if_spppsubr.c revision 88709 
1/*
2 * Synchronous PPP/Cisco link level subroutines.
3 * Keepalive protocol implemented in both Cisco and PPP modes.
4 *
5 * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
6 * Author: Serge Vakulenko, <vak@cronyx.ru>
7 *
8 * Heavily revamped to conform to RFC 1661.
9 * Copyright (C) 1997, 2001 Joerg Wunsch.
10 *
11 * This software is distributed with NO WARRANTIES, not even the implied
12 * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13 *
14 * Authors grant any other persons or organisations permission to use
15 * or modify this software as long as this message is kept with the software,
16 * all derivative works or modified versions.
17 *
18 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
19 *
20 * $FreeBSD: head/sys/net/if_spppsubr.c 88709 2001-12-30 18:07:26Z joerg $
21 */
22
23#include <sys/param.h>
24
25#if defined(__FreeBSD__) && __FreeBSD__ >= 3
26#include "opt_inet.h"
27#include "opt_inet6.h"
28#include "opt_ipx.h"
29#endif
30
31#ifdef NetBSD1_3
32#  if NetBSD1_3 > 6
33#      include "opt_inet.h"
34#      include "opt_inet6.h"
35#      include "opt_iso.h"
36#  endif
37#endif
38
39#include <sys/systm.h>
40#include <sys/kernel.h>
41#include <sys/module.h>
42#include <sys/sockio.h>
43#include <sys/socket.h>
44#include <sys/syslog.h>
45#if defined(__FreeBSD__) && __FreeBSD__ >= 3
46#include <sys/random.h>
47#endif
48#include <sys/malloc.h>
49#include <sys/mbuf.h>
50
51#if defined (__OpenBSD__)
52#include <sys/md5k.h>
53#else
54#include <sys/md5.h>
55#endif
56
57#include <net/if.h>
58#include <net/netisr.h>
59#include <net/if_types.h>
60#include <net/route.h>
61#include <netinet/in.h>
62#include <netinet/in_systm.h>
63#include <netinet/ip.h>
64#include <net/slcompress.h>
65
66#if defined (__NetBSD__) || defined (__OpenBSD__)
67#include <machine/cpu.h> /* XXX for softnet */
68#endif
69
70#include <machine/stdarg.h>
71
72#include <netinet/in.h>
73#include <netinet/in_systm.h>
74#include <netinet/in_var.h>
75
76#ifdef INET
77#include <netinet/ip.h>
78#include <netinet/tcp.h>
79#endif
80
81#if defined (__FreeBSD__) || defined (__OpenBSD__)
82# include <netinet/if_ether.h>
83#else
84# include <net/ethertypes.h>
85#endif
86
87#ifdef IPX
88#include <netipx/ipx.h>
89#include <netipx/ipx_if.h>
90#endif
91
92#ifdef NS
93#include <netns/ns.h>
94#include <netns/ns_if.h>
95#endif
96
97#include <net/if_sppp.h>
98
99#if defined(__FreeBSD__) && __FreeBSD__ >= 3
100# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg, handle)
101# define TIMEOUT(fun, arg1, arg2, handle) handle = timeout(fun, arg1, arg2)
102# define IOCTL_CMD_T	u_long
103#else
104# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg)
105# define TIMEOUT(fun, arg1, arg2, handle) timeout(fun, arg1, arg2)
106# define IOCTL_CMD_T	int
107#endif
108
109#define MAXALIVECNT     3               /* max. alive packets */
110
111/*
112 * Interface flags that can be set in an ifconfig command.
113 *
114 * Setting link0 will make the link passive, i.e. it will be marked
115 * as being administrative openable, but won't be opened to begin
116 * with.  Incoming calls will be answered, or subsequent calls with
117 * -link1 will cause the administrative open of the LCP layer.
118 *
119 * Setting link1 will cause the link to auto-dial only as packets
120 * arrive to be sent.
121 *
122 * Setting IFF_DEBUG will syslog the option negotiation and state
123 * transitions at level kern.debug.  Note: all logs consistently look
124 * like
125 *
126 *   <if-name><unit>: <proto-name> <additional info...>
127 *
128 * with <if-name><unit> being something like "bppp0", and <proto-name>
129 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
130 */
131
132#define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
133#define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
134#define IFF_CISCO	IFF_LINK2	/* auto-dial on output */
135
136#define PPP_ALLSTATIONS 0xff		/* All-Stations broadcast address */
137#define PPP_UI		0x03		/* Unnumbered Information */
138#define PPP_IP		0x0021		/* Internet Protocol */
139#define PPP_ISO		0x0023		/* ISO OSI Protocol */
140#define PPP_XNS		0x0025		/* Xerox NS Protocol */
141#define PPP_IPX		0x002b		/* Novell IPX Protocol */
142#define PPP_VJ_COMP	0x002d		/* VJ compressed TCP/IP */
143#define PPP_VJ_UCOMP	0x002f		/* VJ uncompressed TCP/IP */
144#define PPP_IPV6	0x0057		/* Internet Protocol Version 6 */
145#define PPP_LCP		0xc021		/* Link Control Protocol */
146#define PPP_PAP		0xc023		/* Password Authentication Protocol */
147#define PPP_CHAP	0xc223		/* Challenge-Handshake Auth Protocol */
148#define PPP_IPCP	0x8021		/* Internet Protocol Control Protocol */
149#define PPP_IPV6CP	0x8057		/* IPv6 Control Protocol */
150
151#define CONF_REQ	1		/* PPP configure request */
152#define CONF_ACK	2		/* PPP configure acknowledge */
153#define CONF_NAK	3		/* PPP configure negative ack */
154#define CONF_REJ	4		/* PPP configure reject */
155#define TERM_REQ	5		/* PPP terminate request */
156#define TERM_ACK	6		/* PPP terminate acknowledge */
157#define CODE_REJ	7		/* PPP code reject */
158#define PROTO_REJ	8		/* PPP protocol reject */
159#define ECHO_REQ	9		/* PPP echo request */
160#define ECHO_REPLY	10		/* PPP echo reply */
161#define DISC_REQ	11		/* PPP discard request */
162
163#define LCP_OPT_MRU		1	/* maximum receive unit */
164#define LCP_OPT_ASYNC_MAP	2	/* async control character map */
165#define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
166#define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
167#define LCP_OPT_MAGIC		5	/* magic number */
168#define LCP_OPT_RESERVED	6	/* reserved */
169#define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
170#define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
171
172#define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
173#define IPCP_OPT_COMPRESSION	2	/* IP compression protocol (VJ) */
174#define IPCP_OPT_ADDRESS	3	/* local IP address */
175
176#define IPV6CP_OPT_IFID	1	/* interface identifier */
177#define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
178
179#define IPCP_COMP_VJ		0x2d	/* Code for VJ compression */
180
181#define PAP_REQ			1	/* PAP name/password request */
182#define PAP_ACK			2	/* PAP acknowledge */
183#define PAP_NAK			3	/* PAP fail */
184
185#define CHAP_CHALLENGE		1	/* CHAP challenge request */
186#define CHAP_RESPONSE		2	/* CHAP challenge response */
187#define CHAP_SUCCESS		3	/* CHAP response ok */
188#define CHAP_FAILURE		4	/* CHAP response failed */
189
190#define CHAP_MD5		5	/* hash algorithm - MD5 */
191
192#define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
193#define CISCO_UNICAST		0x0f	/* Cisco unicast address */
194#define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
195#define CISCO_ADDR_REQ		0	/* Cisco address request */
196#define CISCO_ADDR_REPLY	1	/* Cisco address reply */
197#define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
198
199/* states are named and numbered according to RFC 1661 */
200#define STATE_INITIAL	0
201#define STATE_STARTING	1
202#define STATE_CLOSED	2
203#define STATE_STOPPED	3
204#define STATE_CLOSING	4
205#define STATE_STOPPING	5
206#define STATE_REQ_SENT	6
207#define STATE_ACK_RCVD	7
208#define STATE_ACK_SENT	8
209#define STATE_OPENED	9
210
211struct ppp_header {
212	u_char address;
213	u_char control;
214	u_short protocol;
215} __attribute__((__packed__));
216#define PPP_HEADER_LEN          sizeof (struct ppp_header)
217
218struct lcp_header {
219	u_char type;
220	u_char ident;
221	u_short len;
222} __attribute__((__packed__));
223#define LCP_HEADER_LEN          sizeof (struct lcp_header)
224
225struct cisco_packet {
226	u_long type;
227	u_long par1;
228	u_long par2;
229	u_short rel;
230	u_short time0;
231	u_short time1;
232} __attribute__((__packed__));
233#define CISCO_PACKET_LEN	sizeof (struct cisco_packet)
234
235/*
236 * We follow the spelling and capitalization of RFC 1661 here, to make
237 * it easier comparing with the standard.  Please refer to this RFC in
238 * case you can't make sense out of these abbreviation; it will also
239 * explain the semantics related to the various events and actions.
240 */
241struct cp {
242	u_short	proto;		/* PPP control protocol number */
243	u_char protoidx;	/* index into state table in struct sppp */
244	u_char flags;
245#define CP_LCP		0x01	/* this is the LCP */
246#define CP_AUTH		0x02	/* this is an authentication protocol */
247#define CP_NCP		0x04	/* this is a NCP */
248#define CP_QUAL		0x08	/* this is a quality reporting protocol */
249	const char *name;	/* name of this control protocol */
250	/* event handlers */
251	void	(*Up)(struct sppp *sp);
252	void	(*Down)(struct sppp *sp);
253	void	(*Open)(struct sppp *sp);
254	void	(*Close)(struct sppp *sp);
255	void	(*TO)(void *sp);
256	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
257	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
258	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
259	/* actions */
260	void	(*tlu)(struct sppp *sp);
261	void	(*tld)(struct sppp *sp);
262	void	(*tls)(struct sppp *sp);
263	void	(*tlf)(struct sppp *sp);
264	void	(*scr)(struct sppp *sp);
265};
266
267static struct sppp *spppq;
268#if defined(__FreeBSD__) && __FreeBSD__ >= 3
269static struct callout_handle keepalive_ch;
270#endif
271
272#if defined(__FreeBSD__) && __FreeBSD__ >= 3
273#define	SPP_FMT		"%s%d: "
274#define	SPP_ARGS(ifp)	(ifp)->if_name, (ifp)->if_unit
275#else
276#define	SPP_FMT		"%s: "
277#define	SPP_ARGS(ifp)	(ifp)->if_xname
278#endif
279
280#ifdef INET
281/*
282 * The following disgusting hack gets around the problem that IP TOS
283 * can't be set yet.  We want to put "interactive" traffic on a high
284 * priority queue.  To decide if traffic is interactive, we check that
285 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
286 *
287 * XXX is this really still necessary?  - joerg -
288 */
289static u_short interactive_ports[8] = {
290	0,	513,	0,	0,
291	0,	21,	0,	23,
292};
293#define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
294#endif
295
296/* almost every function needs these */
297#define STDDCL							\
298	struct ifnet *ifp = &sp->pp_if;				\
299	int debug = ifp->if_flags & IFF_DEBUG
300
301static int sppp_output(struct ifnet *ifp, struct mbuf *m,
302		       struct sockaddr *dst, struct rtentry *rt);
303
304static void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2);
305static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
306
307static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
308			  struct mbuf *m);
309static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
310			 u_char ident, u_short len, void *data);
311/* static void sppp_cp_timeout(void *arg); */
312static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
313				 int newstate);
314static void sppp_auth_send(const struct cp *cp,
315			   struct sppp *sp, unsigned int type, unsigned int id,
316			   ...);
317
318static void sppp_up_event(const struct cp *cp, struct sppp *sp);
319static void sppp_down_event(const struct cp *cp, struct sppp *sp);
320static void sppp_open_event(const struct cp *cp, struct sppp *sp);
321static void sppp_close_event(const struct cp *cp, struct sppp *sp);
322static void sppp_to_event(const struct cp *cp, struct sppp *sp);
323
324static void sppp_null(struct sppp *sp);
325
326static void sppp_lcp_init(struct sppp *sp);
327static void sppp_lcp_up(struct sppp *sp);
328static void sppp_lcp_down(struct sppp *sp);
329static void sppp_lcp_open(struct sppp *sp);
330static void sppp_lcp_close(struct sppp *sp);
331static void sppp_lcp_TO(void *sp);
332static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
333static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
334static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
335static void sppp_lcp_tlu(struct sppp *sp);
336static void sppp_lcp_tld(struct sppp *sp);
337static void sppp_lcp_tls(struct sppp *sp);
338static void sppp_lcp_tlf(struct sppp *sp);
339static void sppp_lcp_scr(struct sppp *sp);
340static void sppp_lcp_check_and_close(struct sppp *sp);
341static int sppp_ncp_check(struct sppp *sp);
342
343static void sppp_ipcp_init(struct sppp *sp);
344static void sppp_ipcp_up(struct sppp *sp);
345static void sppp_ipcp_down(struct sppp *sp);
346static void sppp_ipcp_open(struct sppp *sp);
347static void sppp_ipcp_close(struct sppp *sp);
348static void sppp_ipcp_TO(void *sp);
349static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
350static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
351static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
352static void sppp_ipcp_tlu(struct sppp *sp);
353static void sppp_ipcp_tld(struct sppp *sp);
354static void sppp_ipcp_tls(struct sppp *sp);
355static void sppp_ipcp_tlf(struct sppp *sp);
356static void sppp_ipcp_scr(struct sppp *sp);
357
358static void sppp_ipv6cp_init(struct sppp *sp);
359static void sppp_ipv6cp_up(struct sppp *sp);
360static void sppp_ipv6cp_down(struct sppp *sp);
361static void sppp_ipv6cp_open(struct sppp *sp);
362static void sppp_ipv6cp_close(struct sppp *sp);
363static void sppp_ipv6cp_TO(void *sp);
364static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
365static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
366static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
367static void sppp_ipv6cp_tlu(struct sppp *sp);
368static void sppp_ipv6cp_tld(struct sppp *sp);
369static void sppp_ipv6cp_tls(struct sppp *sp);
370static void sppp_ipv6cp_tlf(struct sppp *sp);
371static void sppp_ipv6cp_scr(struct sppp *sp);
372
373static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
374static void sppp_pap_init(struct sppp *sp);
375static void sppp_pap_open(struct sppp *sp);
376static void sppp_pap_close(struct sppp *sp);
377static void sppp_pap_TO(void *sp);
378static void sppp_pap_my_TO(void *sp);
379static void sppp_pap_tlu(struct sppp *sp);
380static void sppp_pap_tld(struct sppp *sp);
381static void sppp_pap_scr(struct sppp *sp);
382
383static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
384static void sppp_chap_init(struct sppp *sp);
385static void sppp_chap_open(struct sppp *sp);
386static void sppp_chap_close(struct sppp *sp);
387static void sppp_chap_TO(void *sp);
388static void sppp_chap_tlu(struct sppp *sp);
389static void sppp_chap_tld(struct sppp *sp);
390static void sppp_chap_scr(struct sppp *sp);
391
392static const char *sppp_auth_type_name(u_short proto, u_char type);
393static const char *sppp_cp_type_name(u_char type);
394static const char *sppp_dotted_quad(u_long addr);
395static const char *sppp_ipcp_opt_name(u_char opt);
396#ifdef INET6
397static const char *sppp_ipv6cp_opt_name(u_char opt);
398#endif
399static const char *sppp_lcp_opt_name(u_char opt);
400static const char *sppp_phase_name(enum ppp_phase phase);
401static const char *sppp_proto_name(u_short proto);
402static const char *sppp_state_name(int state);
403static int sppp_params(struct sppp *sp, u_long cmd, void *data);
404static int sppp_strnlen(u_char *p, int max);
405static void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst,
406			      u_long *srcmask);
407static void sppp_keepalive(void *dummy);
408static void sppp_phase_network(struct sppp *sp);
409static void sppp_print_bytes(const u_char *p, u_short len);
410static void sppp_print_string(const char *p, u_short len);
411static void sppp_qflush(struct ifqueue *ifq);
412static void sppp_set_ip_addr(struct sppp *sp, u_long src);
413#ifdef INET6
414static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
415			       struct in6_addr *dst, struct in6_addr *srcmask);
416#ifdef IPV6CP_MYIFID_DYN
417static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
418static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
419#endif
420static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
421#endif
422
423/* our control protocol descriptors */
424static const struct cp lcp = {
425	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
426	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
427	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
428	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
429	sppp_lcp_scr
430};
431
432static const struct cp ipcp = {
433	PPP_IPCP, IDX_IPCP,
434#ifdef INET	/* don't run IPCP if there's no IPv4 support */
435	CP_NCP,
436#else
437	0,
438#endif
439	"ipcp",
440	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
441	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
442	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
443	sppp_ipcp_scr
444};
445
446static const struct cp ipv6cp = {
447	PPP_IPV6CP, IDX_IPV6CP,
448#ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
449	CP_NCP,
450#else
451	0,
452#endif
453	"ipv6cp",
454	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
455	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
456	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
457	sppp_ipv6cp_scr
458};
459
460static const struct cp pap = {
461	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
462	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
463	sppp_pap_TO, 0, 0, 0,
464	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
465	sppp_pap_scr
466};
467
468static const struct cp chap = {
469	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
470	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
471	sppp_chap_TO, 0, 0, 0,
472	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
473	sppp_chap_scr
474};
475
476static const struct cp *cps[IDX_COUNT] = {
477	&lcp,			/* IDX_LCP */
478	&ipcp,			/* IDX_IPCP */
479	&ipv6cp,		/* IDX_IPV6CP */
480	&pap,			/* IDX_PAP */
481	&chap,			/* IDX_CHAP */
482};
483
484static int
485sppp_modevent(module_t mod, int type, void *unused)
486{
487	switch (type) {
488	case MOD_LOAD:
489		break;
490	case MOD_UNLOAD:
491		return EACCES;
492		break;
493	default:
494		break;
495	}
496	return 0;
497}
498static moduledata_t spppmod = {
499	"sppp",
500	sppp_modevent,
501	0
502};
503MODULE_VERSION(sppp, 1);
504DECLARE_MODULE(sppp, spppmod, SI_SUB_DRIVERS, SI_ORDER_ANY);
505
506/*
507 * Exported functions, comprising our interface to the lower layer.
508 */
509
510/*
511 * Process the received packet.
512 */
513void
514sppp_input(struct ifnet *ifp, struct mbuf *m)
515{
516	struct ppp_header *h;
517	struct ifqueue *inq = 0;
518	struct sppp *sp = (struct sppp *)ifp;
519	u_char *iphdr;
520	int hlen, vjlen, do_account = 0;
521	int debug = ifp->if_flags & IFF_DEBUG;
522
523	if (ifp->if_flags & IFF_UP)
524		/* Count received bytes, add FCS and one flag */
525		ifp->if_ibytes += m->m_pkthdr.len + 3;
526
527	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
528		/* Too small packet, drop it. */
529		if (debug)
530			log(LOG_DEBUG,
531			    SPP_FMT "input packet is too small, %d bytes\n",
532			    SPP_ARGS(ifp), m->m_pkthdr.len);
533	  drop:
534		m_freem (m);
535	  drop2:
536		++ifp->if_ierrors;
537		++ifp->if_iqdrops;
538		return;
539	}
540
541	/* Get PPP header. */
542	h = mtod (m, struct ppp_header*);
543	m_adj (m, PPP_HEADER_LEN);
544
545	switch (h->address) {
546	case PPP_ALLSTATIONS:
547		if (h->control != PPP_UI)
548			goto invalid;
549		if (sp->pp_mode == IFF_CISCO) {
550			if (debug)
551				log(LOG_DEBUG,
552				    SPP_FMT "PPP packet in Cisco mode "
553				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
554				    SPP_ARGS(ifp),
555				    h->address, h->control, ntohs(h->protocol));
556			goto drop;
557		}
558		switch (ntohs (h->protocol)) {
559		default:
560			if (debug)
561				log(LOG_DEBUG,
562				    SPP_FMT "rejecting protocol "
563				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
564				    SPP_ARGS(ifp),
565				    h->address, h->control, ntohs(h->protocol));
566			if (sp->state[IDX_LCP] == STATE_OPENED)
567				sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
568					++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
569					&h->protocol);
570			++ifp->if_noproto;
571			goto drop;
572		case PPP_LCP:
573			sppp_cp_input(&lcp, sp, m);
574			m_freem (m);
575			return;
576		case PPP_PAP:
577			if (sp->pp_phase >= PHASE_AUTHENTICATE)
578				sppp_pap_input(sp, m);
579			m_freem (m);
580			return;
581		case PPP_CHAP:
582			if (sp->pp_phase >= PHASE_AUTHENTICATE)
583				sppp_chap_input(sp, m);
584			m_freem (m);
585			return;
586#ifdef INET
587		case PPP_IPCP:
588			if (sp->pp_phase == PHASE_NETWORK)
589				sppp_cp_input(&ipcp, sp, m);
590			m_freem (m);
591			return;
592		case PPP_IP:
593			if (sp->state[IDX_IPCP] == STATE_OPENED) {
594				schednetisr (NETISR_IP);
595				inq = &ipintrq;
596			}
597			do_account++;
598			break;
599		case PPP_VJ_COMP:
600			if (sp->state[IDX_IPCP] == STATE_OPENED) {
601				if ((vjlen =
602				     sl_uncompress_tcp_core(mtod(m, u_char *),
603							    m->m_len, m->m_len,
604							    TYPE_COMPRESSED_TCP,
605							    sp->pp_comp,
606							    &iphdr, &hlen)) <= 0) {
607					if (debug)
608						log(LOG_INFO,
609			    SPP_FMT "VJ uncompress failed on compressed packet\n",
610						    SPP_ARGS(ifp));
611					goto drop;
612				}
613
614				/*
615				 * Trim the VJ header off the packet, and prepend
616				 * the uncompressed IP header (which will usually
617				 * end up in two chained mbufs since there's not
618				 * enough leading space in the existing mbuf).
