if_spppsubr.c revision 1.75.2.1.4.1
1 /* $NetBSD: if_spppsubr.c,v 1.75.2.1.4.1 2006/08/23 20:19:17 tron Exp $ */ 2 3 /* 4 * Synchronous PPP/Cisco link level subroutines. 5 * Keepalive protocol implemented in both Cisco and PPP modes. 6 * 7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 8 * Author: Serge Vakulenko, <vak (at) cronyx.ru> 9 * 10 * Heavily revamped to conform to RFC 1661. 11 * Copyright (C) 1997, Joerg Wunsch. 12 * 13 * RFC2472 IPv6CP support. 14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun (at) iijlab.net>. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions are met: 18 * 1. Redistributions of source code must retain the above copyright notice, 19 * this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright notice, 21 * this list of conditions and the following disclaimer in the documentation 22 * and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * POSSIBILITY OF SUCH DAMAGE. 35 * 36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 37 * 38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp 39 * 40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp 41 */ 42 43 #include <sys/cdefs.h> 44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.75.2.1.4.1 2006/08/23 20:19:17 tron Exp $"); 45 46 #include "opt_inet.h" 47 #include "opt_ipx.h" 48 #include "opt_iso.h" 49 #include "opt_ns.h" 50 51 #include <sys/param.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/kernel.h> 55 #include <sys/sockio.h> 56 #include <sys/socket.h> 57 #include <sys/syslog.h> 58 #include <sys/malloc.h> 59 #include <sys/mbuf.h> 60 #include <sys/callout.h> 61 #include <sys/md5.h> 62 #include <sys/inttypes.h> 63 64 #include <net/if.h> 65 #include <net/netisr.h> 66 #include <net/if_types.h> 67 #include <net/route.h> 68 #include <net/ppp_defs.h> 69 70 #include <machine/stdarg.h> 71 72 #include <netinet/in.h> 73 #include <netinet/in_systm.h> 74 #include <netinet/in_var.h> 75 #ifdef INET 76 #include <netinet/ip.h> 77 #include <netinet/tcp.h> 78 #endif 79 #include <net/ethertypes.h> 80 81 #ifdef IPX 82 #include <netipx/ipx.h> 83 #include <netipx/ipx_if.h> 84 #endif 85 86 #ifdef NS 87 #include <netns/ns.h> 88 #include <netns/ns_if.h> 89 #endif 90 91 #ifdef ISO 92 #include <netiso/argo_debug.h> 93 #include <netiso/iso.h> 94 #include <netiso/iso_var.h> 95 #include <netiso/iso_snpac.h> 96 #endif 97 98 #include <net/if_sppp.h> 99 #include <net/if_spppvar.h> 100 101 #define LCP_KEEPALIVE_INTERVAL 10 /* seconds between checks */ 102 #define LOOPALIVECNT 3 /* loopback detection tries */ 103 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */ 104 #define DEFAULT_NORECV_TIME 15 /* before we get worried */ 105 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */ 106 107 /* 108 * Interface flags that can be set in an ifconfig command. 109 * 110 * Setting link0 will make the link passive, i.e. it will be marked 111 * as being administrative openable, but won't be opened to begin 112 * with. Incoming calls will be answered, or subsequent calls with 113 * -link1 will cause the administrative open of the LCP layer. 114 * 115 * Setting link1 will cause the link to auto-dial only as packets 116 * arrive to be sent. 117 * 118 * Setting IFF_DEBUG will syslog the option negotiation and state 119 * transitions at level kern.debug. Note: all logs consistently look 120 * like 121 * 122 * <if-name><unit>: <proto-name> <additional info...> 123 * 124 * with <if-name><unit> being something like "bppp0", and <proto-name> 125 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 126 */ 127 128 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 129 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 130 131 #define CONF_REQ 1 /* PPP configure request */ 132 #define CONF_ACK 2 /* PPP configure acknowledge */ 133 #define CONF_NAK 3 /* PPP configure negative ack */ 134 #define CONF_REJ 4 /* PPP configure reject */ 135 #define TERM_REQ 5 /* PPP terminate request */ 136 #define TERM_ACK 6 /* PPP terminate acknowledge */ 137 #define CODE_REJ 7 /* PPP code reject */ 138 #define PROTO_REJ 8 /* PPP protocol reject */ 139 #define ECHO_REQ 9 /* PPP echo request */ 140 #define ECHO_REPLY 10 /* PPP echo reply */ 141 #define DISC_REQ 11 /* PPP discard request */ 142 143 #define LCP_OPT_MRU 1 /* maximum receive unit */ 144 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 145 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 146 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 147 #define LCP_OPT_MAGIC 5 /* magic number */ 148 #define LCP_OPT_RESERVED 6 /* reserved */ 149 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 150 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 151 152 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 153 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */ 154 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 155 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */ 156 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */ 157 158 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 159 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 160 161 #define PAP_REQ 1 /* PAP name/password request */ 162 #define PAP_ACK 2 /* PAP acknowledge */ 163 #define PAP_NAK 3 /* PAP fail */ 164 165 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 166 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 167 #define CHAP_SUCCESS 3 /* CHAP response ok */ 168 #define CHAP_FAILURE 4 /* CHAP response failed */ 169 170 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 171 172 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 173 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 174 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 175 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 176 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 177 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 178 179 /* states are named and numbered according to RFC 1661 */ 180 #define STATE_INITIAL 0 181 #define STATE_STARTING 1 182 #define STATE_CLOSED 2 183 #define STATE_STOPPED 3 184 #define STATE_CLOSING 4 185 #define STATE_STOPPING 5 186 #define STATE_REQ_SENT 6 187 #define STATE_ACK_RCVD 7 188 #define STATE_ACK_SENT 8 189 #define STATE_OPENED 9 190 191 struct ppp_header { 192 u_int8_t address; 193 u_int8_t control; 194 u_int16_t protocol; 195 } __attribute__((__packed__)); 196 #define PPP_HEADER_LEN sizeof (struct ppp_header) 197 198 struct lcp_header { 199 u_int8_t type; 200 u_int8_t ident; 201 u_int16_t len; 202 } __attribute__((__packed__)); 203 #define LCP_HEADER_LEN sizeof (struct lcp_header) 204 205 struct cisco_packet { 206 u_int32_t type; 207 u_int32_t par1; 208 u_int32_t par2; 209 u_int16_t rel; 210 u_int16_t time0; 211 u_int16_t time1; 212 } __attribute__((__packed__)); 213 #define CISCO_PACKET_LEN 18 214 215 /* 216 * We follow the spelling and capitalization of RFC 1661 here, to make 217 * it easier comparing with the standard. Please refer to this RFC in 218 * case you can't make sense out of these abbreviation; it will also 219 * explain the semantics related to the various events and actions. 220 */ 221 struct cp { 222 u_short proto; /* PPP control protocol number */ 223 u_char protoidx; /* index into state table in struct sppp */ 224 u_char flags; 225 #define CP_LCP 0x01 /* this is the LCP */ 226 #define CP_AUTH 0x02 /* this is an authentication protocol */ 227 #define CP_NCP 0x04 /* this is a NCP */ 228 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 229 const char *name; /* name of this control protocol */ 230 /* event handlers */ 231 void (*Up)(struct sppp *sp); 232 void (*Down)(struct sppp *sp); 233 void (*Open)(struct sppp *sp); 234 void (*Close)(struct sppp *sp); 235 void (*TO)(void *sp); 236 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 237 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 238 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 239 /* actions */ 240 void (*tlu)(struct sppp *sp); 241 void (*tld)(struct sppp *sp); 242 void (*tls)(struct sppp *sp); 243 void (*tlf)(struct sppp *sp); 244 void (*scr)(struct sppp *sp); 245 }; 246 247 static struct sppp *spppq; 248 static struct callout keepalive_ch; 249 250 #ifdef INET 251 /* 252 * The following disgusting hack gets around the problem that IP TOS 253 * can't be set yet. We want to put "interactive" traffic on a high 254 * priority queue. To decide if traffic is interactive, we check that 255 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 256 * 257 * XXX is this really still necessary? - joerg - 258 */ 259 static u_short interactive_ports[8] = { 260 0, 513, 0, 0, 261 0, 21, 0, 23, 262 }; 263 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 264 #endif 265 266 /* almost every function needs these */ 267 #define STDDCL \ 268 struct ifnet *ifp = &sp->pp_if; \ 269 int debug = ifp->if_flags & IFF_DEBUG 270 271 static int sppp_output(struct ifnet *ifp, struct mbuf *m, 272 struct sockaddr *dst, struct rtentry *rt); 273 274 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2); 275 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 276 277 static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 278 struct mbuf *m); 279 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 280 u_char ident, u_short len, void *data); 281 /* static void sppp_cp_timeout(void *arg); */ 282 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 283 int newstate); 284 static void sppp_auth_send(const struct cp *cp, 285 struct sppp *sp, unsigned int type, unsigned int id, 286 ...); 287 288 static void sppp_up_event(const struct cp *cp, struct sppp *sp); 289 static void sppp_down_event(const struct cp *cp, struct sppp *sp); 290 static void sppp_open_event(const struct cp *cp, struct sppp *sp); 291 static void sppp_close_event(const struct cp *cp, struct sppp *sp); 292 static void sppp_to_event(const struct cp *cp, struct sppp *sp); 293 294 static void sppp_null(struct sppp *sp); 295 296 static void sppp_lcp_init(struct sppp *sp); 297 static void sppp_lcp_up(struct sppp *sp); 298 static void sppp_lcp_down(struct sppp *sp); 299 static void sppp_lcp_open(struct sppp *sp); 300 static void sppp_lcp_close(struct sppp *sp); 301 static void sppp_lcp_TO(void *sp); 302 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 303 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 304 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 305 static void sppp_lcp_tlu(struct sppp *sp); 306 static void sppp_lcp_tld(struct sppp *sp); 307 static void sppp_lcp_tls(struct sppp *sp); 308 static void sppp_lcp_tlf(struct sppp *sp); 309 static void sppp_lcp_scr(struct sppp *sp); 310 static void sppp_lcp_check_and_close(struct sppp *sp); 311 static int sppp_ncp_check(struct sppp *sp); 312 313 static void sppp_ipcp_init(struct sppp *sp); 314 static void sppp_ipcp_up(struct sppp *sp); 315 static void sppp_ipcp_down(struct sppp *sp); 316 static void sppp_ipcp_open(struct sppp *sp); 317 static void sppp_ipcp_close(struct sppp *sp); 318 static void sppp_ipcp_TO(void *sp); 319 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 320 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 321 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 322 static void sppp_ipcp_tlu(struct sppp *sp); 323 static void sppp_ipcp_tld(struct sppp *sp); 324 static void sppp_ipcp_tls(struct sppp *sp); 325 static void sppp_ipcp_tlf(struct sppp *sp); 326 static void sppp_ipcp_scr(struct sppp *sp); 327 328 static void sppp_ipv6cp_init(struct sppp *sp); 329 static void sppp_ipv6cp_up(struct sppp *sp); 330 static void sppp_ipv6cp_down(struct sppp *sp); 331 static void sppp_ipv6cp_open(struct sppp *sp); 332 static void sppp_ipv6cp_close(struct sppp *sp); 333 static void sppp_ipv6cp_TO(void *sp); 334 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 335 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 336 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 337 static void sppp_ipv6cp_tlu(struct sppp *sp); 338 static void sppp_ipv6cp_tld(struct sppp *sp); 339 static void sppp_ipv6cp_tls(struct sppp *sp); 340 static void sppp_ipv6cp_tlf(struct sppp *sp); 341 static void sppp_ipv6cp_scr(struct sppp *sp); 342 343 static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 344 static void sppp_pap_init(struct sppp *sp); 345 static void sppp_pap_open(struct sppp *sp); 346 static void sppp_pap_close(struct sppp *sp); 347 static void sppp_pap_TO(void *sp); 348 static void sppp_pap_my_TO(void *sp); 349 static void sppp_pap_tlu(struct sppp *sp); 350 static void sppp_pap_tld(struct sppp *sp); 351 static void sppp_pap_scr(struct sppp *sp); 352 353 static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 354 static void sppp_chap_init(struct sppp *sp); 355 static void sppp_chap_open(struct sppp *sp); 356 static void sppp_chap_close(struct sppp *sp); 357 static void sppp_chap_TO(void *sp); 358 static void sppp_chap_tlu(struct sppp *sp); 359 static void sppp_chap_tld(struct sppp *sp); 360 static void sppp_chap_scr(struct sppp *sp); 361 362 static const char *sppp_auth_type_name(u_short proto, u_char type); 363 static const char *sppp_cp_type_name(u_char type); 364 static const char *sppp_dotted_quad(u_int32_t addr); 365 static const char *sppp_ipcp_opt_name(u_char opt); 366 #ifdef INET6 367 static const char *sppp_ipv6cp_opt_name(u_char opt); 368 #endif 369 static const char *sppp_lcp_opt_name(u_char opt); 370 static const char *sppp_phase_name(int phase); 371 static const char *sppp_proto_name(u_short proto); 372 static const char *sppp_state_name(int state); 373 static int sppp_params(struct sppp *sp, int cmd, void *data); 374 static void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 375 u_int32_t *srcmask); 376 static void sppp_keepalive(void *dummy); 377 static void sppp_phase_network(struct sppp *sp); 378 static void sppp_print_bytes(const u_char *p, u_short len); 379 static void sppp_print_string(const char *p, u_short len); 380 static void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr); 381 static void sppp_clear_ip_addrs(struct sppp *sp); 382 #ifdef INET6 383 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 384 struct in6_addr *dst, struct in6_addr *srcmask); 385 #ifdef IPV6CP_MYIFID_DYN 386 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 387 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 388 #endif 389 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 390 #endif 391 392 /* our control protocol descriptors */ 393 static const struct cp lcp = { 394 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 395 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 396 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 397 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 398 sppp_lcp_scr 399 }; 400 401 static const struct cp ipcp = { 402 PPP_IPCP, IDX_IPCP, 403 #ifdef INET 404 CP_NCP, /*don't run IPCP if there's no IPv4 support*/ 405 #else 406 0, 407 #endif 408 "ipcp", 409 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 410 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 411 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 412 sppp_ipcp_scr 413 }; 414 415 static const struct cp ipv6cp = { 416 PPP_IPV6CP, IDX_IPV6CP, 417 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 418 CP_NCP, 419 #else 420 0, 421 #endif 422 "ipv6cp", 423 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 424 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 425 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 426 sppp_ipv6cp_scr 427 }; 428 429 static const struct cp pap = { 430 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 431 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 432 sppp_pap_TO, 0, 0, 0, 433 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 434 sppp_pap_scr 435 }; 436 437 static const struct cp chap = { 438 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 439 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 440 sppp_chap_TO, 0, 0, 0, 441 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 442 sppp_chap_scr 443 }; 444 445 static const struct cp *cps[IDX_COUNT] = { 446 &lcp, /* IDX_LCP */ 447 &ipcp, /* IDX_IPCP */ 448 &ipv6cp, /* IDX_IPV6CP */ 449 &pap, /* IDX_PAP */ 450 &chap, /* IDX_CHAP */ 451 }; 452 453 454 /* 455 * Exported functions, comprising our interface to the lower layer. 456 */ 457 458 /* 459 * Process the received packet. 460 */ 461 void 462 sppp_input(struct ifnet *ifp, struct mbuf *m) 463 { 464 struct ppp_header *h = NULL; 465 struct ifqueue *inq = 0; 466 u_int16_t protocol; 467 int s; 468 struct sppp *sp = (struct sppp *)ifp; 469 int debug = ifp->if_flags & IFF_DEBUG; 470 471 if (ifp->if_flags & IFF_UP) { 472 /* Count received bytes, add hardware framing */ 473 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 474 /* Note time of last receive */ 475 sp->pp_last_receive = mono_time.tv_sec; 476 } 477 478 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 479 /* Too small packet, drop it. */ 480 if (debug) 481 log(LOG_DEBUG, 482 "%s: input packet is too small, %d bytes\n", 483 ifp->if_xname, m->m_pkthdr.len); 484 drop: 485 ++ifp->if_ierrors; 486 ++ifp->if_iqdrops; 487 m_freem(m); 488 return; 489 } 490 491 if (sp->pp_flags & PP_NOFRAMING) { 492 memcpy(&protocol, mtod(m, void *), 2); 493 protocol = ntohs(protocol); 494 m_adj(m, 2); 495 } else { 496 497 /* Get PPP header. */ 498 h = mtod(m, struct ppp_header *); 499 m_adj(m, PPP_HEADER_LEN); 500 501 switch (h->address) { 502 case PPP_ALLSTATIONS: 503 if (h->control != PPP_UI) 504 goto invalid; 505 if (sp->pp_flags & PP_CISCO) { 506 if (debug) 507 log(LOG_DEBUG, 508 "%s: PPP packet in Cisco mode " 509 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 510 ifp->if_xname, 511 h->address, h->control, ntohs(h->protocol)); 512 goto drop; 513 } 514 break; 515 case CISCO_MULTICAST: 516 case CISCO_UNICAST: 517 /* Don't check the control field here (RFC 1547). */ 518 if (! (sp->pp_flags & PP_CISCO)) { 519 if (debug) 520 log(LOG_DEBUG, 521 "%s: Cisco packet in PPP mode " 522 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 523 ifp->if_xname, 524 h->address, h->control, ntohs(h->protocol)); 525 goto drop; 526 } 527 switch (ntohs(h->protocol)) { 528 default: 529 ++ifp->if_noproto; 530 goto invalid; 531 case CISCO_KEEPALIVE: 532 sppp_cisco_input((struct sppp *) ifp, m); 533 m_freem(m); 534 return; 535 #ifdef INET 536 case ETHERTYPE_IP: 537 schednetisr(NETISR_IP); 538 inq = &ipintrq; 539 break; 540 #endif 541 #ifdef INET6 542 case ETHERTYPE_IPV6: 543 schednetisr(NETISR_IPV6); 544 inq = &ip6intrq; 545 break; 546 #endif 547 #ifdef IPX 548 case ETHERTYPE_IPX: 549 schednetisr(NETISR_IPX); 550 inq = &ipxintrq; 551 break; 552 #endif 553 #ifdef NS 554 case ETHERTYPE_NS: 555 schednetisr(NETISR_NS); 556 inq = &nsintrq; 557 break; 558 #endif 559 } 560 goto queue_pkt; 561 default: /* Invalid PPP packet. */ 562 invalid: 563 if (debug) 564 log(LOG_DEBUG, 565 "%s: invalid input packet " 566 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 567 ifp->if_xname, 568 h->address, h->control, ntohs(h->protocol)); 569 goto drop; 570 } 571 protocol = ntohs(h->protocol); 572 } 573 574 switch (protocol) { 575 default: 576 if (sp->state[IDX_LCP] == STATE_OPENED) { 577 u_int16_t prot = htons(protocol); 578 sppp_cp_send(sp, PPP_LCP, PROTO_REJ, 579 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 580 &prot); 581 } 582 if (debug) 583 log(LOG_DEBUG, 584 "%s: invalid input protocol " 585 "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol)); 586 ++ifp->if_noproto; 587 goto drop; 588 case PPP_LCP: 589 sppp_cp_input(&lcp, sp, m); 590 m_freem(m); 591 return; 592 case PPP_PAP: 593 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 594 sppp_pap_input(sp, m); 595 m_freem(m); 596 return; 597 case PPP_CHAP: 598 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) 599 sppp_chap_input(sp, m); 600 m_freem(m); 601 return; 602 #ifdef INET 603 case PPP_IPCP: 604 if (sp->pp_phase == SPPP_PHASE_NETWORK) 605 sppp_cp_input(&ipcp, sp, m); 606 m_freem(m); 607 return; 608 case PPP_IP: 609 if (sp->state[IDX_IPCP] == STATE_OPENED) { 610 schednetisr(NETISR_IP); 611 inq = &ipintrq; 612 sp->pp_last_activity = mono_time.tv_sec; 613 } 614 break; 615 #endif 616 #ifdef INET6 617 case PPP_IPV6CP: 618 if (sp->pp_phase == SPPP_PHASE_NETWORK) 619 sppp_cp_input(&ipv6cp, sp, m); 620 m_freem(m); 621 return; 622 623 case PPP_IPV6: 624 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 625 schednetisr(NETISR_IPV6); 626 inq = &ip6intrq; 627 sp->pp_last_activity = mono_time.tv_sec; 628 } 629 break; 630 #endif 631 #ifdef IPX 632 case PPP_IPX: 633 /* IPX IPXCP not implemented yet */ 634 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 635 schednetisr(NETISR_IPX); 636 inq = &ipxintrq; 637 } 638 break; 639 #endif 640 #ifdef NS 641 case PPP_XNS: 642 /* XNS IDPCP not implemented yet */ 643 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 644 schednetisr(NETISR_NS); 645 inq = &nsintrq; 646 } 647 break; 648 #endif 649 #ifdef ISO 650 case PPP_ISO: 651 /* OSI NLCP not implemented yet */ 652 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 653 schednetisr(NETISR_ISO); 654 inq = &clnlintrq; 655 } 656 break; 657 #endif 658 } 659 660 queue_pkt: 661 if (! (ifp->if_flags & IFF_UP) || ! inq) 662 goto drop; 663 664 /* Check queue. */ 665 s = splnet(); 666 if (IF_QFULL(inq)) { 667 /* Queue overflow. */ 668 IF_DROP(inq); 669 splx(s); 670 if (debug) 671 log(LOG_DEBUG, "%s: protocol queue overflow\n", 672 ifp->if_xname); 673 goto drop; 674 } 675 IF_ENQUEUE(inq, m); 676 splx(s); 677 } 678 679 /* 680 * Enqueue transmit packet. 