if_spppsubr.c revision 88710
1/* 2 * Synchronous PPP/Cisco link level subroutines. 3 * Keepalive protocol implemented in both Cisco and PPP modes. 4 * 5 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 6 * Author: Serge Vakulenko, <vak@cronyx.ru> 7 * 8 * Heavily revamped to conform to RFC 1661. 9 * Copyright (C) 1997, 2001 Joerg Wunsch. 10 * 11 * This software is distributed with NO WARRANTIES, not even the implied 12 * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 13 * 14 * Authors grant any other persons or organisations permission to use 15 * or modify this software as long as this message is kept with the software, 16 * all derivative works or modified versions. 17 * 18 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997 19 * 20 * $FreeBSD: head/sys/net/if_spppsubr.c 88710 2001-12-30 18:39:38Z joerg $ 21 */ 22 23#include <sys/param.h> 24 25#if defined(__FreeBSD__) && __FreeBSD__ >= 3 26#include "opt_inet.h" 27#include "opt_inet6.h" 28#include "opt_ipx.h" 29#endif 30 31#ifdef NetBSD1_3 32# if NetBSD1_3 > 6 33# include "opt_inet.h" 34# include "opt_inet6.h" 35# include "opt_iso.h" 36# endif 37#endif 38 39#include <sys/systm.h> 40#include <sys/kernel.h> 41#include <sys/module.h> 42#include <sys/sockio.h> 43#include <sys/socket.h> 44#include <sys/syslog.h> 45#if defined(__FreeBSD__) && __FreeBSD__ >= 3 46#include <sys/random.h> 47#endif 48#include <sys/malloc.h> 49#include <sys/mbuf.h> 50 51#if defined (__OpenBSD__) 52#include <sys/md5k.h> 53#else 54#include <sys/md5.h> 55#endif 56 57#include <net/if.h> 58#include <net/netisr.h> 59#include <net/if_types.h> 60#include <net/route.h> 61#include <netinet/in.h> 62#include <netinet/in_systm.h> 63#include <netinet/ip.h> 64#include <net/slcompress.h> 65 66#if defined (__NetBSD__) || defined (__OpenBSD__) 67#include <machine/cpu.h> /* XXX for softnet */ 68#endif 69 70#include <machine/stdarg.h> 71 72#include <netinet/in.h> 73#include <netinet/in_systm.h> 74#include <netinet/in_var.h> 75 76#ifdef INET 77#include <netinet/ip.h> 78#include <netinet/tcp.h> 79#endif 80 81#if defined (__FreeBSD__) || defined (__OpenBSD__) 82# include <netinet/if_ether.h> 83#else 84# include <net/ethertypes.h> 85#endif 86 87#ifdef IPX 88#include <netipx/ipx.h> 89#include <netipx/ipx_if.h> 90#endif 91 92#ifdef NS 93#include <netns/ns.h> 94#include <netns/ns_if.h> 95#endif 96 97#include <net/if_sppp.h> 98 99#if defined(__FreeBSD__) && __FreeBSD__ >= 3 100# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg, handle) 101# define TIMEOUT(fun, arg1, arg2, handle) handle = timeout(fun, arg1, arg2) 102# define IOCTL_CMD_T u_long 103#else 104# define UNTIMEOUT(fun, arg, handle) untimeout(fun, arg) 105# define TIMEOUT(fun, arg1, arg2, handle) timeout(fun, arg1, arg2) 106# define IOCTL_CMD_T int 107#endif 108 109#define MAXALIVECNT 3 /* max. alive packets */ 110 111/* 112 * Interface flags that can be set in an ifconfig command. 113 * 114 * Setting link0 will make the link passive, i.e. it will be marked 115 * as being administrative openable, but won't be opened to begin 116 * with. Incoming calls will be answered, or subsequent calls with 117 * -link1 will cause the administrative open of the LCP layer. 118 * 119 * Setting link1 will cause the link to auto-dial only as packets 120 * arrive to be sent. 121 * 122 * Setting IFF_DEBUG will syslog the option negotiation and state 123 * transitions at level kern.debug. Note: all logs consistently look 124 * like 125 * 126 * <if-name><unit>: <proto-name> <additional info...> 127 * 128 * with <if-name><unit> being something like "bppp0", and <proto-name> 129 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 130 */ 131 132#define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 133#define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 134#define IFF_CISCO IFF_LINK2 /* auto-dial on output */ 135 136#define PPP_ALLSTATIONS 0xff /* All-Stations broadcast address */ 137#define PPP_UI 0x03 /* Unnumbered Information */ 138#define PPP_IP 0x0021 /* Internet Protocol */ 139#define PPP_ISO 0x0023 /* ISO OSI Protocol */ 140#define PPP_XNS 0x0025 /* Xerox NS Protocol */ 141#define PPP_IPX 0x002b /* Novell IPX Protocol */ 142#define PPP_VJ_COMP 0x002d /* VJ compressed TCP/IP */ 143#define PPP_VJ_UCOMP 0x002f /* VJ uncompressed TCP/IP */ 144#define PPP_IPV6 0x0057 /* Internet Protocol Version 6 */ 145#define PPP_LCP 0xc021 /* Link Control Protocol */ 146#define PPP_PAP 0xc023 /* Password Authentication Protocol */ 147#define PPP_CHAP 0xc223 /* Challenge-Handshake Auth Protocol */ 148#define PPP_IPCP 0x8021 /* Internet Protocol Control Protocol */ 149#define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */ 150 151#define CONF_REQ 1 /* PPP configure request */ 152#define CONF_ACK 2 /* PPP configure acknowledge */ 153#define CONF_NAK 3 /* PPP configure negative ack */ 154#define CONF_REJ 4 /* PPP configure reject */ 155#define TERM_REQ 5 /* PPP terminate request */ 156#define TERM_ACK 6 /* PPP terminate acknowledge */ 157#define CODE_REJ 7 /* PPP code reject */ 158#define PROTO_REJ 8 /* PPP protocol reject */ 159#define ECHO_REQ 9 /* PPP echo request */ 160#define ECHO_REPLY 10 /* PPP echo reply */ 161#define DISC_REQ 11 /* PPP discard request */ 162 163#define LCP_OPT_MRU 1 /* maximum receive unit */ 164#define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 165#define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 166#define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 167#define LCP_OPT_MAGIC 5 /* magic number */ 168#define LCP_OPT_RESERVED 6 /* reserved */ 169#define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 170#define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 171 172#define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 173#define IPCP_OPT_COMPRESSION 2 /* IP compression protocol (VJ) */ 174#define IPCP_OPT_ADDRESS 3 /* local IP address */ 175 176#define IPV6CP_OPT_IFID 1 /* interface identifier */ 177#define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 178 179#define IPCP_COMP_VJ 0x2d /* Code for VJ compression */ 180 181#define PAP_REQ 1 /* PAP name/password request */ 182#define PAP_ACK 2 /* PAP acknowledge */ 183#define PAP_NAK 3 /* PAP fail */ 184 185#define CHAP_CHALLENGE 1 /* CHAP challenge request */ 186#define CHAP_RESPONSE 2 /* CHAP challenge response */ 187#define CHAP_SUCCESS 3 /* CHAP response ok */ 188#define CHAP_FAILURE 4 /* CHAP response failed */ 189 190#define CHAP_MD5 5 /* hash algorithm - MD5 */ 191 192#define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 193#define CISCO_UNICAST 0x0f /* Cisco unicast address */ 194#define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 195#define CISCO_ADDR_REQ 0 /* Cisco address request */ 196#define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 197#define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 198 199/* states are named and numbered according to RFC 1661 */ 200#define STATE_INITIAL 0 201#define STATE_STARTING 1 202#define STATE_CLOSED 2 203#define STATE_STOPPED 3 204#define STATE_CLOSING 4 205#define STATE_STOPPING 5 206#define STATE_REQ_SENT 6 207#define STATE_ACK_RCVD 7 208#define STATE_ACK_SENT 8 209#define STATE_OPENED 9 210 211struct ppp_header { 212 u_char address; 213 u_char control; 214 u_short protocol; 215} __attribute__((__packed__)); 216#define PPP_HEADER_LEN sizeof (struct ppp_header) 217 218struct lcp_header { 219 u_char type; 220 u_char ident; 221 u_short len; 222} __attribute__((__packed__)); 223#define LCP_HEADER_LEN sizeof (struct lcp_header) 224 225struct cisco_packet { 226 u_long type; 227 u_long par1; 228 u_long par2; 229 u_short rel; 230 u_short time0; 231 u_short time1; 232} __attribute__((__packed__)); 233#define CISCO_PACKET_LEN sizeof (struct cisco_packet) 234 235/* 236 * We follow the spelling and capitalization of RFC 1661 here, to make 237 * it easier comparing with the standard. Please refer to this RFC in 238 * case you can't make sense out of these abbreviation; it will also 239 * explain the semantics related to the various events and actions. 240 */ 241struct cp { 242 u_short proto; /* PPP control protocol number */ 243 u_char protoidx; /* index into state table in struct sppp */ 244 u_char flags; 245#define CP_LCP 0x01 /* this is the LCP */ 246#define CP_AUTH 0x02 /* this is an authentication protocol */ 247#define CP_NCP 0x04 /* this is a NCP */ 248#define CP_QUAL 0x08 /* this is a quality reporting protocol */ 249 const char *name; /* name of this control protocol */ 250 /* event handlers */ 251 void (*Up)(struct sppp *sp); 252 void (*Down)(struct sppp *sp); 253 void (*Open)(struct sppp *sp); 254 void (*Close)(struct sppp *sp); 255 void (*TO)(void *sp); 256 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 257 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 258 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 259 /* actions */ 260 void (*tlu)(struct sppp *sp); 261 void (*tld)(struct sppp *sp); 262 void (*tls)(struct sppp *sp); 263 void (*tlf)(struct sppp *sp); 264 void (*scr)(struct sppp *sp); 265}; 266 267static struct sppp *spppq; 268#if defined(__FreeBSD__) && __FreeBSD__ >= 3 269static struct callout_handle keepalive_ch; 270#endif 271 272#if defined(__FreeBSD__) && __FreeBSD__ >= 3 273#define SPP_FMT "%s%d: " 274#define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 275#else 276#define SPP_FMT "%s: " 277#define SPP_ARGS(ifp) (ifp)->if_xname 278#endif 279 280#ifdef INET 281/* 282 * The following disgusting hack gets around the problem that IP TOS 283 * can't be set yet. We want to put "interactive" traffic on a high 284 * priority queue. To decide if traffic is interactive, we check that 285 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 286 * 287 * XXX is this really still necessary? - joerg - 288 */ 289static u_short interactive_ports[8] = { 290 0, 513, 0, 0, 291 0, 21, 0, 23, 292}; 293#define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 294#endif 295 296/* almost every function needs these */ 297#define STDDCL \ 298 struct ifnet *ifp = &sp->pp_if; \ 299 int debug = ifp->if_flags & IFF_DEBUG 300 301static int sppp_output(struct ifnet *ifp, struct mbuf *m, 302 struct sockaddr *dst, struct rtentry *rt); 303 304static void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2); 305static void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 306 307static void sppp_cp_input(const struct cp *cp, struct sppp *sp, 308 struct mbuf *m); 309static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 310 u_char ident, u_short len, void *data); 311/* static void sppp_cp_timeout(void *arg); */ 312static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 313 int newstate); 314static void sppp_auth_send(const struct cp *cp, 315 struct sppp *sp, unsigned int type, unsigned int id, 316 ...); 317 318static void sppp_up_event(const struct cp *cp, struct sppp *sp); 319static void sppp_down_event(const struct cp *cp, struct sppp *sp); 320static void sppp_open_event(const struct cp *cp, struct sppp *sp); 321static void sppp_close_event(const struct cp *cp, struct sppp *sp); 322static void sppp_to_event(const struct cp *cp, struct sppp *sp); 323 324static void sppp_null(struct sppp *sp); 325 326static void sppp_lcp_init(struct sppp *sp); 327static void sppp_lcp_up(struct sppp *sp); 328static void sppp_lcp_down(struct sppp *sp); 329static void sppp_lcp_open(struct sppp *sp); 330static void sppp_lcp_close(struct sppp *sp); 331static void sppp_lcp_TO(void *sp); 332static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 333static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 334static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 335static void sppp_lcp_tlu(struct sppp *sp); 336static void sppp_lcp_tld(struct sppp *sp); 337static void sppp_lcp_tls(struct sppp *sp); 338static void sppp_lcp_tlf(struct sppp *sp); 339static void sppp_lcp_scr(struct sppp *sp); 340static void sppp_lcp_check_and_close(struct sppp *sp); 341static int sppp_ncp_check(struct sppp *sp); 342 343static void sppp_ipcp_init(struct sppp *sp); 344static void sppp_ipcp_up(struct sppp *sp); 345static void sppp_ipcp_down(struct sppp *sp); 346static void sppp_ipcp_open(struct sppp *sp); 347static void sppp_ipcp_close(struct sppp *sp); 348static void sppp_ipcp_TO(void *sp); 349static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 350static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 351static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 352static void sppp_ipcp_tlu(struct sppp *sp); 353static void sppp_ipcp_tld(struct sppp *sp); 354static void sppp_ipcp_tls(struct sppp *sp); 355static void sppp_ipcp_tlf(struct sppp *sp); 356static void sppp_ipcp_scr(struct sppp *sp); 357 358static void sppp_ipv6cp_init(struct sppp *sp); 359static void sppp_ipv6cp_up(struct sppp *sp); 360static void sppp_ipv6cp_down(struct sppp *sp); 361static void sppp_ipv6cp_open(struct sppp *sp); 362static void sppp_ipv6cp_close(struct sppp *sp); 363static void sppp_ipv6cp_TO(void *sp); 364static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 365static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 366static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 367static void sppp_ipv6cp_tlu(struct sppp *sp); 368static void sppp_ipv6cp_tld(struct sppp *sp); 369static void sppp_ipv6cp_tls(struct sppp *sp); 370static void sppp_ipv6cp_tlf(struct sppp *sp); 371static void sppp_ipv6cp_scr(struct sppp *sp); 372 373static void sppp_pap_input(struct sppp *sp, struct mbuf *m); 374static void sppp_pap_init(struct sppp *sp); 375static void sppp_pap_open(struct sppp *sp); 376static void sppp_pap_close(struct sppp *sp); 377static void sppp_pap_TO(void *sp); 378static void sppp_pap_my_TO(void *sp); 379static void sppp_pap_tlu(struct sppp *sp); 380static void sppp_pap_tld(struct sppp *sp); 381static void sppp_pap_scr(struct sppp *sp); 382 383static void sppp_chap_input(struct sppp *sp, struct mbuf *m); 384static void sppp_chap_init(struct sppp *sp); 385static void sppp_chap_open(struct sppp *sp); 386static void sppp_chap_close(struct sppp *sp); 387static void sppp_chap_TO(void *sp); 388static void sppp_chap_tlu(struct sppp *sp); 389static void sppp_chap_tld(struct sppp *sp); 390static void sppp_chap_scr(struct sppp *sp); 391 392static const char *sppp_auth_type_name(u_short proto, u_char type); 393static const char *sppp_cp_type_name(u_char type); 394static const char *sppp_dotted_quad(u_long addr); 395static const char *sppp_ipcp_opt_name(u_char opt); 396#ifdef INET6 397static const char *sppp_ipv6cp_opt_name(u_char opt); 398#endif 399static const char *sppp_lcp_opt_name(u_char opt); 400static const char *sppp_phase_name(enum ppp_phase phase); 401static const char *sppp_proto_name(u_short proto); 402static const char *sppp_state_name(int state); 403static int sppp_params(struct sppp *sp, u_long cmd, void *data); 404static int sppp_strnlen(u_char *p, int max); 405static void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, 406 u_long *srcmask); 407static void sppp_keepalive(void *dummy); 408static void sppp_phase_network(struct sppp *sp); 409static void sppp_print_bytes(const u_char *p, u_short len); 410static void sppp_print_string(const char *p, u_short len); 411static void sppp_qflush(struct ifqueue *ifq); 412static void sppp_set_ip_addr(struct sppp *sp, u_long src); 413#ifdef INET6 414static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 415 struct in6_addr *dst, struct in6_addr *srcmask); 416#ifdef IPV6CP_MYIFID_DYN 417static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 418static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src); 419#endif 420static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src); 421#endif 422 423/* our control protocol descriptors */ 424static const struct cp lcp = { 425 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 426 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 427 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 428 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 429 sppp_lcp_scr 430}; 431 432static const struct cp ipcp = { 433 PPP_IPCP, IDX_IPCP, 434#ifdef INET /* don't run IPCP if there's no IPv4 support */ 435 CP_NCP, 436#else 437 0, 438#endif 439 "ipcp", 440 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 441 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 442 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 443 sppp_ipcp_scr 444}; 445 446static const struct cp ipv6cp = { 447 PPP_IPV6CP, IDX_IPV6CP, 448#ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 449 CP_NCP, 450#else 451 0, 452#endif 453 "ipv6cp", 454 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 455 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 456 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 457 sppp_ipv6cp_scr 458}; 459 460static const struct cp pap = { 461 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 462 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 463 sppp_pap_TO, 0, 0, 0, 464 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 465 sppp_pap_scr 466}; 467 468static const struct cp chap = { 469 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 470 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 471 sppp_chap_TO, 0, 0, 0, 472 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 473 sppp_chap_scr 474}; 475 476static const struct cp *cps[IDX_COUNT] = { 477 &lcp, /* IDX_LCP */ 478 &ipcp, /* IDX_IPCP */ 479 &ipv6cp, /* IDX_IPV6CP */ 480 &pap, /* IDX_PAP */ 481 &chap, /* IDX_CHAP */ 482}; 483 484static int 485sppp_modevent(module_t mod, int type, void *unused) 486{ 487 switch (type) { 488 case MOD_LOAD: 489 break; 490 case MOD_UNLOAD: 491 return EACCES; 492 break; 493 default: 494 break; 495 } 496 return 0; 497} 498static moduledata_t spppmod = { 499 "sppp", 500 sppp_modevent, 501 0 502}; 503MODULE_VERSION(sppp, 1); 504DECLARE_MODULE(sppp, spppmod, SI_SUB_DRIVERS, SI_ORDER_ANY); 505 506/* 507 * Exported functions, comprising our interface to the lower layer. 508 */ 509 510/* 511 * Process the received packet. 