619				 */
620				m_adj(m, vjlen);
621				M_PREPEND(m, hlen, M_DONTWAIT);
622				if (m == NULL)
623					goto drop2;
624				bcopy(iphdr, mtod(m, u_char *), hlen);
625
626				schednetisr (NETISR_IP);
627				inq = &ipintrq;
628			}
629			do_account++;
630			break;
631		case PPP_VJ_UCOMP:
632			if (sp->state[IDX_IPCP] == STATE_OPENED) {
633				if (sl_uncompress_tcp_core(mtod(m, u_char *),
634							   m->m_len, m->m_len,
635							   TYPE_UNCOMPRESSED_TCP,
636							   sp->pp_comp,
637							   &iphdr, &hlen) != 0) {
638					if (debug)
639						log(LOG_INFO,
640			    SPP_FMT "VJ uncompress failed on uncompressed packet\n",
641						    SPP_ARGS(ifp));
642					goto drop;
643				}
644				schednetisr (NETISR_IP);
645				inq = &ipintrq;
646			}
647			do_account++;
648			break;
649#endif
650#ifdef INET6
651		case PPP_IPV6CP:
652			if (sp->pp_phase == PHASE_NETWORK)
653			    sppp_cp_input(&ipv6cp, sp, m);
654			m_freem (m);
655			return;
656
657		case PPP_IPV6:
658			if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
659				schednetisr (NETISR_IPV6);
660				inq = &ip6intrq;
661			}
662			do_account++;
663			break;
664#endif
665#ifdef IPX
666		case PPP_IPX:
667			/* IPX IPXCP not implemented yet */
668			if (sp->pp_phase == PHASE_NETWORK) {
669				schednetisr (NETISR_IPX);
670				inq = &ipxintrq;
671			}
672			do_account++;
673			break;
674#endif
675#ifdef NS
676		case PPP_XNS:
677			/* XNS IDPCP not implemented yet */
678			if (sp->pp_phase == PHASE_NETWORK) {
679				schednetisr (NETISR_NS);
680				inq = &nsintrq;
681			}
682			do_account++;
683			break;
684#endif
685		}
686		break;
687	case CISCO_MULTICAST:
688	case CISCO_UNICAST:
689		/* Don't check the control field here (RFC 1547). */
690		if (sp->pp_mode != IFF_CISCO) {
691			if (debug)
692				log(LOG_DEBUG,
693				    SPP_FMT "Cisco packet in PPP mode "
694				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
695				    SPP_ARGS(ifp),
696				    h->address, h->control, ntohs(h->protocol));
697			goto drop;
698		}
699		switch (ntohs (h->protocol)) {
700		default:
701			++ifp->if_noproto;
702			goto invalid;
703		case CISCO_KEEPALIVE:
704			sppp_cisco_input ((struct sppp*) ifp, m);
705			m_freem (m);
706			return;
707#ifdef INET
708		case ETHERTYPE_IP:
709			schednetisr (NETISR_IP);
710			inq = &ipintrq;
711			do_account++;
712			break;
713#endif
714#ifdef INET6
715		case ETHERTYPE_IPV6:
716			schednetisr (NETISR_IPV6);
717			inq = &ip6intrq;
718			do_account++;
719			break;
720#endif
721#ifdef IPX
722		case ETHERTYPE_IPX:
723			schednetisr (NETISR_IPX);
724			inq = &ipxintrq;
725			do_account++;
726			break;
727#endif
728#ifdef NS
729		case ETHERTYPE_NS:
730			schednetisr (NETISR_NS);
731			inq = &nsintrq;
732			do_account++;
733			break;
734#endif
735		}
736		break;
737	default:        /* Invalid PPP packet. */
738	  invalid:
739		if (debug)
740			log(LOG_DEBUG,
741			    SPP_FMT "invalid input packet "
742			    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
743			    SPP_ARGS(ifp),
744			    h->address, h->control, ntohs(h->protocol));
745		goto drop;
746	}
747
748	if (! (ifp->if_flags & IFF_UP) || ! inq)
749		goto drop;
750
751	/* Check queue. */
752	if (! IF_HANDOFF(inq, m, NULL)) {
753		if (debug)
754			log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
755				SPP_ARGS(ifp));
756		goto drop;
757	}
758	if (do_account)
759		/*
760		 * Do only account for network packets, not for control
761		 * packets.  This is used by some subsystems to detect
762		 * idle lines.
763		 */
764		sp->pp_last_recv = time_second;
765}
766
767/*
768 * Enqueue transmit packet.
769 */
770static int
771sppp_output(struct ifnet *ifp, struct mbuf *m,
772	    struct sockaddr *dst, struct rtentry *rt)
773{
774	struct sppp *sp = (struct sppp*) ifp;
775	struct ppp_header *h;
776	struct ifqueue *ifq = NULL;
777	int s, rv = 0;
778	int ipproto = PPP_IP;
779	int debug = ifp->if_flags & IFF_DEBUG;
780
781	s = splimp();
782
783	if ((ifp->if_flags & IFF_UP) == 0 ||
784	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
785		m_freem (m);
786		splx (s);
787		return (ENETDOWN);
788	}
789
790	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
791		/*
792		 * Interface is not yet running, but auto-dial.  Need
793		 * to start LCP for it.
794		 */
795		ifp->if_flags |= IFF_RUNNING;
796		splx(s);
797		lcp.Open(sp);
798		s = splimp();
799	}
800
801	ifq = &ifp->if_snd;
802#ifdef INET
803	if (dst->sa_family == AF_INET) {
804		/* XXX Check mbuf length here? */
805		struct ip *ip = mtod (m, struct ip*);
806		struct tcphdr *tcp = (struct tcphdr*) ((long*)ip + ip->ip_hl);
807
808		/*
809		 * When using dynamic local IP address assignment by using
810		 * 0.0.0.0 as a local address, the first TCP session will
811		 * not connect because the local TCP checksum is computed
812		 * using 0.0.0.0 which will later become our real IP address
813		 * so the TCP checksum computed at the remote end will
814		 * become invalid. So we
815		 * - don't let packets with src ip addr 0 thru
816		 * - we flag TCP packets with src ip 0 as an error
817		 */
818
819		if(ip->ip_src.s_addr == INADDR_ANY)	/* -hm */
820		{
821			m_freem(m);
822			splx(s);
823			if(ip->ip_p == IPPROTO_TCP)
824				return(EADDRNOTAVAIL);
825			else
826				return(0);
827		}
828
829		/*
830		 * Put low delay, telnet, rlogin and ftp control packets
831		 * in front of the queue.
832		 */
833		if (_IF_QFULL(&sp->pp_fastq))
834			;
835		else if (ip->ip_tos & IPTOS_LOWDELAY)
836			ifq = &sp->pp_fastq;
837		else if (m->m_len < sizeof *ip + sizeof *tcp)
838			;
839		else if (ip->ip_p != IPPROTO_TCP)
840			;
841		else if (INTERACTIVE (ntohs (tcp->th_sport)))
842			ifq = &sp->pp_fastq;
843		else if (INTERACTIVE (ntohs (tcp->th_dport)))
844			ifq = &sp->pp_fastq;
845
846		/*
847		 * Do IP Header compression
848		 */
849		if (sp->pp_mode != IFF_CISCO && (sp->ipcp.flags & IPCP_VJ) &&
850		    ip->ip_p == IPPROTO_TCP)
851			switch (sl_compress_tcp(m, ip, sp->pp_comp,
852						sp->ipcp.compress_cid)) {
853			case TYPE_COMPRESSED_TCP:
854				ipproto = PPP_VJ_COMP;
855				break;
856			case TYPE_UNCOMPRESSED_TCP:
857				ipproto = PPP_VJ_UCOMP;
858				break;
859			case TYPE_IP:
860				ipproto = PPP_IP;
861				break;
862			default:
863				m_freem(m);
864				splx(s);
865				return (EINVAL);
866			}
867	}
868#endif
869
870#ifdef INET6
871	if (dst->sa_family == AF_INET6) {
872		/* XXX do something tricky here? */
873	}
874#endif
875
876	/*
877	 * Prepend general data packet PPP header. For now, IP only.
878	 */
879	M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
880	if (! m) {
881		if (debug)
882			log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
883				SPP_ARGS(ifp));
884		++ifp->if_oerrors;
885		splx (s);
886		return (ENOBUFS);
887	}
888	/*
889	 * May want to check size of packet
890	 * (albeit due to the implementation it's always enough)
891	 */
892	h = mtod (m, struct ppp_header*);
893	if (sp->pp_mode == IFF_CISCO) {
894		h->address = CISCO_UNICAST;        /* unicast address */
895		h->control = 0;
896	} else {
897		h->address = PPP_ALLSTATIONS;        /* broadcast address */
898		h->control = PPP_UI;                 /* Unnumbered Info */
899	}
900
901	switch (dst->sa_family) {
902#ifdef INET
903	case AF_INET:   /* Internet Protocol */
904		if (sp->pp_mode == IFF_CISCO)
905			h->protocol = htons (ETHERTYPE_IP);
906		else {
907			/*
908			 * Don't choke with an ENETDOWN early.  It's
909			 * possible that we just started dialing out,
910			 * so don't drop the packet immediately.  If
911			 * we notice that we run out of buffer space
912			 * below, we will however remember that we are
913			 * not ready to carry IP packets, and return
914			 * ENETDOWN, as opposed to ENOBUFS.
915			 */
916			h->protocol = htons(ipproto);
917			if (sp->state[IDX_IPCP] != STATE_OPENED)
918				rv = ENETDOWN;
919		}
920		break;
921#endif
922#ifdef INET6
923	case AF_INET6:   /* Internet Protocol */
924		if (sp->pp_mode == IFF_CISCO)
925			h->protocol = htons (ETHERTYPE_IPV6);
926		else {
927			/*
928			 * Don't choke with an ENETDOWN early.  It's
929			 * possible that we just started dialing out,
930			 * so don't drop the packet immediately.  If
931			 * we notice that we run out of buffer space
932			 * below, we will however remember that we are
933			 * not ready to carry IP packets, and return
934			 * ENETDOWN, as opposed to ENOBUFS.
935			 */
936			h->protocol = htons(PPP_IPV6);
937			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
938				rv = ENETDOWN;
939		}
940		break;
941#endif
942#ifdef NS
943	case AF_NS:     /* Xerox NS Protocol */
944		h->protocol = htons (sp->pp_mode == IFF_CISCO ?
945			ETHERTYPE_NS : PPP_XNS);
946		break;
947#endif
948#ifdef IPX
949	case AF_IPX:     /* Novell IPX Protocol */
950		h->protocol = htons (sp->pp_mode == IFF_CISCO ?
951			ETHERTYPE_IPX : PPP_IPX);
952		break;
953#endif
954	default:
955		m_freem (m);
956		++ifp->if_oerrors;
957		splx (s);
958		return (EAFNOSUPPORT);
959	}
960
961	/*
962	 * Queue message on interface, and start output if interface
963	 * not yet active.
964	 */
965	if (! IF_HANDOFF_ADJ(ifq, m, ifp, 3)) {
966		++ifp->if_oerrors;
967		return (rv? rv: ENOBUFS);
968	}
969	/*
970	 * Unlike in sppp_input(), we can always bump the timestamp
971	 * here since sppp_output() is only called on behalf of
972	 * network-layer traffic; control-layer traffic is handled
973	 * by sppp_cp_send().
974	 */
975	sp->pp_last_sent = time_second;
976	return (0);
977}
978
979void
980sppp_attach(struct ifnet *ifp)
981{
982	struct sppp *sp = (struct sppp*) ifp;
983
984	/* Initialize keepalive handler. */
985	if (! spppq)
986		TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch);
987
988	/* Insert new entry into the keepalive list. */
989	sp->pp_next = spppq;
990	spppq = sp;
991
992	sp->pp_if.if_mtu = PP_MTU;
993	sp->pp_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
994	sp->pp_if.if_type = IFT_PPP;
995	sp->pp_if.if_output = sppp_output;
996#if 0
997	sp->pp_flags = PP_KEEPALIVE;
998#endif
999 	sp->pp_if.if_snd.ifq_maxlen = 32;
1000 	sp->pp_fastq.ifq_maxlen = 32;
1001 	sp->pp_cpq.ifq_maxlen = 20;
1002	sp->pp_loopcnt = 0;
1003	sp->pp_alivecnt = 0;
1004	bzero(&sp->pp_seq[0], sizeof(sp->pp_seq));
1005	bzero(&sp->pp_rseq[0], sizeof(sp->pp_rseq));
1006	sp->pp_phase = PHASE_DEAD;
1007	sp->pp_up = lcp.Up;
1008	sp->pp_down = lcp.Down;
1009	mtx_init(&sp->pp_cpq.ifq_mtx, "sppp_cpq", MTX_DEF);
1010	mtx_init(&sp->pp_fastq.ifq_mtx, "sppp_fastq", MTX_DEF);
1011	sp->pp_last_recv = sp->pp_last_sent = time_second;
1012	sp->enable_vj = 1;
1013	sp->pp_comp = malloc(sizeof(struct slcompress), M_TEMP, M_WAIT);
1014	sl_compress_init(sp->pp_comp, -1);
1015	sppp_lcp_init(sp);
1016	sppp_ipcp_init(sp);
1017	sppp_ipv6cp_init(sp);
1018	sppp_pap_init(sp);
1019	sppp_chap_init(sp);
1020}
1021
1022void
1023sppp_detach(struct ifnet *ifp)
1024{
1025	struct sppp **q, *p, *sp = (struct sppp*) ifp;
1026	int i;
1027
1028	/* Remove the entry from the keepalive list. */
1029	for (q = &spppq; (p = *q); q = &p->pp_next)
1030		if (p == sp) {
1031			*q = p->pp_next;
1032			break;
1033		}
1034
1035	/* Stop keepalive handler. */
1036	if (! spppq)
1037		UNTIMEOUT(sppp_keepalive, 0, keepalive_ch);
1038
1039	for (i = 0; i < IDX_COUNT; i++)
1040		UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]);
1041	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
1042	mtx_destroy(&sp->pp_cpq.ifq_mtx);
1043	mtx_destroy(&sp->pp_fastq.ifq_mtx);
1044}
1045
1046/*
1047 * Flush the interface output queue.
1048 */
1049void
1050sppp_flush(struct ifnet *ifp)
1051{
1052	struct sppp *sp = (struct sppp*) ifp;
1053
1054	sppp_qflush (&sp->pp_if.if_snd);
1055	sppp_qflush (&sp->pp_fastq);
1056	sppp_qflush (&sp->pp_cpq);
1057}
1058
1059/*
1060 * Check if the output queue is empty.
1061 */
1062int
1063sppp_isempty(struct ifnet *ifp)
1064{
1065	struct sppp *sp = (struct sppp*) ifp;
1066	int empty, s;
1067
1068	s = splimp();
1069	empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head &&
1070		!sp->pp_if.if_snd.ifq_head;
1071	splx(s);
1072	return (empty);
1073}
1074
1075/*
1076 * Get next packet to send.
1077 */
1078struct mbuf *
1079sppp_dequeue(struct ifnet *ifp)
1080{
1081	struct sppp *sp = (struct sppp*) ifp;
1082	struct mbuf *m;
1083	int s;
1084
1085	s = splimp();
1086	/*
1087	 * Process only the control protocol queue until we have at
1088	 * least one NCP open.
1089	 *
1090	 * Do always serve all three queues in Cisco mode.
1091	 */
1092	IF_DEQUEUE(&sp->pp_cpq, m);
1093	if (m == NULL &&
1094	    (sppp_ncp_check(sp) || sp->pp_mode == IFF_CISCO)) {
1095		IF_DEQUEUE(&sp->pp_fastq, m);
1096		if (m == NULL)
1097			IF_DEQUEUE (&sp->pp_if.if_snd, m);
1098	}
1099	splx(s);
1100	return m;
1101}
1102
1103/*
1104 * Pick the next packet, do not remove it from the queue.
1105 */
1106struct mbuf *
1107sppp_pick(struct ifnet *ifp)
1108{
1109	struct sppp *sp = (struct sppp*)ifp;
1110	struct mbuf *m;
1111	int s;
1112
1113	s= splimp ();
1114
1115	m = sp->pp_cpq.ifq_head;
1116	if (m == NULL &&
1117	    (sp->pp_phase == PHASE_NETWORK || sp->pp_mode == IFF_CISCO))
1118		if ((m = sp->pp_fastq.ifq_head) == NULL)
1119			m = sp->pp_if.if_snd.ifq_head;
1120	splx (s);
1121	return (m);
1122}
1123
1124/*
1125 * Process an ioctl request.  Called on low priority level.
1126 */
1127int
1128sppp_ioctl(struct ifnet *ifp, IOCTL_CMD_T cmd, void *data)
1129{
1130	struct ifreq *ifr = (struct ifreq*) data;
1131	struct sppp *sp = (struct sppp*) ifp;
1132	int s, rv, going_up, going_down, newmode;
1133
1134	s = splimp();
1135	rv = 0;
1136	switch (cmd) {
1137	case SIOCAIFADDR:
1138	case SIOCSIFDSTADDR:
1139		break;
1140
1141	case SIOCSIFADDR:
1142		/* set the interface "up" when assigning an IP address */
1143		ifp->if_flags |= IFF_UP;
1144		/* fall through... */
1145
1146	case SIOCSIFFLAGS:
1147		going_up = ifp->if_flags & IFF_UP &&
1148			(ifp->if_flags & IFF_RUNNING) == 0;
1149		going_down = (ifp->if_flags & IFF_UP) == 0 &&
1150			ifp->if_flags & IFF_RUNNING;
1151
1152		newmode = ifp->if_flags & IFF_PASSIVE;
1153		if (!newmode)
1154			newmode = ifp->if_flags & IFF_AUTO;
1155		if (!newmode)
1156			newmode = ifp->if_flags & IFF_CISCO;
1157		ifp->if_flags &= ~(IFF_PASSIVE | IFF_AUTO | IFF_CISCO);
1158		ifp->if_flags |= newmode;
1159
1160		if (newmode != sp->pp_mode) {
1161			going_down = 1;
1162			if (!going_up)
1163				going_up = ifp->if_flags & IFF_RUNNING;
1164		}
1165
1166		if (going_down) {
1167			if (sp->pp_mode != IFF_CISCO)
1168				lcp.Close(sp);
1169			else if (sp->pp_tlf)
1170				(sp->pp_tlf)(sp);
1171			sppp_flush(ifp);
1172			ifp->if_flags &= ~IFF_RUNNING;
1173			sp->pp_mode = newmode;
1174		}
1175
1176		if (going_up) {
1177			if (sp->pp_mode != IFF_CISCO)
1178				lcp.Close(sp);
1179			sp->pp_mode = newmode;
1180			if (sp->pp_mode == 0) {
1181				ifp->if_flags |= IFF_RUNNING;
1182				lcp.Open(sp);
1183			}
1184			if (sp->pp_mode == IFF_CISCO) {
1185				if (sp->pp_tls)
1186					(sp->pp_tls)(sp);
1187				ifp->if_flags |= IFF_RUNNING;
1188			}
1189		}
1190
1191		break;
1192
1193#ifdef SIOCSIFMTU
1194#ifndef ifr_mtu
1195#define ifr_mtu ifr_metric
1196#endif
1197	case SIOCSIFMTU:
1198		if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru)
1199			return (EINVAL);
1200		ifp->if_mtu = ifr->ifr_mtu;
1201		break;
1202#endif
1203#ifdef SLIOCSETMTU
1204	case SLIOCSETMTU:
1205		if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru)
1206			return (EINVAL);
1207		ifp->if_mtu = *(short*)data;
1208		break;
1209#endif
1210#ifdef SIOCGIFMTU
1211	case SIOCGIFMTU:
1212		ifr->ifr_mtu = ifp->if_mtu;
1213		break;
1214#endif
1215#ifdef SLIOCGETMTU
1216	case SLIOCGETMTU:
1217		*(short*)data = ifp->if_mtu;
1218		break;
1219#endif
1220	case SIOCADDMULTI:
1221	case SIOCDELMULTI:
1222		break;
1223
1224	case SIOCGIFGENERIC:
1225	case SIOCSIFGENERIC:
1226		rv = sppp_params(sp, cmd, data);
1227		break;
1228
1229	default:
1230		rv = ENOTTY;
1231	}
1232	splx(s);
1233	return rv;
1234}
1235
1236/*
1237 * Cisco framing implementation.
1238 */
1239
1240/*
1241 * Handle incoming Cisco keepalive protocol packets.
1242 */
1243static void
1244sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1245{
1246	STDDCL;
1247	struct cisco_packet *h;
1248	u_long me, mymask;
1249
1250	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1251		if (debug)
1252			log(LOG_DEBUG,
1253			    SPP_FMT "cisco invalid packet length: %d bytes\n",
1254			    SPP_ARGS(ifp), m->m_pkthdr.len);
1255		return;
1256	}
1257	h = mtod (m, struct cisco_packet*);
1258	if (debug)
1259		log(LOG_DEBUG,
1260		    SPP_FMT "cisco input: %d bytes "
1261		    "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1262		    SPP_ARGS(ifp), m->m_pkthdr.len,
1263		    (u_long)ntohl (h->type), (u_long)h->par1, (u_long)h->par2, (u_int)h->rel,
1264		    (u_int)h->time0, (u_int)h->time1);
1265	switch (ntohl (h->type)) {
1266	default:
1267		if (debug)
1268			log(-1, SPP_FMT "cisco unknown packet type: 0x%lx\n",
1269			       SPP_ARGS(ifp), (u_long)ntohl (h->type));
1270		break;
1271	case CISCO_ADDR_REPLY:
1272		/* Reply on address request, ignore */
1273		break;
1274	case CISCO_KEEPALIVE_REQ:
1275		sp->pp_alivecnt = 0;
1276		sp->pp_rseq[IDX_LCP] = ntohl (h->par1);
1277		if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
1278			/* Local and remote sequence numbers are equal.
