1 /* $NetBSD: if_spppsubr.c,v 1.267 2023/03/25 21:35:49 andvar Exp $ */
2
3 /*
4 * Synchronous PPP/Cisco link level subroutines.
5 * Keepalive protocol implemented in both Cisco and PPP modes.
6 *
7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
8 * Author: Serge Vakulenko, <vak@cronyx.ru>
9 *
10 * Heavily revamped to conform to RFC 1661.
11 * Copyright (C) 1997, Joerg Wunsch.
12 *
13 * RFC2472 IPv6CP support.
14 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun@iijlab.net>.
15 *
16 * Redistribution and use in source and binary forms, with or without
17 * modification, are permitted provided that the following conditions are met:
18 * 1. Redistributions of source code must retain the above copyright notice,
19 * this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright notice,
21 * this list of conditions and the following disclaimer in the documentation
22 * and/or other materials provided with the distribution.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
25 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
35 *
36 * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
37 *
38 * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp
39 *
40 * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp
41 */
42
43 #include <sys/cdefs.h>
44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.267 2023/03/25 21:35:49 andvar Exp $");
45
46 #if defined(_KERNEL_OPT)
47 #include "opt_inet.h"
48 #include "opt_modular.h"
49 #include "opt_compat_netbsd.h"
50 #include "opt_net_mpsafe.h"
51 #include "opt_sppp.h"
52 #endif
53
54 #include <sys/param.h>
55 #include <sys/proc.h>
56 #include <sys/systm.h>
57 #include <sys/kernel.h>
58 #include <sys/sockio.h>
59 #include <sys/socket.h>
60 #include <sys/syslog.h>
61 #include <sys/malloc.h>
62 #include <sys/mbuf.h>
63 #include <sys/callout.h>
64 #include <sys/md5.h>
65 #include <sys/inttypes.h>
66 #include <sys/kauth.h>
67 #include <sys/cprng.h>
68 #include <sys/module.h>
69 #include <sys/workqueue.h>
70 #include <sys/atomic.h>
71 #include <sys/compat_stub.h>
72 #include <sys/cpu.h>
73
74 #include <net/if.h>
75 #include <net/if_types.h>
76 #include <net/route.h>
77 #include <net/ppp_defs.h>
78
79 #include <netinet/in.h>
80 #include <netinet/in_systm.h>
81 #include <netinet/in_var.h>
82 #ifdef INET
83 #include <netinet/ip.h>
84 #include <netinet/tcp.h>
85 #endif
86 #include <net/ethertypes.h>
87
88 #ifdef INET6
89 #include <netinet6/scope6_var.h>
90 #endif
91
92 #include <net/if_sppp.h>
93 #include <net/if_spppvar.h>
94
95 #ifdef NET_MPSAFE
96 #define SPPPSUBR_MPSAFE 1
97 #endif
98
99 #define DEFAULT_KEEPALIVE_INTERVAL 10 /* seconds between checks */
100 #define DEFAULT_ALIVE_INTERVAL 1 /* count of sppp_keepalive */
101 #define LOOPALIVECNT 3 /* loopback detection tries */
102 #define DEFAULT_MAXALIVECNT 3 /* max. missed alive packets */
103 #define DEFAULT_NORECV_TIME 15 /* before we get worried */
104 #define DEFAULT_MAX_AUTH_FAILURES 5 /* max. auth. failures */
105
106 #ifndef SPPP_KEEPALIVE_INTERVAL
107 #define SPPP_KEEPALIVE_INTERVAL DEFAULT_KEEPALIVE_INTERVAL
108 #endif
109
110 #ifndef SPPP_NORECV_TIME
111 #define SPPP_NORECV_TIME DEFAULT_NORECV_TIME
112 #endif
113
114 #ifndef SPPP_ALIVE_INTERVAL
115 #define SPPP_ALIVE_INTERVAL DEFAULT_ALIVE_INTERVAL
116 #endif
117
118 #define SPPP_CPTYPE_NAMELEN 5 /* buf size of cp type name */
119 #define SPPP_AUTHTYPE_NAMELEN 32 /* buf size of auth type name */
120 #define SPPP_LCPOPT_NAMELEN 5 /* buf size of lcp option name */
121 #define SPPP_IPCPOPT_NAMELEN 5 /* buf size of ipcp option name */
122 #define SPPP_IPV6CPOPT_NAMELEN 5 /* buf size of ipv6cp option name */
123 #define SPPP_PROTO_NAMELEN 7 /* buf size of protocol name */
124 #define SPPP_DOTQUAD_BUFLEN 16 /* length of "aa.bb.cc.dd" */
125
126 /*
127 * Interface flags that can be set in an ifconfig command.
128 *
129 * Setting link0 will make the link passive, i.e. it will be marked
130 * as being administrative openable, but won't be opened to begin
131 * with. Incoming calls will be answered, or subsequent calls with
132 * -link1 will cause the administrative open of the LCP layer.
133 *
134 * Setting link1 will cause the link to auto-dial only as packets
135 * arrive to be sent.
136 *
137 * Setting IFF_DEBUG will syslog the option negotiation and state
138 * transitions at level kern.debug. Note: all logs consistently look
139 * like
140 *
141 * <if-name><unit>: <proto-name> <additional info...>
142 *
143 * with <if-name><unit> being something like "bppp0", and <proto-name>
144 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
145 */
146
147 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */
148 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */
149
150 #define CONF_REQ 1 /* PPP configure request */
151 #define CONF_ACK 2 /* PPP configure acknowledge */
152 #define CONF_NAK 3 /* PPP configure negative ack */
153 #define CONF_REJ 4 /* PPP configure reject */
154 #define TERM_REQ 5 /* PPP terminate request */
155 #define TERM_ACK 6 /* PPP terminate acknowledge */
156 #define CODE_REJ 7 /* PPP code reject */
157 #define PROTO_REJ 8 /* PPP protocol reject */
158 #define ECHO_REQ 9 /* PPP echo request */
159 #define ECHO_REPLY 10 /* PPP echo reply */
160 #define DISC_REQ 11 /* PPP discard request */
161
162 #define LCP_OPT_MRU 1 /* maximum receive unit */
163 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */
164 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */
165 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */
166 #define LCP_OPT_MAGIC 5 /* magic number */
167 #define LCP_OPT_RESERVED 6 /* reserved */
168 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */
169 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */
170 #define LCP_OPT_FCS_ALTS 9 /* FCS alternatives */
171 #define LCP_OPT_SELF_DESC_PAD 10 /* self-describing padding */
172 #define LCP_OPT_CALL_BACK 13 /* callback */
173 #define LCP_OPT_COMPOUND_FRMS 15 /* compound frames */
174 #define LCP_OPT_MP_MRRU 17 /* multilink MRRU */
175 #define LCP_OPT_MP_SSNHF 18 /* multilink short seq. numbers */
176 #define LCP_OPT_MP_EID 19 /* multilink endpoint discriminator */
177
178 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */
179 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol */
180 #define IPCP_OPT_ADDRESS 3 /* local IP address */
181 #define IPCP_OPT_PRIMDNS 129 /* primary remote dns address */
182 #define IPCP_OPT_SECDNS 131 /* secondary remote dns address */
183
184 #define IPCP_UPDATE_LIMIT 8 /* limit of pending IP updating job */
185 #define IPCP_SET_ADDRS 1 /* marker for IP address setting job */
186 #define IPCP_CLEAR_ADDRS 2 /* marker for IP address clearing job */
187
188 #define IPV6CP_OPT_IFID 1 /* interface identifier */
189 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */
190
191 #define PAP_REQ 1 /* PAP name/password request */
192 #define PAP_ACK 2 /* PAP acknowledge */
193 #define PAP_NAK 3 /* PAP fail */
194
195 #define CHAP_CHALLENGE 1 /* CHAP challenge request */
196 #define CHAP_RESPONSE 2 /* CHAP challenge response */
197 #define CHAP_SUCCESS 3 /* CHAP response ok */
198 #define CHAP_FAILURE 4 /* CHAP response failed */
199
200 #define CHAP_MD5 5 /* hash algorithm - MD5 */
201
202 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */
203 #define CISCO_UNICAST 0x0f /* Cisco unicast address */
204 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */
205 #define CISCO_ADDR_REQ 0 /* Cisco address request */
206 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */
207 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */
208
209 #define PPP_NOPROTO 0 /* no authentication protocol */
210
211 enum {
212 STATE_INITIAL = SPPP_STATE_INITIAL,
213 STATE_STARTING = SPPP_STATE_STARTING,
214 STATE_CLOSED = SPPP_STATE_CLOSED,
215 STATE_STOPPED = SPPP_STATE_STOPPED,
216 STATE_CLOSING = SPPP_STATE_CLOSING,
217 STATE_STOPPING = SPPP_STATE_STOPPING,
218 STATE_REQ_SENT = SPPP_STATE_REQ_SENT,
219 STATE_ACK_RCVD = SPPP_STATE_ACK_RCVD,
220 STATE_ACK_SENT = SPPP_STATE_ACK_SENT,
221 STATE_OPENED = SPPP_STATE_OPENED,
222 };
223
224 enum cp_rcr_type {
225 CP_RCR_NONE = 0, /* initial value */
226 CP_RCR_ACK, /* RCR+ */
227 CP_RCR_NAK, /* RCR- */
228 CP_RCR_REJ, /* RCR- */
229 CP_RCR_DROP, /* DROP message */
230 CP_RCR_ERR, /* internal error */
231 };
232
233 struct ppp_header {
234 uint8_t address;
235 uint8_t control;
236 uint16_t protocol;
237 } __packed;
238 #define PPP_HEADER_LEN sizeof (struct ppp_header)
239
240 struct lcp_header {
241 uint8_t type;
242 uint8_t ident;
243 uint16_t len;
244 } __packed;
245 #define LCP_HEADER_LEN sizeof (struct lcp_header)
246
247 struct cisco_packet {
248 uint32_t type;
249 uint32_t par1;
250 uint32_t par2;
251 uint16_t rel;
252 uint16_t time0;
253 uint16_t time1;
254 } __packed;
255 #define CISCO_PACKET_LEN 18
256
257 /*
258 * We follow the spelling and capitalization of RFC 1661 here, to make
259 * it easier comparing with the standard. Please refer to this RFC in
260 * case you can't make sense out of these abbreviation; it will also
261 * explain the semantics related to the various events and actions.
262 */
263 struct cp {
264 u_short proto; /* PPP control protocol number */
265 u_char protoidx; /* index into state table in struct sppp */
266 u_char flags;
267 #define CP_LCP 0x01 /* this is the LCP */
268 #define CP_AUTH 0x02 /* this is an authentication protocol */
269 #define CP_NCP 0x04 /* this is a NCP */
270 #define CP_QUAL 0x08 /* this is a quality reporting protocol */
271 const char *name; /* name of this control protocol */
272 /* event handlers */
273 void (*Up)(struct sppp *, void *);
274 void (*Down)(struct sppp *, void *);
275 void (*Open)(struct sppp *, void *);
276 void (*Close)(struct sppp *, void *);
277 void (*TO)(struct sppp *, void *);
278 /* actions */
279 void (*tlu)(struct sppp *);
280 void (*tld)(struct sppp *);
281 void (*tls)(const struct cp *, struct sppp *);
282 void (*tlf)(const struct cp *, struct sppp *);
283 void (*scr)(struct sppp *);
284 void (*screply)(const struct cp *, struct sppp *, u_char,
285 uint8_t, size_t, void *);
286
287 /* message parser */
288 enum cp_rcr_type
289 (*parse_confreq)(struct sppp *, struct lcp_header *, int,
290 uint8_t **, size_t *, size_t *);
291 void (*parse_confrej)(struct sppp *, struct lcp_header *, int);
292 void (*parse_confnak)(struct sppp *, struct lcp_header *, int);
293 };
294
295 enum auth_role {
296 SPPP_AUTH_NOROLE = 0,
297 SPPP_AUTH_SERV = __BIT(0),
298 SPPP_AUTH_PEER = __BIT(1),
299 };
300
301 static struct sppp *spppq;
302 static kmutex_t *spppq_lock = NULL;
303 static callout_t keepalive_ch;
304 static unsigned int sppp_keepalive_cnt = 0;
305
306 pktq_rps_hash_func_t sppp_pktq_rps_hash_p;
307
308 #define SPPPQ_LOCK() if (spppq_lock) \
309 mutex_enter(spppq_lock);
310 #define SPPPQ_UNLOCK() if (spppq_lock) \
311 mutex_exit(spppq_lock);
312
313 #define SPPP_LOCK(_sp, _op) rw_enter(&(_sp)->pp_lock, (_op))
314 #define SPPP_UNLOCK(_sp) rw_exit(&(_sp)->pp_lock)
315 #define SPPP_WLOCKED(_sp) rw_write_held(&(_sp)->pp_lock)
316 #define SPPP_UPGRADE(_sp) do{ \
317 SPPP_UNLOCK(_sp); \
318 SPPP_LOCK(_sp, RW_WRITER); \
319 }while (0)
320 #define SPPP_DOWNGRADE(_sp) rw_downgrade(&(_sp)->pp_lock)
321 #define SPPP_WQ_SET(_wk, _func, _arg) \
322 sppp_wq_set((_wk), (_func), __UNCONST((_arg)))
323 #define SPPP_LOG(_sp, _lvl, _fmt, _args...) do { \
324 if (__predict_true((_sp) != NULL)) { \
325 log((_lvl), "%s: ", (_sp)->pp_if.if_xname); \
326 } \
327 addlog((_fmt), ##_args); \
328 } while (0)
329 #define SPPP_DLOG(_sp, _fmt, _args...) do { \
330 if (!sppp_debug_enabled(_sp)) \
331 break; \
332 SPPP_LOG(_sp, LOG_DEBUG, _fmt, ##_args); \
333 } while (0)
334
335 #ifdef INET
336 #ifndef SPPPSUBR_MPSAFE
337 /*
338 * The following disgusting hack gets around the problem that IP TOS
339 * can't be set yet. We want to put "interactive" traffic on a high
340 * priority queue. To decide if traffic is interactive, we check that
341 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
342 *
343 * XXX is this really still necessary? - joerg -
344 */
345 static u_short interactive_ports[8] = {
346 0, 513, 0, 0,
347 0, 21, 0, 23,
348 };
349 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
350 #endif /* SPPPSUBR_MPSAFE */
351 #endif
352
353 /* almost every function needs these */
354
355 static bool sppp_debug_enabled(struct sppp *sp);
356 static int sppp_output(struct ifnet *, struct mbuf *,
357 const struct sockaddr *, const struct rtentry *);
358
359 static void sppp_cp_init(const struct cp *, struct sppp *);
360 static void sppp_cp_fini(const struct cp *, struct sppp *);
361 static void sppp_cp_input(const struct cp *, struct sppp *,
362 struct mbuf *);
363 static void sppp_cp_input(const struct cp *, struct sppp *,
364 struct mbuf *);
365 static void sppp_cp_send(struct sppp *, u_short, u_char,
366 u_char, u_short, void *);
367 /* static void sppp_cp_timeout(void *arg); */
368 static void sppp_cp_change_state(const struct cp *, struct sppp *, int);
369 static struct workqueue *
370 sppp_wq_create(struct sppp *, const char *, pri_t, int, int);
371 static void sppp_wq_destroy(struct sppp *, struct workqueue *);
372 static void sppp_wq_set(struct sppp_work *,
373 void (*)(struct sppp *, void *), void *);
374 static void sppp_wq_add(struct workqueue *, struct sppp_work *);
375 static void sppp_wq_wait(struct workqueue *, struct sppp_work *);
376 static void sppp_cp_to_lcp(void *);
377 static void sppp_cp_to_ipcp(void *);
378 static void sppp_cp_to_ipv6cp(void *);
379 static void sppp_auth_send(const struct cp *, struct sppp *,
380 unsigned int, unsigned int, ...);
381 static int sppp_auth_role(const struct cp *, struct sppp *);
382 static void sppp_auth_to_event(struct sppp *, void *);
383 static void sppp_auth_screply(const struct cp *, struct sppp *,
384 u_char, uint8_t, size_t, void *);
385 static void sppp_up_event(struct sppp *, void *);
386 static void sppp_down_event(struct sppp *, void *);
387 static void sppp_open_event(struct sppp *, void *);
388 static void sppp_close_event(struct sppp *, void *);
389 static void sppp_to_event(struct sppp *, void *);
390 static void sppp_rcr_event(struct sppp *, void *);
391 static void sppp_rca_event(struct sppp *, void *);
392 static void sppp_rcn_event(struct sppp *, void *);
393 static void sppp_rtr_event(struct sppp *, void *);
394 static void sppp_rta_event(struct sppp *, void *);
395 static void sppp_rxj_event(struct sppp *, void *);
396
397 static void sppp_null(struct sppp *);
398 static void sppp_tls(const struct cp *, struct sppp *);
399 static void sppp_tlf(const struct cp *, struct sppp *);
400 static void sppp_screply(const struct cp *, struct sppp *,
401 u_char, uint8_t, size_t, void *);
402 static void sppp_ifdown(struct sppp *, void *);
403
404 static void sppp_lcp_init(struct sppp *);
405 static void sppp_lcp_up(struct sppp *, void *);
406 static void sppp_lcp_down(struct sppp *, void *);
407 static void sppp_lcp_open(struct sppp *, void *);
408 static enum cp_rcr_type
409 sppp_lcp_confreq(struct sppp *, struct lcp_header *, int,
410 uint8_t **, size_t *, size_t *);
411 static void sppp_lcp_confrej(struct sppp *, struct lcp_header *, int);
412 static void sppp_lcp_confnak(struct sppp *, struct lcp_header *, int);
413 static void sppp_lcp_tlu(struct sppp *);
414 static void sppp_lcp_tld(struct sppp *);
415 static void sppp_lcp_tls(const struct cp *, struct sppp *);
416 static void sppp_lcp_tlf(const struct cp *, struct sppp *);
417 static void sppp_lcp_scr(struct sppp *);
418 static void sppp_lcp_check_and_close(struct sppp *);
419 static int sppp_cp_check(struct sppp *, u_char);
420
421 static void sppp_ipcp_init(struct sppp *);
422 static void sppp_ipcp_open(struct sppp *, void *);
423 static void sppp_ipcp_close(struct sppp *, void *);
424 static enum cp_rcr_type
425 sppp_ipcp_confreq(struct sppp *, struct lcp_header *, int,
426 uint8_t **, size_t *, size_t *);
427 static void sppp_ipcp_confrej(struct sppp *, struct lcp_header *, int);
428 static void sppp_ipcp_confnak(struct sppp *, struct lcp_header *, int);
429 static void sppp_ipcp_tlu(struct sppp *);
430 static void sppp_ipcp_tld(struct sppp *);
431 static void sppp_ipcp_scr(struct sppp *);
432
433 static void sppp_ipv6cp_init(struct sppp *);
434 static void sppp_ipv6cp_open(struct sppp *, void *);
435 static enum cp_rcr_type
436 sppp_ipv6cp_confreq(struct sppp *, struct lcp_header *, int,
437 uint8_t **, size_t *, size_t *);
438 static void sppp_ipv6cp_confrej(struct sppp *, struct lcp_header *, int);
439 static void sppp_ipv6cp_confnak(struct sppp *, struct lcp_header *, int);
440 static void sppp_ipv6cp_tlu(struct sppp *);
441 static void sppp_ipv6cp_tld(struct sppp *);
442 static void sppp_ipv6cp_scr(struct sppp *);
443
444 static void sppp_pap_input(struct sppp *, struct mbuf *);
445 static void sppp_pap_init(struct sppp *);
446 static void sppp_pap_tlu(struct sppp *);
447 static void sppp_pap_scr(struct sppp *);
448 static void sppp_pap_scr(struct sppp *);
449
450 static void sppp_chap_input(struct sppp *, struct mbuf *);
451 static void sppp_chap_init(struct sppp *);
452 static void sppp_chap_open(struct sppp *, void *);
453 static void sppp_chap_tlu(struct sppp *);
454 static void sppp_chap_scr(struct sppp *);
455 static void sppp_chap_rcv_challenge_event(struct sppp *, void *);
456
457 static const char *sppp_auth_type_name(char *, size_t, u_short, u_char);
458 static const char *sppp_cp_type_name(char *, size_t, u_char);
459 static const char *sppp_dotted_quad(char *, size_t, uint32_t);
460 static const char *sppp_ipcp_opt_name(char *, size_t, u_char);
461 #ifdef INET6
462 static const char *sppp_ipv6cp_opt_name(char *, size_t, u_char);
463 #endif
464 static const char *sppp_lcp_opt_name(char *, size_t, u_char);
465 static const char *sppp_phase_name(int);
466 static const char *sppp_proto_name(char *, size_t, u_short);
467 static const char *sppp_state_name(int);
468 static int sppp_params(struct sppp *, u_long, void *);
469 #ifdef INET
470 static void sppp_get_ip_addrs(struct sppp *, uint32_t *, uint32_t *, uint32_t *);
471 static void sppp_set_ip_addrs(struct sppp *);
472 static void sppp_clear_ip_addrs(struct sppp *);
473 #endif
474 static void sppp_keepalive(void *);
475 static void sppp_phase_network(struct sppp *);
476 static void sppp_print_bytes(const u_char *, u_short);
477 static void sppp_print_string(const char *, u_short);
478 #ifdef INET6
479 static void sppp_get_ip6_addrs(struct sppp *, struct in6_addr *,
480 struct in6_addr *, struct in6_addr *);
481 #ifdef IPV6CP_MYIFID_DYN
482 static void sppp_set_ip6_addr(struct sppp *, const struct in6_addr *);
483 static void sppp_gen_ip6_addr(struct sppp *, const struct in6_addr *);
484 #endif
485 static void sppp_suggest_ip6_addr(struct sppp *, struct in6_addr *);
486 #endif
487
488 static void sppp_notify_up(struct sppp *);
489 static void sppp_notify_down(struct sppp *);
490 static void sppp_notify_tls_wlocked(struct sppp *);
491 static void sppp_notify_tlf_wlocked(struct sppp *);
492 #ifdef INET6
493 static void sppp_notify_con_wlocked(struct sppp *);
494 #endif
495 static void sppp_notify_con(struct sppp *);
496
497 static void sppp_notify_chg_wlocked(struct sppp *);
498
499 /* our control protocol descriptors */
500 static const struct cp lcp = {
501 PPP_LCP, IDX_LCP, CP_LCP, "lcp",
502 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open,
503 sppp_close_event, sppp_to_event,
504 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls,
505 sppp_lcp_tlf, sppp_lcp_scr, sppp_screply,
506 sppp_lcp_confreq, sppp_lcp_confrej, sppp_lcp_confnak
507 };
508
509 static const struct cp ipcp = {
510 PPP_IPCP, IDX_IPCP,
511 #ifdef INET
512 CP_NCP, /*don't run IPCP if there's no IPv4 support*/
513 #else
514 0,
515 #endif
516 "ipcp",
517 sppp_up_event, sppp_down_event, sppp_ipcp_open,
518 sppp_ipcp_close, sppp_to_event,
519 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_tls,
520 sppp_tlf, sppp_ipcp_scr, sppp_screply,
521 sppp_ipcp_confreq, sppp_ipcp_confrej, sppp_ipcp_confnak,
522 };
523
524 static const struct cp ipv6cp = {
525 PPP_IPV6CP, IDX_IPV6CP,
526 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/
527 CP_NCP,
528 #else
529 0,
530 #endif
531 "ipv6cp",
532 sppp_up_event, sppp_down_event, sppp_ipv6cp_open,
533 sppp_close_event, sppp_to_event,
534 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_tls,
535 sppp_tlf, sppp_ipv6cp_scr, sppp_screply,
536 sppp_ipv6cp_confreq, sppp_ipv6cp_confrej, sppp_ipv6cp_confnak,
537 };
538
539 static const struct cp pap = {
540 PPP_PAP, IDX_PAP, CP_AUTH, "pap",
541 sppp_up_event, sppp_down_event, sppp_open_event,
542 sppp_close_event, sppp_auth_to_event,
543 sppp_pap_tlu, sppp_null, sppp_tls, sppp_tlf,
544 sppp_pap_scr, sppp_auth_screply,
545 NULL, NULL, NULL
546 };
547
548 static const struct cp chap = {
549 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
550 sppp_up_event, sppp_down_event, sppp_chap_open,
551 sppp_close_event, sppp_auth_to_event,
552 sppp_chap_tlu, sppp_null, sppp_tls, sppp_tlf,
553 sppp_chap_scr, sppp_auth_screply,
554 NULL, NULL, NULL
555 };
556
557 static const struct cp *cps[IDX_COUNT] = {
558 &lcp, /* IDX_LCP */
559 &ipcp, /* IDX_IPCP */
560 &ipv6cp, /* IDX_IPV6CP */
561 &pap, /* IDX_PAP */
562 &chap, /* IDX_CHAP */
563 };
564
565 static inline u_int
sppp_proto2authproto(u_short proto)566 sppp_proto2authproto(u_short proto)
567 {
568
569 switch (proto) {
570 case PPP_PAP:
571 return SPPP_AUTHPROTO_PAP;
572 case PPP_CHAP:
573 return SPPP_AUTHPROTO_CHAP;
574 }
575
576 return SPPP_AUTHPROTO_NONE;
577 }
578
579 static inline u_short
sppp_authproto2proto(u_int authproto)580 sppp_authproto2proto(u_int authproto)
581 {
582
583 switch (authproto) {
584 case SPPP_AUTHPROTO_PAP:
585 return PPP_PAP;
586 case SPPP_AUTHPROTO_CHAP:
587 return PPP_CHAP;
588 }
589
590 return PPP_NOPROTO;
591 }
592
593 static inline bool
sppp_debug_enabled(struct sppp * sp)594 sppp_debug_enabled(struct sppp *sp)
595 {
596
597 if (__predict_false(sp == NULL))
598 return false;
599
600 if ((sp->pp_if.if_flags & IFF_DEBUG) == 0)
601 return false;
602
603 return true;
604 }
605
606 static void
sppp_change_phase(struct sppp * sp,int phase)607 sppp_change_phase(struct sppp *sp, int phase)
608 {
609 struct ifnet *ifp;
610
611 KASSERT(SPPP_WLOCKED(sp));
612
613 ifp = &sp->pp_if;
614
615 if (sp->pp_phase == phase)
616 return;
617
618 sp->pp_phase = phase;
619
620 if (phase == SPPP_PHASE_NETWORK)
621 if_link_state_change(ifp, LINK_STATE_UP);
622 else
623 if_link_state_change(ifp, LINK_STATE_DOWN);
624
625 SPPP_DLOG(sp, "phase %s\n",
626 sppp_phase_name(sp->pp_phase));
627 }
628
629 /*
630 * Exported functions, comprising our interface to the lower layer.
631 */
632
633 /*
634 * Process the received packet.
635 */
636 void
sppp_input(struct ifnet * ifp,struct mbuf * m)637 sppp_input(struct ifnet *ifp, struct mbuf *m)
638 {
639 struct ppp_header *h = NULL;
640 pktqueue_t *pktq = NULL;
641 uint16_t protocol;
642 struct sppp *sp = (struct sppp *)ifp;
643
644 /* No RPS for not-IP. */
645 pktq_rps_hash_func_t rps_hash = NULL;
646
647 SPPP_LOCK(sp, RW_READER);
648
649 if (ifp->if_flags & IFF_UP) {
650 /* Count received bytes, add hardware framing */
651 if_statadd(ifp, if_ibytes, m->m_pkthdr.len + sp->pp_framebytes);
652 /* Note time of last receive */
653 sp->pp_last_receive = time_uptime;
654 }
655
656 if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
657 /* Too small packet, drop it. */
658 SPPP_DLOG(sp, "input packet is too small, "
659 "%d bytes\n", m->m_pkthdr.len);
660 goto drop;
661 }
662
663 if (sp->pp_flags & PP_NOFRAMING) {
664 memcpy(&protocol, mtod(m, void *), 2);
665 protocol = ntohs(protocol);
666 m_adj(m, 2);
667 } else {
668
669 /* Get PPP header. */
670 h = mtod(m, struct ppp_header *);
671 m_adj(m, PPP_HEADER_LEN);
672
673 switch (h->address) {
674 case PPP_ALLSTATIONS:
675 if (h->control != PPP_UI)
676 goto invalid;
677 break;
678 case CISCO_MULTICAST:
679 case CISCO_UNICAST:
680 /* Don't check the control field here (RFC 1547). */
681 SPPP_DLOG(sp, "Cisco packet in PPP mode "
682 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
683 h->address, h->control, ntohs(h->protocol));
684 goto drop;
685 default: /* Invalid PPP packet. */
686 invalid:
687 SPPP_DLOG(sp, "invalid input packet "
688 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
689 h->address, h->control, ntohs(h->protocol));
690 goto drop;
691 }
692 protocol = ntohs(h->protocol);
693 }
694
695 switch (protocol) {
696 reject_protocol:
697 if (sp->scp[IDX_LCP].state == STATE_OPENED) {
698 uint16_t prot = htons(protocol);
699
700 SPPP_UPGRADE(sp);
701 sppp_cp_send(sp, PPP_LCP, PROTO_REJ,
702 ++sp->scp[IDX_LCP].seq, m->m_pkthdr.len + 2,
703 &prot);
704 SPPP_DOWNGRADE(sp);
705 }
706 if_statinc(ifp, if_noproto);
707 goto drop;
708 default:
709 SPPP_DLOG(sp, "invalid input protocol "
710 "<proto=0x%x>\n", protocol);
711 goto reject_protocol;
712 case PPP_LCP:
713 SPPP_UNLOCK(sp);
714 sppp_cp_input(&lcp, sp, m);
715 /* already m_freem(m) */
716 return;
717 case PPP_PAP:
718 SPPP_UNLOCK(sp);
719 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
720 sppp_pap_input(sp, m);
721 }
722 m_freem(m);
723 return;
724 case PPP_CHAP:
725 SPPP_UNLOCK(sp);
726 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
727 sppp_chap_input(sp, m);
728 }
729 m_freem(m);
730 return;
731 #ifdef INET
732 case PPP_IPCP:
733 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) {
734 SPPP_LOG(sp, LOG_INFO, "reject IPCP packet "
735 "because IPCP is disabled\n");
736 goto reject_protocol;
737 }
738 SPPP_UNLOCK(sp);
739 if (sp->pp_phase == SPPP_PHASE_NETWORK) {
740 sppp_cp_input(&ipcp, sp, m);
741 /* already m_freem(m) */
742 } else {
743 m_freem(m);
744 }
745 return;
746 case PPP_IP:
747 if (sp->scp[IDX_IPCP].state == STATE_OPENED) {
748 sp->pp_last_activity = time_uptime;
749 pktq = ip_pktq;
750 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p);
751 }
752 break;
753 #endif
754 #ifdef INET6
755 case PPP_IPV6CP:
756 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP)) {
757 SPPP_LOG(sp, LOG_INFO, "reject IPv6CP packet "
758 "because IPv6CP is disabled\n");
759 goto reject_protocol;
760 }
761 SPPP_UNLOCK(sp);
762 if (sp->pp_phase == SPPP_PHASE_NETWORK) {
763 sppp_cp_input(&ipv6cp, sp, m);
764 /* already m_freem(m) */
765 } else {
766 m_freem(m);
767 }
768 return;
769
770 case PPP_IPV6:
771 if (sp->scp[IDX_IPV6CP].state == STATE_OPENED) {
772 sp->pp_last_activity = time_uptime;
773 pktq = ip6_pktq;
774 rps_hash = atomic_load_relaxed(&sppp_pktq_rps_hash_p);
775 }
776 break;
777 #endif
778 }
779
780 if ((ifp->if_flags & IFF_UP) == 0 || pktq == NULL) {
781 goto drop;
782 }
783
784 /* Check queue. */
785 const uint32_t hash = rps_hash ? pktq_rps_hash(&rps_hash, m) : 0;
786 if (__predict_false(!pktq_enqueue(pktq, m, hash))) {
787 goto drop;
788 }
789 SPPP_UNLOCK(sp);
790 return;
791
792 drop:
793 if_statadd2(ifp, if_ierrors, 1, if_iqdrops, 1);
794 m_freem(m);
795 SPPP_UNLOCK(sp);
796 return;
797 }
798
799 /*
800 * Enqueue transmit packet.
