xref: /openbsd/sys/net/if_spppsubr.c (revision 17df1aa7)
1 /*	$OpenBSD: if_spppsubr.c,v 1.80 2010/05/01 08:14:26 mk Exp $	*/
2 /*
3  * Synchronous PPP/Cisco link level subroutines.
4  * Keepalive protocol implemented in both Cisco and PPP modes.
5  *
6  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
7  * Author: Serge Vakulenko, <vak@cronyx.ru>
8  *
9  * Heavily revamped to conform to RFC 1661.
10  * Copyright (C) 1997, Joerg Wunsch.
11  *
12  * RFC2472 IPv6CP support.
13  * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun@iijlab.net>.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions are met:
17  * 1. Redistributions of source code must retain the above copyright notice,
18  *    this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright notice,
20  *    this list of conditions and the following disclaimer in the documentation
21  *    and/or other materials provided with the distribution.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
24  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
27  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  *
35  * From: Version 2.6, Tue May 12 17:10:39 MSD 1998
36  */
37 
38 #include <sys/param.h>
39 
40 #define HIDE
41 
42 #include <sys/systm.h>
43 #include <sys/kernel.h>
44 #include <sys/sockio.h>
45 #include <sys/socket.h>
46 #include <sys/proc.h>
47 #include <sys/syslog.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 
51 #if defined (__OpenBSD__)
52 #include <sys/timeout.h>
53 #include <crypto/md5.h>
54 #else
55 #include <sys/md5.h>
56 #endif
57 
58 #include <net/if.h>
59 #include <net/netisr.h>
60 #include <net/if_types.h>
61 #include <net/route.h>
62 
63 /* for arc4random() */
64 #include <dev/rndvar.h>
65 
66 #if defined (__FreeBSD__) || defined(__OpenBSD_) || defined(__NetBSD__)
67 #include <machine/random.h>
68 #endif
69 #if defined (__NetBSD__) || defined (__OpenBSD__)
70 #include <machine/cpu.h> /* XXX for softnet */
71 #endif
72 #include <sys/stdarg.h>
73 
74 #ifdef INET
75 #include <netinet/in.h>
76 #include <netinet/in_systm.h>
77 #include <netinet/in_var.h>
78 #include <netinet/ip.h>
79 #include <netinet/tcp.h>
80 # if defined (__FreeBSD__) || defined (__OpenBSD__)
81 #  include <netinet/if_ether.h>
82 # else
83 #  include <net/ethertypes.h>
84 # endif
85 #endif
86 
87 #ifdef INET6
88 #include <netinet6/in6_var.h>
89 #endif
90 
91 #include <net/if_sppp.h>
92 
93 #if defined (__FreeBSD__)
94 # define UNTIMEOUT(fun, arg, handle)	\
95 	untimeout(fun, arg, handle)
96 #elif defined(__OpenBSD__)
97 # define UNTIMEOUT(fun, arg, handle)	\
98 	timeout_del(&(handle))
99 #else
100 # define UNTIMEOUT(fun, arg, handle)	\
101 	untimeout(fun, arg)
102 #endif
103 
104 #define LOOPALIVECNT     		3	/* loopback detection tries */
105 #define MAXALIVECNT    			3	/* max. missed alive packets */
106 #define	NORECV_TIME			15	/* before we get worried */
107 
108 /*
109  * Interface flags that can be set in an ifconfig command.
110  *
111  * Setting link0 will make the link passive, i.e. it will be marked
112  * as being administrative openable, but won't be opened to begin
113  * with.  Incoming calls will be answered, or subsequent calls with
114  * -link1 will cause the administrative open of the LCP layer.
115  *
116  * Setting link1 will cause the link to auto-dial only as packets
117  * arrive to be sent.
118  *
119  * Setting IFF_DEBUG will syslog the option negotiation and state
120  * transitions at level kern.debug.  Note: all logs consistently look
121  * like
122  *
123  *   <if-name><unit>: <proto-name> <additional info...>
124  *
125  * with <if-name><unit> being something like "bppp0", and <proto-name>
126  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
127  */
128 
129 #define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
130 #define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
131 
132 #define PPP_ALLSTATIONS 0xff		/* All-Stations broadcast address */
133 #define PPP_UI		0x03		/* Unnumbered Information */
134 #define PPP_IP		0x0021		/* Internet Protocol */
135 #define PPP_ISO		0x0023		/* ISO OSI Protocol */
136 #define PPP_XNS		0x0025		/* Xerox NS Protocol */
137 #define PPP_IPX		0x002b		/* Novell IPX Protocol */
138 #define PPP_IPV6	0x0057		/* Internet Protocol v6 */
139 #define PPP_LCP		0xc021		/* Link Control Protocol */
140 #define PPP_PAP		0xc023		/* Password Authentication Protocol */
141 #define PPP_CHAP	0xc223		/* Challenge-Handshake Auth Protocol */
142 #define PPP_IPCP	0x8021		/* Internet Protocol Control Protocol */
143 #define PPP_IPV6CP	0x8057		/* IPv6 Control Protocol */
144 
145 #define CONF_REQ	1		/* PPP configure request */
146 #define CONF_ACK	2		/* PPP configure acknowledge */
147 #define CONF_NAK	3		/* PPP configure negative ack */
148 #define CONF_REJ	4		/* PPP configure reject */
149 #define TERM_REQ	5		/* PPP terminate request */
150 #define TERM_ACK	6		/* PPP terminate acknowledge */
151 #define CODE_REJ	7		/* PPP code reject */
152 #define PROTO_REJ	8		/* PPP protocol reject */
153 #define ECHO_REQ	9		/* PPP echo request */
154 #define ECHO_REPLY	10		/* PPP echo reply */
155 #define DISC_REQ	11		/* PPP discard request */
156 
157 #define LCP_OPT_MRU		1	/* maximum receive unit */
158 #define LCP_OPT_ASYNC_MAP	2	/* async control character map */
159 #define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
160 #define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
161 #define LCP_OPT_MAGIC		5	/* magic number */
162 #define LCP_OPT_RESERVED	6	/* reserved */
163 #define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
164 #define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
165 
166 #define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
167 #define IPCP_OPT_COMPRESSION	2	/* IP compression protocol (VJ) */
168 #define IPCP_OPT_ADDRESS	3	/* local IP address */
169 
170 #define IPV6CP_OPT_IFID		1	/* interface identifier */
171 #define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
172 
173 #define PAP_REQ			1	/* PAP name/password request */
174 #define PAP_ACK			2	/* PAP acknowledge */
175 #define PAP_NAK			3	/* PAP fail */
176 
177 #define CHAP_CHALLENGE		1	/* CHAP challenge request */
178 #define CHAP_RESPONSE		2	/* CHAP challenge response */
179 #define CHAP_SUCCESS		3	/* CHAP response ok */
180 #define CHAP_FAILURE		4	/* CHAP response failed */
181 
182 #define CHAP_MD5		5	/* hash algorithm - MD5 */
183 
184 #define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
185 #define CISCO_UNICAST		0x0f	/* Cisco unicast address */
186 #define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
187 #define CISCO_ADDR_REQ		0	/* Cisco address request */
188 #define CISCO_ADDR_REPLY	1	/* Cisco address reply */
189 #define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
190 
191 /* states are named and numbered according to RFC 1661 */
192 #define STATE_INITIAL	0
193 #define STATE_STARTING	1
194 #define STATE_CLOSED	2
195 #define STATE_STOPPED	3
196 #define STATE_CLOSING	4
197 #define STATE_STOPPING	5
198 #define STATE_REQ_SENT	6
199 #define STATE_ACK_RCVD	7
200 #define STATE_ACK_SENT	8
201 #define STATE_OPENED	9
202 
203 struct ppp_header {
204 	u_char address;
205 	u_char control;
206 	u_short protocol;
207 };
208 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
209 
210 struct lcp_header {
211 	u_char type;
212 	u_char ident;
213 	u_short len;
214 };
215 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
216 
217 struct cisco_packet {
218 	u_int32_t type;
219 	u_int32_t par1;
220 	u_int32_t par2;
221 	u_short rel;
222 	u_short time0;
223 	u_short time1;
224 };
225 #define CISCO_PACKET_LEN 18
226 
227 /*
228  * We follow the spelling and capitalization of RFC 1661 here, to make
229  * it easier comparing with the standard.  Please refer to this RFC in
230  * case you can't make sense out of these abbreviation; it will also
231  * explain the semantics related to the various events and actions.
232  */
233 struct cp {
234 	u_short	proto;		/* PPP control protocol number */
235 	u_char protoidx;	/* index into state table in struct sppp */
236 	u_char flags;
237 #define CP_LCP		0x01	/* this is the LCP */
238 #define CP_AUTH		0x02	/* this is an authentication protocol */
239 #define CP_NCP		0x04	/* this is a NCP */
240 #define CP_QUAL		0x08	/* this is a quality reporting protocol */
241 	const char *name;	/* name of this control protocol */
242 	/* event handlers */
243 	void	(*Up)(struct sppp *sp);
244 	void	(*Down)(struct sppp *sp);
245 	void	(*Open)(struct sppp *sp);
246 	void	(*Close)(struct sppp *sp);
247 	void	(*TO)(void *sp);
248 	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
249 	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
250 	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
251 	/* actions */
252 	void	(*tlu)(struct sppp *sp);
253 	void	(*tld)(struct sppp *sp);
254 	void	(*tls)(struct sppp *sp);
255 	void	(*tlf)(struct sppp *sp);
256 	void	(*scr)(struct sppp *sp);
257 };
258 
259 static struct sppp *spppq;
260 #if defined (__OpenBSD__)
261 static struct timeout keepalive_ch;
262 #endif
263 #if defined (__FreeBSD__)
264 static struct callout_handle keepalive_ch;
265 #endif
266 
267 #if defined (__FreeBSD__)
268 #define	SPP_FMT		"%s%d: "
269 #define	SPP_ARGS(ifp)	(ifp)->if_name, (ifp)->if_unit
270 #else
271 #define	SPP_FMT		"%s: "
272 #define	SPP_ARGS(ifp)	(ifp)->if_xname
273 #endif
274 
275 /*
276  * The following disgusting hack gets around the problem that IP TOS
277  * can't be set yet.  We want to put "interactive" traffic on a high
278  * priority queue.  To decide if traffic is interactive, we check that
279  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
280  *
281  * XXX is this really still necessary?  - joerg -
282  */
283 static u_short interactive_ports[8] = {
284 	0,	513,	0,	0,
285 	0,	21,	0,	23,
286 };
287 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
288 
289 /* almost every function needs these */
290 #define STDDCL							\
291 	struct ifnet *ifp = &sp->pp_if;				\
292 	int debug = ifp->if_flags & IFF_DEBUG
293 
294 HIDE int sppp_output(struct ifnet *ifp, struct mbuf *m,
295 		       struct sockaddr *dst, struct rtentry *rt);
296 
297 HIDE void sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2);
298 HIDE void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
299 
300 HIDE void sppp_cp_input(const struct cp *cp, struct sppp *sp,
301 			  struct mbuf *m);
302 HIDE void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
303 			 u_char ident, u_short len, void *data);
304 #ifdef notyet
305 HIDE void sppp_cp_timeout(void *arg);
306 #endif
307 HIDE void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
308 				 int newstate);
309 HIDE void sppp_auth_send(const struct cp *cp,
310 			   struct sppp *sp, unsigned int type, u_int id,
311 			   ...);
312 
313 HIDE void sppp_up_event(const struct cp *cp, struct sppp *sp);
314 HIDE void sppp_down_event(const struct cp *cp, struct sppp *sp);
315 HIDE void sppp_open_event(const struct cp *cp, struct sppp *sp);
316 HIDE void sppp_close_event(const struct cp *cp, struct sppp *sp);
317 HIDE void sppp_increasing_timeout(const struct cp *cp, struct sppp *sp);
318 HIDE void sppp_to_event(const struct cp *cp, struct sppp *sp);
319 
320 HIDE void sppp_null(struct sppp *sp);
321 
322 HIDE void sppp_lcp_init(struct sppp *sp);
323 HIDE void sppp_lcp_up(struct sppp *sp);
324 HIDE void sppp_lcp_down(struct sppp *sp);
325 HIDE void sppp_lcp_open(struct sppp *sp);
326 HIDE void sppp_lcp_close(struct sppp *sp);
327 HIDE void sppp_lcp_TO(void *sp);
328 HIDE int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
329 HIDE void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
330 HIDE void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
331 HIDE void sppp_lcp_tlu(struct sppp *sp);
332 HIDE void sppp_lcp_tld(struct sppp *sp);
333 HIDE void sppp_lcp_tls(struct sppp *sp);
334 HIDE void sppp_lcp_tlf(struct sppp *sp);
335 HIDE void sppp_lcp_scr(struct sppp *sp);
336 HIDE void sppp_lcp_check_and_close(struct sppp *sp);
337 HIDE int sppp_ncp_check(struct sppp *sp);
338 
339 HIDE void sppp_ipcp_init(struct sppp *sp);
340 HIDE void sppp_ipcp_up(struct sppp *sp);
341 HIDE void sppp_ipcp_down(struct sppp *sp);
342 HIDE void sppp_ipcp_open(struct sppp *sp);
343 HIDE void sppp_ipcp_close(struct sppp *sp);
344 HIDE void sppp_ipcp_TO(void *sp);
345 HIDE int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
346 HIDE void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
347 HIDE void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
348 HIDE void sppp_ipcp_tlu(struct sppp *sp);
349 HIDE void sppp_ipcp_tld(struct sppp *sp);
350 HIDE void sppp_ipcp_tls(struct sppp *sp);
351 HIDE void sppp_ipcp_tlf(struct sppp *sp);
352 HIDE void sppp_ipcp_scr(struct sppp *sp);
353 
354 HIDE void sppp_ipv6cp_init(struct sppp *sp);
355 HIDE void sppp_ipv6cp_up(struct sppp *sp);
356 HIDE void sppp_ipv6cp_down(struct sppp *sp);
357 HIDE void sppp_ipv6cp_open(struct sppp *sp);
358 HIDE void sppp_ipv6cp_close(struct sppp *sp);
359 HIDE void sppp_ipv6cp_TO(void *sp);
360 HIDE int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
361 HIDE void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
362 HIDE void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
363 HIDE void sppp_ipv6cp_tlu(struct sppp *sp);
364 HIDE void sppp_ipv6cp_tld(struct sppp *sp);
365 HIDE void sppp_ipv6cp_tls(struct sppp *sp);
366 HIDE void sppp_ipv6cp_tlf(struct sppp *sp);
367 HIDE void sppp_ipv6cp_scr(struct sppp *sp);
368 HIDE const char *sppp_ipv6cp_opt_name(u_char opt);
369 HIDE void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
370 			       struct in6_addr *dst, struct in6_addr *srcmask);
371 HIDE void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
372 HIDE void sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr);
373 HIDE void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest);
374 
375 HIDE void sppp_pap_input(struct sppp *sp, struct mbuf *m);
376 HIDE void sppp_pap_init(struct sppp *sp);
377 HIDE void sppp_pap_open(struct sppp *sp);
378 HIDE void sppp_pap_close(struct sppp *sp);
379 HIDE void sppp_pap_TO(void *sp);
380 HIDE void sppp_pap_my_TO(void *sp);
381 HIDE void sppp_pap_tlu(struct sppp *sp);
382 HIDE void sppp_pap_tld(struct sppp *sp);
383 HIDE void sppp_pap_scr(struct sppp *sp);
384 
385 HIDE void sppp_chap_input(struct sppp *sp, struct mbuf *m);
386 HIDE void sppp_chap_init(struct sppp *sp);
387 HIDE void sppp_chap_open(struct sppp *sp);
388 HIDE void sppp_chap_close(struct sppp *sp);
389 HIDE void sppp_chap_TO(void *sp);
390 HIDE void sppp_chap_tlu(struct sppp *sp);
391 HIDE void sppp_chap_tld(struct sppp *sp);
392 HIDE void sppp_chap_scr(struct sppp *sp);
393 
394 HIDE const char *sppp_auth_type_name(u_short proto, u_char type);
395 HIDE const char *sppp_cp_type_name(u_char type);
396 HIDE const char *sppp_dotted_quad(u_int32_t addr);
397 HIDE const char *sppp_ipcp_opt_name(u_char opt);
398 HIDE const char *sppp_lcp_opt_name(u_char opt);
399 HIDE const char *sppp_phase_name(enum ppp_phase phase);
400 HIDE const char *sppp_proto_name(u_short proto);
401 HIDE const char *sppp_state_name(int state);
402 HIDE int sppp_get_params(struct sppp *sp, struct ifreq *data);
403 HIDE int sppp_set_params(struct sppp *sp, struct ifreq *data);
404 HIDE void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst,
405 			      u_int32_t *srcmask);
406 HIDE void sppp_keepalive(void *dummy);
407 HIDE void sppp_phase_network(struct sppp *sp);
408 HIDE void sppp_print_bytes(const u_char *p, u_short len);
409 HIDE void sppp_print_string(const char *p, u_short len);
410 HIDE void sppp_qflush(struct ifqueue *ifq);
411 HIDE void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr,
412 			      u_int32_t hisaddr);
413 HIDE void sppp_clear_ip_addrs(struct sppp *sp);
414 HIDE void sppp_set_phase(struct sppp *sp);
415 
416 /* our control protocol descriptors */
417 static const struct cp lcp = {
418 	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
419 	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
420 	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
421 	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
422 	sppp_lcp_scr
423 };
424 
425 static const struct cp ipcp = {
426 	PPP_IPCP, IDX_IPCP,
427 #ifdef INET	/* don't run IPCP if there's no IPv4 support */
428 	CP_NCP,
429 #else
430 	0,
431 #endif
432 	"ipcp",
433 	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
434 	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
435 	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
436 	sppp_ipcp_scr
437 };
438 
439 static const struct cp ipv6cp = {
440 	PPP_IPV6CP, IDX_IPV6CP,
441 #ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
442 	CP_NCP,
443 #else
444 	0,
445 #endif
446 	"ipv6cp",
447 	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
448 	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
449 	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
450 	sppp_ipv6cp_scr
451 };
452 
453 static const struct cp pap = {
454 	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
455 	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
456 	sppp_pap_TO, 0, 0, 0,
457 	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
458 	sppp_pap_scr
459 };
460 
461 static const struct cp chap = {
462 	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
463 	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
464 	sppp_chap_TO, 0, 0, 0,
465 	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
466 	sppp_chap_scr
467 };
468 
469 static const struct cp *cps[IDX_COUNT] = {
470 	&lcp,			/* IDX_LCP */
471 	&ipcp,			/* IDX_IPCP */
472 	&ipv6cp,		/* IDX_IPV6CP */
473 	&pap,			/* IDX_PAP */
474 	&chap,			/* IDX_CHAP */
475 };
476 
477 
478 /*
479  * Exported functions, comprising our interface to the lower layer.
480  */
481 
482 #if defined(__OpenBSD__)
483 /* Workaround */
484 void
485 spppattach(struct ifnet *ifp)
486 {
487 }
488 #endif
489 
490 /*
491  * Process the received packet.
492  */
493 void
494 sppp_input(struct ifnet *ifp, struct mbuf *m)
495 {
496 	struct ppp_header *h, ht;
497 	struct ifqueue *inq = 0;
498 	struct sppp *sp = (struct sppp *)ifp;
499 	struct timeval tv;
500 	int debug = ifp->if_flags & IFF_DEBUG;
501 	int s;
502 
503 	if (ifp->if_flags & IFF_UP) {
504 		/* Count received bytes, add hardware framing */
505 		ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
506 		/* Note time of last receive */
507 		getmicrouptime(&tv);
508 		sp->pp_last_receive = tv.tv_sec;
509 	}
510 
511 	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
512 		/* Too small packet, drop it. */
513 		if (debug)
514 			log(LOG_DEBUG,
515 			    SPP_FMT "input packet is too small, %d bytes\n",
516 			    SPP_ARGS(ifp), m->m_pkthdr.len);
517 	  drop:
518 		++ifp->if_ierrors;
519 		++ifp->if_iqdrops;
520 		m_freem (m);
521 		return;
522 	}
523 
524 	/* mark incoming routing domain */
525 	m->m_pkthdr.rdomain = ifp->if_rdomain;
526 
527 	if (sp->pp_flags & PP_NOFRAMING) {
528 		memcpy(&ht.protocol, mtod(m, char *), sizeof(ht.protocol));
529 		m_adj(m, 2);
530 		ht.control = PPP_UI;
531 		ht.address = PPP_ALLSTATIONS;
532 		h = &ht;
533 	} else {
534 		/* Get PPP header. */
535 		h = mtod (m, struct ppp_header*);
536 		m_adj (m, PPP_HEADER_LEN);
537 	}
538 
539 	/* preserve the alignment */
540 	if (m->m_len < m->m_pkthdr.len) {
541 		m = m_pullup2(m, m->m_pkthdr.len);
542 		if (m == NULL) {
543 			if (debug)
544 				log(LOG_DEBUG,
545 				    SPP_FMT "Failed to align packet!\n", SPP_ARGS(ifp));
546 			++ifp->if_ierrors;
547 			++ifp->if_iqdrops;
548 			return;
549 		}
550 	}
551 
552 	switch (h->address) {
553 	case PPP_ALLSTATIONS:
554 		if (h->control != PPP_UI)
555 			goto invalid;
556 		if (sp->pp_flags & PP_CISCO) {
557 			if (debug)
558 				log(LOG_DEBUG,
559 				    SPP_FMT "PPP packet in Cisco mode "
560 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
561 				    SPP_ARGS(ifp),
562 				    h->address, h->control, ntohs(h->protocol));
563 			goto drop;
564 		}
565 		switch (ntohs (h->protocol)) {
566 		default:
567 			if (sp->state[IDX_LCP] == STATE_OPENED)
568 				sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
569 				    ++sp->pp_seq, 2, &h->protocol);
570 			if (debug)
571 				log(LOG_DEBUG,
572 				    SPP_FMT "invalid input protocol "
573 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
574 				    SPP_ARGS(ifp),
575 				    h->address, h->control, ntohs(h->protocol));
576 			++ifp->if_noproto;
577 			goto drop;
578 		case PPP_LCP:
579 			sppp_cp_input(&lcp, sp, m);
580 			m_freem (m);
581 			return;
582 		case PPP_PAP:
583 			if (sp->pp_phase >= PHASE_AUTHENTICATE)
584 				sppp_pap_input(sp, m);
585 			m_freem (m);
586 			return;
587 		case PPP_CHAP:
588 			if (sp->pp_phase >= PHASE_AUTHENTICATE)
589 				sppp_chap_input(sp, m);
590 			m_freem (m);
591 			return;
592 #ifdef INET
593 		case PPP_IPCP:
594 			if (sp->pp_phase == PHASE_NETWORK)
595 				sppp_cp_input(&ipcp, sp, m);
596 			m_freem (m);
597 			return;
598 		case PPP_IP:
599 			if (sp->state[IDX_IPCP] == STATE_OPENED) {
600 				schednetisr (NETISR_IP);
601 				inq = &ipintrq;
602 				sp->pp_last_activity = tv.tv_sec;
603 			}
604 			break;
605 #endif
606 #ifdef INET6
607 		case PPP_IPV6CP:
608 			if (sp->pp_phase == PHASE_NETWORK)
609 				sppp_cp_input(&ipv6cp, sp, m);
610 			m_freem (m);
611 			return;
612 		case PPP_IPV6:
613 			if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
614 				schednetisr (NETISR_IPV6);
615 				inq = &ip6intrq;
616 				sp->pp_last_activity = tv.tv_sec;
617 			}
618 			break;
619 #endif
620 		}
621 		break;
622 	case CISCO_MULTICAST:
623 	case CISCO_UNICAST:
624 		/* Don't check the control field here (RFC 1547). */
625 		if (! (sp->pp_flags & PP_CISCO)) {
626 			if (debug)
627 				log(LOG_DEBUG,
628 				    SPP_FMT "Cisco packet in PPP mode "
629 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
630 				    SPP_ARGS(ifp),
631 				    h->address, h->control, ntohs(h->protocol));
632 			goto drop;
633 		}
634 		switch (ntohs (h->protocol)) {
635 		default:
636 			++ifp->if_noproto;
637 			goto invalid;
638 		case CISCO_KEEPALIVE:
639 			sppp_cisco_input ((struct sppp*) ifp, m);
640 			m_freem (m);
641 			return;
642 #ifdef INET
643 		case ETHERTYPE_IP:
644 			schednetisr (NETISR_IP);
645 			inq = &ipintrq;
646 			break;
647 #endif
648 #ifdef INET6
649 		case ETHERTYPE_IPV6:
650 			schednetisr (NETISR_IPV6);
651 			inq = &ip6intrq;
652 			break;
653 #endif
654 		}
655 		break;
656 	default:        /* Invalid PPP packet. */
657 	  invalid:
658 		if (debug)
659 			log(LOG_DEBUG,
660 			    SPP_FMT "invalid input packet "
661 			    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
662 			    SPP_ARGS(ifp),
663 			    h->address, h->control, ntohs(h->protocol));
664 		goto drop;
665 	}
666 
667 	if (! (ifp->if_flags & IFF_UP) || ! inq)
668 		goto drop;
669 
670 	/* Check queue. */
671 	s = splnet();
672 	if (IF_QFULL (inq)) {
673 		/* Queue overflow. */
674 		IF_DROP(inq);
675 		splx(s);
676 		if (debug)
677 			log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
678 				SPP_ARGS(ifp));
679 		if (!inq->ifq_congestion)
680 			if_congestion(inq);
681 		goto drop;
682 	}
683 	IF_ENQUEUE(inq, m);
684 	splx(s);
685 }
686 
687 /*
688  * Enqueue transmit packet.
