myaddr == 0) { 2774 /* 2775 * I don't have an assigned address, so i need to 2776 * negotiate my address. 2777 */ 2778 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2779 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2780 } 2781 if (hisaddr == 1) { 2782 /* 2783 * XXX - remove this hack! 2784 * remote has no valid adress, we need to get one assigned. 2785 */ 2786 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2787 } 2788 sppp_open_event(&ipcp, sp); 2789 } 2790 2791 static void 2792 sppp_ipcp_close(struct sppp *sp) 2793 { 2794 sppp_close_event(&ipcp, sp); 2795 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2796 /* 2797 * Some address was dynamic, clear it again. 2798 */ 2799 sppp_clear_ip_addrs(sp); 2800 } 2801 2802 static void 2803 sppp_ipcp_TO(void *cookie) 2804 { 2805 sppp_to_event(&ipcp, (struct sppp *)cookie); 2806 } 2807 2808 /* 2809 * Analyze a configure request. Return true if it was agreeable, and 2810 * caused action sca, false if it has been rejected or nak'ed, and 2811 * caused action scn. (The return value is used to make the state 2812 * transition decision in the state automaton.) 2813 */ 2814 static int 2815 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2816 { 2817 u_char *buf, *r, *p; 2818 struct ifnet *ifp = &sp->pp_if; 2819 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2820 u_int32_t hisaddr, desiredaddr; 2821 2822 len -= 4; 2823 origlen = len; 2824 /* 2825 * Make sure to allocate a buf that can at least hold a 2826 * conf-nak with an `address' option. We might need it below. 2827 */ 2828 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2829 if (! buf) 2830 return (0); 2831 2832 /* pass 1: see if we can recognize them */ 2833 if (debug) 2834 log(LOG_DEBUG, SPP_FMT "ipcp parse opts:", 2835 SPP_ARGS(ifp)); 2836 p = (void *)(h + 1); 2837 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2838 if (debug) 2839 addlog(" %s", sppp_ipcp_opt_name(*p)); 2840 switch (*p) { 2841 #ifdef notyet 2842 case IPCP_OPT_COMPRESSION: 2843 if (len >= 6 && p[1] >= 6) { 2844 /* correctly formed compress option */ 2845 continue; 2846 } 2847 if (debug) 2848 addlog(" [invalid]"); 2849 break; 2850 #endif 2851 case IPCP_OPT_ADDRESS: 2852 if (len >= 6 && p[1] == 6) { 2853 /* correctly formed address option */ 2854 continue; 2855 } 2856 if (debug) 2857 addlog(" [invalid]"); 2858 break; 2859 default: 2860 /* Others not supported. */ 2861 if (debug) 2862 addlog(" [rej]"); 2863 break; 2864 } 2865 /* Add the option to rejected list. */ 2866 bcopy (p, r, p[1]); 2867 r += p[1]; 2868 rlen += p[1]; 2869 } 2870 if (rlen) { 2871 if (debug) 2872 addlog(" send conf-rej\n"); 2873 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2874 goto end; 2875 } else if (debug) 2876 addlog("\n"); 2877 2878 /* pass 2: parse option values */ 2879 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2880 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2881 else 2882 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2883 if (debug) 2884 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2885 SPP_ARGS(ifp)); 2886 p = (void *)(h + 1); 2887 len = origlen; 2888 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2889 if (debug) 2890 addlog(" %s", sppp_ipcp_opt_name(*p)); 2891 switch (*p) { 2892 #ifdef notyet 2893 case IPCP_OPT_COMPRESSION: 2894 continue; 2895 #endif 2896 case IPCP_OPT_ADDRESS: 2897 desiredaddr = p[2] << 24 | p[3] << 16 | 2898 p[4] << 8 | p[5]; 2899 if (desiredaddr == hisaddr || 2900 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2901 /* 2902 * Peer's address is same as our value, 2903 * this is agreeable. Gonna conf-ack 2904 * it. 2905 */ 2906 if (debug) 2907 addlog(" %s [ack]", 2908 sppp_dotted_quad(hisaddr)); 2909 /* record that we've seen it already */ 2910 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2911 sp->ipcp.req_hisaddr = desiredaddr; 2912 hisaddr = desiredaddr; 2913 continue; 2914 } 2915 /* 2916 * The address wasn't agreeable. This is either 2917 * he sent us 0.0.0.0, asking to assign him an 2918 * address, or he send us another address not 2919 * matching our value. Either case, we gonna 2920 * conf-nak it with our value. 2921 */ 2922 if (debug) { 2923 if (desiredaddr == 0) 2924 addlog(" [addr requested]"); 2925 else 2926 addlog(" %s [not agreed]", 2927 sppp_dotted_quad(desiredaddr)); 2928 } 2929 2930 p[2] = hisaddr >> 24; 2931 p[3] = hisaddr >> 16; 2932 p[4] = hisaddr >> 8; 2933 p[5] = hisaddr; 2934 break; 2935 } 2936 /* Add the option to nak'ed list. */ 2937 bcopy (p, r, p[1]); 2938 r += p[1]; 2939 rlen += p[1]; 2940 } 2941 2942 /* 2943 * If we are about to conf-ack the request, but haven't seen 2944 * his address so far, gonna conf-nak it instead, with the 2945 * `address' option present and our idea of his address being 2946 * filled in there, to request negotiation of both addresses. 2947 * 2948 * XXX This can result in an endless req - nak loop if peer 2949 * doesn't want to send us his address. Q: What should we do 2950 * about it? XXX A: implement the max-failure counter. 2951 */ 2952 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2953 buf[0] = IPCP_OPT_ADDRESS; 2954 buf[1] = 6; 2955 buf[2] = hisaddr >> 24; 2956 buf[3] = hisaddr >> 16; 2957 buf[4] = hisaddr >> 8; 2958 buf[5] = hisaddr; 2959 rlen = 6; 2960 if (debug) 2961 addlog(" still need hisaddr"); 2962 } 2963 2964 if (rlen) { 2965 if (debug) 2966 addlog(" send conf-nak\n"); 2967 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2968 } else { 2969 if (debug) 2970 addlog(" send conf-ack\n"); 2971 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 2972 } 2973 2974 end: 2975 free(buf, M_TEMP); 2976 return (rlen == 0); 2977 } 2978 2979 /* 2980 * Analyze the IPCP Configure-Reject option list, and adjust our 2981 * negotiation. 2982 */ 2983 static void 2984 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2985 { 2986 u_char *buf, *p; 2987 struct ifnet *ifp = &sp->pp_if; 2988 int debug = ifp->if_flags & IFF_DEBUG; 2989 2990 len -= 4; 2991 buf = malloc (len, M_TEMP, M_NOWAIT); 2992 if (!buf) 2993 return; 2994 2995 if (debug) 2996 log(LOG_DEBUG, SPP_FMT "ipcp rej opts:", 2997 SPP_ARGS(ifp)); 2998 2999 p = (void *)(h + 1); 3000 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3001 if (debug) 3002 addlog(" %s", sppp_ipcp_opt_name(*p)); 3003 switch (*p) { 3004 case IPCP_OPT_ADDRESS: 3005 /* 3006 * Peer doesn't grok address option. This is 3007 * bad. XXX Should we better give up here? 3008 */ 3009 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3010 break; 3011 #ifdef notyet 3012 case IPCP_OPT_COMPRESS: 3013 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3014 break; 3015 #endif 3016 } 3017 } 3018 if (debug) 3019 addlog("\n"); 3020 free(buf, M_TEMP); 3021 return; 3022 } 3023 3024 /* 3025 * Analyze the IPCP Configure-NAK option list, and adjust our 3026 * negotiation. 3027 */ 3028 static void 3029 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3030 { 3031 u_char *p; 3032 struct ifnet *ifp = &sp->pp_if; 3033 int debug = ifp->if_flags & IFF_DEBUG; 3034 u_int32_t wantaddr; 3035 3036 len -= 4; 3037 3038 if (debug) 3039 log(LOG_DEBUG, SPP_FMT "ipcp nak opts:", 3040 SPP_ARGS(ifp)); 3041 3042 p = (void *)(h + 1); 3043 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3044 if (debug) 3045 addlog(" %s", sppp_ipcp_opt_name(*p)); 3046 switch (*p) { 3047 case IPCP_OPT_ADDRESS: 3048 /* 3049 * Peer doesn't like our local IP address. See 3050 * if we can do something for him. We'll drop 3051 * him our address then. 3052 */ 3053 if (len >= 6 && p[1] == 6) { 3054 wantaddr = p[2] << 24 | p[3] << 16 | 3055 p[4] << 8 | p[5]; 3056 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3057 if (debug) 3058 addlog(" [wantaddr %s]", 3059 sppp_dotted_quad(wantaddr)); 3060 /* 3061 * When doing dynamic address assignment, 3062 * we accept his offer. Otherwise, we 3063 * ignore it and thus continue to negotiate 3064 * our already existing value. 3065 */ 3066 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3067 if (debug) 3068 addlog(" [agree]"); 3069 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3070 sp->ipcp.req_myaddr = wantaddr; 3071 } 3072 } 3073 break; 3074 3075 case IPCP_OPT_PRIMDNS: 3076 if (len >= 6 && p[1] == 6) { 3077 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3078 p[4] << 8 | p[5]; 3079 } 3080 break; 3081 3082 case IPCP_OPT_SECDNS: 3083 if (len >= 6 && p[1] == 6) { 3084 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3085 p[4] << 8 | p[5]; 3086 } 3087 break; 3088 #ifdef notyet 3089 case IPCP_OPT_COMPRESS: 3090 /* 3091 * Peer wants different compression parameters. 