if_spppsubr.c 125 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226
  1. /* $OpenBSD: if_spppsubr.c,v 1.136 2015/07/18 15:51:16 mpi Exp $ */
  2. /*
  3. * Synchronous PPP/Cisco link level subroutines.
  4. * Keepalive protocol implemented in both Cisco and PPP modes.
  5. *
  6. * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
  7. * Author: Serge Vakulenko, <vak@cronyx.ru>
  8. *
  9. * Heavily revamped to conform to RFC 1661.
  10. * Copyright (C) 1997, Joerg Wunsch.
  11. *
  12. * RFC2472 IPv6CP support.
  13. * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun@iijlab.net>.
  14. *
  15. * Redistribution and use in source and binary forms, with or without
  16. * modification, are permitted provided that the following conditions are met:
  17. * 1. Redistributions of source code must retain the above copyright notice,
  18. * this list of conditions and the following disclaimer.
  19. * 2. Redistributions in binary form must reproduce the above copyright notice,
  20. * this list of conditions and the following disclaimer in the documentation
  21. * and/or other materials provided with the distribution.
  22. *
  23. * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
  24. * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26. * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
  27. * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29. * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30. * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31. * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33. * POSSIBILITY OF SUCH DAMAGE.
  34. *
  35. * From: Version 2.6, Tue May 12 17:10:39 MSD 1998
  36. */
  37. #include <sys/param.h>
  38. #include <sys/systm.h>
  39. #include <sys/kernel.h>
  40. #include <sys/sockio.h>
  41. #include <sys/socket.h>
  42. #include <sys/syslog.h>
  43. #include <sys/malloc.h>
  44. #include <sys/mbuf.h>
  45. #include <sys/timeout.h>
  46. #include <crypto/md5.h>
  47. #include <net/if.h>
  48. #include <net/if_var.h>
  49. #include <net/netisr.h>
  50. #include <net/if_types.h>
  51. #include <net/route.h>
  52. #include <sys/stdarg.h>
  53. #include <netinet/in.h>
  54. #include <netinet/in_var.h>
  55. #include <netinet/ip.h>
  56. #include <netinet/tcp.h>
  57. #include <netinet/if_ether.h>
  58. #ifdef INET6
  59. #include <netinet6/in6_ifattach.h>
  60. #endif
  61. #include <net/if_sppp.h>
  62. # define UNTIMEOUT(fun, arg, handle) \
  63. timeout_del(&(handle))
  64. #define LOOPALIVECNT 3 /* loopback detection tries */
  65. #define MAXALIVECNT 3 /* max. missed alive packets */
  66. #define NORECV_TIME 15 /* before we get worried */
  67. /*
  68. * Interface flags that can be set in an ifconfig command.
  69. *
  70. * Setting link0 will make the link passive, i.e. it will be marked
  71. * as being administrative openable, but won't be opened to begin
  72. * with. Incoming calls will be answered, or subsequent calls with
  73. * -link1 will cause the administrative open of the LCP layer.
  74. *
  75. * Setting link1 will cause the link to auto-dial only as packets
  76. * arrive to be sent.
  77. *
  78. * Setting IFF_DEBUG will syslog the option negotiation and state
  79. * transitions at level kern.debug. Note: all logs consistently look
  80. * like
  81. *
  82. * <if-name><unit>: <proto-name> <additional info...>
  83. *
  84. * with <if-name><unit> being something like "bppp0", and <proto-name>
  85. * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
  86. */
  87. #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */
  88. #define IFF_AUTO IFF_LINK1 /* auto-dial on output */
  89. #define PPP_ALLSTATIONS 0xff /* All-Stations broadcast address */
  90. #define PPP_UI 0x03 /* Unnumbered Information */
  91. #define PPP_IP 0x0021 /* Internet Protocol */
  92. #define PPP_ISO 0x0023 /* ISO OSI Protocol */
  93. #define PPP_XNS 0x0025 /* Xerox NS Protocol */
  94. #define PPP_IPX 0x002b /* Novell IPX Protocol */
  95. #define PPP_IPV6 0x0057 /* Internet Protocol v6 */
  96. #define PPP_LCP 0xc021 /* Link Control Protocol */
  97. #define PPP_PAP 0xc023 /* Password Authentication Protocol */
  98. #define PPP_CHAP 0xc223 /* Challenge-Handshake Auth Protocol */
  99. #define PPP_IPCP 0x8021 /* Internet Protocol Control Protocol */
  100. #define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */
  101. #define CONF_REQ 1 /* PPP configure request */
  102. #define CONF_ACK 2 /* PPP configure acknowledge */
  103. #define CONF_NAK 3 /* PPP configure negative ack */
  104. #define CONF_REJ 4 /* PPP configure reject */
  105. #define TERM_REQ 5 /* PPP terminate request */
  106. #define TERM_ACK 6 /* PPP terminate acknowledge */
  107. #define CODE_REJ 7 /* PPP code reject */
  108. #define PROTO_REJ 8 /* PPP protocol reject */
  109. #define ECHO_REQ 9 /* PPP echo request */
  110. #define ECHO_REPLY 10 /* PPP echo reply */
  111. #define DISC_REQ 11 /* PPP discard request */
  112. #define LCP_OPT_MRU 1 /* maximum receive unit */
  113. #define LCP_OPT_ASYNC_MAP 2 /* async control character map */
  114. #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */
  115. #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */
  116. #define LCP_OPT_MAGIC 5 /* magic number */
  117. #define LCP_OPT_RESERVED 6 /* reserved */
  118. #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */
  119. #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */
  120. #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */
  121. #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol (VJ) */
  122. #define IPCP_OPT_ADDRESS 3 /* local IP address */
  123. #define IPV6CP_OPT_IFID 1 /* interface identifier */
  124. #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */
  125. #define PAP_REQ 1 /* PAP name/password request */
  126. #define PAP_ACK 2 /* PAP acknowledge */
  127. #define PAP_NAK 3 /* PAP fail */
  128. #define CHAP_CHALLENGE 1 /* CHAP challenge request */
  129. #define CHAP_RESPONSE 2 /* CHAP challenge response */
  130. #define CHAP_SUCCESS 3 /* CHAP response ok */
  131. #define CHAP_FAILURE 4 /* CHAP response failed */
  132. #define CHAP_MD5 5 /* hash algorithm - MD5 */
  133. #define CISCO_MULTICAST 0x8f /* Cisco multicast address */
  134. #define CISCO_UNICAST 0x0f /* Cisco unicast address */
  135. #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */
  136. #define CISCO_ADDR_REQ 0 /* Cisco address request */
  137. #define CISCO_ADDR_REPLY 1 /* Cisco address reply */
  138. #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */
  139. /* states are named and numbered according to RFC 1661 */
  140. #define STATE_INITIAL 0
  141. #define STATE_STARTING 1
  142. #define STATE_CLOSED 2
  143. #define STATE_STOPPED 3
  144. #define STATE_CLOSING 4
  145. #define STATE_STOPPING 5
  146. #define STATE_REQ_SENT 6
  147. #define STATE_ACK_RCVD 7
  148. #define STATE_ACK_SENT 8
  149. #define STATE_OPENED 9
  150. struct ppp_header {
  151. u_char address;
  152. u_char control;
  153. u_short protocol;
  154. };
  155. #define PPP_HEADER_LEN sizeof (struct ppp_header)
  156. struct lcp_header {
  157. u_char type;
  158. u_char ident;
  159. u_short len;
  160. };
  161. #define LCP_HEADER_LEN sizeof (struct lcp_header)
  162. struct cisco_packet {
  163. u_int32_t type;
  164. u_int32_t par1;
  165. u_int32_t par2;
  166. u_short rel;
  167. u_short time0;
  168. u_short time1;
  169. };
  170. #define CISCO_PACKET_LEN 18
  171. /*
  172. * We follow the spelling and capitalization of RFC 1661 here, to make
  173. * it easier comparing with the standard. Please refer to this RFC in
  174. * case you can't make sense out of these abbreviation; it will also
  175. * explain the semantics related to the various events and actions.
  176. */
  177. struct cp {
  178. u_short proto; /* PPP control protocol number */
  179. u_char protoidx; /* index into state table in struct sppp */
  180. u_char flags;
  181. #define CP_LCP 0x01 /* this is the LCP */
  182. #define CP_AUTH 0x02 /* this is an authentication protocol */
  183. #define CP_NCP 0x04 /* this is a NCP */
  184. #define CP_QUAL 0x08 /* this is a quality reporting protocol */
  185. const char *name; /* name of this control protocol */
  186. /* event handlers */
  187. void (*Up)(struct sppp *sp);
  188. void (*Down)(struct sppp *sp);
  189. void (*Open)(struct sppp *sp);
  190. void (*Close)(struct sppp *sp);
  191. void (*TO)(void *sp);
  192. int (*RCR)(struct sppp *sp, struct lcp_header *h, int len);
  193. void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
  194. void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
  195. /* actions */
  196. void (*tlu)(struct sppp *sp);
  197. void (*tld)(struct sppp *sp);
  198. void (*tls)(struct sppp *sp);
  199. void (*tlf)(struct sppp *sp);
  200. void (*scr)(struct sppp *sp);
  201. };
  202. static struct sppp *spppq;
  203. static struct timeout keepalive_ch;
  204. #define SPP_FMT "%s: "
  205. #define SPP_ARGS(ifp) (ifp)->if_xname
  206. /* almost every function needs these */
  207. #define STDDCL \
  208. struct ifnet *ifp = &sp->pp_if; \
  209. int debug = ifp->if_flags & IFF_DEBUG
  210. int sppp_output(struct ifnet *ifp, struct mbuf *m,
  211. struct sockaddr *dst, struct rtentry *rt);
  212. void sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2);
  213. void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
  214. void sppp_cp_input(const struct cp *cp, struct sppp *sp,
  215. struct mbuf *m);
  216. void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
  217. u_char ident, u_short len, void *data);
  218. #ifdef notyet
  219. void sppp_cp_timeout(void *arg);
  220. #endif
  221. void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
  222. int newstate);
  223. void sppp_auth_send(const struct cp *cp,
  224. struct sppp *sp, unsigned int type, u_int id,
  225. ...);
  226. void sppp_up_event(const struct cp *cp, struct sppp *sp);
  227. void sppp_down_event(const struct cp *cp, struct sppp *sp);
  228. void sppp_open_event(const struct cp *cp, struct sppp *sp);
  229. void sppp_close_event(const struct cp *cp, struct sppp *sp);
  230. void sppp_increasing_timeout(const struct cp *cp, struct sppp *sp);
  231. void sppp_to_event(const struct cp *cp, struct sppp *sp);
  232. void sppp_null(struct sppp *sp);
  233. void sppp_lcp_init(struct sppp *sp);
  234. void sppp_lcp_up(struct sppp *sp);
  235. void sppp_lcp_down(struct sppp *sp);
  236. void sppp_lcp_open(struct sppp *sp);
  237. void sppp_lcp_close(struct sppp *sp);
  238. void sppp_lcp_TO(void *sp);
  239. int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
  240. void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
  241. void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
  242. void sppp_lcp_tlu(struct sppp *sp);
  243. void sppp_lcp_tld(struct sppp *sp);
  244. void sppp_lcp_tls(struct sppp *sp);
  245. void sppp_lcp_tlf(struct sppp *sp);
  246. void sppp_lcp_scr(struct sppp *sp);
  247. void sppp_lcp_check_and_close(struct sppp *sp);
  248. int sppp_ncp_check(struct sppp *sp);
  249. void sppp_ipcp_init(struct sppp *sp);
  250. void sppp_ipcp_destroy(struct sppp *sp);
  251. void sppp_ipcp_up(struct sppp *sp);
  252. void sppp_ipcp_down(struct sppp *sp);
  253. void sppp_ipcp_open(struct sppp *sp);
  254. void sppp_ipcp_close(struct sppp *sp);
  255. void sppp_ipcp_TO(void *sp);
  256. int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
  257. void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
  258. void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
  259. void sppp_ipcp_tlu(struct sppp *sp);
  260. void sppp_ipcp_tld(struct sppp *sp);
  261. void sppp_ipcp_tls(struct sppp *sp);
  262. void sppp_ipcp_tlf(struct sppp *sp);
  263. void sppp_ipcp_scr(struct sppp *sp);
  264. void sppp_ipv6cp_init(struct sppp *sp);
  265. void sppp_ipv6cp_destroy(struct sppp *sp);
  266. void sppp_ipv6cp_up(struct sppp *sp);
  267. void sppp_ipv6cp_down(struct sppp *sp);
  268. void sppp_ipv6cp_open(struct sppp *sp);
  269. void sppp_ipv6cp_close(struct sppp *sp);
  270. void sppp_ipv6cp_TO(void *sp);
  271. int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
  272. void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
  273. void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
  274. void sppp_ipv6cp_tlu(struct sppp *sp);
  275. void sppp_ipv6cp_tld(struct sppp *sp);
  276. void sppp_ipv6cp_tls(struct sppp *sp);
  277. void sppp_ipv6cp_tlf(struct sppp *sp);
  278. void sppp_ipv6cp_scr(struct sppp *sp);
  279. const char *sppp_ipv6cp_opt_name(u_char opt);
  280. void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
  281. struct in6_addr *dst, struct in6_addr *srcmask);
  282. void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src, const struct in6_addr *dst);
  283. void sppp_update_ip6_addr(void *sp);
  284. void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest);
  285. void sppp_pap_input(struct sppp *sp, struct mbuf *m);
  286. void sppp_pap_init(struct sppp *sp);
  287. void sppp_pap_open(struct sppp *sp);
  288. void sppp_pap_close(struct sppp *sp);
  289. void sppp_pap_TO(void *sp);
  290. void sppp_pap_my_TO(void *sp);
  291. void sppp_pap_tlu(struct sppp *sp);
  292. void sppp_pap_tld(struct sppp *sp);
  293. void sppp_pap_scr(struct sppp *sp);
  294. void sppp_chap_input(struct sppp *sp, struct mbuf *m);
  295. void sppp_chap_init(struct sppp *sp);
  296. void sppp_chap_open(struct sppp *sp);
  297. void sppp_chap_close(struct sppp *sp);
  298. void sppp_chap_TO(void *sp);
  299. void sppp_chap_tlu(struct sppp *sp);
  300. void sppp_chap_tld(struct sppp *sp);
  301. void sppp_chap_scr(struct sppp *sp);
  302. const char *sppp_auth_type_name(u_short proto, u_char type);
  303. const char *sppp_cp_type_name(u_char type);
  304. const char *sppp_dotted_quad(u_int32_t addr);
  305. const char *sppp_ipcp_opt_name(u_char opt);
  306. const char *sppp_lcp_opt_name(u_char opt);
  307. const char *sppp_phase_name(enum ppp_phase phase);
  308. const char *sppp_proto_name(u_short proto);
  309. const char *sppp_state_name(int state);
  310. int sppp_get_params(struct sppp *sp, struct ifreq *data);
  311. int sppp_set_params(struct sppp *sp, struct ifreq *data);
  312. void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst,
  313. u_int32_t *srcmask);
  314. void sppp_keepalive(void *dummy);
  315. void sppp_phase_network(struct sppp *sp);
  316. void sppp_print_bytes(const u_char *p, u_short len);
  317. void sppp_print_string(const char *p, u_short len);
  318. void sppp_qflush(struct ifqueue *ifq);
  319. int sppp_update_gw_walker(struct rtentry *rt, void *arg, unsigned int id);
  320. void sppp_update_gw(struct ifnet *ifp);
  321. void sppp_set_ip_addrs(void *);
  322. void sppp_clear_ip_addrs(void *);
  323. void sppp_set_phase(struct sppp *sp);
  324. /* our control protocol descriptors */
  325. static const struct cp lcp = {
  326. PPP_LCP, IDX_LCP, CP_LCP, "lcp",
  327. sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
  328. sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
  329. sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
  330. sppp_lcp_scr
  331. };
  332. static const struct cp ipcp = {
  333. PPP_IPCP, IDX_IPCP,
  334. CP_NCP,
  335. "ipcp",
  336. sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
  337. sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
  338. sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
  339. sppp_ipcp_scr
  340. };
  341. static const struct cp ipv6cp = {
  342. PPP_IPV6CP, IDX_IPV6CP,
  343. #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/
  344. CP_NCP,
  345. #else
  346. 0,
  347. #endif
  348. "ipv6cp",
  349. sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
  350. sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
  351. sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
  352. sppp_ipv6cp_scr
  353. };
  354. static const struct cp pap = {
  355. PPP_PAP, IDX_PAP, CP_AUTH, "pap",
  356. sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
  357. sppp_pap_TO, 0, 0, 0,
  358. sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
  359. sppp_pap_scr
  360. };
  361. static const struct cp chap = {
  362. PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
  363. sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
  364. sppp_chap_TO, 0, 0, 0,
  365. sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
  366. sppp_chap_scr
  367. };
  368. static const struct cp *cps[IDX_COUNT] = {
  369. &lcp, /* IDX_LCP */
  370. &ipcp, /* IDX_IPCP */
  371. &ipv6cp, /* IDX_IPV6CP */
  372. &pap, /* IDX_PAP */
  373. &chap, /* IDX_CHAP */
  374. };
  375. /*
  376. * Exported functions, comprising our interface to the lower layer.
  377. */
  378. /* Workaround */
  379. void
  380. spppattach(struct ifnet *ifp)
  381. {
  382. }
  383. /*
  384. * Process the received packet.
  385. */
  386. void
  387. sppp_input(struct ifnet *ifp, struct mbuf *m)
  388. {
  389. struct ppp_header ht;
  390. struct niqueue *inq = NULL;
  391. struct sppp *sp = (struct sppp *)ifp;
  392. struct timeval tv;
  393. int debug = ifp->if_flags & IFF_DEBUG;
  394. if (ifp->if_flags & IFF_UP) {
  395. /* Count received bytes, add hardware framing */
  396. ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
  397. /* Note time of last receive */
  398. getmicrouptime(&tv);
  399. sp->pp_last_receive = tv.tv_sec;
  400. }
  401. if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
  402. /* Too small packet, drop it. */
  403. if (debug)
  404. log(LOG_DEBUG,
  405. SPP_FMT "input packet is too small, %d bytes\n",
  406. SPP_ARGS(ifp), m->m_pkthdr.len);
  407. drop:
  408. m_freem (m);
  409. dropped:
  410. ++ifp->if_ierrors;
  411. ++ifp->if_iqdrops;
  412. return;
  413. }
  414. /* mark incoming routing domain */
  415. m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
  416. if (sp->pp_flags & PP_NOFRAMING) {
  417. m_copydata(m, 0, sizeof(ht.protocol), (caddr_t)&ht.protocol);
  418. m_adj(m, 2);
  419. ht.control = PPP_UI;
  420. ht.address = PPP_ALLSTATIONS;
  421. } else {
  422. /* Get PPP header. */
  423. m_copydata(m, 0, sizeof(ht), (caddr_t)&ht);
  424. m_adj (m, PPP_HEADER_LEN);
  425. }
  426. /* preserve the alignment */
  427. if (m->m_len < m->m_pkthdr.len) {
  428. m = m_pullup(m, m->m_pkthdr.len);
  429. if (m == NULL) {
  430. if (debug)
  431. log(LOG_DEBUG,
  432. SPP_FMT "Failed to align packet!\n", SPP_ARGS(ifp));
  433. ++ifp->if_ierrors;
  434. ++ifp->if_iqdrops;
  435. return;
  436. }
  437. }
  438. switch (ht.address) {
  439. case PPP_ALLSTATIONS:
  440. if (ht.control != PPP_UI)
  441. goto invalid;
  442. if (sp->pp_flags & PP_CISCO) {
  443. if (debug)
  444. log(LOG_DEBUG,
  445. SPP_FMT "PPP packet in Cisco mode "
  446. "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
  447. SPP_ARGS(ifp),
  448. ht.address, ht.control, ntohs(ht.protocol));
  449. goto drop;
  450. }
  451. switch (ntohs (ht.protocol)) {
  452. default:
  453. if (sp->state[IDX_LCP] == STATE_OPENED)
  454. sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
  455. ++sp->pp_seq, 2, &ht.protocol);
  456. if (debug)
  457. log(LOG_DEBUG,
  458. SPP_FMT "invalid input protocol "
  459. "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
  460. SPP_ARGS(ifp),
  461. ht.address, ht.control, ntohs(ht.protocol));
  462. ++ifp->if_noproto;
  463. goto drop;
  464. case PPP_LCP:
  465. sppp_cp_input(&lcp, sp, m);
  466. m_freem (m);
  467. return;
  468. case PPP_PAP:
  469. if (sp->pp_phase >= PHASE_AUTHENTICATE)
  470. sppp_pap_input(sp, m);
  471. m_freem (m);
  472. return;
  473. case PPP_CHAP:
  474. if (sp->pp_phase >= PHASE_AUTHENTICATE)
  475. sppp_chap_input(sp, m);
  476. m_freem (m);
  477. return;
  478. case PPP_IPCP:
  479. if (sp->pp_phase == PHASE_NETWORK)
  480. sppp_cp_input(&ipcp, sp, m);
  481. m_freem (m);
  482. return;
  483. case PPP_IP:
  484. if (sp->state[IDX_IPCP] == STATE_OPENED) {
  485. inq = &ipintrq;
  486. sp->pp_last_activity = tv.tv_sec;
  487. }
  488. break;
  489. #ifdef INET6
  490. case PPP_IPV6CP:
  491. if (sp->pp_phase == PHASE_NETWORK)
  492. sppp_cp_input(&ipv6cp, sp, m);
  493. m_freem (m);
  494. return;
  495. case PPP_IPV6:
  496. if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
  497. inq = &ip6intrq;
  498. sp->pp_last_activity = tv.tv_sec;
  499. }
  500. break;
  501. #endif
  502. }
  503. break;
  504. case CISCO_MULTICAST:
  505. case CISCO_UNICAST:
  506. /* Don't check the control field here (RFC 1547). */
  507. if (! (sp->pp_flags & PP_CISCO)) {
  508. if (debug)
  509. log(LOG_DEBUG,
  510. SPP_FMT "Cisco packet in PPP mode "
  511. "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
  512. SPP_ARGS(ifp),
  513. ht.address, ht.control, ntohs(ht.protocol));
  514. goto drop;
  515. }
  516. switch (ntohs (ht.protocol)) {
  517. default:
  518. ++ifp->if_noproto;
  519. goto invalid;
  520. case CISCO_KEEPALIVE:
  521. sppp_cisco_input ((struct sppp*) ifp, m);
  522. m_freem (m);
  523. return;
  524. case ETHERTYPE_IP:
  525. inq = &ipintrq;
  526. break;
  527. #ifdef INET6
  528. case ETHERTYPE_IPV6:
  529. inq = &ip6intrq;
  530. break;
  531. #endif
  532. }
  533. break;
  534. default: /* Invalid PPP packet. */
  535. invalid:
  536. if (debug)
  537. log(LOG_DEBUG,
  538. SPP_FMT "invalid input packet "
  539. "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
  540. SPP_ARGS(ifp),
  541. ht.address, ht.control, ntohs(ht.protocol));
  542. goto drop;
  543. }
  544. if (! (ifp->if_flags & IFF_UP) || ! inq)
  545. goto drop;
  546. if (niq_enqueue(inq, m) != 0) {
  547. /* Queue overflow. */
  548. if (debug)
  549. log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
  550. SPP_ARGS(ifp));
  551. goto dropped;
  552. }
  553. }
  554. /*
  555. * Enqueue transmit packet.