689  */
690 HIDE int
691 sppp_output(struct ifnet *ifp, struct mbuf *m,
692 	    struct sockaddr *dst, struct rtentry *rt)
693 {
694 	struct sppp *sp = (struct sppp*) ifp;
695 	struct ppp_header *h;
696 	struct ifqueue *ifq = NULL;
697 	struct timeval tv;
698 	int s, len, rv = 0;
699 	u_int16_t protocol;
700 
701 #ifdef DIAGNOSTIC
702 	if (ifp->if_rdomain != rtable_l2(m->m_pkthdr.rdomain)) {
703 		printf("%s: trying to send packet on wrong domain. "
704 		    "if %d vs. mbuf %d, AF %d\n", ifp->if_xname,
705 		    ifp->if_rdomain, rtable_l2(m->m_pkthdr.rdomain),
706 		    dst->sa_family);
707 	}
708 #endif
709 
710 	s = splnet();
711 
712 	getmicrouptime(&tv);
713 	sp->pp_last_activity = tv.tv_sec;
714 
715 	if ((ifp->if_flags & IFF_UP) == 0 ||
716 	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
717 		m_freem (m);
718 		splx (s);
719 		return (ENETDOWN);
720 	}
721 
722 	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
723 		/*
724 		 * Interface is not yet running, but auto-dial.  Need
725 		 * to start LCP for it.
726 		 */
727 		ifp->if_flags |= IFF_RUNNING;
728 		splx(s);
729 		lcp.Open(sp);
730 		s = splnet();
731 	}
732 
733 #ifdef INET
734 	/*
735 	 * Put low delay, telnet, rlogin and ftp control packets
736 	 * in front of the queue.
737 	 */
738 	if (dst->sa_family == AF_INET) {
739 		struct ip *ip = NULL;
740 		struct tcphdr *th = NULL;
741 
742 		if (m->m_len >= sizeof(struct ip)) {
743 			ip = mtod(m, struct ip *);
744 			if (ip->ip_p == IPPROTO_TCP &&
745 			    m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
746 			    sizeof(struct tcphdr)) {
747 				th = (struct tcphdr *)
748 				    ((caddr_t)ip + (ip->ip_hl << 2));
749 			}
750 		}
751 		/*
752 		 * When using dynamic local IP address assignment by using
753 		 * 0.0.0.0 as a local address, the first TCP session will
754 		 * not connect because the local TCP checksum is computed
755 		 * using 0.0.0.0 which will later become our real IP address
756 		 * so the TCP checksum computed at the remote end will
757 		 * become invalid. So we
758 		 * - don't let packets with src ip addr 0 thru
759 		 * - we flag TCP packets with src ip 0 as an error
760 		 */
761 
762 		if(ip && ip->ip_src.s_addr == INADDR_ANY) {
763 			u_int8_t proto = ip->ip_p;
764 
765 			m_freem(m);
766 			splx(s);
767 			if(proto == IPPROTO_TCP)
768 				return (EADDRNOTAVAIL);
769 			else
770 				return (0);
771 		}
772 
773 		if (!IF_QFULL(&sp->pp_fastq) &&
774 		    ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
775 	    	      (th && (INTERACTIVE(ntohs(th->th_sport)) ||
776 	    	       INTERACTIVE(ntohs(th->th_dport))))))
777 			ifq = &sp->pp_fastq;
778 	}
779 #endif
780 
781 	if (sp->pp_flags & PP_NOFRAMING)
782 		goto skip_header;
783 	/*
784 	 * Prepend general data packet PPP header. For now, IP only.
785 	 */
786 	M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
787 	if (!m) {
788 		if (ifp->if_flags & IFF_DEBUG)
789 			log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
790 				SPP_ARGS(ifp));
791 		++ifp->if_oerrors;
792 		splx (s);
793 		return (ENOBUFS);
794 	}
795 	/*
796 	 * May want to check size of packet
797 	 * (albeit due to the implementation it's always enough)
798 	 */
799 	h = mtod (m, struct ppp_header*);
800 	if (sp->pp_flags & PP_CISCO) {
801 		h->address = CISCO_UNICAST;        /* unicast address */
802 		h->control = 0;
803 	} else {
804 		h->address = PPP_ALLSTATIONS;        /* broadcast address */
805 		h->control = PPP_UI;                 /* Unnumbered Info */
806 	}
807 
808  skip_header:
809 	switch (dst->sa_family) {
810 #ifdef INET
811 	case AF_INET:   /* Internet Protocol */
812 		if (sp->pp_flags & PP_CISCO)
813 			protocol = htons (ETHERTYPE_IP);
814 		else {
815 			/*
816 			 * Don't choke with an ENETDOWN early.  It's
817 			 * possible that we just started dialing out,
818 			 * so don't drop the packet immediately.  If
819 			 * we notice that we run out of buffer space
820 			 * below, we will however remember that we are
821 			 * not ready to carry IP packets, and return
822 			 * ENETDOWN, as opposed to ENOBUFS.
823 			 */
824 			protocol = htons(PPP_IP);
825 			if (sp->state[IDX_IPCP] != STATE_OPENED)
826 				rv = ENETDOWN;
827 		}
828 		break;
829 #endif
830 #ifdef INET6
831 	case AF_INET6:   /* Internet Protocol v6 */
832 		if (sp->pp_flags & PP_CISCO)
833 			protocol = htons (ETHERTYPE_IPV6);
834 		else {
835 			/*
836 			 * Don't choke with an ENETDOWN early.  It's
837 			 * possible that we just started dialing out,
838 			 * so don't drop the packet immediately.  If
839 			 * we notice that we run out of buffer space
840 			 * below, we will however remember that we are
841 			 * not ready to carry IPv6 packets, and return
842 			 * ENETDOWN, as opposed to ENOBUFS.
843 			 */
844 			protocol = htons(PPP_IPV6);
845 			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
846 				rv = ENETDOWN;
847 		}
848 		break;
849 #endif
850 	default:
851 		m_freem(m);
852 		++ifp->if_oerrors;
853 		splx(s);
854 		return (EAFNOSUPPORT);
855 	}
856 
857 	if (sp->pp_flags & PP_NOFRAMING) {
858 		M_PREPEND(m, 2, M_DONTWAIT);
859 		if (m == NULL) {
860 			if (ifp->if_flags & IFF_DEBUG)
861 				log(LOG_DEBUG, SPP_FMT
862 				    "no memory for transmit header\n",
863 				    SPP_ARGS(ifp));
864 			++ifp->if_oerrors;
865 			splx(s);
866 			return (ENOBUFS);
867 		}
868 		*mtod(m, u_int16_t *) = protocol;
869 	} else
870 		h->protocol = protocol;
871 
872 	/*
873 	 * Queue message on interface, and start output if interface
874 	 * not yet active.
875 	 */
876 	len = m->m_pkthdr.len;
877 	if (ifq != NULL
878 #ifdef ALTQ
879 	    && ALTQ_IS_ENABLED(&ifp->if_snd) == 0
880 #endif
881 		) {
882 		if (IF_QFULL (ifq)) {
883 			IF_DROP (&ifp->if_snd);
884 			m_freem (m);
885 			if (rv == 0)
886 				rv = ENOBUFS;
887 		} else
888 			IF_ENQUEUE (ifq, m);
889 	} else
890 		IFQ_ENQUEUE(&ifp->if_snd, m, NULL, rv);
891 
892 	if (rv != 0) {
893 		++ifp->if_oerrors;
894 		splx (s);
895 		return (rv);
896 	}
897 
898 	if (!(ifp->if_flags & IFF_OACTIVE))
899 		(*ifp->if_start) (ifp);
900 
901 	/*
902 	 * Count output packets and bytes.
903 	 * The packet length includes header, FCS and 1 flag,
904 	 * according to RFC 1333.
905 	 */
906 	ifp->if_obytes += len + sp->pp_framebytes;
907 	splx (s);
908 	return (0);
909 }
910 
911 void
912 sppp_attach(struct ifnet *ifp)
913 {
914 	struct sppp *sp = (struct sppp*) ifp;
915 	int i;
916 
917 	/* Initialize keepalive handler. */
918 	if (! spppq) {
919 #if defined (__FreeBSD__)
920 		keepalive_ch = timeout(sppp_keepalive, 0, hz * 10);
921 #elif defined(__OpenBSD__)
922 		timeout_set(&keepalive_ch, sppp_keepalive, NULL);
923 		timeout_add_sec(&keepalive_ch, 10);
924 #endif
925 	}
926 
927 	/* Insert new entry into the keepalive list. */
928 	sp->pp_next = spppq;
929 	spppq = sp;
930 
931 	sp->pp_if.if_type = IFT_PPP;
932 	sp->pp_if.if_output = sppp_output;
933 	IFQ_SET_MAXLEN(&sp->pp_if.if_snd, 50);
934 	sp->pp_fastq.ifq_maxlen = 50;
935 	sp->pp_cpq.ifq_maxlen = 50;
936 	sp->pp_loopcnt = 0;
937 	sp->pp_alivecnt = 0;
938 	sp->pp_last_activity = 0;
939 	sp->pp_last_receive = 0;
940 	sp->pp_seq = 0;
941 	sp->pp_rseq = 0;
942 	sp->pp_phase = PHASE_DEAD;
943 	sp->pp_up = lcp.Up;
944 	sp->pp_down = lcp.Down;
945 
946 
947 	for (i = 0; i < IDX_COUNT; i++)
948 		timeout_set(&sp->ch[i], (cps[i])->TO, (void *)sp);
949 	timeout_set(&sp->pap_my_to_ch, sppp_pap_my_TO, (void *)sp);
950 
951 	sppp_lcp_init(sp);
952 	sppp_ipcp_init(sp);
953 	sppp_ipv6cp_init(sp);
954 	sppp_pap_init(sp);
955 	sppp_chap_init(sp);
956 }
957 
958 void
959 sppp_detach(struct ifnet *ifp)
960 {
961 	struct sppp **q, *p, *sp = (struct sppp*) ifp;
962 	int i;
963 
964 	/* Remove the entry from the keepalive list. */
965 	for (q = &spppq; (p = *q); q = &p->pp_next)
966 		if (p == sp) {
967 			*q = p->pp_next;
968 			break;
969 		}
970 
971 	/* Stop keepalive handler. */
972 	if (! spppq)
973 		UNTIMEOUT(sppp_keepalive, 0, keepalive_ch);
974 
975 	for (i = 0; i < IDX_COUNT; i++)
976 		UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]);
977 	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
978 
979 	/* release authentication data */
980 	if (sp->myauth.name != NULL)
981 		free(sp->myauth.name, M_DEVBUF);
982 	if (sp->myauth.secret != NULL)
983 		free(sp->myauth.secret, M_DEVBUF);
984 	if (sp->hisauth.name != NULL)
985 		free(sp->hisauth.name, M_DEVBUF);
986 	if (sp->hisauth.secret != NULL)
987 		free(sp->hisauth.secret, M_DEVBUF);
988 }
989 
990 /*
991  * Flush the interface output queue.
992  */
993 void
994 sppp_flush(struct ifnet *ifp)
995 {
996 	struct sppp *sp = (struct sppp*) ifp;
997 
998 	IFQ_PURGE(&sp->pp_if.if_snd);
999 	sppp_qflush (&sp->pp_fastq);
1000 	sppp_qflush (&sp->pp_cpq);
1001 }
1002 
1003 /*
1004  * Check if the output queue is empty.
1005  */
1006 int
1007 sppp_isempty(struct ifnet *ifp)
1008 {
1009 	struct sppp *sp = (struct sppp*) ifp;
1010 	int empty, s;
1011 
1012 	s = splnet();
1013 	empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head &&
1014 		IFQ_IS_EMPTY(&sp->pp_if.if_snd);
1015 	splx(s);
1016 	return (empty);
1017 }
1018 
1019 /*
1020  * Get next packet to send.
1021  */
1022 struct mbuf *
1023 sppp_dequeue(struct ifnet *ifp)
1024 {
1025 	struct sppp *sp = (struct sppp*) ifp;
1026 	struct mbuf *m;
1027 	int s;
1028 
1029 	s = splnet();
1030 	/*
1031 	 * Process only the control protocol queue until we have at
1032 	 * least one NCP open.
1033 	 *
1034 	 * Do always serve all three queues in Cisco mode.
1035 	 */
1036 	IF_DEQUEUE(&sp->pp_cpq, m);
1037 	if (m == NULL &&
1038 	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
1039 		IF_DEQUEUE(&sp->pp_fastq, m);
1040 		if (m == NULL)
1041 			IFQ_DEQUEUE (&sp->pp_if.if_snd, m);
1042 	}
1043 	splx(s);
1044 	return m;
1045 }
1046 
1047 /*
1048  * Pick the next packet, do not remove it from the queue.
1049  */
1050 struct mbuf *
1051 sppp_pick(struct ifnet *ifp)
1052 {
1053 	struct sppp *sp = (struct sppp*)ifp;
1054 	struct mbuf *m;
1055 	int s;
1056 
1057 	s = splnet();
1058 	m = sp->pp_cpq.ifq_head;
1059 	if (m == NULL &&
1060 	    (sp->pp_phase == PHASE_NETWORK ||
1061 	     (sp->pp_flags & PP_CISCO) != 0))
1062 		if ((m = sp->pp_fastq.ifq_head) == NULL)
1063 			IFQ_POLL(&sp->pp_if.if_snd, m);
1064 	splx (s);
1065 	return (m);
1066 }
1067 
1068 /*
1069  * Process an ioctl request.  Called on low priority level.
1070  */
1071 int
1072 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1073 {
1074 	struct ifreq *ifr = (struct ifreq*) data;
1075 	struct sppp *sp = (struct sppp*) ifp;
1076 	int s, rv, going_up, going_down, newmode;
1077 
1078 	s = splnet();
1079 	rv = 0;
1080 	switch (cmd) {
1081 	case SIOCAIFADDR:
1082 	case SIOCSIFDSTADDR:
1083 		break;
1084 
1085 	case SIOCSIFADDR:
1086 		if_up(ifp);
1087 		/* FALLTHROUGH */
1088 
1089 	case SIOCSIFFLAGS:
1090 		going_up = (ifp->if_flags & IFF_UP) &&
1091 			(ifp->if_flags & IFF_RUNNING) == 0;
1092 		going_down = (ifp->if_flags & IFF_UP) == 0 &&
1093 			(ifp->if_flags & IFF_RUNNING);
1094 		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
1095 		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
1096 			/* sanity */
1097 			newmode = IFF_PASSIVE;
1098 			ifp->if_flags &= ~IFF_AUTO;
1099 		}
1100 
1101 		if (going_up || going_down)
1102 			if (!(sp->pp_flags & PP_CISCO))
1103 				lcp.Close(sp);
1104 
1105 		if (going_up && newmode == 0) {
1106 			/* neither auto-dial nor passive */
1107 			ifp->if_flags |= IFF_RUNNING;
1108 			if (!(sp->pp_flags & PP_CISCO))
1109 				lcp.Open(sp);
1110 		} else if (going_down) {
1111 			sppp_flush(ifp);
1112 			ifp->if_flags &= ~IFF_RUNNING;
1113 		}
1114 		break;
1115 
1116 #ifdef SIOCSIFMTU
1117 	case SIOCSIFMTU:
1118 		if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) {
1119 			splx(s);
1120 			return (EINVAL);
1121 		}
1122 		ifp->if_mtu = ifr->ifr_mtu;
1123 		break;
1124 #endif
1125 #ifdef SLIOCSETMTU
1126 	case SLIOCSETMTU:
1127 		if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) {
1128 			splx(s);
1129 			return (EINVAL);
1130 		}
1131 		ifp->if_mtu = *(short*)data;
1132 		break;
1133 #endif
1134 #ifdef SIOCGIFMTU
1135 	case SIOCGIFMTU:
1136 		ifr->ifr_mtu = ifp->if_mtu;
1137 		break;
1138 #endif
1139 #ifdef SLIOCGETMTU
1140 	case SLIOCGETMTU:
1141 		*(short*)data = ifp->if_mtu;
1142 		break;
1143 #endif
1144 	case SIOCADDMULTI:
1145 	case SIOCDELMULTI:
1146 		break;
1147 
1148 	case SIOCGIFGENERIC:
1149 		rv = sppp_get_params(sp, ifr);
1150 		break;
1151 
1152 	case SIOCSIFGENERIC:
1153 		rv = sppp_set_params(sp, ifr);
1154 		break;
1155 
1156 	default:
1157 		rv = ENOTTY;
1158 	}
1159 	splx(s);
1160 	return rv;
1161 }
1162 
1163 
1164 /*
1165  * Cisco framing implementation.
1166  */
1167 
1168 /*
1169  * Handle incoming Cisco keepalive protocol packets.
1170  */
1171 HIDE void
1172 sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1173 {
1174 	STDDCL;
1175 	struct cisco_packet *h;
1176 	u_int32_t me, mymask;
1177 
1178 	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1179 		if (debug)
1180 			log(LOG_DEBUG,
1181 			    SPP_FMT "cisco invalid packet length: %d bytes\n",
1182 			    SPP_ARGS(ifp), m->m_pkthdr.len);
1183 		return;
1184 	}
1185 	h = mtod (m, struct cisco_packet*);
1186 	if (debug)
1187 		log(LOG_DEBUG,
1188 		    SPP_FMT "cisco input: %d bytes "
1189 		    "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
1190 		    SPP_ARGS(ifp), m->m_pkthdr.len,
1191 		    ntohl(h->type), h->par1, h->par2, (u_int)h->rel,
1192 		    (u_int)h->time0, (u_int)h->time1);
1193 	switch (ntohl (h->type)) {
1194 	default:
1195 		if (debug)
1196 			addlog(SPP_FMT "cisco unknown packet type: 0x%x\n",
1197 			       SPP_ARGS(ifp), ntohl(h->type));
1198 		break;
1199 	case CISCO_ADDR_REPLY:
1200 		/* Reply on address request, ignore */
1201 		break;
1202 	case CISCO_KEEPALIVE_REQ:
1203 		sp->pp_alivecnt = 0;
1204 		sp->pp_rseq = ntohl (h->par1);
1205 		if (sp->pp_seq == sp->pp_rseq) {
1206 			/* Local and remote sequence numbers are equal.
1207 			 * Probably, the line is in loopback mode. */
1208 			if (sp->pp_loopcnt >= LOOPALIVECNT) {
1209 				log(LOG_INFO, SPP_FMT "loopback\n",
1210 					SPP_ARGS(ifp));
1211 				sp->pp_loopcnt = 0;
1212 				if (ifp->if_flags & IFF_UP) {
1213 					if_down (ifp);
1214 					sppp_qflush (&sp->pp_cpq);
1215 				}
1216 			}
1217 			++sp->pp_loopcnt;
1218 
1219 			/* Generate new local sequence number */
1220 #if defined (__FreeBSD__) || defined (__NetBSD__) || defined(__OpenBSD__)
1221 			sp->pp_seq = arc4random();
1222 #else
1223 			sp->pp_seq ^= time.tv_sec ^ time.tv_usec;
1224 #endif
1225 			break;
1226 		}
1227 		sp->pp_loopcnt = 0;
1228 		if (! (ifp->if_flags & IFF_UP) &&
1229 		    (ifp->if_flags & IFF_RUNNING)) {
1230 			if_up(ifp);
1231 			if (debug)
1232 				log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp));
1233 		}
1234 		break;
1235 	case CISCO_ADDR_REQ:
1236 		sppp_get_ip_addrs(sp, &me, 0, &mymask);
1237 		if (me != 0)
1238 			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1239 		break;
1240 	}
1241 }
1242 
1243 /*
1244  * Send Cisco keepalive packet.