3092 */ 3093 break; 3094 #endif 3095 } 3096 } 3097 if (debug) 3098 addlog("\n"); 3099 return; 3100 } 3101 3102 static void 3103 sppp_ipcp_tlu(struct sppp *sp) 3104 { 3105 /* we are up. Set addresses and notify anyone interested */ 3106 u_int32_t myaddr, hisaddr; 3107 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3108 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3109 myaddr = sp->ipcp.req_myaddr; 3110 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3111 hisaddr = sp->ipcp.req_hisaddr; 3112 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3113 if (sp->pp_con) 3114 sp->pp_con(sp); 3115 } 3116 3117 static void 3118 sppp_ipcp_tld(struct sppp *sp) 3119 { 3120 } 3121 3122 static void 3123 sppp_ipcp_tls(struct sppp *sp) 3124 { 3125 /* indicate to LCP that it must stay alive */ 3126 sp->lcp.protos |= (1 << IDX_IPCP); 3127 } 3128 3129 static void 3130 sppp_ipcp_tlf(struct sppp *sp) 3131 { 3132 /* we no longer need LCP */ 3133 sp->lcp.protos &= ~(1 << IDX_IPCP); 3134 } 3135 3136 static void 3137 sppp_ipcp_scr(struct sppp *sp) 3138 { 3139 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3140 u_int32_t ouraddr; 3141 int i = 0; 3142 3143 #ifdef notyet 3144 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3145 opt[i++] = IPCP_OPT_COMPRESSION; 3146 opt[i++] = 6; 3147 opt[i++] = 0; /* VJ header compression */ 3148 opt[i++] = 0x2d; /* VJ header compression */ 3149 opt[i++] = max_slot_id; 3150 opt[i++] = comp_slot_id; 3151 } 3152 #endif 3153 3154 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3155 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3156 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3157 else 3158 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3159 opt[i++] = IPCP_OPT_ADDRESS; 3160 opt[i++] = 6; 3161 opt[i++] = ouraddr >> 24; 3162 opt[i++] = ouraddr >> 16; 3163 opt[i++] = ouraddr >> 8; 3164 opt[i++] = ouraddr; 3165 } 3166 3167 if (sp->query_dns & 1) { 3168 opt[i++] = IPCP_OPT_PRIMDNS; 3169 opt[i++] = 6; 3170 opt[i++] = sp->dns_addrs[0] >> 24; 3171 opt[i++] = sp->dns_addrs[0] >> 16; 3172 opt[i++] = sp->dns_addrs[0] >> 8; 3173 opt[i++] = sp->dns_addrs[0]; 3174 } 3175 if (sp->query_dns & 2) { 3176 opt[i++] = IPCP_OPT_SECDNS; 3177 opt[i++] = 6; 3178 opt[i++] = sp->dns_addrs[1] >> 24; 3179 opt[i++] = sp->dns_addrs[1] >> 16; 3180 opt[i++] = sp->dns_addrs[1] >> 8; 3181 opt[i++] = sp->dns_addrs[1]; 3182 } 3183 3184 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3185 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3186 } 3187 3188 3189 /* 3190 *--------------------------------------------------------------------------* 3191 * * 3192 * The IPv6CP implementation. * 3193 * * 3194 *--------------------------------------------------------------------------* 3195 */ 3196 3197 #ifdef INET6 3198 static void 3199 sppp_ipv6cp_init(struct sppp *sp) 3200 { 3201 sp->ipv6cp.opts = 0; 3202 sp->ipv6cp.flags = 0; 3203 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3204 sp->fail_counter[IDX_IPV6CP] = 0; 3205 sp->pp_seq[IDX_IPV6CP] = 0; 3206 sp->pp_rseq[IDX_IPV6CP] = 0; 3207 callout_init(&sp->ch[IDX_IPV6CP]); 3208 } 3209 3210 static void 3211 sppp_ipv6cp_up(struct sppp *sp) 3212 { 3213 sppp_up_event(&ipv6cp, sp); 3214 } 3215 3216 static void 3217 sppp_ipv6cp_down(struct sppp *sp) 3218 { 3219 sppp_down_event(&ipv6cp, sp); 3220 } 3221 3222 static void 3223 sppp_ipv6cp_open(struct sppp *sp) 3224 { 3225 STDDCL; 3226 struct in6_addr myaddr, hisaddr; 3227 3228 #ifdef IPV6CP_MYIFID_DYN 3229 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3230 #else 3231 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3232 #endif 3233 3234 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3235 /* 3236 * If we don't have our address, this probably means our 3237 * interface doesn't want to talk IPv6 at all. (This could 3238 * be the case if somebody wants to speak only IPX, for 3239 * example.) Don't open IPv6CP in this case. 3240 */ 3241 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3242 /* XXX this message should go away */ 3243 if (debug) 3244 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3245 SPP_ARGS(ifp)); 3246 return; 3247 } 3248 3249 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3250 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3251 sppp_open_event(&ipv6cp, sp); 3252 } 3253 3254 static void 3255 sppp_ipv6cp_close(struct sppp *sp) 3256 { 3257 sppp_close_event(&ipv6cp, sp); 3258 } 3259 3260 static void 3261 sppp_ipv6cp_TO(void *cookie) 3262 { 3263 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3264 } 3265 3266 /* 3267 * Analyze a configure request. Return true if it was agreeable, and 3268 * caused action sca, false if it has been rejected or nak'ed, and 3269 * caused action scn. (The return value is used to make the state 3270 * transition decision in the state automaton.) 3271 */ 3272 static int 3273 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3274 { 3275 u_char *buf, *r, *p; 3276 struct ifnet *ifp = &sp->pp_if; 3277 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3278 struct in6_addr myaddr, desiredaddr, suggestaddr; 3279 int ifidcount; 3280 int type; 3281 int collision, nohisaddr; 3282 3283 len -= 4; 3284 origlen = len; 3285 /* 3286 * Make sure to allocate a buf that can at least hold a 3287 * conf-nak with an `address' option. We might need it below. 3288 */ 3289 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3290 if (! buf) 3291 return (0); 3292 3293 /* pass 1: see if we can recognize them */ 3294 if (debug) 3295 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:", 3296 SPP_ARGS(ifp)); 3297 p = (void *)(h + 1); 3298 ifidcount = 0; 3299 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3300 if (debug) 3301 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3302 switch (*p) { 3303 case IPV6CP_OPT_IFID: 3304 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3305 /* correctly formed address option */ 3306 ifidcount++; 3307 continue; 3308 } 3309 if (debug) 3310 addlog(" [invalid]"); 3311 break; 3312 #ifdef notyet 3313 case IPV6CP_OPT_COMPRESSION: 3314 if (len >= 4 && p[1] >= 4) { 3315 /* correctly formed compress option */ 3316 continue; 3317 } 3318 if (debug) 3319 addlog(" [invalid]"); 3320 break; 3321 #endif 3322 default: 3323 /* Others not supported. */ 3324 if (debug) 3325 addlog(" [rej]"); 3326 break; 3327 } 3328 /* Add the option to rejected list. */ 3329 bcopy (p, r, p[1]); 3330 r += p[1]; 3331 rlen += p[1]; 3332 } 3333 if (rlen) { 3334 if (debug) 3335 addlog(" send conf-rej\n"); 3336 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3337 goto end; 3338 } else if (debug) 3339 addlog("\n"); 3340 3341 /* pass 2: parse option values */ 3342 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3343 if (debug) 3344 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ", 3345 SPP_ARGS(ifp)); 3346 p = (void *)(h + 1); 3347 len = origlen; 3348 type = CONF_ACK; 3349 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3350 if (debug) 3351 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3352 switch (*p) { 3353 #ifdef notyet 3354 case IPV6CP_OPT_COMPRESSION: 3355 continue; 3356 #endif 3357 case IPV6CP_OPT_IFID: 3358 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3359 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3360 collision = (memcmp(&desiredaddr.s6_addr[8], 3361 &myaddr.s6_addr[8], 8) == 0); 3362 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3363 3364 desiredaddr.s6_addr16[0] = htons(0xfe80); 3365 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3366 3367 if (!collision && !nohisaddr) { 3368 /* no collision, hisaddr known - Conf-Ack */ 3369 type = CONF_ACK; 3370 3371 if (debug) { 3372 addlog(" %s [%s]", 3373 ip6_sprintf(&desiredaddr), 3374 sppp_cp_type_name(type)); 3375 } 3376 continue; 3377 } 3378 3379 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3380 if (collision && nohisaddr) { 3381 /* collision, hisaddr unknown - Conf-Rej */ 3382 type = CONF_REJ; 3383 memset(&p[2], 0, 8); 3384 } else { 3385 /* 3386 * - no collision, hisaddr unknown, or 3387 * - collision, hisaddr known 3388 * Conf-Nak, suggest hisaddr 3389 */ 3390 type = CONF_NAK; 3391 sppp_suggest_ip6_addr(sp, &suggestaddr); 3392 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3393 } 3394 if (debug) 3395 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3396 sppp_cp_type_name(type)); 3397 break; 3398 } 3399 /* Add the option to nak'ed list. */ 3400 bcopy (p, r, p[1]); 3401 r += p[1]; 3402 rlen += p[1]; 3403 } 3404 3405 if (rlen == 0 && type == CONF_ACK) { 3406 if (debug) 3407 addlog(" send %s\n", sppp_cp_type_name(type)); 3408 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3409 } else { 3410 #ifdef notdef 3411 if (type == CONF_ACK) 3412 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3413 #endif 3414 3415 if (debug) { 3416 addlog(" send %s suggest %s\n", 3417 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3418 } 3419 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3420 } 3421 3422 end: 3423 free(buf, M_TEMP); 3424 return (rlen == 0); 3425 } 3426 3427 /* 3428 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3429 * negotiation. 