1279			 * Probably, the line is in loopback mode. */
1280			if (sp->pp_loopcnt >= MAXALIVECNT) {
1281				printf (SPP_FMT "loopback\n",
1282					SPP_ARGS(ifp));
1283				sp->pp_loopcnt = 0;
1284				if (ifp->if_flags & IFF_UP) {
1285					if_down (ifp);
1286					sppp_qflush (&sp->pp_cpq);
1287				}
1288			}
1289			++sp->pp_loopcnt;
1290
1291			/* Generate new local sequence number */
1292#if defined(__FreeBSD__) && __FreeBSD__ >= 3
1293			sp->pp_seq[IDX_LCP] = random();
1294#else
1295			sp->pp_seq[IDX_LCP] ^= time.tv_sec ^ time.tv_usec;
1296#endif
1297			break;
1298		}
1299		sp->pp_loopcnt = 0;
1300		if (! (ifp->if_flags & IFF_UP) &&
1301		    (ifp->if_flags & IFF_RUNNING)) {
1302			if_up(ifp);
1303			printf (SPP_FMT "up\n", SPP_ARGS(ifp));
1304		}
1305		break;
1306	case CISCO_ADDR_REQ:
1307		sppp_get_ip_addrs(sp, &me, 0, &mymask);
1308		if (me != 0L)
1309			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1310		break;
1311	}
1312}
1313
1314/*
1315 * Send Cisco keepalive packet.
1316 */
1317static void
1318sppp_cisco_send(struct sppp *sp, int type, long par1, long par2)
1319{
1320	STDDCL;
1321	struct ppp_header *h;
1322	struct cisco_packet *ch;
1323	struct mbuf *m;
1324#if defined(__FreeBSD__) && __FreeBSD__ >= 3
1325	struct timeval tv;
1326#else
1327	u_long t = (time.tv_sec - boottime.tv_sec) * 1000;
1328#endif
1329
1330#if defined(__FreeBSD__) && __FreeBSD__ >= 3
1331	getmicrouptime(&tv);
1332#endif
1333
1334	MGETHDR (m, M_DONTWAIT, MT_DATA);
1335	if (! m)
1336		return;
1337	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1338	m->m_pkthdr.rcvif = 0;
1339
1340	h = mtod (m, struct ppp_header*);
1341	h->address = CISCO_MULTICAST;
1342	h->control = 0;
1343	h->protocol = htons (CISCO_KEEPALIVE);
1344
1345	ch = (struct cisco_packet*) (h + 1);
1346	ch->type = htonl (type);
1347	ch->par1 = htonl (par1);
1348	ch->par2 = htonl (par2);
1349	ch->rel = -1;
1350
1351#if defined(__FreeBSD__) && __FreeBSD__ >= 3
1352	ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
1353	ch->time1 = htons ((u_short) tv.tv_sec);
1354#else
1355	ch->time0 = htons ((u_short) (t >> 16));
1356	ch->time1 = htons ((u_short) t);
1357#endif
1358
1359	if (debug)
1360		log(LOG_DEBUG,
1361		    SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1362			SPP_ARGS(ifp), (u_long)ntohl (ch->type), (u_long)ch->par1,
1363			(u_long)ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
1364
1365	if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3))
1366		ifp->if_oerrors++;
1367}
1368
1369/*
1370 * PPP protocol implementation.
1371 */
1372
1373/*
1374 * Send PPP control protocol packet.
1375 */
1376static void
1377sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1378	     u_char ident, u_short len, void *data)
1379{
1380	STDDCL;
1381	struct ppp_header *h;
1382	struct lcp_header *lh;
1383	struct mbuf *m;
1384
1385	if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN)
1386		len = MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN;
1387	MGETHDR (m, M_DONTWAIT, MT_DATA);
1388	if (! m)
1389		return;
1390	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len;
1391	m->m_pkthdr.rcvif = 0;
1392
1393	h = mtod (m, struct ppp_header*);
1394	h->address = PPP_ALLSTATIONS;        /* broadcast address */
1395	h->control = PPP_UI;                 /* Unnumbered Info */
1396	h->protocol = htons (proto);         /* Link Control Protocol */
1397
1398	lh = (struct lcp_header*) (h + 1);
1399	lh->type = type;
1400	lh->ident = ident;
1401	lh->len = htons (LCP_HEADER_LEN + len);
1402	if (len)
1403		bcopy (data, lh+1, len);
1404
1405	if (debug) {
1406		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
1407		    SPP_ARGS(ifp),
1408		    sppp_proto_name(proto),
1409		    sppp_cp_type_name (lh->type), lh->ident,
1410		    ntohs (lh->len));
1411		sppp_print_bytes ((u_char*) (lh+1), len);
1412		log(-1, ">\n");
1413	}
1414	if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3))
1415		ifp->if_oerrors++;
1416}
1417
1418/*
1419 * Handle incoming PPP control protocol packets.
1420 */
1421static void
1422sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1423{
1424	STDDCL;
1425	struct lcp_header *h;
1426	int len = m->m_pkthdr.len;
1427	int rv;
1428	u_char *p;
1429
1430	if (len < 4) {
1431		if (debug)
1432			log(LOG_DEBUG,
1433			    SPP_FMT "%s invalid packet length: %d bytes\n",
1434			    SPP_ARGS(ifp), cp->name, len);
1435		return;
1436	}
1437	h = mtod (m, struct lcp_header*);
1438	if (debug) {
1439		log(LOG_DEBUG,
1440		    SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
1441		    SPP_ARGS(ifp), cp->name,
1442		    sppp_state_name(sp->state[cp->protoidx]),
1443		    sppp_cp_type_name (h->type), h->ident, ntohs (h->len));
1444		sppp_print_bytes ((u_char*) (h+1), len-4);
1445		log(-1, ">\n");
1446	}
1447	if (len > ntohs (h->len))
1448		len = ntohs (h->len);
1449	p = (u_char *)(h + 1);
1450	switch (h->type) {
1451	case CONF_REQ:
1452		if (len < 4) {
1453			if (debug)
1454				log(-1, SPP_FMT "%s invalid conf-req length %d\n",
1455				       SPP_ARGS(ifp), cp->name,
1456				       len);
1457			++ifp->if_ierrors;
1458			break;
1459		}
1460		/* handle states where RCR doesn't get a SCA/SCN */
1461		switch (sp->state[cp->protoidx]) {
1462		case STATE_CLOSING:
1463		case STATE_STOPPING:
1464			return;
1465		case STATE_CLOSED:
1466			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1467				     0, 0);
1468			return;
1469		}
1470		rv = (cp->RCR)(sp, h, len);
1471		switch (sp->state[cp->protoidx]) {
1472		case STATE_OPENED:
1473			(cp->tld)(sp);
1474			(cp->scr)(sp);
1475			/* fall through... */
1476		case STATE_ACK_SENT:
1477		case STATE_REQ_SENT:
1478			/*
1479			 * sppp_cp_change_state() have the side effect of
1480			 * restarting the timeouts. We want to avoid that
1481			 * if the state don't change, otherwise we won't
1482			 * ever timeout and resend a configuration request
1483			 * that got lost.
1484			 */
1485			if (sp->state[cp->protoidx] == (rv ? STATE_ACK_SENT:
1486			    STATE_REQ_SENT))
1487				break;
1488			sppp_cp_change_state(cp, sp, rv?
1489					     STATE_ACK_SENT: STATE_REQ_SENT);
1490			break;
1491		case STATE_STOPPED:
1492			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1493			(cp->scr)(sp);
1494			sppp_cp_change_state(cp, sp, rv?
1495					     STATE_ACK_SENT: STATE_REQ_SENT);
1496			break;
1497		case STATE_ACK_RCVD:
1498			if (rv) {
1499				sppp_cp_change_state(cp, sp, STATE_OPENED);
1500				if (debug)
1501					log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1502					    SPP_ARGS(ifp),
1503					    cp->name);
1504				(cp->tlu)(sp);
1505			} else
1506				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1507			break;
1508		default:
1509			printf(SPP_FMT "%s illegal %s in state %s\n",
1510			       SPP_ARGS(ifp), cp->name,
1511			       sppp_cp_type_name(h->type),
1512			       sppp_state_name(sp->state[cp->protoidx]));
1513			++ifp->if_ierrors;
1514		}
1515		break;
1516	case CONF_ACK:
1517		if (h->ident != sp->confid[cp->protoidx]) {
1518			if (debug)
1519				log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1520				       SPP_ARGS(ifp), cp->name,
1521				       h->ident, sp->confid[cp->protoidx]);
1522			++ifp->if_ierrors;
1523			break;
1524		}
1525		switch (sp->state[cp->protoidx]) {
1526		case STATE_CLOSED:
1527		case STATE_STOPPED:
1528			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1529			break;
1530		case STATE_CLOSING:
1531		case STATE_STOPPING:
1532			break;
1533		case STATE_REQ_SENT:
1534			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1535			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1536			break;
1537		case STATE_OPENED:
1538			(cp->tld)(sp);
1539			/* fall through */
1540		case STATE_ACK_RCVD:
1541			(cp->scr)(sp);
1542			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1543			break;
1544		case STATE_ACK_SENT:
1545			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1546			sppp_cp_change_state(cp, sp, STATE_OPENED);
1547			if (debug)
1548				log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1549				       SPP_ARGS(ifp), cp->name);
1550			(cp->tlu)(sp);
1551			break;
1552		default:
1553			printf(SPP_FMT "%s illegal %s in state %s\n",
1554			       SPP_ARGS(ifp), cp->name,
1555			       sppp_cp_type_name(h->type),
1556			       sppp_state_name(sp->state[cp->protoidx]));
1557			++ifp->if_ierrors;
1558		}
1559		break;
1560	case CONF_NAK:
1561	case CONF_REJ:
1562		if (h->ident != sp->confid[cp->protoidx]) {
1563			if (debug)
1564				log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1565				       SPP_ARGS(ifp), cp->name,
1566				       h->ident, sp->confid[cp->protoidx]);
1567			++ifp->if_ierrors;
1568			break;
1569		}
1570		if (h->type == CONF_NAK)
1571			(cp->RCN_nak)(sp, h, len);
1572		else /* CONF_REJ */
1573			(cp->RCN_rej)(sp, h, len);
1574
1575		switch (sp->state[cp->protoidx]) {
1576		case STATE_CLOSED:
1577		case STATE_STOPPED:
1578			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1579			break;
1580		case STATE_REQ_SENT:
1581		case STATE_ACK_SENT:
1582			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1583			/*
1584			 * Slow things down a bit if we think we might be
1585			 * in loopback. Depend on the timeout to send the
1586			 * next configuration request.
1587			 */
1588			if (sp->pp_loopcnt)
1589				break;
1590			(cp->scr)(sp);
1591			break;
1592		case STATE_OPENED:
1593			(cp->tld)(sp);
1594			/* fall through */
1595		case STATE_ACK_RCVD:
1596			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1597			(cp->scr)(sp);
1598			break;
1599		case STATE_CLOSING:
1600		case STATE_STOPPING:
1601			break;
1602		default:
1603			printf(SPP_FMT "%s illegal %s in state %s\n",
1604			       SPP_ARGS(ifp), cp->name,
1605			       sppp_cp_type_name(h->type),
1606			       sppp_state_name(sp->state[cp->protoidx]));
1607			++ifp->if_ierrors;
1608		}
1609		break;
1610
1611	case TERM_REQ:
1612		switch (sp->state[cp->protoidx]) {
1613		case STATE_ACK_RCVD:
1614		case STATE_ACK_SENT:
1615			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1616			/* fall through */
1617		case STATE_CLOSED:
1618		case STATE_STOPPED:
1619		case STATE_CLOSING:
1620		case STATE_STOPPING:
1621		case STATE_REQ_SENT:
1622		  sta:
1623			/* Send Terminate-Ack packet. */
1624			if (debug)
1625				log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
1626				    SPP_ARGS(ifp), cp->name);
1627			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1628			break;
1629		case STATE_OPENED:
1630			(cp->tld)(sp);
1631			sp->rst_counter[cp->protoidx] = 0;
1632			sppp_cp_change_state(cp, sp, STATE_STOPPING);
1633			goto sta;
1634			break;
1635		default:
1636			printf(SPP_FMT "%s illegal %s in state %s\n",
1637			       SPP_ARGS(ifp), cp->name,
1638			       sppp_cp_type_name(h->type),
1639			       sppp_state_name(sp->state[cp->protoidx]));
1640			++ifp->if_ierrors;
1641		}
1642		break;
1643	case TERM_ACK:
1644		switch (sp->state[cp->protoidx]) {
1645		case STATE_CLOSED:
1646		case STATE_STOPPED:
1647		case STATE_REQ_SENT:
1648		case STATE_ACK_SENT:
1649			break;
1650		case STATE_CLOSING:
1651			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1652			(cp->tlf)(sp);
1653			break;
1654		case STATE_STOPPING:
1655			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1656			(cp->tlf)(sp);
1657			break;
1658		case STATE_ACK_RCVD:
1659			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1660			break;
1661		case STATE_OPENED:
1662			(cp->tld)(sp);
1663			(cp->scr)(sp);
1664			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1665			break;
1666		default:
1667			printf(SPP_FMT "%s illegal %s in state %s\n",
1668			       SPP_ARGS(ifp), cp->name,
1669			       sppp_cp_type_name(h->type),
1670			       sppp_state_name(sp->state[cp->protoidx]));
1671			++ifp->if_ierrors;
1672		}
1673		break;
1674	case CODE_REJ:
1675		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1676		log(LOG_INFO,
1677		    SPP_FMT "%s: ignoring RXJ (%s) for proto 0x%x, "
1678		    "danger will robinson\n",
1679		    SPP_ARGS(ifp), cp->name,
1680		    sppp_cp_type_name(h->type), ntohs(*((u_short *)p)));
1681		switch (sp->state[cp->protoidx]) {
1682		case STATE_CLOSED:
1683		case STATE_STOPPED:
1684		case STATE_REQ_SENT:
1685		case STATE_ACK_SENT:
1686		case STATE_CLOSING:
1687		case STATE_STOPPING:
1688		case STATE_OPENED:
1689			break;
1690		case STATE_ACK_RCVD:
1691			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1692			break;
1693		default:
1694			printf(SPP_FMT "%s illegal %s in state %s\n",
1695			       SPP_ARGS(ifp), cp->name,
1696			       sppp_cp_type_name(h->type),
1697			       sppp_state_name(sp->state[cp->protoidx]));
1698			++ifp->if_ierrors;
1699		}
1700		break;
1701	case PROTO_REJ:
1702	    {
1703		int catastrophic;
1704		const struct cp *upper;
1705		int i;
1706		u_int16_t proto;
1707
1708		catastrophic = 0;
1709		upper = NULL;
1710		proto = ntohs(*((u_int16_t *)p));
1711		for (i = 0; i < IDX_COUNT; i++) {
1712			if (cps[i]->proto == proto) {
1713				upper = cps[i];
1714				break;
1715			}
1716		}
1717		if (upper == NULL)
1718			catastrophic++;
1719
1720		if (catastrophic || debug)
1721			log(catastrophic? LOG_INFO: LOG_DEBUG,
1722			    SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
1723			    SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+',
1724			    sppp_cp_type_name(h->type), proto,
1725			    upper ? upper->name : "unknown",
1726			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
1727
1728		/*
1729		 * if we got RXJ+ against conf-req, the peer does not implement
1730		 * this particular protocol type.  terminate the protocol.
1731		 */
1732		if (upper && !catastrophic) {
1733			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
1734				upper->Close(sp);
1735				break;
1736			}
1737		}
1738
1739		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1740		switch (sp->state[cp->protoidx]) {
1741		case STATE_CLOSED:
1742		case STATE_STOPPED:
1743		case STATE_REQ_SENT:
1744		case STATE_ACK_SENT:
1745		case STATE_CLOSING:
1746		case STATE_STOPPING:
1747		case STATE_OPENED:
1748			break;
1749		case STATE_ACK_RCVD:
1750			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1751			break;
1752		default:
1753			printf(SPP_FMT "%s illegal %s in state %s\n",
1754			       SPP_ARGS(ifp), cp->name,
1755			       sppp_cp_type_name(h->type),
1756			       sppp_state_name(sp->state[cp->protoidx]));
1757			++ifp->if_ierrors;
1758		}
1759		break;
1760	    }
1761	case DISC_REQ:
1762		if (cp->proto != PPP_LCP)
1763			goto illegal;
1764		/* Discard the packet. */
1765		break;
1766	case ECHO_REQ:
1767		if (cp->proto != PPP_LCP)
1768			goto illegal;
1769		if (sp->state[cp->protoidx] != STATE_OPENED) {
1770			if (debug)
1771				log(-1, SPP_FMT "lcp echo req but lcp closed\n",
1772				       SPP_ARGS(ifp));
1773			++ifp->if_ierrors;
1774			break;
1775		}
1776		if (len < 8) {
1777			if (debug)
1778				log(-1, SPP_FMT "invalid lcp echo request "
1779				       "packet length: %d bytes\n",
1780				       SPP_ARGS(ifp), len);
1781			break;
1782		}
1783		if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
1784		    ntohl (*(long*)(h+1)) == sp->lcp.magic) {
1785			/* Line loopback mode detected. */
1786			printf(SPP_FMT "loopback\n", SPP_ARGS(ifp));
1787			sp->pp_loopcnt = MAXALIVECNT * 5;
1788			if_down (ifp);
1789			sppp_qflush (&sp->pp_cpq);
1790
1791			/* Shut down the PPP link. */
1792			/* XXX */
1793			lcp.Down(sp);
1794			lcp.Up(sp);
1795			break;
1796		}
1797		*(long*)(h+1) = htonl (sp->lcp.magic);
1798		if (debug)
1799			log(-1, SPP_FMT "got lcp echo req, sending echo rep\n",
1800			       SPP_ARGS(ifp));
1801		sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
1802		break;
1803	case ECHO_REPLY:
1804		if (cp->proto != PPP_LCP)
1805			goto illegal;
1806		if (h->ident != sp->lcp.echoid) {
1807			++ifp->if_ierrors;
1808			break;
1809		}
1810		if (len < 8) {
1811			if (debug)
1812				log(-1, SPP_FMT "lcp invalid echo reply "
1813				       "packet length: %d bytes\n",
1814				       SPP_ARGS(ifp), len);
1815			break;
1816		}
1817		if (debug)
1818			log(-1, SPP_FMT "lcp got echo rep\n",
1819			       SPP_ARGS(ifp));
1820		if (!(sp->lcp.opts & (1 << LCP_OPT_MAGIC)) ||
1821		    ntohl (*(long*)(h+1)) != sp->lcp.magic)
1822			sp->pp_alivecnt = 0;
1823		break;
1824	default:
1825		/* Unknown packet type -- send Code-Reject packet. */
1826	  illegal:
1827		if (debug)
1828			log(-1, SPP_FMT "%s send code-rej for 0x%x\n",
1829			       SPP_ARGS(ifp), cp->name, h->type);
1830		sppp_cp_send(sp, cp->proto, CODE_REJ,
1831			     ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
1832		++ifp->if_ierrors;
1833	}
1834}
1835
1836
1837/*
1838 * The generic part of all Up/Down/Open/Close/TO event handlers.
1839 * Basically, the state transition handling in the automaton.
1840 */
1841static void
1842sppp_up_event(const struct cp *cp, struct sppp *sp)
1843{
1844	STDDCL;
1845
1846	if (debug)
1847		log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
1848		    SPP_ARGS(ifp), cp->name,
1849		    sppp_state_name(sp->state[cp->protoidx]));
1850
1851	switch (sp->state[cp->protoidx]) {
1852	case STATE_INITIAL:
1853		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1854		break;
1855	case STATE_STARTING:
1856		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1857		(cp->scr)(sp);
1858		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1859		break;
1860	default:
1861		printf(SPP_FMT "%s illegal up in state %s\n",
1862		       SPP_ARGS(ifp), cp->name,
1863		       sppp_state_name(sp->state[cp->protoidx]));
1864	}
1865}
1866
1867static void
1868sppp_down_event(const struct cp *cp, struct sppp *sp)
1869{
1870	STDDCL;
1871
1872	if (debug)
1873		log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
1874		    SPP_ARGS(ifp), cp->name,
1875		    sppp_state_name(sp->state[cp->protoidx]));
1876
1877	switch (sp->state[cp->protoidx]) {
1878	case STATE_CLOSED:
1879	case STATE_CLOSING:
1880		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1881		break;
1882	case STATE_STOPPED:
1883		sppp_cp_change_state(cp, sp, STATE_STARTING);
1884		(cp->tls)(sp);
1885		break;
1886	case STATE_STOPPING:
1887	case STATE_REQ_SENT:
1888	case STATE_ACK_RCVD:
1889	case STATE_ACK_SENT:
1890		sppp_cp_change_state(cp, sp, STATE_STARTING);
1891		break;
1892	case STATE_OPENED:
1893		(cp->tld)(sp);
1894		sppp_cp_change_state(cp, sp, STATE_STARTING);
1895		break;
1896	default:
1897		printf(SPP_FMT "%s illegal down in state %s\n",
1898		       SPP_ARGS(ifp), cp->name,
1899		       sppp_state_name(sp->state[cp->protoidx]));
1900	}
1901}
1902
1903
1904static void
1905sppp_open_event(const struct cp *cp, struct sppp *sp)
1906{
1907	STDDCL;
1908
1909	if (debug)
1910		log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
1911		    SPP_ARGS(ifp), cp->name,
1912		    sppp_state_name(sp->state[cp->protoidx]));
1913
1914	switch (sp->state[cp->protoidx]) {
1915	case STATE_INITIAL:
1916		sppp_cp_change_state(cp, sp, STATE_STARTING);
1917		(cp->tls)(sp);
1918		break;
1919	case STATE_STARTING:
1920		break;
1921	case STATE_CLOSED:
1922		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1923		(cp->scr)(sp);
1924		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1925		break;
1926	case STATE_STOPPED:
1927		/*
1928		 * Try escaping stopped state.  This seems to bite
1929		 * people occasionally, in particular for IPCP,
1930		 * presumably following previous IPCP negotiation
1931		 * aborts.  Somehow, we must have missed a Down event
1932		 * which would have caused a transition into starting
1933		 * state, so as a bandaid we force the Down event now.