1245  */
1246 HIDE void
1247 sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2)
1248 {
1249 	STDDCL;
1250 	struct ppp_header *h;
1251 	struct cisco_packet *ch;
1252 	struct mbuf *m;
1253 	struct timeval tv;
1254 
1255 	getmicrouptime(&tv);
1256 
1257 	MGETHDR (m, M_DONTWAIT, MT_DATA);
1258 	if (! m)
1259 		return;
1260 	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1261 	m->m_pkthdr.rcvif = 0;
1262 
1263 	h = mtod (m, struct ppp_header*);
1264 	h->address = CISCO_MULTICAST;
1265 	h->control = 0;
1266 	h->protocol = htons (CISCO_KEEPALIVE);
1267 
1268 	ch = (struct cisco_packet*) (h + 1);
1269 	ch->type = htonl (type);
1270 	ch->par1 = htonl (par1);
1271 	ch->par2 = htonl (par2);
1272 	ch->rel = -1;
1273 
1274 	ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
1275 	ch->time1 = htons ((u_short) tv.tv_sec);
1276 
1277 	if (debug)
1278 		log(LOG_DEBUG, SPP_FMT
1279 		    "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1280 			SPP_ARGS(ifp), ntohl(ch->type), ch->par1, ch->par2,
1281 			(u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
1282 
1283 	if (IF_QFULL (&sp->pp_cpq)) {
1284 		IF_DROP (&sp->pp_fastq);
1285 		IF_DROP (&ifp->if_snd);
1286 		m_freem (m);
1287 		m = NULL;
1288 	} else
1289 		IF_ENQUEUE (&sp->pp_cpq, m);
1290 	if (! (ifp->if_flags & IFF_OACTIVE))
1291 		(*ifp->if_start) (ifp);
1292 	if (m != NULL)
1293 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1294 }
1295 
1296 /*
1297  * PPP protocol implementation.
1298  */
1299 
1300 /*
1301  * Send PPP control protocol packet.
1302  */
1303 HIDE void
1304 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1305 	     u_char ident, u_short len, void *data)
1306 {
1307 	STDDCL;
1308 	struct ppp_header *h;
1309 	struct lcp_header *lh;
1310 	struct mbuf *m;
1311 	size_t pkthdrlen;
1312 
1313 	pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
1314 
1315 	if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
1316 		len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
1317 	MGETHDR (m, M_DONTWAIT, MT_DATA);
1318 	if (! m)
1319 		return;
1320 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
1321 	m->m_pkthdr.rcvif = 0;
1322 
1323 	if (sp->pp_flags & PP_NOFRAMING) {
1324 		*mtod(m, u_int16_t *) = htons(proto);
1325 		lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
1326 	} else {
1327 		h = mtod (m, struct ppp_header*);
1328 		h->address = PPP_ALLSTATIONS;	/* broadcast address */
1329 		h->control = PPP_UI;		/* Unnumbered Info */
1330 		h->protocol = htons (proto);	/* Link Control Protocol */
1331 		lh = (struct lcp_header*) (h + 1);
1332 	}
1333 	lh->type = type;
1334 	lh->ident = ident;
1335 	lh->len = htons (LCP_HEADER_LEN + len);
1336 	if (len)
1337 		bcopy (data, lh+1, len);
1338 
1339 	if (debug) {
1340 		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
1341 		    SPP_ARGS(ifp),
1342 		    sppp_proto_name(proto),
1343 		    sppp_cp_type_name (lh->type), lh->ident,
1344 		    ntohs (lh->len));
1345 		if (len)
1346 			sppp_print_bytes ((u_char*) (lh+1), len);
1347 		addlog(">\n");
1348 	}
1349 	if (IF_QFULL (&sp->pp_cpq)) {
1350 		IF_DROP (&sp->pp_fastq);
1351 		IF_DROP (&ifp->if_snd);
1352 		m_freem (m);
1353 		++ifp->if_oerrors;
1354 		m = NULL;
1355 	} else
1356 		IF_ENQUEUE (&sp->pp_cpq, m);
1357 	if (!(ifp->if_flags & IFF_OACTIVE))
1358 		(*ifp->if_start) (ifp);
1359 	if (m != NULL)
1360 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1361 }
1362 
1363 /*
1364  * Handle incoming PPP control protocol packets.
1365  */
1366 HIDE void
1367 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1368 {
1369 	STDDCL;
1370 	struct lcp_header *h;
1371 	int len = m->m_pkthdr.len;
1372 	int rv;
1373 	u_char *p;
1374 	u_long nmagic;
1375 
1376 	if (len < 4) {
1377 		if (debug)
1378 			log(LOG_DEBUG,
1379 			    SPP_FMT "%s invalid packet length: %d bytes\n",
1380 			    SPP_ARGS(ifp), cp->name, len);
1381 		return;
1382 	}
1383 	h = mtod (m, struct lcp_header*);
1384 	if (debug) {
1385 		log(LOG_DEBUG,
1386 		    SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
1387 		    SPP_ARGS(ifp), cp->name,
1388 		    sppp_state_name(sp->state[cp->protoidx]),
1389 		    sppp_cp_type_name (h->type), h->ident, ntohs (h->len));
1390 		if (len > 4)
1391 			sppp_print_bytes ((u_char*) (h+1), len-4);
1392 		addlog(">\n");
1393 	}
1394 	if (len > ntohs (h->len))
1395 		len = ntohs (h->len);
1396 	p = (u_char *)(h + 1);
1397 	switch (h->type) {
1398 	case CONF_REQ:
1399 		if (len < 4) {
1400 			if (debug)
1401 				addlog(SPP_FMT "%s invalid conf-req length %d\n",
1402 				       SPP_ARGS(ifp), cp->name,
1403 				       len);
1404 			++ifp->if_ierrors;
1405 			break;
1406 		}
1407 		/* handle states where RCR doesn't get a SCA/SCN */
1408 		switch (sp->state[cp->protoidx]) {
1409 		case STATE_CLOSING:
1410 		case STATE_STOPPING:
1411 			return;
1412 		case STATE_CLOSED:
1413 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1414 				     0, 0);
1415 			return;
1416 		}
1417 		rv = (cp->RCR)(sp, h, len);
1418 		/* silently drop illegal packets */
1419 		if (rv == -1)
1420 			return;
1421 		switch (sp->state[cp->protoidx]) {
1422 		case STATE_OPENED:
1423 			sppp_cp_change_state(cp, sp, rv?
1424 					     STATE_ACK_SENT: STATE_REQ_SENT);
1425 			(cp->tld)(sp);
1426 			(cp->scr)(sp);
1427 			break;
1428 		case STATE_ACK_SENT:
1429 		case STATE_REQ_SENT:
1430 			sppp_cp_change_state(cp, sp, rv?
1431 					     STATE_ACK_SENT: STATE_REQ_SENT);
1432 			break;
1433 		case STATE_STOPPED:
1434 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1435 			sppp_cp_change_state(cp, sp, rv?
1436 					     STATE_ACK_SENT: STATE_REQ_SENT);
1437 			(cp->scr)(sp);
1438 			break;
1439 		case STATE_ACK_RCVD:
1440 			if (rv) {
1441 				sppp_cp_change_state(cp, sp, STATE_OPENED);
1442 				if (debug)
1443 					log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1444 					    SPP_ARGS(ifp),
1445 					    cp->name);
1446 				(cp->tlu)(sp);
1447 			} else
1448 				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1449 			break;
1450 		default:
1451 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1452 			       SPP_ARGS(ifp), cp->name,
1453 			       sppp_cp_type_name(h->type),
1454 			       sppp_state_name(sp->state[cp->protoidx])); */
1455 			++ifp->if_ierrors;
1456 		}
1457 		break;
1458 	case CONF_ACK:
1459 		if (h->ident != sp->confid[cp->protoidx]) {
1460 			if (debug)
1461 				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1462 				       SPP_ARGS(ifp), cp->name,
1463 				       h->ident, sp->confid[cp->protoidx]);
1464 			++ifp->if_ierrors;
1465 			break;
1466 		}
1467 		switch (sp->state[cp->protoidx]) {
1468 		case STATE_CLOSED:
1469 		case STATE_STOPPED:
1470 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1471 			break;
1472 		case STATE_CLOSING:
1473 		case STATE_STOPPING:
1474 			break;
1475 		case STATE_REQ_SENT:
1476 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1477 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1478 			break;
1479 		case STATE_OPENED:
1480 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1481 			(cp->tld)(sp);
1482 			(cp->scr)(sp);
1483 			break;
1484 		case STATE_ACK_RCVD:
1485 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1486 			(cp->scr)(sp);
1487 			break;
1488 		case STATE_ACK_SENT:
1489 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1490 			sppp_cp_change_state(cp, sp, STATE_OPENED);
1491 			if (debug)
1492 				log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1493 				       SPP_ARGS(ifp), cp->name);
1494 			(cp->tlu)(sp);
1495 			break;
1496 		default:
1497 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1498 			       SPP_ARGS(ifp), cp->name,
1499 			       sppp_cp_type_name(h->type),
1500 			       sppp_state_name(sp->state[cp->protoidx])); */
1501 			++ifp->if_ierrors;
1502 		}
1503 		break;
1504 	case CONF_NAK:
1505 	case CONF_REJ:
1506 		if (h->ident != sp->confid[cp->protoidx]) {
1507 			if (debug)
1508 				addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1509 				       SPP_ARGS(ifp), cp->name,
1510 				       h->ident, sp->confid[cp->protoidx]);
1511 			++ifp->if_ierrors;
1512 			break;
1513 		}
1514 		if (h->type == CONF_NAK)
1515 			(cp->RCN_nak)(sp, h, len);
1516 		else /* CONF_REJ */
1517 			(cp->RCN_rej)(sp, h, len);
1518 
1519 		switch (sp->state[cp->protoidx]) {
1520 		case STATE_CLOSED:
1521 		case STATE_STOPPED:
1522 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1523 			break;
1524 		case STATE_REQ_SENT:
1525 		case STATE_ACK_SENT:
1526 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1527 			(cp->scr)(sp);
1528 			break;
1529 		case STATE_OPENED:
1530 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1531 			(cp->tld)(sp);
1532 			(cp->scr)(sp);
1533 			break;
1534 		case STATE_ACK_RCVD:
1535 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1536 			(cp->scr)(sp);
1537 			break;
1538 		case STATE_CLOSING:
1539 		case STATE_STOPPING:
1540 			break;
1541 		default:
1542 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1543 			       SPP_ARGS(ifp), cp->name,
1544 			       sppp_cp_type_name(h->type),
1545 			       sppp_state_name(sp->state[cp->protoidx])); */
1546 			++ifp->if_ierrors;
1547 		}
1548 		break;
1549 
1550 	case TERM_REQ:
1551 		switch (sp->state[cp->protoidx]) {
1552 		case STATE_ACK_RCVD:
1553 		case STATE_ACK_SENT:
1554 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1555 			/* FALLTHROUGH */
1556 		case STATE_CLOSED:
1557 		case STATE_STOPPED:
1558 		case STATE_CLOSING:
1559 		case STATE_STOPPING:
1560 		case STATE_REQ_SENT:
1561 		  sta:
1562 			/* Send Terminate-Ack packet. */
1563 			if (debug)
1564 				log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
1565 				    SPP_ARGS(ifp), cp->name);
1566 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1567 			break;
1568 		case STATE_OPENED:
1569 			sp->rst_counter[cp->protoidx] = 0;
1570 			sppp_cp_change_state(cp, sp, STATE_STOPPING);
1571 			(cp->tld)(sp);
1572 			goto sta;
1573 			break;
1574 		default:
1575 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1576 			       SPP_ARGS(ifp), cp->name,
1577 			       sppp_cp_type_name(h->type),
1578 			       sppp_state_name(sp->state[cp->protoidx])); */
1579 			++ifp->if_ierrors;
1580 		}
1581 		break;
1582 	case TERM_ACK:
1583 		switch (sp->state[cp->protoidx]) {
1584 		case STATE_CLOSED:
1585 		case STATE_STOPPED:
1586 		case STATE_REQ_SENT:
1587 		case STATE_ACK_SENT:
1588 			break;
1589 		case STATE_CLOSING:
1590 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1591 			(cp->tlf)(sp);
1592 			break;
1593 		case STATE_STOPPING:
1594 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1595 			(cp->tlf)(sp);
1596 			break;
1597 		case STATE_ACK_RCVD:
1598 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1599 			break;
1600 		case STATE_OPENED:
1601 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1602 			(cp->tld)(sp);
1603 			(cp->scr)(sp);
1604 			break;
1605 		default:
1606 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1607 			       SPP_ARGS(ifp), cp->name,
1608 			       sppp_cp_type_name(h->type),
1609 			       sppp_state_name(sp->state[cp->protoidx])); */
1610 			++ifp->if_ierrors;
1611 		}
1612 		break;
1613 	case CODE_REJ:
1614 	case PROTO_REJ:
1615 	    {
1616 		int catastrophic = 0;
1617 		const struct cp *upper = NULL;
1618 		int i;
1619 		u_int16_t proto;
1620 
1621 		if (len < 2) {
1622 			if (debug)
1623 				log(LOG_DEBUG, SPP_FMT "invalid proto-rej length\n",
1624 				       SPP_ARGS(ifp));
1625 			++ifp->if_ierrors;
1626 			break;
1627 		}
1628 
1629 		proto = ntohs(*((u_int16_t *)p));
1630 		for (i = 0; i < IDX_COUNT; i++) {
1631 			if (cps[i]->proto == proto) {
1632 				upper = cps[i];
1633 				break;
1634 			}
1635 		}
1636 		if (upper == NULL)
1637 			catastrophic++;
1638 
1639 		if (catastrophic || debug)
1640 			log(catastrophic? LOG_INFO: LOG_DEBUG,
1641 			    SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
1642 			    SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+',
1643 			    sppp_cp_type_name(h->type), proto,
1644 			    upper ? upper->name : "unknown",
1645 			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
1646 
1647 		/*
1648 		 * if we got RXJ+ against conf-req, the peer does not implement
1649 		 * this particular protocol type.  terminate the protocol.
1650 		 */
1651 		if (upper) {
1652 			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
1653 				upper->Close(sp);
1654 				break;
1655 			}
1656 		}
1657 
1658 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1659 		switch (sp->state[cp->protoidx]) {
1660 		case STATE_CLOSED:
1661 		case STATE_STOPPED:
1662 		case STATE_REQ_SENT:
1663 		case STATE_ACK_SENT:
1664 		case STATE_CLOSING:
1665 		case STATE_STOPPING:
1666 		case STATE_OPENED:
1667 			break;
1668 		case STATE_ACK_RCVD:
1669 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1670 			break;
1671 		default:
1672 			/* printf(SPP_FMT "%s illegal %s in state %s\n",
1673 			       SPP_ARGS(ifp), cp->name,
1674 			       sppp_cp_type_name(h->type),
1675 			       sppp_state_name(sp->state[cp->protoidx])); */
1676 			++ifp->if_ierrors;
1677 		}
1678 		break;
1679 	    }
1680 	case DISC_REQ:
1681 		if (cp->proto != PPP_LCP)
1682 			goto illegal;
1683 		/* Discard the packet. */
1684 		break;
1685 	case ECHO_REQ:
1686 		if (cp->proto != PPP_LCP)
1687 			goto illegal;
1688 		if (sp->state[cp->protoidx] != STATE_OPENED) {
1689 			if (debug)
1690 				addlog(SPP_FMT "lcp echo req but lcp closed\n",
1691 				       SPP_ARGS(ifp));
1692 			++ifp->if_ierrors;
1693 			break;
1694 		}
1695 		if (len < 8) {
1696 			if (debug)
1697 				addlog(SPP_FMT "invalid lcp echo request "
1698 				       "packet length: %d bytes\n",
1699 				       SPP_ARGS(ifp), len);
1700 			break;
1701 		}
1702 
1703 		nmagic = (u_long)p[0] << 24 |
1704 		    (u_long)p[1] << 16 | p[2] << 8 | p[3];
1705 
1706 		if (nmagic == sp->lcp.magic) {
1707 			/* Line loopback mode detected. */
1708 			log(LOG_INFO, SPP_FMT "loopback\n", SPP_ARGS(ifp));
1709 			/* Shut down the PPP link. */
1710  			lcp.Close(sp);
1711 			break;
1712 		}
1713 
1714 		p[0] = sp->lcp.magic >> 24;
1715 		p[1] = sp->lcp.magic >> 16;
1716 		p[2] = sp->lcp.magic >> 8;
1717 		p[3] = sp->lcp.magic;
1718 
1719 		if (debug)
1720 			addlog(SPP_FMT "got lcp echo req, sending echo rep\n",
1721 			       SPP_ARGS(ifp));
1722 		sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
1723 		break;
1724 	case ECHO_REPLY:
1725 		if (cp->proto != PPP_LCP)
1726 			goto illegal;
1727 		if (h->ident != sp->lcp.echoid) {
1728 			++ifp->if_ierrors;
1729 			break;
1730 		}
1731 		if (len < 8) {
1732 			if (debug)
1733 				addlog(SPP_FMT "lcp invalid echo reply "
1734 				       "packet length: %d bytes\n",
1735 				       SPP_ARGS(ifp), len);
1736 			break;
1737 		}
1738 		if (debug)
1739 			addlog(SPP_FMT "lcp got echo rep\n",
1740 			       SPP_ARGS(ifp));
1741 
1742 		nmagic = (u_long)p[0] << 24 |
1743 		    (u_long)p[1] << 16 | p[2] << 8 | p[3];
1744 
1745 		if (nmagic != sp->lcp.magic)
1746 			sp->pp_alivecnt = 0;
1747 		break;
1748 	default:
1749 		/* Unknown packet type -- send Code-Reject packet. */
1750 	  illegal:
1751 		if (debug)
1752 			addlog(SPP_FMT "%s send code-rej for 0x%x\n",
1753 			       SPP_ARGS(ifp), cp->name, h->type);
1754 		sppp_cp_send(sp, cp->proto, CODE_REJ, ++sp->pp_seq,
1755 			     m->m_pkthdr.len, h);
1756 		++ifp->if_ierrors;
1757 	}
1758 }
1759 
1760 
1761 /*
1762  * The generic part of all Up/Down/Open/Close/TO event handlers.
1763  * Basically, the state transition handling in the automaton.
1764  */
1765 HIDE void
1766 sppp_up_event(const struct cp *cp, struct sppp *sp)
1767 {
1768 	STDDCL;
1769 
1770 	if (debug)
1771 		log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
1772 		    SPP_ARGS(ifp), cp->name,
1773 		    sppp_state_name(sp->state[cp->protoidx]));
1774 
1775 	switch (sp->state[cp->protoidx]) {
1776 	case STATE_INITIAL:
1777 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1778 		break;
1779 	case STATE_STARTING:
1780 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1781 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1782 		(cp->scr)(sp);
1783 		break;
1784 	default:
1785 		/* printf(SPP_FMT "%s illegal up in state %s\n",
1786 		       SPP_ARGS(ifp), cp->name,
1787 		       sppp_state_name(sp->state[cp->protoidx])); */
1788 		break;
1789 	}
1790 }
1791 
1792 HIDE void
1793 sppp_down_event(const struct cp *cp, struct sppp *sp)
1794 {
1795 	STDDCL;
1796 
1797 	if (debug)
1798 		log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
1799 		    SPP_ARGS(ifp), cp->name,
1800 		    sppp_state_name(sp->state[cp->protoidx]));
1801 
1802 	switch (sp->state[cp->protoidx]) {
1803 	case STATE_CLOSED:
1804 	case STATE_CLOSING:
1805 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1806 		break;
1807 	case STATE_STOPPED:
1808 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1809 		(cp->tls)(sp);
1810 		break;
1811 	case STATE_STOPPING:
1812 	case STATE_REQ_SENT:
1813 	case STATE_ACK_RCVD:
1814 	case STATE_ACK_SENT:
1815 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1816 		break;
1817 	case STATE_OPENED:
1818 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1819 		(cp->tld)(sp);
1820 		break;
1821 	default:
1822 		/* printf(SPP_FMT "%s illegal down in state %s\n",
1823 		       SPP_ARGS(ifp), cp->name,
1824 		       sppp_state_name(sp->state[cp->protoidx])); */
1825 		break;
1826 	}
1827 }
1828 
1829 
1830 HIDE void
1831 sppp_open_event(const struct cp *cp, struct sppp *sp)
1832 {
1833 	STDDCL;
1834 
1835 	if (debug)
1836 		log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
1837 		    SPP_ARGS(ifp), cp->name,
1838 		    sppp_state_name(sp->state[cp->protoidx]));
1839 
1840 	switch (sp->state[cp->protoidx]) {
1841 	case STATE_INITIAL:
1842 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1843 		(cp->tls)(sp);
1844 		break;
1845 	case STATE_STARTING:
1846 		break;
1847 	case STATE_CLOSED:
1848 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1849 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1850 		(cp->scr)(sp);
1851 		break;
1852 	case STATE_STOPPED:
1853 	case STATE_STOPPING:
1854 	case STATE_REQ_SENT:
1855 	case STATE_ACK_RCVD:
1856 	case STATE_ACK_SENT:
1857 	case STATE_OPENED:
1858 		break;
1859 	case STATE_CLOSING:
1860 		sppp_cp_change_state(cp, sp, STATE_STOPPING);
1861 		break;
1862 	}
1863 }
1864 
1865 
1866 HIDE void
1867 sppp_close_event(const struct cp *cp, struct sppp *sp)
1868 {
1869 	STDDCL;
1870 
1871 	if (debug)
1872 		log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
1873 		    SPP_ARGS(ifp), cp->name,
1874 		    sppp_state_name(sp->state[cp->protoidx]));
1875 
1876 	switch (sp->state[cp->protoidx]) {
1877 	case STATE_INITIAL:
1878 	case STATE_CLOSED:
1879 	case STATE_CLOSING:
1880 		break;
1881 	case STATE_STARTING:
1882 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1883 		(cp->tlf)(sp);
1884 		break;
1885 	case STATE_STOPPED:
1886 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1887 		break;
1888 	case STATE_STOPPING:
1889 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1890 		break;
1891 	case STATE_OPENED:
1892 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1893 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1894 		sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
1895 		(cp->tld)(sp);
1896 		break;
1897 	case STATE_REQ_SENT:
1898 	case STATE_ACK_RCVD:
1899 	case STATE_ACK_SENT:
1900 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1901 		sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
1902 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
1903 		break;
1904 	}
1905 }
1906 
1907 HIDE void
1908 sppp_increasing_timeout (const struct cp *cp, struct sppp *sp)
1909 {
1910 	int timo;
1911 
1912 	timo = sp->lcp.max_configure - sp->rst_counter[cp->protoidx];
1913 	if (timo < 1)
1914 		timo = 1;
1915 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
1916 	sp->ch[cp->protoidx] =
1917 	    timeout(cp->TO, (void *)sp, timo * sp->lcp.timeout);
1918 #elif defined(__OpenBSD__)
1919 	timeout_add(&sp->ch[cp->protoidx], timo * sp->lcp.timeout);
1920 #endif
1921 }
1922 
1923 HIDE void
1924 sppp_to_event(const struct cp *cp, struct sppp *sp)
1925 {
1926 	STDDCL;
1927 	int s;
1928 
1929 	s = splnet();
1930 	if (debug)
1931 		log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
1932 		    SPP_ARGS(ifp), cp->name,
1933 		    sppp_state_name(sp->state[cp->protoidx]),
1934 		    sp->rst_counter[cp->protoidx]);
1935 
1936 	if (--sp->rst_counter[cp->protoidx] < 0)
1937 		/* TO- event */
1938 		switch (sp->state[cp->protoidx]) {
1939 		case STATE_CLOSING:
1940 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1941 			(cp->tlf)(sp);
1942 			break;
1943 		case STATE_STOPPING:
1944 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1945 			(cp->tlf)(sp);
1946 			break;
1947 		case STATE_REQ_SENT:
1948 		case STATE_ACK_RCVD:
1949 		case STATE_ACK_SENT:
1950 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1951 			(cp->tlf)(sp);
1952 			break;
1953 		}
1954 	else
1955 		/* TO+ event */
1956 		switch (sp->state[cp->protoidx]) {
1957 		case STATE_CLOSING:
1958 		case STATE_STOPPING:
1959 			sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq,
1960 				     0, 0);
1961   			sppp_increasing_timeout (cp, sp);
1962 			break;
1963 		case STATE_REQ_SENT:
1964 		case STATE_ACK_RCVD:
1965 			/* sppp_cp_change_state() will restart the timer */
1966 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1967 			(cp->scr)(sp);
1968 			break;
1969 		case STATE_ACK_SENT:
1970   			sppp_increasing_timeout (cp, sp);
1971 			(cp->scr)(sp);
1972 			break;
1973 		}
1974 
1975 	splx(s);
1976 }
1977 
1978 /*
1979  * Change the state of a control protocol in the state automaton.