  556. */
  557. int
  558. sppp_output(struct ifnet *ifp, struct mbuf *m,
  559. struct sockaddr *dst, struct rtentry *rt)
  560. {
  561. struct sppp *sp = (struct sppp*) ifp;
  562. struct ppp_header *h;
  563. struct timeval tv;
  564. int s, rv = 0;
  565. u_int16_t protocol;
  566. #ifdef DIAGNOSTIC
  567. if (ifp->if_rdomain != rtable_l2(m->m_pkthdr.ph_rtableid)) {
  568. printf("%s: trying to send packet on wrong domain. "
  569. "if %d vs. mbuf %d, AF %d\n", ifp->if_xname,
  570. ifp->if_rdomain, rtable_l2(m->m_pkthdr.ph_rtableid),
  571. dst->sa_family);
  572. }
  573. #endif
  574. s = splnet();
  575. getmicrouptime(&tv);
  576. sp->pp_last_activity = tv.tv_sec;
  577. if ((ifp->if_flags & IFF_UP) == 0 ||
  578. (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
  579. m_freem (m);
  580. splx (s);
  581. return (ENETDOWN);
  582. }
  583. if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
  584. /*
  585. * Interface is not yet running, but auto-dial. Need
  586. * to start LCP for it.
  587. */
  588. ifp->if_flags |= IFF_RUNNING;
  589. splx(s);
  590. lcp.Open(sp);
  591. s = splnet();
  592. }
  593. /*
  594. * Put low delay, telnet, rlogin and ftp control packets
  595. * in front of the queue.
  596. */
  597. if (dst->sa_family == AF_INET) {
  598. struct ip *ip = NULL;
  599. struct tcphdr *th = NULL;
  600. if (m->m_len >= sizeof(struct ip)) {
  601. ip = mtod(m, struct ip *);
  602. if (ip->ip_p == IPPROTO_TCP &&
  603. m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
  604. sizeof(struct tcphdr)) {
  605. th = (struct tcphdr *)
  606. ((caddr_t)ip + (ip->ip_hl << 2));
  607. }
  608. }
  609. /*
  610. * When using dynamic local IP address assignment by using
  611. * 0.0.0.0 as a local address, the first TCP session will
  612. * not connect because the local TCP checksum is computed
  613. * using 0.0.0.0 which will later become our real IP address
  614. * so the TCP checksum computed at the remote end will
  615. * become invalid. So we
  616. * - don't let packets with src ip addr 0 thru
  617. * - we flag TCP packets with src ip 0 as an error
  618. */
  619. if(ip && ip->ip_src.s_addr == INADDR_ANY) {
  620. u_int8_t proto = ip->ip_p;
  621. m_freem(m);
  622. splx(s);
  623. if(proto == IPPROTO_TCP)
  624. return (EADDRNOTAVAIL);
  625. else
  626. return (0);
  627. }
  628. }
  629. if (sp->pp_flags & PP_NOFRAMING)
  630. goto skip_header;
  631. /*
  632. * Prepend general data packet PPP header. For now, IP only.
  633. */
  634. M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
  635. if (!m) {
  636. if (ifp->if_flags & IFF_DEBUG)
  637. log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
  638. SPP_ARGS(ifp));
  639. ++ifp->if_oerrors;
  640. splx (s);
  641. return (ENOBUFS);
  642. }
  643. /*
  644. * May want to check size of packet
  645. * (albeit due to the implementation it's always enough)
  646. */
  647. h = mtod (m, struct ppp_header*);
  648. if (sp->pp_flags & PP_CISCO) {
  649. h->address = CISCO_UNICAST; /* unicast address */
  650. h->control = 0;
  651. } else {
  652. h->address = PPP_ALLSTATIONS; /* broadcast address */
  653. h->control = PPP_UI; /* Unnumbered Info */
  654. }
  655. skip_header:
  656. switch (dst->sa_family) {
  657. case AF_INET: /* Internet Protocol */
  658. if (sp->pp_flags & PP_CISCO)
  659. protocol = htons (ETHERTYPE_IP);
  660. else {
  661. /*
  662. * Don't choke with an ENETDOWN early. It's
  663. * possible that we just started dialing out,
  664. * so don't drop the packet immediately. If
  665. * we notice that we run out of buffer space
  666. * below, we will however remember that we are
  667. * not ready to carry IP packets, and return
  668. * ENETDOWN, as opposed to ENOBUFS.
  669. */
  670. protocol = htons(PPP_IP);
  671. if (sp->state[IDX_IPCP] != STATE_OPENED)
  672. rv = ENETDOWN;
  673. }
  674. break;
  675. #ifdef INET6
  676. case AF_INET6: /* Internet Protocol v6 */
  677. if (sp->pp_flags & PP_CISCO)
  678. protocol = htons (ETHERTYPE_IPV6);
  679. else {
  680. /*
  681. * Don't choke with an ENETDOWN early. It's
  682. * possible that we just started dialing out,
  683. * so don't drop the packet immediately. If
  684. * we notice that we run out of buffer space
  685. * below, we will however remember that we are
  686. * not ready to carry IPv6 packets, and return
  687. * ENETDOWN, as opposed to ENOBUFS.
  688. */
  689. protocol = htons(PPP_IPV6);
  690. if (sp->state[IDX_IPV6CP] != STATE_OPENED)
  691. rv = ENETDOWN;
  692. }
  693. break;
  694. #endif
  695. default:
  696. m_freem(m);
  697. ++ifp->if_oerrors;
  698. splx(s);
  699. return (EAFNOSUPPORT);
  700. }
  701. if (sp->pp_flags & PP_NOFRAMING) {
  702. M_PREPEND(m, 2, M_DONTWAIT);
  703. if (m == NULL) {
  704. if (ifp->if_flags & IFF_DEBUG)
  705. log(LOG_DEBUG, SPP_FMT
  706. "no memory for transmit header\n",
  707. SPP_ARGS(ifp));
  708. ++ifp->if_oerrors;
  709. splx(s);
  710. return (ENOBUFS);
  711. }
  712. *mtod(m, u_int16_t *) = protocol;
  713. } else
  714. h->protocol = protocol;
  715. /*
  716. * Queue message on interface, and start output if interface
  717. * not yet active.
  718. */
  719. rv = if_enqueue(ifp, m);
  720. if (rv != 0) {
  721. ifp->if_oerrors++;
  722. return (rv);
  723. }
  724. /*
  725. * Count output packets and bytes.
  726. * The packet length includes header, FCS and 1 flag,
  727. * according to RFC 1333.
  728. */
  729. ifp->if_obytes += sp->pp_framebytes;
  730. return (0);
  731. }
  732. void
  733. sppp_attach(struct ifnet *ifp)
  734. {
  735. struct sppp *sp = (struct sppp*) ifp;
  736. int i;
  737. /* Initialize keepalive handler. */
  738. if (! spppq) {
  739. timeout_set(&keepalive_ch, sppp_keepalive, NULL);
  740. timeout_add_sec(&keepalive_ch, 10);
  741. }
  742. /* Insert new entry into the keepalive list. */
  743. sp->pp_next = spppq;
  744. spppq = sp;
  745. sp->pp_if.if_type = IFT_PPP;
  746. sp->pp_if.if_output = sppp_output;
  747. IFQ_SET_MAXLEN(&sp->pp_if.if_snd, 50);
  748. IFQ_SET_MAXLEN(&sp->pp_cpq, 50);
  749. sp->pp_loopcnt = 0;
  750. sp->pp_alivecnt = 0;
  751. sp->pp_last_activity = 0;
  752. sp->pp_last_receive = 0;
  753. sp->pp_seq = 0;
  754. sp->pp_rseq = 0;
  755. sp->pp_phase = PHASE_DEAD;
  756. sp->pp_up = lcp.Up;
  757. sp->pp_down = lcp.Down;
  758. for (i = 0; i < IDX_COUNT; i++)
  759. timeout_set(&sp->ch[i], (cps[i])->TO, (void *)sp);
  760. timeout_set(&sp->pap_my_to_ch, sppp_pap_my_TO, (void *)sp);
  761. sppp_lcp_init(sp);
  762. sppp_ipcp_init(sp);
  763. sppp_ipv6cp_init(sp);
  764. sppp_pap_init(sp);
  765. sppp_chap_init(sp);
  766. }
  767. void
  768. sppp_detach(struct ifnet *ifp)
  769. {
  770. struct sppp **q, *p, *sp = (struct sppp*) ifp;
  771. int i;
  772. sppp_ipcp_destroy(sp);
  773. sppp_ipv6cp_destroy(sp);
  774. /* Remove the entry from the keepalive list. */
  775. for (q = &spppq; (p = *q); q = &p->pp_next)
  776. if (p == sp) {
  777. *q = p->pp_next;
  778. break;
  779. }
  780. /* Stop keepalive handler. */
  781. if (! spppq)
  782. UNTIMEOUT(sppp_keepalive, 0, keepalive_ch);
  783. for (i = 0; i < IDX_COUNT; i++)
  784. UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]);
  785. UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
  786. /* release authentication data */
  787. if (sp->myauth.name != NULL)
  788. free(sp->myauth.name, M_DEVBUF, 0);
  789. if (sp->myauth.secret != NULL)
  790. free(sp->myauth.secret, M_DEVBUF, 0);
  791. if (sp->hisauth.name != NULL)
  792. free(sp->hisauth.name, M_DEVBUF, 0);
  793. if (sp->hisauth.secret != NULL)
  794. free(sp->hisauth.secret, M_DEVBUF, 0);
  795. }
  796. /*
  797. * Flush the interface output queue.
  798. */
  799. void
  800. sppp_flush(struct ifnet *ifp)
  801. {
  802. struct sppp *sp = (struct sppp*) ifp;
  803. IFQ_PURGE(&sp->pp_if.if_snd);
  804. sppp_qflush (&sp->pp_cpq);
  805. }
  806. /*
  807. * Check if the output queue is empty.
  808. */
  809. int
  810. sppp_isempty(struct ifnet *ifp)
  811. {
  812. struct sppp *sp = (struct sppp*) ifp;
  813. int empty, s;
  814. s = splnet();
  815. empty = IF_IS_EMPTY(&sp->pp_cpq) &&
  816. IFQ_IS_EMPTY(&sp->pp_if.if_snd);
  817. splx(s);
  818. return (empty);
  819. }
  820. /*
  821. * Get next packet to send.
  822. */
  823. struct mbuf *
  824. sppp_dequeue(struct ifnet *ifp)
  825. {
  826. struct sppp *sp = (struct sppp*) ifp;
  827. struct mbuf *m;
  828. int s;
  829. s = splnet();
  830. /*
  831. * Process only the control protocol queue until we have at
  832. * least one NCP open.
  833. *
  834. * Do always serve all queues in Cisco mode.
  835. */
  836. IF_DEQUEUE(&sp->pp_cpq, m);
  837. if (m == NULL &&
  838. (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
  839. IFQ_DEQUEUE (&sp->pp_if.if_snd, m);
  840. }
  841. splx(s);
  842. return m;
  843. }
  844. /*
  845. * Pick the next packet, do not remove it from the queue.
  846. */
  847. struct mbuf *
  848. sppp_pick(struct ifnet *ifp)
  849. {
  850. struct sppp *sp = (struct sppp*)ifp;
  851. struct mbuf *m;
  852. int s;
  853. s = splnet();
  854. IF_POLL(&sp->pp_cpq, m);
  855. if (m == NULL &&
  856. (sp->pp_phase == PHASE_NETWORK ||
  857. (sp->pp_flags & PP_CISCO) != 0)) {
  858. IFQ_POLL(&sp->pp_if.if_snd, m);
  859. }
  860. splx (s);
  861. return (m);
  862. }
  863. /*
  864. * Process an ioctl request. Called on low priority level.
  865. */
  866. int
  867. sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
  868. {
  869. struct ifreq *ifr = data;
  870. struct ifaddr *ifa = data;
  871. struct sppp *sp = (struct sppp*) ifp;
  872. int s, rv, going_up, going_down, newmode;
  873. s = splnet();
  874. rv = 0;
  875. switch (cmd) {
  876. case SIOCAIFADDR:
  877. case SIOCSIFDSTADDR:
  878. break;
  879. case SIOCSIFADDR:
  880. if_up(ifp);
  881. ifa->ifa_rtrequest = p2p_rtrequest;
  882. /* FALLTHROUGH */
  883. case SIOCSIFFLAGS:
  884. going_up = (ifp->if_flags & IFF_UP) &&
  885. (ifp->if_flags & IFF_RUNNING) == 0;
  886. going_down = (ifp->if_flags & IFF_UP) == 0 &&
  887. (ifp->if_flags & IFF_RUNNING);
  888. newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
  889. if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
  890. /* sanity */
  891. newmode = IFF_PASSIVE;
  892. ifp->if_flags &= ~IFF_AUTO;
  893. }
  894. if (going_up || going_down)
  895. if (!(sp->pp_flags & PP_CISCO))
  896. lcp.Close(sp);
  897. if (going_up && newmode == 0) {
  898. /* neither auto-dial nor passive */
  899. ifp->if_flags |= IFF_RUNNING;
  900. if (!(sp->pp_flags & PP_CISCO))
  901. lcp.Open(sp);
  902. } else if (going_down) {
  903. sppp_flush(ifp);
  904. ifp->if_flags &= ~IFF_RUNNING;
  905. }
  906. break;
  907. #ifdef SIOCSIFMTU
  908. case SIOCSIFMTU:
  909. if (ifr->ifr_mtu < 128 ||
  910. (sp->lcp.their_mru > 0 &&
  911. ifr->ifr_mtu > sp->lcp.their_mru)) {
  912. splx(s);
  913. return (EINVAL);
  914. }
  915. ifp->if_mtu = ifr->ifr_mtu;
  916. break;
  917. #endif
  918. #ifdef SLIOCSETMTU
  919. case SLIOCSETMTU:
  920. if (*(short*)data < 128 ||
  921. (sp->lcp.their_mru > 0 &&
  922. *(short*)data > sp->lcp.their_mru)) {
  923. splx(s);
  924. return (EINVAL);
  925. }
  926. ifp->if_mtu = *(short*)data;
  927. break;
  928. #endif
  929. #ifdef SIOCGIFMTU
  930. case SIOCGIFMTU:
  931. ifr->ifr_mtu = ifp->if_mtu;
  932. break;
  933. #endif
  934. #ifdef SIOCGIFHARDMTU
  935. case SIOCGIFHARDMTU:
  936. ifr->ifr_hardmtu = ifp->if_hardmtu;
  937. break;
  938. #endif
  939. #ifdef SLIOCGETMTU
  940. case SLIOCGETMTU:
  941. *(short*)data = ifp->if_mtu;
  942. break;
  943. #endif
  944. case SIOCADDMULTI:
  945. case SIOCDELMULTI:
  946. break;
  947. case SIOCGSPPPPARAMS:
  948. rv = sppp_get_params(sp, ifr);
  949. break;
  950. case SIOCSSPPPPARAMS:
  951. rv = sppp_set_params(sp, ifr);
  952. break;
  953. default:
  954. rv = ENOTTY;
  955. }
  956. splx(s);
  957. return rv;
  958. }
  959. /*
  960. * Cisco framing implementation.
  961. */
  962. /*
  963. * Handle incoming Cisco keepalive protocol packets.
  964. */
  965. void
  966. sppp_cisco_input(struct sppp *sp, struct mbuf *m)
  967. {
  968. STDDCL;
  969. struct cisco_packet *h;
  970. u_int32_t me, mymask;
  971. if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
  972. if (debug)
  973. log(LOG_DEBUG,
  974. SPP_FMT "cisco invalid packet length: %d bytes\n",
  975. SPP_ARGS(ifp), m->m_pkthdr.len);
  976. return;
  977. }
  978. h = mtod (m, struct cisco_packet*);
  979. if (debug)
  980. log(LOG_DEBUG,
  981. SPP_FMT "cisco input: %d bytes "
  982. "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
  983. SPP_ARGS(ifp), m->m_pkthdr.len,
  984. ntohl(h->type), h->par1, h->par2, (u_int)h->rel,
  985. (u_int)h->time0, (u_int)h->time1);
  986. switch (ntohl (h->type)) {
  987. default:
  988. if (debug)
  989. addlog(SPP_FMT "cisco unknown packet type: 0x%x\n",
  990. SPP_ARGS(ifp), ntohl(h->type));
  991. break;
  992. case CISCO_ADDR_REPLY:
  993. /* Reply on address request, ignore */
  994. break;
  995. case CISCO_KEEPALIVE_REQ:
  996. sp->pp_alivecnt = 0;
  997. sp->pp_rseq = ntohl (h->par1);
  998. if (sp->pp_seq == sp->pp_rseq) {
  999. /* Local and remote sequence numbers are equal.
  1000. * Probably, the line is in loopback mode. */
  1001. if (sp->pp_loopcnt >= LOOPALIVECNT) {
  1002. log(LOG_INFO, SPP_FMT "loopback\n",
  1003. SPP_ARGS(ifp));
  1004. sp->pp_loopcnt = 0;
  1005. if (ifp->if_flags & IFF_UP) {
  1006. if_down (ifp);
  1007. sppp_qflush (&sp->pp_cpq);
  1008. }
  1009. }
  1010. ++sp->pp_loopcnt;
  1011. /* Generate new local sequence number */
  1012. sp->pp_seq = arc4random();
  1013. break;
  1014. }
  1015. sp->pp_loopcnt = 0;
  1016. if (! (ifp->if_flags & IFF_UP) &&
  1017. (ifp->if_flags & IFF_RUNNING)) {
  1018. if_up(ifp);
  1019. if (debug)
  1020. log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp));
  1021. }
  1022. break;
  1023. case CISCO_ADDR_REQ:
  1024. sppp_get_ip_addrs(sp, &me, 0, &mymask);
  1025. if (me != 0)
  1026. sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
  1027. break;
  1028. }
  1029. }
  1030. /*
  1031. * Send Cisco keepalive packet.
  1032. */
  1033. void
  1034. sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2)
  1035. {
  1036. STDDCL;
  1037. struct ppp_header *h;
  1038. struct cisco_packet *ch;
  1039. struct mbuf *m;
  1040. struct timeval tv;
  1041. getmicrouptime(&tv);
  1042. MGETHDR (m, M_DONTWAIT, MT_DATA);
  1043. if (! m)
  1044. return;
  1045. m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
  1046. m->m_pkthdr.ph_ifidx = 0;
  1047. h = mtod (m, struct ppp_header*);
  1048. h->address = CISCO_MULTICAST;
  1049. h->control = 0;
  1050. h->protocol = htons (CISCO_KEEPALIVE);
  1051. ch = (struct cisco_packet*) (h + 1);
  1052. ch->type = htonl (type);
  1053. ch->par1 = htonl (par1);
  1054. ch->par2 = htonl (par2);
  1055. ch->rel = -1;
  1056. ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
  1057. ch->time1 = htons ((u_short) tv.tv_sec);
  1058. if (debug)
  1059. log(LOG_DEBUG, SPP_FMT
  1060. "cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
  1061. SPP_ARGS(ifp), ntohl(ch->type), ch->par1, ch->par2,
  1062. (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
  1063. if (IF_QFULL (&sp->pp_cpq)) {
  1064. IF_DROP (&ifp->if_snd);
  1065. m_freem (m);
  1066. m = NULL;
  1067. } else
  1068. IF_ENQUEUE (&sp->pp_cpq, m);
  1069. if (! (ifp->if_flags & IFF_OACTIVE))
  1070. (*ifp->if_start) (ifp);
  1071. if (m != NULL)
  1072. ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
  1073. }
  1074. /*
  1075. * PPP protocol implementation.
  1076. */
  1077. /*
  1078. * Send PPP control protocol packet.
  1079. */
  1080. void
  1081. sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
  1082. u_char ident, u_short len, void *data)
  1083. {
  1084. STDDCL;
  1085. struct ppp_header *h;
  1086. struct lcp_header *lh;
  1087. struct mbuf *m;
  1088. size_t pkthdrlen;
  1089. pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
  1090. if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
  1091. len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
  1092. MGETHDR (m, M_DONTWAIT, MT_DATA);
  1093. if (! m)
  1094. return;
  1095. m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
  1096. m->m_pkthdr.ph_ifidx = 0;
  1097. if (sp->pp_flags & PP_NOFRAMING) {
  1098. *mtod(m, u_int16_t *) = htons(proto);
  1099. lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
  1100. } else {
  1101. h = mtod (m, struct ppp_header*);
  1102. h->address = PPP_ALLSTATIONS; /* broadcast address */
  1103. h->control = PPP_UI; /* Unnumbered Info */
  1104. h->protocol = htons (proto); /* Link Control Protocol */
  1105. lh = (struct lcp_header*) (h + 1);
  1106. }
  1107. lh->type = type;
  1108. lh->ident = ident;
  1109. lh->len = htons (LCP_HEADER_LEN + len);
  1110. if (len)
  1111. bcopy (data, lh+1, len);
  1112. if (debug) {
  1113. log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
  1114. SPP_ARGS(ifp),
  1115. sppp_proto_name(proto),
  1116. sppp_cp_type_name (lh->type), lh->ident,
  1117. ntohs (lh->len));
  1118. if (len)
  1119. sppp_print_bytes ((u_char*) (lh+1), len);
  1120. addlog(">\n");
  1121. }
  1122. if (IF_QFULL (&sp->pp_cpq)) {
  1123. IF_DROP (&ifp->if_snd);
  1124. m_freem (m);
  1125. ++ifp->if_oerrors;
  1126. m = NULL;
  1127. } else
  1128. IF_ENQUEUE (&sp->pp_cpq, m);
  1129. if (!(ifp->if_flags & IFF_OACTIVE))
  1130. (*ifp->if_start) (ifp);
  1131. if (m != NULL)
  1132. ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
  1133. }
  1134. /*
  1135. * Handle incoming PPP control protocol packets.