1934		 * This effectively implements (something like the)
1935		 * `restart' option mentioned in the state transition
1936		 * table of RFC 1661.
1937		 */
1938		sppp_cp_change_state(cp, sp, STATE_STARTING);
1939		(cp->tls)(sp);
1940		break;
1941	case STATE_STOPPING:
1942	case STATE_REQ_SENT:
1943	case STATE_ACK_RCVD:
1944	case STATE_ACK_SENT:
1945	case STATE_OPENED:
1946		break;
1947	case STATE_CLOSING:
1948		sppp_cp_change_state(cp, sp, STATE_STOPPING);
1949		break;
1950	}
1951}
1952
1953
1954static void
1955sppp_close_event(const struct cp *cp, struct sppp *sp)
1956{
1957	STDDCL;
1958
1959	if (debug)
1960		log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
1961		    SPP_ARGS(ifp), cp->name,
1962		    sppp_state_name(sp->state[cp->protoidx]));
1963
1964	switch (sp->state[cp->protoidx]) {
1965	case STATE_INITIAL:
1966	case STATE_CLOSED:
1967	case STATE_CLOSING:
1968		break;
1969	case STATE_STARTING:
1970		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1971		(cp->tlf)(sp);
1972		break;
1973	case STATE_STOPPED:
1974		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1975		break;
1976	case STATE_STOPPING:
1977		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1978		break;
1979	case STATE_OPENED:
1980		(cp->tld)(sp);
1981		/* fall through */
1982	case STATE_REQ_SENT:
1983	case STATE_ACK_RCVD:
1984	case STATE_ACK_SENT:
1985		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1986		sppp_cp_send(sp, cp->proto, TERM_REQ,
1987			     ++sp->pp_seq[cp->protoidx], 0, 0);
1988		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1989		break;
1990	}
1991}
1992
1993static void
1994sppp_to_event(const struct cp *cp, struct sppp *sp)
1995{
1996	STDDCL;
1997	int s;
1998
1999	s = splimp();
2000	if (debug)
2001		log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
2002		    SPP_ARGS(ifp), cp->name,
2003		    sppp_state_name(sp->state[cp->protoidx]),
2004		    sp->rst_counter[cp->protoidx]);
2005
2006	if (--sp->rst_counter[cp->protoidx] < 0)
2007		/* TO- event */
2008		switch (sp->state[cp->protoidx]) {
2009		case STATE_CLOSING:
2010			sppp_cp_change_state(cp, sp, STATE_CLOSED);
2011			(cp->tlf)(sp);
2012			break;
2013		case STATE_STOPPING:
2014			sppp_cp_change_state(cp, sp, STATE_STOPPED);
2015			(cp->tlf)(sp);
2016			break;
2017		case STATE_REQ_SENT:
2018		case STATE_ACK_RCVD:
2019		case STATE_ACK_SENT:
2020			sppp_cp_change_state(cp, sp, STATE_STOPPED);
2021			(cp->tlf)(sp);
2022			break;
2023		}
2024	else
2025		/* TO+ event */
2026		switch (sp->state[cp->protoidx]) {
2027		case STATE_CLOSING:
2028		case STATE_STOPPING:
2029			sppp_cp_send(sp, cp->proto, TERM_REQ,
2030				     ++sp->pp_seq[cp->protoidx], 0, 0);
2031			TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
2032			    sp->ch[cp->protoidx]);
2033			break;
2034		case STATE_REQ_SENT:
2035		case STATE_ACK_RCVD:
2036			(cp->scr)(sp);
2037			/* sppp_cp_change_state() will restart the timer */
2038			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2039			break;
2040		case STATE_ACK_SENT:
2041			(cp->scr)(sp);
2042			TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
2043			    sp->ch[cp->protoidx]);
2044			break;
2045		}
2046
2047	splx(s);
2048}
2049
2050/*
2051 * Change the state of a control protocol in the state automaton.
2052 * Takes care of starting/stopping the restart timer.
2053 */
2054void
2055sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
2056{
2057	sp->state[cp->protoidx] = newstate;
2058
2059	UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]);
2060	switch (newstate) {
2061	case STATE_INITIAL:
2062	case STATE_STARTING:
2063	case STATE_CLOSED:
2064	case STATE_STOPPED:
2065	case STATE_OPENED:
2066		break;
2067	case STATE_CLOSING:
2068	case STATE_STOPPING:
2069	case STATE_REQ_SENT:
2070	case STATE_ACK_RCVD:
2071	case STATE_ACK_SENT:
2072		TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
2073		    sp->ch[cp->protoidx]);
2074		break;
2075	}
2076}
2077
2078/*
2079 *--------------------------------------------------------------------------*
2080 *                                                                          *
2081 *                         The LCP implementation.                          *
2082 *                                                                          *
2083 *--------------------------------------------------------------------------*
2084 */
2085static void
2086sppp_lcp_init(struct sppp *sp)
2087{
2088	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2089	sp->lcp.magic = 0;
2090	sp->state[IDX_LCP] = STATE_INITIAL;
2091	sp->fail_counter[IDX_LCP] = 0;
2092	sp->pp_seq[IDX_LCP] = 0;
2093	sp->pp_rseq[IDX_LCP] = 0;
2094	sp->lcp.protos = 0;
2095	sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
2096
2097	/* Note that these values are  relevant for all control protocols */
2098	sp->lcp.timeout = 3 * hz;
2099	sp->lcp.max_terminate = 2;
2100	sp->lcp.max_configure = 10;
2101	sp->lcp.max_failure = 10;
2102#if defined(__FreeBSD__) && __FreeBSD__ >= 3
2103	callout_handle_init(&sp->ch[IDX_LCP]);
2104#endif
2105}
2106
2107static void
2108sppp_lcp_up(struct sppp *sp)
2109{
2110	STDDCL;
2111
2112	sp->pp_alivecnt = 0;
2113	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2114	sp->lcp.magic = 0;
2115	sp->lcp.protos = 0;
2116	sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
2117	/*
2118	 * If we are authenticator, negotiate LCP_AUTH
2119	 */
2120	if (sp->hisauth.proto != 0)
2121		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
2122	else
2123		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2124	sp->pp_flags &= ~PP_NEEDAUTH;
2125	/*
2126	 * If this interface is passive or dial-on-demand, and we are
2127	 * still in Initial state, it means we've got an incoming
2128	 * call.  Activate the interface.
2129	 */
2130	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
2131		if (debug)
2132			log(LOG_DEBUG,
2133			    SPP_FMT "Up event", SPP_ARGS(ifp));
2134		ifp->if_flags |= IFF_RUNNING;
2135		if (sp->state[IDX_LCP] == STATE_INITIAL) {
2136			if (debug)
2137				log(-1, "(incoming call)\n");
2138			sp->pp_flags |= PP_CALLIN;
2139			lcp.Open(sp);
2140		} else if (debug)
2141			log(-1, "\n");
2142	}
2143
2144	sppp_up_event(&lcp, sp);
2145}
2146
2147static void
2148sppp_lcp_down(struct sppp *sp)
2149{
2150	STDDCL;
2151
2152	sppp_down_event(&lcp, sp);
2153
2154	/*
2155	 * If this is neither a dial-on-demand nor a passive
2156	 * interface, simulate an ``ifconfig down'' action, so the
2157	 * administrator can force a redial by another ``ifconfig
2158	 * up''.  XXX For leased line operation, should we immediately
2159	 * try to reopen the connection here?
2160	 */
2161	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
2162		log(LOG_INFO,
2163		    SPP_FMT "Down event, taking interface down.\n",
2164		    SPP_ARGS(ifp));
2165		if_down(ifp);
2166	} else {
2167		if (debug)
2168			log(LOG_DEBUG,
2169			    SPP_FMT "Down event (carrier loss)\n",
2170			    SPP_ARGS(ifp));
2171		sp->pp_flags &= ~PP_CALLIN;
2172		if (sp->state[IDX_LCP] != STATE_INITIAL)
2173			lcp.Close(sp);
2174		ifp->if_flags &= ~IFF_RUNNING;
2175	}
2176}
2177
2178static void
2179sppp_lcp_open(struct sppp *sp)
2180{
2181	sppp_open_event(&lcp, sp);
2182}
2183
2184static void
2185sppp_lcp_close(struct sppp *sp)
2186{
2187	sppp_close_event(&lcp, sp);
2188}
2189
2190static void
2191sppp_lcp_TO(void *cookie)
2192{
2193	sppp_to_event(&lcp, (struct sppp *)cookie);
2194}
2195
2196/*
2197 * Analyze a configure request.  Return true if it was agreeable, and
2198 * caused action sca, false if it has been rejected or nak'ed, and
2199 * caused action scn.  (The return value is used to make the state
2200 * transition decision in the state automaton.)
2201 */
2202static int
2203sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2204{
2205	STDDCL;
2206	u_char *buf, *r, *p;
2207	int origlen, rlen;
2208	u_long nmagic;
2209	u_short authproto;
2210
2211	len -= 4;
2212	origlen = len;
2213	buf = r = malloc (len, M_TEMP, M_NOWAIT);
2214	if (! buf)
2215		return (0);
2216
2217	if (debug)
2218		log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
2219		    SPP_ARGS(ifp));
2220
2221	/* pass 1: check for things that need to be rejected */
2222	p = (void*) (h+1);
2223	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2224		if (debug)
2225			log(-1, " %s ", sppp_lcp_opt_name(*p));
2226		switch (*p) {
2227		case LCP_OPT_MAGIC:
2228			/* Magic number. */
2229			if (len >= 6 && p[1] == 6)
2230				continue;
2231			if (debug)
2232				log(-1, "[invalid] ");
2233			break;
2234		case LCP_OPT_ASYNC_MAP:
2235			/* Async control character map. */
2236			if (len >= 6 && p[1] == 6)
2237				continue;
2238			if (debug)
2239				log(-1, "[invalid] ");
2240			break;
2241		case LCP_OPT_MRU:
2242			/* Maximum receive unit. */
2243			if (len >= 4 && p[1] == 4)
2244				continue;
2245			if (debug)
2246				log(-1, "[invalid] ");
2247			break;
2248		case LCP_OPT_AUTH_PROTO:
2249			if (len < 4) {
2250				if (debug)
2251					log(-1, "[invalid] ");
2252				break;
2253			}
2254			authproto = (p[2] << 8) + p[3];
2255			if (authproto == PPP_CHAP && p[1] != 5) {
2256				if (debug)
2257					log(-1, "[invalid chap len] ");
2258				break;
2259			}
2260			if (sp->myauth.proto == 0) {
2261				/* we are not configured to do auth */
2262				if (debug)
2263					log(-1, "[not configured] ");
2264				break;
2265			}
2266			/*
2267			 * Remote want us to authenticate, remember this,
2268			 * so we stay in PHASE_AUTHENTICATE after LCP got
2269			 * up.
2270			 */
2271			sp->pp_flags |= PP_NEEDAUTH;
2272			continue;
2273		default:
2274			/* Others not supported. */
2275			if (debug)
2276				log(-1, "[rej] ");
2277			break;
2278		}
2279		/* Add the option to rejected list. */
2280		bcopy (p, r, p[1]);
2281		r += p[1];
2282		rlen += p[1];
2283	}
2284	if (rlen) {
2285		if (debug)
2286			log(-1, " send conf-rej\n");
2287		sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2288		return 0;
2289	} else if (debug)
2290		log(-1, "\n");
2291
2292	/*
2293	 * pass 2: check for option values that are unacceptable and
2294	 * thus require to be nak'ed.
2295	 */
2296	if (debug)
2297		log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
2298		    SPP_ARGS(ifp));
2299
2300	p = (void*) (h+1);
2301	len = origlen;
2302	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2303		if (debug)
2304			log(-1, " %s ", sppp_lcp_opt_name(*p));
2305		switch (*p) {
2306		case LCP_OPT_MAGIC:
2307			/* Magic number -- extract. */
2308			nmagic = (u_long)p[2] << 24 |
2309				(u_long)p[3] << 16 | p[4] << 8 | p[5];
2310			if (nmagic != sp->lcp.magic) {
2311				sp->pp_loopcnt = 0;
2312				if (debug)
2313					log(-1, "0x%lx ", nmagic);
2314				continue;
2315			}
2316			if (debug && sp->pp_loopcnt < MAXALIVECNT*5)
2317				log(-1, "[glitch] ");
2318			++sp->pp_loopcnt;
2319			/*
2320			 * We negate our magic here, and NAK it.  If
2321			 * we see it later in an NAK packet, we
2322			 * suggest a new one.
2323			 */
2324			nmagic = ~sp->lcp.magic;
2325			/* Gonna NAK it. */
2326			p[2] = nmagic >> 24;
2327			p[3] = nmagic >> 16;
2328			p[4] = nmagic >> 8;
2329			p[5] = nmagic;
2330			break;
2331
2332		case LCP_OPT_ASYNC_MAP:
2333			/*
2334			 * Async control character map -- just ignore it.
2335			 *
2336			 * Quote from RFC 1662, chapter 6:
2337			 * To enable this functionality, synchronous PPP
2338			 * implementations MUST always respond to the
2339			 * Async-Control-Character-Map Configuration
2340			 * Option with the LCP Configure-Ack.  However,
2341			 * acceptance of the Configuration Option does
2342			 * not imply that the synchronous implementation
2343			 * will do any ACCM mapping.  Instead, all such
2344			 * octet mapping will be performed by the
2345			 * asynchronous-to-synchronous converter.
2346			 */
2347			continue;
2348
2349		case LCP_OPT_MRU:
2350			/*
2351			 * Maximum receive unit.  Always agreeable,
2352			 * but ignored by now.
2353			 */
2354			sp->lcp.their_mru = p[2] * 256 + p[3];
2355			if (debug)
2356				log(-1, "%lu ", sp->lcp.their_mru);
2357			continue;
2358
2359		case LCP_OPT_AUTH_PROTO:
2360			authproto = (p[2] << 8) + p[3];
2361			if (sp->myauth.proto != authproto) {
2362				/* not agreed, nak */
2363				if (debug)
2364					log(-1, "[mine %s != his %s] ",
2365					       sppp_proto_name(sp->hisauth.proto),
2366					       sppp_proto_name(authproto));
2367				p[2] = sp->myauth.proto >> 8;
2368				p[3] = sp->myauth.proto;
2369				break;
2370			}
2371			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2372				if (debug)
2373					log(-1, "[chap not MD5] ");
2374				p[4] = CHAP_MD5;
2375				break;
2376			}
2377			continue;
2378		}
2379		/* Add the option to nak'ed list. */
2380		bcopy (p, r, p[1]);
2381		r += p[1];
2382		rlen += p[1];
2383	}
2384	if (rlen) {
2385		/*
2386		 * Local and remote magics equal -- loopback?
2387		 */
2388		if (sp->pp_loopcnt >= MAXALIVECNT*5) {
2389			if (sp->pp_loopcnt == MAXALIVECNT*5)
2390				printf (SPP_FMT "loopback\n",
2391					SPP_ARGS(ifp));
2392			if (ifp->if_flags & IFF_UP) {
2393				if_down(ifp);
2394				sppp_qflush(&sp->pp_cpq);
2395				/* XXX ? */
2396				lcp.Down(sp);
2397				lcp.Up(sp);
2398			}
2399		} else if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2400			if (debug)
2401				log(-1, " max_failure (%d) exceeded, "
2402				       "send conf-rej\n",
2403				       sp->lcp.max_failure);
2404			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2405		} else {
2406			if (debug)
2407				log(-1, " send conf-nak\n");
2408			sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2409		}
2410	} else {
2411		if (debug)
2412			log(-1, " send conf-ack\n");
2413		sp->fail_counter[IDX_LCP] = 0;
2414		sp->pp_loopcnt = 0;
2415		sppp_cp_send (sp, PPP_LCP, CONF_ACK,
2416			      h->ident, origlen, h+1);
2417	}
2418
2419	free (buf, M_TEMP);
2420	return (rlen == 0);
2421}
2422
2423/*
2424 * Analyze the LCP Configure-Reject option list, and adjust our
2425 * negotiation.
2426 */
2427static void
2428sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2429{
2430	STDDCL;
2431	u_char *buf, *p;
2432
2433	len -= 4;
2434	buf = malloc (len, M_TEMP, M_NOWAIT);
2435	if (!buf)
2436		return;
2437
2438	if (debug)
2439		log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
2440		    SPP_ARGS(ifp));
2441
2442	p = (void*) (h+1);
2443	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2444		if (debug)
2445			log(-1, " %s ", sppp_lcp_opt_name(*p));
2446		switch (*p) {
2447		case LCP_OPT_MAGIC:
2448			/* Magic number -- can't use it, use 0 */
2449			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2450			sp->lcp.magic = 0;
2451			break;
2452		case LCP_OPT_MRU:
2453			/*
2454			 * Should not be rejected anyway, since we only
2455			 * negotiate a MRU if explicitly requested by
2456			 * peer.
2457			 */
2458			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2459			break;
2460		case LCP_OPT_AUTH_PROTO:
2461			/*
2462			 * Peer doesn't want to authenticate himself,
2463			 * deny unless this is a dialout call, and
2464			 * AUTHFLAG_NOCALLOUT is set.
2465			 */
2466			if ((sp->pp_flags & PP_CALLIN) == 0 &&
2467			    (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
2468				if (debug)
2469					log(-1, "[don't insist on auth "
2470					       "for callout]");
2471				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2472				break;
2473			}
2474			if (debug)
2475				log(-1, "[access denied]\n");
2476			lcp.Close(sp);
2477			break;
2478		}
2479	}
2480	if (debug)
2481		log(-1, "\n");
2482	free (buf, M_TEMP);
2483	return;
2484}
2485
2486/*
2487 * Analyze the LCP Configure-NAK option list, and adjust our
2488 * negotiation.
2489 */
2490static void
2491sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2492{
2493	STDDCL;
2494	u_char *buf, *p;
2495	u_long magic;
2496
2497	len -= 4;
2498	buf = malloc (len, M_TEMP, M_NOWAIT);
2499	if (!buf)
2500		return;
2501
2502	if (debug)
2503		log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
2504		    SPP_ARGS(ifp));
2505
2506	p = (void*) (h+1);
2507	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2508		if (debug)
2509			log(-1, " %s ", sppp_lcp_opt_name(*p));
2510		switch (*p) {
2511		case LCP_OPT_MAGIC:
2512			/* Magic number -- renegotiate */
2513			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2514			    len >= 6 && p[1] == 6) {
2515				magic = (u_long)p[2] << 24 |
2516					(u_long)p[3] << 16 | p[4] << 8 | p[5];
2517				/*
2518				 * If the remote magic is our negated one,
2519				 * this looks like a loopback problem.
2520				 * Suggest a new magic to make sure.
2521				 */
2522				if (magic == ~sp->lcp.magic) {
2523					if (debug)
2524						log(-1, "magic glitch ");
2525#if defined(__FreeBSD__) && __FreeBSD__ >= 3
2526					sp->lcp.magic = random();
2527#else
2528					sp->lcp.magic = time.tv_sec + time.tv_usec;
2529#endif
2530				} else {
2531					sp->lcp.magic = magic;
2532					if (debug)
2533						log(-1, "%lu ", magic);
2534				}
2535			}
2536			break;
2537		case LCP_OPT_MRU:
2538			/*
2539			 * Peer wants to advise us to negotiate an MRU.
2540			 * Agree on it if it's reasonable, or use
2541			 * default otherwise.
2542			 */
2543			if (len >= 4 && p[1] == 4) {
2544				u_int mru = p[2] * 256 + p[3];
2545				if (debug)
2546					log(-1, "%d ", mru);
2547				if (mru < PP_MTU || mru > PP_MAX_MRU)
2548					mru = PP_MTU;
2549				sp->lcp.mru = mru;
2550				sp->lcp.opts |= (1 << LCP_OPT_MRU);
2551			}
2552			break;
2553		case LCP_OPT_AUTH_PROTO:
2554			/*
2555			 * Peer doesn't like our authentication method,
2556			 * deny.
2557			 */
2558			if (debug)
2559				log(-1, "[access denied]\n");
2560			lcp.Close(sp);
2561			break;
2562		}
2563	}
2564	if (debug)
2565		log(-1, "\n");
2566	free (buf, M_TEMP);
2567	return;
2568}
2569
2570static void
2571sppp_lcp_tlu(struct sppp *sp)
2572{
2573	STDDCL;
2574	int i;
2575	u_long mask;
2576
2577	/* XXX ? */
2578	if (! (ifp->if_flags & IFF_UP) &&
2579	    (ifp->if_flags & IFF_RUNNING)) {
2580		/* Coming out of loopback mode. */
2581		if_up(ifp);
2582		printf (SPP_FMT "up\n", SPP_ARGS(ifp));
2583	}
2584
2585	for (i = 0; i < IDX_COUNT; i++)
2586		if ((cps[i])->flags & CP_QUAL)
2587			(cps[i])->Open(sp);
2588
2589	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2590	    (sp->pp_flags & PP_NEEDAUTH) != 0)
2591		sp->pp_phase = PHASE_AUTHENTICATE;
2592	else
2593		sp->pp_phase = PHASE_NETWORK;
2594
2595	if (debug)
2596		log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2597		    sppp_phase_name(sp->pp_phase));
2598
2599	/*
2600	 * Open all authentication protocols.  This is even required
2601	 * if we already proceeded to network phase, since it might be
2602	 * that remote wants us to authenticate, so we might have to
2603	 * send a PAP request.  Undesired authentication protocols
2604	 * don't do anything when they get an Open event.