3430 */ 3431 static void 3432 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3433 { 3434 u_char *buf, *p; 3435 struct ifnet *ifp = &sp->pp_if; 3436 int debug = ifp->if_flags & IFF_DEBUG; 3437 3438 len -= 4; 3439 buf = malloc (len, M_TEMP, M_NOWAIT); 3440 if (!buf) 3441 return; 3442 3443 if (debug) 3444 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:", 3445 SPP_ARGS(ifp)); 3446 3447 p = (void *)(h + 1); 3448 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3449 if (debug) 3450 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3451 switch (*p) { 3452 case IPV6CP_OPT_IFID: 3453 /* 3454 * Peer doesn't grok address option. This is 3455 * bad. XXX Should we better give up here? 3456 */ 3457 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3458 break; 3459 #ifdef notyet 3460 case IPV6CP_OPT_COMPRESS: 3461 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3462 break; 3463 #endif 3464 } 3465 } 3466 if (debug) 3467 addlog("\n"); 3468 free(buf, M_TEMP); 3469 return; 3470 } 3471 3472 /* 3473 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3474 * negotiation. 3475 */ 3476 static void 3477 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3478 { 3479 u_char *buf, *p; 3480 struct ifnet *ifp = &sp->pp_if; 3481 int debug = ifp->if_flags & IFF_DEBUG; 3482 struct in6_addr suggestaddr; 3483 3484 len -= 4; 3485 buf = malloc (len, M_TEMP, M_NOWAIT); 3486 if (!buf) 3487 return; 3488 3489 if (debug) 3490 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:", 3491 SPP_ARGS(ifp)); 3492 3493 p = (void *)(h + 1); 3494 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3495 if (debug) 3496 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3497 switch (*p) { 3498 case IPV6CP_OPT_IFID: 3499 /* 3500 * Peer doesn't like our local ifid. See 3501 * if we can do something for him. We'll drop 3502 * him our address then. 3503 */ 3504 if (len < 10 || p[1] != 10) 3505 break; 3506 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3507 suggestaddr.s6_addr16[0] = htons(0xfe80); 3508 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3509 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3510 3511 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3512 if (debug) 3513 addlog(" [suggestaddr %s]", 3514 ip6_sprintf(&suggestaddr)); 3515 #ifdef IPV6CP_MYIFID_DYN 3516 /* 3517 * When doing dynamic address assignment, 3518 * we accept his offer. 3519 */ 3520 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3521 struct in6_addr lastsuggest; 3522 /* 3523 * If <suggested myaddr from peer> equals to 3524 * <hisaddr we have suggested last time>, 3525 * we have a collision. generate new random 3526 * ifid. 3527 */ 3528 sppp_suggest_ip6_addr(&lastsuggest); 3529 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3530 lastsuggest)) { 3531 if (debug) 3532 addlog(" [random]"); 3533 sppp_gen_ip6_addr(sp, &suggestaddr); 3534 } 3535 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3536 if (debug) 3537 addlog(" [agree]"); 3538 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3539 } 3540 #else 3541 /* 3542 * Since we do not do dynamic address assignment, 3543 * we ignore it and thus continue to negotiate 3544 * our already existing value. This can possibly 3545 * go into infinite request-reject loop. 3546 * 3547 * This is not likely because we normally use 3548 * ifid based on MAC-address. 3549 * If you have no ethernet card on the node, too bad. 3550 * XXX should we use fail_counter? 3551 */ 3552 #endif 3553 break; 3554 #ifdef notyet 3555 case IPV6CP_OPT_COMPRESS: 3556 /* 3557 * Peer wants different compression parameters. 3558 */ 3559 break; 3560 #endif 3561 } 3562 } 3563 if (debug) 3564 addlog("\n"); 3565 free(buf, M_TEMP); 3566 return; 3567 } 3568 3569 static void 3570 sppp_ipv6cp_tlu(struct sppp *sp) 3571 { 3572 /* we are up - notify isdn daemon */ 3573 if (sp->pp_con) 3574 sp->pp_con(sp); 3575 } 3576 3577 static void 3578 sppp_ipv6cp_tld(struct sppp *sp) 3579 { 3580 } 3581 3582 static void 3583 sppp_ipv6cp_tls(struct sppp *sp) 3584 { 3585 /* indicate to LCP that it must stay alive */ 3586 sp->lcp.protos |= (1 << IDX_IPV6CP); 3587 } 3588 3589 static void 3590 sppp_ipv6cp_tlf(struct sppp *sp) 3591 { 3592 /* we no longer need LCP */ 3593 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3594 } 3595 3596 static void 3597 sppp_ipv6cp_scr(struct sppp *sp) 3598 { 3599 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3600 struct in6_addr ouraddr; 3601 int i = 0; 3602 3603 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3604 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3605 opt[i++] = IPV6CP_OPT_IFID; 3606 opt[i++] = 10; 3607 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3608 i += 8; 3609 } 3610 3611 #ifdef notyet 3612 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3613 opt[i++] = IPV6CP_OPT_COMPRESSION; 3614 opt[i++] = 4; 3615 opt[i++] = 0; /* TBD */ 3616 opt[i++] = 0; /* TBD */ 3617 /* variable length data may follow */ 3618 } 3619 #endif 3620 3621 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3622 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3623 } 3624 #else /*INET6*/ 3625 static void sppp_ipv6cp_init(struct sppp *sp) 3626 { 3627 } 3628 3629 static void sppp_ipv6cp_up(struct sppp *sp) 3630 { 3631 } 3632 3633 static void sppp_ipv6cp_down(struct sppp *sp) 3634 { 3635 } 3636 3637 3638 static void sppp_ipv6cp_open(struct sppp *sp) 3639 { 3640 } 3641 3642 static void sppp_ipv6cp_close(struct sppp *sp) 3643 { 3644 } 3645 3646 static void sppp_ipv6cp_TO(void *sp) 3647 { 3648 } 3649 3650 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3651 { 3652 return 0; 3653 } 3654 3655 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3656 { 3657 } 3658 3659 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3660 { 3661 } 3662 3663 static void sppp_ipv6cp_tlu(struct sppp *sp) 3664 { 3665 } 3666 3667 static void sppp_ipv6cp_tld(struct sppp *sp) 3668 { 3669 } 3670 3671 static void sppp_ipv6cp_tls(struct sppp *sp) 3672 { 3673 } 3674 3675 static void sppp_ipv6cp_tlf(struct sppp *sp) 3676 { 3677 } 3678 3679 static void sppp_ipv6cp_scr(struct sppp *sp) 3680 { 3681 } 3682 #endif /*INET6*/ 3683 3684 3685 /* 3686 *--------------------------------------------------------------------------* 3687 * * 3688 * The CHAP implementation. * 3689 * * 3690 *--------------------------------------------------------------------------* 3691 */ 3692 3693 /* 3694 * The authentication protocols don't employ a full-fledged state machine as 3695 * the control protocols do, since they do have Open and Close events, but 3696 * not Up and Down, nor are they explicitly terminated. Also, use of the 3697 * authentication protocols may be different in both directions (this makes 3698 * sense, think of a machine that never accepts incoming calls but only 3699 * calls out, it doesn't require the called party to authenticate itself). 3700 * 3701 * Our state machine for the local authentication protocol (we are requesting 3702 * the peer to authenticate) looks like: 3703 * 3704 * RCA- 3705 * +--------------------------------------------+ 3706 * V scn,tld| 3707 * +--------+ Close +---------+ RCA+ 3708 * | |<----------------------------------| |------+ 3709 * +--->| Closed | TO* | Opened | sca | 3710 * | | |-----+ +-------| |<-----+ 3711 * | +--------+ irc | | +---------+ 3712 * | ^ | | ^ 3713 * | | | | | 3714 * | | | | | 3715 * | TO-| | | | 3716 * | |tld TO+ V | | 3717 * | | +------->+ | | 3718 * | | | | | | 3719 * | +--------+ V | | 3720 * | | |<----+<--------------------+ | 3721 * | | Req- | scr | 3722 * | | Sent | | 3723 * | | | | 3724 * | +--------+ | 3725 * | RCA- | | RCA+ | 3726 * +------+ +------------------------------------------+ 3727 * scn,tld sca,irc,ict,tlu 3728 * 3729 * 3730 * with: 3731 * 3732 * Open: LCP reached authentication phase 3733 * Close: LCP reached terminate phase 3734 * 3735 * RCA+: received reply (pap-req, chap-response), acceptable 3736 * RCN: received reply (pap-req, chap-response), not acceptable 3737 * TO+: timeout with restart counter >= 0 3738 * TO-: timeout with restart counter < 0 3739 * TO*: reschedule timeout for CHAP 3740 * 3741 * scr: send request packet (none for PAP, chap-challenge) 3742 * sca: send ack packet (pap-ack, chap-success) 3743 * scn: send nak packet (pap-nak, chap-failure) 3744 * ict: initialize re-challenge timer (CHAP only) 3745 * 3746 * tlu: this-layer-up, LCP reaches network phase 3747 * tld: this-layer-down, LCP enters terminate phase 3748 * 3749 * Note that in CHAP mode, after sending a new challenge, while the state 3750 * automaton falls back into Req-Sent state, it doesn't signal a tld 3751 * event to LCP, so LCP remains in network phase. Only after not getting 3752 * any response (or after getting an unacceptable response), CHAP closes, 3753 * causing LCP to enter terminate phase. 3754 * 3755 * With PAP, there is no initial request that can be sent. The peer is 3756 * expected to send one based on the successful negotiation of PAP as 3757 * the authentication protocol during the LCP option negotiation. 3758 * 3759 * Incoming authentication protocol requests (remote requests 3760 * authentication, we are peer) don't employ a state machine at all, 3761 * they are simply answered. Some peers [Ascend P50 firmware rev 3762 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3763 * still in authentication phase (thereby violating the standard that 3764 * demands that these NCP packets are to be discarded), so we keep 3765 * track of the peer demanding us to authenticate, and only proceed to 3766 * phase network once we've seen a positive acknowledge for the 3767 * authentication. 