801 */
802 static int
sppp_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,const struct rtentry * rt)803 sppp_output(struct ifnet *ifp, struct mbuf *m,
804 const struct sockaddr *dst, const struct rtentry *rt)
805 {
806 struct sppp *sp = (struct sppp *) ifp;
807 struct ppp_header *h = NULL;
808 #ifndef SPPPSUBR_MPSAFE
809 struct ifqueue *ifq = NULL; /* XXX */
810 #endif
811 int s, error = 0;
812 uint16_t protocol;
813 size_t pktlen;
814
815 s = splnet();
816 SPPP_LOCK(sp, RW_READER);
817
818 sp->pp_last_activity = time_uptime;
819
820 if ((ifp->if_flags & IFF_UP) == 0 ||
821 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
822 SPPP_UNLOCK(sp);
823 splx(s);
824
825 m_freem(m);
826 if_statinc(ifp, if_oerrors);
827 return (ENETDOWN);
828 }
829
830 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
831 /* ignore packets that have no enabled NCP */
832 if ((dst->sa_family == AF_INET &&
833 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP)) ||
834 (dst->sa_family == AF_INET6 &&
835 !ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))) {
836 SPPP_UNLOCK(sp);
837 splx(s);
838
839 m_freem(m);
840 if_statinc(ifp, if_oerrors);
841 return (ENETDOWN);
842 }
843 /*
844 * Interface is not yet running, but auto-dial. Need
845 * to start LCP for it.
846 */
847 ifp->if_flags |= IFF_RUNNING;
848 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open);
849 }
850
851 /*
852 * If the queueing discipline needs packet classification,
853 * do it before prepending link headers.
854 */
855 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family);
856
857 #ifdef INET
858 if (dst->sa_family == AF_INET) {
859 struct ip *ip = NULL;
860 #ifndef SPPPSUBR_MPSAFE
861 struct tcphdr *th = NULL;
862 #endif
863
864 if (m->m_len >= sizeof(struct ip)) {
865 ip = mtod(m, struct ip *);
866 #ifndef SPPPSUBR_MPSAFE
867 if (ip->ip_p == IPPROTO_TCP &&
868 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
869 sizeof(struct tcphdr)) {
870 th = (struct tcphdr *)
871 ((char *)ip + (ip->ip_hl << 2));
872 }
873 #endif
874 } else
875 ip = NULL;
876
877 /*
878 * When using dynamic local IP address assignment by using
879 * 0.0.0.0 as a local address, the first TCP session will
880 * not connect because the local TCP checksum is computed
881 * using 0.0.0.0 which will later become our real IP address
882 * so the TCP checksum computed at the remote end will
883 * become invalid. So we
884 * - don't let packets with src ip addr 0 thru
885 * - we flag TCP packets with src ip 0 as an error
886 */
887 if (ip && ip->ip_src.s_addr == INADDR_ANY) {
888 uint8_t proto = ip->ip_p;
889
890 SPPP_UNLOCK(sp);
891 splx(s);
892
893 m_freem(m);
894 if (proto == IPPROTO_TCP)
895 return (EADDRNOTAVAIL);
896 else
897 return (0);
898 }
899
900 #ifndef SPPPSUBR_MPSAFE
901 /*
902 * Put low delay, telnet, rlogin and ftp control packets
903 * in front of the queue.
904 */
905 if (!IF_QFULL(&sp->pp_fastq) &&
906 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
907 (th && (INTERACTIVE(ntohs(th->th_sport)) ||
908 INTERACTIVE(ntohs(th->th_dport))))))
909 ifq = &sp->pp_fastq;
910 #endif /* !SPPPSUBR_MPSAFE */
911 }
912 #endif
913
914 #ifdef INET6
915 if (dst->sa_family == AF_INET6) {
916 /* XXX do something tricky here? */
917 }
918 #endif
919
920 if ((sp->pp_flags & PP_NOFRAMING) == 0) {
921 /*
922 * Prepend general data packet PPP header. For now, IP only.
923 */
924 M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT);
925 if (! m) {
926 SPPP_DLOG(sp, "no memory for transmit header\n");
927 if_statinc(ifp, if_oerrors);
928 SPPP_UNLOCK(sp);
929 splx(s);
930 return (ENOBUFS);
931 }
932 /*
933 * May want to check size of packet
934 * (albeit due to the implementation it's always enough)
935 */
936 h = mtod(m, struct ppp_header *);
937 h->address = PPP_ALLSTATIONS; /* broadcast address */
938 h->control = PPP_UI; /* Unnumbered Info */
939 }
940
941 switch (dst->sa_family) {
942 #ifdef INET
943 case AF_INET: /* Internet Protocol */
944 /*
945 * Don't choke with an ENETDOWN early. It's
946 * possible that we just started dialing out,
947 * so don't drop the packet immediately. If
948 * we notice that we run out of buffer space
949 * below, we will however remember that we are
950 * not ready to carry IP packets, and return
951 * ENETDOWN, as opposed to ENOBUFS.
952 */
953 protocol = htons(PPP_IP);
954 if (sp->scp[IDX_IPCP].state != STATE_OPENED) {
955 if (ifp->if_flags & IFF_AUTO) {
956 error = ENETDOWN;
957 } else {
958 IF_DROP(&ifp->if_snd);
959 SPPP_UNLOCK(sp);
960 splx(s);
961
962 m_freem(m);
963 if_statinc(ifp, if_oerrors);
964 return (ENETDOWN);
965 }
966 }
967 break;
968 #endif
969 #ifdef INET6
970 case AF_INET6: /* Internet Protocol version 6 */
971 /*
972 * Don't choke with an ENETDOWN early. It's
973 * possible that we just started dialing out,
974 * so don't drop the packet immediately. If
975 * we notice that we run out of buffer space
976 * below, we will however remember that we are
977 * not ready to carry IP packets, and return
978 * ENETDOWN, as opposed to ENOBUFS.
979 */
980 protocol = htons(PPP_IPV6);
981 if (sp->scp[IDX_IPV6CP].state != STATE_OPENED) {
982 if (ifp->if_flags & IFF_AUTO) {
983 error = ENETDOWN;
984 } else {
985 IF_DROP(&ifp->if_snd);
986 SPPP_UNLOCK(sp);
987 splx(s);
988
989 m_freem(m);
990 if_statinc(ifp, if_oerrors);
991 return (ENETDOWN);
992 }
993 }
994 break;
995 #endif
996 default:
997 m_freem(m);
998 if_statinc(ifp, if_oerrors);
999 SPPP_UNLOCK(sp);
1000 splx(s);
1001 return (EAFNOSUPPORT);
1002 }
1003
1004 if (sp->pp_flags & PP_NOFRAMING) {
1005 M_PREPEND(m, 2, M_DONTWAIT);
1006 if (m == NULL) {
1007 SPPP_DLOG(sp, "no memory for transmit header\n");
1008 if_statinc(ifp, if_oerrors);
1009 SPPP_UNLOCK(sp);
1010 splx(s);
1011 return (ENOBUFS);
1012 }
1013 *mtod(m, uint16_t *) = protocol;
1014 } else {
1015 h->protocol = protocol;
1016 }
1017
1018 pktlen = m->m_pkthdr.len;
1019 #ifdef SPPPSUBR_MPSAFE
1020 SPPP_UNLOCK(sp);
1021 error = if_transmit_lock(ifp, m);
1022 SPPP_LOCK(sp, RW_READER);
1023 if (error == 0)
1024 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes);
1025 #else /* !SPPPSUBR_MPSAFE */
1026 error = ifq_enqueue2(ifp, ifq, m);
1027
1028 if (error == 0) {
1029 /*
1030 * Count output packets and bytes.
1031 * The packet length includes header + additional hardware
1032 * framing according to RFC 1333.
1033 */
1034 if (!(ifp->if_flags & IFF_OACTIVE)) {
1035 SPPP_UNLOCK(sp);
1036 if_start_lock(ifp);
1037 SPPP_LOCK(sp, RW_READER);
1038 }
1039 if_statadd(ifp, if_obytes, pktlen + sp->pp_framebytes);
1040 }
1041 #endif /* !SPPPSUBR_MPSAFE */
1042 SPPP_UNLOCK(sp);
1043 splx(s);
1044 return error;
1045 }
1046
1047 void
sppp_attach(struct ifnet * ifp)1048 sppp_attach(struct ifnet *ifp)
1049 {
1050 struct sppp *sp = (struct sppp *) ifp;
1051 char xnamebuf[MAXCOMLEN];
1052
1053 /* Initialize keepalive handler. */
1054 if (! spppq) {
1055 callout_init(&keepalive_ch, CALLOUT_MPSAFE);
1056 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
1057 }
1058
1059 if (! spppq_lock)
1060 spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET);
1061
1062 sp->pp_if.if_type = IFT_PPP;
1063 sp->pp_if.if_output = sppp_output;
1064 IFQ_SET_MAXLEN(&sp->pp_fastq, 32);
1065 IFQ_LOCK_INIT(&sp->pp_fastq);
1066 IFQ_SET_MAXLEN(&sp->pp_cpq, 20);
1067 sp->pp_loopcnt = 0;
1068 sp->pp_alivecnt = 0;
1069 sp->pp_alive_interval = SPPP_ALIVE_INTERVAL;
1070 sp->pp_last_activity = 0;
1071 sp->pp_last_receive = 0;
1072 sp->pp_maxalive = DEFAULT_MAXALIVECNT;
1073 sp->pp_max_noreceive = SPPP_NORECV_TIME;
1074 sp->pp_idle_timeout = 0;
1075 sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES;
1076 sp->pp_phase = SPPP_PHASE_DEAD;
1077 sp->pp_up = sppp_notify_up;
1078 sp->pp_down = sppp_notify_down;
1079 sp->pp_ncpflags = SPPP_NCP_IPCP | SPPP_NCP_IPV6CP;
1080 #ifdef SPPP_IFDOWN_RECONNECT
1081 sp->pp_flags |= PP_LOOPBACK_IFDOWN | PP_KEEPALIVE_IFDOWN;
1082 #endif
1083 sppp_wq_set(&sp->work_ifdown, sppp_ifdown, NULL);
1084 memset(sp->scp, 0, sizeof(sp->scp));
1085 rw_init(&sp->pp_lock);
1086
1087 if_alloc_sadl(ifp);
1088
1089 /* Lets not beat about the bush, we know we're down. */
1090 if_link_state_change(ifp, LINK_STATE_DOWN);
1091
1092 snprintf(xnamebuf, sizeof(xnamebuf), "%s.wq_cp", ifp->if_xname);
1093 sp->wq_cp = sppp_wq_create(sp, xnamebuf,
1094 PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
1095
1096 memset(&sp->myauth, 0, sizeof sp->myauth);
1097 memset(&sp->hisauth, 0, sizeof sp->hisauth);
1098 SPPP_LOCK(sp, RW_WRITER);
1099 sppp_lcp_init(sp);
1100 sppp_ipcp_init(sp);
1101 sppp_ipv6cp_init(sp);
1102 sppp_pap_init(sp);
1103 sppp_chap_init(sp);
1104 SPPP_UNLOCK(sp);
1105
1106 SPPPQ_LOCK();
1107 /* Insert new entry into the keepalive list. */
1108 sp->pp_next = spppq;
1109 spppq = sp;
1110 SPPPQ_UNLOCK();
1111 }
1112
1113 void
sppp_detach(struct ifnet * ifp)1114 sppp_detach(struct ifnet *ifp)
1115 {
1116 struct sppp **q, *p, *sp = (struct sppp *) ifp;
1117
1118 /* Remove the entry from the keepalive list. */
1119 SPPPQ_LOCK();
1120 for (q = &spppq; (p = *q); q = &p->pp_next)
1121 if (p == sp) {
1122 *q = p->pp_next;
1123 break;
1124 }
1125 SPPPQ_UNLOCK();
1126
1127 if (! spppq) {
1128 /* Stop keepalive handler. */
1129 callout_stop(&keepalive_ch);
1130 mutex_obj_free(spppq_lock);
1131 spppq_lock = NULL;
1132 }
1133
1134 sppp_cp_fini(&lcp, sp);
1135 sppp_cp_fini(&ipcp, sp);
1136 sppp_cp_fini(&pap, sp);
1137 sppp_cp_fini(&chap, sp);
1138 #ifdef INET6
1139 sppp_cp_fini(&ipv6cp, sp);
1140 #endif
1141 sppp_wq_destroy(sp, sp->wq_cp);
1142
1143 /* free authentication info */
1144 if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF);
1145 if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF);
1146 if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF);
1147 if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF);
1148
1149 IFQ_LOCK_DESTROY(&sp->pp_fastq);
1150 rw_destroy(&sp->pp_lock);
1151 }
1152
1153 /*
1154 * Flush the interface output queue.
1155 */
1156 void
sppp_flush(struct ifnet * ifp)1157 sppp_flush(struct ifnet *ifp)
1158 {
1159 struct sppp *sp = (struct sppp *) ifp;
1160
1161 SPPP_LOCK(sp, RW_WRITER);
1162 IFQ_PURGE(&sp->pp_if.if_snd);
1163 IF_PURGE(&sp->pp_fastq);
1164 IF_PURGE(&sp->pp_cpq);
1165 SPPP_UNLOCK(sp);
1166 }
1167
1168 /*
1169 * Check if the output queue is empty.
1170 */
1171 int
sppp_isempty(struct ifnet * ifp)1172 sppp_isempty(struct ifnet *ifp)
1173 {
1174 struct sppp *sp = (struct sppp *) ifp;
1175 int empty, s;
1176
1177 s = splnet();
1178 SPPP_LOCK(sp, RW_READER);
1179 empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) &&
1180 IFQ_IS_EMPTY(&sp->pp_if.if_snd);
1181 SPPP_UNLOCK(sp);
1182 splx(s);
1183 return (empty);
1184 }
1185
1186 /*
1187 * Get next packet to send.
1188 */
1189 struct mbuf *
sppp_dequeue(struct ifnet * ifp)1190 sppp_dequeue(struct ifnet *ifp)
1191 {
1192 struct sppp *sp = (struct sppp *) ifp;
1193 struct mbuf *m;
1194 int s;
1195
1196 s = splnet();
1197 SPPP_LOCK(sp, RW_WRITER);
1198 /*
1199 * Process only the control protocol queue until we have at
1200 * least one NCP open.
1201 *
1202 * Do always serve all three queues in Cisco mode.
1203 */
1204 IF_DEQUEUE(&sp->pp_cpq, m);
1205 if (m == NULL && sppp_cp_check(sp, CP_NCP)) {
1206 IF_DEQUEUE(&sp->pp_fastq, m);
1207 if (m == NULL)
1208 IFQ_DEQUEUE(&sp->pp_if.if_snd, m);
1209 }
1210 SPPP_UNLOCK(sp);
1211 splx(s);
1212 return m;
1213 }
1214
1215 /*
1216 * Process an ioctl request. Called on low priority level.
1217 */
1218 int
sppp_ioctl(struct ifnet * ifp,u_long cmd,void * data)1219 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1220 {
1221 struct lwp *l = curlwp; /* XXX */
1222 struct ifreq *ifr = (struct ifreq *) data;
1223 struct ifaddr *ifa = (struct ifaddr *) data;
1224 struct sppp *sp = (struct sppp *) ifp;
1225 int s, error=0, going_up, going_down;
1226 u_short newmode;
1227 u_long lcp_mru;
1228
1229 s = splnet();
1230 switch (cmd) {
1231 case SIOCINITIFADDR:
1232 ifa->ifa_rtrequest = p2p_rtrequest;
1233 break;
1234
1235 case SIOCSIFFLAGS:
1236 if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1237 break;
1238
1239 SPPP_LOCK(sp, RW_WRITER);
1240 going_up = ifp->if_flags & IFF_UP &&
1241 (ifp->if_flags & IFF_RUNNING) == 0;
1242 going_down = (ifp->if_flags & IFF_UP) == 0 &&
1243 ifp->if_flags & IFF_RUNNING;
1244 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
1245 if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
1246 /* sanity */
1247 newmode = IFF_PASSIVE;
1248 ifp->if_flags &= ~IFF_AUTO;
1249 }
1250
1251 if (ifp->if_flags & IFF_UP) {
1252 sp->pp_flags |= PP_ADMIN_UP;
1253 } else {
1254 sp->pp_flags &= ~PP_ADMIN_UP;
1255 }
1256
1257 if (going_up || going_down) {
1258 sp->lcp.reestablish = false;
1259 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
1260 }
1261 if (going_up && newmode == 0) {
1262 /* neither auto-dial nor passive */
1263 ifp->if_flags |= IFF_RUNNING;
1264 sppp_wq_add(sp->wq_cp,
1265 &sp->scp[IDX_LCP].work_open);
1266 } else if (going_down) {
1267 SPPP_UNLOCK(sp);
1268 sppp_flush(ifp);
1269 SPPP_LOCK(sp, RW_WRITER);
1270
1271 ifp->if_flags &= ~IFF_RUNNING;
1272 }
1273 SPPP_UNLOCK(sp);
1274 break;
1275
1276 case SIOCSIFMTU:
1277 if (ifr->ifr_mtu < PPP_MINMRU ||
1278 ifr->ifr_mtu > PP_MTU) {
1279 error = EINVAL;
1280 break;
1281 }
1282
1283 error = ifioctl_common(ifp, cmd, data);
1284 if (error == ENETRESET)
1285 error = 0;
1286
1287 SPPP_LOCK(sp, RW_WRITER);
1288 lcp_mru = sp->lcp.mru;
1289 if (ifp->if_mtu < PP_MTU) {
1290 sp->lcp.mru = ifp->if_mtu;
1291 } else {
1292 sp->lcp.mru = PP_MTU;
1293 }
1294 if (lcp_mru != sp->lcp.mru)
1295 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU);
1296
1297 if (sp->scp[IDX_LCP].state == STATE_OPENED &&
1298 ifp->if_mtu > sp->lcp.their_mru) {
1299 sp->pp_saved_mtu = ifp->if_mtu;
1300 ifp->if_mtu = sp->lcp.their_mru;
1301
1302 SPPP_DLOG(sp, "setting MTU "
1303 "from %"PRIu64" bytes to %"PRIu64" bytes\n",
1304 sp->pp_saved_mtu, ifp->if_mtu);
1305 }
1306 SPPP_UNLOCK(sp);
1307 break;
1308
1309 case SIOCGIFMTU:
1310 if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
1311 error = 0;
1312 break;
1313 case SIOCADDMULTI:
1314 case SIOCDELMULTI:
1315 break;
1316
1317 case SPPPSETAUTHCFG:
1318 case SPPPSETLCPCFG:
1319 case SPPPSETNCPCFG:
1320 case SPPPSETIDLETO:
1321 case SPPPSETAUTHFAILURE:
1322 case SPPPSETDNSOPTS:
1323 case SPPPSETKEEPALIVE:
1324 #if defined(COMPAT_50) || defined(MODULAR)
1325 case __SPPPSETIDLETO50:
1326 case __SPPPSETKEEPALIVE50:
1327 #endif /* COMPAT_50 || MODULAR */
1328 error = kauth_authorize_network(l->l_cred,
1329 KAUTH_NETWORK_INTERFACE,
1330 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
1331 NULL);
1332 if (error)
1333 break;
1334 error = sppp_params(sp, cmd, data);
1335 break;
1336
1337 case SPPPGETAUTHCFG:
1338 case SPPPGETLCPCFG:
1339 case SPPPGETNCPCFG:
1340 case SPPPGETAUTHFAILURES:
1341 error = kauth_authorize_network(l->l_cred,
1342 KAUTH_NETWORK_INTERFACE,
1343 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd,
1344 NULL);
1345 if (error)
1346 break;
1347 error = sppp_params(sp, cmd, data);
1348 break;
1349
1350 case SPPPGETSTATUS:
1351 case SPPPGETSTATUSNCP:
1352 case SPPPGETIDLETO:
1353 case SPPPGETDNSOPTS:
1354 case SPPPGETDNSADDRS:
1355 case SPPPGETKEEPALIVE:
1356 #if defined(COMPAT_50) || defined(MODULAR)
1357 case __SPPPGETIDLETO50:
1358 case __SPPPGETKEEPALIVE50:
1359 #endif /* COMPAT_50 || MODULAR */
1360 case SPPPGETLCPSTATUS:
1361 case SPPPGETIPCPSTATUS:
1362 case SPPPGETIPV6CPSTATUS:
1363 error = sppp_params(sp, cmd, data);
1364 break;
1365
1366 default:
1367 error = ifioctl_common(ifp, cmd, data);
1368 break;
1369 }
1370 splx(s);
1371 return (error);
1372 }
1373
1374 /*
1375 * PPP protocol implementation.
1376 */
1377
1378 /*
1379 * Send PPP control protocol packet.
1380 */
1381 static void
sppp_cp_send(struct sppp * sp,u_short proto,u_char type,u_char ident,u_short len,void * data)1382 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1383 u_char ident, u_short len, void *data)
1384 {
1385 struct ifnet *ifp;
1386 struct lcp_header *lh;
1387 struct mbuf *m;
1388 size_t pkthdrlen;
1389
1390 KASSERT(SPPP_WLOCKED(sp));
1391
1392 ifp = &sp->pp_if;
1393 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
1394
1395 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
1396 len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
1397 MGETHDR(m, M_DONTWAIT, MT_DATA);
1398 if (! m) {
1399 return;
1400 }
1401 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
1402 m_reset_rcvif(m);
1403
1404 if (sp->pp_flags & PP_NOFRAMING) {
1405 *mtod(m, uint16_t *) = htons(proto);
1406 lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2);
1407 } else {
1408 struct ppp_header *h;
1409 h = mtod(m, struct ppp_header *);
1410 h->address = PPP_ALLSTATIONS; /* broadcast address */
1411 h->control = PPP_UI; /* Unnumbered Info */
1412 h->protocol = htons(proto); /* Link Control Protocol */
1413 lh = (struct lcp_header *)(h + 1);
1414 }
1415 lh->type = type;
1416 lh->ident = ident;
1417 lh->len = htons(LCP_HEADER_LEN + len);
1418 if (len)
1419 memcpy(lh + 1, data, len);
1420
1421 if (sppp_debug_enabled(sp)) {
1422 char pbuf[SPPP_PROTO_NAMELEN];
1423 char tbuf[SPPP_CPTYPE_NAMELEN];
1424 const char *pname, *cpname;
1425
1426 pname = sppp_proto_name(pbuf, sizeof(pbuf), proto);
1427 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), lh->type);
1428 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d",
1429 pname, cpname, lh->ident, ntohs(lh->len));
1430 if (len)
1431 sppp_print_bytes((u_char *)(lh + 1), len);
1432 addlog(">\n");
1433 }
1434 if (IF_QFULL(&sp->pp_cpq)) {
1435 IF_DROP(&sp->pp_fastq);
1436 IF_DROP(&ifp->if_snd);
1437 m_freem(m);
1438 if_statinc(ifp, if_oerrors);
1439 return;
1440 }
1441
1442 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes);
1443 IF_ENQUEUE(&sp->pp_cpq, m);
1444
1445 if (! (ifp->if_flags & IFF_OACTIVE)) {
1446 SPPP_UNLOCK(sp);
1447 if_start_lock(ifp);
1448 SPPP_LOCK(sp, RW_WRITER);
1449 }
1450 }
1451
1452 static void
sppp_cp_to_lcp(void * xsp)1453 sppp_cp_to_lcp(void *xsp)
1454 {
1455 struct sppp *sp = xsp;
1456
1457 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_to);
1458 }
1459
1460 static void
sppp_cp_to_ipcp(void * xsp)1461 sppp_cp_to_ipcp(void *xsp)
1462 {
1463 struct sppp *sp = xsp;
1464
1465 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPCP].work_to);
1466 }
1467
1468 static void
sppp_cp_to_ipv6cp(void * xsp)1469 sppp_cp_to_ipv6cp(void *xsp)
1470 {
1471 struct sppp *sp = xsp;
1472
1473 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_IPV6CP].work_to);
1474 }
1475
1476 static void
sppp_cp_to_pap(void * xsp)1477 sppp_cp_to_pap(void *xsp)
1478 {
1479 struct sppp *sp = xsp;
1480
1481 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_to);
1482 }
1483
1484 static void
sppp_cp_to_chap(void * xsp)1485 sppp_cp_to_chap(void *xsp)
1486 {
1487 struct sppp *sp = xsp;
1488
1489 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_to);
1490 }
1491
1492 static void
sppp_cp_init(const struct cp * cp,struct sppp * sp)1493 sppp_cp_init(const struct cp *cp, struct sppp *sp)
1494 {
1495 struct sppp_cp *scp;
1496 typedef void (*sppp_co_cb_t)(void *);
1497 static const sppp_co_cb_t to_cb[IDX_COUNT] = {
1498 [IDX_LCP] = sppp_cp_to_lcp,
1499 [IDX_IPCP] = sppp_cp_to_ipcp,
1500 [IDX_IPV6CP] = sppp_cp_to_ipv6cp,
1501 [IDX_PAP] = sppp_cp_to_pap,
1502 [IDX_CHAP] = sppp_cp_to_chap,
1503 };
1504
1505 scp = &sp->scp[cp->protoidx];
1506 scp->state = STATE_INITIAL;
1507 scp->fail_counter = 0;
1508 scp->seq = 0;
1509 scp->rseq = 0;
1510
1511 SPPP_WQ_SET(&scp->work_up, cp->Up, cp);
1512 SPPP_WQ_SET(&scp->work_down, cp->Down, cp);
1513 SPPP_WQ_SET(&scp->work_open, cp->Open, cp);
1514 SPPP_WQ_SET(&scp->work_close, cp->Close, cp);
1515 SPPP_WQ_SET(&scp->work_to, cp->TO, cp);
1516 SPPP_WQ_SET(&scp->work_rcr, sppp_rcr_event, cp);
1517 SPPP_WQ_SET(&scp->work_rca, sppp_rca_event, cp);
1518 SPPP_WQ_SET(&scp->work_rcn, sppp_rcn_event, cp);
1519 SPPP_WQ_SET(&scp->work_rtr, sppp_rtr_event, cp);
1520 SPPP_WQ_SET(&scp->work_rta, sppp_rta_event, cp);
1521 SPPP_WQ_SET(&scp->work_rxj, sppp_rxj_event, cp);
1522
1523 callout_init(&scp->ch, CALLOUT_MPSAFE);
1524 callout_setfunc(&scp->ch, to_cb[cp->protoidx], sp);
1525 }
1526
1527 static void
sppp_cp_fini(const struct cp * cp,struct sppp * sp)1528 sppp_cp_fini(const struct cp *cp, struct sppp *sp)
1529 {
1530 struct sppp_cp *scp;
1531 scp = &sp->scp[cp->protoidx];
1532
1533 sppp_wq_wait(sp->wq_cp, &scp->work_up);
1534 sppp_wq_wait(sp->wq_cp, &scp->work_down);
1535 sppp_wq_wait(sp->wq_cp, &scp->work_open);
1536 sppp_wq_wait(sp->wq_cp, &scp->work_close);
1537 sppp_wq_wait(sp->wq_cp, &scp->work_to);
1538 sppp_wq_wait(sp->wq_cp, &scp->work_rcr);
1539 sppp_wq_wait(sp->wq_cp, &scp->work_rca);
1540 sppp_wq_wait(sp->wq_cp, &scp->work_rcn);
1541 sppp_wq_wait(sp->wq_cp, &scp->work_rtr);
1542 sppp_wq_wait(sp->wq_cp, &scp->work_rta);
1543 sppp_wq_wait(sp->wq_cp, &scp->work_rxj);
1544
1545 callout_halt(&scp->ch, NULL);
1546 callout_destroy(&scp->ch);
1547
1548 if (scp->mbuf_confreq != NULL) {
1549 m_freem(scp->mbuf_confreq);
1550 scp->mbuf_confreq = NULL;
1551 }
1552 if (scp->mbuf_confnak != NULL) {
1553 m_freem(scp->mbuf_confnak);
1554 scp->mbuf_confnak = NULL;
1555 }
1556 }
1557
1558 /*
1559 * Handle incoming PPP control protocol packets.