2605	 */
2606	for (i = 0; i < IDX_COUNT; i++)
2607		if ((cps[i])->flags & CP_AUTH)
2608			(cps[i])->Open(sp);
2609
2610	if (sp->pp_phase == PHASE_NETWORK) {
2611		/* Notify all NCPs. */
2612		for (i = 0; i < IDX_COUNT; i++)
2613			if ((cps[i])->flags & CP_NCP)
2614				(cps[i])->Open(sp);
2615	}
2616
2617	/* Send Up events to all started protos. */
2618	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2619		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0)
2620			(cps[i])->Up(sp);
2621
2622	/* notify low-level driver of state change */
2623	if (sp->pp_chg)
2624		sp->pp_chg(sp, (int)sp->pp_phase);
2625
2626	if (sp->pp_phase == PHASE_NETWORK)
2627		/* if no NCP is starting, close down */
2628		sppp_lcp_check_and_close(sp);
2629}
2630
2631static void
2632sppp_lcp_tld(struct sppp *sp)
2633{
2634	STDDCL;
2635	int i;
2636	u_long mask;
2637
2638	sp->pp_phase = PHASE_TERMINATE;
2639
2640	if (debug)
2641		log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2642		    sppp_phase_name(sp->pp_phase));
2643
2644	/*
2645	 * Take upper layers down.  We send the Down event first and
2646	 * the Close second to prevent the upper layers from sending
2647	 * ``a flurry of terminate-request packets'', as the RFC
2648	 * describes it.
2649	 */
2650	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2651		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
2652			(cps[i])->Down(sp);
2653			(cps[i])->Close(sp);
2654		}
2655}
2656
2657static void
2658sppp_lcp_tls(struct sppp *sp)
2659{
2660	STDDCL;
2661
2662	sp->pp_phase = PHASE_ESTABLISH;
2663
2664	if (debug)
2665		log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2666		    sppp_phase_name(sp->pp_phase));
2667
2668	/* Notify lower layer if desired. */
2669	if (sp->pp_tls)
2670		(sp->pp_tls)(sp);
2671	else
2672		(sp->pp_up)(sp);
2673}
2674
2675static void
2676sppp_lcp_tlf(struct sppp *sp)
2677{
2678	STDDCL;
2679
2680	sp->pp_phase = PHASE_DEAD;
2681	if (debug)
2682		log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2683		    sppp_phase_name(sp->pp_phase));
2684
2685	/* Notify lower layer if desired. */
2686	if (sp->pp_tlf)
2687		(sp->pp_tlf)(sp);
2688	else
2689		(sp->pp_down)(sp);
2690}
2691
2692static void
2693sppp_lcp_scr(struct sppp *sp)
2694{
2695	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2696	int i = 0;
2697	u_short authproto;
2698
2699	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2700		if (! sp->lcp.magic)
2701#if defined(__FreeBSD__) && __FreeBSD__ >= 3
2702			sp->lcp.magic = random();
2703#else
2704			sp->lcp.magic = time.tv_sec + time.tv_usec;
2705#endif
2706		opt[i++] = LCP_OPT_MAGIC;
2707		opt[i++] = 6;
2708		opt[i++] = sp->lcp.magic >> 24;
2709		opt[i++] = sp->lcp.magic >> 16;
2710		opt[i++] = sp->lcp.magic >> 8;
2711		opt[i++] = sp->lcp.magic;
2712	}
2713
2714	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2715		opt[i++] = LCP_OPT_MRU;
2716		opt[i++] = 4;
2717		opt[i++] = sp->lcp.mru >> 8;
2718		opt[i++] = sp->lcp.mru;
2719	}
2720
2721	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2722		authproto = sp->hisauth.proto;
2723		opt[i++] = LCP_OPT_AUTH_PROTO;
2724		opt[i++] = authproto == PPP_CHAP? 5: 4;
2725		opt[i++] = authproto >> 8;
2726		opt[i++] = authproto;
2727		if (authproto == PPP_CHAP)
2728			opt[i++] = CHAP_MD5;
2729	}
2730
2731	sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
2732	sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
2733}
2734
2735/*
2736 * Check the open NCPs, return true if at least one NCP is open.
2737 */
2738static int
2739sppp_ncp_check(struct sppp *sp)
2740{
2741	int i, mask;
2742
2743	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2744		if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
2745			return 1;
2746	return 0;
2747}
2748
2749/*
2750 * Re-check the open NCPs and see if we should terminate the link.
2751 * Called by the NCPs during their tlf action handling.
2752 */
2753static void
2754sppp_lcp_check_and_close(struct sppp *sp)
2755{
2756
2757	if (sp->pp_phase < PHASE_NETWORK)
2758		/* don't bother, we are already going down */
2759		return;
2760
2761	if (sppp_ncp_check(sp))
2762		return;
2763
2764	lcp.Close(sp);
2765}
2766
2767/*
2768 *--------------------------------------------------------------------------*
2769 *                                                                          *
2770 *                        The IPCP implementation.                          *
2771 *                                                                          *
2772 *--------------------------------------------------------------------------*
2773 */
2774
2775static void
2776sppp_ipcp_init(struct sppp *sp)
2777{
2778	sp->ipcp.opts = 0;
2779	sp->ipcp.flags = 0;
2780	sp->state[IDX_IPCP] = STATE_INITIAL;
2781	sp->fail_counter[IDX_IPCP] = 0;
2782	sp->pp_seq[IDX_IPCP] = 0;
2783	sp->pp_rseq[IDX_IPCP] = 0;
2784#if defined(__FreeBSD__) && __FreeBSD__ >= 3
2785	callout_handle_init(&sp->ch[IDX_IPCP]);
2786#endif
2787}
2788
2789static void
2790sppp_ipcp_up(struct sppp *sp)
2791{
2792	sppp_up_event(&ipcp, sp);
2793}
2794
2795static void
2796sppp_ipcp_down(struct sppp *sp)
2797{
2798	sppp_down_event(&ipcp, sp);
2799}
2800
2801static void
2802sppp_ipcp_open(struct sppp *sp)
2803{
2804	STDDCL;
2805	u_long myaddr, hisaddr;
2806
2807	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN | IPCP_MYADDR_SEEN |
2808			    IPCP_MYADDR_DYN | IPCP_VJ);
2809	sp->ipcp.opts = 0;
2810
2811	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
2812	/*
2813	 * If we don't have his address, this probably means our
2814	 * interface doesn't want to talk IP at all.  (This could
2815	 * be the case if somebody wants to speak only IPX, for
2816	 * example.)  Don't open IPCP in this case.
2817	 */
2818	if (hisaddr == 0L) {
2819		/* XXX this message should go away */
2820		if (debug)
2821			log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
2822			    SPP_ARGS(ifp));
2823		return;
2824	}
2825	if (myaddr == 0L) {
2826		/*
2827		 * I don't have an assigned address, so i need to
2828		 * negotiate my address.
2829		 */
2830		sp->ipcp.flags |= IPCP_MYADDR_DYN;
2831		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2832	} else
2833		sp->ipcp.flags |= IPCP_MYADDR_SEEN;
2834	if (sp->enable_vj) {
2835		sp->ipcp.opts |= (1 << IPCP_OPT_COMPRESSION);
2836		sp->ipcp.max_state = MAX_STATES - 1;
2837		sp->ipcp.compress_cid = 1;
2838	}
2839	sppp_open_event(&ipcp, sp);
2840}
2841
2842static void
2843sppp_ipcp_close(struct sppp *sp)
2844{
2845	sppp_close_event(&ipcp, sp);
2846	if (sp->ipcp.flags & IPCP_MYADDR_DYN)
2847		/*
2848		 * My address was dynamic, clear it again.
2849		 */
2850		sppp_set_ip_addr(sp, 0L);
2851}
2852
2853static void
2854sppp_ipcp_TO(void *cookie)
2855{
2856	sppp_to_event(&ipcp, (struct sppp *)cookie);
2857}
2858
2859/*
2860 * Analyze a configure request.  Return true if it was agreeable, and
2861 * caused action sca, false if it has been rejected or nak'ed, and
2862 * caused action scn.  (The return value is used to make the state
2863 * transition decision in the state automaton.)
2864 */
2865static int
2866sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2867{
2868	u_char *buf, *r, *p;
2869	struct ifnet *ifp = &sp->pp_if;
2870	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
2871	u_long hisaddr, desiredaddr;
2872	int gotmyaddr = 0;
2873	int desiredcomp;
2874
2875	len -= 4;
2876	origlen = len;
2877	/*
2878	 * Make sure to allocate a buf that can at least hold a
2879	 * conf-nak with an `address' option.  We might need it below.
2880	 */
2881	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
2882	if (! buf)
2883		return (0);
2884
2885	/* pass 1: see if we can recognize them */
2886	if (debug)
2887		log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
2888		    SPP_ARGS(ifp));
2889	p = (void*) (h+1);
2890	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2891		if (debug)
2892			log(-1, " %s ", sppp_ipcp_opt_name(*p));
2893		switch (*p) {
2894		case IPCP_OPT_COMPRESSION:
2895			if (!sp->enable_vj) {
2896				/* VJ compression administratively disabled */
2897				if (debug)
2898					log(-1, "[locally disabled] ");
2899				break;
2900			}
2901			/*
2902			 * In theory, we should only conf-rej an
2903			 * option that is shorter than RFC 1618
2904			 * requires (i.e. < 4), and should conf-nak
2905			 * anything else that is not VJ.  However,
2906			 * since our algorithm always uses the
2907			 * original option to NAK it with new values,
2908			 * things would become more complicated.  In
2909			 * pratice, the only commonly implemented IP
2910			 * compression option is VJ anyway, so the
2911			 * difference is negligible.
2912			 */
2913			if (len >= 6 && p[1] == 6) {
2914				/*
2915				 * correctly formed compression option
2916				 * that could be VJ compression
2917				 */
2918				continue;
2919			}
2920			if (debug)
2921				log(-1,
2922				    "optlen %d [invalid/unsupported] ",
2923				    p[1]);
2924			break;
2925		case IPCP_OPT_ADDRESS:
2926			if (len >= 6 && p[1] == 6) {
2927				/* correctly formed address option */
2928				continue;
2929			}
2930			if (debug)
2931				log(-1, "[invalid] ");
2932			break;
2933		default:
2934			/* Others not supported. */
2935			if (debug)
2936				log(-1, "[rej] ");
2937			break;
2938		}
2939		/* Add the option to rejected list. */
2940		bcopy (p, r, p[1]);
2941		r += p[1];
2942		rlen += p[1];
2943	}
2944	if (rlen) {
2945		if (debug)
2946			log(-1, " send conf-rej\n");
2947		sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
2948		return 0;
2949	} else if (debug)
2950		log(-1, "\n");
2951
2952	/* pass 2: parse option values */
2953	sppp_get_ip_addrs(sp, 0, &hisaddr, 0);
2954	if (debug)
2955		log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
2956		       SPP_ARGS(ifp));
2957	p = (void*) (h+1);
2958	len = origlen;
2959	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2960		if (debug)
2961			log(-1, " %s ", sppp_ipcp_opt_name(*p));
2962		switch (*p) {
2963		case IPCP_OPT_COMPRESSION:
2964			desiredcomp = p[2] << 8 | p[3];
2965			/* We only support VJ */
2966			if (desiredcomp == IPCP_COMP_VJ) {
2967				if (debug)
2968					log(-1, "VJ [ack] ");
2969				sp->ipcp.flags |= IPCP_VJ;
2970				sl_compress_init(sp->pp_comp, p[4]);
2971				sp->ipcp.max_state = p[4];
2972				sp->ipcp.compress_cid = p[5];
2973				continue;
2974			}
2975			if (debug)
2976				log(-1,
2977				    "compproto %#04x [not supported] ",
2978				    desiredcomp);
2979			p[2] = IPCP_COMP_VJ >> 8;
2980			p[3] = IPCP_COMP_VJ;
2981			p[4] = sp->ipcp.max_state;
2982			p[5] = sp->ipcp.compress_cid;
2983			break;
2984		case IPCP_OPT_ADDRESS:
2985			/* This is the address he wants in his end */
2986			desiredaddr = p[2] << 24 | p[3] << 16 |
2987				p[4] << 8 | p[5];
2988			if (desiredaddr == hisaddr ||
2989			    (hisaddr >= 1 && hisaddr <= 254 && desiredaddr != 0)) {
2990				/*
2991				 * Peer's address is same as our value,
2992				 * or we have set it to 0.0.0.* to
2993				 * indicate that we do not really care,
2994				 * this is agreeable.  Gonna conf-ack
2995				 * it.
2996				 */
2997				if (debug)
2998					log(-1, "%s [ack] ",
2999						sppp_dotted_quad(hisaddr));
3000				/* record that we've seen it already */
3001				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
3002				continue;
3003			}
3004			/*
3005			 * The address wasn't agreeable.  This is either
3006			 * he sent us 0.0.0.0, asking to assign him an
3007			 * address, or he send us another address not
3008			 * matching our value.  Either case, we gonna
3009			 * conf-nak it with our value.
3010			 * XXX: we should "rej" if hisaddr == 0
3011			 */
3012			if (debug) {
3013				if (desiredaddr == 0)
3014					log(-1, "[addr requested] ");
3015				else
3016					log(-1, "%s [not agreed] ",
3017						sppp_dotted_quad(desiredaddr));
3018
3019			}
3020			p[2] = hisaddr >> 24;
3021			p[3] = hisaddr >> 16;
3022			p[4] = hisaddr >> 8;
3023			p[5] = hisaddr;
3024			break;
3025		}
3026		/* Add the option to nak'ed list. */
3027		bcopy (p, r, p[1]);
3028		r += p[1];
3029		rlen += p[1];
3030	}
3031
3032	/*
3033	 * If we are about to conf-ack the request, but haven't seen
3034	 * his address so far, gonna conf-nak it instead, with the
3035	 * `address' option present and our idea of his address being
3036	 * filled in there, to request negotiation of both addresses.
3037	 *
3038	 * XXX This can result in an endless req - nak loop if peer
3039	 * doesn't want to send us his address.  Q: What should we do
3040	 * about it?  XXX  A: implement the max-failure counter.
3041	 */
3042	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN) && !gotmyaddr) {
3043		buf[0] = IPCP_OPT_ADDRESS;
3044		buf[1] = 6;
3045		buf[2] = hisaddr >> 24;
3046		buf[3] = hisaddr >> 16;
3047		buf[4] = hisaddr >> 8;
3048		buf[5] = hisaddr;
3049		rlen = 6;
3050		if (debug)
3051			log(-1, "still need hisaddr ");
3052	}
3053
3054	if (rlen) {
3055		if (debug)
3056			log(-1, " send conf-nak\n");
3057		sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
3058	} else {
3059		if (debug)
3060			log(-1, " send conf-ack\n");
3061		sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
3062			      h->ident, origlen, h+1);
3063	}
3064
3065	free (buf, M_TEMP);
3066	return (rlen == 0);
3067}
3068
3069/*
3070 * Analyze the IPCP Configure-Reject option list, and adjust our
3071 * negotiation.
3072 */
3073static void
3074sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3075{
3076	u_char *buf, *p;
3077	struct ifnet *ifp = &sp->pp_if;
3078	int debug = ifp->if_flags & IFF_DEBUG;
3079
3080	len -= 4;
3081	buf = malloc (len, M_TEMP, M_NOWAIT);
3082	if (!buf)
3083		return;
3084
3085	if (debug)
3086		log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
3087		    SPP_ARGS(ifp));
3088
3089	p = (void*) (h+1);
3090	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3091		if (debug)
3092			log(-1, " %s ", sppp_ipcp_opt_name(*p));
3093		switch (*p) {
3094		case IPCP_OPT_COMPRESSION:
3095			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESSION);
3096			break;
3097		case IPCP_OPT_ADDRESS:
3098			/*
3099			 * Peer doesn't grok address option.  This is
3100			 * bad.  XXX  Should we better give up here?
3101			 * XXX We could try old "addresses" option...
3102			 */
3103			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
3104			break;
3105		}
3106	}
3107	if (debug)
3108		log(-1, "\n");
3109	free (buf, M_TEMP);
3110	return;
3111}
3112
3113/*
3114 * Analyze the IPCP Configure-NAK option list, and adjust our
3115 * negotiation.
3116 */
3117static void
3118sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3119{
3120	u_char *buf, *p;
3121	struct ifnet *ifp = &sp->pp_if;
3122	int debug = ifp->if_flags & IFF_DEBUG;
3123	int desiredcomp;
3124	u_long wantaddr;
3125
3126	len -= 4;
3127	buf = malloc (len, M_TEMP, M_NOWAIT);
3128	if (!buf)
3129		return;
3130
3131	if (debug)
3132		log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
3133		    SPP_ARGS(ifp));
3134
3135	p = (void*) (h+1);
3136	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3137		if (debug)
3138			log(-1, " %s ", sppp_ipcp_opt_name(*p));
3139		switch (*p) {
3140		case IPCP_OPT_COMPRESSION:
3141			if (len >= 6 && p[1] == 6) {
3142				desiredcomp = p[2] << 8 | p[3];
3143				if (debug)
3144					log(-1, "[wantcomp %#04x] ",
3145						desiredcomp);
3146				if (desiredcomp == IPCP_COMP_VJ) {
3147					sl_compress_init(sp->pp_comp, p[4]);
3148					sp->ipcp.max_state = p[4];
3149					sp->ipcp.compress_cid = p[5];
3150					if (debug)
3151						log(-1, "[agree] ");
3152				} else
3153					sp->ipcp.opts &=
3154						~(1 << IPCP_OPT_COMPRESSION);
3155			}
3156			break;
3157		case IPCP_OPT_ADDRESS:
3158			/*
3159			 * Peer doesn't like our local IP address.  See
3160			 * if we can do something for him.  We'll drop
3161			 * him our address then.
3162			 */
3163			if (len >= 6 && p[1] == 6) {
3164				wantaddr = p[2] << 24 | p[3] << 16 |
3165					p[4] << 8 | p[5];
3166				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
3167				if (debug)
3168					log(-1, "[wantaddr %s] ",
3169					       sppp_dotted_quad(wantaddr));
3170				/*
3171				 * When doing dynamic address assignment,
3172				 * we accept his offer.  Otherwise, we
3173				 * ignore it and thus continue to negotiate
3174				 * our already existing value.
3175			 	 * XXX: Bogus, if he said no once, he'll
3176				 * just say no again, might as well die.
3177				 */
3178				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
3179					sppp_set_ip_addr(sp, wantaddr);
3180					if (debug)
3181						log(-1, "[agree] ");
3182					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
3183				}
3184			}
3185			break;
3186		}
3187	}
3188	if (debug)
3189		log(-1, "\n");
3190	free (buf, M_TEMP);
3191	return;
3192}
3193
3194static void
3195sppp_ipcp_tlu(struct sppp *sp)
3196{
3197	/* we are up - notify isdn daemon */
3198	if (sp->pp_con)
3199		sp->pp_con(sp);
3200}
3201
3202static void
3203sppp_ipcp_tld(struct sppp *sp)
3204{
3205}
3206
3207static void
3208sppp_ipcp_tls(struct sppp *sp)
3209{
3210	/* indicate to LCP that it must stay alive */
3211	sp->lcp.protos |= (1 << IDX_IPCP);
3212}
3213
3214static void
3215sppp_ipcp_tlf(struct sppp *sp)
3216{
3217	/* we no longer need LCP */
3218	sp->lcp.protos &= ~(1 << IDX_IPCP);
3219	sppp_lcp_check_and_close(sp);
3220}
3221
3222static void
3223sppp_ipcp_scr(struct sppp *sp)
3224{
3225	char opt[6 /* compression */ + 6 /* address */];
3226	u_long ouraddr;
3227	int i = 0;
3228
3229	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
3230		opt[i++] = IPCP_OPT_COMPRESSION;
3231		opt[i++] = 6;
3232		opt[i++] = IPCP_COMP_VJ >> 8;
3233		opt[i++] = IPCP_COMP_VJ;
3234		opt[i++] = sp->ipcp.max_state;
3235		opt[i++] = sp->ipcp.compress_cid;
3236	}
3237	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
3238		sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
3239		opt[i++] = IPCP_OPT_ADDRESS;
3240		opt[i++] = 6;
3241		opt[i++] = ouraddr >> 24;
3242		opt[i++] = ouraddr >> 16;
3243		opt[i++] = ouraddr >> 8;
3244		opt[i++] = ouraddr;
3245	}
3246
3247	sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
3248	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
3249}
3250
3251/*
3252 *--------------------------------------------------------------------------*
3253 *                                                                          *
3254 *                      The IPv6CP implementation.                          *
3255 *                                                                          *
3256 *--------------------------------------------------------------------------*
3257 */
3258
3259#ifdef INET6
3260static void
3261sppp_ipv6cp_init(struct sppp *sp)
3262{
3263	sp->ipv6cp.opts = 0;
3264	sp->ipv6cp.flags = 0;
3265	sp->state[IDX_IPV6CP] = STATE_INITIAL;
3266	sp->fail_counter[IDX_IPV6CP] = 0;
3267	sp->pp_seq[IDX_IPV6CP] = 0;
3268	sp->pp_rseq[IDX_IPV6CP] = 0;
3269#if defined(__NetBSD__)
3270	callout_init(&sp->ch[IDX_IPV6CP]);
3271#endif
3272#if defined(__FreeBSD__) && __FreeBSD__ >= 3
3273	callout_handle_init(&sp->ch[IDX_IPV6CP]);
3274#endif
3275}
3276
3277static void
3278sppp_ipv6cp_up(struct sppp *sp)
3279{
3280	sppp_up_event(&ipv6cp, sp);
3281}
3282
3283static void
3284sppp_ipv6cp_down(struct sppp *sp)
3285{
3286	sppp_down_event(&ipv6cp, sp);
3287}
3288
3289static void
3290sppp_ipv6cp_open(struct sppp *sp)
3291{
3292	STDDCL;
3293	struct in6_addr myaddr, hisaddr;
3294
3295#ifdef IPV6CP_MYIFID_DYN
3296	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
3297#else
3298	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
3299#endif
3300
3301	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
3302	/*
3303	 * If we don't have our address, this probably means our
3304	 * interface doesn't want to talk IPv6 at all.  (This could
3305	 * be the case if somebody wants to speak only IPX, for
3306	 * example.)  Don't open IPv6CP in this case.