1980  * Takes care of starting/stopping the restart timer.
1981  */
1982 void
1983 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
1984 {
1985 	STDDCL;
1986 
1987 	if (debug && sp->state[cp->protoidx] != newstate)
1988 		log(LOG_DEBUG, SPP_FMT "%s %s->%s\n",
1989 		    SPP_ARGS(ifp), cp->name,
1990 		    sppp_state_name(sp->state[cp->protoidx]),
1991 		    sppp_state_name(newstate));
1992 	sp->state[cp->protoidx] = newstate;
1993 
1994 	switch (newstate) {
1995 	case STATE_INITIAL:
1996 	case STATE_STARTING:
1997 	case STATE_CLOSED:
1998 	case STATE_STOPPED:
1999 	case STATE_OPENED:
2000 		UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]);
2001 		break;
2002 	case STATE_CLOSING:
2003 	case STATE_STOPPING:
2004 	case STATE_REQ_SENT:
2005 	case STATE_ACK_RCVD:
2006 	case STATE_ACK_SENT:
2007 		if (!timeout_pending(&sp->ch[cp->protoidx]))
2008 			sppp_increasing_timeout (cp, sp);
2009 		break;
2010 	}
2011 }
2012 /*
2013  *--------------------------------------------------------------------------*
2014  *                                                                          *
2015  *                         The LCP implementation.                          *
2016  *                                                                          *
2017  *--------------------------------------------------------------------------*
2018  */
2019 HIDE void
2020 sppp_lcp_init(struct sppp *sp)
2021 {
2022 	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2023 	sp->lcp.magic = 0;
2024 	sp->state[IDX_LCP] = STATE_INITIAL;
2025 	sp->fail_counter[IDX_LCP] = 0;
2026 	sp->lcp.protos = 0;
2027 	sp->lcp.mru = sp->lcp.their_mru = sp->pp_if.if_mtu;
2028 
2029 	/*
2030 	 * Initialize counters and timeout values.  Note that we don't
2031 	 * use the 3 seconds suggested in RFC 1661 since we are likely
2032 	 * running on a fast link.  XXX We should probably implement
2033 	 * the exponential backoff option.  Note that these values are
2034 	 * relevant for all control protocols, not just LCP only.
2035 	 */
2036 	sp->lcp.timeout = 1 * hz;
2037 	sp->lcp.max_terminate = 2;
2038 	sp->lcp.max_configure = 10;
2039 	sp->lcp.max_failure = 10;
2040 #if defined (__FreeBSD__)
2041 	callout_handle_init(&sp->ch[IDX_LCP]);
2042 #endif
2043 }
2044 
2045 HIDE void
2046 sppp_lcp_up(struct sppp *sp)
2047 {
2048 	STDDCL;
2049 	struct timeval tv;
2050 
2051 	if (sp->pp_flags & PP_CISCO) {
2052 		int s = splsoftnet();
2053 		sp->pp_if.if_link_state = LINK_STATE_UP;
2054 		if_link_state_change(&sp->pp_if);
2055 		splx(s);
2056 		return;
2057 	}
2058 
2059  	sp->pp_alivecnt = 0;
2060  	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2061  	sp->lcp.magic = 0;
2062  	sp->lcp.protos = 0;
2063  	sp->lcp.mru = sp->lcp.their_mru = sp->pp_if.if_mtu;
2064 
2065 	getmicrouptime(&tv);
2066 	sp->pp_last_receive = sp->pp_last_activity = tv.tv_sec;
2067 
2068 	/*
2069 	 * If this interface is passive or dial-on-demand, and we are
2070 	 * still in Initial state, it means we've got an incoming
2071 	 * call.  Activate the interface.
2072 	 */
2073 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
2074 		if (debug)
2075 			log(LOG_DEBUG,
2076 			    SPP_FMT "Up event", SPP_ARGS(ifp));
2077 		ifp->if_flags |= IFF_RUNNING;
2078 		if (sp->state[IDX_LCP] == STATE_INITIAL) {
2079 			if (debug)
2080 				addlog("(incoming call)\n");
2081 			sp->pp_flags |= PP_CALLIN;
2082 			lcp.Open(sp);
2083 		} else if (debug)
2084 			addlog("\n");
2085 	} else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
2086 		   (sp->state[IDX_LCP] == STATE_INITIAL)) {
2087 			ifp->if_flags |= IFF_RUNNING;
2088 			lcp.Open(sp);
2089 	}
2090 
2091 	sppp_up_event(&lcp, sp);
2092 }
2093 
2094 HIDE void
2095 sppp_lcp_down(struct sppp *sp)
2096 {
2097 	STDDCL;
2098 
2099 	if (sp->pp_flags & PP_CISCO) {
2100 		int s = splsoftnet();
2101 		sp->pp_if.if_link_state = LINK_STATE_DOWN;
2102 		if_link_state_change(&sp->pp_if);
2103 		splx(s);
2104 		return;
2105 	}
2106 
2107 	sppp_down_event(&lcp, sp);
2108 
2109 	/*
2110 	 * If this is neither a dial-on-demand nor a passive
2111 	 * interface, simulate an ``ifconfig down'' action, so the
2112 	 * administrator can force a redial by another ``ifconfig
2113 	 * up''.  XXX For leased line operation, should we immediately
2114 	 * try to reopen the connection here?
2115 	 */
2116 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
2117 		if (debug)
2118 			log(LOG_DEBUG, SPP_FMT "Down event (carrier loss), "
2119 			    "taking interface down.", SPP_ARGS(ifp));
2120 		if_down(ifp);
2121 	} else {
2122 		if (debug)
2123 			log(LOG_DEBUG, SPP_FMT "Down event (carrier loss)\n",
2124 			    SPP_ARGS(ifp));
2125 	}
2126 
2127 	if (sp->state[IDX_LCP] != STATE_INITIAL)
2128 		lcp.Close(sp);
2129  	sp->pp_flags &= ~PP_CALLIN;
2130 	ifp->if_flags &= ~IFF_RUNNING;
2131  	sppp_flush(ifp);
2132 }
2133 
2134 HIDE void
2135 sppp_lcp_open(struct sppp *sp)
2136 {
2137 	/*
2138 	 * If we are authenticator, negotiate LCP_AUTH
2139 	 */
2140 	if (sp->hisauth.proto != 0)
2141 		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
2142 	else
2143 		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2144 	sp->pp_flags &= ~PP_NEEDAUTH;
2145 	sppp_open_event(&lcp, sp);
2146 }
2147 
2148 HIDE void
2149 sppp_lcp_close(struct sppp *sp)
2150 {
2151 	sppp_close_event(&lcp, sp);
2152 }
2153 
2154 HIDE void
2155 sppp_lcp_TO(void *cookie)
2156 {
2157 	sppp_to_event(&lcp, (struct sppp *)cookie);
2158 }
2159 
2160 /*
2161  * Analyze a configure request.  Return true if it was agreeable, and
2162  * caused action sca, false if it has been rejected or nak'ed, and
2163  * caused action scn.  (The return value is used to make the state
2164  * transition decision in the state automaton.)
2165  */
2166 HIDE int
2167 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2168 {
2169 	STDDCL;
2170 	u_char *buf, *r, *p;
2171 	int origlen, rlen;
2172 	u_long nmagic;
2173 	u_short authproto;
2174 
2175 	len -= 4;
2176 	origlen = len;
2177 	buf = r = malloc (len, M_TEMP, M_NOWAIT);
2178 	if (! buf)
2179 		return (0);
2180 
2181 	if (debug)
2182 		log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
2183 		    SPP_ARGS(ifp));
2184 
2185 	/* pass 1: check for things that need to be rejected */
2186 	p = (void*) (h+1);
2187 	for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
2188 		if (p[1] < 2 || p[1] > len) {
2189 			free(buf, M_TEMP);
2190 			return (-1);
2191 		}
2192 		if (debug)
2193 			addlog("%s ", sppp_lcp_opt_name(*p));
2194 		switch (*p) {
2195 		case LCP_OPT_MAGIC:
2196 			/* Magic number. */
2197 			/* FALLTHROUGH, both are same length */
2198 		case LCP_OPT_ASYNC_MAP:
2199 			/* Async control character map. */
2200 			if (len >= 6 && p[1] == 6)
2201 				continue;
2202 			if (debug)
2203 				addlog("[invalid] ");
2204 			break;
2205 		case LCP_OPT_MRU:
2206 			/* Maximum receive unit. */
2207 			if (len >= 4 && p[1] == 4)
2208 				continue;
2209 			if (debug)
2210 				addlog("[invalid] ");
2211 			break;
2212 		case LCP_OPT_AUTH_PROTO:
2213 			if (len < 4) {
2214 				if (debug)
2215 					addlog("[invalid] ");
2216 				break;
2217 			}
2218 			authproto = (p[2] << 8) + p[3];
2219 			if (authproto == PPP_CHAP && p[1] != 5) {
2220 				if (debug)
2221 					addlog("[invalid chap len] ");
2222 				break;
2223 			}
2224 			if (sp->myauth.proto == 0) {
2225 				/* we are not configured to do auth */
2226 				if (debug)
2227 					addlog("[not configured] ");
2228 				break;
2229 			}
2230 			/*
2231 			 * Remote want us to authenticate, remember this,
2232 			 * so we stay in PHASE_AUTHENTICATE after LCP got
2233 			 * up.
2234 			 */
2235 			sp->pp_flags |= PP_NEEDAUTH;
2236 			continue;
2237 		default:
2238 			/* Others not supported. */
2239 			if (debug)
2240 				addlog("[rej] ");
2241 			break;
2242 		}
2243 		/* Add the option to rejected list. */
2244 		bcopy (p, r, p[1]);
2245 		r += p[1];
2246 		rlen += p[1];
2247 	}
2248 	if (rlen) {
2249 		if (debug)
2250 			addlog(" send conf-rej\n");
2251 		sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2252 		goto end;
2253 	} else if (debug)
2254 		addlog("\n");
2255 
2256 	/*
2257 	 * pass 2: check for option values that are unacceptable and
2258 	 * thus require to be nak'ed.
2259 	 */
2260 	if (debug)
2261 		log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
2262 		    SPP_ARGS(ifp));
2263 
2264 	p = (void*) (h+1);
2265 	len = origlen;
2266 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2267 		if (debug)
2268 			addlog("%s ", sppp_lcp_opt_name(*p));
2269 		switch (*p) {
2270 		case LCP_OPT_MAGIC:
2271 			/* Magic number -- extract. */
2272 			nmagic = (u_long)p[2] << 24 |
2273 				(u_long)p[3] << 16 | p[4] << 8 | p[5];
2274 			if (nmagic != sp->lcp.magic) {
2275 				if (debug)
2276 					addlog("0x%lx ", nmagic);
2277 				continue;
2278 			}
2279 			if (debug)
2280 				addlog("[glitch] ");
2281 			++sp->pp_loopcnt;
2282 			/*
2283 			 * We negate our magic here, and NAK it.  If
2284 			 * we see it later in an NAK packet, we
2285 			 * suggest a new one.
2286 			 */
2287 			nmagic = ~sp->lcp.magic;
2288 			/* Gonna NAK it. */
2289 			p[2] = nmagic >> 24;
2290 			p[3] = nmagic >> 16;
2291 			p[4] = nmagic >> 8;
2292 			p[5] = nmagic;
2293 			break;
2294 
2295 		case LCP_OPT_ASYNC_MAP:
2296 			/* Async control character map -- check to be zero. */
2297 			if (! p[2] && ! p[3] && ! p[4] && ! p[5]) {
2298 				if (debug)
2299 					addlog("[empty] ");
2300 				continue;
2301 			}
2302 			if (debug)
2303 				addlog("[non-empty] ");
2304 			/* suggest a zero one */
2305 			p[2] = p[3] = p[4] = p[5] = 0;
2306 			break;
2307 
2308 		case LCP_OPT_MRU:
2309 			/*
2310 			 * Maximum receive unit.  Always agreeable,
2311 			 * but ignored by now.
2312 			 */
2313 			sp->lcp.their_mru = p[2] * 256 + p[3];
2314 			if (debug)
2315 				addlog("%lu ", sp->lcp.their_mru);
2316 			continue;
2317 
2318 		case LCP_OPT_AUTH_PROTO:
2319 			authproto = (p[2] << 8) + p[3];
2320 			if (sp->myauth.proto != authproto) {
2321 				/* not agreed, nak */
2322 				if (debug)
2323 					addlog("[mine %s != his %s] ",
2324 					       sppp_proto_name(sp->hisauth.proto),
2325 					       sppp_proto_name(authproto));
2326 				p[2] = sp->myauth.proto >> 8;
2327 				p[3] = sp->myauth.proto;
2328 				break;
2329 			}
2330 			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2331 				if (debug)
2332 					addlog("[chap not MD5] ");
2333 				p[4] = CHAP_MD5;
2334 				break;
2335 			}
2336 			continue;
2337 		}
2338 		/* Add the option to nak'ed list. */
2339 		bcopy (p, r, p[1]);
2340 		r += p[1];
2341 		rlen += p[1];
2342 	}
2343 	if (rlen) {
2344 		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2345 			if (debug)
2346 				addlog(" max_failure (%d) exceeded, "
2347 				       "send conf-rej\n",
2348 				       sp->lcp.max_failure);
2349 			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2350 		} else {
2351 			if (debug)
2352 				addlog(" send conf-nak\n");
2353 			sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2354 		}
2355 		goto end;
2356 	} else {
2357 		if (debug)
2358 			addlog("send conf-ack\n");
2359 		sp->fail_counter[IDX_LCP] = 0;
2360 		sp->pp_loopcnt = 0;
2361 		sppp_cp_send (sp, PPP_LCP, CONF_ACK,
2362 			      h->ident, origlen, h+1);
2363 	}
2364 
2365  end:
2366 	free(buf, M_TEMP);
2367 	return (rlen == 0);
2368 }
2369 
2370 /*
2371  * Analyze the LCP Configure-Reject option list, and adjust our
2372  * negotiation.
2373  */
2374 HIDE void
2375 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2376 {
2377 	STDDCL;
2378 	u_char *p;
2379 
2380 	len -= 4;
2381 
2382 	if (debug)
2383 		log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
2384 		    SPP_ARGS(ifp));
2385 
2386 	p = (void*) (h+1);
2387 	for (; len > 1; len -= p[1], p += p[1]) {
2388 		if (p[1] < 2 || p[1] > len)
2389 			return;
2390 		if (debug)
2391 			addlog("%s ", sppp_lcp_opt_name(*p));
2392 		switch (*p) {
2393 		case LCP_OPT_MAGIC:
2394 			/* Magic number -- can't use it, use 0 */
2395 			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2396 			sp->lcp.magic = 0;
2397 			break;
2398 		case LCP_OPT_MRU:
2399 			/*
2400 			 * Should not be rejected anyway, since we only
2401 			 * negotiate a MRU if explicitly requested by
2402 			 * peer.
2403 			 */
2404 			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2405 			break;
2406 		case LCP_OPT_AUTH_PROTO:
2407 			/*
2408 			 * Peer doesn't want to authenticate himself,
2409 			 * deny unless this is a dialout call, and
2410 			 * AUTHFLAG_NOCALLOUT is set.
2411 			 */
2412 			if ((sp->pp_flags & PP_CALLIN) == 0 &&
2413 			    (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
2414 				if (debug)
2415 					addlog("[don't insist on auth "
2416 					       "for callout]");
2417 				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2418 				break;
2419 			}
2420 			if (debug)
2421 				addlog("[access denied]\n");
2422 			lcp.Close(sp);
2423 			break;
2424 		}
2425 	}
2426 	if (debug)
2427 		addlog("\n");
2428 }
2429 
2430 /*
2431  * Analyze the LCP Configure-NAK option list, and adjust our
2432  * negotiation.
2433  */
2434 HIDE void
2435 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2436 {
2437 	STDDCL;
2438 	u_char *p;
2439 	u_long magic;
2440 
2441 	len -= 4;
2442 
2443 	if (debug)
2444 		log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
2445 		    SPP_ARGS(ifp));
2446 
2447 	p = (void*) (h+1);
2448 	for (; len > 1; len -= p[1], p += p[1]) {
2449 		if (p[1] < 2 || p[1] > len)
2450 			return;
2451 		if (debug)
2452 			addlog("%s ", sppp_lcp_opt_name(*p));
2453 		switch (*p) {
2454 		case LCP_OPT_MAGIC:
2455 			/* Magic number -- renegotiate */
2456 			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2457 			    len >= 6 && p[1] == 6) {
2458 				magic = (u_long)p[2] << 24 |
2459 					(u_long)p[3] << 16 | p[4] << 8 | p[5];
2460 				/*
2461 				 * If the remote magic is our negated one,
2462 				 * this looks like a loopback problem.
2463 				 * Suggest a new magic to make sure.
2464 				 */
2465 				if (magic == ~sp->lcp.magic) {
2466 					if (debug)
2467 						addlog("magic glitch ");
2468 					sp->lcp.magic = arc4random();
2469 				} else {
2470 					sp->lcp.magic = magic;
2471 					if (debug)
2472 						addlog("%lu ", magic);
2473 				}
2474 			}
2475 			break;
2476 		case LCP_OPT_MRU:
2477 			/*
2478 			 * Peer wants to advise us to negotiate an MRU.
2479 			 * Agree on it if it's reasonable, or use
2480 			 * default otherwise.
2481 			 */
2482 			if (len >= 4 && p[1] == 4) {
2483 				u_int mru = p[2] * 256 + p[3];
2484 				if (debug)
2485 					addlog("%d ", mru);
2486 				if (mru < PP_MIN_MRU)
2487 					mru = PP_MIN_MRU;
2488 				if (mru > PP_MAX_MRU)
2489 					mru = PP_MAX_MRU;
2490 				sp->lcp.mru = mru;
2491 				sp->lcp.opts |= (1 << LCP_OPT_MRU);
2492 			}
2493 			break;
2494 		case LCP_OPT_AUTH_PROTO:
2495 			/*
2496 			 * Peer doesn't like our authentication method,
2497 			 * deny.
2498 			 */
2499 			if (debug)
2500 				addlog("[access denied]\n");
2501 			lcp.Close(sp);
2502 			break;
2503 		}
2504 	}
2505 	if (debug)
2506 		addlog("\n");
2507 }
2508 
2509 HIDE void
2510 sppp_lcp_tlu(struct sppp *sp)
2511 {
2512 	struct ifnet *ifp = &sp->pp_if;
2513 	int i;
2514 	u_long mask;
2515 
2516 	/* XXX ? */
2517 	if (! (ifp->if_flags & IFF_UP) &&
2518 	    (ifp->if_flags & IFF_RUNNING)) {
2519 		/* Coming out of loopback mode. */
2520 		if_up(ifp);
2521 		if (ifp->if_flags & IFF_DEBUG)
2522 			log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp));
2523 	}
2524 
2525 	for (i = 0; i < IDX_COUNT; i++)
2526 		if ((cps[i])->flags & CP_QUAL)
2527 			(cps[i])->Open(sp);
2528 
2529 	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2530 	    (sp->pp_flags & PP_NEEDAUTH) != 0)
2531 		sp->pp_phase = PHASE_AUTHENTICATE;
2532 	else
2533 		sp->pp_phase = PHASE_NETWORK;
2534 
2535 	sppp_set_phase(sp);
2536 
2537 	/*
2538 	 * Open all authentication protocols.  This is even required
2539 	 * if we already proceeded to network phase, since it might be
2540 	 * that remote wants us to authenticate, so we might have to
2541 	 * send a PAP request.  Undesired authentication protocols
2542 	 * don't do anything when they get an Open event.
2543 	 */
2544 	for (i = 0; i < IDX_COUNT; i++)
2545 		if ((cps[i])->flags & CP_AUTH)
2546 			(cps[i])->Open(sp);
2547 
2548 	if (sp->pp_phase == PHASE_NETWORK) {
2549 		/* Notify all NCPs. */
2550 		for (i = 0; i < IDX_COUNT; i++)
2551 			if ((cps[i])->flags & CP_NCP)
2552 				(cps[i])->Open(sp);
2553 	}
2554 
2555 	/* Send Up events to all started protos. */
2556 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2557 		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0)
2558 			(cps[i])->Up(sp);
2559 
2560 	/* notify low-level driver of state change */
2561 	if (sp->pp_chg)
2562 		sp->pp_chg(sp, (int)sp->pp_phase);
2563 
2564 	if (sp->pp_phase == PHASE_NETWORK)
2565 		/* if no NCP is starting, close down */
2566 		sppp_lcp_check_and_close(sp);
2567 }
2568 
2569 HIDE void
2570 sppp_lcp_tld(struct sppp *sp)
2571 {
2572 	int i;
2573 	u_long mask;
2574 
2575 	sp->pp_phase = PHASE_TERMINATE;
2576 
2577 	sppp_set_phase(sp);
2578 
2579 	/*
2580 	 * Take upper layers down.  We send the Down event first and
2581 	 * the Close second to prevent the upper layers from sending
2582 	 * ``a flurry of terminate-request packets'', as the RFC
2583 	 * describes it.