1560 */
1561 static void
sppp_cp_input(const struct cp * cp,struct sppp * sp,struct mbuf * m)1562 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1563 {
1564 struct ifnet *ifp;
1565 struct lcp_header *h;
1566 struct sppp_cp *scp;
1567 int printlen, len = m->m_pkthdr.len;
1568 u_char *p;
1569 uint32_t u32;
1570 char tbuf[SPPP_CPTYPE_NAMELEN];
1571 const char *cpname;
1572 bool debug;
1573
1574 SPPP_LOCK(sp, RW_WRITER);
1575
1576 ifp = &sp->pp_if;
1577 debug = sppp_debug_enabled(sp);
1578 scp = &sp->scp[cp->protoidx];
1579
1580 if (len < 4) {
1581 SPPP_DLOG(sp, "%s invalid packet length: %d bytes\n",
1582 cp->name, len);
1583 goto out;
1584 }
1585 h = mtod(m, struct lcp_header *);
1586 if (debug) {
1587 printlen = ntohs(h->len);
1588 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type);
1589 SPPP_LOG(sp, LOG_DEBUG, "%s input(%s): <%s id=0x%x len=%d",
1590 cp->name, sppp_state_name(scp->state),
1591 cpname, h->ident, printlen);
1592 if (len < printlen)
1593 printlen = len;
1594 if (printlen > 4)
1595 sppp_print_bytes((u_char *)(h + 1), printlen - 4);
1596 addlog(">\n");
1597 }
1598 if (len > ntohs(h->len))
1599 len = ntohs(h->len);
1600 p = (u_char *)(h + 1);
1601 switch (h->type) {
1602 case CONF_REQ:
1603 if (len < 4) {
1604 SPPP_DLOG(sp,"%s invalid conf-req length %d\n",
1605 cp->name, len);
1606 if_statinc(ifp, if_ierrors);
1607 break;
1608 }
1609
1610 scp->rcr_type = CP_RCR_NONE;
1611 scp->rconfid = h->ident;
1612 if (scp->mbuf_confreq != NULL) {
1613 m_freem(scp->mbuf_confreq);
1614 }
1615 scp->mbuf_confreq = m;
1616 m = NULL;
1617 sppp_wq_add(sp->wq_cp, &scp->work_rcr);
1618 break;
1619 case CONF_ACK:
1620 if (h->ident != scp->confid) {
1621 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
1622 cp->name, h->ident, scp->confid);
1623 if_statinc(ifp, if_ierrors);
1624 break;
1625 }
1626 sppp_wq_add(sp->wq_cp, &scp->work_rca);
1627 break;
1628 case CONF_NAK:
1629 case CONF_REJ:
1630 if (h->ident != scp->confid) {
1631 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
1632 cp->name, h->ident, scp->confid);
1633 if_statinc(ifp, if_ierrors);
1634 break;
1635 }
1636
1637 if (scp->mbuf_confnak) {
1638 m_freem(scp->mbuf_confnak);
1639 }
1640 scp->mbuf_confnak = m;
1641 m = NULL;
1642 sppp_wq_add(sp->wq_cp, &scp->work_rcn);
1643 break;
1644 case TERM_REQ:
1645 scp->rseq = h->ident;
1646 sppp_wq_add(sp->wq_cp, &scp->work_rtr);
1647 break;
1648 case TERM_ACK:
1649 if (h->ident != scp->confid &&
1650 h->ident != scp->seq) {
1651 SPPP_DLOG(sp, "%s id mismatch "
1652 "0x%x != 0x%x and 0x%x != %0lx\n",
1653 cp->name, h->ident, scp->confid,
1654 h->ident, scp->seq);
1655 if_statinc(ifp, if_ierrors);
1656 break;
1657 }
1658
1659 sppp_wq_add(sp->wq_cp, &scp->work_rta);
1660 break;
1661 case CODE_REJ:
1662 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1663 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type);
1664 SPPP_LOG(sp, LOG_INFO, "%s: ignoring RXJ (%s) for code ?, "
1665 "danger will robinson\n", cp->name, cpname);
1666 sppp_wq_add(sp->wq_cp, &scp->work_rxj);
1667 break;
1668 case PROTO_REJ:
1669 {
1670 int catastrophic;
1671 const struct cp *upper;
1672 int i;
1673 uint16_t proto;
1674
1675 catastrophic = 0;
1676 upper = NULL;
1677 proto = p[0] << 8 | p[1];
1678 for (i = 0; i < IDX_COUNT; i++) {
1679 if (cps[i]->proto == proto) {
1680 upper = cps[i];
1681 break;
1682 }
1683 }
1684 if (upper == NULL)
1685 catastrophic++;
1686
1687 if (debug) {
1688 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), h->type);
1689 SPPP_LOG(sp, LOG_INFO,
1690 "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
1691 cp->name, catastrophic ? '-' : '+',
1692 cpname, proto, upper ? upper->name : "unknown",
1693 upper ? sppp_state_name(sp->scp[upper->protoidx].state) : "?");
1694 }
1695
1696 /*
1697 * if we got RXJ+ against conf-req, the peer does not implement
1698 * this particular protocol type. terminate the protocol.
1699 */
1700 if (upper && !catastrophic) {
1701 if (sp->scp[upper->protoidx].state == STATE_REQ_SENT) {
1702 sppp_wq_add(sp->wq_cp,
1703 &sp->scp[upper->protoidx].work_close);
1704 break;
1705 }
1706 }
1707 sppp_wq_add(sp->wq_cp, &scp->work_rxj);
1708 break;
1709 }
1710 case DISC_REQ:
1711 if (cp->proto != PPP_LCP)
1712 goto illegal;
1713 /* Discard the packet. */
1714 break;
1715 case ECHO_REQ:
1716 if (cp->proto != PPP_LCP)
1717 goto illegal;
1718 if (scp->state != STATE_OPENED) {
1719 SPPP_DLOG(sp, "lcp echo req but lcp closed\n");
1720 if_statinc(ifp, if_ierrors);
1721 break;
1722 }
1723 if (len < 8) {
1724 SPPP_DLOG(sp, "invalid lcp echo request "
1725 "packet length: %d bytes\n", len);
1726 break;
1727 }
1728 memcpy(&u32, h + 1, sizeof u32);
1729 if (ntohl(u32) == sp->lcp.magic) {
1730 /* Line loopback mode detected. */
1731 SPPP_DLOG(sp, "loopback\n");
1732
1733 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) {
1734 sp->pp_flags |= PP_LOOPBACK;
1735 sppp_wq_add(sp->wq_cp,
1736 &sp->work_ifdown);
1737 }
1738
1739 /* Shut down the PPP link. */
1740 sppp_wq_add(sp->wq_cp,
1741 &sp->scp[IDX_LCP].work_close);
1742 sppp_wq_add(sp->wq_cp,
1743 &sp->scp[IDX_LCP].work_open);
1744 break;
1745 }
1746 u32 = htonl(sp->lcp.magic);
1747 memcpy(h + 1, &u32, sizeof u32);
1748 SPPP_DLOG(sp, "got lcp echo req, sending echo rep\n");
1749 sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4,
1750 h + 1);
1751 break;
1752 case ECHO_REPLY:
1753 if (cp->proto != PPP_LCP)
1754 goto illegal;
1755 if (h->ident != sp->lcp.echoid) {
1756 if_statinc(ifp, if_ierrors);
1757 break;
1758 }
1759 if (len < 8) {
1760 SPPP_DLOG(sp, "lcp invalid echo reply "
1761 "packet length: %d bytes\n", len);
1762 break;
1763 }
1764 SPPP_DLOG(sp, "lcp got echo rep\n");
1765 memcpy(&u32, h + 1, sizeof u32);
1766 if (ntohl(u32) != sp->lcp.magic)
1767 sp->pp_alivecnt = 0;
1768 break;
1769 default:
1770 /* Unknown packet type -- send Code-Reject packet. */
1771 illegal:
1772 SPPP_DLOG(sp, "%s send code-rej for 0x%x\n",
1773 cp->name, h->type);
1774 sppp_cp_send(sp, cp->proto, CODE_REJ,
1775 ++scp->seq, m->m_pkthdr.len, h);
1776 if_statinc(ifp, if_ierrors);
1777 }
1778
1779 out:
1780 SPPP_UNLOCK(sp);
1781 if (m != NULL)
1782 m_freem(m);
1783 }
1784
1785 /*
1786 * The generic part of all Up/Down/Open/Close/TO event handlers.
1787 * Basically, the state transition handling in the automaton.
1788 */
1789 static void
sppp_up_event(struct sppp * sp,void * xcp)1790 sppp_up_event(struct sppp *sp, void *xcp)
1791 {
1792 const struct cp *cp = xcp;
1793
1794 KASSERT(SPPP_WLOCKED(sp));
1795 KASSERT(!cpu_softintr_p());
1796
1797 if ((cp->flags & CP_AUTH) != 0 &&
1798 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE)
1799 return;
1800
1801 SPPP_DLOG(sp, "%s up(%s)\n", cp->name,
1802 sppp_state_name(sp->scp[cp->protoidx].state));
1803
1804 switch (sp->scp[cp->protoidx].state) {
1805 case STATE_INITIAL:
1806 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1807 break;
1808 case STATE_STARTING:
1809 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure;
1810 (cp->scr)(sp);
1811 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1812 break;
1813 default:
1814 SPPP_LOG(sp, LOG_DEBUG,
1815 "%s illegal up in state %s\n", cp->name,
1816 sppp_state_name(sp->scp[cp->protoidx].state));
1817 }
1818 }
1819
1820 static void
sppp_down_event(struct sppp * sp,void * xcp)1821 sppp_down_event(struct sppp *sp, void *xcp)
1822 {
1823 const struct cp *cp = xcp;
1824
1825 KASSERT(SPPP_WLOCKED(sp));
1826 KASSERT(!cpu_softintr_p());
1827
1828 if ((cp->flags & CP_AUTH) != 0 &&
1829 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE)
1830 return;
1831
1832 SPPP_DLOG(sp, "%s down(%s)\n", cp->name,
1833 sppp_state_name(sp->scp[cp->protoidx].state));
1834
1835 switch (sp->scp[cp->protoidx].state) {
1836 case STATE_CLOSED:
1837 case STATE_CLOSING:
1838 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1839 break;
1840 case STATE_STOPPED:
1841 (cp->tls)(cp, sp);
1842 /* fall through */
1843 case STATE_STOPPING:
1844 case STATE_REQ_SENT:
1845 case STATE_ACK_RCVD:
1846 case STATE_ACK_SENT:
1847 sppp_cp_change_state(cp, sp, STATE_STARTING);
1848 break;
1849 case STATE_OPENED:
1850 (cp->tld)(sp);
1851 sppp_cp_change_state(cp, sp, STATE_STARTING);
1852 break;
1853 default:
1854 /*
1855 * a down event may be caused regardless
1856 * of state just in LCP case.
1857 */
1858 if (cp->proto == PPP_LCP)
1859 break;
1860
1861 SPPP_LOG(sp, LOG_DEBUG,
1862 "%s illegal down in state %s\n", cp->name,
1863 sppp_state_name(sp->scp[cp->protoidx].state));
1864 }
1865 }
1866
1867 static void
sppp_open_event(struct sppp * sp,void * xcp)1868 sppp_open_event(struct sppp *sp, void *xcp)
1869 {
1870 const struct cp *cp = xcp;
1871
1872 KASSERT(SPPP_WLOCKED(sp));
1873 KASSERT(!cpu_softintr_p());
1874
1875 if ((cp->flags & CP_AUTH) != 0 &&
1876 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE)
1877 return;
1878
1879 SPPP_DLOG(sp, "%s open(%s)\n", cp->name,
1880 sppp_state_name(sp->scp[cp->protoidx].state));
1881
1882 switch (sp->scp[cp->protoidx].state) {
1883 case STATE_INITIAL:
1884 sppp_cp_change_state(cp, sp, STATE_STARTING);
1885 (cp->tls)(cp, sp);
1886 break;
1887 case STATE_STARTING:
1888 break;
1889 case STATE_CLOSED:
1890 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure;
1891 sp->lcp.protos |= (1 << cp->protoidx);
1892 (cp->scr)(sp);
1893 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1894 break;
1895 case STATE_STOPPED:
1896 case STATE_STOPPING:
1897 case STATE_REQ_SENT:
1898 case STATE_ACK_RCVD:
1899 case STATE_ACK_SENT:
1900 case STATE_OPENED:
1901 break;
1902 case STATE_CLOSING:
1903 sppp_cp_change_state(cp, sp, STATE_STOPPING);
1904 break;
1905 }
1906 }
1907
1908 static void
sppp_close_event(struct sppp * sp,void * xcp)1909 sppp_close_event(struct sppp *sp, void *xcp)
1910 {
1911 const struct cp *cp = xcp;
1912
1913 KASSERT(SPPP_WLOCKED(sp));
1914 KASSERT(!cpu_softintr_p());
1915
1916 if ((cp->flags & CP_AUTH) != 0 &&
1917 sppp_auth_role(cp, sp) == SPPP_AUTH_NOROLE)
1918 return;
1919
1920 SPPP_DLOG(sp, "%s close(%s)\n", cp->name,
1921 sppp_state_name(sp->scp[cp->protoidx].state));
1922
1923 switch (sp->scp[cp->protoidx].state) {
1924 case STATE_INITIAL:
1925 case STATE_CLOSED:
1926 case STATE_CLOSING:
1927 break;
1928 case STATE_STARTING:
1929 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1930 (cp->tlf)(cp, sp);
1931 break;
1932 case STATE_STOPPED:
1933 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1934 break;
1935 case STATE_STOPPING:
1936 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1937 break;
1938 case STATE_OPENED:
1939 (cp->tld)(sp);
1940 /* fall through */
1941 case STATE_REQ_SENT:
1942 case STATE_ACK_RCVD:
1943 case STATE_ACK_SENT:
1944 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_terminate;
1945 if ((cp->flags & CP_AUTH) == 0) {
1946 sppp_cp_send(sp, cp->proto, TERM_REQ,
1947 ++sp->scp[cp->protoidx].seq, 0, 0);
1948 }
1949 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1950 break;
1951 }
1952 }
1953
1954 static void
sppp_to_event(struct sppp * sp,void * xcp)1955 sppp_to_event(struct sppp *sp, void *xcp)
1956 {
1957 const struct cp *cp = xcp;
1958 int s;
1959
1960 KASSERT(SPPP_WLOCKED(sp));
1961 KASSERT(!cpu_softintr_p());
1962
1963 s = splnet();
1964
1965 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n", cp->name,
1966 sppp_state_name(sp->scp[cp->protoidx].state),
1967 sp->scp[cp->protoidx].rst_counter);
1968
1969 if (--sp->scp[cp->protoidx].rst_counter < 0)
1970 /* TO- event */
1971 switch (sp->scp[cp->protoidx].state) {
1972 case STATE_CLOSING:
1973 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1974 (cp->tlf)(cp, sp);
1975 break;
1976 case STATE_STOPPING:
1977 sppp_cp_change_state(cp, sp, STATE_STOPPED);
1978 (cp->tlf)(cp, sp);
1979 break;
1980 case STATE_REQ_SENT:
1981 case STATE_ACK_RCVD:
1982 case STATE_ACK_SENT:
1983 sppp_cp_change_state(cp, sp, STATE_STOPPED);
1984 (cp->tlf)(cp, sp);
1985 break;
1986 }
1987 else
1988 /* TO+ event */
1989 switch (sp->scp[cp->protoidx].state) {
1990 case STATE_CLOSING:
1991 case STATE_STOPPING:
1992 if ((cp->flags & CP_AUTH) == 0) {
1993 sppp_cp_send(sp, cp->proto, TERM_REQ,
1994 ++sp->scp[cp->protoidx].seq, 0, 0);
1995 }
1996 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout);
1997 break;
1998 case STATE_REQ_SENT:
1999 case STATE_ACK_RCVD:
2000 (cp->scr)(sp);
2001 /* sppp_cp_change_state() will restart the timer */
2002 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2003 break;
2004 case STATE_ACK_SENT:
2005 (cp->scr)(sp);
2006 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout);
2007 break;
2008 }
2009
2010 splx(s);
2011 }
2012 static void
sppp_rcr_update_state(const struct cp * cp,struct sppp * sp,enum cp_rcr_type type,uint8_t ident,size_t msglen,void * msg)2013 sppp_rcr_update_state(const struct cp *cp, struct sppp *sp,
2014 enum cp_rcr_type type, uint8_t ident, size_t msglen, void *msg)
2015 {
2016 struct ifnet *ifp;
2017 u_char ctype;
2018
2019 ifp = &sp->pp_if;
2020
2021 if (type == CP_RCR_ERR) {
2022 /* parse error, shut down */
2023 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
2024 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open);
2025 } else if (type == CP_RCR_ACK) {
2026 /* RCR+ event */
2027 ctype = CONF_ACK;
2028 switch (sp->scp[cp->protoidx].state) {
2029 case STATE_OPENED:
2030 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
2031 cp->tld(sp);
2032 cp->scr(sp);
2033 cp->screply(cp, sp, ctype, ident, msglen, msg);
2034 break;
2035 case STATE_REQ_SENT:
2036 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
2037 /* fall through */
2038 case STATE_ACK_SENT:
2039 cp->screply(cp, sp, ctype, ident, msglen, msg);
2040 break;
2041 case STATE_STOPPED:
2042 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
2043 cp->scr(sp);
2044 cp->screply(cp, sp, ctype, ident, msglen, msg);
2045 break;
2046 case STATE_ACK_RCVD:
2047 sppp_cp_change_state(cp, sp, STATE_OPENED);
2048 SPPP_DLOG(sp, "%s tlu\n", cp->name);
2049 cp->tlu(sp);
2050 cp->screply(cp, sp, ctype, ident, msglen, msg);
2051 break;
2052 case STATE_CLOSING:
2053 case STATE_STOPPING:
2054 break;
2055 case STATE_CLOSED:
2056 if ((cp->flags & CP_AUTH) == 0) {
2057 sppp_cp_send(sp, cp->proto, TERM_ACK,
2058 ident, 0, 0);
2059 }
2060 break;
2061 default:
2062 SPPP_LOG(sp, LOG_DEBUG,
2063 "%s illegal RCR+ in state %s\n", cp->name,
2064 sppp_state_name(sp->scp[cp->protoidx].state));
2065 if_statinc(ifp, if_ierrors);
2066 }
2067 } else if (type == CP_RCR_NAK || type == CP_RCR_REJ) {
2068 ctype = type == CP_RCR_NAK ? CONF_NAK : CONF_REJ;
2069 /* RCR- event */
2070 switch (sp->scp[cp->protoidx].state) {
2071 case STATE_OPENED:
2072 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2073 cp->tld(sp);
2074 cp->scr(sp);
2075 cp->screply(cp, sp, ctype, ident, msglen, msg);
2076 break;
2077 case STATE_ACK_SENT:
2078 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2079 /* fall through */
2080 case STATE_REQ_SENT:
2081 cp->screply(cp, sp, ctype, ident, msglen, msg);
2082 break;
2083 case STATE_STOPPED:
2084 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2085 cp->scr(sp);
2086 cp->screply(cp, sp, ctype, ident, msglen, msg);
2087 break;
2088 case STATE_ACK_RCVD:
2089 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
2090 cp->screply(cp, sp, ctype, ident, msglen, msg);
2091 break;
2092 case STATE_CLOSING:
2093 case STATE_STOPPING:
2094 break;
2095 case STATE_CLOSED:
2096 sppp_cp_change_state(cp, sp, STATE_CLOSED);
2097 if ((cp->flags & CP_AUTH) == 0) {
2098 sppp_cp_send(sp, cp->proto, TERM_ACK,
2099 ident, 0, 0);
2100 }
2101 break;
2102 default:
2103 SPPP_LOG(sp, LOG_DEBUG,
2104 "%s illegal RCR- in state %s\n", cp->name,
2105 sppp_state_name(sp->scp[cp->protoidx].state));
2106 if_statinc(ifp, if_ierrors);
2107 }
2108 }
2109 }
2110
2111 static void
sppp_rcr_event(struct sppp * sp,void * xcp)2112 sppp_rcr_event(struct sppp *sp, void *xcp)
2113 {
2114 const struct cp *cp = xcp;
2115 struct sppp_cp *scp;
2116 struct lcp_header *h;
2117 struct mbuf *m;
2118 enum cp_rcr_type type;
2119 size_t len;
2120 uint8_t *buf;
2121 size_t blen, rlen;
2122 uint8_t ident;
2123
2124 KASSERT(!cpu_softintr_p());
2125
2126 scp = &sp->scp[cp->protoidx];
2127
2128 if (cp->parse_confreq != NULL) {
2129 m = scp->mbuf_confreq;
2130 if (m == NULL)
2131 return;
2132 scp->mbuf_confreq = NULL;
2133
2134 h = mtod(m, struct lcp_header *);
2135 if (h->type != CONF_REQ) {
2136 m_freem(m);
2137 return;
2138 }
2139
2140 ident = h->ident;
2141 len = MIN(m->m_pkthdr.len, ntohs(h->len));
2142
2143 type = (cp->parse_confreq)(sp, h, len,
2144 &buf, &blen, &rlen);
2145 m_freem(m);
2146 } else {
2147 /* mbuf_cofreq is already parsed and freed */
2148 type = scp->rcr_type;
2149 ident = scp->rconfid;
2150 buf = NULL;
2151 blen = rlen = 0;
2152 }
2153
2154 sppp_rcr_update_state(cp, sp, type, ident, rlen, (void *)buf);
2155
2156 if (buf != NULL)
2157 kmem_free(buf, blen);
2158 }
2159
2160 static void
sppp_rca_event(struct sppp * sp,void * xcp)2161 sppp_rca_event(struct sppp *sp, void *xcp)
2162 {
2163 struct ifnet *ifp;
2164 const struct cp *cp = xcp;
2165
2166 KASSERT(!cpu_softintr_p());
2167
2168 ifp = &sp->pp_if;
2169
2170 switch (sp->scp[cp->protoidx].state) {
2171 case STATE_CLOSED:
2172 case STATE_STOPPED:
2173 if ((cp->flags & CP_AUTH) == 0) {
2174 sppp_cp_send(sp, cp->proto, TERM_ACK,
2175 sp->scp[cp->protoidx].rconfid, 0, 0);
2176 }
2177 break;
2178 case STATE_CLOSING:
2179 case STATE_STOPPING:
2180 break;
2181 case STATE_REQ_SENT:
2182 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure;
2183 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
2184 break;
2185 case STATE_OPENED:
2186 (cp->tld)(sp);
2187 /* fall through */
2188 case STATE_ACK_RCVD:
2189 (cp->scr)(sp);
2190 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2191 break;
2192 case STATE_ACK_SENT:
2193 sppp_cp_change_state(cp, sp, STATE_OPENED);
2194 sp->scp[cp->protoidx].rst_counter = sp->lcp.max_configure;
2195 SPPP_DLOG(sp, "%s tlu\n", cp->name);
2196 (cp->tlu)(sp);
2197 break;
2198 default:
2199 SPPP_LOG(sp, LOG_DEBUG,
2200 "%s illegal RCA in state %s\n", cp->name,
2201 sppp_state_name(sp->scp[cp->protoidx].state));
2202 if_statinc(ifp, if_ierrors);
2203 }
2204 }
2205
2206 static void
sppp_rcn_event(struct sppp * sp,void * xcp)2207 sppp_rcn_event(struct sppp *sp, void *xcp)
2208 {
2209 const struct cp *cp = xcp;
2210 struct sppp_cp *scp;
2211 struct lcp_header *h;
2212 struct mbuf *m;
2213 struct ifnet *ifp = &sp->pp_if;
2214 size_t len;
2215
2216 KASSERT(!cpu_softintr_p());
2217
2218 scp = &sp->scp[cp->protoidx];
2219 m = scp->mbuf_confnak;
2220 if (m == NULL)
2221 return;
2222 scp->mbuf_confnak = NULL;
2223
2224 h = mtod(m, struct lcp_header *);
2225 len = MIN(m->m_pkthdr.len, ntohs(h->len));
2226
2227 switch (h->type) {
2228 case CONF_NAK:
2229 (cp->parse_confnak)(sp, h, len);
2230 break;
2231 case CONF_REJ:
2232 (cp->parse_confrej)(sp, h, len);
2233 break;
2234 default:
2235 m_freem(m);
2236 return;
2237 }
2238
2239 m_freem(m);
2240
2241 switch (scp->state) {
2242 case STATE_CLOSED:
2243 case STATE_STOPPED:
2244 if ((cp->flags & CP_AUTH) == 0) {
2245 sppp_cp_send(sp, cp->proto, TERM_ACK,
2246 scp->rconfid, 0, 0);
2247 }
2248 break;
2249 case STATE_REQ_SENT:
2250 case STATE_ACK_SENT:
2251 scp->rst_counter = sp->lcp.max_configure;
2252 (cp->scr)(sp);
2253 break;
2254 case STATE_OPENED:
2255 (cp->tld)(sp);
2256 /* fall through */
2257 case STATE_ACK_RCVD:
2258 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
2259 (cp->scr)(sp);
2260 break;
2261 case STATE_CLOSING:
2262 case STATE_STOPPING:
2263 break;
2264 default:
2265 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RCN in state %s\n",
2266 cp->name, sppp_state_name(scp->state));
2267 if_statinc(ifp, if_ierrors);
2268 }
2269 }
2270
2271 static void
sppp_rtr_event(struct sppp * sp,void * xcp)2272 sppp_rtr_event(struct sppp *sp, void *xcp)
2273 {
2274 struct ifnet *ifp;
2275 const struct cp *cp = xcp;
2276
2277 KASSERT(!cpu_softintr_p());
2278
2279 ifp = &sp->pp_if;
2280
2281 switch (sp->scp[cp->protoidx].state) {
2282 case STATE_ACK_RCVD:
2283 case STATE_ACK_SENT:
2284 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2285 break;
2286 case STATE_CLOSED:
2287 case STATE_STOPPED:
2288 case STATE_CLOSING:
2289 case STATE_STOPPING:
2290 case STATE_REQ_SENT:
2291 break;
2292 case STATE_OPENED:
2293 (cp->tld)(sp);
2294 sp->scp[cp->protoidx].rst_counter = 0;
2295 sppp_cp_change_state(cp, sp, STATE_STOPPING);
2296 break;
2297 default:
2298 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTR in state %s\n",
2299 cp->name,
2300 sppp_state_name(sp->scp[cp->protoidx].state));
2301 if_statinc(ifp, if_ierrors);
2302 return;
2303 }
2304
2305 /* Send Terminate-Ack packet. */
2306 SPPP_DLOG(sp, "%s send terminate-ack\n", cp->name);
2307 if ((cp->flags & CP_AUTH) == 0) {
2308 sppp_cp_send(sp, cp->proto, TERM_ACK,
2309 sp->scp[cp->protoidx].rseq, 0, 0);
2310 }
2311 }
2312
2313 static void
sppp_rta_event(struct sppp * sp,void * xcp)2314 sppp_rta_event(struct sppp *sp, void *xcp)
2315 {
2316 const struct cp *cp = xcp;
2317 struct ifnet *ifp = &sp->pp_if;
2318
2319 KASSERT(!cpu_softintr_p());
2320
2321 switch (sp->scp[cp->protoidx].state) {
2322 case STATE_CLOSED:
2323 case STATE_STOPPED:
2324 case STATE_REQ_SENT:
2325 case STATE_ACK_SENT:
2326 break;
2327 case STATE_CLOSING:
2328 sppp_cp_change_state(cp, sp, STATE_CLOSED);
2329 (cp->tlf)(cp, sp);
2330 break;
2331 case STATE_STOPPING:
2332 sppp_cp_change_state(cp, sp, STATE_STOPPED);
2333 (cp->tlf)(cp, sp);
2334 break;
2335 case STATE_ACK_RCVD:
2336 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2337 break;
2338 case STATE_OPENED:
2339 (cp->tld)(sp);
2340 (cp->scr)(sp);
2341 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
2342 break;
2343 default:
2344 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RTA in state %s\n",
2345 cp->name, sppp_state_name(sp->scp[cp->protoidx].state));
2346 if_statinc(ifp, if_ierrors);
2347 }
2348 }
2349
2350 static void
sppp_rxj_event(struct sppp * sp,void * xcp)2351 sppp_rxj_event(struct sppp *sp, void *xcp)
2352 {
2353 const struct cp *cp = xcp;
2354 struct ifnet *ifp = &sp->pp_if;
2355
2356 KASSERT(!cpu_softintr_p());
2357
2358 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
2359 switch (sp->scp[cp->protoidx].state) {
2360 case STATE_CLOSED:
2361 case STATE_STOPPED:
2362 case STATE_REQ_SENT:
2363 case STATE_ACK_SENT:
2364 case STATE_CLOSING:
2365 case STATE_STOPPING:
2366 case STATE_OPENED:
2367 break;
2368 case STATE_ACK_RCVD:
2369 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2370 break;
2371 default:
2372 SPPP_LOG(sp, LOG_DEBUG, "%s illegal RXJ- in state %s\n",
2373 cp->name, sppp_state_name(sp->scp[cp->protoidx].state));
2374 if_statinc(ifp, if_ierrors);
2375 }
2376 }
2377
2378 /*
2379 * Change the state of a control protocol in the state automaton.
2380 * Takes care of starting/stopping the restart timer.