681 */ 682 static int 683 sppp_output(struct ifnet *ifp, struct mbuf *m, 684 struct sockaddr *dst, struct rtentry *rt) 685 { 686 struct sppp *sp = (struct sppp *) ifp; 687 struct ppp_header *h = NULL; 688 struct ifqueue *ifq = NULL; /* XXX */ 689 int s, len, rv = 0; 690 u_int16_t protocol; 691 ALTQ_DECL(struct altq_pktattr pktattr;) 692 693 s = splnet(); 694 695 sp->pp_last_activity = mono_time.tv_sec; 696 697 if ((ifp->if_flags & IFF_UP) == 0 || 698 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 699 m_freem(m); 700 splx(s); 701 return (ENETDOWN); 702 } 703 704 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 705 /* 706 * Interface is not yet running, but auto-dial. Need 707 * to start LCP for it. 708 */ 709 ifp->if_flags |= IFF_RUNNING; 710 splx(s); 711 lcp.Open(sp); 712 s = splnet(); 713 } 714 715 /* 716 * If the queueing discipline needs packet classification, 717 * do it before prepending link headers. 718 */ 719 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family, &pktattr); 720 721 #ifdef INET 722 if (dst->sa_family == AF_INET) { 723 struct ip *ip = NULL; 724 struct tcphdr *th = NULL; 725 726 if (m->m_len >= sizeof(struct ip)) { 727 ip = mtod(m, struct ip *); 728 if (ip->ip_p == IPPROTO_TCP && 729 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 730 sizeof(struct tcphdr)) { 731 th = (struct tcphdr *) 732 ((caddr_t)ip + (ip->ip_hl << 2)); 733 } 734 } else 735 ip = NULL; 736 737 /* 738 * When using dynamic local IP address assignment by using 739 * 0.0.0.0 as a local address, the first TCP session will 740 * not connect because the local TCP checksum is computed 741 * using 0.0.0.0 which will later become our real IP address 742 * so the TCP checksum computed at the remote end will 743 * become invalid. So we 744 * - don't let packets with src ip addr 0 thru 745 * - we flag TCP packets with src ip 0 as an error 746 */ 747 if (ip && ip->ip_src.s_addr == INADDR_ANY) { 748 u_int8_t proto = ip->ip_p; 749 750 m_freem(m); 751 splx(s); 752 if (proto == IPPROTO_TCP) 753 return (EADDRNOTAVAIL); 754 else 755 return (0); 756 } 757 758 /* 759 * Put low delay, telnet, rlogin and ftp control packets 760 * in front of the queue. 761 */ 762 763 if (!IF_QFULL(&sp->pp_fastq) && 764 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 765 (th && (INTERACTIVE(ntohs(th->th_sport)) || 766 INTERACTIVE(ntohs(th->th_dport)))))) 767 ifq = &sp->pp_fastq; 768 } 769 #endif 770 771 #ifdef INET6 772 if (dst->sa_family == AF_INET6) { 773 /* XXX do something tricky here? */ 774 } 775 #endif 776 777 if ((sp->pp_flags & PP_NOFRAMING) == 0) { 778 /* 779 * Prepend general data packet PPP header. For now, IP only. 780 */ 781 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT); 782 if (! m) { 783 if (ifp->if_flags & IFF_DEBUG) 784 log(LOG_DEBUG, "%s: no memory for transmit header\n", 785 ifp->if_xname); 786 ++ifp->if_oerrors; 787 splx(s); 788 return (ENOBUFS); 789 } 790 /* 791 * May want to check size of packet 792 * (albeit due to the implementation it's always enough) 793 */ 794 h = mtod(m, struct ppp_header *); 795 if (sp->pp_flags & PP_CISCO) { 796 h->address = CISCO_UNICAST; /* unicast address */ 797 h->control = 0; 798 } else { 799 h->address = PPP_ALLSTATIONS; /* broadcast address */ 800 h->control = PPP_UI; /* Unnumbered Info */ 801 } 802 } 803 804 switch (dst->sa_family) { 805 #ifdef INET 806 case AF_INET: /* Internet Protocol */ 807 if (sp->pp_flags & PP_CISCO) 808 protocol = htons(ETHERTYPE_IP); 809 else { 810 /* 811 * Don't choke with an ENETDOWN early. It's 812 * possible that we just started dialing out, 813 * so don't drop the packet immediately. If 814 * we notice that we run out of buffer space 815 * below, we will however remember that we are 816 * not ready to carry IP packets, and return 817 * ENETDOWN, as opposed to ENOBUFS. 818 */ 819 protocol = htons(PPP_IP); 820 if (sp->state[IDX_IPCP] != STATE_OPENED) 821 rv = ENETDOWN; 822 } 823 break; 824 #endif 825 #ifdef INET6 826 case AF_INET6: /* Internet Protocol version 6 */ 827 if (sp->pp_flags & PP_CISCO) 828 protocol = htons(ETHERTYPE_IPV6); 829 else { 830 /* 831 * Don't choke with an ENETDOWN early. It's 832 * possible that we just started dialing out, 833 * so don't drop the packet immediately. If 834 * we notice that we run out of buffer space 835 * below, we will however remember that we are 836 * not ready to carry IP packets, and return 837 * ENETDOWN, as opposed to ENOBUFS. 838 */ 839 protocol = htons(PPP_IPV6); 840 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 841 rv = ENETDOWN; 842 } 843 break; 844 #endif 845 #ifdef NS 846 case AF_NS: /* Xerox NS Protocol */ 847 protocol = htons((sp->pp_flags & PP_CISCO) ? 848 ETHERTYPE_NS : PPP_XNS); 849 break; 850 #endif 851 #ifdef IPX 852 case AF_IPX: /* Novell IPX Protocol */ 853 protocol = htons((sp->pp_flags & PP_CISCO) ? 854 ETHERTYPE_IPX : PPP_IPX); 855 break; 856 #endif 857 #ifdef ISO 858 case AF_ISO: /* ISO OSI Protocol */ 859 if (sp->pp_flags & PP_CISCO) 860 goto nosupport; 861 protocol = htons(PPP_ISO); 862 break; 863 nosupport: 864 #endif 865 default: 866 m_freem(m); 867 ++ifp->if_oerrors; 868 splx(s); 869 return (EAFNOSUPPORT); 870 } 871 872 if (sp->pp_flags & PP_NOFRAMING) { 873 M_PREPEND(m, 2, M_DONTWAIT); 874 if (m == NULL) { 875 if (ifp->if_flags & IFF_DEBUG) 876 log(LOG_DEBUG, "%s: no memory for transmit header\n", 877 ifp->if_xname); 878 ++ifp->if_oerrors; 879 splx(s); 880 return (ENOBUFS); 881 } 882 *mtod(m, u_int16_t *) = protocol; 883 } else { 884 h->protocol = protocol; 885 } 886 887 /* 888 * Queue message on interface, and start output if interface 889 * not yet active. 890 */ 891 len = m->m_pkthdr.len; 892 if (ifq != NULL 893 #ifdef ALTQ 894 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 895 #endif 896 ) { 897 if (IF_QFULL(ifq)) { 898 IF_DROP(&ifp->if_snd); 899 m_freem(m); 900 if (rv == 0) 901 rv = ENOBUFS; 902 } 903 else 904 IF_ENQUEUE(ifq, m); 905 } else 906 IFQ_ENQUEUE(&ifp->if_snd, m, &pktattr, rv); 907 if (rv != 0) { 908 ++ifp->if_oerrors; 909 splx(s); 910 return (rv); 911 } 912 913 if (! (ifp->if_flags & IFF_OACTIVE)) 914 (*ifp->if_start)(ifp); 915 916 /* 917 * Count output packets and bytes. 918 * The packet length includes header + additional hardware framing 919 * according to RFC 1333. 920 */ 921 ifp->if_obytes += len + sp->pp_framebytes; 922 splx(s); 923 return (0); 924 } 925 926 void 927 sppp_attach(struct ifnet *ifp) 928 { 929 struct sppp *sp = (struct sppp *) ifp; 930 931 /* Initialize keepalive handler. */ 932 if (! spppq) { 933 callout_init(&keepalive_ch); 934 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 935 } 936 937 /* Insert new entry into the keepalive list. */ 938 sp->pp_next = spppq; 939 spppq = sp; 940 941 sp->pp_if.if_type = IFT_PPP; 942 sp->pp_if.if_output = sppp_output; 943 sp->pp_fastq.ifq_maxlen = 32; 944 sp->pp_cpq.ifq_maxlen = 20; 945 sp->pp_loopcnt = 0; 946 sp->pp_alivecnt = 0; 947 sp->pp_last_activity = 0; 948 sp->pp_last_receive = 0; 949 sp->pp_maxalive = DEFAULT_MAXALIVECNT; 950 sp->pp_max_noreceive = DEFAULT_NORECV_TIME; 951 sp->pp_idle_timeout = 0; 952 memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq)); 953 memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq)); 954 sp->pp_auth_failures = 0; 955 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES; 956 sp->pp_phase = SPPP_PHASE_DEAD; 957 sp->pp_up = lcp.Up; 958 sp->pp_down = lcp.Down; 959 960 if_alloc_sadl(ifp); 961 962 memset(&sp->myauth, 0, sizeof sp->myauth); 963 memset(&sp->hisauth, 0, sizeof sp->hisauth); 964 sppp_lcp_init(sp); 965 sppp_ipcp_init(sp); 966 sppp_ipv6cp_init(sp); 967 sppp_pap_init(sp); 968 sppp_chap_init(sp); 969 } 970 971 void 972 sppp_detach(struct ifnet *ifp) 973 { 974 struct sppp **q, *p, *sp = (struct sppp *) ifp; 975 int i; 976 977 /* Remove the entry from the keepalive list. */ 978 for (q = &spppq; (p = *q); q = &p->pp_next) 979 if (p == sp) { 980 *q = p->pp_next; 981 break; 982 } 983 984 /* Stop keepalive handler. */ 985 if (! spppq) { 986 callout_stop(&keepalive_ch); 987 } 988 989 for (i = 0; i < IDX_COUNT; i++) { 990 callout_stop(&sp->ch[i]); 991 } 992 callout_stop(&sp->pap_my_to_ch); 993 994 /* free authentication info */ 995 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF); 996 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF); 997 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF); 998 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF); 999 1000 #if 0 /* done in if_detach() */ 1001 if_free_sadl(ifp); 1002 #endif 1003 } 1004 1005 /* 1006 * Flush the interface output queue. 1007 */ 1008 void 1009 sppp_flush(struct ifnet *ifp) 1010 { 1011 struct sppp *sp = (struct sppp *) ifp; 1012 1013 IFQ_PURGE(&sp->pp_if.if_snd); 1014 IF_PURGE(&sp->pp_fastq); 1015 IF_PURGE(&sp->pp_cpq); 1016 } 1017 1018 /* 1019 * Check if the output queue is empty. 1020 */ 1021 int 1022 sppp_isempty(struct ifnet *ifp) 1023 { 1024 struct sppp *sp = (struct sppp *) ifp; 1025 int empty, s; 1026 1027 s = splnet(); 1028 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) && 1029 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1030 splx(s); 1031 return (empty); 1032 } 1033 1034 /* 1035 * Get next packet to send. 1036 */ 1037 struct mbuf * 1038 sppp_dequeue(struct ifnet *ifp) 1039 { 1040 struct sppp *sp = (struct sppp *) ifp; 1041 struct mbuf *m; 1042 int s; 1043 1044 s = splnet(); 1045 /* 1046 * Process only the control protocol queue until we have at 1047 * least one NCP open. 1048 * 1049 * Do always serve all three queues in Cisco mode. 1050 */ 1051 IF_DEQUEUE(&sp->pp_cpq, m); 1052 if (m == NULL && 1053 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1054 IF_DEQUEUE(&sp->pp_fastq, m); 1055 if (m == NULL) 1056 IFQ_DEQUEUE(&sp->pp_if.if_snd, m); 1057 } 1058 splx(s); 1059 return m; 1060 } 1061 1062 /* 1063 * Process an ioctl request. Called on low priority level. 1064 */ 1065 int 1066 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1067 { 1068 struct ifreq *ifr = (struct ifreq *) data; 1069 struct sppp *sp = (struct sppp *) ifp; 1070 int s, error=0, going_up, going_down, newmode; 1071 1072 s = splnet(); 1073 switch (cmd) { 1074 case SIOCAIFADDR: 1075 case SIOCSIFDSTADDR: 1076 break; 1077 1078 case SIOCSIFADDR: 1079 if_up(ifp); 1080 /* fall through... */ 1081 1082 case SIOCSIFFLAGS: 1083 going_up = ifp->if_flags & IFF_UP && 1084 (ifp->if_flags & IFF_RUNNING) == 0; 1085 going_down = (ifp->if_flags & IFF_UP) == 0 && 1086 ifp->if_flags & IFF_RUNNING; 1087 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1088 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1089 /* sanity */ 1090 newmode = IFF_PASSIVE; 1091 ifp->if_flags &= ~IFF_AUTO; 1092 } 1093 1094 if (going_up || going_down) 1095 lcp.Close(sp); 1096 if (going_up && newmode == 0) { 1097 /* neither auto-dial nor passive */ 1098 ifp->if_flags |= IFF_RUNNING; 1099 if (!(sp->pp_flags & PP_CISCO)) 1100 lcp.Open(sp); 1101 } else if (going_down) { 1102 sppp_flush(ifp); 1103 ifp->if_flags &= ~IFF_RUNNING; 1104 } 1105 1106 break; 1107 1108 #ifdef SIOCSIFMTU 1109 #ifndef ifr_mtu 1110 #define ifr_mtu ifr_metric 1111 #endif 1112 case SIOCSIFMTU: 1113 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1114 error = EINVAL; 1115 break; 1116 } 1117 1118 ifp->if_mtu = ifr->ifr_mtu; 1119 break; 1120 #endif 1121 #ifdef SLIOCSETMTU 1122 case SLIOCSETMTU: 1123 if (*(short *)data < 128 || *(short *)data > sp->lcp.their_mru) 1124 { 1125 error = EINVAL; 1126 break; 1127 } 1128 1129 ifp->if_mtu = *(short *)data; 1130 break; 1131 #endif 1132 #ifdef SIOCGIFMTU 1133 case SIOCGIFMTU: 1134 ifr->ifr_mtu = ifp->if_mtu; 1135 break; 1136 #endif 1137 #ifdef SLIOCGETMTU 1138 case SLIOCGETMTU: 1139 *(short *)data = ifp->if_mtu; 1140 break; 1141 #endif 1142 case SIOCADDMULTI: 1143 case SIOCDELMULTI: 1144 break; 1145 1146 case SPPPSETAUTHCFG: 1147 case SPPPGETAUTHCFG: 1148 case SPPPSETLCPCFG: 1149 case SPPPGETLCPCFG: 1150 case SPPPSETIDLETO: 1151 case SPPPSETAUTHFAILURE: 1152 case SPPPGETAUTHFAILURES: 1153 case SPPPSETDNSOPTS: 1154 case SPPPSETKEEPALIVE: 1155 { 1156 struct proc *p = curproc; /* XXX */ 1157 1158 if ((error = suser(p->p_ucred, &p->p_acflag)) != 0) 1159 break; 1160 } 1161 /* FALLTHROUGH */ 1162 case SPPPGETSTATUS: 1163 case SPPPGETSTATUSNCP: 1164 case SPPPGETIDLETO: 1165 case SPPPGETDNSOPTS: 1166 case SPPPGETDNSADDRS: 1167 case SPPPGETKEEPALIVE: 1168 error = sppp_params(sp, cmd, data); 1169 break; 1170 1171 default: 1172 error = ENOTTY; 1173 } 1174 splx(s); 1175 return (error); 1176 } 1177 1178 1179 /* 1180 * Cisco framing implementation. 1181 */ 1182 1183 /* 1184 * Handle incoming Cisco keepalive protocol packets. 1185 */ 1186 static void 1187 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1188 { 1189 STDDCL; 1190 struct cisco_packet *h; 1191 u_int32_t me, mymask; 1192 1193 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1194 if (debug) 1195 log(LOG_DEBUG, 1196 "%s: cisco invalid packet length: %d bytes\n", 1197 ifp->if_xname, m->m_pkthdr.len); 1198 return; 1199 } 1200 h = mtod(m, struct cisco_packet *); 1201 if (debug) 1202 log(LOG_DEBUG, 1203 "%s: cisco input: %d bytes " 1204 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1205 ifp->if_xname, m->m_pkthdr.len, 1206 ntohl (h->type), h->par1, h->par2, (u_int)h->rel, 1207 (u_int)h->time0, (u_int)h->time1); 1208 switch (ntohl (h->type)) { 1209 default: 1210 if (debug) 1211 addlog("%s: cisco unknown packet type: 0x%x\n", 1212 ifp->if_xname, ntohl (h->type)); 1213 break; 1214 case CISCO_ADDR_REPLY: 1215 /* Reply on address request, ignore */ 1216 break; 1217 case CISCO_KEEPALIVE_REQ: 1218 sp->pp_alivecnt = 0; 1219 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1220 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1221 /* Local and remote sequence numbers are equal. 1222 * Probably, the line is in loopback mode. */ 1223 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1224 printf ("%s: loopback\n", 1225 ifp->if_xname); 1226 sp->pp_loopcnt = 0; 1227 if (ifp->if_flags & IFF_UP) { 1228 if_down(ifp); 1229 IF_PURGE(&sp->pp_cpq); 1230 } 1231 } 1232 ++sp->pp_loopcnt; 1233 1234 /* Generate new local sequence number */ 1235 sp->pp_seq[IDX_LCP] = arc4random(); 1236 break; 1237 } 1238 sp->pp_loopcnt = 0; 1239 if (! (ifp->if_flags & IFF_UP) && 1240 (ifp->if_flags & IFF_RUNNING)) { 1241 if_up(ifp); 1242 } 1243 break; 1244 case CISCO_ADDR_REQ: 1245 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1246 if (me != 0L) 1247 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1248 break; 1249 } 1250 } 1251 1252 /* 1253 * Send Cisco keepalive packet. 1254 */ 1255 static void 1256 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2) 1257 { 1258 STDDCL; 1259 struct ppp_header *h; 1260 struct cisco_packet *ch; 1261 struct mbuf *m; 1262 u_int32_t t = (time.tv_sec - boottime.tv_sec) * 1000; 1263 1264 MGETHDR(m, M_DONTWAIT, MT_DATA); 1265 if (! m) 1266 return; 1267 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1268 m->m_pkthdr.rcvif = 0; 1269 1270 h = mtod(m, struct ppp_header *); 1271 h->address = CISCO_MULTICAST; 1272 h->control = 0; 1273 h->protocol = htons(CISCO_KEEPALIVE); 1274 1275 ch = (struct cisco_packet *)(h + 1); 1276 ch->type = htonl(type); 1277 ch->par1 = htonl(par1); 1278 ch->par2 = htonl(par2); 1279 ch->rel = -1; 1280 1281 ch->time0 = htons((u_short)(t >> 16)); 1282 ch->time1 = htons((u_short) t); 1283 1284 if (debug) 1285 log(LOG_DEBUG, 1286 "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1287 ifp->if_xname, ntohl (ch->type), ch->par1, 1288 ch->par2, (u_int)ch->rel, (u_int)ch->time0, 1289 (u_int)ch->time1); 1290 1291 if (IF_QFULL(&sp->pp_cpq)) { 1292 IF_DROP(&sp->pp_fastq); 1293 IF_DROP(&ifp->if_snd); 1294 m_freem(m); 1295 ++ifp->if_oerrors; 1296 return; 1297 } else 1298 IF_ENQUEUE(&sp->pp_cpq, m); 1299 if (! (ifp->if_flags & IFF_OACTIVE)) 1300 (*ifp->if_start)(ifp); 1301 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1302 } 1303 1304 /* 1305 * PPP protocol implementation. 1306 */ 1307 1308 /* 1309 * Send PPP control protocol packet. 