if_spppsubr.c revision 42064 
1/*
2 * Synchronous PPP/Cisco link level subroutines.
3 * Keepalive protocol implemented in both Cisco and PPP modes.
4 *
5 * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
6 * Author: Serge Vakulenko, <vak@cronyx.ru>
7 *
8 * Heavily revamped to conform to RFC 1661.
9 * Copyright (C) 1997, Joerg Wunsch.
10 *
11 * This software is distributed with NO WARRANTIES, not even the implied
12 * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13 *
14 * Authors grant any other persons or organisations permission to use
15 * or modify this software as long as this message is kept with the software,
16 * all derivative works or modified versions.
17 *
18 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
19 *
20 * $Id: if_spppsubr.c,v 1.48 1998/12/16 18:42:30 phk Exp $
21 */
22
23#include <sys/param.h>
24
25#if defined (__FreeBSD__)
26#include "opt_inet.h"
27#include "opt_ipx.h"
28#endif
29
30#ifdef NetBSD1_3
31#  if NetBSD1_3 > 6
32#      include "opt_inet.h"
33#      include "opt_iso.h"
34#  endif
35#endif
36
37#include <sys/systm.h>
38#include <sys/kernel.h>
39#include <sys/sockio.h>
40#include <sys/socket.h>
41#include <sys/syslog.h>
42#include <sys/malloc.h>
43#include <sys/mbuf.h>
44
45#if defined (__OpenBSD__)
46#include <sys/md5k.h>
47#else
48#include <sys/md5.h>
49#endif
50
51#include <net/if.h>
52#include <net/netisr.h>
53#include <net/if_types.h>
54
55#if defined (__FreeBSD__)
56#include <machine/random.h>
57#endif
58#if defined (__NetBSD__) || defined (__OpenBSD__)
59#include <machine/cpu.h> /* XXX for softnet */
60#endif
61#include <machine/stdarg.h>
62
63#ifdef INET
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/in_var.h>
67#include <netinet/ip.h>
68#include <netinet/tcp.h>
69# if defined (__FreeBSD__) || defined (__OpenBSD__)
70#  include <netinet/if_ether.h>
71# else
72#  include <net/ethertypes.h>
73# endif
74#else
75# error Huh? sppp without INET?
76#endif
77
78#ifdef IPX
79#include <netipx/ipx.h>
80#include <netipx/ipx_if.h>
81#endif
82
83#ifdef NS
84#include <netns/ns.h>
85#include <netns/ns_if.h>
86#endif
87
88#ifdef ISO
89#include <netiso/argo_debug.h>
90#include <netiso/iso.h>
91#include <netiso/iso_var.h>
92#include <netiso/iso_snpac.h>
93#endif
94
95#include <net/if_sppp.h>
96
97#if defined (__FreeBSD__)
98# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg, handle)
99# define TIMEOUT(fun, arg1, arg2, handle) handle = timeout(fun, arg1, arg2)
100#else
101# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg)
102# define TIMEOUT(fun, arg1, arg2, handle) timeout(fun, arg1, arg2)
103#endif
104#define MAXALIVECNT     3               /* max. alive packets */
105
106/*
107 * Interface flags that can be set in an ifconfig command.
108 *
109 * Setting link0 will make the link passive, i.e. it will be marked
110 * as being administrative openable, but won't be opened to begin
111 * with.  Incoming calls will be answered, or subsequent calls with
112 * -link1 will cause the administrative open of the LCP layer.
113 *
114 * Setting link1 will cause the link to auto-dial only as packets
115 * arrive to be sent.
116 *
117 * Setting IFF_DEBUG will syslog the option negotiation and state
118 * transitions at level kern.debug.  Note: all logs consistently look
119 * like
120 *
121 *   <if-name><unit>: <proto-name> <additional info...>
122 *
123 * with <if-name><unit> being something like "bppp0", and <proto-name>
124 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
125 */
126
127#define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
128#define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
129
130#define PPP_ALLSTATIONS 0xff		/* All-Stations broadcast address */
131#define PPP_UI		0x03		/* Unnumbered Information */
132#define PPP_IP		0x0021		/* Internet Protocol */
133#define PPP_ISO		0x0023		/* ISO OSI Protocol */
134#define PPP_XNS		0x0025		/* Xerox NS Protocol */
135#define PPP_IPX		0x002b		/* Novell IPX Protocol */
136#define PPP_LCP		0xc021		/* Link Control Protocol */
137#define PPP_PAP		0xc023		/* Password Authentication Protocol */
138#define PPP_CHAP	0xc223		/* Challenge-Handshake Auth Protocol */
139#define PPP_IPCP	0x8021		/* Internet Protocol Control Protocol */
140
141#define CONF_REQ	1		/* PPP configure request */
142#define CONF_ACK	2		/* PPP configure acknowledge */
143#define CONF_NAK	3		/* PPP configure negative ack */
144#define CONF_REJ	4		/* PPP configure reject */
145#define TERM_REQ	5		/* PPP terminate request */
146#define TERM_ACK	6		/* PPP terminate acknowledge */
147#define CODE_REJ	7		/* PPP code reject */
148#define PROTO_REJ	8		/* PPP protocol reject */
149#define ECHO_REQ	9		/* PPP echo request */
150#define ECHO_REPLY	10		/* PPP echo reply */
151#define DISC_REQ	11		/* PPP discard request */
152
153#define LCP_OPT_MRU		1	/* maximum receive unit */
154#define LCP_OPT_ASYNC_MAP	2	/* async control character map */
155#define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
156#define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
157#define LCP_OPT_MAGIC		5	/* magic number */
158#define LCP_OPT_RESERVED	6	/* reserved */
159#define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
160#define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
161
162#define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
163#define IPCP_OPT_COMPRESSION	2	/* IP compression protocol (VJ) */
164#define IPCP_OPT_ADDRESS	3	/* local IP address */
165
166#define PAP_REQ			1	/* PAP name/password request */
167#define PAP_ACK			2	/* PAP acknowledge */
168#define PAP_NAK			3	/* PAP fail */
169
170#define CHAP_CHALLENGE		1	/* CHAP challenge request */
171#define CHAP_RESPONSE		2	/* CHAP challenge response */
172#define CHAP_SUCCESS		3	/* CHAP response ok */
173#define CHAP_FAILURE		4	/* CHAP response failed */
174
175#define CHAP_MD5		5	/* hash algorithm - MD5 */
176
177#define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
178#define CISCO_UNICAST		0x0f	/* Cisco unicast address */
179#define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
180#define CISCO_ADDR_REQ		0	/* Cisco address request */
181#define CISCO_ADDR_REPLY	1	/* Cisco address reply */
182#define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
183
184/* states are named and numbered according to RFC 1661 */
185#define STATE_INITIAL	0
186#define STATE_STARTING	1
187#define STATE_CLOSED	2
188#define STATE_STOPPED	3
189#define STATE_CLOSING	4
190#define STATE_STOPPING	5
191#define STATE_REQ_SENT	6
192#define STATE_ACK_RCVD	7
193#define STATE_ACK_SENT	8
194#define STATE_OPENED	9
195
196struct ppp_header {
197	u_char address;
198	u_char control;
199	u_short protocol;
200};
201#define PPP_HEADER_LEN          sizeof (struct ppp_header)
202
203struct lcp_header {
204	u_char type;
205	u_char ident;
206	u_short len;
207};
208#define LCP_HEADER_LEN          sizeof (struct lcp_header)
209
210struct cisco_packet {
211	u_long type;
212	u_long par1;
213	u_long par2;
214	u_short rel;
215	u_short time0;
216	u_short time1;
217};
218#define CISCO_PACKET_LEN 18
219
220/*
221 * We follow the spelling and capitalization of RFC 1661 here, to make
222 * it easier comparing with the standard.  Please refer to this RFC in
223 * case you can't make sense out of these abbreviation; it will also
224 * explain the semantics related to the various events and actions.
225 */
226struct cp {
227	u_short	proto;		/* PPP control protocol number */
228	u_char protoidx;	/* index into state table in struct sppp */
229	u_char flags;
230#define CP_LCP		0x01	/* this is the LCP */
231#define CP_AUTH		0x02	/* this is an authentication protocol */
232#define CP_NCP		0x04	/* this is a NCP */
233#define CP_QUAL		0x08	/* this is a quality reporting protocol */
234	const char *name;	/* name of this control protocol */
235	/* event handlers */
236	void	(*Up)(struct sppp *sp);
237	void	(*Down)(struct sppp *sp);
238	void	(*Open)(struct sppp *sp);
239	void	(*Close)(struct sppp *sp);
240	void	(*TO)(void *sp);
241	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
242	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
243	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
244	/* actions */
245	void	(*tlu)(struct sppp *sp);
246	void	(*tld)(struct sppp *sp);
247	void	(*tls)(struct sppp *sp);
248	void	(*tlf)(struct sppp *sp);
249	void	(*scr)(struct sppp *sp);
250};
251
252static struct sppp *spppq;
253#if defined (__FreeBSD__)
254static struct callout_handle keepalive_ch;
255#endif
256
257#if defined (__FreeBSD__)
258#define	SPP_FMT		"%s%d: "
259#define	SPP_ARGS(ifp)	(ifp)->if_name, (ifp)->if_unit
260#else
261#define	SPP_FMT		"%s: "
262#define	SPP_ARGS(ifp)	(ifp)->if_xname
263#endif
264
265/*
266 * The following disgusting hack gets around the problem that IP TOS
267 * can't be set yet.  We want to put "interactive" traffic on a high
268 * priority queue.  To decide if traffic is interactive, we check that
269 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
270 *
271 * XXX is this really still necessary?  - joerg -
272 */
273static u_short interactive_ports[8] = {
274	0,	513,	0,	0,
275	0,	21,	0,	23,
276};
277#define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
278
279/* almost every function needs these */
280#define STDDCL							\
281	struct ifnet *ifp = &sp->pp_if;				\
282	int debug = ifp->if_flags & IFF_DEBUG
283
284static int sppp_output(struct ifnet *ifp, struct mbuf *m,
285		       struct sockaddr *dst, struct rtentry *rt);
286
287static void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2);
288static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
289
290static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
291			  struct mbuf *m);
292static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
293			 u_char ident, u_short len, void *data);
294#ifdef notyet
295static void sppp_cp_timeout(void *arg);
296#endif
297static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
298				 int newstate);
299static void sppp_auth_send(const struct cp *cp,
300			   struct sppp *sp, u_char type, u_char id,
301			   ...);
302
303static void sppp_up_event(const struct cp *cp, struct sppp *sp);
304static void sppp_down_event(const struct cp *cp, struct sppp *sp);
305static void sppp_open_event(const struct cp *cp, struct sppp *sp);
306static void sppp_close_event(const struct cp *cp, struct sppp *sp);
307static void sppp_to_event(const struct cp *cp, struct sppp *sp);
308
309static void sppp_null(struct sppp *sp);
310
311static void sppp_lcp_init(struct sppp *sp);
312static void sppp_lcp_up(struct sppp *sp);
313static void sppp_lcp_down(struct sppp *sp);
314static void sppp_lcp_open(struct sppp *sp);
315static void sppp_lcp_close(struct sppp *sp);
316static void sppp_lcp_TO(void *sp);
317static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
318static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
319static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
320static void sppp_lcp_tlu(struct sppp *sp);
321static void sppp_lcp_tld(struct sppp *sp);
322static void sppp_lcp_tls(struct sppp *sp);
323static void sppp_lcp_tlf(struct sppp *sp);
324static void sppp_lcp_scr(struct sppp *sp);
325static void sppp_lcp_check_and_close(struct sppp *sp);
326static int sppp_ncp_check(struct sppp *sp);
327
328static void sppp_ipcp_init(struct sppp *sp);
329static void sppp_ipcp_up(struct sppp *sp);
330static void sppp_ipcp_down(struct sppp *sp);
331static void sppp_ipcp_open(struct sppp *sp);
332static void sppp_ipcp_close(struct sppp *sp);
333static void sppp_ipcp_TO(void *sp);
334static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
335static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
336static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
337static void sppp_ipcp_tlu(struct sppp *sp);
338static void sppp_ipcp_tld(struct sppp *sp);
339static void sppp_ipcp_tls(struct sppp *sp);
340static void sppp_ipcp_tlf(struct sppp *sp);
341static void sppp_ipcp_scr(struct sppp *sp);
342
343static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
344static void sppp_pap_init(struct sppp *sp);
345static void sppp_pap_open(struct sppp *sp);
346static void sppp_pap_close(struct sppp *sp);
347static void sppp_pap_TO(void *sp);
348static void sppp_pap_my_TO(void *sp);
349static void sppp_pap_tlu(struct sppp *sp);
350static void sppp_pap_tld(struct sppp *sp);
351static void sppp_pap_scr(struct sppp *sp);
352
353static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
354static void sppp_chap_init(struct sppp *sp);
355static void sppp_chap_open(struct sppp *sp);
356static void sppp_chap_close(struct sppp *sp);
357static void sppp_chap_TO(void *sp);
358static void sppp_chap_tlu(struct sppp *sp);
359static void sppp_chap_tld(struct sppp *sp);
360static void sppp_chap_scr(struct sppp *sp);
361
362static const char *sppp_auth_type_name(u_short proto, u_char type);
363static const char *sppp_cp_type_name(u_char type);
364static const char *sppp_dotted_quad(u_long addr);
365static const char *sppp_ipcp_opt_name(u_char opt);
366static const char *sppp_lcp_opt_name(u_char opt);
367static const char *sppp_phase_name(enum ppp_phase phase);
368static const char *sppp_proto_name(u_short proto);
369static const char *sppp_state_name(int state);
370static int sppp_params(struct sppp *sp, u_long cmd, void *data);
371static int sppp_strnlen(u_char *p, int max);
372static void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst,
373			      u_long *srcmask);
374static void sppp_keepalive(void *dummy);
375static void sppp_phase_network(struct sppp *sp);
376static void sppp_print_bytes(const u_char *p, u_short len);
377static void sppp_print_string(const char *p, u_short len);
378static void sppp_qflush(struct ifqueue *ifq);
379static void sppp_set_ip_addr(struct sppp *sp, u_long src);
380
381/* our control protocol descriptors */
382static const struct cp lcp = {
383	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
384	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
385	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
386	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
387	sppp_lcp_scr
388};
389
390static const struct cp ipcp = {
391	PPP_IPCP, IDX_IPCP, CP_NCP, "ipcp",
392	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
393	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
394	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
395	sppp_ipcp_scr
396};
397
398static const struct cp pap = {
399	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
400	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
401	sppp_pap_TO, 0, 0, 0,
402	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
403	sppp_pap_scr
404};
405
406static const struct cp chap = {
407	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
408	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
409	sppp_chap_TO, 0, 0, 0,
410	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
411	sppp_chap_scr
412};
413
414static const struct cp *cps[IDX_COUNT] = {
415	&lcp,			/* IDX_LCP */
416	&ipcp,			/* IDX_IPCP */
417	&pap,			/* IDX_PAP */
418	&chap,			/* IDX_CHAP */
419};
420
421
422/*
423 * Exported functions, comprising our interface to the lower layer.
424 */
425
426/*
427 * Process the received packet.