2381 */
2382 void
sppp_cp_change_state(const struct cp * cp,struct sppp * sp,int newstate)2383 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
2384 {
2385
2386 KASSERT(SPPP_WLOCKED(sp));
2387
2388 sp->scp[cp->protoidx].state = newstate;
2389 callout_stop(&sp->scp[cp->protoidx].ch);
2390 switch (newstate) {
2391 case STATE_INITIAL:
2392 case STATE_STARTING:
2393 case STATE_CLOSED:
2394 case STATE_STOPPED:
2395 case STATE_OPENED:
2396 break;
2397 case STATE_CLOSING:
2398 case STATE_STOPPING:
2399 case STATE_REQ_SENT:
2400 case STATE_ACK_RCVD:
2401 case STATE_ACK_SENT:
2402 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout);
2403 break;
2404 }
2405 }
2406
2407 /*
2408 *--------------------------------------------------------------------------*
2409 * *
2410 * The LCP implementation. *
2411 * *
2412 *--------------------------------------------------------------------------*
2413 */
2414 static void
sppp_lcp_init(struct sppp * sp)2415 sppp_lcp_init(struct sppp *sp)
2416 {
2417
2418 KASSERT(SPPP_WLOCKED(sp));
2419
2420 sppp_cp_init(&lcp, sp);
2421
2422 SET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC);
2423 sp->lcp.magic = 0;
2424 sp->lcp.protos = 0;
2425 sp->lcp.max_terminate = 2;
2426 sp->lcp.max_configure = 10;
2427 sp->lcp.max_failure = 10;
2428 sp->lcp.tlf_sent = false;
2429
2430 /*
2431 * Initialize counters and timeout values. Note that we don't
2432 * use the 3 seconds suggested in RFC 1661 since we are likely
2433 * running on a fast link. XXX We should probably implement
2434 * the exponential backoff option. Note that these values are
2435 * relevant for all control protocols, not just LCP only.
2436 */
2437 sp->lcp.timeout = 1 * hz;
2438 }
2439
2440 static void
sppp_lcp_up(struct sppp * sp,void * xcp)2441 sppp_lcp_up(struct sppp *sp, void *xcp)
2442 {
2443 struct ifnet *ifp;
2444 const struct cp *cp = xcp;
2445 int pidx;
2446
2447 KASSERT(SPPP_WLOCKED(sp));
2448 ifp = &sp->pp_if;
2449
2450 pidx = cp->protoidx;
2451 /* Initialize activity timestamp: opening a connection is an activity */
2452 sp->pp_last_receive = sp->pp_last_activity = time_uptime;
2453
2454 /*
2455 * If this interface is passive or dial-on-demand, and we are
2456 * still in Initial state, it means we've got an incoming
2457 * call. Activate the interface.
2458 */
2459 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
2460 ifp->if_flags |= IFF_RUNNING;
2461 if (sp->scp[pidx].state == STATE_INITIAL) {
2462 SPPP_DLOG(sp, "Up event (incoming call)\n");
2463 sp->pp_flags |= PP_CALLIN;
2464 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_open);
2465 } else {
2466 SPPP_DLOG(sp, "Up event\n");
2467 }
2468 }
2469
2470 sppp_up_event(sp, xcp);
2471 }
2472
2473 static void
sppp_lcp_down(struct sppp * sp,void * xcp)2474 sppp_lcp_down(struct sppp *sp, void *xcp)
2475 {
2476 const struct cp *cp = xcp;
2477 struct ifnet *ifp;
2478 int pidx;
2479
2480 KASSERT(SPPP_WLOCKED(sp));
2481 KASSERT(!cpu_softintr_p());
2482
2483 ifp = &sp->pp_if;
2484 pidx = cp->protoidx;
2485 sppp_down_event(sp, xcp);
2486
2487 /*
2488 * We need to do tls to restart when a down event is caused
2489 * by the last tlf.
2490 */
2491 if (sp->scp[pidx].state == STATE_STARTING &&
2492 sp->lcp.tlf_sent) {
2493 cp->tls(cp, sp);
2494 sp->lcp.tlf_sent = false;
2495 }
2496
2497 SPPP_DLOG(sp, "Down event (carrier loss)\n");
2498
2499 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
2500 if (sp->lcp.reestablish)
2501 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open);
2502 } else {
2503 sp->pp_flags &= ~PP_CALLIN;
2504 if (sp->scp[pidx].state != STATE_INITIAL)
2505 sppp_wq_add(sp->wq_cp, &sp->scp[pidx].work_close);
2506 ifp->if_flags &= ~IFF_RUNNING;
2507 }
2508 sp->scp[pidx].fail_counter = 0;
2509 }
2510
2511 static void
sppp_lcp_open(struct sppp * sp,void * xcp)2512 sppp_lcp_open(struct sppp *sp, void *xcp)
2513 {
2514
2515 KASSERT(SPPP_WLOCKED(sp));
2516 KASSERT(!cpu_softintr_p());
2517
2518 sp->lcp.reestablish = false;
2519 sp->scp[IDX_LCP].fail_counter = 0;
2520
2521 /* the interface was down while waiting for reconnection */
2522 if ((sp->pp_flags & PP_ADMIN_UP) == 0)
2523 return;
2524
2525 if (sp->pp_if.if_mtu < PP_MTU) {
2526 sp->lcp.mru = sp->pp_if.if_mtu;
2527 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU);
2528 } else {
2529 sp->lcp.mru = PP_MTU;
2530 }
2531 sp->lcp.their_mru = PP_MTU;
2532
2533 /*
2534 * If we are authenticator, negotiate LCP_AUTH
2535 */
2536 if (sp->hisauth.proto != PPP_NOPROTO)
2537 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO);
2538 else
2539 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO);
2540 sp->pp_flags &= ~PP_NEEDAUTH;
2541 sppp_open_event(sp, xcp);
2542 }
2543
2544
2545 /*
2546 * Analyze a configure request. Return true if it was agreeable, and
2547 * caused action sca, false if it has been rejected or nak'ed, and
2548 * caused action scn. (The return value is used to make the state
2549 * transition decision in the state automaton.)
2550 */
2551 static enum cp_rcr_type
sppp_lcp_confreq(struct sppp * sp,struct lcp_header * h,int origlen,uint8_t ** msgbuf,size_t * buflen,size_t * msglen)2552 sppp_lcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen,
2553 uint8_t **msgbuf, size_t *buflen, size_t *msglen)
2554 {
2555 u_char *buf, *r, *p, l, blen;
2556 enum cp_rcr_type type;
2557 int len, rlen;
2558 uint32_t nmagic;
2559 u_short authproto;
2560 char lbuf[SPPP_LCPOPT_NAMELEN];
2561 bool debug;
2562
2563 KASSERT(SPPP_WLOCKED(sp));
2564
2565 debug = sppp_debug_enabled(sp);
2566
2567 if (origlen < sizeof(*h))
2568 return CP_RCR_DROP;
2569
2570 origlen -= sizeof(*h);
2571 type = CP_RCR_NONE;
2572 type = 0;
2573
2574 if (origlen <= 0)
2575 return CP_RCR_DROP;
2576 else
2577 blen = origlen;
2578
2579 buf = kmem_intr_alloc(blen, KM_NOSLEEP);
2580 if (buf == NULL)
2581 return CP_RCR_DROP;
2582
2583 if (debug)
2584 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opts:");
2585
2586 /* pass 1: check for things that need to be rejected */
2587 p = (void *)(h + 1);
2588 r = buf;
2589 rlen = 0;
2590 for (len = origlen; len > 1; len-= l, p += l) {
2591 l = p[1];
2592 if (l == 0)
2593 break;
2594
2595 /* Sanity check option length */
2596 if (l > len) {
2597 /*
2598 * Malicious option - drop immediately.
2599 * XXX Maybe we should just RXJ it?
2600 */
2601 if (debug)
2602 addlog("\n");
2603
2604 SPPP_LOG(sp, LOG_DEBUG,
2605 "received malicious LCP option 0x%02x, "
2606 "length 0x%02x, (len: 0x%02x) dropping.\n",
2607 p[0], l, len);
2608 type = CP_RCR_ERR;
2609 goto end;
2610 }
2611 if (debug)
2612 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p));
2613 switch (p[0]) {
2614 case LCP_OPT_MAGIC:
2615 /* Magic number. */
2616 /* fall through, both are same length */
2617 case LCP_OPT_ASYNC_MAP:
2618 /* Async control character map. */
2619 if (len >= 6 || l == 6)
2620 continue;
2621 if (debug)
2622 addlog(" [invalid]");
2623 break;
2624 case LCP_OPT_MP_EID:
2625 if (len >= l && l >= 3) {
2626 switch (p[2]) {
2627 case 0: if (l==3+ 0) continue;break;
2628 case 2: if (l==3+ 4) continue;break;
2629 case 3: if (l==3+ 6) continue;break;
2630 case 6: if (l==3+16) continue;break;
2631 case 1: /* FALLTHROUGH */
2632 case 4: if (l<=3+20) continue;break;
2633 case 5: if (l<=3+15) continue;break;
2634 /* XXX should it be default: continue;? */
2635 }
2636 }
2637 if (debug)
2638 addlog(" [invalid class %d len %d]", p[2], l);
2639 break;
2640 case LCP_OPT_MP_SSNHF:
2641 if (len >= 2 && l == 2) {
2642 if (debug)
2643 addlog(" [rej]");
2644 break;
2645 }
2646 if (debug)
2647 addlog(" [invalid]");
2648 break;
2649 case LCP_OPT_MP_MRRU:
2650 /* Multilink maximum received reconstructed unit */
2651 /* should be fall through, both are same length */
2652 /* FALLTHROUGH */
2653 case LCP_OPT_MRU:
2654 /* Maximum receive unit. */
2655 if (len >= 4 && l == 4)
2656 continue;
2657 if (debug)
2658 addlog(" [invalid]");
2659 break;
2660 case LCP_OPT_AUTH_PROTO:
2661 if (len < 4) {
2662 if (debug)
2663 addlog(" [invalid]");
2664 break;
2665 }
2666 authproto = (p[2] << 8) + p[3];
2667 if (authproto == PPP_CHAP && l != 5) {
2668 if (debug)
2669 addlog(" [invalid chap len]");
2670 break;
2671 }
2672 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) {
2673 if (authproto == PPP_PAP || authproto == PPP_CHAP)
2674 sp->myauth.proto = authproto;
2675 }
2676 if (sp->myauth.proto == PPP_NOPROTO) {
2677 /* we are not configured to do auth */
2678 if (debug)
2679 addlog(" [not configured]");
2680 break;
2681 }
2682 /*
2683 * Remote want us to authenticate, remember this,
2684 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got
2685 * up.
2686 */
2687 sp->pp_flags |= PP_NEEDAUTH;
2688 continue;
2689 default:
2690 /* Others not supported. */
2691 if (debug)
2692 addlog(" [rej]");
2693 break;
2694 }
2695 if (rlen + l > blen) {
2696 if (debug)
2697 addlog(" [overflow]");
2698 continue;
2699 }
2700 /* Add the option to rejected list. */
2701 memcpy(r, p, l);
2702 r += l;
2703 rlen += l;
2704 }
2705
2706 if (rlen > 0) {
2707 type = CP_RCR_REJ;
2708 goto end;
2709 }
2710
2711 if (debug)
2712 addlog("\n");
2713
2714 /*
2715 * pass 2: check for option values that are unacceptable and
2716 * thus require to be nak'ed.
2717 */
2718 if (debug)
2719 SPPP_LOG(sp, LOG_DEBUG, "lcp parse opt values:");
2720
2721 p = (void *)(h + 1);
2722 r = buf;
2723 rlen = 0;
2724 for (len = origlen; len > 0; len -= l, p += l) {
2725 l = p[1];
2726 if (l == 0)
2727 break;
2728
2729 if (debug)
2730 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p));
2731 switch (p[0]) {
2732 case LCP_OPT_MAGIC:
2733 /* Magic number -- extract. */
2734 nmagic = (uint32_t)p[2] << 24 |
2735 (uint32_t)p[3] << 16 | p[4] << 8 | p[5];
2736 if (nmagic != sp->lcp.magic) {
2737 if (debug)
2738 addlog(" 0x%x", nmagic);
2739 continue;
2740 }
2741 /*
2742 * Local and remote magics equal -- loopback?
2743 */
2744 if (sp->pp_loopcnt >= LOOPALIVECNT*5) {
2745 SPPP_DLOG(sp, "loopback\n");
2746 sp->pp_loopcnt = 0;
2747
2748 if (sp->pp_flags & PP_LOOPBACK_IFDOWN) {
2749 sp->pp_flags |= PP_LOOPBACK;
2750 sppp_wq_add(sp->wq_cp,
2751 &sp->work_ifdown);
2752 }
2753
2754 sppp_wq_add(sp->wq_cp,
2755 &sp->scp[IDX_LCP].work_close);
2756 sppp_wq_add(sp->wq_cp,
2757 &sp->scp[IDX_LCP].work_open);
2758 } else {
2759 if (debug)
2760 addlog(" [glitch]");
2761 ++sp->pp_loopcnt;
2762 }
2763 /*
2764 * We negate our magic here, and NAK it. If
2765 * we see it later in an NAK packet, we
2766 * suggest a new one.
2767 */
2768 nmagic = ~sp->lcp.magic;
2769 /* Gonna NAK it. */
2770 p[2] = nmagic >> 24;
2771 p[3] = nmagic >> 16;
2772 p[4] = nmagic >> 8;
2773 p[5] = nmagic;
2774 break;
2775
2776 case LCP_OPT_ASYNC_MAP:
2777 /*
2778 * Async control character map -- just ignore it.
2779 *
2780 * Quote from RFC 1662, chapter 6:
2781 * To enable this functionality, synchronous PPP
2782 * implementations MUST always respond to the
2783 * Async-Control-Character-Map Configuration
2784 * Option with the LCP Configure-Ack. However,
2785 * acceptance of the Configuration Option does
2786 * not imply that the synchronous implementation
2787 * will do any ACCM mapping. Instead, all such
2788 * octet mapping will be performed by the
2789 * asynchronous-to-synchronous converter.
2790 */
2791 continue;
2792
2793 case LCP_OPT_MRU:
2794 /*
2795 * Maximum receive unit. Always agreeable,
2796 * but ignored by now.
2797 */
2798 sp->lcp.their_mru = p[2] * 256 + p[3];
2799 if (debug)
2800 addlog(" %ld", sp->lcp.their_mru);
2801 continue;
2802
2803 case LCP_OPT_AUTH_PROTO:
2804 authproto = (p[2] << 8) + p[3];
2805 if (ISSET(sp->myauth.flags, SPPP_AUTHFLAG_PASSIVEAUTHPROTO)) {
2806 if (authproto == PPP_PAP || authproto == PPP_CHAP)
2807 sp->myauth.proto = authproto;
2808 }
2809 if (sp->myauth.proto == authproto) {
2810 if (authproto != PPP_CHAP || p[4] == CHAP_MD5) {
2811 continue;
2812 }
2813 if (debug)
2814 addlog(" [chap without MD5]");
2815 } else {
2816 if (debug) {
2817 char pbuf1[SPPP_PROTO_NAMELEN];
2818 char pbuf2[SPPP_PROTO_NAMELEN];
2819 const char *pname1, *pname2;
2820
2821 pname1 = sppp_proto_name(pbuf1,
2822 sizeof(pbuf1), sp->myauth.proto);
2823 pname2 = sppp_proto_name(pbuf2,
2824 sizeof(pbuf2), authproto);
2825 addlog(" [mine %s != his %s]",
2826 pname1, pname2);
2827 }
2828 }
2829 /* not agreed, nak */
2830 if (sp->myauth.proto == PPP_CHAP) {
2831 l = 5;
2832 } else {
2833 l = 4;
2834 }
2835
2836 if (rlen + l > blen) {
2837 if (debug)
2838 addlog(" [overflow]");
2839 continue;
2840 }
2841
2842 r[0] = LCP_OPT_AUTH_PROTO;
2843 r[1] = l;
2844 r[2] = sp->myauth.proto >> 8;
2845 r[3] = sp->myauth.proto & 0xff;
2846 if (sp->myauth.proto == PPP_CHAP)
2847 r[4] = CHAP_MD5;
2848 rlen += l;
2849 r += l;
2850 continue;
2851 case LCP_OPT_MP_EID:
2852 /*
2853 * Endpoint identification.
2854 * Always agreeable,
2855 * but ignored by now.
2856 */
2857 if (debug) {
2858 addlog(" type %d", p[2]);
2859 sppp_print_bytes(p+3, p[1]-3);
2860 }
2861 continue;
2862 case LCP_OPT_MP_MRRU:
2863 /*
2864 * Maximum received reconstructed unit.
2865 * Always agreeable,
2866 * but ignored by now.
2867 */
2868 sp->lcp.their_mrru = p[2] * 256 + p[3];
2869 if (debug)
2870 addlog(" %ld", sp->lcp.their_mrru);
2871 continue;
2872 }
2873 if (rlen + l > blen) {
2874 if (debug)
2875 addlog(" [overflow]");
2876 continue;
2877 }
2878 /* Add the option to nak'ed list. */
2879 memcpy(r, p, l);
2880 r += l;
2881 rlen += l;
2882 }
2883
2884 if (rlen > 0) {
2885 if (++sp->scp[IDX_LCP].fail_counter >= sp->lcp.max_failure) {
2886 if (debug)
2887 addlog(" max_failure (%d) exceeded, ",
2888 sp->lcp.max_failure);
2889 type = CP_RCR_REJ;
2890 } else {
2891 type = CP_RCR_NAK;
2892 }
2893 } else {
2894 type = CP_RCR_ACK;
2895 rlen = origlen;
2896 memcpy(r, h + 1, rlen);
2897 sp->scp[IDX_LCP].fail_counter = 0;
2898 sp->pp_loopcnt = 0;
2899 }
2900
2901 end:
2902 if (debug)
2903 addlog("\n");
2904
2905 if (type == CP_RCR_ERR || type == CP_RCR_DROP) {
2906 if (buf != NULL)
2907 kmem_intr_free(buf, blen);
2908 } else {
2909 *msgbuf = buf;
2910 *buflen = blen;
2911 *msglen = rlen;
2912 }
2913
2914 return type;
2915 }
2916
2917 /*
2918 * Analyze the LCP Configure-Reject option list, and adjust our
2919 * negotiation.
2920 */
2921 static void
sppp_lcp_confrej(struct sppp * sp,struct lcp_header * h,int len)2922 sppp_lcp_confrej(struct sppp *sp, struct lcp_header *h, int len)
2923 {
2924 u_char *p, l;
2925 bool debug;
2926
2927 KASSERT(SPPP_WLOCKED(sp));
2928
2929 debug = sppp_debug_enabled(sp);
2930
2931 if (len <= sizeof(*h))
2932 return;
2933
2934 len -= sizeof(*h);
2935
2936 if (debug)
2937 SPPP_LOG(sp, LOG_DEBUG, "lcp rej opts:");
2938
2939 p = (void *)(h + 1);
2940 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
2941 /* Sanity check option length */
2942 if (l > len) {
2943 /*
2944 * Malicious option - drop immediately.
2945 * XXX Maybe we should just RXJ it?
2946 */
2947 if (debug)
2948 addlog("\n");
2949
2950 SPPP_LOG(sp, LOG_DEBUG,
2951 "received malicious LCP option, dropping.\n");
2952 goto end;
2953 }
2954 if (debug) {
2955 char lbuf[SPPP_LCPOPT_NAMELEN];
2956 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf), *p));
2957 }
2958 switch (p[0]) {
2959 case LCP_OPT_MAGIC:
2960 /* Magic number -- can't use it, use 0 */
2961 CLR(sp->lcp.opts, SPPP_LCP_OPT_MAGIC);
2962 sp->lcp.magic = 0;
2963 break;
2964 case LCP_OPT_MRU:
2965 /*
2966 * We try to negotiate a lower MRU if the underlying
2967 * link's MTU is less than PP_MTU (e.g. PPPoE). If the
2968 * peer rejects this lower rate, fallback to the
2969 * default.
2970 */
2971 if (!debug) {
2972 SPPP_LOG(sp, LOG_INFO,
2973 "peer rejected our MRU of "
2974 "%ld bytes. Defaulting to %d bytes\n",
2975 sp->lcp.mru, PP_MTU);
2976 }
2977 CLR(sp->lcp.opts, SPPP_LCP_OPT_MRU);
2978 sp->lcp.mru = PP_MTU;
2979 break;
2980 case LCP_OPT_AUTH_PROTO:
2981 /*
2982 * Peer doesn't want to authenticate himself,
2983 * deny unless this is a dialout call, and
2984 * SPPP_AUTHFLAG_NOCALLOUT is set.
2985 */
2986 if ((sp->pp_flags & PP_CALLIN) == 0 &&
2987 (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) {
2988 if (debug) {
2989 addlog(" [don't insist on auth "
2990 "for callout]");
2991 }
2992 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO);
2993 break;
2994 }
2995 if (debug)
2996 addlog("[access denied]\n");
2997 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
2998 break;
2999 }
3000 }
3001 if (debug)
3002 addlog("\n");
3003 end:
3004 return;
3005 }
3006
3007 /*
3008 * Analyze the LCP Configure-NAK option list, and adjust our
3009 * negotiation.
3010 */
3011 static void
sppp_lcp_confnak(struct sppp * sp,struct lcp_header * h,int len)3012 sppp_lcp_confnak(struct sppp *sp, struct lcp_header *h, int len)
3013 {
3014 u_char *p, l;
3015 uint32_t magic;
3016 bool debug;
3017
3018 KASSERT(SPPP_WLOCKED(sp));
3019
3020 if (len <= sizeof(*h))
3021 return;
3022
3023 debug = sppp_debug_enabled(sp);
3024 len -= sizeof(*h);
3025
3026 if (debug)
3027 SPPP_LOG(sp, LOG_DEBUG, "lcp nak opts:");
3028
3029 p = (void *)(h + 1);
3030 for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3031 /* Sanity check option length */
3032 if (l > len) {
3033 /*
3034 * Malicious option - drop immediately.
3035 * XXX Maybe we should just RXJ it?
3036 */
3037 if (debug)
3038 addlog("\n");
3039
3040 SPPP_LOG(sp, LOG_DEBUG,
3041 "received malicious LCP option, dropping.\n");
3042 goto end;
3043 }
3044 if (debug) {
3045 char lbuf[SPPP_LCPOPT_NAMELEN];
3046 addlog(" %s", sppp_lcp_opt_name(lbuf, sizeof(lbuf),*p));
3047 }
3048 switch (p[0]) {
3049 case LCP_OPT_MAGIC:
3050 /* Magic number -- renegotiate */
3051 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC) &&
3052 len >= 6 && l == 6) {
3053 magic = (uint32_t)p[2] << 24 |
3054 (uint32_t)p[3] << 16 | p[4] << 8 | p[5];
3055 /*
3056 * If the remote magic is our negated one,
3057 * this looks like a loopback problem.
3058 * Suggest a new magic to make sure.
3059 */
3060 if (magic == ~sp->lcp.magic) {
3061 if (debug)
3062 addlog(" magic glitch");
3063 sp->lcp.magic = cprng_fast32();
3064 } else {
3065 sp->lcp.magic = magic;
3066 if (debug)
3067 addlog(" %d", magic);
3068 }
3069 }
3070 break;
3071 case LCP_OPT_MRU:
3072 /*
3073 * Peer wants to advise us to negotiate an MRU.
3074 * Agree on it if it's reasonable, or use
3075 * default otherwise.
3076 */
3077 if (len >= 4 && l == 4) {
3078 u_int mru = p[2] * 256 + p[3];
3079 if (debug)
3080 addlog(" %d", mru);
3081 if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu)
3082 mru = sp->pp_if.if_mtu;
3083 sp->lcp.mru = mru;
3084 SET(sp->lcp.opts, SPPP_LCP_OPT_MRU);
3085 }
3086 break;
3087 case LCP_OPT_AUTH_PROTO:
3088 /*
3089 * Peer doesn't like our authentication method,
3090 * deny.
3091 */
3092 if (debug)
3093 addlog("[access denied]\n");
3094 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
3095 break;
3096 }
3097 }
3098 if (debug)
3099 addlog("\n");
3100 end:
3101 return;
3102 }
3103
3104 static void
sppp_lcp_tlu(struct sppp * sp)3105 sppp_lcp_tlu(struct sppp *sp)
3106 {
3107 struct ifnet *ifp;
3108 struct sppp_cp *scp;
3109 int i;
3110 bool going_up;
3111
3112 KASSERT(SPPP_WLOCKED(sp));
3113
3114 ifp = &sp->pp_if;
3115
3116 /* unlock for IFNET_LOCK and if_up() */
3117 SPPP_UNLOCK(sp);
3118
3119 if (! (ifp->if_flags & IFF_UP) &&
3120 (ifp->if_flags & IFF_RUNNING)) {
3121 /* Coming out of loopback mode. */
3122 going_up = true;
3123 if_up(ifp);
3124 } else {
3125 going_up = false;
3126 }
3127
3128 IFNET_LOCK(ifp);
3129 SPPP_LOCK(sp, RW_WRITER);
3130
3131 if (going_up) {
3132 if ((sp->pp_flags & PP_LOOPBACK) == 0) {
3133 SPPP_LOG(sp, LOG_DEBUG,
3134 "interface is going up, "
3135 "but no loopback packet is detected\n");
3136 }
3137 sp->pp_flags &= ~PP_LOOPBACK;
3138 }
3139
3140 if (ifp->if_mtu > sp->lcp.their_mru) {
3141 sp->pp_saved_mtu = ifp->if_mtu;
3142 ifp->if_mtu = sp->lcp.their_mru;
3143 SPPP_DLOG(sp, "setting MTU "
3144 "from %"PRIu64" bytes to %"PRIu64" bytes\n",
3145 sp->pp_saved_mtu, ifp->if_mtu);
3146 }
3147 IFNET_UNLOCK(ifp);
3148
3149 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO) ||
3150 (sp->pp_flags & PP_NEEDAUTH) != 0)
3151 sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE);
3152 else
3153 sppp_change_phase(sp, SPPP_PHASE_NETWORK);
3154
3155
3156 for (i = 0; i < IDX_COUNT; i++) {
3157 scp = &sp->scp[(cps[i])->protoidx];
3158
3159 if (((cps[i])->flags & CP_LCP) == 0)
3160 sppp_wq_add(sp->wq_cp, &scp->work_up);
3161
3162 /*
3163 * Open all authentication protocols. This is even required
3164 * if we already proceeded to network phase, since it might be
3165 * that remote wants us to authenticate, so we might have to
3166 * send a PAP request. Undesired authentication protocols
3167 * don't do anything when they get an Open event.
3168 */
3169 if ((cps[i])->flags & CP_AUTH)
3170 sppp_wq_add(sp->wq_cp, &scp->work_open);
3171
3172 /* Open all NCPs. */
3173 if (sp->pp_phase == SPPP_PHASE_NETWORK &&
3174 ((cps[i])->flags & CP_NCP) != 0) {
3175 sppp_wq_add(sp->wq_cp, &scp->work_open);
3176 }
3177 }
3178
3179 /* notify low-level driver of state change */
3180 sppp_notify_chg_wlocked(sp);
3181 }
3182
3183 static void
sppp_lcp_tld(struct sppp * sp)3184 sppp_lcp_tld(struct sppp *sp)
3185 {
3186 struct ifnet *ifp;
3187 struct sppp_cp *scp;
3188 int i, phase;
3189
3190 KASSERT(SPPP_WLOCKED(sp));
3191
3192 phase = sp->pp_phase;
3193
3194 sppp_change_phase(sp, SPPP_PHASE_TERMINATE);
3195
3196 if (sp->pp_saved_mtu > 0) {
3197 ifp = &sp->pp_if;
3198
3199 SPPP_UNLOCK(sp);
3200 IFNET_LOCK(ifp);
3201 SPPP_LOCK(sp, RW_WRITER);
3202
3203 SPPP_DLOG(sp, "setting MTU "
3204 "from %"PRIu64" bytes to %"PRIu64" bytes\n",
3205 ifp->if_mtu, sp->pp_saved_mtu);
3206
3207 ifp->if_mtu = sp->pp_saved_mtu;
3208 sp->pp_saved_mtu = 0;
3209 IFNET_UNLOCK(ifp);
3210 }
3211
3212 /*
3213 * Take upper layers down. We send the Down event first and
3214 * the Close second to prevent the upper layers from sending
3215 * ``a flurry of terminate-request packets'', as the RFC
3216 * describes it.
3217 */
3218 for (i = 0; i < IDX_COUNT; i++) {
3219 scp = &sp->scp[(cps[i])->protoidx];
3220
3221 if (((cps[i])->flags & CP_LCP) == 0)
3222 sppp_wq_add(sp->wq_cp, &scp->work_down);
3223
3224 if ((cps[i])->flags & CP_AUTH) {
3225 sppp_wq_add(sp->wq_cp, &scp->work_close);
3226 }
3227
3228 /* Close all NCPs. */
3229 if (phase == SPPP_PHASE_NETWORK &&
3230 ((cps[i])->flags & CP_NCP) != 0) {
3231 sppp_wq_add(sp->wq_cp, &scp->work_close);
3232 }
3233 }
3234 }
3235
3236 static void
sppp_lcp_tls(const struct cp * cp __unused,struct sppp * sp)3237 sppp_lcp_tls(const struct cp *cp __unused, struct sppp *sp)
3238 {
3239
3240 KASSERT(SPPP_WLOCKED(sp));
3241
3242 sppp_change_phase(sp, SPPP_PHASE_ESTABLISH);
3243
3244 /* Notify lower layer if desired. */
3245 sppp_notify_tls_wlocked(sp);
3246 sp->lcp.tlf_sent = false;
3247 }
3248
3249 static void
sppp_lcp_tlf(const struct cp * cp __unused,struct sppp * sp)3250 sppp_lcp_tlf(const struct cp *cp __unused, struct sppp *sp)
3251 {
3252
3253 KASSERT(SPPP_WLOCKED(sp));
3254
3255 sppp_change_phase(sp, SPPP_PHASE_DEAD);
3256
3257 /* Notify lower layer if desired. */
3258 sppp_notify_tlf_wlocked(sp);
3259
3260 switch (sp->scp[IDX_LCP].state) {
3261 case STATE_CLOSED:
3262 case STATE_STOPPED:
3263 sp->lcp.tlf_sent = true;
3264 break;
3265 case STATE_INITIAL:
3266 default:
3267 /* just in case */
3268 sp->lcp.tlf_sent = false;
3269 }
3270 }
3271
3272 static void
sppp_lcp_scr(struct sppp * sp)3273 sppp_lcp_scr(struct sppp *sp)
3274 {
3275 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
3276 int i = 0;
3277 u_short authproto;
3278
3279 KASSERT(SPPP_WLOCKED(sp));
3280
3281 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_MAGIC)) {
3282 if (! sp->lcp.magic)
3283 sp->lcp.magic = cprng_fast32();
3284 opt[i++] = LCP_OPT_MAGIC;
3285 opt[i++] = 6;
3286 opt[i++] = sp->lcp.magic >> 24;
3287 opt[i++] = sp->lcp.magic >> 16;
3288 opt[i++] = sp->lcp.magic >> 8;
3289 opt[i++] = sp->lcp.magic;
3290 }
3291
3292 if (ISSET(sp->lcp.opts,SPPP_LCP_OPT_MRU)) {
3293 opt[i++] = LCP_OPT_MRU;
3294 opt[i++] = 4;
3295 opt[i++] = sp->lcp.mru >> 8;
3296 opt[i++] = sp->lcp.mru;
3297 }
3298
3299 if (ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO)) {
3300 authproto = sp->hisauth.proto;
3301 opt[i++] = LCP_OPT_AUTH_PROTO;
3302 opt[i++] = authproto == PPP_CHAP? 5: 4;
3303 opt[i++] = authproto >> 8;
3304 opt[i++] = authproto;
3305 if (authproto == PPP_CHAP)
3306 opt[i++] = CHAP_MD5;
3307 }
3308
3309 sp->scp[IDX_LCP].confid = ++sp->scp[IDX_LCP].seq;
3310 sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->scp[IDX_LCP].confid, i, &opt);
3311 }
3312
3313 /*
3314 * Check the open NCPs, return true if at least one NCP is open.