1310 */ 1311 static void 1312 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1313 u_char ident, u_short len, void *data) 1314 { 1315 STDDCL; 1316 struct lcp_header *lh; 1317 struct mbuf *m; 1318 size_t pkthdrlen; 1319 1320 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1321 1322 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1323 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1324 MGETHDR(m, M_DONTWAIT, MT_DATA); 1325 if (! m) 1326 return; 1327 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1328 m->m_pkthdr.rcvif = 0; 1329 1330 if (sp->pp_flags & PP_NOFRAMING) { 1331 *mtod(m, u_int16_t *) = htons(proto); 1332 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1333 } else { 1334 struct ppp_header *h; 1335 h = mtod(m, struct ppp_header *); 1336 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1337 h->control = PPP_UI; /* Unnumbered Info */ 1338 h->protocol = htons(proto); /* Link Control Protocol */ 1339 lh = (struct lcp_header *)(h + 1); 1340 } 1341 lh->type = type; 1342 lh->ident = ident; 1343 lh->len = htons(LCP_HEADER_LEN + len); 1344 if (len) 1345 bcopy (data, lh + 1, len); 1346 1347 if (debug) { 1348 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 1349 ifp->if_xname, 1350 sppp_proto_name(proto), 1351 sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len)); 1352 if (len) 1353 sppp_print_bytes((u_char *)(lh + 1), len); 1354 addlog(">\n"); 1355 } 1356 if (IF_QFULL(&sp->pp_cpq)) { 1357 IF_DROP(&sp->pp_fastq); 1358 IF_DROP(&ifp->if_snd); 1359 m_freem(m); 1360 ++ifp->if_oerrors; 1361 return; 1362 } else 1363 IF_ENQUEUE(&sp->pp_cpq, m); 1364 if (! (ifp->if_flags & IFF_OACTIVE)) 1365 (*ifp->if_start)(ifp); 1366 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1367 } 1368 1369 /* 1370 * Handle incoming PPP control protocol packets. 1371 */ 1372 static void 1373 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1374 { 1375 STDDCL; 1376 struct lcp_header *h; 1377 int printlen, len = m->m_pkthdr.len; 1378 int rv; 1379 u_char *p; 1380 u_int32_t u32; 1381 1382 if (len < 4) { 1383 if (debug) 1384 log(LOG_DEBUG, 1385 "%s: %s invalid packet length: %d bytes\n", 1386 ifp->if_xname, cp->name, len); 1387 return; 1388 } 1389 h = mtod(m, struct lcp_header *); 1390 if (debug) { 1391 printlen = ntohs(h->len); 1392 log(LOG_DEBUG, 1393 "%s: %s input(%s): <%s id=0x%x len=%d", 1394 ifp->if_xname, cp->name, 1395 sppp_state_name(sp->state[cp->protoidx]), 1396 sppp_cp_type_name(h->type), h->ident, printlen); 1397 if (len < printlen) 1398 printlen = len; 1399 if (printlen > 4) 1400 sppp_print_bytes((u_char *)(h + 1), printlen - 4); 1401 addlog(">\n"); 1402 } 1403 if (len > ntohs(h->len)) 1404 len = ntohs(h->len); 1405 p = (u_char *)(h + 1); 1406 switch (h->type) { 1407 case CONF_REQ: 1408 if (len < 4) { 1409 if (debug) 1410 addlog("%s: %s invalid conf-req length %d\n", 1411 ifp->if_xname, cp->name, 1412 len); 1413 ++ifp->if_ierrors; 1414 break; 1415 } 1416 /* handle states where RCR doesn't get a SCA/SCN */ 1417 switch (sp->state[cp->protoidx]) { 1418 case STATE_CLOSING: 1419 case STATE_STOPPING: 1420 return; 1421 case STATE_CLOSED: 1422 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1423 0, 0); 1424 return; 1425 } 1426 rv = (cp->RCR)(sp, h, len); 1427 if (rv < 0) { 1428 /* fatal error, shut down */ 1429 (cp->tld)(sp); 1430 sppp_lcp_tlf(sp); 1431 return; 1432 } 1433 switch (sp->state[cp->protoidx]) { 1434 case STATE_OPENED: 1435 (cp->tld)(sp); 1436 (cp->scr)(sp); 1437 /* fall through... */ 1438 case STATE_ACK_SENT: 1439 case STATE_REQ_SENT: 1440 sppp_cp_change_state(cp, sp, rv? 1441 STATE_ACK_SENT: STATE_REQ_SENT); 1442 break; 1443 case STATE_STOPPED: 1444 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1445 (cp->scr)(sp); 1446 sppp_cp_change_state(cp, sp, rv? 1447 STATE_ACK_SENT: STATE_REQ_SENT); 1448 break; 1449 case STATE_ACK_RCVD: 1450 if (rv) { 1451 sppp_cp_change_state(cp, sp, STATE_OPENED); 1452 if (debug) 1453 log(LOG_DEBUG, "%s: %s tlu\n", 1454 ifp->if_xname, 1455 cp->name); 1456 (cp->tlu)(sp); 1457 } else 1458 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1459 break; 1460 default: 1461 printf("%s: %s illegal %s in state %s\n", 1462 ifp->if_xname, cp->name, 1463 sppp_cp_type_name(h->type), 1464 sppp_state_name(sp->state[cp->protoidx])); 1465 ++ifp->if_ierrors; 1466 } 1467 break; 1468 case CONF_ACK: 1469 if (h->ident != sp->confid[cp->protoidx]) { 1470 if (debug) 1471 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1472 ifp->if_xname, cp->name, 1473 h->ident, sp->confid[cp->protoidx]); 1474 ++ifp->if_ierrors; 1475 break; 1476 } 1477 switch (sp->state[cp->protoidx]) { 1478 case STATE_CLOSED: 1479 case STATE_STOPPED: 1480 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1481 break; 1482 case STATE_CLOSING: 1483 case STATE_STOPPING: 1484 break; 1485 case STATE_REQ_SENT: 1486 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1487 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1488 break; 1489 case STATE_OPENED: 1490 (cp->tld)(sp); 1491 /* fall through */ 1492 case STATE_ACK_RCVD: 1493 (cp->scr)(sp); 1494 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1495 break; 1496 case STATE_ACK_SENT: 1497 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1498 sppp_cp_change_state(cp, sp, STATE_OPENED); 1499 if (debug) 1500 log(LOG_DEBUG, "%s: %s tlu\n", 1501 ifp->if_xname, cp->name); 1502 (cp->tlu)(sp); 1503 break; 1504 default: 1505 printf("%s: %s illegal %s in state %s\n", 1506 ifp->if_xname, cp->name, 1507 sppp_cp_type_name(h->type), 1508 sppp_state_name(sp->state[cp->protoidx])); 1509 ++ifp->if_ierrors; 1510 } 1511 break; 1512 case CONF_NAK: 1513 case CONF_REJ: 1514 if (h->ident != sp->confid[cp->protoidx]) { 1515 if (debug) 1516 addlog("%s: %s id mismatch 0x%x != 0x%x\n", 1517 ifp->if_xname, cp->name, 1518 h->ident, sp->confid[cp->protoidx]); 1519 ++ifp->if_ierrors; 1520 break; 1521 } 1522 if (h->type == CONF_NAK) 1523 (cp->RCN_nak)(sp, h, len); 1524 else /* CONF_REJ */ 1525 (cp->RCN_rej)(sp, h, len); 1526 1527 switch (sp->state[cp->protoidx]) { 1528 case STATE_CLOSED: 1529 case STATE_STOPPED: 1530 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1531 break; 1532 case STATE_REQ_SENT: 1533 case STATE_ACK_SENT: 1534 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1535 (cp->scr)(sp); 1536 break; 1537 case STATE_OPENED: 1538 (cp->tld)(sp); 1539 /* fall through */ 1540 case STATE_ACK_RCVD: 1541 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1542 (cp->scr)(sp); 1543 break; 1544 case STATE_CLOSING: 1545 case STATE_STOPPING: 1546 break; 1547 default: 1548 printf("%s: %s illegal %s in state %s\n", 1549 ifp->if_xname, cp->name, 1550 sppp_cp_type_name(h->type), 1551 sppp_state_name(sp->state[cp->protoidx])); 1552 ++ifp->if_ierrors; 1553 } 1554 break; 1555 1556 case TERM_REQ: 1557 switch (sp->state[cp->protoidx]) { 1558 case STATE_ACK_RCVD: 1559 case STATE_ACK_SENT: 1560 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1561 /* fall through */ 1562 case STATE_CLOSED: 1563 case STATE_STOPPED: 1564 case STATE_CLOSING: 1565 case STATE_STOPPING: 1566 case STATE_REQ_SENT: 1567 sta: 1568 /* Send Terminate-Ack packet. */ 1569 if (debug) 1570 log(LOG_DEBUG, "%s: %s send terminate-ack\n", 1571 ifp->if_xname, cp->name); 1572 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1573 break; 1574 case STATE_OPENED: 1575 (cp->tld)(sp); 1576 sp->rst_counter[cp->protoidx] = 0; 1577 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1578 goto sta; 1579 default: 1580 printf("%s: %s illegal %s in state %s\n", 1581 ifp->if_xname, cp->name, 1582 sppp_cp_type_name(h->type), 1583 sppp_state_name(sp->state[cp->protoidx])); 1584 ++ifp->if_ierrors; 1585 } 1586 break; 1587 case TERM_ACK: 1588 switch (sp->state[cp->protoidx]) { 1589 case STATE_CLOSED: 1590 case STATE_STOPPED: 1591 case STATE_REQ_SENT: 1592 case STATE_ACK_SENT: 1593 break; 1594 case STATE_CLOSING: 1595 (cp->tlf)(sp); 1596 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1597 sppp_lcp_check_and_close(sp); 1598 break; 1599 case STATE_STOPPING: 1600 (cp->tlf)(sp); 1601 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1602 sppp_lcp_check_and_close(sp); 1603 break; 1604 case STATE_ACK_RCVD: 1605 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1606 break; 1607 case STATE_OPENED: 1608 (cp->tld)(sp); 1609 (cp->scr)(sp); 1610 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1611 break; 1612 default: 1613 printf("%s: %s illegal %s in state %s\n", 1614 ifp->if_xname, cp->name, 1615 sppp_cp_type_name(h->type), 1616 sppp_state_name(sp->state[cp->protoidx])); 1617 ++ifp->if_ierrors; 1618 } 1619 break; 1620 case CODE_REJ: 1621 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1622 log(LOG_INFO, 1623 "%s: %s: ignoring RXJ (%s) for code ?, " 1624 "danger will robinson\n", 1625 ifp->if_xname, cp->name, 1626 sppp_cp_type_name(h->type)); 1627 switch (sp->state[cp->protoidx]) { 1628 case STATE_CLOSED: 1629 case STATE_STOPPED: 1630 case STATE_REQ_SENT: 1631 case STATE_ACK_SENT: 1632 case STATE_CLOSING: 1633 case STATE_STOPPING: 1634 case STATE_OPENED: 1635 break; 1636 case STATE_ACK_RCVD: 1637 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1638 break; 1639 default: 1640 printf("%s: %s illegal %s in state %s\n", 1641 ifp->if_xname, cp->name, 1642 sppp_cp_type_name(h->type), 1643 sppp_state_name(sp->state[cp->protoidx])); 1644 ++ifp->if_ierrors; 1645 } 1646 break; 1647 case PROTO_REJ: 1648 { 1649 int catastrophic; 1650 const struct cp *upper; 1651 int i; 1652 u_int16_t proto; 1653 1654 catastrophic = 0; 1655 upper = NULL; 1656 proto = p[0] << 8 | p[1]; 1657 for (i = 0; i < IDX_COUNT; i++) { 1658 if (cps[i]->proto == proto) { 1659 upper = cps[i]; 1660 break; 1661 } 1662 } 1663 if (upper == NULL) 1664 catastrophic++; 1665 1666 if (debug) 1667 log(LOG_INFO, 1668 "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1669 ifp->if_xname, cp->name, catastrophic ? '-' : '+', 1670 sppp_cp_type_name(h->type), proto, 1671 upper ? upper->name : "unknown", 1672 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1673 1674 /* 1675 * if we got RXJ+ against conf-req, the peer does not implement 1676 * this particular protocol type. terminate the protocol. 1677 */ 1678 if (upper && !catastrophic) { 1679 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1680 upper->Close(sp); 1681 break; 1682 } 1683 } 1684 1685 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1686 switch (sp->state[cp->protoidx]) { 1687 case STATE_CLOSED: 1688 case STATE_STOPPED: 1689 case STATE_REQ_SENT: 1690 case STATE_ACK_SENT: 1691 case STATE_CLOSING: 1692 case STATE_STOPPING: 1693 case STATE_OPENED: 1694 break; 1695 case STATE_ACK_RCVD: 1696 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1697 break; 1698 default: 1699 printf("%s: %s illegal %s in state %s\n", 1700 ifp->if_xname, cp->name, 1701 sppp_cp_type_name(h->type), 1702 sppp_state_name(sp->state[cp->protoidx])); 1703 ++ifp->if_ierrors; 1704 } 1705 break; 1706 } 1707 case DISC_REQ: 1708 if (cp->proto != PPP_LCP) 1709 goto illegal; 1710 /* Discard the packet. */ 1711 break; 1712 case ECHO_REQ: 1713 if (cp->proto != PPP_LCP) 1714 goto illegal; 1715 if (sp->state[cp->protoidx] != STATE_OPENED) { 1716 if (debug) 1717 addlog("%s: lcp echo req but lcp closed\n", 1718 ifp->if_xname); 1719 ++ifp->if_ierrors; 1720 break; 1721 } 1722 if (len < 8) { 1723 if (debug) 1724 addlog("%s: invalid lcp echo request " 1725 "packet length: %d bytes\n", 1726 ifp->if_xname, len); 1727 break; 1728 } 1729 memcpy(&u32, h + 1, sizeof u32); 1730 if (ntohl(u32) == sp->lcp.magic) { 1731 /* Line loopback mode detected. */ 1732 printf("%s: loopback\n", ifp->if_xname); 1733 if_down(ifp); 1734 IF_PURGE(&sp->pp_cpq); 1735 1736 /* Shut down the PPP link. */ 1737 /* XXX */ 1738 lcp.Down(sp); 1739 lcp.Up(sp); 1740 break; 1741 } 1742 u32 = htonl(sp->lcp.magic); 1743 memcpy(h + 1, &u32, sizeof u32); 1744 if (debug) 1745 addlog("%s: got lcp echo req, sending echo rep\n", 1746 ifp->if_xname); 1747 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4, 1748 h + 1); 1749 break; 1750 case ECHO_REPLY: 1751 if (cp->proto != PPP_LCP) 1752 goto illegal; 1753 if (h->ident != sp->lcp.echoid) { 1754 ++ifp->if_ierrors; 1755 break; 1756 } 1757 if (len < 8) { 1758 if (debug) 1759 addlog("%s: lcp invalid echo reply " 1760 "packet length: %d bytes\n", 1761 ifp->if_xname, len); 1762 break; 1763 } 1764 if (debug) 1765 addlog("%s: lcp got echo rep\n", 1766 ifp->if_xname); 1767 memcpy(&u32, h + 1, sizeof u32); 1768 if (ntohl(u32) != sp->lcp.magic) 1769 sp->pp_alivecnt = 0; 1770 break; 1771 default: 1772 /* Unknown packet type -- send Code-Reject packet. */ 1773 illegal: 1774 if (debug) 1775 addlog("%s: %s send code-rej for 0x%x\n", 1776 ifp->if_xname, cp->name, h->type); 1777 sppp_cp_send(sp, cp->proto, CODE_REJ, 1778 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1779 ++ifp->if_ierrors; 1780 } 1781 } 1782 1783 1784 /* 1785 * The generic part of all Up/Down/Open/Close/TO event handlers. 1786 * Basically, the state transition handling in the automaton. 1787 */ 1788 static void 1789 sppp_up_event(const struct cp *cp, struct sppp *sp) 1790 { 1791 STDDCL; 1792 1793 if (debug) 1794 log(LOG_DEBUG, "%s: %s up(%s)\n", 1795 ifp->if_xname, cp->name, 1796 sppp_state_name(sp->state[cp->protoidx])); 1797 1798 switch (sp->state[cp->protoidx]) { 1799 case STATE_INITIAL: 1800 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1801 break; 1802 case STATE_STARTING: 1803 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1804 (cp->scr)(sp); 1805 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1806 break; 1807 default: 1808 printf("%s: %s illegal up in state %s\n", 1809 ifp->if_xname, cp->name, 1810 sppp_state_name(sp->state[cp->protoidx])); 1811 } 1812 } 1813 1814 static void 1815 sppp_down_event(const struct cp *cp, struct sppp *sp) 1816 { 1817 STDDCL; 1818 1819 if (debug) 1820 log(LOG_DEBUG, "%s: %s down(%s)\n", 1821 ifp->if_xname, cp->name, 1822 sppp_state_name(sp->state[cp->protoidx])); 1823 1824 switch (sp->state[cp->protoidx]) { 1825 case STATE_CLOSED: 1826 case STATE_CLOSING: 1827 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1828 break; 1829 case STATE_STOPPED: 1830 (cp->tls)(sp); 1831 /* fall through */ 1832 case STATE_STOPPING: 1833 case STATE_REQ_SENT: 1834 case STATE_ACK_RCVD: 1835 case STATE_ACK_SENT: 1836 sppp_cp_change_state(cp, sp, STATE_STARTING); 1837 break; 1838 case STATE_OPENED: 1839 (cp->tld)(sp); 1840 sppp_cp_change_state(cp, sp, STATE_STARTING); 1841 break; 1842 default: 1843 printf("%s: %s illegal down in state %s\n", 1844 ifp->if_xname, cp->name, 1845 sppp_state_name(sp->state[cp->protoidx])); 1846 } 1847 } 1848 1849 1850 static void 1851 sppp_open_event(const struct cp *cp, struct sppp *sp) 1852 { 1853 STDDCL; 1854 1855 if (debug) 1856 log(LOG_DEBUG, "%s: %s open(%s)\n", 1857 ifp->if_xname, cp->name, 1858 sppp_state_name(sp->state[cp->protoidx])); 1859 1860 switch (sp->state[cp->protoidx]) { 1861 case STATE_INITIAL: 1862 (cp->tls)(sp); 1863 sppp_cp_change_state(cp, sp, STATE_STARTING); 1864 break; 1865 case STATE_STARTING: 1866 break; 1867 case STATE_CLOSED: 1868 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1869 (cp->scr)(sp); 1870 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1871 break; 1872 case STATE_STOPPED: 1873 case STATE_STOPPING: 1874 case STATE_REQ_SENT: 1875 case STATE_ACK_RCVD: 1876 case STATE_ACK_SENT: 1877 case STATE_OPENED: 1878 break; 1879 case STATE_CLOSING: 1880 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1881 break; 1882 } 1883 } 1884 1885 1886 static void 1887 sppp_close_event(const struct cp *cp, struct sppp *sp) 1888 { 1889 STDDCL; 1890 1891 if (debug) 1892 log(LOG_DEBUG, "%s: %s close(%s)\n", 1893 ifp->if_xname, cp->name, 1894 sppp_state_name(sp->state[cp->protoidx])); 1895 1896 switch (sp->state[cp->protoidx]) { 1897 case STATE_INITIAL: 1898 case STATE_CLOSED: 1899 case STATE_CLOSING: 1900 break; 1901 case STATE_STARTING: 1902 (cp->tlf)(sp); 1903 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1904 break; 1905 case STATE_STOPPED: 1906 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1907 break; 1908 case STATE_STOPPING: 1909 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1910 break; 1911 case STATE_OPENED: 1912 (cp->tld)(sp); 1913 /* fall through */ 1914 case STATE_REQ_SENT: 1915 case STATE_ACK_RCVD: 1916 case STATE_ACK_SENT: 1917 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1918 sppp_cp_send(sp, cp->proto, TERM_REQ, 1919 ++sp->pp_seq[cp->protoidx], 0, 0); 1920 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1921 break; 1922 } 1923 } 1924 1925 static void 1926 sppp_to_event(const struct cp *cp, struct sppp *sp) 1927 { 1928 STDDCL; 1929 int s; 1930 1931 s = splnet(); 1932 if (debug) 1933 log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n", 1934 ifp->if_xname, cp->name, 1935 sppp_state_name(sp->state[cp->protoidx]), 1936 sp->rst_counter[cp->protoidx]); 1937 1938 if (--sp->rst_counter[cp->protoidx] < 0) 1939 /* TO- event */ 1940 switch (sp->state[cp->protoidx]) { 1941 case STATE_CLOSING: 1942 (cp->tlf)(sp); 1943 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1944 sppp_lcp_check_and_close(sp); 1945 break; 1946 case STATE_STOPPING: 1947 (cp->tlf)(sp); 1948 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1949 sppp_lcp_check_and_close(sp); 1950 break; 1951 case STATE_REQ_SENT: 1952 case STATE_ACK_RCVD: 1953 case STATE_ACK_SENT: 1954 (cp->tlf)(sp); 1955 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1956 sppp_lcp_check_and_close(sp); 1957 break; 1958 } 1959 else 1960 /* TO+ event */ 1961 switch (sp->state[cp->protoidx]) { 1962 case STATE_CLOSING: 1963 case STATE_STOPPING: 1964 sppp_cp_send(sp, cp->proto, TERM_REQ, 1965 ++sp->pp_seq[cp->protoidx], 0, 0); 1966 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1967 cp->TO, sp); 1968 break; 1969 case STATE_REQ_SENT: 1970 case STATE_ACK_RCVD: 1971 (cp->scr)(sp); 1972 /* sppp_cp_change_state() will restart the timer */ 1973 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1974 break; 1975 case STATE_ACK_SENT: 1976 (cp->scr)(sp); 1977 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 1978 cp->TO, sp); 1979 break; 1980 } 1981 1982 splx(s); 1983 } 1984 1985 /* 1986 * Change the state of a control protocol in the state automaton. 1987 * Takes care of starting/stopping the restart timer. 1988 */ 1989 void 1990 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1991 { 1992 sp->state[cp->protoidx] = newstate; 1993 callout_stop(&sp->ch[cp->protoidx]); 1994 switch (newstate) { 1995 case STATE_INITIAL: 1996 case STATE_STARTING: 1997 case STATE_CLOSED: 1998 case STATE_STOPPED: 1999 case STATE_OPENED: 2000 break; 2001 case STATE_CLOSING: 2002 case STATE_STOPPING: 2003 case STATE_REQ_SENT: 2004 case STATE_ACK_RCVD: 2005 case STATE_ACK_SENT: 2006 callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout, 2007 cp->TO, sp); 2008 break; 2009 } 2010 } 2011 2012 /* 2013 *--------------------------------------------------------------------------* 2014 * * 2015 * The LCP implementation. * 2016 * * 2017 *--------------------------------------------------------------------------* 2018 */ 2019 static void 2020 sppp_lcp_init(struct sppp *sp) 2021 { 2022 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2023 sp->lcp.magic = 0; 2024 sp->state[IDX_LCP] = STATE_INITIAL; 2025 sp->fail_counter[IDX_LCP] = 0; 2026 sp->pp_seq[IDX_LCP] = 0; 2027 sp->pp_rseq[IDX_LCP] = 0; 2028 sp->lcp.protos = 0; 2029 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2030 2031 /* 2032 * Initialize counters and timeout values. Note that we don't 2033 * use the 3 seconds suggested in RFC 1661 since we are likely 2034 * running on a fast link. XXX We should probably implement 2035 * the exponential backoff option. Note that these values are 2036 * relevant for all control protocols, not just LCP only. 2037 */ 2038 sp->lcp.timeout = 1 * hz; 2039 sp->lcp.max_terminate = 2; 2040 sp->lcp.max_configure = 10; 2041 sp->lcp.max_failure = 10; 2042 callout_init(&sp->ch[IDX_LCP]); 2043 } 2044 2045 static void 2046 sppp_lcp_up(struct sppp *sp) 2047 { 2048 STDDCL; 2049 2050 /* Initialize activity timestamp: opening a connection is an activity */ 2051 sp->pp_last_receive = sp->pp_last_activity = mono_time.tv_sec; 2052 2053 /* 2054 * If this interface is passive or dial-on-demand, and we are 2055 * still in Initial state, it means we've got an incoming 2056 * call. Activate the interface. 