428 */
429void
430sppp_input(struct ifnet *ifp, struct mbuf *m)
431{
432	struct ppp_header *h;
433	struct ifqueue *inq = 0;
434	int s;
435	struct sppp *sp = (struct sppp *)ifp;
436	int debug = ifp->if_flags & IFF_DEBUG;
437
438	if (ifp->if_flags & IFF_UP)
439		/* Count received bytes, add FCS and one flag */
440		ifp->if_ibytes += m->m_pkthdr.len + 3;
441
442	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
443		/* Too small packet, drop it. */
444		if (debug)
445			log(LOG_DEBUG,
446			    SPP_FMT "input packet is too small, %d bytes\n",
447			    SPP_ARGS(ifp), m->m_pkthdr.len);
448	  drop:
449		++ifp->if_ierrors;
450		++ifp->if_iqdrops;
451		m_freem (m);
452		return;
453	}
454
455	/* Get PPP header. */
456	h = mtod (m, struct ppp_header*);
457	m_adj (m, PPP_HEADER_LEN);
458
459	switch (h->address) {
460	case PPP_ALLSTATIONS:
461		if (h->control != PPP_UI)
462			goto invalid;
463		if (sp->pp_flags & PP_CISCO) {
464			if (debug)
465				log(LOG_DEBUG,
466				    SPP_FMT "PPP packet in Cisco mode "
467				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
468				    SPP_ARGS(ifp),
469				    h->address, h->control, ntohs(h->protocol));
470			goto drop;
471		}
472		switch (ntohs (h->protocol)) {
473		default:
474			if (sp->state[IDX_LCP] == STATE_OPENED)
475				sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
476					++sp->pp_seq, m->m_pkthdr.len + 2,
477					&h->protocol);
478			if (debug)
479				log(LOG_DEBUG,
480				    SPP_FMT "invalid input protocol "
481				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
482				    SPP_ARGS(ifp),
483				    h->address, h->control, ntohs(h->protocol));
484			++ifp->if_noproto;
485			goto drop;
486		case PPP_LCP:
487			sppp_cp_input(&lcp, sp, m);
488			m_freem (m);
489			return;
490		case PPP_PAP:
491			if (sp->pp_phase >= PHASE_AUTHENTICATE)
492				sppp_pap_input(sp, m);
493			m_freem (m);
494			return;
495		case PPP_CHAP:
496			if (sp->pp_phase >= PHASE_AUTHENTICATE)
497				sppp_chap_input(sp, m);
498			m_freem (m);
499			return;
500#ifdef INET
501		case PPP_IPCP:
502			if (sp->pp_phase == PHASE_NETWORK)
503				sppp_cp_input(&ipcp, sp, m);
504			m_freem (m);
505			return;
506		case PPP_IP:
507			if (sp->state[IDX_IPCP] == STATE_OPENED) {
508				schednetisr (NETISR_IP);
509				inq = &ipintrq;
510			}
511			break;
512#endif
513#ifdef IPX
514		case PPP_IPX:
515			/* IPX IPXCP not implemented yet */
516			if (sp->pp_phase == PHASE_NETWORK) {
517				schednetisr (NETISR_IPX);
518				inq = &ipxintrq;
519			}
520			break;
521#endif
522#ifdef NS
523		case PPP_XNS:
524			/* XNS IDPCP not implemented yet */
525			if (sp->pp_phase == PHASE_NETWORK) {
526				schednetisr (NETISR_NS);
527				inq = &nsintrq;
528			}
529			break;
530#endif
531#ifdef ISO
532		case PPP_ISO:
533			/* OSI NLCP not implemented yet */
534			if (sp->pp_phase == PHASE_NETWORK) {
535				schednetisr (NETISR_ISO);
536				inq = &clnlintrq;
537			}
538			break;
539#endif
540		}
541		break;
542	case CISCO_MULTICAST:
543	case CISCO_UNICAST:
544		/* Don't check the control field here (RFC 1547). */
545		if (! (sp->pp_flags & PP_CISCO)) {
546			if (debug)
547				log(LOG_DEBUG,
548				    SPP_FMT "Cisco packet in PPP mode "
549				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
550				    SPP_ARGS(ifp),
551				    h->address, h->control, ntohs(h->protocol));
552			goto drop;
553		}
554		switch (ntohs (h->protocol)) {
555		default:
556			++ifp->if_noproto;
557			goto invalid;
558		case CISCO_KEEPALIVE:
559			sppp_cisco_input ((struct sppp*) ifp, m);
560			m_freem (m);
561			return;
562#ifdef INET
563		case ETHERTYPE_IP:
564			schednetisr (NETISR_IP);
565			inq = &ipintrq;
566			break;
567#endif
568#ifdef IPX
569		case ETHERTYPE_IPX:
570			schednetisr (NETISR_IPX);
571			inq = &ipxintrq;
572			break;
573#endif
574#ifdef NS
575		case ETHERTYPE_NS:
576			schednetisr (NETISR_NS);
577			inq = &nsintrq;
578			break;
579#endif
580		}
581		break;
582	default:        /* Invalid PPP packet. */
583	  invalid:
584		if (debug)
585			log(LOG_DEBUG,
586			    SPP_FMT "invalid input packet "
587			    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
588			    SPP_ARGS(ifp),
589			    h->address, h->control, ntohs(h->protocol));
590		goto drop;
591	}
592
593	if (! (ifp->if_flags & IFF_UP) || ! inq)
594		goto drop;
595
596	/* Check queue. */
597	s = splimp();
598	if (IF_QFULL (inq)) {
599		/* Queue overflow. */
600		IF_DROP(inq);
601		splx(s);
602		if (debug)
603			log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
604				SPP_ARGS(ifp));
605		goto drop;
606	}
607	IF_ENQUEUE(inq, m);
608	splx(s);
609}
610
611/*
612 * Enqueue transmit packet.
613 */
614static int
615sppp_output(struct ifnet *ifp, struct mbuf *m,
616	    struct sockaddr *dst, struct rtentry *rt)
617{
618	struct sppp *sp = (struct sppp*) ifp;
619	struct ppp_header *h;
620	struct ifqueue *ifq;
621	int s, rv = 0;
622
623	s = splimp();
624
625	if ((ifp->if_flags & IFF_UP) == 0 ||
626	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
627		m_freem (m);
628		splx (s);
629		return (ENETDOWN);
630	}
631
632	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
633		/*
634		 * Interface is not yet running, but auto-dial.  Need
635		 * to start LCP for it.
636		 */
637		ifp->if_flags |= IFF_RUNNING;
638		splx(s);
639		lcp.Open(sp);
640		s = splimp();
641	}
642
643	ifq = &ifp->if_snd;
644#ifdef INET
645	/*
646	 * Put low delay, telnet, rlogin and ftp control packets
647	 * in front of the queue.
648	 */
649	if (dst->sa_family == AF_INET) {
650		/* XXX Check mbuf length here? */
651		struct ip *ip = mtod (m, struct ip*);
652		struct tcphdr *tcp = (struct tcphdr*) ((long*)ip + ip->ip_hl);
653
654		if (IF_QFULL (&sp->pp_fastq))
655			;
656		else if (ip->ip_tos & IPTOS_LOWDELAY)
657			ifq = &sp->pp_fastq;
658		else if (m->m_len < sizeof *ip + sizeof *tcp)
659			;
660		else if (ip->ip_p != IPPROTO_TCP)
661			;
662		else if (INTERACTIVE (ntohs (tcp->th_sport)))
663			ifq = &sp->pp_fastq;
664		else if (INTERACTIVE (ntohs (tcp->th_dport)))
665			ifq = &sp->pp_fastq;
666	}
667#endif
668
669	/*
670	 * Prepend general data packet PPP header. For now, IP only.
671	 */
672	M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
673	if (! m) {
674		if (ifp->if_flags & IFF_DEBUG)
675			log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
676				SPP_ARGS(ifp));
677		++ifp->if_oerrors;
678		splx (s);
679		return (ENOBUFS);
680	}
681	/*
682	 * May want to check size of packet
683	 * (albeit due to the implementation it's always enough)
684	 */
685	h = mtod (m, struct ppp_header*);
686	if (sp->pp_flags & PP_CISCO) {
687		h->address = CISCO_UNICAST;        /* unicast address */
688		h->control = 0;
689	} else {
690		h->address = PPP_ALLSTATIONS;        /* broadcast address */
691		h->control = PPP_UI;                 /* Unnumbered Info */
692	}
693
694	switch (dst->sa_family) {
695#ifdef INET
696	case AF_INET:   /* Internet Protocol */
697		if (sp->pp_flags & PP_CISCO)
698			h->protocol = htons (ETHERTYPE_IP);
699		else {
700			/*
701			 * Don't choke with an ENETDOWN early.  It's
702			 * possible that we just started dialing out,
703			 * so don't drop the packet immediately.  If
704			 * we notice that we run out of buffer space
705			 * below, we will however remember that we are
706			 * not ready to carry IP packets, and return
707			 * ENETDOWN, as opposed to ENOBUFS.
708			 */
709			h->protocol = htons(PPP_IP);
710			if (sp->state[IDX_IPCP] != STATE_OPENED)
711				rv = ENETDOWN;
712		}
713		break;
714#endif
715#ifdef NS
716	case AF_NS:     /* Xerox NS Protocol */
717		h->protocol = htons ((sp->pp_flags & PP_CISCO) ?
718			ETHERTYPE_NS : PPP_XNS);
719		break;
720#endif
721#ifdef IPX
722	case AF_IPX:     /* Novell IPX Protocol */
723		h->protocol = htons ((sp->pp_flags & PP_CISCO) ?
724			ETHERTYPE_IPX : PPP_IPX);
725		break;
726#endif
727#ifdef ISO
728	case AF_ISO:    /* ISO OSI Protocol */
729		if (sp->pp_flags & PP_CISCO)
730			goto nosupport;
731		h->protocol = htons (PPP_ISO);
732		break;
733nosupport:
734#endif
735	default:
736		m_freem (m);
737		++ifp->if_oerrors;
738		splx (s);
739		return (EAFNOSUPPORT);
740	}
741
742	/*
743	 * Queue message on interface, and start output if interface
744	 * not yet active.
745	 */
746	if (IF_QFULL (ifq)) {
747		IF_DROP (&ifp->if_snd);
748		m_freem (m);
749		++ifp->if_oerrors;
750		splx (s);
751		return (rv? rv: ENOBUFS);
752	}
753	IF_ENQUEUE (ifq, m);
754	if (! (ifp->if_flags & IFF_OACTIVE))
755		(*ifp->if_start) (ifp);
756
757	/*
758	 * Count output packets and bytes.
759	 * The packet length includes header, FCS and 1 flag,
760	 * according to RFC 1333.
761	 */
762	ifp->if_obytes += m->m_pkthdr.len + 3;
763	splx (s);
764	return (0);
765}
766
767void
768sppp_attach(struct ifnet *ifp)
769{
770	struct sppp *sp = (struct sppp*) ifp;
771
772	/* Initialize keepalive handler. */
773	if (! spppq)
774		TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch);
775
776	/* Insert new entry into the keepalive list. */
777	sp->pp_next = spppq;
778	spppq = sp;
779
780	sp->pp_if.if_mtu = PP_MTU;
781	sp->pp_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
782	sp->pp_if.if_type = IFT_PPP;
783	sp->pp_if.if_output = sppp_output;
784	sp->pp_flags = PP_KEEPALIVE;
785	sp->pp_fastq.ifq_maxlen = 32;
786	sp->pp_cpq.ifq_maxlen = 20;
787	sp->pp_loopcnt = 0;
788	sp->pp_alivecnt = 0;
789	sp->pp_seq = 0;
790	sp->pp_rseq = 0;
791	sp->pp_phase = PHASE_DEAD;
792	sp->pp_up = lcp.Up;
793	sp->pp_down = lcp.Down;
794
795	sppp_lcp_init(sp);
796	sppp_ipcp_init(sp);
797	sppp_pap_init(sp);
798	sppp_chap_init(sp);
799}
800
801void
802sppp_detach(struct ifnet *ifp)
803{
804	struct sppp **q, *p, *sp = (struct sppp*) ifp;
805	int i;
806
807	/* Remove the entry from the keepalive list. */
808	for (q = &spppq; (p = *q); q = &p->pp_next)
809		if (p == sp) {
810			*q = p->pp_next;
811			break;
812		}
813
814	/* Stop keepalive handler. */
815	if (! spppq)
816		UNTIMEOUT(sppp_keepalive, 0, keepalive_ch);
817
818	for (i = 0; i < IDX_COUNT; i++)
819		UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]);
820	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
821}
822
823/*
824 * Flush the interface output queue.
825 */
826void
827sppp_flush(struct ifnet *ifp)
828{
829	struct sppp *sp = (struct sppp*) ifp;
830
831	sppp_qflush (&sp->pp_if.if_snd);
832	sppp_qflush (&sp->pp_fastq);
833	sppp_qflush (&sp->pp_cpq);
834}
835
836/*
837 * Check if the output queue is empty.
838 */
839int
840sppp_isempty(struct ifnet *ifp)
841{
842	struct sppp *sp = (struct sppp*) ifp;
843	int empty, s;
844
845	s = splimp();
846	empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head &&
847		!sp->pp_if.if_snd.ifq_head;
848	splx(s);
849	return (empty);
850}
851
852/*
853 * Get next packet to send.
854 */
855struct mbuf *
856sppp_dequeue(struct ifnet *ifp)
857{
858	struct sppp *sp = (struct sppp*) ifp;
859	struct mbuf *m;
860	int s;
861
862	s = splimp();
863	/*
864	 * Process only the control protocol queue until we have at
865	 * least one NCP open.
866	 *
867	 * Do always serve all three queues in Cisco mode.
868	 */
869	IF_DEQUEUE(&sp->pp_cpq, m);
870	if (m == NULL &&
871	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
872		IF_DEQUEUE(&sp->pp_fastq, m);
873		if (m == NULL)
874			IF_DEQUEUE (&sp->pp_if.if_snd, m);
875	}
876	splx(s);
877	return m;
878}
879
880/*
881 * Pick the next packet, do not remove it from the queue.
882 */
883struct mbuf *
884sppp_pick(struct ifnet *ifp)
885{
886	struct sppp *sp = (struct sppp*)ifp;
887	struct mbuf *m;
888	int s;
889
890	s= splimp ();
891
892	m = sp->pp_cpq.ifq_head;
893	if (m == NULL &&
894	    (sp->pp_phase == PHASE_NETWORK ||
895	     (sp->pp_flags & PP_CISCO) != 0))
896		if ((m = sp->pp_fastq.ifq_head) == NULL)
897			m = sp->pp_if.if_snd.ifq_head;
898	splx (s);
899	return (m);
900}
901
902/*
903 * Process an ioctl request.  Called on low priority level.
904 */
905int
906sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
907{
908	struct ifreq *ifr = (struct ifreq*) data;
909	struct sppp *sp = (struct sppp*) ifp;
910	int s, rv, going_up, going_down, newmode;
911
912	s = splimp();
913	rv = 0;
914	switch (cmd) {
915	case SIOCAIFADDR:
916	case SIOCSIFDSTADDR:
917		break;
918
919	case SIOCSIFADDR:
920		if_up(ifp);
921		/* fall through... */
922
923	case SIOCSIFFLAGS:
924		going_up = ifp->if_flags & IFF_UP &&
925			(ifp->if_flags & IFF_RUNNING) == 0;
926		going_down = (ifp->if_flags & IFF_UP) == 0 &&
927			ifp->if_flags & IFF_RUNNING;
928		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
929		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
930			/* sanity */
931			newmode = IFF_PASSIVE;
932			ifp->if_flags &= ~IFF_AUTO;
933		}
934
935		if (going_up || going_down)
936			lcp.Close(sp);
937		if (going_up && newmode == 0) {
938			/* neither auto-dial nor passive */
939			ifp->if_flags |= IFF_RUNNING;
940			if (!(sp->pp_flags & PP_CISCO))
941				lcp.Open(sp);
942		} else if (going_down) {
943			sppp_flush(ifp);
944			ifp->if_flags &= ~IFF_RUNNING;
945		}
946
947		break;
948
949#ifdef SIOCSIFMTU
950#ifndef ifr_mtu
951#define ifr_mtu ifr_metric
952#endif
953	case SIOCSIFMTU:
954		if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru)
955			return (EINVAL);
956		ifp->if_mtu = ifr->ifr_mtu;
957		break;
958#endif
959#ifdef SLIOCSETMTU
960	case SLIOCSETMTU:
961		if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru)
962			return (EINVAL);
963		ifp->if_mtu = *(short*)data;
964		break;
965#endif
966#ifdef SIOCGIFMTU
967	case SIOCGIFMTU:
968		ifr->ifr_mtu = ifp->if_mtu;
969		break;
970#endif
971#ifdef SLIOCGETMTU
972	case SLIOCGETMTU:
973		*(short*)data = ifp->if_mtu;
974		break;
975#endif
976	case SIOCADDMULTI:
977	case SIOCDELMULTI:
978		break;
979
980	case SIOCGIFGENERIC:
981	case SIOCSIFGENERIC:
982		rv = sppp_params(sp, cmd, data);
983		break;
984
985	default:
986		rv = ENOTTY;
987	}
988	splx(s);
989	return rv;
990}
991
992
993/*
994 * Cisco framing implementation.
995 */
996
997/*
998 * Handle incoming Cisco keepalive protocol packets.
999 */
1000static void
1001sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1002{
1003	STDDCL;
1004	struct cisco_packet *h;
1005	u_long me, mymask;
1006
1007	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1008		if (debug)
1009			log(LOG_DEBUG,
1010			    SPP_FMT "cisco invalid packet length: %d bytes\n",
1011			    SPP_ARGS(ifp), m->m_pkthdr.len);
1012		return;
1013	}
1014	h = mtod (m, struct cisco_packet*);
1015	if (debug)
1016		log(LOG_DEBUG,
1017		    SPP_FMT "cisco input: %d bytes "
1018		    "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1019		    SPP_ARGS(ifp), m->m_pkthdr.len,
1020		    (u_long)ntohl (h->type), (u_long)h->par1, (u_long)h->par2, (u_int)h->rel,
1021		    (u_int)h->time0, (u_int)h->time1);
1022	switch (ntohl (h->type)) {
1023	default:
1024		if (debug)
1025			addlog(SPP_FMT "cisco unknown packet type: 0x%lx\n",
1026			       SPP_ARGS(ifp), (u_long)ntohl (h->type));
1027		break;
1028	case CISCO_ADDR_REPLY:
1029		/* Reply on address request, ignore */
1030		break;
1031	case CISCO_KEEPALIVE_REQ:
1032		sp->pp_alivecnt = 0;
1033		sp->pp_rseq = ntohl (h->par1);
1034		if (sp->pp_seq == sp->pp_rseq) {
1035			/* Local and remote sequence numbers are equal.
