1 /* $OpenBSD: if_spppsubr.c,v 1.80 2010/05/01 08:14:26 mk Exp $ */ 2 /* 3 * Synchronous PPP/Cisco link level subroutines. 4 * Keepalive protocol implemented in both Cisco and PPP modes. 5 * 6 * Copyright (C) 1994-1996 Cronyx Engineering Ltd. 7 * Author: Serge Vakulenko, <vak@cronyx.ru> 8 * 9 * Heavily revamped to conform to RFC 1661. 10 * Copyright (C) 1997, Joerg Wunsch. 11 * 12 * RFC2472 IPv6CP support. 13 * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun@iijlab.net>. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions are met: 17 * 1. Redistributions of source code must retain the above copyright notice, 18 * this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright notice, 20 * this list of conditions and the following disclaimer in the documentation 21 * and/or other materials provided with the distribution. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY 24 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE 27 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 28 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 29 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 30 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 31 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 33 * POSSIBILITY OF SUCH DAMAGE. 34 * 35 * From: Version 2.6, Tue May 12 17:10:39 MSD 1998 36 */ 37 38 #include <sys/param.h> 39 40 #define HIDE 41 42 #include <sys/systm.h> 43 #include <sys/kernel.h> 44 #include <sys/sockio.h> 45 #include <sys/socket.h> 46 #include <sys/proc.h> 47 #include <sys/syslog.h> 48 #include <sys/malloc.h> 49 #include <sys/mbuf.h> 50 51 #if defined (__OpenBSD__) 52 #include <sys/timeout.h> 53 #include <crypto/md5.h> 54 #else 55 #include <sys/md5.h> 56 #endif 57 58 #include <net/if.h> 59 #include <net/netisr.h> 60 #include <net/if_types.h> 61 #include <net/route.h> 62 63 /* for arc4random() */ 64 #include <dev/rndvar.h> 65 66 #if defined (__FreeBSD__) || defined(__OpenBSD_) || defined(__NetBSD__) 67 #include <machine/random.h> 68 #endif 69 #if defined (__NetBSD__) || defined (__OpenBSD__) 70 #include <machine/cpu.h> /* XXX for softnet */ 71 #endif 72 #include <sys/stdarg.h> 73 74 #ifdef INET 75 #include <netinet/in.h> 76 #include <netinet/in_systm.h> 77 #include <netinet/in_var.h> 78 #include <netinet/ip.h> 79 #include <netinet/tcp.h> 80 # if defined (__FreeBSD__) || defined (__OpenBSD__) 81 # include <netinet/if_ether.h> 82 # else 83 # include <net/ethertypes.h> 84 # endif 85 #endif 86 87 #ifdef INET6 88 #include <netinet6/in6_var.h> 89 #endif 90 91 #include <net/if_sppp.h> 92 93 #if defined (__FreeBSD__) 94 # define UNTIMEOUT(fun, arg, handle) \ 95 untimeout(fun, arg, handle) 96 #elif defined(__OpenBSD__) 97 # define UNTIMEOUT(fun, arg, handle) \ 98 timeout_del(&(handle)) 99 #else 100 # define UNTIMEOUT(fun, arg, handle) \ 101 untimeout(fun, arg) 102 #endif 103 104 #define LOOPALIVECNT 3 /* loopback detection tries */ 105 #define MAXALIVECNT 3 /* max. missed alive packets */ 106 #define NORECV_TIME 15 /* before we get worried */ 107 108 /* 109 * Interface flags that can be set in an ifconfig command. 110 * 111 * Setting link0 will make the link passive, i.e. it will be marked 112 * as being administrative openable, but won't be opened to begin 113 * with. Incoming calls will be answered, or subsequent calls with 114 * -link1 will cause the administrative open of the LCP layer. 115 * 116 * Setting link1 will cause the link to auto-dial only as packets 117 * arrive to be sent. 118 * 119 * Setting IFF_DEBUG will syslog the option negotiation and state 120 * transitions at level kern.debug. Note: all logs consistently look 121 * like 122 * 123 * <if-name><unit>: <proto-name> <additional info...> 124 * 125 * with <if-name><unit> being something like "bppp0", and <proto-name> 126 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc. 127 */ 128 129 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 130 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */ 131 132 #define PPP_ALLSTATIONS 0xff /* All-Stations broadcast address */ 133 #define PPP_UI 0x03 /* Unnumbered Information */ 134 #define PPP_IP 0x0021 /* Internet Protocol */ 135 #define PPP_ISO 0x0023 /* ISO OSI Protocol */ 136 #define PPP_XNS 0x0025 /* Xerox NS Protocol */ 137 #define PPP_IPX 0x002b /* Novell IPX Protocol */ 138 #define PPP_IPV6 0x0057 /* Internet Protocol v6 */ 139 #define PPP_LCP 0xc021 /* Link Control Protocol */ 140 #define PPP_PAP 0xc023 /* Password Authentication Protocol */ 141 #define PPP_CHAP 0xc223 /* Challenge-Handshake Auth Protocol */ 142 #define PPP_IPCP 0x8021 /* Internet Protocol Control Protocol */ 143 #define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */ 144 145 #define CONF_REQ 1 /* PPP configure request */ 146 #define CONF_ACK 2 /* PPP configure acknowledge */ 147 #define CONF_NAK 3 /* PPP configure negative ack */ 148 #define CONF_REJ 4 /* PPP configure reject */ 149 #define TERM_REQ 5 /* PPP terminate request */ 150 #define TERM_ACK 6 /* PPP terminate acknowledge */ 151 #define CODE_REJ 7 /* PPP code reject */ 152 #define PROTO_REJ 8 /* PPP protocol reject */ 153 #define ECHO_REQ 9 /* PPP echo request */ 154 #define ECHO_REPLY 10 /* PPP echo reply */ 155 #define DISC_REQ 11 /* PPP discard request */ 156 157 #define LCP_OPT_MRU 1 /* maximum receive unit */ 158 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */ 159 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */ 160 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */ 161 #define LCP_OPT_MAGIC 5 /* magic number */ 162 #define LCP_OPT_RESERVED 6 /* reserved */ 163 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */ 164 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */ 165 166 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */ 167 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol (VJ) */ 168 #define IPCP_OPT_ADDRESS 3 /* local IP address */ 169 170 #define IPV6CP_OPT_IFID 1 /* interface identifier */ 171 #define IPV6CP_OPT_COMPRESSION 2 /* IPv6 compression protocol */ 172 173 #define PAP_REQ 1 /* PAP name/password request */ 174 #define PAP_ACK 2 /* PAP acknowledge */ 175 #define PAP_NAK 3 /* PAP fail */ 176 177 #define CHAP_CHALLENGE 1 /* CHAP challenge request */ 178 #define CHAP_RESPONSE 2 /* CHAP challenge response */ 179 #define CHAP_SUCCESS 3 /* CHAP response ok */ 180 #define CHAP_FAILURE 4 /* CHAP response failed */ 181 182 #define CHAP_MD5 5 /* hash algorithm - MD5 */ 183 184 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 185 #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 186 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 187 #define CISCO_ADDR_REQ 0 /* Cisco address request */ 188 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */ 189 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */ 190 191 /* states are named and numbered according to RFC 1661 */ 192 #define STATE_INITIAL 0 193 #define STATE_STARTING 1 194 #define STATE_CLOSED 2 195 #define STATE_STOPPED 3 196 #define STATE_CLOSING 4 197 #define STATE_STOPPING 5 198 #define STATE_REQ_SENT 6 199 #define STATE_ACK_RCVD 7 200 #define STATE_ACK_SENT 8 201 #define STATE_OPENED 9 202 203 struct ppp_header { 204 u_char address; 205 u_char control; 206 u_short protocol; 207 }; 208 #define PPP_HEADER_LEN sizeof (struct ppp_header) 209 210 struct lcp_header { 211 u_char type; 212 u_char ident; 213 u_short len; 214 }; 215 #define LCP_HEADER_LEN sizeof (struct lcp_header) 216 217 struct cisco_packet { 218 u_int32_t type; 219 u_int32_t par1; 220 u_int32_t par2; 221 u_short rel; 222 u_short time0; 223 u_short time1; 224 }; 225 #define CISCO_PACKET_LEN 18 226 227 /* 228 * We follow the spelling and capitalization of RFC 1661 here, to make 229 * it easier comparing with the standard. Please refer to this RFC in 230 * case you can't make sense out of these abbreviation; it will also 231 * explain the semantics related to the various events and actions. 232 */ 233 struct cp { 234 u_short proto; /* PPP control protocol number */ 235 u_char protoidx; /* index into state table in struct sppp */ 236 u_char flags; 237 #define CP_LCP 0x01 /* this is the LCP */ 238 #define CP_AUTH 0x02 /* this is an authentication protocol */ 239 #define CP_NCP 0x04 /* this is a NCP */ 240 #define CP_QUAL 0x08 /* this is a quality reporting protocol */ 241 const char *name; /* name of this control protocol */ 242 /* event handlers */ 243 void (*Up)(struct sppp *sp); 244 void (*Down)(struct sppp *sp); 245 void (*Open)(struct sppp *sp); 246 void (*Close)(struct sppp *sp); 247 void (*TO)(void *sp); 248 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len); 249 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len); 250 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len); 251 /* actions */ 252 void (*tlu)(struct sppp *sp); 253 void (*tld)(struct sppp *sp); 254 void (*tls)(struct sppp *sp); 255 void (*tlf)(struct sppp *sp); 256 void (*scr)(struct sppp *sp); 257 }; 258 259 static struct sppp *spppq; 260 #if defined (__OpenBSD__) 261 static struct timeout keepalive_ch; 262 #endif 263 #if defined (__FreeBSD__) 264 static struct callout_handle keepalive_ch; 265 #endif 266 267 #if defined (__FreeBSD__) 268 #define SPP_FMT "%s%d: " 269 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit 270 #else 271 #define SPP_FMT "%s: " 272 #define SPP_ARGS(ifp) (ifp)->if_xname 273 #endif 274 275 /* 276 * The following disgusting hack gets around the problem that IP TOS 277 * can't be set yet. We want to put "interactive" traffic on a high 278 * priority queue. To decide if traffic is interactive, we check that 279 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control. 280 * 281 * XXX is this really still necessary? - joerg - 282 */ 283 static u_short interactive_ports[8] = { 284 0, 513, 0, 0, 285 0, 21, 0, 23, 286 }; 287 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p)) 288 289 /* almost every function needs these */ 290 #define STDDCL \ 291 struct ifnet *ifp = &sp->pp_if; \ 292 int debug = ifp->if_flags & IFF_DEBUG 293 294 HIDE int sppp_output(struct ifnet *ifp, struct mbuf *m, 295 struct sockaddr *dst, struct rtentry *rt); 296 297 HIDE void sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2); 298 HIDE void sppp_cisco_input(struct sppp *sp, struct mbuf *m); 299 300 HIDE void sppp_cp_input(const struct cp *cp, struct sppp *sp, 301 struct mbuf *m); 302 HIDE void sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 303 u_char ident, u_short len, void *data); 304 #ifdef notyet 305 HIDE void sppp_cp_timeout(void *arg); 306 #endif 307 HIDE void sppp_cp_change_state(const struct cp *cp, struct sppp *sp, 308 int newstate); 309 HIDE void sppp_auth_send(const struct cp *cp, 310 struct sppp *sp, unsigned int type, u_int id, 311 ...); 312 313 HIDE void sppp_up_event(const struct cp *cp, struct sppp *sp); 314 HIDE void sppp_down_event(const struct cp *cp, struct sppp *sp); 315 HIDE void sppp_open_event(const struct cp *cp, struct sppp *sp); 316 HIDE void sppp_close_event(const struct cp *cp, struct sppp *sp); 317 HIDE void sppp_increasing_timeout(const struct cp *cp, struct sppp *sp); 318 HIDE void sppp_to_event(const struct cp *cp, struct sppp *sp); 319 320 HIDE void sppp_null(struct sppp *sp); 321 322 HIDE void sppp_lcp_init(struct sppp *sp); 323 HIDE void sppp_lcp_up(struct sppp *sp); 324 HIDE void sppp_lcp_down(struct sppp *sp); 325 HIDE void sppp_lcp_open(struct sppp *sp); 326 HIDE void sppp_lcp_close(struct sppp *sp); 327 HIDE void sppp_lcp_TO(void *sp); 328 HIDE int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 329 HIDE void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 330 HIDE void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 331 HIDE void sppp_lcp_tlu(struct sppp *sp); 332 HIDE void sppp_lcp_tld(struct sppp *sp); 333 HIDE void sppp_lcp_tls(struct sppp *sp); 334 HIDE void sppp_lcp_tlf(struct sppp *sp); 335 HIDE void sppp_lcp_scr(struct sppp *sp); 336 HIDE void sppp_lcp_check_and_close(struct sppp *sp); 337 HIDE int sppp_ncp_check(struct sppp *sp); 338 339 HIDE void sppp_ipcp_init(struct sppp *sp); 340 HIDE void sppp_ipcp_up(struct sppp *sp); 341 HIDE void sppp_ipcp_down(struct sppp *sp); 342 HIDE void sppp_ipcp_open(struct sppp *sp); 343 HIDE void sppp_ipcp_close(struct sppp *sp); 344 HIDE void sppp_ipcp_TO(void *sp); 345 HIDE int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len); 346 HIDE void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 347 HIDE void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 348 HIDE void sppp_ipcp_tlu(struct sppp *sp); 349 HIDE void sppp_ipcp_tld(struct sppp *sp); 350 HIDE void sppp_ipcp_tls(struct sppp *sp); 351 HIDE void sppp_ipcp_tlf(struct sppp *sp); 352 HIDE void sppp_ipcp_scr(struct sppp *sp); 353 354 HIDE void sppp_ipv6cp_init(struct sppp *sp); 355 HIDE void sppp_ipv6cp_up(struct sppp *sp); 356 HIDE void sppp_ipv6cp_down(struct sppp *sp); 357 HIDE void sppp_ipv6cp_open(struct sppp *sp); 358 HIDE void sppp_ipv6cp_close(struct sppp *sp); 359 HIDE void sppp_ipv6cp_TO(void *sp); 360 HIDE int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len); 361 HIDE void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len); 362 HIDE void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len); 363 HIDE void sppp_ipv6cp_tlu(struct sppp *sp); 364 HIDE void sppp_ipv6cp_tld(struct sppp *sp); 365 HIDE void sppp_ipv6cp_tls(struct sppp *sp); 366 HIDE void sppp_ipv6cp_tlf(struct sppp *sp); 367 HIDE void sppp_ipv6cp_scr(struct sppp *sp); 368 HIDE const char *sppp_ipv6cp_opt_name(u_char opt); 369 HIDE void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, 370 struct in6_addr *dst, struct in6_addr *srcmask); 371 HIDE void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src); 372 HIDE void sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr); 373 HIDE void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest); 374 375 HIDE void sppp_pap_input(struct sppp *sp, struct mbuf *m); 376 HIDE void sppp_pap_init(struct sppp *sp); 377 HIDE void sppp_pap_open(struct sppp *sp); 378 HIDE void sppp_pap_close(struct sppp *sp); 379 HIDE void sppp_pap_TO(void *sp); 380 HIDE void sppp_pap_my_TO(void *sp); 381 HIDE void sppp_pap_tlu(struct sppp *sp); 382 HIDE void sppp_pap_tld(struct sppp *sp); 383 HIDE void sppp_pap_scr(struct sppp *sp); 384 385 HIDE void sppp_chap_input(struct sppp *sp, struct mbuf *m); 386 HIDE void sppp_chap_init(struct sppp *sp); 387 HIDE void sppp_chap_open(struct sppp *sp); 388 HIDE void sppp_chap_close(struct sppp *sp); 389 HIDE void sppp_chap_TO(void *sp); 390 HIDE void sppp_chap_tlu(struct sppp *sp); 391 HIDE void sppp_chap_tld(struct sppp *sp); 392 HIDE void sppp_chap_scr(struct sppp *sp); 393 394 HIDE const char *sppp_auth_type_name(u_short proto, u_char type); 395 HIDE const char *sppp_cp_type_name(u_char type); 396 HIDE const char *sppp_dotted_quad(u_int32_t addr); 397 HIDE const char *sppp_ipcp_opt_name(u_char opt); 398 HIDE const char *sppp_lcp_opt_name(u_char opt); 399 HIDE const char *sppp_phase_name(enum ppp_phase phase); 400 HIDE const char *sppp_proto_name(u_short proto); 401 HIDE const char *sppp_state_name(int state); 402 HIDE int sppp_get_params(struct sppp *sp, struct ifreq *data); 403 HIDE int sppp_set_params(struct sppp *sp, struct ifreq *data); 404 HIDE void sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 405 u_int32_t *srcmask); 406 HIDE void sppp_keepalive(void *dummy); 407 HIDE void sppp_phase_network(struct sppp *sp); 408 HIDE void sppp_print_bytes(const u_char *p, u_short len); 409 HIDE void sppp_print_string(const char *p, u_short len); 410 HIDE void sppp_qflush(struct ifqueue *ifq); 411 HIDE void sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, 412 u_int32_t hisaddr); 413 HIDE void sppp_clear_ip_addrs(struct sppp *sp); 414 HIDE void sppp_set_phase(struct sppp *sp); 415 416 /* our control protocol descriptors */ 417 static const struct cp lcp = { 418 PPP_LCP, IDX_LCP, CP_LCP, "lcp", 419 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close, 420 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak, 421 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf, 422 sppp_lcp_scr 423 }; 424 425 static const struct cp ipcp = { 426 PPP_IPCP, IDX_IPCP, 427 #ifdef INET /* don't run IPCP if there's no IPv4 support */ 428 CP_NCP, 429 #else 430 0, 431 #endif 432 "ipcp", 433 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close, 434 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak, 435 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf, 436 sppp_ipcp_scr 437 }; 438 439 static const struct cp ipv6cp = { 440 PPP_IPV6CP, IDX_IPV6CP, 441 #ifdef INET6 /*don't run IPv6CP if there's no IPv6 support*/ 442 CP_NCP, 443 #else 444 0, 445 #endif 446 "ipv6cp", 447 sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close, 448 sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak, 449 sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf, 450 sppp_ipv6cp_scr 451 }; 452 453 static const struct cp pap = { 454 PPP_PAP, IDX_PAP, CP_AUTH, "pap", 455 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close, 456 sppp_pap_TO, 0, 0, 0, 457 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null, 458 sppp_pap_scr 459 }; 460 461 static const struct cp chap = { 462 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap", 463 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close, 464 sppp_chap_TO, 0, 0, 0, 465 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null, 466 sppp_chap_scr 467 }; 468 469 static const struct cp *cps[IDX_COUNT] = { 470 &lcp, /* IDX_LCP */ 471 &ipcp, /* IDX_IPCP */ 472 &ipv6cp, /* IDX_IPV6CP */ 473 &pap, /* IDX_PAP */ 474 &chap, /* IDX_CHAP */ 475 }; 476 477 478 /* 479 * Exported functions, comprising our interface to the lower layer. 480 */ 481 482 #if defined(__OpenBSD__) 483 /* Workaround */ 484 void 485 spppattach(struct ifnet *ifp) 486 { 487 } 488 #endif 489 490 /* 491 * Process the received packet. 