2584 	 */
2585 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2586 		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) {
2587 			(cps[i])->Down(sp);
2588 			(cps[i])->Close(sp);
2589 		}
2590 }
2591 
2592 HIDE void
2593 sppp_lcp_tls(struct sppp *sp)
2594 {
2595 	sp->pp_phase = PHASE_ESTABLISH;
2596 
2597 	sppp_set_phase(sp);
2598 
2599 	/* Notify lower layer if desired. */
2600 	if (sp->pp_tls)
2601 		(sp->pp_tls)(sp);
2602 }
2603 
2604 HIDE void
2605 sppp_lcp_tlf(struct sppp *sp)
2606 {
2607 	sp->pp_phase = PHASE_DEAD;
2608 	sppp_set_phase(sp);
2609 
2610 	/* Notify lower layer if desired. */
2611 	if (sp->pp_tlf)
2612 		(sp->pp_tlf)(sp);
2613 }
2614 
2615 HIDE void
2616 sppp_lcp_scr(struct sppp *sp)
2617 {
2618 	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2619 	int i = 0;
2620 	u_short authproto;
2621 
2622 	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2623 		if (! sp->lcp.magic)
2624 #if defined (__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
2625 			sp->lcp.magic = arc4random();
2626 #else
2627 			sp->lcp.magic = time.tv_sec + time.tv_usec;
2628 #endif
2629 		opt[i++] = LCP_OPT_MAGIC;
2630 		opt[i++] = 6;
2631 		opt[i++] = sp->lcp.magic >> 24;
2632 		opt[i++] = sp->lcp.magic >> 16;
2633 		opt[i++] = sp->lcp.magic >> 8;
2634 		opt[i++] = sp->lcp.magic;
2635 	}
2636 
2637 	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2638 		opt[i++] = LCP_OPT_MRU;
2639 		opt[i++] = 4;
2640 		opt[i++] = sp->lcp.mru >> 8;
2641 		opt[i++] = sp->lcp.mru;
2642 	}
2643 
2644 	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2645 		authproto = sp->hisauth.proto;
2646 		opt[i++] = LCP_OPT_AUTH_PROTO;
2647 		opt[i++] = authproto == PPP_CHAP? 5: 4;
2648 		opt[i++] = authproto >> 8;
2649 		opt[i++] = authproto;
2650 		if (authproto == PPP_CHAP)
2651 			opt[i++] = CHAP_MD5;
2652 	}
2653 
2654 	sp->confid[IDX_LCP] = ++sp->pp_seq;
2655 	sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, opt);
2656 }
2657 
2658 /*
2659  * Check the open NCPs, return true if at least one NCP is open.
2660  */
2661 HIDE int
2662 sppp_ncp_check(struct sppp *sp)
2663 {
2664 	int i, mask;
2665 
2666 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2667 		if (sp->lcp.protos & mask && (cps[i])->flags & CP_NCP)
2668 			return 1;
2669 	return 0;
2670 }
2671 
2672 /*
2673  * Re-check the open NCPs and see if we should terminate the link.
2674  * Called by the NCPs during their tlf action handling.
2675  */
2676 HIDE void
2677 sppp_lcp_check_and_close(struct sppp *sp)
2678 {
2679 
2680 	if (sp->pp_phase < PHASE_NETWORK)
2681 		/* don't bother, we are already going down */
2682 		return;
2683 
2684 	if (sppp_ncp_check(sp))
2685 		return;
2686 
2687 	lcp.Close(sp);
2688 }
2689 /*
2690  *--------------------------------------------------------------------------*
2691  *                                                                          *
2692  *                        The IPCP implementation.                          *
2693  *                                                                          *
2694  *--------------------------------------------------------------------------*
2695  */
2696 
2697 HIDE void
2698 sppp_ipcp_init(struct sppp *sp)
2699 {
2700 	sp->ipcp.opts = 0;
2701 	sp->ipcp.flags = 0;
2702 	sp->state[IDX_IPCP] = STATE_INITIAL;
2703 	sp->fail_counter[IDX_IPCP] = 0;
2704 #if defined (__FreeBSD__)
2705 	callout_handle_init(&sp->ch[IDX_IPCP]);
2706 #endif
2707 }
2708 
2709 HIDE void
2710 sppp_ipcp_up(struct sppp *sp)
2711 {
2712 	sppp_up_event(&ipcp, sp);
2713 }
2714 
2715 HIDE void
2716 sppp_ipcp_down(struct sppp *sp)
2717 {
2718 	sppp_down_event(&ipcp, sp);
2719 }
2720 
2721 HIDE void
2722 sppp_ipcp_open(struct sppp *sp)
2723 {
2724 	sppp_open_event(&ipcp, sp);
2725 }
2726 
2727 HIDE void
2728 sppp_ipcp_close(struct sppp *sp)
2729 {
2730 	sppp_close_event(&ipcp, sp);
2731 }
2732 
2733 HIDE void
2734 sppp_ipcp_TO(void *cookie)
2735 {
2736 	sppp_to_event(&ipcp, (struct sppp *)cookie);
2737 }
2738 
2739 /*
2740  * Analyze a configure request.  Return true if it was agreeable, and
2741  * caused action sca, false if it has been rejected or nak'ed, and
2742  * caused action scn.  (The return value is used to make the state
2743  * transition decision in the state automaton.)
2744  */
2745 HIDE int
2746 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2747 {
2748 	u_char *buf, *r, *p;
2749 	struct ifnet *ifp = &sp->pp_if;
2750 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
2751 	u_int32_t hisaddr, desiredaddr;
2752 
2753 	len -= 4;
2754 	origlen = len;
2755 	/*
2756 	 * Make sure to allocate a buf that can at least hold a
2757 	 * conf-nak with an `address' option.  We might need it below.
2758 	 */
2759 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
2760 	if (! buf)
2761 		return (0);
2762 
2763 	/* pass 1: see if we can recognize them */
2764 	if (debug)
2765 		log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
2766 		    SPP_ARGS(ifp));
2767 	p = (void*) (h+1);
2768 	for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
2769 		if (p[1] < 2 || p[1] > len) {
2770 			free(buf, M_TEMP);
2771 			return (-1);
2772 		}
2773 		if (debug)
2774 			addlog("%s ", sppp_ipcp_opt_name(*p));
2775 		switch (*p) {
2776 #ifdef notyet
2777 		case IPCP_OPT_COMPRESSION:
2778 			if (len >= 6 && p[1] >= 6) {
2779 				/* correctly formed compress option */
2780 				continue;
2781 			}
2782 			if (debug)
2783 				addlog("[invalid] ");
2784 			break;
2785 #endif
2786 		case IPCP_OPT_ADDRESS:
2787 			if (len >= 6 && p[1] == 6) {
2788 				/* correctly formed address option */
2789 				continue;
2790 			}
2791 			if (debug)
2792 				addlog("[invalid] ");
2793 			break;
2794 		default:
2795 			/* Others not supported. */
2796 			if (debug)
2797 				addlog("[rej] ");
2798 			break;
2799 		}
2800 		/* Add the option to rejected list. */
2801 		bcopy (p, r, p[1]);
2802 		r += p[1];
2803 		rlen += p[1];
2804 	}
2805 	if (rlen) {
2806 		if (debug)
2807 			addlog(" send conf-rej\n");
2808 		sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
2809 		goto end;
2810 	} else if (debug)
2811 		addlog("\n");
2812 
2813 	/* pass 2: parse option values */
2814 	if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
2815 		hisaddr = sp->ipcp.req_hisaddr; /* we already agreed on that */
2816 	else
2817 		sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */
2818 	if (debug)
2819 		log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
2820 		       SPP_ARGS(ifp));
2821 	p = (void*) (h+1);
2822 	len = origlen;
2823 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2824 		if (debug)
2825 			addlog(" %s ", sppp_ipcp_opt_name(*p));
2826 		switch (*p) {
2827 #ifdef notyet
2828 		case IPCP_OPT_COMPRESSION:
2829 			continue;
2830 #endif
2831 		case IPCP_OPT_ADDRESS:
2832 			desiredaddr = p[2] << 24 | p[3] << 16 |
2833 				p[4] << 8 | p[5];
2834 			if (desiredaddr == hisaddr ||
2835 			    ((sp->ipcp.flags & IPCP_HISADDR_DYN) &&
2836 			    desiredaddr != 0)) {
2837 				/*
2838 				 * Peer's address is same as our value,
2839 				 * or we have set it to 0.0.0.1 to
2840 				 * indicate that we do not really care,
2841 				 * this is agreeable.  Gonna conf-ack
2842 				 * it.
2843 				 */
2844 				if (debug)
2845 					addlog("%s [ack] ",
2846 					       sppp_dotted_quad(desiredaddr));
2847 				/* record that we've seen it already */
2848 				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
2849 				sp->ipcp.req_hisaddr = desiredaddr;
2850 				hisaddr = desiredaddr;
2851 				continue;
2852 			}
2853 			/*
2854 			 * The address wasn't agreeable.  This is either
2855 			 * he sent us 0.0.0.0, asking to assign him an
2856 			 * address, or he send us another address not
2857 			 * matching our value.  Either case, we gonna
2858 			 * conf-nak it with our value.
2859 			 */
2860 			if (debug) {
2861 				if (desiredaddr == 0)
2862 					addlog("[addr requested] ");
2863 				else
2864 					addlog("%s [not agreed] ",
2865 					       sppp_dotted_quad(desiredaddr));
2866 			}
2867 
2868 			p[2] = hisaddr >> 24;
2869 			p[3] = hisaddr >> 16;
2870 			p[4] = hisaddr >> 8;
2871 			p[5] = hisaddr;
2872 			break;
2873 		}
2874 		/* Add the option to nak'ed list. */
2875 		bcopy (p, r, p[1]);
2876 		r += p[1];
2877 		rlen += p[1];
2878 	}
2879 
2880 	/*
2881 	 * If we are about to conf-ack the request, but haven't seen
2882 	 * his address so far, gonna conf-nak it instead, with the
2883 	 * `address' option present and our idea of his address being
2884 	 * filled in there, to request negotiation of both addresses.
2885 	 *
2886 	 * XXX This can result in an endless req - nak loop if peer
2887 	 * doesn't want to send us his address.  Q: What should we do
2888 	 * about it?  XXX  A: implement the max-failure counter.
2889 	 */
2890 	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
2891 		buf[0] = IPCP_OPT_ADDRESS;
2892 		buf[1] = 6;
2893 		buf[2] = hisaddr >> 24;
2894 		buf[3] = hisaddr >> 16;
2895 		buf[4] = hisaddr >> 8;
2896 		buf[5] = hisaddr;
2897 		rlen = 6;
2898 		if (debug)
2899 			addlog("still need hisaddr ");
2900 	}
2901 
2902 	if (rlen) {
2903 		if (debug)
2904 			addlog(" send conf-nak\n");
2905 		sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
2906 	} else {
2907 		if (debug)
2908 			addlog(" send conf-ack\n");
2909 		sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
2910 			      h->ident, origlen, h+1);
2911 	}
2912 
2913  end:
2914 	free(buf, M_TEMP);
2915 	return (rlen == 0);
2916 }
2917 
2918 /*
2919  * Analyze the IPCP Configure-Reject option list, and adjust our
2920  * negotiation.
2921  */
2922 HIDE void
2923 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2924 {
2925 	u_char *p;
2926 	struct ifnet *ifp = &sp->pp_if;
2927 	int debug = ifp->if_flags & IFF_DEBUG;
2928 
2929 	len -= 4;
2930 
2931 	if (debug)
2932 		log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
2933 		    SPP_ARGS(ifp));
2934 
2935 	p = (void*) (h+1);
2936 	for (; len > 1; len -= p[1], p += p[1]) {
2937 		if (p[1] < 2 || p[1] > len)
2938 			return;
2939 		if (debug)
2940 			addlog("%s ", sppp_ipcp_opt_name(*p));
2941 		switch (*p) {
2942 		case IPCP_OPT_ADDRESS:
2943 			/*
2944 			 * Peer doesn't grok address option.  This is
2945 			 * bad.  XXX  Should we better give up here?
2946 			 */
2947 			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
2948 			break;
2949 #ifdef notyet
2950 		case IPCP_OPT_COMPRESS:
2951 			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
2952 			break;
2953 #endif
2954 		}
2955 	}
2956 	if (debug)
2957 		addlog("\n");
2958 }
2959 
2960 /*
2961  * Analyze the IPCP Configure-NAK option list, and adjust our
2962  * negotiation.
2963  */
2964 HIDE void
2965 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2966 {
2967 	u_char *p;
2968 	struct ifnet *ifp = &sp->pp_if;
2969 	int debug = ifp->if_flags & IFF_DEBUG;
2970 	u_int32_t wantaddr;
2971 
2972 	len -= 4;
2973 
2974 	if (debug)
2975 		log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
2976 		    SPP_ARGS(ifp));
2977 
2978 	p = (void*) (h+1);
2979 	for (; len > 1; len -= p[1], p += p[1]) {
2980 		if (p[1] < 2 || p[1] > len)
2981 			return;
2982 		if (debug)
2983 			addlog("%s ", sppp_ipcp_opt_name(*p));
2984 		switch (*p) {
2985 		case IPCP_OPT_ADDRESS:
2986 			/*
2987 			 * Peer doesn't like our local IP address.  See
2988 			 * if we can do something for him.  We'll drop
2989 			 * him our address then.
2990 			 */
2991 			if (len >= 6 && p[1] == 6) {
2992 				wantaddr = p[2] << 24 | p[3] << 16 |
2993 					p[4] << 8 | p[5];
2994 				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2995 				if (debug)
2996 					addlog("[wantaddr %s] ",
2997 					       sppp_dotted_quad(wantaddr));
2998 				/*
2999 				 * When doing dynamic address assignment,
3000 				 * we accept his offer.  Otherwise, we
3001 				 * ignore it and thus continue to negotiate
3002 				 * our already existing value.
3003 				 */
3004 				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
3005 					if (debug)
3006 						addlog("[agree] ");
3007 					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
3008 					sp->ipcp.req_myaddr = wantaddr;
3009 				}
3010 			}
3011 			break;
3012 #ifdef notyet
3013 		case IPCP_OPT_COMPRESS:
3014 			/*
3015 			 * Peer wants different compression parameters.
3016 			 */
3017 			break;
3018 #endif
3019 		}
3020 	}
3021 	if (debug)
3022 		addlog("\n");
3023 }
3024 
3025 HIDE void
3026 sppp_ipcp_tlu(struct sppp *sp)
3027 {
3028 	/* we are up. Set addresses and notify anyone interested */
3029 	u_int32_t myaddr, hisaddr;
3030 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
3031 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) &&
3032 	    (sp->ipcp.flags & IPCP_MYADDR_SEEN))
3033 		myaddr = sp->ipcp.req_myaddr;
3034 	if ((sp->ipcp.flags & IPCP_HISADDR_DYN) &&
3035 	    (sp->ipcp.flags & IPCP_HISADDR_SEEN))
3036 		hisaddr = sp->ipcp.req_hisaddr;
3037 	sppp_set_ip_addrs(sp, myaddr, hisaddr);
3038 }
3039 
3040 HIDE void
3041 sppp_ipcp_tld(struct sppp *sp)
3042 {
3043 }
3044 
3045 HIDE void
3046 sppp_ipcp_tls(struct sppp *sp)
3047 {
3048 	STDDCL;
3049 	u_int32_t myaddr, hisaddr;
3050 
3051 	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|
3052 	    IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
3053 	sp->ipcp.req_myaddr = 0;
3054 	sp->ipcp.req_hisaddr = 0;
3055 
3056 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
3057 	/*
3058 	 * If we don't have his address, this probably means our
3059 	 * interface doesn't want to talk IP at all.  (This could
3060 	 * be the case if somebody wants to speak only IPX, for
3061 	 * example.)  Don't open IPCP in this case.
3062 	 */
3063 	if (hisaddr == 0) {
3064 		/* XXX this message should go away */
3065 		if (debug)
3066 			log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
3067 			    SPP_ARGS(ifp));
3068 		return;
3069 	}
3070 
3071 	if (myaddr == 0) {
3072 		/*
3073 		 * I don't have an assigned address, so i need to
3074 		 * negotiate my address.
3075 		 */
3076 		sp->ipcp.flags |= IPCP_MYADDR_DYN;
3077 		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
3078 	}
3079 	if (hisaddr == 1) {
3080 		/*
3081 		 * XXX - remove this hack!
3082 		 * remote has no valid address, we need to get one assigned.
3083 		 */
3084 		sp->ipcp.flags |= IPCP_HISADDR_DYN;
3085 	}
3086 
3087 	/* indicate to LCP that it must stay alive */
3088 	sp->lcp.protos |= (1 << IDX_IPCP);
3089 }
3090 
3091 HIDE void
3092 sppp_ipcp_tlf(struct sppp *sp)
3093 {
3094 	if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
3095 		/* Some address was dynamic, clear it again. */
3096 		sppp_clear_ip_addrs(sp);
3097 
3098 	/* we no longer need LCP */
3099 	sp->lcp.protos &= ~(1 << IDX_IPCP);
3100 	sppp_lcp_check_and_close(sp);
3101 }
3102 
3103 HIDE void
3104 sppp_ipcp_scr(struct sppp *sp)
3105 {
3106 	char opt[6 /* compression */ + 6 /* address */];
3107 	u_int32_t ouraddr;
3108 	int i = 0;
3109 
3110 #ifdef notyet
3111 	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
3112 		opt[i++] = IPCP_OPT_COMPRESSION;
3113 		opt[i++] = 6;
3114 		opt[i++] = 0;	/* VJ header compression */
3115 		opt[i++] = 0x2d; /* VJ header compression */
3116 		opt[i++] = max_slot_id;
3117 		opt[i++] = comp_slot_id;
3118 	}
3119 #endif
3120 
3121 	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
3122 		if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
3123 			/* not sure if this can ever happen */
3124 			ouraddr = sp->ipcp.req_myaddr;
3125 		else
3126 			sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
3127 		opt[i++] = IPCP_OPT_ADDRESS;
3128 		opt[i++] = 6;
3129 		opt[i++] = ouraddr >> 24;
3130 		opt[i++] = ouraddr >> 16;
3131 		opt[i++] = ouraddr >> 8;
3132 		opt[i++] = ouraddr;
3133 	}
3134 
3135 	sp->confid[IDX_IPCP] = ++sp->pp_seq;
3136 	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, opt);
3137 }
3138 
3139 /*
3140  *--------------------------------------------------------------------------*
3141  *                                                                          *
3142  *                      The IPv6CP implementation.                          *
3143  *                                                                          *
3144  *--------------------------------------------------------------------------*
3145  */
3146 
3147 #ifdef INET6
3148 HIDE void
3149 sppp_ipv6cp_init(struct sppp *sp)
3150 {
3151 	sp->ipv6cp.opts = 0;
3152 	sp->ipv6cp.flags = 0;
3153 	sp->state[IDX_IPV6CP] = STATE_INITIAL;
3154 	sp->fail_counter[IDX_IPV6CP] = 0;
3155 #if defined (__FreeBSD__)
3156 	callout_handle_init(&sp->ch[IDX_IPV6CP]);
3157 #endif
3158 }
3159 
3160 HIDE void
3161 sppp_ipv6cp_up(struct sppp *sp)
3162 {
3163 	sppp_up_event(&ipv6cp, sp);
3164 }
3165 
3166 HIDE void
3167 sppp_ipv6cp_down(struct sppp *sp)
3168 {
3169 	sppp_down_event(&ipv6cp, sp);
3170 }
3171 
3172 HIDE void
3173 sppp_ipv6cp_open(struct sppp *sp)
3174 {
3175 	STDDCL;
3176 	struct in6_addr myaddr, hisaddr;
3177 
3178 #ifdef IPV6CP_MYIFID_DYN
3179 	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
3180 #else
3181 	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
3182 #endif
3183 
3184 	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
3185 	/*
3186 	 * If we don't have our address, this probably means our
3187 	 * interface doesn't want to talk IPv6 at all.  (This could
3188 	 * be the case if somebody wants to speak only IPX, for
3189 	 * example.)  Don't open IPv6CP in this case.
3190 	 */
3191 	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
3192 		/* XXX this message should go away */
3193 		if (debug)
3194 			log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n",
3195 			    SPP_ARGS(ifp));
3196 		return;
3197 	}
3198 	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3199 	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3200 	sppp_open_event(&ipv6cp, sp);
3201 }
3202 
3203 HIDE void
3204 sppp_ipv6cp_close(struct sppp *sp)
3205 {
3206 	sppp_close_event(&ipv6cp, sp);
3207 }
3208 
3209 HIDE void
3210 sppp_ipv6cp_TO(void *cookie)
3211 {
3212 	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
3213 }
3214 
3215 HIDE int
3216 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3217 {
3218 	u_char *buf, *r, *p;
3219 	struct ifnet *ifp = &sp->pp_if;
3220 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
3221 	struct in6_addr myaddr, desiredaddr, suggestaddr;
3222 	int ifidcount;
3223 	int type;
3224 	int collision, nohisaddr;
3225 
3226 	len -= 4;
3227 	origlen = len;
3228 	/*
3229 	 * Make sure to allocate a buf that can at least hold a
3230 	 * conf-nak with an `address' option.  We might need it below.