1036			 * Probably, the line is in loopback mode. */
1037			if (sp->pp_loopcnt >= MAXALIVECNT) {
1038				printf (SPP_FMT "loopback\n",
1039					SPP_ARGS(ifp));
1040				sp->pp_loopcnt = 0;
1041				if (ifp->if_flags & IFF_UP) {
1042					if_down (ifp);
1043					sppp_qflush (&sp->pp_cpq);
1044				}
1045			}
1046			++sp->pp_loopcnt;
1047
1048			/* Generate new local sequence number */
1049#if defined (__FreeBSD__)
1050			sp->pp_seq = random();
1051#else
1052			sp->pp_seq ^= time.tv_sec ^ time.tv_usec;
1053#endif
1054			break;
1055		}
1056		sp->pp_loopcnt = 0;
1057		if (! (ifp->if_flags & IFF_UP) &&
1058		    (ifp->if_flags & IFF_RUNNING)) {
1059			if_up(ifp);
1060			printf (SPP_FMT "up\n", SPP_ARGS(ifp));
1061		}
1062		break;
1063	case CISCO_ADDR_REQ:
1064		sppp_get_ip_addrs(sp, &me, 0, &mymask);
1065		if (me != 0L)
1066			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1067		break;
1068	}
1069}
1070
1071/*
1072 * Send Cisco keepalive packet.
1073 */
1074static void
1075sppp_cisco_send(struct sppp *sp, int type, long par1, long par2)
1076{
1077	STDDCL;
1078	struct ppp_header *h;
1079	struct cisco_packet *ch;
1080	struct mbuf *m;
1081#if defined (__FreeBSD__)
1082	struct timeval tv;
1083#else
1084	u_long t = (time.tv_sec - boottime.tv_sec) * 1000;
1085#endif
1086
1087#if defined (__FreeBSD__)
1088	getmicrouptime(&tv);
1089#endif
1090
1091	MGETHDR (m, M_DONTWAIT, MT_DATA);
1092	if (! m)
1093		return;
1094	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1095	m->m_pkthdr.rcvif = 0;
1096
1097	h = mtod (m, struct ppp_header*);
1098	h->address = CISCO_MULTICAST;
1099	h->control = 0;
1100	h->protocol = htons (CISCO_KEEPALIVE);
1101
1102	ch = (struct cisco_packet*) (h + 1);
1103	ch->type = htonl (type);
1104	ch->par1 = htonl (par1);
1105	ch->par2 = htonl (par2);
1106	ch->rel = -1;
1107
1108#if defined (__FreeBSD__)
1109	ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
1110	ch->time1 = htons ((u_short) tv.tv_sec);
1111#else
1112	ch->time0 = htons ((u_short) (t >> 16));
1113	ch->time1 = htons ((u_short) t);
1114#endif
1115
1116	if (debug)
1117		log(LOG_DEBUG,
1118		    SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1119			SPP_ARGS(ifp), (u_long)ntohl (ch->type), (u_long)ch->par1,
1120			(u_long)ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
1121
1122	if (IF_QFULL (&sp->pp_cpq)) {
1123		IF_DROP (&sp->pp_fastq);
1124		IF_DROP (&ifp->if_snd);
1125		m_freem (m);
1126	} else
1127		IF_ENQUEUE (&sp->pp_cpq, m);
1128	if (! (ifp->if_flags & IFF_OACTIVE))
1129		(*ifp->if_start) (ifp);
1130	ifp->if_obytes += m->m_pkthdr.len + 3;
1131}
1132
1133/*
1134 * PPP protocol implementation.
1135 */
1136
1137/*
1138 * Send PPP control protocol packet.
1139 */
1140static void
1141sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1142	     u_char ident, u_short len, void *data)
1143{
1144	STDDCL;
1145	struct ppp_header *h;
1146	struct lcp_header *lh;
1147	struct mbuf *m;
1148
1149	if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN)
1150		len = MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN;
1151	MGETHDR (m, M_DONTWAIT, MT_DATA);
1152	if (! m)
1153		return;
1154	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len;
1155	m->m_pkthdr.rcvif = 0;
1156
1157	h = mtod (m, struct ppp_header*);
1158	h->address = PPP_ALLSTATIONS;        /* broadcast address */
1159	h->control = PPP_UI;                 /* Unnumbered Info */
1160	h->protocol = htons (proto);         /* Link Control Protocol */
1161
1162	lh = (struct lcp_header*) (h + 1);
1163	lh->type = type;
1164	lh->ident = ident;
1165	lh->len = htons (LCP_HEADER_LEN + len);
1166	if (len)
1167		bcopy (data, lh+1, len);
1168
1169	if (debug) {
1170		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
1171		    SPP_ARGS(ifp),
1172		    sppp_proto_name(proto),
1173		    sppp_cp_type_name (lh->type), lh->ident,
1174		    ntohs (lh->len));
1175		if (len)
1176			sppp_print_bytes ((u_char*) (lh+1), len);
1177		addlog(">\n");
1178	}
1179	if (IF_QFULL (&sp->pp_cpq)) {
1180		IF_DROP (&sp->pp_fastq);
1181		IF_DROP (&ifp->if_snd);
1182		m_freem (m);
1183		++ifp->if_oerrors;
1184	} else
1185		IF_ENQUEUE (&sp->pp_cpq, m);
1186	if (! (ifp->if_flags & IFF_OACTIVE))
1187		(*ifp->if_start) (ifp);
1188	ifp->if_obytes += m->m_pkthdr.len + 3;
1189}
1190
1191/*
1192 * Handle incoming PPP control protocol packets.
1193 */
1194static void
1195sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1196{
1197	STDDCL;
1198	struct lcp_header *h;
1199	int len = m->m_pkthdr.len;
1200	int rv;
1201	u_char *p;
1202
1203	if (len < 4) {
1204		if (debug)
1205			log(LOG_DEBUG,
1206			    SPP_FMT "%s invalid packet length: %d bytes\n",
1207			    SPP_ARGS(ifp), cp->name, len);
1208		return;
1209	}
1210	h = mtod (m, struct lcp_header*);
1211	if (debug) {
1212		log(LOG_DEBUG,
1213		    SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
1214		    SPP_ARGS(ifp), cp->name,
1215		    sppp_state_name(sp->state[cp->protoidx]),
1216		    sppp_cp_type_name (h->type), h->ident, ntohs (h->len));
1217		if (len > 4)
1218			sppp_print_bytes ((u_char*) (h+1), len-4);
1219		addlog(">\n");
1220	}
1221	if (len > ntohs (h->len))
1222		len = ntohs (h->len);
1223	p = (u_char *)(h + 1);
1224	switch (h->type) {
1225	case CONF_REQ:
1226		if (len < 4) {
1227			if (debug)
1228				addlog(SPP_FMT "%s invalid conf-req length %d\n",
1229				       SPP_ARGS(ifp), cp->name,
1230				       len);
1231			++ifp->if_ierrors;
1232			break;
1233		}
1234		/* handle states where RCR doesn't get a SCA/SCN */
1235		switch (sp->state[cp->protoidx]) {
1236		case STATE_CLOSING:
1237		case STATE_STOPPING:
1238			return;
1239		case STATE_CLOSED:
1240			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1241				     0, 0);
1242			return;
1243		}
1244		rv = (cp->RCR)(sp, h, len);
1245		switch (sp->state[cp->protoidx]) {
1246		case STATE_OPENED:
1247			(cp->tld)(sp);
1248			(cp->scr)(sp);
1249			/* fall through... */
1250		case STATE_ACK_SENT:
1251		case STATE_REQ_SENT:
1252			sppp_cp_change_state(cp, sp, rv?
1253					     STATE_ACK_SENT: STATE_REQ_SENT);
1254			break;
1255		case STATE_STOPPED:
1256			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1257			(cp->scr)(sp);
1258			sppp_cp_change_state(cp, sp, rv?
1259					     STATE_ACK_SENT: STATE_REQ_SENT);
1260			break;
1261		case STATE_ACK_RCVD:
1262			if (rv) {
1263				sppp_cp_change_state(cp, sp, STATE_OPENED);
1264				if (debug)
1265					log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1266					    SPP_ARGS(ifp),
1267					    cp->name);
1268				(cp->tlu)(sp);
1269			} else
1270				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1271			break;
1272		default:
1273			printf(SPP_FMT "%s illegal %s in state %s\n",
1274			       SPP_ARGS(ifp), cp->name,
1275			       sppp_cp_type_name(h->type),
1276			       sppp_state_name(sp->state[cp->protoidx]));
1277			++ifp->if_ierrors;
1278		}
1279		break;
1280	case CONF_ACK:
1281		if (h->ident != sp->confid[cp->protoidx]) {
1282			if (debug)
1283				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1284				       SPP_ARGS(ifp), cp->name,
1285				       h->ident, sp->confid[cp->protoidx]);
1286			++ifp->if_ierrors;
1287			break;
1288		}
1289		switch (sp->state[cp->protoidx]) {
1290		case STATE_CLOSED:
1291		case STATE_STOPPED:
1292			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1293			break;
1294		case STATE_CLOSING:
1295		case STATE_STOPPING:
1296			break;
1297		case STATE_REQ_SENT:
1298			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1299			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1300			break;
1301		case STATE_OPENED:
1302			(cp->tld)(sp);
1303			/* fall through */
1304		case STATE_ACK_RCVD:
1305			(cp->scr)(sp);
1306			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1307			break;
1308		case STATE_ACK_SENT:
1309			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1310			sppp_cp_change_state(cp, sp, STATE_OPENED);
1311			if (debug)
1312				log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1313				       SPP_ARGS(ifp), cp->name);
1314			(cp->tlu)(sp);
1315			break;
1316		default:
1317			printf(SPP_FMT "%s illegal %s in state %s\n",
1318			       SPP_ARGS(ifp), cp->name,
1319			       sppp_cp_type_name(h->type),
1320			       sppp_state_name(sp->state[cp->protoidx]));
1321			++ifp->if_ierrors;
1322		}
1323		break;
1324	case CONF_NAK:
1325	case CONF_REJ:
1326		if (h->ident != sp->confid[cp->protoidx]) {
1327			if (debug)
1328				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1329				       SPP_ARGS(ifp), cp->name,
1330				       h->ident, sp->confid[cp->protoidx]);
1331			++ifp->if_ierrors;
1332			break;
1333		}
1334		if (h->type == CONF_NAK)
1335			(cp->RCN_nak)(sp, h, len);
1336		else /* CONF_REJ */
1337			(cp->RCN_rej)(sp, h, len);
1338
1339		switch (sp->state[cp->protoidx]) {
1340		case STATE_CLOSED:
1341		case STATE_STOPPED:
1342			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1343			break;
1344		case STATE_REQ_SENT:
1345		case STATE_ACK_SENT:
1346			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1347			(cp->scr)(sp);
1348			break;
1349		case STATE_OPENED:
1350			(cp->tld)(sp);
1351			/* fall through */
1352		case STATE_ACK_RCVD:
1353			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1354			(cp->scr)(sp);
1355			break;
1356		case STATE_CLOSING:
1357		case STATE_STOPPING:
1358			break;
1359		default:
1360			printf(SPP_FMT "%s illegal %s in state %s\n",
1361			       SPP_ARGS(ifp), cp->name,
1362			       sppp_cp_type_name(h->type),
1363			       sppp_state_name(sp->state[cp->protoidx]));
1364			++ifp->if_ierrors;
1365		}
1366		break;
1367
1368	case TERM_REQ:
1369		switch (sp->state[cp->protoidx]) {
1370		case STATE_ACK_RCVD:
1371		case STATE_ACK_SENT:
1372			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1373			/* fall through */
1374		case STATE_CLOSED:
1375		case STATE_STOPPED:
1376		case STATE_CLOSING:
1377		case STATE_STOPPING:
1378		case STATE_REQ_SENT:
1379		  sta:
1380			/* Send Terminate-Ack packet. */
1381			if (debug)
1382				log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
1383				    SPP_ARGS(ifp), cp->name);
1384			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1385			break;
1386		case STATE_OPENED:
1387			(cp->tld)(sp);
1388			sp->rst_counter[cp->protoidx] = 0;
1389			sppp_cp_change_state(cp, sp, STATE_STOPPING);
1390			goto sta;
1391			break;
1392		default:
1393			printf(SPP_FMT "%s illegal %s in state %s\n",
1394			       SPP_ARGS(ifp), cp->name,
1395			       sppp_cp_type_name(h->type),
1396			       sppp_state_name(sp->state[cp->protoidx]));
1397			++ifp->if_ierrors;
1398		}
1399		break;
1400	case TERM_ACK:
1401		switch (sp->state[cp->protoidx]) {
1402		case STATE_CLOSED:
1403		case STATE_STOPPED:
1404		case STATE_REQ_SENT:
1405		case STATE_ACK_SENT:
1406			break;
1407		case STATE_CLOSING:
1408			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1409			(cp->tlf)(sp);
1410			break;
1411		case STATE_STOPPING:
1412			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1413			(cp->tlf)(sp);
1414			break;
1415		case STATE_ACK_RCVD:
1416			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1417			break;
1418		case STATE_OPENED:
1419			(cp->tld)(sp);
1420			(cp->scr)(sp);
1421			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1422			break;
1423		default:
1424			printf(SPP_FMT "%s illegal %s in state %s\n",
1425			       SPP_ARGS(ifp), cp->name,
1426			       sppp_cp_type_name(h->type),
1427			       sppp_state_name(sp->state[cp->protoidx]));
1428			++ifp->if_ierrors;
1429		}
1430		break;
1431	case CODE_REJ:
1432	case PROTO_REJ:
1433		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1434		log(LOG_INFO,
1435		    SPP_FMT "%s: ignoring RXJ (%s) for proto 0x%x, "
1436		    "danger will robinson\n",
1437		    SPP_ARGS(ifp), cp->name,
1438		    sppp_cp_type_name(h->type), ntohs(*((u_short *)p)));
1439		switch (sp->state[cp->protoidx]) {
1440		case STATE_CLOSED:
1441		case STATE_STOPPED:
1442		case STATE_REQ_SENT:
1443		case STATE_ACK_SENT:
1444		case STATE_CLOSING:
1445		case STATE_STOPPING:
1446		case STATE_OPENED:
1447			break;
1448		case STATE_ACK_RCVD:
1449			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1450			break;
1451		default:
1452			printf(SPP_FMT "%s illegal %s in state %s\n",
1453			       SPP_ARGS(ifp), cp->name,
1454			       sppp_cp_type_name(h->type),
1455			       sppp_state_name(sp->state[cp->protoidx]));
1456			++ifp->if_ierrors;
1457		}
1458		break;
1459	case DISC_REQ:
1460		if (cp->proto != PPP_LCP)
1461			goto illegal;
1462		/* Discard the packet. */
1463		break;
1464	case ECHO_REQ:
1465		if (cp->proto != PPP_LCP)
1466			goto illegal;
1467		if (sp->state[cp->protoidx] != STATE_OPENED) {
1468			if (debug)
1469				addlog(SPP_FMT "lcp echo req but lcp closed\n",
1470				       SPP_ARGS(ifp));
1471			++ifp->if_ierrors;
1472			break;
1473		}
1474		if (len < 8) {
1475			if (debug)
1476				addlog(SPP_FMT "invalid lcp echo request "
1477				       "packet length: %d bytes\n",
1478				       SPP_ARGS(ifp), len);
1479			break;
1480		}
1481		if (ntohl (*(long*)(h+1)) == sp->lcp.magic) {
1482			/* Line loopback mode detected. */
1483			printf(SPP_FMT "loopback\n", SPP_ARGS(ifp));
1484			if_down (ifp);
1485			sppp_qflush (&sp->pp_cpq);
1486
1487			/* Shut down the PPP link. */
1488			/* XXX */
1489			lcp.Down(sp);
1490			lcp.Up(sp);
1491			break;
1492		}
1493		*(long*)(h+1) = htonl (sp->lcp.magic);
1494		if (debug)
1495			addlog(SPP_FMT "got lcp echo req, sending echo rep\n",
1496			       SPP_ARGS(ifp));
1497		sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
1498		break;
1499	case ECHO_REPLY:
1500		if (cp->proto != PPP_LCP)
1501			goto illegal;
1502		if (h->ident != sp->lcp.echoid) {
1503			++ifp->if_ierrors;
1504			break;
1505		}
1506		if (len < 8) {
1507			if (debug)
1508				addlog(SPP_FMT "lcp invalid echo reply "
1509				       "packet length: %d bytes\n",
1510				       SPP_ARGS(ifp), len);
1511			break;
1512		}
1513		if (debug)
1514			addlog(SPP_FMT "lcp got echo rep\n",
1515			       SPP_ARGS(ifp));
1516		if (ntohl (*(long*)(h+1)) != sp->lcp.magic)
1517			sp->pp_alivecnt = 0;
1518		break;
1519	default:
1520		/* Unknown packet type -- send Code-Reject packet. */
1521	  illegal:
1522		if (debug)
1523			addlog(SPP_FMT "%s send code-rej for 0x%x\n",
1524			       SPP_ARGS(ifp), cp->name, h->type);
1525		sppp_cp_send(sp, cp->proto, CODE_REJ, ++sp->pp_seq,
1526			     m->m_pkthdr.len, h);
1527		++ifp->if_ierrors;
1528	}
1529}
1530
1531
1532/*
1533 * The generic part of all Up/Down/Open/Close/TO event handlers.
1534 * Basically, the state transition handling in the automaton.