512 */ 513void 514sppp_input(struct ifnet *ifp, struct mbuf *m) 515{ 516 struct ppp_header *h; 517 struct ifqueue *inq = 0; 518 struct sppp *sp = (struct sppp *)ifp; 519 u_char *iphdr; 520 int hlen, vjlen, do_account = 0; 521 int debug = ifp->if_flags & IFF_DEBUG; 522 523 if (ifp->if_flags & IFF_UP) 524 /* Count received bytes, add FCS and one flag */ 525 ifp->if_ibytes += m->m_pkthdr.len + 3; 526 527 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 528 /* Too small packet, drop it. */ 529 if (debug) 530 log(LOG_DEBUG, 531 SPP_FMT "input packet is too small, %d bytes\n", 532 SPP_ARGS(ifp), m->m_pkthdr.len); 533 drop: 534 m_freem (m); 535 drop2: 536 ++ifp->if_ierrors; 537 ++ifp->if_iqdrops; 538 return; 539 } 540 541 /* Get PPP header. */ 542 h = mtod (m, struct ppp_header*); 543 m_adj (m, PPP_HEADER_LEN); 544 545 switch (h->address) { 546 case PPP_ALLSTATIONS: 547 if (h->control != PPP_UI) 548 goto invalid; 549 if (sp->pp_mode == IFF_CISCO) { 550 if (debug) 551 log(LOG_DEBUG, 552 SPP_FMT "PPP packet in Cisco mode " 553 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 554 SPP_ARGS(ifp), 555 h->address, h->control, ntohs(h->protocol)); 556 goto drop; 557 } 558 switch (ntohs (h->protocol)) { 559 default: 560 if (debug) 561 log(LOG_DEBUG, 562 SPP_FMT "rejecting protocol " 563 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 564 SPP_ARGS(ifp), 565 h->address, h->control, ntohs(h->protocol)); 566 if (sp->state[IDX_LCP] == STATE_OPENED) 567 sppp_cp_send (sp, PPP_LCP, PROTO_REJ, 568 ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2, 569 &h->protocol); 570 ++ifp->if_noproto; 571 goto drop; 572 case PPP_LCP: 573 sppp_cp_input(&lcp, sp, m); 574 m_freem (m); 575 return; 576 case PPP_PAP: 577 if (sp->pp_phase >= PHASE_AUTHENTICATE) 578 sppp_pap_input(sp, m); 579 m_freem (m); 580 return; 581 case PPP_CHAP: 582 if (sp->pp_phase >= PHASE_AUTHENTICATE) 583 sppp_chap_input(sp, m); 584 m_freem (m); 585 return; 586#ifdef INET 587 case PPP_IPCP: 588 if (sp->pp_phase == PHASE_NETWORK) 589 sppp_cp_input(&ipcp, sp, m); 590 m_freem (m); 591 return; 592 case PPP_IP: 593 if (sp->state[IDX_IPCP] == STATE_OPENED) { 594 schednetisr (NETISR_IP); 595 inq = &ipintrq; 596 } 597 do_account++; 598 break; 599 case PPP_VJ_COMP: 600 if (sp->state[IDX_IPCP] == STATE_OPENED) { 601 if ((vjlen = 602 sl_uncompress_tcp_core(mtod(m, u_char *), 603 m->m_len, m->m_len, 604 TYPE_COMPRESSED_TCP, 605 sp->pp_comp, 606 &iphdr, &hlen)) <= 0) { 607 if (debug) 608 log(LOG_INFO, 609 SPP_FMT "VJ uncompress failed on compressed packet\n", 610 SPP_ARGS(ifp)); 611 goto drop; 612 } 613 614 /* 615 * Trim the VJ header off the packet, and prepend 616 * the uncompressed IP header (which will usually 617 * end up in two chained mbufs since there's not 618 * enough leading space in the existing mbuf). 619 */ 620 m_adj(m, vjlen); 621 M_PREPEND(m, hlen, M_DONTWAIT); 622 if (m == NULL) 623 goto drop2; 624 bcopy(iphdr, mtod(m, u_char *), hlen); 625 626 schednetisr (NETISR_IP); 627 inq = &ipintrq; 628 } 629 do_account++; 630 break; 631 case PPP_VJ_UCOMP: 632 if (sp->state[IDX_IPCP] == STATE_OPENED) { 633 if (sl_uncompress_tcp_core(mtod(m, u_char *), 634 m->m_len, m->m_len, 635 TYPE_UNCOMPRESSED_TCP, 636 sp->pp_comp, 637 &iphdr, &hlen) != 0) { 638 if (debug) 639 log(LOG_INFO, 640 SPP_FMT "VJ uncompress failed on uncompressed packet\n", 641 SPP_ARGS(ifp)); 642 goto drop; 643 } 644 schednetisr (NETISR_IP); 645 inq = &ipintrq; 646 } 647 do_account++; 648 break; 649#endif 650#ifdef INET6 651 case PPP_IPV6CP: 652 if (sp->pp_phase == PHASE_NETWORK) 653 sppp_cp_input(&ipv6cp, sp, m); 654 m_freem (m); 655 return; 656 657 case PPP_IPV6: 658 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 659 schednetisr (NETISR_IPV6); 660 inq = &ip6intrq; 661 } 662 do_account++; 663 break; 664#endif 665#ifdef IPX 666 case PPP_IPX: 667 /* IPX IPXCP not implemented yet */ 668 if (sp->pp_phase == PHASE_NETWORK) { 669 schednetisr (NETISR_IPX); 670 inq = &ipxintrq; 671 } 672 do_account++; 673 break; 674#endif 675#ifdef NS 676 case PPP_XNS: 677 /* XNS IDPCP not implemented yet */ 678 if (sp->pp_phase == PHASE_NETWORK) { 679 schednetisr (NETISR_NS); 680 inq = &nsintrq; 681 } 682 do_account++; 683 break; 684#endif 685 } 686 break; 687 case CISCO_MULTICAST: 688 case CISCO_UNICAST: 689 /* Don't check the control field here (RFC 1547). */ 690 if (sp->pp_mode != IFF_CISCO) { 691 if (debug) 692 log(LOG_DEBUG, 693 SPP_FMT "Cisco packet in PPP mode " 694 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 695 SPP_ARGS(ifp), 696 h->address, h->control, ntohs(h->protocol)); 697 goto drop; 698 } 699 switch (ntohs (h->protocol)) { 700 default: 701 ++ifp->if_noproto; 702 goto invalid; 703 case CISCO_KEEPALIVE: 704 sppp_cisco_input ((struct sppp*) ifp, m); 705 m_freem (m); 706 return; 707#ifdef INET 708 case ETHERTYPE_IP: 709 schednetisr (NETISR_IP); 710 inq = &ipintrq; 711 do_account++; 712 break; 713#endif 714#ifdef INET6 715 case ETHERTYPE_IPV6: 716 schednetisr (NETISR_IPV6); 717 inq = &ip6intrq; 718 do_account++; 719 break; 720#endif 721#ifdef IPX 722 case ETHERTYPE_IPX: 723 schednetisr (NETISR_IPX); 724 inq = &ipxintrq; 725 do_account++; 726 break; 727#endif 728#ifdef NS 729 case ETHERTYPE_NS: 730 schednetisr (NETISR_NS); 731 inq = &nsintrq; 732 do_account++; 733 break; 734#endif 735 } 736 break; 737 default: /* Invalid PPP packet. */ 738 invalid: 739 if (debug) 740 log(LOG_DEBUG, 741 SPP_FMT "invalid input packet " 742 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 743 SPP_ARGS(ifp), 744 h->address, h->control, ntohs(h->protocol)); 745 goto drop; 746 } 747 748 if (! (ifp->if_flags & IFF_UP) || ! inq) 749 goto drop; 750 751 /* Check queue. */ 752 if (! IF_HANDOFF(inq, m, NULL)) { 753 if (debug) 754 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 755 SPP_ARGS(ifp)); 756 goto drop; 757 } 758 if (do_account) 759 /* 760 * Do only account for network packets, not for control 761 * packets. This is used by some subsystems to detect 762 * idle lines. 763 */ 764 sp->pp_last_recv = time_second; 765} 766 767/* 768 * Enqueue transmit packet. 769 */ 770static int 771sppp_output(struct ifnet *ifp, struct mbuf *m, 772 struct sockaddr *dst, struct rtentry *rt) 773{ 774 struct sppp *sp = (struct sppp*) ifp; 775 struct ppp_header *h; 776 struct ifqueue *ifq = NULL; 777 int s, rv = 0; 778 int ipproto = PPP_IP; 779 int debug = ifp->if_flags & IFF_DEBUG; 780 781 s = splimp(); 782 783 if ((ifp->if_flags & IFF_UP) == 0 || 784 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 785 m_freem (m); 786 splx (s); 787 return (ENETDOWN); 788 } 789 790 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 791 /* 792 * Interface is not yet running, but auto-dial. Need 793 * to start LCP for it. 794 */ 795 ifp->if_flags |= IFF_RUNNING; 796 splx(s); 797 lcp.Open(sp); 798 s = splimp(); 799 } 800 801 ifq = &ifp->if_snd; 802#ifdef INET 803 if (dst->sa_family == AF_INET) { 804 /* XXX Check mbuf length here? */ 805 struct ip *ip = mtod (m, struct ip*); 806 struct tcphdr *tcp = (struct tcphdr*) ((long*)ip + ip->ip_hl); 807 808 /* 809 * When using dynamic local IP address assignment by using 810 * 0.0.0.0 as a local address, the first TCP session will 811 * not connect because the local TCP checksum is computed 812 * using 0.0.0.0 which will later become our real IP address 813 * so the TCP checksum computed at the remote end will 814 * become invalid. So we 815 * - don't let packets with src ip addr 0 thru 816 * - we flag TCP packets with src ip 0 as an error 817 */ 818 819 if(ip->ip_src.s_addr == INADDR_ANY) /* -hm */ 820 { 821 m_freem(m); 822 splx(s); 823 if(ip->ip_p == IPPROTO_TCP) 824 return(EADDRNOTAVAIL); 825 else 826 return(0); 827 } 828 829 /* 830 * Put low delay, telnet, rlogin and ftp control packets 831 * in front of the queue. 832 */ 833 if (_IF_QFULL(&sp->pp_fastq)) 834 ; 835 else if (ip->ip_tos & IPTOS_LOWDELAY) 836 ifq = &sp->pp_fastq; 837 else if (m->m_len < sizeof *ip + sizeof *tcp) 838 ; 839 else if (ip->ip_p != IPPROTO_TCP) 840 ; 841 else if (INTERACTIVE (ntohs (tcp->th_sport))) 842 ifq = &sp->pp_fastq; 843 else if (INTERACTIVE (ntohs (tcp->th_dport))) 844 ifq = &sp->pp_fastq; 845 846 /* 847 * Do IP Header compression 848 */ 849 if (sp->pp_mode != IFF_CISCO && (sp->ipcp.flags & IPCP_VJ) && 850 ip->ip_p == IPPROTO_TCP) 851 switch (sl_compress_tcp(m, ip, sp->pp_comp, 852 sp->ipcp.compress_cid)) { 853 case TYPE_COMPRESSED_TCP: 854 ipproto = PPP_VJ_COMP; 855 break; 856 case TYPE_UNCOMPRESSED_TCP: 857 ipproto = PPP_VJ_UCOMP; 858 break; 859 case TYPE_IP: 860 ipproto = PPP_IP; 861 break; 862 default: 863 m_freem(m); 864 splx(s); 865 return (EINVAL); 866 } 867 } 868#endif 869 870#ifdef INET6 871 if (dst->sa_family == AF_INET6) { 872 /* XXX do something tricky here? */ 873 } 874#endif 875 876 /* 877 * Prepend general data packet PPP header. For now, IP only. 878 */ 879 M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT); 880 if (! m) { 881 if (debug) 882 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 883 SPP_ARGS(ifp)); 884 ++ifp->if_oerrors; 885 splx (s); 886 return (ENOBUFS); 887 } 888 /* 889 * May want to check size of packet 890 * (albeit due to the implementation it's always enough) 891 */ 892 h = mtod (m, struct ppp_header*); 893 if (sp->pp_mode == IFF_CISCO) { 894 h->address = CISCO_UNICAST; /* unicast address */ 895 h->control = 0; 896 } else { 897 h->address = PPP_ALLSTATIONS; /* broadcast address */ 898 h->control = PPP_UI; /* Unnumbered Info */ 899 } 900 901 switch (dst->sa_family) { 902#ifdef INET 903 case AF_INET: /* Internet Protocol */ 904 if (sp->pp_mode == IFF_CISCO) 905 h->protocol = htons (ETHERTYPE_IP); 906 else { 907 /* 908 * Don't choke with an ENETDOWN early. It's 909 * possible that we just started dialing out, 910 * so don't drop the packet immediately. If 911 * we notice that we run out of buffer space 912 * below, we will however remember that we are 913 * not ready to carry IP packets, and return 914 * ENETDOWN, as opposed to ENOBUFS. 915 */ 916 h->protocol = htons(ipproto); 917 if (sp->state[IDX_IPCP] != STATE_OPENED) 918 rv = ENETDOWN; 919 } 920 break; 921#endif 922#ifdef INET6 923 case AF_INET6: /* Internet Protocol */ 924 if (sp->pp_mode == IFF_CISCO) 925 h->protocol = htons (ETHERTYPE_IPV6); 926 else { 927 /* 928 * Don't choke with an ENETDOWN early. It's 929 * possible that we just started dialing out, 930 * so don't drop the packet immediately. If 931 * we notice that we run out of buffer space 932 * below, we will however remember that we are 933 * not ready to carry IP packets, and return 934 * ENETDOWN, as opposed to ENOBUFS. 935 */ 936 h->protocol = htons(PPP_IPV6); 937 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 938 rv = ENETDOWN; 939 } 940 break; 941#endif 942#ifdef NS 943 case AF_NS: /* Xerox NS Protocol */ 944 h->protocol = htons (sp->pp_mode == IFF_CISCO ? 945 ETHERTYPE_NS : PPP_XNS); 946 break; 947#endif 948#ifdef IPX 949 case AF_IPX: /* Novell IPX Protocol */ 950 h->protocol = htons (sp->pp_mode == IFF_CISCO ? 951 ETHERTYPE_IPX : PPP_IPX); 952 break; 953#endif 954 default: 955 m_freem (m); 956 ++ifp->if_oerrors; 957 splx (s); 958 return (EAFNOSUPPORT); 959 } 960 961 /* 962 * Queue message on interface, and start output if interface 963 * not yet active. 964 */ 965 if (! IF_HANDOFF_ADJ(ifq, m, ifp, 3)) { 966 ++ifp->if_oerrors; 967 return (rv? rv: ENOBUFS); 968 } 969 /* 970 * Unlike in sppp_input(), we can always bump the timestamp 971 * here since sppp_output() is only called on behalf of 972 * network-layer traffic; control-layer traffic is handled 973 * by sppp_cp_send(). 974 */ 975 sp->pp_last_sent = time_second; 976 return (0); 977} 978 979void 980sppp_attach(struct ifnet *ifp) 981{ 982 struct sppp *sp = (struct sppp*) ifp; 983 984 /* Initialize keepalive handler. */ 985 if (! spppq) 986 TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch); 987 988 /* Insert new entry into the keepalive list. */ 989 sp->pp_next = spppq; 990 spppq = sp; 991 992 sp->pp_if.if_mtu = PP_MTU; 993 sp->pp_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 994 sp->pp_if.if_type = IFT_PPP; 995 sp->pp_if.if_output = sppp_output; 996#if 0 997 sp->pp_flags = PP_KEEPALIVE; 998#endif 999 sp->pp_if.if_snd.ifq_maxlen = 32; 1000 sp->pp_fastq.ifq_maxlen = 32; 1001 sp->pp_cpq.ifq_maxlen = 20; 1002 sp->pp_loopcnt = 0; 1003 sp->pp_alivecnt = 0; 1004 bzero(&sp->pp_seq[0], sizeof(sp->pp_seq)); 1005 bzero(&sp->pp_rseq[0], sizeof(sp->pp_rseq)); 1006 sp->pp_phase = PHASE_DEAD; 1007 sp->pp_up = lcp.Up; 1008 sp->pp_down = lcp.Down; 1009 mtx_init(&sp->pp_cpq.ifq_mtx, "sppp_cpq", MTX_DEF); 1010 mtx_init(&sp->pp_fastq.ifq_mtx, "sppp_fastq", MTX_DEF); 1011 sp->pp_last_recv = sp->pp_last_sent = time_second; 1012 sp->enable_vj = 1; 1013 sp->pp_comp = malloc(sizeof(struct slcompress), M_TEMP, M_WAIT); 1014 sl_compress_init(sp->pp_comp, -1); 1015 sppp_lcp_init(sp); 1016 sppp_ipcp_init(sp); 1017 sppp_ipv6cp_init(sp); 1018 sppp_pap_init(sp); 1019 sppp_chap_init(sp); 1020} 1021 1022void 1023sppp_detach(struct ifnet *ifp) 1024{ 1025 struct sppp **q, *p, *sp = (struct sppp*) ifp; 1026 int i; 1027 1028 /* Remove the entry from the keepalive list. */ 1029 for (q = &spppq; (p = *q); q = &p->pp_next) 1030 if (p == sp) { 1031 *q = p->pp_next; 1032 break; 1033 } 1034 1035 /* Stop keepalive handler. */ 1036 if (! spppq) 1037 UNTIMEOUT(sppp_keepalive, 0, keepalive_ch); 1038 1039 for (i = 0; i < IDX_COUNT; i++) 1040 UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]); 1041 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 1042 mtx_destroy(&sp->pp_cpq.ifq_mtx); 1043 mtx_destroy(&sp->pp_fastq.ifq_mtx); 1044} 1045 1046/* 1047 * Flush the interface output queue. 1048 */ 1049void 1050sppp_flush(struct ifnet *ifp) 1051{ 1052 struct sppp *sp = (struct sppp*) ifp; 1053 1054 sppp_qflush (&sp->pp_if.if_snd); 1055 sppp_qflush (&sp->pp_fastq); 1056 sppp_qflush (&sp->pp_cpq); 1057} 1058 1059/* 1060 * Check if the output queue is empty. 1061 */ 1062int 1063sppp_isempty(struct ifnet *ifp) 1064{ 1065 struct sppp *sp = (struct sppp*) ifp; 1066 int empty, s; 1067 1068 s = splimp(); 1069 empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head && 1070 !sp->pp_if.if_snd.ifq_head; 1071 splx(s); 1072 return (empty); 1073} 1074 1075/* 1076 * Get next packet to send. 1077 */ 1078struct mbuf * 1079sppp_dequeue(struct ifnet *ifp) 1080{ 1081 struct sppp *sp = (struct sppp*) ifp; 1082 struct mbuf *m; 1083 int s; 1084 1085 s = splimp(); 1086 /* 1087 * Process only the control protocol queue until we have at 1088 * least one NCP open. 1089 * 1090 * Do always serve all three queues in Cisco mode. 1091 */ 1092 IF_DEQUEUE(&sp->pp_cpq, m); 1093 if (m == NULL && 1094 (sppp_ncp_check(sp) || sp->pp_mode == IFF_CISCO)) { 1095 IF_DEQUEUE(&sp->pp_fastq, m); 1096 if (m == NULL) 1097 IF_DEQUEUE (&sp->pp_if.if_snd, m); 1098 } 1099 splx(s); 1100 return m; 1101} 1102 1103/* 1104 * Pick the next packet, do not remove it from the queue. 1105 */ 1106struct mbuf * 1107sppp_pick(struct ifnet *ifp) 1108{ 1109 struct sppp *sp = (struct sppp*)ifp; 1110 struct mbuf *m; 1111 int s; 1112 1113 s= splimp (); 1114 1115 m = sp->pp_cpq.ifq_head; 1116 if (m == NULL && 1117 (sp->pp_phase == PHASE_NETWORK || sp->pp_mode == IFF_CISCO)) 1118 if ((m = sp->pp_fastq.ifq_head) == NULL) 1119 m = sp->pp_if.if_snd.ifq_head; 1120 splx (s); 1121 return (m); 1122} 1123 1124/* 1125 * Process an ioctl request. Called on low priority level. 1126 */ 1127int 1128sppp_ioctl(struct ifnet *ifp, IOCTL_CMD_T cmd, void *data) 1129{ 1130 struct ifreq *ifr = (struct ifreq*) data; 1131 struct sppp *sp = (struct sppp*) ifp; 1132 int s, rv, going_up, going_down, newmode; 1133 1134 s = splimp(); 1135 rv = 0; 1136 switch (cmd) { 1137 case SIOCAIFADDR: 1138 case SIOCSIFDSTADDR: 1139 break; 1140 1141 case SIOCSIFADDR: 1142 /* set the interface "up" when assigning an IP address */ 1143 ifp->if_flags |= IFF_UP; 1144 /* fall through... */ 1145 1146 case SIOCSIFFLAGS: 1147 going_up = ifp->if_flags & IFF_UP && 1148 (ifp->if_flags & IFF_RUNNING) == 0; 1149 going_down = (ifp->if_flags & IFF_UP) == 0 && 1150 ifp->if_flags & IFF_RUNNING; 1151 1152 newmode = ifp->if_flags & IFF_PASSIVE; 1153 if (!newmode) 1154 newmode = ifp->if_flags & IFF_AUTO; 1155 if (!newmode) 1156 newmode = ifp->if_flags & IFF_CISCO; 1157 ifp->if_flags &= ~(IFF_PASSIVE | IFF_AUTO | IFF_CISCO); 1158 ifp->if_flags |= newmode; 1159 1160 if (newmode != sp->pp_mode) { 1161 going_down = 1; 1162 if (!going_up) 1163 going_up = ifp->if_flags & IFF_RUNNING; 1164 } 1165 1166 if (going_down) { 1167 if (sp->pp_mode != IFF_CISCO) 1168 lcp.Close(sp); 1169 else if (sp->pp_tlf) 1170 (sp->pp_tlf)(sp); 1171 sppp_flush(ifp); 1172 ifp->if_flags &= ~IFF_RUNNING; 1173 sp->pp_mode = newmode; 1174 } 1175 1176 if (going_up) { 1177 if (sp->pp_mode != IFF_CISCO) 1178 lcp.Close(sp); 1179 sp->pp_mode = newmode; 1180 if (sp->pp_mode == 0) { 1181 ifp->if_flags |= IFF_RUNNING; 1182 lcp.Open(sp); 1183 } 1184 if (sp->pp_mode == IFF_CISCO) { 1185 if (sp->pp_tls) 1186 (sp->pp_tls)(sp); 1187 ifp->if_flags |= IFF_RUNNING; 1188 } 1189 } 1190 1191 break; 1192 1193#ifdef SIOCSIFMTU 1194#ifndef ifr_mtu 1195#define ifr_mtu ifr_metric 1196#endif 1197 case SIOCSIFMTU: 1198 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) 1199 return (EINVAL); 1200 ifp->if_mtu = ifr->ifr_mtu; 1201 break; 1202#endif 1203#ifdef SLIOCSETMTU 1204 case SLIOCSETMTU: 1205 if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) 1206 return (EINVAL); 1207 ifp->if_mtu = *(short*)data; 1208 break; 1209#endif 1210#ifdef SIOCGIFMTU 1211 case SIOCGIFMTU: 1212 ifr->ifr_mtu = ifp->if_mtu; 1213 break; 1214#endif 1215#ifdef SLIOCGETMTU 1216 case SLIOCGETMTU: 1217 *(short*)data = ifp->if_mtu; 1218 break; 1219#endif 1220 case SIOCADDMULTI: 1221 case SIOCDELMULTI: 1222 break; 1223 1224 case SIOCGIFGENERIC: 1225 case SIOCSIFGENERIC: 1226 rv = sppp_params(sp, cmd, data); 1227 break; 1228 1229 default: 1230 rv = ENOTTY; 1231 } 1232 splx(s); 1233 return rv; 1234} 1235 1236/* 1237 * Cisco framing implementation. 1238 */ 1239 1240/* 1241 * Handle incoming Cisco keepalive protocol packets. 1242 */ 1243static void 1244sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1245{ 1246 STDDCL; 1247 struct cisco_packet *h; 1248 u_long me, mymask; 1249 1250 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1251 if (debug) 1252 log(LOG_DEBUG, 1253 SPP_FMT "cisco invalid packet length: %d bytes\n", 1254 SPP_ARGS(ifp), m->m_pkthdr.len); 1255 return; 1256 } 1257 h = mtod (m, struct cisco_packet*); 1258 if (debug) 1259 log(LOG_DEBUG, 1260 SPP_FMT "cisco input: %d bytes " 1261 "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n", 1262 SPP_ARGS(ifp), m->m_pkthdr.len, 1263 (u_long)ntohl (h->type), (u_long)h->par1, (u_long)h->par2, (u_int)h->rel, 1264 (u_int)h->time0, (u_int)h->time1); 1265 switch (ntohl (h->type)) { 1266 default: 1267 if (debug) 1268 log(-1, SPP_FMT "cisco unknown packet type: 0x%lx\n", 1269 SPP_ARGS(ifp), (u_long)ntohl (h->type)); 1270 break; 1271 case CISCO_ADDR_REPLY: 1272 /* Reply on address request, ignore */ 1273 break; 1274 case CISCO_KEEPALIVE_REQ: 1275 sp->pp_alivecnt = 0; 1276 sp->pp_rseq[IDX_LCP] = ntohl (h->par1); 1277 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) { 1278 /* Local and remote sequence numbers are equal. 