3307	 */
3308	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
3309		/* XXX this message should go away */
3310		if (debug)
3311			log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n",
3312			    SPP_ARGS(ifp));
3313		return;
3314	}
3315
3316	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3317	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3318	sppp_open_event(&ipv6cp, sp);
3319}
3320
3321static void
3322sppp_ipv6cp_close(struct sppp *sp)
3323{
3324	sppp_close_event(&ipv6cp, sp);
3325}
3326
3327static void
3328sppp_ipv6cp_TO(void *cookie)
3329{
3330	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
3331}
3332
3333/*
3334 * Analyze a configure request.  Return true if it was agreeable, and
3335 * caused action sca, false if it has been rejected or nak'ed, and
3336 * caused action scn.  (The return value is used to make the state
3337 * transition decision in the state automaton.)
3338 */
3339static int
3340sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3341{
3342	u_char *buf, *r, *p;
3343	struct ifnet *ifp = &sp->pp_if;
3344	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
3345	struct in6_addr myaddr, desiredaddr, suggestaddr;
3346	int ifidcount;
3347	int type;
3348	int collision, nohisaddr;
3349
3350	len -= 4;
3351	origlen = len;
3352	/*
3353	 * Make sure to allocate a buf that can at least hold a
3354	 * conf-nak with an `address' option.  We might need it below.
3355	 */
3356	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
3357	if (! buf)
3358		return (0);
3359
3360	/* pass 1: see if we can recognize them */
3361	if (debug)
3362		log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:",
3363		    SPP_ARGS(ifp));
3364	p = (void*) (h+1);
3365	ifidcount = 0;
3366	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3367		if (debug)
3368			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3369		switch (*p) {
3370		case IPV6CP_OPT_IFID:
3371			if (len >= 10 && p[1] == 10 && ifidcount == 0) {
3372				/* correctly formed address option */
3373				ifidcount++;
3374				continue;
3375			}
3376			if (debug)
3377				log(-1, " [invalid]");
3378			break;
3379#ifdef notyet
3380		case IPV6CP_OPT_COMPRESSION:
3381			if (len >= 4 && p[1] >= 4) {
3382				/* correctly formed compress option */
3383				continue;
3384			}
3385			if (debug)
3386				log(-1, " [invalid]");
3387			break;
3388#endif
3389		default:
3390			/* Others not supported. */
3391			if (debug)
3392				log(-1, " [rej]");
3393			break;
3394		}
3395		/* Add the option to rejected list. */
3396		bcopy (p, r, p[1]);
3397		r += p[1];
3398		rlen += p[1];
3399	}
3400	if (rlen) {
3401		if (debug)
3402			log(-1, " send conf-rej\n");
3403		sppp_cp_send (sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
3404		goto end;
3405	} else if (debug)
3406		log(-1, "\n");
3407
3408	/* pass 2: parse option values */
3409	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
3410	if (debug)
3411		log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ",
3412		    SPP_ARGS(ifp));
3413	p = (void*) (h+1);
3414	len = origlen;
3415	type = CONF_ACK;
3416	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3417		if (debug)
3418			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3419		switch (*p) {
3420#ifdef notyet
3421		case IPV6CP_OPT_COMPRESSION:
3422			continue;
3423#endif
3424		case IPV6CP_OPT_IFID:
3425			bzero(&desiredaddr, sizeof(desiredaddr));
3426			bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
3427			collision = (bcmp(&desiredaddr.s6_addr[8],
3428					  &myaddr.s6_addr[8], 8) == 0);
3429			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
3430
3431			desiredaddr.s6_addr16[0] = htons(0xfe80);
3432			desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
3433
3434			if (!collision && !nohisaddr) {
3435				/* no collision, hisaddr known - Conf-Ack */
3436				type = CONF_ACK;
3437
3438				if (debug) {
3439					log(-1, " %s [%s]",
3440					       ip6_sprintf(&desiredaddr),
3441					       sppp_cp_type_name(type));
3442				}
3443				continue;
3444			}
3445
3446			bzero(&suggestaddr, sizeof(&suggestaddr));
3447			if (collision && nohisaddr) {
3448				/* collision, hisaddr unknown - Conf-Rej */
3449				type = CONF_REJ;
3450				bzero(&p[2], 8);
3451			} else {
3452				/*
3453				 * - no collision, hisaddr unknown, or
3454				 * - collision, hisaddr known
3455				 * Conf-Nak, suggest hisaddr
3456				 */
3457				type = CONF_NAK;
3458				sppp_suggest_ip6_addr(sp, &suggestaddr);
3459				bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
3460			}
3461			if (debug)
3462				log(-1, " %s [%s]", ip6_sprintf(&desiredaddr),
3463				       sppp_cp_type_name(type));
3464			break;
3465		}
3466		/* Add the option to nak'ed list. */
3467		bcopy (p, r, p[1]);
3468		r += p[1];
3469		rlen += p[1];
3470	}
3471
3472	if (rlen == 0 && type == CONF_ACK) {
3473		if (debug)
3474			log(-1, " send %s\n", sppp_cp_type_name(type));
3475		sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, origlen, h+1);
3476	} else {
3477#ifdef DIAGNOSTIC
3478		if (type == CONF_ACK)
3479			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
3480#endif
3481
3482		if (debug) {
3483			log(-1, " send %s suggest %s\n",
3484			       sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
3485		}
3486		sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, rlen, buf);
3487	}
3488
3489 end:
3490	free (buf, M_TEMP);
3491	return (rlen == 0);
3492}
3493
3494/*
3495 * Analyze the IPv6CP Configure-Reject option list, and adjust our
3496 * negotiation.
3497 */
3498static void
3499sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3500{
3501	u_char *buf, *p;
3502	struct ifnet *ifp = &sp->pp_if;
3503	int debug = ifp->if_flags & IFF_DEBUG;
3504
3505	len -= 4;
3506	buf = malloc (len, M_TEMP, M_NOWAIT);
3507	if (!buf)
3508		return;
3509
3510	if (debug)
3511		log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:",
3512		    SPP_ARGS(ifp));
3513
3514	p = (void*) (h+1);
3515	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3516		if (debug)
3517			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3518		switch (*p) {
3519		case IPV6CP_OPT_IFID:
3520			/*
3521			 * Peer doesn't grok address option.  This is
3522			 * bad.  XXX  Should we better give up here?
3523			 */
3524			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
3525			break;
3526#ifdef notyet
3527		case IPV6CP_OPT_COMPRESS:
3528			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
3529			break;
3530#endif
3531		}
3532	}
3533	if (debug)
3534		log(-1, "\n");
3535	free (buf, M_TEMP);
3536	return;
3537}
3538
3539/*
3540 * Analyze the IPv6CP Configure-NAK option list, and adjust our
3541 * negotiation.
3542 */
3543static void
3544sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3545{
3546	u_char *buf, *p;
3547	struct ifnet *ifp = &sp->pp_if;
3548	int debug = ifp->if_flags & IFF_DEBUG;
3549	struct in6_addr suggestaddr;
3550
3551	len -= 4;
3552	buf = malloc (len, M_TEMP, M_NOWAIT);
3553	if (!buf)
3554		return;
3555
3556	if (debug)
3557		log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:",
3558		    SPP_ARGS(ifp));
3559
3560	p = (void*) (h+1);
3561	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3562		if (debug)
3563			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3564		switch (*p) {
3565		case IPV6CP_OPT_IFID:
3566			/*
3567			 * Peer doesn't like our local ifid.  See
3568			 * if we can do something for him.  We'll drop
3569			 * him our address then.
3570			 */
3571			if (len < 10 || p[1] != 10)
3572				break;
3573			bzero(&suggestaddr, sizeof(suggestaddr));
3574			suggestaddr.s6_addr16[0] = htons(0xfe80);
3575			suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
3576			bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
3577
3578			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3579			if (debug)
3580				log(-1, " [suggestaddr %s]",
3581				       ip6_sprintf(&suggestaddr));
3582#ifdef IPV6CP_MYIFID_DYN
3583			/*
3584			 * When doing dynamic address assignment,
3585			 * we accept his offer.
3586			 */
3587			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
3588				struct in6_addr lastsuggest;
3589				/*
3590				 * If <suggested myaddr from peer> equals to
3591				 * <hisaddr we have suggested last time>,
3592				 * we have a collision.  generate new random
3593				 * ifid.
3594				 */
3595				sppp_suggest_ip6_addr(&lastsuggest);
3596				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
3597						       lastsuggest)) {
3598					if (debug)
3599						log(-1, " [random]");
3600					sppp_gen_ip6_addr(sp, &suggestaddr);
3601				}
3602				sppp_set_ip6_addr(sp, &suggestaddr, 0);
3603				if (debug)
3604					log(-1, " [agree]");
3605				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3606			}
3607#else
3608			/*
3609			 * Since we do not do dynamic address assignment,
3610			 * we ignore it and thus continue to negotiate
3611			 * our already existing value.  This can possibly
3612			 * go into infinite request-reject loop.
3613			 *
3614			 * This is not likely because we normally use
3615			 * ifid based on MAC-address.
3616			 * If you have no ethernet card on the node, too bad.
3617			 * XXX should we use fail_counter?
3618			 */
3619#endif
3620			break;
3621#ifdef notyet
3622		case IPV6CP_OPT_COMPRESS:
3623			/*
3624			 * Peer wants different compression parameters.
3625			 */
3626			break;
3627#endif
3628		}
3629	}
3630	if (debug)
3631		log(-1, "\n");
3632	free (buf, M_TEMP);
3633	return;
3634}
3635static void
3636sppp_ipv6cp_tlu(struct sppp *sp)
3637{
3638	/* we are up - notify isdn daemon */
3639	if (sp->pp_con)
3640		sp->pp_con(sp);
3641}
3642
3643static void
3644sppp_ipv6cp_tld(struct sppp *sp)
3645{
3646}
3647
3648static void
3649sppp_ipv6cp_tls(struct sppp *sp)
3650{
3651	/* indicate to LCP that it must stay alive */
3652	sp->lcp.protos |= (1 << IDX_IPV6CP);
3653}
3654
3655static void
3656sppp_ipv6cp_tlf(struct sppp *sp)
3657{
3658
3659#if 0	/* need #if 0 to close IPv6CP properly */
3660	/* we no longer need LCP */
3661	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
3662	sppp_lcp_check_and_close(sp);
3663#endif
3664}
3665
3666static void
3667sppp_ipv6cp_scr(struct sppp *sp)
3668{
3669	char opt[10 /* ifid */ + 4 /* compression, minimum */];
3670	struct in6_addr ouraddr;
3671	int i = 0;
3672
3673	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
3674		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
3675		opt[i++] = IPV6CP_OPT_IFID;
3676		opt[i++] = 10;
3677		bcopy(&ouraddr.s6_addr[8], &opt[i], 8);
3678		i += 8;
3679	}
3680
3681#ifdef notyet
3682	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
3683		opt[i++] = IPV6CP_OPT_COMPRESSION;
3684		opt[i++] = 4;
3685		opt[i++] = 0;   /* TBD */
3686		opt[i++] = 0;   /* TBD */
3687		/* variable length data may follow */
3688	}
3689#endif
3690
3691	sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP];
3692	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt);
3693}
3694#else /*INET6*/
3695static void sppp_ipv6cp_init(struct sppp *sp)
3696{
3697}
3698
3699static void sppp_ipv6cp_up(struct sppp *sp)
3700{
3701}
3702
3703static void sppp_ipv6cp_down(struct sppp *sp)
3704{
3705}
3706
3707
3708static void sppp_ipv6cp_open(struct sppp *sp)
3709{
3710}
3711
3712static void sppp_ipv6cp_close(struct sppp *sp)
3713{
3714}
3715
3716static void sppp_ipv6cp_TO(void *sp)
3717{
3718}
3719
3720static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3721{
3722	return 0;
3723}
3724
3725static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3726{
3727}
3728
3729static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3730{
3731}
3732
3733static void sppp_ipv6cp_tlu(struct sppp *sp)
3734{
3735}
3736
3737static void sppp_ipv6cp_tld(struct sppp *sp)
3738{
3739}
3740
3741static void sppp_ipv6cp_tls(struct sppp *sp)
3742{
3743}
3744
3745static void sppp_ipv6cp_tlf(struct sppp *sp)
3746{
3747}
3748
3749static void sppp_ipv6cp_scr(struct sppp *sp)
3750{
3751}
3752#endif /*INET6*/
3753
3754/*
3755 *--------------------------------------------------------------------------*
3756 *                                                                          *
3757 *                        The CHAP implementation.                          *
3758 *                                                                          *
3759 *--------------------------------------------------------------------------*
3760 */
3761
3762/*
3763 * The authentication protocols don't employ a full-fledged state machine as
3764 * the control protocols do, since they do have Open and Close events, but
3765 * not Up and Down, nor are they explicitly terminated.  Also, use of the
3766 * authentication protocols may be different in both directions (this makes
3767 * sense, think of a machine that never accepts incoming calls but only
3768 * calls out, it doesn't require the called party to authenticate itself).
3769 *
3770 * Our state machine for the local authentication protocol (we are requesting
3771 * the peer to authenticate) looks like:
3772 *
3773 *						    RCA-
3774 *	      +--------------------------------------------+
3775 *	      V					    scn,tld|
3776 *	  +--------+			       Close   +---------+ RCA+
3777 *	  |	   |<----------------------------------|	 |------+
3778 *   +--->| Closed |				TO*    | Opened	 | sca	|
3779 *   |	  |	   |-----+		       +-------|	 |<-----+
3780 *   |	  +--------+ irc |		       |       +---------+
3781 *   |	    ^		 |		       |	   ^
3782 *   |	    |		 |		       |	   |
3783 *   |	    |		 |		       |	   |
3784 *   |	 TO-|		 |		       |	   |
3785 *   |	    |tld  TO+	 V		       |	   |
3786 *   |	    |	+------->+		       |	   |
3787 *   |	    |	|	 |		       |	   |
3788 *   |	  +--------+	 V		       |	   |
3789 *   |	  |	   |<----+<--------------------+	   |
3790 *   |	  | Req-   | scr				   |
3791 *   |	  | Sent   |					   |
3792 *   |	  |	   |					   |
3793 *   |	  +--------+					   |
3794 *   | RCA- |	| RCA+					   |
3795 *   +------+	+------------------------------------------+
3796 *   scn,tld	  sca,irc,ict,tlu
3797 *
3798 *
3799 *   with:
3800 *
3801 *	Open:	LCP reached authentication phase
3802 *	Close:	LCP reached terminate phase
3803 *
3804 *	RCA+:	received reply (pap-req, chap-response), acceptable
3805 *	RCN:	received reply (pap-req, chap-response), not acceptable
3806 *	TO+:	timeout with restart counter >= 0
3807 *	TO-:	timeout with restart counter < 0
3808 *	TO*:	reschedule timeout for CHAP
3809 *
3810 *	scr:	send request packet (none for PAP, chap-challenge)
3811 *	sca:	send ack packet (pap-ack, chap-success)
3812 *	scn:	send nak packet (pap-nak, chap-failure)
3813 *	ict:	initialize re-challenge timer (CHAP only)
3814 *
3815 *	tlu:	this-layer-up, LCP reaches network phase
3816 *	tld:	this-layer-down, LCP enters terminate phase
3817 *
3818 * Note that in CHAP mode, after sending a new challenge, while the state
3819 * automaton falls back into Req-Sent state, it doesn't signal a tld
3820 * event to LCP, so LCP remains in network phase.  Only after not getting
3821 * any response (or after getting an unacceptable response), CHAP closes,
3822 * causing LCP to enter terminate phase.
3823 *
3824 * With PAP, there is no initial request that can be sent.  The peer is
3825 * expected to send one based on the successful negotiation of PAP as
3826 * the authentication protocol during the LCP option negotiation.
3827 *
3828 * Incoming authentication protocol requests (remote requests
3829 * authentication, we are peer) don't employ a state machine at all,
3830 * they are simply answered.  Some peers [Ascend P50 firmware rev
3831 * 4.50] react allergically when sending IPCP requests while they are
3832 * still in authentication phase (thereby violating the standard that
3833 * demands that these NCP packets are to be discarded), so we keep
3834 * track of the peer demanding us to authenticate, and only proceed to
3835 * phase network once we've seen a positive acknowledge for the
3836 * authentication.
3837 */
3838
3839/*
3840 * Handle incoming CHAP packets.
3841 */
3842void
3843sppp_chap_input(struct sppp *sp, struct mbuf *m)
3844{
3845	STDDCL;
3846	struct lcp_header *h;
3847	int len, x;
3848	u_char *value, *name, digest[AUTHKEYLEN], dsize;
3849	int value_len, name_len;
3850	MD5_CTX ctx;
3851
3852	len = m->m_pkthdr.len;
3853	if (len < 4) {
3854		if (debug)
3855			log(LOG_DEBUG,
3856			    SPP_FMT "chap invalid packet length: %d bytes\n",
3857			    SPP_ARGS(ifp), len);
3858		return;
3859	}
3860	h = mtod (m, struct lcp_header*);
3861	if (len > ntohs (h->len))
3862		len = ntohs (h->len);
3863
3864	switch (h->type) {
3865	/* challenge, failure and success are his authproto */
3866	case CHAP_CHALLENGE:
3867		value = 1 + (u_char*)(h+1);
3868		value_len = value[-1];
3869		name = value + value_len;
3870		name_len = len - value_len - 5;
3871		if (name_len < 0) {
3872			if (debug) {
3873				log(LOG_DEBUG,
3874				    SPP_FMT "chap corrupted challenge "
3875				    "<%s id=0x%x len=%d",
3876				    SPP_ARGS(ifp),
3877				    sppp_auth_type_name(PPP_CHAP, h->type),
3878				    h->ident, ntohs(h->len));
3879				sppp_print_bytes((u_char*) (h+1), len-4);
3880				log(-1, ">\n");
3881			}
3882			break;
3883		}
3884
3885		if (debug) {
3886			log(LOG_DEBUG,
3887			    SPP_FMT "chap input <%s id=0x%x len=%d name=",
3888			    SPP_ARGS(ifp),
3889			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
3890			    ntohs(h->len));
3891			sppp_print_string((char*) name, name_len);
3892			log(-1, " value-size=%d value=", value_len);
3893			sppp_print_bytes(value, value_len);
3894			log(-1, ">\n");
3895		}
3896
3897		/* Compute reply value. */
3898		MD5Init(&ctx);
3899		MD5Update(&ctx, &h->ident, 1);
3900		MD5Update(&ctx, sp->myauth.secret,
3901			  sppp_strnlen(sp->myauth.secret, AUTHKEYLEN));
3902		MD5Update(&ctx, value, value_len);
3903		MD5Final(digest, &ctx);
3904		dsize = sizeof digest;
3905
3906		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
3907			       sizeof dsize, (const char *)&dsize,
3908			       sizeof digest, digest,
3909			       (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
3910			       sp->myauth.name,
3911			       0);
3912		break;
3913
3914	case CHAP_SUCCESS:
3915		if (debug) {
3916			log(LOG_DEBUG, SPP_FMT "chap success",
3917			    SPP_ARGS(ifp));
3918			if (len > 4) {
3919				log(-1, ": ");
3920				sppp_print_string((char*)(h + 1), len - 4);
3921			}
3922			log(-1, "\n");
3923		}
3924		x = splimp();
3925		sp->pp_flags &= ~PP_NEEDAUTH;
3926		if (sp->myauth.proto == PPP_CHAP &&
3927		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3928		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
3929			/*
3930			 * We are authenticator for CHAP but didn't
3931			 * complete yet.  Leave it to tlu to proceed
3932			 * to network phase.
3933			 */
3934			splx(x);
3935			break;
3936		}
3937		splx(x);
3938		sppp_phase_network(sp);
3939		break;
3940
3941	case CHAP_FAILURE:
3942		if (debug) {
3943			log(LOG_INFO, SPP_FMT "chap failure",
3944			    SPP_ARGS(ifp));
3945			if (len > 4) {
3946				log(-1, ": ");
3947				sppp_print_string((char*)(h + 1), len - 4);
3948			}
3949			log(-1, "\n");
3950		} else
3951			log(LOG_INFO, SPP_FMT "chap failure\n",
3952			    SPP_ARGS(ifp));
3953		/* await LCP shutdown by authenticator */
3954		break;
3955
3956	/* response is my authproto */
3957	case CHAP_RESPONSE:
3958		value = 1 + (u_char*)(h+1);
3959		value_len = value[-1];
3960		name = value + value_len;
3961		name_len = len - value_len - 5;
3962		if (name_len < 0) {
3963			if (debug) {
3964				log(LOG_DEBUG,
3965				    SPP_FMT "chap corrupted response "
3966				    "<%s id=0x%x len=%d",
3967				    SPP_ARGS(ifp),
3968				    sppp_auth_type_name(PPP_CHAP, h->type),
3969				    h->ident, ntohs(h->len));
3970				sppp_print_bytes((u_char*)(h+1), len-4);
3971				log(-1, ">\n");
3972			}
3973			break;
3974		}
3975		if (h->ident != sp->confid[IDX_CHAP]) {
3976			if (debug)
3977				log(LOG_DEBUG,
3978				    SPP_FMT "chap dropping response for old ID "
3979				    "(got %d, expected %d)\n",
3980				    SPP_ARGS(ifp),
3981				    h->ident, sp->confid[IDX_CHAP]);
3982			break;
3983		}
3984		if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN)
3985		    || bcmp(name, sp->hisauth.name, name_len) != 0) {
3986			log(LOG_INFO, SPP_FMT "chap response, his name ",
3987			    SPP_ARGS(ifp));
3988			sppp_print_string(name, name_len);
3989			log(-1, " != expected ");
3990			sppp_print_string(sp->hisauth.name,
3991					  sppp_strnlen(sp->hisauth.name, AUTHNAMELEN));
3992			log(-1, "\n");
3993		}
3994		if (debug) {
3995			log(LOG_DEBUG, SPP_FMT "chap input(%s) "
3996			    "<%s id=0x%x len=%d name=",
3997			    SPP_ARGS(ifp),
3998			    sppp_state_name(sp->state[IDX_CHAP]),
3999			    sppp_auth_type_name(PPP_CHAP, h->type),
4000			    h->ident, ntohs (h->len));
4001			sppp_print_string((char*)name, name_len);
4002			log(-1, " value-size=%d value=", value_len);
4003			sppp_print_bytes(value, value_len);
4004			log(-1, ">\n");
4005		}
4006		if (value_len != AUTHKEYLEN) {
4007			if (debug)
4008				log(LOG_DEBUG,
4009				    SPP_FMT "chap bad hash value length: "
4010				    "%d bytes, should be %d\n",
4011				    SPP_ARGS(ifp), value_len,
4012				    AUTHKEYLEN);
4013			break;
4014		}
4015
4016		MD5Init(&ctx);
4017		MD5Update(&ctx, &h->ident, 1);
4018		MD5Update(&ctx, sp->hisauth.secret,
4019			  sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN));
4020		MD5Update(&ctx, sp->myauth.challenge, AUTHKEYLEN);
4021		MD5Final(digest, &ctx);
4022
4023#define FAILMSG "Failed..."