2057 */ 2058 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2059 if (debug) 2060 log(LOG_DEBUG, 2061 "%s: Up event", ifp->if_xname); 2062 ifp->if_flags |= IFF_RUNNING; 2063 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2064 if (debug) 2065 addlog("(incoming call)\n"); 2066 sp->pp_flags |= PP_CALLIN; 2067 lcp.Open(sp); 2068 } else if (debug) 2069 addlog("\n"); 2070 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2071 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2072 ifp->if_flags |= IFF_RUNNING; 2073 lcp.Open(sp); 2074 } 2075 2076 sppp_up_event(&lcp, sp); 2077 } 2078 2079 static void 2080 sppp_lcp_down(struct sppp *sp) 2081 { 2082 STDDCL; 2083 2084 sppp_down_event(&lcp, sp); 2085 2086 /* 2087 * If this is neither a dial-on-demand nor a passive 2088 * interface, simulate an ``ifconfig down'' action, so the 2089 * administrator can force a redial by another ``ifconfig 2090 * up''. XXX For leased line operation, should we immediately 2091 * try to reopen the connection here? 2092 */ 2093 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2094 if (debug) 2095 log(LOG_INFO, 2096 "%s: Down event (carrier loss), taking interface down.\n", 2097 ifp->if_xname); 2098 if_down(ifp); 2099 } else { 2100 if (debug) 2101 log(LOG_DEBUG, 2102 "%s: Down event (carrier loss)\n", 2103 ifp->if_xname); 2104 } 2105 sp->pp_flags &= ~PP_CALLIN; 2106 if (sp->state[IDX_LCP] != STATE_INITIAL) 2107 lcp.Close(sp); 2108 ifp->if_flags &= ~IFF_RUNNING; 2109 } 2110 2111 static void 2112 sppp_lcp_open(struct sppp *sp) 2113 { 2114 /* 2115 * If we are authenticator, negotiate LCP_AUTH 2116 */ 2117 if (sp->hisauth.proto != 0) 2118 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2119 else 2120 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2121 sp->pp_flags &= ~PP_NEEDAUTH; 2122 sppp_open_event(&lcp, sp); 2123 } 2124 2125 static void 2126 sppp_lcp_close(struct sppp *sp) 2127 { 2128 sppp_close_event(&lcp, sp); 2129 } 2130 2131 static void 2132 sppp_lcp_TO(void *cookie) 2133 { 2134 sppp_to_event(&lcp, (struct sppp *)cookie); 2135 } 2136 2137 /* 2138 * Analyze a configure request. Return true if it was agreeable, and 2139 * caused action sca, false if it has been rejected or nak'ed, and 2140 * caused action scn. (The return value is used to make the state 2141 * transition decision in the state automaton.) 2142 */ 2143 static int 2144 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2145 { 2146 STDDCL; 2147 u_char *buf, *r, *p; 2148 int origlen, rlen; 2149 u_int32_t nmagic; 2150 u_short authproto; 2151 2152 len -= 4; 2153 origlen = len; 2154 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2155 if (! buf) 2156 return (0); 2157 2158 if (debug) 2159 log(LOG_DEBUG, "%s: lcp parse opts:", 2160 ifp->if_xname); 2161 2162 /* pass 1: check for things that need to be rejected */ 2163 p = (void *)(h + 1); 2164 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2165 /* Sanity check option length */ 2166 if (p[1] > len) { 2167 /* 2168 * Malicious option - drop imediately. 2169 * XXX Maybe we should just RXJ it? 2170 */ 2171 addlog("%s: received malicious LCP option 0x%02x, " 2172 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname, 2173 p[0], p[1], len); 2174 goto drop; 2175 } 2176 if (debug) 2177 addlog(" %s", sppp_lcp_opt_name(*p)); 2178 switch (*p) { 2179 case LCP_OPT_MAGIC: 2180 /* Magic number. */ 2181 /* fall through, both are same length */ 2182 case LCP_OPT_ASYNC_MAP: 2183 /* Async control character map. */ 2184 if (len >= 6 || p[1] == 6) 2185 continue; 2186 if (debug) 2187 addlog(" [invalid]"); 2188 break; 2189 case LCP_OPT_MRU: 2190 /* Maximum receive unit. */ 2191 if (len >= 4 && p[1] == 4) 2192 continue; 2193 if (debug) 2194 addlog(" [invalid]"); 2195 break; 2196 case LCP_OPT_AUTH_PROTO: 2197 if (len < 4) { 2198 if (debug) 2199 addlog(" [invalid]"); 2200 break; 2201 } 2202 authproto = (p[2] << 8) + p[3]; 2203 if (authproto == PPP_CHAP && p[1] != 5) { 2204 if (debug) 2205 addlog(" [invalid chap len]"); 2206 break; 2207 } 2208 if (sp->myauth.proto == 0) { 2209 /* we are not configured to do auth */ 2210 if (debug) 2211 addlog(" [not configured]"); 2212 break; 2213 } 2214 /* 2215 * Remote want us to authenticate, remember this, 2216 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got 2217 * up. 2218 */ 2219 sp->pp_flags |= PP_NEEDAUTH; 2220 continue; 2221 default: 2222 /* Others not supported. */ 2223 if (debug) 2224 addlog(" [rej]"); 2225 break; 2226 } 2227 /* Add the option to rejected list. */ 2228 bcopy (p, r, p[1]); 2229 r += p[1]; 2230 rlen += p[1]; 2231 } 2232 if (rlen) { 2233 if (debug) 2234 addlog(" send conf-rej\n"); 2235 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2236 goto end; 2237 } else if (debug) 2238 addlog("\n"); 2239 2240 /* 2241 * pass 2: check for option values that are unacceptable and 2242 * thus require to be nak'ed. 2243 */ 2244 if (debug) 2245 log(LOG_DEBUG, "%s: lcp parse opt values: ", 2246 ifp->if_xname); 2247 2248 p = (void *)(h + 1); 2249 len = origlen; 2250 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2251 if (debug) 2252 addlog(" %s", sppp_lcp_opt_name(*p)); 2253 switch (*p) { 2254 case LCP_OPT_MAGIC: 2255 /* Magic number -- extract. */ 2256 nmagic = (u_int32_t)p[2] << 24 | 2257 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2258 if (nmagic != sp->lcp.magic) { 2259 if (debug) 2260 addlog(" 0x%x", nmagic); 2261 continue; 2262 } 2263 /* 2264 * Local and remote magics equal -- loopback? 2265 */ 2266 if (sp->pp_loopcnt >= LOOPALIVECNT*5) { 2267 printf ("%s: loopback\n", 2268 ifp->if_xname); 2269 sp->pp_loopcnt = 0; 2270 if (ifp->if_flags & IFF_UP) { 2271 if_down(ifp); 2272 IF_PURGE(&sp->pp_cpq); 2273 /* XXX ? */ 2274 lcp.Down(sp); 2275 lcp.Up(sp); 2276 } 2277 } else if (debug) 2278 addlog(" [glitch]"); 2279 ++sp->pp_loopcnt; 2280 /* 2281 * We negate our magic here, and NAK it. If 2282 * we see it later in an NAK packet, we 2283 * suggest a new one. 2284 */ 2285 nmagic = ~sp->lcp.magic; 2286 /* Gonna NAK it. */ 2287 p[2] = nmagic >> 24; 2288 p[3] = nmagic >> 16; 2289 p[4] = nmagic >> 8; 2290 p[5] = nmagic; 2291 break; 2292 2293 case LCP_OPT_ASYNC_MAP: 2294 /* 2295 * Async control character map -- just ignore it. 2296 * 2297 * Quote from RFC 1662, chapter 6: 2298 * To enable this functionality, synchronous PPP 2299 * implementations MUST always respond to the 2300 * Async-Control-Character-Map Configuration 2301 * Option with the LCP Configure-Ack. However, 2302 * acceptance of the Configuration Option does 2303 * not imply that the synchronous implementation 2304 * will do any ACCM mapping. Instead, all such 2305 * octet mapping will be performed by the 2306 * asynchronous-to-synchronous converter. 2307 */ 2308 continue; 2309 2310 case LCP_OPT_MRU: 2311 /* 2312 * Maximum receive unit. Always agreeable, 2313 * but ignored by now. 2314 */ 2315 sp->lcp.their_mru = p[2] * 256 + p[3]; 2316 if (debug) 2317 addlog(" %ld", sp->lcp.their_mru); 2318 continue; 2319 2320 case LCP_OPT_AUTH_PROTO: 2321 authproto = (p[2] << 8) + p[3]; 2322 if (sp->myauth.proto != authproto) { 2323 /* not agreed, nak */ 2324 if (debug) 2325 addlog(" [mine %s != his %s]", 2326 sppp_proto_name(sp->myauth.proto), 2327 sppp_proto_name(authproto)); 2328 p[2] = sp->myauth.proto >> 8; 2329 p[3] = sp->myauth.proto; 2330 break; 2331 } 2332 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2333 if (debug) 2334 addlog(" [chap not MD5]"); 2335 p[4] = CHAP_MD5; 2336 break; 2337 } 2338 continue; 2339 } 2340 /* Add the option to nak'ed list. */ 2341 bcopy (p, r, p[1]); 2342 r += p[1]; 2343 rlen += p[1]; 2344 } 2345 if (rlen) { 2346 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2347 if (debug) 2348 addlog(" max_failure (%d) exceeded, " 2349 "send conf-rej\n", 2350 sp->lcp.max_failure); 2351 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2352 } else { 2353 if (debug) 2354 addlog(" send conf-nak\n"); 2355 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2356 } 2357 goto end; 2358 } else { 2359 if (debug) 2360 addlog(" send conf-ack\n"); 2361 sp->fail_counter[IDX_LCP] = 0; 2362 sp->pp_loopcnt = 0; 2363 sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1); 2364 } 2365 2366 end: 2367 free(buf, M_TEMP); 2368 return (rlen == 0); 2369 2370 drop: 2371 free(buf, M_TEMP); 2372 return -1; 2373 } 2374 2375 /* 2376 * Analyze the LCP Configure-Reject option list, and adjust our 2377 * negotiation. 2378 */ 2379 static void 2380 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2381 { 2382 STDDCL; 2383 u_char *buf, *p; 2384 2385 len -= 4; 2386 buf = malloc (len, M_TEMP, M_NOWAIT); 2387 if (!buf) 2388 return; 2389 2390 if (debug) 2391 log(LOG_DEBUG, "%s: lcp rej opts:", 2392 ifp->if_xname); 2393 2394 p = (void *)(h + 1); 2395 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2396 /* Sanity check option length */ 2397 if (p[1] > len) { 2398 /* 2399 * Malicious option - drop imediately. 2400 * XXX Maybe we should just RXJ it? 2401 */ 2402 addlog("%s: received malicious LCP option, " 2403 "dropping.\n", ifp->if_xname); 2404 goto drop; 2405 } 2406 if (debug) 2407 addlog(" %s", sppp_lcp_opt_name(*p)); 2408 switch (*p) { 2409 case LCP_OPT_MAGIC: 2410 /* Magic number -- can't use it, use 0 */ 2411 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2412 sp->lcp.magic = 0; 2413 break; 2414 case LCP_OPT_MRU: 2415 /* 2416 * Should not be rejected anyway, since we only 2417 * negotiate a MRU if explicitly requested by 2418 * peer. 2419 */ 2420 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2421 break; 2422 case LCP_OPT_AUTH_PROTO: 2423 /* 2424 * Peer doesn't want to authenticate himself, 2425 * deny unless this is a dialout call, and 2426 * SPPP_AUTHFLAG_NOCALLOUT is set. 2427 */ 2428 if ((sp->pp_flags & PP_CALLIN) == 0 && 2429 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) { 2430 if (debug) 2431 addlog(" [don't insist on auth " 2432 "for callout]"); 2433 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2434 break; 2435 } 2436 if (debug) 2437 addlog("[access denied]\n"); 2438 lcp.Close(sp); 2439 break; 2440 } 2441 } 2442 if (debug) 2443 addlog("\n"); 2444 drop: 2445 free(buf, M_TEMP); 2446 return; 2447 } 2448 2449 /* 2450 * Analyze the LCP Configure-NAK option list, and adjust our 2451 * negotiation. 2452 */ 2453 static void 2454 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2455 { 2456 STDDCL; 2457 u_char *buf, *p; 2458 u_int32_t magic; 2459 2460 len -= 4; 2461 buf = malloc (len, M_TEMP, M_NOWAIT); 2462 if (!buf) 2463 return; 2464 2465 if (debug) 2466 log(LOG_DEBUG, "%s: lcp nak opts:", 2467 ifp->if_xname); 2468 2469 p = (void *)(h + 1); 2470 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2471 /* Sanity check option length */ 2472 if (p[1] > len) { 2473 /* 2474 * Malicious option - drop imediately. 2475 * XXX Maybe we should just RXJ it? 2476 */ 2477 addlog("%s: received malicious LCP option, " 2478 "dropping.\n", ifp->if_xname); 2479 goto drop; 2480 } 2481 if (debug) 2482 addlog(" %s", sppp_lcp_opt_name(*p)); 2483 switch (*p) { 2484 case LCP_OPT_MAGIC: 2485 /* Magic number -- renegotiate */ 2486 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2487 len >= 6 && p[1] == 6) { 2488 magic = (u_int32_t)p[2] << 24 | 2489 (u_int32_t)p[3] << 16 | p[4] << 8 | p[5]; 2490 /* 2491 * If the remote magic is our negated one, 2492 * this looks like a loopback problem. 2493 * Suggest a new magic to make sure. 2494 */ 2495 if (magic == ~sp->lcp.magic) { 2496 if (debug) 2497 addlog(" magic glitch"); 2498 sp->lcp.magic = arc4random(); 2499 } else { 2500 sp->lcp.magic = magic; 2501 if (debug) 2502 addlog(" %d", magic); 2503 } 2504 } 2505 break; 2506 case LCP_OPT_MRU: 2507 /* 2508 * Peer wants to advise us to negotiate an MRU. 2509 * Agree on it if it's reasonable, or use 2510 * default otherwise. 2511 */ 2512 if (len >= 4 && p[1] == 4) { 2513 u_int mru = p[2] * 256 + p[3]; 2514 if (debug) 2515 addlog(" %d", mru); 2516 if (mru < PP_MTU || mru > PP_MAX_MRU) 2517 mru = PP_MTU; 2518 sp->lcp.mru = mru; 2519 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2520 } 2521 break; 2522 case LCP_OPT_AUTH_PROTO: 2523 /* 2524 * Peer doesn't like our authentication method, 2525 * deny. 2526 */ 2527 if (debug) 2528 addlog("[access denied]\n"); 2529 lcp.Close(sp); 2530 break; 2531 } 2532 } 2533 if (debug) 2534 addlog("\n"); 2535 drop: 2536 free(buf, M_TEMP); 2537 return; 2538 } 2539 2540 static void 2541 sppp_lcp_tlu(struct sppp *sp) 2542 { 2543 STDDCL; 2544 int i; 2545 u_int32_t mask; 2546 2547 /* XXX ? */ 2548 if (! (ifp->if_flags & IFF_UP) && 2549 (ifp->if_flags & IFF_RUNNING)) { 2550 /* Coming out of loopback mode. */ 2551 if_up(ifp); 2552 } 2553 2554 for (i = 0; i < IDX_COUNT; i++) 2555 if ((cps[i])->flags & CP_QUAL) 2556 (cps[i])->Open(sp); 2557 2558 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2559 (sp->pp_flags & PP_NEEDAUTH) != 0) 2560 sp->pp_phase = SPPP_PHASE_AUTHENTICATE; 2561 else 2562 sp->pp_phase = SPPP_PHASE_NETWORK; 2563 2564 if (debug) 2565 { 2566 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2567 sppp_phase_name(sp->pp_phase)); 2568 } 2569 2570 /* 2571 * Open all authentication protocols. This is even required 2572 * if we already proceeded to network phase, since it might be 2573 * that remote wants us to authenticate, so we might have to 2574 * send a PAP request. Undesired authentication protocols 2575 * don't do anything when they get an Open event. 2576 */ 2577 for (i = 0; i < IDX_COUNT; i++) 2578 if ((cps[i])->flags & CP_AUTH) 2579 (cps[i])->Open(sp); 2580 2581 if (sp->pp_phase == SPPP_PHASE_NETWORK) { 2582 /* Notify all NCPs. */ 2583 for (i = 0; i < IDX_COUNT; i++) 2584 if ((cps[i])->flags & CP_NCP) 2585 (cps[i])->Open(sp); 2586 } 2587 2588 /* Send Up events to all started protos. */ 2589 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2590 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2591 (cps[i])->Up(sp); 2592 2593 /* notify low-level driver of state change */ 2594 if (sp->pp_chg) 2595 sp->pp_chg(sp, (int)sp->pp_phase); 2596 2597 if (sp->pp_phase == SPPP_PHASE_NETWORK) 2598 /* if no NCP is starting, close down */ 2599 sppp_lcp_check_and_close(sp); 2600 } 2601 2602 static void 2603 sppp_lcp_tld(struct sppp *sp) 2604 { 2605 STDDCL; 2606 int i; 2607 u_int32_t mask; 2608 2609 sp->pp_phase = SPPP_PHASE_TERMINATE; 2610 2611 if (debug) 2612 { 2613 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2614 sppp_phase_name(sp->pp_phase)); 2615 } 2616 2617 /* 2618 * Take upper layers down. We send the Down event first and 2619 * the Close second to prevent the upper layers from sending 2620 * ``a flurry of terminate-request packets'', as the RFC 2621 * describes it. 2622 */ 2623 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2624 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2625 (cps[i])->Down(sp); 2626 (cps[i])->Close(sp); 2627 } 2628 } 2629 2630 static void 2631 sppp_lcp_tls(struct sppp *sp) 2632 { 2633 STDDCL; 2634 2635 if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) { 2636 printf("%s: authentication failed %d times, not retrying again\n", 2637 sp->pp_if.if_xname, sp->pp_auth_failures); 2638 if_down(&sp->pp_if); 2639 return; 2640 } 2641 2642 sp->pp_phase = SPPP_PHASE_ESTABLISH; 2643 2644 if (debug) 2645 { 2646 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2647 sppp_phase_name(sp->pp_phase)); 2648 } 2649 2650 /* Notify lower layer if desired. */ 2651 if (sp->pp_tls) 2652 (sp->pp_tls)(sp); 2653 } 2654 2655 static void 2656 sppp_lcp_tlf(struct sppp *sp) 2657 { 2658 STDDCL; 2659 2660 sp->pp_phase = SPPP_PHASE_DEAD; 2661 2662 if (debug) 2663 { 2664 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 2665 sppp_phase_name(sp->pp_phase)); 2666 } 2667 2668 /* Notify lower layer if desired. */ 2669 if (sp->pp_tlf) 2670 (sp->pp_tlf)(sp); 2671 } 2672 2673 static void 2674 sppp_lcp_scr(struct sppp *sp) 2675 { 2676 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2677 int i = 0; 2678 u_short authproto; 2679 2680 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2681 if (! sp->lcp.magic) 2682 sp->lcp.magic = arc4random(); 2683 opt[i++] = LCP_OPT_MAGIC; 2684 opt[i++] = 6; 2685 opt[i++] = sp->lcp.magic >> 24; 2686 opt[i++] = sp->lcp.magic >> 16; 2687 opt[i++] = sp->lcp.magic >> 8; 2688 opt[i++] = sp->lcp.magic; 2689 } 2690 2691 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2692 opt[i++] = LCP_OPT_MRU; 2693 opt[i++] = 4; 2694 opt[i++] = sp->lcp.mru >> 8; 2695 opt[i++] = sp->lcp.mru; 2696 } 2697 2698 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2699 authproto = sp->hisauth.proto; 2700 opt[i++] = LCP_OPT_AUTH_PROTO; 2701 opt[i++] = authproto == PPP_CHAP? 5: 4; 2702 opt[i++] = authproto >> 8; 2703 opt[i++] = authproto; 2704 if (authproto == PPP_CHAP) 2705 opt[i++] = CHAP_MD5; 2706 } 2707 2708 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2709 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2710 } 2711 2712 /* 2713 * Check the open NCPs, return true if at least one NCP is open. 2714 */ 2715 static int 2716 sppp_ncp_check(struct sppp *sp) 2717 { 2718 int i, mask; 2719 2720 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2721 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2722 return 1; 2723 return 0; 2724 } 2725 2726 /* 2727 * Re-check the open NCPs and see if we should terminate the link. 2728 * Called by the NCPs during their tlf action handling. 