3768 */ 3769 3770 /* 3771 * Handle incoming CHAP packets. 3772 */ 3773 void 3774 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3775 { 3776 STDDCL; 3777 struct lcp_header *h; 3778 int len, x; 3779 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3780 int value_len, name_len; 3781 MD5_CTX ctx; 3782 3783 len = m->m_pkthdr.len; 3784 if (len < 4) { 3785 if (debug) 3786 log(LOG_DEBUG, 3787 SPP_FMT "chap invalid packet length: %d bytes\n", 3788 SPP_ARGS(ifp), len); 3789 return; 3790 } 3791 h = mtod(m, struct lcp_header *); 3792 if (len > ntohs(h->len)) 3793 len = ntohs(h->len); 3794 3795 switch (h->type) { 3796 /* challenge, failure and success are his authproto */ 3797 case CHAP_CHALLENGE: 3798 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3799 /* can't do anything usefull */ 3800 sp->pp_auth_failures++; 3801 printf(SPP_FMT "chap input without my name and my secret being set\n", 3802 SPP_ARGS(ifp)); 3803 break; 3804 } 3805 value = 1 + (u_char *)(h + 1); 3806 value_len = value[-1]; 3807 name = value + value_len; 3808 name_len = len - value_len - 5; 3809 if (name_len < 0) { 3810 if (debug) { 3811 log(LOG_DEBUG, 3812 SPP_FMT "chap corrupted challenge " 3813 "<%s id=0x%x len=%d", 3814 SPP_ARGS(ifp), 3815 sppp_auth_type_name(PPP_CHAP, h->type), 3816 h->ident, ntohs(h->len)); 3817 if (len > 4) 3818 sppp_print_bytes((u_char *)(h + 1), 3819 len - 4); 3820 addlog(">\n"); 3821 } 3822 break; 3823 } 3824 3825 if (debug) { 3826 log(LOG_DEBUG, 3827 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3828 SPP_ARGS(ifp), 3829 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3830 ntohs(h->len)); 3831 sppp_print_string((char *) name, name_len); 3832 addlog(" value-size=%d value=", value_len); 3833 sppp_print_bytes(value, value_len); 3834 addlog(">\n"); 3835 } 3836 3837 /* Compute reply value. */ 3838 MD5Init(&ctx); 3839 MD5Update(&ctx, &h->ident, 1); 3840 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3841 MD5Update(&ctx, value, value_len); 3842 MD5Final(digest, &ctx); 3843 dsize = sizeof digest; 3844 3845 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3846 sizeof dsize, (const char *)&dsize, 3847 sizeof digest, digest, 3848 sp->myauth.name_len, 3849 sp->myauth.name, 3850 0); 3851 break; 3852 3853 case CHAP_SUCCESS: 3854 if (debug) { 3855 log(LOG_DEBUG, SPP_FMT "chap success", 3856 SPP_ARGS(ifp)); 3857 if (len > 4) { 3858 addlog(": "); 3859 sppp_print_string((char *)(h + 1), len - 4); 3860 } 3861 addlog("\n"); 3862 } 3863 x = splnet(); 3864 sp->pp_auth_failures = 0; 3865 sp->pp_flags &= ~PP_NEEDAUTH; 3866 if (sp->myauth.proto == PPP_CHAP && 3867 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3868 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3869 /* 3870 * We are authenticator for CHAP but didn't 3871 * complete yet. Leave it to tlu to proceed 3872 * to network phase. 3873 */ 3874 splx(x); 3875 break; 3876 } 3877 splx(x); 3878 sppp_phase_network(sp); 3879 break; 3880 3881 case CHAP_FAILURE: 3882 x = splnet(); 3883 sp->pp_auth_failures++; 3884 splx(x); 3885 if (debug) { 3886 log(LOG_INFO, SPP_FMT "chap failure", 3887 SPP_ARGS(ifp)); 3888 if (len > 4) { 3889 addlog(": "); 3890 sppp_print_string((char *)(h + 1), len - 4); 3891 } 3892 addlog("\n"); 3893 } else 3894 log(LOG_INFO, SPP_FMT "chap failure\n", 3895 SPP_ARGS(ifp)); 3896 /* await LCP shutdown by authenticator */ 3897 break; 3898 3899 /* response is my authproto */ 3900 case CHAP_RESPONSE: 3901 if (sp->hisauth.secret == NULL) { 3902 /* can't do anything usefull */ 3903 printf(SPP_FMT "chap input without his secret being set\n", 3904 SPP_ARGS(ifp)); 3905 break; 3906 } 3907 value = 1 + (u_char *)(h + 1); 3908 value_len = value[-1]; 3909 name = value + value_len; 3910 name_len = len - value_len - 5; 3911 if (name_len < 0) { 3912 if (debug) { 3913 log(LOG_DEBUG, 3914 SPP_FMT "chap corrupted response " 3915 "<%s id=0x%x len=%d", 3916 SPP_ARGS(ifp), 3917 sppp_auth_type_name(PPP_CHAP, h->type), 3918 h->ident, ntohs(h->len)); 3919 if (len > 4) 3920 sppp_print_bytes((u_char *)(h + 1), 3921 len - 4); 3922 addlog(">\n"); 3923 } 3924 break; 3925 } 3926 if (h->ident != sp->confid[IDX_CHAP]) { 3927 if (debug) 3928 log(LOG_DEBUG, 3929 SPP_FMT "chap dropping response for old ID " 3930 "(got %d, expected %d)\n", 3931 SPP_ARGS(ifp), 3932 h->ident, sp->confid[IDX_CHAP]); 3933 break; 3934 } 3935 if (sp->hisauth.name != NULL && 3936 (name_len != sp->hisauth.name_len 3937 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 3938 log(LOG_INFO, SPP_FMT "chap response, his name ", 3939 SPP_ARGS(ifp)); 3940 sppp_print_string(name, name_len); 3941 addlog(" != expected "); 3942 sppp_print_string(sp->hisauth.name, 3943 sp->hisauth.name_len); 3944 addlog("\n"); 3945 goto chap_failure; 3946 } 3947 if (debug) { 3948 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 3949 "<%s id=0x%x len=%d name=", 3950 SPP_ARGS(ifp), 3951 sppp_state_name(sp->state[IDX_CHAP]), 3952 sppp_auth_type_name(PPP_CHAP, h->type), 3953 h->ident, ntohs(h->len)); 3954 sppp_print_string((char *)name, name_len); 3955 addlog(" value-size=%d value=", value_len); 3956 sppp_print_bytes(value, value_len); 3957 addlog(">\n"); 3958 } 3959 if (value_len != sizeof(sp->myauth.challenge)) { 3960 if (debug) 3961 log(LOG_DEBUG, 3962 SPP_FMT "chap bad hash value length: " 3963 "%d bytes, should be %ld\n", 3964 SPP_ARGS(ifp), value_len, 3965 (long) sizeof(sp->myauth.challenge)); 3966 goto chap_failure; 3967 } 3968 3969 MD5Init(&ctx); 3970 MD5Update(&ctx, &h->ident, 1); 3971 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 3972 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 3973 MD5Final(digest, &ctx); 3974 3975 #define FAILMSG "Failed..." 3976 #define SUCCMSG "Welcome!" 3977 3978 if (value_len != sizeof digest || 3979 memcmp(digest, value, value_len) != 0) { 3980 chap_failure: 3981 /* action scn, tld */ 3982 x = splnet(); 3983 sp->pp_auth_failures++; 3984 splx(x); 3985 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 3986 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 3987 0); 3988 chap.tld(sp); 3989 break; 3990 } 3991 sp->pp_auth_failures = 0; 3992 /* action sca, perhaps tlu */ 3993 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 3994 sp->state[IDX_CHAP] == STATE_OPENED) 3995 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 3996 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 3997 0); 3998 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 3999 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4000 chap.tlu(sp); 4001 } 4002 break; 4003 4004 default: 4005 /* Unknown CHAP packet type -- ignore. */ 4006 if (debug) { 4007 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 4008 "<0x%x id=0x%xh len=%d", 4009 SPP_ARGS(ifp), 4010 sppp_state_name(sp->state[IDX_CHAP]), 4011 h->type, h->ident, ntohs(h->len)); 4012 if (len > 4) 4013 sppp_print_bytes((u_char *)(h + 1), len - 4); 4014 addlog(">\n"); 4015 } 4016 break; 4017 4018 } 4019 } 4020 4021 static void 4022 sppp_chap_init(struct sppp *sp) 4023 { 4024 /* Chap doesn't have STATE_INITIAL at all. */ 4025 sp->state[IDX_CHAP] = STATE_CLOSED; 4026 sp->fail_counter[IDX_CHAP] = 0; 4027 sp->pp_seq[IDX_CHAP] = 0; 4028 sp->pp_rseq[IDX_CHAP] = 0; 4029 callout_init(&sp->ch[IDX_CHAP]); 4030 } 4031 4032 static void 4033 sppp_chap_open(struct sppp *sp) 4034 { 4035 if (sp->myauth.proto == PPP_CHAP && 4036 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4037 /* we are authenticator for CHAP, start it */ 4038 chap.scr(sp); 4039 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4040 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4041 } 4042 /* nothing to be done if we are peer, await a challenge */ 4043 } 4044 4045 static void 4046 sppp_chap_close(struct sppp *sp) 4047 { 4048 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4049 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4050 } 4051 4052 static void 4053 sppp_chap_TO(void *cookie) 4054 { 4055 struct sppp *sp = (struct sppp *)cookie; 4056 STDDCL; 4057 int s; 4058 4059 s = splnet(); 4060 if (debug) 4061 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 4062 SPP_ARGS(ifp), 4063 sppp_state_name(sp->state[IDX_CHAP]), 4064 sp->rst_counter[IDX_CHAP]); 4065 4066 if (--sp->rst_counter[IDX_CHAP] < 0) 4067 /* TO- event */ 4068 switch (sp->state[IDX_CHAP]) { 4069 case STATE_REQ_SENT: 4070 chap.tld(sp); 4071 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4072 break; 4073 } 4074 else 4075 /* TO+ (or TO*) event */ 4076 switch (sp->state[IDX_CHAP]) { 4077 case STATE_OPENED: 4078 /* TO* event */ 4079 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4080 /* fall through */ 4081 case STATE_REQ_SENT: 4082 chap.scr(sp); 4083 /* sppp_cp_change_state() will restart the timer */ 4084 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4085 break; 4086 } 4087 4088 splx(s); 4089 } 4090 4091 static void 4092 sppp_chap_tlu(struct sppp *sp) 4093 { 4094 STDDCL; 4095 int i, x; 4096 4097 i = 0; 4098 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4099 4100 /* 4101 * Some broken CHAP implementations (Conware CoNet, firmware 4102 * 4.0.?) don't want to re-authenticate their CHAP once the 4103 * initial challenge-response exchange has taken place. 