3231 	 */
3232 	buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
3233 	if (! buf)
3234 		return (0);
3235 
3236 	/* pass 1: see if we can recognize them */
3237 	if (debug)
3238 		log(LOG_DEBUG, "%s: ipv6cp parse opts:",
3239 		    SPP_ARGS(ifp));
3240 	p = (void *)(h + 1);
3241 	ifidcount = 0;
3242 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3243 		/* Sanity check option length */
3244 		if (p[1] < 2 || p[1] > len) {
3245 			free(buf, M_TEMP);
3246 			return (-1);
3247 		}
3248 		if (debug)
3249 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3250 		switch (*p) {
3251 		case IPV6CP_OPT_IFID:
3252 			if (len >= 10 && p[1] == 10 && ifidcount == 0) {
3253 				/* correctly formed address option */
3254 				ifidcount++;
3255 				continue;
3256 			}
3257 			if (debug)
3258 				addlog(" [invalid]");
3259 			break;
3260 #ifdef notyet
3261 		case IPV6CP_OPT_COMPRESSION:
3262 			if (len >= 4 && p[1] >= 4) {
3263 				/* correctly formed compress option */
3264 				continue;
3265 			}
3266 			if (debug)
3267 				addlog(" [invalid]");
3268 			break;
3269 #endif
3270 		default:
3271 			/* Others not supported. */
3272 			if (debug)
3273 				addlog(" [rej]");
3274 			break;
3275 		}
3276 		/* Add the option to rejected list. */
3277 		bcopy (p, r, p[1]);
3278 		r += p[1];
3279 		rlen += p[1];
3280 	}
3281 	if (rlen) {
3282 		if (debug)
3283 			addlog(" send conf-rej\n");
3284 		sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
3285 		goto end;
3286 	} else if (debug)
3287 		addlog("\n");
3288 
3289 	/* pass 2: parse option values */
3290 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
3291 	if (debug)
3292 		log(LOG_DEBUG, "%s: ipv6cp parse opt values: ",
3293 		       SPP_ARGS(ifp));
3294 	p = (void *)(h + 1);
3295 	len = origlen;
3296 	type = CONF_ACK;
3297 	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3298 		if (debug)
3299 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3300 		switch (*p) {
3301 #ifdef notyet
3302 		case IPV6CP_OPT_COMPRESSION:
3303 			continue;
3304 #endif
3305 		case IPV6CP_OPT_IFID:
3306 			memset(&desiredaddr, 0, sizeof(desiredaddr));
3307 			bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
3308 			collision = (memcmp(&desiredaddr.s6_addr[8],
3309 					&myaddr.s6_addr[8], 8) == 0);
3310 			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
3311 
3312 			desiredaddr.s6_addr16[0] = htons(0xfe80);
3313 
3314 			if (!collision && !nohisaddr) {
3315 				/* no collision, hisaddr known - Conf-Ack */
3316 				type = CONF_ACK;
3317 
3318 				if (debug) {
3319 					addlog(" %s [%s]",
3320 					    ip6_sprintf(&desiredaddr),
3321 					    sppp_cp_type_name(type));
3322 				}
3323 				continue;
3324 			}
3325 
3326 			memset(&suggestaddr, 0, sizeof(&suggestaddr));
3327 			if (collision && nohisaddr) {
3328 				/* collision, hisaddr unknown - Conf-Rej */
3329 				type = CONF_REJ;
3330 				memset(&p[2], 0, 8);
3331 			} else {
3332 				/*
3333 				 * - no collision, hisaddr unknown, or
3334 				 * - collision, hisaddr known
3335 				 * Conf-Nak, suggest hisaddr
3336 				 */
3337 				type = CONF_NAK;
3338 				sppp_suggest_ip6_addr(sp, &suggestaddr);
3339 				bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
3340 			}
3341 			if (debug)
3342 				addlog(" %s [%s]", ip6_sprintf(&desiredaddr),
3343 				    sppp_cp_type_name(type));
3344 			break;
3345 		}
3346 		/* Add the option to nak'ed list. */
3347 		bcopy (p, r, p[1]);
3348 		r += p[1];
3349 		rlen += p[1];
3350 	}
3351 
3352 	if (rlen == 0 && type == CONF_ACK) {
3353 		if (debug)
3354 			addlog(" send %s\n", sppp_cp_type_name(type));
3355 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1);
3356 	} else {
3357 #ifdef notdef
3358 		if (type == CONF_ACK)
3359 			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
3360 #endif
3361 
3362 		if (debug) {
3363 			addlog(" send %s suggest %s\n",
3364 			    sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
3365 		}
3366 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
3367 	}
3368 
3369 end:
3370 	free(buf, M_TEMP);
3371 	return (rlen == 0);
3372 }
3373 
3374 HIDE void
3375 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3376 {
3377 	u_char *p;
3378 	struct ifnet *ifp = &sp->pp_if;
3379 	int debug = ifp->if_flags & IFF_DEBUG;
3380 
3381 	len -= 4;
3382 
3383 	if (debug)
3384 		log(LOG_DEBUG, "%s: ipv6cp rej opts:",
3385 		    SPP_ARGS(ifp));
3386 
3387 	p = (void *)(h + 1);
3388 	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3389 		if (p[1] < 2 || p[1] > len)
3390 			return;
3391 		if (debug)
3392 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3393 		switch (*p) {
3394 		case IPV6CP_OPT_IFID:
3395 			/*
3396 			 * Peer doesn't grok address option.  This is
3397 			 * bad.  XXX  Should we better give up here?
3398 			 */
3399 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
3400 			break;
3401 #ifdef notyet
3402 		case IPV6CP_OPT_COMPRESS:
3403 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
3404 			break;
3405 #endif
3406 		}
3407 	}
3408 	if (debug)
3409 		addlog("\n");
3410 	return;
3411 }
3412 
3413 HIDE void
3414 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3415 {
3416 	u_char *p;
3417 	struct ifnet *ifp = &sp->pp_if;
3418 	int debug = ifp->if_flags & IFF_DEBUG;
3419 	struct in6_addr suggestaddr;
3420 
3421 	len -= 4;
3422 
3423 	if (debug)
3424 		log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts: ",
3425 		    SPP_ARGS(ifp));
3426 
3427 	p = (void*) (h+1);
3428 	for (; len > 1; len -= p[1], p += p[1]) {
3429 		if (p[1] < 2 || p[1] > len)
3430 			return;
3431 		if (debug)
3432 			addlog("%s ", sppp_ipv6cp_opt_name(*p));
3433 		switch (*p) {
3434 		case IPV6CP_OPT_IFID:
3435 			/*
3436 			 * Peer doesn't like our local ifid.  See
3437 			 * if we can do something for him.  We'll drop
3438 			 * him our address then.
3439 			 */
3440 			if (len < 10 || p[1] != 10)
3441 				break;
3442 			memset(&suggestaddr, 0, sizeof(suggestaddr));
3443 			suggestaddr.s6_addr16[0] = htons(0xfe80);
3444 			bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
3445 
3446 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3447 			if (debug)
3448 				addlog(" [suggestaddr %s]",
3449 				       ip6_sprintf(&suggestaddr));
3450 #ifdef IPV6CP_MYIFID_DYN
3451 			/*
3452 			 * When doing dynamic address assignment,
3453 			 * we accept his offer.
3454 			 */
3455 			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
3456 				struct in6_addr lastsuggest;
3457 				/*
3458 				 * If <suggested myaddr from peer> equals to
3459 				 * <hisaddr we have suggested last time>,
3460 				 * we have a collision.  generate new random
3461 				 * ifid.
3462 				 */
3463 				sppp_suggest_ip6_addr(sp,&lastsuggest);
3464 				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
3465 						 &lastsuggest)) {
3466 					if (debug)
3467 						addlog(" [random]");
3468 					sppp_gen_ip6_addr(sp, &suggestaddr);
3469 				}
3470 				sppp_set_ip6_addr(sp, &suggestaddr);
3471 				if (debug)
3472 					addlog(" [agree]");
3473 				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3474 			}
3475 #else
3476 			/*
3477 			 * Since we do not do dynamic address assignment,
3478 			 * we ignore it and thus continue to negotiate
3479 			 * our already existing value.  This can possibly
3480 			 * go into infinite request-reject loop.
3481 			 *
3482 			 * This is not likely because we normally use
3483 			 * ifid based on MAC-address.
3484 			 * If you have no ethernet card on the node, too bad.
3485 			 * XXX should we use fail_counter?
3486 			 */
3487 #endif
3488 			break;
3489 #ifdef notyet
3490 		case IPV6CP_OPT_COMPRESS:
3491 			/*
3492 			 * Peer wants different compression parameters.
3493 			 */
3494 			break;
3495 #endif
3496 		}
3497 	}
3498 	if (debug)
3499 		addlog("\n");
3500 }
3501 
3502 HIDE void
3503 sppp_ipv6cp_tlu(struct sppp *sp)
3504 {
3505 }
3506 
3507 HIDE void
3508 sppp_ipv6cp_tld(struct sppp *sp)
3509 {
3510 }
3511 
3512 HIDE void
3513 sppp_ipv6cp_tls(struct sppp *sp)
3514 {
3515 	/* indicate to LCP that it must stay alive */
3516 	sp->lcp.protos |= (1 << IDX_IPV6CP);
3517 }
3518 
3519 HIDE void
3520 sppp_ipv6cp_tlf(struct sppp *sp)
3521 {
3522 	/* we no longer need LCP */
3523 	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
3524 	sppp_lcp_check_and_close(sp);
3525 }
3526 
3527 HIDE void
3528 sppp_ipv6cp_scr(struct sppp *sp)
3529 {
3530 	char opt[10 /* ifid */ + 4 /* compression, minimum */];
3531 	struct in6_addr ouraddr;
3532 	int i = 0;
3533 
3534 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
3535 		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
3536 		opt[i++] = IPV6CP_OPT_IFID;
3537 		opt[i++] = 10;
3538 		bcopy(&ouraddr.s6_addr[8], &opt[i], 8);
3539 		i += 8;
3540 	}
3541 
3542 #ifdef notyet
3543 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
3544 		opt[i++] = IPV6CP_OPT_COMPRESSION;
3545 		opt[i++] = 4;
3546 p		opt[i++] = 0;   /* TBD */
3547 		opt[i++] = 0;   /* TBD */
3548 		/* variable length data may follow */
3549 	}
3550 #endif
3551 
3552 	sp->confid[IDX_IPV6CP] = ++sp->pp_seq;
3553 	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, opt);
3554 }
3555 #else /*INET6*/
3556 HIDE void
3557 sppp_ipv6cp_init(struct sppp *sp)
3558 {
3559 }
3560 
3561 HIDE void
3562 sppp_ipv6cp_up(struct sppp *sp)
3563 {
3564 }
3565 
3566 HIDE void
3567 sppp_ipv6cp_down(struct sppp *sp)
3568 {
3569 }
3570 
3571 HIDE void
3572 sppp_ipv6cp_open(struct sppp *sp)
3573 {
3574 }
3575 
3576 HIDE void
3577 sppp_ipv6cp_close(struct sppp *sp)
3578 {
3579 }
3580 
3581 HIDE void
3582 sppp_ipv6cp_TO(void *sp)
3583 {
3584 }
3585 
3586 HIDE int
3587 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h,
3588 		int len)
3589 {
3590 	return 0;
3591 }
3592 
3593 HIDE void
3594 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h,
3595 		    int len)
3596 {
3597 }
3598 
3599 HIDE void
3600 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h,
3601 		    int len)
3602 {
3603 }
3604 
3605 HIDE void
3606 sppp_ipv6cp_tlu(struct sppp *sp)
3607 {
3608 }
3609 
3610 HIDE void
3611 sppp_ipv6cp_tld(struct sppp *sp)
3612 {
3613 }
3614 
3615 HIDE void
3616 sppp_ipv6cp_tls(struct sppp *sp)
3617 {
3618 }
3619 
3620 HIDE void
3621 sppp_ipv6cp_tlf(struct sppp *sp)
3622 {
3623 }
3624 
3625 HIDE void
3626 sppp_ipv6cp_scr(struct sppp *sp)
3627 {
3628 }
3629 #endif /*INET6*/
3630 
3631 /*
3632  *--------------------------------------------------------------------------*
3633  *                                                                          *
3634  *                        The CHAP implementation.                          *
3635  *                                                                          *
3636  *--------------------------------------------------------------------------*
3637  */
3638 
3639 /*
3640  * The authentication protocols don't employ a full-fledged state machine as
3641  * the control protocols do, since they do have Open and Close events, but
3642  * not Up and Down, nor are they explicitly terminated.  Also, use of the
3643  * authentication protocols may be different in both directions (this makes
3644  * sense, think of a machine that never accepts incoming calls but only
3645  * calls out, it doesn't require the called party to authenticate itself).
3646  *
3647  * Our state machine for the local authentication protocol (we are requesting
3648  * the peer to authenticate) looks like:
3649  *
3650  *						    RCA-
3651  *	      +--------------------------------------------+
3652  *	      V					    scn,tld|
3653  *	  +--------+			       Close   +---------+ RCA+
3654  *	  |	   |<----------------------------------|	 |------+
3655  *   +--->| Closed |				TO*    | Opened	 | sca	|
3656  *   |	  |	   |-----+		       +-------|	 |<-----+
3657  *   |	  +--------+ irc |		       |       +---------+
3658  *   |	    ^		 |		       |	   ^
3659  *   |	    |		 |		       |	   |
3660  *   |	    |		 |		       |	   |
3661  *   |	 TO-|		 |		       |	   |
3662  *   |	    |tld  TO+	 V		       |	   |
3663  *   |	    |	+------->+		       |	   |
3664  *   |	    |	|	 |		       |	   |
3665  *   |	  +--------+	 V		       |	   |
3666  *   |	  |	   |<----+<--------------------+	   |
3667  *   |	  | Req-   | scr				   |
3668  *   |	  | Sent   |					   |
3669  *   |	  |	   |					   |
3670  *   |	  +--------+					   |
3671  *   | RCA- |	| RCA+					   |
3672  *   +------+	+------------------------------------------+
3673  *   scn,tld	  sca,irc,ict,tlu
3674  *
3675  *
3676  *   with:
3677  *
3678  *	Open:	LCP reached authentication phase
3679  *	Close:	LCP reached terminate phase
3680  *
3681  *	RCA+:	received reply (pap-req, chap-response), acceptable
3682  *	RCN:	received reply (pap-req, chap-response), not acceptable
3683  *	TO+:	timeout with restart counter >= 0
3684  *	TO-:	timeout with restart counter < 0
3685  *	TO*:	reschedule timeout for CHAP
3686  *
3687  *	scr:	send request packet (none for PAP, chap-challenge)
3688  *	sca:	send ack packet (pap-ack, chap-success)
3689  *	scn:	send nak packet (pap-nak, chap-failure)
3690  *	ict:	initialize re-challenge timer (CHAP only)
3691  *
3692  *	tlu:	this-layer-up, LCP reaches network phase
3693  *	tld:	this-layer-down, LCP enters terminate phase
3694  *
3695  * Note that in CHAP mode, after sending a new challenge, while the state
3696  * automaton falls back into Req-Sent state, it doesn't signal a tld
3697  * event to LCP, so LCP remains in network phase.  Only after not getting
3698  * any response (or after getting an unacceptable response), CHAP closes,
3699  * causing LCP to enter terminate phase.
3700  *
3701  * With PAP, there is no initial request that can be sent.  The peer is
3702  * expected to send one based on the successful negotiation of PAP as
3703  * the authentication protocol during the LCP option negotiation.
3704  *
3705  * Incoming authentication protocol requests (remote requests
3706  * authentication, we are peer) don't employ a state machine at all,
3707  * they are simply answered.  Some peers [Ascend P50 firmware rev
3708  * 4.50] react allergically when sending IPCP requests while they are
3709  * still in authentication phase (thereby violating the standard that
3710  * demands that these NCP packets are to be discarded), so we keep
3711  * track of the peer demanding us to authenticate, and only proceed to
3712  * phase network once we've seen a positive acknowledge for the
3713  * authentication.
3714  */
3715 
3716 /*
3717  * Handle incoming CHAP packets.
3718  */
3719 void
3720 sppp_chap_input(struct sppp *sp, struct mbuf *m)
3721 {
3722 	STDDCL;
3723 	struct lcp_header *h;
3724 	int len, x;
3725 	u_char *value, *name, digest[AUTHCHALEN], dsize;
3726 	int value_len, name_len;
3727 	MD5_CTX ctx;
3728 
3729 	len = m->m_pkthdr.len;
3730 	if (len < 4) {
3731 		if (debug)
3732 			log(LOG_DEBUG,
3733 			    SPP_FMT "chap invalid packet length: %d bytes\n",
3734 			    SPP_ARGS(ifp), len);
3735 		return;
3736 	}
3737 	h = mtod (m, struct lcp_header*);
3738 	if (len > ntohs (h->len))
3739 		len = ntohs (h->len);
3740 
3741 	switch (h->type) {
3742 	/* challenge, failure and success are his authproto */
3743 	case CHAP_CHALLENGE:
3744 		value = 1 + (u_char*)(h+1);
3745 		value_len = value[-1];
3746 		name = value + value_len;
3747 		name_len = len - value_len - 5;
3748 		if (name_len < 0) {
3749 			if (debug) {
3750 				log(LOG_DEBUG,
3751 				    SPP_FMT "chap corrupted challenge "
3752 				    "<%s id=0x%x len=%d",
3753 				    SPP_ARGS(ifp),
3754 				    sppp_auth_type_name(PPP_CHAP, h->type),
3755 				    h->ident, ntohs(h->len));
3756 				if (len > 4)
3757 					sppp_print_bytes((u_char*) (h+1), len-4);
3758 				addlog(">\n");
3759 			}
3760 			break;
3761 		}
3762 
3763 		if (debug) {
3764 			log(LOG_DEBUG,
3765 			    SPP_FMT "chap input <%s id=0x%x len=%d name=",
3766 			    SPP_ARGS(ifp),
3767 			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
3768 			    ntohs(h->len));
3769 			sppp_print_string((char*) name, name_len);
3770 			addlog(" value-size=%d value=", value_len);
3771 			sppp_print_bytes(value, value_len);
3772 			addlog(">\n");
3773 		}
3774 
3775 		/* Compute reply value. */
3776 		MD5Init(&ctx);
3777 		MD5Update(&ctx, &h->ident, 1);
3778 		MD5Update(&ctx, sp->myauth.secret,
3779 			  strlen(sp->myauth.secret));
3780 		MD5Update(&ctx, value, value_len);
3781 		MD5Final(digest, &ctx);
3782 		dsize = sizeof digest;
3783 
3784 		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
3785 			       sizeof dsize, (const char *)&dsize,
3786 			       sizeof digest, digest,
3787 			       strlen(sp->myauth.name),
3788 			       sp->myauth.name,
3789 			       0);
3790 		break;
3791 
3792 	case CHAP_SUCCESS:
3793 		if (debug) {
3794 			log(LOG_DEBUG, SPP_FMT "chap success",
3795 			    SPP_ARGS(ifp));
3796 			if (len > 4) {
3797 				addlog(": ");
3798 				sppp_print_string((char*)(h + 1), len - 4);
3799 			}
3800 			addlog("\n");
3801 		}
3802 		x = splnet();
3803 		sp->pp_flags &= ~PP_NEEDAUTH;
3804 		if (sp->myauth.proto == PPP_CHAP &&
3805 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3806 		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
3807 			/*
3808 			 * We are authenticator for CHAP but didn't
3809 			 * complete yet.  Leave it to tlu to proceed
3810 			 * to network phase.
3811 			 */
3812 			splx(x);
3813 			break;
3814 		}
3815 		splx(x);
3816 		sppp_phase_network(sp);
3817 		break;
3818 
3819 	case CHAP_FAILURE:
3820 		if (debug) {
3821 			log(LOG_INFO, SPP_FMT "chap failure",
3822 			    SPP_ARGS(ifp));
3823 			if (len > 4) {
3824 				addlog(": ");
3825 				sppp_print_string((char*)(h + 1), len - 4);
3826 			}
3827 			addlog("\n");
3828 		} else
3829 			log(LOG_INFO, SPP_FMT "chap failure\n",
3830 			    SPP_ARGS(ifp));
3831 		/* await LCP shutdown by authenticator */
3832 		break;
3833 
3834 	/* response is my authproto */
3835 	case CHAP_RESPONSE:
3836 		value = 1 + (u_char*)(h+1);
3837 		value_len = value[-1];
3838 		name = value + value_len;
3839 		name_len = len - value_len - 5;
3840 		if (name_len < 0) {
3841 			if (debug) {
3842 				log(LOG_DEBUG,
3843 				    SPP_FMT "chap corrupted response "
3844 				    "<%s id=0x%x len=%d",
3845 				    SPP_ARGS(ifp),
3846 				    sppp_auth_type_name(PPP_CHAP, h->type),
3847 				    h->ident, ntohs(h->len));
3848 				if (len > 4)
3849 					sppp_print_bytes((u_char*)(h+1), len-4);
3850 				addlog(">\n");
3851 			}
3852 			break;
3853 		}
3854 		if (h->ident != sp->confid[IDX_CHAP]) {
3855 			if (debug)
3856 				log(LOG_DEBUG,
3857 				    SPP_FMT "chap dropping response for old ID "
3858 				    "(got %d, expected %d)\n",
3859 				    SPP_ARGS(ifp),
3860 				    h->ident, sp->confid[IDX_CHAP]);
3861 			break;
3862 		}
3863 		if (name_len != strlen(sp->hisauth.name)
3864 		    || bcmp(name, sp->hisauth.name, name_len) != 0) {
3865 			log(LOG_INFO, SPP_FMT "chap response, his name ",
3866 			    SPP_ARGS(ifp));
3867 			sppp_print_string(name, name_len);
3868 			addlog(" != expected ");
3869 			sppp_print_string(sp->hisauth.name,
3870 			    strlen(sp->hisauth.name));
3871 			addlog("\n");
3872 		}
3873 		if (debug) {
3874 			log(LOG_DEBUG, SPP_FMT "chap input(%s) "
3875 			    "<%s id=0x%x len=%d name=",
3876 			    SPP_ARGS(ifp),
3877 			    sppp_state_name(sp->state[IDX_CHAP]),
3878 			    sppp_auth_type_name(PPP_CHAP, h->type),
3879 			    h->ident, ntohs (h->len));
3880 			sppp_print_string((char*)name, name_len);
3881 			addlog(" value-size=%d value=", value_len);
3882 			sppp_print_bytes(value, value_len);
3883 			addlog(">\n");
3884 		}
3885 		if (value_len != AUTHCHALEN) {
3886 			if (debug)
3887 				log(LOG_DEBUG,
3888 				    SPP_FMT "chap bad hash value length: "
3889 				    "%d bytes, should be %d\n",
3890 				    SPP_ARGS(ifp), value_len,
3891 				    AUTHCHALEN);
3892 			break;
3893 		}
3894 
3895 		MD5Init(&ctx);
3896 		MD5Update(&ctx, &h->ident, 1);
3897 		MD5Update(&ctx, sp->hisauth.secret,
3898 			  strlen(sp->hisauth.secret));
3899 		MD5Update(&ctx, sp->chap_challenge, AUTHCHALEN);
3900 		MD5Final(digest, &ctx);
3901 
3902 #define FAILMSG "Failed..."
3903 #define SUCCMSG "Welcome!"