1535 */
1536static void
1537sppp_up_event(const struct cp *cp, struct sppp *sp)
1538{
1539	STDDCL;
1540
1541	if (debug)
1542		log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
1543		    SPP_ARGS(ifp), cp->name,
1544		    sppp_state_name(sp->state[cp->protoidx]));
1545
1546	switch (sp->state[cp->protoidx]) {
1547	case STATE_INITIAL:
1548		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1549		break;
1550	case STATE_STARTING:
1551		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1552		(cp->scr)(sp);
1553		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1554		break;
1555	default:
1556		printf(SPP_FMT "%s illegal up in state %s\n",
1557		       SPP_ARGS(ifp), cp->name,
1558		       sppp_state_name(sp->state[cp->protoidx]));
1559	}
1560}
1561
1562static void
1563sppp_down_event(const struct cp *cp, struct sppp *sp)
1564{
1565	STDDCL;
1566
1567	if (debug)
1568		log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
1569		    SPP_ARGS(ifp), cp->name,
1570		    sppp_state_name(sp->state[cp->protoidx]));
1571
1572	switch (sp->state[cp->protoidx]) {
1573	case STATE_CLOSED:
1574	case STATE_CLOSING:
1575		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1576		break;
1577	case STATE_STOPPED:
1578		sppp_cp_change_state(cp, sp, STATE_STARTING);
1579		(cp->tls)(sp);
1580		break;
1581	case STATE_STOPPING:
1582	case STATE_REQ_SENT:
1583	case STATE_ACK_RCVD:
1584	case STATE_ACK_SENT:
1585		sppp_cp_change_state(cp, sp, STATE_STARTING);
1586		break;
1587	case STATE_OPENED:
1588		(cp->tld)(sp);
1589		sppp_cp_change_state(cp, sp, STATE_STARTING);
1590		break;
1591	default:
1592		printf(SPP_FMT "%s illegal down in state %s\n",
1593		       SPP_ARGS(ifp), cp->name,
1594		       sppp_state_name(sp->state[cp->protoidx]));
1595	}
1596}
1597
1598
1599static void
1600sppp_open_event(const struct cp *cp, struct sppp *sp)
1601{
1602	STDDCL;
1603
1604	if (debug)
1605		log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
1606		    SPP_ARGS(ifp), cp->name,
1607		    sppp_state_name(sp->state[cp->protoidx]));
1608
1609	switch (sp->state[cp->protoidx]) {
1610	case STATE_INITIAL:
1611		sppp_cp_change_state(cp, sp, STATE_STARTING);
1612		(cp->tls)(sp);
1613		break;
1614	case STATE_STARTING:
1615		break;
1616	case STATE_CLOSED:
1617		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1618		(cp->scr)(sp);
1619		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1620		break;
1621	case STATE_STOPPED:
1622	case STATE_STOPPING:
1623	case STATE_REQ_SENT:
1624	case STATE_ACK_RCVD:
1625	case STATE_ACK_SENT:
1626	case STATE_OPENED:
1627		break;
1628	case STATE_CLOSING:
1629		sppp_cp_change_state(cp, sp, STATE_STOPPING);
1630		break;
1631	}
1632}
1633
1634
1635static void
1636sppp_close_event(const struct cp *cp, struct sppp *sp)
1637{
1638	STDDCL;
1639
1640	if (debug)
1641		log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
1642		    SPP_ARGS(ifp), cp->name,
1643		    sppp_state_name(sp->state[cp->protoidx]));
1644
1645	switch (sp->state[cp->protoidx]) {
1646	case STATE_INITIAL:
1647	case STATE_CLOSED:
1648	case STATE_CLOSING:
1649		break;
1650	case STATE_STARTING:
1651		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1652		(cp->tlf)(sp);
1653		break;
1654	case STATE_STOPPED:
1655		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1656		break;
1657	case STATE_STOPPING:
1658		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1659		break;
1660	case STATE_OPENED:
1661		(cp->tld)(sp);
1662		/* fall through */
1663	case STATE_REQ_SENT:
1664	case STATE_ACK_RCVD:
1665	case STATE_ACK_SENT:
1666		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1667		sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
1668		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1669		break;
1670	}
1671}
1672
1673static void
1674sppp_to_event(const struct cp *cp, struct sppp *sp)
1675{
1676	STDDCL;
1677	int s;
1678
1679	s = splimp();
1680	if (debug)
1681		log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
1682		    SPP_ARGS(ifp), cp->name,
1683		    sppp_state_name(sp->state[cp->protoidx]),
1684		    sp->rst_counter[cp->protoidx]);
1685
1686	if (--sp->rst_counter[cp->protoidx] < 0)
1687		/* TO- event */
1688		switch (sp->state[cp->protoidx]) {
1689		case STATE_CLOSING:
1690			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1691			(cp->tlf)(sp);
1692			break;
1693		case STATE_STOPPING:
1694			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1695			(cp->tlf)(sp);
1696			break;
1697		case STATE_REQ_SENT:
1698		case STATE_ACK_RCVD:
1699		case STATE_ACK_SENT:
1700			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1701			(cp->tlf)(sp);
1702			break;
1703		}
1704	else
1705		/* TO+ event */
1706		switch (sp->state[cp->protoidx]) {
1707		case STATE_CLOSING:
1708		case STATE_STOPPING:
1709			sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq,
1710				     0, 0);
1711			TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
1712			    sp->ch[cp->protoidx]);
1713			break;
1714		case STATE_REQ_SENT:
1715		case STATE_ACK_RCVD:
1716			(cp->scr)(sp);
1717			/* sppp_cp_change_state() will restart the timer */
1718			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1719			break;
1720		case STATE_ACK_SENT:
1721			(cp->scr)(sp);
1722			TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
1723			    sp->ch[cp->protoidx]);
1724			break;
1725		}
1726
1727	splx(s);
1728}
1729
1730/*
1731 * Change the state of a control protocol in the state automaton.
1732 * Takes care of starting/stopping the restart timer.
1733 */
1734void
1735sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
1736{
1737	sp->state[cp->protoidx] = newstate;
1738
1739	UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]);
1740	switch (newstate) {
1741	case STATE_INITIAL:
1742	case STATE_STARTING:
1743	case STATE_CLOSED:
1744	case STATE_STOPPED:
1745	case STATE_OPENED:
1746		break;
1747	case STATE_CLOSING:
1748	case STATE_STOPPING:
1749	case STATE_REQ_SENT:
1750	case STATE_ACK_RCVD:
1751	case STATE_ACK_SENT:
1752		TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout,
1753		    sp->ch[cp->protoidx]);
1754		break;
1755	}
1756}
1757/*
1758 *--------------------------------------------------------------------------*
1759 *                                                                          *
1760 *                         The LCP implementation.                          *
1761 *                                                                          *
1762 *--------------------------------------------------------------------------*
1763 */
1764static void
1765sppp_lcp_init(struct sppp *sp)
1766{
1767	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
1768	sp->lcp.magic = 0;
1769	sp->state[IDX_LCP] = STATE_INITIAL;
1770	sp->fail_counter[IDX_LCP] = 0;
1771	sp->lcp.protos = 0;
1772	sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
1773
1774	/*
1775	 * Initialize counters and timeout values.  Note that we don't
1776	 * use the 3 seconds suggested in RFC 1661 since we are likely
1777	 * running on a fast link.  XXX We should probably implement
1778	 * the exponential backoff option.  Note that these values are
1779	 * relevant for all control protocols, not just LCP only.
1780	 */
1781	sp->lcp.timeout = 1 * hz;
1782	sp->lcp.max_terminate = 2;
1783	sp->lcp.max_configure = 10;
1784	sp->lcp.max_failure = 10;
1785#if defined (__FreeBSD__)
1786	callout_handle_init(&sp->ch[IDX_LCP]);
1787#endif
1788}
1789
1790static void
1791sppp_lcp_up(struct sppp *sp)
1792{
1793	STDDCL;
1794
1795	/*
1796	 * If this interface is passive or dial-on-demand, and we are
1797	 * still in Initial state, it means we've got an incoming
1798	 * call.  Activate the interface.
1799	 */
1800	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
1801		if (debug)
1802			log(LOG_DEBUG,
1803			    SPP_FMT "Up event", SPP_ARGS(ifp));
1804		ifp->if_flags |= IFF_RUNNING;
1805		if (sp->state[IDX_LCP] == STATE_INITIAL) {
1806			if (debug)
1807				addlog("(incoming call)\n");
1808			sp->pp_flags |= PP_CALLIN;
1809			lcp.Open(sp);
1810		} else if (debug)
1811			addlog("\n");
1812	}
1813
1814	sppp_up_event(&lcp, sp);
1815}
1816
1817static void
1818sppp_lcp_down(struct sppp *sp)
1819{
1820	STDDCL;
1821
1822	sppp_down_event(&lcp, sp);
1823
1824	/*
1825	 * If this is neither a dial-on-demand nor a passive
1826	 * interface, simulate an ``ifconfig down'' action, so the
1827	 * administrator can force a redial by another ``ifconfig
1828	 * up''.  XXX For leased line operation, should we immediately
1829	 * try to reopen the connection here?
1830	 */
1831	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
1832		log(LOG_INFO,
1833		    SPP_FMT "Down event (carrier loss), taking interface down.\n",
1834		    SPP_ARGS(ifp));
1835		if_down(ifp);
1836	} else {
1837		if (debug)
1838			log(LOG_DEBUG,
1839			    SPP_FMT "Down event (carrier loss)\n",
1840			    SPP_ARGS(ifp));
1841	}
1842	sp->pp_flags &= ~PP_CALLIN;
1843	if (sp->state[IDX_LCP] != STATE_INITIAL)
1844		lcp.Close(sp);
1845	ifp->if_flags &= ~IFF_RUNNING;
1846}
1847
1848static void
1849sppp_lcp_open(struct sppp *sp)
1850{
1851	/*
1852	 * If we are authenticator, negotiate LCP_AUTH
1853	 */
1854	if (sp->hisauth.proto != 0)
1855		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
1856	else
1857		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
1858	sp->pp_flags &= ~PP_NEEDAUTH;
1859	sppp_open_event(&lcp, sp);
1860}
1861
1862static void
1863sppp_lcp_close(struct sppp *sp)
1864{
1865	sppp_close_event(&lcp, sp);
1866}
1867
1868static void
1869sppp_lcp_TO(void *cookie)
1870{
1871	sppp_to_event(&lcp, (struct sppp *)cookie);
1872}
1873
1874/*
1875 * Analyze a configure request.  Return true if it was agreeable, and
1876 * caused action sca, false if it has been rejected or nak'ed, and
1877 * caused action scn.  (The return value is used to make the state
1878 * transition decision in the state automaton.)
1879 */
1880static int
1881sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
1882{
1883	STDDCL;
1884	u_char *buf, *r, *p;
1885	int origlen, rlen;
1886	u_long nmagic;
1887	u_short authproto;
1888
1889	len -= 4;
1890	origlen = len;
1891	buf = r = malloc (len, M_TEMP, M_NOWAIT);
1892	if (! buf)
1893		return (0);
1894
1895	if (debug)
1896		log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
1897		    SPP_ARGS(ifp));
1898
1899	/* pass 1: check for things that need to be rejected */
1900	p = (void*) (h+1);
1901	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
1902		if (debug)
1903			addlog(" %s ", sppp_lcp_opt_name(*p));
1904		switch (*p) {
1905		case LCP_OPT_MAGIC:
1906			/* Magic number. */
1907			/* fall through, both are same length */
1908		case LCP_OPT_ASYNC_MAP:
1909			/* Async control character map. */
1910			if (len >= 6 || p[1] == 6)
1911				continue;
1912			if (debug)
1913				addlog("[invalid] ");
1914			break;
1915		case LCP_OPT_MRU:
1916			/* Maximum receive unit. */
1917			if (len >= 4 && p[1] == 4)
1918				continue;
1919			if (debug)
1920				addlog("[invalid] ");
1921			break;
1922		case LCP_OPT_AUTH_PROTO:
1923			if (len < 4) {
1924				if (debug)
1925					addlog("[invalid] ");
1926				break;
1927			}
1928			authproto = (p[2] << 8) + p[3];
1929			if (authproto == PPP_CHAP && p[1] != 5) {
1930				if (debug)
1931					addlog("[invalid chap len] ");
1932				break;
1933			}
1934			if (sp->myauth.proto == 0) {
1935				/* we are not configured to do auth */
1936				if (debug)
1937					addlog("[not configured] ");
1938				break;
1939			}
1940			/*
1941			 * Remote want us to authenticate, remember this,
1942			 * so we stay in PHASE_AUTHENTICATE after LCP got
1943			 * up.
1944			 */
1945			sp->pp_flags |= PP_NEEDAUTH;
1946			continue;
1947		default:
1948			/* Others not supported. */
1949			if (debug)
1950				addlog("[rej] ");
1951			break;
1952		}
1953		/* Add the option to rejected list. */
1954		bcopy (p, r, p[1]);
1955		r += p[1];
1956		rlen += p[1];
1957	}
1958	if (rlen) {
1959		if (debug)
1960			addlog(" send conf-rej\n");
1961		sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
1962		return 0;
1963	} else if (debug)
1964		addlog("\n");
1965
1966	/*
1967	 * pass 2: check for option values that are unacceptable and
1968	 * thus require to be nak'ed.
1969	 */
1970	if (debug)
1971		log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
1972		    SPP_ARGS(ifp));
1973
1974	p = (void*) (h+1);
1975	len = origlen;
1976	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
1977		if (debug)
1978			addlog(" %s ", sppp_lcp_opt_name(*p));
1979		switch (*p) {
1980		case LCP_OPT_MAGIC:
1981			/* Magic number -- extract. */
1982			nmagic = (u_long)p[2] << 24 |
1983				(u_long)p[3] << 16 | p[4] << 8 | p[5];
1984			if (nmagic != sp->lcp.magic) {
1985				if (debug)
1986					addlog("0x%lx ", nmagic);
1987				continue;
1988			}
1989			/*
1990			 * Local and remote magics equal -- loopback?
1991			 */
1992			if (sp->pp_loopcnt >= MAXALIVECNT*5) {
1993				printf (SPP_FMT "loopback\n",
1994					SPP_ARGS(ifp));
1995				sp->pp_loopcnt = 0;
1996				if (ifp->if_flags & IFF_UP) {
1997					if_down(ifp);
1998					sppp_qflush(&sp->pp_cpq);
1999					/* XXX ? */
2000					lcp.Down(sp);
2001					lcp.Up(sp);
2002				}
2003			} else if (debug)
2004				addlog("[glitch] ");
2005			++sp->pp_loopcnt;
2006			/*
2007			 * We negate our magic here, and NAK it.  If
2008			 * we see it later in an NAK packet, we
2009			 * suggest a new one.
2010			 */
2011			nmagic = ~sp->lcp.magic;
2012			/* Gonna NAK it. */
2013			p[2] = nmagic >> 24;
2014			p[3] = nmagic >> 16;
2015			p[4] = nmagic >> 8;
2016			p[5] = nmagic;
2017			break;
2018
2019		case LCP_OPT_ASYNC_MAP:
2020			/* Async control character map -- check to be zero. */
2021			if (! p[2] && ! p[3] && ! p[4] && ! p[5]) {
2022				if (debug)
2023					addlog("[empty] ");
2024				continue;
2025			}
2026			if (debug)
2027				addlog("[non-empty] ");
2028			/* suggest a zero one */
2029			p[2] = p[3] = p[4] = p[5] = 0;
2030			break;
2031
2032		case LCP_OPT_MRU:
2033			/*
2034			 * Maximum receive unit.  Always agreeable,
2035			 * but ignored by now.
2036			 */
2037			sp->lcp.their_mru = p[2] * 256 + p[3];
2038			if (debug)
2039				addlog("%lu ", sp->lcp.their_mru);
2040			continue;
2041
2042		case LCP_OPT_AUTH_PROTO:
2043			authproto = (p[2] << 8) + p[3];
2044			if (sp->myauth.proto != authproto) {
2045				/* not agreed, nak */
2046				if (debug)
2047					addlog("[mine %s != his %s] ",
2048					       sppp_proto_name(sp->hisauth.proto),
2049					       sppp_proto_name(authproto));
2050				p[2] = sp->myauth.proto >> 8;
2051				p[3] = sp->myauth.proto;
2052				break;
2053			}
2054			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2055				if (debug)
2056					addlog("[chap not MD5] ");
2057				p[4] = CHAP_MD5;
2058				break;
2059			}
2060			continue;
2061		}
2062		/* Add the option to nak'ed list. */
2063		bcopy (p, r, p[1]);
2064		r += p[1];
2065		rlen += p[1];
2066	}
2067	if (rlen) {
2068		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2069			if (debug)
2070				addlog(" max_failure (%d) exceeded, "
2071				       "send conf-rej\n",
2072				       sp->lcp.max_failure);
2073			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2074		} else {
2075			if (debug)
2076				addlog(" send conf-nak\n");
2077			sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2078		}
2079		return 0;
2080	} else {
2081		if (debug)
2082			addlog(" send conf-ack\n");
2083		sp->fail_counter[IDX_LCP] = 0;
2084		sp->pp_loopcnt = 0;
2085		sppp_cp_send (sp, PPP_LCP, CONF_ACK,
2086			      h->ident, origlen, h+1);
2087	}
2088
2089	free (buf, M_TEMP);
2090	return (rlen == 0);
2091}
2092
2093/*
2094 * Analyze the LCP Configure-Reject option list, and adjust our
2095 * negotiation.