4024#define SUCCMSG "Welcome!"
4025
4026		if (value_len != sizeof digest ||
4027		    bcmp(digest, value, value_len) != 0) {
4028			/* action scn, tld */
4029			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
4030				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
4031				       0);
4032			chap.tld(sp);
4033			break;
4034		}
4035		/* action sca, perhaps tlu */
4036		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
4037		    sp->state[IDX_CHAP] == STATE_OPENED)
4038			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
4039				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
4040				       0);
4041		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
4042			sppp_cp_change_state(&chap, sp, STATE_OPENED);
4043			chap.tlu(sp);
4044		}
4045		break;
4046
4047	default:
4048		/* Unknown CHAP packet type -- ignore. */
4049		if (debug) {
4050			log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
4051			    "<0x%x id=0x%xh len=%d",
4052			    SPP_ARGS(ifp),
4053			    sppp_state_name(sp->state[IDX_CHAP]),
4054			    h->type, h->ident, ntohs(h->len));
4055			sppp_print_bytes((u_char*)(h+1), len-4);
4056			log(-1, ">\n");
4057		}
4058		break;
4059
4060	}
4061}
4062
4063static void
4064sppp_chap_init(struct sppp *sp)
4065{
4066	/* Chap doesn't have STATE_INITIAL at all. */
4067	sp->state[IDX_CHAP] = STATE_CLOSED;
4068	sp->fail_counter[IDX_CHAP] = 0;
4069	sp->pp_seq[IDX_CHAP] = 0;
4070	sp->pp_rseq[IDX_CHAP] = 0;
4071#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4072	callout_handle_init(&sp->ch[IDX_CHAP]);
4073#endif
4074}
4075
4076static void
4077sppp_chap_open(struct sppp *sp)
4078{
4079	if (sp->myauth.proto == PPP_CHAP &&
4080	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
4081		/* we are authenticator for CHAP, start it */
4082		chap.scr(sp);
4083		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4084		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
4085	}
4086	/* nothing to be done if we are peer, await a challenge */
4087}
4088
4089static void
4090sppp_chap_close(struct sppp *sp)
4091{
4092	if (sp->state[IDX_CHAP] != STATE_CLOSED)
4093		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
4094}
4095
4096static void
4097sppp_chap_TO(void *cookie)
4098{
4099	struct sppp *sp = (struct sppp *)cookie;
4100	STDDCL;
4101	int s;
4102
4103	s = splimp();
4104	if (debug)
4105		log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
4106		    SPP_ARGS(ifp),
4107		    sppp_state_name(sp->state[IDX_CHAP]),
4108		    sp->rst_counter[IDX_CHAP]);
4109
4110	if (--sp->rst_counter[IDX_CHAP] < 0)
4111		/* TO- event */
4112		switch (sp->state[IDX_CHAP]) {
4113		case STATE_REQ_SENT:
4114			chap.tld(sp);
4115			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
4116			break;
4117		}
4118	else
4119		/* TO+ (or TO*) event */
4120		switch (sp->state[IDX_CHAP]) {
4121		case STATE_OPENED:
4122			/* TO* event */
4123			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4124			/* fall through */
4125		case STATE_REQ_SENT:
4126			chap.scr(sp);
4127			/* sppp_cp_change_state() will restart the timer */
4128			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
4129			break;
4130		}
4131
4132	splx(s);
4133}
4134
4135static void
4136sppp_chap_tlu(struct sppp *sp)
4137{
4138	STDDCL;
4139	int i, x;
4140
4141	i = 0;
4142	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4143
4144	/*
4145	 * Some broken CHAP implementations (Conware CoNet, firmware
4146	 * 4.0.?) don't want to re-authenticate their CHAP once the
4147	 * initial challenge-response exchange has taken place.
4148	 * Provide for an option to avoid rechallenges.
4149	 */
4150	if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) {
4151		/*
4152		 * Compute the re-challenge timeout.  This will yield
4153		 * a number between 300 and 810 seconds.
4154		 */
4155		i = 300 + ((unsigned)(random() & 0xff00) >> 7);
4156		TIMEOUT(chap.TO, (void *)sp, i * hz, sp->ch[IDX_CHAP]);
4157	}
4158
4159	if (debug) {
4160		log(LOG_DEBUG,
4161		    SPP_FMT "chap %s, ",
4162		    SPP_ARGS(ifp),
4163		    sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu");
4164		if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0)
4165			log(-1, "next re-challenge in %d seconds\n", i);
4166		else
4167			log(-1, "re-challenging supressed\n");
4168	}
4169
4170	x = splimp();
4171	/* indicate to LCP that we need to be closed down */
4172	sp->lcp.protos |= (1 << IDX_CHAP);
4173
4174	if (sp->pp_flags & PP_NEEDAUTH) {
4175		/*
4176		 * Remote is authenticator, but his auth proto didn't
4177		 * complete yet.  Defer the transition to network
4178		 * phase.
4179		 */
4180		splx(x);
4181		return;
4182	}
4183	splx(x);
4184
4185	/*
4186	 * If we are already in phase network, we are done here.  This
4187	 * is the case if this is a dummy tlu event after a re-challenge.
4188	 */
4189	if (sp->pp_phase != PHASE_NETWORK)
4190		sppp_phase_network(sp);
4191}
4192
4193static void
4194sppp_chap_tld(struct sppp *sp)
4195{
4196	STDDCL;
4197
4198	if (debug)
4199		log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
4200	UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]);
4201	sp->lcp.protos &= ~(1 << IDX_CHAP);
4202
4203	lcp.Close(sp);
4204}
4205
4206static void
4207sppp_chap_scr(struct sppp *sp)
4208{
4209	u_long *ch, seed;
4210	u_char clen;
4211
4212	/* Compute random challenge. */
4213	ch = (u_long *)sp->myauth.challenge;
4214#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4215	read_random(&seed, sizeof seed);
4216#else
4217	{
4218	struct timeval tv;
4219	microtime(&tv);
4220	seed = tv.tv_sec ^ tv.tv_usec;
4221	}
4222#endif
4223	ch[0] = seed ^ random();
4224	ch[1] = seed ^ random();
4225	ch[2] = seed ^ random();
4226	ch[3] = seed ^ random();
4227	clen = AUTHKEYLEN;
4228
4229	sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];
4230
4231	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
4232		       sizeof clen, (const char *)&clen,
4233		       (size_t)AUTHKEYLEN, sp->myauth.challenge,
4234		       (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
4235		       sp->myauth.name,
4236		       0);
4237}
4238
4239/*
4240 *--------------------------------------------------------------------------*
4241 *                                                                          *
4242 *                        The PAP implementation.                           *
4243 *                                                                          *
4244 *--------------------------------------------------------------------------*
4245 */
4246/*
4247 * For PAP, we need to keep a little state also if we are the peer, not the
4248 * authenticator.  This is since we don't get a request to authenticate, but
4249 * have to repeatedly authenticate ourself until we got a response (or the
4250 * retry counter is expired).
4251 */
4252
4253/*
4254 * Handle incoming PAP packets.  */
4255static void
4256sppp_pap_input(struct sppp *sp, struct mbuf *m)
4257{
4258	STDDCL;
4259	struct lcp_header *h;
4260	int len, x;
4261	u_char *name, *passwd, mlen;
4262	int name_len, passwd_len;
4263
4264	len = m->m_pkthdr.len;
4265	if (len < 5) {
4266		if (debug)
4267			log(LOG_DEBUG,
4268			    SPP_FMT "pap invalid packet length: %d bytes\n",
4269			    SPP_ARGS(ifp), len);
4270		return;
4271	}
4272	h = mtod (m, struct lcp_header*);
4273	if (len > ntohs (h->len))
4274		len = ntohs (h->len);
4275	switch (h->type) {
4276	/* PAP request is my authproto */
4277	case PAP_REQ:
4278		name = 1 + (u_char*)(h+1);
4279		name_len = name[-1];
4280		passwd = name + name_len + 1;
4281		if (name_len > len - 6 ||
4282		    (passwd_len = passwd[-1]) > len - 6 - name_len) {
4283			if (debug) {
4284				log(LOG_DEBUG, SPP_FMT "pap corrupted input "
4285				    "<%s id=0x%x len=%d",
4286				    SPP_ARGS(ifp),
4287				    sppp_auth_type_name(PPP_PAP, h->type),
4288				    h->ident, ntohs(h->len));
4289				sppp_print_bytes((u_char*)(h+1), len-4);
4290				log(-1, ">\n");
4291			}
4292			break;
4293		}
4294		if (debug) {
4295			log(LOG_DEBUG, SPP_FMT "pap input(%s) "
4296			    "<%s id=0x%x len=%d name=",
4297			    SPP_ARGS(ifp),
4298			    sppp_state_name(sp->state[IDX_PAP]),
4299			    sppp_auth_type_name(PPP_PAP, h->type),
4300			    h->ident, ntohs(h->len));
4301			sppp_print_string((char*)name, name_len);
4302			log(-1, " passwd=");
4303			sppp_print_string((char*)passwd, passwd_len);
4304			log(-1, ">\n");
4305		}
4306		if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN) ||
4307		    passwd_len != sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN) ||
4308		    bcmp(name, sp->hisauth.name, name_len) != 0 ||
4309		    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
4310			/* action scn, tld */
4311			mlen = sizeof(FAILMSG) - 1;
4312			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
4313				       sizeof mlen, (const char *)&mlen,
4314				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
4315				       0);
4316			pap.tld(sp);
4317			break;
4318		}
4319		/* action sca, perhaps tlu */
4320		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
4321		    sp->state[IDX_PAP] == STATE_OPENED) {
4322			mlen = sizeof(SUCCMSG) - 1;
4323			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
4324				       sizeof mlen, (const char *)&mlen,
4325				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
4326				       0);
4327		}
4328		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
4329			sppp_cp_change_state(&pap, sp, STATE_OPENED);
4330			pap.tlu(sp);
4331		}
4332		break;
4333
4334	/* ack and nak are his authproto */
4335	case PAP_ACK:
4336		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4337		if (debug) {
4338			log(LOG_DEBUG, SPP_FMT "pap success",
4339			    SPP_ARGS(ifp));
4340			name_len = *((char *)h);
4341			if (len > 5 && name_len) {
4342				log(-1, ": ");
4343				sppp_print_string((char*)(h+1), name_len);
4344			}
4345			log(-1, "\n");
4346		}
4347		x = splimp();
4348		sp->pp_flags &= ~PP_NEEDAUTH;
4349		if (sp->myauth.proto == PPP_PAP &&
4350		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
4351		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
4352			/*
4353			 * We are authenticator for PAP but didn't
4354			 * complete yet.  Leave it to tlu to proceed
4355			 * to network phase.
4356			 */
4357			splx(x);
4358			break;
4359		}
4360		splx(x);
4361		sppp_phase_network(sp);
4362		break;
4363
4364	case PAP_NAK:
4365		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4366		if (debug) {
4367			log(LOG_INFO, SPP_FMT "pap failure",
4368			    SPP_ARGS(ifp));
4369			name_len = *((char *)h);
4370			if (len > 5 && name_len) {
4371				log(-1, ": ");
4372				sppp_print_string((char*)(h+1), name_len);
4373			}
4374			log(-1, "\n");
4375		} else
4376			log(LOG_INFO, SPP_FMT "pap failure\n",
4377			    SPP_ARGS(ifp));
4378		/* await LCP shutdown by authenticator */
4379		break;
4380
4381	default:
4382		/* Unknown PAP packet type -- ignore. */
4383		if (debug) {
4384			log(LOG_DEBUG, SPP_FMT "pap corrupted input "
4385			    "<0x%x id=0x%x len=%d",
4386			    SPP_ARGS(ifp),
4387			    h->type, h->ident, ntohs(h->len));
4388			sppp_print_bytes((u_char*)(h+1), len-4);
4389			log(-1, ">\n");
4390		}
4391		break;
4392
4393	}
4394}
4395
4396static void
4397sppp_pap_init(struct sppp *sp)
4398{
4399	/* PAP doesn't have STATE_INITIAL at all. */
4400	sp->state[IDX_PAP] = STATE_CLOSED;
4401	sp->fail_counter[IDX_PAP] = 0;
4402	sp->pp_seq[IDX_PAP] = 0;
4403	sp->pp_rseq[IDX_PAP] = 0;
4404#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4405	callout_handle_init(&sp->ch[IDX_PAP]);
4406	callout_handle_init(&sp->pap_my_to_ch);
4407#endif
4408}
4409
4410static void
4411sppp_pap_open(struct sppp *sp)
4412{
4413	if (sp->hisauth.proto == PPP_PAP &&
4414	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
4415		/* we are authenticator for PAP, start our timer */
4416		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4417		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4418	}
4419	if (sp->myauth.proto == PPP_PAP) {
4420		/* we are peer, send a request, and start a timer */
4421		pap.scr(sp);
4422		TIMEOUT(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout,
4423		    sp->pap_my_to_ch);
4424	}
4425}
4426
4427static void
4428sppp_pap_close(struct sppp *sp)
4429{
4430	if (sp->state[IDX_PAP] != STATE_CLOSED)
4431		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4432}
4433
4434/*
4435 * That's the timeout routine if we are authenticator.  Since the
4436 * authenticator is basically passive in PAP, we can't do much here.
4437 */
4438static void
4439sppp_pap_TO(void *cookie)
4440{
4441	struct sppp *sp = (struct sppp *)cookie;
4442	STDDCL;
4443	int s;
4444
4445	s = splimp();
4446	if (debug)
4447		log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
4448		    SPP_ARGS(ifp),
4449		    sppp_state_name(sp->state[IDX_PAP]),
4450		    sp->rst_counter[IDX_PAP]);
4451
4452	if (--sp->rst_counter[IDX_PAP] < 0)
4453		/* TO- event */
4454		switch (sp->state[IDX_PAP]) {
4455		case STATE_REQ_SENT:
4456			pap.tld(sp);
4457			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4458			break;
4459		}
4460	else
4461		/* TO+ event, not very much we could do */
4462		switch (sp->state[IDX_PAP]) {
4463		case STATE_REQ_SENT:
4464			/* sppp_cp_change_state() will restart the timer */
4465			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4466			break;
4467		}
4468
4469	splx(s);
4470}
4471
4472/*
4473 * That's the timeout handler if we are peer.  Since the peer is active,
4474 * we need to retransmit our PAP request since it is apparently lost.
4475 * XXX We should impose a max counter.
4476 */
4477static void
4478sppp_pap_my_TO(void *cookie)
4479{
4480	struct sppp *sp = (struct sppp *)cookie;
4481	STDDCL;
4482
4483	if (debug)
4484		log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
4485		    SPP_ARGS(ifp));
4486
4487	pap.scr(sp);
4488}
4489
4490static void
4491sppp_pap_tlu(struct sppp *sp)
4492{
4493	STDDCL;
4494	int x;
4495
4496	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4497
4498	if (debug)
4499		log(LOG_DEBUG, SPP_FMT "%s tlu\n",
4500		    SPP_ARGS(ifp), pap.name);
4501
4502	x = splimp();
4503	/* indicate to LCP that we need to be closed down */
4504	sp->lcp.protos |= (1 << IDX_PAP);
4505
4506	if (sp->pp_flags & PP_NEEDAUTH) {
4507		/*
4508		 * Remote is authenticator, but his auth proto didn't
4509		 * complete yet.  Defer the transition to network
4510		 * phase.
4511		 */
4512		splx(x);
4513		return;
4514	}
4515	splx(x);
4516	sppp_phase_network(sp);
4517}
4518
4519static void
4520sppp_pap_tld(struct sppp *sp)
4521{
4522	STDDCL;
4523
4524	if (debug)
4525		log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
4526	UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]);
4527	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4528	sp->lcp.protos &= ~(1 << IDX_PAP);
4529
4530	lcp.Close(sp);
4531}
4532
4533static void
4534sppp_pap_scr(struct sppp *sp)
4535{
4536	u_char idlen, pwdlen;
4537
4538	sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP];
4539	pwdlen = sppp_strnlen(sp->myauth.secret, AUTHKEYLEN);
4540	idlen = sppp_strnlen(sp->myauth.name, AUTHNAMELEN);
4541
4542	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
4543		       sizeof idlen, (const char *)&idlen,
4544		       (size_t)idlen, sp->myauth.name,
4545		       sizeof pwdlen, (const char *)&pwdlen,
4546		       (size_t)pwdlen, sp->myauth.secret,
4547		       0);
4548}
4549
4550/*
4551 * Random miscellaneous functions.
4552 */
4553
4554/*
4555 * Send a PAP or CHAP proto packet.
4556 *
4557 * Varadic function, each of the elements for the ellipsis is of type
4558 * ``size_t mlen, const u_char *msg''.  Processing will stop iff
4559 * mlen == 0.
4560 * NOTE: never declare variadic functions with types subject to type
4561 * promotion (i.e. u_char). This is asking for big trouble depending
4562 * on the architecture you are on...
4563 */
4564
4565static void
4566sppp_auth_send(const struct cp *cp, struct sppp *sp,
4567               unsigned int type, unsigned int id,
4568	       ...)
4569{
4570	STDDCL;
4571	struct ppp_header *h;
4572	struct lcp_header *lh;
4573	struct mbuf *m;
4574	u_char *p;
4575	int len;
4576	unsigned int mlen;
4577	const char *msg;
4578	va_list ap;
4579
4580	MGETHDR (m, M_DONTWAIT, MT_DATA);
4581	if (! m)
4582		return;
4583	m->m_pkthdr.rcvif = 0;
4584
4585	h = mtod (m, struct ppp_header*);
4586	h->address = PPP_ALLSTATIONS;		/* broadcast address */
4587	h->control = PPP_UI;			/* Unnumbered Info */
4588	h->protocol = htons(cp->proto);
4589
4590	lh = (struct lcp_header*)(h + 1);
4591	lh->type = type;
4592	lh->ident = id;
4593	p = (u_char*) (lh+1);
4594
4595	va_start(ap, id);
4596	len = 0;
4597
4598	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
4599		msg = va_arg(ap, const char *);
4600		len += mlen;
4601		if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN) {
4602			va_end(ap);
4603			m_freem(m);
4604			return;
4605		}
4606
4607		bcopy(msg, p, mlen);
4608		p += mlen;
4609	}
4610	va_end(ap);
4611
4612	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len;
4613	lh->len = htons (LCP_HEADER_LEN + len);
4614
4615	if (debug) {
4616		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
4617		    SPP_ARGS(ifp), cp->name,
4618		    sppp_auth_type_name(cp->proto, lh->type),
4619		    lh->ident, ntohs(lh->len));
4620		sppp_print_bytes((u_char*) (lh+1), len);
4621		log(-1, ">\n");
4622	}
4623	if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3))
4624		ifp->if_oerrors++;
4625}
4626
4627/*
4628 * Flush interface queue.
4629 */
4630static void
4631sppp_qflush(struct ifqueue *ifq)
4632{
4633	struct mbuf *m, *n;
4634
4635	n = ifq->ifq_head;
4636	while ((m = n)) {
4637		n = m->m_act;
4638		m_freem (m);
4639	}
4640	ifq->ifq_head = 0;
4641	ifq->ifq_tail = 0;
4642	ifq->ifq_len = 0;
4643}
4644
4645/*
4646 * Send keepalive packets, every 10 seconds.
4647 */
4648static void
4649sppp_keepalive(void *dummy)
4650{
4651	struct sppp *sp;
4652	int s;
4653
4654	s = splimp();
4655	for (sp=spppq; sp; sp=sp->pp_next) {
4656		struct ifnet *ifp = &sp->pp_if;
4657
4658		/* Keepalive mode disabled or channel down? */
4659		if (! (sp->pp_flags & PP_KEEPALIVE) ||
4660		    ! (ifp->if_flags & IFF_RUNNING))
4661			continue;
4662
4663		/* No keepalive in PPP mode if LCP not opened yet. */
4664		if (sp->pp_mode != IFF_CISCO &&
4665		    sp->pp_phase < PHASE_AUTHENTICATE)
4666			continue;
4667
4668		if (sp->pp_alivecnt == MAXALIVECNT) {
4669			/* No keepalive packets got.  Stop the interface. */
4670			printf (SPP_FMT "down\n", SPP_ARGS(ifp));
4671			if_down (ifp);
4672			sppp_qflush (&sp->pp_cpq);
4673			if (sp->pp_mode != IFF_CISCO) {
4674				/* XXX */
4675				/* Shut down the PPP link. */
4676				lcp.Down(sp);
4677				/* Initiate negotiation. XXX */
4678				lcp.Up(sp);
4679			}
4680		}
4681		if (sp->pp_alivecnt <= MAXALIVECNT)
4682			++sp->pp_alivecnt;
4683		if (sp->pp_mode == IFF_CISCO)
4684			sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ,
4685				 ++sp->pp_seq[IDX_LCP],	sp->pp_rseq[IDX_LCP]);
4686		else if (sp->pp_phase >= PHASE_AUTHENTICATE) {
4687			long nmagic = htonl (sp->lcp.magic);
4688			sp->lcp.echoid = ++sp->pp_seq[IDX_LCP];
4689			sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
4690				sp->lcp.echoid, 4, &nmagic);
4691		}
4692	}
4693	splx(s);
4694	TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch);
4695}
4696
4697/*
4698 * Get both IP addresses.