492 */ 493 void 494 sppp_input(struct ifnet *ifp, struct mbuf *m) 495 { 496 struct ppp_header *h, ht; 497 struct ifqueue *inq = 0; 498 struct sppp *sp = (struct sppp *)ifp; 499 struct timeval tv; 500 int debug = ifp->if_flags & IFF_DEBUG; 501 int s; 502 503 if (ifp->if_flags & IFF_UP) { 504 /* Count received bytes, add hardware framing */ 505 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes; 506 /* Note time of last receive */ 507 getmicrouptime(&tv); 508 sp->pp_last_receive = tv.tv_sec; 509 } 510 511 if (m->m_pkthdr.len <= PPP_HEADER_LEN) { 512 /* Too small packet, drop it. */ 513 if (debug) 514 log(LOG_DEBUG, 515 SPP_FMT "input packet is too small, %d bytes\n", 516 SPP_ARGS(ifp), m->m_pkthdr.len); 517 drop: 518 ++ifp->if_ierrors; 519 ++ifp->if_iqdrops; 520 m_freem (m); 521 return; 522 } 523 524 /* mark incoming routing domain */ 525 m->m_pkthdr.rdomain = ifp->if_rdomain; 526 527 if (sp->pp_flags & PP_NOFRAMING) { 528 memcpy(&ht.protocol, mtod(m, char *), sizeof(ht.protocol)); 529 m_adj(m, 2); 530 ht.control = PPP_UI; 531 ht.address = PPP_ALLSTATIONS; 532 h = &ht; 533 } else { 534 /* Get PPP header. */ 535 h = mtod (m, struct ppp_header*); 536 m_adj (m, PPP_HEADER_LEN); 537 } 538 539 /* preserve the alignment */ 540 if (m->m_len < m->m_pkthdr.len) { 541 m = m_pullup2(m, m->m_pkthdr.len); 542 if (m == NULL) { 543 if (debug) 544 log(LOG_DEBUG, 545 SPP_FMT "Failed to align packet!\n", SPP_ARGS(ifp)); 546 ++ifp->if_ierrors; 547 ++ifp->if_iqdrops; 548 return; 549 } 550 } 551 552 switch (h->address) { 553 case PPP_ALLSTATIONS: 554 if (h->control != PPP_UI) 555 goto invalid; 556 if (sp->pp_flags & PP_CISCO) { 557 if (debug) 558 log(LOG_DEBUG, 559 SPP_FMT "PPP packet in Cisco mode " 560 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 561 SPP_ARGS(ifp), 562 h->address, h->control, ntohs(h->protocol)); 563 goto drop; 564 } 565 switch (ntohs (h->protocol)) { 566 default: 567 if (sp->state[IDX_LCP] == STATE_OPENED) 568 sppp_cp_send (sp, PPP_LCP, PROTO_REJ, 569 ++sp->pp_seq, 2, &h->protocol); 570 if (debug) 571 log(LOG_DEBUG, 572 SPP_FMT "invalid input protocol " 573 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 574 SPP_ARGS(ifp), 575 h->address, h->control, ntohs(h->protocol)); 576 ++ifp->if_noproto; 577 goto drop; 578 case PPP_LCP: 579 sppp_cp_input(&lcp, sp, m); 580 m_freem (m); 581 return; 582 case PPP_PAP: 583 if (sp->pp_phase >= PHASE_AUTHENTICATE) 584 sppp_pap_input(sp, m); 585 m_freem (m); 586 return; 587 case PPP_CHAP: 588 if (sp->pp_phase >= PHASE_AUTHENTICATE) 589 sppp_chap_input(sp, m); 590 m_freem (m); 591 return; 592 #ifdef INET 593 case PPP_IPCP: 594 if (sp->pp_phase == PHASE_NETWORK) 595 sppp_cp_input(&ipcp, sp, m); 596 m_freem (m); 597 return; 598 case PPP_IP: 599 if (sp->state[IDX_IPCP] == STATE_OPENED) { 600 schednetisr (NETISR_IP); 601 inq = &ipintrq; 602 sp->pp_last_activity = tv.tv_sec; 603 } 604 break; 605 #endif 606 #ifdef INET6 607 case PPP_IPV6CP: 608 if (sp->pp_phase == PHASE_NETWORK) 609 sppp_cp_input(&ipv6cp, sp, m); 610 m_freem (m); 611 return; 612 case PPP_IPV6: 613 if (sp->state[IDX_IPV6CP] == STATE_OPENED) { 614 schednetisr (NETISR_IPV6); 615 inq = &ip6intrq; 616 sp->pp_last_activity = tv.tv_sec; 617 } 618 break; 619 #endif 620 } 621 break; 622 case CISCO_MULTICAST: 623 case CISCO_UNICAST: 624 /* Don't check the control field here (RFC 1547). */ 625 if (! (sp->pp_flags & PP_CISCO)) { 626 if (debug) 627 log(LOG_DEBUG, 628 SPP_FMT "Cisco packet in PPP mode " 629 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 630 SPP_ARGS(ifp), 631 h->address, h->control, ntohs(h->protocol)); 632 goto drop; 633 } 634 switch (ntohs (h->protocol)) { 635 default: 636 ++ifp->if_noproto; 637 goto invalid; 638 case CISCO_KEEPALIVE: 639 sppp_cisco_input ((struct sppp*) ifp, m); 640 m_freem (m); 641 return; 642 #ifdef INET 643 case ETHERTYPE_IP: 644 schednetisr (NETISR_IP); 645 inq = &ipintrq; 646 break; 647 #endif 648 #ifdef INET6 649 case ETHERTYPE_IPV6: 650 schednetisr (NETISR_IPV6); 651 inq = &ip6intrq; 652 break; 653 #endif 654 } 655 break; 656 default: /* Invalid PPP packet. */ 657 invalid: 658 if (debug) 659 log(LOG_DEBUG, 660 SPP_FMT "invalid input packet " 661 "<addr=0x%x ctrl=0x%x proto=0x%x>\n", 662 SPP_ARGS(ifp), 663 h->address, h->control, ntohs(h->protocol)); 664 goto drop; 665 } 666 667 if (! (ifp->if_flags & IFF_UP) || ! inq) 668 goto drop; 669 670 /* Check queue. */ 671 s = splnet(); 672 if (IF_QFULL (inq)) { 673 /* Queue overflow. */ 674 IF_DROP(inq); 675 splx(s); 676 if (debug) 677 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n", 678 SPP_ARGS(ifp)); 679 if (!inq->ifq_congestion) 680 if_congestion(inq); 681 goto drop; 682 } 683 IF_ENQUEUE(inq, m); 684 splx(s); 685 } 686 687 /* 688 * Enqueue transmit packet. 689 */ 690 HIDE int 691 sppp_output(struct ifnet *ifp, struct mbuf *m, 692 struct sockaddr *dst, struct rtentry *rt) 693 { 694 struct sppp *sp = (struct sppp*) ifp; 695 struct ppp_header *h; 696 struct ifqueue *ifq = NULL; 697 struct timeval tv; 698 int s, len, rv = 0; 699 u_int16_t protocol; 700 701 #ifdef DIAGNOSTIC 702 if (ifp->if_rdomain != rtable_l2(m->m_pkthdr.rdomain)) { 703 printf("%s: trying to send packet on wrong domain. " 704 "if %d vs. mbuf %d, AF %d\n", ifp->if_xname, 705 ifp->if_rdomain, rtable_l2(m->m_pkthdr.rdomain), 706 dst->sa_family); 707 } 708 #endif 709 710 s = splnet(); 711 712 getmicrouptime(&tv); 713 sp->pp_last_activity = tv.tv_sec; 714 715 if ((ifp->if_flags & IFF_UP) == 0 || 716 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) { 717 m_freem (m); 718 splx (s); 719 return (ENETDOWN); 720 } 721 722 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) { 723 /* 724 * Interface is not yet running, but auto-dial. Need 725 * to start LCP for it. 726 */ 727 ifp->if_flags |= IFF_RUNNING; 728 splx(s); 729 lcp.Open(sp); 730 s = splnet(); 731 } 732 733 #ifdef INET 734 /* 735 * Put low delay, telnet, rlogin and ftp control packets 736 * in front of the queue. 737 */ 738 if (dst->sa_family == AF_INET) { 739 struct ip *ip = NULL; 740 struct tcphdr *th = NULL; 741 742 if (m->m_len >= sizeof(struct ip)) { 743 ip = mtod(m, struct ip *); 744 if (ip->ip_p == IPPROTO_TCP && 745 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) + 746 sizeof(struct tcphdr)) { 747 th = (struct tcphdr *) 748 ((caddr_t)ip + (ip->ip_hl << 2)); 749 } 750 } 751 /* 752 * When using dynamic local IP address assignment by using 753 * 0.0.0.0 as a local address, the first TCP session will 754 * not connect because the local TCP checksum is computed 755 * using 0.0.0.0 which will later become our real IP address 756 * so the TCP checksum computed at the remote end will 757 * become invalid. So we 758 * - don't let packets with src ip addr 0 thru 759 * - we flag TCP packets with src ip 0 as an error 760 */ 761 762 if(ip && ip->ip_src.s_addr == INADDR_ANY) { 763 u_int8_t proto = ip->ip_p; 764 765 m_freem(m); 766 splx(s); 767 if(proto == IPPROTO_TCP) 768 return (EADDRNOTAVAIL); 769 else 770 return (0); 771 } 772 773 if (!IF_QFULL(&sp->pp_fastq) && 774 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) || 775 (th && (INTERACTIVE(ntohs(th->th_sport)) || 776 INTERACTIVE(ntohs(th->th_dport)))))) 777 ifq = &sp->pp_fastq; 778 } 779 #endif 780 781 if (sp->pp_flags & PP_NOFRAMING) 782 goto skip_header; 783 /* 784 * Prepend general data packet PPP header. For now, IP only. 785 */ 786 M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT); 787 if (!m) { 788 if (ifp->if_flags & IFF_DEBUG) 789 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n", 790 SPP_ARGS(ifp)); 791 ++ifp->if_oerrors; 792 splx (s); 793 return (ENOBUFS); 794 } 795 /* 796 * May want to check size of packet 797 * (albeit due to the implementation it's always enough) 798 */ 799 h = mtod (m, struct ppp_header*); 800 if (sp->pp_flags & PP_CISCO) { 801 h->address = CISCO_UNICAST; /* unicast address */ 802 h->control = 0; 803 } else { 804 h->address = PPP_ALLSTATIONS; /* broadcast address */ 805 h->control = PPP_UI; /* Unnumbered Info */ 806 } 807 808 skip_header: 809 switch (dst->sa_family) { 810 #ifdef INET 811 case AF_INET: /* Internet Protocol */ 812 if (sp->pp_flags & PP_CISCO) 813 protocol = htons (ETHERTYPE_IP); 814 else { 815 /* 816 * Don't choke with an ENETDOWN early. It's 817 * possible that we just started dialing out, 818 * so don't drop the packet immediately. If 819 * we notice that we run out of buffer space 820 * below, we will however remember that we are 821 * not ready to carry IP packets, and return 822 * ENETDOWN, as opposed to ENOBUFS. 823 */ 824 protocol = htons(PPP_IP); 825 if (sp->state[IDX_IPCP] != STATE_OPENED) 826 rv = ENETDOWN; 827 } 828 break; 829 #endif 830 #ifdef INET6 831 case AF_INET6: /* Internet Protocol v6 */ 832 if (sp->pp_flags & PP_CISCO) 833 protocol = htons (ETHERTYPE_IPV6); 834 else { 835 /* 836 * Don't choke with an ENETDOWN early. It's 837 * possible that we just started dialing out, 838 * so don't drop the packet immediately. If 839 * we notice that we run out of buffer space 840 * below, we will however remember that we are 841 * not ready to carry IPv6 packets, and return 842 * ENETDOWN, as opposed to ENOBUFS. 843 */ 844 protocol = htons(PPP_IPV6); 845 if (sp->state[IDX_IPV6CP] != STATE_OPENED) 846 rv = ENETDOWN; 847 } 848 break; 849 #endif 850 default: 851 m_freem(m); 852 ++ifp->if_oerrors; 853 splx(s); 854 return (EAFNOSUPPORT); 855 } 856 857 if (sp->pp_flags & PP_NOFRAMING) { 858 M_PREPEND(m, 2, M_DONTWAIT); 859 if (m == NULL) { 860 if (ifp->if_flags & IFF_DEBUG) 861 log(LOG_DEBUG, SPP_FMT 862 "no memory for transmit header\n", 863 SPP_ARGS(ifp)); 864 ++ifp->if_oerrors; 865 splx(s); 866 return (ENOBUFS); 867 } 868 *mtod(m, u_int16_t *) = protocol; 869 } else 870 h->protocol = protocol; 871 872 /* 873 * Queue message on interface, and start output if interface 874 * not yet active. 875 */ 876 len = m->m_pkthdr.len; 877 if (ifq != NULL 878 #ifdef ALTQ 879 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0 880 #endif 881 ) { 882 if (IF_QFULL (ifq)) { 883 IF_DROP (&ifp->if_snd); 884 m_freem (m); 885 if (rv == 0) 886 rv = ENOBUFS; 887 } else 888 IF_ENQUEUE (ifq, m); 889 } else 890 IFQ_ENQUEUE(&ifp->if_snd, m, NULL, rv); 891 892 if (rv != 0) { 893 ++ifp->if_oerrors; 894 splx (s); 895 return (rv); 896 } 897 898 if (!(ifp->if_flags & IFF_OACTIVE)) 899 (*ifp->if_start) (ifp); 900 901 /* 902 * Count output packets and bytes. 903 * The packet length includes header, FCS and 1 flag, 904 * according to RFC 1333. 905 */ 906 ifp->if_obytes += len + sp->pp_framebytes; 907 splx (s); 908 return (0); 909 } 910 911 void 912 sppp_attach(struct ifnet *ifp) 913 { 914 struct sppp *sp = (struct sppp*) ifp; 915 int i; 916 917 /* Initialize keepalive handler. */ 918 if (! spppq) { 919 #if defined (__FreeBSD__) 920 keepalive_ch = timeout(sppp_keepalive, 0, hz * 10); 921 #elif defined(__OpenBSD__) 922 timeout_set(&keepalive_ch, sppp_keepalive, NULL); 923 timeout_add_sec(&keepalive_ch, 10); 924 #endif 925 } 926 927 /* Insert new entry into the keepalive list. */ 928 sp->pp_next = spppq; 929 spppq = sp; 930 931 sp->pp_if.if_type = IFT_PPP; 932 sp->pp_if.if_output = sppp_output; 933 IFQ_SET_MAXLEN(&sp->pp_if.if_snd, 50); 934 sp->pp_fastq.ifq_maxlen = 50; 935 sp->pp_cpq.ifq_maxlen = 50; 936 sp->pp_loopcnt = 0; 937 sp->pp_alivecnt = 0; 938 sp->pp_last_activity = 0; 939 sp->pp_last_receive = 0; 940 sp->pp_seq = 0; 941 sp->pp_rseq = 0; 942 sp->pp_phase = PHASE_DEAD; 943 sp->pp_up = lcp.Up; 944 sp->pp_down = lcp.Down; 945 946 947 for (i = 0; i < IDX_COUNT; i++) 948 timeout_set(&sp->ch[i], (cps[i])->TO, (void *)sp); 949 timeout_set(&sp->pap_my_to_ch, sppp_pap_my_TO, (void *)sp); 950 951 sppp_lcp_init(sp); 952 sppp_ipcp_init(sp); 953 sppp_ipv6cp_init(sp); 954 sppp_pap_init(sp); 955 sppp_chap_init(sp); 956 } 957 958 void 959 sppp_detach(struct ifnet *ifp) 960 { 961 struct sppp **q, *p, *sp = (struct sppp*) ifp; 962 int i; 963 964 /* Remove the entry from the keepalive list. */ 965 for (q = &spppq; (p = *q); q = &p->pp_next) 966 if (p == sp) { 967 *q = p->pp_next; 968 break; 969 } 970 971 /* Stop keepalive handler. */ 972 if (! spppq) 973 UNTIMEOUT(sppp_keepalive, 0, keepalive_ch); 974 975 for (i = 0; i < IDX_COUNT; i++) 976 UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]); 977 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 978 979 /* release authentication data */ 980 if (sp->myauth.name != NULL) 981 free(sp->myauth.name, M_DEVBUF); 982 if (sp->myauth.secret != NULL) 983 free(sp->myauth.secret, M_DEVBUF); 984 if (sp->hisauth.name != NULL) 985 free(sp->hisauth.name, M_DEVBUF); 986 if (sp->hisauth.secret != NULL) 987 free(sp->hisauth.secret, M_DEVBUF); 988 } 989 990 /* 991 * Flush the interface output queue. 992 */ 993 void 994 sppp_flush(struct ifnet *ifp) 995 { 996 struct sppp *sp = (struct sppp*) ifp; 997 998 IFQ_PURGE(&sp->pp_if.if_snd); 999 sppp_qflush (&sp->pp_fastq); 1000 sppp_qflush (&sp->pp_cpq); 1001 } 1002 1003 /* 1004 * Check if the output queue is empty. 1005 */ 1006 int 1007 sppp_isempty(struct ifnet *ifp) 1008 { 1009 struct sppp *sp = (struct sppp*) ifp; 1010 int empty, s; 1011 1012 s = splnet(); 1013 empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head && 1014 IFQ_IS_EMPTY(&sp->pp_if.if_snd); 1015 splx(s); 1016 return (empty); 1017 } 1018 1019 /* 1020 * Get next packet to send. 1021 */ 1022 struct mbuf * 1023 sppp_dequeue(struct ifnet *ifp) 1024 { 1025 struct sppp *sp = (struct sppp*) ifp; 1026 struct mbuf *m; 1027 int s; 1028 1029 s = splnet(); 1030 /* 1031 * Process only the control protocol queue until we have at 1032 * least one NCP open. 1033 * 1034 * Do always serve all three queues in Cisco mode. 1035 */ 1036 IF_DEQUEUE(&sp->pp_cpq, m); 1037 if (m == NULL && 1038 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) { 1039 IF_DEQUEUE(&sp->pp_fastq, m); 1040 if (m == NULL) 1041 IFQ_DEQUEUE (&sp->pp_if.if_snd, m); 1042 } 1043 splx(s); 1044 return m; 1045 } 1046 1047 /* 1048 * Pick the next packet, do not remove it from the queue. 1049 */ 1050 struct mbuf * 1051 sppp_pick(struct ifnet *ifp) 1052 { 1053 struct sppp *sp = (struct sppp*)ifp; 1054 struct mbuf *m; 1055 int s; 1056 1057 s = splnet(); 1058 m = sp->pp_cpq.ifq_head; 1059 if (m == NULL && 1060 (sp->pp_phase == PHASE_NETWORK || 1061 (sp->pp_flags & PP_CISCO) != 0)) 1062 if ((m = sp->pp_fastq.ifq_head) == NULL) 1063 IFQ_POLL(&sp->pp_if.if_snd, m); 1064 splx (s); 1065 return (m); 1066 } 1067 1068 /* 1069 * Process an ioctl request. Called on low priority level. 1070 */ 1071 int 1072 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1073 { 1074 struct ifreq *ifr = (struct ifreq*) data; 1075 struct sppp *sp = (struct sppp*) ifp; 1076 int s, rv, going_up, going_down, newmode; 1077 1078 s = splnet(); 1079 rv = 0; 1080 switch (cmd) { 1081 case SIOCAIFADDR: 1082 case SIOCSIFDSTADDR: 1083 break; 1084 1085 case SIOCSIFADDR: 1086 if_up(ifp); 1087 /* FALLTHROUGH */ 1088 1089 case SIOCSIFFLAGS: 1090 going_up = (ifp->if_flags & IFF_UP) && 1091 (ifp->if_flags & IFF_RUNNING) == 0; 1092 going_down = (ifp->if_flags & IFF_UP) == 0 && 1093 (ifp->if_flags & IFF_RUNNING); 1094 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE); 1095 if (newmode == (IFF_AUTO | IFF_PASSIVE)) { 1096 /* sanity */ 1097 newmode = IFF_PASSIVE; 1098 ifp->if_flags &= ~IFF_AUTO; 1099 } 1100 1101 if (going_up || going_down) 1102 if (!(sp->pp_flags & PP_CISCO)) 1103 lcp.Close(sp); 1104 1105 if (going_up && newmode == 0) { 1106 /* neither auto-dial nor passive */ 1107 ifp->if_flags |= IFF_RUNNING; 1108 if (!(sp->pp_flags & PP_CISCO)) 1109 lcp.Open(sp); 1110 } else if (going_down) { 1111 sppp_flush(ifp); 1112 ifp->if_flags &= ~IFF_RUNNING; 1113 } 1114 break; 1115 1116 #ifdef SIOCSIFMTU 1117 case SIOCSIFMTU: 1118 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) { 1119 splx(s); 1120 return (EINVAL); 1121 } 1122 ifp->if_mtu = ifr->ifr_mtu; 1123 break; 1124 #endif 1125 #ifdef SLIOCSETMTU 1126 case SLIOCSETMTU: 1127 if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) { 1128 splx(s); 1129 return (EINVAL); 1130 } 1131 ifp->if_mtu = *(short*)data; 1132 break; 1133 #endif 1134 #ifdef SIOCGIFMTU 1135 case SIOCGIFMTU: 1136 ifr->ifr_mtu = ifp->if_mtu; 1137 break; 1138 #endif 1139 #ifdef SLIOCGETMTU 1140 case SLIOCGETMTU: 1141 *(short*)data = ifp->if_mtu; 1142 break; 1143 #endif 1144 case SIOCADDMULTI: 1145 case SIOCDELMULTI: 1146 break; 1147 1148 case SIOCGIFGENERIC: 1149 rv = sppp_get_params(sp, ifr); 1150 break; 1151 1152 case SIOCSIFGENERIC: 1153 rv = sppp_set_params(sp, ifr); 1154 break; 1155 1156 default: 1157 rv = ENOTTY; 1158 } 1159 splx(s); 1160 return rv; 1161 } 1162 1163 1164 /* 1165 * Cisco framing implementation. 1166 */ 1167 1168 /* 1169 * Handle incoming Cisco keepalive protocol packets. 1170 */ 1171 HIDE void 1172 sppp_cisco_input(struct sppp *sp, struct mbuf *m) 1173 { 1174 STDDCL; 1175 struct cisco_packet *h; 1176 u_int32_t me, mymask; 1177 1178 if (m->m_pkthdr.len < CISCO_PACKET_LEN) { 1179 if (debug) 1180 log(LOG_DEBUG, 1181 SPP_FMT "cisco invalid packet length: %d bytes\n", 1182 SPP_ARGS(ifp), m->m_pkthdr.len); 1183 return; 1184 } 1185 h = mtod (m, struct cisco_packet*); 1186 if (debug) 1187 log(LOG_DEBUG, 1188 SPP_FMT "cisco input: %d bytes " 1189 "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n", 1190 SPP_ARGS(ifp), m->m_pkthdr.len, 1191 ntohl(h->type), h->par1, h->par2, (u_int)h->rel, 1192 (u_int)h->time0, (u_int)h->time1); 1193 switch (ntohl (h->type)) { 1194 default: 1195 if (debug) 1196 addlog(SPP_FMT "cisco unknown packet type: 0x%x\n", 1197 SPP_ARGS(ifp), ntohl(h->type)); 1198 break; 1199 case CISCO_ADDR_REPLY: 1200 /* Reply on address request, ignore */ 1201 break; 1202 case CISCO_KEEPALIVE_REQ: 1203 sp->pp_alivecnt = 0; 1204 sp->pp_rseq = ntohl (h->par1); 1205 if (sp->pp_seq == sp->pp_rseq) { 1206 /* Local and remote sequence numbers are equal. 