  1136. */
  1137. void
  1138. sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
  1139. {
  1140. STDDCL;
  1141. struct lcp_header *h;
  1142. int len = m->m_pkthdr.len;
  1143. int rv;
  1144. u_char *p;
  1145. u_long nmagic;
  1146. if (len < 4) {
  1147. if (debug)
  1148. log(LOG_DEBUG,
  1149. SPP_FMT "%s invalid packet length: %d bytes\n",
  1150. SPP_ARGS(ifp), cp->name, len);
  1151. return;
  1152. }
  1153. h = mtod (m, struct lcp_header*);
  1154. if (debug) {
  1155. log(LOG_DEBUG,
  1156. SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
  1157. SPP_ARGS(ifp), cp->name,
  1158. sppp_state_name(sp->state[cp->protoidx]),
  1159. sppp_cp_type_name (h->type), h->ident, ntohs (h->len));
  1160. if (len > 4)
  1161. sppp_print_bytes ((u_char*) (h+1), len-4);
  1162. addlog(">\n");
  1163. }
  1164. if (len > ntohs (h->len))
  1165. len = ntohs (h->len);
  1166. p = (u_char *)(h + 1);
  1167. switch (h->type) {
  1168. case CONF_REQ:
  1169. if (len < 4) {
  1170. if (debug)
  1171. addlog(SPP_FMT "%s invalid conf-req length %d\n",
  1172. SPP_ARGS(ifp), cp->name,
  1173. len);
  1174. ++ifp->if_ierrors;
  1175. break;
  1176. }
  1177. /* handle states where RCR doesn't get a SCA/SCN */
  1178. switch (sp->state[cp->protoidx]) {
  1179. case STATE_CLOSING:
  1180. case STATE_STOPPING:
  1181. return;
  1182. case STATE_CLOSED:
  1183. sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
  1184. 0, 0);
  1185. return;
  1186. }
  1187. rv = (cp->RCR)(sp, h, len);
  1188. /* silently drop illegal packets */
  1189. if (rv == -1)
  1190. return;
  1191. switch (sp->state[cp->protoidx]) {
  1192. case STATE_OPENED:
  1193. sppp_cp_change_state(cp, sp, rv?
  1194. STATE_ACK_SENT: STATE_REQ_SENT);
  1195. (cp->tld)(sp);
  1196. (cp->scr)(sp);
  1197. break;
  1198. case STATE_ACK_SENT:
  1199. case STATE_REQ_SENT:
  1200. sppp_cp_change_state(cp, sp, rv?
  1201. STATE_ACK_SENT: STATE_REQ_SENT);
  1202. break;
  1203. case STATE_STOPPED:
  1204. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1205. sppp_cp_change_state(cp, sp, rv?
  1206. STATE_ACK_SENT: STATE_REQ_SENT);
  1207. (cp->scr)(sp);
  1208. break;
  1209. case STATE_ACK_RCVD:
  1210. if (rv) {
  1211. sppp_cp_change_state(cp, sp, STATE_OPENED);
  1212. if (debug)
  1213. log(LOG_DEBUG, SPP_FMT "%s tlu\n",
  1214. SPP_ARGS(ifp),
  1215. cp->name);
  1216. (cp->tlu)(sp);
  1217. } else
  1218. sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
  1219. break;
  1220. default:
  1221. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1222. SPP_ARGS(ifp), cp->name,
  1223. sppp_cp_type_name(h->type),
  1224. sppp_state_name(sp->state[cp->protoidx])); */
  1225. ++ifp->if_ierrors;
  1226. }
  1227. break;
  1228. case CONF_ACK:
  1229. if (h->ident != sp->confid[cp->protoidx]) {
  1230. if (debug)
  1231. addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
  1232. SPP_ARGS(ifp), cp->name,
  1233. h->ident, sp->confid[cp->protoidx]);
  1234. ++ifp->if_ierrors;
  1235. break;
  1236. }
  1237. switch (sp->state[cp->protoidx]) {
  1238. case STATE_CLOSED:
  1239. case STATE_STOPPED:
  1240. sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
  1241. break;
  1242. case STATE_CLOSING:
  1243. case STATE_STOPPING:
  1244. break;
  1245. case STATE_REQ_SENT:
  1246. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1247. sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
  1248. break;
  1249. case STATE_OPENED:
  1250. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1251. (cp->tld)(sp);
  1252. (cp->scr)(sp);
  1253. break;
  1254. case STATE_ACK_RCVD:
  1255. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1256. (cp->scr)(sp);
  1257. break;
  1258. case STATE_ACK_SENT:
  1259. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1260. sppp_cp_change_state(cp, sp, STATE_OPENED);
  1261. if (debug)
  1262. log(LOG_DEBUG, SPP_FMT "%s tlu\n",
  1263. SPP_ARGS(ifp), cp->name);
  1264. (cp->tlu)(sp);
  1265. break;
  1266. default:
  1267. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1268. SPP_ARGS(ifp), cp->name,
  1269. sppp_cp_type_name(h->type),
  1270. sppp_state_name(sp->state[cp->protoidx])); */
  1271. ++ifp->if_ierrors;
  1272. }
  1273. break;
  1274. case CONF_NAK:
  1275. case CONF_REJ:
  1276. if (h->ident != sp->confid[cp->protoidx]) {
  1277. if (debug)
  1278. addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
  1279. SPP_ARGS(ifp), cp->name,
  1280. h->ident, sp->confid[cp->protoidx]);
  1281. ++ifp->if_ierrors;
  1282. break;
  1283. }
  1284. if (h->type == CONF_NAK)
  1285. (cp->RCN_nak)(sp, h, len);
  1286. else /* CONF_REJ */
  1287. (cp->RCN_rej)(sp, h, len);
  1288. switch (sp->state[cp->protoidx]) {
  1289. case STATE_CLOSED:
  1290. case STATE_STOPPED:
  1291. sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
  1292. break;
  1293. case STATE_REQ_SENT:
  1294. case STATE_ACK_SENT:
  1295. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1296. (cp->scr)(sp);
  1297. break;
  1298. case STATE_OPENED:
  1299. sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
  1300. (cp->tld)(sp);
  1301. (cp->scr)(sp);
  1302. break;
  1303. case STATE_ACK_RCVD:
  1304. sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
  1305. (cp->scr)(sp);
  1306. break;
  1307. case STATE_CLOSING:
  1308. case STATE_STOPPING:
  1309. break;
  1310. default:
  1311. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1312. SPP_ARGS(ifp), cp->name,
  1313. sppp_cp_type_name(h->type),
  1314. sppp_state_name(sp->state[cp->protoidx])); */
  1315. ++ifp->if_ierrors;
  1316. }
  1317. break;
  1318. case TERM_REQ:
  1319. switch (sp->state[cp->protoidx]) {
  1320. case STATE_ACK_RCVD:
  1321. case STATE_ACK_SENT:
  1322. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1323. /* FALLTHROUGH */
  1324. case STATE_CLOSED:
  1325. case STATE_STOPPED:
  1326. case STATE_CLOSING:
  1327. case STATE_STOPPING:
  1328. case STATE_REQ_SENT:
  1329. sta:
  1330. /* Send Terminate-Ack packet. */
  1331. if (debug)
  1332. log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
  1333. SPP_ARGS(ifp), cp->name);
  1334. sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
  1335. break;
  1336. case STATE_OPENED:
  1337. sp->rst_counter[cp->protoidx] = 0;
  1338. sppp_cp_change_state(cp, sp, STATE_STOPPING);
  1339. (cp->tld)(sp);
  1340. goto sta;
  1341. break;
  1342. default:
  1343. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1344. SPP_ARGS(ifp), cp->name,
  1345. sppp_cp_type_name(h->type),
  1346. sppp_state_name(sp->state[cp->protoidx])); */
  1347. ++ifp->if_ierrors;
  1348. }
  1349. break;
  1350. case TERM_ACK:
  1351. switch (sp->state[cp->protoidx]) {
  1352. case STATE_CLOSED:
  1353. case STATE_STOPPED:
  1354. case STATE_REQ_SENT:
  1355. case STATE_ACK_SENT:
  1356. break;
  1357. case STATE_CLOSING:
  1358. sppp_cp_change_state(cp, sp, STATE_CLOSED);
  1359. (cp->tlf)(sp);
  1360. break;
  1361. case STATE_STOPPING:
  1362. sppp_cp_change_state(cp, sp, STATE_STOPPED);
  1363. (cp->tlf)(sp);
  1364. break;
  1365. case STATE_ACK_RCVD:
  1366. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1367. break;
  1368. case STATE_OPENED:
  1369. sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
  1370. (cp->tld)(sp);
  1371. (cp->scr)(sp);
  1372. break;
  1373. default:
  1374. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1375. SPP_ARGS(ifp), cp->name,
  1376. sppp_cp_type_name(h->type),
  1377. sppp_state_name(sp->state[cp->protoidx])); */
  1378. ++ifp->if_ierrors;
  1379. }
  1380. break;
  1381. case CODE_REJ:
  1382. case PROTO_REJ:
  1383. {
  1384. int catastrophic = 0;
  1385. const struct cp *upper = NULL;
  1386. int i;
  1387. u_int16_t proto;
  1388. if (len < 2) {
  1389. if (debug)
  1390. log(LOG_DEBUG, SPP_FMT "invalid proto-rej length\n",
  1391. SPP_ARGS(ifp));
  1392. ++ifp->if_ierrors;
  1393. break;
  1394. }
  1395. proto = ntohs(*((u_int16_t *)p));
  1396. for (i = 0; i < IDX_COUNT; i++) {
  1397. if (cps[i]->proto == proto) {
  1398. upper = cps[i];
  1399. break;
  1400. }
  1401. }
  1402. if (upper == NULL)
  1403. catastrophic++;
  1404. if (catastrophic || debug)
  1405. log(catastrophic? LOG_INFO: LOG_DEBUG,
  1406. SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
  1407. SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+',
  1408. sppp_cp_type_name(h->type), proto,
  1409. upper ? upper->name : "unknown",
  1410. upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
  1411. /*
  1412. * if we got RXJ+ against conf-req, the peer does not implement
  1413. * this particular protocol type. terminate the protocol.
  1414. */
  1415. if (upper) {
  1416. if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
  1417. upper->Close(sp);
  1418. break;
  1419. }
  1420. }
  1421. /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
  1422. switch (sp->state[cp->protoidx]) {
  1423. case STATE_CLOSED:
  1424. case STATE_STOPPED:
  1425. case STATE_REQ_SENT:
  1426. case STATE_ACK_SENT:
  1427. case STATE_CLOSING:
  1428. case STATE_STOPPING:
  1429. case STATE_OPENED:
  1430. break;
  1431. case STATE_ACK_RCVD:
  1432. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1433. break;
  1434. default:
  1435. /* printf(SPP_FMT "%s illegal %s in state %s\n",
  1436. SPP_ARGS(ifp), cp->name,
  1437. sppp_cp_type_name(h->type),
  1438. sppp_state_name(sp->state[cp->protoidx])); */
  1439. ++ifp->if_ierrors;
  1440. }
  1441. break;
  1442. }
  1443. case DISC_REQ:
  1444. if (cp->proto != PPP_LCP)
  1445. goto illegal;
  1446. /* Discard the packet. */
  1447. break;
  1448. case ECHO_REQ:
  1449. if (cp->proto != PPP_LCP)
  1450. goto illegal;
  1451. if (sp->state[cp->protoidx] != STATE_OPENED) {
  1452. if (debug)
  1453. addlog(SPP_FMT "lcp echo req but lcp closed\n",
  1454. SPP_ARGS(ifp));
  1455. ++ifp->if_ierrors;
  1456. break;
  1457. }
  1458. if (len < 8) {
  1459. if (debug)
  1460. addlog(SPP_FMT "invalid lcp echo request "
  1461. "packet length: %d bytes\n",
  1462. SPP_ARGS(ifp), len);
  1463. break;
  1464. }
  1465. nmagic = (u_long)p[0] << 24 |
  1466. (u_long)p[1] << 16 | p[2] << 8 | p[3];
  1467. if (nmagic == sp->lcp.magic) {
  1468. /* Line loopback mode detected. */
  1469. log(LOG_INFO, SPP_FMT "loopback\n", SPP_ARGS(ifp));
  1470. /* Shut down the PPP link. */
  1471. lcp.Close(sp);
  1472. break;
  1473. }
  1474. p[0] = sp->lcp.magic >> 24;
  1475. p[1] = sp->lcp.magic >> 16;
  1476. p[2] = sp->lcp.magic >> 8;
  1477. p[3] = sp->lcp.magic;
  1478. if (debug)
  1479. addlog(SPP_FMT "got lcp echo req, sending echo rep\n",
  1480. SPP_ARGS(ifp));
  1481. sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
  1482. break;
  1483. case ECHO_REPLY:
  1484. if (cp->proto != PPP_LCP)
  1485. goto illegal;
  1486. if (h->ident != sp->lcp.echoid) {
  1487. ++ifp->if_ierrors;
  1488. break;
  1489. }
  1490. if (len < 8) {
  1491. if (debug)
  1492. addlog(SPP_FMT "lcp invalid echo reply "
  1493. "packet length: %d bytes\n",
  1494. SPP_ARGS(ifp), len);
  1495. break;
  1496. }
  1497. if (debug)
  1498. addlog(SPP_FMT "lcp got echo rep\n",
  1499. SPP_ARGS(ifp));
  1500. nmagic = (u_long)p[0] << 24 |
  1501. (u_long)p[1] << 16 | p[2] << 8 | p[3];
  1502. if (nmagic != sp->lcp.magic)
  1503. sp->pp_alivecnt = 0;
  1504. break;
  1505. default:
  1506. /* Unknown packet type -- send Code-Reject packet. */
  1507. illegal:
  1508. if (debug)
  1509. addlog(SPP_FMT "%s send code-rej for 0x%x\n",
  1510. SPP_ARGS(ifp), cp->name, h->type);
  1511. sppp_cp_send(sp, cp->proto, CODE_REJ, ++sp->pp_seq,
  1512. m->m_pkthdr.len, h);
  1513. ++ifp->if_ierrors;
  1514. }
  1515. }
  1516. /*
  1517. * The generic part of all Up/Down/Open/Close/TO event handlers.
  1518. * Basically, the state transition handling in the automaton.
  1519. */
  1520. void
  1521. sppp_up_event(const struct cp *cp, struct sppp *sp)
  1522. {
  1523. STDDCL;
  1524. if (debug)
  1525. log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
  1526. SPP_ARGS(ifp), cp->name,
  1527. sppp_state_name(sp->state[cp->protoidx]));
  1528. switch (sp->state[cp->protoidx]) {
  1529. case STATE_INITIAL:
  1530. sppp_cp_change_state(cp, sp, STATE_CLOSED);
  1531. break;
  1532. case STATE_STARTING:
  1533. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1534. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1535. (cp->scr)(sp);
  1536. break;
  1537. default:
  1538. /* printf(SPP_FMT "%s illegal up in state %s\n",
  1539. SPP_ARGS(ifp), cp->name,
  1540. sppp_state_name(sp->state[cp->protoidx])); */
  1541. break;
  1542. }
  1543. }
  1544. void
  1545. sppp_down_event(const struct cp *cp, struct sppp *sp)
  1546. {
  1547. STDDCL;
  1548. if (debug)
  1549. log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
  1550. SPP_ARGS(ifp), cp->name,
  1551. sppp_state_name(sp->state[cp->protoidx]));
  1552. switch (sp->state[cp->protoidx]) {
  1553. case STATE_CLOSED:
  1554. case STATE_CLOSING:
  1555. sppp_cp_change_state(cp, sp, STATE_INITIAL);
  1556. break;
  1557. case STATE_STOPPED:
  1558. sppp_cp_change_state(cp, sp, STATE_STARTING);
  1559. (cp->tls)(sp);
  1560. break;
  1561. case STATE_STOPPING:
  1562. case STATE_REQ_SENT:
  1563. case STATE_ACK_RCVD:
  1564. case STATE_ACK_SENT:
  1565. sppp_cp_change_state(cp, sp, STATE_STARTING);
  1566. break;
  1567. case STATE_OPENED:
  1568. sppp_cp_change_state(cp, sp, STATE_STARTING);
  1569. (cp->tld)(sp);
  1570. break;
  1571. default:
  1572. /* printf(SPP_FMT "%s illegal down in state %s\n",
  1573. SPP_ARGS(ifp), cp->name,
  1574. sppp_state_name(sp->state[cp->protoidx])); */
  1575. break;
  1576. }
  1577. }
  1578. void
  1579. sppp_open_event(const struct cp *cp, struct sppp *sp)
  1580. {
  1581. STDDCL;
  1582. if (debug)
  1583. log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
  1584. SPP_ARGS(ifp), cp->name,
  1585. sppp_state_name(sp->state[cp->protoidx]));
  1586. switch (sp->state[cp->protoidx]) {
  1587. case STATE_INITIAL:
  1588. sppp_cp_change_state(cp, sp, STATE_STARTING);
  1589. (cp->tls)(sp);
  1590. break;
  1591. case STATE_STARTING:
  1592. break;
  1593. case STATE_CLOSED:
  1594. sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
  1595. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1596. (cp->scr)(sp);
  1597. break;
  1598. case STATE_STOPPED:
  1599. case STATE_STOPPING:
  1600. case STATE_REQ_SENT:
  1601. case STATE_ACK_RCVD:
  1602. case STATE_ACK_SENT:
  1603. case STATE_OPENED:
  1604. break;
  1605. case STATE_CLOSING:
  1606. sppp_cp_change_state(cp, sp, STATE_STOPPING);
  1607. break;
  1608. }
  1609. }
  1610. void
  1611. sppp_close_event(const struct cp *cp, struct sppp *sp)
  1612. {
  1613. STDDCL;
  1614. if (debug)
  1615. log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
  1616. SPP_ARGS(ifp), cp->name,
  1617. sppp_state_name(sp->state[cp->protoidx]));
  1618. switch (sp->state[cp->protoidx]) {
  1619. case STATE_INITIAL:
  1620. case STATE_CLOSED:
  1621. case STATE_CLOSING:
  1622. break;
  1623. case STATE_STARTING:
  1624. sppp_cp_change_state(cp, sp, STATE_INITIAL);
  1625. (cp->tlf)(sp);
  1626. break;
  1627. case STATE_STOPPED:
  1628. sppp_cp_change_state(cp, sp, STATE_CLOSED);
  1629. break;
  1630. case STATE_STOPPING:
  1631. sppp_cp_change_state(cp, sp, STATE_CLOSING);
  1632. break;
  1633. case STATE_OPENED:
  1634. sppp_cp_change_state(cp, sp, STATE_CLOSING);
  1635. sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
  1636. sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
  1637. (cp->tld)(sp);
  1638. break;
  1639. case STATE_REQ_SENT:
  1640. case STATE_ACK_RCVD:
  1641. case STATE_ACK_SENT:
  1642. sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
  1643. sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
  1644. sppp_cp_change_state(cp, sp, STATE_CLOSING);
  1645. break;
  1646. }
  1647. }
  1648. void
  1649. sppp_increasing_timeout (const struct cp *cp, struct sppp *sp)
  1650. {
  1651. int timo;
  1652. timo = sp->lcp.max_configure - sp->rst_counter[cp->protoidx];
  1653. if (timo < 1)
  1654. timo = 1;
  1655. timeout_add(&sp->ch[cp->protoidx], timo * sp->lcp.timeout);
  1656. }
  1657. void
  1658. sppp_to_event(const struct cp *cp, struct sppp *sp)
  1659. {
  1660. STDDCL;
  1661. int s;
  1662. s = splnet();
  1663. if (debug)
  1664. log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
  1665. SPP_ARGS(ifp), cp->name,
  1666. sppp_state_name(sp->state[cp->protoidx]),
  1667. sp->rst_counter[cp->protoidx]);
  1668. if (--sp->rst_counter[cp->protoidx] < 0)
  1669. /* TO- event */
  1670. switch (sp->state[cp->protoidx]) {
  1671. case STATE_CLOSING:
  1672. sppp_cp_change_state(cp, sp, STATE_CLOSED);
  1673. (cp->tlf)(sp);
  1674. break;
  1675. case STATE_STOPPING:
  1676. sppp_cp_change_state(cp, sp, STATE_STOPPED);
  1677. (cp->tlf)(sp);
  1678. break;
  1679. case STATE_REQ_SENT:
  1680. case STATE_ACK_RCVD:
  1681. case STATE_ACK_SENT:
  1682. sppp_cp_change_state(cp, sp, STATE_STOPPED);
  1683. (cp->tlf)(sp);
  1684. break;
  1685. }
  1686. else
  1687. /* TO+ event */
  1688. switch (sp->state[cp->protoidx]) {
  1689. case STATE_CLOSING:
  1690. case STATE_STOPPING:
  1691. sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq,
  1692. 0, 0);
  1693. sppp_increasing_timeout (cp, sp);
  1694. break;
  1695. case STATE_REQ_SENT:
  1696. case STATE_ACK_RCVD:
  1697. /* sppp_cp_change_state() will restart the timer */
  1698. sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
  1699. (cp->scr)(sp);
  1700. break;
  1701. case STATE_ACK_SENT:
  1702. sppp_increasing_timeout (cp, sp);
  1703. (cp->scr)(sp);
  1704. break;
  1705. }
  1706. splx(s);
  1707. }
  1708. /*
  1709. * Change the state of a control protocol in the state automaton.
  1710. * Takes care of starting/stopping the restart timer.
  1711. */
  1712. void
  1713. sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
  1714. {
  1715. STDDCL;
  1716. if (debug && sp->state[cp->protoidx] != newstate)
  1717. log(LOG_DEBUG, SPP_FMT "%s %s->%s\n",
  1718. SPP_ARGS(ifp), cp->name,
  1719. sppp_state_name(sp->state[cp->protoidx]),
  1720. sppp_state_name(newstate));
  1721. sp->state[cp->protoidx] = newstate;
  1722. switch (newstate) {
  1723. case STATE_INITIAL:
  1724. case STATE_STARTING:
  1725. case STATE_CLOSED:
  1726. case STATE_STOPPED:
  1727. case STATE_OPENED:
  1728. UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]);
  1729. break;
  1730. case STATE_CLOSING:
  1731. case STATE_STOPPING:
  1732. case STATE_REQ_SENT:
  1733. case STATE_ACK_RCVD:
  1734. case STATE_ACK_SENT:
  1735. if (!timeout_pending(&sp->ch[cp->protoidx]))
  1736. sppp_increasing_timeout (cp, sp);
  1737. break;
  1738. }
  1739. }
  1740. /*
  1741. *--------------------------------------------------------------------------*
  1742. * *
  1743. * The LCP implementation. *
  1744. * *
  1745. *--------------------------------------------------------------------------*
  1746. */
  1747. void
  1748. sppp_lcp_init(struct sppp *sp)
  1749. {
  1750. sp->lcp.opts = (1 << LCP_OPT_MAGIC);
  1751. sp->lcp.magic = 0;
  1752. sp->state[IDX_LCP] = STATE_INITIAL;
  1753. sp->fail_counter[IDX_LCP] = 0;
  1754. sp->lcp.protos = 0;
  1755. sp->lcp.mru = sp->pp_if.if_mtu;
  1756. sp->lcp.their_mru = 0;
  1757. /*
  1758. * Initialize counters and timeout values. Note that we don't
  1759. * use the 3 seconds suggested in RFC 1661 since we are likely
  1760. * running on a fast link. XXX We should probably implement
  1761. * the exponential backoff option. Note that these values are
  1762. * relevant for all control protocols, not just LCP only.