2729 */ 2730 static void 2731 sppp_lcp_check_and_close(struct sppp *sp) 2732 { 2733 2734 if (sp->pp_phase < SPPP_PHASE_NETWORK) 2735 /* don't bother, we are already going down */ 2736 return; 2737 2738 if (sppp_ncp_check(sp)) 2739 return; 2740 2741 lcp.Close(sp); 2742 } 2743 2744 2745 /* 2746 *--------------------------------------------------------------------------* 2747 * * 2748 * The IPCP implementation. * 2749 * * 2750 *--------------------------------------------------------------------------* 2751 */ 2752 2753 static void 2754 sppp_ipcp_init(struct sppp *sp) 2755 { 2756 sp->ipcp.opts = 0; 2757 sp->ipcp.flags = 0; 2758 sp->state[IDX_IPCP] = STATE_INITIAL; 2759 sp->fail_counter[IDX_IPCP] = 0; 2760 sp->pp_seq[IDX_IPCP] = 0; 2761 sp->pp_rseq[IDX_IPCP] = 0; 2762 callout_init(&sp->ch[IDX_IPCP]); 2763 } 2764 2765 static void 2766 sppp_ipcp_up(struct sppp *sp) 2767 { 2768 sppp_up_event(&ipcp, sp); 2769 } 2770 2771 static void 2772 sppp_ipcp_down(struct sppp *sp) 2773 { 2774 sppp_down_event(&ipcp, sp); 2775 } 2776 2777 static void 2778 sppp_ipcp_open(struct sppp *sp) 2779 { 2780 STDDCL; 2781 u_int32_t myaddr, hisaddr; 2782 2783 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 2784 sp->ipcp.req_myaddr = 0; 2785 sp->ipcp.req_hisaddr = 0; 2786 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs); 2787 2788 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2789 /* 2790 * If we don't have his address, this probably means our 2791 * interface doesn't want to talk IP at all. (This could 2792 * be the case if somebody wants to speak only IPX, for 2793 * example.) Don't open IPCP in this case. 2794 */ 2795 if (hisaddr == 0L) { 2796 /* XXX this message should go away */ 2797 if (debug) 2798 log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n", 2799 ifp->if_xname); 2800 return; 2801 } 2802 2803 if (myaddr == 0) { 2804 /* 2805 * I don't have an assigned address, so i need to 2806 * negotiate my address. 2807 */ 2808 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2809 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2810 } 2811 if (hisaddr == 1) { 2812 /* 2813 * XXX - remove this hack! 2814 * remote has no valid address, we need to get one assigned. 2815 */ 2816 sp->ipcp.flags |= IPCP_HISADDR_DYN; 2817 } 2818 sppp_open_event(&ipcp, sp); 2819 } 2820 2821 static void 2822 sppp_ipcp_close(struct sppp *sp) 2823 { 2824 STDDCL; 2825 2826 sppp_close_event(&ipcp, sp); 2827 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 2828 /* 2829 * Some address was dynamic, clear it again. 2830 */ 2831 sppp_clear_ip_addrs(sp); 2832 2833 if (sp->pp_saved_mtu > 0) { 2834 ifp->if_mtu = sp->pp_saved_mtu; 2835 sp->pp_saved_mtu = 0; 2836 if (debug) 2837 log(LOG_DEBUG, 2838 "%s: resetting MTU to %" PRIu64 " bytes\n", 2839 ifp->if_xname, ifp->if_mtu); 2840 } 2841 } 2842 2843 static void 2844 sppp_ipcp_TO(void *cookie) 2845 { 2846 sppp_to_event(&ipcp, (struct sppp *)cookie); 2847 } 2848 2849 /* 2850 * Analyze a configure request. Return true if it was agreeable, and 2851 * caused action sca, false if it has been rejected or nak'ed, and 2852 * caused action scn. (The return value is used to make the state 2853 * transition decision in the state automaton.) 2854 */ 2855 static int 2856 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2857 { 2858 u_char *buf, *r, *p; 2859 struct ifnet *ifp = &sp->pp_if; 2860 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2861 u_int32_t hisaddr, desiredaddr; 2862 2863 len -= 4; 2864 origlen = len; 2865 /* 2866 * Make sure to allocate a buf that can at least hold a 2867 * conf-nak with an `address' option. We might need it below. 2868 */ 2869 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2870 if (! buf) 2871 return (0); 2872 2873 /* pass 1: see if we can recognize them */ 2874 if (debug) 2875 log(LOG_DEBUG, "%s: ipcp parse opts:", 2876 ifp->if_xname); 2877 p = (void *)(h + 1); 2878 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2879 /* Sanity check option length */ 2880 if (p[1] > len) { 2881 /* XXX should we just RXJ? */ 2882 addlog("%s: malicious IPCP option received, dropping\n", 2883 ifp->if_xname); 2884 goto drop; 2885 } 2886 if (debug) 2887 addlog(" %s", sppp_ipcp_opt_name(*p)); 2888 switch (*p) { 2889 #ifdef notyet 2890 case IPCP_OPT_COMPRESSION: 2891 if (len >= 6 && p[1] >= 6) { 2892 /* correctly formed compress option */ 2893 continue; 2894 } 2895 if (debug) 2896 addlog(" [invalid]"); 2897 break; 2898 #endif 2899 case IPCP_OPT_ADDRESS: 2900 if (len >= 6 && p[1] == 6) { 2901 /* correctly formed address option */ 2902 continue; 2903 } 2904 if (debug) 2905 addlog(" [invalid]"); 2906 break; 2907 default: 2908 /* Others not supported. */ 2909 if (debug) 2910 addlog(" [rej]"); 2911 break; 2912 } 2913 /* Add the option to rejected list. */ 2914 bcopy (p, r, p[1]); 2915 r += p[1]; 2916 rlen += p[1]; 2917 } 2918 if (rlen) { 2919 if (debug) 2920 addlog(" send conf-rej\n"); 2921 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2922 goto end; 2923 } else if (debug) 2924 addlog("\n"); 2925 2926 /* pass 2: parse option values */ 2927 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2928 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */ 2929 else 2930 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2931 if (debug) 2932 log(LOG_DEBUG, "%s: ipcp parse opt values: ", 2933 ifp->if_xname); 2934 p = (void *)(h + 1); 2935 len = origlen; 2936 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2937 if (debug) 2938 addlog(" %s", sppp_ipcp_opt_name(*p)); 2939 switch (*p) { 2940 #ifdef notyet 2941 case IPCP_OPT_COMPRESSION: 2942 continue; 2943 #endif 2944 case IPCP_OPT_ADDRESS: 2945 desiredaddr = p[2] << 24 | p[3] << 16 | 2946 p[4] << 8 | p[5]; 2947 if (desiredaddr == hisaddr || 2948 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) { 2949 /* 2950 * Peer's address is same as our value, 2951 * this is agreeable. Gonna conf-ack 2952 * it. 2953 */ 2954 if (debug) 2955 addlog(" %s [ack]", 2956 sppp_dotted_quad(hisaddr)); 2957 /* record that we've seen it already */ 2958 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2959 sp->ipcp.req_hisaddr = desiredaddr; 2960 hisaddr = desiredaddr; 2961 continue; 2962 } 2963 /* 2964 * The address wasn't agreeable. This is either 2965 * he sent us 0.0.0.0, asking to assign him an 2966 * address, or he send us another address not 2967 * matching our value. Either case, we gonna 2968 * conf-nak it with our value. 2969 */ 2970 if (debug) { 2971 if (desiredaddr == 0) 2972 addlog(" [addr requested]"); 2973 else 2974 addlog(" %s [not agreed]", 2975 sppp_dotted_quad(desiredaddr)); 2976 } 2977 2978 p[2] = hisaddr >> 24; 2979 p[3] = hisaddr >> 16; 2980 p[4] = hisaddr >> 8; 2981 p[5] = hisaddr; 2982 break; 2983 } 2984 /* Add the option to nak'ed list. */ 2985 bcopy (p, r, p[1]); 2986 r += p[1]; 2987 rlen += p[1]; 2988 } 2989 2990 /* 2991 * If we are about to conf-ack the request, but haven't seen 2992 * his address so far, gonna conf-nak it instead, with the 2993 * `address' option present and our idea of his address being 2994 * filled in there, to request negotiation of both addresses. 2995 * 2996 * XXX This can result in an endless req - nak loop if peer 2997 * doesn't want to send us his address. Q: What should we do 2998 * about it? XXX A: implement the max-failure counter. 2999 */ 3000 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 3001 buf[0] = IPCP_OPT_ADDRESS; 3002 buf[1] = 6; 3003 buf[2] = hisaddr >> 24; 3004 buf[3] = hisaddr >> 16; 3005 buf[4] = hisaddr >> 8; 3006 buf[5] = hisaddr; 3007 rlen = 6; 3008 if (debug) 3009 addlog(" still need hisaddr"); 3010 } 3011 3012 if (rlen) { 3013 if (debug) 3014 addlog(" send conf-nak\n"); 3015 sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 3016 } else { 3017 if (debug) 3018 addlog(" send conf-ack\n"); 3019 sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1); 3020 } 3021 3022 end: 3023 free(buf, M_TEMP); 3024 return (rlen == 0); 3025 3026 drop: 3027 free(buf, M_TEMP); 3028 return -1; 3029 } 3030 3031 /* 3032 * Analyze the IPCP Configure-Reject option list, and adjust our 3033 * negotiation. 3034 */ 3035 static void 3036 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3037 { 3038 u_char *buf, *p; 3039 struct ifnet *ifp = &sp->pp_if; 3040 int debug = ifp->if_flags & IFF_DEBUG; 3041 3042 len -= 4; 3043 buf = malloc (len, M_TEMP, M_NOWAIT); 3044 if (!buf) 3045 return; 3046 3047 if (debug) 3048 log(LOG_DEBUG, "%s: ipcp rej opts:", 3049 ifp->if_xname); 3050 3051 p = (void *)(h + 1); 3052 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3053 /* Sanity check option length */ 3054 if (p[1] > len) { 3055 /* XXX should we just RXJ? */ 3056 addlog("%s: malicious IPCP option received, dropping\n", 3057 ifp->if_xname); 3058 goto drop; 3059 } 3060 if (debug) 3061 addlog(" %s", sppp_ipcp_opt_name(*p)); 3062 switch (*p) { 3063 case IPCP_OPT_ADDRESS: 3064 /* 3065 * Peer doesn't grok address option. This is 3066 * bad. XXX Should we better give up here? 3067 */ 3068 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3069 break; 3070 #ifdef notyet 3071 case IPCP_OPT_COMPRESS: 3072 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 3073 break; 3074 #endif 3075 } 3076 } 3077 if (debug) 3078 addlog("\n"); 3079 drop: 3080 free(buf, M_TEMP); 3081 return; 3082 } 3083 3084 /* 3085 * Analyze the IPCP Configure-NAK option list, and adjust our 3086 * negotiation. 3087 */ 3088 static void 3089 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3090 { 3091 u_char *p; 3092 struct ifnet *ifp = &sp->pp_if; 3093 int debug = ifp->if_flags & IFF_DEBUG; 3094 u_int32_t wantaddr; 3095 3096 len -= 4; 3097 3098 if (debug) 3099 log(LOG_DEBUG, "%s: ipcp nak opts:", 3100 ifp->if_xname); 3101 3102 p = (void *)(h + 1); 3103 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3104 /* Sanity check option length */ 3105 if (p[1] > len) { 3106 /* XXX should we just RXJ? */ 3107 addlog("%s: malicious IPCP option received, dropping\n", 3108 ifp->if_xname); 3109 return; 3110 } 3111 if (debug) 3112 addlog(" %s", sppp_ipcp_opt_name(*p)); 3113 switch (*p) { 3114 case IPCP_OPT_ADDRESS: 3115 /* 3116 * Peer doesn't like our local IP address. See 3117 * if we can do something for him. We'll drop 3118 * him our address then. 3119 */ 3120 if (len >= 6 && p[1] == 6) { 3121 wantaddr = p[2] << 24 | p[3] << 16 | 3122 p[4] << 8 | p[5]; 3123 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3124 if (debug) 3125 addlog(" [wantaddr %s]", 3126 sppp_dotted_quad(wantaddr)); 3127 /* 3128 * When doing dynamic address assignment, 3129 * we accept his offer. Otherwise, we 3130 * ignore it and thus continue to negotiate 3131 * our already existing value. 3132 */ 3133 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3134 if (debug) 3135 addlog(" [agree]"); 3136 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3137 sp->ipcp.req_myaddr = wantaddr; 3138 } 3139 } 3140 break; 3141 3142 case IPCP_OPT_PRIMDNS: 3143 if (len >= 6 && p[1] == 6) { 3144 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 | 3145 p[4] << 8 | p[5]; 3146 } 3147 break; 3148 3149 case IPCP_OPT_SECDNS: 3150 if (len >= 6 && p[1] == 6) { 3151 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 | 3152 p[4] << 8 | p[5]; 3153 } 3154 break; 3155 #ifdef notyet 3156 case IPCP_OPT_COMPRESS: 3157 /* 3158 * Peer wants different compression parameters. 3159 */ 3160 break; 3161 #endif 3162 } 3163 } 3164 if (debug) 3165 addlog("\n"); 3166 } 3167 3168 static void 3169 sppp_ipcp_tlu(struct sppp *sp) 3170 { 3171 /* we are up. Set addresses and notify anyone interested */ 3172 STDDCL; 3173 u_int32_t myaddr, hisaddr; 3174 3175 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3176 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3177 myaddr = sp->ipcp.req_myaddr; 3178 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3179 hisaddr = sp->ipcp.req_hisaddr; 3180 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3181 3182 if (ifp->if_mtu > sp->lcp.their_mru) { 3183 sp->pp_saved_mtu = ifp->if_mtu; 3184 ifp->if_mtu = sp->lcp.their_mru; 3185 if (debug) 3186 log(LOG_DEBUG, 3187 "%s: setting MTU to %" PRIu64 " bytes\n", 3188 ifp->if_xname, ifp->if_mtu); 3189 } 3190 3191 if (sp->pp_con) 3192 sp->pp_con(sp); 3193 } 3194 3195 static void 3196 sppp_ipcp_tld(struct sppp *sp) 3197 { 3198 } 3199 3200 static void 3201 sppp_ipcp_tls(struct sppp *sp) 3202 { 3203 /* indicate to LCP that it must stay alive */ 3204 sp->lcp.protos |= (1 << IDX_IPCP); 3205 } 3206 3207 static void 3208 sppp_ipcp_tlf(struct sppp *sp) 3209 { 3210 /* we no longer need LCP */ 3211 sp->lcp.protos &= ~(1 << IDX_IPCP); 3212 } 3213 3214 static void 3215 sppp_ipcp_scr(struct sppp *sp) 3216 { 3217 char opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */]; 3218 u_int32_t ouraddr; 3219 int i = 0; 3220 3221 #ifdef notyet 3222 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3223 opt[i++] = IPCP_OPT_COMPRESSION; 3224 opt[i++] = 6; 3225 opt[i++] = 0; /* VJ header compression */ 3226 opt[i++] = 0x2d; /* VJ header compression */ 3227 opt[i++] = max_slot_id; 3228 opt[i++] = comp_slot_id; 3229 } 3230 #endif 3231 3232 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3233 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3234 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */ 3235 else 3236 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3237 opt[i++] = IPCP_OPT_ADDRESS; 3238 opt[i++] = 6; 3239 opt[i++] = ouraddr >> 24; 3240 opt[i++] = ouraddr >> 16; 3241 opt[i++] = ouraddr >> 8; 3242 opt[i++] = ouraddr; 3243 } 3244 3245 if (sp->query_dns & 1) { 3246 opt[i++] = IPCP_OPT_PRIMDNS; 3247 opt[i++] = 6; 3248 opt[i++] = sp->dns_addrs[0] >> 24; 3249 opt[i++] = sp->dns_addrs[0] >> 16; 3250 opt[i++] = sp->dns_addrs[0] >> 8; 3251 opt[i++] = sp->dns_addrs[0]; 3252 } 3253 if (sp->query_dns & 2) { 3254 opt[i++] = IPCP_OPT_SECDNS; 3255 opt[i++] = 6; 3256 opt[i++] = sp->dns_addrs[1] >> 24; 3257 opt[i++] = sp->dns_addrs[1] >> 16; 3258 opt[i++] = sp->dns_addrs[1] >> 8; 3259 opt[i++] = sp->dns_addrs[1]; 3260 } 3261 3262 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3263 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3264 } 3265 3266 3267 /* 3268 *--------------------------------------------------------------------------* 3269 * * 3270 * The IPv6CP implementation. * 3271 * * 3272 *--------------------------------------------------------------------------* 3273 */ 3274 3275 #ifdef INET6 3276 static void 3277 sppp_ipv6cp_init(struct sppp *sp) 3278 { 3279 sp->ipv6cp.opts = 0; 3280 sp->ipv6cp.flags = 0; 3281 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3282 sp->fail_counter[IDX_IPV6CP] = 0; 3283 sp->pp_seq[IDX_IPV6CP] = 0; 3284 sp->pp_rseq[IDX_IPV6CP] = 0; 3285 callout_init(&sp->ch[IDX_IPV6CP]); 3286 } 3287 3288 static void 3289 sppp_ipv6cp_up(struct sppp *sp) 3290 { 3291 sppp_up_event(&ipv6cp, sp); 3292 } 3293 3294 static void 3295 sppp_ipv6cp_down(struct sppp *sp) 3296 { 3297 sppp_down_event(&ipv6cp, sp); 3298 } 3299 3300 static void 3301 sppp_ipv6cp_open(struct sppp *sp) 3302 { 3303 STDDCL; 3304 struct in6_addr myaddr, hisaddr; 3305 3306 #ifdef IPV6CP_MYIFID_DYN 3307 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3308 #else 3309 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3310 #endif 3311 3312 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3313 /* 3314 * If we don't have our address, this probably means our 3315 * interface doesn't want to talk IPv6 at all. (This could 3316 * be the case if somebody wants to speak only IPX, for 3317 * example.) Don't open IPv6CP in this case. 3318 */ 3319 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3320 /* XXX this message should go away */ 3321 if (debug) 3322 log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n", 3323 ifp->if_xname); 3324 return; 3325 } 3326 3327 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3328 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3329 sppp_open_event(&ipv6cp, sp); 3330 } 3331 3332 static void 3333 sppp_ipv6cp_close(struct sppp *sp) 3334 { 3335 sppp_close_event(&ipv6cp, sp); 3336 } 3337 3338 static void 3339 sppp_ipv6cp_TO(void *cookie) 3340 { 3341 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3342 } 3343 3344 /* 3345 * Analyze a configure request. Return true if it was agreeable, and 3346 * caused action sca, false if it has been rejected or nak'ed, and 3347 * caused action scn. (The return value is used to make the state 3348 * transition decision in the state automaton.) 3349 */ 3350 static int 3351 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3352 { 3353 u_char *buf, *r, *p; 3354 struct ifnet *ifp = &sp->pp_if; 3355 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3356 struct in6_addr myaddr, desiredaddr, suggestaddr; 3357 int ifidcount; 3358 int type; 3359 int collision, nohisaddr; 3360 3361 len -= 4; 3362 origlen = len; 3363 /* 3364 * Make sure to allocate a buf that can at least hold a 3365 * conf-nak with an `address' option. We might need it below. 3366 */ 3367 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3368 if (! buf) 3369 return (0); 3370 3371 /* pass 1: see if we can recognize them */ 3372 if (debug) 3373 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3374 ifp->if_xname); 3375 p = (void *)(h + 1); 3376 ifidcount = 0; 3377 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3378 /* Sanity check option length */ 3379 if (p[1] > len) { 3380 /* XXX just RXJ? */ 3381 addlog("%s: received malicious IPCPv6 option, " 3382 "dropping\n", ifp->if_xname); 3383 goto drop; 3384 } 3385 if (debug) 3386 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3387 switch (*p) { 3388 case IPV6CP_OPT_IFID: 3389 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3390 /* correctly formed address option */ 3391 ifidcount++; 3392 continue; 3393 } 3394 if (debug) 3395 addlog(" [invalid]"); 3396 break; 3397 #ifdef notyet 3398 case IPV6CP_OPT_COMPRESSION: 3399 if (len >= 4 && p[1] >= 4) { 3400 /* correctly formed compress option */ 3401 continue; 3402 } 3403 if (debug) 3404 addlog(" [invalid]"); 3405 break; 3406 #endif 3407 default: 3408 /* Others not supported. */ 3409 if (debug) 3410 addlog(" [rej]"); 3411 break; 3412 } 3413 /* Add the option to rejected list. */ 3414 bcopy (p, r, p[1]); 3415 r += p[1]; 3416 rlen += p[1]; 3417 } 3418 if (rlen) { 3419 if (debug) 3420 addlog(" send conf-rej\n"); 3421 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3422 goto end; 3423 } else if (debug) 3424 addlog("\n"); 3425 3426 /* pass 2: parse option values */ 3427 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3428 if (debug) 3429 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3430 ifp->if_xname); 3431 p = (void *)(h + 1); 3432 len = origlen; 3433 type = CONF_ACK; 3434 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3435 if (debug) 3436 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3437 switch (*p) { 3438 #ifdef notyet 3439 case IPV6CP_OPT_COMPRESSION: 3440 continue; 3441 #endif 3442 case IPV6CP_OPT_IFID: 3443 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3444 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3445 collision = (memcmp(&desiredaddr.s6_addr[8], 3446 &myaddr.s6_addr[8], 8) == 0); 3447 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3448 3449 desiredaddr.s6_addr16[0] = htons(0xfe80); 3450 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3451 3452 if (!collision && !nohisaddr) { 3453 /* no collision, hisaddr known - Conf-Ack */ 3454 type = CONF_ACK; 3455 3456 if (debug) { 3457 addlog(" %s [%s]", 3458 ip6_sprintf(&desiredaddr), 3459 sppp_cp_type_name(type)); 3460 } 3461 continue; 3462 } 3463 3464 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3465 if (collision && nohisaddr) { 3466 /* collision, hisaddr unknown - Conf-Rej */ 3467 type = CONF_REJ; 3468 memset(&p[2], 0, 8); 3469 } else { 3470 /* 3471 * - no collision, hisaddr unknown, or 3472 * - collision, hisaddr known 3473 * Conf-Nak, suggest hisaddr 3474 */ 3475 type = CONF_NAK; 3476 sppp_suggest_ip6_addr(sp, &suggestaddr); 3477 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3478 } 3479 if (debug) 3480 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3481 sppp_cp_type_name(type)); 3482 break; 3483 } 3484 /* Add the option to nak'ed list. */ 3485 bcopy (p, r, p[1]); 3486 r += p[1]; 3487 rlen += p[1]; 3488 } 3489 3490 if (rlen == 0 && type == CONF_ACK) { 3491 if (debug) 3492 addlog(" send %s\n", sppp_cp_type_name(type)); 3493 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3494 } else { 3495 #ifdef notdef 3496 if (type == CONF_ACK) 3497 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3498 #endif 3499 3500 if (debug) { 3501 addlog(" send %s suggest %s\n", 3502 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3503 } 3504 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3505 } 3506 3507 end: 3508 free(buf, M_TEMP); 3509 return (rlen == 0); 3510 3511 drop: 3512 free(buf, M_TEMP); 3513 return -1; 3514 } 3515 3516 /* 3517 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3518 * negotiation. 