1207 * Probably, the line is in loopback mode. */ 1208 if (sp->pp_loopcnt >= LOOPALIVECNT) { 1209 log(LOG_INFO, SPP_FMT "loopback\n", 1210 SPP_ARGS(ifp)); 1211 sp->pp_loopcnt = 0; 1212 if (ifp->if_flags & IFF_UP) { 1213 if_down (ifp); 1214 sppp_qflush (&sp->pp_cpq); 1215 } 1216 } 1217 ++sp->pp_loopcnt; 1218 1219 /* Generate new local sequence number */ 1220 #if defined (__FreeBSD__) || defined (__NetBSD__) || defined(__OpenBSD__) 1221 sp->pp_seq = arc4random(); 1222 #else 1223 sp->pp_seq ^= time.tv_sec ^ time.tv_usec; 1224 #endif 1225 break; 1226 } 1227 sp->pp_loopcnt = 0; 1228 if (! (ifp->if_flags & IFF_UP) && 1229 (ifp->if_flags & IFF_RUNNING)) { 1230 if_up(ifp); 1231 if (debug) 1232 log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp)); 1233 } 1234 break; 1235 case CISCO_ADDR_REQ: 1236 sppp_get_ip_addrs(sp, &me, 0, &mymask); 1237 if (me != 0) 1238 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask); 1239 break; 1240 } 1241 } 1242 1243 /* 1244 * Send Cisco keepalive packet. 1245 */ 1246 HIDE void 1247 sppp_cisco_send(struct sppp *sp, u_int32_t type, u_int32_t par1, u_int32_t par2) 1248 { 1249 STDDCL; 1250 struct ppp_header *h; 1251 struct cisco_packet *ch; 1252 struct mbuf *m; 1253 struct timeval tv; 1254 1255 getmicrouptime(&tv); 1256 1257 MGETHDR (m, M_DONTWAIT, MT_DATA); 1258 if (! m) 1259 return; 1260 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN; 1261 m->m_pkthdr.rcvif = 0; 1262 1263 h = mtod (m, struct ppp_header*); 1264 h->address = CISCO_MULTICAST; 1265 h->control = 0; 1266 h->protocol = htons (CISCO_KEEPALIVE); 1267 1268 ch = (struct cisco_packet*) (h + 1); 1269 ch->type = htonl (type); 1270 ch->par1 = htonl (par1); 1271 ch->par2 = htonl (par2); 1272 ch->rel = -1; 1273 1274 ch->time0 = htons ((u_short) (tv.tv_sec >> 16)); 1275 ch->time1 = htons ((u_short) tv.tv_sec); 1276 1277 if (debug) 1278 log(LOG_DEBUG, SPP_FMT 1279 "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n", 1280 SPP_ARGS(ifp), ntohl(ch->type), ch->par1, ch->par2, 1281 (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1); 1282 1283 if (IF_QFULL (&sp->pp_cpq)) { 1284 IF_DROP (&sp->pp_fastq); 1285 IF_DROP (&ifp->if_snd); 1286 m_freem (m); 1287 m = NULL; 1288 } else 1289 IF_ENQUEUE (&sp->pp_cpq, m); 1290 if (! (ifp->if_flags & IFF_OACTIVE)) 1291 (*ifp->if_start) (ifp); 1292 if (m != NULL) 1293 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1294 } 1295 1296 /* 1297 * PPP protocol implementation. 1298 */ 1299 1300 /* 1301 * Send PPP control protocol packet. 1302 */ 1303 HIDE void 1304 sppp_cp_send(struct sppp *sp, u_short proto, u_char type, 1305 u_char ident, u_short len, void *data) 1306 { 1307 STDDCL; 1308 struct ppp_header *h; 1309 struct lcp_header *lh; 1310 struct mbuf *m; 1311 size_t pkthdrlen; 1312 1313 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN; 1314 1315 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) 1316 len = MHLEN - pkthdrlen - LCP_HEADER_LEN; 1317 MGETHDR (m, M_DONTWAIT, MT_DATA); 1318 if (! m) 1319 return; 1320 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 1321 m->m_pkthdr.rcvif = 0; 1322 1323 if (sp->pp_flags & PP_NOFRAMING) { 1324 *mtod(m, u_int16_t *) = htons(proto); 1325 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 1326 } else { 1327 h = mtod (m, struct ppp_header*); 1328 h->address = PPP_ALLSTATIONS; /* broadcast address */ 1329 h->control = PPP_UI; /* Unnumbered Info */ 1330 h->protocol = htons (proto); /* Link Control Protocol */ 1331 lh = (struct lcp_header*) (h + 1); 1332 } 1333 lh->type = type; 1334 lh->ident = ident; 1335 lh->len = htons (LCP_HEADER_LEN + len); 1336 if (len) 1337 bcopy (data, lh+1, len); 1338 1339 if (debug) { 1340 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 1341 SPP_ARGS(ifp), 1342 sppp_proto_name(proto), 1343 sppp_cp_type_name (lh->type), lh->ident, 1344 ntohs (lh->len)); 1345 if (len) 1346 sppp_print_bytes ((u_char*) (lh+1), len); 1347 addlog(">\n"); 1348 } 1349 if (IF_QFULL (&sp->pp_cpq)) { 1350 IF_DROP (&sp->pp_fastq); 1351 IF_DROP (&ifp->if_snd); 1352 m_freem (m); 1353 ++ifp->if_oerrors; 1354 m = NULL; 1355 } else 1356 IF_ENQUEUE (&sp->pp_cpq, m); 1357 if (!(ifp->if_flags & IFF_OACTIVE)) 1358 (*ifp->if_start) (ifp); 1359 if (m != NULL) 1360 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 1361 } 1362 1363 /* 1364 * Handle incoming PPP control protocol packets. 1365 */ 1366 HIDE void 1367 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m) 1368 { 1369 STDDCL; 1370 struct lcp_header *h; 1371 int len = m->m_pkthdr.len; 1372 int rv; 1373 u_char *p; 1374 u_long nmagic; 1375 1376 if (len < 4) { 1377 if (debug) 1378 log(LOG_DEBUG, 1379 SPP_FMT "%s invalid packet length: %d bytes\n", 1380 SPP_ARGS(ifp), cp->name, len); 1381 return; 1382 } 1383 h = mtod (m, struct lcp_header*); 1384 if (debug) { 1385 log(LOG_DEBUG, 1386 SPP_FMT "%s input(%s): <%s id=0x%x len=%d", 1387 SPP_ARGS(ifp), cp->name, 1388 sppp_state_name(sp->state[cp->protoidx]), 1389 sppp_cp_type_name (h->type), h->ident, ntohs (h->len)); 1390 if (len > 4) 1391 sppp_print_bytes ((u_char*) (h+1), len-4); 1392 addlog(">\n"); 1393 } 1394 if (len > ntohs (h->len)) 1395 len = ntohs (h->len); 1396 p = (u_char *)(h + 1); 1397 switch (h->type) { 1398 case CONF_REQ: 1399 if (len < 4) { 1400 if (debug) 1401 addlog(SPP_FMT "%s invalid conf-req length %d\n", 1402 SPP_ARGS(ifp), cp->name, 1403 len); 1404 ++ifp->if_ierrors; 1405 break; 1406 } 1407 /* handle states where RCR doesn't get a SCA/SCN */ 1408 switch (sp->state[cp->protoidx]) { 1409 case STATE_CLOSING: 1410 case STATE_STOPPING: 1411 return; 1412 case STATE_CLOSED: 1413 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 1414 0, 0); 1415 return; 1416 } 1417 rv = (cp->RCR)(sp, h, len); 1418 /* silently drop illegal packets */ 1419 if (rv == -1) 1420 return; 1421 switch (sp->state[cp->protoidx]) { 1422 case STATE_OPENED: 1423 sppp_cp_change_state(cp, sp, rv? 1424 STATE_ACK_SENT: STATE_REQ_SENT); 1425 (cp->tld)(sp); 1426 (cp->scr)(sp); 1427 break; 1428 case STATE_ACK_SENT: 1429 case STATE_REQ_SENT: 1430 sppp_cp_change_state(cp, sp, rv? 1431 STATE_ACK_SENT: STATE_REQ_SENT); 1432 break; 1433 case STATE_STOPPED: 1434 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1435 sppp_cp_change_state(cp, sp, rv? 1436 STATE_ACK_SENT: STATE_REQ_SENT); 1437 (cp->scr)(sp); 1438 break; 1439 case STATE_ACK_RCVD: 1440 if (rv) { 1441 sppp_cp_change_state(cp, sp, STATE_OPENED); 1442 if (debug) 1443 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1444 SPP_ARGS(ifp), 1445 cp->name); 1446 (cp->tlu)(sp); 1447 } else 1448 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1449 break; 1450 default: 1451 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1452 SPP_ARGS(ifp), cp->name, 1453 sppp_cp_type_name(h->type), 1454 sppp_state_name(sp->state[cp->protoidx])); */ 1455 ++ifp->if_ierrors; 1456 } 1457 break; 1458 case CONF_ACK: 1459 if (h->ident != sp->confid[cp->protoidx]) { 1460 if (debug) 1461 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1462 SPP_ARGS(ifp), cp->name, 1463 h->ident, sp->confid[cp->protoidx]); 1464 ++ifp->if_ierrors; 1465 break; 1466 } 1467 switch (sp->state[cp->protoidx]) { 1468 case STATE_CLOSED: 1469 case STATE_STOPPED: 1470 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1471 break; 1472 case STATE_CLOSING: 1473 case STATE_STOPPING: 1474 break; 1475 case STATE_REQ_SENT: 1476 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1477 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1478 break; 1479 case STATE_OPENED: 1480 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1481 (cp->tld)(sp); 1482 (cp->scr)(sp); 1483 break; 1484 case STATE_ACK_RCVD: 1485 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1486 (cp->scr)(sp); 1487 break; 1488 case STATE_ACK_SENT: 1489 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1490 sppp_cp_change_state(cp, sp, STATE_OPENED); 1491 if (debug) 1492 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 1493 SPP_ARGS(ifp), cp->name); 1494 (cp->tlu)(sp); 1495 break; 1496 default: 1497 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1498 SPP_ARGS(ifp), cp->name, 1499 sppp_cp_type_name(h->type), 1500 sppp_state_name(sp->state[cp->protoidx])); */ 1501 ++ifp->if_ierrors; 1502 } 1503 break; 1504 case CONF_NAK: 1505 case CONF_REJ: 1506 if (h->ident != sp->confid[cp->protoidx]) { 1507 if (debug) 1508 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n", 1509 SPP_ARGS(ifp), cp->name, 1510 h->ident, sp->confid[cp->protoidx]); 1511 ++ifp->if_ierrors; 1512 break; 1513 } 1514 if (h->type == CONF_NAK) 1515 (cp->RCN_nak)(sp, h, len); 1516 else /* CONF_REJ */ 1517 (cp->RCN_rej)(sp, h, len); 1518 1519 switch (sp->state[cp->protoidx]) { 1520 case STATE_CLOSED: 1521 case STATE_STOPPED: 1522 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1523 break; 1524 case STATE_REQ_SENT: 1525 case STATE_ACK_SENT: 1526 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1527 (cp->scr)(sp); 1528 break; 1529 case STATE_OPENED: 1530 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1531 (cp->tld)(sp); 1532 (cp->scr)(sp); 1533 break; 1534 case STATE_ACK_RCVD: 1535 sppp_cp_change_state(cp, sp, STATE_ACK_SENT); 1536 (cp->scr)(sp); 1537 break; 1538 case STATE_CLOSING: 1539 case STATE_STOPPING: 1540 break; 1541 default: 1542 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1543 SPP_ARGS(ifp), cp->name, 1544 sppp_cp_type_name(h->type), 1545 sppp_state_name(sp->state[cp->protoidx])); */ 1546 ++ifp->if_ierrors; 1547 } 1548 break; 1549 1550 case TERM_REQ: 1551 switch (sp->state[cp->protoidx]) { 1552 case STATE_ACK_RCVD: 1553 case STATE_ACK_SENT: 1554 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1555 /* FALLTHROUGH */ 1556 case STATE_CLOSED: 1557 case STATE_STOPPED: 1558 case STATE_CLOSING: 1559 case STATE_STOPPING: 1560 case STATE_REQ_SENT: 1561 sta: 1562 /* Send Terminate-Ack packet. */ 1563 if (debug) 1564 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n", 1565 SPP_ARGS(ifp), cp->name); 1566 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0); 1567 break; 1568 case STATE_OPENED: 1569 sp->rst_counter[cp->protoidx] = 0; 1570 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1571 (cp->tld)(sp); 1572 goto sta; 1573 break; 1574 default: 1575 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1576 SPP_ARGS(ifp), cp->name, 1577 sppp_cp_type_name(h->type), 1578 sppp_state_name(sp->state[cp->protoidx])); */ 1579 ++ifp->if_ierrors; 1580 } 1581 break; 1582 case TERM_ACK: 1583 switch (sp->state[cp->protoidx]) { 1584 case STATE_CLOSED: 1585 case STATE_STOPPED: 1586 case STATE_REQ_SENT: 1587 case STATE_ACK_SENT: 1588 break; 1589 case STATE_CLOSING: 1590 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1591 (cp->tlf)(sp); 1592 break; 1593 case STATE_STOPPING: 1594 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1595 (cp->tlf)(sp); 1596 break; 1597 case STATE_ACK_RCVD: 1598 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1599 break; 1600 case STATE_OPENED: 1601 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD); 1602 (cp->tld)(sp); 1603 (cp->scr)(sp); 1604 break; 1605 default: 1606 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1607 SPP_ARGS(ifp), cp->name, 1608 sppp_cp_type_name(h->type), 1609 sppp_state_name(sp->state[cp->protoidx])); */ 1610 ++ifp->if_ierrors; 1611 } 1612 break; 1613 case CODE_REJ: 1614 case PROTO_REJ: 1615 { 1616 int catastrophic = 0; 1617 const struct cp *upper = NULL; 1618 int i; 1619 u_int16_t proto; 1620 1621 if (len < 2) { 1622 if (debug) 1623 log(LOG_DEBUG, SPP_FMT "invalid proto-rej length\n", 1624 SPP_ARGS(ifp)); 1625 ++ifp->if_ierrors; 1626 break; 1627 } 1628 1629 proto = ntohs(*((u_int16_t *)p)); 1630 for (i = 0; i < IDX_COUNT; i++) { 1631 if (cps[i]->proto == proto) { 1632 upper = cps[i]; 1633 break; 1634 } 1635 } 1636 if (upper == NULL) 1637 catastrophic++; 1638 1639 if (catastrophic || debug) 1640 log(catastrophic? LOG_INFO: LOG_DEBUG, 1641 SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n", 1642 SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+', 1643 sppp_cp_type_name(h->type), proto, 1644 upper ? upper->name : "unknown", 1645 upper ? sppp_state_name(sp->state[upper->protoidx]) : "?"); 1646 1647 /* 1648 * if we got RXJ+ against conf-req, the peer does not implement 1649 * this particular protocol type. terminate the protocol. 1650 */ 1651 if (upper) { 1652 if (sp->state[upper->protoidx] == STATE_REQ_SENT) { 1653 upper->Close(sp); 1654 break; 1655 } 1656 } 1657 1658 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */ 1659 switch (sp->state[cp->protoidx]) { 1660 case STATE_CLOSED: 1661 case STATE_STOPPED: 1662 case STATE_REQ_SENT: 1663 case STATE_ACK_SENT: 1664 case STATE_CLOSING: 1665 case STATE_STOPPING: 1666 case STATE_OPENED: 1667 break; 1668 case STATE_ACK_RCVD: 1669 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1670 break; 1671 default: 1672 /* printf(SPP_FMT "%s illegal %s in state %s\n", 1673 SPP_ARGS(ifp), cp->name, 1674 sppp_cp_type_name(h->type), 1675 sppp_state_name(sp->state[cp->protoidx])); */ 1676 ++ifp->if_ierrors; 1677 } 1678 break; 1679 } 1680 case DISC_REQ: 1681 if (cp->proto != PPP_LCP) 1682 goto illegal; 1683 /* Discard the packet. */ 1684 break; 1685 case ECHO_REQ: 1686 if (cp->proto != PPP_LCP) 1687 goto illegal; 1688 if (sp->state[cp->protoidx] != STATE_OPENED) { 1689 if (debug) 1690 addlog(SPP_FMT "lcp echo req but lcp closed\n", 1691 SPP_ARGS(ifp)); 1692 ++ifp->if_ierrors; 1693 break; 1694 } 1695 if (len < 8) { 1696 if (debug) 1697 addlog(SPP_FMT "invalid lcp echo request " 1698 "packet length: %d bytes\n", 1699 SPP_ARGS(ifp), len); 1700 break; 1701 } 1702 1703 nmagic = (u_long)p[0] << 24 | 1704 (u_long)p[1] << 16 | p[2] << 8 | p[3]; 1705 1706 if (nmagic == sp->lcp.magic) { 1707 /* Line loopback mode detected. */ 1708 log(LOG_INFO, SPP_FMT "loopback\n", SPP_ARGS(ifp)); 1709 /* Shut down the PPP link. */ 1710 lcp.Close(sp); 1711 break; 1712 } 1713 1714 p[0] = sp->lcp.magic >> 24; 1715 p[1] = sp->lcp.magic >> 16; 1716 p[2] = sp->lcp.magic >> 8; 1717 p[3] = sp->lcp.magic; 1718 1719 if (debug) 1720 addlog(SPP_FMT "got lcp echo req, sending echo rep\n", 1721 SPP_ARGS(ifp)); 1722 sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1); 1723 break; 1724 case ECHO_REPLY: 1725 if (cp->proto != PPP_LCP) 1726 goto illegal; 1727 if (h->ident != sp->lcp.echoid) { 1728 ++ifp->if_ierrors; 1729 break; 1730 } 1731 if (len < 8) { 1732 if (debug) 1733 addlog(SPP_FMT "lcp invalid echo reply " 1734 "packet length: %d bytes\n", 1735 SPP_ARGS(ifp), len); 1736 break; 1737 } 1738 if (debug) 1739 addlog(SPP_FMT "lcp got echo rep\n", 1740 SPP_ARGS(ifp)); 1741 1742 nmagic = (u_long)p[0] << 24 | 1743 (u_long)p[1] << 16 | p[2] << 8 | p[3]; 1744 1745 if (nmagic != sp->lcp.magic) 1746 sp->pp_alivecnt = 0; 1747 break; 1748 default: 1749 /* Unknown packet type -- send Code-Reject packet. */ 1750 illegal: 1751 if (debug) 1752 addlog(SPP_FMT "%s send code-rej for 0x%x\n", 1753 SPP_ARGS(ifp), cp->name, h->type); 1754 sppp_cp_send(sp, cp->proto, CODE_REJ, ++sp->pp_seq, 1755 m->m_pkthdr.len, h); 1756 ++ifp->if_ierrors; 1757 } 1758 } 1759 1760 1761 /* 1762 * The generic part of all Up/Down/Open/Close/TO event handlers. 1763 * Basically, the state transition handling in the automaton. 1764 */ 1765 HIDE void 1766 sppp_up_event(const struct cp *cp, struct sppp *sp) 1767 { 1768 STDDCL; 1769 1770 if (debug) 1771 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n", 1772 SPP_ARGS(ifp), cp->name, 1773 sppp_state_name(sp->state[cp->protoidx])); 1774 1775 switch (sp->state[cp->protoidx]) { 1776 case STATE_INITIAL: 1777 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1778 break; 1779 case STATE_STARTING: 1780 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1781 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1782 (cp->scr)(sp); 1783 break; 1784 default: 1785 /* printf(SPP_FMT "%s illegal up in state %s\n", 1786 SPP_ARGS(ifp), cp->name, 1787 sppp_state_name(sp->state[cp->protoidx])); */ 1788 break; 1789 } 1790 } 1791 1792 HIDE void 1793 sppp_down_event(const struct cp *cp, struct sppp *sp) 1794 { 1795 STDDCL; 1796 1797 if (debug) 1798 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n", 1799 SPP_ARGS(ifp), cp->name, 1800 sppp_state_name(sp->state[cp->protoidx])); 1801 1802 switch (sp->state[cp->protoidx]) { 1803 case STATE_CLOSED: 1804 case STATE_CLOSING: 1805 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1806 break; 1807 case STATE_STOPPED: 1808 sppp_cp_change_state(cp, sp, STATE_STARTING); 1809 (cp->tls)(sp); 1810 break; 1811 case STATE_STOPPING: 1812 case STATE_REQ_SENT: 1813 case STATE_ACK_RCVD: 1814 case STATE_ACK_SENT: 1815 sppp_cp_change_state(cp, sp, STATE_STARTING); 1816 break; 1817 case STATE_OPENED: 1818 sppp_cp_change_state(cp, sp, STATE_STARTING); 1819 (cp->tld)(sp); 1820 break; 1821 default: 1822 /* printf(SPP_FMT "%s illegal down in state %s\n", 1823 SPP_ARGS(ifp), cp->name, 1824 sppp_state_name(sp->state[cp->protoidx])); */ 1825 break; 1826 } 1827 } 1828 1829 1830 HIDE void 1831 sppp_open_event(const struct cp *cp, struct sppp *sp) 1832 { 1833 STDDCL; 1834 1835 if (debug) 1836 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n", 1837 SPP_ARGS(ifp), cp->name, 1838 sppp_state_name(sp->state[cp->protoidx])); 1839 1840 switch (sp->state[cp->protoidx]) { 1841 case STATE_INITIAL: 1842 sppp_cp_change_state(cp, sp, STATE_STARTING); 1843 (cp->tls)(sp); 1844 break; 1845 case STATE_STARTING: 1846 break; 1847 case STATE_CLOSED: 1848 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure; 1849 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1850 (cp->scr)(sp); 1851 break; 1852 case STATE_STOPPED: 1853 case STATE_STOPPING: 1854 case STATE_REQ_SENT: 1855 case STATE_ACK_RCVD: 1856 case STATE_ACK_SENT: 1857 case STATE_OPENED: 1858 break; 1859 case STATE_CLOSING: 1860 sppp_cp_change_state(cp, sp, STATE_STOPPING); 1861 break; 1862 } 1863 } 1864 1865 1866 HIDE void 1867 sppp_close_event(const struct cp *cp, struct sppp *sp) 1868 { 1869 STDDCL; 1870 1871 if (debug) 1872 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n", 1873 SPP_ARGS(ifp), cp->name, 1874 sppp_state_name(sp->state[cp->protoidx])); 1875 1876 switch (sp->state[cp->protoidx]) { 1877 case STATE_INITIAL: 1878 case STATE_CLOSED: 1879 case STATE_CLOSING: 1880 break; 1881 case STATE_STARTING: 1882 sppp_cp_change_state(cp, sp, STATE_INITIAL); 1883 (cp->tlf)(sp); 1884 break; 1885 case STATE_STOPPED: 1886 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1887 break; 1888 case STATE_STOPPING: 1889 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1890 break; 1891 case STATE_OPENED: 1892 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1893 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1894 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0); 1895 (cp->tld)(sp); 1896 break; 1897 case STATE_REQ_SENT: 1898 case STATE_ACK_RCVD: 1899 case STATE_ACK_SENT: 1900 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate; 1901 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0); 1902 sppp_cp_change_state(cp, sp, STATE_CLOSING); 1903 break; 1904 } 1905 } 1906 1907 HIDE void 1908 sppp_increasing_timeout (const struct cp *cp, struct sppp *sp) 1909 { 1910 int timo; 1911 1912 timo = sp->lcp.max_configure - sp->rst_counter[cp->protoidx]; 1913 if (timo < 1) 1914 timo = 1; 1915 #if defined(__FreeBSD__) && __FreeBSD__ >= 3 1916 sp->ch[cp->protoidx] = 1917 timeout(cp->TO, (void *)sp, timo * sp->lcp.timeout); 1918 #elif defined(__OpenBSD__) 1919 timeout_add(&sp->ch[cp->protoidx], timo * sp->lcp.timeout); 1920 #endif 1921 } 1922 1923 HIDE void 1924 sppp_to_event(const struct cp *cp, struct sppp *sp) 1925 { 1926 STDDCL; 1927 int s; 1928 1929 s = splnet(); 1930 if (debug) 1931 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n", 1932 SPP_ARGS(ifp), cp->name, 1933 sppp_state_name(sp->state[cp->protoidx]), 1934 sp->rst_counter[cp->protoidx]); 1935 1936 if (--sp->rst_counter[cp->protoidx] < 0) 1937 /* TO- event */ 1938 switch (sp->state[cp->protoidx]) { 1939 case STATE_CLOSING: 1940 sppp_cp_change_state(cp, sp, STATE_CLOSED); 1941 (cp->tlf)(sp); 1942 break; 1943 case STATE_STOPPING: 1944 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1945 (cp->tlf)(sp); 1946 break; 1947 case STATE_REQ_SENT: 1948 case STATE_ACK_RCVD: 1949 case STATE_ACK_SENT: 1950 sppp_cp_change_state(cp, sp, STATE_STOPPED); 1951 (cp->tlf)(sp); 1952 break; 1953 } 1954 else 1955 /* TO+ event */ 1956 switch (sp->state[cp->protoidx]) { 1957 case STATE_CLOSING: 1958 case STATE_STOPPING: 1959 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 1960 0, 0); 1961 sppp_increasing_timeout (cp, sp); 1962 break; 1963 case STATE_REQ_SENT: 1964 case STATE_ACK_RCVD: 1965 /* sppp_cp_change_state() will restart the timer */ 1966 sppp_cp_change_state(cp, sp, STATE_REQ_SENT); 1967 (cp->scr)(sp); 1968 break; 1969 case STATE_ACK_SENT: 1970 sppp_increasing_timeout (cp, sp); 1971 (cp->scr)(sp); 1972 break; 1973 } 1974 1975 splx(s); 1976 } 1977 1978 /* 1979 * Change the state of a control protocol in the state automaton. 