3904 
3905 		if (value_len != sizeof digest ||
3906 		    bcmp(digest, value, value_len) != 0) {
3907 			/* action scn, tld */
3908 			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
3909 				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
3910 				       0);
3911 			chap.tld(sp);
3912 			break;
3913 		}
3914 		/* action sca, perhaps tlu */
3915 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
3916 		    sp->state[IDX_CHAP] == STATE_OPENED)
3917 			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
3918 				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
3919 				       0);
3920 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
3921 			sppp_cp_change_state(&chap, sp, STATE_OPENED);
3922 			chap.tlu(sp);
3923 		}
3924 		break;
3925 
3926 	default:
3927 		/* Unknown CHAP packet type -- ignore. */
3928 		if (debug) {
3929 			log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
3930 			    "<0x%x id=0x%xh len=%d",
3931 			    SPP_ARGS(ifp),
3932 			    sppp_state_name(sp->state[IDX_CHAP]),
3933 			    h->type, h->ident, ntohs(h->len));
3934 			if (len > 4)
3935 				sppp_print_bytes((u_char*)(h+1), len-4);
3936 			addlog(">\n");
3937 		}
3938 		break;
3939 
3940 	}
3941 }
3942 
3943 HIDE void
3944 sppp_chap_init(struct sppp *sp)
3945 {
3946 	/* Chap doesn't have STATE_INITIAL at all. */
3947 	sp->state[IDX_CHAP] = STATE_CLOSED;
3948 	sp->fail_counter[IDX_CHAP] = 0;
3949 #if defined (__FreeBSD__)
3950 	callout_handle_init(&sp->ch[IDX_CHAP]);
3951 #endif
3952 }
3953 
3954 HIDE void
3955 sppp_chap_open(struct sppp *sp)
3956 {
3957 	if (sp->myauth.proto == PPP_CHAP &&
3958 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
3959 		/* we are authenticator for CHAP, start it */
3960 		chap.scr(sp);
3961 		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3962 		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
3963 	}
3964 	/* nothing to be done if we are peer, await a challenge */
3965 }
3966 
3967 HIDE void
3968 sppp_chap_close(struct sppp *sp)
3969 {
3970 	if (sp->state[IDX_CHAP] != STATE_CLOSED)
3971 		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3972 }
3973 
3974 HIDE void
3975 sppp_chap_TO(void *cookie)
3976 {
3977 	struct sppp *sp = (struct sppp *)cookie;
3978 	STDDCL;
3979 	int s;
3980 
3981 	s = splnet();
3982 	if (debug)
3983 		log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
3984 		    SPP_ARGS(ifp),
3985 		    sppp_state_name(sp->state[IDX_CHAP]),
3986 		    sp->rst_counter[IDX_CHAP]);
3987 
3988 	if (--sp->rst_counter[IDX_CHAP] < 0)
3989 		/* TO- event */
3990 		switch (sp->state[IDX_CHAP]) {
3991 		case STATE_REQ_SENT:
3992 			chap.tld(sp);
3993 			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3994 			break;
3995 		}
3996 	else
3997 		/* TO+ (or TO*) event */
3998 		switch (sp->state[IDX_CHAP]) {
3999 		case STATE_OPENED:
4000 			/* TO* event */
4001 			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4002 			/* FALLTHROUGH */
4003 		case STATE_REQ_SENT:
4004 			chap.scr(sp);
4005 			/* sppp_cp_change_state() will restart the timer */
4006 			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
4007 			break;
4008 		}
4009 
4010 	splx(s);
4011 }
4012 
4013 HIDE void
4014 sppp_chap_tlu(struct sppp *sp)
4015 {
4016 	STDDCL;
4017 	int i = 0, x;
4018 
4019 	i = 0;
4020 	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4021 
4022 	/*
4023 	 * Some broken CHAP implementations (Conware CoNet, firmware
4024 	 * 4.0.?) don't want to re-authenticate their CHAP once the
4025 	 * initial challenge-response exchange has taken place.
4026 	 * Provide for an option to avoid rechallenges.
4027 	 */
4028 	if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) {
4029 		/*
4030 		 * Compute the re-challenge timeout.  This will yield
4031 		 * a number between 300 and 810 seconds.
4032 		 */
4033 		i = 300 + (arc4random() & 0x01fe);
4034 
4035 #if defined (__FreeBSD__)
4036 		sp->ch[IDX_CHAP] = timeout(chap.TO, (void *)sp, i * hz);
4037 #elif defined(__OpenBSD__)
4038 		timeout_add_sec(&sp->ch[IDX_CHAP], i);
4039 #endif
4040 	}
4041 
4042 	if (debug) {
4043 		log(LOG_DEBUG,
4044 		    SPP_FMT "chap %s, ",
4045 		    SPP_ARGS(ifp),
4046 		    sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu");
4047 		if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0)
4048 			addlog("next re-challenge in %d seconds\n", i);
4049 		else
4050 			addlog("re-challenging suppressed\n");
4051 	}
4052 
4053 	x = splnet();
4054 	/* indicate to LCP that we need to be closed down */
4055 	sp->lcp.protos |= (1 << IDX_CHAP);
4056 
4057 	if (sp->pp_flags & PP_NEEDAUTH) {
4058 		/*
4059 		 * Remote is authenticator, but his auth proto didn't
4060 		 * complete yet.  Defer the transition to network
4061 		 * phase.
4062 		 */
4063 		splx(x);
4064 		return;
4065 	}
4066 	splx(x);
4067 
4068 	/*
4069 	 * If we are already in phase network, we are done here.  This
4070 	 * is the case if this is a dummy tlu event after a re-challenge.
4071 	 */
4072 	if (sp->pp_phase != PHASE_NETWORK)
4073 		sppp_phase_network(sp);
4074 }
4075 
4076 HIDE void
4077 sppp_chap_tld(struct sppp *sp)
4078 {
4079 	STDDCL;
4080 
4081 	if (debug)
4082 		log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
4083 	UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]);
4084 	sp->lcp.protos &= ~(1 << IDX_CHAP);
4085 
4086 	lcp.Close(sp);
4087 }
4088 
4089 HIDE void
4090 sppp_chap_scr(struct sppp *sp)
4091 {
4092 	u_char clen;
4093 
4094 	/* Compute random challenge. */
4095 	arc4random_buf(sp->chap_challenge, sizeof(sp->chap_challenge));
4096 	clen = AUTHCHALEN;
4097 
4098 	sp->confid[IDX_CHAP] = ++sp->pp_seq;
4099 
4100 	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
4101 		       sizeof clen, (const char *)&clen,
4102 		       (size_t)AUTHCHALEN, sp->chap_challenge,
4103 		       strlen(sp->myauth.name),
4104 		       sp->myauth.name,
4105 		       0);
4106 }
4107 /*
4108  *--------------------------------------------------------------------------*
4109  *                                                                          *
4110  *                        The PAP implementation.                           *
4111  *                                                                          *
4112  *--------------------------------------------------------------------------*
4113  */
4114 /*
4115  * For PAP, we need to keep a little state also if we are the peer, not the
4116  * authenticator.  This is since we don't get a request to authenticate, but
4117  * have to repeatedly authenticate ourself until we got a response (or the
4118  * retry counter is expired).
4119  */
4120 
4121 /*
4122  * Handle incoming PAP packets.  */
4123 HIDE void
4124 sppp_pap_input(struct sppp *sp, struct mbuf *m)
4125 {
4126 	STDDCL;
4127 	struct lcp_header *h;
4128 	int len, x;
4129 	u_char *name, *passwd, mlen;
4130 	int name_len, passwd_len;
4131 
4132 	len = m->m_pkthdr.len;
4133 	if (len < 5) {
4134 		if (debug)
4135 			log(LOG_DEBUG,
4136 			    SPP_FMT "pap invalid packet length: %d bytes\n",
4137 			    SPP_ARGS(ifp), len);
4138 		return;
4139 	}
4140 	h = mtod (m, struct lcp_header*);
4141 	if (len > ntohs (h->len))
4142 		len = ntohs (h->len);
4143 	switch (h->type) {
4144 	/* PAP request is my authproto */
4145 	case PAP_REQ:
4146 		name = 1 + (u_char*)(h+1);
4147 		name_len = name[-1];
4148 		passwd = name + name_len + 1;
4149 		if (name_len > len - 6 ||
4150 		    (passwd_len = passwd[-1]) > len - 6 - name_len) {
4151 			if (debug) {
4152 				log(LOG_DEBUG, SPP_FMT "pap corrupted input "
4153 				    "<%s id=0x%x len=%d",
4154 				    SPP_ARGS(ifp),
4155 				    sppp_auth_type_name(PPP_PAP, h->type),
4156 				    h->ident, ntohs(h->len));
4157 				if (len > 4)
4158 					sppp_print_bytes((u_char*)(h+1), len-4);
4159 				addlog(">\n");
4160 			}
4161 			break;
4162 		}
4163 		if (debug) {
4164 			log(LOG_DEBUG, SPP_FMT "pap input(%s) "
4165 			    "<%s id=0x%x len=%d name=",
4166 			    SPP_ARGS(ifp),
4167 			    sppp_state_name(sp->state[IDX_PAP]),
4168 			    sppp_auth_type_name(PPP_PAP, h->type),
4169 			    h->ident, ntohs(h->len));
4170 			sppp_print_string((char*)name, name_len);
4171 			addlog(" passwd=");
4172 			sppp_print_string((char*)passwd, passwd_len);
4173 			addlog(">\n");
4174 		}
4175 		if (name_len > AUTHMAXLEN ||
4176 		    passwd_len > AUTHMAXLEN ||
4177 		    bcmp(name, sp->hisauth.name, name_len) != 0 ||
4178 		    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
4179 			/* action scn, tld */
4180 			mlen = sizeof(FAILMSG) - 1;
4181 			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
4182 				       sizeof mlen, (const char *)&mlen,
4183 				       sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
4184 				       0);
4185 			pap.tld(sp);
4186 			break;
4187 		}
4188 		/* action sca, perhaps tlu */
4189 		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
4190 		    sp->state[IDX_PAP] == STATE_OPENED) {
4191 			mlen = sizeof(SUCCMSG) - 1;
4192 			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
4193 				       sizeof mlen, (const char *)&mlen,
4194 				       sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
4195 				       0);
4196 		}
4197 		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
4198 			sppp_cp_change_state(&pap, sp, STATE_OPENED);
4199 			pap.tlu(sp);
4200 		}
4201 		break;
4202 
4203 	/* ack and nak are his authproto */
4204 	case PAP_ACK:
4205 		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4206 		if (debug) {
4207 			log(LOG_DEBUG, SPP_FMT "pap success",
4208 			    SPP_ARGS(ifp));
4209 			name_len = *((char *)h);
4210 			if (len > 5 && name_len) {
4211 				addlog(": ");
4212 				sppp_print_string((char*)(h+1), name_len);
4213 			}
4214 			addlog("\n");
4215 		}
4216 		x = splnet();
4217 		sp->pp_flags &= ~PP_NEEDAUTH;
4218 		if (sp->myauth.proto == PPP_PAP &&
4219 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
4220 		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
4221 			/*
4222 			 * We are authenticator for PAP but didn't
4223 			 * complete yet.  Leave it to tlu to proceed
4224 			 * to network phase.
4225 			 */
4226 			splx(x);
4227 			break;
4228 		}
4229 		splx(x);
4230 		sppp_phase_network(sp);
4231 		break;
4232 
4233 	case PAP_NAK:
4234 		UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4235 		if (debug) {
4236 			log(LOG_INFO, SPP_FMT "pap failure",
4237 			    SPP_ARGS(ifp));
4238 			name_len = *((char *)h);
4239 			if (len > 5 && name_len) {
4240 				addlog(": ");
4241 				sppp_print_string((char*)(h+1), name_len);
4242 			}
4243 			addlog("\n");
4244 		} else
4245 			log(LOG_INFO, SPP_FMT "pap failure\n",
4246 			    SPP_ARGS(ifp));
4247 		/* await LCP shutdown by authenticator */
4248 		break;
4249 
4250 	default:
4251 		/* Unknown PAP packet type -- ignore. */
4252 		if (debug) {
4253 			log(LOG_DEBUG, SPP_FMT "pap corrupted input "
4254 			    "<0x%x id=0x%x len=%d",
4255 			    SPP_ARGS(ifp),
4256 			    h->type, h->ident, ntohs(h->len));
4257 			if (len > 4)
4258 				sppp_print_bytes((u_char*)(h+1), len-4);
4259 			addlog(">\n");
4260 		}
4261 		break;
4262 
4263 	}
4264 }
4265 
4266 HIDE void
4267 sppp_pap_init(struct sppp *sp)
4268 {
4269 	/* PAP doesn't have STATE_INITIAL at all. */
4270 	sp->state[IDX_PAP] = STATE_CLOSED;
4271 	sp->fail_counter[IDX_PAP] = 0;
4272 #if defined (__FreeBSD__)
4273 	callout_handle_init(&sp->ch[IDX_PAP]);
4274 	callout_handle_init(&sp->pap_my_to_ch);
4275 #endif
4276 }
4277 
4278 HIDE void
4279 sppp_pap_open(struct sppp *sp)
4280 {
4281 	if (sp->hisauth.proto == PPP_PAP &&
4282 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
4283 		/* we are authenticator for PAP, start our timer */
4284 		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4285 		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4286 	}
4287 	if (sp->myauth.proto == PPP_PAP) {
4288 		/* we are peer, send a request, and start a timer */
4289 		pap.scr(sp);
4290 #if defined (__FreeBSD__)
4291 		sp->pap_my_to_ch =
4292 		    timeout(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout);
4293 #elif defined (__OpenBSD__)
4294 		timeout_add(&sp->pap_my_to_ch, sp->lcp.timeout);
4295 #endif
4296 	}
4297 }
4298 
4299 HIDE void
4300 sppp_pap_close(struct sppp *sp)
4301 {
4302 	if (sp->state[IDX_PAP] != STATE_CLOSED)
4303 		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4304 }
4305 
4306 /*
4307  * That's the timeout routine if we are authenticator.  Since the
4308  * authenticator is basically passive in PAP, we can't do much here.
4309  */
4310 HIDE void
4311 sppp_pap_TO(void *cookie)
4312 {
4313 	struct sppp *sp = (struct sppp *)cookie;
4314 	STDDCL;
4315 	int s;
4316 
4317 	s = splnet();
4318 	if (debug)
4319 		log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
4320 		    SPP_ARGS(ifp),
4321 		    sppp_state_name(sp->state[IDX_PAP]),
4322 		    sp->rst_counter[IDX_PAP]);
4323 
4324 	if (--sp->rst_counter[IDX_PAP] < 0)
4325 		/* TO- event */
4326 		switch (sp->state[IDX_PAP]) {
4327 		case STATE_REQ_SENT:
4328 			pap.tld(sp);
4329 			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4330 			break;
4331 		}
4332 	else
4333 		/* TO+ event, not very much we could do */
4334 		switch (sp->state[IDX_PAP]) {
4335 		case STATE_REQ_SENT:
4336 			/* sppp_cp_change_state() will restart the timer */
4337 			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4338 			break;
4339 		}
4340 
4341 	splx(s);
4342 }
4343 
4344 /*
4345  * That's the timeout handler if we are peer.  Since the peer is active,
4346  * we need to retransmit our PAP request since it is apparently lost.
4347  * XXX We should impose a max counter.
4348  */
4349 HIDE void
4350 sppp_pap_my_TO(void *cookie)
4351 {
4352 	struct sppp *sp = (struct sppp *)cookie;
4353 	STDDCL;
4354 
4355 	if (debug)
4356 		log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
4357 		    SPP_ARGS(ifp));
4358 
4359 	pap.scr(sp);
4360 }
4361 
4362 HIDE void
4363 sppp_pap_tlu(struct sppp *sp)
4364 {
4365 	STDDCL;
4366 	int x;
4367 
4368 	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4369 
4370 	if (debug)
4371 		log(LOG_DEBUG, SPP_FMT "%s tlu\n",
4372 		    SPP_ARGS(ifp), pap.name);
4373 
4374 	x = splnet();
4375 	/* indicate to LCP that we need to be closed down */
4376 	sp->lcp.protos |= (1 << IDX_PAP);
4377 
4378 	if (sp->pp_flags & PP_NEEDAUTH) {
4379 		/*
4380 		 * Remote is authenticator, but his auth proto didn't
4381 		 * complete yet.  Defer the transition to network
4382 		 * phase.
4383 		 */
4384 		splx(x);
4385 		return;
4386 	}
4387 	splx(x);
4388 	sppp_phase_network(sp);
4389 }
4390 
4391 HIDE void
4392 sppp_pap_tld(struct sppp *sp)
4393 {
4394 	STDDCL;
4395 
4396 	if (debug)
4397 		log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
4398 	UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]);
4399 	UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
4400 	sp->lcp.protos &= ~(1 << IDX_PAP);
4401 
4402 	lcp.Close(sp);
4403 }
4404 
4405 HIDE void
4406 sppp_pap_scr(struct sppp *sp)
4407 {
4408 	u_char idlen, pwdlen;
4409 
4410 	sp->confid[IDX_PAP] = ++sp->pp_seq;
4411 	pwdlen = strlen(sp->myauth.secret);
4412 	idlen = strlen(sp->myauth.name);
4413 
4414 	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
4415 		       sizeof idlen, (const char *)&idlen,
4416 		       (size_t)idlen, sp->myauth.name,
4417 		       sizeof pwdlen, (const char *)&pwdlen,
4418 		       (size_t)pwdlen, sp->myauth.secret,
4419 		       0);
4420 }
4421 /*
4422  * Random miscellaneous functions.
4423  */
4424 
4425 /*
4426  * Send a PAP or CHAP proto packet.
4427  *
4428  * Varadic function, each of the elements for the ellipsis is of type
4429  * ``size_t mlen, const u_char *msg''.  Processing will stop iff
4430  * mlen == 0.
4431  */
4432 
4433 HIDE void
4434 sppp_auth_send(const struct cp *cp, struct sppp *sp,
4435 		unsigned int type, u_int id, ...)
4436 {
4437 	STDDCL;
4438 	struct ppp_header *h;
4439 	struct lcp_header *lh;
4440 	struct mbuf *m;
4441 	u_char *p;
4442 	int len;
4443 	size_t pkthdrlen;
4444 	unsigned int mlen;
4445 	const char *msg;
4446 	va_list ap;
4447 
4448 	MGETHDR (m, M_DONTWAIT, MT_DATA);
4449 	if (! m)
4450 		return;
4451 	m->m_pkthdr.rcvif = 0;
4452 
4453 	if (sp->pp_flags & PP_NOFRAMING) {
4454 		*mtod(m, u_int16_t *) = htons(cp->proto);
4455 		pkthdrlen = 2;
4456 		lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
4457 	} else {
4458 		h = mtod (m, struct ppp_header*);
4459 		h->address = PPP_ALLSTATIONS;	/* broadcast address */
4460 		h->control = PPP_UI;		/* Unnumbered Info */
4461 		h->protocol = htons(cp->proto);
4462 		pkthdrlen = PPP_HEADER_LEN;
4463 		lh = (struct lcp_header*)(h + 1);
4464 	}
4465 
4466 	lh->type = type;
4467 	lh->ident = id;
4468 	p = (u_char*) (lh+1);
4469 
4470 	va_start(ap, id);
4471 	len = 0;
4472 
4473 	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
4474 		msg = va_arg(ap, const char *);
4475 		len += mlen;
4476 		if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
4477 			va_end(ap);
4478 			m_freem(m);
4479 			return;
4480 		}
4481 
4482 		bcopy(msg, p, mlen);
4483 		p += mlen;
4484 	}
4485 	va_end(ap);
4486 
4487 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
4488 	lh->len = htons (LCP_HEADER_LEN + len);
4489 
4490 	if (debug) {
4491 		log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
4492 		    SPP_ARGS(ifp), cp->name,
4493 		    sppp_auth_type_name(cp->proto, lh->type),
4494 		    lh->ident, ntohs(lh->len));
4495 		if (len)
4496 			sppp_print_bytes((u_char*) (lh+1), len);
4497 		addlog(">\n");
4498 	}
4499 	if (IF_QFULL (&sp->pp_cpq)) {
4500 		IF_DROP (&sp->pp_fastq);
4501 		IF_DROP (&ifp->if_snd);
4502 		m_freem (m);
4503 		++ifp->if_oerrors;
4504 		m = NULL;
4505 	} else
4506 		IF_ENQUEUE (&sp->pp_cpq, m);
4507 	if (! (ifp->if_flags & IFF_OACTIVE))
4508 		(*ifp->if_start) (ifp);
4509 	if (m != NULL)
4510 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
4511 }
4512 
4513 /*
4514  * Flush interface queue.
4515  */
4516 HIDE void
4517 sppp_qflush(struct ifqueue *ifq)
4518 {
4519 	struct mbuf *m, *n;
4520 
4521 	n = ifq->ifq_head;
4522 	while ((m = n)) {
4523 		n = m->m_act;
4524 		m_freem (m);
4525 	}
4526 	ifq->ifq_head = 0;
4527 	ifq->ifq_tail = 0;
4528 	ifq->ifq_len = 0;
4529 }
4530 
4531 /*
4532  * Send keepalive packets, every 10 seconds.
4533  */
4534 HIDE void
4535 sppp_keepalive(void *dummy)
4536 {
4537 	struct sppp *sp;
4538 	int s;
4539 	struct timeval tv;
4540 
4541 	s = splnet();
4542 	getmicrouptime(&tv);
4543 	for (sp=spppq; sp; sp=sp->pp_next) {
4544 		struct ifnet *ifp = &sp->pp_if;
4545 
4546 		/* Keepalive mode disabled or channel down? */
4547 		if (! (sp->pp_flags & PP_KEEPALIVE) ||
4548 		    ! (ifp->if_flags & IFF_RUNNING))
4549 			continue;
4550 
4551 		/* No keepalive in PPP mode if LCP not opened yet. */
4552 		if (! (sp->pp_flags & PP_CISCO) &&
4553 		    sp->pp_phase < PHASE_AUTHENTICATE)
4554 			continue;
4555 
4556 		/* No echo reply, but maybe user data passed through? */
4557 		if (!(sp->pp_flags & PP_CISCO) &&
4558 		    (tv.tv_sec - sp->pp_last_receive) < NORECV_TIME) {
4559 			sp->pp_alivecnt = 0;
4560 			continue;
4561 		}
4562 
4563 		if (sp->pp_alivecnt >= MAXALIVECNT) {
4564 			/* No keepalive packets got.  Stop the interface. */
4565 			if_down (ifp);
4566 			sppp_qflush (&sp->pp_cpq);
4567 			if (! (sp->pp_flags & PP_CISCO)) {
4568 				log(LOG_INFO, SPP_FMT "LCP keepalive timeout\n",
4569 				    SPP_ARGS(ifp));
4570 				sp->pp_alivecnt = 0;
4571 
4572 				/* we are down, close all open protocols */
4573 				lcp.Close(sp);
4574 
4575 				/* And now prepare LCP to reestablish the link, if configured to do so. */
4576 				sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
4577 
4578 				/* Close connection immediately, completition of this
4579 				 * will summon the magic needed to reestablish it. */
4580 				if (sp->pp_tlf)
4581 					sp->pp_tlf(sp);
4582 				continue;
4583 			}
4584 		}
4585 		if (sp->pp_alivecnt < MAXALIVECNT)
4586 			++sp->pp_alivecnt;
4587 		if (sp->pp_flags & PP_CISCO)
4588 			sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
4589 				sp->pp_rseq);
4590 		else if (sp->pp_phase >= PHASE_AUTHENTICATE) {
4591 			unsigned long nmagic = htonl (sp->lcp.magic);
4592 			sp->lcp.echoid = ++sp->pp_seq;
4593 			sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
4594 				sp->lcp.echoid, 4, &nmagic);
4595 		}
4596 	}
4597 	splx(s);
4598 #if defined (__FreeBSD__)
4599 	keepalive_ch = timeout(sppp_keepalive, 0, hz * 10);
4600 #endif
4601 #if defined (__OpenBSD__)
4602 	timeout_add_sec(&keepalive_ch, 10);
4603 #endif
4604 }
4605 
4606 /*
4607  * Get both IP addresses.
4608  */
4609 HIDE void
4610 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst,
4611     u_int32_t *srcmask)
4612 {
4613 	struct ifnet *ifp = &sp->pp_if;
4614 	struct ifaddr *ifa;
4615 	struct sockaddr_in *si, *sm = 0;
4616 	u_int32_t ssrc, ddst;
4617 
4618 	sm = NULL;
4619 	ssrc = ddst = 0;
4620 	/*
4621 	 * Pick the first AF_INET address from the list,
4622 	 * aliases don't make any sense on a p2p link anyway.