3315 */
3316
3317 static int
sppp_cp_check(struct sppp * sp,u_char cp_flags)3318 sppp_cp_check(struct sppp *sp, u_char cp_flags)
3319 {
3320 int i, mask;
3321
3322 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
3323 if ((sp->lcp.protos & mask) && (cps[i])->flags & cp_flags)
3324 return 1;
3325 return 0;
3326 }
3327
3328 /*
3329 * Re-check the open NCPs and see if we should terminate the link.
3330 * Called by the NCPs during their tlf action handling.
3331 */
3332 static void
sppp_lcp_check_and_close(struct sppp * sp)3333 sppp_lcp_check_and_close(struct sppp *sp)
3334 {
3335
3336 KASSERT(SPPP_WLOCKED(sp));
3337
3338 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) {
3339 /* don't bother, we are already going down */
3340 return;
3341 }
3342
3343 if (sp->pp_phase == SPPP_PHASE_AUTHENTICATE &&
3344 sppp_cp_check(sp, CP_AUTH))
3345 return;
3346
3347 if (sp->pp_phase >= SPPP_PHASE_NETWORK &&
3348 sppp_cp_check(sp, CP_NCP))
3349 return;
3350
3351 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
3352
3353 if (sp->pp_max_auth_fail != 0 &&
3354 sp->pp_auth_failures >= sp->pp_max_auth_fail) {
3355 SPPP_LOG(sp, LOG_INFO, "authentication failed %d times, "
3356 "not retrying again\n", sp->pp_auth_failures);
3357
3358 sppp_wq_add(sp->wq_cp, &sp->work_ifdown);
3359 sp->pp_if.if_flags &= ~IFF_RUNNING;
3360 } else {
3361 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_open);
3362 }
3363 }
3364
3365 /*
3366 *--------------------------------------------------------------------------*
3367 * *
3368 * The IPCP implementation. *
3369 * *
3370 *--------------------------------------------------------------------------*
3371 */
3372
3373 static void
sppp_ipcp_init(struct sppp * sp)3374 sppp_ipcp_init(struct sppp *sp)
3375 {
3376
3377 KASSERT(SPPP_WLOCKED(sp));
3378
3379 sppp_cp_init(&ipcp, sp);
3380
3381 sp->ipcp.opts = 0;
3382 sp->ipcp.flags = 0;
3383 }
3384
3385 static void
sppp_ipcp_open(struct sppp * sp,void * xcp)3386 sppp_ipcp_open(struct sppp *sp, void *xcp)
3387 {
3388 uint32_t myaddr, hisaddr;
3389
3390 KASSERT(SPPP_WLOCKED(sp));
3391 KASSERT(!cpu_softintr_p());
3392
3393 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPCP))
3394 return;
3395
3396 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
3397 sp->ipcp.req_myaddr = 0;
3398 sp->ipcp.req_hisaddr = 0;
3399 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
3400
3401 #ifdef INET
3402 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
3403 #else
3404 myaddr = hisaddr = 0;
3405 #endif
3406 /*
3407 * If we don't have his address, this probably means our
3408 * interface doesn't want to talk IP at all. (This could
3409 * be the case if somebody wants to speak only IPX, for
3410 * example.) Don't open IPCP in this case.
3411 */
3412 if (hisaddr == 0) {
3413 /* XXX this message should go away */
3414 SPPP_DLOG(sp, "ipcp_open(): no IP interface\n");
3415 return;
3416 }
3417
3418 if (myaddr == 0) {
3419 /*
3420 * I don't have an assigned address, so i need to
3421 * negotiate my address.
3422 */
3423 sp->ipcp.flags |= IPCP_MYADDR_DYN;
3424 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS);
3425 }
3426 if (hisaddr == 1) {
3427 /*
3428 * XXX - remove this hack!
3429 * remote has no valid address, we need to get one assigned.
3430 */
3431 sp->ipcp.flags |= IPCP_HISADDR_DYN;
3432 sp->ipcp.saved_hisaddr = htonl(hisaddr);
3433 }
3434
3435 if (sp->query_dns & 1) {
3436 SET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS);
3437 } else {
3438 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS);
3439 }
3440
3441 if (sp->query_dns & 2) {
3442 SET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS);
3443 } else {
3444 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS);
3445 }
3446 sppp_open_event(sp, xcp);
3447 }
3448
3449 static void
sppp_ipcp_close(struct sppp * sp,void * xcp)3450 sppp_ipcp_close(struct sppp *sp, void *xcp)
3451 {
3452
3453 KASSERT(SPPP_WLOCKED(sp));
3454 KASSERT(!cpu_softintr_p());
3455
3456 sppp_close_event(sp, xcp);
3457
3458 #ifdef INET
3459 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) {
3460 /*
3461 * Some address was dynamic, clear it again.
3462 */
3463 sppp_clear_ip_addrs(sp);
3464 }
3465 #endif
3466 memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
3467 }
3468
3469 /*
3470 * Analyze a configure request. Return true if it was agreeable, and
3471 * caused action sca, false if it has been rejected or nak'ed, and
3472 * caused action scn. (The return value is used to make the state
3473 * transition decision in the state automaton.)
3474 */
3475 static enum cp_rcr_type
sppp_ipcp_confreq(struct sppp * sp,struct lcp_header * h,int origlen,uint8_t ** msgbuf,size_t * buflen,size_t * msglen)3476 sppp_ipcp_confreq(struct sppp *sp, struct lcp_header *h, int origlen,
3477 uint8_t **msgbuf, size_t *buflen, size_t *msglen)
3478 {
3479 u_char *buf, *r, *p, l, blen;
3480 enum cp_rcr_type type;
3481 int rlen, len;
3482 uint32_t hisaddr, desiredaddr;
3483 char ipbuf[SPPP_IPCPOPT_NAMELEN];
3484 char dqbuf[SPPP_DOTQUAD_BUFLEN];
3485 const char *dq;
3486 bool debug;
3487
3488 KASSERT(SPPP_WLOCKED(sp));
3489
3490 type = CP_RCR_NONE;
3491 origlen -= sizeof(*h);
3492
3493 if (origlen < 0)
3494 return CP_RCR_DROP;
3495
3496 debug = sppp_debug_enabled(sp);
3497
3498 /*
3499 * Make sure to allocate a buf that can at least hold a
3500 * conf-nak with an `address' option. We might need it below.
3501 */
3502 blen = MAX(6, origlen);
3503
3504 buf = kmem_intr_alloc(blen, KM_NOSLEEP);
3505 if (buf == NULL)
3506 return CP_RCR_DROP;
3507
3508 /* pass 1: see if we can recognize them */
3509 if (debug)
3510 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opts:");
3511 p = (void *)(h + 1);
3512 r = buf;
3513 rlen = 0;
3514 for (len = origlen; len > 1; len -= l, p += l) {
3515 l = p[1];
3516 if (l == 0)
3517 break;
3518
3519 /* Sanity check option length */
3520 if (l > len) {
3521 /* XXX should we just RXJ? */
3522 if (debug)
3523 addlog("\n");
3524
3525 SPPP_LOG(sp, LOG_DEBUG,
3526 " malicious IPCP option received, dropping\n");
3527 type = CP_RCR_ERR;
3528 goto end;
3529 }
3530 if (debug) {
3531 addlog(" %s",
3532 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p));
3533 }
3534 switch (p[0]) {
3535 #ifdef notyet
3536 case IPCP_OPT_COMPRESSION:
3537 if (len >= 6 && l >= 6) {
3538 /* correctly formed compress option */
3539 continue;
3540 }
3541 if (debug)
3542 addlog(" [invalid]");
3543 break;
3544 #endif
3545 case IPCP_OPT_ADDRESS:
3546 if (len >= 6 && l == 6) {
3547 /* correctly formed address option */
3548 continue;
3549 }
3550 if (debug)
3551 addlog(" [invalid]");
3552 break;
3553 default:
3554 /* Others not supported. */
3555 if (debug)
3556 addlog(" [rej]");
3557 break;
3558 }
3559 /* Add the option to rejected list. */
3560 if (rlen + l > blen) {
3561 if (debug)
3562 addlog(" [overflow]");
3563 continue;
3564 }
3565 memcpy(r, p, l);
3566 r += l;
3567 rlen += l;
3568 }
3569
3570 if (rlen > 0) {
3571 type = CP_RCR_REJ;
3572 goto end;
3573 }
3574
3575 if (debug)
3576 addlog("\n");
3577
3578 /* pass 2: parse option values */
3579 if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
3580 hisaddr = sp->ipcp.req_hisaddr; /* we already aggreed on that */
3581 else
3582 #ifdef INET
3583 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */
3584 #else
3585 hisaddr = 0;
3586 #endif
3587 if (debug)
3588 SPPP_LOG(sp, LOG_DEBUG, "ipcp parse opt values:");
3589 p = (void *)(h + 1);
3590 r = buf;
3591 rlen = 0;
3592 for (len = origlen; len > 1; len -= l, p += l) {
3593 l = p[1];
3594 if (l == 0)
3595 break;
3596
3597 if (debug) {
3598 addlog(" %s",
3599 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p));
3600 }
3601 switch (p[0]) {
3602 #ifdef notyet
3603 case IPCP_OPT_COMPRESSION:
3604 continue;
3605 #endif
3606 case IPCP_OPT_ADDRESS:
3607 desiredaddr = p[2] << 24 | p[3] << 16 |
3608 p[4] << 8 | p[5];
3609 if (desiredaddr == hisaddr ||
3610 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) {
3611 /*
3612 * Peer's address is same as our value,
3613 * this is agreeable. Gonna conf-ack
3614 * it.
3615 */
3616 if (debug) {
3617 dq = sppp_dotted_quad(dqbuf,
3618 sizeof(dqbuf), hisaddr);
3619 addlog(" %s [ack]", dq);
3620 }
3621 /* record that we've seen it already */
3622 sp->ipcp.flags |= IPCP_HISADDR_SEEN;
3623 sp->ipcp.req_hisaddr = desiredaddr;
3624 hisaddr = desiredaddr;
3625 continue;
3626 }
3627 /*
3628 * The address wasn't agreeable. This is either
3629 * he sent us 0.0.0.0, asking to assign him an
3630 * address, or he send us another address not
3631 * matching our value. Either case, we gonna
3632 * conf-nak it with our value.
3633 */
3634 if (debug) {
3635 if (desiredaddr == 0) {
3636 addlog(" [addr requested]");
3637 } else {
3638 dq = sppp_dotted_quad(dqbuf,
3639 sizeof(dqbuf), desiredaddr);
3640 addlog(" %s [not agreed]", dq);
3641 }
3642 }
3643
3644 p[2] = hisaddr >> 24;
3645 p[3] = hisaddr >> 16;
3646 p[4] = hisaddr >> 8;
3647 p[5] = hisaddr;
3648 break;
3649 }
3650 if (rlen + l > blen) {
3651 if (debug)
3652 addlog(" [overflow]");
3653 continue;
3654 }
3655 /* Add the option to nak'ed list. */
3656 memcpy(r, p, l);
3657 r += l;
3658 rlen += l;
3659 }
3660
3661 if (rlen > 0) {
3662 type = CP_RCR_NAK;
3663 } else {
3664 if ((sp->ipcp.flags & IPCP_HISADDR_SEEN) == 0) {
3665 /*
3666 * If we are about to conf-ack the request, but haven't seen
3667 * his address so far, gonna conf-nak it instead, with the
3668 * `address' option present and our idea of his address being
3669 * filled in there, to request negotiation of both addresses.
3670 *
3671 * XXX This can result in an endless req - nak loop if peer
3672 * doesn't want to send us his address. Q: What should we do
3673 * about it? XXX A: implement the max-failure counter.
3674 */
3675 buf[0] = IPCP_OPT_ADDRESS;
3676 buf[1] = 6;
3677 buf[2] = hisaddr >> 24;
3678 buf[3] = hisaddr >> 16;
3679 buf[4] = hisaddr >> 8;
3680 buf[5] = hisaddr;
3681 rlen = 6;
3682 if (debug)
3683 addlog(" still need hisaddr");
3684 type = CP_RCR_NAK;
3685 } else {
3686 type = CP_RCR_ACK;
3687 rlen = origlen;
3688 memcpy(r, h + 1, rlen);
3689 }
3690 }
3691
3692 end:
3693 if (debug)
3694 addlog("\n");
3695
3696 if (type == CP_RCR_ERR || type == CP_RCR_DROP) {
3697 if (buf != NULL)
3698 kmem_intr_free(buf, blen);
3699 } else {
3700 *msgbuf = buf;
3701 *buflen = blen;
3702 *msglen = rlen;
3703 }
3704
3705 return type;
3706 }
3707
3708 /*
3709 * Analyze the IPCP Configure-Reject option list, and adjust our
3710 * negotiation.
3711 */
3712 static void
sppp_ipcp_confrej(struct sppp * sp,struct lcp_header * h,int len)3713 sppp_ipcp_confrej(struct sppp *sp, struct lcp_header *h, int len)
3714 {
3715 u_char *p, l;
3716 bool debug;
3717
3718 KASSERT(SPPP_WLOCKED(sp));
3719
3720 if (len <= sizeof(*h))
3721 return;
3722
3723 len -= sizeof(*h);
3724 debug = sppp_debug_enabled(sp);
3725
3726 if (debug)
3727 SPPP_LOG(sp, LOG_DEBUG, "ipcp rej opts:");
3728
3729 p = (void *)(h + 1);
3730 for (; len > 1; len -= l, p += l) {
3731 l = p[1];
3732 if (l == 0)
3733 break;
3734
3735 /* Sanity check option length */
3736 if (l > len) {
3737 /* XXX should we just RXJ? */
3738 if (debug)
3739 addlog("\n");
3740 SPPP_LOG(sp, LOG_DEBUG,
3741 "malicious IPCP option received, dropping\n");
3742 goto end;
3743 }
3744 if (debug) {
3745 char ipbuf[SPPP_IPCPOPT_NAMELEN];
3746 addlog(" %s",
3747 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p));
3748 }
3749 switch (p[0]) {
3750 case IPCP_OPT_ADDRESS:
3751 /*
3752 * Peer doesn't grok address option. This is
3753 * bad. XXX Should we better give up here?
3754 */
3755 if (!debug) {
3756 SPPP_LOG(sp, LOG_ERR,
3757 "IPCP address option rejected\n");
3758 }
3759 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS);
3760 break;
3761 #ifdef notyet
3762 case IPCP_OPT_COMPRESS:
3763 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_COMPRESS);
3764 break;
3765 #endif
3766 case IPCP_OPT_PRIMDNS:
3767 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS);
3768 break;
3769
3770 case IPCP_OPT_SECDNS:
3771 CLR(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS);
3772 break;
3773 }
3774 }
3775 if (debug)
3776 addlog("\n");
3777 end:
3778 return;
3779 }
3780
3781 /*
3782 * Analyze the IPCP Configure-NAK option list, and adjust our
3783 * negotiation.
3784 */
3785 static void
sppp_ipcp_confnak(struct sppp * sp,struct lcp_header * h,int len)3786 sppp_ipcp_confnak(struct sppp *sp, struct lcp_header *h, int len)
3787 {
3788 u_char *p, l;
3789 struct ifnet *ifp = &sp->pp_if;
3790 int debug = ifp->if_flags & IFF_DEBUG;
3791 uint32_t wantaddr;
3792
3793 KASSERT(SPPP_WLOCKED(sp));
3794
3795 len -= sizeof(*h);
3796
3797 debug = sppp_debug_enabled(sp);
3798
3799 if (debug)
3800 SPPP_LOG(sp, LOG_DEBUG, "ipcp nak opts:");
3801
3802 p = (void *)(h + 1);
3803 for (; len > 1; len -= l, p += l) {
3804 l = p[1];
3805 if (l == 0)
3806 break;
3807
3808 /* Sanity check option length */
3809 if (l > len) {
3810 /* XXX should we just RXJ? */
3811 if (debug)
3812 addlog("\n");
3813 SPPP_LOG(sp, LOG_DEBUG,
3814 "malicious IPCP option received, dropping\n");
3815 return;
3816 }
3817 if (debug) {
3818 char ipbuf[SPPP_IPCPOPT_NAMELEN];
3819 addlog(" %s",
3820 sppp_ipcp_opt_name(ipbuf, sizeof(ipbuf), *p));
3821 }
3822 switch (*p) {
3823 case IPCP_OPT_ADDRESS:
3824 /*
3825 * Peer doesn't like our local IP address. See
3826 * if we can do something for him. We'll drop
3827 * him our address then.
3828 */
3829 if (len >= 6 && l == 6) {
3830 wantaddr = p[2] << 24 | p[3] << 16 |
3831 p[4] << 8 | p[5];
3832 SET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS);
3833 if (debug) {
3834 char dqbuf[SPPP_DOTQUAD_BUFLEN];
3835 const char *dq;
3836
3837 dq = sppp_dotted_quad(dqbuf,
3838 sizeof(dqbuf), wantaddr);
3839 addlog(" [wantaddr %s]", dq);
3840 }
3841 /*
3842 * When doing dynamic address assignment,
3843 * we accept his offer. Otherwise, we
3844 * ignore it and thus continue to negotiate
3845 * our already existing value.
3846 */
3847 if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
3848 if (ntohl(wantaddr) != INADDR_ANY) {
3849 if (debug)
3850 addlog(" [agree]");
3851 sp->ipcp.flags |= IPCP_MYADDR_SEEN;
3852 sp->ipcp.req_myaddr = wantaddr;
3853 } else {
3854 if (debug)
3855 addlog(" [not agreed]");
3856 }
3857 }
3858 }
3859 break;
3860
3861 case IPCP_OPT_PRIMDNS:
3862 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS) &&
3863 len >= 6 && l == 6) {
3864 sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 |
3865 p[4] << 8 | p[5];
3866 }
3867 break;
3868
3869 case IPCP_OPT_SECDNS:
3870 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS) &&
3871 len >= 6 && l == 6) {
3872 sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 |
3873 p[4] << 8 | p[5];
3874 }
3875 break;
3876 #ifdef notyet
3877 case IPCP_OPT_COMPRESS:
3878 /*
3879 * Peer wants different compression parameters.
3880 */
3881 break;
3882 #endif
3883 }
3884 }
3885 if (debug)
3886 addlog("\n");
3887 }
3888
3889 static void
sppp_ipcp_tlu(struct sppp * sp)3890 sppp_ipcp_tlu(struct sppp *sp)
3891 {
3892 #ifdef INET
3893 struct ifnet *ifp;
3894
3895 KASSERT(SPPP_WLOCKED(sp));
3896
3897 SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n");
3898 ifp = &sp->pp_if;
3899 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) &&
3900 ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) {
3901 SPPP_LOG(sp, LOG_WARNING,
3902 "no IP address, closing IPCP\n");
3903 sppp_wq_add(sp->wq_cp,
3904 &sp->scp[IDX_IPCP].work_close);
3905 } else {
3906 /* we are up. Set addresses and notify anyone interested */
3907 sppp_set_ip_addrs(sp);
3908 rt_ifmsg(ifp);
3909 }
3910 #endif
3911 }
3912
3913 static void
sppp_ipcp_tld(struct sppp * sp)3914 sppp_ipcp_tld(struct sppp *sp)
3915 {
3916 #ifdef INET
3917 struct ifnet *ifp;
3918
3919 KASSERT(SPPP_WLOCKED(sp));
3920
3921 SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n");
3922 ifp = &sp->pp_if;
3923 rt_ifmsg(ifp);
3924 #endif
3925 }
3926
3927 static void
sppp_ipcp_scr(struct sppp * sp)3928 sppp_ipcp_scr(struct sppp *sp)
3929 {
3930 uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */];
3931 #ifdef INET
3932 uint32_t ouraddr;
3933 #endif
3934 int i = 0;
3935
3936 KASSERT(SPPP_WLOCKED(sp));
3937
3938 #ifdef notyet
3939 if (ISSET(sp->ipcp.opts,SPPP_IPCP_OPT_COMPRESSION)) {
3940 opt[i++] = IPCP_OPT_COMPRESSION;
3941 opt[i++] = 6;
3942 opt[i++] = 0; /* VJ header compression */
3943 opt[i++] = 0x2d; /* VJ header compression */
3944 opt[i++] = max_slot_id;
3945 opt[i++] = comp_slot_id;
3946 }
3947 #endif
3948
3949 #ifdef INET
3950 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_ADDRESS)) {
3951 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) {
3952 ouraddr = sp->ipcp.req_myaddr; /* not sure if this can ever happen */
3953 } else {
3954 sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
3955 }
3956 opt[i++] = IPCP_OPT_ADDRESS;
3957 opt[i++] = 6;
3958 opt[i++] = ouraddr >> 24;
3959 opt[i++] = ouraddr >> 16;
3960 opt[i++] = ouraddr >> 8;
3961 opt[i++] = ouraddr;
3962 }
3963 #endif
3964
3965 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_PRIMDNS)) {
3966 opt[i++] = IPCP_OPT_PRIMDNS;
3967 opt[i++] = 6;
3968 opt[i++] = sp->dns_addrs[0] >> 24;
3969 opt[i++] = sp->dns_addrs[0] >> 16;
3970 opt[i++] = sp->dns_addrs[0] >> 8;
3971 opt[i++] = sp->dns_addrs[0];
3972 }
3973 if (ISSET(sp->ipcp.opts, SPPP_IPCP_OPT_SECDNS)) {
3974 opt[i++] = IPCP_OPT_SECDNS;
3975 opt[i++] = 6;
3976 opt[i++] = sp->dns_addrs[1] >> 24;
3977 opt[i++] = sp->dns_addrs[1] >> 16;
3978 opt[i++] = sp->dns_addrs[1] >> 8;
3979 opt[i++] = sp->dns_addrs[1];
3980 }
3981
3982 sp->scp[IDX_IPCP].confid = ++sp->scp[IDX_IPCP].seq;
3983 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->scp[IDX_IPCP].confid, i, &opt);
3984 }
3985
3986 /*
3987 *--------------------------------------------------------------------------*
3988 * *
3989 * The IPv6CP implementation. *
3990 * *
3991 *--------------------------------------------------------------------------*
3992 */
3993
3994 #ifdef INET6
3995 static void
sppp_ipv6cp_init(struct sppp * sp)3996 sppp_ipv6cp_init(struct sppp *sp)
3997 {
3998
3999 KASSERT(SPPP_WLOCKED(sp));
4000
4001 sppp_cp_init(&ipv6cp, sp);
4002
4003 sp->ipv6cp.opts = 0;
4004 sp->ipv6cp.flags = 0;
4005 }
4006
4007 static void
sppp_ipv6cp_open(struct sppp * sp,void * xcp)4008 sppp_ipv6cp_open(struct sppp *sp, void *xcp)
4009 {
4010 struct in6_addr myaddr, hisaddr;
4011
4012 KASSERT(SPPP_WLOCKED(sp));
4013 KASSERT(!cpu_softintr_p());
4014
4015 if (!ISSET(sp->pp_ncpflags, SPPP_NCP_IPV6CP))
4016 return;
4017
4018 #ifdef IPV6CP_MYIFID_DYN
4019 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
4020 #else
4021 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
4022 #endif
4023
4024 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
4025 /*
4026 * If we don't have our address, this probably means our
4027 * interface doesn't want to talk IPv6 at all. (This could
4028 * be the case if somebody wants to speak only IPX, for
4029 * example.) Don't open IPv6CP in this case.
4030 */
4031 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
4032 /* XXX this message should go away */
4033 SPPP_DLOG(sp, "ipv6cp_open(): no IPv6 interface\n");
4034 return;
4035 }
4036
4037 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
4038 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID);
4039 sppp_open_event(sp, xcp);
4040 }
4041
4042 /*
4043 * Analyze a configure request. Return true if it was agreeable, and
4044 * caused action sca, false if it has been rejected or nak'ed, and
4045 * caused action scn. (The return value is used to make the state
4046 * transition decision in the state automaton.)
4047 */
4048 static enum cp_rcr_type
sppp_ipv6cp_confreq(struct sppp * sp,struct lcp_header * h,int origlen,uint8_t ** msgbuf,size_t * buflen,size_t * msglen)4049 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h, int origlen,
4050 uint8_t **msgbuf, size_t *buflen, size_t *msglen)
4051 {
4052 u_char *buf, *r, *p, l, blen;
4053 int rlen, len;
4054 struct in6_addr myaddr, desiredaddr, suggestaddr;
4055 enum cp_rcr_type type;
4056 int ifidcount;
4057 int collision, nohisaddr;
4058 char ip6buf[INET6_ADDRSTRLEN];
4059 char tbuf[SPPP_CPTYPE_NAMELEN];
4060 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN];
4061 const char *cpname;
4062 bool debug;
4063
4064 KASSERT(SPPP_WLOCKED(sp));
4065
4066 debug = sppp_debug_enabled(sp);
4067 type = CP_RCR_NONE;
4068 origlen -= sizeof(*h);
4069
4070 if (origlen < 0)
4071 return CP_RCR_DROP;
4072
4073 /*
4074 * Make sure to allocate a buf that can at least hold a
4075 * conf-nak with an `address' option. We might need it below.
4076 */
4077 blen = MAX(6, origlen);
4078
4079 buf = kmem_intr_alloc(blen, KM_NOSLEEP);
4080 if (buf == NULL)
4081 return CP_RCR_DROP;
4082
4083 /* pass 1: see if we can recognize them */
4084 if (debug)
4085 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opts:");
4086 p = (void *)(h + 1);
4087 r = buf;
4088 rlen = 0;
4089 ifidcount = 0;
4090 for (len = origlen; len > 1; len -= l, p += l) {
4091 l = p[1];
4092 if (l == 0)
4093 break;
4094
4095 /* Sanity check option length */
4096 if (l > len) {
4097 /* XXX just RXJ? */
4098 if (debug)
4099 addlog("\n");
4100 SPPP_LOG(sp, LOG_DEBUG,
4101 "received malicious IPCPv6 option, "
4102 "dropping\n");
4103 type = CP_RCR_ERR;
4104 goto end;
4105 }
4106 if (debug) {
4107 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf,
4108 sizeof(ipv6buf),*p));
4109 }
4110 switch (p[0]) {
4111 case IPV6CP_OPT_IFID:
4112 if (len >= 10 && l == 10 && ifidcount == 0) {
4113 /* correctly formed address option */
4114 ifidcount++;
4115 continue;
4116 }
4117 if (debug)
4118 addlog(" [invalid]");
4119 break;
4120 #ifdef notyet
4121 case IPV6CP_OPT_COMPRESSION:
4122 if (len >= 4 && l >= 4) {
4123 /* correctly formed compress option */
4124 continue;
4125 }
4126 if (debug)
4127 addlog(" [invalid]");
4128 break;
4129 #endif
4130 default:
4131 /* Others not supported. */
4132 if (debug)
4133 addlog(" [rej]");
4134 break;
4135 }
4136 if (rlen + l > blen) {
4137 if (debug)
4138 addlog(" [overflow]");
4139 continue;
4140 }
4141 /* Add the option to rejected list. */
4142 memcpy(r, p, l);
4143 r += l;
4144 rlen += l;
4145 }
4146
4147 if (rlen > 0) {
4148 type = CP_RCR_REJ;
4149 goto end;
4150 }
4151
4152 if (debug)
4153 addlog("\n");
4154
4155 /* pass 2: parse option values */
4156 sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
4157 if (debug)
4158 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp parse opt values:");
4159 p = (void *)(h + 1);
4160 r = buf;
4161 rlen = 0;
4162 type = CP_RCR_ACK;
4163 for (len = origlen; len > 1; len -= l, p += l) {
4164 l = p[1];
4165 if (l == 0)
4166 break;
4167
4168 if (debug) {
4169 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf,
4170 sizeof(ipv6buf), *p));
4171 }
4172 switch (p[0]) {
4173 #ifdef notyet
4174 case IPV6CP_OPT_COMPRESSION:
4175 continue;
4176 #endif
4177 case IPV6CP_OPT_IFID:
4178 memset(&desiredaddr, 0, sizeof(desiredaddr));
4179 memcpy(&desiredaddr.s6_addr[8], &p[2], 8);
4180 collision = (memcmp(&desiredaddr.s6_addr[8],
4181 &myaddr.s6_addr[8], 8) == 0);
4182 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
4183
4184 desiredaddr.s6_addr16[0] = htons(0xfe80);
4185 (void)in6_setscope(&desiredaddr, &sp->pp_if, NULL);
4186
4187 if (!collision && !nohisaddr) {
4188 /* no collision, hisaddr known - Conf-Ack */
4189 type = CP_RCR_ACK;
4190 memcpy(sp->ipv6cp.my_ifid, &myaddr.s6_addr[8],
4191 sizeof(sp->ipv6cp.my_ifid));
4192 memcpy(sp->ipv6cp.his_ifid,
4193 &desiredaddr.s6_addr[8],
4194 sizeof(sp->ipv6cp.my_ifid));
4195
4196 if (debug) {
4197 cpname = sppp_cp_type_name(tbuf,
4198 sizeof(tbuf), CONF_ACK);
4199 addlog(" %s [%s]",
4200 IN6_PRINT(ip6buf, &desiredaddr),
4201 cpname);
4202 }
4203 continue;
4204 }
4205
4206 memset(&suggestaddr, 0, sizeof(suggestaddr));
4207 if (collision && nohisaddr) {
4208 /* collision, hisaddr unknown - Conf-Rej */
4209 type = CP_RCR_REJ;
4210 memset(&p[2], 0, 8);
4211 } else {
4212 /*
4213 * - no collision, hisaddr unknown, or
4214 * - collision, hisaddr known
4215 * Conf-Nak, suggest hisaddr
4216 */
4217 type = CP_RCR_NAK;
4218 sppp_suggest_ip6_addr(sp, &suggestaddr);
4219 memcpy(&p[2], &suggestaddr.s6_addr[8], 8);
4220 }
4221 if (debug) {
4222 int ctype = type == CP_RCR_REJ ? CONF_REJ : CONF_NAK;
4223
4224 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype);
4225 addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr),
4226 cpname);
4227 }
4228 break;
4229 }
4230 if (rlen + l > blen) {
4231 if (debug)
4232 addlog(" [overflow]");
4233 continue;
4234 }
4235 /* Add the option to nak'ed list. */
4236 memcpy(r, p, l);
4237 r += l;
4238 rlen += l;
4239 }
4240
4241 if (rlen > 0) {
4242 if (type != CP_RCR_ACK) {
4243 if (debug) {
4244 int ctype ;
4245 ctype = type == CP_RCR_REJ ?