1279 * Probably, the line is in loopback mode. */ 1280 if (sp->pp_loopcnt >= MAXALIVECNT) { 1281 printf (SPP_FMT "loopback\n", 1282 SPP_ARGS(ifp)); 1283 sp->pp_loopcnt = 0; 1284 if (ifp->if_flags & IFF_UP) { 1285 if_down (ifp); 1286 sppp_qflush (&sp->pp_cpq); 1287 } 1288 } 1289 ++sp->pp_loopcnt; 1290 1291 /* Generate new local sequence number */ 1292#if defined(__FreeBSD__) && __FreeBSD__ >= 3 1293 sp->pp_seq[IDX_LCP] = random(); 1294#else 1295 sp->pp_seq[IDX_LCP] ^= time.tv_sec ^ time.tv_usec; 1296#endif 1297 break; 1298 } 1299 sp->pp_loopcnt = 0; 1300 if (! (ifp->if_flags & IFF_UP) && 1301 (ifp->if_flags & IFF_RUNNING)) { 1302 if_up(ifp); 1303 printf (SPP_FMT "up\n", SPP_ARGS(ifp)); 1304 } 1305 break; 1306 case CISCO_ADDR_REQ: 1307 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1308 if (me != 0L) 1309 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1310 break; 1311 } 1312} 1313 1314/* 1315 * Send Cisco keepalive packet. 1316 */ 1317static void 1318sppp_cisco_send(struct sppp *sp, int type, long par1, long par2) 1319{ 1320 STDDCL; 1321 struct ppp_header *h; 1322 struct cisco_packet *ch; 1323 struct mbuf *m; 1324#if defined(__FreeBSD__) && __FreeBSD__ >= 3 1325 struct timeval tv; 1326#else 1327 u_long t = (time.tv_sec - boottime.tv_sec) * 1000; 1328#endif 1329 1330#if defined(__FreeBSD__) && __FreeBSD__ >= 3 1331 getmicrouptime(&tv); 1332#endif 1333 1334 MGETHDR (m, M_DONTWAIT, MT_DATA); 1335 if (! m) 1336 return; 1337 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1338 m->m_pkthdr.rcvif = 0; 1339 1340 h = mtod (m, struct ppp_header*); 1341 h->address = CISCO_MULTICAST; 1342 h->control = 0; 1343 h->protocol = htons (CISCO_KEEPALIVE); 1344 1345 ch = (struct cisco_packet*) (h + 1); 1346 ch->type = htonl (type); 1347 ch->par1 = htonl (par1); 1348 ch->par2 = htonl (par2); 1349 ch->rel = -1; 1350 1351#if defined(__FreeBSD__) && __FreeBSD__ >= 3 1352 ch->time0 = htons ((u_short) (tv.tv_sec >> 16)); 1353 ch->time1 = htons ((u_short) tv.tv_sec); 1354#else 1355 ch->time0 = htons ((u_short) (t >> 16)); 1356 ch->time1 = htons ((u_short) t); 1357#endif 1358 1359 if (debug) 1360 log(LOG_DEBUG, 1361 SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n", 1362 SPP_ARGS(ifp), (u_long)ntohl (ch->type), (u_long)ch->par1, 1363 (u_long)ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1); 1364 1365 if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3)) 1366 ifp->if_oerrors++; 1367} 1368 1369/* 1370 * PPP protocol implementation. 1371 */ 1372 1373/* 1374 * Send PPP control protocol packet. 1375 */ 1376static void 1377sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1378 u_char ident, u_short len, void *data) 1379{ 1380 STDDCL; 1381 struct ppp_header *h; 1382 struct lcp_header *lh; 1383 struct mbuf *m; 1384 1385 if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN) 1386 len = MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN; 1387 MGETHDR (m, M_DONTWAIT, MT_DATA); 1388 if (! m) 1389 return; 1390 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len; 1391 m->m_pkthdr.rcvif = 0; 1392 1393 h = mtod (m, struct ppp_header*); 1394 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1395 h->control = PPP_UI; /* Unnumbered Info */ 1396 h->protocol = htons (proto); /* Link Control Protocol */ 1397 1398 lh = (struct lcp_header*) (h + 1); 1399 lh->type = type; 1400 lh->ident = ident; 1401 lh->len = htons (LCP_HEADER_LEN + len); 1402 if (len) 1403 bcopy (data, lh+1, len); 1404 1405 if (debug) { 1406 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1407 SPP_ARGS(ifp), 1408 sppp_proto_name(proto), 1409 sppp_cp_type_name (lh->type), lh->ident, 1410 ntohs (lh->len)); 1411 sppp_print_bytes ((u_char*) (lh+1), len); 1412 log(-1, ">\n"); 1413 } 1414 if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3)) 1415 ifp->if_oerrors++; 1416} 1417 1418/* 1419 * Handle incoming PPP control protocol packets. 1420 */ 1421static void 1422sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1423{ 1424 STDDCL; 1425 struct lcp_header *h; 1426 int len = m->m_pkthdr.len; 1427 int rv; 1428 u_char *p; 1429 1430 if (len < 4) { 1431 if (debug) 1432 log(LOG_DEBUG, 1433 SPP_FMT "%s invalid packet length: %d bytes\n", 1434 SPP_ARGS(ifp), cp->name, len); 1435 return; 1436 } 1437 h = mtod (m, struct lcp_header*); 1438 if (debug) { 1439 log(LOG_DEBUG, 1440 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1441 SPP_ARGS(ifp), cp->name, 1442 sppp_state_name(sp->state[cp->protoidx]), 1443 sppp_cp_type_name (h->type), h->ident, ntohs (h->len)); 1444 sppp_print_bytes ((u_char*) (h+1), len-4); 1445 log(-1, ">\n"); 1446 } 1447 if (len > ntohs (h->len)) 1448 len = ntohs (h->len); 1449 p = (u_char *)(h + 1); 1450 switch (h->type) { 1451 case CONF_REQ: 1452 if (len < 4) { 1453 if (debug) 1454 log(-1, SPP_FMT "%s invalid conf-req length %d\n", 1455 SPP_ARGS(ifp), cp->name, 1456 len); 1457 ++ifp->if_ierrors; 1458 break; 1459 } 1460 /* handle states where RCR doesn't get a SCA/SCN */ 1461 switch (sp->state[cp->protoidx]) { 1462 case STATE_CLOSING: 1463 case STATE_STOPPING: 1464 return; 1465 case STATE_CLOSED: 1466 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1467 0, 0); 1468 return; 1469 } 1470 rv = (cp->RCR)(sp, h, len); 1471 switch (sp->state[cp->protoidx]) { 1472 case STATE_OPENED: 1473 (cp->tld)(sp); 1474 (cp->scr)(sp); 1475 /* fall through... */ 1476 case STATE_ACK_SENT: 1477 case STATE_REQ_SENT: 1478 /* 1479 * sppp_cp_change_state() have the side effect of 1480 * restarting the timeouts. We want to avoid that 1481 * if the state don't change, otherwise we won't 1482 * ever timeout and resend a configuration request 1483 * that got lost. 1484 */ 1485 if (sp->state[cp->protoidx] == (rv ? STATE_ACK_SENT: 1486 STATE_REQ_SENT)) 1487 break; 1488 sppp_cp_change_state(cp, sp, rv? 1489 STATE_ACK_SENT: STATE_REQ_SENT); 1490 break; 1491 case STATE_STOPPED: 1492 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1493 (cp->scr)(sp); 1494 sppp_cp_change_state(cp, sp, rv? 1495 STATE_ACK_SENT: STATE_REQ_SENT); 1496 break; 1497 case STATE_ACK_RCVD: 1498 if (rv) { 1499 sppp_cp_change_state(cp, sp, STATE_OPENED); 1500 if (debug) 1501 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1502 SPP_ARGS(ifp), 1503 cp->name); 1504 (cp->tlu)(sp); 1505 } else 1506 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1507 break; 1508 default: 1509 printf(SPP_FMT "%s illegal %s in state %s\n", 1510 SPP_ARGS(ifp), cp->name, 1511 sppp_cp_type_name(h->type), 1512 sppp_state_name(sp->state[cp->protoidx])); 1513 ++ifp->if_ierrors; 1514 } 1515 break; 1516 case CONF_ACK: 1517 if (h->ident != sp->confid[cp->protoidx]) { 1518 if (debug) 1519 log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1520 SPP_ARGS(ifp), cp->name, 1521 h->ident, sp->confid[cp->protoidx]); 1522 ++ifp->if_ierrors; 1523 break; 1524 } 1525 switch (sp->state[cp->protoidx]) { 1526 case STATE_CLOSED: 1527 case STATE_STOPPED: 1528 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1529 break; 1530 case STATE_CLOSING: 1531 case STATE_STOPPING: 1532 break; 1533 case STATE_REQ_SENT: 1534 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1535 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1536 break; 1537 case STATE_OPENED: 1538 (cp->tld)(sp); 1539 /* fall through */ 1540 case STATE_ACK_RCVD: 1541 (cp->scr)(sp); 1542 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1543 break; 1544 case STATE_ACK_SENT: 1545 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1546 sppp_cp_change_state(cp, sp, STATE_OPENED); 1547 if (debug) 1548 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1549 SPP_ARGS(ifp), cp->name); 1550 (cp->tlu)(sp); 1551 break; 1552 default: 1553 printf(SPP_FMT "%s illegal %s in state %s\n", 1554 SPP_ARGS(ifp), cp->name, 1555 sppp_cp_type_name(h->type), 1556 sppp_state_name(sp->state[cp->protoidx])); 1557 ++ifp->if_ierrors; 1558 } 1559 break; 1560 case CONF_NAK: 1561 case CONF_REJ: 1562 if (h->ident != sp->confid[cp->protoidx]) { 1563 if (debug) 1564 log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1565 SPP_ARGS(ifp), cp->name, 1566 h->ident, sp->confid[cp->protoidx]); 1567 ++ifp->if_ierrors; 1568 break; 1569 } 1570 if (h->type == CONF_NAK) 1571 (cp->RCN_nak)(sp, h, len); 1572 else /* CONF_REJ */ 1573 (cp->RCN_rej)(sp, h, len); 1574 1575 switch (sp->state[cp->protoidx]) { 1576 case STATE_CLOSED: 1577 case STATE_STOPPED: 1578 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1579 break; 1580 case STATE_REQ_SENT: 1581 case STATE_ACK_SENT: 1582 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1583 /* 1584 * Slow things down a bit if we think we might be 1585 * in loopback. Depend on the timeout to send the 1586 * next configuration request. 1587 */ 1588 if (sp->pp_loopcnt) 1589 break; 1590 (cp->scr)(sp); 1591 break; 1592 case STATE_OPENED: 1593 (cp->tld)(sp); 1594 /* fall through */ 1595 case STATE_ACK_RCVD: 1596 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1597 (cp->scr)(sp); 1598 break; 1599 case STATE_CLOSING: 1600 case STATE_STOPPING: 1601 break; 1602 default: 1603 printf(SPP_FMT "%s illegal %s in state %s\n", 1604 SPP_ARGS(ifp), cp->name, 1605 sppp_cp_type_name(h->type), 1606 sppp_state_name(sp->state[cp->protoidx])); 1607 ++ifp->if_ierrors; 1608 } 1609 break; 1610 1611 case TERM_REQ: 1612 switch (sp->state[cp->protoidx]) { 1613 case STATE_ACK_RCVD: 1614 case STATE_ACK_SENT: 1615 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1616 /* fall through */ 1617 case STATE_CLOSED: 1618 case STATE_STOPPED: 1619 case STATE_CLOSING: 1620 case STATE_STOPPING: 1621 case STATE_REQ_SENT: 1622 sta: 1623 /* Send Terminate-Ack packet. */ 1624 if (debug) 1625 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1626 SPP_ARGS(ifp), cp->name); 1627 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1628 break; 1629 case STATE_OPENED: 1630 (cp->tld)(sp); 1631 sp->rst_counter[cp->protoidx] = 0; 1632 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1633 goto sta; 1634 break; 1635 default: 1636 printf(SPP_FMT "%s illegal %s in state %s\n", 1637 SPP_ARGS(ifp), cp->name, 1638 sppp_cp_type_name(h->type), 1639 sppp_state_name(sp->state[cp->protoidx])); 1640 ++ifp->if_ierrors; 1641 } 1642 break; 1643 case TERM_ACK: 1644 switch (sp->state[cp->protoidx]) { 1645 case STATE_CLOSED: 1646 case STATE_STOPPED: 1647 case STATE_REQ_SENT: 1648 case STATE_ACK_SENT: 1649 break; 1650 case STATE_CLOSING: 1651 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1652 (cp->tlf)(sp); 1653 break; 1654 case STATE_STOPPING: 1655 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1656 (cp->tlf)(sp); 1657 break; 1658 case STATE_ACK_RCVD: 1659 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1660 break; 1661 case STATE_OPENED: 1662 (cp->tld)(sp); 1663 (cp->scr)(sp); 1664 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1665 break; 1666 default: 1667 printf(SPP_FMT "%s illegal %s in state %s\n", 1668 SPP_ARGS(ifp), cp->name, 1669 sppp_cp_type_name(h->type), 1670 sppp_state_name(sp->state[cp->protoidx])); 1671 ++ifp->if_ierrors; 1672 } 1673 break; 1674 case CODE_REJ: 1675 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1676 log(LOG_INFO, 1677 SPP_FMT "%s: ignoring RXJ (%s) for proto 0x%x, " 1678 "danger will robinson\n", 1679 SPP_ARGS(ifp), cp->name, 1680 sppp_cp_type_name(h->type), ntohs(*((u_short *)p))); 1681 switch (sp->state[cp->protoidx]) { 1682 case STATE_CLOSED: 1683 case STATE_STOPPED: 1684 case STATE_REQ_SENT: 1685 case STATE_ACK_SENT: 1686 case STATE_CLOSING: 1687 case STATE_STOPPING: 1688 case STATE_OPENED: 1689 break; 1690 case STATE_ACK_RCVD: 1691 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1692 break; 1693 default: 1694 printf(SPP_FMT "%s illegal %s in state %s\n", 1695 SPP_ARGS(ifp), cp->name, 1696 sppp_cp_type_name(h->type), 1697 sppp_state_name(sp->state[cp->protoidx])); 1698 ++ifp->if_ierrors; 1699 } 1700 break; 1701 case PROTO_REJ: 1702 { 1703 int catastrophic; 1704 const struct cp *upper; 1705 int i; 1706 u_int16_t proto; 1707 1708 catastrophic = 0; 1709 upper = NULL; 1710 proto = ntohs(*((u_int16_t *)p)); 1711 for (i = 0; i < IDX_COUNT; i++) { 1712 if (cps[i]->proto == proto) { 1713 upper = cps[i]; 1714 break; 1715 } 1716 } 1717 if (upper == NULL) 1718 catastrophic++; 1719 1720 if (catastrophic || debug) 1721 log(catastrophic? LOG_INFO: LOG_DEBUG, 1722 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1723 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1724 sppp_cp_type_name(h->type), proto, 1725 upper ? upper->name : "unknown", 1726 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1727 1728 /* 1729 * if we got RXJ+ against conf-req, the peer does not implement 1730 * this particular protocol type. terminate the protocol. 1731 */ 1732 if (upper && !catastrophic) { 1733 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1734 upper->Close(sp); 1735 break; 1736 } 1737 } 1738 1739 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1740 switch (sp->state[cp->protoidx]) { 1741 case STATE_CLOSED: 1742 case STATE_STOPPED: 1743 case STATE_REQ_SENT: 1744 case STATE_ACK_SENT: 1745 case STATE_CLOSING: 1746 case STATE_STOPPING: 1747 case STATE_OPENED: 1748 break; 1749 case STATE_ACK_RCVD: 1750 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1751 break; 1752 default: 1753 printf(SPP_FMT "%s illegal %s in state %s\n", 1754 SPP_ARGS(ifp), cp->name, 1755 sppp_cp_type_name(h->type), 1756 sppp_state_name(sp->state[cp->protoidx])); 1757 ++ifp->if_ierrors; 1758 } 1759 break; 1760 } 1761 case DISC_REQ: 1762 if (cp->proto != PPP_LCP) 1763 goto illegal; 1764 /* Discard the packet. */ 1765 break; 1766 case ECHO_REQ: 1767 if (cp->proto != PPP_LCP) 1768 goto illegal; 1769 if (sp->state[cp->protoidx] != STATE_OPENED) { 1770 if (debug) 1771 log(-1, SPP_FMT "lcp echo req but lcp closed\n", 1772 SPP_ARGS(ifp)); 1773 ++ifp->if_ierrors; 1774 break; 1775 } 1776 if (len < 8) { 1777 if (debug) 1778 log(-1, SPP_FMT "invalid lcp echo request " 1779 "packet length: %d bytes\n", 1780 SPP_ARGS(ifp), len); 1781 break; 1782 } 1783 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 1784 ntohl (*(long*)(h+1)) == sp->lcp.magic) { 1785 /* Line loopback mode detected. */ 1786 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1787 sp->pp_loopcnt = MAXALIVECNT * 5; 1788 if_down (ifp); 1789 sppp_qflush (&sp->pp_cpq); 1790 1791 /* Shut down the PPP link. */ 1792 /* XXX */ 1793 lcp.Down(sp); 1794 lcp.Up(sp); 1795 break; 1796 } 1797 *(long*)(h+1) = htonl (sp->lcp.magic); 1798 if (debug) 1799 log(-1, SPP_FMT "got lcp echo req, sending echo rep\n", 1800 SPP_ARGS(ifp)); 1801 sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1); 1802 break; 1803 case ECHO_REPLY: 1804 if (cp->proto != PPP_LCP) 1805 goto illegal; 1806 if (h->ident != sp->lcp.echoid) { 1807 ++ifp->if_ierrors; 1808 break; 1809 } 1810 if (len < 8) { 1811 if (debug) 1812 log(-1, SPP_FMT "lcp invalid echo reply " 1813 "packet length: %d bytes\n", 1814 SPP_ARGS(ifp), len); 1815 break; 1816 } 1817 if (debug) 1818 log(-1, SPP_FMT "lcp got echo rep\n", 1819 SPP_ARGS(ifp)); 1820 if (!(sp->lcp.opts & (1 << LCP_OPT_MAGIC)) || 1821 ntohl (*(long*)(h+1)) != sp->lcp.magic) 1822 sp->pp_alivecnt = 0; 1823 break; 1824 default: 1825 /* Unknown packet type -- send Code-Reject packet. */ 1826 illegal: 1827 if (debug) 1828 log(-1, SPP_FMT "%s send code-rej for 0x%x\n", 1829 SPP_ARGS(ifp), cp->name, h->type); 1830 sppp_cp_send(sp, cp->proto, CODE_REJ, 1831 ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h); 1832 ++ifp->if_ierrors; 1833 } 1834} 1835 1836 1837/* 1838 * The generic part of all Up/Down/Open/Close/TO event handlers. 1839 * Basically, the state transition handling in the automaton. 1840 */ 1841static void 1842sppp_up_event(const struct cp *cp, struct sppp *sp) 1843{ 1844 STDDCL; 1845 1846 if (debug) 1847 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1848 SPP_ARGS(ifp), cp->name, 1849 sppp_state_name(sp->state[cp->protoidx])); 1850 1851 switch (sp->state[cp->protoidx]) { 1852 case STATE_INITIAL: 1853 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1854 break; 1855 case STATE_STARTING: 1856 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1857 (cp->scr)(sp); 1858 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1859 break; 1860 default: 1861 printf(SPP_FMT "%s illegal up in state %s\n", 1862 SPP_ARGS(ifp), cp->name, 1863 sppp_state_name(sp->state[cp->protoidx])); 1864 } 1865} 1866 1867static void 1868sppp_down_event(const struct cp *cp, struct sppp *sp) 1869{ 1870 STDDCL; 1871 1872 if (debug) 1873 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1874 SPP_ARGS(ifp), cp->name, 1875 sppp_state_name(sp->state[cp->protoidx])); 1876 1877 switch (sp->state[cp->protoidx]) { 1878 case STATE_CLOSED: 1879 case STATE_CLOSING: 1880 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1881 break; 1882 case STATE_STOPPED: 1883 sppp_cp_change_state(cp, sp, STATE_STARTING); 1884 (cp->tls)(sp); 1885 break; 1886 case STATE_STOPPING: 1887 case STATE_REQ_SENT: 1888 case STATE_ACK_RCVD: 1889 case STATE_ACK_SENT: 1890 sppp_cp_change_state(cp, sp, STATE_STARTING); 1891 break; 1892 case STATE_OPENED: 1893 (cp->tld)(sp); 1894 sppp_cp_change_state(cp, sp, STATE_STARTING); 1895 break; 1896 default: 1897 printf(SPP_FMT "%s illegal down in state %s\n", 1898 SPP_ARGS(ifp), cp->name, 1899 sppp_state_name(sp->state[cp->protoidx])); 1900 } 1901} 1902 1903 1904static void 1905sppp_open_event(const struct cp *cp, struct sppp *sp) 1906{ 1907 STDDCL; 1908 1909 if (debug) 1910 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1911 SPP_ARGS(ifp), cp->name, 1912 sppp_state_name(sp->state[cp->protoidx])); 1913 1914 switch (sp->state[cp->protoidx]) { 1915 case STATE_INITIAL: 1916 sppp_cp_change_state(cp, sp, STATE_STARTING); 1917 (cp->tls)(sp); 1918 break; 1919 case STATE_STARTING: 1920 break; 1921 case STATE_CLOSED: 1922 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1923 (cp->scr)(sp); 1924 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1925 break; 1926 case STATE_STOPPED: 1927 /* 1928 * Try escaping stopped state. This seems to bite 1929 * people occasionally, in particular for IPCP, 1930 * presumably following previous IPCP negotiation 1931 * aborts. Somehow, we must have missed a Down event 1932 * which would have caused a transition into starting 1933 * state, so as a bandaid we force the Down event now. 1934 * This effectively implements (something like the) 1935 * `restart' option mentioned in the state transition 1936 * table of RFC 1661. 