4104 * Provide for an option to avoid rechallenges. 4105 */ 4106 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4107 /* 4108 * Compute the re-challenge timeout. This will yield 4109 * a number between 300 and 810 seconds. 4110 */ 4111 i = 300 + ((unsigned)(random() & 0xff00) >> 7); 4112 4113 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4114 } 4115 4116 if (debug) { 4117 log(LOG_DEBUG, 4118 SPP_FMT "chap %s, ", 4119 SPP_ARGS(ifp), 4120 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4121 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4122 addlog("next re-challenge in %d seconds\n", i); 4123 else 4124 addlog("re-challenging supressed\n"); 4125 } 4126 4127 x = splnet(); 4128 sp->pp_auth_failures = 0; 4129 /* indicate to LCP that we need to be closed down */ 4130 sp->lcp.protos |= (1 << IDX_CHAP); 4131 4132 if (sp->pp_flags & PP_NEEDAUTH) { 4133 /* 4134 * Remote is authenticator, but his auth proto didn't 4135 * complete yet. Defer the transition to network 4136 * phase. 4137 */ 4138 splx(x); 4139 return; 4140 } 4141 splx(x); 4142 4143 /* 4144 * If we are already in phase network, we are done here. This 4145 * is the case if this is a dummy tlu event after a re-challenge. 4146 */ 4147 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4148 sppp_phase_network(sp); 4149 } 4150 4151 static void 4152 sppp_chap_tld(struct sppp *sp) 4153 { 4154 STDDCL; 4155 4156 if (debug) 4157 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4158 callout_stop(&sp->ch[IDX_CHAP]); 4159 sp->lcp.protos &= ~(1 << IDX_CHAP); 4160 4161 lcp.Close(sp); 4162 } 4163 4164 static void 4165 sppp_chap_scr(struct sppp *sp) 4166 { 4167 struct timeval tv; 4168 u_int32_t *ch, seed; 4169 u_char clen; 4170 4171 if (sp->myauth.name == NULL) { 4172 /* can't do anything usefull */ 4173 printf(SPP_FMT "chap starting without my name being set\n", 4174 SPP_ARGS(&sp->pp_if)); 4175 return; 4176 } 4177 4178 /* Compute random challenge. */ 4179 ch = (u_int32_t *)sp->myauth.challenge; 4180 microtime(&tv); 4181 seed = tv.tv_sec ^ tv.tv_usec; 4182 ch[0] = seed ^ random(); 4183 ch[1] = seed ^ random(); 4184 ch[2] = seed ^ random(); 4185 ch[3] = seed ^ random(); 4186 clen = 16; /* 4 * sizeof(u_int32_t) */ 4187 4188 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4189 4190 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4191 sizeof clen, (const char *)&clen, 4192 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4193 sp->myauth.name_len, 4194 sp->myauth.name, 4195 0); 4196 } 4197 4198 /* 4199 *--------------------------------------------------------------------------* 4200 * * 4201 * The PAP implementation. * 4202 * * 4203 *--------------------------------------------------------------------------* 4204 */ 4205 /* 4206 * For PAP, we need to keep a little state also if we are the peer, not the 4207 * authenticator. This is since we don't get a request to authenticate, but 4208 * have to repeatedly authenticate ourself until we got a response (or the 4209 * retry counter is expired). 4210 */ 4211 4212 /* 4213 * Handle incoming PAP packets. */ 4214 static void 4215 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4216 { 4217 STDDCL; 4218 struct lcp_header *h; 4219 int len, x; 4220 u_char mlen; 4221 char *name, *secret; 4222 int name_len, secret_len; 4223 4224 len = m->m_pkthdr.len; 4225 if (len < 5) { 4226 if (debug) 4227 log(LOG_DEBUG, 4228 SPP_FMT "pap invalid packet length: %d bytes\n", 4229 SPP_ARGS(ifp), len); 4230 return; 4231 } 4232 h = mtod(m, struct lcp_header *); 4233 if (len > ntohs(h->len)) 4234 len = ntohs(h->len); 4235 switch (h->type) { 4236 /* PAP request is my authproto */ 4237 case PAP_REQ: 4238 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4239 /* can't do anything usefull */ 4240 printf(SPP_FMT "pap request without his name and his secret being set\n", 4241 SPP_ARGS(ifp)); 4242 break; 4243 } 4244 name = 1 + (u_char *)(h + 1); 4245 name_len = name[-1]; 4246 secret = name + name_len + 1; 4247 if (name_len > len - 6 || 4248 (secret_len = secret[-1]) > len - 6 - name_len) { 4249 if (debug) { 4250 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4251 "<%s id=0x%x len=%d", 4252 SPP_ARGS(ifp), 4253 sppp_auth_type_name(PPP_PAP, h->type), 4254 h->ident, ntohs(h->len)); 4255 if (len > 4) 4256 sppp_print_bytes((u_char *)(h + 1), 4257 len - 4); 4258 addlog(">\n"); 4259 } 4260 break; 4261 } 4262 if (debug) { 4263 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4264 "<%s id=0x%x len=%d name=", 4265 SPP_ARGS(ifp), 4266 sppp_state_name(sp->state[IDX_PAP]), 4267 sppp_auth_type_name(PPP_PAP, h->type), 4268 h->ident, ntohs(h->len)); 4269 sppp_print_string((char *)name, name_len); 4270 addlog(" secret="); 4271 sppp_print_string((char *)secret, secret_len); 4272 addlog(">\n"); 4273 } 4274 if (name_len != sp->hisauth.name_len || 4275 secret_len != sp->hisauth.secret_len || 4276 memcmp(name, sp->hisauth.name, name_len) != 0 || 4277 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4278 /* action scn, tld */ 4279 sp->pp_auth_failures++; 4280 mlen = sizeof(FAILMSG) - 1; 4281 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4282 sizeof mlen, (const char *)&mlen, 4283 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4284 0); 4285 pap.tld(sp); 4286 break; 4287 } 4288 /* action sca, perhaps tlu */ 4289 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4290 sp->state[IDX_PAP] == STATE_OPENED) { 4291 mlen = sizeof(SUCCMSG) - 1; 4292 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4293 sizeof mlen, (const char *)&mlen, 4294 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4295 0); 4296 } 4297 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4298 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4299 pap.tlu(sp); 4300 } 4301 break; 4302 4303 /* ack and nak are his authproto */ 4304 case PAP_ACK: 4305 callout_stop(&sp->pap_my_to_ch); 4306 if (debug) { 4307 log(LOG_DEBUG, SPP_FMT "pap success", 4308 SPP_ARGS(ifp)); 4309 name_len = *(char *)h; 4310 if (len > 5 && name_len) { 4311 addlog(": "); 4312 sppp_print_string((char *)(h + 1), name_len); 4313 } 4314 addlog("\n"); 4315 } 4316 x = splnet(); 4317 sp->pp_auth_failures = 0; 4318 sp->pp_flags &= ~PP_NEEDAUTH; 4319 if (sp->myauth.proto == PPP_PAP && 4320 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4321 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4322 /* 4323 * We are authenticator for PAP but didn't 4324 * complete yet. Leave it to tlu to proceed 4325 * to network phase. 4326 */ 4327 splx(x); 4328 break; 4329 } 4330 splx(x); 4331 sppp_phase_network(sp); 4332 break; 4333 4334 case PAP_NAK: 4335 callout_stop(&sp->pap_my_to_ch); 4336 sp->pp_auth_failures++; 4337 if (debug) { 4338 log(LOG_INFO, SPP_FMT "pap failure", 4339 SPP_ARGS(ifp)); 4340 name_len = *(char *)h; 4341 if (len > 5 && name_len) { 4342 addlog(": "); 4343 sppp_print_string((char *)(h + 1), name_len); 4344 } 4345 addlog("\n"); 4346 } else 4347 log(LOG_INFO, SPP_FMT "pap failure\n", 4348 SPP_ARGS(ifp)); 4349 /* await LCP shutdown by authenticator */ 4350 break; 4351 4352 default: 4353 /* Unknown PAP packet type -- ignore. */ 4354 if (debug) { 4355 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4356 "<0x%x id=0x%x len=%d", 4357 SPP_ARGS(ifp), 4358 h->type, h->ident, ntohs(h->len)); 4359 if (len > 4) 4360 sppp_print_bytes((u_char *)(h + 1), len - 4); 4361 addlog(">\n"); 4362 } 4363 break; 4364 4365 } 4366 } 4367 4368 static void 4369 sppp_pap_init(struct sppp *sp) 4370 { 4371 /* PAP doesn't have STATE_INITIAL at all. */ 4372 sp->state[IDX_PAP] = STATE_CLOSED; 4373 sp->fail_counter[IDX_PAP] = 0; 4374 sp->pp_seq[IDX_PAP] = 0; 4375 sp->pp_rseq[IDX_PAP] = 0; 4376 callout_init(&sp->ch[IDX_PAP]); 4377 callout_init(&sp->pap_my_to_ch); 4378 } 4379 4380 static void 4381 sppp_pap_open(struct sppp *sp) 4382 { 4383 if (sp->hisauth.proto == PPP_PAP && 4384 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4385 /* we are authenticator for PAP, start our timer */ 4386 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4387 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4388 } 4389 if (sp->myauth.proto == PPP_PAP) { 4390 /* we are peer, send a request, and start a timer */ 4391 pap.scr(sp); 4392 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4393 sppp_pap_my_TO, sp); 4394 } 4395 } 4396 4397 static void 4398 sppp_pap_close(struct sppp *sp) 4399 { 4400 if (sp->state[IDX_PAP] != STATE_CLOSED) 4401 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4402 } 4403 4404 /* 4405 * That's the timeout routine if we are authenticator. Since the 4406 * authenticator is basically passive in PAP, we can't do much here. 4407 */ 4408 static void 4409 sppp_pap_TO(void *cookie) 4410 { 4411 struct sppp *sp = (struct sppp *)cookie; 4412 STDDCL; 4413 int s; 4414 4415 s = splnet(); 4416 if (debug) 4417 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4418 SPP_ARGS(ifp), 4419 sppp_state_name(sp->state[IDX_PAP]), 4420 sp->rst_counter[IDX_PAP]); 4421 4422 if (--sp->rst_counter[IDX_PAP] < 0) 4423 /* TO- event */ 4424 switch (sp->state[IDX_PAP]) { 4425 case STATE_REQ_SENT: 4426 pap.tld(sp); 4427 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4428 break; 4429 } 4430 else 4431 /* TO+ event, not very much we could do */ 4432 switch (sp->state[IDX_PAP]) { 4433 case STATE_REQ_SENT: 4434 /* sppp_cp_change_state() will restart the timer */ 4435 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4436 break; 4437 } 4438 4439 splx(s); 4440 } 4441 4442 /* 4443 * That's the timeout handler if we are peer. Since the peer is active, 4444 * we need to retransmit our PAP request since it is apparently lost. 4445 * XXX We should impose a max counter. 