2096 */
2097static void
2098sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2099{
2100	STDDCL;
2101	u_char *buf, *p;
2102
2103	len -= 4;
2104	buf = malloc (len, M_TEMP, M_NOWAIT);
2105	if (!buf)
2106		return;
2107
2108	if (debug)
2109		log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
2110		    SPP_ARGS(ifp));
2111
2112	p = (void*) (h+1);
2113	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2114		if (debug)
2115			addlog(" %s ", sppp_lcp_opt_name(*p));
2116		switch (*p) {
2117		case LCP_OPT_MAGIC:
2118			/* Magic number -- can't use it, use 0 */
2119			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2120			sp->lcp.magic = 0;
2121			break;
2122		case LCP_OPT_MRU:
2123			/*
2124			 * Should not be rejected anyway, since we only
2125			 * negotiate a MRU if explicitly requested by
2126			 * peer.
2127			 */
2128			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2129			break;
2130		case LCP_OPT_AUTH_PROTO:
2131			/*
2132			 * Peer doesn't want to authenticate himself,
2133			 * deny unless this is a dialout call, and
2134			 * AUTHFLAG_NOCALLOUT is set.
2135			 */
2136			if ((sp->pp_flags & PP_CALLIN) == 0 &&
2137			    (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
2138				if (debug)
2139					addlog("[don't insist on auth "
2140					       "for callout]");
2141				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2142				break;
2143			}
2144			if (debug)
2145				addlog("[access denied]\n");
2146			lcp.Close(sp);
2147			break;
2148		}
2149	}
2150	if (debug)
2151		addlog("\n");
2152	free (buf, M_TEMP);
2153	return;
2154}
2155
2156/*
2157 * Analyze the LCP Configure-NAK option list, and adjust our
2158 * negotiation.
2159 */
2160static void
2161sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2162{
2163	STDDCL;
2164	u_char *buf, *p;
2165	u_long magic;
2166
2167	len -= 4;
2168	buf = malloc (len, M_TEMP, M_NOWAIT);
2169	if (!buf)
2170		return;
2171
2172	if (debug)
2173		log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
2174		    SPP_ARGS(ifp));
2175
2176	p = (void*) (h+1);
2177	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2178		if (debug)
2179			addlog(" %s ", sppp_lcp_opt_name(*p));
2180		switch (*p) {
2181		case LCP_OPT_MAGIC:
2182			/* Magic number -- renegotiate */
2183			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2184			    len >= 6 && p[1] == 6) {
2185				magic = (u_long)p[2] << 24 |
2186					(u_long)p[3] << 16 | p[4] << 8 | p[5];
2187				/*
2188				 * If the remote magic is our negated one,
2189				 * this looks like a loopback problem.
2190				 * Suggest a new magic to make sure.
2191				 */
2192				if (magic == ~sp->lcp.magic) {
2193					if (debug)
2194						addlog("magic glitch ");
2195#if defined (__FreeBSD__)
2196					sp->lcp.magic = random();
2197#else
2198					sp->lcp.magic = time.tv_sec + time.tv_usec;
2199#endif
2200				} else {
2201					sp->lcp.magic = magic;
2202					if (debug)
2203						addlog("%lu ", magic);
2204				}
2205			}
2206			break;
2207		case LCP_OPT_MRU:
2208			/*
2209			 * Peer wants to advise us to negotiate an MRU.
2210			 * Agree on it if it's reasonable, or use
2211			 * default otherwise.
2212			 */
2213			if (len >= 4 && p[1] == 4) {
2214				u_int mru = p[2] * 256 + p[3];
2215				if (debug)
2216					addlog("%d ", mru);
2217				if (mru < PP_MTU || mru > PP_MAX_MRU)
2218					mru = PP_MTU;
2219				sp->lcp.mru = mru;
2220				sp->lcp.opts |= (1 << LCP_OPT_MRU);
2221			}
2222			break;
2223		case LCP_OPT_AUTH_PROTO:
2224			/*
2225			 * Peer doesn't like our authentication method,
2226			 * deny.
2227			 */
2228			if (debug)
2229				addlog("[access denied]\n");
2230			lcp.Close(sp);
2231			break;
2232		}
2233	}
2234	if (debug)
2235		addlog("\n");
2236	free (buf, M_TEMP);
2237	return;
2238}
2239
2240static void
2241sppp_lcp_tlu(struct sppp *sp)
2242{
2243	struct ifnet *ifp = &sp->pp_if;
2244	int i;
2245	u_long mask;
2246
2247	/* XXX ? */
2248	if (! (ifp->if_flags & IFF_UP) &&
2249	    (ifp->if_flags & IFF_RUNNING)) {
2250		/* Coming out of loopback mode. */
2251		if_up(ifp);
2252		printf (SPP_FMT "up\n", SPP_ARGS(ifp));
2253	}
2254
2255	for (i = 0; i < IDX_COUNT; i++)
2256		if ((cps[i])->flags & CP_QUAL)
2257			(cps[i])->Open(sp);
2258
2259	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2260	    (sp->pp_flags & PP_NEEDAUTH) != 0)
2261		sp->pp_phase = PHASE_AUTHENTICATE;
2262	else
2263		sp->pp_phase = PHASE_NETWORK;
2264
2265	log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2266	    sppp_phase_name(sp->pp_phase));
2267
2268	/*
2269	 * Open all authentication protocols.  This is even required
2270	 * if we already proceeded to network phase, since it might be
2271	 * that remote wants us to authenticate, so we might have to
2272	 * send a PAP request.  Undesired authentication protocols
2273	 * don't do anything when they get an Open event.
2274	 */
2275	for (i = 0; i < IDX_COUNT; i++)
2276		if ((cps[i])->flags & CP_AUTH)
2277			(cps[i])->Open(sp);
2278
2279	if (sp->pp_phase == PHASE_NETWORK) {
2280		/* Notify all NCPs. */
2281		for (i = 0; i < IDX_COUNT; i++)
2282			if ((cps[i])->flags & CP_NCP)
2283				(cps[i])->Open(sp);
2284	}
2285
2286	/* Send Up events to all started protos. */
2287	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2288		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0)
2289			(cps[i])->Up(sp);
2290
2291	if (sp->pp_phase == PHASE_NETWORK)
2292		/* if no NCP is starting, close down */
2293		sppp_lcp_check_and_close(sp);
2294}
2295
2296static void
2297sppp_lcp_tld(struct sppp *sp)
2298{
2299	struct ifnet *ifp = &sp->pp_if;
2300	int i;
2301	u_long mask;
2302
2303	sp->pp_phase = PHASE_TERMINATE;
2304
2305	log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2306	    sppp_phase_name(sp->pp_phase));
2307
2308	/*
2309	 * Take upper layers down.  We send the Down event first and
2310	 * the Close second to prevent the upper layers from sending
2311	 * ``a flurry of terminate-request packets'', as the RFC
2312	 * describes it.
2313	 */
2314	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2315		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) {
2316			(cps[i])->Down(sp);
2317			(cps[i])->Close(sp);
2318		}
2319}
2320
2321static void
2322sppp_lcp_tls(struct sppp *sp)
2323{
2324	struct ifnet *ifp = &sp->pp_if;
2325
2326	sp->pp_phase = PHASE_ESTABLISH;
2327
2328	log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2329	    sppp_phase_name(sp->pp_phase));
2330
2331	/* Notify lower layer if desired. */
2332	if (sp->pp_tls)
2333		(sp->pp_tls)(sp);
2334	else
2335		(sp->pp_up)(sp);
2336}
2337
2338static void
2339sppp_lcp_tlf(struct sppp *sp)
2340{
2341	struct ifnet *ifp = &sp->pp_if;
2342
2343	sp->pp_phase = PHASE_DEAD;
2344	log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2345	    sppp_phase_name(sp->pp_phase));
2346
2347	/* Notify lower layer if desired. */
2348	if (sp->pp_tlf)
2349		(sp->pp_tlf)(sp);
2350	else
2351		(sp->pp_down)(sp);
2352}
2353
2354static void
2355sppp_lcp_scr(struct sppp *sp)
2356{
2357	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2358	int i = 0;
2359	u_short authproto;
2360
2361	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2362		if (! sp->lcp.magic)
2363#if defined (__FreeBSD__)
2364			sp->lcp.magic = random();
2365#else
2366			sp->lcp.magic = time.tv_sec + time.tv_usec;
2367#endif
2368		opt[i++] = LCP_OPT_MAGIC;
2369		opt[i++] = 6;
2370		opt[i++] = sp->lcp.magic >> 24;
2371		opt[i++] = sp->lcp.magic >> 16;
2372		opt[i++] = sp->lcp.magic >> 8;
2373		opt[i++] = sp->lcp.magic;
2374	}
2375
2376	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2377		opt[i++] = LCP_OPT_MRU;
2378		opt[i++] = 4;
2379		opt[i++] = sp->lcp.mru >> 8;
2380		opt[i++] = sp->lcp.mru;
2381	}
2382
2383	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2384		authproto = sp->hisauth.proto;
2385		opt[i++] = LCP_OPT_AUTH_PROTO;
2386		opt[i++] = authproto == PPP_CHAP? 5: 4;
2387		opt[i++] = authproto >> 8;
2388		opt[i++] = authproto;
2389		if (authproto == PPP_CHAP)
2390			opt[i++] = CHAP_MD5;
2391	}
2392
2393	sp->confid[IDX_LCP] = ++sp->pp_seq;
2394	sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
2395}
2396
2397/*
2398 * Check the open NCPs, return true if at least one NCP is open.
2399 */
2400static int
2401sppp_ncp_check(struct sppp *sp)
2402{
2403	int i, mask;
2404
2405	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2406		if (sp->lcp.protos & mask && (cps[i])->flags & CP_NCP)
2407			return 1;
2408	return 0;
2409}
2410
2411/*
2412 * Re-check the open NCPs and see if we should terminate the link.
2413 * Called by the NCPs during their tlf action handling.
2414 */
2415static void
2416sppp_lcp_check_and_close(struct sppp *sp)
2417{
2418
2419	if (sp->pp_phase < PHASE_NETWORK)
2420		/* don't bother, we are already going down */
2421		return;
2422
2423	if (sppp_ncp_check(sp))
2424		return;
2425
2426	lcp.Close(sp);
2427}
2428/*
2429 *--------------------------------------------------------------------------*
2430 *                                                                          *
2431 *                        The IPCP implementation.                          *
2432 *                                                                          *
2433 *--------------------------------------------------------------------------*
2434 */
2435
2436static void
2437sppp_ipcp_init(struct sppp *sp)
2438{
2439	sp->ipcp.opts = 0;
2440	sp->ipcp.flags = 0;
2441	sp->state[IDX_IPCP] = STATE_INITIAL;
2442	sp->fail_counter[IDX_IPCP] = 0;
2443#if defined (__FreeBSD__)
2444	callout_handle_init(&sp->ch[IDX_IPCP]);
2445#endif
2446}
2447
2448static void
2449sppp_ipcp_up(struct sppp *sp)
2450{
2451	sppp_up_event(&ipcp, sp);
2452}
2453
2454static void
2455sppp_ipcp_down(struct sppp *sp)
2456{
2457	sppp_down_event(&ipcp, sp);
2458}
2459
2460static void
2461sppp_ipcp_open(struct sppp *sp)
2462{
2463	STDDCL;
2464	u_long myaddr, hisaddr;
2465
2466	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
2467	/*
2468	 * If we don't have his address, this probably means our
2469	 * interface doesn't want to talk IP at all.  (This could
2470	 * be the case if somebody wants to speak only IPX, for
2471	 * example.)  Don't open IPCP in this case.
2472	 */
2473	if (hisaddr == 0L) {
2474		/* XXX this message should go away */
2475		if (debug)
2476			log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
2477			    SPP_ARGS(ifp));
2478		return;
2479	}
2480
2481	if (myaddr == 0L) {
2482		/*
2483		 * I don't have an assigned address, so i need to
2484		 * negotiate my address.
2485		 */
2486		sp->ipcp.flags |= IPCP_MYADDR_DYN;
2487		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2488	}
2489	sppp_open_event(&ipcp, sp);
2490}
2491
2492static void
2493sppp_ipcp_close(struct sppp *sp)
2494{
2495	sppp_close_event(&ipcp, sp);
2496	if (sp->ipcp.flags & IPCP_MYADDR_DYN)
2497		/*
2498		 * My address was dynamic, clear it again.
2499		 */
2500		sppp_set_ip_addr(sp, 0L);
2501}
2502
2503static void
2504sppp_ipcp_TO(void *cookie)
2505{
2506	sppp_to_event(&ipcp, (struct sppp *)cookie);
2507}
2508
2509/*
2510 * Analyze a configure request.  Return true if it was agreeable, and
2511 * caused action sca, false if it has been rejected or nak'ed, and
2512 * caused action scn.  (The return value is used to make the state
2513 * transition decision in the state automaton.)
2514 */
2515static int
2516sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2517{
2518	u_char *buf, *r, *p;
2519	struct ifnet *ifp = &sp->pp_if;
2520	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
2521	u_long hisaddr, desiredaddr;
2522
2523	len -= 4;
2524	origlen = len;
2525	/*
2526	 * Make sure to allocate a buf that can at least hold a
2527	 * conf-nak with an `address' option.  We might need it below.
2528	 */
2529	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
2530	if (! buf)
2531		return (0);
2532
2533	/* pass 1: see if we can recognize them */
2534	if (debug)
2535		log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
2536		    SPP_ARGS(ifp));
2537	p = (void*) (h+1);
2538	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2539		if (debug)
2540			addlog(" %s ", sppp_ipcp_opt_name(*p));
2541		switch (*p) {
2542#ifdef notyet
2543		case IPCP_OPT_COMPRESSION:
2544			if (len >= 6 && p[1] >= 6) {
2545				/* correctly formed compress option */
2546				continue;
2547			}
2548			if (debug)
2549				addlog("[invalid] ");
2550			break;
2551#endif
2552		case IPCP_OPT_ADDRESS:
2553			if (len >= 6 && p[1] == 6) {
2554				/* correctly formed address option */
2555				continue;
2556			}
2557			if (debug)
2558				addlog("[invalid] ");
2559			break;
2560		default:
2561			/* Others not supported. */
2562			if (debug)
2563				addlog("[rej] ");
2564			break;
2565		}
2566		/* Add the option to rejected list. */
2567		bcopy (p, r, p[1]);
2568		r += p[1];
2569		rlen += p[1];
2570	}
2571	if (rlen) {
2572		if (debug)
2573			addlog(" send conf-rej\n");
2574		sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
2575		return 0;
2576	} else if (debug)
2577		addlog("\n");
2578
2579	/* pass 2: parse option values */
2580	sppp_get_ip_addrs(sp, 0, &hisaddr, 0);
2581	if (debug)
2582		log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
2583		       SPP_ARGS(ifp));
2584	p = (void*) (h+1);
2585	len = origlen;
2586	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2587		if (debug)
2588			addlog(" %s ", sppp_ipcp_opt_name(*p));
2589		switch (*p) {
2590#ifdef notyet
2591		case IPCP_OPT_COMPRESSION:
2592			continue;
2593#endif
2594		case IPCP_OPT_ADDRESS:
2595			desiredaddr = p[2] << 24 | p[3] << 16 |
2596				p[4] << 8 | p[5];
2597			if (desiredaddr == hisaddr ||
2598			    hisaddr == 1 && desiredaddr != 0) {
2599				/*
2600				 * Peer's address is same as our value,
2601				 * or we have set it to 0.0.0.1 to
2602				 * indicate that we do not really care,
2603				 * this is agreeable.  Gonna conf-ack
2604				 * it.
2605				 */
2606				if (debug)
2607					addlog("%s [ack] ",
2608					       sppp_dotted_quad(desiredaddr));
2609				/* record that we've seen it already */
2610				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
2611				continue;
2612			}
2613			/*
2614			 * The address wasn't agreeable.  This is either
2615			 * he sent us 0.0.0.0, asking to assign him an
2616			 * address, or he send us another address not
2617			 * matching our value.  Either case, we gonna
2618			 * conf-nak it with our value.
2619			 */
2620			if (debug) {
2621				if (desiredaddr == 0)
2622					addlog("[addr requested] ");
2623				else
2624					addlog("%s [not agreed] ",
2625					       sppp_dotted_quad(desiredaddr));
2626
2627				p[2] = hisaddr >> 24;
2628				p[3] = hisaddr >> 16;
2629				p[4] = hisaddr >> 8;
2630				p[5] = hisaddr;
2631			}
2632			break;
2633		}
2634		/* Add the option to nak'ed list. */
2635		bcopy (p, r, p[1]);
2636		r += p[1];
2637		rlen += p[1];
2638	}
2639
2640	/*
2641	 * If we are about to conf-ack the request, but haven't seen
2642	 * his address so far, gonna conf-nak it instead, with the
2643	 * `address' option present and our idea of his address being
2644	 * filled in there, to request negotiation of both addresses.
2645	 *
2646	 * XXX This can result in an endless req - nak loop if peer
2647	 * doesn't want to send us his address.  Q: What should we do
2648	 * about it?  XXX  A: implement the max-failure counter.