1980 * Takes care of starting/stopping the restart timer. 1981 */ 1982 void 1983 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate) 1984 { 1985 STDDCL; 1986 1987 if (debug && sp->state[cp->protoidx] != newstate) 1988 log(LOG_DEBUG, SPP_FMT "%s %s->%s\n", 1989 SPP_ARGS(ifp), cp->name, 1990 sppp_state_name(sp->state[cp->protoidx]), 1991 sppp_state_name(newstate)); 1992 sp->state[cp->protoidx] = newstate; 1993 1994 switch (newstate) { 1995 case STATE_INITIAL: 1996 case STATE_STARTING: 1997 case STATE_CLOSED: 1998 case STATE_STOPPED: 1999 case STATE_OPENED: 2000 UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]); 2001 break; 2002 case STATE_CLOSING: 2003 case STATE_STOPPING: 2004 case STATE_REQ_SENT: 2005 case STATE_ACK_RCVD: 2006 case STATE_ACK_SENT: 2007 if (!timeout_pending(&sp->ch[cp->protoidx])) 2008 sppp_increasing_timeout (cp, sp); 2009 break; 2010 } 2011 } 2012 /* 2013 *--------------------------------------------------------------------------* 2014 * * 2015 * The LCP implementation. * 2016 * * 2017 *--------------------------------------------------------------------------* 2018 */ 2019 HIDE void 2020 sppp_lcp_init(struct sppp *sp) 2021 { 2022 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2023 sp->lcp.magic = 0; 2024 sp->state[IDX_LCP] = STATE_INITIAL; 2025 sp->fail_counter[IDX_LCP] = 0; 2026 sp->lcp.protos = 0; 2027 sp->lcp.mru = sp->lcp.their_mru = sp->pp_if.if_mtu; 2028 2029 /* 2030 * Initialize counters and timeout values. Note that we don't 2031 * use the 3 seconds suggested in RFC 1661 since we are likely 2032 * running on a fast link. XXX We should probably implement 2033 * the exponential backoff option. Note that these values are 2034 * relevant for all control protocols, not just LCP only. 2035 */ 2036 sp->lcp.timeout = 1 * hz; 2037 sp->lcp.max_terminate = 2; 2038 sp->lcp.max_configure = 10; 2039 sp->lcp.max_failure = 10; 2040 #if defined (__FreeBSD__) 2041 callout_handle_init(&sp->ch[IDX_LCP]); 2042 #endif 2043 } 2044 2045 HIDE void 2046 sppp_lcp_up(struct sppp *sp) 2047 { 2048 STDDCL; 2049 struct timeval tv; 2050 2051 if (sp->pp_flags & PP_CISCO) { 2052 int s = splsoftnet(); 2053 sp->pp_if.if_link_state = LINK_STATE_UP; 2054 if_link_state_change(&sp->pp_if); 2055 splx(s); 2056 return; 2057 } 2058 2059 sp->pp_alivecnt = 0; 2060 sp->lcp.opts = (1 << LCP_OPT_MAGIC); 2061 sp->lcp.magic = 0; 2062 sp->lcp.protos = 0; 2063 sp->lcp.mru = sp->lcp.their_mru = sp->pp_if.if_mtu; 2064 2065 getmicrouptime(&tv); 2066 sp->pp_last_receive = sp->pp_last_activity = tv.tv_sec; 2067 2068 /* 2069 * If this interface is passive or dial-on-demand, and we are 2070 * still in Initial state, it means we've got an incoming 2071 * call. Activate the interface. 2072 */ 2073 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) { 2074 if (debug) 2075 log(LOG_DEBUG, 2076 SPP_FMT "Up event", SPP_ARGS(ifp)); 2077 ifp->if_flags |= IFF_RUNNING; 2078 if (sp->state[IDX_LCP] == STATE_INITIAL) { 2079 if (debug) 2080 addlog("(incoming call)\n"); 2081 sp->pp_flags |= PP_CALLIN; 2082 lcp.Open(sp); 2083 } else if (debug) 2084 addlog("\n"); 2085 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 && 2086 (sp->state[IDX_LCP] == STATE_INITIAL)) { 2087 ifp->if_flags |= IFF_RUNNING; 2088 lcp.Open(sp); 2089 } 2090 2091 sppp_up_event(&lcp, sp); 2092 } 2093 2094 HIDE void 2095 sppp_lcp_down(struct sppp *sp) 2096 { 2097 STDDCL; 2098 2099 if (sp->pp_flags & PP_CISCO) { 2100 int s = splsoftnet(); 2101 sp->pp_if.if_link_state = LINK_STATE_DOWN; 2102 if_link_state_change(&sp->pp_if); 2103 splx(s); 2104 return; 2105 } 2106 2107 sppp_down_event(&lcp, sp); 2108 2109 /* 2110 * If this is neither a dial-on-demand nor a passive 2111 * interface, simulate an ``ifconfig down'' action, so the 2112 * administrator can force a redial by another ``ifconfig 2113 * up''. XXX For leased line operation, should we immediately 2114 * try to reopen the connection here? 2115 */ 2116 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) { 2117 if (debug) 2118 log(LOG_DEBUG, SPP_FMT "Down event (carrier loss), " 2119 "taking interface down.", SPP_ARGS(ifp)); 2120 if_down(ifp); 2121 } else { 2122 if (debug) 2123 log(LOG_DEBUG, SPP_FMT "Down event (carrier loss)\n", 2124 SPP_ARGS(ifp)); 2125 } 2126 2127 if (sp->state[IDX_LCP] != STATE_INITIAL) 2128 lcp.Close(sp); 2129 sp->pp_flags &= ~PP_CALLIN; 2130 ifp->if_flags &= ~IFF_RUNNING; 2131 sppp_flush(ifp); 2132 } 2133 2134 HIDE void 2135 sppp_lcp_open(struct sppp *sp) 2136 { 2137 /* 2138 * If we are authenticator, negotiate LCP_AUTH 2139 */ 2140 if (sp->hisauth.proto != 0) 2141 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO); 2142 else 2143 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2144 sp->pp_flags &= ~PP_NEEDAUTH; 2145 sppp_open_event(&lcp, sp); 2146 } 2147 2148 HIDE void 2149 sppp_lcp_close(struct sppp *sp) 2150 { 2151 sppp_close_event(&lcp, sp); 2152 } 2153 2154 HIDE void 2155 sppp_lcp_TO(void *cookie) 2156 { 2157 sppp_to_event(&lcp, (struct sppp *)cookie); 2158 } 2159 2160 /* 2161 * Analyze a configure request. Return true if it was agreeable, and 2162 * caused action sca, false if it has been rejected or nak'ed, and 2163 * caused action scn. (The return value is used to make the state 2164 * transition decision in the state automaton.) 2165 */ 2166 HIDE int 2167 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2168 { 2169 STDDCL; 2170 u_char *buf, *r, *p; 2171 int origlen, rlen; 2172 u_long nmagic; 2173 u_short authproto; 2174 2175 len -= 4; 2176 origlen = len; 2177 buf = r = malloc (len, M_TEMP, M_NOWAIT); 2178 if (! buf) 2179 return (0); 2180 2181 if (debug) 2182 log(LOG_DEBUG, SPP_FMT "lcp parse opts: ", 2183 SPP_ARGS(ifp)); 2184 2185 /* pass 1: check for things that need to be rejected */ 2186 p = (void*) (h+1); 2187 for (rlen = 0; len > 1; len -= p[1], p += p[1]) { 2188 if (p[1] < 2 || p[1] > len) { 2189 free(buf, M_TEMP); 2190 return (-1); 2191 } 2192 if (debug) 2193 addlog("%s ", sppp_lcp_opt_name(*p)); 2194 switch (*p) { 2195 case LCP_OPT_MAGIC: 2196 /* Magic number. */ 2197 /* FALLTHROUGH, both are same length */ 2198 case LCP_OPT_ASYNC_MAP: 2199 /* Async control character map. */ 2200 if (len >= 6 && p[1] == 6) 2201 continue; 2202 if (debug) 2203 addlog("[invalid] "); 2204 break; 2205 case LCP_OPT_MRU: 2206 /* Maximum receive unit. */ 2207 if (len >= 4 && p[1] == 4) 2208 continue; 2209 if (debug) 2210 addlog("[invalid] "); 2211 break; 2212 case LCP_OPT_AUTH_PROTO: 2213 if (len < 4) { 2214 if (debug) 2215 addlog("[invalid] "); 2216 break; 2217 } 2218 authproto = (p[2] << 8) + p[3]; 2219 if (authproto == PPP_CHAP && p[1] != 5) { 2220 if (debug) 2221 addlog("[invalid chap len] "); 2222 break; 2223 } 2224 if (sp->myauth.proto == 0) { 2225 /* we are not configured to do auth */ 2226 if (debug) 2227 addlog("[not configured] "); 2228 break; 2229 } 2230 /* 2231 * Remote want us to authenticate, remember this, 2232 * so we stay in PHASE_AUTHENTICATE after LCP got 2233 * up. 2234 */ 2235 sp->pp_flags |= PP_NEEDAUTH; 2236 continue; 2237 default: 2238 /* Others not supported. */ 2239 if (debug) 2240 addlog("[rej] "); 2241 break; 2242 } 2243 /* Add the option to rejected list. */ 2244 bcopy (p, r, p[1]); 2245 r += p[1]; 2246 rlen += p[1]; 2247 } 2248 if (rlen) { 2249 if (debug) 2250 addlog(" send conf-rej\n"); 2251 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2252 goto end; 2253 } else if (debug) 2254 addlog("\n"); 2255 2256 /* 2257 * pass 2: check for option values that are unacceptable and 2258 * thus require to be nak'ed. 2259 */ 2260 if (debug) 2261 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ", 2262 SPP_ARGS(ifp)); 2263 2264 p = (void*) (h+1); 2265 len = origlen; 2266 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2267 if (debug) 2268 addlog("%s ", sppp_lcp_opt_name(*p)); 2269 switch (*p) { 2270 case LCP_OPT_MAGIC: 2271 /* Magic number -- extract. */ 2272 nmagic = (u_long)p[2] << 24 | 2273 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2274 if (nmagic != sp->lcp.magic) { 2275 if (debug) 2276 addlog("0x%lx ", nmagic); 2277 continue; 2278 } 2279 if (debug) 2280 addlog("[glitch] "); 2281 ++sp->pp_loopcnt; 2282 /* 2283 * We negate our magic here, and NAK it. If 2284 * we see it later in an NAK packet, we 2285 * suggest a new one. 2286 */ 2287 nmagic = ~sp->lcp.magic; 2288 /* Gonna NAK it. */ 2289 p[2] = nmagic >> 24; 2290 p[3] = nmagic >> 16; 2291 p[4] = nmagic >> 8; 2292 p[5] = nmagic; 2293 break; 2294 2295 case LCP_OPT_ASYNC_MAP: 2296 /* Async control character map -- check to be zero. */ 2297 if (! p[2] && ! p[3] && ! p[4] && ! p[5]) { 2298 if (debug) 2299 addlog("[empty] "); 2300 continue; 2301 } 2302 if (debug) 2303 addlog("[non-empty] "); 2304 /* suggest a zero one */ 2305 p[2] = p[3] = p[4] = p[5] = 0; 2306 break; 2307 2308 case LCP_OPT_MRU: 2309 /* 2310 * Maximum receive unit. Always agreeable, 2311 * but ignored by now. 2312 */ 2313 sp->lcp.their_mru = p[2] * 256 + p[3]; 2314 if (debug) 2315 addlog("%lu ", sp->lcp.their_mru); 2316 continue; 2317 2318 case LCP_OPT_AUTH_PROTO: 2319 authproto = (p[2] << 8) + p[3]; 2320 if (sp->myauth.proto != authproto) { 2321 /* not agreed, nak */ 2322 if (debug) 2323 addlog("[mine %s != his %s] ", 2324 sppp_proto_name(sp->hisauth.proto), 2325 sppp_proto_name(authproto)); 2326 p[2] = sp->myauth.proto >> 8; 2327 p[3] = sp->myauth.proto; 2328 break; 2329 } 2330 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) { 2331 if (debug) 2332 addlog("[chap not MD5] "); 2333 p[4] = CHAP_MD5; 2334 break; 2335 } 2336 continue; 2337 } 2338 /* Add the option to nak'ed list. */ 2339 bcopy (p, r, p[1]); 2340 r += p[1]; 2341 rlen += p[1]; 2342 } 2343 if (rlen) { 2344 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) { 2345 if (debug) 2346 addlog(" max_failure (%d) exceeded, " 2347 "send conf-rej\n", 2348 sp->lcp.max_failure); 2349 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf); 2350 } else { 2351 if (debug) 2352 addlog(" send conf-nak\n"); 2353 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf); 2354 } 2355 goto end; 2356 } else { 2357 if (debug) 2358 addlog("send conf-ack\n"); 2359 sp->fail_counter[IDX_LCP] = 0; 2360 sp->pp_loopcnt = 0; 2361 sppp_cp_send (sp, PPP_LCP, CONF_ACK, 2362 h->ident, origlen, h+1); 2363 } 2364 2365 end: 2366 free(buf, M_TEMP); 2367 return (rlen == 0); 2368 } 2369 2370 /* 2371 * Analyze the LCP Configure-Reject option list, and adjust our 2372 * negotiation. 2373 */ 2374 HIDE void 2375 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2376 { 2377 STDDCL; 2378 u_char *p; 2379 2380 len -= 4; 2381 2382 if (debug) 2383 log(LOG_DEBUG, SPP_FMT "lcp rej opts: ", 2384 SPP_ARGS(ifp)); 2385 2386 p = (void*) (h+1); 2387 for (; len > 1; len -= p[1], p += p[1]) { 2388 if (p[1] < 2 || p[1] > len) 2389 return; 2390 if (debug) 2391 addlog("%s ", sppp_lcp_opt_name(*p)); 2392 switch (*p) { 2393 case LCP_OPT_MAGIC: 2394 /* Magic number -- can't use it, use 0 */ 2395 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC); 2396 sp->lcp.magic = 0; 2397 break; 2398 case LCP_OPT_MRU: 2399 /* 2400 * Should not be rejected anyway, since we only 2401 * negotiate a MRU if explicitly requested by 2402 * peer. 2403 */ 2404 sp->lcp.opts &= ~(1 << LCP_OPT_MRU); 2405 break; 2406 case LCP_OPT_AUTH_PROTO: 2407 /* 2408 * Peer doesn't want to authenticate himself, 2409 * deny unless this is a dialout call, and 2410 * AUTHFLAG_NOCALLOUT is set. 2411 */ 2412 if ((sp->pp_flags & PP_CALLIN) == 0 && 2413 (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) { 2414 if (debug) 2415 addlog("[don't insist on auth " 2416 "for callout]"); 2417 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO); 2418 break; 2419 } 2420 if (debug) 2421 addlog("[access denied]\n"); 2422 lcp.Close(sp); 2423 break; 2424 } 2425 } 2426 if (debug) 2427 addlog("\n"); 2428 } 2429 2430 /* 2431 * Analyze the LCP Configure-NAK option list, and adjust our 2432 * negotiation. 2433 */ 2434 HIDE void 2435 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2436 { 2437 STDDCL; 2438 u_char *p; 2439 u_long magic; 2440 2441 len -= 4; 2442 2443 if (debug) 2444 log(LOG_DEBUG, SPP_FMT "lcp nak opts: ", 2445 SPP_ARGS(ifp)); 2446 2447 p = (void*) (h+1); 2448 for (; len > 1; len -= p[1], p += p[1]) { 2449 if (p[1] < 2 || p[1] > len) 2450 return; 2451 if (debug) 2452 addlog("%s ", sppp_lcp_opt_name(*p)); 2453 switch (*p) { 2454 case LCP_OPT_MAGIC: 2455 /* Magic number -- renegotiate */ 2456 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) && 2457 len >= 6 && p[1] == 6) { 2458 magic = (u_long)p[2] << 24 | 2459 (u_long)p[3] << 16 | p[4] << 8 | p[5]; 2460 /* 2461 * If the remote magic is our negated one, 2462 * this looks like a loopback problem. 2463 * Suggest a new magic to make sure. 2464 */ 2465 if (magic == ~sp->lcp.magic) { 2466 if (debug) 2467 addlog("magic glitch "); 2468 sp->lcp.magic = arc4random(); 2469 } else { 2470 sp->lcp.magic = magic; 2471 if (debug) 2472 addlog("%lu ", magic); 2473 } 2474 } 2475 break; 2476 case LCP_OPT_MRU: 2477 /* 2478 * Peer wants to advise us to negotiate an MRU. 2479 * Agree on it if it's reasonable, or use 2480 * default otherwise. 2481 */ 2482 if (len >= 4 && p[1] == 4) { 2483 u_int mru = p[2] * 256 + p[3]; 2484 if (debug) 2485 addlog("%d ", mru); 2486 if (mru < PP_MIN_MRU) 2487 mru = PP_MIN_MRU; 2488 if (mru > PP_MAX_MRU) 2489 mru = PP_MAX_MRU; 2490 sp->lcp.mru = mru; 2491 sp->lcp.opts |= (1 << LCP_OPT_MRU); 2492 } 2493 break; 2494 case LCP_OPT_AUTH_PROTO: 2495 /* 2496 * Peer doesn't like our authentication method, 2497 * deny. 2498 */ 2499 if (debug) 2500 addlog("[access denied]\n"); 2501 lcp.Close(sp); 2502 break; 2503 } 2504 } 2505 if (debug) 2506 addlog("\n"); 2507 } 2508 2509 HIDE void 2510 sppp_lcp_tlu(struct sppp *sp) 2511 { 2512 struct ifnet *ifp = &sp->pp_if; 2513 int i; 2514 u_long mask; 2515 2516 /* XXX ? */ 2517 if (! (ifp->if_flags & IFF_UP) && 2518 (ifp->if_flags & IFF_RUNNING)) { 2519 /* Coming out of loopback mode. */ 2520 if_up(ifp); 2521 if (ifp->if_flags & IFF_DEBUG) 2522 log(LOG_INFO, SPP_FMT "up\n", SPP_ARGS(ifp)); 2523 } 2524 2525 for (i = 0; i < IDX_COUNT; i++) 2526 if ((cps[i])->flags & CP_QUAL) 2527 (cps[i])->Open(sp); 2528 2529 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 || 2530 (sp->pp_flags & PP_NEEDAUTH) != 0) 2531 sp->pp_phase = PHASE_AUTHENTICATE; 2532 else 2533 sp->pp_phase = PHASE_NETWORK; 2534 2535 sppp_set_phase(sp); 2536 2537 /* 2538 * Open all authentication protocols. This is even required 2539 * if we already proceeded to network phase, since it might be 2540 * that remote wants us to authenticate, so we might have to 2541 * send a PAP request. Undesired authentication protocols 2542 * don't do anything when they get an Open event. 