4446 */ 4447 static void 4448 sppp_pap_my_TO(void *cookie) 4449 { 4450 struct sppp *sp = (struct sppp *)cookie; 4451 STDDCL; 4452 4453 if (debug) 4454 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4455 SPP_ARGS(ifp)); 4456 4457 pap.scr(sp); 4458 } 4459 4460 static void 4461 sppp_pap_tlu(struct sppp *sp) 4462 { 4463 STDDCL; 4464 int x; 4465 4466 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4467 4468 if (debug) 4469 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4470 SPP_ARGS(ifp), pap.name); 4471 4472 x = splnet(); 4473 sp->pp_auth_failures = 0; 4474 /* indicate to LCP that we need to be closed down */ 4475 sp->lcp.protos |= (1 << IDX_PAP); 4476 4477 if (sp->pp_flags & PP_NEEDAUTH) { 4478 /* 4479 * Remote is authenticator, but his auth proto didn't 4480 * complete yet. Defer the transition to network 4481 * phase. 4482 */ 4483 splx(x); 4484 return; 4485 } 4486 splx(x); 4487 sppp_phase_network(sp); 4488 } 4489 4490 static void 4491 sppp_pap_tld(struct sppp *sp) 4492 { 4493 STDDCL; 4494 4495 if (debug) 4496 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4497 callout_stop(&sp->ch[IDX_PAP]); 4498 callout_stop(&sp->pap_my_to_ch); 4499 sp->lcp.protos &= ~(1 << IDX_PAP); 4500 4501 lcp.Close(sp); 4502 } 4503 4504 static void 4505 sppp_pap_scr(struct sppp *sp) 4506 { 4507 u_char idlen, pwdlen; 4508 4509 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4510 /* can't do anything usefull */ 4511 printf(SPP_FMT "pap starting without my name and secret being set\n", 4512 SPP_ARGS(&sp->pp_if)); 4513 return; 4514 } 4515 4516 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4517 pwdlen = sp->myauth.secret_len; 4518 idlen = sp->myauth.name_len; 4519 4520 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4521 sizeof idlen, (const char *)&idlen, 4522 idlen, sp->myauth.name, 4523 sizeof pwdlen, (const char *)&pwdlen, 4524 pwdlen, sp->myauth.secret, 4525 0); 4526 } 4527 4528 /* 4529 * Random miscellaneous functions. 4530 */ 4531 4532 /* 4533 * Send a PAP or CHAP proto packet. 4534 * 4535 * Varadic function, each of the elements for the ellipsis is of type 4536 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4537 * mlen == 0. 4538 * NOTE: never declare variadic functions with types subject to type 4539 * promotion (i.e. u_char). This is asking for big trouble depending 4540 * on the architecture you are on... 4541 */ 4542 4543 static void 4544 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4545 unsigned int type, unsigned int id, 4546 ...) 4547 { 4548 STDDCL; 4549 struct lcp_header *lh; 4550 struct mbuf *m; 4551 u_char *p; 4552 int len; 4553 size_t pkthdrlen; 4554 unsigned int mlen; 4555 const char *msg; 4556 va_list ap; 4557 4558 MGETHDR(m, M_DONTWAIT, MT_DATA); 4559 if (! m) 4560 return; 4561 m->m_pkthdr.rcvif = 0; 4562 4563 if (sp->pp_flags & PP_NOFRAMING) { 4564 *mtod(m, u_int16_t *) = htons(cp->proto); 4565 pkthdrlen = 2; 4566 lh = (struct lcp_header *)(mtod(m, u_int8_t *)+2); 4567 } else { 4568 struct ppp_header *h; 4569 h = mtod(m, struct ppp_header *); 4570 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4571 h->control = PPP_UI; /* Unnumbered Info */ 4572 h->protocol = htons(cp->proto); 4573 pkthdrlen = PPP_HEADER_LEN; 4574 4575 lh = (struct lcp_header *)(h + 1); 4576 } 4577 4578 lh->type = type; 4579 lh->ident = id; 4580 p = (u_char *)(lh + 1); 4581 4582 va_start(ap, id); 4583 len = 0; 4584 4585 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4586 msg = va_arg(ap, const char *); 4587 len += mlen; 4588 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4589 va_end(ap); 4590 m_freem(m); 4591 return; 4592 } 4593 4594 bcopy(msg, p, mlen); 4595 p += mlen; 4596 } 4597 va_end(ap); 4598 4599 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4600 lh->len = htons(LCP_HEADER_LEN + len); 4601 4602 if (debug) { 4603 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4604 SPP_ARGS(ifp), cp->name, 4605 sppp_auth_type_name(cp->proto, lh->type), 4606 lh->ident, ntohs(lh->len)); 4607 if (len) 4608 sppp_print_bytes((u_char *)(lh + 1), len); 4609 addlog(">\n"); 4610 } 4611 if (IF_QFULL(&sp->pp_cpq)) { 4612 IF_DROP(&sp->pp_fastq); 4613 IF_DROP(&ifp->if_snd); 4614 m_freem(m); 4615 ++ifp->if_oerrors; 4616 return; 4617 } else 4618 IF_ENQUEUE(&sp->pp_cpq, m); 4619 if (! (ifp->if_flags & IFF_OACTIVE)) 4620 (*ifp->if_start)(ifp); 4621 ifp->if_obytes += m->m_pkthdr.len + 3; 4622 } 4623 4624 /* 4625 * Send keepalive packets, every 10 seconds. 4626 */ 4627 static void 4628 sppp_keepalive(void *dummy) 4629 { 4630 struct sppp *sp; 4631 int s; 4632 time_t now; 4633 4634 s = splnet(); 4635 now = mono_time.tv_sec; 4636 for (sp=spppq; sp; sp=sp->pp_next) { 4637 struct ifnet *ifp = &sp->pp_if; 4638 4639 /* check idle timeout */ 4640 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4641 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4642 /* idle timeout is enabled for this interface */ 4643 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4644 if (ifp->if_flags & IFF_DEBUG) 4645 printf("%s: no activitiy for %lu seconds\n", 4646 sp->pp_if.if_xname, 4647 (unsigned long)(now-sp->pp_last_activity)); 4648 lcp.Close(sp); 4649 continue; 4650 } 4651 } 4652 4653 /* Keepalive mode disabled or channel down? */ 4654 if (! (sp->pp_flags & PP_KEEPALIVE) || 4655 ! (ifp->if_flags & IFF_RUNNING)) 4656 continue; 4657 4658 /* No keepalive in PPP mode if LCP not opened yet. */ 4659 if (! (sp->pp_flags & PP_CISCO) && 4660 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4661 continue; 4662 4663 /* No echo reply, but maybe user data passed through? */ 4664 if ((now - sp->pp_last_activity) < LCP_KEEPALIVE_INTERVAL) { 4665 sp->pp_alivecnt = 0; 4666 continue; 4667 } 4668 4669 if (sp->pp_alivecnt == MAXALIVECNT) { 4670 /* No keepalive packets got. Stop the interface. */ 4671 if_down (ifp); 4672 IF_PURGE(&sp->pp_cpq); 4673 if (! (sp->pp_flags & PP_CISCO)) { 4674 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4675 ifp->if_xname); 4676 sp->pp_alivecnt = 0; 4677 4678 /* we are down, close all open protocols */ 4679 lcp.Close(sp); 4680 4681 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4682 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4683 4684 /* Close connection imediatly, completition of this 4685 * will summon the magic needed to reestablish it. */ 4686 sp->pp_tlf(sp); 4687 continue; 4688 } 4689 } 4690 if (sp->pp_alivecnt <= MAXALIVECNT) 4691 ++sp->pp_alivecnt; 4692 if (sp->pp_flags & PP_CISCO) 4693 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4694 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4695 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4696 int32_t nmagic = htonl(sp->lcp.magic); 4697 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4698 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4699 sp->lcp.echoid, 4, &nmagic); 4700 } 4701 } 4702 splx(s); 4703 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4704 } 4705 4706 /* 4707 * Get both IP addresses. 4708 */ 4709 static void 4710 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask) 4711 { 4712 struct ifnet *ifp = &sp->pp_if; 4713 struct ifaddr *ifa; 4714 struct sockaddr_in *si, *sm; 4715 u_int32_t ssrc, ddst; 4716 4717 sm = NULL; 4718 ssrc = ddst = 0; 4719 /* 4720 * Pick the first AF_INET address from the list, 4721 * aliases don't make any sense on a p2p link anyway. 4722 */ 4723 si = 0; 4724 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4725 if (ifa->ifa_addr->sa_family == AF_INET) { 4726 si = (struct sockaddr_in *)ifa->ifa_addr; 4727 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4728 if (si) 4729 break; 4730 } 4731 } 4732 if (ifa) { 4733 if (si && si->sin_addr.s_addr) { 4734 ssrc = si->sin_addr.s_addr; 4735 if (srcmask) 4736 *srcmask = ntohl(sm->sin_addr.s_addr); 4737 } 4738 4739 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4740 if (si && si->sin_addr.s_addr) 4741 ddst = si->sin_addr.s_addr; 4742 } 4743 4744 if (dst) *dst = ntohl(ddst); 4745 if (src) *src = ntohl(ssrc); 4746 } 4747 4748 /* 4749 * Set IP addresses. Must be called at splnet. 