2649	 */
2650	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
2651		buf[0] = IPCP_OPT_ADDRESS;
2652		buf[1] = 6;
2653		buf[2] = hisaddr >> 24;
2654		buf[3] = hisaddr >> 16;
2655		buf[4] = hisaddr >> 8;
2656		buf[5] = hisaddr;
2657		rlen = 6;
2658		if (debug)
2659			addlog("still need hisaddr ");
2660	}
2661
2662	if (rlen) {
2663		if (debug)
2664			addlog(" send conf-nak\n");
2665		sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
2666	} else {
2667		if (debug)
2668			addlog(" send conf-ack\n");
2669		sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
2670			      h->ident, origlen, h+1);
2671	}
2672
2673	free (buf, M_TEMP);
2674	return (rlen == 0);
2675}
2676
2677/*
2678 * Analyze the IPCP Configure-Reject option list, and adjust our
2679 * negotiation.
2680 */
2681static void
2682sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2683{
2684	u_char *buf, *p;
2685	struct ifnet *ifp = &sp->pp_if;
2686	int debug = ifp->if_flags & IFF_DEBUG;
2687
2688	len -= 4;
2689	buf = malloc (len, M_TEMP, M_NOWAIT);
2690	if (!buf)
2691		return;
2692
2693	if (debug)
2694		log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
2695		    SPP_ARGS(ifp));
2696
2697	p = (void*) (h+1);
2698	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2699		if (debug)
2700			addlog(" %s ", sppp_ipcp_opt_name(*p));
2701		switch (*p) {
2702		case IPCP_OPT_ADDRESS:
2703			/*
2704			 * Peer doesn't grok address option.  This is
2705			 * bad.  XXX  Should we better give up here?
2706			 */
2707			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
2708			break;
2709#ifdef notyet
2710		case IPCP_OPT_COMPRESS:
2711			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
2712			break;
2713#endif
2714		}
2715	}
2716	if (debug)
2717		addlog("\n");
2718	free (buf, M_TEMP);
2719	return;
2720}
2721
2722/*
2723 * Analyze the IPCP Configure-NAK option list, and adjust our
2724 * negotiation.
2725 */
2726static void
2727sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2728{
2729	u_char *buf, *p;
2730	struct ifnet *ifp = &sp->pp_if;
2731	int debug = ifp->if_flags & IFF_DEBUG;
2732	u_long wantaddr;
2733
2734	len -= 4;
2735	buf = malloc (len, M_TEMP, M_NOWAIT);
2736	if (!buf)
2737		return;
2738
2739	if (debug)
2740		log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
2741		    SPP_ARGS(ifp));
2742
2743	p = (void*) (h+1);
2744	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2745		if (debug)
2746			addlog(" %s ", sppp_ipcp_opt_name(*p));
2747		switch (*p) {
2748		case IPCP_OPT_ADDRESS:
2749			/*
2750			 * Peer doesn't like our local IP address.  See
2751			 * if we can do something for him.  We'll drop
2752			 * him our address then.
2753			 */
2754			if (len >= 6 && p[1] == 6) {
2755				wantaddr = p[2] << 24 | p[3] << 16 |
2756					p[4] << 8 | p[5];
2757				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2758				if (debug)
2759					addlog("[wantaddr %s] ",
2760					       sppp_dotted_quad(wantaddr));
2761				/*
2762				 * When doing dynamic address assignment,
2763				 * we accept his offer.  Otherwise, we
2764				 * ignore it and thus continue to negotiate
2765				 * our already existing value.
2766				 */
2767				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
2768					sppp_set_ip_addr(sp, wantaddr);
2769					if (debug)
2770						addlog("[agree] ");
2771				}
2772			}
2773			break;
2774#ifdef notyet
2775		case IPCP_OPT_COMPRESS:
2776			/*
2777			 * Peer wants different compression parameters.
2778			 */
2779			break;
2780#endif
2781		}
2782	}
2783	if (debug)
2784		addlog("\n");
2785	free (buf, M_TEMP);
2786	return;
2787}
2788
2789static void
2790sppp_ipcp_tlu(struct sppp *sp)
2791{
2792}
2793
2794static void
2795sppp_ipcp_tld(struct sppp *sp)
2796{
2797}
2798
2799static void
2800sppp_ipcp_tls(struct sppp *sp)
2801{
2802	/* indicate to LCP that it must stay alive */
2803	sp->lcp.protos |= (1 << IDX_IPCP);
2804}
2805
2806static void
2807sppp_ipcp_tlf(struct sppp *sp)
2808{
2809	/* we no longer need LCP */
2810	sp->lcp.protos &= ~(1 << IDX_IPCP);
2811	sppp_lcp_check_and_close(sp);
2812}
2813
2814static void
2815sppp_ipcp_scr(struct sppp *sp)
2816{
2817	char opt[6 /* compression */ + 6 /* address */];
2818	u_long ouraddr;
2819	int i = 0;
2820
2821#ifdef notyet
2822	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
2823		opt[i++] = IPCP_OPT_COMPRESSION;
2824		opt[i++] = 6;
2825		opt[i++] = 0;	/* VJ header compression */
2826		opt[i++] = 0x2d; /* VJ header compression */
2827		opt[i++] = max_slot_id;
2828		opt[i++] = comp_slot_id;
2829	}
2830#endif
2831
2832	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
2833		sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
2834		opt[i++] = IPCP_OPT_ADDRESS;
2835		opt[i++] = 6;
2836		opt[i++] = ouraddr >> 24;
2837		opt[i++] = ouraddr >> 16;
2838		opt[i++] = ouraddr >> 8;
2839		opt[i++] = ouraddr;
2840	}
2841
2842	sp->confid[IDX_IPCP] = ++sp->pp_seq;
2843	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
2844}
2845
2846
2847/*
2848 *--------------------------------------------------------------------------*
2849 *                                                                          *
2850 *                        The CHAP implementation.                          *
2851 *                                                                          *
2852 *--------------------------------------------------------------------------*
2853 */
2854
2855/*
2856 * The authentication protocols don't employ a full-fledged state machine as
2857 * the control protocols do, since they do have Open and Close events, but
2858 * not Up and Down, nor are they explicitly terminated.  Also, use of the
2859 * authentication protocols may be different in both directions (this makes
2860 * sense, think of a machine that never accepts incoming calls but only
2861 * calls out, it doesn't require the called party to authenticate itself).
2862 *
2863 * Our state machine for the local authentication protocol (we are requesting
2864 * the peer to authenticate) looks like:
2865 *
2866 *						    RCA-
2867 *	      +--------------------------------------------+
2868 *	      V					    scn,tld|
2869 *	  +--------+			       Close   +---------+ RCA+
2870 *	  |	   |<----------------------------------|	 |------+
2871 *   +--->| Closed |				TO*    | Opened	 | sca	|
2872 *   |	  |	   |-----+		       +-------|	 |<-----+
2873 *   |	  +--------+ irc |		       |       +---------+
2874 *   |	    ^		 |		       |	   ^
2875 *   |	    |		 |		       |	   |
2876 *   |	    |		 |		       |	   |
2877 *   |	 TO-|		 |		       |	   |
2878 *   |	    |tld  TO+	 V		       |	   |
2879 *   |	    |	+------->+		       |	   |
2880 *   |	    |	|	 |		       |	   |
2881 *   |	  +--------+	 V		       |	   |
2882 *   |	  |	   |<----+<--------------------+	   |
2883 *   |	  | Req-   | scr				   |
2884 *   |	  | Sent   |					   |
2885 *   |	  |	   |					   |
2886 *   |	  +--------+					   |
2887 *   | RCA- |	| RCA+					   |
2888 *   +------+	+------------------------------------------+
2889 *   scn,tld	  sca,irc,ict,tlu
2890 *
2891 *
2892 *   with:
2893 *
2894 *	Open:	LCP reached authentication phase
2895 *	Close:	LCP reached terminate phase
2896 *
2897 *	RCA+:	received reply (pap-req, chap-response), acceptable
2898 *	RCN:	received reply (pap-req, chap-response), not acceptable
2899 *	TO+:	timeout with restart counter >= 0
2900 *	TO-:	timeout with restart counter < 0
2901 *	TO*:	reschedule timeout for CHAP
2902 *
2903 *	scr:	send request packet (none for PAP, chap-challenge)
2904 *	sca:	send ack packet (pap-ack, chap-success)
2905 *	scn:	send nak packet (pap-nak, chap-failure)
2906 *	ict:	initialize re-challenge timer (CHAP only)
2907 *
2908 *	tlu:	this-layer-up, LCP reaches network phase
2909 *	tld:	this-layer-down, LCP enters terminate phase
2910 *
2911 * Note that in CHAP mode, after sending a new challenge, while the state
2912 * automaton falls back into Req-Sent state, it doesn't signal a tld
2913 * event to LCP, so LCP remains in network phase.  Only after not getting
2914 * any response (or after getting an unacceptable response), CHAP closes,
2915 * causing LCP to enter terminate phase.
2916 *
2917 * With PAP, there is no initial request that can be sent.  The peer is
2918 * expected to send one based on the successful negotiation of PAP as
2919 * the authentication protocol during the LCP option negotiation.
2920 *
2921 * Incoming authentication protocol requests (remote requests
2922 * authentication, we are peer) don't employ a state machine at all,
2923 * they are simply answered.  Some peers [Ascend P50 firmware rev
2924 * 4.50] react allergically when sending IPCP requests while they are
2925 * still in authentication phase (thereby violating the standard that
2926 * demands that these NCP packets are to be discarded), so we keep
2927 * track of the peer demanding us to authenticate, and only proceed to
2928 * phase network once we've seen a positive acknowledge for the
2929 * authentication.
2930 */
2931
2932/*
2933 * Handle incoming CHAP packets.
2934 */
2935void
2936sppp_chap_input(struct sppp *sp, struct mbuf *m)
2937{
2938	STDDCL;
2939	struct lcp_header *h;
2940	int len, x;
2941	u_char *value, *name, digest[AUTHKEYLEN], dsize;
2942	int value_len, name_len;
2943	MD5_CTX ctx;
2944
2945	len = m->m_pkthdr.len;
2946	if (len < 4) {
2947		if (debug)
2948			log(LOG_DEBUG,
2949			    SPP_FMT "chap invalid packet length: %d bytes\n",
2950			    SPP_ARGS(ifp), len);
2951		return;
2952	}
2953	h = mtod (m, struct lcp_header*);
2954	if (len > ntohs (h->len))
2955		len = ntohs (h->len);
2956
2957	switch (h->type) {
2958	/* challenge, failure and success are his authproto */
2959	case CHAP_CHALLENGE:
2960		value = 1 + (u_char*)(h+1);
2961		value_len = value[-1];
2962		name = value + value_len;
2963		name_len = len - value_len - 5;
2964		if (name_len < 0) {
2965			if (debug) {
2966				log(LOG_DEBUG,
2967				    SPP_FMT "chap corrupted challenge "
2968				    "<%s id=0x%x len=%d",
2969				    SPP_ARGS(ifp),
2970				    sppp_auth_type_name(PPP_CHAP, h->type),
2971				    h->ident, ntohs(h->len));
2972				if (len > 4)
2973					sppp_print_bytes((u_char*) (h+1), len-4);
2974				addlog(">\n");
2975			}
2976			break;
2977		}
2978
2979		if (debug) {
2980			log(LOG_DEBUG,
2981			    SPP_FMT "chap input <%s id=0x%x len=%d name=",
2982			    SPP_ARGS(ifp),
2983			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
2984			    ntohs(h->len));
2985			sppp_print_string((char*) name, name_len);
2986			addlog(" value-size=%d value=", value_len);
2987			sppp_print_bytes(value, value_len);
2988			addlog(">\n");
2989		}
2990
2991		/* Compute reply value. */
2992		MD5Init(&ctx);
2993		MD5Update(&ctx, &h->ident, 1);
2994		MD5Update(&ctx, sp->myauth.secret,
2995			  sppp_strnlen(sp->myauth.secret, AUTHKEYLEN));
2996		MD5Update(&ctx, value, value_len);
2997		MD5Final(digest, &ctx);
2998		dsize = sizeof digest;
2999
3000		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
3001			       sizeof dsize, (const char *)&dsize,
3002			       sizeof digest, digest,
3003			       (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
3004			       sp->myauth.name,
3005			       0);
3006		break;
3007
3008	case CHAP_SUCCESS:
3009		if (debug) {
3010			log(LOG_DEBUG, SPP_FMT "chap success",
3011			    SPP_ARGS(ifp));
3012			if (len > 4) {
3013				addlog(": ");
3014				sppp_print_string((char*)(h + 1), len - 4);
3015			}
3016			addlog("\n");
3017		}
3018		x = splimp();
3019		sp->pp_flags &= ~PP_NEEDAUTH;
3020		if (sp->myauth.proto == PPP_CHAP &&
3021		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3022		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
3023			/*
3024			 * We are authenticator for CHAP but didn't
3025			 * complete yet.  Leave it to tlu to proceed
3026			 * to network phase.
3027			 */
3028			splx(x);
3029			break;
3030		}
3031		splx(x);
3032		sppp_phase_network(sp);
3033		break;
3034
3035	case CHAP_FAILURE:
3036		if (debug) {
3037			log(LOG_INFO, SPP_FMT "chap failure",
3038			    SPP_ARGS(ifp));
3039			if (len > 4) {
3040				addlog(": ");
3041				sppp_print_string((char*)(h + 1), len - 4);
3042			}
3043			addlog("\n");
3044		} else
3045			log(LOG_INFO, SPP_FMT "chap failure\n",
3046			    SPP_ARGS(ifp));
3047		/* await LCP shutdown by authenticator */
3048		break;
3049
3050	/* response is my authproto */
3051	case CHAP_RESPONSE:
3052		value = 1 + (u_char*)(h+1);
3053		value_len = value[-1];
3054		name = value + value_len;
3055		name_len = len - value_len - 5;
3056		if (name_len < 0) {
3057			if (debug) {
3058				log(LOG_DEBUG,
3059				    SPP_FMT "chap corrupted response "
3060				    "<%s id=0x%x len=%d",
3061				    SPP_ARGS(ifp),
3062				    sppp_auth_type_name(PPP_CHAP, h->type),
3063				    h->ident, ntohs(h->len));
3064				if (len > 4)
3065					sppp_print_bytes((u_char*)(h+1), len-4);
3066				addlog(">\n");
3067			}
3068			break;
3069		}
3070		if (h->ident != sp->confid[IDX_CHAP]) {
3071			if (debug)
3072				log(LOG_DEBUG,
3073				    SPP_FMT "chap dropping response for old ID "
3074				    "(got %d, expected %d)\n",
3075				    SPP_ARGS(ifp),
3076				    h->ident, sp->confid[IDX_CHAP]);
3077			break;
3078		}
3079		if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN)
3080		    || bcmp(name, sp->hisauth.name, name_len) != 0) {
3081			log(LOG_INFO, SPP_FMT "chap response, his name ",
3082			    SPP_ARGS(ifp));
3083			sppp_print_string(name, name_len);
3084			addlog(" != expected ");
3085			sppp_print_string(sp->hisauth.name,
3086					  sppp_strnlen(sp->hisauth.name, AUTHNAMELEN));
3087			addlog("\n");
3088		}
3089		if (debug) {
3090			log(LOG_DEBUG, SPP_FMT "chap input(%s) "
3091			    "<%s id=0x%x len=%d name=",
3092			    SPP_ARGS(ifp),
3093			    sppp_state_name(sp->state[IDX_CHAP]),
3094			    sppp_auth_type_name(PPP_CHAP, h->type),
3095			    h->ident, ntohs (h->len));
3096			sppp_print_string((char*)name, name_len);
3097			addlog(" value-size=%d value=", value_len);
3098			sppp_print_bytes(value, value_len);
3099			addlog(">\n");
3100		}
3101		if (value_len != AUTHKEYLEN) {
3102			if (debug)
3103				log(LOG_DEBUG,
3104				    SPP_FMT "chap bad hash value length: "
3105				    "%d bytes, should be %d\n",
3106				    SPP_ARGS(ifp), value_len,
3107				    AUTHKEYLEN);
3108			break;
3109		}
3110
3111		MD5Init(&ctx);
3112		MD5Update(&ctx, &h->ident, 1);
3113		MD5Update(&ctx, sp->hisauth.secret,
3114			  sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN));
3115		MD5Update(&ctx, sp->myauth.challenge, AUTHKEYLEN);
3116		MD5Final(digest, &ctx);
3117
3118#define FAILMSG "Failed..."
3119#define SUCCMSG "Welcome!"