1937 */ 1938 sppp_cp_change_state(cp, sp, STATE_STARTING); 1939 (cp->tls)(sp); 1940 break; 1941 case STATE_STOPPING: 1942 case STATE_REQ_SENT: 1943 case STATE_ACK_RCVD: 1944 case STATE_ACK_SENT: 1945 case STATE_OPENED: 1946 break; 1947 case STATE_CLOSING: 1948 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1949 break; 1950 } 1951} 1952 1953 1954static void 1955sppp_close_event(const struct cp *cp, struct sppp *sp) 1956{ 1957 STDDCL; 1958 1959 if (debug) 1960 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1961 SPP_ARGS(ifp), cp->name, 1962 sppp_state_name(sp->state[cp->protoidx])); 1963 1964 switch (sp->state[cp->protoidx]) { 1965 case STATE_INITIAL: 1966 case STATE_CLOSED: 1967 case STATE_CLOSING: 1968 break; 1969 case STATE_STARTING: 1970 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1971 (cp->tlf)(sp); 1972 break; 1973 case STATE_STOPPED: 1974 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1975 break; 1976 case STATE_STOPPING: 1977 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1978 break; 1979 case STATE_OPENED: 1980 (cp->tld)(sp); 1981 /* fall through */ 1982 case STATE_REQ_SENT: 1983 case STATE_ACK_RCVD: 1984 case STATE_ACK_SENT: 1985 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1986 sppp_cp_send(sp, cp->proto, TERM_REQ, 1987 ++sp->pp_seq[cp->protoidx], 0, 0); 1988 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1989 break; 1990 } 1991} 1992 1993static void 1994sppp_to_event(const struct cp *cp, struct sppp *sp) 1995{ 1996 STDDCL; 1997 int s; 1998 1999 s = splimp(); 2000 if (debug) 2001 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 2002 SPP_ARGS(ifp), cp->name, 2003 sppp_state_name(sp->state[cp->protoidx]), 2004 sp->rst_counter[cp->protoidx]); 2005 2006 if (--sp->rst_counter[cp->protoidx] < 0) 2007 /* TO- event */ 2008 switch (sp->state[cp->protoidx]) { 2009 case STATE_CLOSING: 2010 sppp_cp_change_state(cp, sp, STATE_CLOSED); 2011 (cp->tlf)(sp); 2012 break; 2013 case STATE_STOPPING: 2014 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2015 (cp->tlf)(sp); 2016 break; 2017 case STATE_REQ_SENT: 2018 case STATE_ACK_RCVD: 2019 case STATE_ACK_SENT: 2020 sppp_cp_change_state(cp, sp, STATE_STOPPED); 2021 (cp->tlf)(sp); 2022 break; 2023 } 2024 else 2025 /* TO+ event */ 2026 switch (sp->state[cp->protoidx]) { 2027 case STATE_CLOSING: 2028 case STATE_STOPPING: 2029 sppp_cp_send(sp, cp->proto, TERM_REQ, 2030 ++sp->pp_seq[cp->protoidx], 0, 0); 2031 TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout, 2032 sp->ch[cp->protoidx]); 2033 break; 2034 case STATE_REQ_SENT: 2035 case STATE_ACK_RCVD: 2036 (cp->scr)(sp); 2037 /* sppp_cp_change_state() will restart the timer */ 2038 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 2039 break; 2040 case STATE_ACK_SENT: 2041 (cp->scr)(sp); 2042 TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout, 2043 sp->ch[cp->protoidx]); 2044 break; 2045 } 2046 2047 splx(s); 2048} 2049 2050/* 2051 * Change the state of a control protocol in the state automaton. 2052 * Takes care of starting/stopping the restart timer. 2053 */ 2054void 2055sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 2056{ 2057 sp->state[cp->protoidx] = newstate; 2058 2059 UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]); 2060 switch (newstate) { 2061 case STATE_INITIAL: 2062 case STATE_STARTING: 2063 case STATE_CLOSED: 2064 case STATE_STOPPED: 2065 case STATE_OPENED: 2066 break; 2067 case STATE_CLOSING: 2068 case STATE_STOPPING: 2069 case STATE_REQ_SENT: 2070 case STATE_ACK_RCVD: 2071 case STATE_ACK_SENT: 2072 TIMEOUT(cp->TO, (void *)sp, sp->lcp.timeout, 2073 sp->ch[cp->protoidx]); 2074 break; 2075 } 2076} 2077 2078/* 2079 *--------------------------------------------------------------------------* 2080 * * 2081 * The LCP implementation. * 2082 * * 2083 *--------------------------------------------------------------------------* 2084 */ 2085static void 2086sppp_lcp_init(struct sppp *sp) 2087{ 2088 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2089 sp->lcp.magic = 0; 2090 sp->state[IDX_LCP] = STATE_INITIAL; 2091 sp->fail_counter[IDX_LCP] = 0; 2092 sp->pp_seq[IDX_LCP] = 0; 2093 sp->pp_rseq[IDX_LCP] = 0; 2094 sp->lcp.protos = 0; 2095 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2096 2097 /* Note that these values are relevant for all control protocols */ 2098 sp->lcp.timeout = 3 * hz; 2099 sp->lcp.max_terminate = 2; 2100 sp->lcp.max_configure = 10; 2101 sp->lcp.max_failure = 10; 2102#if defined(__FreeBSD__) && __FreeBSD__ >= 3 2103 callout_handle_init(&sp->ch[IDX_LCP]); 2104#endif 2105} 2106 2107static void 2108sppp_lcp_up(struct sppp *sp) 2109{ 2110 STDDCL; 2111 2112 sp->pp_alivecnt = 0; 2113 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2114 sp->lcp.magic = 0; 2115 sp->lcp.protos = 0; 2116 sp->lcp.mru = sp->lcp.their_mru = PP_MTU; 2117 /* 2118 * If we are authenticator, negotiate LCP_AUTH 2119 */ 2120 if (sp->hisauth.proto != 0) 2121 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2122 else 2123 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2124 sp->pp_flags &= ~PP_NEEDAUTH; 2125 /* 2126 * If this interface is passive or dial-on-demand, and we are 2127 * still in Initial state, it means we've got an incoming 2128 * call. Activate the interface. 2129 */ 2130 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2131 if (debug) 2132 log(LOG_DEBUG, 2133 SPP_FMT "Up event", SPP_ARGS(ifp)); 2134 ifp->if_flags |= IFF_RUNNING; 2135 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2136 if (debug) 2137 log(-1, "(incoming call)\n"); 2138 sp->pp_flags |= PP_CALLIN; 2139 lcp.Open(sp); 2140 } else if (debug) 2141 log(-1, "\n"); 2142 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2143 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2144 ifp->if_flags |= IFF_RUNNING; 2145 lcp.Open(sp); 2146 } 2147 2148 sppp_up_event(&lcp, sp); 2149} 2150 2151static void 2152sppp_lcp_down(struct sppp *sp) 2153{ 2154 STDDCL; 2155 2156 sppp_down_event(&lcp, sp); 2157 2158 /* 2159 * If this is neither a dial-on-demand nor a passive 2160 * interface, simulate an ``ifconfig down'' action, so the 2161 * administrator can force a redial by another ``ifconfig 2162 * up''. XXX For leased line operation, should we immediately 2163 * try to reopen the connection here? 2164 */ 2165 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2166 log(LOG_INFO, 2167 SPP_FMT "Down event, taking interface down.\n", 2168 SPP_ARGS(ifp)); 2169 if_down(ifp); 2170 } else { 2171 if (debug) 2172 log(LOG_DEBUG, 2173 SPP_FMT "Down event (carrier loss)\n", 2174 SPP_ARGS(ifp)); 2175 sp->pp_flags &= ~PP_CALLIN; 2176 if (sp->state[IDX_LCP] != STATE_INITIAL) 2177 lcp.Close(sp); 2178 ifp->if_flags &= ~IFF_RUNNING; 2179 } 2180} 2181 2182static void 2183sppp_lcp_open(struct sppp *sp) 2184{ 2185 sppp_open_event(&lcp, sp); 2186} 2187 2188static void 2189sppp_lcp_close(struct sppp *sp) 2190{ 2191 sppp_close_event(&lcp, sp); 2192} 2193 2194static void 2195sppp_lcp_TO(void *cookie) 2196{ 2197 sppp_to_event(&lcp, (struct sppp *)cookie); 2198} 2199 2200/* 2201 * Analyze a configure request. Return true if it was agreeable, and 2202 * caused action sca, false if it has been rejected or nak'ed, and 2203 * caused action scn. (The return value is used to make the state 2204 * transition decision in the state automaton.) 2205 */ 2206static int 2207sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2208{ 2209 STDDCL; 2210 u_char *buf, *r, *p; 2211 int origlen, rlen; 2212 u_long nmagic; 2213 u_short authproto; 2214 2215 len -= 4; 2216 origlen = len; 2217 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2218 if (! buf) 2219 return (0); 2220 2221 if (debug) 2222 log(LOG_DEBUG, SPP_FMT "lcp parse opts: ", 2223 SPP_ARGS(ifp)); 2224 2225 /* pass 1: check for things that need to be rejected */ 2226 p = (void*) (h+1); 2227 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2228 if (debug) 2229 log(-1, " %s ", sppp_lcp_opt_name(*p)); 2230 switch (*p) { 2231 case LCP_OPT_MAGIC: 2232 /* Magic number. */ 2233 if (len >= 6 && p[1] == 6) 2234 continue; 2235 if (debug) 2236 log(-1, "[invalid] "); 2237 break; 2238 case LCP_OPT_ASYNC_MAP: 2239 /* Async control character map. */ 2240 if (len >= 6 && p[1] == 6) 2241 continue; 2242 if (debug) 2243 log(-1, "[invalid] "); 2244 break; 2245 case LCP_OPT_MRU: 2246 /* Maximum receive unit. */ 2247 if (len >= 4 && p[1] == 4) 2248 continue; 2249 if (debug) 2250 log(-1, "[invalid] "); 2251 break; 2252 case LCP_OPT_AUTH_PROTO: 2253 if (len < 4) { 2254 if (debug) 2255 log(-1, "[invalid] "); 2256 break; 2257 } 2258 authproto = (p[2] << 8) + p[3]; 2259 if (authproto == PPP_CHAP && p[1] != 5) { 2260 if (debug) 2261 log(-1, "[invalid chap len] "); 2262 break; 2263 } 2264 if (sp->myauth.proto == 0) { 2265 /* we are not configured to do auth */ 2266 if (debug) 2267 log(-1, "[not configured] "); 2268 break; 2269 } 2270 /* 2271 * Remote want us to authenticate, remember this, 2272 * so we stay in PHASE_AUTHENTICATE after LCP got 2273 * up. 2274 */ 2275 sp->pp_flags |= PP_NEEDAUTH; 2276 continue; 2277 default: 2278 /* Others not supported. */ 2279 if (debug) 2280 log(-1, "[rej] "); 2281 break; 2282 } 2283 /* Add the option to rejected list. */ 2284 bcopy (p, r, p[1]); 2285 r += p[1]; 2286 rlen += p[1]; 2287 } 2288 if (rlen) { 2289 if (debug) 2290 log(-1, " send conf-rej\n"); 2291 sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2292 return 0; 2293 } else if (debug) 2294 log(-1, "\n"); 2295 2296 /* 2297 * pass 2: check for option values that are unacceptable and 2298 * thus require to be nak'ed. 2299 */ 2300 if (debug) 2301 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2302 SPP_ARGS(ifp)); 2303 2304 p = (void*) (h+1); 2305 len = origlen; 2306 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2307 if (debug) 2308 log(-1, " %s ", sppp_lcp_opt_name(*p)); 2309 switch (*p) { 2310 case LCP_OPT_MAGIC: 2311 /* Magic number -- extract. */ 2312 nmagic = (u_long)p[2] << 24 | 2313 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2314 if (nmagic != sp->lcp.magic) { 2315 sp->pp_loopcnt = 0; 2316 if (debug) 2317 log(-1, "0x%lx ", nmagic); 2318 continue; 2319 } 2320 if (debug && sp->pp_loopcnt < MAXALIVECNT*5) 2321 log(-1, "[glitch] "); 2322 ++sp->pp_loopcnt; 2323 /* 2324 * We negate our magic here, and NAK it. If 2325 * we see it later in an NAK packet, we 2326 * suggest a new one. 2327 */ 2328 nmagic = ~sp->lcp.magic; 2329 /* Gonna NAK it. */ 2330 p[2] = nmagic >> 24; 2331 p[3] = nmagic >> 16; 2332 p[4] = nmagic >> 8; 2333 p[5] = nmagic; 2334 break; 2335 2336 case LCP_OPT_ASYNC_MAP: 2337 /* 2338 * Async control character map -- just ignore it. 2339 * 2340 * Quote from RFC 1662, chapter 6: 2341 * To enable this functionality, synchronous PPP 2342 * implementations MUST always respond to the 2343 * Async-Control-Character-Map Configuration 2344 * Option with the LCP Configure-Ack. However, 2345 * acceptance of the Configuration Option does 2346 * not imply that the synchronous implementation 2347 * will do any ACCM mapping. Instead, all such 2348 * octet mapping will be performed by the 2349 * asynchronous-to-synchronous converter. 2350 */ 2351 continue; 2352 2353 case LCP_OPT_MRU: 2354 /* 2355 * Maximum receive unit. Always agreeable, 2356 * but ignored by now. 2357 */ 2358 sp->lcp.their_mru = p[2] * 256 + p[3]; 2359 if (debug) 2360 log(-1, "%lu ", sp->lcp.their_mru); 2361 continue; 2362 2363 case LCP_OPT_AUTH_PROTO: 2364 authproto = (p[2] << 8) + p[3]; 2365 if (sp->myauth.proto != authproto) { 2366 /* not agreed, nak */ 2367 if (debug) 2368 log(-1, "[mine %s != his %s] ", 2369 sppp_proto_name(sp->hisauth.proto), 2370 sppp_proto_name(authproto)); 2371 p[2] = sp->myauth.proto >> 8; 2372 p[3] = sp->myauth.proto; 2373 break; 2374 } 2375 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2376 if (debug) 2377 log(-1, "[chap not MD5] "); 2378 p[4] = CHAP_MD5; 2379 break; 2380 } 2381 continue; 2382 } 2383 /* Add the option to nak'ed list. */ 2384 bcopy (p, r, p[1]); 2385 r += p[1]; 2386 rlen += p[1]; 2387 } 2388 if (rlen) { 2389 /* 2390 * Local and remote magics equal -- loopback? 2391 */ 2392 if (sp->pp_loopcnt >= MAXALIVECNT*5) { 2393 if (sp->pp_loopcnt == MAXALIVECNT*5) 2394 printf (SPP_FMT "loopback\n", 2395 SPP_ARGS(ifp)); 2396 if (ifp->if_flags & IFF_UP) { 2397 if_down(ifp); 2398 sppp_qflush(&sp->pp_cpq); 2399 /* XXX ? */ 2400 lcp.Down(sp); 2401 lcp.Up(sp); 2402 } 2403 } else if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2404 if (debug) 2405 log(-1, " max_failure (%d) exceeded, " 2406 "send conf-rej\n", 2407 sp->lcp.max_failure); 2408 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2409 } else { 2410 if (debug) 2411 log(-1, " send conf-nak\n"); 2412 sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2413 } 2414 } else { 2415 if (debug) 2416 log(-1, " send conf-ack\n"); 2417 sp->fail_counter[IDX_LCP] = 0; 2418 sp->pp_loopcnt = 0; 2419 sppp_cp_send (sp, PPP_LCP, CONF_ACK, 2420 h->ident, origlen, h+1); 2421 } 2422 2423 free (buf, M_TEMP); 2424 return (rlen == 0); 2425} 2426 2427/* 2428 * Analyze the LCP Configure-Reject option list, and adjust our 2429 * negotiation. 2430 */ 2431static void 2432sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2433{ 2434 STDDCL; 2435 u_char *buf, *p; 2436 2437 len -= 4; 2438 buf = malloc (len, M_TEMP, M_NOWAIT); 2439 if (!buf) 2440 return; 2441 2442 if (debug) 2443 log(LOG_DEBUG, SPP_FMT "lcp rej opts: ", 2444 SPP_ARGS(ifp)); 2445 2446 p = (void*) (h+1); 2447 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2448 if (debug) 2449 log(-1, " %s ", sppp_lcp_opt_name(*p)); 2450 switch (*p) { 2451 case LCP_OPT_MAGIC: 2452 /* Magic number -- can't use it, use 0 */ 2453 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2454 sp->lcp.magic = 0; 2455 break; 2456 case LCP_OPT_MRU: 2457 /* 2458 * Should not be rejected anyway, since we only 2459 * negotiate a MRU if explicitly requested by 2460 * peer. 2461 */ 2462 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2463 break; 2464 case LCP_OPT_AUTH_PROTO: 2465 /* 2466 * Peer doesn't want to authenticate himself, 2467 * deny unless this is a dialout call, and 2468 * AUTHFLAG_NOCALLOUT is set. 2469 */ 2470 if ((sp->pp_flags & PP_CALLIN) == 0 && 2471 (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) { 2472 if (debug) 2473 log(-1, "[don't insist on auth " 2474 "for callout]"); 2475 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2476 break; 2477 } 2478 if (debug) 2479 log(-1, "[access denied]\n"); 2480 lcp.Close(sp); 2481 break; 2482 } 2483 } 2484 if (debug) 2485 log(-1, "\n"); 2486 free (buf, M_TEMP); 2487 return; 2488} 2489 2490/* 2491 * Analyze the LCP Configure-NAK option list, and adjust our 2492 * negotiation. 2493 */ 2494static void 2495sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2496{ 2497 STDDCL; 2498 u_char *buf, *p; 2499 u_long magic; 2500 2501 len -= 4; 2502 buf = malloc (len, M_TEMP, M_NOWAIT); 2503 if (!buf) 2504 return; 2505 2506 if (debug) 2507 log(LOG_DEBUG, SPP_FMT "lcp nak opts: ", 2508 SPP_ARGS(ifp)); 2509 2510 p = (void*) (h+1); 2511 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 2512 if (debug) 2513 log(-1, " %s ", sppp_lcp_opt_name(*p)); 2514 switch (*p) { 2515 case LCP_OPT_MAGIC: 2516 /* Magic number -- renegotiate */ 2517 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2518 len >= 6 && p[1] == 6) { 2519 magic = (u_long)p[2] << 24 | 2520 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2521 /* 2522 * If the remote magic is our negated one, 2523 * this looks like a loopback problem. 2524 * Suggest a new magic to make sure. 2525 */ 2526 if (magic == ~sp->lcp.magic) { 2527 if (debug) 2528 log(-1, "magic glitch "); 2529#if defined(__FreeBSD__) && __FreeBSD__ >= 3 2530 sp->lcp.magic = random(); 2531#else 2532 sp->lcp.magic = time.tv_sec + time.tv_usec; 2533#endif 2534 } else { 2535 sp->lcp.magic = magic; 2536 if (debug) 2537 log(-1, "%lu ", magic); 2538 } 2539 } 2540 break; 2541 case LCP_OPT_MRU: 2542 /* 2543 * Peer wants to advise us to negotiate an MRU. 2544 * Agree on it if it's reasonable, or use 2545 * default otherwise. 2546 */ 2547 if (len >= 4 && p[1] == 4) { 2548 u_int mru = p[2] * 256 + p[3]; 2549 if (debug) 2550 log(-1, "%d ", mru); 2551 if (mru < PP_MTU || mru > PP_MAX_MRU) 2552 mru = PP_MTU; 2553 sp->lcp.mru = mru; 2554 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2555 } 2556 break; 2557 case LCP_OPT_AUTH_PROTO: 2558 /* 2559 * Peer doesn't like our authentication method, 2560 * deny. 2561 */ 2562 if (debug) 2563 log(-1, "[access denied]\n"); 2564 lcp.Close(sp); 2565 break; 2566 } 2567 } 2568 if (debug) 2569 log(-1, "\n"); 2570 free (buf, M_TEMP); 2571 return; 2572} 2573 2574static void 2575sppp_lcp_tlu(struct sppp *sp) 2576{ 2577 STDDCL; 2578 int i; 2579 u_long mask; 2580 2581 /* XXX ? */ 2582 if (! (ifp->if_flags & IFF_UP) && 2583 (ifp->if_flags & IFF_RUNNING)) { 2584 /* Coming out of loopback mode. */ 2585 if_up(ifp); 2586 printf (SPP_FMT "up\n", SPP_ARGS(ifp)); 2587 } 2588 2589 for (i = 0; i < IDX_COUNT; i++) 2590 if ((cps[i])->flags & CP_QUAL) 2591 (cps[i])->Open(sp); 2592 2593 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2594 (sp->pp_flags & PP_NEEDAUTH) != 0) 2595 sp->pp_phase = PHASE_AUTHENTICATE; 2596 else 2597 sp->pp_phase = PHASE_NETWORK; 2598 2599 if (debug) 2600 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2601 sppp_phase_name(sp->pp_phase)); 2602 2603 /* 2604 * Open all authentication protocols. This is even required 2605 * if we already proceeded to network phase, since it might be 2606 * that remote wants us to authenticate, so we might have to 2607 * send a PAP request. Undesired authentication protocols 2608 * don't do anything when they get an Open event. 