4246 CONF_REJ : CONF_NAK;
4247 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), ctype);
4248 addlog(" send %s suggest %s\n",
4249 cpname, IN6_PRINT(ip6buf, &suggestaddr));
4250 }
4251 }
4252 #ifdef notdef
4253 if (type == CP_RCR_ACK)
4254 panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
4255 #endif
4256 } else {
4257 if (type == CP_RCR_ACK) {
4258 rlen = origlen;
4259 memcpy(r, h + 1, rlen);
4260 }
4261 }
4262 end:
4263 if (debug)
4264 addlog("\n");
4265
4266 if (type == CP_RCR_ERR || type == CP_RCR_DROP) {
4267 if (buf != NULL)
4268 kmem_intr_free(buf, blen);
4269 } else {
4270 *msgbuf = buf;
4271 *buflen = blen;
4272 *msglen = rlen;
4273 }
4274
4275 return type;
4276 }
4277
4278 /*
4279 * Analyze the IPv6CP Configure-Reject option list, and adjust our
4280 * negotiation.
4281 */
4282 static void
sppp_ipv6cp_confrej(struct sppp * sp,struct lcp_header * h,int len)4283 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h, int len)
4284 {
4285 u_char *p, l;
4286 bool debug;
4287
4288 KASSERT(SPPP_WLOCKED(sp));
4289
4290 if (len <= sizeof(*h))
4291 return;
4292
4293 len -= sizeof(*h);
4294 debug = sppp_debug_enabled(sp);
4295
4296 if (debug)
4297 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp rej opts:");
4298
4299 p = (void *)(h + 1);
4300 for (; len > 1; len -= l, p += l) {
4301 l = p[1];
4302 if (l == 0)
4303 break;
4304
4305 if (l > len) {
4306 /* XXX just RXJ? */
4307 if (debug)
4308 addlog("\n");
4309 SPPP_LOG(sp, LOG_DEBUG,
4310 "received malicious IPCPv6 option, "
4311 "dropping\n");
4312 goto end;
4313 }
4314 if (debug) {
4315 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN];
4316 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf,
4317 sizeof(ipv6buf), *p));
4318 }
4319 switch (p[0]) {
4320 case IPV6CP_OPT_IFID:
4321 /*
4322 * Peer doesn't grok address option. This is
4323 * bad. XXX Should we better give up here?
4324 */
4325 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID);
4326 break;
4327 #ifdef notyet
4328 case IPV6CP_OPT_COMPRESS:
4329 CLR(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESS);
4330 break;
4331 #endif
4332 }
4333 }
4334 if (debug)
4335 addlog("\n");
4336 end:
4337 return;
4338 }
4339
4340 /*
4341 * Analyze the IPv6CP Configure-NAK option list, and adjust our
4342 * negotiation.
4343 */
4344 static void
sppp_ipv6cp_confnak(struct sppp * sp,struct lcp_header * h,int len)4345 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h, int len)
4346 {
4347 u_char *p, l;
4348 struct in6_addr suggestaddr;
4349 char ip6buf[INET6_ADDRSTRLEN];
4350 bool debug;
4351
4352 KASSERT(SPPP_WLOCKED(sp));
4353
4354 if (len <= sizeof(*h))
4355 return;
4356
4357 len -= sizeof(*h);
4358 debug = sppp_debug_enabled(sp);
4359
4360 if (debug)
4361 SPPP_LOG(sp, LOG_DEBUG, "ipv6cp nak opts:");
4362
4363 p = (void *)(h + 1);
4364 for (; len > 1; len -= l, p += l) {
4365 l = p[1];
4366 if (l == 0)
4367 break;
4368
4369 if (l > len) {
4370 /* XXX just RXJ? */
4371 if (debug)
4372 addlog("\n");
4373 SPPP_LOG(sp, LOG_DEBUG,
4374 "received malicious IPCPv6 option, "
4375 "dropping\n");
4376 goto end;
4377 }
4378 if (debug) {
4379 char ipv6buf[SPPP_IPV6CPOPT_NAMELEN];
4380 addlog(" %s", sppp_ipv6cp_opt_name(ipv6buf,
4381 sizeof(ipv6buf), *p));
4382 }
4383 switch (p[0]) {
4384 case IPV6CP_OPT_IFID:
4385 /*
4386 * Peer doesn't like our local ifid. See
4387 * if we can do something for him. We'll drop
4388 * him our address then.
4389 */
4390 if (len < 10 || l != 10)
4391 break;
4392 memset(&suggestaddr, 0, sizeof(suggestaddr));
4393 suggestaddr.s6_addr16[0] = htons(0xfe80);
4394 (void)in6_setscope(&suggestaddr, &sp->pp_if, NULL);
4395 memcpy(&suggestaddr.s6_addr[8], &p[2], 8);
4396
4397 SET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID);
4398 if (debug)
4399 addlog(" [suggestaddr %s]",
4400 IN6_PRINT(ip6buf, &suggestaddr));
4401 #ifdef IPV6CP_MYIFID_DYN
4402 /*
4403 * When doing dynamic address assignment,
4404 * we accept his offer.
4405 */
4406 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
4407 struct in6_addr lastsuggest;
4408 /*
4409 * If <suggested myaddr from peer> equals to
4410 * <hisaddr we have suggested last time>,
4411 * we have a collision. generate new random
4412 * ifid.
4413 */
4414 sppp_suggest_ip6_addr(&lastsuggest);
4415 if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
4416 lastsuggest)) {
4417 if (debug)
4418 addlog(" [random]");
4419 sppp_gen_ip6_addr(sp, &suggestaddr);
4420 }
4421 sppp_set_ip6_addr(sp, &suggestaddr, 0);
4422 if (debug)
4423 addlog(" [agree]");
4424 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
4425 }
4426 #else
4427 /*
4428 * Since we do not do dynamic address assignment,
4429 * we ignore it and thus continue to negotiate
4430 * our already existing value. This can possibly
4431 * go into infinite request-reject loop.
4432 *
4433 * This is not likely because we normally use
4434 * ifid based on MAC-address.
4435 * If you have no ethernet card on the node, too bad.
4436 * XXX should we use fail_counter?
4437 */
4438 #endif
4439 break;
4440 #ifdef notyet
4441 case IPV6CP_OPT_COMPRESS:
4442 /*
4443 * Peer wants different compression parameters.
4444 */
4445 break;
4446 #endif
4447 }
4448 }
4449 if (debug)
4450 addlog("\n");
4451 end:
4452 return;
4453 }
4454
4455 static void
sppp_ipv6cp_tlu(struct sppp * sp)4456 sppp_ipv6cp_tlu(struct sppp *sp)
4457 {
4458 struct ifnet *ifp;
4459
4460 KASSERT(SPPP_WLOCKED(sp));
4461
4462 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n");
4463 ifp = &sp->pp_if;
4464 /* we are up - notify isdn daemon */
4465 sppp_notify_con_wlocked(sp);
4466 rt_ifmsg(ifp);
4467 }
4468
4469 static void
sppp_ipv6cp_tld(struct sppp * sp)4470 sppp_ipv6cp_tld(struct sppp *sp)
4471 {
4472 struct ifnet *ifp;
4473
4474 KASSERT(SPPP_WLOCKED(sp));
4475
4476 SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n");
4477 ifp = &sp->pp_if;
4478 rt_ifmsg(ifp);
4479 }
4480
4481 static void
sppp_ipv6cp_scr(struct sppp * sp)4482 sppp_ipv6cp_scr(struct sppp *sp)
4483 {
4484 char opt[10 /* ifid */ + 4 /* compression, minimum */];
4485 struct in6_addr ouraddr;
4486 int i = 0;
4487
4488 KASSERT(SPPP_WLOCKED(sp));
4489
4490 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_IFID)) {
4491 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
4492
4493 opt[i++] = IPV6CP_OPT_IFID;
4494 opt[i++] = 10;
4495 memcpy(&opt[i], &ouraddr.s6_addr[8], 8);
4496 i += 8;
4497 }
4498
4499 #ifdef notyet
4500 if (ISSET(sp->ipv6cp.opts, SPPP_IPV6CP_OPT_COMPRESSION)) {
4501 opt[i++] = IPV6CP_OPT_COMPRESSION;
4502 opt[i++] = 4;
4503 opt[i++] = 0; /* TBD */
4504 opt[i++] = 0; /* TBD */
4505 /* variable length data may follow */
4506 }
4507 #endif
4508
4509 sp->scp[IDX_IPV6CP].confid = ++sp->scp[IDX_IPV6CP].seq;
4510 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->scp[IDX_IPV6CP].confid, i, &opt);
4511 }
4512 #else /*INET6*/
4513 static void
sppp_ipv6cp_init(struct sppp * sp)4514 sppp_ipv6cp_init(struct sppp *sp)
4515 {
4516
4517 KASSERT(SPPP_WLOCKED(sp));
4518 }
4519
4520 static void
sppp_ipv6cp_open(struct sppp * sp,void * xcp)4521 sppp_ipv6cp_open(struct sppp *sp, void *xcp)
4522 {
4523
4524 KASSERT(SPPP_WLOCKED(sp));
4525 }
4526
4527 static enum cp_rcr_type
sppp_ipv6cp_confreq(struct sppp * sp,struct lcp_header * h,int len,uint8_t ** msgbuf,size_t * buflen,size_t * msglen)4528 sppp_ipv6cp_confreq(struct sppp *sp, struct lcp_header *h,
4529 int len, uint8_t **msgbuf, size_t *buflen, size_t *msglen)
4530 {
4531
4532 KASSERT(SPPP_WLOCKED(sp));
4533 return 0;
4534 }
4535
4536 static void
sppp_ipv6cp_confrej(struct sppp * sp,struct lcp_header * h,int len)4537 sppp_ipv6cp_confrej(struct sppp *sp, struct lcp_header *h,
4538 int len)
4539 {
4540
4541 KASSERT(SPPP_WLOCKED(sp));
4542 }
4543
4544 static void
sppp_ipv6cp_confnak(struct sppp * sp,struct lcp_header * h,int len)4545 sppp_ipv6cp_confnak(struct sppp *sp, struct lcp_header *h,
4546 int len)
4547 {
4548
4549 KASSERT(SPPP_WLOCKED(sp));
4550 }
4551
4552 static void
sppp_ipv6cp_tlu(struct sppp * sp)4553 sppp_ipv6cp_tlu(struct sppp *sp)
4554 {
4555
4556 KASSERT(SPPP_WLOCKED(sp));
4557 }
4558
4559 static void
sppp_ipv6cp_tld(struct sppp * sp)4560 sppp_ipv6cp_tld(struct sppp *sp)
4561 {
4562
4563 KASSERT(SPPP_WLOCKED(sp));
4564 }
4565
4566 static void
sppp_ipv6cp_scr(struct sppp * sp)4567 sppp_ipv6cp_scr(struct sppp *sp)
4568 {
4569
4570 KASSERT(SPPP_WLOCKED(sp));
4571 }
4572 #endif /*INET6*/
4573
4574 /*
4575 *--------------------------------------------------------------------------*
4576 * *
4577 * The CHAP implementation. *
4578 * *
4579 *--------------------------------------------------------------------------*
4580 */
4581 /*
4582 * The authentication protocols is implemented on the state machine for
4583 * control protocols. And it uses following actions and events.
4584 *
4585 * Actions:
4586 * - scr: send CHAP_CHALLENGE and CHAP_RESPONSE
4587 * - sca: send CHAP_SUCCESS
4588 * - scn: send CHAP_FAILURE and shutdown lcp
4589 * Events:
4590 * - RCR+: receive CHAP_RESPONSE containing correct digest
4591 * - RCR-: receive CHAP_RESPONSE containing wrong digest
4592 * - RCA: receive CHAP_SUCCESS
4593 * - RCN: (this event is unused)
4594 * - TO+: re-send CHAP_CHALLENGE and CHAP_RESPONSE
4595 * - TO-: this layer finish
4596 */
4597
4598 /*
4599 * Handle incoming CHAP packets.
4600 */
4601 void
sppp_chap_input(struct sppp * sp,struct mbuf * m)4602 sppp_chap_input(struct sppp *sp, struct mbuf *m)
4603 {
4604 struct ifnet *ifp;
4605 struct lcp_header *h;
4606 int len, x;
4607 u_char *value, *name, digest[sizeof(sp->chap.challenge)];
4608 int value_len, name_len;
4609 MD5_CTX ctx;
4610 char abuf[SPPP_AUTHTYPE_NAMELEN];
4611 const char *authname;
4612 bool debug;
4613
4614 ifp = &sp->pp_if;
4615 debug = sppp_debug_enabled(sp);
4616 len = m->m_pkthdr.len;
4617 if (len < 4) {
4618 SPPP_DLOG(sp, "chap invalid packet length: "
4619 "%d bytes\n", len);
4620 return;
4621 }
4622 h = mtod(m, struct lcp_header *);
4623 if (len > ntohs(h->len))
4624 len = ntohs(h->len);
4625
4626 SPPP_LOCK(sp, RW_WRITER);
4627
4628 switch (h->type) {
4629 /* challenge, failure and success are his authproto */
4630 case CHAP_CHALLENGE:
4631 if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
4632 /* can't do anything useful */
4633 sp->pp_auth_failures++;
4634 SPPP_DLOG(sp, "chap input "
4635 "without my name and my secret being set\n");
4636 break;
4637 }
4638 value = 1 + (u_char *)(h + 1);
4639 value_len = value[-1];
4640 name = value + value_len;
4641 name_len = len - value_len - 5;
4642 if (name_len < 0) {
4643 if (debug) {
4644 authname = sppp_auth_type_name(abuf,
4645 sizeof(abuf), PPP_CHAP, h->type);
4646 SPPP_LOG(sp, LOG_DEBUG,
4647 "chap corrupted challenge "
4648 "<%s id=0x%x len=%d",
4649 authname, h->ident, ntohs(h->len));
4650 if (len > 4)
4651 sppp_print_bytes((u_char *)(h + 1),
4652 len - 4);
4653 addlog(">\n");
4654 }
4655 break;
4656 }
4657
4658 if (debug) {
4659 authname = sppp_auth_type_name(abuf,
4660 sizeof(abuf), PPP_CHAP, h->type);
4661 SPPP_LOG(sp, LOG_DEBUG,
4662 "chap input <%s id=0x%x len=%d name=",
4663 authname, h->ident, ntohs(h->len));
4664 sppp_print_string((char *) name, name_len);
4665 addlog(" value-size=%d value=", value_len);
4666 sppp_print_bytes(value, value_len);
4667 addlog(">\n");
4668 }
4669
4670 /* Compute reply value. */
4671 MD5Init(&ctx);
4672 MD5Update(&ctx, &h->ident, 1);
4673 MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len);
4674 MD5Update(&ctx, value, value_len);
4675 MD5Final(sp->chap.digest, &ctx);
4676 sp->chap.digest_len = sizeof(sp->chap.digest);
4677 sp->scp[IDX_CHAP].rconfid = h->ident;
4678
4679 sppp_wq_add(sp->wq_cp, &sp->chap.work_challenge_rcvd);
4680 break;
4681
4682 case CHAP_SUCCESS:
4683 if (debug) {
4684 SPPP_LOG(sp, LOG_DEBUG, "chap success");
4685 if (len > 4) {
4686 addlog(": ");
4687 sppp_print_string((char *)(h + 1), len - 4);
4688 }
4689 addlog("\n");
4690 }
4691
4692 if (h->ident != sp->scp[IDX_CHAP].rconfid) {
4693 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
4694 chap.name, h->ident,
4695 sp->scp[IDX_CHAP].rconfid);
4696 if_statinc(ifp, if_ierrors);
4697 break;
4698 }
4699
4700 if (sp->chap.digest_len == 0) {
4701 SPPP_DLOG(sp, "receive CHAP success"
4702 " without challenge\n");
4703 if_statinc(ifp, if_ierrors);
4704 break;
4705 }
4706
4707 x = splnet();
4708 sp->pp_auth_failures = 0;
4709 sp->pp_flags &= ~PP_NEEDAUTH;
4710 splx(x);
4711 memset(sp->chap.digest, 0, sizeof(sp->chap.digest));
4712 sp->chap.digest_len = 0;
4713
4714 if (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV)) {
4715 /*
4716 * we are not authenticator for CHAP,
4717 * generate a dummy RCR+ event without CHAP_RESPONSE
4718 */
4719 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK;
4720 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr);
4721 }
4722 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca);
4723 break;
4724
4725 case CHAP_FAILURE:
4726 if (h->ident != sp->scp[IDX_CHAP].rconfid) {
4727 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
4728 chap.name, h->ident, sp->scp[IDX_CHAP].rconfid);
4729 if_statinc(ifp, if_ierrors);
4730 break;
4731 }
4732
4733 if (sp->chap.digest_len == 0) {
4734 SPPP_DLOG(sp, "receive CHAP failure "
4735 "without challenge\n");
4736 if_statinc(ifp, if_ierrors);
4737 break;
4738 }
4739
4740 x = splnet();
4741 sp->pp_auth_failures++;
4742 splx(x);
4743 SPPP_LOG(sp, LOG_INFO, "chap failure");
4744 if (debug) {
4745 if (len > 4) {
4746 addlog(": ");
4747 sppp_print_string((char *)(h + 1), len - 4);
4748 }
4749 }
4750 addlog("\n");
4751
4752 memset(sp->chap.digest, 0, sizeof(sp->chap.digest));
4753 sp->chap.digest_len = 0;
4754 /*
4755 * await LCP shutdown by authenticator,
4756 * so we don't have to enqueue sc->scp[IDX_CHAP].work_rcn
4757 */
4758 break;
4759
4760 /* response is my authproto */
4761 case CHAP_RESPONSE:
4762 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
4763 /* can't do anything useful */
4764 SPPP_DLOG(sp, "chap response "
4765 "without his name and his secret being set\n");
4766 break;
4767 }
4768 value = 1 + (u_char *)(h + 1);
4769 value_len = value[-1];
4770 name = value + value_len;
4771 name_len = len - value_len - 5;
4772 if (name_len < 0) {
4773 if (debug) {
4774 authname = sppp_auth_type_name(abuf,
4775 sizeof(abuf), PPP_CHAP, h->type);
4776 SPPP_LOG(sp, LOG_DEBUG,
4777 "chap corrupted response "
4778 "<%s id=0x%x len=%d",
4779 authname, h->ident, ntohs(h->len));
4780 if (len > 4)
4781 sppp_print_bytes((u_char *)(h + 1),
4782 len - 4);
4783 addlog(">\n");
4784 }
4785 break;
4786 }
4787 if (h->ident != sp->scp[IDX_CHAP].confid) {
4788 SPPP_DLOG(sp, "chap dropping response for old ID "
4789 "(got %d, expected %d)\n",
4790 h->ident, sp->scp[IDX_CHAP].confid);
4791 break;
4792 } else {
4793 sp->scp[IDX_CHAP].rconfid = h->ident;
4794 }
4795
4796 if (sp->hisauth.name != NULL &&
4797 (name_len != sp->hisauth.name_len
4798 || memcmp(name, sp->hisauth.name, name_len) != 0)) {
4799 SPPP_LOG(sp, LOG_INFO,
4800 "chap response, his name ");
4801 sppp_print_string(name, name_len);
4802 addlog(" != expected ");
4803 sppp_print_string(sp->hisauth.name,
4804 sp->hisauth.name_len);
4805 addlog("\n");
4806
4807 /* generate RCR- event */
4808 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK;
4809 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr);
4810 break;
4811 }
4812
4813 if (debug) {
4814 authname = sppp_auth_type_name(abuf,
4815 sizeof(abuf), PPP_CHAP, h->type);
4816 SPPP_LOG(sp, LOG_DEBUG, "chap input(%s) "
4817 "<%s id=0x%x len=%d name=",
4818 sppp_state_name(sp->scp[IDX_CHAP].state),
4819 authname, h->ident, ntohs(h->len));
4820 sppp_print_string((char *)name, name_len);
4821 addlog(" value-size=%d value=", value_len);
4822 sppp_print_bytes(value, value_len);
4823 addlog(">\n");
4824 }
4825
4826 if (value_len == sizeof(sp->chap.challenge) &&
4827 value_len == sizeof(sp->chap.digest)) {
4828 MD5Init(&ctx);
4829 MD5Update(&ctx, &h->ident, 1);
4830 MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len);
4831 MD5Update(&ctx, sp->chap.challenge, sizeof(sp->chap.challenge));
4832 MD5Final(digest, &ctx);
4833
4834 if (memcmp(digest, value, value_len) == 0) {
4835 sp->scp[IDX_CHAP].rcr_type = CP_RCR_ACK;
4836 } else {
4837 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK;
4838 }
4839 } else {
4840 if (debug) {
4841 SPPP_LOG(sp, LOG_DEBUG,
4842 "chap bad hash value length: "
4843 "%d bytes, should be %zu\n",
4844 value_len, sizeof(sp->chap.challenge));
4845 }
4846
4847 sp->scp[IDX_CHAP].rcr_type = CP_RCR_NAK;
4848 }
4849
4850 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rcr);
4851
4852 /* generate a dummy RCA event */
4853 if (sp->scp[IDX_CHAP].rcr_type == CP_RCR_ACK &&
4854 (!ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_PEER) ||
4855 sp->chap.rechallenging)) {
4856 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_CHAP].work_rca);
4857 }
4858 break;
4859
4860 default:
4861 /* Unknown CHAP packet type -- ignore. */
4862 if (debug) {
4863 SPPP_LOG(sp, LOG_DEBUG, "chap unknown input(%s) "
4864 "<0x%x id=0x%xh len=%d",
4865 sppp_state_name(sp->scp[IDX_CHAP].state),
4866 h->type, h->ident, ntohs(h->len));
4867 if (len > 4)
4868 sppp_print_bytes((u_char *)(h + 1), len - 4);
4869 addlog(">\n");
4870 }
4871 break;
4872
4873 }
4874
4875 SPPP_UNLOCK(sp);
4876 }
4877
4878 static void
sppp_chap_init(struct sppp * sp)4879 sppp_chap_init(struct sppp *sp)
4880 {
4881
4882 KASSERT(SPPP_WLOCKED(sp));
4883
4884 sppp_cp_init(&chap, sp);
4885
4886 SPPP_WQ_SET(&sp->chap.work_challenge_rcvd,
4887 sppp_chap_rcv_challenge_event, &chap);
4888 }
4889
4890 static void
sppp_chap_open(struct sppp * sp,void * xcp)4891 sppp_chap_open(struct sppp *sp, void *xcp)
4892 {
4893
4894 KASSERT(SPPP_WLOCKED(sp));
4895
4896 memset(sp->chap.digest, 0, sizeof(sp->chap.digest));
4897 sp->chap.digest_len = 0;
4898 sp->chap.rechallenging = false;
4899 sp->chap.response_rcvd = false;
4900 sppp_open_event(sp, xcp);
4901 }
4902
4903 static void
sppp_chap_tlu(struct sppp * sp)4904 sppp_chap_tlu(struct sppp *sp)
4905 {
4906 int i, x;
4907
4908 KASSERT(SPPP_WLOCKED(sp));
4909
4910 i = 0;
4911 sp->scp[IDX_CHAP].rst_counter = sp->lcp.max_configure;
4912 x = splnet();
4913 sp->pp_auth_failures = 0;
4914 splx(x);
4915
4916 SPPP_LOG(sp, LOG_DEBUG, "chap %s",
4917 sp->pp_phase == SPPP_PHASE_NETWORK ? "reconfirmed" : "tlu");
4918
4919 /*
4920 * Some broken CHAP implementations (Conware CoNet, firmware
4921 * 4.0.?) don't want to re-authenticate their CHAP once the
4922 * initial challenge-response exchange has taken place.
4923 * Provide for an option to avoid rechallenges.
4924 */
4925 if (ISSET(sppp_auth_role(&chap, sp), SPPP_AUTH_SERV) &&
4926 (sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
4927 /*
4928 * Compute the re-challenge timeout. This will yield
4929 * a number between 300 and 810 seconds.
4930 */
4931 i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7);
4932 callout_schedule(&sp->scp[IDX_CHAP].ch, i * hz);
4933
4934 if (sppp_debug_enabled(sp)) {
4935 addlog(", next rechallenge in %d seconds", i);
4936 }
4937 }
4938
4939 addlog("\n");
4940
4941 /*
4942 * If we are already in phase network, we are done here. This
4943 * is the case if this is a dummy tlu event after a re-challenge.
4944 */
4945 if (sp->pp_phase != SPPP_PHASE_NETWORK)
4946 sppp_phase_network(sp);
4947 }
4948
4949 static void
sppp_chap_scr(struct sppp * sp)4950 sppp_chap_scr(struct sppp *sp)
4951 {
4952 uint32_t *ch;
4953 u_char clen, dsize;
4954 int role;
4955
4956 KASSERT(SPPP_WLOCKED(sp));
4957
4958 role = sppp_auth_role(&chap, sp);
4959
4960 if (ISSET(role, SPPP_AUTH_SERV) &&
4961 !sp->chap.response_rcvd) {
4962 /* we are authenticator for CHAP, send challenge */
4963 ch = (uint32_t *)sp->chap.challenge;
4964 clen = sizeof(sp->chap.challenge);
4965 /* Compute random challenge. */
4966 cprng_strong(kern_cprng, ch, clen, 0);
4967
4968 sp->scp[IDX_CHAP].confid = ++sp->scp[IDX_CHAP].seq;
4969 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->scp[IDX_CHAP].confid,
4970 sizeof(clen), (const char *)&clen,
4971 sizeof(sp->chap.challenge), sp->chap.challenge,
4972 0);
4973 }
4974
4975 if (ISSET(role, SPPP_AUTH_PEER) &&
4976 sp->chap.digest_len > 0) {
4977 /* we are peer for CHAP, send response */
4978 dsize = sp->chap.digest_len;
4979
4980 sppp_auth_send(&chap, sp, CHAP_RESPONSE, sp->scp[IDX_CHAP].rconfid,
4981 sizeof(dsize), (const char *)&dsize,
4982 sp->chap.digest_len, sp->chap.digest,
4983 sp->myauth.name_len, sp->myauth.name, 0);
4984 }
4985 }
4986
4987 static void
sppp_chap_rcv_challenge_event(struct sppp * sp,void * xcp)4988 sppp_chap_rcv_challenge_event(struct sppp *sp, void *xcp)
4989 {
4990 const struct cp *cp = xcp;
4991
4992 KASSERT(!cpu_softintr_p());
4993
4994 sp->chap.rechallenging = false;
4995
4996 switch (sp->scp[IDX_CHAP].state) {
4997 case STATE_REQ_SENT:
4998 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
4999 cp->scr(sp);
5000 break;
5001 case STATE_OPENED:
5002 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
5003 cp->scr(sp);
5004 break;
5005 }
5006 }
5007
5008 /*
5009 *--------------------------------------------------------------------------*
5010 * *
5011 * The PAP implementation. *
5012 * *
5013 *--------------------------------------------------------------------------*
5014 */
5015 /*
5016 * PAP uses following actions and events.
5017 * Actions:
5018 * - scr: send PAP_REQ
5019 * - sca: send PAP_ACK
5020 * - scn: send PAP_NAK
5021 * Events:
5022 * - RCR+: receive PAP_REQ containing correct username and password
5023 * - RCR-: receive PAP_REQ containing wrong username and password
5024 * - RCA: receive PAP_ACK
5025 * - RCN: (this event is unused)
5026 * - TO+: re-send PAP_REQ
5027 * - TO-: this layer finish
5028 */
5029
5030 /*
5031 * Handle incoming PAP packets. */
5032 static void
sppp_pap_input(struct sppp * sp,struct mbuf * m)5033 sppp_pap_input(struct sppp *sp, struct mbuf *m)
5034 {
5035 struct ifnet *ifp;
5036 struct lcp_header *h;
5037 int len, x;
5038 char *name, *secret;
5039 int name_len, secret_len;
5040 char abuf[SPPP_AUTHTYPE_NAMELEN];
5041 const char *authname;
5042 bool debug;
5043
5044 ifp = &sp->pp_if;
5045 debug = sppp_debug_enabled(sp);
5046
5047 /*
5048 * Malicious input might leave this uninitialized, so
5049 * init to an impossible value.