4623 	 */
4624 #if defined (__FreeBSD__)
4625 	for (ifa = ifp->if_addrhead.tqh_first, si = 0;
4626 	     ifa;
4627 	     ifa = ifa->ifa_link.tqe_next)
4628 #else
4629 	si = 0;
4630 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
4631 #endif
4632 	{
4633 		if (ifa->ifa_addr->sa_family == AF_INET) {
4634 			si = (struct sockaddr_in *)ifa->ifa_addr;
4635 			sm = (struct sockaddr_in *)ifa->ifa_netmask;
4636 			if (si)
4637 				break;
4638 		}
4639 	}
4640 	if (ifa) {
4641 		if (si && si->sin_addr.s_addr) {
4642 			ssrc = si->sin_addr.s_addr;
4643 			if (srcmask)
4644 				*srcmask = ntohl(sm->sin_addr.s_addr);
4645 		}
4646 
4647 		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
4648 		if (si && si->sin_addr.s_addr)
4649 			ddst = si->sin_addr.s_addr;
4650 	}
4651 
4652 	if (dst) *dst = ntohl(ddst);
4653 	if (src) *src = ntohl(ssrc);
4654 }
4655 
4656 /*
4657  * If an address is 0, leave it the way it is.
4658  */
4659 HIDE void
4660 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr)
4661 {
4662 	STDDCL;
4663  	struct ifaddr *ifa;
4664  	struct sockaddr_in *si;
4665 	struct sockaddr_in *dest;
4666 
4667 	/*
4668 	 * Pick the first AF_INET address from the list,
4669 	 * aliases don't make any sense on a p2p link anyway.
4670 	 */
4671 
4672 #if defined (__FreeBSD__)
4673 	for (ifa = ifp->if_addrhead.tqh_first, si = 0;
4674 	     ifa;
4675 	     ifa = ifa->ifa_link.tqe_next)
4676 #else
4677 	si = 0;
4678 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
4679 #endif
4680 	{
4681 		if (ifa->ifa_addr->sa_family == AF_INET)
4682 		{
4683 			si = (struct sockaddr_in *)ifa->ifa_addr;
4684 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
4685 			if (si)
4686 				break;
4687 		}
4688 	}
4689 
4690 	if (ifa && si) {
4691 		int error;
4692 		struct sockaddr_in new_sin = *si;
4693 		struct sockaddr_in new_dst = *dest;
4694 
4695 		/*
4696 		 * Scrub old routes now instead of calling in_ifinit with
4697 		 * scrub=1, because we may change the dstaddr
4698 		 * before the call to in_ifinit.
4699 		 */
4700 		in_ifscrub(ifp, ifatoia(ifa));
4701 
4702 		if (myaddr != 0)
4703 			new_sin.sin_addr.s_addr = htonl(myaddr);
4704 		if (hisaddr != 0) {
4705 			new_dst.sin_addr.s_addr = htonl(hisaddr);
4706 			if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) {
4707 				sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
4708 				*dest = new_dst; /* fix dstaddr in place */
4709 			}
4710 		}
4711 		if (!(error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0)))
4712 			dohooks(ifp->if_addrhooks, 0);
4713 		if (debug && error) {
4714 			log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit "
4715 			" failed, error=%d\n", SPP_ARGS(ifp), error);
4716 		}
4717 	}
4718 }
4719 
4720 /*
4721  * Clear IP addresses.  Must be called at splnet.
4722  */
4723 HIDE void
4724 sppp_clear_ip_addrs(struct sppp *sp)
4725 {
4726 	struct ifnet *ifp = &sp->pp_if;
4727 	struct ifaddr *ifa;
4728 	struct sockaddr_in *si;
4729 	struct sockaddr_in *dest;
4730 
4731 	u_int32_t remote;
4732 	if (sp->ipcp.flags & IPCP_HISADDR_DYN)
4733 		remote = sp->ipcp.saved_hisaddr;
4734 	else
4735 		sppp_get_ip_addrs(sp, 0, &remote, 0);
4736 
4737 	/*
4738 	 * Pick the first AF_INET address from the list,
4739 	 * aliases don't make any sense on a p2p link anyway.
4740 	 */
4741 
4742 	si = 0;
4743 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
4744 		if (ifa->ifa_addr->sa_family == AF_INET) {
4745 			si = (struct sockaddr_in *)ifa->ifa_addr;
4746 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
4747 			if (si)
4748 				break;
4749 		}
4750 	}
4751 
4752 	if (ifa && si) {
4753 		struct sockaddr_in new_sin = *si;
4754 
4755 		in_ifscrub(ifp, ifatoia(ifa));
4756 		if (sp->ipcp.flags & IPCP_MYADDR_DYN)
4757 			new_sin.sin_addr.s_addr = 0;
4758 		if (sp->ipcp.flags & IPCP_HISADDR_DYN)
4759 			/* replace peer addr in place */
4760 			dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr;
4761 		if (!in_ifinit(ifp, ifatoia(ifa), &new_sin, 0))
4762 			dohooks(ifp->if_addrhooks, 0);
4763 	}
4764 }
4765 
4766 
4767 #ifdef INET6
4768 /*
4769  * Get both IPv6 addresses.
4770  */
4771 HIDE void
4772 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
4773 		   struct in6_addr *srcmask)
4774 {
4775 	struct ifnet *ifp = &sp->pp_if;
4776 	struct ifaddr *ifa;
4777 	struct sockaddr_in6 *si, *sm;
4778 	struct in6_addr ssrc, ddst;
4779 
4780 	sm = NULL;
4781 	bzero(&ssrc, sizeof(ssrc));
4782 	bzero(&ddst, sizeof(ddst));
4783 	/*
4784 	 * Pick the first link-local AF_INET6 address from the list,
4785 	 * aliases don't make any sense on a p2p link anyway.
4786 	 */
4787 	si = 0;
4788 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
4789 		if (ifa->ifa_addr->sa_family == AF_INET6) {
4790 			si = (struct sockaddr_in6 *)ifa->ifa_addr;
4791 			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
4792 			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
4793 				break;
4794 		}
4795 	}
4796 
4797 	if (ifa) {
4798 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
4799 			bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc));
4800 			if (srcmask) {
4801 				bcopy(&sm->sin6_addr, srcmask,
4802 				    sizeof(*srcmask));
4803 			}
4804 		}
4805 
4806 		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
4807 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
4808 			bcopy(&si->sin6_addr, &ddst, sizeof(ddst));
4809 	}
4810 
4811 	if (dst)
4812 		bcopy(&ddst, dst, sizeof(*dst));
4813 	if (src)
4814 		bcopy(&ssrc, src, sizeof(*src));
4815 }
4816 
4817 #ifdef IPV6CP_MYIFID_DYN
4818 /*
4819  * Generate random ifid.
4820  */
4821 HIDE void
4822 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
4823 {
4824 	/* TBD */
4825 }
4826 
4827 /*
4828  * Set my IPv6 address.  Must be called at splnet.
4829  */
4830 HIDE void
4831 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
4832 {
4833 	struct ifnet *ifp = &sp->pp_if;
4834 	struct ifaddr *ifa;
4835 	struct sockaddr_in6 *sin6;
4836 
4837 	/*
4838 	 * Pick the first link-local AF_INET6 address from the list,
4839 	 * aliases don't make any sense on a p2p link anyway.
4840 	 */
4841 
4842 	sin6 = NULL;
4843 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
4844 		if (ifa->ifa_addr->sa_family == AF_INET6) {
4845 			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
4846 			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
4847 				break;
4848 		}
4849 	}
4850 
4851 	if (ifa && sin6) {
4852 		struct sockaddr_in6 new_sin6 = *sin6;
4853 		bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr));
4854 		dohooks(ifp->if_addrhooks, 0);
4855 	}
4856 }
4857 #endif
4858 
4859 /*
4860  * Suggest a candidate address to be used by peer.
4861  */
4862 HIDE void
4863 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
4864 {
4865 	struct in6_addr myaddr;
4866 	struct timeval tv;
4867 
4868 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
4869 
4870 	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
4871 	getmicrouptime(&tv);
4872 	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
4873 		myaddr.s6_addr[14] ^= 0xff;
4874 		myaddr.s6_addr[15] ^= 0xff;
4875 	} else {
4876 		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
4877 		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
4878 	}
4879 	if (suggest)
4880 		bcopy(&myaddr, suggest, sizeof(myaddr));
4881 }
4882 #endif /*INET6*/
4883 
4884 HIDE int
4885 sppp_get_params(struct sppp *sp, struct ifreq *ifr)
4886 {
4887 	int cmd;
4888 
4889 	if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0)
4890 		return EFAULT;
4891 
4892 	switch (cmd) {
4893 	case SPPPIOGDEFS:
4894 	{
4895 		struct spppreq *spr;
4896 
4897 		spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK);
4898 
4899 		/*
4900 		 * We copy over the entire current state, but clean
4901 		 * out some of the stuff we don't wanna pass up.
4902 		 * Remember, SIOCGIFGENERIC is unprotected, and can be
4903 		 * called by any user.  No need to ever get PAP or
4904 		 * CHAP secrets back to userland anyway.
4905 		 */
4906 
4907 		spr->cmd = cmd;
4908 		bcopy(sp, &spr->defs, sizeof(struct sppp));
4909 
4910 		bzero(&spr->defs.myauth, sizeof(spr->defs.myauth));
4911 		bzero(&spr->defs.hisauth, sizeof(spr->defs.hisauth));
4912 		bzero(&spr->defs.chap_challenge, sizeof(spr->defs.chap_challenge));
4913 
4914 		if (copyout(spr, (caddr_t)ifr->ifr_data, sizeof(*spr)) != 0) {
4915 			free(spr, M_DEVBUF);
4916 			return EFAULT;
4917 		}
4918 		free(spr, M_DEVBUF);
4919 		break;
4920 	}
4921 	case SPPPIOGMAUTH:
4922 	case SPPPIOGHAUTH:
4923 	{
4924 		struct sauthreq *spa;
4925 		struct sauth *auth;
4926 
4927 		spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK);
4928 		auth = (cmd == SPPPIOGMAUTH) ? &sp->myauth : &sp->hisauth;
4929 		bzero(spa, sizeof(*spa));
4930 		spa->proto = auth->proto;
4931 		spa->flags = auth->flags;
4932 
4933 		/* do not copy the secret, and only let root know the name */
4934 		if (auth->name != NULL && suser(curproc, 0) == 0)
4935 			strlcpy(spa->name, auth->name, sizeof(spa->name));
4936 
4937 		if (copyout(spa, (caddr_t)ifr->ifr_data, sizeof(*spa)) != 0) {
4938 			free(spa, M_DEVBUF);
4939 			return EFAULT;
4940 		}
4941 		free(spa, M_DEVBUF);
4942 		break;
4943 	}
4944 	default:
4945 		return EINVAL;
4946 	}
4947 
4948 	return 0;
4949 }
4950 
4951 
4952 HIDE int
4953 sppp_set_params(struct sppp *sp, struct ifreq *ifr)
4954 {
4955 	int cmd;
4956 
4957 	if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0)
4958 		return EFAULT;
4959 
4960 	/*
4961 	 * We have a very specific idea of which fields we allow
4962 	 * being passed back from userland, so to not clobber our
4963 	 * current state.  For one, we only allow setting
4964 	 * anything if LCP is in dead phase.  Once the LCP
4965 	 * negotiations started, the authentication settings must
4966 	 * not be changed again.  (The administrator can force an
4967 	 * ifconfig down in order to get LCP back into dead
4968 	 * phase.)
4969 	 */
4970 	if (sp->pp_phase != PHASE_DEAD)
4971 		return EBUSY;
4972 
4973 	switch (cmd) {
4974 	case SPPPIOSDEFS:
4975 	{
4976 		struct spppreq *spr;
4977 
4978 		spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK);
4979 
4980 		if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(*spr)) != 0) {
4981 			free(spr, M_DEVBUF);
4982 			return EFAULT;
4983 		}
4984 		/*
4985 		 * Also, we only allow for authentication parameters to be
4986 		 * specified.
4987 		 *
4988 		 * XXX Should allow to set or clear pp_flags.
4989 		 */
4990 		free(spr, M_DEVBUF);
4991 		break;
4992 	}
4993 	case SPPPIOSMAUTH:
4994 	case SPPPIOSHAUTH:
4995 	{
4996 		/*
4997 		 * Finally, if the respective authentication protocol to
4998 		 * be used is set differently than 0, but the secret is
4999 		 * passed as all zeros, we don't trash the existing secret.
5000 		 * This allows an administrator to change the system name
5001 		 * only without clobbering the secret (which he didn't get
5002 		 * back in a previous SPPPIOGXAUTH call).  However, the
5003 		 * secrets are cleared if the authentication protocol is
5004 		 * reset to 0.
5005 		 */
5006 
5007 		struct sauthreq *spa;
5008 		struct sauth *auth;
5009 		char *p;
5010 		int len;
5011 
5012 		spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK);
5013 
5014 		auth = (cmd == SPPPIOSMAUTH) ? &sp->myauth : &sp->hisauth;
5015 
5016 		if (copyin((caddr_t)ifr->ifr_data, spa, sizeof(*spa)) != 0) {
5017 			free(spa, M_DEVBUF);
5018 			return EFAULT;
5019 		}
5020 
5021 		if (spa->proto != 0 && spa->proto != PPP_PAP &&
5022 		    spa->proto != PPP_CHAP) {
5023 			free(spa, M_DEVBUF);
5024 			return EINVAL;
5025 		}
5026 
5027 		if (spa->proto == 0) {
5028 			/* resetting auth */
5029 			if (auth->name != NULL)
5030 				free(auth->name, M_DEVBUF);
5031 			if (auth->secret != NULL)
5032 				free(auth->secret, M_DEVBUF);
5033 			bzero(auth, sizeof *auth);
5034 			bzero(sp->chap_challenge, sizeof sp->chap_challenge);
5035 		} else {
5036 			/* setting/changing auth */
5037 			auth->proto = spa->proto;
5038 			auth->flags = spa->flags;
5039 
5040 			spa->name[AUTHMAXLEN - 1] = '\0';
5041 			len = strlen(spa->name) + 1;
5042 			p = malloc(len, M_DEVBUF, M_WAITOK);
5043 			strlcpy(p, spa->name, len);
5044 			if (auth->name != NULL)
5045 				free(auth->name, M_DEVBUF);
5046 			auth->name = p;
5047 
5048 			if (spa->secret[0] != '\0') {
5049 				spa->secret[AUTHMAXLEN - 1] = '\0';
5050 				len = strlen(spa->secret) + 1;
5051 				p = malloc(len, M_DEVBUF, M_WAITOK);
5052 				strlcpy(p, spa->secret, len);
5053 				if (auth->secret != NULL)
5054 					free(auth->secret, M_DEVBUF);
5055 				auth->secret = p;
5056 			}
5057 		}
5058 		free(spa, M_DEVBUF);
5059 		break;
5060 	}
5061 	default:
5062 		return EINVAL;
5063 	}
5064 
5065 	return 0;
5066 }
5067 
5068 HIDE void
5069 sppp_phase_network(struct sppp *sp)
5070 {
5071 	int i;
5072 	u_long mask;
5073 
5074 	sp->pp_phase = PHASE_NETWORK;
5075 
5076 	sppp_set_phase(sp);
5077 
5078 	/* Notify NCPs now. */
5079 	for (i = 0; i < IDX_COUNT; i++)
5080 		if ((cps[i])->flags & CP_NCP)
5081 			(cps[i])->Open(sp);
5082 
5083 	/* Send Up events to all NCPs. */
5084 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
5085 		if (sp->lcp.protos & mask && ((cps[i])->flags & CP_NCP))
5086 			(cps[i])->Up(sp);
5087 
5088 	/* if no NCP is starting, all this was in vain, close down */
5089 	sppp_lcp_check_and_close(sp);
5090 }
5091 
5092 
5093 HIDE const char *
5094 sppp_cp_type_name(u_char type)
5095 {
5096 	static char buf[12];
5097 	switch (type) {
5098 	case CONF_REQ:   return "conf-req";
5099 	case CONF_ACK:   return "conf-ack";
5100 	case CONF_NAK:   return "conf-nak";
5101 	case CONF_REJ:   return "conf-rej";
5102 	case TERM_REQ:   return "term-req";
5103 	case TERM_ACK:   return "term-ack";
5104 	case CODE_REJ:   return "code-rej";
5105 	case PROTO_REJ:  return "proto-rej";
5106 	case ECHO_REQ:   return "echo-req";
5107 	case ECHO_REPLY: return "echo-reply";
5108 	case DISC_REQ:   return "discard-req";
5109 	}
5110 	snprintf (buf, sizeof buf, "0x%x", type);
5111 	return buf;
5112 }
5113 
5114 HIDE const char *
5115 sppp_auth_type_name(u_short proto, u_char type)
5116 {
5117 	static char buf[12];
5118 	switch (proto) {
5119 	case PPP_CHAP:
5120 		switch (type) {
5121 		case CHAP_CHALLENGE:	return "challenge";
5122 		case CHAP_RESPONSE:	return "response";
5123 		case CHAP_SUCCESS:	return "success";
5124 		case CHAP_FAILURE:	return "failure";
5125 		}
5126 	case PPP_PAP:
5127 		switch (type) {
5128 		case PAP_REQ:		return "req";
5129 		case PAP_ACK:		return "ack";
5130 		case PAP_NAK:		return "nak";
5131 		}
5132 	}
5133 	snprintf (buf, sizeof buf, "0x%x", type);
5134 	return buf;
5135 }
5136 
5137 HIDE const char *
5138 sppp_lcp_opt_name(u_char opt)
5139 {
5140 	static char buf[12];
5141 	switch (opt) {
5142 	case LCP_OPT_MRU:		return "mru";
5143 	case LCP_OPT_ASYNC_MAP:		return "async-map";
5144 	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
5145 	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
5146 	case LCP_OPT_MAGIC:		return "magic";
5147 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
5148 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
5149 	}
5150 	snprintf (buf, sizeof buf, "0x%x", opt);
5151 	return buf;
5152 }
5153 
5154 HIDE const char *
5155 sppp_ipcp_opt_name(u_char opt)
5156 {
5157 	static char buf[12];
5158 	switch (opt) {
5159 	case IPCP_OPT_ADDRESSES:	return "addresses";
5160 	case IPCP_OPT_COMPRESSION:	return "compression";
5161 	case IPCP_OPT_ADDRESS:		return "address";
5162 	}
5163 	snprintf (buf, sizeof buf, "0x%x", opt);
5164 	return buf;
5165 }
5166 
5167 #ifdef INET6
5168 HIDE const char *
5169 sppp_ipv6cp_opt_name(u_char opt)
5170 {
5171 	static char buf[12];
5172 	switch (opt) {
5173 	case IPV6CP_OPT_IFID:		return "ifid";
5174 	case IPV6CP_OPT_COMPRESSION:	return "compression";
5175 	}
5176 	snprintf (buf, sizeof buf, "0x%x", opt);
5177 	return buf;
5178 }
5179 #endif
5180 
5181 HIDE const char *
5182 sppp_state_name(int state)
5183 {
5184 	switch (state) {
5185 	case STATE_INITIAL:	return "initial";
5186 	case STATE_STARTING:	return "starting";
5187 	case STATE_CLOSED:	return "closed";
5188 	case STATE_STOPPED:	return "stopped";
5189 	case STATE_CLOSING:	return "closing";
5190 	case STATE_STOPPING:	return "stopping";
5191 	case STATE_REQ_SENT:	return "req-sent";
5192 	case STATE_ACK_RCVD:	return "ack-rcvd";
5193 	case STATE_ACK_SENT:	return "ack-sent";
5194 	case STATE_OPENED:	return "opened";
5195 	}
5196 	return "illegal";
5197 }
5198 
5199 HIDE const char *
5200 sppp_phase_name(enum ppp_phase phase)
5201 {
5202 	switch (phase) {
5203 	case PHASE_DEAD:	return "dead";
5204 	case PHASE_ESTABLISH:	return "establish";
5205 	case PHASE_TERMINATE:	return "terminate";
5206 	case PHASE_AUTHENTICATE: return "authenticate";
5207 	case PHASE_NETWORK:	return "network";
5208 	}
5209 	return "illegal";
5210 }
5211 
5212 HIDE const char *
5213 sppp_proto_name(u_short proto)
5214 {
5215 	static char buf[12];
5216 	switch (proto) {
5217 	case PPP_LCP:	return "lcp";
5218 	case PPP_IPCP:	return "ipcp";
5219 	case PPP_PAP:	return "pap";
5220 	case PPP_CHAP:	return "chap";
5221 	}
5222 	snprintf(buf, sizeof buf, "0x%x", (unsigned)proto);
5223 	return buf;
5224 }
5225 
5226 HIDE void
5227 sppp_print_bytes(const u_char *p, u_short len)
5228 {
5229 	addlog(" %02x", *p++);
5230 	while (--len > 0)
5231 		addlog("-%02x", *p++);
5232 }
5233 
5234 HIDE void
5235 sppp_print_string(const char *p, u_short len)
5236 {
5237 	u_char c;
5238 
5239 	while (len-- > 0) {
5240 		c = *p++;
5241 		/*
5242 		 * Print only ASCII chars directly.  RFC 1994 recommends
5243 		 * using only them, but we don't rely on it.  */
5244 		if (c < ' ' || c > '~')
5245 			addlog("\\x%x", c);
5246 		else
5247 			addlog("%c", c);
5248 	}
5249 }
5250 
5251 HIDE const char *
5252 sppp_dotted_quad(u_int32_t addr)
5253 {
5254 	static char s[16];
5255 	snprintf(s, sizeof s, "%d.%d.%d.%d",
5256 		(int)((addr >> 24) & 0xff),
5257 		(int)((addr >> 16) & 0xff),
5258 		(int)((addr >> 8) & 0xff),
5259 		(int)(addr & 0xff));
5260 	return s;
5261 }
5262 
5263 /* a dummy, used to drop uninteresting events */
5264 HIDE void
5265 sppp_null(struct sppp *unused)
5266 {
5267 	/* do just nothing */
5268 }
5269 /*
5270  * This file is large.  Tell emacs to highlight it nevertheless.
5271  *
5272  * Local Variables:
5273  * hilit-auto-highlight-maxout: 120000
5274  * End:
5275  */
5276 
5277 HIDE void
5278 sppp_set_phase(struct sppp *sp)
5279 {
5280 	STDDCL;
5281 	int lstate, s;
5282 
5283 	if (debug)
5284 		log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
5285 		    sppp_phase_name(sp->pp_phase));
5286 
5287 	/* set link state */
5288 	if (sp->pp_phase == PHASE_NETWORK)
5289 		lstate = LINK_STATE_UP;
5290 	else
5291 		lstate = LINK_STATE_DOWN;
5292 
5293 	if (ifp->if_link_state != lstate) {
5294 		ifp->if_link_state = lstate;
5295 		s = splsoftnet();
5296 		if_link_state_change(ifp);
5297 		splx(s);
5298 	}
5299 }
5300