  1763. */
  1764. sp->lcp.timeout = 1 * hz;
  1765. sp->lcp.max_terminate = 2;
  1766. sp->lcp.max_configure = 10;
  1767. sp->lcp.max_failure = 10;
  1768. }
  1769. void
  1770. sppp_lcp_up(struct sppp *sp)
  1771. {
  1772. STDDCL;
  1773. struct timeval tv;
  1774. if (sp->pp_flags & PP_CISCO) {
  1775. int s = splsoftnet();
  1776. sp->pp_if.if_link_state = LINK_STATE_UP;
  1777. if_link_state_change(&sp->pp_if);
  1778. splx(s);
  1779. return;
  1780. }
  1781. sp->pp_alivecnt = 0;
  1782. sp->lcp.opts = (1 << LCP_OPT_MAGIC);
  1783. sp->lcp.magic = 0;
  1784. sp->lcp.protos = 0;
  1785. if (sp->pp_if.if_mtu != PP_MTU) {
  1786. sp->lcp.mru = sp->pp_if.if_mtu;
  1787. sp->lcp.opts |= (1 << LCP_OPT_MRU);
  1788. } else
  1789. sp->lcp.mru = PP_MTU;
  1790. sp->lcp.their_mru = PP_MTU;
  1791. getmicrouptime(&tv);
  1792. sp->pp_last_receive = sp->pp_last_activity = tv.tv_sec;
  1793. /*
  1794. * If this interface is passive or dial-on-demand, and we are
  1795. * still in Initial state, it means we've got an incoming
  1796. * call. Activate the interface.
  1797. */
  1798. if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
  1799. if (debug)
  1800. log(LOG_DEBUG,
  1801. SPP_FMT "Up event", SPP_ARGS(ifp));
  1802. ifp->if_flags |= IFF_RUNNING;
  1803. if (sp->state[IDX_LCP] == STATE_INITIAL) {
  1804. if (debug)
  1805. addlog("(incoming call)\n");
  1806. sp->pp_flags |= PP_CALLIN;
  1807. lcp.Open(sp);
  1808. } else if (debug)
  1809. addlog("\n");
  1810. } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
  1811. (sp->state[IDX_LCP] == STATE_INITIAL)) {
  1812. ifp->if_flags |= IFF_RUNNING;
  1813. lcp.Open(sp);
  1814. }
  1815. sppp_up_event(&lcp, sp);
  1816. }
  1817. void
  1818. sppp_lcp_down(struct sppp *sp)
  1819. {
  1820. STDDCL;
  1821. if (sp->pp_flags & PP_CISCO) {
  1822. int s = splsoftnet();
  1823. sp->pp_if.if_link_state = LINK_STATE_DOWN;
  1824. if_link_state_change(&sp->pp_if);
  1825. splx(s);
  1826. return;
  1827. }
  1828. sppp_down_event(&lcp, sp);
  1829. /*
  1830. * If this is neither a dial-on-demand nor a passive
  1831. * interface, simulate an ``ifconfig down'' action, so the
  1832. * administrator can force a redial by another ``ifconfig
  1833. * up''. XXX For leased line operation, should we immediately
  1834. * try to reopen the connection here?
  1835. */
  1836. if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
  1837. if (debug)
  1838. log(LOG_DEBUG, SPP_FMT "Down event (carrier loss), "
  1839. "taking interface down.", SPP_ARGS(ifp));
  1840. if_down(ifp);
  1841. } else {
  1842. if (debug)
  1843. log(LOG_DEBUG, SPP_FMT "Down event (carrier loss)\n",
  1844. SPP_ARGS(ifp));
  1845. }
  1846. if (sp->state[IDX_LCP] != STATE_INITIAL)
  1847. lcp.Close(sp);
  1848. sp->lcp.their_mru = 0;
  1849. sp->pp_flags &= ~PP_CALLIN;
  1850. ifp->if_flags &= ~IFF_RUNNING;
  1851. sppp_flush(ifp);
  1852. }
  1853. void
  1854. sppp_lcp_open(struct sppp *sp)
  1855. {
  1856. /*
  1857. * If we are authenticator, negotiate LCP_AUTH
  1858. */
  1859. if (sp->hisauth.proto != 0)
  1860. sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
  1861. else
  1862. sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
  1863. sp->pp_flags &= ~PP_NEEDAUTH;
  1864. sppp_open_event(&lcp, sp);
  1865. }
  1866. void
  1867. sppp_lcp_close(struct sppp *sp)
  1868. {
  1869. sppp_close_event(&lcp, sp);
  1870. }
  1871. void
  1872. sppp_lcp_TO(void *cookie)
  1873. {
  1874. sppp_to_event(&lcp, (struct sppp *)cookie);
  1875. }
  1876. /*
  1877. * Analyze a configure request. Return true if it was agreeable, and
  1878. * caused action sca, false if it has been rejected or nak'ed, and
  1879. * caused action scn. (The return value is used to make the state
  1880. * transition decision in the state automaton.)
  1881. */
  1882. int
  1883. sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
  1884. {
  1885. STDDCL;
  1886. u_char *buf, *r, *p;
  1887. int origlen, rlen;
  1888. u_long nmagic;
  1889. u_short authproto;
  1890. len -= 4;
  1891. origlen = len;
  1892. buf = r = malloc (len, M_TEMP, M_NOWAIT);
  1893. if (! buf)
  1894. return (0);
  1895. if (debug)
  1896. log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
  1897. SPP_ARGS(ifp));
  1898. /* pass 1: check for things that need to be rejected */
  1899. p = (void*) (h+1);
  1900. for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
  1901. if (p[1] < 2 || p[1] > len) {
  1902. free(buf, M_TEMP, 0);
  1903. return (-1);
  1904. }
  1905. if (debug)
  1906. addlog("%s ", sppp_lcp_opt_name(*p));
  1907. switch (*p) {
  1908. case LCP_OPT_MAGIC:
  1909. /* Magic number. */
  1910. /* FALLTHROUGH, both are same length */
  1911. case LCP_OPT_ASYNC_MAP:
  1912. /* Async control character map. */
  1913. if (len >= 6 && p[1] == 6)
  1914. continue;
  1915. if (debug)
  1916. addlog("[invalid] ");
  1917. break;
  1918. case LCP_OPT_MRU:
  1919. /* Maximum receive unit. */
  1920. if (len >= 4 && p[1] == 4)
  1921. continue;
  1922. if (debug)
  1923. addlog("[invalid] ");
  1924. break;
  1925. case LCP_OPT_AUTH_PROTO:
  1926. if (len < 4) {
  1927. if (debug)
  1928. addlog("[invalid] ");
  1929. break;
  1930. }
  1931. authproto = (p[2] << 8) + p[3];
  1932. if (authproto == PPP_CHAP && p[1] != 5) {
  1933. if (debug)
  1934. addlog("[invalid chap len] ");
  1935. break;
  1936. }
  1937. if (sp->myauth.proto == 0) {
  1938. /* we are not configured to do auth */
  1939. if (debug)
  1940. addlog("[not configured] ");
  1941. break;
  1942. }
  1943. /*
  1944. * Remote want us to authenticate, remember this,
  1945. * so we stay in PHASE_AUTHENTICATE after LCP got
  1946. * up.
  1947. */
  1948. sp->pp_flags |= PP_NEEDAUTH;
  1949. continue;
  1950. default:
  1951. /* Others not supported. */
  1952. if (debug)
  1953. addlog("[rej] ");
  1954. break;
  1955. }
  1956. /* Add the option to rejected list. */
  1957. bcopy (p, r, p[1]);
  1958. r += p[1];
  1959. rlen += p[1];
  1960. }
  1961. if (rlen) {
  1962. if (debug)
  1963. addlog(" send conf-rej\n");
  1964. sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
  1965. goto end;
  1966. } else if (debug)
  1967. addlog("\n");
  1968. /*
  1969. * pass 2: check for option values that are unacceptable and
  1970. * thus require to be nak'ed.
  1971. */
  1972. if (debug)
  1973. log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
  1974. SPP_ARGS(ifp));
  1975. p = (void*) (h+1);
  1976. len = origlen;
  1977. for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
  1978. if (debug)
  1979. addlog("%s ", sppp_lcp_opt_name(*p));
  1980. switch (*p) {
  1981. case LCP_OPT_MAGIC:
  1982. /* Magic number -- extract. */
  1983. nmagic = (u_long)p[2] << 24 |
  1984. (u_long)p[3] << 16 | p[4] << 8 | p[5];
  1985. if (nmagic != sp->lcp.magic) {
  1986. if (debug)
  1987. addlog("0x%lx ", nmagic);
  1988. continue;
  1989. }
  1990. if (debug)
  1991. addlog("[glitch] ");
  1992. ++sp->pp_loopcnt;
  1993. /*
  1994. * We negate our magic here, and NAK it. If
  1995. * we see it later in an NAK packet, we
  1996. * suggest a new one.
  1997. */
  1998. nmagic = ~sp->lcp.magic;
  1999. /* Gonna NAK it. */
  2000. p[2] = nmagic >> 24;
  2001. p[3] = nmagic >> 16;
  2002. p[4] = nmagic >> 8;
  2003. p[5] = nmagic;
  2004. break;
  2005. case LCP_OPT_ASYNC_MAP:
  2006. /* Async control character map -- check to be zero. */
  2007. if (! p[2] && ! p[3] && ! p[4] && ! p[5]) {
  2008. if (debug)
  2009. addlog("[empty] ");
  2010. continue;
  2011. }
  2012. if (debug)
  2013. addlog("[non-empty] ");
  2014. /* suggest a zero one */
  2015. p[2] = p[3] = p[4] = p[5] = 0;
  2016. break;
  2017. case LCP_OPT_MRU:
  2018. /*
  2019. * Maximum receive unit. Always agreeable,
  2020. * but ignored by now.
  2021. */
  2022. sp->lcp.their_mru = p[2] * 256 + p[3];
  2023. if (debug)
  2024. addlog("%lu ", sp->lcp.their_mru);
  2025. continue;
  2026. case LCP_OPT_AUTH_PROTO:
  2027. authproto = (p[2] << 8) + p[3];
  2028. if (sp->myauth.proto != authproto) {
  2029. /* not agreed, nak */
  2030. if (debug)
  2031. addlog("[mine %s != his %s] ",
  2032. sppp_proto_name(sp->hisauth.proto),
  2033. sppp_proto_name(authproto));
  2034. p[2] = sp->myauth.proto >> 8;
  2035. p[3] = sp->myauth.proto;
  2036. break;
  2037. }
  2038. if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
  2039. if (debug)
  2040. addlog("[chap not MD5] ");
  2041. p[4] = CHAP_MD5;
  2042. break;
  2043. }
  2044. continue;
  2045. }
  2046. /* Add the option to nak'ed list. */
  2047. bcopy (p, r, p[1]);
  2048. r += p[1];
  2049. rlen += p[1];
  2050. }
  2051. if (rlen) {
  2052. if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
  2053. if (debug)
  2054. addlog(" max_failure (%d) exceeded, "
  2055. "send conf-rej\n",
  2056. sp->lcp.max_failure);
  2057. sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
  2058. } else {
  2059. if (debug)
  2060. addlog(" send conf-nak\n");
  2061. sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
  2062. }
  2063. goto end;
  2064. } else {
  2065. if (debug)
  2066. addlog("send conf-ack\n");
  2067. sp->fail_counter[IDX_LCP] = 0;
  2068. sp->pp_loopcnt = 0;
  2069. sppp_cp_send (sp, PPP_LCP, CONF_ACK,
  2070. h->ident, origlen, h+1);
  2071. }
  2072. end:
  2073. free(buf, M_TEMP, 0);
  2074. return (rlen == 0);
  2075. }
  2076. /*
  2077. * Analyze the LCP Configure-Reject option list, and adjust our
  2078. * negotiation.
  2079. */
  2080. void
  2081. sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
  2082. {
  2083. STDDCL;
  2084. u_char *p;
  2085. len -= 4;
  2086. if (debug)
  2087. log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
  2088. SPP_ARGS(ifp));
  2089. p = (void*) (h+1);
  2090. for (; len > 1; len -= p[1], p += p[1]) {
  2091. if (p[1] < 2 || p[1] > len)
  2092. return;
  2093. if (debug)
  2094. addlog("%s ", sppp_lcp_opt_name(*p));
  2095. switch (*p) {
  2096. case LCP_OPT_MAGIC:
  2097. /* Magic number -- can't use it, use 0 */
  2098. sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
  2099. sp->lcp.magic = 0;
  2100. break;
  2101. case LCP_OPT_MRU:
  2102. /*
  2103. * Should not be rejected anyway, since we only
  2104. * negotiate a MRU if explicitly requested by
  2105. * peer.
  2106. */
  2107. sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
  2108. break;
  2109. case LCP_OPT_AUTH_PROTO:
  2110. /*
  2111. * Peer doesn't want to authenticate himself,
  2112. * deny unless this is a dialout call, and
  2113. * AUTHFLAG_NOCALLOUT is set.
  2114. */
  2115. if ((sp->pp_flags & PP_CALLIN) == 0 &&
  2116. (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
  2117. if (debug)
  2118. addlog("[don't insist on auth "
  2119. "for callout]");
  2120. sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
  2121. break;
  2122. }
  2123. if (debug)
  2124. addlog("[access denied]\n");
  2125. lcp.Close(sp);
  2126. break;
  2127. }
  2128. }
  2129. if (debug)
  2130. addlog("\n");
  2131. }
  2132. /*
  2133. * Analyze the LCP Configure-NAK option list, and adjust our
  2134. * negotiation.
  2135. */
  2136. void
  2137. sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
  2138. {
  2139. STDDCL;
  2140. u_char *p;
  2141. u_long magic;
  2142. len -= 4;
  2143. if (debug)
  2144. log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
  2145. SPP_ARGS(ifp));
  2146. p = (void*) (h+1);
  2147. for (; len > 1; len -= p[1], p += p[1]) {
  2148. if (p[1] < 2 || p[1] > len)
  2149. return;
  2150. if (debug)
  2151. addlog("%s ", sppp_lcp_opt_name(*p));
  2152. switch (*p) {
  2153. case LCP_OPT_MAGIC:
  2154. /* Magic number -- renegotiate */
  2155. if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
  2156. len >= 6 && p[1] == 6) {
  2157. magic = (u_long)p[2] << 24 |
  2158. (u_long)p[3] << 16 | p[4] << 8 | p[5];
  2159. /*
  2160. * If the remote magic is our negated one,
  2161. * this looks like a loopback problem.
  2162. * Suggest a new magic to make sure.
  2163. */
  2164. if (magic == ~sp->lcp.magic) {
  2165. if (debug)
  2166. addlog("magic glitch ");
  2167. sp->lcp.magic = arc4random();
  2168. } else {
  2169. sp->lcp.magic = magic;
  2170. if (debug)
  2171. addlog("%lu ", magic);
  2172. }
  2173. }
  2174. break;
  2175. case LCP_OPT_MRU:
  2176. /*
  2177. * Peer wants to advise us to negotiate an MRU.
  2178. * Agree on it if it's reasonable, or use
  2179. * default otherwise.
  2180. */
  2181. if (len >= 4 && p[1] == 4) {
  2182. u_int mru = p[2] * 256 + p[3];
  2183. if (debug)
  2184. addlog("%d ", mru);
  2185. if (mru < PP_MIN_MRU)
  2186. mru = PP_MIN_MRU;
  2187. if (mru > PP_MAX_MRU)
  2188. mru = PP_MAX_MRU;
  2189. sp->lcp.mru = mru;
  2190. sp->lcp.opts |= (1 << LCP_OPT_MRU);
  2191. }
  2192. break;
  2193. case LCP_OPT_AUTH_PROTO:
  2194. /*
  2195. * Peer doesn't like our authentication method,
  2196. * deny.
  2197. */
  2198. if (debug)
  2199. addlog("[access denied]\n");
  2200. lcp.Close(sp);
  2201. break;
  2202. }
  2203. }
  2204. if (debug)
  2205. addlog("\n");
  2206. }
  2207. void
  2208. sppp_lcp_tlu(struct sppp *sp)
  2209. {
  2210. struct ifnet *ifp = &sp->pp_if;
  2211. int i;
  2212. u_long mask;
  2213. /* XXX ? */
  2214. if (! (ifp->if_flags & IFF_UP) &&
  2215. (ifp->if_flags & IFF_RUNNING)) {
  2216. /* Coming out of loopback mode. */
  2217. if_up(ifp);
  2218. if (ifp->if_flags & IFF_DEBUG)
  2219. log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp));
  2220. }
  2221. for (i = 0; i < IDX_COUNT; i++)
  2222. if ((cps[i])->flags & CP_QUAL)
  2223. (cps[i])->Open(sp);
  2224. if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
  2225. (sp->pp_flags & PP_NEEDAUTH) != 0)
  2226. sp->pp_phase = PHASE_AUTHENTICATE;
  2227. else
  2228. sp->pp_phase = PHASE_NETWORK;
  2229. sppp_set_phase(sp);
  2230. /*
  2231. * Open all authentication protocols. This is even required
  2232. * if we already proceeded to network phase, since it might be
  2233. * that remote wants us to authenticate, so we might have to
  2234. * send a PAP request. Undesired authentication protocols
  2235. * don't do anything when they get an Open event.
  2236. */
  2237. for (i = 0; i < IDX_COUNT; i++)
  2238. if ((cps[i])->flags & CP_AUTH)
  2239. (cps[i])->Open(sp);
  2240. if (sp->pp_phase == PHASE_NETWORK) {
  2241. /* Notify all NCPs. */
  2242. for (i = 0; i < IDX_COUNT; i++)
  2243. if ((cps[i])->flags & CP_NCP)
  2244. (cps[i])->Open(sp);
  2245. }
  2246. /* Send Up events to all started protos. */
  2247. for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
  2248. if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0)
  2249. (cps[i])->Up(sp);
  2250. /* notify low-level driver of state change */
  2251. if (sp->pp_chg)
  2252. sp->pp_chg(sp, (int)sp->pp_phase);
  2253. if (sp->pp_phase == PHASE_NETWORK)
  2254. /* if no NCP is starting, close down */
  2255. sppp_lcp_check_and_close(sp);
  2256. }
  2257. void
  2258. sppp_lcp_tld(struct sppp *sp)
  2259. {
  2260. int i;
  2261. u_long mask;
  2262. sp->pp_phase = PHASE_TERMINATE;
  2263. sppp_set_phase(sp);
  2264. /*
  2265. * Take upper layers down. We send the Down event first and
  2266. * the Close second to prevent the upper layers from sending
  2267. * ``a flurry of terminate-request packets'', as the RFC
  2268. * describes it.
  2269. */
  2270. for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
  2271. if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) {
  2272. (cps[i])->Down(sp);
  2273. (cps[i])->Close(sp);
  2274. }
  2275. }
  2276. void
  2277. sppp_lcp_tls(struct sppp *sp)
  2278. {
  2279. sp->pp_phase = PHASE_ESTABLISH;
  2280. sppp_set_phase(sp);
  2281. /* Notify lower layer if desired. */
  2282. if (sp->pp_tls)
  2283. (sp->pp_tls)(sp);
  2284. }
  2285. void
  2286. sppp_lcp_tlf(struct sppp *sp)
  2287. {
  2288. sp->pp_phase = PHASE_DEAD;
  2289. sppp_set_phase(sp);
  2290. /* Notify lower layer if desired. */
  2291. if (sp->pp_tlf)
  2292. (sp->pp_tlf)(sp);
  2293. }
  2294. void
  2295. sppp_lcp_scr(struct sppp *sp)
  2296. {
  2297. char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
  2298. int i = 0;
  2299. u_short authproto;
  2300. if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
  2301. if (! sp->lcp.magic)
  2302. sp->lcp.magic = arc4random();
  2303. opt[i++] = LCP_OPT_MAGIC;
  2304. opt[i++] = 6;
  2305. opt[i++] = sp->lcp.magic >> 24;
  2306. opt[i++] = sp->lcp.magic >> 16;
  2307. opt[i++] = sp->lcp.magic >> 8;
  2308. opt[i++] = sp->lcp.magic;
  2309. }
  2310. if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
  2311. opt[i++] = LCP_OPT_MRU;
  2312. opt[i++] = 4;
  2313. opt[i++] = sp->lcp.mru >> 8;
  2314. opt[i++] = sp->lcp.mru;
  2315. }
  2316. if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
  2317. authproto = sp->hisauth.proto;
  2318. opt[i++] = LCP_OPT_AUTH_PROTO;
  2319. opt[i++] = authproto == PPP_CHAP? 5: 4;
  2320. opt[i++] = authproto >> 8;
  2321. opt[i++] = authproto;
  2322. if (authproto == PPP_CHAP)
  2323. opt[i++] = CHAP_MD5;
  2324. }
  2325. sp->confid[IDX_LCP] = ++sp->pp_seq;
  2326. sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, opt);
  2327. }
  2328. /*
  2329. * Check the open NCPs, return true if at least one NCP is open.
  2330. */
  2331. int
  2332. sppp_ncp_check(struct sppp *sp)
  2333. {
  2334. int i, mask;
  2335. for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
  2336. if (sp->lcp.protos & mask && (cps[i])->flags & CP_NCP)
  2337. return 1;
  2338. return 0;
  2339. }
  2340. /*
  2341. * Re-check the open NCPs and see if we should terminate the link.
  2342. * Called by the NCPs during their tlf action handling.