3519 */ 3520 static void 3521 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3522 { 3523 u_char *buf, *p; 3524 struct ifnet *ifp = &sp->pp_if; 3525 int debug = ifp->if_flags & IFF_DEBUG; 3526 3527 len -= 4; 3528 buf = malloc (len, M_TEMP, M_NOWAIT); 3529 if (!buf) 3530 return; 3531 3532 if (debug) 3533 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3534 ifp->if_xname); 3535 3536 p = (void *)(h + 1); 3537 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3538 if (p[1] > len) { 3539 /* XXX just RXJ? */ 3540 addlog("%s: received malicious IPCPv6 option, " 3541 "dropping\n", ifp->if_xname); 3542 goto drop; 3543 } 3544 if (debug) 3545 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3546 switch (*p) { 3547 case IPV6CP_OPT_IFID: 3548 /* 3549 * Peer doesn't grok address option. This is 3550 * bad. XXX Should we better give up here? 3551 */ 3552 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3553 break; 3554 #ifdef notyet 3555 case IPV6CP_OPT_COMPRESS: 3556 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3557 break; 3558 #endif 3559 } 3560 } 3561 if (debug) 3562 addlog("\n"); 3563 drop: 3564 free(buf, M_TEMP); 3565 return; 3566 } 3567 3568 /* 3569 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3570 * negotiation. 3571 */ 3572 static void 3573 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3574 { 3575 u_char *buf, *p; 3576 struct ifnet *ifp = &sp->pp_if; 3577 int debug = ifp->if_flags & IFF_DEBUG; 3578 struct in6_addr suggestaddr; 3579 3580 len -= 4; 3581 buf = malloc (len, M_TEMP, M_NOWAIT); 3582 if (!buf) 3583 return; 3584 3585 if (debug) 3586 log(LOG_DEBUG, "%s: ipv6cp nak opts:", 3587 ifp->if_xname); 3588 3589 p = (void *)(h + 1); 3590 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3591 if (p[1] > len) { 3592 /* XXX just RXJ? */ 3593 addlog("%s: received malicious IPCPv6 option, " 3594 "dropping\n", ifp->if_xname); 3595 goto drop; 3596 } 3597 if (debug) 3598 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3599 switch (*p) { 3600 case IPV6CP_OPT_IFID: 3601 /* 3602 * Peer doesn't like our local ifid. See 3603 * if we can do something for him. We'll drop 3604 * him our address then. 3605 */ 3606 if (len < 10 || p[1] != 10) 3607 break; 3608 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3609 suggestaddr.s6_addr16[0] = htons(0xfe80); 3610 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3611 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3612 3613 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3614 if (debug) 3615 addlog(" [suggestaddr %s]", 3616 ip6_sprintf(&suggestaddr)); 3617 #ifdef IPV6CP_MYIFID_DYN 3618 /* 3619 * When doing dynamic address assignment, 3620 * we accept his offer. 3621 */ 3622 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3623 struct in6_addr lastsuggest; 3624 /* 3625 * If <suggested myaddr from peer> equals to 3626 * <hisaddr we have suggested last time>, 3627 * we have a collision. generate new random 3628 * ifid. 3629 */ 3630 sppp_suggest_ip6_addr(&lastsuggest); 3631 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3632 lastsuggest)) { 3633 if (debug) 3634 addlog(" [random]"); 3635 sppp_gen_ip6_addr(sp, &suggestaddr); 3636 } 3637 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3638 if (debug) 3639 addlog(" [agree]"); 3640 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3641 } 3642 #else 3643 /* 3644 * Since we do not do dynamic address assignment, 3645 * we ignore it and thus continue to negotiate 3646 * our already existing value. This can possibly 3647 * go into infinite request-reject loop. 3648 * 3649 * This is not likely because we normally use 3650 * ifid based on MAC-address. 3651 * If you have no ethernet card on the node, too bad. 3652 * XXX should we use fail_counter? 3653 */ 3654 #endif 3655 break; 3656 #ifdef notyet 3657 case IPV6CP_OPT_COMPRESS: 3658 /* 3659 * Peer wants different compression parameters. 3660 */ 3661 break; 3662 #endif 3663 } 3664 } 3665 if (debug) 3666 addlog("\n"); 3667 drop: 3668 free(buf, M_TEMP); 3669 return; 3670 } 3671 3672 static void 3673 sppp_ipv6cp_tlu(struct sppp *sp) 3674 { 3675 /* we are up - notify isdn daemon */ 3676 if (sp->pp_con) 3677 sp->pp_con(sp); 3678 } 3679 3680 static void 3681 sppp_ipv6cp_tld(struct sppp *sp) 3682 { 3683 } 3684 3685 static void 3686 sppp_ipv6cp_tls(struct sppp *sp) 3687 { 3688 /* indicate to LCP that it must stay alive */ 3689 sp->lcp.protos |= (1 << IDX_IPV6CP); 3690 } 3691 3692 static void 3693 sppp_ipv6cp_tlf(struct sppp *sp) 3694 { 3695 /* we no longer need LCP */ 3696 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3697 } 3698 3699 static void 3700 sppp_ipv6cp_scr(struct sppp *sp) 3701 { 3702 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3703 struct in6_addr ouraddr; 3704 int i = 0; 3705 3706 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3707 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3708 opt[i++] = IPV6CP_OPT_IFID; 3709 opt[i++] = 10; 3710 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3711 i += 8; 3712 } 3713 3714 #ifdef notyet 3715 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3716 opt[i++] = IPV6CP_OPT_COMPRESSION; 3717 opt[i++] = 4; 3718 opt[i++] = 0; /* TBD */ 3719 opt[i++] = 0; /* TBD */ 3720 /* variable length data may follow */ 3721 } 3722 #endif 3723 3724 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3725 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3726 } 3727 #else /*INET6*/ 3728 static void sppp_ipv6cp_init(struct sppp *sp) 3729 { 3730 } 3731 3732 static void sppp_ipv6cp_up(struct sppp *sp) 3733 { 3734 } 3735 3736 static void sppp_ipv6cp_down(struct sppp *sp) 3737 { 3738 } 3739 3740 3741 static void sppp_ipv6cp_open(struct sppp *sp) 3742 { 3743 } 3744 3745 static void sppp_ipv6cp_close(struct sppp *sp) 3746 { 3747 } 3748 3749 static void sppp_ipv6cp_TO(void *sp) 3750 { 3751 } 3752 3753 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3754 { 3755 return 0; 3756 } 3757 3758 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3759 { 3760 } 3761 3762 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3763 { 3764 } 3765 3766 static void sppp_ipv6cp_tlu(struct sppp *sp) 3767 { 3768 } 3769 3770 static void sppp_ipv6cp_tld(struct sppp *sp) 3771 { 3772 } 3773 3774 static void sppp_ipv6cp_tls(struct sppp *sp) 3775 { 3776 } 3777 3778 static void sppp_ipv6cp_tlf(struct sppp *sp) 3779 { 3780 } 3781 3782 static void sppp_ipv6cp_scr(struct sppp *sp) 3783 { 3784 } 3785 #endif /*INET6*/ 3786 3787 3788 /* 3789 *--------------------------------------------------------------------------* 3790 * * 3791 * The CHAP implementation. * 3792 * * 3793 *--------------------------------------------------------------------------* 3794 */ 3795 3796 /* 3797 * The authentication protocols don't employ a full-fledged state machine as 3798 * the control protocols do, since they do have Open and Close events, but 3799 * not Up and Down, nor are they explicitly terminated. Also, use of the 3800 * authentication protocols may be different in both directions (this makes 3801 * sense, think of a machine that never accepts incoming calls but only 3802 * calls out, it doesn't require the called party to authenticate itself). 3803 * 3804 * Our state machine for the local authentication protocol (we are requesting 3805 * the peer to authenticate) looks like: 3806 * 3807 * RCA- 3808 * +--------------------------------------------+ 3809 * V scn,tld| 3810 * +--------+ Close +---------+ RCA+ 3811 * | |<----------------------------------| |------+ 3812 * +--->| Closed | TO* | Opened | sca | 3813 * | | |-----+ +-------| |<-----+ 3814 * | +--------+ irc | | +---------+ 3815 * | ^ | | ^ 3816 * | | | | | 3817 * | | | | | 3818 * | TO-| | | | 3819 * | |tld TO+ V | | 3820 * | | +------->+ | | 3821 * | | | | | | 3822 * | +--------+ V | | 3823 * | | |<----+<--------------------+ | 3824 * | | Req- | scr | 3825 * | | Sent | | 3826 * | | | | 3827 * | +--------+ | 3828 * | RCA- | | RCA+ | 3829 * +------+ +------------------------------------------+ 3830 * scn,tld sca,irc,ict,tlu 3831 * 3832 * 3833 * with: 3834 * 3835 * Open: LCP reached authentication phase 3836 * Close: LCP reached terminate phase 3837 * 3838 * RCA+: received reply (pap-req, chap-response), acceptable 3839 * RCN: received reply (pap-req, chap-response), not acceptable 3840 * TO+: timeout with restart counter >= 0 3841 * TO-: timeout with restart counter < 0 3842 * TO*: reschedule timeout for CHAP 3843 * 3844 * scr: send request packet (none for PAP, chap-challenge) 3845 * sca: send ack packet (pap-ack, chap-success) 3846 * scn: send nak packet (pap-nak, chap-failure) 3847 * ict: initialize re-challenge timer (CHAP only) 3848 * 3849 * tlu: this-layer-up, LCP reaches network phase 3850 * tld: this-layer-down, LCP enters terminate phase 3851 * 3852 * Note that in CHAP mode, after sending a new challenge, while the state 3853 * automaton falls back into Req-Sent state, it doesn't signal a tld 3854 * event to LCP, so LCP remains in network phase. Only after not getting 3855 * any response (or after getting an unacceptable response), CHAP closes, 3856 * causing LCP to enter terminate phase. 3857 * 3858 * With PAP, there is no initial request that can be sent. The peer is 3859 * expected to send one based on the successful negotiation of PAP as 3860 * the authentication protocol during the LCP option negotiation. 3861 * 3862 * Incoming authentication protocol requests (remote requests 3863 * authentication, we are peer) don't employ a state machine at all, 3864 * they are simply answered. Some peers [Ascend P50 firmware rev 3865 * 4.50] react allergically when sending IPCP/IPv6CP requests while they are 3866 * still in authentication phase (thereby violating the standard that 3867 * demands that these NCP packets are to be discarded), so we keep 3868 * track of the peer demanding us to authenticate, and only proceed to 3869 * phase network once we've seen a positive acknowledge for the 3870 * authentication. 3871 */ 3872 3873 /* 3874 * Handle incoming CHAP packets. 3875 */ 3876 void 3877 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3878 { 3879 STDDCL; 3880 struct lcp_header *h; 3881 int len, x; 3882 u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize; 3883 int value_len, name_len; 3884 MD5_CTX ctx; 3885 3886 len = m->m_pkthdr.len; 3887 if (len < 4) { 3888 if (debug) 3889 log(LOG_DEBUG, 3890 "%s: chap invalid packet length: %d bytes\n", 3891 ifp->if_xname, len); 3892 return; 3893 } 3894 h = mtod(m, struct lcp_header *); 3895 if (len > ntohs(h->len)) 3896 len = ntohs(h->len); 3897 3898 switch (h->type) { 3899 /* challenge, failure and success are his authproto */ 3900 case CHAP_CHALLENGE: 3901 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 3902 /* can't do anything usefull */ 3903 sp->pp_auth_failures++; 3904 printf("%s: chap input without my name and my secret being set\n", 3905 ifp->if_xname); 3906 break; 3907 } 3908 value = 1 + (u_char *)(h + 1); 3909 value_len = value[-1]; 3910 name = value + value_len; 3911 name_len = len - value_len - 5; 3912 if (name_len < 0) { 3913 if (debug) { 3914 log(LOG_DEBUG, 3915 "%s: chap corrupted challenge " 3916 "<%s id=0x%x len=%d", 3917 ifp->if_xname, 3918 sppp_auth_type_name(PPP_CHAP, h->type), 3919 h->ident, ntohs(h->len)); 3920 if (len > 4) 3921 sppp_print_bytes((u_char *)(h + 1), 3922 len - 4); 3923 addlog(">\n"); 3924 } 3925 break; 3926 } 3927 3928 if (debug) { 3929 log(LOG_DEBUG, 3930 "%s: chap input <%s id=0x%x len=%d name=", 3931 ifp->if_xname, 3932 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3933 ntohs(h->len)); 3934 sppp_print_string((char *) name, name_len); 3935 addlog(" value-size=%d value=", value_len); 3936 sppp_print_bytes(value, value_len); 3937 addlog(">\n"); 3938 } 3939 3940 /* Compute reply value. */ 3941 MD5Init(&ctx); 3942 MD5Update(&ctx, &h->ident, 1); 3943 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len); 3944 MD5Update(&ctx, value, value_len); 3945 MD5Final(digest, &ctx); 3946 dsize = sizeof digest; 3947 3948 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3949 sizeof dsize, (const char *)&dsize, 3950 sizeof digest, digest, 3951 sp->myauth.name_len, 3952 sp->myauth.name, 3953 0); 3954 break; 3955 3956 case CHAP_SUCCESS: 3957 if (debug) { 3958 log(LOG_DEBUG, "%s: chap success", 3959 ifp->if_xname); 3960 if (len > 4) { 3961 addlog(": "); 3962 sppp_print_string((char *)(h + 1), len - 4); 3963 } 3964 addlog("\n"); 3965 } 3966 x = splnet(); 3967 sp->pp_auth_failures = 0; 3968 sp->pp_flags &= ~PP_NEEDAUTH; 3969 if (sp->myauth.proto == PPP_CHAP && 3970 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3971 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3972 /* 3973 * We are authenticator for CHAP but didn't 3974 * complete yet. Leave it to tlu to proceed 3975 * to network phase. 3976 */ 3977 splx(x); 3978 break; 3979 } 3980 splx(x); 3981 sppp_phase_network(sp); 3982 break; 3983 3984 case CHAP_FAILURE: 3985 x = splnet(); 3986 sp->pp_auth_failures++; 3987 splx(x); 3988 if (debug) { 3989 log(LOG_INFO, "%s: chap failure", 3990 ifp->if_xname); 3991 if (len > 4) { 3992 addlog(": "); 3993 sppp_print_string((char *)(h + 1), len - 4); 3994 } 3995 addlog("\n"); 3996 } else 3997 log(LOG_INFO, "%s: chap failure\n", 3998 ifp->if_xname); 3999 /* await LCP shutdown by authenticator */ 4000 break; 4001 4002 /* response is my authproto */ 4003 case CHAP_RESPONSE: 4004 if (sp->hisauth.secret == NULL) { 4005 /* can't do anything usefull */ 4006 printf("%s: chap input without his secret being set\n", 4007 ifp->if_xname); 4008 break; 4009 } 4010 value = 1 + (u_char *)(h + 1); 4011 value_len = value[-1]; 4012 name = value + value_len; 4013 name_len = len - value_len - 5; 4014 if (name_len < 0) { 4015 if (debug) { 4016 log(LOG_DEBUG, 4017 "%s: chap corrupted response " 4018 "<%s id=0x%x len=%d", 4019 ifp->if_xname, 4020 sppp_auth_type_name(PPP_CHAP, h->type), 4021 h->ident, ntohs(h->len)); 4022 if (len > 4) 4023 sppp_print_bytes((u_char *)(h + 1), 4024 len - 4); 4025 addlog(">\n"); 4026 } 4027 break; 4028 } 4029 if (h->ident != sp->confid[IDX_CHAP]) { 4030 if (debug) 4031 log(LOG_DEBUG, 4032 "%s: chap dropping response for old ID " 4033 "(got %d, expected %d)\n", 4034 ifp->if_xname, 4035 h->ident, sp->confid[IDX_CHAP]); 4036 break; 4037 } 4038 if (sp->hisauth.name != NULL && 4039 (name_len != sp->hisauth.name_len 4040 || memcmp(name, sp->hisauth.name, name_len) != 0)) { 4041 log(LOG_INFO, "%s: chap response, his name ", 4042 ifp->if_xname); 4043 sppp_print_string(name, name_len); 4044 addlog(" != expected "); 4045 sppp_print_string(sp->hisauth.name, 4046 sp->hisauth.name_len); 4047 addlog("\n"); 4048 goto chap_failure; 4049 } 4050 if (debug) { 4051 log(LOG_DEBUG, "%s: chap input(%s) " 4052 "<%s id=0x%x len=%d name=", 4053 ifp->if_xname, 4054 sppp_state_name(sp->state[IDX_CHAP]), 4055 sppp_auth_type_name(PPP_CHAP, h->type), 4056 h->ident, ntohs(h->len)); 4057 sppp_print_string((char *)name, name_len); 4058 addlog(" value-size=%d value=", value_len); 4059 sppp_print_bytes(value, value_len); 4060 addlog(">\n"); 4061 } 4062 if (value_len != sizeof(sp->myauth.challenge)) { 4063 if (debug) 4064 log(LOG_DEBUG, 4065 "%s: chap bad hash value length: " 4066 "%d bytes, should be %ld\n", 4067 ifp->if_xname, value_len, 4068 (long) sizeof(sp->myauth.challenge)); 4069 goto chap_failure; 4070 } 4071 4072 MD5Init(&ctx); 4073 MD5Update(&ctx, &h->ident, 1); 4074 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len); 4075 MD5Update(&ctx, sp->myauth.challenge, sizeof(sp->myauth.challenge)); 4076 MD5Final(digest, &ctx); 4077 4078 #define FAILMSG "Failed..." 4079 #define SUCCMSG "Welcome!" 4080 4081 if (value_len != sizeof digest || 4082 memcmp(digest, value, value_len) != 0) { 4083 chap_failure: 4084 /* action scn, tld */ 4085 x = splnet(); 4086 sp->pp_auth_failures++; 4087 splx(x); 4088 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4089 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4090 0); 4091 chap.tld(sp); 4092 break; 4093 } 4094 sp->pp_auth_failures = 0; 4095 /* action sca, perhaps tlu */ 4096 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4097 sp->state[IDX_CHAP] == STATE_OPENED) 4098 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4099 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4100 0); 4101 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4102 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4103 chap.tlu(sp); 4104 } 4105 break; 4106 4107 default: 4108 /* Unknown CHAP packet type -- ignore. */ 4109 if (debug) { 4110 log(LOG_DEBUG, "%s: chap unknown input(%s) " 4111 "<0x%x id=0x%xh len=%d", 4112 ifp->if_xname, 4113 sppp_state_name(sp->state[IDX_CHAP]), 4114 h->type, h->ident, ntohs(h->len)); 4115 if (len > 4) 4116 sppp_print_bytes((u_char *)(h + 1), len - 4); 4117 addlog(">\n"); 4118 } 4119 break; 4120 4121 } 4122 } 4123 4124 static void 4125 sppp_chap_init(struct sppp *sp) 4126 { 4127 /* Chap doesn't have STATE_INITIAL at all. */ 4128 sp->state[IDX_CHAP] = STATE_CLOSED; 4129 sp->fail_counter[IDX_CHAP] = 0; 4130 sp->pp_seq[IDX_CHAP] = 0; 4131 sp->pp_rseq[IDX_CHAP] = 0; 4132 callout_init(&sp->ch[IDX_CHAP]); 4133 } 4134 4135 static void 4136 sppp_chap_open(struct sppp *sp) 4137 { 4138 if (sp->myauth.proto == PPP_CHAP && 4139 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4140 /* we are authenticator for CHAP, start it */ 4141 chap.scr(sp); 4142 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4143 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4144 } 4145 /* nothing to be done if we are peer, await a challenge */ 4146 } 4147 4148 static void 4149 sppp_chap_close(struct sppp *sp) 4150 { 4151 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4152 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4153 } 4154 4155 static void 4156 sppp_chap_TO(void *cookie) 4157 { 4158 struct sppp *sp = (struct sppp *)cookie; 4159 STDDCL; 4160 int s; 4161 4162 s = splnet(); 4163 if (debug) 4164 log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n", 4165 ifp->if_xname, 4166 sppp_state_name(sp->state[IDX_CHAP]), 4167 sp->rst_counter[IDX_CHAP]); 4168 4169 if (--sp->rst_counter[IDX_CHAP] < 0) 4170 /* TO- event */ 4171 switch (sp->state[IDX_CHAP]) { 4172 case STATE_REQ_SENT: 4173 chap.tld(sp); 4174 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4175 break; 4176 } 4177 else 4178 /* TO+ (or TO*) event */ 4179 switch (sp->state[IDX_CHAP]) { 4180 case STATE_OPENED: 4181 /* TO* event */ 4182 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4183 /* fall through */ 4184 case STATE_REQ_SENT: 4185 chap.scr(sp); 4186 /* sppp_cp_change_state() will restart the timer */ 4187 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4188 break; 4189 } 4190 4191 splx(s); 4192 } 4193 4194 static void 4195 sppp_chap_tlu(struct sppp *sp) 4196 { 4197 STDDCL; 4198 int i, x; 4199 4200 i = 0; 4201 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4202 4203 /* 4204 * Some broken CHAP implementations (Conware CoNet, firmware 4205 * 4.0.?) don't want to re-authenticate their CHAP once the 4206 * initial challenge-response exchange has taken place. 