5050 */
5051 secret_len = -1;
5052
5053 len = m->m_pkthdr.len;
5054 if (len < 5) {
5055 SPPP_DLOG(sp, "pap invalid packet length: "
5056 "%d bytes\n", len);
5057 return;
5058 }
5059 h = mtod(m, struct lcp_header *);
5060 if (len > ntohs(h->len))
5061 len = ntohs(h->len);
5062
5063 SPPP_LOCK(sp, RW_WRITER);
5064
5065 switch (h->type) {
5066 /* PAP request is my authproto */
5067 case PAP_REQ:
5068 if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
5069 /* can't do anything useful */
5070 SPPP_DLOG(sp, "pap request"
5071 " without his name and his secret being set\n");
5072 break;
5073 }
5074 name = 1 + (u_char *)(h + 1);
5075 name_len = name[-1];
5076 secret = name + name_len + 1;
5077 if (name_len > len - 6 ||
5078 (secret_len = secret[-1]) > len - 6 - name_len) {
5079 if (debug) {
5080 authname = sppp_auth_type_name(abuf,
5081 sizeof(abuf), PPP_PAP, h->type);
5082 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input "
5083 "<%s id=0x%x len=%d",
5084 authname, h->ident, ntohs(h->len));
5085 if (len > 4)
5086 sppp_print_bytes((u_char *)(h + 1),
5087 len - 4);
5088 addlog(">\n");
5089 }
5090 break;
5091 }
5092 if (debug) {
5093 authname = sppp_auth_type_name(abuf,
5094 sizeof(abuf), PPP_PAP, h->type);
5095 SPPP_LOG(sp, LOG_DEBUG, "pap input(%s) "
5096 "<%s id=0x%x len=%d name=",
5097 sppp_state_name(sp->scp[IDX_PAP].state),
5098 authname, h->ident, ntohs(h->len));
5099 sppp_print_string((char *)name, name_len);
5100 addlog(" secret=");
5101 sppp_print_string((char *)secret, secret_len);
5102 addlog(">\n");
5103 }
5104
5105 sp->scp[IDX_PAP].rconfid = h->ident;
5106
5107 if (name_len == sp->hisauth.name_len &&
5108 memcmp(name, sp->hisauth.name, name_len) == 0 &&
5109 secret_len == sp->hisauth.secret_len &&
5110 memcmp(secret, sp->hisauth.secret, secret_len) == 0) {
5111 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK;
5112 } else {
5113 sp->scp[IDX_PAP].rcr_type = CP_RCR_NAK;
5114 }
5115
5116 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr);
5117
5118 /* generate a dummy RCA event */
5119 if (sp->scp[IDX_PAP].rcr_type == CP_RCR_ACK &&
5120 !ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER)) {
5121 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca);
5122 }
5123 break;
5124
5125 /* ack and nak are his authproto */
5126 case PAP_ACK:
5127 if (debug) {
5128 SPPP_LOG(sp, LOG_DEBUG, "pap success");
5129 name = 1 + (u_char *)(h + 1);
5130 name_len = name[-1];
5131 if (len > 5 && name_len < len+4) {
5132 addlog(": ");
5133 sppp_print_string(name, name_len);
5134 }
5135 addlog("\n");
5136 }
5137
5138 if (h->ident != sp->scp[IDX_PAP].confid) {
5139 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
5140 pap.name, h->ident, sp->scp[IDX_PAP].rconfid);
5141 if_statinc(ifp, if_ierrors);
5142 break;
5143 }
5144
5145 x = splnet();
5146 sp->pp_auth_failures = 0;
5147 sp->pp_flags &= ~PP_NEEDAUTH;
5148 splx(x);
5149
5150 /* we are not authenticator, generate a dummy RCR+ event */
5151 if (!ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_SERV)) {
5152 sp->scp[IDX_PAP].rcr_type = CP_RCR_ACK;
5153 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rcr);
5154 }
5155
5156 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_PAP].work_rca);
5157 break;
5158
5159 case PAP_NAK:
5160 if (debug) {
5161 SPPP_LOG(sp, LOG_INFO, "pap failure");
5162 name = 1 + (u_char *)(h + 1);
5163 name_len = name[-1];
5164 if (len > 5 && name_len < len+4) {
5165 addlog(": ");
5166 sppp_print_string(name, name_len);
5167 }
5168 addlog("\n");
5169 } else {
5170 SPPP_LOG(sp, LOG_INFO, "pap failure\n");
5171 }
5172
5173 if (h->ident != sp->scp[IDX_PAP].confid) {
5174 SPPP_DLOG(sp, "%s id mismatch 0x%x != 0x%x\n",
5175 pap.name, h->ident, sp->scp[IDX_PAP].rconfid);
5176 if_statinc(ifp, if_ierrors);
5177 break;
5178 }
5179
5180 sp->pp_auth_failures++;
5181 /*
5182 * await LCP shutdown by authenticator,
5183 * so we don't have to enqueue sc->scp[IDX_PAP].work_rcn
5184 */
5185 break;
5186
5187 default:
5188 /* Unknown PAP packet type -- ignore. */
5189 if (debug) {
5190 SPPP_LOG(sp, LOG_DEBUG, "pap corrupted input "
5191 "<0x%x id=0x%x len=%d",
5192 h->type, h->ident, ntohs(h->len));
5193 if (len > 4)
5194 sppp_print_bytes((u_char *)(h + 1), len - 4);
5195 addlog(">\n");
5196 }
5197 break;
5198 }
5199
5200 SPPP_UNLOCK(sp);
5201 }
5202
5203 static void
sppp_pap_init(struct sppp * sp)5204 sppp_pap_init(struct sppp *sp)
5205 {
5206
5207 KASSERT(SPPP_WLOCKED(sp));
5208 sppp_cp_init(&pap, sp);
5209 }
5210
5211 static void
sppp_pap_tlu(struct sppp * sp)5212 sppp_pap_tlu(struct sppp *sp)
5213 {
5214 int x;
5215
5216 SPPP_DLOG(sp, "%s tlu\n", pap.name);
5217
5218 sp->scp[IDX_PAP].rst_counter = sp->lcp.max_configure;
5219 x = splnet();
5220 sp->pp_auth_failures = 0;
5221 splx(x);
5222
5223 if (sp->pp_phase < SPPP_PHASE_NETWORK)
5224 sppp_phase_network(sp);
5225 }
5226
5227 static void
sppp_pap_scr(struct sppp * sp)5228 sppp_pap_scr(struct sppp *sp)
5229 {
5230 u_char idlen, pwdlen;
5231
5232 KASSERT(SPPP_WLOCKED(sp));
5233
5234 if (ISSET(sppp_auth_role(&pap, sp), SPPP_AUTH_PEER) &&
5235 sp->scp[IDX_PAP].state != STATE_ACK_RCVD) {
5236 if (sp->myauth.secret == NULL ||
5237 sp->myauth.name == NULL) {
5238 SPPP_LOG(sp, LOG_DEBUG,
5239 "couldn't send PAP_REQ "
5240 "because of no name or no secret\n");
5241 } else {
5242 sp->scp[IDX_PAP].confid = ++sp->scp[IDX_PAP].seq;
5243 pwdlen = sp->myauth.secret_len;
5244 idlen = sp->myauth.name_len;
5245
5246 sppp_auth_send(&pap, sp, PAP_REQ, sp->scp[IDX_PAP].confid,
5247 sizeof idlen, (const char *)&idlen,
5248 idlen, sp->myauth.name,
5249 sizeof pwdlen, (const char *)&pwdlen,
5250 pwdlen, sp->myauth.secret,
5251 0);
5252 }
5253 }
5254 }
5255
5256 /*
5257 * Random miscellaneous functions.
5258 */
5259
5260 /*
5261 * Send a PAP or CHAP proto packet.
5262 *
5263 * Varadic function, each of the elements for the ellipsis is of type
5264 * ``size_t mlen, const u_char *msg''. Processing will stop iff
5265 * mlen == 0.
5266 * NOTE: never declare variadic functions with types subject to type
5267 * promotion (i.e. u_char). This is asking for big trouble depending
5268 * on the architecture you are on...
5269 */
5270
5271 static void
sppp_auth_send(const struct cp * cp,struct sppp * sp,unsigned int type,unsigned int id,...)5272 sppp_auth_send(const struct cp *cp, struct sppp *sp,
5273 unsigned int type, unsigned int id,
5274 ...)
5275 {
5276 struct ifnet *ifp;
5277 struct lcp_header *lh;
5278 struct mbuf *m;
5279 u_char *p;
5280 int len;
5281 size_t pkthdrlen;
5282 unsigned int mlen;
5283 const char *msg;
5284 va_list ap;
5285
5286 KASSERT(SPPP_WLOCKED(sp));
5287
5288 ifp = &sp->pp_if;
5289
5290 MGETHDR(m, M_DONTWAIT, MT_DATA);
5291 if (! m)
5292 return;
5293 m_reset_rcvif(m);
5294
5295 if (sp->pp_flags & PP_NOFRAMING) {
5296 *mtod(m, uint16_t *) = htons(cp->proto);
5297 pkthdrlen = 2;
5298 lh = (struct lcp_header *)(mtod(m, uint8_t *)+2);
5299 } else {
5300 struct ppp_header *h;
5301 h = mtod(m, struct ppp_header *);
5302 h->address = PPP_ALLSTATIONS; /* broadcast address */
5303 h->control = PPP_UI; /* Unnumbered Info */
5304 h->protocol = htons(cp->proto);
5305 pkthdrlen = PPP_HEADER_LEN;
5306
5307 lh = (struct lcp_header *)(h + 1);
5308 }
5309
5310 lh->type = type;
5311 lh->ident = id;
5312 p = (u_char *)(lh + 1);
5313
5314 va_start(ap, id);
5315 len = 0;
5316
5317 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
5318 msg = va_arg(ap, const char *);
5319 len += mlen;
5320 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
5321 va_end(ap);
5322 m_freem(m);
5323 return;
5324 }
5325
5326 memcpy(p, msg, mlen);
5327 p += mlen;
5328 }
5329 va_end(ap);
5330
5331 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
5332 lh->len = htons(LCP_HEADER_LEN + len);
5333
5334 if (sppp_debug_enabled(sp)) {
5335 char abuf[SPPP_AUTHTYPE_NAMELEN];
5336 const char *authname;
5337
5338 authname = sppp_auth_type_name(abuf,
5339 sizeof(abuf), cp->proto, lh->type);
5340 SPPP_LOG(sp, LOG_DEBUG, "%s output <%s id=0x%x len=%d",
5341 cp->name, authname,
5342 lh->ident, ntohs(lh->len));
5343 if (len)
5344 sppp_print_bytes((u_char *)(lh + 1), len);
5345 addlog(">\n");
5346 }
5347 if (IF_QFULL(&sp->pp_cpq)) {
5348 IF_DROP(&sp->pp_fastq);
5349 IF_DROP(&ifp->if_snd);
5350 m_freem(m);
5351 if_statinc(ifp, if_oerrors);
5352 return;
5353 }
5354
5355 if_statadd(ifp, if_obytes, m->m_pkthdr.len + sp->pp_framebytes);
5356 IF_ENQUEUE(&sp->pp_cpq, m);
5357
5358 if (! (ifp->if_flags & IFF_OACTIVE)) {
5359 SPPP_UNLOCK(sp);
5360 if_start_lock(ifp);
5361 SPPP_LOCK(sp, RW_WRITER);
5362 }
5363 }
5364
5365 static int
sppp_auth_role(const struct cp * cp,struct sppp * sp)5366 sppp_auth_role(const struct cp *cp, struct sppp *sp)
5367 {
5368 int role;
5369
5370 role = SPPP_AUTH_NOROLE;
5371
5372 if (sp->hisauth.proto == cp->proto &&
5373 ISSET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO))
5374 SET(role, SPPP_AUTH_SERV);
5375
5376 if (sp->myauth.proto == cp->proto)
5377 SET(role, SPPP_AUTH_PEER);
5378
5379 return role;
5380 }
5381
5382 static void
sppp_auth_to_event(struct sppp * sp,void * xcp)5383 sppp_auth_to_event(struct sppp *sp, void *xcp)
5384 {
5385 const struct cp *cp = xcp;
5386 bool override;
5387 int state;
5388
5389 KASSERT(SPPP_WLOCKED(sp));
5390 KASSERT(!cpu_softintr_p());
5391
5392 override = false;
5393 state = sp->scp[cp->protoidx].state;
5394
5395 if (sp->scp[cp->protoidx].rst_counter > 0) {
5396 /* override TO+ event */
5397 switch (state) {
5398 case STATE_OPENED:
5399 if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
5400 override = true;
5401 sp->chap.rechallenging = true;
5402 sp->chap.response_rcvd = false;
5403 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
5404 cp->scr(sp);
5405 }
5406 break;
5407
5408 case STATE_ACK_RCVD:
5409 override = true;
5410 cp->scr(sp);
5411 callout_schedule(&sp->scp[cp->protoidx].ch, sp->lcp.timeout);
5412 break;
5413 }
5414 }
5415
5416 if (override) {
5417 SPPP_DLOG(sp, "%s TO(%s) rst_counter = %d\n",
5418 cp->name, sppp_state_name(state),
5419 sp->scp[cp->protoidx].rst_counter);
5420 sp->scp[cp->protoidx].rst_counter--;
5421 } else {
5422 sppp_to_event(sp, xcp);
5423 }
5424 }
5425
5426 static void
sppp_auth_screply(const struct cp * cp,struct sppp * sp,u_char ctype,uint8_t ident,size_t _mlen __unused,void * _msg __unused)5427 sppp_auth_screply(const struct cp *cp, struct sppp *sp, u_char ctype,
5428 uint8_t ident, size_t _mlen __unused, void *_msg __unused)
5429 {
5430 static const char *succmsg = "Welcome!";
5431 static const char *failmsg = "Failed...";
5432 const char *msg;
5433 u_char type, mlen;
5434
5435 KASSERT(SPPP_WLOCKED(sp));
5436
5437 if (!ISSET(sppp_auth_role(cp, sp), SPPP_AUTH_SERV))
5438 return;
5439
5440 if (ctype == CONF_ACK) {
5441 type = cp->proto == PPP_CHAP ? CHAP_SUCCESS : PAP_ACK;
5442 msg = succmsg;
5443 mlen = sizeof(succmsg) - 1;
5444
5445 sp->pp_auth_failures = 0;
5446 } else {
5447 type = cp->proto == PPP_CHAP ? CHAP_FAILURE : PAP_NAK;
5448 msg = failmsg;
5449 mlen = sizeof(failmsg) - 1;
5450
5451 /* shutdown LCP if auth failed */
5452 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
5453 sp->pp_auth_failures++;
5454 }
5455
5456 sppp_auth_send(cp, sp, type, ident, mlen, (const u_char *)msg, 0);
5457 }
5458
5459 /*
5460 * Send keepalive packets, every 10 seconds.
5461 */
5462 static void
sppp_keepalive(void * dummy)5463 sppp_keepalive(void *dummy)
5464 {
5465 struct sppp *sp;
5466 int s;
5467 time_t now;
5468
5469 SPPPQ_LOCK();
5470
5471 s = splnet();
5472 now = time_uptime;
5473 for (sp=spppq; sp; sp=sp->pp_next) {
5474 struct ifnet *ifp = NULL;
5475
5476 SPPP_LOCK(sp, RW_WRITER);
5477 ifp = &sp->pp_if;
5478
5479 /* check idle timeout */
5480 if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING)
5481 && (sp->pp_phase == SPPP_PHASE_NETWORK)) {
5482 /* idle timeout is enabled for this interface */
5483 if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) {
5484 SPPP_DLOG(sp, "no activity for %lu seconds\n",
5485 (unsigned long)(now-sp->pp_last_activity));
5486 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
5487 SPPP_UNLOCK(sp);
5488 continue;
5489 }
5490 }
5491
5492 /* Keepalive mode disabled or channel down? */
5493 if (! (sp->pp_flags & PP_KEEPALIVE) ||
5494 ! (ifp->if_flags & IFF_RUNNING)) {
5495 SPPP_UNLOCK(sp);
5496 continue;
5497 }
5498
5499 /* No keepalive in PPP mode if LCP not opened yet. */
5500 if (sp->pp_phase < SPPP_PHASE_AUTHENTICATE) {
5501 SPPP_UNLOCK(sp);
5502 continue;
5503 }
5504
5505 /* No echo reply, but maybe user data passed through? */
5506 if (sp->pp_max_noreceive != 0 &&
5507 (now - sp->pp_last_receive) < sp->pp_max_noreceive) {
5508 sp->pp_alivecnt = 0;
5509 SPPP_UNLOCK(sp);
5510 continue;
5511 }
5512
5513 /* No echo request */
5514 if (sp->pp_alive_interval == 0) {
5515 SPPP_UNLOCK(sp);
5516 continue;
5517 }
5518
5519 /* send a ECHO_REQ once in sp->pp_alive_interval times */
5520 if ((sppp_keepalive_cnt % sp->pp_alive_interval) != 0) {
5521 SPPP_UNLOCK(sp);
5522 continue;
5523 }
5524
5525 if (sp->pp_alivecnt >= sp->pp_maxalive) {
5526 /* No keepalive packets got. Stop the interface. */
5527 if (sp->pp_flags & PP_KEEPALIVE_IFDOWN)
5528 sppp_wq_add(sp->wq_cp, &sp->work_ifdown);
5529
5530 SPPP_LOG(sp, LOG_INFO,"LCP keepalive timed out, "
5531 "going to restart the connection\n");
5532 sp->pp_alivecnt = 0;
5533
5534 /* we are down, close all open protocols */
5535 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_close);
5536
5537 /* And now prepare LCP to reestablish the link, if configured to do so. */
5538 sp->lcp.reestablish = true;
5539
5540 SPPP_UNLOCK(sp);
5541 continue;
5542 }
5543 if (sp->pp_alivecnt < sp->pp_maxalive)
5544 ++sp->pp_alivecnt;
5545 if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
5546 int32_t nmagic = htonl(sp->lcp.magic);
5547 sp->lcp.echoid = ++sp->scp[IDX_LCP].seq;
5548 sppp_cp_send(sp, PPP_LCP, ECHO_REQ,
5549 sp->lcp.echoid, 4, &nmagic);
5550 }
5551
5552 SPPP_UNLOCK(sp);
5553 }
5554 splx(s);
5555 sppp_keepalive_cnt++;
5556 callout_reset(&keepalive_ch, hz * SPPP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
5557
5558 SPPPQ_UNLOCK();
5559 }
5560
5561 #ifdef INET
5562 /*
5563 * Get both IP addresses.
5564 */
5565 static void
sppp_get_ip_addrs(struct sppp * sp,uint32_t * src,uint32_t * dst,uint32_t * srcmask)5566 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask)
5567 {
5568 struct ifnet *ifp = &sp->pp_if;
5569 struct ifaddr *ifa;
5570 struct sockaddr_in *si, *sm;
5571 uint32_t ssrc, ddst;
5572 int bound, s;
5573 struct psref psref;
5574
5575 sm = NULL;
5576 ssrc = ddst = 0;
5577 /*
5578 * Pick the first AF_INET address from the list,
5579 * aliases don't make any sense on a p2p link anyway.
5580 */
5581 si = 0;
5582 bound = curlwp_bind();
5583 s = pserialize_read_enter();
5584 IFADDR_READER_FOREACH(ifa, ifp) {
5585 if (ifa->ifa_addr->sa_family == AF_INET) {
5586 si = (struct sockaddr_in *)ifa->ifa_addr;
5587 sm = (struct sockaddr_in *)ifa->ifa_netmask;
5588 if (si) {
5589 ifa_acquire(ifa, &psref);
5590 break;
5591 }
5592 }
5593 }
5594 pserialize_read_exit(s);
5595 if (ifa) {
5596 if (si && si->sin_addr.s_addr) {
5597 ssrc = si->sin_addr.s_addr;
5598 if (srcmask)
5599 *srcmask = ntohl(sm->sin_addr.s_addr);
5600 }
5601
5602 si = (struct sockaddr_in *)ifa->ifa_dstaddr;
5603 if (si && si->sin_addr.s_addr)
5604 ddst = si->sin_addr.s_addr;
5605 ifa_release(ifa, &psref);
5606 }
5607 curlwp_bindx(bound);
5608
5609 if (dst) *dst = ntohl(ddst);
5610 if (src) *src = ntohl(ssrc);
5611 }
5612
5613 /*
5614 * Set IP addresses. Must be called at splnet.
5615 * If an address is 0, leave it the way it is.
5616 */
5617 static void
sppp_set_ip_addrs(struct sppp * sp)5618 sppp_set_ip_addrs(struct sppp *sp)
5619 {
5620 struct ifnet *ifp;
5621 struct ifaddr *ifa;
5622 struct sockaddr_in *si, *dest;
5623 uint32_t myaddr = 0, hisaddr = 0;
5624 int s;
5625
5626 KASSERT(SPPP_WLOCKED(sp));
5627
5628 ifp = &sp->pp_if;
5629
5630 SPPP_UNLOCK(sp);
5631 IFNET_LOCK(ifp);
5632 SPPP_LOCK(sp, RW_WRITER);
5633
5634 /*
5635 * Pick the first AF_INET address from the list,
5636 * aliases don't make any sense on a p2p link anyway.
5637 */
5638 si = dest = NULL;
5639 s = pserialize_read_enter();
5640 IFADDR_READER_FOREACH(ifa, ifp) {
5641 if (ifa->ifa_addr->sa_family == AF_INET) {
5642 si = (struct sockaddr_in *)ifa->ifa_addr;
5643 dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
5644 break;
5645 }
5646 }
5647 pserialize_read_exit(s);
5648
5649 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN))
5650 myaddr = sp->ipcp.req_myaddr;
5651 else if (si != NULL)
5652 myaddr = ntohl(si->sin_addr.s_addr);
5653
5654 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN))
5655 hisaddr = sp->ipcp.req_hisaddr;
5656 else if (dest != NULL)
5657 hisaddr = ntohl(dest->sin_addr.s_addr);
5658
5659 if (si != NULL && dest != NULL) {
5660 int error;
5661 struct sockaddr_in new_sin = *si;
5662 struct sockaddr_in new_dst = *dest;
5663
5664 if (myaddr != 0)
5665 new_sin.sin_addr.s_addr = htonl(myaddr);
5666 if (hisaddr != 0) {
5667 new_dst.sin_addr.s_addr = htonl(hisaddr);
5668 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr)
5669 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
5670 }
5671
5672 in_addrhash_remove(ifatoia(ifa));
5673
5674 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
5675
5676 in_addrhash_insert(ifatoia(ifa));
5677
5678 if (error) {
5679 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n",
5680 __func__, error);
5681 } else {
5682 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
5683 }
5684 }
5685
5686 IFNET_UNLOCK(ifp);
5687
5688 sppp_notify_con(sp);
5689 }
5690
5691 /*
5692 * Clear IP addresses. Must be called at splnet.
5693 */
5694 static void
sppp_clear_ip_addrs(struct sppp * sp)5695 sppp_clear_ip_addrs(struct sppp *sp)
5696 {
5697 struct ifnet *ifp;
5698 struct ifaddr *ifa;
5699 struct sockaddr_in *si, *dest;
5700 int s;
5701
5702 KASSERT(SPPP_WLOCKED(sp));
5703
5704 ifp = &sp->pp_if;
5705
5706 SPPP_UNLOCK(sp);
5707 IFNET_LOCK(ifp);
5708 SPPP_LOCK(sp, RW_WRITER);
5709
5710 /*
5711 * Pick the first AF_INET address from the list,
5712 * aliases don't make any sense on a p2p link anyway.
5713 */
5714 si = dest = NULL;
5715 s = pserialize_read_enter();
5716 IFADDR_READER_FOREACH(ifa, ifp) {
5717 if (ifa->ifa_addr->sa_family == AF_INET) {
5718 si = (struct sockaddr_in *)ifa->ifa_addr;
5719 dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
5720 break;
5721 }
5722 }
5723 pserialize_read_exit(s);
5724
5725 if (si != NULL) {
5726 struct sockaddr_in new_sin = *si;
5727 struct sockaddr_in new_dst = *dest;
5728 int error;
5729
5730 if (sp->ipcp.flags & IPCP_MYADDR_DYN)
5731 new_sin.sin_addr.s_addr = 0;
5732 if (sp->ipcp.flags & IPCP_HISADDR_DYN &&
5733 ntohl(sp->ipcp.saved_hisaddr) != 0)
5734 new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr;
5735
5736 in_addrhash_remove(ifatoia(ifa));
5737
5738 error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
5739
5740 in_addrhash_insert(ifatoia(ifa));
5741
5742 if (error) {
5743 SPPP_DLOG(sp, "%s: in_ifinit failed, error=%d\n",
5744 __func__, error);
5745 } else {
5746 pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
5747 }
5748 }
5749
5750 IFNET_UNLOCK(ifp);
5751 }
5752 #endif
5753
5754 #ifdef INET6
5755 /*
5756 * Get both IPv6 addresses.
5757 */
5758 static void
sppp_get_ip6_addrs(struct sppp * sp,struct in6_addr * src,struct in6_addr * dst,struct in6_addr * srcmask)5759 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
5760 struct in6_addr *srcmask)
5761 {
5762 struct ifnet *ifp = &sp->pp_if;
5763 struct ifaddr *ifa;
5764 struct sockaddr_in6 *si, *sm;
5765 struct in6_addr ssrc, ddst;
5766 int bound, s;
5767 struct psref psref;
5768
5769 sm = NULL;
5770 memset(&ssrc, 0, sizeof(ssrc));
5771 memset(&ddst, 0, sizeof(ddst));
5772 /*
5773 * Pick the first link-local AF_INET6 address from the list,
5774 * aliases don't make any sense on a p2p link anyway.
5775 */
5776 si = 0;
5777 bound = curlwp_bind();
5778 s = pserialize_read_enter();
5779 IFADDR_READER_FOREACH(ifa, ifp) {
5780 if (ifa->ifa_addr->sa_family == AF_INET6) {
5781 si = (struct sockaddr_in6 *)ifa->ifa_addr;
5782 sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
5783 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) {
5784 ifa_acquire(ifa, &psref);
5785 break;
5786 }
5787 }
5788 }
5789 pserialize_read_exit(s);
5790
5791 if (ifa) {
5792 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
5793 memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc));
5794 if (srcmask) {
5795 memcpy(srcmask, &sm->sin6_addr,
5796 sizeof(*srcmask));
5797 }
5798 }
5799
5800 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
5801 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
5802 memcpy(&ddst, &si->sin6_addr, sizeof(ddst));
5803 ifa_release(ifa, &psref);
5804 }
5805 curlwp_bindx(bound);
5806
5807 if (dst)
5808 memcpy(dst, &ddst, sizeof(*dst));
5809 if (src)
5810 memcpy(src, &ssrc, sizeof(*src));
5811 }
5812
5813 #ifdef IPV6CP_MYIFID_DYN
5814 /*
5815 * Generate random ifid.
5816 */
5817 static void
sppp_gen_ip6_addr(struct sppp * sp,struct in6_addr * addr)5818 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
5819 {
5820 /* TBD */
5821 }
5822
5823 /*
5824 * Set my IPv6 address. Must be called at splnet.
5825 */
5826 static void
sppp_set_ip6_addr(struct sppp * sp,const struct in6_addr * src)5827 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
5828 {
5829 struct ifnet *ifp;
5830 struct ifaddr *ifa;
5831 struct sockaddr_in6 *sin6;
5832 int s;
5833 struct psref psref;
5834
5835 KASSERT(SPPP_WLOCKED(sp));
5836
5837 ifp = &sp->pp_if;
5838
5839 SPPP_UNLOCK(sp);
5840 IFNET_LOCK(ifp);
5841 SPPP_LOCK(sp, RW_WRITER);
5842
5843 /*
5844 * Pick the first link-local AF_INET6 address from the list,
5845 * aliases don't make any sense on a p2p link anyway.
5846 */
5847
5848 sin6 = NULL;
5849 s = pserialize_read_enter();
5850 IFADDR_READER_FOREACH(ifa, ifp)
5851 {
5852 if (ifa->ifa_addr->sa_family == AF_INET6)
5853 {
5854 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
5855 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
5856 ifa_acquire(ifa, &psref);
5857 break;
5858 }
5859 }
5860 }
5861 pserialize_read_exit(s);
5862
5863 if (ifa && sin6)
5864 {
5865 int error;
5866 struct sockaddr_in6 new_sin6 = *sin6;
5867
5868 memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr));
5869 error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
5870 if (error) {
5871 SPPP_DLOG(sp, "%s: in6_ifinit failed, error=%d\n",
5872 __func__, error);
5873 } else {
5874 pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa);
5875 }
5876 ifa_release(ifa, &psref);
5877 }
5878
5879 IFNET_UNLOCK(ifp);
5880 }
5881 #endif
5882
5883 /*
5884 * Suggest a candidate address to be used by peer.
5885 */
5886 static void
sppp_suggest_ip6_addr(struct sppp * sp,struct in6_addr * suggest)5887 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
5888 {
5889 struct in6_addr myaddr;
5890 struct timeval tv;
5891
5892 sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
5893
5894 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */
5895 microtime(&tv);
5896 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
5897 myaddr.s6_addr[14] ^= 0xff;
5898 myaddr.s6_addr[15] ^= 0xff;
5899 } else {
5900 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
5901 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
5902 }
5903 if (suggest)
5904 memcpy(suggest, &myaddr, sizeof(myaddr));
5905 }
5906 #endif /*INET6*/
5907
5908 /*
5909 * Process ioctl requests specific to the PPP interface.
5910 * Permissions have already been checked.