  2343. */
  2344. void
  2345. sppp_lcp_check_and_close(struct sppp *sp)
  2346. {
  2347. if (sp->pp_phase < PHASE_NETWORK)
  2348. /* don't bother, we are already going down */
  2349. return;
  2350. if (sppp_ncp_check(sp))
  2351. return;
  2352. lcp.Close(sp);
  2353. }
  2354. /*
  2355. *--------------------------------------------------------------------------*
  2356. * *
  2357. * The IPCP implementation. *
  2358. * *
  2359. *--------------------------------------------------------------------------*
  2360. */
  2361. void
  2362. sppp_ipcp_init(struct sppp *sp)
  2363. {
  2364. sp->ipcp.opts = 0;
  2365. sp->ipcp.flags = 0;
  2366. sp->state[IDX_IPCP] = STATE_INITIAL;
  2367. sp->fail_counter[IDX_IPCP] = 0;
  2368. task_set(&sp->ipcp.set_addr_task, sppp_set_ip_addrs, sp);
  2369. task_set(&sp->ipcp.clear_addr_task, sppp_clear_ip_addrs, sp);
  2370. }
  2371. void
  2372. sppp_ipcp_destroy(struct sppp *sp)
  2373. {
  2374. task_del(systq, &sp->ipcp.set_addr_task);
  2375. task_del(systq, &sp->ipcp.clear_addr_task);
  2376. }
  2377. void
  2378. sppp_ipcp_up(struct sppp *sp)
  2379. {
  2380. sppp_up_event(&ipcp, sp);
  2381. }
  2382. void
  2383. sppp_ipcp_down(struct sppp *sp)
  2384. {
  2385. sppp_down_event(&ipcp, sp);
  2386. }
  2387. void
  2388. sppp_ipcp_open(struct sppp *sp)
  2389. {
  2390. sppp_open_event(&ipcp, sp);
  2391. }
  2392. void
  2393. sppp_ipcp_close(struct sppp *sp)
  2394. {
  2395. sppp_close_event(&ipcp, sp);
  2396. }
  2397. void
  2398. sppp_ipcp_TO(void *cookie)
  2399. {
  2400. sppp_to_event(&ipcp, (struct sppp *)cookie);
  2401. }
  2402. /*
  2403. * Analyze a configure request. Return true if it was agreeable, and
  2404. * caused action sca, false if it has been rejected or nak'ed, and
  2405. * caused action scn. (The return value is used to make the state
  2406. * transition decision in the state automaton.)
  2407. */
  2408. int
  2409. sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
  2410. {
  2411. u_char *buf, *r, *p;
  2412. struct ifnet *ifp = &sp->pp_if;
  2413. int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
  2414. u_int32_t hisaddr, desiredaddr;
  2415. len -= 4;
  2416. origlen = len;
  2417. /*
  2418. * Make sure to allocate a buf that can at least hold a
  2419. * conf-nak with an `address' option. We might need it below.
  2420. */
  2421. buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
  2422. if (! buf)
  2423. return (0);
  2424. /* pass 1: see if we can recognize them */
  2425. if (debug)
  2426. log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
  2427. SPP_ARGS(ifp));
  2428. p = (void*) (h+1);
  2429. for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
  2430. if (p[1] < 2 || p[1] > len) {
  2431. free(buf, M_TEMP, 0);
  2432. return (-1);
  2433. }
  2434. if (debug)
  2435. addlog("%s ", sppp_ipcp_opt_name(*p));
  2436. switch (*p) {
  2437. #ifdef notyet
  2438. case IPCP_OPT_COMPRESSION:
  2439. if (len >= 6 && p[1] >= 6) {
  2440. /* correctly formed compress option */
  2441. continue;
  2442. }
  2443. if (debug)
  2444. addlog("[invalid] ");
  2445. break;
  2446. #endif
  2447. case IPCP_OPT_ADDRESS:
  2448. if (len >= 6 && p[1] == 6) {
  2449. /* correctly formed address option */
  2450. continue;
  2451. }
  2452. if (debug)
  2453. addlog("[invalid] ");
  2454. break;
  2455. default:
  2456. /* Others not supported. */
  2457. if (debug)
  2458. addlog("[rej] ");
  2459. break;
  2460. }
  2461. /* Add the option to rejected list. */
  2462. bcopy (p, r, p[1]);
  2463. r += p[1];
  2464. rlen += p[1];
  2465. }
  2466. if (rlen) {
  2467. if (debug)
  2468. addlog(" send conf-rej\n");
  2469. sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
  2470. goto end;
  2471. } else if (debug)
  2472. addlog("\n");
  2473. /* pass 2: parse option values */
  2474. if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
  2475. hisaddr = sp->ipcp.req_hisaddr; /* we already agreed on that */
  2476. else
  2477. sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */
  2478. if (debug)
  2479. log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
  2480. SPP_ARGS(ifp));
  2481. p = (void*) (h+1);
  2482. len = origlen;
  2483. for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
  2484. if (debug)
  2485. addlog(" %s ", sppp_ipcp_opt_name(*p));
  2486. switch (*p) {
  2487. #ifdef notyet
  2488. case IPCP_OPT_COMPRESSION:
  2489. continue;
  2490. #endif
  2491. case IPCP_OPT_ADDRESS:
  2492. desiredaddr = p[2] << 24 | p[3] << 16 |
  2493. p[4] << 8 | p[5];
  2494. if (desiredaddr == hisaddr ||
  2495. ((sp->ipcp.flags & IPCP_HISADDR_DYN) &&
  2496. desiredaddr != 0)) {
  2497. /*
  2498. * Peer's address is same as our value,
  2499. * or we have set it to 0.0.0.1 to
  2500. * indicate that we do not really care,
  2501. * this is agreeable. Gonna conf-ack
  2502. * it.
  2503. */
  2504. if (debug)
  2505. addlog("%s [ack] ",
  2506. sppp_dotted_quad(desiredaddr));
  2507. /* record that we've seen it already */
  2508. sp->ipcp.flags |= IPCP_HISADDR_SEEN;
  2509. sp->ipcp.req_hisaddr = desiredaddr;
  2510. hisaddr = desiredaddr;
  2511. continue;
  2512. }
  2513. /*
  2514. * The address wasn't agreeable. This is either
  2515. * he sent us 0.0.0.0, asking to assign him an
  2516. * address, or he send us another address not
  2517. * matching our value. Either case, we gonna
  2518. * conf-nak it with our value.
  2519. */
  2520. if (debug) {
  2521. if (desiredaddr == 0)
  2522. addlog("[addr requested] ");
  2523. else
  2524. addlog("%s [not agreed] ",
  2525. sppp_dotted_quad(desiredaddr));
  2526. }
  2527. p[2] = hisaddr >> 24;
  2528. p[3] = hisaddr >> 16;
  2529. p[4] = hisaddr >> 8;
  2530. p[5] = hisaddr;
  2531. break;
  2532. }
  2533. /* Add the option to nak'ed list. */
  2534. bcopy (p, r, p[1]);
  2535. r += p[1];
  2536. rlen += p[1];
  2537. }
  2538. /*
  2539. * If we are about to conf-ack the request, but haven't seen
  2540. * his address so far, gonna conf-nak it instead, with the
  2541. * `address' option present and our idea of his address being
  2542. * filled in there, to request negotiation of both addresses.
  2543. *
  2544. * XXX This can result in an endless req - nak loop if peer
  2545. * doesn't want to send us his address. Q: What should we do
  2546. * about it? XXX A: implement the max-failure counter.
  2547. */
  2548. if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
  2549. buf[0] = IPCP_OPT_ADDRESS;
  2550. buf[1] = 6;
  2551. buf[2] = hisaddr >> 24;
  2552. buf[3] = hisaddr >> 16;
  2553. buf[4] = hisaddr >> 8;
  2554. buf[5] = hisaddr;
  2555. rlen = 6;
  2556. if (debug)
  2557. addlog("still need hisaddr ");
  2558. }
  2559. if (rlen) {
  2560. if (debug)
  2561. addlog(" send conf-nak\n");
  2562. sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
  2563. } else {
  2564. if (debug)
  2565. addlog(" send conf-ack\n");
  2566. sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
  2567. h->ident, origlen, h+1);
  2568. }
  2569. end:
  2570. free(buf, M_TEMP, 0);
  2571. return (rlen == 0);
  2572. }
  2573. /*
  2574. * Analyze the IPCP Configure-Reject option list, and adjust our
  2575. * negotiation.
  2576. */
  2577. void
  2578. sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
  2579. {
  2580. u_char *p;
  2581. struct ifnet *ifp = &sp->pp_if;
  2582. int debug = ifp->if_flags & IFF_DEBUG;
  2583. len -= 4;
  2584. if (debug)
  2585. log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
  2586. SPP_ARGS(ifp));
  2587. p = (void*) (h+1);
  2588. for (; len > 1; len -= p[1], p += p[1]) {
  2589. if (p[1] < 2 || p[1] > len)
  2590. return;
  2591. if (debug)
  2592. addlog("%s ", sppp_ipcp_opt_name(*p));
  2593. switch (*p) {
  2594. case IPCP_OPT_ADDRESS:
  2595. /*
  2596. * Peer doesn't grok address option. This is
  2597. * bad. XXX Should we better give up here?
  2598. */
  2599. sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
  2600. break;
  2601. #ifdef notyet
  2602. case IPCP_OPT_COMPRESS:
  2603. sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
  2604. break;
  2605. #endif
  2606. }
  2607. }
  2608. if (debug)
  2609. addlog("\n");
  2610. }
  2611. /*
  2612. * Analyze the IPCP Configure-NAK option list, and adjust our
  2613. * negotiation.
  2614. */
  2615. void
  2616. sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
  2617. {
  2618. u_char *p;
  2619. struct ifnet *ifp = &sp->pp_if;
  2620. int debug = ifp->if_flags & IFF_DEBUG;
  2621. u_int32_t wantaddr;
  2622. len -= 4;
  2623. if (debug)
  2624. log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
  2625. SPP_ARGS(ifp));
  2626. p = (void*) (h+1);
  2627. for (; len > 1; len -= p[1], p += p[1]) {
  2628. if (p[1] < 2 || p[1] > len)
  2629. return;
  2630. if (debug)
  2631. addlog("%s ", sppp_ipcp_opt_name(*p));
  2632. switch (*p) {
  2633. case IPCP_OPT_ADDRESS:
  2634. /*
  2635. * Peer doesn't like our local IP address. See
  2636. * if we can do something for him. We'll drop
  2637. * him our address then.
  2638. */
  2639. if (len >= 6 && p[1] == 6) {
  2640. wantaddr = p[2] << 24 | p[3] << 16 |
  2641. p[4] << 8 | p[5];
  2642. sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
  2643. if (debug)
  2644. addlog("[wantaddr %s] ",
  2645. sppp_dotted_quad(wantaddr));
  2646. /*
  2647. * When doing dynamic address assignment,
  2648. * we accept his offer. Otherwise, we
  2649. * ignore it and thus continue to negotiate
  2650. * our already existing value.
  2651. */
  2652. if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
  2653. if (debug)
  2654. addlog("[agree] ");
  2655. sp->ipcp.flags |= IPCP_MYADDR_SEEN;
  2656. sp->ipcp.req_myaddr = wantaddr;
  2657. }
  2658. }
  2659. break;
  2660. #ifdef notyet
  2661. case IPCP_OPT_COMPRESS:
  2662. /*
  2663. * Peer wants different compression parameters.
  2664. */
  2665. break;
  2666. #endif
  2667. }
  2668. }
  2669. if (debug)
  2670. addlog("\n");
  2671. }
  2672. void
  2673. sppp_ipcp_tlu(struct sppp *sp)
  2674. {
  2675. if (sp->ipcp.req_myaddr != 0 || sp->ipcp.req_hisaddr != 0)
  2676. task_add(systq, &sp->ipcp.set_addr_task);
  2677. }
  2678. void
  2679. sppp_ipcp_tld(struct sppp *sp)
  2680. {
  2681. }
  2682. void
  2683. sppp_ipcp_tls(struct sppp *sp)
  2684. {
  2685. STDDCL;
  2686. u_int32_t myaddr, hisaddr;
  2687. sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|
  2688. IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
  2689. sp->ipcp.req_myaddr = 0;
  2690. sp->ipcp.req_hisaddr = 0;
  2691. sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
  2692. /*
  2693. * If we don't have his address, this probably means our
  2694. * interface doesn't want to talk IP at all. (This could
  2695. * be the case if somebody wants to speak only IPX, for
  2696. * example.) Don't open IPCP in this case.
  2697. */
  2698. if (hisaddr == 0) {
  2699. /* XXX this message should go away */
  2700. if (debug)
  2701. log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
  2702. SPP_ARGS(ifp));
  2703. return;
  2704. }
  2705. if (myaddr == 0) {
  2706. /*
  2707. * I don't have an assigned address, so i need to
  2708. * negotiate my address.
  2709. */
  2710. sp->ipcp.flags |= IPCP_MYADDR_DYN;
  2711. sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
  2712. }
  2713. if (hisaddr == 1) {
  2714. /*
  2715. * XXX - remove this hack!
  2716. * remote has no valid address, we need to get one assigned.
  2717. */
  2718. sp->ipcp.flags |= IPCP_HISADDR_DYN;
  2719. }
  2720. /* indicate to LCP that it must stay alive */
  2721. sp->lcp.protos |= (1 << IDX_IPCP);
  2722. }
  2723. void
  2724. sppp_ipcp_tlf(struct sppp *sp)
  2725. {
  2726. if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
  2727. /* Some address was dynamic, clear it again. */
  2728. task_add(systq, &sp->ipcp.clear_addr_task);
  2729. /* we no longer need LCP */
  2730. sp->lcp.protos &= ~(1 << IDX_IPCP);
  2731. sppp_lcp_check_and_close(sp);
  2732. }
  2733. void
  2734. sppp_ipcp_scr(struct sppp *sp)
  2735. {
  2736. char opt[6 /* compression */ + 6 /* address */];
  2737. u_int32_t ouraddr;
  2738. int i = 0;
  2739. #ifdef notyet
  2740. if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
  2741. opt[i++] = IPCP_OPT_COMPRESSION;
  2742. opt[i++] = 6;
  2743. opt[i++] = 0; /* VJ header compression */
  2744. opt[i++] = 0x2d; /* VJ header compression */
  2745. opt[i++] = max_slot_id;
  2746. opt[i++] = comp_slot_id;
  2747. }
  2748. #endif
  2749. if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
  2750. if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
  2751. /* not sure if this can ever happen */
  2752. ouraddr = sp->ipcp.req_myaddr;
  2753. else
  2754. sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
  2755. opt[i++] = IPCP_OPT_ADDRESS;
  2756. opt[i++] = 6;
  2757. opt[i++] = ouraddr >> 24;
  2758. opt[i++] = ouraddr >> 16;
  2759. opt[i++] = ouraddr >> 8;
  2760. opt[i++] = ouraddr;
  2761. }
  2762. sp->confid[IDX_IPCP] = ++sp->pp_seq;
  2763. sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, opt);
  2764. }
  2765. /*
  2766. *--------------------------------------------------------------------------*
  2767. * *
  2768. * The IPv6CP implementation. *
  2769. * *
  2770. *--------------------------------------------------------------------------*
  2771. */
  2772. #ifdef INET6
  2773. void
  2774. sppp_ipv6cp_init(struct sppp *sp)
  2775. {
  2776. sp->ipv6cp.opts = 0;
  2777. sp->ipv6cp.flags = 0;
  2778. sp->state[IDX_IPV6CP] = STATE_INITIAL;
  2779. sp->fail_counter[IDX_IPV6CP] = 0;
  2780. task_set(&sp->ipv6cp.set_addr_task, sppp_update_ip6_addr, sp);
  2781. }
  2782. void
  2783. sppp_ipv6cp_destroy(struct sppp *sp)
  2784. {
  2785. task_del(systq, &sp->ipv6cp.set_addr_task);
  2786. }
  2787. void
  2788. sppp_ipv6cp_up(struct sppp *sp)
  2789. {
  2790. sppp_up_event(&ipv6cp, sp);
  2791. }
  2792. void
  2793. sppp_ipv6cp_down(struct sppp *sp)
  2794. {
  2795. sppp_down_event(&ipv6cp, sp);
  2796. }
  2797. void
  2798. sppp_ipv6cp_open(struct sppp *sp)
  2799. {
  2800. STDDCL;
  2801. struct in6_addr myaddr, hisaddr;
  2802. sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
  2803. sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, NULL);
  2804. /*
  2805. * If we don't have our address, this probably means our
  2806. * interface doesn't want to talk IPv6 at all. (This could
  2807. * be the case if the IFXF_NOINET6 flag is set, for
  2808. * example.) Don't open IPv6CP in this case.
  2809. */
  2810. if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
  2811. /* XXX this message should go away */
  2812. if (debug)
  2813. log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n",
  2814. SPP_ARGS(ifp));
  2815. return;
  2816. }
  2817. sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
  2818. sppp_open_event(&ipv6cp, sp);
  2819. }
  2820. void
  2821. sppp_ipv6cp_close(struct sppp *sp)
  2822. {
  2823. sppp_close_event(&ipv6cp, sp);
  2824. }
  2825. void
  2826. sppp_ipv6cp_TO(void *cookie)
  2827. {
  2828. sppp_to_event(&ipv6cp, (struct sppp *)cookie);
  2829. }
  2830. int
  2831. sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
  2832. {
  2833. u_char *buf, *r, *p;
  2834. struct ifnet *ifp = &sp->pp_if;
  2835. int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
  2836. struct in6_addr myaddr, desiredaddr, suggestaddr;
  2837. int ifidcount;
  2838. int type;
  2839. int collision, nohisaddr;
  2840. char addr[INET6_ADDRSTRLEN];
  2841. len -= 4;
  2842. origlen = len;
  2843. /*
  2844. * Make sure to allocate a buf that can at least hold a
  2845. * conf-nak with an `address' option. We might need it below.
  2846. */
  2847. buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
  2848. if (! buf)
  2849. return (0);
  2850. /* pass 1: see if we can recognize them */
  2851. if (debug)
  2852. log(LOG_DEBUG, "%s: ipv6cp parse opts:",
  2853. SPP_ARGS(ifp));
  2854. p = (void *)(h + 1);
  2855. ifidcount = 0;
  2856. for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
  2857. /* Sanity check option length */
  2858. if (p[1] < 2 || p[1] > len) {
  2859. free(buf, M_TEMP, 0);
  2860. return (-1);
  2861. }
  2862. if (debug)
  2863. addlog(" %s", sppp_ipv6cp_opt_name(*p));
  2864. switch (*p) {
  2865. case IPV6CP_OPT_IFID:
  2866. if (len >= 10 && p[1] == 10 && ifidcount == 0) {
  2867. /* correctly formed address option */
  2868. ifidcount++;
  2869. continue;
  2870. }
  2871. if (debug)
  2872. addlog(" [invalid]");
  2873. break;
  2874. #ifdef notyet
  2875. case IPV6CP_OPT_COMPRESSION:
  2876. if (len >= 4 && p[1] >= 4) {
  2877. /* correctly formed compress option */
  2878. continue;
  2879. }
  2880. if (debug)
  2881. addlog(" [invalid]");
  2882. break;
  2883. #endif
  2884. default:
  2885. /* Others not supported. */
  2886. if (debug)
  2887. addlog(" [rej]");
  2888. break;
  2889. }
  2890. /* Add the option to rejected list. */
  2891. bcopy (p, r, p[1]);
  2892. r += p[1];
  2893. rlen += p[1];
  2894. }
  2895. if (rlen) {
  2896. if (debug)
  2897. addlog(" send conf-rej\n");
  2898. sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
  2899. goto end;
  2900. } else if (debug)
  2901. addlog("\n");
  2902. /* pass 2: parse option values */
  2903. if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN)
  2904. myaddr = sp->ipv6cp.req_ifid.ifra_addr.sin6_addr;
  2905. else
  2906. sppp_get_ip6_addrs(sp, &myaddr, NULL, NULL);
  2907. if (debug)
  2908. log(LOG_DEBUG, "%s: ipv6cp parse opt values: ",
  2909. SPP_ARGS(ifp));
  2910. p = (void *)(h + 1);
  2911. len = origlen;
  2912. type = CONF_ACK;
  2913. for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
  2914. if (debug)
  2915. addlog(" %s", sppp_ipv6cp_opt_name(*p));
  2916. switch (*p) {
  2917. #ifdef notyet
  2918. case IPV6CP_OPT_COMPRESSION:
  2919. continue;
  2920. #endif
  2921. case IPV6CP_OPT_IFID:
  2922. memset(&desiredaddr, 0, sizeof(desiredaddr));
  2923. bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
  2924. collision = (memcmp(&desiredaddr.s6_addr[8],
  2925. &myaddr.s6_addr[8], 8) == 0);
  2926. nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
  2927. desiredaddr.s6_addr16[0] = htons(0xfe80);
  2928. if (!collision && !nohisaddr) {
  2929. /* no collision, hisaddr known - Conf-Ack */
  2930. type = CONF_ACK;
  2931. if (debug) {
  2932. addlog(" %s [%s]",
  2933. inet_ntop(AF_INET6, &desiredaddr,
  2934. addr, sizeof(addr)),
  2935. sppp_cp_type_name(type));
  2936. }
  2937. sppp_set_ip6_addr(sp, &myaddr, &desiredaddr);
  2938. continue;
  2939. }
  2940. memset(&suggestaddr, 0, sizeof(suggestaddr));
  2941. if (collision && nohisaddr) {
  2942. /* collision, hisaddr unknown - Conf-Rej */
  2943. type = CONF_REJ;
  2944. memset(&p[2], 0, 8);
  2945. } else {
  2946. /*
  2947. * - no collision, hisaddr unknown, or
  2948. * - collision, hisaddr known
  2949. * Conf-Nak, suggest hisaddr
  2950. */
  2951. type = CONF_NAK;
  2952. sppp_suggest_ip6_addr(sp, &suggestaddr);
  2953. bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
  2954. }
  2955. if (debug)
  2956. addlog(" %s [%s]",
  2957. inet_ntop(AF_INET6, &desiredaddr, addr,
  2958. sizeof(addr)),
  2959. sppp_cp_type_name(type));
  2960. break;
  2961. }
  2962. /* Add the option to nak'ed list. */
  2963. bcopy (p, r, p[1]);
  2964. r += p[1];
  2965. rlen += p[1];
  2966. }
  2967. if (rlen == 0 && type == CONF_ACK) {
  2968. if (debug)
  2969. addlog(" send %s\n", sppp_cp_type_name(type));
  2970. sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1);
  2971. } else {
  2972. #ifdef notdef
  2973. if (type == CONF_ACK)
  2974. panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
  2975. #endif
  2976. if (debug) {
  2977. addlog(" send %s suggest %s\n",
  2978. sppp_cp_type_name(type),
  2979. inet_ntop(AF_INET6, &suggestaddr, addr,
  2980. sizeof(addr)));
  2981. }
  2982. sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
  2983. }
  2984. end:
  2985. free(buf, M_TEMP, 0);
  2986. return (rlen == 0);
  2987. }
  2988. void
  2989. sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
  2990. {
  2991. u_char *p;
  2992. struct ifnet *ifp = &sp->pp_if;
  2993. int debug = ifp->if_flags & IFF_DEBUG;
  2994. len -= 4;
  2995. if (debug)
  2996. log(LOG_DEBUG, "%s: ipv6cp rej opts:",
  2997. SPP_ARGS(ifp));
  2998. p = (void *)(h + 1);
  2999. for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
  3000. if (p[1] < 2 || p[1] > len)
  3001. return;
  3002. if (debug)
  3003. addlog(" %s", sppp_ipv6cp_opt_name(*p));
  3004. switch (*p) {
  3005. case IPV6CP_OPT_IFID:
  3006. /*
  3007. * Peer doesn't grok address option. This is
  3008. * bad. XXX Should we better give up here?