4207 * Provide for an option to avoid rechallenges. 4208 */ 4209 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) { 4210 /* 4211 * Compute the re-challenge timeout. This will yield 4212 * a number between 300 and 810 seconds. 4213 */ 4214 i = 300 + ((unsigned)(arc4random() & 0xff00) >> 7); 4215 4216 callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp); 4217 } 4218 4219 if (debug) { 4220 log(LOG_DEBUG, 4221 "%s: chap %s, ", 4222 ifp->if_xname, 4223 sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu"); 4224 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) 4225 addlog("next re-challenge in %d seconds\n", i); 4226 else 4227 addlog("re-challenging supressed\n"); 4228 } 4229 4230 x = splnet(); 4231 sp->pp_auth_failures = 0; 4232 /* indicate to LCP that we need to be closed down */ 4233 sp->lcp.protos |= (1 << IDX_CHAP); 4234 4235 if (sp->pp_flags & PP_NEEDAUTH) { 4236 /* 4237 * Remote is authenticator, but his auth proto didn't 4238 * complete yet. Defer the transition to network 4239 * phase. 4240 */ 4241 splx(x); 4242 return; 4243 } 4244 splx(x); 4245 4246 /* 4247 * If we are already in phase network, we are done here. This 4248 * is the case if this is a dummy tlu event after a re-challenge. 4249 */ 4250 if (sp->pp_phase != SPPP_PHASE_NETWORK) 4251 sppp_phase_network(sp); 4252 } 4253 4254 static void 4255 sppp_chap_tld(struct sppp *sp) 4256 { 4257 STDDCL; 4258 4259 if (debug) 4260 log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname); 4261 callout_stop(&sp->ch[IDX_CHAP]); 4262 sp->lcp.protos &= ~(1 << IDX_CHAP); 4263 4264 lcp.Close(sp); 4265 } 4266 4267 static void 4268 sppp_chap_scr(struct sppp *sp) 4269 { 4270 u_int32_t *ch; 4271 u_char clen; 4272 4273 if (sp->myauth.name == NULL) { 4274 /* can't do anything usefull */ 4275 printf("%s: chap starting without my name being set\n", 4276 sp->pp_if.if_xname); 4277 return; 4278 } 4279 4280 /* Compute random challenge. */ 4281 ch = (u_int32_t *)sp->myauth.challenge; 4282 ch[0] = arc4random(); 4283 ch[1] = arc4random(); 4284 ch[2] = arc4random(); 4285 ch[3] = arc4random(); 4286 clen = 16; /* 4 * sizeof(u_int32_t) */ 4287 4288 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4289 4290 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4291 sizeof clen, (const char *)&clen, 4292 sizeof(sp->myauth.challenge), sp->myauth.challenge, 4293 sp->myauth.name_len, 4294 sp->myauth.name, 4295 0); 4296 } 4297 4298 /* 4299 *--------------------------------------------------------------------------* 4300 * * 4301 * The PAP implementation. * 4302 * * 4303 *--------------------------------------------------------------------------* 4304 */ 4305 /* 4306 * For PAP, we need to keep a little state also if we are the peer, not the 4307 * authenticator. This is since we don't get a request to authenticate, but 4308 * have to repeatedly authenticate ourself until we got a response (or the 4309 * retry counter is expired). 4310 */ 4311 4312 /* 4313 * Handle incoming PAP packets. */ 4314 static void 4315 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4316 { 4317 STDDCL; 4318 struct lcp_header *h; 4319 int len, x; 4320 u_char mlen; 4321 char *name, *secret; 4322 int name_len, secret_len; 4323 4324 /* 4325 * Malicious input might leave this uninitialized, so 4326 * init to an impossible value. 4327 */ 4328 secret_len = -1; 4329 4330 len = m->m_pkthdr.len; 4331 if (len < 5) { 4332 if (debug) 4333 log(LOG_DEBUG, 4334 "%s: pap invalid packet length: %d bytes\n", 4335 ifp->if_xname, len); 4336 return; 4337 } 4338 h = mtod(m, struct lcp_header *); 4339 if (len > ntohs(h->len)) 4340 len = ntohs(h->len); 4341 switch (h->type) { 4342 /* PAP request is my authproto */ 4343 case PAP_REQ: 4344 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) { 4345 /* can't do anything usefull */ 4346 printf("%s: pap request without his name and his secret being set\n", 4347 ifp->if_xname); 4348 break; 4349 } 4350 name = 1 + (u_char *)(h + 1); 4351 name_len = name[-1]; 4352 secret = name + name_len + 1; 4353 if (name_len > len - 6 || 4354 (secret_len = secret[-1]) > len - 6 - name_len) { 4355 if (debug) { 4356 log(LOG_DEBUG, "%s: pap corrupted input " 4357 "<%s id=0x%x len=%d", 4358 ifp->if_xname, 4359 sppp_auth_type_name(PPP_PAP, h->type), 4360 h->ident, ntohs(h->len)); 4361 if (len > 4) 4362 sppp_print_bytes((u_char *)(h + 1), 4363 len - 4); 4364 addlog(">\n"); 4365 } 4366 break; 4367 } 4368 if (debug) { 4369 log(LOG_DEBUG, "%s: pap input(%s) " 4370 "<%s id=0x%x len=%d name=", 4371 ifp->if_xname, 4372 sppp_state_name(sp->state[IDX_PAP]), 4373 sppp_auth_type_name(PPP_PAP, h->type), 4374 h->ident, ntohs(h->len)); 4375 sppp_print_string((char *)name, name_len); 4376 addlog(" secret="); 4377 sppp_print_string((char *)secret, secret_len); 4378 addlog(">\n"); 4379 } 4380 if (name_len != sp->hisauth.name_len || 4381 secret_len != sp->hisauth.secret_len || 4382 memcmp(name, sp->hisauth.name, name_len) != 0 || 4383 memcmp(secret, sp->hisauth.secret, secret_len) != 0) { 4384 /* action scn, tld */ 4385 sp->pp_auth_failures++; 4386 mlen = sizeof(FAILMSG) - 1; 4387 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4388 sizeof mlen, (const char *)&mlen, 4389 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4390 0); 4391 pap.tld(sp); 4392 break; 4393 } 4394 /* action sca, perhaps tlu */ 4395 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4396 sp->state[IDX_PAP] == STATE_OPENED) { 4397 mlen = sizeof(SUCCMSG) - 1; 4398 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4399 sizeof mlen, (const char *)&mlen, 4400 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4401 0); 4402 } 4403 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4404 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4405 pap.tlu(sp); 4406 } 4407 break; 4408 4409 /* ack and nak are his authproto */ 4410 case PAP_ACK: 4411 callout_stop(&sp->pap_my_to_ch); 4412 if (debug) { 4413 log(LOG_DEBUG, "%s: pap success", 4414 ifp->if_xname); 4415 name = 1 + (u_char *)(h + 1); 4416 name_len = name[-1]; 4417 if (len > 5 && name_len < len+4) { 4418 addlog(": "); 4419 sppp_print_string(name, name_len); 4420 } 4421 addlog("\n"); 4422 } 4423 x = splnet(); 4424 sp->pp_auth_failures = 0; 4425 sp->pp_flags &= ~PP_NEEDAUTH; 4426 if (sp->myauth.proto == PPP_PAP && 4427 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4428 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4429 /* 4430 * We are authenticator for PAP but didn't 4431 * complete yet. Leave it to tlu to proceed 4432 * to network phase. 4433 */ 4434 splx(x); 4435 break; 4436 } 4437 splx(x); 4438 sppp_phase_network(sp); 4439 break; 4440 4441 case PAP_NAK: 4442 callout_stop(&sp->pap_my_to_ch); 4443 sp->pp_auth_failures++; 4444 if (debug) { 4445 log(LOG_INFO, "%s: pap failure", 4446 ifp->if_xname); 4447 name = 1 + (u_char *)(h + 1); 4448 name_len = name[-1]; 4449 if (len > 5 && name_len < len+4) { 4450 addlog(": "); 4451 sppp_print_string(name, name_len); 4452 } 4453 addlog("\n"); 4454 } else 4455 log(LOG_INFO, "%s: pap failure\n", 4456 ifp->if_xname); 4457 /* await LCP shutdown by authenticator */ 4458 break; 4459 4460 default: 4461 /* Unknown PAP packet type -- ignore. */ 4462 if (debug) { 4463 log(LOG_DEBUG, "%s: pap corrupted input " 4464 "<0x%x id=0x%x len=%d", 4465 ifp->if_xname, 4466 h->type, h->ident, ntohs(h->len)); 4467 if (len > 4) 4468 sppp_print_bytes((u_char *)(h + 1), len - 4); 4469 addlog(">\n"); 4470 } 4471 break; 4472 4473 } 4474 } 4475 4476 static void 4477 sppp_pap_init(struct sppp *sp) 4478 { 4479 /* PAP doesn't have STATE_INITIAL at all. */ 4480 sp->state[IDX_PAP] = STATE_CLOSED; 4481 sp->fail_counter[IDX_PAP] = 0; 4482 sp->pp_seq[IDX_PAP] = 0; 4483 sp->pp_rseq[IDX_PAP] = 0; 4484 callout_init(&sp->ch[IDX_PAP]); 4485 callout_init(&sp->pap_my_to_ch); 4486 } 4487 4488 static void 4489 sppp_pap_open(struct sppp *sp) 4490 { 4491 if (sp->hisauth.proto == PPP_PAP && 4492 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4493 /* we are authenticator for PAP, start our timer */ 4494 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4495 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4496 } 4497 if (sp->myauth.proto == PPP_PAP) { 4498 /* we are peer, send a request, and start a timer */ 4499 pap.scr(sp); 4500 callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout, 4501 sppp_pap_my_TO, sp); 4502 } 4503 } 4504 4505 static void 4506 sppp_pap_close(struct sppp *sp) 4507 { 4508 if (sp->state[IDX_PAP] != STATE_CLOSED) 4509 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4510 } 4511 4512 /* 4513 * That's the timeout routine if we are authenticator. Since the 4514 * authenticator is basically passive in PAP, we can't do much here. 4515 */ 4516 static void 4517 sppp_pap_TO(void *cookie) 4518 { 4519 struct sppp *sp = (struct sppp *)cookie; 4520 STDDCL; 4521 int s; 4522 4523 s = splnet(); 4524 if (debug) 4525 log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n", 4526 ifp->if_xname, 4527 sppp_state_name(sp->state[IDX_PAP]), 4528 sp->rst_counter[IDX_PAP]); 4529 4530 if (--sp->rst_counter[IDX_PAP] < 0) 4531 /* TO- event */ 4532 switch (sp->state[IDX_PAP]) { 4533 case STATE_REQ_SENT: 4534 pap.tld(sp); 4535 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4536 break; 4537 } 4538 else 4539 /* TO+ event, not very much we could do */ 4540 switch (sp->state[IDX_PAP]) { 4541 case STATE_REQ_SENT: 4542 /* sppp_cp_change_state() will restart the timer */ 4543 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4544 break; 4545 } 4546 4547 splx(s); 4548 } 4549 4550 /* 4551 * That's the timeout handler if we are peer. Since the peer is active, 4552 * we need to retransmit our PAP request since it is apparently lost. 4553 * XXX We should impose a max counter. 4554 */ 4555 static void 4556 sppp_pap_my_TO(void *cookie) 4557 { 4558 struct sppp *sp = (struct sppp *)cookie; 4559 STDDCL; 4560 4561 if (debug) 4562 log(LOG_DEBUG, "%s: pap peer TO\n", 4563 ifp->if_xname); 4564 4565 pap.scr(sp); 4566 } 4567 4568 static void 4569 sppp_pap_tlu(struct sppp *sp) 4570 { 4571 STDDCL; 4572 int x; 4573 4574 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4575 4576 if (debug) 4577 log(LOG_DEBUG, "%s: %s tlu\n", 4578 ifp->if_xname, pap.name); 4579 4580 x = splnet(); 4581 sp->pp_auth_failures = 0; 4582 /* indicate to LCP that we need to be closed down */ 4583 sp->lcp.protos |= (1 << IDX_PAP); 4584 4585 if (sp->pp_flags & PP_NEEDAUTH) { 4586 /* 4587 * Remote is authenticator, but his auth proto didn't 4588 * complete yet. Defer the transition to network 4589 * phase. 4590 */ 4591 splx(x); 4592 return; 4593 } 4594 splx(x); 4595 sppp_phase_network(sp); 4596 } 4597 4598 static void 4599 sppp_pap_tld(struct sppp *sp) 4600 { 4601 STDDCL; 4602 4603 if (debug) 4604 log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname); 4605 callout_stop(&sp->ch[IDX_PAP]); 4606 callout_stop(&sp->pap_my_to_ch); 4607 sp->lcp.protos &= ~(1 << IDX_PAP); 4608 4609 lcp.Close(sp); 4610 } 4611 4612 static void 4613 sppp_pap_scr(struct sppp *sp) 4614 { 4615 u_char idlen, pwdlen; 4616 4617 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) { 4618 /* can't do anything usefull */ 4619 printf("%s: pap starting without my name and secret being set\n", 4620 sp->pp_if.if_xname); 4621 return; 4622 } 4623 4624 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4625 pwdlen = sp->myauth.secret_len; 4626 idlen = sp->myauth.name_len; 4627 4628 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4629 sizeof idlen, (const char *)&idlen, 4630 idlen, sp->myauth.name, 4631 sizeof pwdlen, (const char *)&pwdlen, 4632 pwdlen, sp->myauth.secret, 4633 0); 4634 } 4635 4636 /* 4637 * Random miscellaneous functions. 4638 */ 4639 4640 /* 4641 * Send a PAP or CHAP proto packet. 4642 * 4643 * Varadic function, each of the elements for the ellipsis is of type 4644 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4645 * mlen == 0. 4646 * NOTE: never declare variadic functions with types subject to type 4647 * promotion (i.e. u_char). This is asking for big trouble depending 4648 * on the architecture you are on... 4649 */ 4650 4651 static void 4652 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4653 unsigned int type, unsigned int id, 4654 ...) 4655 { 4656 STDDCL; 4657 struct lcp_header *lh; 4658 struct mbuf *m; 4659 u_char *p; 4660 int len; 4661 size_t pkthdrlen; 4662 unsigned int mlen; 4663 const char *msg; 4664 va_list ap; 4665 4666 MGETHDR(m, M_DONTWAIT, MT_DATA); 4667 if (! m) 4668 return; 4669 m->m_pkthdr.rcvif = 0; 4670 4671 if (sp->pp_flags & PP_NOFRAMING) { 4672 *mtod(m, u_int16_t *) = htons(cp->proto); 4673 pkthdrlen = 2; 4674 lh = (struct lcp_header *)(mtod(m, u_int8_t *)+2); 4675 } else { 4676 struct ppp_header *h; 4677 h = mtod(m, struct ppp_header *); 4678 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4679 h->control = PPP_UI; /* Unnumbered Info */ 4680 h->protocol = htons(cp->proto); 4681 pkthdrlen = PPP_HEADER_LEN; 4682 4683 lh = (struct lcp_header *)(h + 1); 4684 } 4685 4686 lh->type = type; 4687 lh->ident = id; 4688 p = (u_char *)(lh + 1); 4689 4690 va_start(ap, id); 4691 len = 0; 4692 4693 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4694 msg = va_arg(ap, const char *); 4695 len += mlen; 4696 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4697 va_end(ap); 4698 m_freem(m); 4699 return; 4700 } 4701 4702 bcopy(msg, p, mlen); 4703 p += mlen; 4704 } 4705 va_end(ap); 4706 4707 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4708 lh->len = htons(LCP_HEADER_LEN + len); 4709 4710 if (debug) { 4711 log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d", 4712 ifp->if_xname, cp->name, 4713 sppp_auth_type_name(cp->proto, lh->type), 4714 lh->ident, ntohs(lh->len)); 4715 if (len) 4716 sppp_print_bytes((u_char *)(lh + 1), len); 4717 addlog(">\n"); 4718 } 4719 if (IF_QFULL(&sp->pp_cpq)) { 4720 IF_DROP(&sp->pp_fastq); 4721 IF_DROP(&ifp->if_snd); 4722 m_freem(m); 4723 ++ifp->if_oerrors; 4724 return; 4725 } else 4726 IF_ENQUEUE(&sp->pp_cpq, m); 4727 if (! (ifp->if_flags & IFF_OACTIVE)) 4728 (*ifp->if_start)(ifp); 4729 ifp->if_obytes += m->m_pkthdr.len + 3; 4730 } 4731 4732 /* 4733 * Send keepalive packets, every 10 seconds. 4734 */ 4735 static void 4736 sppp_keepalive(void *dummy) 4737 { 4738 struct sppp *sp; 4739 int s; 4740 time_t now; 4741 4742 s = splnet(); 4743 now = mono_time.tv_sec; 4744 for (sp=spppq; sp; sp=sp->pp_next) { 4745 struct ifnet *ifp = &sp->pp_if; 4746 4747 /* check idle timeout */ 4748 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING) 4749 && (sp->pp_phase == SPPP_PHASE_NETWORK)) { 4750 /* idle timeout is enabled for this interface */ 4751 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) { 4752 if (ifp->if_flags & IFF_DEBUG) 4753 printf("%s: no activitiy for %lu seconds\n", 4754 sp->pp_if.if_xname, 4755 (unsigned long)(now-sp->pp_last_activity)); 4756 lcp.Close(sp); 4757 continue; 4758 } 4759 } 4760 4761 /* Keepalive mode disabled or channel down? */ 4762 if (! (sp->pp_flags & PP_KEEPALIVE) || 4763 ! (ifp->if_flags & IFF_RUNNING)) 4764 continue; 4765 4766 /* No keepalive in PPP mode if LCP not opened yet. */ 4767 if (! (sp->pp_flags & PP_CISCO) && 4768 sp->pp_phase < SPPP_PHASE_AUTHENTICATE) 4769 continue; 4770 4771 /* No echo reply, but maybe user data passed through? */ 4772 if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) { 4773 sp->pp_alivecnt = 0; 4774 continue; 4775 } 4776 4777 if (sp->pp_alivecnt >= sp->pp_maxalive) { 4778 /* No keepalive packets got. Stop the interface. */ 4779 if_down (ifp); 4780 IF_PURGE(&sp->pp_cpq); 4781 if (! (sp->pp_flags & PP_CISCO)) { 4782 printf("%s: LCP keepalive timed out, going to restart the connection\n", 4783 ifp->if_xname); 4784 sp->pp_alivecnt = 0; 4785 4786 /* we are down, close all open protocols */ 4787 lcp.Close(sp); 4788 4789 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4790 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4791 4792 /* Close connection imediatly, completition of this 4793 * will summon the magic needed to reestablish it. */ 4794 sp->pp_tlf(sp); 4795 continue; 4796 } 4797 } 4798 if (sp->pp_alivecnt < sp->pp_maxalive) 4799 ++sp->pp_alivecnt; 4800 if (sp->pp_flags & PP_CISCO) 4801 sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ, 4802 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4803 else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) { 4804 int32_t nmagic = htonl(sp->lcp.magic); 4805 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4806 sppp_cp_send(sp, PPP_LCP, ECHO_REQ, 4807 sp->lcp.echoid, 4, &nmagic); 4808 } 4809 } 4810 splx(s); 4811 callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL); 4812 } 4813 4814 /* 4815 * Get both IP addresses. 4816 */ 4817 static void 4818 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, u_int32_t *srcmask) 4819 { 4820 struct ifnet *ifp = &sp->pp_if; 4821 struct ifaddr *ifa; 4822 struct sockaddr_in *si, *sm; 4823 u_int32_t ssrc, ddst; 4824 4825 sm = NULL; 4826 ssrc = ddst = 0; 4827 /* 4828 * Pick the first AF_INET address from the list, 4829 * aliases don't make any sense on a p2p link anyway. 4830 */ 4831 si = 0; 4832 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4833 if (ifa->ifa_addr->sa_family == AF_INET) { 4834 si = (struct sockaddr_in *)ifa->ifa_addr; 4835 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4836 if (si) 4837 break; 4838 } 4839 } 4840 if (ifa) { 4841 if (si && si->sin_addr.s_addr) { 4842 ssrc = si->sin_addr.s_addr; 4843 if (srcmask) 4844 *srcmask = ntohl(sm->sin_addr.s_addr); 4845 } 4846 4847 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4848 if (si && si->sin_addr.s_addr) 4849 ddst = si->sin_addr.s_addr; 4850 } 4851 4852 if (dst) *dst = ntohl(ddst); 4853 if (src) *src = ntohl(ssrc); 4854 } 4855 4856 /* 4857 * Set IP addresses. Must be called at splnet. 