4699 */
4700static void
4701sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask)
4702{
4703	struct ifnet *ifp = &sp->pp_if;
4704	struct ifaddr *ifa;
4705	struct sockaddr_in *si, *sm;
4706	u_long ssrc, ddst;
4707
4708	sm = NULL;
4709	ssrc = ddst = 0L;
4710	/*
4711	 * Pick the first AF_INET address from the list,
4712	 * aliases don't make any sense on a p2p link anyway.
4713	 */
4714	si = 0;
4715#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4716	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
4717#elif defined(__NetBSD__) || defined (__OpenBSD__)
4718	for (ifa = TAILQ_FIRST(&ifp->if_addrlist);
4719	     ifa;
4720	     ifa = TAILQ_NEXT(ifa, ifa_list))
4721#else
4722	for (ifa = ifp->if_addrlist;
4723	     ifa;
4724	     ifa = ifa->ifa_next)
4725#endif
4726		if (ifa->ifa_addr->sa_family == AF_INET) {
4727			si = (struct sockaddr_in *)ifa->ifa_addr;
4728			sm = (struct sockaddr_in *)ifa->ifa_netmask;
4729			if (si)
4730				break;
4731		}
4732	if (ifa) {
4733		if (si && si->sin_addr.s_addr) {
4734			ssrc = si->sin_addr.s_addr;
4735			if (srcmask)
4736				*srcmask = ntohl(sm->sin_addr.s_addr);
4737		}
4738
4739		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
4740		if (si && si->sin_addr.s_addr)
4741			ddst = si->sin_addr.s_addr;
4742	}
4743
4744	if (dst) *dst = ntohl(ddst);
4745	if (src) *src = ntohl(ssrc);
4746}
4747
4748/*
4749 * Set my IP address.  Must be called at splimp.
4750 */
4751static void
4752sppp_set_ip_addr(struct sppp *sp, u_long src)
4753{
4754	STDDCL;
4755	struct ifaddr *ifa;
4756	struct sockaddr_in *si;
4757	struct in_ifaddr *ia;
4758
4759	/*
4760	 * Pick the first AF_INET address from the list,
4761	 * aliases don't make any sense on a p2p link anyway.
4762	 */
4763	si = 0;
4764#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4765	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
4766#elif defined(__NetBSD__) || defined (__OpenBSD__)
4767	for (ifa = TAILQ_FIRST(&ifp->if_addrlist);
4768	     ifa;
4769	     ifa = TAILQ_NEXT(ifa, ifa_list))
4770#else
4771	for (ifa = ifp->if_addrlist;
4772	     ifa;
4773	     ifa = ifa->ifa_next)
4774#endif
4775	{
4776		if (ifa->ifa_addr->sa_family == AF_INET)
4777		{
4778			si = (struct sockaddr_in *)ifa->ifa_addr;
4779			if (si)
4780				break;
4781		}
4782	}
4783
4784	if (ifa && si)
4785	{
4786		int error;
4787#if __NetBSD_Version__ >= 103080000
4788		struct sockaddr_in new_sin = *si;
4789
4790		new_sin.sin_addr.s_addr = htonl(src);
4791		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 1);
4792		if(debug && error)
4793		{
4794			log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: in_ifinit "
4795			" failed, error=%d\n", SPP_ARGS(ifp), error);
4796		}
4797#else
4798		/* delete old route */
4799		error = rtinit(ifa, (int)RTM_DELETE, RTF_HOST);
4800		if(debug && error)
4801		{
4802			log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: rtinit DEL failed, error=%d\n",
4803		    		SPP_ARGS(ifp), error);
4804		}
4805
4806		/* set new address */
4807		si->sin_addr.s_addr = htonl(src);
4808		ia = ifatoia(ifa);
4809		LIST_REMOVE(ia, ia_hash);
4810		LIST_INSERT_HEAD(INADDR_HASH(si->sin_addr.s_addr), ia, ia_hash);
4811
4812		/* add new route */
4813		error = rtinit(ifa, (int)RTM_ADD, RTF_HOST);
4814		if (debug && error)
4815		{
4816			log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: rtinit ADD failed, error=%d",
4817		    		SPP_ARGS(ifp), error);
4818		}
4819#endif
4820	}
4821}
4822
4823#ifdef INET6
4824/*
4825 * Get both IPv6 addresses.
4826 */
4827static void
4828sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
4829		   struct in6_addr *srcmask)
4830{
4831	struct ifnet *ifp = &sp->pp_if;
4832	struct ifaddr *ifa;
4833	struct sockaddr_in6 *si, *sm;
4834	struct in6_addr ssrc, ddst;
4835
4836	sm = NULL;
4837	bzero(&ssrc, sizeof(ssrc));
4838	bzero(&ddst, sizeof(ddst));
4839	/*
4840	 * Pick the first link-local AF_INET6 address from the list,
4841	 * aliases don't make any sense on a p2p link anyway.
4842	 */
4843#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4844	for (ifa = ifp->if_addrhead.tqh_first, si = 0;
4845	     ifa;
4846	     ifa = ifa->ifa_link.tqe_next)
4847#elif defined(__NetBSD__) || defined (__OpenBSD__)
4848	for (ifa = ifp->if_addrlist.tqh_first, si = 0;
4849	     ifa;
4850	     ifa = ifa->ifa_list.tqe_next)
4851#else
4852	for (ifa = ifp->if_addrlist, si = 0;
4853	     ifa;
4854	     ifa = ifa->ifa_next)
4855#endif
4856		if (ifa->ifa_addr->sa_family == AF_INET6) {
4857			si = (struct sockaddr_in6 *)ifa->ifa_addr;
4858			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
4859			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
4860				break;
4861		}
4862	if (ifa) {
4863		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
4864			bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc));
4865			if (srcmask) {
4866				bcopy(&sm->sin6_addr, srcmask,
4867				      sizeof(*srcmask));
4868			}
4869		}
4870
4871		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
4872		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
4873			bcopy(&si->sin6_addr, &ddst, sizeof(ddst));
4874	}
4875
4876	if (dst)
4877		bcopy(&ddst, dst, sizeof(*dst));
4878	if (src)
4879		bcopy(&ssrc, src, sizeof(*src));
4880}
4881
4882#ifdef IPV6CP_MYIFID_DYN
4883/*
4884 * Generate random ifid.
4885 */
4886static void
4887sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
4888{
4889	/* TBD */
4890}
4891
4892/*
4893 * Set my IPv6 address.  Must be called at splimp.
4894 */
4895static void
4896sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
4897{
4898	STDDCL;
4899	struct ifaddr *ifa;
4900	struct sockaddr_in6 *sin6;
4901
4902	/*
4903	 * Pick the first link-local AF_INET6 address from the list,
4904	 * aliases don't make any sense on a p2p link anyway.
4905	 */
4906
4907	sin6 = NULL;
4908#if defined(__FreeBSD__) && __FreeBSD__ >= 3
4909	for (ifa = ifp->if_addrhead.tqh_first;
4910	     ifa;
4911	     ifa = ifa->ifa_link.tqe_next)
4912#elif defined(__NetBSD__) || defined (__OpenBSD__)
4913	for (ifa = ifp->if_addrlist.tqh_first;
4914	     ifa;
4915	     ifa = ifa->ifa_list.tqe_next)
4916#else
4917	for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
4918#endif
4919	{
4920		if (ifa->ifa_addr->sa_family == AF_INET6)
4921		{
4922			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
4923			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
4924				break;
4925		}
4926	}
4927
4928	if (ifa && sin6)
4929	{
4930		int error;
4931		struct sockaddr_in6 new_sin6 = *sin6;
4932
4933		bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr));
4934		error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
4935		if (debug && error)
4936		{
4937			log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit "
4938			    " failed, error=%d\n", SPP_ARGS(ifp), error);
4939		}
4940	}
4941}
4942#endif
4943
4944/*
4945 * Suggest a candidate address to be used by peer.
4946 */
4947static void
4948sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
4949{
4950	struct in6_addr myaddr;
4951	struct timeval tv;
4952
4953	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
4954
4955	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
4956	microtime(&tv);
4957	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
4958		myaddr.s6_addr[14] ^= 0xff;
4959		myaddr.s6_addr[15] ^= 0xff;
4960	} else {
4961		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
4962		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
4963	}
4964	if (suggest)
4965		bcopy(&myaddr, suggest, sizeof(myaddr));
4966}
4967#endif /*INET6*/
4968
4969static int
4970sppp_params(struct sppp *sp, u_long cmd, void *data)
4971{
4972	u_long subcmd;
4973	struct ifreq *ifr = (struct ifreq *)data;
4974	struct spppreq *spr;
4975	int rv = 0;
4976
4977	if ((spr = malloc(sizeof(struct spppreq), M_TEMP, M_NOWAIT)) == 0)
4978		return (EAGAIN);
4979	/*
4980	 * ifr->ifr_data is supposed to point to a struct spppreq.
4981	 * Check the cmd word first before attempting to fetch all the
4982	 * data.
4983	 */
4984	if ((subcmd = fuword(ifr->ifr_data)) == -1) {
4985		rv = EFAULT;
4986		goto quit;
4987	}
4988
4989	if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(struct spppreq)) != 0) {
4990		rv = EFAULT;
4991		goto quit;
4992	}
4993
4994	switch (subcmd) {
4995	case SPPPIOGDEFS:
4996		if (cmd != SIOCGIFGENERIC) {
4997			rv = EINVAL;
4998			break;
4999		}
5000		/*
5001		 * We copy over the entire current state, but clean
5002		 * out some of the stuff we don't wanna pass up.
5003		 * Remember, SIOCGIFGENERIC is unprotected, and can be
5004		 * called by any user.  No need to ever get PAP or
5005		 * CHAP secrets back to userland anyway.
5006		 */
5007		spr->defs.pp_phase = sp->pp_phase;
5008		spr->defs.enable_vj = sp->enable_vj;
5009		spr->defs.lcp = sp->lcp;
5010		spr->defs.ipcp = sp->ipcp;
5011		spr->defs.ipv6cp = sp->ipv6cp;
5012		spr->defs.myauth = sp->myauth;
5013		spr->defs.hisauth = sp->hisauth;
5014		bzero(spr->defs.myauth.secret, AUTHKEYLEN);
5015		bzero(spr->defs.myauth.challenge, AUTHKEYLEN);
5016		bzero(spr->defs.hisauth.secret, AUTHKEYLEN);
5017		bzero(spr->defs.hisauth.challenge, AUTHKEYLEN);
5018		/*
5019		 * Fixup the LCP timeout value to milliseconds so
5020		 * spppcontrol doesn't need to bother about the value
5021		 * of "hz".  We do the reverse calculation below when
5022		 * setting it.
5023		 */
5024		spr->defs.lcp.timeout = sp->lcp.timeout * 1000 / hz;
5025		rv = copyout(spr, (caddr_t)ifr->ifr_data,
5026			     sizeof(struct spppreq));
5027		break;
5028
5029	case SPPPIOSDEFS:
5030		if (cmd != SIOCSIFGENERIC) {
5031			rv = EINVAL;
5032			break;
5033		}
5034		/*
5035		 * We have a very specific idea of which fields we
5036		 * allow being passed back from userland, so to not
5037		 * clobber our current state.  For one, we only allow
5038		 * setting anything if LCP is in dead or establish
5039		 * phase.  Once the authentication negotiations
5040		 * started, the authentication settings must not be
5041		 * changed again.  (The administrator can force an
5042		 * ifconfig down in order to get LCP back into dead
5043		 * phase.)
5044		 *
5045		 * Also, we only allow for authentication parameters to be
5046		 * specified.
5047		 *
5048		 * XXX Should allow to set or clear pp_flags.
5049		 *
5050		 * Finally, if the respective authentication protocol to
5051		 * be used is set differently than 0, but the secret is
5052		 * passed as all zeros, we don't trash the existing secret.
5053		 * This allows an administrator to change the system name
5054		 * only without clobbering the secret (which he didn't get
5055		 * back in a previous SPPPIOGDEFS call).  However, the
5056		 * secrets are cleared if the authentication protocol is
5057		 * reset to 0.  */
5058		if (sp->pp_phase != PHASE_DEAD &&
5059		    sp->pp_phase != PHASE_ESTABLISH) {
5060			rv = EBUSY;
5061			break;
5062		}
5063
5064		if ((spr->defs.myauth.proto != 0 && spr->defs.myauth.proto != PPP_PAP &&
5065		     spr->defs.myauth.proto != PPP_CHAP) ||
5066		    (spr->defs.hisauth.proto != 0 && spr->defs.hisauth.proto != PPP_PAP &&
5067		     spr->defs.hisauth.proto != PPP_CHAP)) {
5068			rv = EINVAL;
5069			break;
5070		}
5071
5072		if (spr->defs.myauth.proto == 0)
5073			/* resetting myauth */
5074			bzero(&sp->myauth, sizeof sp->myauth);
5075		else {
5076			/* setting/changing myauth */
5077			sp->myauth.proto = spr->defs.myauth.proto;
5078			bcopy(spr->defs.myauth.name, sp->myauth.name, AUTHNAMELEN);
5079			if (spr->defs.myauth.secret[0] != '\0')
5080				bcopy(spr->defs.myauth.secret, sp->myauth.secret,
5081				      AUTHKEYLEN);
5082		}
5083		if (spr->defs.hisauth.proto == 0)
5084			/* resetting hisauth */
5085			bzero(&sp->hisauth, sizeof sp->hisauth);
5086		else {
5087			/* setting/changing hisauth */
5088			sp->hisauth.proto = spr->defs.hisauth.proto;
5089			sp->hisauth.flags = spr->defs.hisauth.flags;
5090			bcopy(spr->defs.hisauth.name, sp->hisauth.name, AUTHNAMELEN);
5091			if (spr->defs.hisauth.secret[0] != '\0')
5092				bcopy(spr->defs.hisauth.secret, sp->hisauth.secret,
5093				      AUTHKEYLEN);
5094		}
5095		/* set LCP restart timer timeout */
5096		if (spr->defs.lcp.timeout != 0)
5097			sp->lcp.timeout = spr->defs.lcp.timeout * hz / 1000;
5098		/* set VJ enable flag */
5099		sp->enable_vj = spr->defs.enable_vj;
5100		break;
5101
5102	default:
5103		rv = EINVAL;
5104	}
5105
5106 quit:
5107	free(spr, M_TEMP);
5108
5109	return (rv);
5110}
5111
5112static void
5113sppp_phase_network(struct sppp *sp)
5114{
5115	STDDCL;
5116	int i;
5117	u_long mask;
5118
5119	sp->pp_phase = PHASE_NETWORK;
5120
5121	if (debug)
5122		log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
5123		    sppp_phase_name(sp->pp_phase));
5124
5125	/* Notify NCPs now. */
5126	for (i = 0; i < IDX_COUNT; i++)
5127		if ((cps[i])->flags & CP_NCP)
5128			(cps[i])->Open(sp);
5129
5130	/* Send Up events to all NCPs. */
5131	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
5132		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP))
5133			(cps[i])->Up(sp);
5134
5135	/* if no NCP is starting, all this was in vain, close down */
5136	sppp_lcp_check_and_close(sp);
5137}
5138
5139
5140static const char *
5141sppp_cp_type_name(u_char type)
5142{
5143	static char buf[12];
5144	switch (type) {
5145	case CONF_REQ:   return "conf-req";
5146	case CONF_ACK:   return "conf-ack";
5147	case CONF_NAK:   return "conf-nak";
5148	case CONF_REJ:   return "conf-rej";
5149	case TERM_REQ:   return "term-req";
5150	case TERM_ACK:   return "term-ack";
5151	case CODE_REJ:   return "code-rej";
5152	case PROTO_REJ:  return "proto-rej";
5153	case ECHO_REQ:   return "echo-req";
5154	case ECHO_REPLY: return "echo-reply";
5155	case DISC_REQ:   return "discard-req";
5156	}
5157	snprintf (buf, sizeof(buf), "cp/0x%x", type);
5158	return buf;
5159}
5160
5161static const char *
5162sppp_auth_type_name(u_short proto, u_char type)
5163{
5164	static char buf[12];
5165	switch (proto) {
5166	case PPP_CHAP:
5167		switch (type) {
5168		case CHAP_CHALLENGE:	return "challenge";
5169		case CHAP_RESPONSE:	return "response";
5170		case CHAP_SUCCESS:	return "success";
5171		case CHAP_FAILURE:	return "failure";
5172		}
5173	case PPP_PAP:
5174		switch (type) {
5175		case PAP_REQ:		return "req";
5176		case PAP_ACK:		return "ack";
5177		case PAP_NAK:		return "nak";
5178		}
5179	}
5180	snprintf (buf, sizeof(buf), "auth/0x%x", type);
5181	return buf;
5182}
5183
5184static const char *
5185sppp_lcp_opt_name(u_char opt)
5186{
5187	static char buf[12];
5188	switch (opt) {
5189	case LCP_OPT_MRU:		return "mru";
5190	case LCP_OPT_ASYNC_MAP:		return "async-map";
5191	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
5192	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
5193	case LCP_OPT_MAGIC:		return "magic";
5194	case LCP_OPT_PROTO_COMP:	return "proto-comp";
5195	case LCP_OPT_ADDR_COMP:		return "addr-comp";
5196	}
5197	snprintf (buf, sizeof(buf), "lcp/0x%x", opt);
5198	return buf;
5199}
5200
5201static const char *
5202sppp_ipcp_opt_name(u_char opt)
5203{
5204	static char buf[12];
5205	switch (opt) {
5206	case IPCP_OPT_ADDRESSES:	return "addresses";
5207	case IPCP_OPT_COMPRESSION:	return "compression";
5208	case IPCP_OPT_ADDRESS:		return "address";
5209	}
5210	snprintf (buf, sizeof(buf), "ipcp/0x%x", opt);
5211	return buf;
5212}
5213
5214#ifdef INET6
5215static const char *
5216sppp_ipv6cp_opt_name(u_char opt)
5217{
5218	static char buf[12];
5219	switch (opt) {
5220	case IPV6CP_OPT_IFID:		return "ifid";
5221	case IPV6CP_OPT_COMPRESSION:	return "compression";
5222	}
5223	sprintf (buf, "0x%x", opt);
5224	return buf;
5225}
5226#endif
5227
5228static const char *
5229sppp_state_name(int state)
5230{
5231	switch (state) {
5232	case STATE_INITIAL:	return "initial";
5233	case STATE_STARTING:	return "starting";
5234	case STATE_CLOSED:	return "closed";
5235	case STATE_STOPPED:	return "stopped";
5236	case STATE_CLOSING:	return "closing";
5237	case STATE_STOPPING:	return "stopping";
5238	case STATE_REQ_SENT:	return "req-sent";
5239	case STATE_ACK_RCVD:	return "ack-rcvd";
5240	case STATE_ACK_SENT:	return "ack-sent";
5241	case STATE_OPENED:	return "opened";
5242	}
5243	return "illegal";
5244}
5245
5246static const char *
5247sppp_phase_name(enum ppp_phase phase)
5248{
5249	switch (phase) {
5250	case PHASE_DEAD:	return "dead";
5251	case PHASE_ESTABLISH:	return "establish";
5252	case PHASE_TERMINATE:	return "terminate";
5253	case PHASE_AUTHENTICATE: return "authenticate";
5254	case PHASE_NETWORK:	return "network";
5255	}
5256	return "illegal";
5257}
5258
5259static const char *
5260sppp_proto_name(u_short proto)
5261{
5262	static char buf[12];
5263	switch (proto) {
5264	case PPP_LCP:	return "lcp";
5265	case PPP_IPCP:	return "ipcp";
5266	case PPP_PAP:	return "pap";
5267	case PPP_CHAP:	return "chap";
5268	case PPP_IPV6CP: return "ipv6cp";
5269	}
5270	snprintf(buf, sizeof(buf), "proto/0x%x", (unsigned)proto);
5271	return buf;
5272}
5273
5274static void
5275sppp_print_bytes(const u_char *p, u_short len)
5276{
5277	if (len)
5278		log(-1, " %*D", len, p, "-");
5279}
5280
5281static void
5282sppp_print_string(const char *p, u_short len)
5283{
5284	u_char c;
5285
5286	while (len-- > 0) {
5287		c = *p++;
5288		/*
5289		 * Print only ASCII chars directly.  RFC 1994 recommends
5290		 * using only them, but we don't rely on it.  */
5291		if (c < ' ' || c > '~')
5292			log(-1, "\\x%x", c);
5293		else
5294			log(-1, "%c", c);
5295	}
5296}
5297
5298static const char *
5299sppp_dotted_quad(u_long addr)
5300{
5301	static char s[16];
5302	sprintf(s, "%d.%d.%d.%d",
5303		(int)((addr >> 24) & 0xff),
5304		(int)((addr >> 16) & 0xff),
5305		(int)((addr >> 8) & 0xff),
5306		(int)(addr & 0xff));
5307	return s;
5308}
5309
5310static int
5311sppp_strnlen(u_char *p, int max)
5312{
5313	int len;
5314
5315	for (len = 0; len < max && *p; ++p)
5316		++len;
5317	return len;
5318}
5319
5320/* a dummy, used to drop uninteresting events */
5321static void
5322sppp_null(struct sppp *unused)
5323{
5324	/* do just nothing */
5325}
5326