3120
3121		if (value_len != sizeof digest ||
3122		    bcmp(digest, value, value_len) != 0) {
3123			/* action scn, tld */
3124			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
3125				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
3126				       0);
3127			chap.tld(sp);
3128			break;
3129		}
3130		/* action sca, perhaps tlu */
3131		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
3132		    sp->state[IDX_CHAP] == STATE_OPENED)
3133			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
3134				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
3135				       0);
3136		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
3137			sppp_cp_change_state(&chap, sp, STATE_OPENED);
3138			chap.tlu(sp);
3139		}
3140		break;
3141
3142	default:
3143		/* Unknown CHAP packet type -- ignore. */
3144		if (debug) {
3145			log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
3146			    "<0x%x id=0x%xh len=%d",
3147			    SPP_ARGS(ifp),
3148			    sppp_state_name(sp->state[IDX_CHAP]),
3149			    h->type, h->ident, ntohs(h->len));
3150			if (len > 4)
3151				sppp_print_bytes((u_char*)(h+1), len-4);
3152			addlog(">\n");
3153		}
3154		break;
3155
3156	}
3157}
3158
3159static void
3160sppp_chap_init(struct sppp *sp)
3161{
3162	/* Chap doesn't have STATE_INITIAL at all. */
3163	sp->state[IDX_CHAP] = STATE_CLOSED;
3164	sp->fail_counter[IDX_CHAP] = 0;
3165#if defined (__FreeBSD__)
3166	callout_handle_init(&sp->ch[IDX_CHAP]);
3167#endif
3168}
3169
3170static void
3171sppp_chap_open(struct sppp *sp)
3172{
3173	if (sp->myauth.proto == PPP_CHAP &&
3174	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
3175		/* we are authenticator for CHAP, start it */
3176		chap.scr(sp);
3177		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3178		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
3179	}
3180	/* nothing to be done if we are peer, await a challenge */
3181}
3182
3183static void
3184sppp_chap_close(struct sppp *sp)
3185{
3186	if (sp->state[IDX_CHAP] != STATE_CLOSED)
3187		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3188}
3189
3190static void
3191sppp_chap_TO(void *cookie)
3192{
3193	struct sppp *sp = (struct sppp *)cookie;
3194	STDDCL;
3195	int s;
3196
3197	s = splimp();
3198	if (debug)
3199		log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
3200		    SPP_ARGS(ifp),
3201		    sppp_state_name(sp->state[IDX_CHAP]),
3202		    sp->rst_counter[IDX_CHAP]);
3203
3204	if (--sp->rst_counter[IDX_CHAP] < 0)
3205		/* TO- event */
3206		switch (sp->state[IDX_CHAP]) {
3207		case STATE_REQ_SENT:
3208			chap.tld(sp);
3209			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3210			break;
3211		}
3212	else
3213		/* TO+ (or TO*) event */
3214		switch (sp->state[IDX_CHAP]) {
3215		case STATE_OPENED:
3216			/* TO* event */
3217			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3218			/* fall through */
3219		case STATE_REQ_SENT:
3220			chap.scr(sp);
3221			/* sppp_cp_change_state() will restart the timer */
3222			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
3223			break;
3224		}
3225
3226	splx(s);
3227}
3228
3229static void
3230sppp_chap_tlu(struct sppp *sp)
3231{
3232	STDDCL;
3233	int i, x;
3234
3235	i = 0;
3236	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3237
3238	/*
3239	 * Some broken CHAP implementations (Conware CoNet, firmware
3240	 * 4.0.?) don't want to re-authenticate their CHAP once the
3241	 * initial challenge-response exchange has taken place.
3242	 * Provide for an option to avoid rechallenges.
3243	 */
3244	if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) {
3245		/*
3246		 * Compute the re-challenge timeout.  This will yield
3247		 * a number between 300 and 810 seconds.
3248		 */
3249		i = 300 + ((unsigned)(random() & 0xff00) >> 7);
3250		TIMEOUT(chap.TO, (void *)sp, i * hz, sp->ch[IDX_CHAP]);
3251	}
3252
3253	if (debug) {
3254		log(LOG_DEBUG,
3255		    SPP_FMT "chap %s, ",
3256		    SPP_ARGS(ifp),
3257		    sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu");
3258		if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0)
3259			addlog("next re-challenge in %d seconds\n", i);
3260		else
3261			addlog("re-challenging supressed\n");
3262	}
3263
3264	x = splimp();
3265	/* indicate to LCP that we need to be closed down */
3266	sp->lcp.protos |= (1 << IDX_CHAP);
3267
3268	if (sp->pp_flags & PP_NEEDAUTH) {
3269		/*
3270		 * Remote is authenticator, but his auth proto didn't
3271		 * complete yet.  Defer the transition to network
3272		 * phase.
3273		 */
3274		splx(x);
3275		return;
3276	}
3277	splx(x);
3278
3279	/*
3280	 * If we are already in phase network, we are done here.  This
3281	 * is the case if this is a dummy tlu event after a re-challenge.
3282	 */
3283	if (sp->pp_phase != PHASE_NETWORK)
3284		sppp_phase_network(sp);
3285}
3286
3287static void
3288sppp_chap_tld(struct sppp *sp)
3289{
3290	STDDCL;
3291
3292	if (debug)
3293		log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
3294	UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]);
3295	sp->lcp.protos &= ~(1 << IDX_CHAP);
3296
3297	lcp.Close(sp);
3298}
3299
3300static void
3301sppp_chap_scr(struct sppp *sp)
3302{
3303	u_long *ch, seed;
3304	u_char clen;
3305#if defined (__NetBSD__) || defined (__OpenBSD__)
3306	struct timeval tv;
3307#endif
3308
3309	/* Compute random challenge. */
3310	ch = (u_long *)sp->myauth.challenge;
3311#if defined (__FreeBSD__)
3312	read_random(&seed, sizeof seed);
3313#else
3314	microtime(&tv);
3315	seed = tv.tv_sec ^ tv.tv_usec;
3316#endif
3317	ch[0] = seed ^ random();
3318	ch[1] = seed ^ random();
3319	ch[2] = seed ^ random();
3320	ch[3] = seed ^ random();
3321	clen = AUTHKEYLEN;
3322
3323	sp->confid[IDX_CHAP] = ++sp->pp_seq;
3324
3325	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
3326		       sizeof clen, (const char *)&clen,
3327		       (size_t)AUTHKEYLEN, sp->myauth.challenge,
3328		       (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
3329		       sp->myauth.name,
3330		       0);
3331}
3332/*
3333 *--------------------------------------------------------------------------*
3334 *                                                                          *
3335 *                        The PAP implementation.                           *
3336 *                                                                          *
3337 *--------------------------------------------------------------------------*
3338 */
3339/*
3340 * For PAP, we need to keep a little state also if we are the peer, not the
3341 * authenticator.  This is since we don't get a request to authenticate, but
3342 * have to repeatedly authenticate ourself until we got a response (or the
3343 * retry counter is expired).
3344 */
3345
3346/*
3347 * Handle incoming PAP packets.  */
3348static void
3349sppp_pap_input(struct sppp *sp, struct mbuf *m)
3350{
3351	STDDCL;
3352	struct lcp_header *h;
3353	int len, x;
3354	u_char *name, *passwd, mlen;
3355	int name_len, passwd_len;
3356
3357	len = m->m_pkthdr.len;
3358	if (len < 5) {
3359		if (debug)
3360			log(LOG_DEBUG,
3361			    SPP_FMT "pap invalid packet length: %d bytes\n",
3362			    SPP_ARGS(ifp), len);
3363		return;
3364	}
3365	h = mtod (m, struct lcp_header*);
3366	if (len > ntohs (h->len))
3367		len = ntohs (h->len);
3368	switch (h->type) {
3369	/* PAP request is my authproto */
3370	case PAP_REQ:
3371		name = 1 + (u_char*)(h+1);
3372		name_len = name[-1];
3373		passwd = name + name_len + 1;
3374		if (name_len > len - 6 ||
3375		    (passwd_len = passwd[-1]) > len - 6 - name_len) {
3376			if (debug) {
3377				log(LOG_DEBUG, SPP_FMT "pap corrupted input "
3378				    "<%s id=0x%x len=%d",
3379				    SPP_ARGS(ifp),
3380				    sppp_auth_type_name(PPP_PAP, h->type),
3381				    h->ident, ntohs(h->len));
3382				if (len > 4)
3383					sppp_print_bytes((u_char*)(h+1), len-4);
3384				addlog(">\n");
3385			}
3386			break;
3387		}
3388		if (debug) {
3389			log(LOG_DEBUG, SPP_FMT "pap input(%s) "
3390			    "<%s id=0x%x len=%d name=",
3391			    SPP_ARGS(ifp),
3392			    sppp_state_name(sp->state[IDX_PAP]),
3393			    sppp_auth_type_name(PPP_PAP, h->type),
3394			    h->ident, ntohs(h->len));
3395			sppp_print_string((char*)name, name_len);
3396			addlog(" passwd=");
3397			sppp_print_string((char*)passwd, passwd_len);
3398			addlog(">\n");
3399		}
3400		if (name_len > AUTHNAMELEN ||
3401		    passwd_len > AUTHKEYLEN ||
3402		    bcmp(name, sp->hisauth.name, name_len) != 0 ||
3403		    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
3404			/* action scn, tld */
3405			mlen = sizeof(FAILMSG) - 1;
3406			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
3407				       sizeof mlen, (const char *)&mlen,
3408				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
3409				       0);
3410			pap.tld(sp);
3411			break;
3412		}
3413		/* action sca, perhaps tlu */
3414		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
3415		    sp->state[IDX_PAP] == STATE_OPENED) {
3416			mlen = sizeof(SUCCMSG) - 1;
3417			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
3418				       sizeof mlen, (const char *)&mlen,
3419				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
3420				       0);
3421		}
3422		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
3423			sppp_cp_change_state(&pap, sp, STATE_OPENED);
3424			pap.tlu(sp);
3425		}
3426		break;
3427
3428	/* ack and nak are his authproto */
3429	case PAP_ACK:
3430		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3431		if (debug) {
3432			log(LOG_DEBUG, SPP_FMT "pap success",
3433			    SPP_ARGS(ifp));
3434			name_len = *((char *)h);
3435			if (len > 5 && name_len) {
3436				addlog(": ");
3437				sppp_print_string((char*)(h+1), name_len);
3438			}
3439			addlog("\n");
3440		}
3441		x = splimp();
3442		sp->pp_flags &= ~PP_NEEDAUTH;
3443		if (sp->myauth.proto == PPP_PAP &&
3444		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3445		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
3446			/*
3447			 * We are authenticator for PAP but didn't
3448			 * complete yet.  Leave it to tlu to proceed
3449			 * to network phase.
3450			 */
3451			splx(x);
3452			break;
3453		}
3454		splx(x);
3455		sppp_phase_network(sp);
3456		break;
3457
3458	case PAP_NAK:
3459		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3460		if (debug) {
3461			log(LOG_INFO, SPP_FMT "pap failure",
3462			    SPP_ARGS(ifp));
3463			name_len = *((char *)h);
3464			if (len > 5 && name_len) {
3465				addlog(": ");
3466				sppp_print_string((char*)(h+1), name_len);
3467			}
3468			addlog("\n");
3469		} else
3470			log(LOG_INFO, SPP_FMT "pap failure\n",
3471			    SPP_ARGS(ifp));
3472		/* await LCP shutdown by authenticator */
3473		break;
3474
3475	default:
3476		/* Unknown PAP packet type -- ignore. */
3477		if (debug) {
3478			log(LOG_DEBUG, SPP_FMT "pap corrupted input "
3479			    "<0x%x id=0x%x len=%d",
3480			    SPP_ARGS(ifp),
3481			    h->type, h->ident, ntohs(h->len));
3482			if (len > 4)
3483				sppp_print_bytes((u_char*)(h+1), len-4);
3484			addlog(">\n");
3485		}
3486		break;
3487
3488	}
3489}
3490
3491static void
3492sppp_pap_init(struct sppp *sp)
3493{
3494	/* PAP doesn't have STATE_INITIAL at all. */
3495	sp->state[IDX_PAP] = STATE_CLOSED;
3496	sp->fail_counter[IDX_PAP] = 0;
3497#if defined (__FreeBSD__)
3498	callout_handle_init(&sp->ch[IDX_PAP]);
3499	callout_handle_init(&sp->pap_my_to_ch);
3500#endif
3501}
3502
3503static void
3504sppp_pap_open(struct sppp *sp)
3505{
3506	if (sp->hisauth.proto == PPP_PAP &&
3507	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
3508		/* we are authenticator for PAP, start our timer */
3509		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
3510		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
3511	}
3512	if (sp->myauth.proto == PPP_PAP) {
3513		/* we are peer, send a request, and start a timer */
3514		pap.scr(sp);
3515		TIMEOUT(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout,
3516		    sp->pap_my_to_ch);
3517	}
3518}
3519
3520static void
3521sppp_pap_close(struct sppp *sp)
3522{
3523	if (sp->state[IDX_PAP] != STATE_CLOSED)
3524		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
3525}
3526
3527/*
3528 * That's the timeout routine if we are authenticator.  Since the
3529 * authenticator is basically passive in PAP, we can't do much here.
3530 */
3531static void
3532sppp_pap_TO(void *cookie)
3533{
3534	struct sppp *sp = (struct sppp *)cookie;
3535	STDDCL;
3536	int s;
3537
3538	s = splimp();
3539	if (debug)
3540		log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
3541		    SPP_ARGS(ifp),
3542		    sppp_state_name(sp->state[IDX_PAP]),
3543		    sp->rst_counter[IDX_PAP]);
3544
3545	if (--sp->rst_counter[IDX_PAP] < 0)
3546		/* TO- event */
3547		switch (sp->state[IDX_PAP]) {
3548		case STATE_REQ_SENT:
3549			pap.tld(sp);
3550			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
3551			break;
3552		}
3553	else
3554		/* TO+ event, not very much we could do */
3555		switch (sp->state[IDX_PAP]) {
3556		case STATE_REQ_SENT:
3557			/* sppp_cp_change_state() will restart the timer */
3558			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
3559			break;
3560		}
3561
3562	splx(s);
3563}
3564
3565/*
3566 * That's the timeout handler if we are peer.  Since the peer is active,
3567 * we need to retransmit our PAP request since it is apparently lost.
3568 * XXX We should impose a max counter.
3569 */
3570static void
3571sppp_pap_my_TO(void *cookie)
3572{
3573	struct sppp *sp = (struct sppp *)cookie;
3574	STDDCL;
3575
3576	if (debug)
3577		log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
3578		    SPP_ARGS(ifp));
3579
3580	pap.scr(sp);
3581}
3582
3583static void
3584sppp_pap_tlu(struct sppp *sp)
3585{
3586	STDDCL;
3587	int x;
3588
3589	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
3590
3591	if (debug)
3592		log(LOG_DEBUG, SPP_FMT "%s tlu\n",
3593		    SPP_ARGS(ifp), pap.name);
3594
3595	x = splimp();
3596	/* indicate to LCP that we need to be closed down */
3597	sp->lcp.protos |= (1 << IDX_PAP);
3598
3599	if (sp->pp_flags & PP_NEEDAUTH) {
3600		/*
3601		 * Remote is authenticator, but his auth proto didn't
3602		 * complete yet.  Defer the transition to network
3603		 * phase.
3604		 */
3605		splx(x);
3606		return;
3607	}
3608	splx(x);
3609	sppp_phase_network(sp);
3610}
3611
3612static void
3613sppp_pap_tld(struct sppp *sp)
3614{
3615	STDDCL;
3616
3617	if (debug)
3618		log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
3619	UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]);
3620	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3621	sp->lcp.protos &= ~(1 << IDX_PAP);
3622
3623	lcp.Close(sp);
3624}
3625
3626static void
3627sppp_pap_scr(struct sppp *sp)
3628{
3629	u_char idlen, pwdlen;
3630
3631	sp->confid[IDX_PAP] = ++sp->pp_seq;
3632	pwdlen = sppp_strnlen(sp->myauth.secret, AUTHKEYLEN);
3633	idlen = sppp_strnlen(sp->myauth.name, AUTHNAMELEN);
3634
3635	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
3636		       sizeof idlen, (const char *)&idlen,
3637		       (size_t)idlen, sp->myauth.name,
3638		       sizeof pwdlen, (const char *)&pwdlen,
3639		       (size_t)pwdlen, sp->myauth.secret,
3640		       0);
3641}
3642/*
3643 * Random miscellaneous functions.
3644 */
3645
3646/*
3647 * Send a PAP or CHAP proto packet.
3648 *
3649 * Varadic function, each of the elements for the ellipsis is of type
3650 * ``size_t mlen, const u_char *msg''.  Processing will stop iff
3651 * mlen == 0.
3652 */
3653
3654static void
3655sppp_auth_send(const struct cp *cp, struct sppp *sp, u_char type, u_char id,
3656	       ...)
3657{
3658	STDDCL;
3659	struct ppp_header *h;
3660	struct lcp_header *lh;
3661	struct mbuf *m;
3662	u_char *p;
3663	int len;
3664	size_t mlen;
3665	const char *msg;
3666	va_list ap;
3667
3668	MGETHDR (m, M_DONTWAIT, MT_DATA);
3669	if (! m)
3670		return;
3671	m->m_pkthdr.rcvif = 0;
3672
3673	h = mtod (m, struct ppp_header*);
3674	h->address = PPP_ALLSTATIONS;		/* broadcast address */
3675	h->control = PPP_UI;			/* Unnumbered Info */
3676	h->protocol = htons(cp->proto);
3677
3678	lh = (struct lcp_header*)(h + 1);
3679	lh->type = type;
3680	lh->ident = id;
3681	p = (u_char*) (lh+1);
3682
3683	va_start(ap, id);
3684	len = 0;
3685
3686	while ((mlen = va_arg(ap, size_t)) != 0) {
3687		msg = va_arg(ap, const char *);
3688		len += mlen;
3689		if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN) {
3690			va_end(ap);
3691			m_freem(m);
3692			return;
3693		}
3694
3695		bcopy(msg, p, mlen);
3696		p += mlen;
3697	}
3698	va_end(ap);
3699
3700	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len;
3701	lh->len = htons (LCP_HEADER_LEN + len);
3702
3703	if (debug) {
3704		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
3705		    SPP_ARGS(ifp), cp->name,
3706		    sppp_auth_type_name(cp->proto, lh->type),
3707		    lh->ident, ntohs(lh->len));
3708		if (len)
3709			sppp_print_bytes((u_char*) (lh+1), len);
3710		addlog(">\n");
3711	}
3712	if (IF_QFULL (&sp->pp_cpq)) {
3713		IF_DROP (&sp->pp_fastq);
3714		IF_DROP (&ifp->if_snd);
3715		m_freem (m);
3716		++ifp->if_oerrors;
3717	} else
3718		IF_ENQUEUE (&sp->pp_cpq, m);
3719	if (! (ifp->if_flags & IFF_OACTIVE))
3720		(*ifp->if_start) (ifp);
3721	ifp->if_obytes += m->m_pkthdr.len + 3;
3722}
3723
3724/*
3725 * Flush interface queue.