2609 */ 2610 for (i = 0; i < IDX_COUNT; i++) 2611 if ((cps[i])->flags & CP_AUTH) 2612 (cps[i])->Open(sp); 2613 2614 if (sp->pp_phase == PHASE_NETWORK) { 2615 /* Notify all NCPs. */ 2616 for (i = 0; i < IDX_COUNT; i++) 2617 if ((cps[i])->flags & CP_NCP) 2618 (cps[i])->Open(sp); 2619 } 2620 2621 /* Send Up events to all started protos. */ 2622 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2623 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) 2624 (cps[i])->Up(sp); 2625 2626 /* notify low-level driver of state change */ 2627 if (sp->pp_chg) 2628 sp->pp_chg(sp, (int)sp->pp_phase); 2629 2630 if (sp->pp_phase == PHASE_NETWORK) 2631 /* if no NCP is starting, close down */ 2632 sppp_lcp_check_and_close(sp); 2633} 2634 2635static void 2636sppp_lcp_tld(struct sppp *sp) 2637{ 2638 STDDCL; 2639 int i; 2640 u_long mask; 2641 2642 sp->pp_phase = PHASE_TERMINATE; 2643 2644 if (debug) 2645 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2646 sppp_phase_name(sp->pp_phase)); 2647 2648 /* 2649 * Take upper layers down. We send the Down event first and 2650 * the Close second to prevent the upper layers from sending 2651 * ``a flurry of terminate-request packets'', as the RFC 2652 * describes it. 2653 */ 2654 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2655 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) { 2656 (cps[i])->Down(sp); 2657 (cps[i])->Close(sp); 2658 } 2659} 2660 2661static void 2662sppp_lcp_tls(struct sppp *sp) 2663{ 2664 STDDCL; 2665 2666 sp->pp_phase = PHASE_ESTABLISH; 2667 2668 if (debug) 2669 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2670 sppp_phase_name(sp->pp_phase)); 2671 2672 /* Notify lower layer if desired. */ 2673 if (sp->pp_tls) 2674 (sp->pp_tls)(sp); 2675 else 2676 (sp->pp_up)(sp); 2677} 2678 2679static void 2680sppp_lcp_tlf(struct sppp *sp) 2681{ 2682 STDDCL; 2683 2684 sp->pp_phase = PHASE_DEAD; 2685 if (debug) 2686 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 2687 sppp_phase_name(sp->pp_phase)); 2688 2689 /* Notify lower layer if desired. */ 2690 if (sp->pp_tlf) 2691 (sp->pp_tlf)(sp); 2692 else 2693 (sp->pp_down)(sp); 2694} 2695 2696static void 2697sppp_lcp_scr(struct sppp *sp) 2698{ 2699 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2700 int i = 0; 2701 u_short authproto; 2702 2703 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2704 if (! sp->lcp.magic) 2705#if defined(__FreeBSD__) && __FreeBSD__ >= 3 2706 sp->lcp.magic = random(); 2707#else 2708 sp->lcp.magic = time.tv_sec + time.tv_usec; 2709#endif 2710 opt[i++] = LCP_OPT_MAGIC; 2711 opt[i++] = 6; 2712 opt[i++] = sp->lcp.magic >> 24; 2713 opt[i++] = sp->lcp.magic >> 16; 2714 opt[i++] = sp->lcp.magic >> 8; 2715 opt[i++] = sp->lcp.magic; 2716 } 2717 2718 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2719 opt[i++] = LCP_OPT_MRU; 2720 opt[i++] = 4; 2721 opt[i++] = sp->lcp.mru >> 8; 2722 opt[i++] = sp->lcp.mru; 2723 } 2724 2725 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2726 authproto = sp->hisauth.proto; 2727 opt[i++] = LCP_OPT_AUTH_PROTO; 2728 opt[i++] = authproto == PPP_CHAP? 5: 4; 2729 opt[i++] = authproto >> 8; 2730 opt[i++] = authproto; 2731 if (authproto == PPP_CHAP) 2732 opt[i++] = CHAP_MD5; 2733 } 2734 2735 sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP]; 2736 sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt); 2737} 2738 2739/* 2740 * Check the open NCPs, return true if at least one NCP is open. 2741 */ 2742static int 2743sppp_ncp_check(struct sppp *sp) 2744{ 2745 int i, mask; 2746 2747 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2748 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP) 2749 return 1; 2750 return 0; 2751} 2752 2753/* 2754 * Re-check the open NCPs and see if we should terminate the link. 2755 * Called by the NCPs during their tlf action handling. 2756 */ 2757static void 2758sppp_lcp_check_and_close(struct sppp *sp) 2759{ 2760 2761 if (sp->pp_phase < PHASE_NETWORK) 2762 /* don't bother, we are already going down */ 2763 return; 2764 2765 if (sppp_ncp_check(sp)) 2766 return; 2767 2768 lcp.Close(sp); 2769} 2770 2771/* 2772 *--------------------------------------------------------------------------* 2773 * * 2774 * The IPCP implementation. * 2775 * * 2776 *--------------------------------------------------------------------------* 2777 */ 2778 2779static void 2780sppp_ipcp_init(struct sppp *sp) 2781{ 2782 sp->ipcp.opts = 0; 2783 sp->ipcp.flags = 0; 2784 sp->state[IDX_IPCP] = STATE_INITIAL; 2785 sp->fail_counter[IDX_IPCP] = 0; 2786 sp->pp_seq[IDX_IPCP] = 0; 2787 sp->pp_rseq[IDX_IPCP] = 0; 2788#if defined(__FreeBSD__) && __FreeBSD__ >= 3 2789 callout_handle_init(&sp->ch[IDX_IPCP]); 2790#endif 2791} 2792 2793static void 2794sppp_ipcp_up(struct sppp *sp) 2795{ 2796 sppp_up_event(&ipcp, sp); 2797} 2798 2799static void 2800sppp_ipcp_down(struct sppp *sp) 2801{ 2802 sppp_down_event(&ipcp, sp); 2803} 2804 2805static void 2806sppp_ipcp_open(struct sppp *sp) 2807{ 2808 STDDCL; 2809 u_long myaddr, hisaddr; 2810 2811 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN | IPCP_MYADDR_SEEN | 2812 IPCP_MYADDR_DYN | IPCP_VJ); 2813 sp->ipcp.opts = 0; 2814 2815 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 2816 /* 2817 * If we don't have his address, this probably means our 2818 * interface doesn't want to talk IP at all. (This could 2819 * be the case if somebody wants to speak only IPX, for 2820 * example.) Don't open IPCP in this case. 2821 */ 2822 if (hisaddr == 0L) { 2823 /* XXX this message should go away */ 2824 if (debug) 2825 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 2826 SPP_ARGS(ifp)); 2827 return; 2828 } 2829 if (myaddr == 0L) { 2830 /* 2831 * I don't have an assigned address, so i need to 2832 * negotiate my address. 2833 */ 2834 sp->ipcp.flags |= IPCP_MYADDR_DYN; 2835 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2836 } else 2837 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 2838 if (sp->enable_vj) { 2839 sp->ipcp.opts |= (1 << IPCP_OPT_COMPRESSION); 2840 sp->ipcp.max_state = MAX_STATES - 1; 2841 sp->ipcp.compress_cid = 1; 2842 } 2843 sppp_open_event(&ipcp, sp); 2844} 2845 2846static void 2847sppp_ipcp_close(struct sppp *sp) 2848{ 2849 sppp_close_event(&ipcp, sp); 2850 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 2851 /* 2852 * My address was dynamic, clear it again. 2853 */ 2854 sppp_set_ip_addr(sp, 0L); 2855} 2856 2857static void 2858sppp_ipcp_TO(void *cookie) 2859{ 2860 sppp_to_event(&ipcp, (struct sppp *)cookie); 2861} 2862 2863/* 2864 * Analyze a configure request. Return true if it was agreeable, and 2865 * caused action sca, false if it has been rejected or nak'ed, and 2866 * caused action scn. (The return value is used to make the state 2867 * transition decision in the state automaton.) 2868 */ 2869static int 2870sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2871{ 2872 u_char *buf, *r, *p; 2873 struct ifnet *ifp = &sp->pp_if; 2874 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2875 u_long hisaddr, desiredaddr; 2876 int gotmyaddr = 0; 2877 int desiredcomp; 2878 2879 len -= 4; 2880 origlen = len; 2881 /* 2882 * Make sure to allocate a buf that can at least hold a 2883 * conf-nak with an `address' option. We might need it below. 2884 */ 2885 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2886 if (! buf) 2887 return (0); 2888 2889 /* pass 1: see if we can recognize them */ 2890 if (debug) 2891 log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ", 2892 SPP_ARGS(ifp)); 2893 p = (void*) (h+1); 2894 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2895 if (debug) 2896 log(-1, " %s ", sppp_ipcp_opt_name(*p)); 2897 switch (*p) { 2898 case IPCP_OPT_COMPRESSION: 2899 if (!sp->enable_vj) { 2900 /* VJ compression administratively disabled */ 2901 if (debug) 2902 log(-1, "[locally disabled] "); 2903 break; 2904 } 2905 /* 2906 * In theory, we should only conf-rej an 2907 * option that is shorter than RFC 1618 2908 * requires (i.e. < 4), and should conf-nak 2909 * anything else that is not VJ. However, 2910 * since our algorithm always uses the 2911 * original option to NAK it with new values, 2912 * things would become more complicated. In 2913 * pratice, the only commonly implemented IP 2914 * compression option is VJ anyway, so the 2915 * difference is negligible. 2916 */ 2917 if (len >= 6 && p[1] == 6) { 2918 /* 2919 * correctly formed compression option 2920 * that could be VJ compression 2921 */ 2922 continue; 2923 } 2924 if (debug) 2925 log(-1, 2926 "optlen %d [invalid/unsupported] ", 2927 p[1]); 2928 break; 2929 case IPCP_OPT_ADDRESS: 2930 if (len >= 6 && p[1] == 6) { 2931 /* correctly formed address option */ 2932 continue; 2933 } 2934 if (debug) 2935 log(-1, "[invalid] "); 2936 break; 2937 default: 2938 /* Others not supported. */ 2939 if (debug) 2940 log(-1, "[rej] "); 2941 break; 2942 } 2943 /* Add the option to rejected list. */ 2944 bcopy (p, r, p[1]); 2945 r += p[1]; 2946 rlen += p[1]; 2947 } 2948 if (rlen) { 2949 if (debug) 2950 log(-1, " send conf-rej\n"); 2951 sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2952 return 0; 2953 } else if (debug) 2954 log(-1, "\n"); 2955 2956 /* pass 2: parse option values */ 2957 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); 2958 if (debug) 2959 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2960 SPP_ARGS(ifp)); 2961 p = (void*) (h+1); 2962 len = origlen; 2963 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2964 if (debug) 2965 log(-1, " %s ", sppp_ipcp_opt_name(*p)); 2966 switch (*p) { 2967 case IPCP_OPT_COMPRESSION: 2968 desiredcomp = p[2] << 8 | p[3]; 2969 /* We only support VJ */ 2970 if (desiredcomp == IPCP_COMP_VJ) { 2971 if (debug) 2972 log(-1, "VJ [ack] "); 2973 sp->ipcp.flags |= IPCP_VJ; 2974 sl_compress_init(sp->pp_comp, p[4]); 2975 sp->ipcp.max_state = p[4]; 2976 sp->ipcp.compress_cid = p[5]; 2977 continue; 2978 } 2979 if (debug) 2980 log(-1, 2981 "compproto %#04x [not supported] ", 2982 desiredcomp); 2983 p[2] = IPCP_COMP_VJ >> 8; 2984 p[3] = IPCP_COMP_VJ; 2985 p[4] = sp->ipcp.max_state; 2986 p[5] = sp->ipcp.compress_cid; 2987 break; 2988 case IPCP_OPT_ADDRESS: 2989 /* This is the address he wants in his end */ 2990 desiredaddr = p[2] << 24 | p[3] << 16 | 2991 p[4] << 8 | p[5]; 2992 if (desiredaddr == hisaddr || 2993 (hisaddr >= 1 && hisaddr <= 254 && desiredaddr != 0)) { 2994 /* 2995 * Peer's address is same as our value, 2996 * or we have set it to 0.0.0.* to 2997 * indicate that we do not really care, 2998 * this is agreeable. Gonna conf-ack 2999 * it. 3000 */ 3001 if (debug) 3002 log(-1, "%s [ack] ", 3003 sppp_dotted_quad(hisaddr)); 3004 /* record that we've seen it already */ 3005 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 3006 continue; 3007 } 3008 /* 3009 * The address wasn't agreeable. This is either 3010 * he sent us 0.0.0.0, asking to assign him an 3011 * address, or he send us another address not 3012 * matching our value. Either case, we gonna 3013 * conf-nak it with our value. 3014 * XXX: we should "rej" if hisaddr == 0 3015 */ 3016 if (debug) { 3017 if (desiredaddr == 0) 3018 log(-1, "[addr requested] "); 3019 else 3020 log(-1, "%s [not agreed] ", 3021 sppp_dotted_quad(desiredaddr)); 3022 3023 } 3024 p[2] = hisaddr >> 24; 3025 p[3] = hisaddr >> 16; 3026 p[4] = hisaddr >> 8; 3027 p[5] = hisaddr; 3028 break; 3029 } 3030 /* Add the option to nak'ed list. */ 3031 bcopy (p, r, p[1]); 3032 r += p[1]; 3033 rlen += p[1]; 3034 } 3035 3036 /* 3037 * If we are about to conf-ack the request, but haven't seen 3038 * his address so far, gonna conf-nak it instead, with the 3039 * `address' option present and our idea of his address being 3040 * filled in there, to request negotiation of both addresses. 3041 * 3042 * XXX This can result in an endless req - nak loop if peer 3043 * doesn't want to send us his address. Q: What should we do 3044 * about it? XXX A: implement the max-failure counter. 3045 */ 3046 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN) && !gotmyaddr) { 3047 buf[0] = IPCP_OPT_ADDRESS; 3048 buf[1] = 6; 3049 buf[2] = hisaddr >> 24; 3050 buf[3] = hisaddr >> 16; 3051 buf[4] = hisaddr >> 8; 3052 buf[5] = hisaddr; 3053 rlen = 6; 3054 if (debug) 3055 log(-1, "still need hisaddr "); 3056 } 3057 3058 if (rlen) { 3059 if (debug) 3060 log(-1, " send conf-nak\n"); 3061 sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 3062 } else { 3063 if (debug) 3064 log(-1, " send conf-ack\n"); 3065 sppp_cp_send (sp, PPP_IPCP, CONF_ACK, 3066 h->ident, origlen, h+1); 3067 } 3068 3069 free (buf, M_TEMP); 3070 return (rlen == 0); 3071} 3072 3073/* 3074 * Analyze the IPCP Configure-Reject option list, and adjust our 3075 * negotiation. 3076 */ 3077static void 3078sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3079{ 3080 u_char *buf, *p; 3081 struct ifnet *ifp = &sp->pp_if; 3082 int debug = ifp->if_flags & IFF_DEBUG; 3083 3084 len -= 4; 3085 buf = malloc (len, M_TEMP, M_NOWAIT); 3086 if (!buf) 3087 return; 3088 3089 if (debug) 3090 log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ", 3091 SPP_ARGS(ifp)); 3092 3093 p = (void*) (h+1); 3094 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3095 if (debug) 3096 log(-1, " %s ", sppp_ipcp_opt_name(*p)); 3097 switch (*p) { 3098 case IPCP_OPT_COMPRESSION: 3099 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESSION); 3100 break; 3101 case IPCP_OPT_ADDRESS: 3102 /* 3103 * Peer doesn't grok address option. This is 3104 * bad. XXX Should we better give up here? 3105 * XXX We could try old "addresses" option... 3106 */ 3107 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 3108 break; 3109 } 3110 } 3111 if (debug) 3112 log(-1, "\n"); 3113 free (buf, M_TEMP); 3114 return; 3115} 3116 3117/* 3118 * Analyze the IPCP Configure-NAK option list, and adjust our 3119 * negotiation. 3120 */ 3121static void 3122sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3123{ 3124 u_char *buf, *p; 3125 struct ifnet *ifp = &sp->pp_if; 3126 int debug = ifp->if_flags & IFF_DEBUG; 3127 int desiredcomp; 3128 u_long wantaddr; 3129 3130 len -= 4; 3131 buf = malloc (len, M_TEMP, M_NOWAIT); 3132 if (!buf) 3133 return; 3134 3135 if (debug) 3136 log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ", 3137 SPP_ARGS(ifp)); 3138 3139 p = (void*) (h+1); 3140 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3141 if (debug) 3142 log(-1, " %s ", sppp_ipcp_opt_name(*p)); 3143 switch (*p) { 3144 case IPCP_OPT_COMPRESSION: 3145 if (len >= 6 && p[1] == 6) { 3146 desiredcomp = p[2] << 8 | p[3]; 3147 if (debug) 3148 log(-1, "[wantcomp %#04x] ", 3149 desiredcomp); 3150 if (desiredcomp == IPCP_COMP_VJ) { 3151 sl_compress_init(sp->pp_comp, p[4]); 3152 sp->ipcp.max_state = p[4]; 3153 sp->ipcp.compress_cid = p[5]; 3154 if (debug) 3155 log(-1, "[agree] "); 3156 } else 3157 sp->ipcp.opts &= 3158 ~(1 << IPCP_OPT_COMPRESSION); 3159 } 3160 break; 3161 case IPCP_OPT_ADDRESS: 3162 /* 3163 * Peer doesn't like our local IP address. See 3164 * if we can do something for him. We'll drop 3165 * him our address then. 3166 */ 3167 if (len >= 6 && p[1] == 6) { 3168 wantaddr = p[2] << 24 | p[3] << 16 | 3169 p[4] << 8 | p[5]; 3170 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3171 if (debug) 3172 log(-1, "[wantaddr %s] ", 3173 sppp_dotted_quad(wantaddr)); 3174 /* 3175 * When doing dynamic address assignment, 3176 * we accept his offer. Otherwise, we 3177 * ignore it and thus continue to negotiate 3178 * our already existing value. 3179 * XXX: Bogus, if he said no once, he'll 3180 * just say no again, might as well die. 3181 */ 3182 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3183 sppp_set_ip_addr(sp, wantaddr); 3184 if (debug) 3185 log(-1, "[agree] "); 3186 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3187 } 3188 } 3189 break; 3190 } 3191 } 3192 if (debug) 3193 log(-1, "\n"); 3194 free (buf, M_TEMP); 3195 return; 3196} 3197 3198static void 3199sppp_ipcp_tlu(struct sppp *sp) 3200{ 3201 /* we are up - notify isdn daemon */ 3202 if (sp->pp_con) 3203 sp->pp_con(sp); 3204} 3205 3206static void 3207sppp_ipcp_tld(struct sppp *sp) 3208{ 3209} 3210 3211static void 3212sppp_ipcp_tls(struct sppp *sp) 3213{ 3214 /* indicate to LCP that it must stay alive */ 3215 sp->lcp.protos |= (1 << IDX_IPCP); 3216} 3217 3218static void 3219sppp_ipcp_tlf(struct sppp *sp) 3220{ 3221 /* we no longer need LCP */ 3222 sp->lcp.protos &= ~(1 << IDX_IPCP); 3223 sppp_lcp_check_and_close(sp); 3224} 3225 3226static void 3227sppp_ipcp_scr(struct sppp *sp) 3228{ 3229 char opt[6 /* compression */ + 6 /* address */]; 3230 u_long ouraddr; 3231 int i = 0; 3232 3233 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3234 opt[i++] = IPCP_OPT_COMPRESSION; 3235 opt[i++] = 6; 3236 opt[i++] = IPCP_COMP_VJ >> 8; 3237 opt[i++] = IPCP_COMP_VJ; 3238 opt[i++] = sp->ipcp.max_state; 3239 opt[i++] = sp->ipcp.compress_cid; 3240 } 3241 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3242 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3243 opt[i++] = IPCP_OPT_ADDRESS; 3244 opt[i++] = 6; 3245 opt[i++] = ouraddr >> 24; 3246 opt[i++] = ouraddr >> 16; 3247 opt[i++] = ouraddr >> 8; 3248 opt[i++] = ouraddr; 3249 } 3250 3251 sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP]; 3252 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt); 3253} 3254 3255/* 3256 *--------------------------------------------------------------------------* 3257 * * 3258 * The IPv6CP implementation. * 3259 * * 3260 *--------------------------------------------------------------------------* 3261 */ 3262 3263#ifdef INET6 3264static void 3265sppp_ipv6cp_init(struct sppp *sp) 3266{ 3267 sp->ipv6cp.opts = 0; 3268 sp->ipv6cp.flags = 0; 3269 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3270 sp->fail_counter[IDX_IPV6CP] = 0; 3271 sp->pp_seq[IDX_IPV6CP] = 0; 3272 sp->pp_rseq[IDX_IPV6CP] = 0; 3273#if defined(__NetBSD__) 3274 callout_init(&sp->ch[IDX_IPV6CP]); 3275#endif 3276#if defined(__FreeBSD__) && __FreeBSD__ >= 3 3277 callout_handle_init(&sp->ch[IDX_IPV6CP]); 3278#endif 3279} 3280 3281static void 3282sppp_ipv6cp_up(struct sppp *sp) 3283{ 3284 sppp_up_event(&ipv6cp, sp); 3285} 3286 3287static void 3288sppp_ipv6cp_down(struct sppp *sp) 3289{ 3290 sppp_down_event(&ipv6cp, sp); 3291} 3292 3293static void 3294sppp_ipv6cp_open(struct sppp *sp) 3295{ 3296 STDDCL; 3297 struct in6_addr myaddr, hisaddr; 3298 3299#ifdef IPV6CP_MYIFID_DYN 3300 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3301#else 3302 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3303#endif 3304 3305 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3306 /* 3307 * If we don't have our address, this probably means our 3308 * interface doesn't want to talk IPv6 at all. (This could 3309 * be the case if somebody wants to speak only IPX, for 3310 * example.) Don't open IPv6CP in this case. 3311 */ 3312 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3313 /* XXX this message should go away */ 3314 if (debug) 3315 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3316 SPP_ARGS(ifp)); 3317 return; 3318 } 3319 3320 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3321 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3322 sppp_open_event(&ipv6cp, sp); 3323} 3324 3325static void 3326sppp_ipv6cp_close(struct sppp *sp) 3327{ 3328 sppp_close_event(&ipv6cp, sp); 3329} 3330 3331static void 3332sppp_ipv6cp_TO(void *cookie) 3333{ 3334 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3335} 3336 3337/* 3338 * Analyze a configure request. Return true if it was agreeable, and 3339 * caused action sca, false if it has been rejected or nak'ed, and 3340 * caused action scn. (The return value is used to make the state 3341 * transition decision in the state automaton.) 