4750 * If an address is 0, leave it the way it is. 4751 */ 4752 static void 4753 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4754 { 4755 STDDCL; 4756 struct ifaddr *ifa; 4757 struct sockaddr_in *si; 4758 struct sockaddr_in *dest; 4759 4760 /* 4761 * Pick the first AF_INET address from the list, 4762 * aliases don't make any sense on a p2p link anyway. 4763 */ 4764 4765 si = 0; 4766 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4767 { 4768 if (ifa->ifa_addr->sa_family == AF_INET) 4769 { 4770 si = (struct sockaddr_in *)ifa->ifa_addr; 4771 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4772 if (si) 4773 break; 4774 } 4775 } 4776 4777 if (ifa && si) 4778 { 4779 int error; 4780 struct sockaddr_in new_sin = *si; 4781 struct sockaddr_in new_dst = *dest; 4782 4783 /* 4784 * Scrub old routes now instead of calling in_ifinit with 4785 * scrub=1, because we may change the dstaddr 4786 * before the call to in_ifinit. 4787 */ 4788 in_ifscrub(ifp, ifatoia(ifa)); 4789 4790 if (myaddr != 0) 4791 new_sin.sin_addr.s_addr = htonl(myaddr); 4792 if (hisaddr != 0) { 4793 new_dst.sin_addr.s_addr = htonl(hisaddr); 4794 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4795 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4796 *dest = new_dst; /* fix dstaddr in place */ 4797 } 4798 } 4799 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4800 if(debug && error) 4801 { 4802 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit " 4803 " failed, error=%d\n", SPP_ARGS(ifp), error); 4804 } 4805 } 4806 } 4807 4808 /* 4809 * Clear IP addresses. Must be called at splnet. 4810 */ 4811 static void 4812 sppp_clear_ip_addrs(struct sppp *sp) 4813 { 4814 struct ifnet *ifp = &sp->pp_if; 4815 struct ifaddr *ifa; 4816 struct sockaddr_in *si; 4817 struct sockaddr_in *dest; 4818 4819 u_int32_t remote; 4820 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4821 remote = sp->ipcp.saved_hisaddr; 4822 else 4823 sppp_get_ip_addrs(sp, 0, &remote, 0); 4824 4825 /* 4826 * Pick the first AF_INET address from the list, 4827 * aliases don't make any sense on a p2p link anyway. 4828 */ 4829 4830 si = 0; 4831 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4832 { 4833 if (ifa->ifa_addr->sa_family == AF_INET) 4834 { 4835 si = (struct sockaddr_in *)ifa->ifa_addr; 4836 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4837 if (si) 4838 break; 4839 } 4840 } 4841 4842 if (ifa && si) 4843 { 4844 struct sockaddr_in new_sin = *si; 4845 4846 in_ifscrub(ifp, ifatoia(ifa)); 4847 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4848 new_sin.sin_addr.s_addr = 0; 4849 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4850 /* replace peer addr in place */ 4851 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4852 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4853 } 4854 } 4855 4856 #ifdef INET6 4857 /* 4858 * Get both IPv6 addresses. 4859 */ 4860 static void 4861 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4862 struct in6_addr *srcmask) 4863 { 4864 struct ifnet *ifp = &sp->pp_if; 4865 struct ifaddr *ifa; 4866 struct sockaddr_in6 *si, *sm; 4867 struct in6_addr ssrc, ddst; 4868 4869 sm = NULL; 4870 memset(&ssrc, 0, sizeof(ssrc)); 4871 memset(&ddst, 0, sizeof(ddst)); 4872 /* 4873 * Pick the first link-local AF_INET6 address from the list, 4874 * aliases don't make any sense on a p2p link anyway. 4875 */ 4876 si = 0; 4877 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4878 if (ifa->ifa_addr->sa_family == AF_INET6) { 4879 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4880 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4881 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4882 break; 4883 } 4884 if (ifa) { 4885 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4886 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4887 if (srcmask) { 4888 bcopy(&sm->sin6_addr, srcmask, 4889 sizeof(*srcmask)); 4890 } 4891 } 4892 4893 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4894 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4895 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4896 } 4897 4898 if (dst) 4899 bcopy(&ddst, dst, sizeof(*dst)); 4900 if (src) 4901 bcopy(&ssrc, src, sizeof(*src)); 4902 } 4903 4904 #ifdef IPV6CP_MYIFID_DYN 4905 /* 4906 * Generate random ifid. 4907 */ 4908 static void 4909 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4910 { 4911 /* TBD */ 4912 } 4913 4914 /* 4915 * Set my IPv6 address. Must be called at splnet. 4916 */ 4917 static void 4918 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4919 { 4920 STDDCL; 4921 struct ifaddr *ifa; 4922 struct sockaddr_in6 *sin6; 4923 4924 /* 4925 * Pick the first link-local AF_INET6 address from the list, 4926 * aliases don't make any sense on a p2p link anyway. 4927 */ 4928 4929 sin6 = NULL; 4930 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4931 { 4932 if (ifa->ifa_addr->sa_family == AF_INET6) 4933 { 4934 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4935 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4936 break; 4937 } 4938 } 4939 4940 if (ifa && sin6) 4941 { 4942 int error; 4943 struct sockaddr_in6 new_sin6 = *sin6; 4944 4945 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4946 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 4947 if (debug && error) 4948 { 4949 log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit " 4950 " failed, error=%d\n", SPP_ARGS(ifp), error); 4951 } 4952 } 4953 } 4954 #endif 4955 4956 /* 4957 * Suggest a candidate address to be used by peer. 4958 */ 4959 static void 4960 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4961 { 4962 struct in6_addr myaddr; 4963 struct timeval tv; 4964 4965 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4966 4967 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4968 microtime(&tv); 4969 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4970 myaddr.s6_addr[14] ^= 0xff; 4971 myaddr.s6_addr[15] ^= 0xff; 4972 } else { 4973 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 4974 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 4975 } 4976 if (suggest) 4977 bcopy(&myaddr, suggest, sizeof(myaddr)); 4978 } 4979 #endif /*INET6*/ 4980 4981 /* 4982 * Process ioctl requests specific to the PPP interface. 4983 * Permissions have already been checked. 4984 */ 4985 static int 4986 sppp_params(struct sppp *sp, int cmd, void *data) 4987 { 4988 switch (cmd) { 4989 case SPPPGETAUTHCFG: 4990 { 4991 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 4992 int error; 4993 size_t len; 4994 4995 cfg->myauthflags = sp->myauth.flags; 4996 cfg->hisauthflags = sp->hisauth.flags; 4997 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 4998 cfg->hisauth = 0; 4999 if (sp->hisauth.proto) 5000 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5001 cfg->myauth = 0; 5002 if (sp->myauth.proto) 5003 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5004 if (cfg->myname_length == 0) { 5005 if (sp->myauth.name != NULL) 5006 cfg->myname_length = sp->myauth.name_len + 1; 5007 } else { 5008 if (sp->myauth.name == NULL) { 5009 cfg->myname_length = 0; 5010 } else { 5011 len = sp->myauth.name_len + 1; 5012 if (cfg->myname_length < len) 5013 return (ENAMETOOLONG); 5014 error = copyout(sp->myauth.name, cfg->myname, len); 5015 if (error) return error; 5016 } 5017 } 5018 if (cfg->hisname_length == 0) { 5019 if(sp->hisauth.name != NULL) 5020 cfg->hisname_length = sp->hisauth.name_len + 1; 5021 } else { 5022 if (sp->hisauth.name == NULL) { 5023 cfg->hisname_length = 0; 5024 } else { 5025 len = sp->hisauth.name_len + 1; 5026 if (cfg->hisname_length < len) 5027 return (ENAMETOOLONG); 5028 error = copyout(sp->hisauth.name, cfg->hisname, len); 5029 if (error) return error; 5030 } 5031 } 5032 } 5033 break; 5034 case SPPPSETAUTHCFG: 5035 { 5036 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5037 int error; 5038 5039 if (sp->myauth.name) { 5040 free(sp->myauth.name, M_DEVBUF); 5041 sp->myauth.name = NULL; 5042 } 5043 if (sp->myauth.secret) { 5044 free(sp->myauth.secret, M_DEVBUF); 5045 sp->myauth.secret = NULL; 5046 } 5047 if (sp->hisauth.name) { 5048 free(sp->hisauth.name, M_DEVBUF); 5049 sp->hisauth.name = NULL; 5050 } 5051 if (sp->hisauth.secret) { 5052 free(sp->hisauth.secret, M_DEVBUF); 5053 sp->hisauth.secret = NULL; 5054 } 5055 5056 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5057 if (cfg->hisname_length >= MCLBYTES) 5058 return (ENAMETOOLONG); 5059 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5060 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5061 if (error) { 5062 free(sp->hisauth.name, M_DEVBUF); 5063 sp->hisauth.name = NULL; 5064 return error; 5065 } 5066 sp->hisauth.name_len = cfg->hisname_length - 1; 5067 sp->hisauth.name[sp->hisauth.name_len] = 0; 5068 } 5069 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5070 if (cfg->hissecret_length >= MCLBYTES) 5071 return (ENAMETOOLONG); 5072 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5073 