  3009. */
  3010. sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
  3011. break;
  3012. #ifdef notyet
  3013. case IPV6CP_OPT_COMPRESS:
  3014. sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
  3015. break;
  3016. #endif
  3017. }
  3018. }
  3019. if (debug)
  3020. addlog("\n");
  3021. return;
  3022. }
  3023. void
  3024. sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
  3025. {
  3026. u_char *p;
  3027. struct ifnet *ifp = &sp->pp_if;
  3028. int debug = ifp->if_flags & IFF_DEBUG;
  3029. struct in6_addr suggestaddr;
  3030. char addr[INET6_ADDRSTRLEN];
  3031. len -= 4;
  3032. if (debug)
  3033. log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts: ",
  3034. SPP_ARGS(ifp));
  3035. p = (void*) (h+1);
  3036. for (; len > 1; len -= p[1], p += p[1]) {
  3037. if (p[1] < 2 || p[1] > len)
  3038. return;
  3039. if (debug)
  3040. addlog("%s ", sppp_ipv6cp_opt_name(*p));
  3041. switch (*p) {
  3042. case IPV6CP_OPT_IFID:
  3043. /*
  3044. * Peer doesn't like our local ifid. See
  3045. * if we can do something for him. We'll drop
  3046. * him our address then.
  3047. */
  3048. if (len < 10 || p[1] != 10)
  3049. break;
  3050. sp->ipv6cp.flags |= IPV6CP_MYIFID_DYN;
  3051. memset(&suggestaddr, 0, sizeof(suggestaddr));
  3052. bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
  3053. if (IN6_IS_ADDR_UNSPECIFIED(&suggestaddr) ||
  3054. (sp->ipv6cp.flags & IPV6CP_MYIFID_SEEN)) {
  3055. /*
  3056. * The peer didn't suggest anything,
  3057. * or wants us to change a previously
  3058. * suggested address.
  3059. * Configure a new address for us.
  3060. */
  3061. sppp_suggest_ip6_addr(sp, &suggestaddr);
  3062. sppp_set_ip6_addr(sp, &suggestaddr, NULL);
  3063. sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
  3064. } else {
  3065. /* Configure address suggested by peer. */
  3066. suggestaddr.s6_addr16[0] = htons(0xfe80);
  3067. sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
  3068. if (debug)
  3069. addlog(" [suggestaddr %s]",
  3070. inet_ntop(AF_INET6, &suggestaddr,
  3071. addr, sizeof(addr)));
  3072. sppp_set_ip6_addr(sp, &suggestaddr, NULL);
  3073. if (debug)
  3074. addlog(" [agree]");
  3075. sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
  3076. }
  3077. break;
  3078. #ifdef notyet
  3079. case IPV6CP_OPT_COMPRESS:
  3080. /*
  3081. * Peer wants different compression parameters.
  3082. */
  3083. break;
  3084. #endif
  3085. }
  3086. }
  3087. if (debug)
  3088. addlog("\n");
  3089. }
  3090. void
  3091. sppp_ipv6cp_tlu(struct sppp *sp)
  3092. {
  3093. }
  3094. void
  3095. sppp_ipv6cp_tld(struct sppp *sp)
  3096. {
  3097. }
  3098. void
  3099. sppp_ipv6cp_tls(struct sppp *sp)
  3100. {
  3101. /* indicate to LCP that it must stay alive */
  3102. sp->lcp.protos |= (1 << IDX_IPV6CP);
  3103. }
  3104. void
  3105. sppp_ipv6cp_tlf(struct sppp *sp)
  3106. {
  3107. /* we no longer need LCP */
  3108. sp->lcp.protos &= ~(1 << IDX_IPV6CP);
  3109. sppp_lcp_check_and_close(sp);
  3110. }
  3111. void
  3112. sppp_ipv6cp_scr(struct sppp *sp)
  3113. {
  3114. char opt[10 /* ifid */ + 4 /* compression, minimum */];
  3115. struct in6_addr ouraddr;
  3116. int i = 0;
  3117. if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
  3118. if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN)
  3119. ouraddr = sp->ipv6cp.req_ifid.ifra_addr.sin6_addr;
  3120. else
  3121. sppp_get_ip6_addrs(sp, &ouraddr, NULL, NULL);
  3122. opt[i++] = IPV6CP_OPT_IFID;
  3123. opt[i++] = 10;
  3124. bcopy(&ouraddr.s6_addr[8], &opt[i], 8);
  3125. i += 8;
  3126. }
  3127. #ifdef notyet
  3128. if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
  3129. opt[i++] = IPV6CP_OPT_COMPRESSION;
  3130. opt[i++] = 4;
  3131. p opt[i++] = 0; /* TBD */
  3132. opt[i++] = 0; /* TBD */
  3133. /* variable length data may follow */
  3134. }
  3135. #endif
  3136. sp->confid[IDX_IPV6CP] = ++sp->pp_seq;
  3137. sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, opt);
  3138. }
  3139. #else /*INET6*/
  3140. void
  3141. sppp_ipv6cp_init(struct sppp *sp)
  3142. {
  3143. }
  3144. void
  3145. sppp_ipv6cp_destroy(struct sppp *sp)
  3146. {
  3147. }
  3148. void
  3149. sppp_ipv6cp_up(struct sppp *sp)
  3150. {
  3151. }
  3152. void
  3153. sppp_ipv6cp_down(struct sppp *sp)
  3154. {
  3155. }
  3156. void
  3157. sppp_ipv6cp_open(struct sppp *sp)
  3158. {
  3159. }
  3160. void
  3161. sppp_ipv6cp_close(struct sppp *sp)
  3162. {
  3163. }
  3164. void
  3165. sppp_ipv6cp_TO(void *sp)
  3166. {
  3167. }
  3168. int
  3169. sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h,
  3170. int len)
  3171. {
  3172. return 0;
  3173. }
  3174. void
  3175. sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h,
  3176. int len)
  3177. {
  3178. }
  3179. void
  3180. sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h,
  3181. int len)
  3182. {
  3183. }
  3184. void
  3185. sppp_ipv6cp_tlu(struct sppp *sp)
  3186. {
  3187. }
  3188. void
  3189. sppp_ipv6cp_tld(struct sppp *sp)
  3190. {
  3191. }
  3192. void
  3193. sppp_ipv6cp_tls(struct sppp *sp)
  3194. {
  3195. }
  3196. void
  3197. sppp_ipv6cp_tlf(struct sppp *sp)
  3198. {
  3199. }
  3200. void
  3201. sppp_ipv6cp_scr(struct sppp *sp)
  3202. {
  3203. }
  3204. #endif /*INET6*/
  3205. /*
  3206. *--------------------------------------------------------------------------*
  3207. * *
  3208. * The CHAP implementation. *
  3209. * *
  3210. *--------------------------------------------------------------------------*
  3211. */
  3212. /*
  3213. * The authentication protocols don't employ a full-fledged state machine as
  3214. * the control protocols do, since they do have Open and Close events, but
  3215. * not Up and Down, nor are they explicitly terminated. Also, use of the
  3216. * authentication protocols may be different in both directions (this makes
  3217. * sense, think of a machine that never accepts incoming calls but only
  3218. * calls out, it doesn't require the called party to authenticate itself).
  3219. *
  3220. * Our state machine for the local authentication protocol (we are requesting
  3221. * the peer to authenticate) looks like:
  3222. *
  3223. * RCA-
  3224. * +--------------------------------------------+
  3225. * V scn,tld|
  3226. * +--------+ Close +---------+ RCA+
  3227. * | |<----------------------------------| |------+
  3228. * +--->| Closed | TO* | Opened | sca |
  3229. * | | |-----+ +-------| |<-----+
  3230. * | +--------+ irc | | +---------+
  3231. * | ^ | | ^
  3232. * | | | | |
  3233. * | | | | |
  3234. * | TO-| | | |
  3235. * | |tld TO+ V | |
  3236. * | | +------->+ | |
  3237. * | | | | | |
  3238. * | +--------+ V | |
  3239. * | | |<----+<--------------------+ |
  3240. * | | Req- | scr |
  3241. * | | Sent | |
  3242. * | | | |
  3243. * | +--------+ |
  3244. * | RCA- | | RCA+ |
  3245. * +------+ +------------------------------------------+
  3246. * scn,tld sca,irc,ict,tlu
  3247. *
  3248. *
  3249. * with:
  3250. *
  3251. * Open: LCP reached authentication phase
  3252. * Close: LCP reached terminate phase
  3253. *
  3254. * RCA+: received reply (pap-req, chap-response), acceptable
  3255. * RCN: received reply (pap-req, chap-response), not acceptable
  3256. * TO+: timeout with restart counter >= 0
  3257. * TO-: timeout with restart counter < 0
  3258. * TO*: reschedule timeout for CHAP
  3259. *
  3260. * scr: send request packet (none for PAP, chap-challenge)
  3261. * sca: send ack packet (pap-ack, chap-success)
  3262. * scn: send nak packet (pap-nak, chap-failure)
  3263. * ict: initialize re-challenge timer (CHAP only)
  3264. *
  3265. * tlu: this-layer-up, LCP reaches network phase
  3266. * tld: this-layer-down, LCP enters terminate phase
  3267. *
  3268. * Note that in CHAP mode, after sending a new challenge, while the state
  3269. * automaton falls back into Req-Sent state, it doesn't signal a tld
  3270. * event to LCP, so LCP remains in network phase. Only after not getting
  3271. * any response (or after getting an unacceptable response), CHAP closes,
  3272. * causing LCP to enter terminate phase.
  3273. *
  3274. * With PAP, there is no initial request that can be sent. The peer is
  3275. * expected to send one based on the successful negotiation of PAP as
  3276. * the authentication protocol during the LCP option negotiation.
  3277. *
  3278. * Incoming authentication protocol requests (remote requests
  3279. * authentication, we are peer) don't employ a state machine at all,
  3280. * they are simply answered. Some peers [Ascend P50 firmware rev
  3281. * 4.50] react allergically when sending IPCP requests while they are
  3282. * still in authentication phase (thereby violating the standard that
  3283. * demands that these NCP packets are to be discarded), so we keep
  3284. * track of the peer demanding us to authenticate, and only proceed to
  3285. * phase network once we've seen a positive acknowledge for the
  3286. * authentication.
  3287. */
  3288. /*
  3289. * Handle incoming CHAP packets.
  3290. */
  3291. void
  3292. sppp_chap_input(struct sppp *sp, struct mbuf *m)
  3293. {
  3294. STDDCL;
  3295. struct lcp_header *h;
  3296. int len, x;
  3297. u_char *value, *name, digest[AUTHCHALEN], dsize;
  3298. int value_len, name_len;
  3299. MD5_CTX ctx;
  3300. len = m->m_pkthdr.len;
  3301. if (len < 4) {
  3302. if (debug)
  3303. log(LOG_DEBUG,
  3304. SPP_FMT "chap invalid packet length: %d bytes\n",
  3305. SPP_ARGS(ifp), len);
  3306. return;
  3307. }
  3308. h = mtod (m, struct lcp_header*);
  3309. if (len > ntohs (h->len))
  3310. len = ntohs (h->len);
  3311. switch (h->type) {
  3312. /* challenge, failure and success are his authproto */
  3313. case CHAP_CHALLENGE:
  3314. value = 1 + (u_char*)(h+1);
  3315. value_len = value[-1];
  3316. name = value + value_len;
  3317. name_len = len - value_len - 5;
  3318. if (name_len < 0) {
  3319. if (debug) {
  3320. log(LOG_DEBUG,
  3321. SPP_FMT "chap corrupted challenge "
  3322. "<%s id=0x%x len=%d",
  3323. SPP_ARGS(ifp),
  3324. sppp_auth_type_name(PPP_CHAP, h->type),
  3325. h->ident, ntohs(h->len));
  3326. if (len > 4)
  3327. sppp_print_bytes((u_char*) (h+1), len-4);
  3328. addlog(">\n");
  3329. }
  3330. break;
  3331. }
  3332. if (debug) {
  3333. log(LOG_DEBUG,
  3334. SPP_FMT "chap input <%s id=0x%x len=%d name=",
  3335. SPP_ARGS(ifp),
  3336. sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
  3337. ntohs(h->len));
  3338. sppp_print_string((char*) name, name_len);
  3339. addlog(" value-size=%d value=", value_len);
  3340. sppp_print_bytes(value, value_len);
  3341. addlog(">\n");
  3342. }
  3343. /* Compute reply value. */
  3344. MD5Init(&ctx);
  3345. MD5Update(&ctx, &h->ident, 1);
  3346. MD5Update(&ctx, sp->myauth.secret, strlen(sp->myauth.secret));
  3347. MD5Update(&ctx, value, value_len);
  3348. MD5Final(digest, &ctx);
  3349. dsize = sizeof digest;
  3350. sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
  3351. sizeof dsize, (const char *)&dsize,
  3352. sizeof digest, digest,
  3353. strlen(sp->myauth.name),
  3354. sp->myauth.name,
  3355. 0);
  3356. break;
  3357. case CHAP_SUCCESS:
  3358. if (debug) {
  3359. log(LOG_DEBUG, SPP_FMT "chap success",
  3360. SPP_ARGS(ifp));
  3361. if (len > 4) {
  3362. addlog(": ");
  3363. sppp_print_string((char*)(h + 1), len - 4);
  3364. }
  3365. addlog("\n");
  3366. }
  3367. x = splnet();
  3368. sp->pp_flags &= ~PP_NEEDAUTH;
  3369. if (sp->myauth.proto == PPP_CHAP &&
  3370. (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
  3371. (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
  3372. /*
  3373. * We are authenticator for CHAP but didn't
  3374. * complete yet. Leave it to tlu to proceed
  3375. * to network phase.
  3376. */
  3377. splx(x);
  3378. break;
  3379. }
  3380. splx(x);
  3381. sppp_phase_network(sp);
  3382. break;
  3383. case CHAP_FAILURE:
  3384. if (debug) {
  3385. log(LOG_INFO, SPP_FMT "chap failure",
  3386. SPP_ARGS(ifp));
  3387. if (len > 4) {
  3388. addlog(": ");
  3389. sppp_print_string((char*)(h + 1), len - 4);
  3390. }
  3391. addlog("\n");
  3392. } else
  3393. log(LOG_INFO, SPP_FMT "chap failure\n",
  3394. SPP_ARGS(ifp));
  3395. /* await LCP shutdown by authenticator */
  3396. break;
  3397. /* response is my authproto */
  3398. case CHAP_RESPONSE:
  3399. value = 1 + (u_char*)(h+1);
  3400. value_len = value[-1];
  3401. name = value + value_len;
  3402. name_len = len - value_len - 5;
  3403. if (name_len < 0) {
  3404. if (debug) {
  3405. log(LOG_DEBUG,
  3406. SPP_FMT "chap corrupted response "
  3407. "<%s id=0x%x len=%d",
  3408. SPP_ARGS(ifp),
  3409. sppp_auth_type_name(PPP_CHAP, h->type),
  3410. h->ident, ntohs(h->len));
  3411. if (len > 4)
  3412. sppp_print_bytes((u_char*)(h+1), len-4);
  3413. addlog(">\n");
  3414. }
  3415. break;
  3416. }
  3417. if (h->ident != sp->confid[IDX_CHAP]) {
  3418. if (debug)
  3419. log(LOG_DEBUG,
  3420. SPP_FMT "chap dropping response for old ID "
  3421. "(got %d, expected %d)\n",
  3422. SPP_ARGS(ifp),
  3423. h->ident, sp->confid[IDX_CHAP]);
  3424. break;
  3425. }
  3426. if (name_len != strlen(sp->hisauth.name)
  3427. || bcmp(name, sp->hisauth.name, name_len) != 0) {
  3428. log(LOG_INFO, SPP_FMT "chap response, his name ",
  3429. SPP_ARGS(ifp));
  3430. sppp_print_string(name, name_len);
  3431. addlog(" != expected ");
  3432. sppp_print_string(sp->hisauth.name,
  3433. strlen(sp->hisauth.name));
  3434. addlog("\n");
  3435. }
  3436. if (debug) {
  3437. log(LOG_DEBUG, SPP_FMT "chap input(%s) "
  3438. "<%s id=0x%x len=%d name=",
  3439. SPP_ARGS(ifp),
  3440. sppp_state_name(sp->state[IDX_CHAP]),
  3441. sppp_auth_type_name(PPP_CHAP, h->type),
  3442. h->ident, ntohs (h->len));
  3443. sppp_print_string((char*)name, name_len);
  3444. addlog(" value-size=%d value=", value_len);
  3445. sppp_print_bytes(value, value_len);
  3446. addlog(">\n");
  3447. }
  3448. if (value_len != AUTHCHALEN) {
  3449. if (debug)
  3450. log(LOG_DEBUG,
  3451. SPP_FMT "chap bad hash value length: "
  3452. "%d bytes, should be %d\n",
  3453. SPP_ARGS(ifp), value_len,
  3454. AUTHCHALEN);
  3455. break;
  3456. }
  3457. MD5Init(&ctx);
  3458. MD5Update(&ctx, &h->ident, 1);
  3459. MD5Update(&ctx, sp->hisauth.secret, strlen(sp->hisauth.secret));
  3460. MD5Update(&ctx, sp->chap_challenge, AUTHCHALEN);
  3461. MD5Final(digest, &ctx);
  3462. #define FAILMSG "Failed..."
  3463. #define SUCCMSG "Welcome!"
  3464. if (value_len != sizeof digest ||
  3465. timingsafe_bcmp(digest, value, value_len) != 0) {
  3466. /* action scn, tld */
  3467. sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
  3468. sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
  3469. 0);
  3470. chap.tld(sp);
  3471. break;
  3472. }
  3473. /* action sca, perhaps tlu */
  3474. if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
  3475. sp->state[IDX_CHAP] == STATE_OPENED)
  3476. sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
  3477. sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
  3478. 0);
  3479. if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
  3480. sppp_cp_change_state(&chap, sp, STATE_OPENED);
  3481. chap.tlu(sp);
  3482. }
  3483. break;
  3484. default:
  3485. /* Unknown CHAP packet type -- ignore. */
  3486. if (debug) {
  3487. log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
  3488. "<0x%x id=0x%xh len=%d",
  3489. SPP_ARGS(ifp),
  3490. sppp_state_name(sp->state[IDX_CHAP]),
  3491. h->type, h->ident, ntohs(h->len));
  3492. if (len > 4)
  3493. sppp_print_bytes((u_char*)(h+1), len-4);
  3494. addlog(">\n");
  3495. }
  3496. break;
  3497. }
  3498. }
  3499. void
  3500. sppp_chap_init(struct sppp *sp)
  3501. {
  3502. /* Chap doesn't have STATE_INITIAL at all. */
  3503. sp->state[IDX_CHAP] = STATE_CLOSED;
  3504. sp->fail_counter[IDX_CHAP] = 0;
  3505. }
  3506. void
  3507. sppp_chap_open(struct sppp *sp)
  3508. {
  3509. if (sp->myauth.proto == PPP_CHAP &&
  3510. (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
  3511. /* we are authenticator for CHAP, start it */
  3512. chap.scr(sp);
  3513. sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
  3514. sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
  3515. }
  3516. /* nothing to be done if we are peer, await a challenge */
  3517. }
  3518. void
  3519. sppp_chap_close(struct sppp *sp)
  3520. {
  3521. if (sp->state[IDX_CHAP] != STATE_CLOSED)
  3522. sppp_cp_change_state(&chap, sp, STATE_CLOSED);
  3523. }
  3524. void
  3525. sppp_chap_TO(void *cookie)
  3526. {
  3527. struct sppp *sp = (struct sppp *)cookie;
  3528. STDDCL;
  3529. int s;
  3530. s = splnet();
  3531. if (debug)
  3532. log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
  3533. SPP_ARGS(ifp),
  3534. sppp_state_name(sp->state[IDX_CHAP]),
  3535. sp->rst_counter[IDX_CHAP]);
  3536. if (--sp->rst_counter[IDX_CHAP] < 0)
  3537. /* TO- event */
  3538. switch (sp->state[IDX_CHAP]) {
  3539. case STATE_REQ_SENT:
  3540. chap.tld(sp);
  3541. sppp_cp_change_state(&chap, sp, STATE_CLOSED);
  3542. break;
  3543. }
  3544. else
  3545. /* TO+ (or TO*) event */
  3546. switch (sp->state[IDX_CHAP]) {
  3547. case STATE_OPENED:
  3548. /* TO* event */
  3549. sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
  3550. /* FALLTHROUGH */
  3551. case STATE_REQ_SENT:
  3552. chap.scr(sp);
  3553. /* sppp_cp_change_state() will restart the timer */
  3554. sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
  3555. break;
  3556. }
  3557. splx(s);
  3558. }
  3559. void
  3560. sppp_chap_tlu(struct sppp *sp)
  3561. {
  3562. STDDCL;
  3563. int i = 0, x;
  3564. i = 0;
  3565. sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
  3566. /*
  3567. * Some broken CHAP implementations (Conware CoNet, firmware
  3568. * 4.0.?) don't want to re-authenticate their CHAP once the
  3569. * initial challenge-response exchange has taken place.
  3570. * Provide for an option to avoid rechallenges.
  3571. */
  3572. if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) {
  3573. /*
  3574. * Compute the re-challenge timeout. This will yield
  3575. * a number between 300 and 810 seconds.
  3576. */
  3577. i = 300 + (arc4random() & 0x01fe);
  3578. timeout_add_sec(&sp->ch[IDX_CHAP], i);
  3579. }
  3580. if (debug) {
  3581. log(LOG_DEBUG,
  3582. SPP_FMT "chap %s, ",
  3583. SPP_ARGS(ifp),
  3584. sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu");
  3585. if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0)
  3586. addlog("next re-challenge in %d seconds\n", i);
  3587. else
  3588. addlog("re-challenging suppressed\n");
  3589. }
  3590. x = splnet();
  3591. /* indicate to LCP that we need to be closed down */
  3592. sp->lcp.protos |= (1 << IDX_CHAP);
  3593. if (sp->pp_flags & PP_NEEDAUTH) {
  3594. /*
  3595. * Remote is authenticator, but his auth proto didn't
  3596. * complete yet. Defer the transition to network
  3597. * phase.