2543 */ 2544 for (i = 0; i < IDX_COUNT; i++) 2545 if ((cps[i])->flags & CP_AUTH) 2546 (cps[i])->Open(sp); 2547 2548 if (sp->pp_phase == PHASE_NETWORK) { 2549 /* Notify all NCPs. */ 2550 for (i = 0; i < IDX_COUNT; i++) 2551 if ((cps[i])->flags & CP_NCP) 2552 (cps[i])->Open(sp); 2553 } 2554 2555 /* Send Up events to all started protos. */ 2556 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2557 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) 2558 (cps[i])->Up(sp); 2559 2560 /* notify low-level driver of state change */ 2561 if (sp->pp_chg) 2562 sp->pp_chg(sp, (int)sp->pp_phase); 2563 2564 if (sp->pp_phase == PHASE_NETWORK) 2565 /* if no NCP is starting, close down */ 2566 sppp_lcp_check_and_close(sp); 2567 } 2568 2569 HIDE void 2570 sppp_lcp_tld(struct sppp *sp) 2571 { 2572 int i; 2573 u_long mask; 2574 2575 sp->pp_phase = PHASE_TERMINATE; 2576 2577 sppp_set_phase(sp); 2578 2579 /* 2580 * Take upper layers down. We send the Down event first and 2581 * the Close second to prevent the upper layers from sending 2582 * ``a flurry of terminate-request packets'', as the RFC 2583 * describes it. 2584 */ 2585 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2586 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) { 2587 (cps[i])->Down(sp); 2588 (cps[i])->Close(sp); 2589 } 2590 } 2591 2592 HIDE void 2593 sppp_lcp_tls(struct sppp *sp) 2594 { 2595 sp->pp_phase = PHASE_ESTABLISH; 2596 2597 sppp_set_phase(sp); 2598 2599 /* Notify lower layer if desired. */ 2600 if (sp->pp_tls) 2601 (sp->pp_tls)(sp); 2602 } 2603 2604 HIDE void 2605 sppp_lcp_tlf(struct sppp *sp) 2606 { 2607 sp->pp_phase = PHASE_DEAD; 2608 sppp_set_phase(sp); 2609 2610 /* Notify lower layer if desired. */ 2611 if (sp->pp_tlf) 2612 (sp->pp_tlf)(sp); 2613 } 2614 2615 HIDE void 2616 sppp_lcp_scr(struct sppp *sp) 2617 { 2618 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */]; 2619 int i = 0; 2620 u_short authproto; 2621 2622 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) { 2623 if (! sp->lcp.magic) 2624 #if defined (__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) 2625 sp->lcp.magic = arc4random(); 2626 #else 2627 sp->lcp.magic = time.tv_sec + time.tv_usec; 2628 #endif 2629 opt[i++] = LCP_OPT_MAGIC; 2630 opt[i++] = 6; 2631 opt[i++] = sp->lcp.magic >> 24; 2632 opt[i++] = sp->lcp.magic >> 16; 2633 opt[i++] = sp->lcp.magic >> 8; 2634 opt[i++] = sp->lcp.magic; 2635 } 2636 2637 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) { 2638 opt[i++] = LCP_OPT_MRU; 2639 opt[i++] = 4; 2640 opt[i++] = sp->lcp.mru >> 8; 2641 opt[i++] = sp->lcp.mru; 2642 } 2643 2644 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) { 2645 authproto = sp->hisauth.proto; 2646 opt[i++] = LCP_OPT_AUTH_PROTO; 2647 opt[i++] = authproto == PPP_CHAP? 5: 4; 2648 opt[i++] = authproto >> 8; 2649 opt[i++] = authproto; 2650 if (authproto == PPP_CHAP) 2651 opt[i++] = CHAP_MD5; 2652 } 2653 2654 sp->confid[IDX_LCP] = ++sp->pp_seq; 2655 sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, opt); 2656 } 2657 2658 /* 2659 * Check the open NCPs, return true if at least one NCP is open. 2660 */ 2661 HIDE int 2662 sppp_ncp_check(struct sppp *sp) 2663 { 2664 int i, mask; 2665 2666 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 2667 if (sp->lcp.protos & mask && (cps[i])->flags & CP_NCP) 2668 return 1; 2669 return 0; 2670 } 2671 2672 /* 2673 * Re-check the open NCPs and see if we should terminate the link. 2674 * Called by the NCPs during their tlf action handling. 2675 */ 2676 HIDE void 2677 sppp_lcp_check_and_close(struct sppp *sp) 2678 { 2679 2680 if (sp->pp_phase < PHASE_NETWORK) 2681 /* don't bother, we are already going down */ 2682 return; 2683 2684 if (sppp_ncp_check(sp)) 2685 return; 2686 2687 lcp.Close(sp); 2688 } 2689 /* 2690 *--------------------------------------------------------------------------* 2691 * * 2692 * The IPCP implementation. * 2693 * * 2694 *--------------------------------------------------------------------------* 2695 */ 2696 2697 HIDE void 2698 sppp_ipcp_init(struct sppp *sp) 2699 { 2700 sp->ipcp.opts = 0; 2701 sp->ipcp.flags = 0; 2702 sp->state[IDX_IPCP] = STATE_INITIAL; 2703 sp->fail_counter[IDX_IPCP] = 0; 2704 #if defined (__FreeBSD__) 2705 callout_handle_init(&sp->ch[IDX_IPCP]); 2706 #endif 2707 } 2708 2709 HIDE void 2710 sppp_ipcp_up(struct sppp *sp) 2711 { 2712 sppp_up_event(&ipcp, sp); 2713 } 2714 2715 HIDE void 2716 sppp_ipcp_down(struct sppp *sp) 2717 { 2718 sppp_down_event(&ipcp, sp); 2719 } 2720 2721 HIDE void 2722 sppp_ipcp_open(struct sppp *sp) 2723 { 2724 sppp_open_event(&ipcp, sp); 2725 } 2726 2727 HIDE void 2728 sppp_ipcp_close(struct sppp *sp) 2729 { 2730 sppp_close_event(&ipcp, sp); 2731 } 2732 2733 HIDE void 2734 sppp_ipcp_TO(void *cookie) 2735 { 2736 sppp_to_event(&ipcp, (struct sppp *)cookie); 2737 } 2738 2739 /* 2740 * Analyze a configure request. Return true if it was agreeable, and 2741 * caused action sca, false if it has been rejected or nak'ed, and 2742 * caused action scn. (The return value is used to make the state 2743 * transition decision in the state automaton.) 2744 */ 2745 HIDE int 2746 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len) 2747 { 2748 u_char *buf, *r, *p; 2749 struct ifnet *ifp = &sp->pp_if; 2750 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 2751 u_int32_t hisaddr, desiredaddr; 2752 2753 len -= 4; 2754 origlen = len; 2755 /* 2756 * Make sure to allocate a buf that can at least hold a 2757 * conf-nak with an `address' option. We might need it below. 2758 */ 2759 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 2760 if (! buf) 2761 return (0); 2762 2763 /* pass 1: see if we can recognize them */ 2764 if (debug) 2765 log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ", 2766 SPP_ARGS(ifp)); 2767 p = (void*) (h+1); 2768 for (rlen = 0; len > 1; len -= p[1], p += p[1]) { 2769 if (p[1] < 2 || p[1] > len) { 2770 free(buf, M_TEMP); 2771 return (-1); 2772 } 2773 if (debug) 2774 addlog("%s ", sppp_ipcp_opt_name(*p)); 2775 switch (*p) { 2776 #ifdef notyet 2777 case IPCP_OPT_COMPRESSION: 2778 if (len >= 6 && p[1] >= 6) { 2779 /* correctly formed compress option */ 2780 continue; 2781 } 2782 if (debug) 2783 addlog("[invalid] "); 2784 break; 2785 #endif 2786 case IPCP_OPT_ADDRESS: 2787 if (len >= 6 && p[1] == 6) { 2788 /* correctly formed address option */ 2789 continue; 2790 } 2791 if (debug) 2792 addlog("[invalid] "); 2793 break; 2794 default: 2795 /* Others not supported. */ 2796 if (debug) 2797 addlog("[rej] "); 2798 break; 2799 } 2800 /* Add the option to rejected list. */ 2801 bcopy (p, r, p[1]); 2802 r += p[1]; 2803 rlen += p[1]; 2804 } 2805 if (rlen) { 2806 if (debug) 2807 addlog(" send conf-rej\n"); 2808 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf); 2809 goto end; 2810 } else if (debug) 2811 addlog("\n"); 2812 2813 /* pass 2: parse option values */ 2814 if (sp->ipcp.flags & IPCP_HISADDR_SEEN) 2815 hisaddr = sp->ipcp.req_hisaddr; /* we already agreed on that */ 2816 else 2817 sppp_get_ip_addrs(sp, 0, &hisaddr, 0); /* user configuration */ 2818 if (debug) 2819 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ", 2820 SPP_ARGS(ifp)); 2821 p = (void*) (h+1); 2822 len = origlen; 2823 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 2824 if (debug) 2825 addlog(" %s ", sppp_ipcp_opt_name(*p)); 2826 switch (*p) { 2827 #ifdef notyet 2828 case IPCP_OPT_COMPRESSION: 2829 continue; 2830 #endif 2831 case IPCP_OPT_ADDRESS: 2832 desiredaddr = p[2] << 24 | p[3] << 16 | 2833 p[4] << 8 | p[5]; 2834 if (desiredaddr == hisaddr || 2835 ((sp->ipcp.flags & IPCP_HISADDR_DYN) && 2836 desiredaddr != 0)) { 2837 /* 2838 * Peer's address is same as our value, 2839 * or we have set it to 0.0.0.1 to 2840 * indicate that we do not really care, 2841 * this is agreeable. Gonna conf-ack 2842 * it. 2843 */ 2844 if (debug) 2845 addlog("%s [ack] ", 2846 sppp_dotted_quad(desiredaddr)); 2847 /* record that we've seen it already */ 2848 sp->ipcp.flags |= IPCP_HISADDR_SEEN; 2849 sp->ipcp.req_hisaddr = desiredaddr; 2850 hisaddr = desiredaddr; 2851 continue; 2852 } 2853 /* 2854 * The address wasn't agreeable. This is either 2855 * he sent us 0.0.0.0, asking to assign him an 2856 * address, or he send us another address not 2857 * matching our value. Either case, we gonna 2858 * conf-nak it with our value. 2859 */ 2860 if (debug) { 2861 if (desiredaddr == 0) 2862 addlog("[addr requested] "); 2863 else 2864 addlog("%s [not agreed] ", 2865 sppp_dotted_quad(desiredaddr)); 2866 } 2867 2868 p[2] = hisaddr >> 24; 2869 p[3] = hisaddr >> 16; 2870 p[4] = hisaddr >> 8; 2871 p[5] = hisaddr; 2872 break; 2873 } 2874 /* Add the option to nak'ed list. */ 2875 bcopy (p, r, p[1]); 2876 r += p[1]; 2877 rlen += p[1]; 2878 } 2879 2880 /* 2881 * If we are about to conf-ack the request, but haven't seen 2882 * his address so far, gonna conf-nak it instead, with the 2883 * `address' option present and our idea of his address being 2884 * filled in there, to request negotiation of both addresses. 2885 * 2886 * XXX This can result in an endless req - nak loop if peer 2887 * doesn't want to send us his address. Q: What should we do 2888 * about it? XXX A: implement the max-failure counter. 2889 */ 2890 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) { 2891 buf[0] = IPCP_OPT_ADDRESS; 2892 buf[1] = 6; 2893 buf[2] = hisaddr >> 24; 2894 buf[3] = hisaddr >> 16; 2895 buf[4] = hisaddr >> 8; 2896 buf[5] = hisaddr; 2897 rlen = 6; 2898 if (debug) 2899 addlog("still need hisaddr "); 2900 } 2901 2902 if (rlen) { 2903 if (debug) 2904 addlog(" send conf-nak\n"); 2905 sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf); 2906 } else { 2907 if (debug) 2908 addlog(" send conf-ack\n"); 2909 sppp_cp_send (sp, PPP_IPCP, CONF_ACK, 2910 h->ident, origlen, h+1); 2911 } 2912 2913 end: 2914 free(buf, M_TEMP); 2915 return (rlen == 0); 2916 } 2917 2918 /* 2919 * Analyze the IPCP Configure-Reject option list, and adjust our 2920 * negotiation. 2921 */ 2922 HIDE void 2923 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 2924 { 2925 u_char *p; 2926 struct ifnet *ifp = &sp->pp_if; 2927 int debug = ifp->if_flags & IFF_DEBUG; 2928 2929 len -= 4; 2930 2931 if (debug) 2932 log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ", 2933 SPP_ARGS(ifp)); 2934 2935 p = (void*) (h+1); 2936 for (; len > 1; len -= p[1], p += p[1]) { 2937 if (p[1] < 2 || p[1] > len) 2938 return; 2939 if (debug) 2940 addlog("%s ", sppp_ipcp_opt_name(*p)); 2941 switch (*p) { 2942 case IPCP_OPT_ADDRESS: 2943 /* 2944 * Peer doesn't grok address option. This is 2945 * bad. XXX Should we better give up here? 2946 */ 2947 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS); 2948 break; 2949 #ifdef notyet 2950 case IPCP_OPT_COMPRESS: 2951 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS); 2952 break; 2953 #endif 2954 } 2955 } 2956 if (debug) 2957 addlog("\n"); 2958 } 2959 2960 /* 2961 * Analyze the IPCP Configure-NAK option list, and adjust our 2962 * negotiation. 2963 */ 2964 HIDE void 2965 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 2966 { 2967 u_char *p; 2968 struct ifnet *ifp = &sp->pp_if; 2969 int debug = ifp->if_flags & IFF_DEBUG; 2970 u_int32_t wantaddr; 2971 2972 len -= 4; 2973 2974 if (debug) 2975 log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ", 2976 SPP_ARGS(ifp)); 2977 2978 p = (void*) (h+1); 2979 for (; len > 1; len -= p[1], p += p[1]) { 2980 if (p[1] < 2 || p[1] > len) 2981 return; 2982 if (debug) 2983 addlog("%s ", sppp_ipcp_opt_name(*p)); 2984 switch (*p) { 2985 case IPCP_OPT_ADDRESS: 2986 /* 2987 * Peer doesn't like our local IP address. See 2988 * if we can do something for him. We'll drop 2989 * him our address then. 2990 */ 2991 if (len >= 6 && p[1] == 6) { 2992 wantaddr = p[2] << 24 | p[3] << 16 | 2993 p[4] << 8 | p[5]; 2994 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 2995 if (debug) 2996 addlog("[wantaddr %s] ", 2997 sppp_dotted_quad(wantaddr)); 2998 /* 2999 * When doing dynamic address assignment, 3000 * we accept his offer. Otherwise, we 3001 * ignore it and thus continue to negotiate 3002 * our already existing value. 3003 */ 3004 if (sp->ipcp.flags & IPCP_MYADDR_DYN) { 3005 if (debug) 3006 addlog("[agree] "); 3007 sp->ipcp.flags |= IPCP_MYADDR_SEEN; 3008 sp->ipcp.req_myaddr = wantaddr; 3009 } 3010 } 3011 break; 3012 #ifdef notyet 3013 case IPCP_OPT_COMPRESS: 3014 /* 3015 * Peer wants different compression parameters. 3016 */ 3017 break; 3018 #endif 3019 } 3020 } 3021 if (debug) 3022 addlog("\n"); 3023 } 3024 3025 HIDE void 3026 sppp_ipcp_tlu(struct sppp *sp) 3027 { 3028 /* we are up. Set addresses and notify anyone interested */ 3029 u_int32_t myaddr, hisaddr; 3030 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3031 if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && 3032 (sp->ipcp.flags & IPCP_MYADDR_SEEN)) 3033 myaddr = sp->ipcp.req_myaddr; 3034 if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && 3035 (sp->ipcp.flags & IPCP_HISADDR_SEEN)) 3036 hisaddr = sp->ipcp.req_hisaddr; 3037 sppp_set_ip_addrs(sp, myaddr, hisaddr); 3038 } 3039 3040 HIDE void 3041 sppp_ipcp_tld(struct sppp *sp) 3042 { 3043 } 3044 3045 HIDE void 3046 sppp_ipcp_tls(struct sppp *sp) 3047 { 3048 STDDCL; 3049 u_int32_t myaddr, hisaddr; 3050 3051 sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN| 3052 IPCP_MYADDR_DYN|IPCP_HISADDR_DYN); 3053 sp->ipcp.req_myaddr = 0; 3054 sp->ipcp.req_hisaddr = 0; 3055 3056 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0); 3057 /* 3058 * If we don't have his address, this probably means our 3059 * interface doesn't want to talk IP at all. (This could 3060 * be the case if somebody wants to speak only IPX, for 3061 * example.) Don't open IPCP in this case. 3062 */ 3063 if (hisaddr == 0) { 3064 /* XXX this message should go away */ 3065 if (debug) 3066 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n", 3067 SPP_ARGS(ifp)); 3068 return; 3069 } 3070 3071 if (myaddr == 0) { 3072 /* 3073 * I don't have an assigned address, so i need to 3074 * negotiate my address. 3075 */ 3076 sp->ipcp.flags |= IPCP_MYADDR_DYN; 3077 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS); 3078 } 3079 if (hisaddr == 1) { 3080 /* 3081 * XXX - remove this hack! 3082 * remote has no valid address, we need to get one assigned. 3083 */ 3084 sp->ipcp.flags |= IPCP_HISADDR_DYN; 3085 } 3086 3087 /* indicate to LCP that it must stay alive */ 3088 sp->lcp.protos |= (1 << IDX_IPCP); 3089 } 3090 3091 HIDE void 3092 sppp_ipcp_tlf(struct sppp *sp) 3093 { 3094 if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN)) 3095 /* Some address was dynamic, clear it again. */ 3096 sppp_clear_ip_addrs(sp); 3097 3098 /* we no longer need LCP */ 3099 sp->lcp.protos &= ~(1 << IDX_IPCP); 3100 sppp_lcp_check_and_close(sp); 3101 } 3102 3103 HIDE void 3104 sppp_ipcp_scr(struct sppp *sp) 3105 { 3106 char opt[6 /* compression */ + 6 /* address */]; 3107 u_int32_t ouraddr; 3108 int i = 0; 3109 3110 #ifdef notyet 3111 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) { 3112 opt[i++] = IPCP_OPT_COMPRESSION; 3113 opt[i++] = 6; 3114 opt[i++] = 0; /* VJ header compression */ 3115 opt[i++] = 0x2d; /* VJ header compression */ 3116 opt[i++] = max_slot_id; 3117 opt[i++] = comp_slot_id; 3118 } 3119 #endif 3120 3121 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) { 3122 if (sp->ipcp.flags & IPCP_MYADDR_SEEN) 3123 /* not sure if this can ever happen */ 3124 ouraddr = sp->ipcp.req_myaddr; 3125 else 3126 sppp_get_ip_addrs(sp, &ouraddr, 0, 0); 3127 opt[i++] = IPCP_OPT_ADDRESS; 3128 opt[i++] = 6; 3129 opt[i++] = ouraddr >> 24; 3130 opt[i++] = ouraddr >> 16; 3131 opt[i++] = ouraddr >> 8; 3132 opt[i++] = ouraddr; 3133 } 3134 3135 sp->confid[IDX_IPCP] = ++sp->pp_seq; 3136 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, opt); 3137 } 3138 3139 /* 3140 *--------------------------------------------------------------------------* 3141 * * 3142 * The IPv6CP implementation. * 3143 * * 3144 *--------------------------------------------------------------------------* 3145 */ 3146 3147 #ifdef INET6 3148 HIDE void 3149 sppp_ipv6cp_init(struct sppp *sp) 3150 { 3151 sp->ipv6cp.opts = 0; 3152 sp->ipv6cp.flags = 0; 3153 sp->state[IDX_IPV6CP] = STATE_INITIAL; 3154 sp->fail_counter[IDX_IPV6CP] = 0; 3155 #if defined (__FreeBSD__) 3156 callout_handle_init(&sp->ch[IDX_IPV6CP]); 3157 #endif 3158 } 3159 3160 HIDE void 3161 sppp_ipv6cp_up(struct sppp *sp) 3162 { 3163 sppp_up_event(&ipv6cp, sp); 3164 } 3165 3166 HIDE void 3167 sppp_ipv6cp_down(struct sppp *sp) 3168 { 3169 sppp_down_event(&ipv6cp, sp); 3170 } 3171 3172 HIDE void 3173 sppp_ipv6cp_open(struct sppp *sp) 3174 { 3175 STDDCL; 3176 struct in6_addr myaddr, hisaddr; 3177 3178 #ifdef IPV6CP_MYIFID_DYN 3179 sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN); 3180 #else 3181 sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN; 3182 #endif 3183 3184 sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0); 3185 /* 3186 * If we don't have our address, this probably means our 3187 * interface doesn't want to talk IPv6 at all. (This could 3188 * be the case if somebody wants to speak only IPX, for 3189 * example.) Don't open IPv6CP in this case. 3190 */ 3191 if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) { 3192 /* XXX this message should go away */ 3193 if (debug) 3194 log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n", 3195 SPP_ARGS(ifp)); 3196 return; 3197 } 3198 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3199 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3200 sppp_open_event(&ipv6cp, sp); 3201 } 3202 3203 HIDE void 3204 sppp_ipv6cp_close(struct sppp *sp) 3205 { 3206 sppp_close_event(&ipv6cp, sp); 3207 } 3208 3209 HIDE void 3210 sppp_ipv6cp_TO(void *cookie) 3211 { 3212 sppp_to_event(&ipv6cp, (struct sppp *)cookie); 3213 } 3214 3215 HIDE int 3216 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len) 3217 { 3218 u_char *buf, *r, *p; 3219 struct ifnet *ifp = &sp->pp_if; 3220 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG; 3221 struct in6_addr myaddr, desiredaddr, suggestaddr; 3222 int ifidcount; 3223 int type; 3224 int collision, nohisaddr; 3225 3226 len -= 4; 3227 origlen = len; 3228 /* 3229 * Make sure to allocate a buf that can at least hold a 3230 * conf-nak with an `address' option. We might need it below. 