3342 */ 3343static int 3344sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3345{ 3346 u_char *buf, *r, *p; 3347 struct ifnet *ifp = &sp->pp_if; 3348 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3349 struct in6_addr myaddr, desiredaddr, suggestaddr; 3350 int ifidcount; 3351 int type; 3352 int collision, nohisaddr; 3353 3354 len -= 4; 3355 origlen = len; 3356 /* 3357 * Make sure to allocate a buf that can at least hold a 3358 * conf-nak with an `address' option. We might need it below. 3359 */ 3360 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3361 if (! buf) 3362 return (0); 3363 3364 /* pass 1: see if we can recognize them */ 3365 if (debug) 3366 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:", 3367 SPP_ARGS(ifp)); 3368 p = (void*) (h+1); 3369 ifidcount = 0; 3370 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3371 if (debug) 3372 log(-1, " %s", sppp_ipv6cp_opt_name(*p)); 3373 switch (*p) { 3374 case IPV6CP_OPT_IFID: 3375 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3376 /* correctly formed address option */ 3377 ifidcount++; 3378 continue; 3379 } 3380 if (debug) 3381 log(-1, " [invalid]"); 3382 break; 3383#ifdef notyet 3384 case IPV6CP_OPT_COMPRESSION: 3385 if (len >= 4 && p[1] >= 4) { 3386 /* correctly formed compress option */ 3387 continue; 3388 } 3389 if (debug) 3390 log(-1, " [invalid]"); 3391 break; 3392#endif 3393 default: 3394 /* Others not supported. */ 3395 if (debug) 3396 log(-1, " [rej]"); 3397 break; 3398 } 3399 /* Add the option to rejected list. */ 3400 bcopy (p, r, p[1]); 3401 r += p[1]; 3402 rlen += p[1]; 3403 } 3404 if (rlen) { 3405 if (debug) 3406 log(-1, " send conf-rej\n"); 3407 sppp_cp_send (sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3408 goto end; 3409 } else if (debug) 3410 log(-1, "\n"); 3411 3412 /* pass 2: parse option values */ 3413 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3414 if (debug) 3415 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ", 3416 SPP_ARGS(ifp)); 3417 p = (void*) (h+1); 3418 len = origlen; 3419 type = CONF_ACK; 3420 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3421 if (debug) 3422 log(-1, " %s", sppp_ipv6cp_opt_name(*p)); 3423 switch (*p) { 3424#ifdef notyet 3425 case IPV6CP_OPT_COMPRESSION: 3426 continue; 3427#endif 3428 case IPV6CP_OPT_IFID: 3429 bzero(&desiredaddr, sizeof(desiredaddr)); 3430 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3431 collision = (bcmp(&desiredaddr.s6_addr[8], 3432 &myaddr.s6_addr[8], 8) == 0); 3433 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3434 3435 desiredaddr.s6_addr16[0] = htons(0xfe80); 3436 desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3437 3438 if (!collision && !nohisaddr) { 3439 /* no collision, hisaddr known - Conf-Ack */ 3440 type = CONF_ACK; 3441 3442 if (debug) { 3443 log(-1, " %s [%s]", 3444 ip6_sprintf(&desiredaddr), 3445 sppp_cp_type_name(type)); 3446 } 3447 continue; 3448 } 3449 3450 bzero(&suggestaddr, sizeof(&suggestaddr)); 3451 if (collision && nohisaddr) { 3452 /* collision, hisaddr unknown - Conf-Rej */ 3453 type = CONF_REJ; 3454 bzero(&p[2], 8); 3455 } else { 3456 /* 3457 * - no collision, hisaddr unknown, or 3458 * - collision, hisaddr known 3459 * Conf-Nak, suggest hisaddr 3460 */ 3461 type = CONF_NAK; 3462 sppp_suggest_ip6_addr(sp, &suggestaddr); 3463 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3464 } 3465 if (debug) 3466 log(-1, " %s [%s]", ip6_sprintf(&desiredaddr), 3467 sppp_cp_type_name(type)); 3468 break; 3469 } 3470 /* Add the option to nak'ed list. */ 3471 bcopy (p, r, p[1]); 3472 r += p[1]; 3473 rlen += p[1]; 3474 } 3475 3476 if (rlen == 0 && type == CONF_ACK) { 3477 if (debug) 3478 log(-1, " send %s\n", sppp_cp_type_name(type)); 3479 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, origlen, h+1); 3480 } else { 3481#ifdef DIAGNOSTIC 3482 if (type == CONF_ACK) 3483 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3484#endif 3485 3486 if (debug) { 3487 log(-1, " send %s suggest %s\n", 3488 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3489 } 3490 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3491 } 3492 3493 end: 3494 free (buf, M_TEMP); 3495 return (rlen == 0); 3496} 3497 3498/* 3499 * Analyze the IPv6CP Configure-Reject option list, and adjust our 3500 * negotiation. 3501 */ 3502static void 3503sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3504{ 3505 u_char *buf, *p; 3506 struct ifnet *ifp = &sp->pp_if; 3507 int debug = ifp->if_flags & IFF_DEBUG; 3508 3509 len -= 4; 3510 buf = malloc (len, M_TEMP, M_NOWAIT); 3511 if (!buf) 3512 return; 3513 3514 if (debug) 3515 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:", 3516 SPP_ARGS(ifp)); 3517 3518 p = (void*) (h+1); 3519 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3520 if (debug) 3521 log(-1, " %s", sppp_ipv6cp_opt_name(*p)); 3522 switch (*p) { 3523 case IPV6CP_OPT_IFID: 3524 /* 3525 * Peer doesn't grok address option. This is 3526 * bad. XXX Should we better give up here? 3527 */ 3528 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3529 break; 3530#ifdef notyet 3531 case IPV6CP_OPT_COMPRESS: 3532 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3533 break; 3534#endif 3535 } 3536 } 3537 if (debug) 3538 log(-1, "\n"); 3539 free (buf, M_TEMP); 3540 return; 3541} 3542 3543/* 3544 * Analyze the IPv6CP Configure-NAK option list, and adjust our 3545 * negotiation. 3546 */ 3547static void 3548sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3549{ 3550 u_char *buf, *p; 3551 struct ifnet *ifp = &sp->pp_if; 3552 int debug = ifp->if_flags & IFF_DEBUG; 3553 struct in6_addr suggestaddr; 3554 3555 len -= 4; 3556 buf = malloc (len, M_TEMP, M_NOWAIT); 3557 if (!buf) 3558 return; 3559 3560 if (debug) 3561 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:", 3562 SPP_ARGS(ifp)); 3563 3564 p = (void*) (h+1); 3565 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3566 if (debug) 3567 log(-1, " %s", sppp_ipv6cp_opt_name(*p)); 3568 switch (*p) { 3569 case IPV6CP_OPT_IFID: 3570 /* 3571 * Peer doesn't like our local ifid. See 3572 * if we can do something for him. We'll drop 3573 * him our address then. 3574 */ 3575 if (len < 10 || p[1] != 10) 3576 break; 3577 bzero(&suggestaddr, sizeof(suggestaddr)); 3578 suggestaddr.s6_addr16[0] = htons(0xfe80); 3579 suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index); 3580 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3581 3582 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3583 if (debug) 3584 log(-1, " [suggestaddr %s]", 3585 ip6_sprintf(&suggestaddr)); 3586#ifdef IPV6CP_MYIFID_DYN 3587 /* 3588 * When doing dynamic address assignment, 3589 * we accept his offer. 3590 */ 3591 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3592 struct in6_addr lastsuggest; 3593 /* 3594 * If <suggested myaddr from peer> equals to 3595 * <hisaddr we have suggested last time>, 3596 * we have a collision. generate new random 3597 * ifid. 3598 */ 3599 sppp_suggest_ip6_addr(&lastsuggest); 3600 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3601 lastsuggest)) { 3602 if (debug) 3603 log(-1, " [random]"); 3604 sppp_gen_ip6_addr(sp, &suggestaddr); 3605 } 3606 sppp_set_ip6_addr(sp, &suggestaddr, 0); 3607 if (debug) 3608 log(-1, " [agree]"); 3609 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3610 } 3611#else 3612 /* 3613 * Since we do not do dynamic address assignment, 3614 * we ignore it and thus continue to negotiate 3615 * our already existing value. This can possibly 3616 * go into infinite request-reject loop. 3617 * 3618 * This is not likely because we normally use 3619 * ifid based on MAC-address. 3620 * If you have no ethernet card on the node, too bad. 3621 * XXX should we use fail_counter? 3622 */ 3623#endif 3624 break; 3625#ifdef notyet 3626 case IPV6CP_OPT_COMPRESS: 3627 /* 3628 * Peer wants different compression parameters. 3629 */ 3630 break; 3631#endif 3632 } 3633 } 3634 if (debug) 3635 log(-1, "\n"); 3636 free (buf, M_TEMP); 3637 return; 3638} 3639static void 3640sppp_ipv6cp_tlu(struct sppp *sp) 3641{ 3642 /* we are up - notify isdn daemon */ 3643 if (sp->pp_con) 3644 sp->pp_con(sp); 3645} 3646 3647static void 3648sppp_ipv6cp_tld(struct sppp *sp) 3649{ 3650} 3651 3652static void 3653sppp_ipv6cp_tls(struct sppp *sp) 3654{ 3655 /* indicate to LCP that it must stay alive */ 3656 sp->lcp.protos |= (1 << IDX_IPV6CP); 3657} 3658 3659static void 3660sppp_ipv6cp_tlf(struct sppp *sp) 3661{ 3662 3663#if 0 /* need #if 0 to close IPv6CP properly */ 3664 /* we no longer need LCP */ 3665 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3666 sppp_lcp_check_and_close(sp); 3667#endif 3668} 3669 3670static void 3671sppp_ipv6cp_scr(struct sppp *sp) 3672{ 3673 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3674 struct in6_addr ouraddr; 3675 int i = 0; 3676 3677 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3678 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3679 opt[i++] = IPV6CP_OPT_IFID; 3680 opt[i++] = 10; 3681 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3682 i += 8; 3683 } 3684 3685#ifdef notyet 3686 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3687 opt[i++] = IPV6CP_OPT_COMPRESSION; 3688 opt[i++] = 4; 3689 opt[i++] = 0; /* TBD */ 3690 opt[i++] = 0; /* TBD */ 3691 /* variable length data may follow */ 3692 } 3693#endif 3694 3695 sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP]; 3696 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt); 3697} 3698#else /*INET6*/ 3699static void sppp_ipv6cp_init(struct sppp *sp) 3700{ 3701} 3702 3703static void sppp_ipv6cp_up(struct sppp *sp) 3704{ 3705} 3706 3707static void sppp_ipv6cp_down(struct sppp *sp) 3708{ 3709} 3710 3711 3712static void sppp_ipv6cp_open(struct sppp *sp) 3713{ 3714} 3715 3716static void sppp_ipv6cp_close(struct sppp *sp) 3717{ 3718} 3719 3720static void sppp_ipv6cp_TO(void *sp) 3721{ 3722} 3723 3724static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3725{ 3726 return 0; 3727} 3728 3729static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3730{ 3731} 3732 3733static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3734{ 3735} 3736 3737static void sppp_ipv6cp_tlu(struct sppp *sp) 3738{ 3739} 3740 3741static void sppp_ipv6cp_tld(struct sppp *sp) 3742{ 3743} 3744 3745static void sppp_ipv6cp_tls(struct sppp *sp) 3746{ 3747} 3748 3749static void sppp_ipv6cp_tlf(struct sppp *sp) 3750{ 3751} 3752 3753static void sppp_ipv6cp_scr(struct sppp *sp) 3754{ 3755} 3756#endif /*INET6*/ 3757 3758/* 3759 *--------------------------------------------------------------------------* 3760 * * 3761 * The CHAP implementation. * 3762 * * 3763 *--------------------------------------------------------------------------* 3764 */ 3765 3766/* 3767 * The authentication protocols don't employ a full-fledged state machine as 3768 * the control protocols do, since they do have Open and Close events, but 3769 * not Up and Down, nor are they explicitly terminated. Also, use of the 3770 * authentication protocols may be different in both directions (this makes 3771 * sense, think of a machine that never accepts incoming calls but only 3772 * calls out, it doesn't require the called party to authenticate itself). 3773 * 3774 * Our state machine for the local authentication protocol (we are requesting 3775 * the peer to authenticate) looks like: 3776 * 3777 * RCA- 3778 * +--------------------------------------------+ 3779 * V scn,tld| 3780 * +--------+ Close +---------+ RCA+ 3781 * | |<----------------------------------| |------+ 3782 * +--->| Closed | TO* | Opened | sca | 3783 * | | |-----+ +-------| |<-----+ 3784 * | +--------+ irc | | +---------+ 3785 * | ^ | | ^ 3786 * | | | | | 3787 * | | | | | 3788 * | TO-| | | | 3789 * | |tld TO+ V | | 3790 * | | +------->+ | | 3791 * | | | | | | 3792 * | +--------+ V | | 3793 * | | |<----+<--------------------+ | 3794 * | | Req- | scr | 3795 * | | Sent | | 3796 * | | | | 3797 * | +--------+ | 3798 * | RCA- | | RCA+ | 3799 * +------+ +------------------------------------------+ 3800 * scn,tld sca,irc,ict,tlu 3801 * 3802 * 3803 * with: 3804 * 3805 * Open: LCP reached authentication phase 3806 * Close: LCP reached terminate phase 3807 * 3808 * RCA+: received reply (pap-req, chap-response), acceptable 3809 * RCN: received reply (pap-req, chap-response), not acceptable 3810 * TO+: timeout with restart counter >= 0 3811 * TO-: timeout with restart counter < 0 3812 * TO*: reschedule timeout for CHAP 3813 * 3814 * scr: send request packet (none for PAP, chap-challenge) 3815 * sca: send ack packet (pap-ack, chap-success) 3816 * scn: send nak packet (pap-nak, chap-failure) 3817 * ict: initialize re-challenge timer (CHAP only) 3818 * 3819 * tlu: this-layer-up, LCP reaches network phase 3820 * tld: this-layer-down, LCP enters terminate phase 3821 * 3822 * Note that in CHAP mode, after sending a new challenge, while the state 3823 * automaton falls back into Req-Sent state, it doesn't signal a tld 3824 * event to LCP, so LCP remains in network phase. Only after not getting 3825 * any response (or after getting an unacceptable response), CHAP closes, 3826 * causing LCP to enter terminate phase. 3827 * 3828 * With PAP, there is no initial request that can be sent. The peer is 3829 * expected to send one based on the successful negotiation of PAP as 3830 * the authentication protocol during the LCP option negotiation. 3831 * 3832 * Incoming authentication protocol requests (remote requests 3833 * authentication, we are peer) don't employ a state machine at all, 3834 * they are simply answered. Some peers [Ascend P50 firmware rev 3835 * 4.50] react allergically when sending IPCP requests while they are 3836 * still in authentication phase (thereby violating the standard that 3837 * demands that these NCP packets are to be discarded), so we keep 3838 * track of the peer demanding us to authenticate, and only proceed to 3839 * phase network once we've seen a positive acknowledge for the 3840 * authentication. 3841 */ 3842 3843/* 3844 * Handle incoming CHAP packets. 3845 */ 3846void 3847sppp_chap_input(struct sppp *sp, struct mbuf *m) 3848{ 3849 STDDCL; 3850 struct lcp_header *h; 3851 int len, x; 3852 u_char *value, *name, digest[AUTHKEYLEN], dsize; 3853 int value_len, name_len; 3854 MD5_CTX ctx; 3855 3856 len = m->m_pkthdr.len; 3857 if (len < 4) { 3858 if (debug) 3859 log(LOG_DEBUG, 3860 SPP_FMT "chap invalid packet length: %d bytes\n", 3861 SPP_ARGS(ifp), len); 3862 return; 3863 } 3864 h = mtod (m, struct lcp_header*); 3865 if (len > ntohs (h->len)) 3866 len = ntohs (h->len); 3867 3868 switch (h->type) { 3869 /* challenge, failure and success are his authproto */ 3870 case CHAP_CHALLENGE: 3871 value = 1 + (u_char*)(h+1); 3872 value_len = value[-1]; 3873 name = value + value_len; 3874 name_len = len - value_len - 5; 3875 if (name_len < 0) { 3876 if (debug) { 3877 log(LOG_DEBUG, 3878 SPP_FMT "chap corrupted challenge " 3879 "<%s id=0x%x len=%d", 3880 SPP_ARGS(ifp), 3881 sppp_auth_type_name(PPP_CHAP, h->type), 3882 h->ident, ntohs(h->len)); 3883 sppp_print_bytes((u_char*) (h+1), len-4); 3884 log(-1, ">\n"); 3885 } 3886 break; 3887 } 3888 3889 if (debug) { 3890 log(LOG_DEBUG, 3891 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3892 SPP_ARGS(ifp), 3893 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3894 ntohs(h->len)); 3895 sppp_print_string((char*) name, name_len); 3896 log(-1, " value-size=%d value=", value_len); 3897 sppp_print_bytes(value, value_len); 3898 log(-1, ">\n"); 3899 } 3900 3901 /* Compute reply value. */ 3902 MD5Init(&ctx); 3903 MD5Update(&ctx, &h->ident, 1); 3904 MD5Update(&ctx, sp->myauth.secret, 3905 sppp_strnlen(sp->myauth.secret, AUTHKEYLEN)); 3906 MD5Update(&ctx, value, value_len); 3907 MD5Final(digest, &ctx); 3908 dsize = sizeof digest; 3909 3910 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3911 sizeof dsize, (const char *)&dsize, 3912 sizeof digest, digest, 3913 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN), 3914 sp->myauth.name, 3915 0); 3916 break; 3917 3918 case CHAP_SUCCESS: 3919 if (debug) { 3920 log(LOG_DEBUG, SPP_FMT "chap success", 3921 SPP_ARGS(ifp)); 3922 if (len > 4) { 3923 log(-1, ": "); 3924 sppp_print_string((char*)(h + 1), len - 4); 3925 } 3926 log(-1, "\n"); 3927 } 3928 x = splimp(); 3929 sp->pp_flags &= ~PP_NEEDAUTH; 3930 if (sp->myauth.proto == PPP_CHAP && 3931 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3932 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3933 /* 3934 * We are authenticator for CHAP but didn't 3935 * complete yet. Leave it to tlu to proceed 3936 * to network phase. 3937 */ 3938 splx(x); 3939 break; 3940 } 3941 splx(x); 3942 sppp_phase_network(sp); 3943 break; 3944 3945 case CHAP_FAILURE: 3946 if (debug) { 3947 log(LOG_INFO, SPP_FMT "chap failure", 3948 SPP_ARGS(ifp)); 3949 if (len > 4) { 3950 log(-1, ": "); 3951 sppp_print_string((char*)(h + 1), len - 4); 3952 } 3953 log(-1, "\n"); 3954 } else 3955 log(LOG_INFO, SPP_FMT "chap failure\n", 3956 SPP_ARGS(ifp)); 3957 /* await LCP shutdown by authenticator */ 3958 break; 3959 3960 /* response is my authproto */ 3961 case CHAP_RESPONSE: 3962 value = 1 + (u_char*)(h+1); 3963 value_len = value[-1]; 3964 name = value + value_len; 3965 name_len = len - value_len - 5; 3966 if (name_len < 0) { 3967 if (debug) { 3968 log(LOG_DEBUG, 3969 SPP_FMT "chap corrupted response " 3970 "<%s id=0x%x len=%d", 3971 SPP_ARGS(ifp), 3972 sppp_auth_type_name(PPP_CHAP, h->type), 3973 h->ident, ntohs(h->len)); 3974 sppp_print_bytes((u_char*)(h+1), len-4); 3975 log(-1, ">\n"); 3976 } 3977 break; 3978 } 3979 if (h->ident != sp->confid[IDX_CHAP]) { 3980 if (debug) 3981 log(LOG_DEBUG, 3982 SPP_FMT "chap dropping response for old ID " 3983 "(got %d, expected %d)\n", 3984 SPP_ARGS(ifp), 3985 h->ident, sp->confid[IDX_CHAP]); 3986 break; 3987 } 3988 if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN) 3989 || bcmp(name, sp->hisauth.name, name_len) != 0) { 3990 log(LOG_INFO, SPP_FMT "chap response, his name ", 3991 SPP_ARGS(ifp)); 3992 sppp_print_string(name, name_len); 3993 log(-1, " != expected "); 3994 sppp_print_string(sp->hisauth.name, 3995 sppp_strnlen(sp->hisauth.name, AUTHNAMELEN)); 3996 log(-1, "\n"); 3997 } 3998 if (debug) { 3999 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 4000 "<%s id=0x%x len=%d name=", 4001 SPP_ARGS(ifp), 4002 sppp_state_name(sp->state[IDX_CHAP]), 4003 sppp_auth_type_name(PPP_CHAP, h->type), 4004 h->ident, ntohs (h->len)); 4005 sppp_print_string((char*)name, name_len); 4006 log(-1, " value-size=%d value=", value_len); 4007 sppp_print_bytes(value, value_len); 4008 log(-1, ">\n"); 4009 } 4010 if (value_len != AUTHKEYLEN) { 4011 if (debug) 4012 log(LOG_DEBUG, 4013 SPP_FMT "chap bad hash value length: " 4014 "%d bytes, should be %d\n", 4015 SPP_ARGS(ifp), value_len, 4016 AUTHKEYLEN); 4017 break; 4018 } 4019 4020 MD5Init(&ctx); 4021 MD5Update(&ctx, &h->ident, 1); 4022 MD5Update(&ctx, sp->hisauth.secret, 4023 sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN)); 4024 MD5Update(&ctx, sp->myauth.challenge, AUTHKEYLEN); 4025 MD5Final(digest, &ctx); 4026 4027#define FAILMSG "Failed..." 