  3598. */
  3599. splx(x);
  3600. return;
  3601. }
  3602. splx(x);
  3603. /*
  3604. * If we are already in phase network, we are done here. This
  3605. * is the case if this is a dummy tlu event after a re-challenge.
  3606. */
  3607. if (sp->pp_phase != PHASE_NETWORK)
  3608. sppp_phase_network(sp);
  3609. }
  3610. void
  3611. sppp_chap_tld(struct sppp *sp)
  3612. {
  3613. STDDCL;
  3614. if (debug)
  3615. log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
  3616. UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]);
  3617. sp->lcp.protos &= ~(1 << IDX_CHAP);
  3618. lcp.Close(sp);
  3619. }
  3620. void
  3621. sppp_chap_scr(struct sppp *sp)
  3622. {
  3623. u_char clen;
  3624. /* Compute random challenge. */
  3625. arc4random_buf(sp->chap_challenge, sizeof(sp->chap_challenge));
  3626. clen = AUTHCHALEN;
  3627. sp->confid[IDX_CHAP] = ++sp->pp_seq;
  3628. sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
  3629. sizeof clen, (const char *)&clen,
  3630. (size_t)AUTHCHALEN, sp->chap_challenge,
  3631. strlen(sp->myauth.name),
  3632. sp->myauth.name,
  3633. 0);
  3634. }
  3635. /*
  3636. *--------------------------------------------------------------------------*
  3637. * *
  3638. * The PAP implementation. *
  3639. * *
  3640. *--------------------------------------------------------------------------*
  3641. */
  3642. /*
  3643. * For PAP, we need to keep a little state also if we are the peer, not the
  3644. * authenticator. This is since we don't get a request to authenticate, but
  3645. * have to repeatedly authenticate ourself until we got a response (or the
  3646. * retry counter is expired).
  3647. */
  3648. /*
  3649. * Handle incoming PAP packets. */
  3650. void
  3651. sppp_pap_input(struct sppp *sp, struct mbuf *m)
  3652. {
  3653. STDDCL;
  3654. struct lcp_header *h;
  3655. int len, x;
  3656. u_char *name, *passwd, mlen;
  3657. int name_len, passwd_len;
  3658. len = m->m_pkthdr.len;
  3659. if (len < 5) {
  3660. if (debug)
  3661. log(LOG_DEBUG,
  3662. SPP_FMT "pap invalid packet length: %d bytes\n",
  3663. SPP_ARGS(ifp), len);
  3664. return;
  3665. }
  3666. h = mtod (m, struct lcp_header*);
  3667. if (len > ntohs (h->len))
  3668. len = ntohs (h->len);
  3669. switch (h->type) {
  3670. /* PAP request is my authproto */
  3671. case PAP_REQ:
  3672. name = 1 + (u_char*)(h+1);
  3673. name_len = name[-1];
  3674. passwd = name + name_len + 1;
  3675. if (name_len > len - 6 ||
  3676. (passwd_len = passwd[-1]) > len - 6 - name_len) {
  3677. if (debug) {
  3678. log(LOG_DEBUG, SPP_FMT "pap corrupted input "
  3679. "<%s id=0x%x len=%d",
  3680. SPP_ARGS(ifp),
  3681. sppp_auth_type_name(PPP_PAP, h->type),
  3682. h->ident, ntohs(h->len));
  3683. if (len > 4)
  3684. sppp_print_bytes((u_char*)(h+1), len-4);
  3685. addlog(">\n");
  3686. }
  3687. break;
  3688. }
  3689. if (debug) {
  3690. log(LOG_DEBUG, SPP_FMT "pap input(%s) "
  3691. "<%s id=0x%x len=%d name=",
  3692. SPP_ARGS(ifp),
  3693. sppp_state_name(sp->state[IDX_PAP]),
  3694. sppp_auth_type_name(PPP_PAP, h->type),
  3695. h->ident, ntohs(h->len));
  3696. sppp_print_string((char*)name, name_len);
  3697. addlog(" passwd=");
  3698. sppp_print_string((char*)passwd, passwd_len);
  3699. addlog(">\n");
  3700. }
  3701. if (name_len > AUTHMAXLEN ||
  3702. passwd_len > AUTHMAXLEN ||
  3703. bcmp(name, sp->hisauth.name, name_len) != 0 ||
  3704. bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
  3705. /* action scn, tld */
  3706. mlen = sizeof(FAILMSG) - 1;
  3707. sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
  3708. sizeof mlen, (const char *)&mlen,
  3709. sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
  3710. 0);
  3711. pap.tld(sp);
  3712. break;
  3713. }
  3714. /* action sca, perhaps tlu */
  3715. if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
  3716. sp->state[IDX_PAP] == STATE_OPENED) {
  3717. mlen = sizeof(SUCCMSG) - 1;
  3718. sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
  3719. sizeof mlen, (const char *)&mlen,
  3720. sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
  3721. 0);
  3722. }
  3723. if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
  3724. sppp_cp_change_state(&pap, sp, STATE_OPENED);
  3725. pap.tlu(sp);
  3726. }
  3727. break;
  3728. /* ack and nak are his authproto */
  3729. case PAP_ACK:
  3730. UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
  3731. if (debug) {
  3732. log(LOG_DEBUG, SPP_FMT "pap success",
  3733. SPP_ARGS(ifp));
  3734. name_len = *((char *)h);
  3735. if (len > 5 && name_len) {
  3736. addlog(": ");
  3737. sppp_print_string((char*)(h+1), name_len);
  3738. }
  3739. addlog("\n");
  3740. }
  3741. x = splnet();
  3742. sp->pp_flags &= ~PP_NEEDAUTH;
  3743. if (sp->myauth.proto == PPP_PAP &&
  3744. (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
  3745. (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
  3746. /*
  3747. * We are authenticator for PAP but didn't
  3748. * complete yet. Leave it to tlu to proceed
  3749. * to network phase.
  3750. */
  3751. splx(x);
  3752. break;
  3753. }
  3754. splx(x);
  3755. sppp_phase_network(sp);
  3756. break;
  3757. case PAP_NAK:
  3758. UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
  3759. if (debug) {
  3760. log(LOG_INFO, SPP_FMT "pap failure",
  3761. SPP_ARGS(ifp));
  3762. name_len = *((char *)h);
  3763. if (len > 5 && name_len) {
  3764. addlog(": ");
  3765. sppp_print_string((char*)(h+1), name_len);
  3766. }
  3767. addlog("\n");
  3768. } else
  3769. log(LOG_INFO, SPP_FMT "pap failure\n",
  3770. SPP_ARGS(ifp));
  3771. /* await LCP shutdown by authenticator */
  3772. break;
  3773. default:
  3774. /* Unknown PAP packet type -- ignore. */
  3775. if (debug) {
  3776. log(LOG_DEBUG, SPP_FMT "pap corrupted input "
  3777. "<0x%x id=0x%x len=%d",
  3778. SPP_ARGS(ifp),
  3779. h->type, h->ident, ntohs(h->len));
  3780. if (len > 4)
  3781. sppp_print_bytes((u_char*)(h+1), len-4);
  3782. addlog(">\n");
  3783. }
  3784. break;
  3785. }
  3786. }
  3787. void
  3788. sppp_pap_init(struct sppp *sp)
  3789. {
  3790. /* PAP doesn't have STATE_INITIAL at all. */
  3791. sp->state[IDX_PAP] = STATE_CLOSED;
  3792. sp->fail_counter[IDX_PAP] = 0;
  3793. }
  3794. void
  3795. sppp_pap_open(struct sppp *sp)
  3796. {
  3797. if (sp->hisauth.proto == PPP_PAP &&
  3798. (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
  3799. /* we are authenticator for PAP, start our timer */
  3800. sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
  3801. sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
  3802. }
  3803. if (sp->myauth.proto == PPP_PAP) {
  3804. /* we are peer, send a request, and start a timer */
  3805. pap.scr(sp);
  3806. timeout_add(&sp->pap_my_to_ch, sp->lcp.timeout);
  3807. }
  3808. }
  3809. void
  3810. sppp_pap_close(struct sppp *sp)
  3811. {
  3812. if (sp->state[IDX_PAP] != STATE_CLOSED)
  3813. sppp_cp_change_state(&pap, sp, STATE_CLOSED);
  3814. }
  3815. /*
  3816. * That's the timeout routine if we are authenticator. Since the
  3817. * authenticator is basically passive in PAP, we can't do much here.
  3818. */
  3819. void
  3820. sppp_pap_TO(void *cookie)
  3821. {
  3822. struct sppp *sp = (struct sppp *)cookie;
  3823. STDDCL;
  3824. int s;
  3825. s = splnet();
  3826. if (debug)
  3827. log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
  3828. SPP_ARGS(ifp),
  3829. sppp_state_name(sp->state[IDX_PAP]),
  3830. sp->rst_counter[IDX_PAP]);
  3831. if (--sp->rst_counter[IDX_PAP] < 0)
  3832. /* TO- event */
  3833. switch (sp->state[IDX_PAP]) {
  3834. case STATE_REQ_SENT:
  3835. pap.tld(sp);
  3836. sppp_cp_change_state(&pap, sp, STATE_CLOSED);
  3837. break;
  3838. }
  3839. else
  3840. /* TO+ event, not very much we could do */
  3841. switch (sp->state[IDX_PAP]) {
  3842. case STATE_REQ_SENT:
  3843. /* sppp_cp_change_state() will restart the timer */
  3844. sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
  3845. break;
  3846. }
  3847. splx(s);
  3848. }
  3849. /*
  3850. * That's the timeout handler if we are peer. Since the peer is active,
  3851. * we need to retransmit our PAP request since it is apparently lost.
  3852. * XXX We should impose a max counter.
  3853. */
  3854. void
  3855. sppp_pap_my_TO(void *cookie)
  3856. {
  3857. struct sppp *sp = (struct sppp *)cookie;
  3858. STDDCL;
  3859. if (debug)
  3860. log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
  3861. SPP_ARGS(ifp));
  3862. pap.scr(sp);
  3863. }
  3864. void
  3865. sppp_pap_tlu(struct sppp *sp)
  3866. {
  3867. STDDCL;
  3868. int x;
  3869. sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
  3870. if (debug)
  3871. log(LOG_DEBUG, SPP_FMT "%s tlu\n",
  3872. SPP_ARGS(ifp), pap.name);
  3873. x = splnet();
  3874. /* indicate to LCP that we need to be closed down */
  3875. sp->lcp.protos |= (1 << IDX_PAP);
  3876. if (sp->pp_flags & PP_NEEDAUTH) {
  3877. /*
  3878. * Remote is authenticator, but his auth proto didn't
  3879. * complete yet. Defer the transition to network
  3880. * phase.
  3881. */
  3882. splx(x);
  3883. return;
  3884. }
  3885. splx(x);
  3886. sppp_phase_network(sp);
  3887. }
  3888. void
  3889. sppp_pap_tld(struct sppp *sp)
  3890. {
  3891. STDDCL;
  3892. if (debug)
  3893. log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
  3894. UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]);
  3895. UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
  3896. sp->lcp.protos &= ~(1 << IDX_PAP);
  3897. lcp.Close(sp);
  3898. }
  3899. void
  3900. sppp_pap_scr(struct sppp *sp)
  3901. {
  3902. u_char idlen, pwdlen;
  3903. sp->confid[IDX_PAP] = ++sp->pp_seq;
  3904. pwdlen = strlen(sp->myauth.secret);
  3905. idlen = strlen(sp->myauth.name);
  3906. sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
  3907. sizeof idlen, (const char *)&idlen,
  3908. (size_t)idlen, sp->myauth.name,
  3909. sizeof pwdlen, (const char *)&pwdlen,
  3910. (size_t)pwdlen, sp->myauth.secret,
  3911. 0);
  3912. }
  3913. /*
  3914. * Random miscellaneous functions.
  3915. */
  3916. /*
  3917. * Send a PAP or CHAP proto packet.
  3918. *
  3919. * Varadic function, each of the elements for the ellipsis is of type
  3920. * ``size_t mlen, const u_char *msg''. Processing will stop iff
  3921. * mlen == 0.
  3922. */
  3923. void
  3924. sppp_auth_send(const struct cp *cp, struct sppp *sp,
  3925. unsigned int type, u_int id, ...)
  3926. {
  3927. STDDCL;
  3928. struct ppp_header *h;
  3929. struct lcp_header *lh;
  3930. struct mbuf *m;
  3931. u_char *p;
  3932. int len;
  3933. size_t pkthdrlen;
  3934. unsigned int mlen;
  3935. const char *msg;
  3936. va_list ap;
  3937. MGETHDR (m, M_DONTWAIT, MT_DATA);
  3938. if (! m)
  3939. return;
  3940. m->m_pkthdr.ph_ifidx = 0;
  3941. if (sp->pp_flags & PP_NOFRAMING) {
  3942. *mtod(m, u_int16_t *) = htons(cp->proto);
  3943. pkthdrlen = 2;
  3944. lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
  3945. } else {
  3946. h = mtod (m, struct ppp_header*);
  3947. h->address = PPP_ALLSTATIONS; /* broadcast address */
  3948. h->control = PPP_UI; /* Unnumbered Info */
  3949. h->protocol = htons(cp->proto);
  3950. pkthdrlen = PPP_HEADER_LEN;
  3951. lh = (struct lcp_header*)(h + 1);
  3952. }
  3953. lh->type = type;
  3954. lh->ident = id;
  3955. p = (u_char*) (lh+1);
  3956. va_start(ap, id);
  3957. len = 0;
  3958. while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
  3959. msg = va_arg(ap, const char *);
  3960. len += mlen;
  3961. if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
  3962. va_end(ap);
  3963. m_freem(m);
  3964. return;
  3965. }
  3966. bcopy(msg, p, mlen);
  3967. p += mlen;
  3968. }
  3969. va_end(ap);
  3970. m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
  3971. lh->len = htons (LCP_HEADER_LEN + len);
  3972. if (debug) {
  3973. log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
  3974. SPP_ARGS(ifp), cp->name,
  3975. sppp_auth_type_name(cp->proto, lh->type),
  3976. lh->ident, ntohs(lh->len));
  3977. if (len)
  3978. sppp_print_bytes((u_char*) (lh+1), len);
  3979. addlog(">\n");
  3980. }
  3981. if (IF_QFULL (&sp->pp_cpq)) {
  3982. IF_DROP (&ifp->if_snd);
  3983. m_freem (m);
  3984. ++ifp->if_oerrors;
  3985. m = NULL;
  3986. } else
  3987. IF_ENQUEUE (&sp->pp_cpq, m);
  3988. if (! (ifp->if_flags & IFF_OACTIVE))
  3989. (*ifp->if_start) (ifp);
  3990. if (m != NULL)
  3991. ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
  3992. }
  3993. /*
  3994. * Flush interface queue.
  3995. */
  3996. void
  3997. sppp_qflush(struct ifqueue *ifq)
  3998. {
  3999. IF_PURGE(ifq);
  4000. }
  4001. /*
  4002. * Send keepalive packets, every 10 seconds.
  4003. */
  4004. void
  4005. sppp_keepalive(void *dummy)
  4006. {
  4007. struct sppp *sp;
  4008. int s;
  4009. struct timeval tv;
  4010. s = splnet();
  4011. getmicrouptime(&tv);
  4012. for (sp=spppq; sp; sp=sp->pp_next) {
  4013. struct ifnet *ifp = &sp->pp_if;
  4014. /* Keepalive mode disabled or channel down? */
  4015. if (! (sp->pp_flags & PP_KEEPALIVE) ||
  4016. ! (ifp->if_flags & IFF_RUNNING))
  4017. continue;
  4018. /* No keepalive in PPP mode if LCP not opened yet. */
  4019. if (! (sp->pp_flags & PP_CISCO) &&
  4020. sp->pp_phase < PHASE_AUTHENTICATE)
  4021. continue;
  4022. /* No echo reply, but maybe user data passed through? */
  4023. if (!(sp->pp_flags & PP_CISCO) &&
  4024. (tv.tv_sec - sp->pp_last_receive) < NORECV_TIME) {
  4025. sp->pp_alivecnt = 0;
  4026. continue;
  4027. }
  4028. if (sp->pp_alivecnt >= MAXALIVECNT) {
  4029. /* No keepalive packets got. Stop the interface. */
  4030. if_down (ifp);
  4031. sppp_qflush (&sp->pp_cpq);
  4032. if (! (sp->pp_flags & PP_CISCO)) {
  4033. log(LOG_INFO, SPP_FMT "LCP keepalive timeout\n",
  4034. SPP_ARGS(ifp));
  4035. sp->pp_alivecnt = 0;
  4036. /* we are down, close all open protocols */
  4037. lcp.Close(sp);
  4038. /* And now prepare LCP to reestablish the link, if configured to do so. */
  4039. sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
  4040. /* Close connection immediately, completition of this
  4041. * will summon the magic needed to reestablish it. */
  4042. if (sp->pp_tlf)
  4043. sp->pp_tlf(sp);
  4044. continue;
  4045. }
  4046. }
  4047. if (sp->pp_alivecnt < MAXALIVECNT)
  4048. ++sp->pp_alivecnt;
  4049. if (sp->pp_flags & PP_CISCO)
  4050. sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
  4051. sp->pp_rseq);
  4052. else if (sp->pp_phase >= PHASE_AUTHENTICATE) {
  4053. u_int32_t nmagic = htonl(sp->lcp.magic);
  4054. sp->lcp.echoid = ++sp->pp_seq;
  4055. sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
  4056. sp->lcp.echoid, 4, &nmagic);
  4057. }
  4058. }
  4059. splx(s);
  4060. timeout_add_sec(&keepalive_ch, 10);
  4061. }
  4062. /*
  4063. * Get both IP addresses.
  4064. */
  4065. void
  4066. sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst,
  4067. u_int32_t *srcmask)
  4068. {
  4069. struct ifnet *ifp = &sp->pp_if;
  4070. struct ifaddr *ifa;
  4071. struct sockaddr_in *si, *sm = 0;
  4072. u_int32_t ssrc, ddst;
  4073. sm = NULL;
  4074. ssrc = ddst = 0;
  4075. /*
  4076. * Pick the first AF_INET address from the list,
  4077. * aliases don't make any sense on a p2p link anyway.
  4078. */
  4079. si = 0;
  4080. TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
  4081. {
  4082. if (ifa->ifa_addr->sa_family == AF_INET) {
  4083. si = (struct sockaddr_in *)ifa->ifa_addr;
  4084. sm = (struct sockaddr_in *)ifa->ifa_netmask;
  4085. if (si)
  4086. break;
  4087. }
  4088. }
  4089. if (ifa) {
  4090. if (si && si->sin_addr.s_addr) {
  4091. ssrc = si->sin_addr.s_addr;
  4092. if (srcmask)
  4093. *srcmask = ntohl(sm->sin_addr.s_addr);
  4094. }
  4095. si = (struct sockaddr_in *)ifa->ifa_dstaddr;
  4096. if (si && si->sin_addr.s_addr)
  4097. ddst = si->sin_addr.s_addr;
  4098. }
  4099. if (dst) *dst = ntohl(ddst);
  4100. if (src) *src = ntohl(ssrc);
  4101. }
  4102. int
  4103. sppp_update_gw_walker(struct rtentry *rt, void *arg, unsigned int id)
  4104. {
  4105. struct ifnet *ifp = arg;
  4106. if (rt->rt_ifp == ifp) {
  4107. if (rt->rt_ifa->ifa_dstaddr->sa_family !=
  4108. rt->rt_gateway->sa_family ||
  4109. (rt->rt_flags & RTF_GATEWAY) == 0)
  4110. return (0); /* do not modify non-gateway routes */
  4111. bcopy(rt->rt_ifa->ifa_dstaddr, rt->rt_gateway,
  4112. rt->rt_ifa->ifa_dstaddr->sa_len);
  4113. }
  4114. return (0);
  4115. }
  4116. void
  4117. sppp_update_gw(struct ifnet *ifp)
  4118. {
  4119. u_int tid;
  4120. /* update routing table */
  4121. for (tid = 0; tid <= RT_TABLEID_MAX; tid++) {
  4122. while (rtable_walk(tid, AF_INET, sppp_update_gw_walker,
  4123. ifp) == EAGAIN)
  4124. ; /* nothing */
  4125. }
  4126. }
  4127. /*
  4128. * Task adding addresses from process context.
  4129. * If an address is 0, leave it the way it is.
  4130. */
  4131. void
  4132. sppp_set_ip_addrs(void *arg1)
  4133. {
  4134. struct sppp *sp = arg1;
  4135. u_int32_t myaddr;
  4136. u_int32_t hisaddr;
  4137. struct ifnet *ifp = &sp->pp_if;
  4138. int debug = ifp->if_flags & IFF_DEBUG;
  4139. struct ifaddr *ifa;
  4140. struct sockaddr_in *si;
  4141. struct sockaddr_in *dest;
  4142. int s;
  4143. sppp_get_ip_addrs(sp, &myaddr, &hisaddr, NULL);
  4144. if ((sp->ipcp.flags & IPCP_MYADDR_DYN) &&
  4145. (sp->ipcp.flags & IPCP_MYADDR_SEEN))
  4146. myaddr = sp->ipcp.req_myaddr;
  4147. if ((sp->ipcp.flags & IPCP_HISADDR_DYN) &&
  4148. (sp->ipcp.flags & IPCP_HISADDR_SEEN))
  4149. hisaddr = sp->ipcp.req_hisaddr;
  4150. s = splsoftnet();
  4151. /*
  4152. * Pick the first AF_INET address from the list,
  4153. * aliases don't make any sense on a p2p link anyway.
  4154. */
  4155. si = 0;
  4156. TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
  4157. {
  4158. if (ifa->ifa_addr->sa_family == AF_INET)
  4159. {
  4160. si = (struct sockaddr_in *)ifa->ifa_addr;
  4161. dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
  4162. if (si)
  4163. break;
  4164. }
  4165. }
  4166. if (ifa && si) {
  4167. int error;
  4168. struct sockaddr_in new_sin = *si;
  4169. struct sockaddr_in new_dst = *dest;
  4170. in_ifscrub(ifp, ifatoia(ifa));
  4171. if (myaddr != 0)
  4172. new_sin.sin_addr.s_addr = htonl(myaddr);
  4173. if (hisaddr != 0) {
  4174. new_dst.sin_addr.s_addr = htonl(hisaddr);
  4175. if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) {
  4176. sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
  4177. *dest = new_dst; /* fix dstaddr in place */
  4178. }
  4179. }
  4180. if (!(error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0)))
  4181. dohooks(ifp->if_addrhooks, 0);
  4182. if (debug && error) {
  4183. log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit "
  4184. " failed, error=%d\n", SPP_ARGS(ifp), error);
  4185. splx(s);
  4186. return;
  4187. }
  4188. sppp_update_gw(ifp);
  4189. }
  4190. splx(s);
  4191. }
  4192. /*
  4193. * Task clearing addresses from process context.