3231 */ 3232 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT); 3233 if (! buf) 3234 return (0); 3235 3236 /* pass 1: see if we can recognize them */ 3237 if (debug) 3238 log(LOG_DEBUG, "%s: ipv6cp parse opts:", 3239 SPP_ARGS(ifp)); 3240 p = (void *)(h + 1); 3241 ifidcount = 0; 3242 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3243 /* Sanity check option length */ 3244 if (p[1] < 2 || p[1] > len) { 3245 free(buf, M_TEMP); 3246 return (-1); 3247 } 3248 if (debug) 3249 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3250 switch (*p) { 3251 case IPV6CP_OPT_IFID: 3252 if (len >= 10 && p[1] == 10 && ifidcount == 0) { 3253 /* correctly formed address option */ 3254 ifidcount++; 3255 continue; 3256 } 3257 if (debug) 3258 addlog(" [invalid]"); 3259 break; 3260 #ifdef notyet 3261 case IPV6CP_OPT_COMPRESSION: 3262 if (len >= 4 && p[1] >= 4) { 3263 /* correctly formed compress option */ 3264 continue; 3265 } 3266 if (debug) 3267 addlog(" [invalid]"); 3268 break; 3269 #endif 3270 default: 3271 /* Others not supported. */ 3272 if (debug) 3273 addlog(" [rej]"); 3274 break; 3275 } 3276 /* Add the option to rejected list. */ 3277 bcopy (p, r, p[1]); 3278 r += p[1]; 3279 rlen += p[1]; 3280 } 3281 if (rlen) { 3282 if (debug) 3283 addlog(" send conf-rej\n"); 3284 sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf); 3285 goto end; 3286 } else if (debug) 3287 addlog("\n"); 3288 3289 /* pass 2: parse option values */ 3290 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 3291 if (debug) 3292 log(LOG_DEBUG, "%s: ipv6cp parse opt values: ", 3293 SPP_ARGS(ifp)); 3294 p = (void *)(h + 1); 3295 len = origlen; 3296 type = CONF_ACK; 3297 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) { 3298 if (debug) 3299 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3300 switch (*p) { 3301 #ifdef notyet 3302 case IPV6CP_OPT_COMPRESSION: 3303 continue; 3304 #endif 3305 case IPV6CP_OPT_IFID: 3306 memset(&desiredaddr, 0, sizeof(desiredaddr)); 3307 bcopy(&p[2], &desiredaddr.s6_addr[8], 8); 3308 collision = (memcmp(&desiredaddr.s6_addr[8], 3309 &myaddr.s6_addr[8], 8) == 0); 3310 nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr); 3311 3312 desiredaddr.s6_addr16[0] = htons(0xfe80); 3313 3314 if (!collision && !nohisaddr) { 3315 /* no collision, hisaddr known - Conf-Ack */ 3316 type = CONF_ACK; 3317 3318 if (debug) { 3319 addlog(" %s [%s]", 3320 ip6_sprintf(&desiredaddr), 3321 sppp_cp_type_name(type)); 3322 } 3323 continue; 3324 } 3325 3326 memset(&suggestaddr, 0, sizeof(&suggestaddr)); 3327 if (collision && nohisaddr) { 3328 /* collision, hisaddr unknown - Conf-Rej */ 3329 type = CONF_REJ; 3330 memset(&p[2], 0, 8); 3331 } else { 3332 /* 3333 * - no collision, hisaddr unknown, or 3334 * - collision, hisaddr known 3335 * Conf-Nak, suggest hisaddr 3336 */ 3337 type = CONF_NAK; 3338 sppp_suggest_ip6_addr(sp, &suggestaddr); 3339 bcopy(&suggestaddr.s6_addr[8], &p[2], 8); 3340 } 3341 if (debug) 3342 addlog(" %s [%s]", ip6_sprintf(&desiredaddr), 3343 sppp_cp_type_name(type)); 3344 break; 3345 } 3346 /* Add the option to nak'ed list. */ 3347 bcopy (p, r, p[1]); 3348 r += p[1]; 3349 rlen += p[1]; 3350 } 3351 3352 if (rlen == 0 && type == CONF_ACK) { 3353 if (debug) 3354 addlog(" send %s\n", sppp_cp_type_name(type)); 3355 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1); 3356 } else { 3357 #ifdef notdef 3358 if (type == CONF_ACK) 3359 panic("IPv6CP RCR: CONF_ACK with non-zero rlen"); 3360 #endif 3361 3362 if (debug) { 3363 addlog(" send %s suggest %s\n", 3364 sppp_cp_type_name(type), ip6_sprintf(&suggestaddr)); 3365 } 3366 sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf); 3367 } 3368 3369 end: 3370 free(buf, M_TEMP); 3371 return (rlen == 0); 3372 } 3373 3374 HIDE void 3375 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len) 3376 { 3377 u_char *p; 3378 struct ifnet *ifp = &sp->pp_if; 3379 int debug = ifp->if_flags & IFF_DEBUG; 3380 3381 len -= 4; 3382 3383 if (debug) 3384 log(LOG_DEBUG, "%s: ipv6cp rej opts:", 3385 SPP_ARGS(ifp)); 3386 3387 p = (void *)(h + 1); 3388 for (; len > 1 && p[1]; len -= p[1], p += p[1]) { 3389 if (p[1] < 2 || p[1] > len) 3390 return; 3391 if (debug) 3392 addlog(" %s", sppp_ipv6cp_opt_name(*p)); 3393 switch (*p) { 3394 case IPV6CP_OPT_IFID: 3395 /* 3396 * Peer doesn't grok address option. This is 3397 * bad. XXX Should we better give up here? 3398 */ 3399 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID); 3400 break; 3401 #ifdef notyet 3402 case IPV6CP_OPT_COMPRESS: 3403 sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS); 3404 break; 3405 #endif 3406 } 3407 } 3408 if (debug) 3409 addlog("\n"); 3410 return; 3411 } 3412 3413 HIDE void 3414 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len) 3415 { 3416 u_char *p; 3417 struct ifnet *ifp = &sp->pp_if; 3418 int debug = ifp->if_flags & IFF_DEBUG; 3419 struct in6_addr suggestaddr; 3420 3421 len -= 4; 3422 3423 if (debug) 3424 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts: ", 3425 SPP_ARGS(ifp)); 3426 3427 p = (void*) (h+1); 3428 for (; len > 1; len -= p[1], p += p[1]) { 3429 if (p[1] < 2 || p[1] > len) 3430 return; 3431 if (debug) 3432 addlog("%s ", sppp_ipv6cp_opt_name(*p)); 3433 switch (*p) { 3434 case IPV6CP_OPT_IFID: 3435 /* 3436 * Peer doesn't like our local ifid. See 3437 * if we can do something for him. We'll drop 3438 * him our address then. 3439 */ 3440 if (len < 10 || p[1] != 10) 3441 break; 3442 memset(&suggestaddr, 0, sizeof(suggestaddr)); 3443 suggestaddr.s6_addr16[0] = htons(0xfe80); 3444 bcopy(&p[2], &suggestaddr.s6_addr[8], 8); 3445 3446 sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID); 3447 if (debug) 3448 addlog(" [suggestaddr %s]", 3449 ip6_sprintf(&suggestaddr)); 3450 #ifdef IPV6CP_MYIFID_DYN 3451 /* 3452 * When doing dynamic address assignment, 3453 * we accept his offer. 3454 */ 3455 if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) { 3456 struct in6_addr lastsuggest; 3457 /* 3458 * If <suggested myaddr from peer> equals to 3459 * <hisaddr we have suggested last time>, 3460 * we have a collision. generate new random 3461 * ifid. 3462 */ 3463 sppp_suggest_ip6_addr(sp,&lastsuggest); 3464 if (IN6_ARE_ADDR_EQUAL(&suggestaddr, 3465 &lastsuggest)) { 3466 if (debug) 3467 addlog(" [random]"); 3468 sppp_gen_ip6_addr(sp, &suggestaddr); 3469 } 3470 sppp_set_ip6_addr(sp, &suggestaddr); 3471 if (debug) 3472 addlog(" [agree]"); 3473 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN; 3474 } 3475 #else 3476 /* 3477 * Since we do not do dynamic address assignment, 3478 * we ignore it and thus continue to negotiate 3479 * our already existing value. This can possibly 3480 * go into infinite request-reject loop. 3481 * 3482 * This is not likely because we normally use 3483 * ifid based on MAC-address. 3484 * If you have no ethernet card on the node, too bad. 3485 * XXX should we use fail_counter? 3486 */ 3487 #endif 3488 break; 3489 #ifdef notyet 3490 case IPV6CP_OPT_COMPRESS: 3491 /* 3492 * Peer wants different compression parameters. 3493 */ 3494 break; 3495 #endif 3496 } 3497 } 3498 if (debug) 3499 addlog("\n"); 3500 } 3501 3502 HIDE void 3503 sppp_ipv6cp_tlu(struct sppp *sp) 3504 { 3505 } 3506 3507 HIDE void 3508 sppp_ipv6cp_tld(struct sppp *sp) 3509 { 3510 } 3511 3512 HIDE void 3513 sppp_ipv6cp_tls(struct sppp *sp) 3514 { 3515 /* indicate to LCP that it must stay alive */ 3516 sp->lcp.protos |= (1 << IDX_IPV6CP); 3517 } 3518 3519 HIDE void 3520 sppp_ipv6cp_tlf(struct sppp *sp) 3521 { 3522 /* we no longer need LCP */ 3523 sp->lcp.protos &= ~(1 << IDX_IPV6CP); 3524 sppp_lcp_check_and_close(sp); 3525 } 3526 3527 HIDE void 3528 sppp_ipv6cp_scr(struct sppp *sp) 3529 { 3530 char opt[10 /* ifid */ + 4 /* compression, minimum */]; 3531 struct in6_addr ouraddr; 3532 int i = 0; 3533 3534 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) { 3535 sppp_get_ip6_addrs(sp, &ouraddr, 0, 0); 3536 opt[i++] = IPV6CP_OPT_IFID; 3537 opt[i++] = 10; 3538 bcopy(&ouraddr.s6_addr[8], &opt[i], 8); 3539 i += 8; 3540 } 3541 3542 #ifdef notyet 3543 if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) { 3544 opt[i++] = IPV6CP_OPT_COMPRESSION; 3545 opt[i++] = 4; 3546 p opt[i++] = 0; /* TBD */ 3547 opt[i++] = 0; /* TBD */ 3548 /* variable length data may follow */ 3549 } 3550 #endif 3551 3552 sp->confid[IDX_IPV6CP] = ++sp->pp_seq; 3553 sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, opt); 3554 } 3555 #else /*INET6*/ 3556 HIDE void 3557 sppp_ipv6cp_init(struct sppp *sp) 3558 { 3559 } 3560 3561 HIDE void 3562 sppp_ipv6cp_up(struct sppp *sp) 3563 { 3564 } 3565 3566 HIDE void 3567 sppp_ipv6cp_down(struct sppp *sp) 3568 { 3569 } 3570 3571 HIDE void 3572 sppp_ipv6cp_open(struct sppp *sp) 3573 { 3574 } 3575 3576 HIDE void 3577 sppp_ipv6cp_close(struct sppp *sp) 3578 { 3579 } 3580 3581 HIDE void 3582 sppp_ipv6cp_TO(void *sp) 3583 { 3584 } 3585 3586 HIDE int 3587 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, 3588 int len) 3589 { 3590 return 0; 3591 } 3592 3593 HIDE void 3594 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, 3595 int len) 3596 { 3597 } 3598 3599 HIDE void 3600 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, 3601 int len) 3602 { 3603 } 3604 3605 HIDE void 3606 sppp_ipv6cp_tlu(struct sppp *sp) 3607 { 3608 } 3609 3610 HIDE void 3611 sppp_ipv6cp_tld(struct sppp *sp) 3612 { 3613 } 3614 3615 HIDE void 3616 sppp_ipv6cp_tls(struct sppp *sp) 3617 { 3618 } 3619 3620 HIDE void 3621 sppp_ipv6cp_tlf(struct sppp *sp) 3622 { 3623 } 3624 3625 HIDE void 3626 sppp_ipv6cp_scr(struct sppp *sp) 3627 { 3628 } 3629 #endif /*INET6*/ 3630 3631 /* 3632 *--------------------------------------------------------------------------* 3633 * * 3634 * The CHAP implementation. * 3635 * * 3636 *--------------------------------------------------------------------------* 3637 */ 3638 3639 /* 3640 * The authentication protocols don't employ a full-fledged state machine as 3641 * the control protocols do, since they do have Open and Close events, but 3642 * not Up and Down, nor are they explicitly terminated. Also, use of the 3643 * authentication protocols may be different in both directions (this makes 3644 * sense, think of a machine that never accepts incoming calls but only 3645 * calls out, it doesn't require the called party to authenticate itself). 3646 * 3647 * Our state machine for the local authentication protocol (we are requesting 3648 * the peer to authenticate) looks like: 3649 * 3650 * RCA- 3651 * +--------------------------------------------+ 3652 * V scn,tld| 3653 * +--------+ Close +---------+ RCA+ 3654 * | |<----------------------------------| |------+ 3655 * +--->| Closed | TO* | Opened | sca | 3656 * | | |-----+ +-------| |<-----+ 3657 * | +--------+ irc | | +---------+ 3658 * | ^ | | ^ 3659 * | | | | | 3660 * | | | | | 3661 * | TO-| | | | 3662 * | |tld TO+ V | | 3663 * | | +------->+ | | 3664 * | | | | | | 3665 * | +--------+ V | | 3666 * | | |<----+<--------------------+ | 3667 * | | Req- | scr | 3668 * | | Sent | | 3669 * | | | | 3670 * | +--------+ | 3671 * | RCA- | | RCA+ | 3672 * +------+ +------------------------------------------+ 3673 * scn,tld sca,irc,ict,tlu 3674 * 3675 * 3676 * with: 3677 * 3678 * Open: LCP reached authentication phase 3679 * Close: LCP reached terminate phase 3680 * 3681 * RCA+: received reply (pap-req, chap-response), acceptable 3682 * RCN: received reply (pap-req, chap-response), not acceptable 3683 * TO+: timeout with restart counter >= 0 3684 * TO-: timeout with restart counter < 0 3685 * TO*: reschedule timeout for CHAP 3686 * 3687 * scr: send request packet (none for PAP, chap-challenge) 3688 * sca: send ack packet (pap-ack, chap-success) 3689 * scn: send nak packet (pap-nak, chap-failure) 3690 * ict: initialize re-challenge timer (CHAP only) 3691 * 3692 * tlu: this-layer-up, LCP reaches network phase 3693 * tld: this-layer-down, LCP enters terminate phase 3694 * 3695 * Note that in CHAP mode, after sending a new challenge, while the state 3696 * automaton falls back into Req-Sent state, it doesn't signal a tld 3697 * event to LCP, so LCP remains in network phase. Only after not getting 3698 * any response (or after getting an unacceptable response), CHAP closes, 3699 * causing LCP to enter terminate phase. 3700 * 3701 * With PAP, there is no initial request that can be sent. The peer is 3702 * expected to send one based on the successful negotiation of PAP as 3703 * the authentication protocol during the LCP option negotiation. 3704 * 3705 * Incoming authentication protocol requests (remote requests 3706 * authentication, we are peer) don't employ a state machine at all, 3707 * they are simply answered. Some peers [Ascend P50 firmware rev 3708 * 4.50] react allergically when sending IPCP requests while they are 3709 * still in authentication phase (thereby violating the standard that 3710 * demands that these NCP packets are to be discarded), so we keep 3711 * track of the peer demanding us to authenticate, and only proceed to 3712 * phase network once we've seen a positive acknowledge for the 3713 * authentication. 3714 */ 3715 3716 /* 3717 * Handle incoming CHAP packets. 3718 */ 3719 void 3720 sppp_chap_input(struct sppp *sp, struct mbuf *m) 3721 { 3722 STDDCL; 3723 struct lcp_header *h; 3724 int len, x; 3725 u_char *value, *name, digest[AUTHCHALEN], dsize; 3726 int value_len, name_len; 3727 MD5_CTX ctx; 3728 3729 len = m->m_pkthdr.len; 3730 if (len < 4) { 3731 if (debug) 3732 log(LOG_DEBUG, 3733 SPP_FMT "chap invalid packet length: %d bytes\n", 3734 SPP_ARGS(ifp), len); 3735 return; 3736 } 3737 h = mtod (m, struct lcp_header*); 3738 if (len > ntohs (h->len)) 3739 len = ntohs (h->len); 3740 3741 switch (h->type) { 3742 /* challenge, failure and success are his authproto */ 3743 case CHAP_CHALLENGE: 3744 value = 1 + (u_char*)(h+1); 3745 value_len = value[-1]; 3746 name = value + value_len; 3747 name_len = len - value_len - 5; 3748 if (name_len < 0) { 3749 if (debug) { 3750 log(LOG_DEBUG, 3751 SPP_FMT "chap corrupted challenge " 3752 "<%s id=0x%x len=%d", 3753 SPP_ARGS(ifp), 3754 sppp_auth_type_name(PPP_CHAP, h->type), 3755 h->ident, ntohs(h->len)); 3756 if (len > 4) 3757 sppp_print_bytes((u_char*) (h+1), len-4); 3758 addlog(">\n"); 3759 } 3760 break; 3761 } 3762 3763 if (debug) { 3764 log(LOG_DEBUG, 3765 SPP_FMT "chap input <%s id=0x%x len=%d name=", 3766 SPP_ARGS(ifp), 3767 sppp_auth_type_name(PPP_CHAP, h->type), h->ident, 3768 ntohs(h->len)); 3769 sppp_print_string((char*) name, name_len); 3770 addlog(" value-size=%d value=", value_len); 3771 sppp_print_bytes(value, value_len); 3772 addlog(">\n"); 3773 } 3774 3775 /* Compute reply value. */ 3776 MD5Init(&ctx); 3777 MD5Update(&ctx, &h->ident, 1); 3778 MD5Update(&ctx, sp->myauth.secret, 3779 strlen(sp->myauth.secret)); 3780 MD5Update(&ctx, value, value_len); 3781 MD5Final(digest, &ctx); 3782 dsize = sizeof digest; 3783 3784 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident, 3785 sizeof dsize, (const char *)&dsize, 3786 sizeof digest, digest, 3787 strlen(sp->myauth.name), 3788 sp->myauth.name, 3789 0); 3790 break; 3791 3792 case CHAP_SUCCESS: 3793 if (debug) { 3794 log(LOG_DEBUG, SPP_FMT "chap success", 3795 SPP_ARGS(ifp)); 3796 if (len > 4) { 3797 addlog(": "); 3798 sppp_print_string((char*)(h + 1), len - 4); 3799 } 3800 addlog("\n"); 3801 } 3802 x = splnet(); 3803 sp->pp_flags &= ~PP_NEEDAUTH; 3804 if (sp->myauth.proto == PPP_CHAP && 3805 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 3806 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) { 3807 /* 3808 * We are authenticator for CHAP but didn't 3809 * complete yet. Leave it to tlu to proceed 3810 * to network phase. 3811 */ 3812 splx(x); 3813 break; 3814 } 3815 splx(x); 3816 sppp_phase_network(sp); 3817 break; 3818 3819 case CHAP_FAILURE: 3820 if (debug) { 3821 log(LOG_INFO, SPP_FMT "chap failure", 3822 SPP_ARGS(ifp)); 3823 if (len > 4) { 3824 addlog(": "); 3825 sppp_print_string((char*)(h + 1), len - 4); 3826 } 3827 addlog("\n"); 3828 } else 3829 log(LOG_INFO, SPP_FMT "chap failure\n", 3830 SPP_ARGS(ifp)); 3831 /* await LCP shutdown by authenticator */ 3832 break; 3833 3834 /* response is my authproto */ 3835 case CHAP_RESPONSE: 3836 value = 1 + (u_char*)(h+1); 3837 value_len = value[-1]; 3838 name = value + value_len; 3839 name_len = len - value_len - 5; 3840 if (name_len < 0) { 3841 if (debug) { 3842 log(LOG_DEBUG, 3843 SPP_FMT "chap corrupted response " 3844 "<%s id=0x%x len=%d", 3845 SPP_ARGS(ifp), 3846 sppp_auth_type_name(PPP_CHAP, h->type), 3847 h->ident, ntohs(h->len)); 3848 if (len > 4) 3849 sppp_print_bytes((u_char*)(h+1), len-4); 3850 addlog(">\n"); 3851 } 3852 break; 3853 } 3854 if (h->ident != sp->confid[IDX_CHAP]) { 3855 if (debug) 3856 log(LOG_DEBUG, 3857 SPP_FMT "chap dropping response for old ID " 3858 "(got %d, expected %d)\n", 3859 SPP_ARGS(ifp), 3860 h->ident, sp->confid[IDX_CHAP]); 3861 break; 3862 } 3863 if (name_len != strlen(sp->hisauth.name) 3864 || bcmp(name, sp->hisauth.name, name_len) != 0) { 3865 log(LOG_INFO, SPP_FMT "chap response, his name ", 3866 SPP_ARGS(ifp)); 3867 sppp_print_string(name, name_len); 3868 addlog(" != expected "); 3869 sppp_print_string(sp->hisauth.name, 3870 strlen(sp->hisauth.name)); 3871 addlog("\n"); 3872 } 3873 if (debug) { 3874 log(LOG_DEBUG, SPP_FMT "chap input(%s) " 3875 "<%s id=0x%x len=%d name=", 3876 SPP_ARGS(ifp), 3877 sppp_state_name(sp->state[IDX_CHAP]), 3878 sppp_auth_type_name(PPP_CHAP, h->type), 3879 h->ident, ntohs (h->len)); 3880 sppp_print_string((char*)name, name_len); 3881 addlog(" value-size=%d value=", value_len); 3882 sppp_print_bytes(value, value_len); 3883 addlog(">\n"); 3884 } 3885 if (value_len != AUTHCHALEN) { 3886 if (debug) 3887 log(LOG_DEBUG, 3888 SPP_FMT "chap bad hash value length: " 3889 "%d bytes, should be %d\n", 3890 SPP_ARGS(ifp), value_len, 3891 AUTHCHALEN); 3892 break; 3893 } 3894 3895 MD5Init(&ctx); 3896 MD5Update(&ctx, &h->ident, 1); 3897 MD5Update(&ctx, sp->hisauth.secret, 3898 strlen(sp->hisauth.secret)); 3899 MD5Update(&ctx, sp->chap_challenge, AUTHCHALEN); 3900 MD5Final(digest, &ctx); 3901 3902 #define FAILMSG "Failed..." 3903 #define SUCCMSG "Welcome!" 