4858 * If an address is 0, leave it the way it is. 4859 */ 4860 static void 4861 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4862 { 4863 STDDCL; 4864 struct ifaddr *ifa; 4865 struct sockaddr_in *si, *dest; 4866 4867 /* 4868 * Pick the first AF_INET address from the list, 4869 * aliases don't make any sense on a p2p link anyway. 4870 */ 4871 4872 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4873 if (ifa->ifa_addr->sa_family == AF_INET) { 4874 si = (struct sockaddr_in *)ifa->ifa_addr; 4875 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4876 goto found; 4877 } 4878 } 4879 return; 4880 4881 found: 4882 { 4883 int error; 4884 struct sockaddr_in new_sin = *si; 4885 struct sockaddr_in new_dst = *dest; 4886 4887 /* 4888 * Scrub old routes now instead of calling in_ifinit with 4889 * scrub=1, because we may change the dstaddr 4890 * before the call to in_ifinit. 4891 */ 4892 in_ifscrub(ifp, ifatoia(ifa)); 4893 4894 if (myaddr != 0) 4895 new_sin.sin_addr.s_addr = htonl(myaddr); 4896 if (hisaddr != 0) { 4897 new_dst.sin_addr.s_addr = htonl(hisaddr); 4898 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4899 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4900 *dest = new_dst; /* fix dstaddr in place */ 4901 } 4902 } 4903 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4904 if (debug && error) 4905 { 4906 log(LOG_DEBUG, "%s: sppp_set_ip_addrs: in_ifinit " 4907 " failed, error=%d\n", ifp->if_xname, error); 4908 } 4909 } 4910 } 4911 4912 /* 4913 * Clear IP addresses. Must be called at splnet. 4914 */ 4915 static void 4916 sppp_clear_ip_addrs(struct sppp *sp) 4917 { 4918 struct ifnet *ifp = &sp->pp_if; 4919 struct ifaddr *ifa; 4920 struct sockaddr_in *si, *dest; 4921 4922 u_int32_t remote; 4923 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4924 remote = sp->ipcp.saved_hisaddr; 4925 else 4926 sppp_get_ip_addrs(sp, 0, &remote, 0); 4927 4928 /* 4929 * Pick the first AF_INET address from the list, 4930 * aliases don't make any sense on a p2p link anyway. 4931 */ 4932 4933 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4934 if (ifa->ifa_addr->sa_family == AF_INET) { 4935 si = (struct sockaddr_in *)ifa->ifa_addr; 4936 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4937 goto found; 4938 } 4939 } 4940 return; 4941 4942 found: 4943 { 4944 struct sockaddr_in new_sin = *si; 4945 4946 in_ifscrub(ifp, ifatoia(ifa)); 4947 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4948 new_sin.sin_addr.s_addr = 0; 4949 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4950 /* replace peer addr in place */ 4951 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4952 in_ifinit(ifp, ifatoia(ifa), &new_sin, 0); 4953 } 4954 } 4955 4956 #ifdef INET6 4957 /* 4958 * Get both IPv6 addresses. 4959 */ 4960 static void 4961 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4962 struct in6_addr *srcmask) 4963 { 4964 struct ifnet *ifp = &sp->pp_if; 4965 struct ifaddr *ifa; 4966 struct sockaddr_in6 *si, *sm; 4967 struct in6_addr ssrc, ddst; 4968 4969 sm = NULL; 4970 memset(&ssrc, 0, sizeof(ssrc)); 4971 memset(&ddst, 0, sizeof(ddst)); 4972 /* 4973 * Pick the first link-local AF_INET6 address from the list, 4974 * aliases don't make any sense on a p2p link anyway. 4975 */ 4976 si = 0; 4977 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4978 if (ifa->ifa_addr->sa_family == AF_INET6) { 4979 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4980 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4981 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4982 break; 4983 } 4984 if (ifa) { 4985 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4986 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4987 if (srcmask) { 4988 bcopy(&sm->sin6_addr, srcmask, 4989 sizeof(*srcmask)); 4990 } 4991 } 4992 4993 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4994 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4995 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4996 } 4997 4998 if (dst) 4999 bcopy(&ddst, dst, sizeof(*dst)); 5000 if (src) 5001 bcopy(&ssrc, src, sizeof(*src)); 5002 } 5003 5004 #ifdef IPV6CP_MYIFID_DYN 5005 /* 5006 * Generate random ifid. 5007 */ 5008 static void 5009 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 5010 { 5011 /* TBD */ 5012 } 5013 5014 /* 5015 * Set my IPv6 address. Must be called at splnet. 5016 */ 5017 static void 5018 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 5019 { 5020 STDDCL; 5021 struct ifaddr *ifa; 5022 struct sockaddr_in6 *sin6; 5023 5024 /* 5025 * Pick the first link-local AF_INET6 address from the list, 5026 * aliases don't make any sense on a p2p link anyway. 5027 */ 5028 5029 sin6 = NULL; 5030 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 5031 { 5032 if (ifa->ifa_addr->sa_family == AF_INET6) 5033 { 5034 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 5035 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 5036 break; 5037 } 5038 } 5039 5040 if (ifa && sin6) 5041 { 5042 int error; 5043 struct sockaddr_in6 new_sin6 = *sin6; 5044 5045 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 5046 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 5047 if (debug && error) 5048 { 5049 log(LOG_DEBUG, "%s: sppp_set_ip6_addr: in6_ifinit " 5050 " failed, error=%d\n", ifp->if_xname, error); 5051 } 5052 } 5053 } 5054 #endif 5055 5056 /* 5057 * Suggest a candidate address to be used by peer. 5058 */ 5059 static void 5060 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 5061 { 5062 struct in6_addr myaddr; 5063 struct timeval tv; 5064 5065 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 5066 5067 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 5068 microtime(&tv); 5069 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 5070 myaddr.s6_addr[14] ^= 0xff; 5071 myaddr.s6_addr[15] ^= 0xff; 5072 } else { 5073 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 5074 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 5075 } 5076 if (suggest) 5077 bcopy(&myaddr, suggest, sizeof(myaddr)); 5078 } 5079 #endif /*INET6*/ 5080 5081 /* 5082 * Process ioctl requests specific to the PPP interface. 5083 * Permissions have already been checked. 5084 */ 5085 static int 5086 sppp_params(struct sppp *sp, int cmd, void *data) 5087 { 5088 switch (cmd) { 5089 case SPPPGETAUTHCFG: 5090 { 5091 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5092 int error; 5093 size_t len; 5094 5095 cfg->myauthflags = sp->myauth.flags; 5096 cfg->hisauthflags = sp->hisauth.flags; 5097 strncpy(cfg->ifname, sp->pp_if.if_xname, IFNAMSIZ); 5098 cfg->hisauth = 0; 5099 if (sp->hisauth.proto) 5100 cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5101 cfg->myauth = 0; 5102 if (sp->myauth.proto) 5103 cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP; 5104 if (cfg->myname_length == 0) { 5105 if (sp->myauth.name != NULL) 5106 cfg->myname_length = sp->myauth.name_len + 1; 5107 } else { 5108 if (sp->myauth.name == NULL) { 5109 cfg->myname_length = 0; 5110 } else { 5111 len = sp->myauth.name_len + 1; 5112 if (cfg->myname_length < len) 5113 return (ENAMETOOLONG); 5114 error = copyout(sp->myauth.name, cfg->myname, len); 5115 if (error) return error; 5116 } 5117 } 5118 if (cfg->hisname_length == 0) { 5119 if (sp->hisauth.name != NULL) 5120 cfg->hisname_length = sp->hisauth.name_len + 1; 5121 } else { 5122 if (sp->hisauth.name == NULL) { 5123 cfg->hisname_length = 0; 5124 } else { 5125 len = sp->hisauth.name_len + 1; 5126 if (cfg->hisname_length < len) 5127 return (ENAMETOOLONG); 5128 error = copyout(sp->hisauth.name, cfg->hisname, len); 5129 if (error) return error; 5130 } 5131 } 5132 } 5133 break; 5134 case SPPPSETAUTHCFG: 5135 { 5136 struct spppauthcfg *cfg = (struct spppauthcfg *)data; 5137 int error; 5138 5139 if (sp->myauth.name) { 5140 free(sp->myauth.name, M_DEVBUF); 5141 sp->myauth.name = NULL; 5142 } 5143 if (sp->myauth.secret) { 5144 free(sp->myauth.secret, M_DEVBUF); 5145 sp->myauth.secret = NULL; 5146 } 5147 if (sp->hisauth.name) { 5148 free(sp->hisauth.name, M_DEVBUF); 5149 sp->hisauth.name = NULL; 5150 } 5151 if (sp->hisauth.secret) { 5152 free(sp->hisauth.secret, M_DEVBUF); 5153 sp->hisauth.secret = NULL; 5154 } 5155 5156 if (cfg->hisname != NULL && cfg->hisname_length > 0) { 5157 if (cfg->hisname_length >= MCLBYTES) 5158 return (ENAMETOOLONG); 5159 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK); 5160 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length); 5161 if (error) { 5162 free(sp->hisauth.name, M_DEVBUF); 5163 sp->hisauth.name = NULL; 5164 return error; 5165 } 5166 sp->hisauth.name_len = cfg->hisname_length - 1; 5167 sp->hisauth.name[sp->hisauth.name_len] = 0; 5168 } 5169 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) { 5170 if (cfg->hissecret_length >= MCLBYTES) 5171 return (ENAMETOOLONG); 5172 sp->hisauth.secret = malloc(cfg->hissecret_length, M_DEVBUF, M_WAITOK); 5173 error = copyin(cfg->hissecret, sp->hisauth.secret, cfg->hissecret_length); 5174 if (error) { 5175 free(sp->hisauth.secret, M_DEVBUF); 5176 sp->hisauth.secret = NULL; 5177 return error; 5178 } 5179 sp->hisauth.secret_len = cfg->hissecret_length - 1; 5180 sp->hisauth.secret[sp->hisauth.secret_len] = 0; 5181 } 5182 if (cfg->myname != NULL && cfg->myname_length > 0) { 5183 if (cfg->myname_length >= MCLBYTES) 5184 return (ENAMETOOLONG); 5185 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK); 5186 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length); 5187 if (error) { 5188 free(sp->myauth.name, M_DEVBUF); 5189 sp->myauth.name = NULL; 5190 return error; 5191 } 5192 sp->myauth.name_len = cfg->myname_length - 1; 5193 sp->myauth.name[sp->myauth.name_len] = 0; 5194 } 5195 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) { 5196 if (cfg->mysecret_length >= MCLBYTES) 5197 return (ENAMETOOLONG); 5198 sp->myauth.secret = malloc(cfg->mysecret_length, M_DEVBUF, M_WAITOK); 5199 error = copyin(cfg->mysecret, sp->myauth.secret, cfg->mysecret_length); 5200 if (error) { 5201 free(sp->myauth.secret, M_DEVBUF); 5202 sp->myauth.secret = NULL; 5203 return error; 5204 } 5205 sp->myauth.secret_len = cfg->mysecret_length - 1; 5206 sp->myauth.secret[sp->myauth.secret_len] = 0; 5207 } 5208 sp->myauth.flags = cfg->myauthflags; 5209 if (cfg->myauth) 5210 sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5211 sp->hisauth.flags = cfg->hisauthflags; 5212 if (cfg->hisauth) 5213 sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP; 5214 sp->pp_auth_failures = 0; 5215 if (sp->hisauth.proto != 0) 5216 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 5217 else 5218 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 5219 } 5220 break; 5221 case SPPPGETLCPCFG: 5222 { 5223 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5224 lcp->lcp_timeout = sp->lcp.timeout; 5225 } 5226 break; 5227 case SPPPSETLCPCFG: 5228 { 5229 struct sppplcpcfg *lcp = (struct sppplcpcfg *)data; 5230 sp->lcp.timeout = lcp->lcp_timeout; 5231 } 5232 break; 5233 case SPPPGETSTATUS: 5234 { 5235 struct spppstatus *status = (struct spppstatus *)data; 5236 status->phase = sp->pp_phase; 5237 } 5238 break; 5239 case SPPPGETSTATUSNCP: 5240 { 5241 struct spppstatusncp *status = (struct spppstatusncp *)data; 5242 status->phase = sp->pp_phase; 5243 status->ncpup = sppp_ncp_check(sp); 5244 } 5245 break; 5246 case SPPPGETIDLETO: 5247 { 5248 struct spppidletimeout *to = (struct spppidletimeout *)data; 5249 to->idle_seconds = sp->pp_idle_timeout; 5250 } 5251 break; 5252 case SPPPSETIDLETO: 5253 { 5254 struct spppidletimeout *to = (struct spppidletimeout *)data; 5255 sp->pp_idle_timeout = to->idle_seconds; 5256 } 5257 break; 5258 case SPPPSETAUTHFAILURE: 5259 { 5260 struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data; 5261 sp->pp_max_auth_fail = afsettings->max_failures; 5262 sp->pp_auth_failures = 0; 5263 } 5264 break; 5265 case SPPPGETAUTHFAILURES: 5266 { 5267 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data; 5268 stats->auth_failures = sp->pp_auth_failures; 5269 stats->max_failures = sp->pp_max_auth_fail; 5270 } 5271 break; 5272 case SPPPSETDNSOPTS: 5273 { 5274 struct spppdnssettings *req = (struct spppdnssettings *)data; 5275 sp->query_dns = req->query_dns & 3; 5276 } 5277 break; 5278 case SPPPGETDNSOPTS: 5279 { 5280 struct spppdnssettings *req = (struct spppdnssettings *)data; 5281 req->query_dns = sp->query_dns; 5282 } 5283 break; 5284 case SPPPGETDNSADDRS: 5285 { 5286 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data; 5287 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns); 5288 } 5289 break; 5290 case SPPPGETKEEPALIVE: 5291 { 5292 struct spppkeepalivesettings *settings = 5293 (struct spppkeepalivesettings*)data; 5294 settings->maxalive = sp->pp_maxalive; 5295 settings->max_noreceive = sp->pp_max_noreceive; 5296 } 5297 break; 5298 case SPPPSETKEEPALIVE: 5299 { 5300 struct spppkeepalivesettings *settings = 5301 (struct spppkeepalivesettings*)data; 5302 sp->pp_maxalive = settings->maxalive; 5303 sp->pp_max_noreceive = settings->max_noreceive; 5304 } 5305 break; 5306 default: 5307 return (EINVAL); 5308 } 5309 5310 return (0); 5311 } 5312 5313 static void 5314 sppp_phase_network(struct sppp *sp) 5315 { 5316 STDDCL; 5317 int i; 5318 u_int32_t mask; 5319 5320 sp->pp_phase = SPPP_PHASE_NETWORK; 5321 5322 if (debug) 5323 { 5324 log(LOG_INFO, "%s: phase %s\n", ifp->if_xname, 5325 sppp_phase_name(sp->pp_phase)); 5326 } 5327 5328 /* Notify NCPs now. */ 5329 for (i = 0; i < IDX_COUNT; i++) 5330 if ((cps[i])->flags & CP_NCP) 5331 (cps[i])->Open(sp); 5332 5333 /* Send Up events to all NCPs. */ 5334 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5335 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5336 (cps[i])->Up(sp); 5337 5338 /* if no NCP is starting, all this was in vain, close down */ 5339 sppp_lcp_check_and_close(sp); 5340 } 5341 5342 5343 static const char * 5344 sppp_cp_type_name(u_char type) 5345 { 5346 static char buf[12]; 5347 switch (type) { 5348 case CONF_REQ: return "conf-req"; 5349 case CONF_ACK: return "conf-ack"; 5350 case CONF_NAK: return "conf-nak"; 5351 case CONF_REJ: return "conf-rej"; 5352 case TERM_REQ: return "term-req"; 5353 case TERM_ACK: return "term-ack"; 5354 case CODE_REJ: return "code-rej"; 5355 case PROTO_REJ: return "proto-rej"; 5356 case ECHO_REQ: return "echo-req"; 5357 case ECHO_REPLY: return "echo-reply"; 5358 case DISC_REQ: return "discard-req"; 5359 } 5360 sprintf (buf, "0x%x", type); 5361 return buf; 5362 } 5363 5364 static const char * 5365 sppp_auth_type_name(u_short proto, u_char type) 5366 { 5367 static char buf[12]; 5368 switch (proto) { 5369 case PPP_CHAP: 5370 switch (type) { 5371 case CHAP_CHALLENGE: return "challenge"; 5372 case CHAP_RESPONSE: return "response"; 5373 case CHAP_SUCCESS: return "success"; 5374 case CHAP_FAILURE: return "failure"; 5375 } 5376 case PPP_PAP: 5377 switch (type) { 5378 case PAP_REQ: return "req"; 5379 case PAP_ACK: return "ack"; 5380 case PAP_NAK: return "nak"; 5381 } 5382 } 5383 sprintf (buf, "0x%x", type); 5384 return buf; 5385 } 5386 5387 static const char * 5388 sppp_lcp_opt_name(u_char opt) 5389 { 5390 static char buf[12]; 5391 switch (opt) { 5392 case LCP_OPT_MRU: return "mru"; 5393 case LCP_OPT_ASYNC_MAP: return "async-map"; 5394 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5395 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5396 case LCP_OPT_MAGIC: return "magic"; 5397 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5398 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5399 } 5400 sprintf (buf, "0x%x", opt); 5401 return buf; 5402 } 5403 5404 static const char * 5405 sppp_ipcp_opt_name(u_char opt) 5406 { 5407 static char buf[12]; 5408 switch (opt) { 5409 case IPCP_OPT_ADDRESSES: return "addresses"; 5410 case IPCP_OPT_COMPRESSION: return "compression"; 5411 case IPCP_OPT_ADDRESS: return "address"; 5412 } 5413 sprintf (buf, "0x%x", opt); 5414 return buf; 5415 } 5416 5417 #ifdef INET6 5418 static const char * 5419 sppp_ipv6cp_opt_name(u_char opt) 5420 { 5421 static char buf[12]; 5422 switch (opt) { 5423 case IPV6CP_OPT_IFID: return "ifid"; 5424 case IPV6CP_OPT_COMPRESSION: return "compression"; 5425 } 5426 sprintf (buf, "0x%x", opt); 5427 return buf; 5428 } 5429 #endif 5430 5431 static const char * 5432 sppp_state_name(int state) 5433 { 5434 switch (state) { 5435 case STATE_INITIAL: return "initial"; 5436 case STATE_STARTING: return "starting"; 5437 case STATE_CLOSED: return "closed"; 5438 case STATE_STOPPED: return "stopped"; 5439 case STATE_CLOSING: return "closing"; 5440 case STATE_STOPPING: return "stopping"; 5441 case STATE_REQ_SENT: return "req-sent"; 5442 case STATE_ACK_RCVD: return "ack-rcvd"; 5443 case STATE_ACK_SENT: return "ack-sent"; 5444 case STATE_OPENED: return "opened"; 5445 } 5446 return "illegal"; 5447 } 5448 5449 static const char * 5450 sppp_phase_name(int phase) 5451 { 5452 switch (phase) { 5453 case SPPP_PHASE_DEAD: return "dead"; 5454 case SPPP_PHASE_ESTABLISH: return "establish"; 5455 case SPPP_PHASE_TERMINATE: return "terminate"; 5456 case SPPP_PHASE_AUTHENTICATE: return "authenticate"; 5457 case SPPP_PHASE_NETWORK: return "network"; 5458 } 5459 return "illegal"; 5460 } 5461 5462 static const char * 5463 sppp_proto_name(u_short proto) 5464 { 5465 static char buf[12]; 5466 switch (proto) { 5467 case PPP_LCP: return "lcp"; 5468 case PPP_IPCP: return "ipcp"; 5469 case PPP_PAP: return "pap"; 5470 case PPP_CHAP: return "chap"; 5471 case PPP_IPV6CP: return "ipv6cp"; 5472 } 5473 sprintf(buf, "0x%x", (unsigned)proto); 5474 return buf; 5475 } 5476 5477 static void 5478 sppp_print_bytes(const u_char *p, u_short len) 5479 { 5480 addlog(" %02x", *p++); 5481 while (--len > 0) 5482 addlog("-%02x", *p++); 5483 } 5484 5485 static void 5486 sppp_print_string(const char *p, u_short len) 5487 { 5488 u_char c; 5489 5490 while (len-- > 0) { 5491 c = *p++; 5492 /* 5493 * Print only ASCII chars directly. RFC 1994 recommends 5494 * using only them, but we don't rely on it. */ 5495 if (c < ' ' || c > '~') 5496 addlog("\\x%x", c); 5497 else 5498 addlog("%c", c); 5499 } 5500 } 5501 5502 static const char * 5503 sppp_dotted_quad(u_int32_t addr) 5504 { 5505 static char s[16]; 5506 sprintf(s, "%d.%d.%d.%d", 5507 (int)((addr >> 24) & 0xff), 5508 (int)((addr >> 16) & 0xff), 5509 (int)((addr >> 8) & 0xff), 5510 (int)(addr & 0xff)); 5511 return s; 5512 } 5513 5514 /* a dummy, used to drop uninteresting events */ 5515 static void 5516 sppp_null(struct sppp *unused) 5517 { 5518 /* do just nothing */ 5519 } 5520 /* 5521 * This file is large. Tell emacs to highlight it nevertheless. 5522 * 5523 * Local Variables: 5524 * hilit-auto-highlight-maxout: 120000 5525 * End: 5526 */ 5527
Indexes created Tue Oct 14 06:10:07 GMT 2025