4028#define SUCCMSG "Welcome!" 4029 4030 if (value_len != sizeof digest || 4031 bcmp(digest, value, value_len) != 0) { 4032 /* action scn, tld */ 4033 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 4034 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4035 0); 4036 chap.tld(sp); 4037 break; 4038 } 4039 /* action sca, perhaps tlu */ 4040 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 4041 sp->state[IDX_CHAP] == STATE_OPENED) 4042 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 4043 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4044 0); 4045 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 4046 sppp_cp_change_state(&chap, sp, STATE_OPENED); 4047 chap.tlu(sp); 4048 } 4049 break; 4050 4051 default: 4052 /* Unknown CHAP packet type -- ignore. */ 4053 if (debug) { 4054 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 4055 "<0x%x id=0x%xh len=%d", 4056 SPP_ARGS(ifp), 4057 sppp_state_name(sp->state[IDX_CHAP]), 4058 h->type, h->ident, ntohs(h->len)); 4059 sppp_print_bytes((u_char*)(h+1), len-4); 4060 log(-1, ">\n"); 4061 } 4062 break; 4063 4064 } 4065} 4066 4067static void 4068sppp_chap_init(struct sppp *sp) 4069{ 4070 /* Chap doesn't have STATE_INITIAL at all. */ 4071 sp->state[IDX_CHAP] = STATE_CLOSED; 4072 sp->fail_counter[IDX_CHAP] = 0; 4073 sp->pp_seq[IDX_CHAP] = 0; 4074 sp->pp_rseq[IDX_CHAP] = 0; 4075#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4076 callout_handle_init(&sp->ch[IDX_CHAP]); 4077#endif 4078} 4079 4080static void 4081sppp_chap_open(struct sppp *sp) 4082{ 4083 if (sp->myauth.proto == PPP_CHAP && 4084 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4085 /* we are authenticator for CHAP, start it */ 4086 chap.scr(sp); 4087 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4088 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4089 } 4090 /* nothing to be done if we are peer, await a challenge */ 4091} 4092 4093static void 4094sppp_chap_close(struct sppp *sp) 4095{ 4096 if (sp->state[IDX_CHAP] != STATE_CLOSED) 4097 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4098} 4099 4100static void 4101sppp_chap_TO(void *cookie) 4102{ 4103 struct sppp *sp = (struct sppp *)cookie; 4104 STDDCL; 4105 int s; 4106 4107 s = splimp(); 4108 if (debug) 4109 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 4110 SPP_ARGS(ifp), 4111 sppp_state_name(sp->state[IDX_CHAP]), 4112 sp->rst_counter[IDX_CHAP]); 4113 4114 if (--sp->rst_counter[IDX_CHAP] < 0) 4115 /* TO- event */ 4116 switch (sp->state[IDX_CHAP]) { 4117 case STATE_REQ_SENT: 4118 chap.tld(sp); 4119 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 4120 break; 4121 } 4122 else 4123 /* TO+ (or TO*) event */ 4124 switch (sp->state[IDX_CHAP]) { 4125 case STATE_OPENED: 4126 /* TO* event */ 4127 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4128 /* fall through */ 4129 case STATE_REQ_SENT: 4130 chap.scr(sp); 4131 /* sppp_cp_change_state() will restart the timer */ 4132 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4133 break; 4134 } 4135 4136 splx(s); 4137} 4138 4139static void 4140sppp_chap_tlu(struct sppp *sp) 4141{ 4142 STDDCL; 4143 int i, x; 4144 4145 i = 0; 4146 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4147 4148 /* 4149 * Some broken CHAP implementations (Conware CoNet, firmware 4150 * 4.0.?) don't want to re-authenticate their CHAP once the 4151 * initial challenge-response exchange has taken place. 4152 * Provide for an option to avoid rechallenges. 4153 */ 4154 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) { 4155 /* 4156 * Compute the re-challenge timeout. This will yield 4157 * a number between 300 and 810 seconds. 4158 */ 4159 i = 300 + ((unsigned)(random() & 0xff00) >> 7); 4160 TIMEOUT(chap.TO, (void *)sp, i * hz, sp->ch[IDX_CHAP]); 4161 } 4162 4163 if (debug) { 4164 log(LOG_DEBUG, 4165 SPP_FMT "chap %s, ", 4166 SPP_ARGS(ifp), 4167 sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu"); 4168 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) 4169 log(-1, "next re-challenge in %d seconds\n", i); 4170 else 4171 log(-1, "re-challenging supressed\n"); 4172 } 4173 4174 x = splimp(); 4175 /* indicate to LCP that we need to be closed down */ 4176 sp->lcp.protos |= (1 << IDX_CHAP); 4177 4178 if (sp->pp_flags & PP_NEEDAUTH) { 4179 /* 4180 * Remote is authenticator, but his auth proto didn't 4181 * complete yet. Defer the transition to network 4182 * phase. 4183 */ 4184 splx(x); 4185 return; 4186 } 4187 splx(x); 4188 4189 /* 4190 * If we are already in phase network, we are done here. This 4191 * is the case if this is a dummy tlu event after a re-challenge. 4192 */ 4193 if (sp->pp_phase != PHASE_NETWORK) 4194 sppp_phase_network(sp); 4195} 4196 4197static void 4198sppp_chap_tld(struct sppp *sp) 4199{ 4200 STDDCL; 4201 4202 if (debug) 4203 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4204 UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]); 4205 sp->lcp.protos &= ~(1 << IDX_CHAP); 4206 4207 lcp.Close(sp); 4208} 4209 4210static void 4211sppp_chap_scr(struct sppp *sp) 4212{ 4213 u_long *ch, seed; 4214 u_char clen; 4215 4216 /* Compute random challenge. */ 4217 ch = (u_long *)sp->myauth.challenge; 4218#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4219 read_random(&seed, sizeof seed); 4220#else 4221 { 4222 struct timeval tv; 4223 microtime(&tv); 4224 seed = tv.tv_sec ^ tv.tv_usec; 4225 } 4226#endif 4227 ch[0] = seed ^ random(); 4228 ch[1] = seed ^ random(); 4229 ch[2] = seed ^ random(); 4230 ch[3] = seed ^ random(); 4231 clen = AUTHKEYLEN; 4232 4233 sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP]; 4234 4235 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4236 sizeof clen, (const char *)&clen, 4237 (size_t)AUTHKEYLEN, sp->myauth.challenge, 4238 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN), 4239 sp->myauth.name, 4240 0); 4241} 4242 4243/* 4244 *--------------------------------------------------------------------------* 4245 * * 4246 * The PAP implementation. * 4247 * * 4248 *--------------------------------------------------------------------------* 4249 */ 4250/* 4251 * For PAP, we need to keep a little state also if we are the peer, not the 4252 * authenticator. This is since we don't get a request to authenticate, but 4253 * have to repeatedly authenticate ourself until we got a response (or the 4254 * retry counter is expired). 4255 */ 4256 4257/* 4258 * Handle incoming PAP packets. */ 4259static void 4260sppp_pap_input(struct sppp *sp, struct mbuf *m) 4261{ 4262 STDDCL; 4263 struct lcp_header *h; 4264 int len, x; 4265 u_char *name, *passwd, mlen; 4266 int name_len, passwd_len; 4267 4268 len = m->m_pkthdr.len; 4269 if (len < 5) { 4270 if (debug) 4271 log(LOG_DEBUG, 4272 SPP_FMT "pap invalid packet length: %d bytes\n", 4273 SPP_ARGS(ifp), len); 4274 return; 4275 } 4276 h = mtod (m, struct lcp_header*); 4277 if (len > ntohs (h->len)) 4278 len = ntohs (h->len); 4279 switch (h->type) { 4280 /* PAP request is my authproto */ 4281 case PAP_REQ: 4282 name = 1 + (u_char*)(h+1); 4283 name_len = name[-1]; 4284 passwd = name + name_len + 1; 4285 if (name_len > len - 6 || 4286 (passwd_len = passwd[-1]) > len - 6 - name_len) { 4287 if (debug) { 4288 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4289 "<%s id=0x%x len=%d", 4290 SPP_ARGS(ifp), 4291 sppp_auth_type_name(PPP_PAP, h->type), 4292 h->ident, ntohs(h->len)); 4293 sppp_print_bytes((u_char*)(h+1), len-4); 4294 log(-1, ">\n"); 4295 } 4296 break; 4297 } 4298 if (debug) { 4299 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4300 "<%s id=0x%x len=%d name=", 4301 SPP_ARGS(ifp), 4302 sppp_state_name(sp->state[IDX_PAP]), 4303 sppp_auth_type_name(PPP_PAP, h->type), 4304 h->ident, ntohs(h->len)); 4305 sppp_print_string((char*)name, name_len); 4306 log(-1, " passwd="); 4307 sppp_print_string((char*)passwd, passwd_len); 4308 log(-1, ">\n"); 4309 } 4310 if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN) || 4311 passwd_len != sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN) || 4312 bcmp(name, sp->hisauth.name, name_len) != 0 || 4313 bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) { 4314 /* action scn, tld */ 4315 mlen = sizeof(FAILMSG) - 1; 4316 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4317 sizeof mlen, (const char *)&mlen, 4318 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4319 0); 4320 pap.tld(sp); 4321 break; 4322 } 4323 /* action sca, perhaps tlu */ 4324 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4325 sp->state[IDX_PAP] == STATE_OPENED) { 4326 mlen = sizeof(SUCCMSG) - 1; 4327 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4328 sizeof mlen, (const char *)&mlen, 4329 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4330 0); 4331 } 4332 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4333 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4334 pap.tlu(sp); 4335 } 4336 break; 4337 4338 /* ack and nak are his authproto */ 4339 case PAP_ACK: 4340 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4341 if (debug) { 4342 log(LOG_DEBUG, SPP_FMT "pap success", 4343 SPP_ARGS(ifp)); 4344 name_len = *((char *)h); 4345 if (len > 5 && name_len) { 4346 log(-1, ": "); 4347 sppp_print_string((char*)(h+1), name_len); 4348 } 4349 log(-1, "\n"); 4350 } 4351 x = splimp(); 4352 sp->pp_flags &= ~PP_NEEDAUTH; 4353 if (sp->myauth.proto == PPP_PAP && 4354 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4355 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4356 /* 4357 * We are authenticator for PAP but didn't 4358 * complete yet. Leave it to tlu to proceed 4359 * to network phase. 4360 */ 4361 splx(x); 4362 break; 4363 } 4364 splx(x); 4365 sppp_phase_network(sp); 4366 break; 4367 4368 case PAP_NAK: 4369 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4370 if (debug) { 4371 log(LOG_INFO, SPP_FMT "pap failure", 4372 SPP_ARGS(ifp)); 4373 name_len = *((char *)h); 4374 if (len > 5 && name_len) { 4375 log(-1, ": "); 4376 sppp_print_string((char*)(h+1), name_len); 4377 } 4378 log(-1, "\n"); 4379 } else 4380 log(LOG_INFO, SPP_FMT "pap failure\n", 4381 SPP_ARGS(ifp)); 4382 /* await LCP shutdown by authenticator */ 4383 break; 4384 4385 default: 4386 /* Unknown PAP packet type -- ignore. */ 4387 if (debug) { 4388 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4389 "<0x%x id=0x%x len=%d", 4390 SPP_ARGS(ifp), 4391 h->type, h->ident, ntohs(h->len)); 4392 sppp_print_bytes((u_char*)(h+1), len-4); 4393 log(-1, ">\n"); 4394 } 4395 break; 4396 4397 } 4398} 4399 4400static void 4401sppp_pap_init(struct sppp *sp) 4402{ 4403 /* PAP doesn't have STATE_INITIAL at all. */ 4404 sp->state[IDX_PAP] = STATE_CLOSED; 4405 sp->fail_counter[IDX_PAP] = 0; 4406 sp->pp_seq[IDX_PAP] = 0; 4407 sp->pp_rseq[IDX_PAP] = 0; 4408#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4409 callout_handle_init(&sp->ch[IDX_PAP]); 4410 callout_handle_init(&sp->pap_my_to_ch); 4411#endif 4412} 4413 4414static void 4415sppp_pap_open(struct sppp *sp) 4416{ 4417 if (sp->hisauth.proto == PPP_PAP && 4418 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4419 /* we are authenticator for PAP, start our timer */ 4420 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4421 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4422 } 4423 if (sp->myauth.proto == PPP_PAP) { 4424 /* we are peer, send a request, and start a timer */ 4425 pap.scr(sp); 4426 TIMEOUT(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout, 4427 sp->pap_my_to_ch); 4428 } 4429} 4430 4431static void 4432sppp_pap_close(struct sppp *sp) 4433{ 4434 if (sp->state[IDX_PAP] != STATE_CLOSED) 4435 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4436} 4437 4438/* 4439 * That's the timeout routine if we are authenticator. Since the 4440 * authenticator is basically passive in PAP, we can't do much here. 4441 */ 4442static void 4443sppp_pap_TO(void *cookie) 4444{ 4445 struct sppp *sp = (struct sppp *)cookie; 4446 STDDCL; 4447 int s; 4448 4449 s = splimp(); 4450 if (debug) 4451 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4452 SPP_ARGS(ifp), 4453 sppp_state_name(sp->state[IDX_PAP]), 4454 sp->rst_counter[IDX_PAP]); 4455 4456 if (--sp->rst_counter[IDX_PAP] < 0) 4457 /* TO- event */ 4458 switch (sp->state[IDX_PAP]) { 4459 case STATE_REQ_SENT: 4460 pap.tld(sp); 4461 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4462 break; 4463 } 4464 else 4465 /* TO+ event, not very much we could do */ 4466 switch (sp->state[IDX_PAP]) { 4467 case STATE_REQ_SENT: 4468 /* sppp_cp_change_state() will restart the timer */ 4469 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4470 break; 4471 } 4472 4473 splx(s); 4474} 4475 4476/* 4477 * That's the timeout handler if we are peer. Since the peer is active, 4478 * we need to retransmit our PAP request since it is apparently lost. 4479 * XXX We should impose a max counter. 4480 */ 4481static void 4482sppp_pap_my_TO(void *cookie) 4483{ 4484 struct sppp *sp = (struct sppp *)cookie; 4485 STDDCL; 4486 4487 if (debug) 4488 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4489 SPP_ARGS(ifp)); 4490 4491 pap.scr(sp); 4492} 4493 4494static void 4495sppp_pap_tlu(struct sppp *sp) 4496{ 4497 STDDCL; 4498 int x; 4499 4500 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4501 4502 if (debug) 4503 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4504 SPP_ARGS(ifp), pap.name); 4505 4506 x = splimp(); 4507 /* indicate to LCP that we need to be closed down */ 4508 sp->lcp.protos |= (1 << IDX_PAP); 4509 4510 if (sp->pp_flags & PP_NEEDAUTH) { 4511 /* 4512 * Remote is authenticator, but his auth proto didn't 4513 * complete yet. Defer the transition to network 4514 * phase. 4515 */ 4516 splx(x); 4517 return; 4518 } 4519 splx(x); 4520 sppp_phase_network(sp); 4521} 4522 4523static void 4524sppp_pap_tld(struct sppp *sp) 4525{ 4526 STDDCL; 4527 4528 if (debug) 4529 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4530 UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]); 4531 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4532 sp->lcp.protos &= ~(1 << IDX_PAP); 4533 4534 lcp.Close(sp); 4535} 4536 4537static void 4538sppp_pap_scr(struct sppp *sp) 4539{ 4540 u_char idlen, pwdlen; 4541 4542 sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP]; 4543 pwdlen = sppp_strnlen(sp->myauth.secret, AUTHKEYLEN); 4544 idlen = sppp_strnlen(sp->myauth.name, AUTHNAMELEN); 4545 4546 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4547 sizeof idlen, (const char *)&idlen, 4548 (size_t)idlen, sp->myauth.name, 4549 sizeof pwdlen, (const char *)&pwdlen, 4550 (size_t)pwdlen, sp->myauth.secret, 4551 0); 4552} 4553 4554/* 4555 * Random miscellaneous functions. 4556 */ 4557 4558/* 4559 * Send a PAP or CHAP proto packet. 4560 * 4561 * Varadic function, each of the elements for the ellipsis is of type 4562 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4563 * mlen == 0. 4564 * NOTE: never declare variadic functions with types subject to type 4565 * promotion (i.e. u_char). This is asking for big trouble depending 4566 * on the architecture you are on... 4567 */ 4568 4569static void 4570sppp_auth_send(const struct cp *cp, struct sppp *sp, 4571 unsigned int type, unsigned int id, 4572 ...) 4573{ 4574 STDDCL; 4575 struct ppp_header *h; 4576 struct lcp_header *lh; 4577 struct mbuf *m; 4578 u_char *p; 4579 int len; 4580 unsigned int mlen; 4581 const char *msg; 4582 va_list ap; 4583 4584 MGETHDR (m, M_DONTWAIT, MT_DATA); 4585 if (! m) 4586 return; 4587 m->m_pkthdr.rcvif = 0; 4588 4589 h = mtod (m, struct ppp_header*); 4590 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4591 h->control = PPP_UI; /* Unnumbered Info */ 4592 h->protocol = htons(cp->proto); 4593 4594 lh = (struct lcp_header*)(h + 1); 4595 lh->type = type; 4596 lh->ident = id; 4597 p = (u_char*) (lh+1); 4598 4599 va_start(ap, id); 4600 len = 0; 4601 4602 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4603 msg = va_arg(ap, const char *); 4604 len += mlen; 4605 if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN) { 4606 va_end(ap); 4607 m_freem(m); 4608 return; 4609 } 4610 4611 bcopy(msg, p, mlen); 4612 p += mlen; 4613 } 4614 va_end(ap); 4615 4616 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len; 4617 lh->len = htons (LCP_HEADER_LEN + len); 4618 4619 if (debug) { 4620 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4621 SPP_ARGS(ifp), cp->name, 4622 sppp_auth_type_name(cp->proto, lh->type), 4623 lh->ident, ntohs(lh->len)); 4624 sppp_print_bytes((u_char*) (lh+1), len); 4625 log(-1, ">\n"); 4626 } 4627 if (! IF_HANDOFF_ADJ(&sp->pp_cpq, m, ifp, 3)) 4628 ifp->if_oerrors++; 4629} 4630 4631/* 4632 * Flush interface queue. 4633 */ 4634static void 4635sppp_qflush(struct ifqueue *ifq) 4636{ 4637 struct mbuf *m, *n; 4638 4639 n = ifq->ifq_head; 4640 while ((m = n)) { 4641 n = m->m_act; 4642 m_freem (m); 4643 } 4644 ifq->ifq_head = 0; 4645 ifq->ifq_tail = 0; 4646 ifq->ifq_len = 0; 4647} 4648 4649/* 4650 * Send keepalive packets, every 10 seconds. 