3904 3905 if (value_len != sizeof digest || 3906 bcmp(digest, value, value_len) != 0) { 3907 /* action scn, tld */ 3908 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident, 3909 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 3910 0); 3911 chap.tld(sp); 3912 break; 3913 } 3914 /* action sca, perhaps tlu */ 3915 if (sp->state[IDX_CHAP] == STATE_REQ_SENT || 3916 sp->state[IDX_CHAP] == STATE_OPENED) 3917 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident, 3918 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 3919 0); 3920 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) { 3921 sppp_cp_change_state(&chap, sp, STATE_OPENED); 3922 chap.tlu(sp); 3923 } 3924 break; 3925 3926 default: 3927 /* Unknown CHAP packet type -- ignore. */ 3928 if (debug) { 3929 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) " 3930 "<0x%x id=0x%xh len=%d", 3931 SPP_ARGS(ifp), 3932 sppp_state_name(sp->state[IDX_CHAP]), 3933 h->type, h->ident, ntohs(h->len)); 3934 if (len > 4) 3935 sppp_print_bytes((u_char*)(h+1), len-4); 3936 addlog(">\n"); 3937 } 3938 break; 3939 3940 } 3941 } 3942 3943 HIDE void 3944 sppp_chap_init(struct sppp *sp) 3945 { 3946 /* Chap doesn't have STATE_INITIAL at all. */ 3947 sp->state[IDX_CHAP] = STATE_CLOSED; 3948 sp->fail_counter[IDX_CHAP] = 0; 3949 #if defined (__FreeBSD__) 3950 callout_handle_init(&sp->ch[IDX_CHAP]); 3951 #endif 3952 } 3953 3954 HIDE void 3955 sppp_chap_open(struct sppp *sp) 3956 { 3957 if (sp->myauth.proto == PPP_CHAP && 3958 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 3959 /* we are authenticator for CHAP, start it */ 3960 chap.scr(sp); 3961 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 3962 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 3963 } 3964 /* nothing to be done if we are peer, await a challenge */ 3965 } 3966 3967 HIDE void 3968 sppp_chap_close(struct sppp *sp) 3969 { 3970 if (sp->state[IDX_CHAP] != STATE_CLOSED) 3971 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 3972 } 3973 3974 HIDE void 3975 sppp_chap_TO(void *cookie) 3976 { 3977 struct sppp *sp = (struct sppp *)cookie; 3978 STDDCL; 3979 int s; 3980 3981 s = splnet(); 3982 if (debug) 3983 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n", 3984 SPP_ARGS(ifp), 3985 sppp_state_name(sp->state[IDX_CHAP]), 3986 sp->rst_counter[IDX_CHAP]); 3987 3988 if (--sp->rst_counter[IDX_CHAP] < 0) 3989 /* TO- event */ 3990 switch (sp->state[IDX_CHAP]) { 3991 case STATE_REQ_SENT: 3992 chap.tld(sp); 3993 sppp_cp_change_state(&chap, sp, STATE_CLOSED); 3994 break; 3995 } 3996 else 3997 /* TO+ (or TO*) event */ 3998 switch (sp->state[IDX_CHAP]) { 3999 case STATE_OPENED: 4000 /* TO* event */ 4001 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4002 /* FALLTHROUGH */ 4003 case STATE_REQ_SENT: 4004 chap.scr(sp); 4005 /* sppp_cp_change_state() will restart the timer */ 4006 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT); 4007 break; 4008 } 4009 4010 splx(s); 4011 } 4012 4013 HIDE void 4014 sppp_chap_tlu(struct sppp *sp) 4015 { 4016 STDDCL; 4017 int i = 0, x; 4018 4019 i = 0; 4020 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure; 4021 4022 /* 4023 * Some broken CHAP implementations (Conware CoNet, firmware 4024 * 4.0.?) don't want to re-authenticate their CHAP once the 4025 * initial challenge-response exchange has taken place. 4026 * Provide for an option to avoid rechallenges. 4027 */ 4028 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) { 4029 /* 4030 * Compute the re-challenge timeout. This will yield 4031 * a number between 300 and 810 seconds. 4032 */ 4033 i = 300 + (arc4random() & 0x01fe); 4034 4035 #if defined (__FreeBSD__) 4036 sp->ch[IDX_CHAP] = timeout(chap.TO, (void *)sp, i * hz); 4037 #elif defined(__OpenBSD__) 4038 timeout_add_sec(&sp->ch[IDX_CHAP], i); 4039 #endif 4040 } 4041 4042 if (debug) { 4043 log(LOG_DEBUG, 4044 SPP_FMT "chap %s, ", 4045 SPP_ARGS(ifp), 4046 sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu"); 4047 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) 4048 addlog("next re-challenge in %d seconds\n", i); 4049 else 4050 addlog("re-challenging suppressed\n"); 4051 } 4052 4053 x = splnet(); 4054 /* indicate to LCP that we need to be closed down */ 4055 sp->lcp.protos |= (1 << IDX_CHAP); 4056 4057 if (sp->pp_flags & PP_NEEDAUTH) { 4058 /* 4059 * Remote is authenticator, but his auth proto didn't 4060 * complete yet. Defer the transition to network 4061 * phase. 4062 */ 4063 splx(x); 4064 return; 4065 } 4066 splx(x); 4067 4068 /* 4069 * If we are already in phase network, we are done here. This 4070 * is the case if this is a dummy tlu event after a re-challenge. 4071 */ 4072 if (sp->pp_phase != PHASE_NETWORK) 4073 sppp_phase_network(sp); 4074 } 4075 4076 HIDE void 4077 sppp_chap_tld(struct sppp *sp) 4078 { 4079 STDDCL; 4080 4081 if (debug) 4082 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp)); 4083 UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]); 4084 sp->lcp.protos &= ~(1 << IDX_CHAP); 4085 4086 lcp.Close(sp); 4087 } 4088 4089 HIDE void 4090 sppp_chap_scr(struct sppp *sp) 4091 { 4092 u_char clen; 4093 4094 /* Compute random challenge. */ 4095 arc4random_buf(sp->chap_challenge, sizeof(sp->chap_challenge)); 4096 clen = AUTHCHALEN; 4097 4098 sp->confid[IDX_CHAP] = ++sp->pp_seq; 4099 4100 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP], 4101 sizeof clen, (const char *)&clen, 4102 (size_t)AUTHCHALEN, sp->chap_challenge, 4103 strlen(sp->myauth.name), 4104 sp->myauth.name, 4105 0); 4106 } 4107 /* 4108 *--------------------------------------------------------------------------* 4109 * * 4110 * The PAP implementation. * 4111 * * 4112 *--------------------------------------------------------------------------* 4113 */ 4114 /* 4115 * For PAP, we need to keep a little state also if we are the peer, not the 4116 * authenticator. This is since we don't get a request to authenticate, but 4117 * have to repeatedly authenticate ourself until we got a response (or the 4118 * retry counter is expired). 4119 */ 4120 4121 /* 4122 * Handle incoming PAP packets. */ 4123 HIDE void 4124 sppp_pap_input(struct sppp *sp, struct mbuf *m) 4125 { 4126 STDDCL; 4127 struct lcp_header *h; 4128 int len, x; 4129 u_char *name, *passwd, mlen; 4130 int name_len, passwd_len; 4131 4132 len = m->m_pkthdr.len; 4133 if (len < 5) { 4134 if (debug) 4135 log(LOG_DEBUG, 4136 SPP_FMT "pap invalid packet length: %d bytes\n", 4137 SPP_ARGS(ifp), len); 4138 return; 4139 } 4140 h = mtod (m, struct lcp_header*); 4141 if (len > ntohs (h->len)) 4142 len = ntohs (h->len); 4143 switch (h->type) { 4144 /* PAP request is my authproto */ 4145 case PAP_REQ: 4146 name = 1 + (u_char*)(h+1); 4147 name_len = name[-1]; 4148 passwd = name + name_len + 1; 4149 if (name_len > len - 6 || 4150 (passwd_len = passwd[-1]) > len - 6 - name_len) { 4151 if (debug) { 4152 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4153 "<%s id=0x%x len=%d", 4154 SPP_ARGS(ifp), 4155 sppp_auth_type_name(PPP_PAP, h->type), 4156 h->ident, ntohs(h->len)); 4157 if (len > 4) 4158 sppp_print_bytes((u_char*)(h+1), len-4); 4159 addlog(">\n"); 4160 } 4161 break; 4162 } 4163 if (debug) { 4164 log(LOG_DEBUG, SPP_FMT "pap input(%s) " 4165 "<%s id=0x%x len=%d name=", 4166 SPP_ARGS(ifp), 4167 sppp_state_name(sp->state[IDX_PAP]), 4168 sppp_auth_type_name(PPP_PAP, h->type), 4169 h->ident, ntohs(h->len)); 4170 sppp_print_string((char*)name, name_len); 4171 addlog(" passwd="); 4172 sppp_print_string((char*)passwd, passwd_len); 4173 addlog(">\n"); 4174 } 4175 if (name_len > AUTHMAXLEN || 4176 passwd_len > AUTHMAXLEN || 4177 bcmp(name, sp->hisauth.name, name_len) != 0 || 4178 bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) { 4179 /* action scn, tld */ 4180 mlen = sizeof(FAILMSG) - 1; 4181 sppp_auth_send(&pap, sp, PAP_NAK, h->ident, 4182 sizeof mlen, (const char *)&mlen, 4183 sizeof(FAILMSG) - 1, (u_char *)FAILMSG, 4184 0); 4185 pap.tld(sp); 4186 break; 4187 } 4188 /* action sca, perhaps tlu */ 4189 if (sp->state[IDX_PAP] == STATE_REQ_SENT || 4190 sp->state[IDX_PAP] == STATE_OPENED) { 4191 mlen = sizeof(SUCCMSG) - 1; 4192 sppp_auth_send(&pap, sp, PAP_ACK, h->ident, 4193 sizeof mlen, (const char *)&mlen, 4194 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG, 4195 0); 4196 } 4197 if (sp->state[IDX_PAP] == STATE_REQ_SENT) { 4198 sppp_cp_change_state(&pap, sp, STATE_OPENED); 4199 pap.tlu(sp); 4200 } 4201 break; 4202 4203 /* ack and nak are his authproto */ 4204 case PAP_ACK: 4205 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4206 if (debug) { 4207 log(LOG_DEBUG, SPP_FMT "pap success", 4208 SPP_ARGS(ifp)); 4209 name_len = *((char *)h); 4210 if (len > 5 && name_len) { 4211 addlog(": "); 4212 sppp_print_string((char*)(h+1), name_len); 4213 } 4214 addlog("\n"); 4215 } 4216 x = splnet(); 4217 sp->pp_flags &= ~PP_NEEDAUTH; 4218 if (sp->myauth.proto == PPP_PAP && 4219 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) && 4220 (sp->lcp.protos & (1 << IDX_PAP)) == 0) { 4221 /* 4222 * We are authenticator for PAP but didn't 4223 * complete yet. Leave it to tlu to proceed 4224 * to network phase. 4225 */ 4226 splx(x); 4227 break; 4228 } 4229 splx(x); 4230 sppp_phase_network(sp); 4231 break; 4232 4233 case PAP_NAK: 4234 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4235 if (debug) { 4236 log(LOG_INFO, SPP_FMT "pap failure", 4237 SPP_ARGS(ifp)); 4238 name_len = *((char *)h); 4239 if (len > 5 && name_len) { 4240 addlog(": "); 4241 sppp_print_string((char*)(h+1), name_len); 4242 } 4243 addlog("\n"); 4244 } else 4245 log(LOG_INFO, SPP_FMT "pap failure\n", 4246 SPP_ARGS(ifp)); 4247 /* await LCP shutdown by authenticator */ 4248 break; 4249 4250 default: 4251 /* Unknown PAP packet type -- ignore. */ 4252 if (debug) { 4253 log(LOG_DEBUG, SPP_FMT "pap corrupted input " 4254 "<0x%x id=0x%x len=%d", 4255 SPP_ARGS(ifp), 4256 h->type, h->ident, ntohs(h->len)); 4257 if (len > 4) 4258 sppp_print_bytes((u_char*)(h+1), len-4); 4259 addlog(">\n"); 4260 } 4261 break; 4262 4263 } 4264 } 4265 4266 HIDE void 4267 sppp_pap_init(struct sppp *sp) 4268 { 4269 /* PAP doesn't have STATE_INITIAL at all. */ 4270 sp->state[IDX_PAP] = STATE_CLOSED; 4271 sp->fail_counter[IDX_PAP] = 0; 4272 #if defined (__FreeBSD__) 4273 callout_handle_init(&sp->ch[IDX_PAP]); 4274 callout_handle_init(&sp->pap_my_to_ch); 4275 #endif 4276 } 4277 4278 HIDE void 4279 sppp_pap_open(struct sppp *sp) 4280 { 4281 if (sp->hisauth.proto == PPP_PAP && 4282 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) { 4283 /* we are authenticator for PAP, start our timer */ 4284 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4285 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4286 } 4287 if (sp->myauth.proto == PPP_PAP) { 4288 /* we are peer, send a request, and start a timer */ 4289 pap.scr(sp); 4290 #if defined (__FreeBSD__) 4291 sp->pap_my_to_ch = 4292 timeout(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout); 4293 #elif defined (__OpenBSD__) 4294 timeout_add(&sp->pap_my_to_ch, sp->lcp.timeout); 4295 #endif 4296 } 4297 } 4298 4299 HIDE void 4300 sppp_pap_close(struct sppp *sp) 4301 { 4302 if (sp->state[IDX_PAP] != STATE_CLOSED) 4303 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4304 } 4305 4306 /* 4307 * That's the timeout routine if we are authenticator. Since the 4308 * authenticator is basically passive in PAP, we can't do much here. 4309 */ 4310 HIDE void 4311 sppp_pap_TO(void *cookie) 4312 { 4313 struct sppp *sp = (struct sppp *)cookie; 4314 STDDCL; 4315 int s; 4316 4317 s = splnet(); 4318 if (debug) 4319 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n", 4320 SPP_ARGS(ifp), 4321 sppp_state_name(sp->state[IDX_PAP]), 4322 sp->rst_counter[IDX_PAP]); 4323 4324 if (--sp->rst_counter[IDX_PAP] < 0) 4325 /* TO- event */ 4326 switch (sp->state[IDX_PAP]) { 4327 case STATE_REQ_SENT: 4328 pap.tld(sp); 4329 sppp_cp_change_state(&pap, sp, STATE_CLOSED); 4330 break; 4331 } 4332 else 4333 /* TO+ event, not very much we could do */ 4334 switch (sp->state[IDX_PAP]) { 4335 case STATE_REQ_SENT: 4336 /* sppp_cp_change_state() will restart the timer */ 4337 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT); 4338 break; 4339 } 4340 4341 splx(s); 4342 } 4343 4344 /* 4345 * That's the timeout handler if we are peer. Since the peer is active, 4346 * we need to retransmit our PAP request since it is apparently lost. 4347 * XXX We should impose a max counter. 4348 */ 4349 HIDE void 4350 sppp_pap_my_TO(void *cookie) 4351 { 4352 struct sppp *sp = (struct sppp *)cookie; 4353 STDDCL; 4354 4355 if (debug) 4356 log(LOG_DEBUG, SPP_FMT "pap peer TO\n", 4357 SPP_ARGS(ifp)); 4358 4359 pap.scr(sp); 4360 } 4361 4362 HIDE void 4363 sppp_pap_tlu(struct sppp *sp) 4364 { 4365 STDDCL; 4366 int x; 4367 4368 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure; 4369 4370 if (debug) 4371 log(LOG_DEBUG, SPP_FMT "%s tlu\n", 4372 SPP_ARGS(ifp), pap.name); 4373 4374 x = splnet(); 4375 /* indicate to LCP that we need to be closed down */ 4376 sp->lcp.protos |= (1 << IDX_PAP); 4377 4378 if (sp->pp_flags & PP_NEEDAUTH) { 4379 /* 4380 * Remote is authenticator, but his auth proto didn't 4381 * complete yet. Defer the transition to network 4382 * phase. 4383 */ 4384 splx(x); 4385 return; 4386 } 4387 splx(x); 4388 sppp_phase_network(sp); 4389 } 4390 4391 HIDE void 4392 sppp_pap_tld(struct sppp *sp) 4393 { 4394 STDDCL; 4395 4396 if (debug) 4397 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp)); 4398 UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]); 4399 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch); 4400 sp->lcp.protos &= ~(1 << IDX_PAP); 4401 4402 lcp.Close(sp); 4403 } 4404 4405 HIDE void 4406 sppp_pap_scr(struct sppp *sp) 4407 { 4408 u_char idlen, pwdlen; 4409 4410 sp->confid[IDX_PAP] = ++sp->pp_seq; 4411 pwdlen = strlen(sp->myauth.secret); 4412 idlen = strlen(sp->myauth.name); 4413 4414 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP], 4415 sizeof idlen, (const char *)&idlen, 4416 (size_t)idlen, sp->myauth.name, 4417 sizeof pwdlen, (const char *)&pwdlen, 4418 (size_t)pwdlen, sp->myauth.secret, 4419 0); 4420 } 4421 /* 4422 * Random miscellaneous functions. 4423 */ 4424 4425 /* 4426 * Send a PAP or CHAP proto packet. 4427 * 4428 * Varadic function, each of the elements for the ellipsis is of type 4429 * ``size_t mlen, const u_char *msg''. Processing will stop iff 4430 * mlen == 0. 4431 */ 4432 4433 HIDE void 4434 sppp_auth_send(const struct cp *cp, struct sppp *sp, 4435 unsigned int type, u_int id, ...) 4436 { 4437 STDDCL; 4438 struct ppp_header *h; 4439 struct lcp_header *lh; 4440 struct mbuf *m; 4441 u_char *p; 4442 int len; 4443 size_t pkthdrlen; 4444 unsigned int mlen; 4445 const char *msg; 4446 va_list ap; 4447 4448 MGETHDR (m, M_DONTWAIT, MT_DATA); 4449 if (! m) 4450 return; 4451 m->m_pkthdr.rcvif = 0; 4452 4453 if (sp->pp_flags & PP_NOFRAMING) { 4454 *mtod(m, u_int16_t *) = htons(cp->proto); 4455 pkthdrlen = 2; 4456 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2); 4457 } else { 4458 h = mtod (m, struct ppp_header*); 4459 h->address = PPP_ALLSTATIONS; /* broadcast address */ 4460 h->control = PPP_UI; /* Unnumbered Info */ 4461 h->protocol = htons(cp->proto); 4462 pkthdrlen = PPP_HEADER_LEN; 4463 lh = (struct lcp_header*)(h + 1); 4464 } 4465 4466 lh->type = type; 4467 lh->ident = id; 4468 p = (u_char*) (lh+1); 4469 4470 va_start(ap, id); 4471 len = 0; 4472 4473 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) { 4474 msg = va_arg(ap, const char *); 4475 len += mlen; 4476 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) { 4477 va_end(ap); 4478 m_freem(m); 4479 return; 4480 } 4481 4482 bcopy(msg, p, mlen); 4483 p += mlen; 4484 } 4485 va_end(ap); 4486 4487 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len; 4488 lh->len = htons (LCP_HEADER_LEN + len); 4489 4490 if (debug) { 4491 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d", 4492 SPP_ARGS(ifp), cp->name, 4493 sppp_auth_type_name(cp->proto, lh->type), 4494 lh->ident, ntohs(lh->len)); 4495 if (len) 4496 sppp_print_bytes((u_char*) (lh+1), len); 4497 addlog(">\n"); 4498 } 4499 if (IF_QFULL (&sp->pp_cpq)) { 4500 IF_DROP (&sp->pp_fastq); 4501 IF_DROP (&ifp->if_snd); 4502 m_freem (m); 4503 ++ifp->if_oerrors; 4504 m = NULL; 4505 } else 4506 IF_ENQUEUE (&sp->pp_cpq, m); 4507 if (! (ifp->if_flags & IFF_OACTIVE)) 4508 (*ifp->if_start) (ifp); 4509 if (m != NULL) 4510 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes; 4511 } 4512 4513 /* 4514 * Flush interface queue. 4515 */ 4516 HIDE void 4517 sppp_qflush(struct ifqueue *ifq) 4518 { 4519 struct mbuf *m, *n; 4520 4521 n = ifq->ifq_head; 4522 while ((m = n)) { 4523 n = m->m_act; 4524 m_freem (m); 4525 } 4526 ifq->ifq_head = 0; 4527 ifq->ifq_tail = 0; 4528 ifq->ifq_len = 0; 4529 } 4530 4531 /* 4532 * Send keepalive packets, every 10 seconds. 4533 */ 4534 HIDE void 4535 sppp_keepalive(void *dummy) 4536 { 4537 struct sppp *sp; 4538 int s; 4539 struct timeval tv; 4540 4541 s = splnet(); 4542 getmicrouptime(&tv); 4543 for (sp=spppq; sp; sp=sp->pp_next) { 4544 struct ifnet *ifp = &sp->pp_if; 4545 4546 /* Keepalive mode disabled or channel down? */ 4547 if (! (sp->pp_flags & PP_KEEPALIVE) || 4548 ! (ifp->if_flags & IFF_RUNNING)) 4549 continue; 4550 4551 /* No keepalive in PPP mode if LCP not opened yet. */ 4552 if (! (sp->pp_flags & PP_CISCO) && 4553 sp->pp_phase < PHASE_AUTHENTICATE) 4554 continue; 4555 4556 /* No echo reply, but maybe user data passed through? */ 4557 if (!(sp->pp_flags & PP_CISCO) && 4558 (tv.tv_sec - sp->pp_last_receive) < NORECV_TIME) { 4559 sp->pp_alivecnt = 0; 4560 continue; 4561 } 4562 4563 if (sp->pp_alivecnt >= MAXALIVECNT) { 4564 /* No keepalive packets got. Stop the interface. */ 4565 if_down (ifp); 4566 sppp_qflush (&sp->pp_cpq); 4567 if (! (sp->pp_flags & PP_CISCO)) { 4568 log(LOG_INFO, SPP_FMT "LCP keepalive timeout\n", 4569 SPP_ARGS(ifp)); 4570 sp->pp_alivecnt = 0; 4571 4572 /* we are down, close all open protocols */ 4573 lcp.Close(sp); 4574 4575 /* And now prepare LCP to reestablish the link, if configured to do so. */ 4576 sppp_cp_change_state(&lcp, sp, STATE_STOPPED); 4577 4578 /* Close connection immediately, completition of this 4579 * will summon the magic needed to reestablish it. */ 4580 if (sp->pp_tlf) 4581 sp->pp_tlf(sp); 4582 continue; 4583 } 4584 } 4585 if (sp->pp_alivecnt < MAXALIVECNT) 4586 ++sp->pp_alivecnt; 4587 if (sp->pp_flags & PP_CISCO) 4588 sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq, 4589 sp->pp_rseq); 4590 else if (sp->pp_phase >= PHASE_AUTHENTICATE) { 4591 unsigned long nmagic = htonl (sp->lcp.magic); 4592 sp->lcp.echoid = ++sp->pp_seq; 4593 sppp_cp_send (sp, PPP_LCP, ECHO_REQ, 4594 sp->lcp.echoid, 4, &nmagic); 4595 } 4596 } 4597 splx(s); 4598 #if defined (__FreeBSD__) 4599 keepalive_ch = timeout(sppp_keepalive, 0, hz * 10); 4600 #endif 4601 #if defined (__OpenBSD__) 4602 timeout_add_sec(&keepalive_ch, 10); 4603 #endif 4604 } 4605 4606 /* 4607 * Get both IP addresses. 