3726 */
3727static void
3728sppp_qflush(struct ifqueue *ifq)
3729{
3730	struct mbuf *m, *n;
3731
3732	n = ifq->ifq_head;
3733	while ((m = n)) {
3734		n = m->m_act;
3735		m_freem (m);
3736	}
3737	ifq->ifq_head = 0;
3738	ifq->ifq_tail = 0;
3739	ifq->ifq_len = 0;
3740}
3741
3742/*
3743 * Send keepalive packets, every 10 seconds.
3744 */
3745static void
3746sppp_keepalive(void *dummy)
3747{
3748	struct sppp *sp;
3749	int s;
3750
3751	s = splimp();
3752	for (sp=spppq; sp; sp=sp->pp_next) {
3753		struct ifnet *ifp = &sp->pp_if;
3754
3755		/* Keepalive mode disabled or channel down? */
3756		if (! (sp->pp_flags & PP_KEEPALIVE) ||
3757		    ! (ifp->if_flags & IFF_RUNNING))
3758			continue;
3759
3760		/* No keepalive in PPP mode if LCP not opened yet. */
3761		if (! (sp->pp_flags & PP_CISCO) &&
3762		    sp->pp_phase < PHASE_AUTHENTICATE)
3763			continue;
3764
3765		if (sp->pp_alivecnt == MAXALIVECNT) {
3766			/* No keepalive packets got.  Stop the interface. */
3767			printf (SPP_FMT "down\n", SPP_ARGS(ifp));
3768			if_down (ifp);
3769			sppp_qflush (&sp->pp_cpq);
3770			if (! (sp->pp_flags & PP_CISCO)) {
3771				/* XXX */
3772				/* Shut down the PPP link. */
3773				lcp.Down(sp);
3774				/* Initiate negotiation. XXX */
3775				lcp.Up(sp);
3776			}
3777		}
3778		if (sp->pp_alivecnt <= MAXALIVECNT)
3779			++sp->pp_alivecnt;
3780		if (sp->pp_flags & PP_CISCO)
3781			sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
3782				sp->pp_rseq);
3783		else if (sp->pp_phase >= PHASE_AUTHENTICATE) {
3784			long nmagic = htonl (sp->lcp.magic);
3785			sp->lcp.echoid = ++sp->pp_seq;
3786			sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
3787				sp->lcp.echoid, 4, &nmagic);
3788		}
3789	}
3790	splx(s);
3791	TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch);
3792}
3793
3794/*
3795 * Get both IP addresses.
3796 */
3797static void
3798sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask)
3799{
3800	struct ifnet *ifp = &sp->pp_if;
3801	struct ifaddr *ifa;
3802	struct sockaddr_in *si, *sm;
3803	u_long ssrc, ddst;
3804
3805	sm = NULL;
3806	ssrc = ddst = 0L;
3807	/*
3808	 * Pick the first AF_INET address from the list,
3809	 * aliases don't make any sense on a p2p link anyway.
3810	 */
3811#if defined (__FreeBSD__)
3812	for (ifa = ifp->if_addrhead.tqh_first, si = 0;
3813	     ifa;
3814	     ifa = ifa->ifa_link.tqe_next)
3815#else
3816	for (ifa = ifp->if_addrlist.tqh_first, si = 0;
3817	     ifa;
3818	     ifa = ifa->ifa_list.tqe_next)
3819#endif
3820		if (ifa->ifa_addr->sa_family == AF_INET) {
3821			si = (struct sockaddr_in *)ifa->ifa_addr;
3822			sm = (struct sockaddr_in *)ifa->ifa_netmask;
3823			if (si)
3824				break;
3825		}
3826	if (ifa) {
3827		if (si && si->sin_addr.s_addr) {
3828			ssrc = si->sin_addr.s_addr;
3829			if (srcmask)
3830				*srcmask = ntohl(sm->sin_addr.s_addr);
3831		}
3832
3833		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
3834		if (si && si->sin_addr.s_addr)
3835			ddst = si->sin_addr.s_addr;
3836	}
3837
3838	if (dst) *dst = ntohl(ddst);
3839	if (src) *src = ntohl(ssrc);
3840}
3841
3842/*
3843 * Set my IP address.  Must be called at splimp.
3844 */
3845static void
3846sppp_set_ip_addr(struct sppp *sp, u_long src)
3847{
3848	struct ifnet *ifp = &sp->pp_if;
3849	struct ifaddr *ifa;
3850	struct sockaddr_in *si;
3851
3852	/*
3853	 * Pick the first AF_INET address from the list,
3854	 * aliases don't make any sense on a p2p link anyway.
3855	 */
3856
3857#if defined (__FreeBSD__)
3858	for (ifa = ifp->if_addrhead.tqh_first, si = 0;
3859	     ifa;
3860	     ifa = ifa->ifa_link.tqe_next)
3861#else
3862	for (ifa = ifp->if_addrlist.tqh_first, si = 0;
3863	     ifa;
3864	     ifa = ifa->ifa_list.tqe_next)
3865#endif
3866	{
3867		if (ifa->ifa_addr->sa_family == AF_INET)
3868		{
3869			si = (struct sockaddr_in *)ifa->ifa_addr;
3870			if (si)
3871				break;
3872		}
3873	}
3874
3875	if (ifa && si)
3876		si->sin_addr.s_addr = htonl(src);
3877}
3878
3879static int
3880sppp_params(struct sppp *sp, u_long cmd, void *data)
3881{
3882	u_long subcmd;
3883	struct ifreq *ifr = (struct ifreq *)data;
3884	struct spppreq spr;
3885
3886	/*
3887	 * ifr->ifr_data is supposed to point to a struct spppreq.
3888	 * Check the cmd word first before attempting to fetch all the
3889	 * data.
3890	 */
3891	if ((subcmd = fuword(ifr->ifr_data)) == -1)
3892		return EFAULT;
3893
3894	if (copyin((caddr_t)ifr->ifr_data, &spr, sizeof spr) != 0)
3895		return EFAULT;
3896
3897	switch (subcmd) {
3898	case SPPPIOGDEFS:
3899		if (cmd != SIOCGIFGENERIC)
3900			return EINVAL;
3901		/*
3902		 * We copy over the entire current state, but clean
3903		 * out some of the stuff we don't wanna pass up.
3904		 * Remember, SIOCGIFGENERIC is unprotected, and can be
3905		 * called by any user.  No need to ever get PAP or
3906		 * CHAP secrets back to userland anyway.
3907		 */
3908		bcopy(sp, &spr.defs, sizeof(struct sppp));
3909		bzero(spr.defs.myauth.secret, AUTHKEYLEN);
3910		bzero(spr.defs.myauth.challenge, AUTHKEYLEN);
3911		bzero(spr.defs.hisauth.secret, AUTHKEYLEN);
3912		bzero(spr.defs.hisauth.challenge, AUTHKEYLEN);
3913		return copyout(&spr, (caddr_t)ifr->ifr_data, sizeof spr);
3914
3915	case SPPPIOSDEFS:
3916		if (cmd != SIOCSIFGENERIC)
3917			return EINVAL;
3918		/*
3919		 * We have a very specific idea of which fields we allow
3920		 * being passed back from userland, so to not clobber our
3921		 * current state.  For one, we only allow setting
3922		 * anything if LCP is in dead phase.  Once the LCP
3923		 * negotiations started, the authentication settings must
3924		 * not be changed again.  (The administrator can force an
3925		 * ifconfig down in order to get LCP back into dead
3926		 * phase.)
3927		 *
3928		 * Also, we only allow for authentication parameters to be
3929		 * specified.
3930		 *
3931		 * XXX Should allow to set or clear pp_flags.
3932		 *
3933		 * Finally, if the respective authentication protocol to
3934		 * be used is set differently than 0, but the secret is
3935		 * passed as all zeros, we don't trash the existing secret.
3936		 * This allows an administrator to change the system name
3937		 * only without clobbering the secret (which he didn't get
3938		 * back in a previous SPPPIOGDEFS call).  However, the
3939		 * secrets are cleared if the authentication protocol is
3940		 * reset to 0.
3941		 */
3942		if (sp->pp_phase != PHASE_DEAD)
3943			return EBUSY;
3944
3945		if ((spr.defs.myauth.proto != 0 && spr.defs.myauth.proto != PPP_PAP &&
3946		     spr.defs.myauth.proto != PPP_CHAP) ||
3947		    (spr.defs.hisauth.proto != 0 && spr.defs.hisauth.proto != PPP_PAP &&
3948		     spr.defs.hisauth.proto != PPP_CHAP))
3949			return EINVAL;
3950
3951		if (spr.defs.myauth.proto == 0)
3952			/* resetting myauth */
3953			bzero(&sp->myauth, sizeof sp->myauth);
3954		else {
3955			/* setting/changing myauth */
3956			sp->myauth.proto = spr.defs.myauth.proto;
3957			bcopy(spr.defs.myauth.name, sp->myauth.name, AUTHNAMELEN);
3958			if (spr.defs.myauth.secret[0] != '\0')
3959				bcopy(spr.defs.myauth.secret, sp->myauth.secret,
3960				      AUTHKEYLEN);
3961		}
3962		if (spr.defs.hisauth.proto == 0)
3963			/* resetting hisauth */
3964			bzero(&sp->hisauth, sizeof sp->hisauth);
3965		else {
3966			/* setting/changing hisauth */
3967			sp->hisauth.proto = spr.defs.hisauth.proto;
3968			sp->hisauth.flags = spr.defs.hisauth.flags;
3969			bcopy(spr.defs.hisauth.name, sp->hisauth.name, AUTHNAMELEN);
3970			if (spr.defs.hisauth.secret[0] != '\0')
3971				bcopy(spr.defs.hisauth.secret, sp->hisauth.secret,
3972				      AUTHKEYLEN);
3973		}
3974		break;
3975
3976	default:
3977		return EINVAL;
3978	}
3979
3980	return 0;
3981}
3982
3983static void
3984sppp_phase_network(struct sppp *sp)
3985{
3986	struct ifnet *ifp = &sp->pp_if;
3987	int i;
3988	u_long mask;
3989
3990	sp->pp_phase = PHASE_NETWORK;
3991
3992	log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
3993	    sppp_phase_name(sp->pp_phase));
3994
3995	/* Notify NCPs now. */
3996	for (i = 0; i < IDX_COUNT; i++)
3997		if ((cps[i])->flags & CP_NCP)
3998			(cps[i])->Open(sp);
3999
4000	/* Send Up events to all NCPs. */
4001	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
4002		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_NCP))
4003			(cps[i])->Up(sp);
4004
4005	/* if no NCP is starting, all this was in vain, close down */
4006	sppp_lcp_check_and_close(sp);
4007}
4008
4009
4010static const char *
4011sppp_cp_type_name(u_char type)
4012{
4013	static char buf[12];
4014	switch (type) {
4015	case CONF_REQ:   return "conf-req";
4016	case CONF_ACK:   return "conf-ack";
4017	case CONF_NAK:   return "conf-nak";
4018	case CONF_REJ:   return "conf-rej";
4019	case TERM_REQ:   return "term-req";
4020	case TERM_ACK:   return "term-ack";
4021	case CODE_REJ:   return "code-rej";
4022	case PROTO_REJ:  return "proto-rej";
4023	case ECHO_REQ:   return "echo-req";
4024	case ECHO_REPLY: return "echo-reply";
4025	case DISC_REQ:   return "discard-req";
4026	}
4027	snprintf (buf, sizeof(buf), "0x%x", type);
4028	return buf;
4029}
4030
4031static const char *
4032sppp_auth_type_name(u_short proto, u_char type)
4033{
4034	static char buf[12];
4035	switch (proto) {
4036	case PPP_CHAP:
4037		switch (type) {
4038		case CHAP_CHALLENGE:	return "challenge";
4039		case CHAP_RESPONSE:	return "response";
4040		case CHAP_SUCCESS:	return "success";
4041		case CHAP_FAILURE:	return "failure";
4042		}
4043	case PPP_PAP:
4044		switch (type) {
4045		case PAP_REQ:		return "req";
4046		case PAP_ACK:		return "ack";
4047		case PAP_NAK:		return "nak";
4048		}
4049	}
4050	snprintf (buf, sizeof(buf), "0x%x", type);
4051	return buf;
4052}
4053
4054static const char *
4055sppp_lcp_opt_name(u_char opt)
4056{
4057	static char buf[12];
4058	switch (opt) {
4059	case LCP_OPT_MRU:		return "mru";
4060	case LCP_OPT_ASYNC_MAP:		return "async-map";
4061	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
4062	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
4063	case LCP_OPT_MAGIC:		return "magic";
4064	case LCP_OPT_PROTO_COMP:	return "proto-comp";
4065	case LCP_OPT_ADDR_COMP:		return "addr-comp";
4066	}
4067	snprintf (buf, sizeof(buf), "0x%x", opt);
4068	return buf;
4069}
4070
4071static const char *
4072sppp_ipcp_opt_name(u_char opt)
4073{
4074	static char buf[12];
4075	switch (opt) {
4076	case IPCP_OPT_ADDRESSES:	return "addresses";
4077	case IPCP_OPT_COMPRESSION:	return "compression";
4078	case IPCP_OPT_ADDRESS:		return "address";
4079	}
4080	snprintf (buf, sizeof(buf), "0x%x", opt);
4081	return buf;
4082}
4083
4084static const char *
4085sppp_state_name(int state)
4086{
4087	switch (state) {
4088	case STATE_INITIAL:	return "initial";
4089	case STATE_STARTING:	return "starting";
4090	case STATE_CLOSED:	return "closed";
4091	case STATE_STOPPED:	return "stopped";
4092	case STATE_CLOSING:	return "closing";
4093	case STATE_STOPPING:	return "stopping";
4094	case STATE_REQ_SENT:	return "req-sent";
4095	case STATE_ACK_RCVD:	return "ack-rcvd";
4096	case STATE_ACK_SENT:	return "ack-sent";
4097	case STATE_OPENED:	return "opened";
4098	}
4099	return "illegal";
4100}
4101
4102static const char *
4103sppp_phase_name(enum ppp_phase phase)
4104{
4105	switch (phase) {
4106	case PHASE_DEAD:	return "dead";
4107	case PHASE_ESTABLISH:	return "establish";
4108	case PHASE_TERMINATE:	return "terminate";
4109	case PHASE_AUTHENTICATE: return "authenticate";
4110	case PHASE_NETWORK:	return "network";
4111	}
4112	return "illegal";
4113}
4114
4115static const char *
4116sppp_proto_name(u_short proto)
4117{
4118	static char buf[12];
4119	switch (proto) {
4120	case PPP_LCP:	return "lcp";
4121	case PPP_IPCP:	return "ipcp";
4122	case PPP_PAP:	return "pap";
4123	case PPP_CHAP:	return "chap";
4124	}
4125	snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto);
4126	return buf;
4127}
4128
4129static void
4130sppp_print_bytes(const u_char *p, u_short len)
4131{
4132	addlog(" %02x", *p++);
4133	while (--len > 0)
4134		addlog("-%02x", *p++);
4135}
4136
4137static void
4138sppp_print_string(const char *p, u_short len)
4139{
4140	u_char c;
4141
4142	while (len-- > 0) {
4143		c = *p++;
4144		/*
4145		 * Print only ASCII chars directly.  RFC 1994 recommends
4146		 * using only them, but we don't rely on it.  */
4147		if (c < ' ' || c > '~')
4148			addlog("\\x%x", c);
4149		else
4150			addlog("%c", c);
4151	}
4152}
4153
4154static const char *
4155sppp_dotted_quad(u_long addr)
4156{
4157	static char s[16];
4158	sprintf(s, "%d.%d.%d.%d",
4159		(int)((addr >> 24) & 0xff),
4160		(int)((addr >> 16) & 0xff),
4161		(int)((addr >> 8) & 0xff),
4162		(int)(addr & 0xff));
4163	return s;
4164}
4165
4166static int
4167sppp_strnlen(u_char *p, int max)
4168{
4169	int len;
4170
4171	for (len = 0; len < max && *p; ++p)
4172		++len;
4173	return len;
4174}
4175
4176/* a dummy, used to drop uninteresting events */
4177static void
4178sppp_null(struct sppp *unused)
4179{
4180	/* do just nothing */
4181}
4182/*
4183 * This file is large.  Tell emacs to highlight it nevertheless.
4184 *
4185 * Local Variables:
4186 * hilit-auto-highlight-maxout: 120000
4187 * End:
4188 */
4189