4651 */ 4652static void 4653sppp_keepalive(void *dummy) 4654{ 4655 struct sppp *sp; 4656 int s; 4657 4658 s = splimp(); 4659 for (sp=spppq; sp; sp=sp->pp_next) { 4660 struct ifnet *ifp = &sp->pp_if; 4661 4662 /* Keepalive mode disabled or channel down? */ 4663 if (! (sp->pp_flags & PP_KEEPALIVE) || 4664 ! (ifp->if_flags & IFF_RUNNING)) 4665 continue; 4666 4667 /* No keepalive in PPP mode if LCP not opened yet. */ 4668 if (sp->pp_mode != IFF_CISCO && 4669 sp->pp_phase < PHASE_AUTHENTICATE) 4670 continue; 4671 4672 if (sp->pp_alivecnt == MAXALIVECNT) { 4673 /* No keepalive packets got. Stop the interface. */ 4674 printf (SPP_FMT "down\n", SPP_ARGS(ifp)); 4675 if_down (ifp); 4676 sppp_qflush (&sp->pp_cpq); 4677 if (sp->pp_mode != IFF_CISCO) { 4678 /* XXX */ 4679 /* Shut down the PPP link. */ 4680 lcp.Down(sp); 4681 /* Initiate negotiation. XXX */ 4682 lcp.Up(sp); 4683 } 4684 } 4685 if (sp->pp_alivecnt <= MAXALIVECNT) 4686 ++sp->pp_alivecnt; 4687 if (sp->pp_mode == IFF_CISCO) 4688 sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, 4689 ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]); 4690 else if (sp->pp_phase >= PHASE_AUTHENTICATE) { 4691 long nmagic = htonl (sp->lcp.magic); 4692 sp->lcp.echoid = ++sp->pp_seq[IDX_LCP]; 4693 sppp_cp_send (sp, PPP_LCP, ECHO_REQ, 4694 sp->lcp.echoid, 4, &nmagic); 4695 } 4696 } 4697 splx(s); 4698 TIMEOUT(sppp_keepalive, 0, hz * 10, keepalive_ch); 4699} 4700 4701/* 4702 * Get both IP addresses. 4703 */ 4704static void 4705sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask) 4706{ 4707 struct ifnet *ifp = &sp->pp_if; 4708 struct ifaddr *ifa; 4709 struct sockaddr_in *si, *sm; 4710 u_long ssrc, ddst; 4711 4712 sm = NULL; 4713 ssrc = ddst = 0L; 4714 /* 4715 * Pick the first AF_INET address from the list, 4716 * aliases don't make any sense on a p2p link anyway. 4717 */ 4718 si = 0; 4719#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4720 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) 4721#elif defined(__NetBSD__) || defined (__OpenBSD__) 4722 for (ifa = TAILQ_FIRST(&ifp->if_addrlist); 4723 ifa; 4724 ifa = TAILQ_NEXT(ifa, ifa_list)) 4725#else 4726 for (ifa = ifp->if_addrlist; 4727 ifa; 4728 ifa = ifa->ifa_next) 4729#endif 4730 if (ifa->ifa_addr->sa_family == AF_INET) { 4731 si = (struct sockaddr_in *)ifa->ifa_addr; 4732 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4733 if (si) 4734 break; 4735 } 4736 if (ifa) { 4737 if (si && si->sin_addr.s_addr) { 4738 ssrc = si->sin_addr.s_addr; 4739 if (srcmask) 4740 *srcmask = ntohl(sm->sin_addr.s_addr); 4741 } 4742 4743 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4744 if (si && si->sin_addr.s_addr) 4745 ddst = si->sin_addr.s_addr; 4746 } 4747 4748 if (dst) *dst = ntohl(ddst); 4749 if (src) *src = ntohl(ssrc); 4750} 4751 4752/* 4753 * Set my IP address. Must be called at splimp. 4754 */ 4755static void 4756sppp_set_ip_addr(struct sppp *sp, u_long src) 4757{ 4758 STDDCL; 4759 struct ifaddr *ifa; 4760 struct sockaddr_in *si; 4761 struct in_ifaddr *ia; 4762 4763 /* 4764 * Pick the first AF_INET address from the list, 4765 * aliases don't make any sense on a p2p link anyway. 4766 */ 4767 si = 0; 4768#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4769 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) 4770#elif defined(__NetBSD__) || defined (__OpenBSD__) 4771 for (ifa = TAILQ_FIRST(&ifp->if_addrlist); 4772 ifa; 4773 ifa = TAILQ_NEXT(ifa, ifa_list)) 4774#else 4775 for (ifa = ifp->if_addrlist; 4776 ifa; 4777 ifa = ifa->ifa_next) 4778#endif 4779 { 4780 if (ifa->ifa_addr->sa_family == AF_INET) 4781 { 4782 si = (struct sockaddr_in *)ifa->ifa_addr; 4783 if (si) 4784 break; 4785 } 4786 } 4787 4788 if (ifa && si) 4789 { 4790 int error; 4791#if __NetBSD_Version__ >= 103080000 4792 struct sockaddr_in new_sin = *si; 4793 4794 new_sin.sin_addr.s_addr = htonl(src); 4795 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 1); 4796 if(debug && error) 4797 { 4798 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: in_ifinit " 4799 " failed, error=%d\n", SPP_ARGS(ifp), error); 4800 } 4801#else 4802 /* delete old route */ 4803 error = rtinit(ifa, (int)RTM_DELETE, RTF_HOST); 4804 if(debug && error) 4805 { 4806 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: rtinit DEL failed, error=%d\n", 4807 SPP_ARGS(ifp), error); 4808 } 4809 4810 /* set new address */ 4811 si->sin_addr.s_addr = htonl(src); 4812 ia = ifatoia(ifa); 4813 LIST_REMOVE(ia, ia_hash); 4814 LIST_INSERT_HEAD(INADDR_HASH(si->sin_addr.s_addr), ia, ia_hash); 4815 4816 /* add new route */ 4817 error = rtinit(ifa, (int)RTM_ADD, RTF_HOST); 4818 if (debug && error) 4819 { 4820 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addr: rtinit ADD failed, error=%d", 4821 SPP_ARGS(ifp), error); 4822 } 4823#endif 4824 } 4825} 4826 4827#ifdef INET6 4828/* 4829 * Get both IPv6 addresses. 4830 */ 4831static void 4832sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4833 struct in6_addr *srcmask) 4834{ 4835 struct ifnet *ifp = &sp->pp_if; 4836 struct ifaddr *ifa; 4837 struct sockaddr_in6 *si, *sm; 4838 struct in6_addr ssrc, ddst; 4839 4840 sm = NULL; 4841 bzero(&ssrc, sizeof(ssrc)); 4842 bzero(&ddst, sizeof(ddst)); 4843 /* 4844 * Pick the first link-local AF_INET6 address from the list, 4845 * aliases don't make any sense on a p2p link anyway. 4846 */ 4847#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4848 for (ifa = ifp->if_addrhead.tqh_first, si = 0; 4849 ifa; 4850 ifa = ifa->ifa_link.tqe_next) 4851#elif defined(__NetBSD__) || defined (__OpenBSD__) 4852 for (ifa = ifp->if_addrlist.tqh_first, si = 0; 4853 ifa; 4854 ifa = ifa->ifa_list.tqe_next) 4855#else 4856 for (ifa = ifp->if_addrlist, si = 0; 4857 ifa; 4858 ifa = ifa->ifa_next) 4859#endif 4860 if (ifa->ifa_addr->sa_family == AF_INET6) { 4861 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4862 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4863 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4864 break; 4865 } 4866 if (ifa) { 4867 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4868 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4869 if (srcmask) { 4870 bcopy(&sm->sin6_addr, srcmask, 4871 sizeof(*srcmask)); 4872 } 4873 } 4874 4875 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4876 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4877 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4878 } 4879 4880 if (dst) 4881 bcopy(&ddst, dst, sizeof(*dst)); 4882 if (src) 4883 bcopy(&ssrc, src, sizeof(*src)); 4884} 4885 4886#ifdef IPV6CP_MYIFID_DYN 4887/* 4888 * Generate random ifid. 4889 */ 4890static void 4891sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4892{ 4893 /* TBD */ 4894} 4895 4896/* 4897 * Set my IPv6 address. Must be called at splimp. 4898 */ 4899static void 4900sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4901{ 4902 STDDCL; 4903 struct ifaddr *ifa; 4904 struct sockaddr_in6 *sin6; 4905 4906 /* 4907 * Pick the first link-local AF_INET6 address from the list, 4908 * aliases don't make any sense on a p2p link anyway. 4909 */ 4910 4911 sin6 = NULL; 4912#if defined(__FreeBSD__) && __FreeBSD__ >= 3 4913 for (ifa = ifp->if_addrhead.tqh_first; 4914 ifa; 4915 ifa = ifa->ifa_link.tqe_next) 4916#elif defined(__NetBSD__) || defined (__OpenBSD__) 4917 for (ifa = ifp->if_addrlist.tqh_first; 4918 ifa; 4919 ifa = ifa->ifa_list.tqe_next) 4920#else 4921 for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next) 4922#endif 4923 { 4924 if (ifa->ifa_addr->sa_family == AF_INET6) 4925 { 4926 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4927 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4928 break; 4929 } 4930 } 4931 4932 if (ifa && sin6) 4933 { 4934 int error; 4935 struct sockaddr_in6 new_sin6 = *sin6; 4936 4937 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4938 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1); 4939 if (debug && error) 4940 { 4941 log(LOG_DEBUG, SPP_FMT "sppp_set_ip6_addr: in6_ifinit " 4942 " failed, error=%d\n", SPP_ARGS(ifp), error); 4943 } 4944 } 4945} 4946#endif 4947 4948/* 4949 * Suggest a candidate address to be used by peer. 4950 */ 4951static void 4952sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4953{ 4954 struct in6_addr myaddr; 4955 struct timeval tv; 4956 4957 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4958 4959 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4960 microtime(&tv); 4961 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4962 myaddr.s6_addr[14] ^= 0xff; 4963 myaddr.s6_addr[15] ^= 0xff; 4964 } else { 4965 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 4966 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 4967 } 4968 if (suggest) 4969 bcopy(&myaddr, suggest, sizeof(myaddr)); 4970} 4971#endif /*INET6*/ 4972 4973static int 4974sppp_params(struct sppp *sp, u_long cmd, void *data) 4975{ 4976 u_long subcmd; 4977 struct ifreq *ifr = (struct ifreq *)data; 4978 struct spppreq *spr; 4979 int rv = 0; 4980 4981 if ((spr = malloc(sizeof(struct spppreq), M_TEMP, M_NOWAIT)) == 0) 4982 return (EAGAIN); 4983 /* 4984 * ifr->ifr_data is supposed to point to a struct spppreq. 4985 * Check the cmd word first before attempting to fetch all the 4986 * data. 4987 */ 4988 if ((subcmd = fuword(ifr->ifr_data)) == -1) { 4989 rv = EFAULT; 4990 goto quit; 4991 } 4992 4993 if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(struct spppreq)) != 0) { 4994 rv = EFAULT; 4995 goto quit; 4996 } 4997 4998 switch (subcmd) { 4999 case SPPPIOGDEFS: 5000 if (cmd != SIOCGIFGENERIC) { 5001 rv = EINVAL; 5002 break; 5003 } 5004 /* 5005 * We copy over the entire current state, but clean 5006 * out some of the stuff we don't wanna pass up. 5007 * Remember, SIOCGIFGENERIC is unprotected, and can be 5008 * called by any user. No need to ever get PAP or 5009 * CHAP secrets back to userland anyway. 5010 */ 5011 spr->defs.pp_phase = sp->pp_phase; 5012 spr->defs.enable_vj = sp->enable_vj; 5013 spr->defs.lcp = sp->lcp; 5014 spr->defs.ipcp = sp->ipcp; 5015 spr->defs.ipv6cp = sp->ipv6cp; 5016 spr->defs.myauth = sp->myauth; 5017 spr->defs.hisauth = sp->hisauth; 5018 bzero(spr->defs.myauth.secret, AUTHKEYLEN); 5019 bzero(spr->defs.myauth.challenge, AUTHKEYLEN); 5020 bzero(spr->defs.hisauth.secret, AUTHKEYLEN); 5021 bzero(spr->defs.hisauth.challenge, AUTHKEYLEN); 5022 /* 5023 * Fixup the LCP timeout value to milliseconds so 5024 * spppcontrol doesn't need to bother about the value 5025 * of "hz". We do the reverse calculation below when 5026 * setting it. 5027 */ 5028 spr->defs.lcp.timeout = sp->lcp.timeout * 1000 / hz; 5029 rv = copyout(spr, (caddr_t)ifr->ifr_data, 5030 sizeof(struct spppreq)); 5031 break; 5032 5033 case SPPPIOSDEFS: 5034 if (cmd != SIOCSIFGENERIC) { 5035 rv = EINVAL; 5036 break; 5037 } 5038 /* 5039 * We have a very specific idea of which fields we 5040 * allow being passed back from userland, so to not 5041 * clobber our current state. For one, we only allow 5042 * setting anything if LCP is in dead or establish 5043 * phase. Once the authentication negotiations 5044 * started, the authentication settings must not be 5045 * changed again. (The administrator can force an 5046 * ifconfig down in order to get LCP back into dead 5047 * phase.) 5048 * 5049 * Also, we only allow for authentication parameters to be 5050 * specified. 5051 * 5052 * XXX Should allow to set or clear pp_flags. 5053 * 5054 * Finally, if the respective authentication protocol to 5055 * be used is set differently than 0, but the secret is 5056 * passed as all zeros, we don't trash the existing secret. 5057 * This allows an administrator to change the system name 5058 * only without clobbering the secret (which he didn't get 5059 * back in a previous SPPPIOGDEFS call). However, the 5060 * secrets are cleared if the authentication protocol is 5061 * reset to 0. */ 5062 if (sp->pp_phase != PHASE_DEAD && 5063 sp->pp_phase != PHASE_ESTABLISH) { 5064 rv = EBUSY; 5065 break; 5066 } 5067 5068 if ((spr->defs.myauth.proto != 0 && spr->defs.myauth.proto != PPP_PAP && 5069 spr->defs.myauth.proto != PPP_CHAP) || 5070 (spr->defs.hisauth.proto != 0 && spr->defs.hisauth.proto != PPP_PAP && 5071 spr->defs.hisauth.proto != PPP_CHAP)) { 5072 rv = EINVAL; 5073 break; 5074 } 5075 5076 if (spr->defs.myauth.proto == 0) 5077 /* resetting myauth */ 5078 bzero(&sp->myauth, sizeof sp->myauth); 5079 else { 5080 /* setting/changing myauth */ 5081 sp->myauth.proto = spr->defs.myauth.proto; 5082 bcopy(spr->defs.myauth.name, sp->myauth.name, AUTHNAMELEN); 5083 if (spr->defs.myauth.secret[0] != '\0') 5084 bcopy(spr->defs.myauth.secret, sp->myauth.secret, 5085 AUTHKEYLEN); 5086 } 5087 if (spr->defs.hisauth.proto == 0) 5088 /* resetting hisauth */ 5089 bzero(&sp->hisauth, sizeof sp->hisauth); 5090 else { 5091 /* setting/changing hisauth */ 5092 sp->hisauth.proto = spr->defs.hisauth.proto; 5093 sp->hisauth.flags = spr->defs.hisauth.flags; 5094 bcopy(spr->defs.hisauth.name, sp->hisauth.name, AUTHNAMELEN); 5095 if (spr->defs.hisauth.secret[0] != '\0') 5096 bcopy(spr->defs.hisauth.secret, sp->hisauth.secret, 5097 AUTHKEYLEN); 5098 } 5099 /* set LCP restart timer timeout */ 5100 if (spr->defs.lcp.timeout != 0) 5101 sp->lcp.timeout = spr->defs.lcp.timeout * hz / 1000; 5102 /* set VJ enable flag */ 5103 sp->enable_vj = spr->defs.enable_vj; 5104 break; 5105 5106 default: 5107 rv = EINVAL; 5108 } 5109 5110 quit: 5111 free(spr, M_TEMP); 5112 5113 return (rv); 5114} 5115 5116static void 5117sppp_phase_network(struct sppp *sp) 5118{ 5119 STDDCL; 5120 int i; 5121 u_long mask; 5122 5123 sp->pp_phase = PHASE_NETWORK; 5124 5125 if (debug) 5126 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 5127 sppp_phase_name(sp->pp_phase)); 5128 5129 /* Notify NCPs now. */ 5130 for (i = 0; i < IDX_COUNT; i++) 5131 if ((cps[i])->flags & CP_NCP) 5132 (cps[i])->Open(sp); 5133 5134 /* Send Up events to all NCPs. */ 5135 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5136 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) 5137 (cps[i])->Up(sp); 5138 5139 /* if no NCP is starting, all this was in vain, close down */ 5140 sppp_lcp_check_and_close(sp); 5141} 5142 5143 5144static const char * 5145sppp_cp_type_name(u_char type) 5146{ 5147 static char buf[12]; 5148 switch (type) { 5149 case CONF_REQ: return "conf-req"; 5150 case CONF_ACK: return "conf-ack"; 5151 case CONF_NAK: return "conf-nak"; 5152 case CONF_REJ: return "conf-rej"; 5153 case TERM_REQ: return "term-req"; 5154 case TERM_ACK: return "term-ack"; 5155 case CODE_REJ: return "code-rej"; 5156 case PROTO_REJ: return "proto-rej"; 5157 case ECHO_REQ: return "echo-req"; 5158 case ECHO_REPLY: return "echo-reply"; 5159 case DISC_REQ: return "discard-req"; 5160 } 5161 snprintf (buf, sizeof(buf), "cp/0x%x", type); 5162 return buf; 5163} 5164 5165static const char * 5166sppp_auth_type_name(u_short proto, u_char type) 5167{ 5168 static char buf[12]; 5169 switch (proto) { 5170 case PPP_CHAP: 5171 switch (type) { 5172 case CHAP_CHALLENGE: return "challenge"; 5173 case CHAP_RESPONSE: return "response"; 5174 case CHAP_SUCCESS: return "success"; 5175 case CHAP_FAILURE: return "failure"; 5176 } 5177 case PPP_PAP: 5178 switch (type) { 5179 case PAP_REQ: return "req"; 5180 case PAP_ACK: return "ack"; 5181 case PAP_NAK: return "nak"; 5182 } 5183 } 5184 snprintf (buf, sizeof(buf), "auth/0x%x", type); 5185 return buf; 5186} 5187 5188static const char * 5189sppp_lcp_opt_name(u_char opt) 5190{ 5191 static char buf[12]; 5192 switch (opt) { 5193 case LCP_OPT_MRU: return "mru"; 5194 case LCP_OPT_ASYNC_MAP: return "async-map"; 5195 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5196 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5197 case LCP_OPT_MAGIC: return "magic"; 5198 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5199 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5200 } 5201 snprintf (buf, sizeof(buf), "lcp/0x%x", opt); 5202 return buf; 5203} 5204 5205static const char * 5206sppp_ipcp_opt_name(u_char opt) 5207{ 5208 static char buf[12]; 5209 switch (opt) { 5210 case IPCP_OPT_ADDRESSES: return "addresses"; 5211 case IPCP_OPT_COMPRESSION: return "compression"; 5212 case IPCP_OPT_ADDRESS: return "address"; 5213 } 5214 snprintf (buf, sizeof(buf), "ipcp/0x%x", opt); 5215 return buf; 5216} 5217 5218#ifdef INET6 5219static const char * 5220sppp_ipv6cp_opt_name(u_char opt) 5221{ 5222 static char buf[12]; 5223 switch (opt) { 5224 case IPV6CP_OPT_IFID: return "ifid"; 5225 case IPV6CP_OPT_COMPRESSION: return "compression"; 5226 } 5227 sprintf (buf, "0x%x", opt); 5228 return buf; 5229} 5230#endif 5231 5232static const char * 5233sppp_state_name(int state) 5234{ 5235 switch (state) { 5236 case STATE_INITIAL: return "initial"; 5237 case STATE_STARTING: return "starting"; 5238 case STATE_CLOSED: return "closed"; 5239 case STATE_STOPPED: return "stopped"; 5240 case STATE_CLOSING: return "closing"; 5241 case STATE_STOPPING: return "stopping"; 5242 case STATE_REQ_SENT: return "req-sent"; 5243 case STATE_ACK_RCVD: return "ack-rcvd"; 5244 case STATE_ACK_SENT: return "ack-sent"; 5245 case STATE_OPENED: return "opened"; 5246 } 5247 return "illegal"; 5248} 5249 5250static const char * 5251sppp_phase_name(enum ppp_phase phase) 5252{ 5253 switch (phase) { 5254 case PHASE_DEAD: return "dead"; 5255 case PHASE_ESTABLISH: return "establish"; 5256 case PHASE_TERMINATE: return "terminate"; 5257 case PHASE_AUTHENTICATE: return "authenticate"; 5258 case PHASE_NETWORK: return "network"; 5259 } 5260 return "illegal"; 5261} 5262 5263static const char * 5264sppp_proto_name(u_short proto) 5265{ 5266 static char buf[12]; 5267 switch (proto) { 5268 case PPP_LCP: return "lcp"; 5269 case PPP_IPCP: return "ipcp"; 5270 case PPP_PAP: return "pap"; 5271 case PPP_CHAP: return "chap"; 5272 case PPP_IPV6CP: return "ipv6cp"; 5273 } 5274 snprintf(buf, sizeof(buf), "proto/0x%x", (unsigned)proto); 5275 return buf; 5276} 5277 5278static void 5279sppp_print_bytes(const u_char *p, u_short len) 5280{ 5281 if (len) 5282 log(-1, " %*D", len, p, "-"); 5283} 5284 5285static void 5286sppp_print_string(const char *p, u_short len) 5287{ 5288 u_char c; 5289 5290 while (len-- > 0) { 5291 c = *p++; 5292 /* 5293 * Print only ASCII chars directly. RFC 1994 recommends 5294 * using only them, but we don't rely on it. */ 5295 if (c < ' ' || c > '~') 5296 log(-1, "\\x%x", c); 5297 else 5298 log(-1, "%c", c); 5299 } 5300} 5301 5302static const char * 5303sppp_dotted_quad(u_long addr) 5304{ 5305 static char s[16]; 5306 sprintf(s, "%d.%d.%d.%d", 5307 (int)((addr >> 24) & 0xff), 5308 (int)((addr >> 16) & 0xff), 5309 (int)((addr >> 8) & 0xff), 5310 (int)(addr & 0xff)); 5311 return s; 5312} 5313 5314static int 5315sppp_strnlen(u_char *p, int max) 5316{ 5317 int len; 5318 5319 for (len = 0; len < max && *p; ++p) 5320 ++len; 5321 return len; 5322} 5323 5324/* a dummy, used to drop uninteresting events */ 5325static void 5326sppp_null(struct sppp *unused) 5327{ 5328 /* do just nothing */ 5329} 5330