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5074 if (error) { 5075 free(sp->hisauth.secret, M_DEVBUF); 5076 sp->hisauth.secret = NULL; 5077 return error; 5078 } 5079 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5080 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5081 } 5082 if (cfg->myname != NULL && cfg->myname_length > 0) { 5083 if (cfg->myname_length >= MCLBYTES) 5084 return (ENAMETOOLONG); 5085 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5086 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5087 if (error) { 5088 free(sp->myauth.name, M_DEVBUF); 5089 sp->myauth.name = NULL; 5090 return error; 5091 } 5092 sp->myauth.name_len = cfg->myname_length - 1; 5093 sp->myauth.name[sp->myauth.name_len] = 0; 5094 } 5095 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5096 if (cfg->mysecret_length >= MCLBYTES) 5097 return (ENAMETOOLONG); 5098 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5099 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5100 if (error) { 5101 free(sp->myauth.secret, M_DEVBUF); 5102 sp->myauth.secret = NULL; 5103 return error; 5104 } 5105 sp->myauth.secret_len = cfg->mysecret_length - 1; 5106 sp->myauth.secret[sp->myauth.secret_len] = 0; 5107 } 5108 sp->myauth.flags = cfg->myauthflags; 5109 if (cfg->myauth) 5110 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5111 sp->hisauth.flags = cfg->hisauthflags; 5112 if (cfg->hisauth) 5113 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5114 sp->pp_auth_failures = 0; 5115 if (sp->hisauth.proto != 0) 5116 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5117 else 5118 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5119 } 5120 break; 5121 case SPPPGETLCPCFG: 5122 { 5123 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5124 lcp->lcp_timeout = sp->lcp.timeout; 5125 } 5126 break; 5127 case SPPPSETLCPCFG: 5128 { 5129 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5130 sp->lcp.timeout = lcp->lcp_timeout; 5131 } 5132 break; 5133 case SPPPGETSTATUS: 5134 { 5135 struct spppstatus *status = (struct spppstatus *)data; 5136 status->phase = sp->pp_phase; 5137 } 5138 break; 5139 case SPPPGETIDLETO: 5140 { 5141 struct spppidletimeout *to = (struct spppidletimeout *)data; 5142 to->idle_seconds = sp->pp_idle_timeout; 5143 } 5144 break; 5145 case SPPPSETIDLETO: 5146 { 5147 struct spppidletimeout *to = (struct spppidletimeout *)data; 5148 sp->pp_idle_timeout = to->idle_seconds; 5149 } 5150 break; 5151 case SPPPSETAUTHFAILURE: 5152 { 5153 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5154 sp->pp_max_auth_fail = afsettings->max_failures; 5155 sp->pp_auth_failures = 0; 5156 } 5157 break; 5158 case SPPPGETAUTHFAILURES: 5159 { 5160 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5161 stats->auth_failures = sp->pp_auth_failures; 5162 stats->max_failures = sp->pp_max_auth_fail; 5163 } 5164 break; 5165 case SPPPSETDNSOPTS: 5166 { 5167 struct spppdnssettings *req = (struct spppdnssettings *)data; 5168 sp->query_dns = req->query_dns & 3; 5169 } 5170 break; 5171 case SPPPGETDNSOPTS: 5172 { 5173 struct spppdnssettings *req = (struct spppdnssettings *)data; 5174 req->query_dns = sp->query_dns; 5175 } 5176 break; 5177 case SPPPGETDNSADDRS: 5178 { 5179 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5180 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5181 } 5182 break; 5183 default: 5184 return (EINVAL); 5185 } 5186 5187 return (0); 5188 } 5189 5190 static void 5191 sppp_phase_network(struct sppp *sp) 5192 { 5193 STDDCL; 5194 int i; 5195 u_int32_t mask; 5196 5197 sp->pp_phase = SPPP_PHASE_NETWORK; 5198 5199 if(debug) 5200 { 5201 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 5202 sppp_phase_name(sp->pp_phase)); 5203 } 5204 5205 /* Notify NCPs now. */ 5206 for (i = 0; i < IDX_COUNT; i++) 5207 if ((cps[i])->flags & CP_NCP) 5208 (cps[i])->Open(sp); 5209 5210 /* Send Up events to all NCPs. */ 5211 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5212 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5213 (cps[i])->Up(sp); 5214 5215 /* if no NCP is starting, all this was in vain, close down */ 5216 sppp_lcp_check_and_close(sp); 5217 } 5218 5219 5220 static const char * 5221 sppp_cp_type_name(u_char type) 5222 { 5223 static char buf[12]; 5224 switch (type) { 5225 case CONF_REQ: return "conf-req"; 5226 case CONF_ACK: return "conf-ack"; 5227 case CONF_NAK: return "conf-nak"; 5228 case CONF_REJ: return "conf-rej"; 5229 case TERM_REQ: return "term-req"; 5230 case TERM_ACK: return "term-ack"; 5231 case CODE_REJ: return "code-rej"; 5232 case PROTO_REJ: return "proto-rej"; 5233 case ECHO_REQ: return "echo-req"; 5234 case ECHO_REPLY: return "echo-reply"; 5235 case DISC_REQ: return "discard-req"; 5236 } 5237 sprintf (buf, "0x%x", type); 5238 return buf; 5239 } 5240 5241 static const char * 5242 sppp_auth_type_name(u_short proto, u_char type) 5243 { 5244 static char buf[12]; 5245 switch (proto) { 5246 case PPP_CHAP: 5247 switch (type) { 5248 case CHAP_CHALLENGE: return "challenge"; 5249 case CHAP_RESPONSE: return "response"; 5250 case CHAP_SUCCESS: return "success"; 5251 case CHAP_FAILURE: return "failure"; 5252 } 5253 case PPP_PAP: 5254 switch (type) { 5255 case PAP_REQ: return "req"; 5256 case PAP_ACK: return "ack"; 5257 case PAP_NAK: return "nak"; 5258 } 5259 } 5260 sprintf (buf, "0x%x", type); 5261 return buf; 5262 } 5263 5264 static const char * 5265 sppp_lcp_opt_name(u_char opt) 5266 { 5267 static char buf[12]; 5268 switch (opt) { 5269 case LCP_OPT_MRU: return "mru"; 5270 case LCP_OPT_ASYNC_MAP: return "async-map"; 5271 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5272 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5273 case LCP_OPT_MAGIC: return "magic"; 5274 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5275 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5276 } 5277 sprintf (buf, "0x%x", opt); 5278 return buf; 5279 } 5280 5281 static const char * 5282 sppp_ipcp_opt_name(u_char opt) 5283 { 5284 static char buf[12]; 5285 switch (opt) { 5286 case IPCP_OPT_ADDRESSES: return "addresses"; 5287 case IPCP_OPT_COMPRESSION: return "compression"; 5288 case IPCP_OPT_ADDRESS: return "address"; 5289 } 5290 sprintf (buf, "0x%x", opt); 5291 return buf; 5292 } 5293 5294 #ifdef INET6 5295 static const char * 5296 sppp_ipv6cp_opt_name(u_char opt) 5297 { 5298 static char buf[12]; 5299 switch (opt) { 5300 case IPV6CP_OPT_IFID: return "ifid"; 5301 case IPV6CP_OPT_COMPRESSION: return "compression"; 5302 } 5303 sprintf (buf, "0x%x", opt); 5304 return buf; 5305 } 5306 #endif 5307 5308 static const char * 5309 sppp_state_name(int state) 5310 { 5311 switch (state) { 5312 case STATE_INITIAL: return "initial"; 5313 case STATE_STARTING: return "starting"; 5314 case STATE_CLOSED: return "closed"; 5315 case STATE_STOPPED: return "stopped"; 5316 case STATE_CLOSING: return "closing"; 5317 case STATE_STOPPING: return "stopping"; 5318 case STATE_REQ_SENT: return "req-sent"; 5319 case STATE_ACK_RCVD: return "ack-rcvd"; 5320 case STATE_ACK_SENT: return "ack-sent"; 5321 case STATE_OPENED: return "opened"; 5322 } 5323 return "illegal"; 5324 } 5325 5326 static const char * 5327 sppp_phase_name(int phase) 5328 { 5329 switch (phase) { 5330 case SPPP_PHASE_DEAD: return "dead"; 5331 case SPPP_PHASE_ESTABLISH: return "establish"; 5332 case SPPP_PHASE_TERMINATE: return "terminate"; 5333 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5334 case SPPP_PHASE_NETWORK: return "network"; 5335 } 5336 return "illegal"; 5337 } 5338 5339 static const char * 5340 sppp_proto_name(u_short proto) 5341 { 5342 static char buf[12]; 5343 switch (proto) { 5344 case PPP_LCP: return "lcp"; 5345 case PPP_IPCP: return "ipcp"; 5346 case PPP_PAP: return "pap"; 5347 case PPP_CHAP: return "chap"; 5348 case PPP_IPV6CP: return "ipv6cp"; 5349 } 5350 sprintf(buf, "0x%x", (unsigned)proto); 5351 return buf; 5352 } 5353 5354 static void 5355 sppp_print_bytes(const u_char *p, u_short len) 5356 { 5357 addlog(" %02x", *p++); 5358 while (--len > 0) 5359 addlog("-%02x", *p++); 5360 } 5361 5362 static void 5363 sppp_print_string(const char *p, u_short len) 5364 { 5365 u_char c; 5366 5367 while (len-- > 0) { 5368 c = *p++; 5369 /* 5370 * Print only ASCII chars directly. RFC 1994 recommends 5371 * using only them, but we don't rely on it. */ 5372 if (c < ' ' || c > '~') 5373 addlog("\\x%x", c); 5374 else 5375 addlog("%c", c); 5376 } 5377 } 5378 5379 static const char * 5380 sppp_dotted_quad(u_int32_t addr) 5381 { 5382 static char s[16]; 5383 sprintf(s, "%d.%d.%d.%d", 5384 (int)((addr >> 24) & 0xff), 5385 (int)((addr >> 16) & 0xff), 5386 (int)((addr >> 8) & 0xff), 5387 (int)(addr & 0xff)); 5388 return s; 5389 } 5390 5391 /* a dummy, used to drop uninteresting events */ 5392 static void 5393 sppp_null(struct sppp *unused) 5394 { 5395 /* do just nothing */ 5396 } 5397 /* 5398 * This file is large. Tell emacs to highlight it nevertheless. 5399 * 5400 * Local Variables: 5401 * hilit-auto-highlight-maxout: 120000 5402 * End: 5403 */ 5404
Indexes created Thu Oct 16 14:10:15 GMT 2025