5911 */
5912 static int
sppp_params(struct sppp * sp,u_long cmd,void * data)5913 sppp_params(struct sppp *sp, u_long cmd, void *data)
5914 {
5915 switch (cmd) {
5916 case SPPPGETAUTHCFG:
5917 {
5918 struct spppauthcfg *cfg = (struct spppauthcfg *)data;
5919 int error;
5920 size_t len;
5921
5922 SPPP_LOCK(sp, RW_READER);
5923
5924 cfg->myauthflags = sp->myauth.flags;
5925 cfg->hisauthflags = sp->hisauth.flags;
5926 strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname));
5927 cfg->hisauth = sppp_proto2authproto(sp->hisauth.proto);
5928 cfg->myauth = sppp_proto2authproto(sp->myauth.proto);
5929 if (cfg->myname_length == 0) {
5930 if (sp->myauth.name != NULL)
5931 cfg->myname_length = sp->myauth.name_len + 1;
5932 } else {
5933 if (sp->myauth.name == NULL) {
5934 cfg->myname_length = 0;
5935 } else {
5936 len = sp->myauth.name_len + 1;
5937
5938 if (cfg->myname_length < len) {
5939 SPPP_UNLOCK(sp);
5940 return (ENAMETOOLONG);
5941 }
5942 error = copyout(sp->myauth.name, cfg->myname, len);
5943 if (error) {
5944 SPPP_UNLOCK(sp);
5945 return error;
5946 }
5947 }
5948 }
5949 if (cfg->hisname_length == 0) {
5950 if (sp->hisauth.name != NULL)
5951 cfg->hisname_length = sp->hisauth.name_len + 1;
5952 } else {
5953 if (sp->hisauth.name == NULL) {
5954 cfg->hisname_length = 0;
5955 } else {
5956 len = sp->hisauth.name_len + 1;
5957
5958 if (cfg->hisname_length < len) {
5959 SPPP_UNLOCK(sp);
5960 return (ENAMETOOLONG);
5961 }
5962 error = copyout(sp->hisauth.name, cfg->hisname, len);
5963 if (error) {
5964 SPPP_UNLOCK(sp);
5965 return error;
5966 }
5967 }
5968 }
5969 SPPP_UNLOCK(sp);
5970 }
5971 break;
5972 case SPPPSETAUTHCFG:
5973 {
5974 struct spppauthcfg *cfg = (struct spppauthcfg *)data;
5975 int error;
5976
5977 SPPP_LOCK(sp, RW_WRITER);
5978
5979 if (sp->myauth.name) {
5980 free(sp->myauth.name, M_DEVBUF);
5981 sp->myauth.name = NULL;
5982 }
5983 if (sp->myauth.secret) {
5984 free(sp->myauth.secret, M_DEVBUF);
5985 sp->myauth.secret = NULL;
5986 }
5987 if (sp->hisauth.name) {
5988 free(sp->hisauth.name, M_DEVBUF);
5989 sp->hisauth.name = NULL;
5990 }
5991 if (sp->hisauth.secret) {
5992 free(sp->hisauth.secret, M_DEVBUF);
5993 sp->hisauth.secret = NULL;
5994 }
5995
5996 if (cfg->hisname != NULL && cfg->hisname_length > 0) {
5997 if (cfg->hisname_length >= MCLBYTES) {
5998 SPPP_UNLOCK(sp);
5999 return (ENAMETOOLONG);
6000 }
6001 sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK);
6002 error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length);
6003 if (error) {
6004 free(sp->hisauth.name, M_DEVBUF);
6005 sp->hisauth.name = NULL;
6006 SPPP_UNLOCK(sp);
6007 return error;
6008 }
6009 sp->hisauth.name_len = cfg->hisname_length - 1;
6010 sp->hisauth.name[sp->hisauth.name_len] = 0;
6011 }
6012 if (cfg->hissecret != NULL && cfg->hissecret_length > 0) {
6013 if (cfg->hissecret_length >= MCLBYTES) {
6014 SPPP_UNLOCK(sp);
6015 return (ENAMETOOLONG);
6016 }
6017 sp->hisauth.secret = malloc(cfg->hissecret_length,
6018 M_DEVBUF, M_WAITOK);
6019 error = copyin(cfg->hissecret, sp->hisauth.secret,
6020 cfg->hissecret_length);
6021 if (error) {
6022 free(sp->hisauth.secret, M_DEVBUF);
6023 sp->hisauth.secret = NULL;
6024 SPPP_UNLOCK(sp);
6025 return error;
6026 }
6027 sp->hisauth.secret_len = cfg->hissecret_length - 1;
6028 sp->hisauth.secret[sp->hisauth.secret_len] = 0;
6029 }
6030 if (cfg->myname != NULL && cfg->myname_length > 0) {
6031 if (cfg->myname_length >= MCLBYTES) {
6032 SPPP_UNLOCK(sp);
6033 return (ENAMETOOLONG);
6034 }
6035 sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK);
6036 error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length);
6037 if (error) {
6038 free(sp->myauth.name, M_DEVBUF);
6039 sp->myauth.name = NULL;
6040 SPPP_UNLOCK(sp);
6041 return error;
6042 }
6043 sp->myauth.name_len = cfg->myname_length - 1;
6044 sp->myauth.name[sp->myauth.name_len] = 0;
6045 }
6046 if (cfg->mysecret != NULL && cfg->mysecret_length > 0) {
6047 if (cfg->mysecret_length >= MCLBYTES) {
6048 SPPP_UNLOCK(sp);
6049 return (ENAMETOOLONG);
6050 }
6051 sp->myauth.secret = malloc(cfg->mysecret_length,
6052 M_DEVBUF, M_WAITOK);
6053 error = copyin(cfg->mysecret, sp->myauth.secret,
6054 cfg->mysecret_length);
6055 if (error) {
6056 free(sp->myauth.secret, M_DEVBUF);
6057 sp->myauth.secret = NULL;
6058 SPPP_UNLOCK(sp);
6059 return error;
6060 }
6061 sp->myauth.secret_len = cfg->mysecret_length - 1;
6062 sp->myauth.secret[sp->myauth.secret_len] = 0;
6063 }
6064 sp->myauth.flags = cfg->myauthflags;
6065 if (cfg->myauth != SPPP_AUTHPROTO_NOCHG) {
6066 sp->myauth.proto = sppp_authproto2proto(cfg->myauth);
6067 }
6068 sp->hisauth.flags = cfg->hisauthflags;
6069 if (cfg->hisauth != SPPP_AUTHPROTO_NOCHG) {
6070 sp->hisauth.proto = sppp_authproto2proto(cfg->hisauth);
6071 }
6072 sp->pp_auth_failures = 0;
6073 if (sp->hisauth.proto != PPP_NOPROTO)
6074 SET(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO);
6075 else
6076 CLR(sp->lcp.opts, SPPP_LCP_OPT_AUTH_PROTO);
6077
6078 SPPP_UNLOCK(sp);
6079 }
6080 break;
6081 case SPPPGETLCPCFG:
6082 {
6083 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
6084
6085 SPPP_LOCK(sp, RW_READER);
6086 lcpp->lcp_timeout = sp->lcp.timeout;
6087 SPPP_UNLOCK(sp);
6088 }
6089 break;
6090 case SPPPSETLCPCFG:
6091 {
6092 struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
6093
6094 SPPP_LOCK(sp, RW_WRITER);
6095 sp->lcp.timeout = lcpp->lcp_timeout;
6096 SPPP_UNLOCK(sp);
6097 }
6098 break;
6099 case SPPPGETNCPCFG:
6100 {
6101 struct spppncpcfg *ncpp = (struct spppncpcfg *) data;
6102
6103 SPPP_LOCK(sp, RW_READER);
6104 ncpp->ncp_flags = sp->pp_ncpflags;
6105 SPPP_UNLOCK(sp);
6106 }
6107 break;
6108 case SPPPSETNCPCFG:
6109 {
6110 struct spppncpcfg *ncpp = (struct spppncpcfg *) data;
6111
6112 SPPP_LOCK(sp, RW_WRITER);
6113 sp->pp_ncpflags = ncpp->ncp_flags;
6114 SPPP_UNLOCK(sp);
6115 }
6116 break;
6117 case SPPPGETSTATUS:
6118 {
6119 struct spppstatus *status = (struct spppstatus *)data;
6120
6121 SPPP_LOCK(sp, RW_READER);
6122 status->phase = sp->pp_phase;
6123 SPPP_UNLOCK(sp);
6124 }
6125 break;
6126 case SPPPGETSTATUSNCP:
6127 {
6128 struct spppstatusncp *status = (struct spppstatusncp *)data;
6129
6130 SPPP_LOCK(sp, RW_READER);
6131 status->phase = sp->pp_phase;
6132 status->ncpup = sppp_cp_check(sp, CP_NCP);
6133 SPPP_UNLOCK(sp);
6134 }
6135 break;
6136 case SPPPGETIDLETO:
6137 {
6138 struct spppidletimeout *to = (struct spppidletimeout *)data;
6139
6140 SPPP_LOCK(sp, RW_READER);
6141 to->idle_seconds = sp->pp_idle_timeout;
6142 SPPP_UNLOCK(sp);
6143 }
6144 break;
6145 case SPPPSETIDLETO:
6146 {
6147 struct spppidletimeout *to = (struct spppidletimeout *)data;
6148
6149 SPPP_LOCK(sp, RW_WRITER);
6150 sp->pp_idle_timeout = to->idle_seconds;
6151 SPPP_UNLOCK(sp);
6152 }
6153 break;
6154 case SPPPSETAUTHFAILURE:
6155 {
6156 struct spppauthfailuresettings *afsettings =
6157 (struct spppauthfailuresettings *)data;
6158
6159 SPPP_LOCK(sp, RW_WRITER);
6160 sp->pp_max_auth_fail = afsettings->max_failures;
6161 sp->pp_auth_failures = 0;
6162 SPPP_UNLOCK(sp);
6163 }
6164 break;
6165 case SPPPGETAUTHFAILURES:
6166 {
6167 struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data;
6168
6169 SPPP_LOCK(sp, RW_READER);
6170 stats->auth_failures = sp->pp_auth_failures;
6171 stats->max_failures = sp->pp_max_auth_fail;
6172 SPPP_UNLOCK(sp);
6173 }
6174 break;
6175 case SPPPSETDNSOPTS:
6176 {
6177 struct spppdnssettings *req = (struct spppdnssettings *)data;
6178
6179 SPPP_LOCK(sp, RW_WRITER);
6180 sp->query_dns = req->query_dns & 3;
6181 SPPP_UNLOCK(sp);
6182 }
6183 break;
6184 case SPPPGETDNSOPTS:
6185 {
6186 struct spppdnssettings *req = (struct spppdnssettings *)data;
6187
6188 SPPP_LOCK(sp, RW_READER);
6189 req->query_dns = sp->query_dns;
6190 SPPP_UNLOCK(sp);
6191 }
6192 break;
6193 case SPPPGETDNSADDRS:
6194 {
6195 struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data;
6196
6197 SPPP_LOCK(sp, RW_READER);
6198 memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns);
6199 SPPP_UNLOCK(sp);
6200 }
6201 break;
6202 case SPPPGETKEEPALIVE:
6203 {
6204 struct spppkeepalivesettings *settings =
6205 (struct spppkeepalivesettings*)data;
6206
6207 SPPP_LOCK(sp, RW_READER);
6208 settings->maxalive = sp->pp_maxalive;
6209 settings->max_noreceive = sp->pp_max_noreceive;
6210 settings->alive_interval = sp->pp_alive_interval;
6211 SPPP_UNLOCK(sp);
6212 }
6213 break;
6214 case SPPPSETKEEPALIVE:
6215 {
6216 struct spppkeepalivesettings *settings =
6217 (struct spppkeepalivesettings*)data;
6218
6219 SPPP_LOCK(sp, RW_WRITER);
6220 sp->pp_maxalive = settings->maxalive;
6221 sp->pp_max_noreceive = settings->max_noreceive;
6222 sp->pp_alive_interval = settings->alive_interval;
6223 SPPP_UNLOCK(sp);
6224 }
6225 break;
6226 case SPPPGETLCPSTATUS:
6227 {
6228 struct sppplcpstatus *status =
6229 (struct sppplcpstatus *)data;
6230
6231 SPPP_LOCK(sp, RW_READER);
6232 status->state = sp->scp[IDX_LCP].state;
6233 status->opts = sp->lcp.opts;
6234 status->magic = sp->lcp.magic;
6235 status->mru = sp->lcp.mru;
6236 SPPP_UNLOCK(sp);
6237 }
6238 break;
6239 case SPPPGETIPCPSTATUS:
6240 {
6241 struct spppipcpstatus *status =
6242 (struct spppipcpstatus *)data;
6243 u_int32_t myaddr;
6244
6245 SPPP_LOCK(sp, RW_READER);
6246 status->state = sp->scp[IDX_IPCP].state;
6247 status->opts = sp->ipcp.opts;
6248 #ifdef INET
6249 sppp_get_ip_addrs(sp, &myaddr, 0, 0);
6250 #else
6251 myaddr = 0;
6252 #endif
6253 status->myaddr = ntohl(myaddr);
6254 SPPP_UNLOCK(sp);
6255 }
6256 break;
6257 case SPPPGETIPV6CPSTATUS:
6258 {
6259 struct spppipv6cpstatus *status =
6260 (struct spppipv6cpstatus *)data;
6261
6262 SPPP_LOCK(sp, RW_READER);
6263 status->state = sp->scp[IDX_IPV6CP].state;
6264 memcpy(status->my_ifid, sp->ipv6cp.my_ifid,
6265 sizeof(status->my_ifid));
6266 memcpy(status->his_ifid, sp->ipv6cp.his_ifid,
6267 sizeof(status->his_ifid));
6268 SPPP_UNLOCK(sp);
6269 }
6270 break;
6271 default:
6272 {
6273 int ret;
6274
6275 MODULE_HOOK_CALL(sppp_params_50_hook, (sp, cmd, data),
6276 enosys(), ret);
6277 if (ret != ENOSYS)
6278 return ret;
6279 return (EINVAL);
6280 }
6281 }
6282 return (0);
6283 }
6284
6285 static void
sppp_phase_network(struct sppp * sp)6286 sppp_phase_network(struct sppp *sp)
6287 {
6288 int i;
6289
6290 KASSERT(SPPP_WLOCKED(sp));
6291
6292 sppp_change_phase(sp, SPPP_PHASE_NETWORK);
6293
6294 /* Notify NCPs now. */
6295 for (i = 0; i < IDX_COUNT; i++)
6296 if ((cps[i])->flags & CP_NCP)
6297 sppp_wq_add(sp->wq_cp, &sp->scp[i].work_open);
6298 }
6299
6300 static const char *
sppp_cp_type_name(char * buf,size_t buflen,u_char type)6301 sppp_cp_type_name(char *buf, size_t buflen, u_char type)
6302 {
6303
6304 switch (type) {
6305 case CONF_REQ: return "conf-req";
6306 case CONF_ACK: return "conf-ack";
6307 case CONF_NAK: return "conf-nak";
6308 case CONF_REJ: return "conf-rej";
6309 case TERM_REQ: return "term-req";
6310 case TERM_ACK: return "term-ack";
6311 case CODE_REJ: return "code-rej";
6312 case PROTO_REJ: return "proto-rej";
6313 case ECHO_REQ: return "echo-req";
6314 case ECHO_REPLY: return "echo-reply";
6315 case DISC_REQ: return "discard-req";
6316 }
6317 if (buf != NULL)
6318 snprintf(buf, buflen, "0x%02x", type);
6319 return buf;
6320 }
6321
6322 static const char *
sppp_auth_type_name(char * buf,size_t buflen,u_short proto,u_char type)6323 sppp_auth_type_name(char *buf, size_t buflen, u_short proto, u_char type)
6324 {
6325 const char *name;
6326
6327 switch (proto) {
6328 case PPP_CHAP:
6329 switch (type) {
6330 case CHAP_CHALLENGE: return "challenge";
6331 case CHAP_RESPONSE: return "response";
6332 case CHAP_SUCCESS: return "success";
6333 case CHAP_FAILURE: return "failure";
6334 default: name = "chap"; break;
6335 }
6336 break;
6337
6338 case PPP_PAP:
6339 switch (type) {
6340 case PAP_REQ: return "req";
6341 case PAP_ACK: return "ack";
6342 case PAP_NAK: return "nak";
6343 default: name = "pap"; break;
6344 }
6345 break;
6346
6347 default:
6348 name = "bad";
6349 break;
6350 }
6351
6352 if (buf != NULL)
6353 snprintf(buf, buflen, "%s(%#x) 0x%02x", name, proto, type);
6354 return buf;
6355 }
6356
6357 static const char *
sppp_lcp_opt_name(char * buf,size_t buflen,u_char opt)6358 sppp_lcp_opt_name(char *buf, size_t buflen, u_char opt)
6359 {
6360
6361 switch (opt) {
6362 case LCP_OPT_MRU: return "mru";
6363 case LCP_OPT_ASYNC_MAP: return "async-map";
6364 case LCP_OPT_AUTH_PROTO: return "auth-proto";
6365 case LCP_OPT_QUAL_PROTO: return "qual-proto";
6366 case LCP_OPT_MAGIC: return "magic";
6367 case LCP_OPT_PROTO_COMP: return "proto-comp";
6368 case LCP_OPT_ADDR_COMP: return "addr-comp";
6369 case LCP_OPT_SELF_DESC_PAD: return "sdpad";
6370 case LCP_OPT_CALL_BACK: return "callback";
6371 case LCP_OPT_COMPOUND_FRMS: return "cmpd-frms";
6372 case LCP_OPT_MP_MRRU: return "mrru";
6373 case LCP_OPT_MP_SSNHF: return "mp-ssnhf";
6374 case LCP_OPT_MP_EID: return "mp-eid";
6375 }
6376 if (buf != NULL)
6377 snprintf(buf, buflen, "0x%02x", opt);
6378 return buf;
6379 }
6380
6381 static const char *
sppp_ipcp_opt_name(char * buf,size_t buflen,u_char opt)6382 sppp_ipcp_opt_name(char *buf, size_t buflen, u_char opt)
6383 {
6384
6385 switch (opt) {
6386 case IPCP_OPT_ADDRESSES: return "addresses";
6387 case IPCP_OPT_COMPRESSION: return "compression";
6388 case IPCP_OPT_ADDRESS: return "address";
6389 case IPCP_OPT_PRIMDNS: return "primdns";
6390 case IPCP_OPT_SECDNS: return "secdns";
6391 }
6392 if (buf != NULL)
6393 snprintf(buf, buflen, "0x%02x", opt);
6394 return buf;
6395 }
6396
6397 #ifdef INET6
6398 static const char *
sppp_ipv6cp_opt_name(char * buf,size_t buflen,u_char opt)6399 sppp_ipv6cp_opt_name(char *buf, size_t buflen, u_char opt)
6400 {
6401
6402 switch (opt) {
6403 case IPV6CP_OPT_IFID: return "ifid";
6404 case IPV6CP_OPT_COMPRESSION: return "compression";
6405 }
6406 if (buf != NULL)
6407 snprintf(buf, buflen, "0x%02x", opt);
6408 return buf;
6409 }
6410 #endif
6411
6412 static const char *
sppp_state_name(int state)6413 sppp_state_name(int state)
6414 {
6415
6416 switch (state) {
6417 case STATE_INITIAL: return "initial";
6418 case STATE_STARTING: return "starting";
6419 case STATE_CLOSED: return "closed";
6420 case STATE_STOPPED: return "stopped";
6421 case STATE_CLOSING: return "closing";
6422 case STATE_STOPPING: return "stopping";
6423 case STATE_REQ_SENT: return "req-sent";
6424 case STATE_ACK_RCVD: return "ack-rcvd";
6425 case STATE_ACK_SENT: return "ack-sent";
6426 case STATE_OPENED: return "opened";
6427 }
6428 return "illegal";
6429 }
6430
6431 static const char *
sppp_phase_name(int phase)6432 sppp_phase_name(int phase)
6433 {
6434
6435 switch (phase) {
6436 case SPPP_PHASE_DEAD: return "dead";
6437 case SPPP_PHASE_ESTABLISH: return "establish";
6438 case SPPP_PHASE_TERMINATE: return "terminate";
6439 case SPPP_PHASE_AUTHENTICATE: return "authenticate";
6440 case SPPP_PHASE_NETWORK: return "network";
6441 }
6442 return "illegal";
6443 }
6444
6445 static const char *
sppp_proto_name(char * buf,size_t buflen,u_short proto)6446 sppp_proto_name(char *buf, size_t buflen, u_short proto)
6447 {
6448
6449 switch (proto) {
6450 case PPP_LCP: return "lcp";
6451 case PPP_IPCP: return "ipcp";
6452 case PPP_PAP: return "pap";
6453 case PPP_CHAP: return "chap";
6454 case PPP_IPV6CP: return "ipv6cp";
6455 }
6456 if (buf != NULL) {
6457 snprintf(buf, sizeof(buf), "0x%04x",
6458 (unsigned)proto);
6459 }
6460 return buf;
6461 }
6462
6463 static void
sppp_print_bytes(const u_char * p,u_short len)6464 sppp_print_bytes(const u_char *p, u_short len)
6465 {
6466 addlog(" %02x", *p++);
6467 while (--len > 0)
6468 addlog("-%02x", *p++);
6469 }
6470
6471 static void
sppp_print_string(const char * p,u_short len)6472 sppp_print_string(const char *p, u_short len)
6473 {
6474 u_char c;
6475
6476 while (len-- > 0) {
6477 c = *p++;
6478 /*
6479 * Print only ASCII chars directly. RFC 1994 recommends
6480 * using only them, but we don't rely on it. */
6481 if (c < ' ' || c > '~')
6482 addlog("\\x%x", c);
6483 else
6484 addlog("%c", c);
6485 }
6486 }
6487
6488 static const char *
sppp_dotted_quad(char * buf,size_t buflen,uint32_t addr)6489 sppp_dotted_quad(char *buf, size_t buflen, uint32_t addr)
6490 {
6491
6492 if (buf != NULL) {
6493 snprintf(buf, buflen, "%u.%u.%u.%u",
6494 (unsigned int)((addr >> 24) & 0xff),
6495 (unsigned int)((addr >> 16) & 0xff),
6496 (unsigned int)((addr >> 8) & 0xff),
6497 (unsigned int)(addr & 0xff));
6498 }
6499 return buf;
6500 }
6501
6502 /* a dummy, used to drop uninteresting events */
6503 static void
sppp_null(struct sppp * unused)6504 sppp_null(struct sppp *unused)
6505 {
6506 /* do just nothing */
6507 }
6508
6509 static void
sppp_tls(const struct cp * cp,struct sppp * sp)6510 sppp_tls(const struct cp *cp, struct sppp *sp)
6511 {
6512
6513 SPPP_DLOG(sp, "%s tls\n", cp->name);
6514
6515 /* notify lcp that is lower layer */
6516 sp->lcp.protos |= (1 << cp->protoidx);
6517 }
6518
6519 static void
sppp_tlf(const struct cp * cp,struct sppp * sp)6520 sppp_tlf(const struct cp *cp, struct sppp *sp)
6521 {
6522
6523 SPPP_DLOG(sp, "%s tlf\n", cp->name);
6524
6525 /* notify lcp that is lower layer */
6526 sp->lcp.protos &= ~(1 << cp->protoidx);
6527
6528 /* cleanup */
6529 if (sp->scp[cp->protoidx].mbuf_confreq != NULL) {
6530 m_freem(sp->scp[cp->protoidx].mbuf_confreq);
6531 sp->scp[cp->protoidx].mbuf_confreq = NULL;
6532 }
6533 if (sp->scp[cp->protoidx].mbuf_confnak != NULL) {
6534 m_freem(sp->scp[cp->protoidx].mbuf_confnak);
6535 sp->scp[cp->protoidx].mbuf_confnak = NULL;
6536 }
6537
6538 sppp_lcp_check_and_close(sp);
6539 }
6540
6541 static void
sppp_screply(const struct cp * cp,struct sppp * sp,u_char type,uint8_t ident,size_t msglen,void * msg)6542 sppp_screply(const struct cp *cp, struct sppp *sp, u_char type,
6543 uint8_t ident, size_t msglen, void *msg)
6544 {
6545
6546 if (msglen == 0)
6547 return;
6548
6549 switch (type) {
6550 case CONF_ACK:
6551 case CONF_NAK:
6552 case CONF_REJ:
6553 break;
6554 default:
6555 return;
6556 }
6557
6558 if (sppp_debug_enabled(sp)) {
6559 char tbuf[SPPP_CPTYPE_NAMELEN];
6560 const char *cpname;
6561
6562 cpname = sppp_cp_type_name(tbuf, sizeof(tbuf), type);
6563 SPPP_LOG(sp, LOG_DEBUG, "send %s\n", cpname);
6564 }
6565
6566 sppp_cp_send(sp, cp->proto, type, ident, msglen, msg);
6567 }
6568
6569 static void
sppp_ifdown(struct sppp * sp,void * xcp __unused)6570 sppp_ifdown(struct sppp *sp, void *xcp __unused)
6571 {
6572
6573 SPPP_UNLOCK(sp);
6574 if_down(&sp->pp_if);
6575 IF_PURGE(&sp->pp_cpq);
6576 SPPP_LOCK(sp, RW_WRITER);
6577 }
6578
6579 static void
sppp_notify_up(struct sppp * sp)6580 sppp_notify_up(struct sppp *sp)
6581 {
6582
6583 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_up);
6584 }
6585
6586 static void
sppp_notify_down(struct sppp * sp)6587 sppp_notify_down(struct sppp *sp)
6588 {
6589
6590 sppp_wq_add(sp->wq_cp, &sp->scp[IDX_LCP].work_down);
6591 }
6592
6593 static void
sppp_notify_tls_wlocked(struct sppp * sp)6594 sppp_notify_tls_wlocked(struct sppp *sp)
6595 {
6596
6597 KASSERT(SPPP_WLOCKED(sp));
6598
6599 if (!sp->pp_tls)
6600 return;
6601
6602 SPPP_UNLOCK(sp);
6603 sp->pp_tls(sp);
6604 SPPP_LOCK(sp, RW_WRITER);
6605 }
6606
6607 static void
sppp_notify_tlf_wlocked(struct sppp * sp)6608 sppp_notify_tlf_wlocked(struct sppp *sp)
6609 {
6610
6611 KASSERT(SPPP_WLOCKED(sp));
6612
6613 if (!sp->pp_tlf)
6614 return;
6615
6616 SPPP_UNLOCK(sp);
6617 sp->pp_tlf(sp);
6618 SPPP_LOCK(sp, RW_WRITER);
6619 }
6620
6621 static void
sppp_notify_con(struct sppp * sp)6622 sppp_notify_con(struct sppp *sp)
6623 {
6624
6625 if (!sp->pp_con)
6626 return;
6627
6628 sp->pp_con(sp);
6629 }
6630
6631 #ifdef INET6
6632 static void
sppp_notify_con_wlocked(struct sppp * sp)6633 sppp_notify_con_wlocked(struct sppp *sp)
6634 {
6635
6636 KASSERT(SPPP_WLOCKED(sp));
6637
6638 SPPP_UNLOCK(sp);
6639 sppp_notify_con(sp);
6640 SPPP_LOCK(sp, RW_WRITER);
6641
6642 }
6643 #endif
6644
6645 static void
sppp_notify_chg_wlocked(struct sppp * sp)6646 sppp_notify_chg_wlocked(struct sppp *sp)
6647 {
6648
6649 KASSERT(SPPP_WLOCKED(sp));
6650
6651 if (!sp->pp_chg)
6652 return;
6653
6654 SPPP_UNLOCK(sp);
6655 sp->pp_chg(sp, sp->pp_phase);
6656 SPPP_LOCK(sp, RW_WRITER);
6657 }
6658
6659 static void
sppp_wq_work(struct work * wk,void * xsp)6660 sppp_wq_work(struct work *wk, void *xsp)
6661 {
6662 struct sppp *sp;
6663 struct sppp_work *work;
6664
6665 sp = xsp;
6666 work = container_of(wk, struct sppp_work, work);
6667 atomic_cas_uint(&work->state, SPPP_WK_BUSY, SPPP_WK_FREE);
6668
6669 SPPP_LOCK(sp, RW_WRITER);
6670 work->func(sp, work->arg);
6671 SPPP_UNLOCK(sp);
6672 }
6673
6674 static struct workqueue *
sppp_wq_create(struct sppp * sp,const char * xnamebuf,pri_t prio,int ipl,int flags)6675 sppp_wq_create(struct sppp *sp, const char *xnamebuf, pri_t prio, int ipl, int flags)
6676 {
6677 struct workqueue *wq;
6678 int error;
6679
6680 error = workqueue_create(&wq, xnamebuf, sppp_wq_work,
6681 (void *)sp, prio, ipl, flags);
6682 if (error) {
6683 panic("%s: workqueue_create failed [%s, %d]\n",
6684 sp->pp_if.if_xname, xnamebuf, error);
6685 }
6686
6687 return wq;
6688 }
6689
6690 static void
sppp_wq_destroy(struct sppp * sp __unused,struct workqueue * wq)6691 sppp_wq_destroy(struct sppp *sp __unused, struct workqueue *wq)
6692 {
6693
6694 workqueue_destroy(wq);
6695 }
6696
6697 static void
sppp_wq_set(struct sppp_work * work,void (* func)(struct sppp *,void *),void * arg)6698 sppp_wq_set(struct sppp_work *work,
6699 void (*func)(struct sppp *, void *), void *arg)
6700 {
6701
6702 work->func = func;
6703 work->arg = arg;
6704 }
6705
6706 static void
sppp_wq_add(struct workqueue * wq,struct sppp_work * work)6707 sppp_wq_add(struct workqueue *wq, struct sppp_work *work)
6708 {
6709
6710 if (atomic_cas_uint(&work->state, SPPP_WK_FREE, SPPP_WK_BUSY)
6711 != SPPP_WK_FREE)
6712 return;
6713
6714 KASSERT(work->func != NULL);
6715 kpreempt_disable();
6716 workqueue_enqueue(wq, &work->work, NULL);
6717 kpreempt_enable();
6718 }
6719 static void
sppp_wq_wait(struct workqueue * wq,struct sppp_work * work)6720 sppp_wq_wait(struct workqueue *wq, struct sppp_work *work)
6721 {
6722
6723 atomic_swap_uint(&work->state, SPPP_WK_UNAVAIL);
6724 workqueue_wait(wq, &work->work);
6725 }
6726
6727 /*
6728 * This file is large. Tell emacs to highlight it nevertheless.
6729 *
6730 * Local Variables:
6731 * hilit-auto-highlight-maxout: 120000
6732 * End:
6733 */
6734
6735 /*
6736 * Module glue
6737 */
6738 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL);
6739
6740 static int
sppp_subr_modcmd(modcmd_t cmd,void * arg)6741 sppp_subr_modcmd(modcmd_t cmd, void *arg)
6742 {
6743
6744 switch (cmd) {
6745 case MODULE_CMD_INIT:
6746 case MODULE_CMD_FINI:
6747 return 0;
6748 case MODULE_CMD_STAT:
6749 case MODULE_CMD_AUTOUNLOAD:
6750 default:
6751 return ENOTTY;
6752 }
6753 }
6754