  4194. * Clear IP addresses.
  4195. */
  4196. void
  4197. sppp_clear_ip_addrs(void *arg1)
  4198. {
  4199. struct sppp *sp = (struct sppp *)arg1;
  4200. struct ifnet *ifp = &sp->pp_if;
  4201. int debug = ifp->if_flags & IFF_DEBUG;
  4202. struct ifaddr *ifa;
  4203. struct sockaddr_in *si;
  4204. struct sockaddr_in *dest;
  4205. u_int32_t remote;
  4206. int s;
  4207. s = splsoftnet();
  4208. if (sp->ipcp.flags & IPCP_HISADDR_DYN)
  4209. remote = sp->ipcp.saved_hisaddr;
  4210. else
  4211. sppp_get_ip_addrs(sp, 0, &remote, 0);
  4212. /*
  4213. * Pick the first AF_INET address from the list,
  4214. * aliases don't make any sense on a p2p link anyway.
  4215. */
  4216. si = 0;
  4217. TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
  4218. if (ifa->ifa_addr->sa_family == AF_INET) {
  4219. si = (struct sockaddr_in *)ifa->ifa_addr;
  4220. dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
  4221. if (si)
  4222. break;
  4223. }
  4224. }
  4225. if (ifa && si) {
  4226. int error;
  4227. struct sockaddr_in new_sin = *si;
  4228. in_ifscrub(ifp, ifatoia(ifa));
  4229. if (sp->ipcp.flags & IPCP_MYADDR_DYN)
  4230. new_sin.sin_addr.s_addr = 0;
  4231. if (sp->ipcp.flags & IPCP_HISADDR_DYN)
  4232. /* replace peer addr in place */
  4233. dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr;
  4234. if (!(error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0)))
  4235. dohooks(ifp->if_addrhooks, 0);
  4236. if (debug && error) {
  4237. log(LOG_DEBUG, SPP_FMT "sppp_clear_ip_addrs: in_ifinit "
  4238. " failed, error=%d\n", SPP_ARGS(ifp), error);
  4239. splx(s);
  4240. return;
  4241. }
  4242. sppp_update_gw(ifp);
  4243. }
  4244. splx(s);
  4245. }
  4246. #ifdef INET6
  4247. /*
  4248. * Get both IPv6 addresses.
  4249. */
  4250. void
  4251. sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
  4252. struct in6_addr *srcmask)
  4253. {
  4254. struct ifnet *ifp = &sp->pp_if;
  4255. struct in6_ifaddr *ia6;
  4256. struct in6_addr ssrc, ddst;
  4257. bzero(&ssrc, sizeof(ssrc));
  4258. bzero(&ddst, sizeof(ddst));
  4259. /*
  4260. * Pick the first link-local AF_INET6 address from the list,
  4261. * aliases don't make any sense on a p2p link anyway.
  4262. */
  4263. ia6 = in6ifa_ifpforlinklocal(ifp, 0);
  4264. if (ia6) {
  4265. if (!IN6_IS_ADDR_UNSPECIFIED(&ia6->ia_addr.sin6_addr)) {
  4266. bcopy(&ia6->ia_addr.sin6_addr, &ssrc, sizeof(ssrc));
  4267. if (srcmask) {
  4268. bcopy(&ia6->ia_prefixmask.sin6_addr, srcmask,
  4269. sizeof(*srcmask));
  4270. }
  4271. }
  4272. if (!IN6_IS_ADDR_UNSPECIFIED(&ia6->ia_dstaddr.sin6_addr))
  4273. bcopy(&ia6->ia_dstaddr.sin6_addr, &ddst, sizeof(ddst));
  4274. }
  4275. if (dst)
  4276. bcopy(&ddst, dst, sizeof(*dst));
  4277. if (src)
  4278. bcopy(&ssrc, src, sizeof(*src));
  4279. }
  4280. /* Task to update my IPv6 address from process context. */
  4281. void
  4282. sppp_update_ip6_addr(void *arg)
  4283. {
  4284. struct sppp *sp = arg;
  4285. struct ifnet *ifp = &sp->pp_if;
  4286. struct in6_aliasreq *ifra = &sp->ipv6cp.req_ifid;
  4287. struct in6_addr mask = in6mask128;
  4288. struct in6_ifaddr *ia6;
  4289. int s, error;
  4290. s = splnet();
  4291. ia6 = in6ifa_ifpforlinklocal(ifp, 0);
  4292. if (ia6 == NULL) {
  4293. /* IPv6 disabled? */
  4294. splx(s);
  4295. return;
  4296. }
  4297. /*
  4298. * Changing the link-local address requires purging all
  4299. * existing addresses and routes for the interface first.
  4300. */
  4301. if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
  4302. in6_ifdetach(ifp);
  4303. error = in6_ifattach_linklocal(ifp, &ifra->ifra_addr.sin6_addr);
  4304. if (error)
  4305. log(LOG_ERR, SPP_FMT
  4306. "could not update IPv6 address (error %d)\n",
  4307. SPP_ARGS(ifp), error);
  4308. splx(s);
  4309. return;
  4310. }
  4311. /*
  4312. * Code below changes address parameters only, not the address itself.
  4313. */
  4314. /* Destination address can only be set for /128. */
  4315. if (!in6_are_prefix_equal(&ia6->ia_prefixmask.sin6_addr, &mask, 128)) {
  4316. ifra->ifra_dstaddr.sin6_len = 0;
  4317. ifra->ifra_dstaddr.sin6_family = AF_UNSPEC;
  4318. }
  4319. ifra->ifra_lifetime = ia6->ia6_lifetime;
  4320. error = in6_update_ifa(ifp, ifra, ia6);
  4321. if (error) {
  4322. log(LOG_ERR, SPP_FMT
  4323. "could not update IPv6 address (error %d)\n",
  4324. SPP_ARGS(ifp), error);
  4325. }
  4326. splx(s);
  4327. }
  4328. /*
  4329. * Configure my link-local address.
  4330. */
  4331. void
  4332. sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src,
  4333. const struct in6_addr *dst)
  4334. {
  4335. struct ifnet *ifp = &sp->pp_if;
  4336. struct in6_aliasreq *ifra = &sp->ipv6cp.req_ifid;
  4337. bzero(ifra, sizeof(*ifra));
  4338. bcopy(ifp->if_xname, ifra->ifra_name, sizeof(ifra->ifra_name));
  4339. ifra->ifra_addr.sin6_len = sizeof(struct sockaddr_in6);
  4340. ifra->ifra_addr.sin6_family = AF_INET6;
  4341. ifra->ifra_addr.sin6_addr = *src;
  4342. if (dst) {
  4343. ifra->ifra_dstaddr.sin6_len = sizeof(struct sockaddr_in6);
  4344. ifra->ifra_dstaddr.sin6_family = AF_INET6;
  4345. ifra->ifra_dstaddr.sin6_addr = *dst;
  4346. } else
  4347. ifra->ifra_dstaddr.sin6_family = AF_UNSPEC;
  4348. /*
  4349. * Don't change the existing prefixlen.
  4350. * It is common to use a /64 for IPv6 over point-to-point links
  4351. * to allow e.g. neighbour discovery and autoconf to work.
  4352. * But it is legal to use other values.
  4353. */
  4354. ifra->ifra_prefixmask.sin6_family = AF_UNSPEC;
  4355. /* DAD is redundant after an IPv6CP exchange. */
  4356. ifra->ifra_flags |= IN6_IFF_NODAD;
  4357. task_add(systq, &sp->ipv6cp.set_addr_task);
  4358. }
  4359. /*
  4360. * Generate an address that differs from our existing address.
  4361. */
  4362. void
  4363. sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
  4364. {
  4365. struct in6_addr myaddr;
  4366. u_int32_t random;
  4367. sppp_get_ip6_addrs(sp, &myaddr, NULL, NULL);
  4368. myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */
  4369. random = arc4random();
  4370. if ((random & 0xff) == 0 && (random & 0xff00) == 0) {
  4371. myaddr.s6_addr[14] ^= 0xff;
  4372. myaddr.s6_addr[15] ^= 0xff;
  4373. } else {
  4374. myaddr.s6_addr[14] ^= (random & 0xff);
  4375. myaddr.s6_addr[15] ^= ((random & 0xff00) >> 8);
  4376. }
  4377. myaddr.s6_addr16[1] = 0; /* KAME hack: clear ifindex */
  4378. bcopy(&myaddr, suggest, sizeof(myaddr));
  4379. }
  4380. #endif /*INET6*/
  4381. int
  4382. sppp_get_params(struct sppp *sp, struct ifreq *ifr)
  4383. {
  4384. int cmd;
  4385. if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0)
  4386. return EFAULT;
  4387. switch (cmd) {
  4388. case SPPPIOGDEFS:
  4389. {
  4390. struct spppreq *spr;
  4391. spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK);
  4392. spr->cmd = cmd;
  4393. spr->phase = sp->pp_phase;
  4394. if (copyout(spr, (caddr_t)ifr->ifr_data, sizeof(*spr)) != 0) {
  4395. free(spr, M_DEVBUF, 0);
  4396. return EFAULT;
  4397. }
  4398. free(spr, M_DEVBUF, 0);
  4399. break;
  4400. }
  4401. case SPPPIOGMAUTH:
  4402. case SPPPIOGHAUTH:
  4403. {
  4404. struct sauthreq *spa;
  4405. struct sauth *auth;
  4406. spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK);
  4407. auth = (cmd == SPPPIOGMAUTH) ? &sp->myauth : &sp->hisauth;
  4408. bzero(spa, sizeof(*spa));
  4409. spa->proto = auth->proto;
  4410. spa->flags = auth->flags;
  4411. /* do not copy the secret, and only let root know the name */
  4412. if (auth->name != NULL && suser(curproc, 0) == 0)
  4413. strlcpy(spa->name, auth->name, sizeof(spa->name));
  4414. if (copyout(spa, (caddr_t)ifr->ifr_data, sizeof(*spa)) != 0) {
  4415. free(spa, M_DEVBUF, 0);
  4416. return EFAULT;
  4417. }
  4418. free(spa, M_DEVBUF, 0);
  4419. break;
  4420. }
  4421. default:
  4422. return EINVAL;
  4423. }
  4424. return 0;
  4425. }
  4426. int
  4427. sppp_set_params(struct sppp *sp, struct ifreq *ifr)
  4428. {
  4429. int cmd;
  4430. if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0)
  4431. return EFAULT;
  4432. /*
  4433. * We have a very specific idea of which fields we allow
  4434. * being passed back from userland, so to not clobber our
  4435. * current state. For one, we only allow setting
  4436. * anything if LCP is in dead phase. Once the LCP
  4437. * negotiations started, the authentication settings must
  4438. * not be changed again. (The administrator can force an
  4439. * ifconfig down in order to get LCP back into dead
  4440. * phase.)
  4441. */
  4442. if (sp->pp_phase != PHASE_DEAD)
  4443. return EBUSY;
  4444. switch (cmd) {
  4445. case SPPPIOSDEFS:
  4446. {
  4447. struct spppreq *spr;
  4448. spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK);
  4449. if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(*spr)) != 0) {
  4450. free(spr, M_DEVBUF, 0);
  4451. return EFAULT;
  4452. }
  4453. /*
  4454. * Also, we only allow for authentication parameters to be
  4455. * specified.
  4456. *
  4457. * XXX Should allow to set or clear pp_flags.
  4458. */
  4459. free(spr, M_DEVBUF, 0);
  4460. break;
  4461. }
  4462. case SPPPIOSMAUTH:
  4463. case SPPPIOSHAUTH:
  4464. {
  4465. /*
  4466. * Finally, if the respective authentication protocol to
  4467. * be used is set differently than 0, but the secret is
  4468. * passed as all zeros, we don't trash the existing secret.
  4469. * This allows an administrator to change the system name
  4470. * only without clobbering the secret (which he didn't get
  4471. * back in a previous SPPPIOGXAUTH call). However, the
  4472. * secrets are cleared if the authentication protocol is
  4473. * reset to 0.
  4474. */
  4475. struct sauthreq *spa;
  4476. struct sauth *auth;
  4477. char *p;
  4478. int len;
  4479. spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK);
  4480. auth = (cmd == SPPPIOSMAUTH) ? &sp->myauth : &sp->hisauth;
  4481. if (copyin((caddr_t)ifr->ifr_data, spa, sizeof(*spa)) != 0) {
  4482. free(spa, M_DEVBUF, 0);
  4483. return EFAULT;
  4484. }
  4485. if (spa->proto != 0 && spa->proto != PPP_PAP &&
  4486. spa->proto != PPP_CHAP) {
  4487. free(spa, M_DEVBUF, 0);
  4488. return EINVAL;
  4489. }
  4490. if (spa->proto == 0) {
  4491. /* resetting auth */
  4492. if (auth->name != NULL)
  4493. free(auth->name, M_DEVBUF, 0);
  4494. if (auth->secret != NULL)
  4495. free(auth->secret, M_DEVBUF, 0);
  4496. bzero(auth, sizeof *auth);
  4497. explicit_bzero(sp->chap_challenge, sizeof sp->chap_challenge);
  4498. } else {
  4499. /* setting/changing auth */
  4500. auth->proto = spa->proto;
  4501. auth->flags = spa->flags;
  4502. spa->name[AUTHMAXLEN - 1] = '\0';
  4503. len = strlen(spa->name) + 1;
  4504. p = malloc(len, M_DEVBUF, M_WAITOK);
  4505. strlcpy(p, spa->name, len);
  4506. if (auth->name != NULL)
  4507. free(auth->name, M_DEVBUF, 0);
  4508. auth->name = p;
  4509. if (spa->secret[0] != '\0') {
  4510. spa->secret[AUTHMAXLEN - 1] = '\0';
  4511. len = strlen(spa->secret) + 1;
  4512. p = malloc(len, M_DEVBUF, M_WAITOK);
  4513. strlcpy(p, spa->secret, len);
  4514. if (auth->secret != NULL)
  4515. free(auth->secret, M_DEVBUF, 0);
  4516. auth->secret = p;
  4517. } else if (!auth->secret) {
  4518. p = malloc(1, M_DEVBUF, M_WAITOK);
  4519. p[0] = '\0';
  4520. auth->secret = p;
  4521. }
  4522. }
  4523. free(spa, M_DEVBUF, 0);
  4524. break;
  4525. }
  4526. default:
  4527. return EINVAL;
  4528. }
  4529. return 0;
  4530. }
  4531. void
  4532. sppp_phase_network(struct sppp *sp)
  4533. {
  4534. int i;
  4535. u_long mask;
  4536. sp->pp_phase = PHASE_NETWORK;
  4537. sppp_set_phase(sp);
  4538. /* Notify NCPs now. */
  4539. for (i = 0; i < IDX_COUNT; i++)
  4540. if ((cps[i])->flags & CP_NCP)
  4541. (cps[i])->Open(sp);
  4542. /* Send Up events to all NCPs. */
  4543. for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
  4544. if (sp->lcp.protos & mask && ((cps[i])->flags & CP_NCP))
  4545. (cps[i])->Up(sp);
  4546. /* if no NCP is starting, all this was in vain, close down */
  4547. sppp_lcp_check_and_close(sp);
  4548. }
  4549. const char *
  4550. sppp_cp_type_name(u_char type)
  4551. {
  4552. static char buf[12];
  4553. switch (type) {
  4554. case CONF_REQ: return "conf-req";
  4555. case CONF_ACK: return "conf-ack";
  4556. case CONF_NAK: return "conf-nak";
  4557. case CONF_REJ: return "conf-rej";
  4558. case TERM_REQ: return "term-req";
  4559. case TERM_ACK: return "term-ack";
  4560. case CODE_REJ: return "code-rej";
  4561. case PROTO_REJ: return "proto-rej";
  4562. case ECHO_REQ: return "echo-req";
  4563. case ECHO_REPLY: return "echo-reply";
  4564. case DISC_REQ: return "discard-req";
  4565. }
  4566. snprintf (buf, sizeof buf, "0x%x", type);
  4567. return buf;
  4568. }
  4569. const char *
  4570. sppp_auth_type_name(u_short proto, u_char type)
  4571. {
  4572. static char buf[12];
  4573. switch (proto) {
  4574. case PPP_CHAP:
  4575. switch (type) {
  4576. case CHAP_CHALLENGE: return "challenge";
  4577. case CHAP_RESPONSE: return "response";
  4578. case CHAP_SUCCESS: return "success";
  4579. case CHAP_FAILURE: return "failure";
  4580. }
  4581. case PPP_PAP:
  4582. switch (type) {
  4583. case PAP_REQ: return "req";
  4584. case PAP_ACK: return "ack";
  4585. case PAP_NAK: return "nak";
  4586. }
  4587. }
  4588. snprintf (buf, sizeof buf, "0x%x", type);
  4589. return buf;
  4590. }
  4591. const char *
  4592. sppp_lcp_opt_name(u_char opt)
  4593. {
  4594. static char buf[12];
  4595. switch (opt) {
  4596. case LCP_OPT_MRU: return "mru";
  4597. case LCP_OPT_ASYNC_MAP: return "async-map";
  4598. case LCP_OPT_AUTH_PROTO: return "auth-proto";
  4599. case LCP_OPT_QUAL_PROTO: return "qual-proto";
  4600. case LCP_OPT_MAGIC: return "magic";
  4601. case LCP_OPT_PROTO_COMP: return "proto-comp";
  4602. case LCP_OPT_ADDR_COMP: return "addr-comp";
  4603. }
  4604. snprintf (buf, sizeof buf, "0x%x", opt);
  4605. return buf;
  4606. }
  4607. const char *
  4608. sppp_ipcp_opt_name(u_char opt)
  4609. {
  4610. static char buf[12];
  4611. switch (opt) {
  4612. case IPCP_OPT_ADDRESSES: return "addresses";
  4613. case IPCP_OPT_COMPRESSION: return "compression";
  4614. case IPCP_OPT_ADDRESS: return "address";
  4615. }
  4616. snprintf (buf, sizeof buf, "0x%x", opt);
  4617. return buf;
  4618. }
  4619. #ifdef INET6
  4620. const char *
  4621. sppp_ipv6cp_opt_name(u_char opt)
  4622. {
  4623. static char buf[12];
  4624. switch (opt) {
  4625. case IPV6CP_OPT_IFID: return "ifid";
  4626. case IPV6CP_OPT_COMPRESSION: return "compression";
  4627. }
  4628. snprintf (buf, sizeof buf, "0x%x", opt);
  4629. return buf;
  4630. }
  4631. #endif
  4632. const char *
  4633. sppp_state_name(int state)
  4634. {
  4635. switch (state) {
  4636. case STATE_INITIAL: return "initial";
  4637. case STATE_STARTING: return "starting";
  4638. case STATE_CLOSED: return "closed";
  4639. case STATE_STOPPED: return "stopped";
  4640. case STATE_CLOSING: return "closing";
  4641. case STATE_STOPPING: return "stopping";
  4642. case STATE_REQ_SENT: return "req-sent";
  4643. case STATE_ACK_RCVD: return "ack-rcvd";
  4644. case STATE_ACK_SENT: return "ack-sent";
  4645. case STATE_OPENED: return "opened";
  4646. }
  4647. return "illegal";
  4648. }
  4649. const char *
  4650. sppp_phase_name(enum ppp_phase phase)
  4651. {
  4652. switch (phase) {
  4653. case PHASE_DEAD: return "dead";
  4654. case PHASE_ESTABLISH: return "establish";
  4655. case PHASE_TERMINATE: return "terminate";
  4656. case PHASE_AUTHENTICATE: return "authenticate";
  4657. case PHASE_NETWORK: return "network";
  4658. }
  4659. return "illegal";
  4660. }
  4661. const char *
  4662. sppp_proto_name(u_short proto)
  4663. {
  4664. static char buf[12];
  4665. switch (proto) {
  4666. case PPP_LCP: return "lcp";
  4667. case PPP_IPCP: return "ipcp";
  4668. case PPP_IPV6CP: return "ipv6cp";
  4669. case PPP_PAP: return "pap";
  4670. case PPP_CHAP: return "chap";
  4671. }
  4672. snprintf(buf, sizeof buf, "0x%x", (unsigned)proto);
  4673. return buf;
  4674. }
  4675. void
  4676. sppp_print_bytes(const u_char *p, u_short len)
  4677. {
  4678. addlog(" %02x", *p++);
  4679. while (--len > 0)
  4680. addlog("-%02x", *p++);
  4681. }
  4682. void
  4683. sppp_print_string(const char *p, u_short len)
  4684. {
  4685. u_char c;
  4686. while (len-- > 0) {
  4687. c = *p++;
  4688. /*
  4689. * Print only ASCII chars directly. RFC 1994 recommends
  4690. * using only them, but we don't rely on it. */
  4691. if (c < ' ' || c > '~')
  4692. addlog("\\x%x", c);
  4693. else
  4694. addlog("%c", c);
  4695. }
  4696. }
  4697. const char *
  4698. sppp_dotted_quad(u_int32_t addr)
  4699. {
  4700. static char s[16];
  4701. snprintf(s, sizeof s, "%d.%d.%d.%d",
  4702. (int)((addr >> 24) & 0xff),
  4703. (int)((addr >> 16) & 0xff),
  4704. (int)((addr >> 8) & 0xff),
  4705. (int)(addr & 0xff));
  4706. return s;
  4707. }
  4708. /* a dummy, used to drop uninteresting events */
  4709. void
  4710. sppp_null(struct sppp *unused)
  4711. {
  4712. /* do just nothing */
  4713. }
  4714. void
  4715. sppp_set_phase(struct sppp *sp)
  4716. {
  4717. STDDCL;
  4718. int lstate, s;
  4719. if (debug)
  4720. log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
  4721. sppp_phase_name(sp->pp_phase));
  4722. /* set link state */
  4723. if (sp->pp_phase == PHASE_NETWORK)
  4724. lstate = LINK_STATE_UP;
  4725. else
  4726. lstate = LINK_STATE_DOWN;
  4727. if (ifp->if_link_state != lstate) {
  4728. ifp->if_link_state = lstate;
  4729. s = splsoftnet();
  4730. if_link_state_change(ifp);
  4731. splx(s);
  4732. }
  4733. }