4608 */ 4609 HIDE void 4610 sppp_get_ip_addrs(struct sppp *sp, u_int32_t *src, u_int32_t *dst, 4611 u_int32_t *srcmask) 4612 { 4613 struct ifnet *ifp = &sp->pp_if; 4614 struct ifaddr *ifa; 4615 struct sockaddr_in *si, *sm = 0; 4616 u_int32_t ssrc, ddst; 4617 4618 sm = NULL; 4619 ssrc = ddst = 0; 4620 /* 4621 * Pick the first AF_INET address from the list, 4622 * aliases don't make any sense on a p2p link anyway. 4623 */ 4624 #if defined (__FreeBSD__) 4625 for (ifa = ifp->if_addrhead.tqh_first, si = 0; 4626 ifa; 4627 ifa = ifa->ifa_link.tqe_next) 4628 #else 4629 si = 0; 4630 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4631 #endif 4632 { 4633 if (ifa->ifa_addr->sa_family == AF_INET) { 4634 si = (struct sockaddr_in *)ifa->ifa_addr; 4635 sm = (struct sockaddr_in *)ifa->ifa_netmask; 4636 if (si) 4637 break; 4638 } 4639 } 4640 if (ifa) { 4641 if (si && si->sin_addr.s_addr) { 4642 ssrc = si->sin_addr.s_addr; 4643 if (srcmask) 4644 *srcmask = ntohl(sm->sin_addr.s_addr); 4645 } 4646 4647 si = (struct sockaddr_in *)ifa->ifa_dstaddr; 4648 if (si && si->sin_addr.s_addr) 4649 ddst = si->sin_addr.s_addr; 4650 } 4651 4652 if (dst) *dst = ntohl(ddst); 4653 if (src) *src = ntohl(ssrc); 4654 } 4655 4656 /* 4657 * If an address is 0, leave it the way it is. 4658 */ 4659 HIDE void 4660 sppp_set_ip_addrs(struct sppp *sp, u_int32_t myaddr, u_int32_t hisaddr) 4661 { 4662 STDDCL; 4663 struct ifaddr *ifa; 4664 struct sockaddr_in *si; 4665 struct sockaddr_in *dest; 4666 4667 /* 4668 * Pick the first AF_INET address from the list, 4669 * aliases don't make any sense on a p2p link anyway. 4670 */ 4671 4672 #if defined (__FreeBSD__) 4673 for (ifa = ifp->if_addrhead.tqh_first, si = 0; 4674 ifa; 4675 ifa = ifa->ifa_link.tqe_next) 4676 #else 4677 si = 0; 4678 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 4679 #endif 4680 { 4681 if (ifa->ifa_addr->sa_family == AF_INET) 4682 { 4683 si = (struct sockaddr_in *)ifa->ifa_addr; 4684 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4685 if (si) 4686 break; 4687 } 4688 } 4689 4690 if (ifa && si) { 4691 int error; 4692 struct sockaddr_in new_sin = *si; 4693 struct sockaddr_in new_dst = *dest; 4694 4695 /* 4696 * Scrub old routes now instead of calling in_ifinit with 4697 * scrub=1, because we may change the dstaddr 4698 * before the call to in_ifinit. 4699 */ 4700 in_ifscrub(ifp, ifatoia(ifa)); 4701 4702 if (myaddr != 0) 4703 new_sin.sin_addr.s_addr = htonl(myaddr); 4704 if (hisaddr != 0) { 4705 new_dst.sin_addr.s_addr = htonl(hisaddr); 4706 if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr) { 4707 sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr; 4708 *dest = new_dst; /* fix dstaddr in place */ 4709 } 4710 } 4711 if (!(error = in_ifinit(ifp, ifatoia(ifa), &new_sin, 0))) 4712 dohooks(ifp->if_addrhooks, 0); 4713 if (debug && error) { 4714 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit " 4715 " failed, error=%d\n", SPP_ARGS(ifp), error); 4716 } 4717 } 4718 } 4719 4720 /* 4721 * Clear IP addresses. Must be called at splnet. 4722 */ 4723 HIDE void 4724 sppp_clear_ip_addrs(struct sppp *sp) 4725 { 4726 struct ifnet *ifp = &sp->pp_if; 4727 struct ifaddr *ifa; 4728 struct sockaddr_in *si; 4729 struct sockaddr_in *dest; 4730 4731 u_int32_t remote; 4732 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4733 remote = sp->ipcp.saved_hisaddr; 4734 else 4735 sppp_get_ip_addrs(sp, 0, &remote, 0); 4736 4737 /* 4738 * Pick the first AF_INET address from the list, 4739 * aliases don't make any sense on a p2p link anyway. 4740 */ 4741 4742 si = 0; 4743 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4744 if (ifa->ifa_addr->sa_family == AF_INET) { 4745 si = (struct sockaddr_in *)ifa->ifa_addr; 4746 dest = (struct sockaddr_in *)ifa->ifa_dstaddr; 4747 if (si) 4748 break; 4749 } 4750 } 4751 4752 if (ifa && si) { 4753 struct sockaddr_in new_sin = *si; 4754 4755 in_ifscrub(ifp, ifatoia(ifa)); 4756 if (sp->ipcp.flags & IPCP_MYADDR_DYN) 4757 new_sin.sin_addr.s_addr = 0; 4758 if (sp->ipcp.flags & IPCP_HISADDR_DYN) 4759 /* replace peer addr in place */ 4760 dest->sin_addr.s_addr = sp->ipcp.saved_hisaddr; 4761 if (!in_ifinit(ifp, ifatoia(ifa), &new_sin, 0)) 4762 dohooks(ifp->if_addrhooks, 0); 4763 } 4764 } 4765 4766 4767 #ifdef INET6 4768 /* 4769 * Get both IPv6 addresses. 4770 */ 4771 HIDE void 4772 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst, 4773 struct in6_addr *srcmask) 4774 { 4775 struct ifnet *ifp = &sp->pp_if; 4776 struct ifaddr *ifa; 4777 struct sockaddr_in6 *si, *sm; 4778 struct in6_addr ssrc, ddst; 4779 4780 sm = NULL; 4781 bzero(&ssrc, sizeof(ssrc)); 4782 bzero(&ddst, sizeof(ddst)); 4783 /* 4784 * Pick the first link-local AF_INET6 address from the list, 4785 * aliases don't make any sense on a p2p link anyway. 4786 */ 4787 si = 0; 4788 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4789 if (ifa->ifa_addr->sa_family == AF_INET6) { 4790 si = (struct sockaddr_in6 *)ifa->ifa_addr; 4791 sm = (struct sockaddr_in6 *)ifa->ifa_netmask; 4792 if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr)) 4793 break; 4794 } 4795 } 4796 4797 if (ifa) { 4798 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) { 4799 bcopy(&si->sin6_addr, &ssrc, sizeof(ssrc)); 4800 if (srcmask) { 4801 bcopy(&sm->sin6_addr, srcmask, 4802 sizeof(*srcmask)); 4803 } 4804 } 4805 4806 si = (struct sockaddr_in6 *)ifa->ifa_dstaddr; 4807 if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) 4808 bcopy(&si->sin6_addr, &ddst, sizeof(ddst)); 4809 } 4810 4811 if (dst) 4812 bcopy(&ddst, dst, sizeof(*dst)); 4813 if (src) 4814 bcopy(&ssrc, src, sizeof(*src)); 4815 } 4816 4817 #ifdef IPV6CP_MYIFID_DYN 4818 /* 4819 * Generate random ifid. 4820 */ 4821 HIDE void 4822 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr) 4823 { 4824 /* TBD */ 4825 } 4826 4827 /* 4828 * Set my IPv6 address. Must be called at splnet. 4829 */ 4830 HIDE void 4831 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src) 4832 { 4833 struct ifnet *ifp = &sp->pp_if; 4834 struct ifaddr *ifa; 4835 struct sockaddr_in6 *sin6; 4836 4837 /* 4838 * Pick the first link-local AF_INET6 address from the list, 4839 * aliases don't make any sense on a p2p link anyway. 4840 */ 4841 4842 sin6 = NULL; 4843 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 4844 if (ifa->ifa_addr->sa_family == AF_INET6) { 4845 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 4846 if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 4847 break; 4848 } 4849 } 4850 4851 if (ifa && sin6) { 4852 struct sockaddr_in6 new_sin6 = *sin6; 4853 bcopy(src, &new_sin6.sin6_addr, sizeof(new_sin6.sin6_addr)); 4854 dohooks(ifp->if_addrhooks, 0); 4855 } 4856 } 4857 #endif 4858 4859 /* 4860 * Suggest a candidate address to be used by peer. 4861 */ 4862 HIDE void 4863 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest) 4864 { 4865 struct in6_addr myaddr; 4866 struct timeval tv; 4867 4868 sppp_get_ip6_addrs(sp, &myaddr, 0, 0); 4869 4870 myaddr.s6_addr[8] &= ~0x02; /* u bit to "local" */ 4871 getmicrouptime(&tv); 4872 if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) { 4873 myaddr.s6_addr[14] ^= 0xff; 4874 myaddr.s6_addr[15] ^= 0xff; 4875 } else { 4876 myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff); 4877 myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff); 4878 } 4879 if (suggest) 4880 bcopy(&myaddr, suggest, sizeof(myaddr)); 4881 } 4882 #endif /*INET6*/ 4883 4884 HIDE int 4885 sppp_get_params(struct sppp *sp, struct ifreq *ifr) 4886 { 4887 int cmd; 4888 4889 if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0) 4890 return EFAULT; 4891 4892 switch (cmd) { 4893 case SPPPIOGDEFS: 4894 { 4895 struct spppreq *spr; 4896 4897 spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK); 4898 4899 /* 4900 * We copy over the entire current state, but clean 4901 * out some of the stuff we don't wanna pass up. 4902 * Remember, SIOCGIFGENERIC is unprotected, and can be 4903 * called by any user. No need to ever get PAP or 4904 * CHAP secrets back to userland anyway. 4905 */ 4906 4907 spr->cmd = cmd; 4908 bcopy(sp, &spr->defs, sizeof(struct sppp)); 4909 4910 bzero(&spr->defs.myauth, sizeof(spr->defs.myauth)); 4911 bzero(&spr->defs.hisauth, sizeof(spr->defs.hisauth)); 4912 bzero(&spr->defs.chap_challenge, sizeof(spr->defs.chap_challenge)); 4913 4914 if (copyout(spr, (caddr_t)ifr->ifr_data, sizeof(*spr)) != 0) { 4915 free(spr, M_DEVBUF); 4916 return EFAULT; 4917 } 4918 free(spr, M_DEVBUF); 4919 break; 4920 } 4921 case SPPPIOGMAUTH: 4922 case SPPPIOGHAUTH: 4923 { 4924 struct sauthreq *spa; 4925 struct sauth *auth; 4926 4927 spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK); 4928 auth = (cmd == SPPPIOGMAUTH) ? &sp->myauth : &sp->hisauth; 4929 bzero(spa, sizeof(*spa)); 4930 spa->proto = auth->proto; 4931 spa->flags = auth->flags; 4932 4933 /* do not copy the secret, and only let root know the name */ 4934 if (auth->name != NULL && suser(curproc, 0) == 0) 4935 strlcpy(spa->name, auth->name, sizeof(spa->name)); 4936 4937 if (copyout(spa, (caddr_t)ifr->ifr_data, sizeof(*spa)) != 0) { 4938 free(spa, M_DEVBUF); 4939 return EFAULT; 4940 } 4941 free(spa, M_DEVBUF); 4942 break; 4943 } 4944 default: 4945 return EINVAL; 4946 } 4947 4948 return 0; 4949 } 4950 4951 4952 HIDE int 4953 sppp_set_params(struct sppp *sp, struct ifreq *ifr) 4954 { 4955 int cmd; 4956 4957 if (copyin((caddr_t)ifr->ifr_data, &cmd, sizeof cmd) != 0) 4958 return EFAULT; 4959 4960 /* 4961 * We have a very specific idea of which fields we allow 4962 * being passed back from userland, so to not clobber our 4963 * current state. For one, we only allow setting 4964 * anything if LCP is in dead phase. Once the LCP 4965 * negotiations started, the authentication settings must 4966 * not be changed again. (The administrator can force an 4967 * ifconfig down in order to get LCP back into dead 4968 * phase.) 4969 */ 4970 if (sp->pp_phase != PHASE_DEAD) 4971 return EBUSY; 4972 4973 switch (cmd) { 4974 case SPPPIOSDEFS: 4975 { 4976 struct spppreq *spr; 4977 4978 spr = malloc(sizeof(*spr), M_DEVBUF, M_WAITOK); 4979 4980 if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(*spr)) != 0) { 4981 free(spr, M_DEVBUF); 4982 return EFAULT; 4983 } 4984 /* 4985 * Also, we only allow for authentication parameters to be 4986 * specified. 4987 * 4988 * XXX Should allow to set or clear pp_flags. 4989 */ 4990 free(spr, M_DEVBUF); 4991 break; 4992 } 4993 case SPPPIOSMAUTH: 4994 case SPPPIOSHAUTH: 4995 { 4996 /* 4997 * Finally, if the respective authentication protocol to 4998 * be used is set differently than 0, but the secret is 4999 * passed as all zeros, we don't trash the existing secret. 5000 * This allows an administrator to change the system name 5001 * only without clobbering the secret (which he didn't get 5002 * back in a previous SPPPIOGXAUTH call). However, the 5003 * secrets are cleared if the authentication protocol is 5004 * reset to 0. 5005 */ 5006 5007 struct sauthreq *spa; 5008 struct sauth *auth; 5009 char *p; 5010 int len; 5011 5012 spa = malloc(sizeof(*spa), M_DEVBUF, M_WAITOK); 5013 5014 auth = (cmd == SPPPIOSMAUTH) ? &sp->myauth : &sp->hisauth; 5015 5016 if (copyin((caddr_t)ifr->ifr_data, spa, sizeof(*spa)) != 0) { 5017 free(spa, M_DEVBUF); 5018 return EFAULT; 5019 } 5020 5021 if (spa->proto != 0 && spa->proto != PPP_PAP && 5022 spa->proto != PPP_CHAP) { 5023 free(spa, M_DEVBUF); 5024 return EINVAL; 5025 } 5026 5027 if (spa->proto == 0) { 5028 /* resetting auth */ 5029 if (auth->name != NULL) 5030 free(auth->name, M_DEVBUF); 5031 if (auth->secret != NULL) 5032 free(auth->secret, M_DEVBUF); 5033 bzero(auth, sizeof *auth); 5034 bzero(sp->chap_challenge, sizeof sp->chap_challenge); 5035 } else { 5036 /* setting/changing auth */ 5037 auth->proto = spa->proto; 5038 auth->flags = spa->flags; 5039 5040 spa->name[AUTHMAXLEN - 1] = '\0'; 5041 len = strlen(spa->name) + 1; 5042 p = malloc(len, M_DEVBUF, M_WAITOK); 5043 strlcpy(p, spa->name, len); 5044 if (auth->name != NULL) 5045 free(auth->name, M_DEVBUF); 5046 auth->name = p; 5047 5048 if (spa->secret[0] != '\0') { 5049 spa->secret[AUTHMAXLEN - 1] = '\0'; 5050 len = strlen(spa->secret) + 1; 5051 p = malloc(len, M_DEVBUF, M_WAITOK); 5052 strlcpy(p, spa->secret, len); 5053 if (auth->secret != NULL) 5054 free(auth->secret, M_DEVBUF); 5055 auth->secret = p; 5056 } 5057 } 5058 free(spa, M_DEVBUF); 5059 break; 5060 } 5061 default: 5062 return EINVAL; 5063 } 5064 5065 return 0; 5066 } 5067 5068 HIDE void 5069 sppp_phase_network(struct sppp *sp) 5070 { 5071 int i; 5072 u_long mask; 5073 5074 sp->pp_phase = PHASE_NETWORK; 5075 5076 sppp_set_phase(sp); 5077 5078 /* Notify NCPs now. */ 5079 for (i = 0; i < IDX_COUNT; i++) 5080 if ((cps[i])->flags & CP_NCP) 5081 (cps[i])->Open(sp); 5082 5083 /* Send Up events to all NCPs. */ 5084 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) 5085 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_NCP)) 5086 (cps[i])->Up(sp); 5087 5088 /* if no NCP is starting, all this was in vain, close down */ 5089 sppp_lcp_check_and_close(sp); 5090 } 5091 5092 5093 HIDE const char * 5094 sppp_cp_type_name(u_char type) 5095 { 5096 static char buf[12]; 5097 switch (type) { 5098 case CONF_REQ: return "conf-req"; 5099 case CONF_ACK: return "conf-ack"; 5100 case CONF_NAK: return "conf-nak"; 5101 case CONF_REJ: return "conf-rej"; 5102 case TERM_REQ: return "term-req"; 5103 case TERM_ACK: return "term-ack"; 5104 case CODE_REJ: return "code-rej"; 5105 case PROTO_REJ: return "proto-rej"; 5106 case ECHO_REQ: return "echo-req"; 5107 case ECHO_REPLY: return "echo-reply"; 5108 case DISC_REQ: return "discard-req"; 5109 } 5110 snprintf (buf, sizeof buf, "0x%x", type); 5111 return buf; 5112 } 5113 5114 HIDE const char * 5115 sppp_auth_type_name(u_short proto, u_char type) 5116 { 5117 static char buf[12]; 5118 switch (proto) { 5119 case PPP_CHAP: 5120 switch (type) { 5121 case CHAP_CHALLENGE: return "challenge"; 5122 case CHAP_RESPONSE: return "response"; 5123 case CHAP_SUCCESS: return "success"; 5124 case CHAP_FAILURE: return "failure"; 5125 } 5126 case PPP_PAP: 5127 switch (type) { 5128 case PAP_REQ: return "req"; 5129 case PAP_ACK: return "ack"; 5130 case PAP_NAK: return "nak"; 5131 } 5132 } 5133 snprintf (buf, sizeof buf, "0x%x", type); 5134 return buf; 5135 } 5136 5137 HIDE const char * 5138 sppp_lcp_opt_name(u_char opt) 5139 { 5140 static char buf[12]; 5141 switch (opt) { 5142 case LCP_OPT_MRU: return "mru"; 5143 case LCP_OPT_ASYNC_MAP: return "async-map"; 5144 case LCP_OPT_AUTH_PROTO: return "auth-proto"; 5145 case LCP_OPT_QUAL_PROTO: return "qual-proto"; 5146 case LCP_OPT_MAGIC: return "magic"; 5147 case LCP_OPT_PROTO_COMP: return "proto-comp"; 5148 case LCP_OPT_ADDR_COMP: return "addr-comp"; 5149 } 5150 snprintf (buf, sizeof buf, "0x%x", opt); 5151 return buf; 5152 } 5153 5154 HIDE const char * 5155 sppp_ipcp_opt_name(u_char opt) 5156 { 5157 static char buf[12]; 5158 switch (opt) { 5159 case IPCP_OPT_ADDRESSES: return "addresses"; 5160 case IPCP_OPT_COMPRESSION: return "compression"; 5161 case IPCP_OPT_ADDRESS: return "address"; 5162 } 5163 snprintf (buf, sizeof buf, "0x%x", opt); 5164 return buf; 5165 } 5166 5167 #ifdef INET6 5168 HIDE const char * 5169 sppp_ipv6cp_opt_name(u_char opt) 5170 { 5171 static char buf[12]; 5172 switch (opt) { 5173 case IPV6CP_OPT_IFID: return "ifid"; 5174 case IPV6CP_OPT_COMPRESSION: return "compression"; 5175 } 5176 snprintf (buf, sizeof buf, "0x%x", opt); 5177 return buf; 5178 } 5179 #endif 5180 5181 HIDE const char * 5182 sppp_state_name(int state) 5183 { 5184 switch (state) { 5185 case STATE_INITIAL: return "initial"; 5186 case STATE_STARTING: return "starting"; 5187 case STATE_CLOSED: return "closed"; 5188 case STATE_STOPPED: return "stopped"; 5189 case STATE_CLOSING: return "closing"; 5190 case STATE_STOPPING: return "stopping"; 5191 case STATE_REQ_SENT: return "req-sent"; 5192 case STATE_ACK_RCVD: return "ack-rcvd"; 5193 case STATE_ACK_SENT: return "ack-sent"; 5194 case STATE_OPENED: return "opened"; 5195 } 5196 return "illegal"; 5197 } 5198 5199 HIDE const char * 5200 sppp_phase_name(enum ppp_phase phase) 5201 { 5202 switch (phase) { 5203 case PHASE_DEAD: return "dead"; 5204 case PHASE_ESTABLISH: return "establish"; 5205 case PHASE_TERMINATE: return "terminate"; 5206 case PHASE_AUTHENTICATE: return "authenticate"; 5207 case PHASE_NETWORK: return "network"; 5208 } 5209 return "illegal"; 5210 } 5211 5212 HIDE const char * 5213 sppp_proto_name(u_short proto) 5214 { 5215 static char buf[12]; 5216 switch (proto) { 5217 case PPP_LCP: return "lcp"; 5218 case PPP_IPCP: return "ipcp"; 5219 case PPP_PAP: return "pap"; 5220 case PPP_CHAP: return "chap"; 5221 } 5222 snprintf(buf, sizeof buf, "0x%x", (unsigned)proto); 5223 return buf; 5224 } 5225 5226 HIDE void 5227 sppp_print_bytes(const u_char *p, u_short len) 5228 { 5229 addlog(" %02x", *p++); 5230 while (--len > 0) 5231 addlog("-%02x", *p++); 5232 } 5233 5234 HIDE void 5235 sppp_print_string(const char *p, u_short len) 5236 { 5237 u_char c; 5238 5239 while (len-- > 0) { 5240 c = *p++; 5241 /* 5242 * Print only ASCII chars directly. RFC 1994 recommends 5243 * using only them, but we don't rely on it. */ 5244 if (c < ' ' || c > '~') 5245 addlog("\\x%x", c); 5246 else 5247 addlog("%c", c); 5248 } 5249 } 5250 5251 HIDE const char * 5252 sppp_dotted_quad(u_int32_t addr) 5253 { 5254 static char s[16]; 5255 snprintf(s, sizeof s, "%d.%d.%d.%d", 5256 (int)((addr >> 24) & 0xff), 5257 (int)((addr >> 16) & 0xff), 5258 (int)((addr >> 8) & 0xff), 5259 (int)(addr & 0xff)); 5260 return s; 5261 } 5262 5263 /* a dummy, used to drop uninteresting events */ 5264 HIDE void 5265 sppp_null(struct sppp *unused) 5266 { 5267 /* do just nothing */ 5268 } 5269 /* 5270 * This file is large. Tell emacs to highlight it nevertheless. 5271 * 5272 * Local Variables: 5273 * hilit-auto-highlight-maxout: 120000 5274 * End: 5275 */ 5276 5277 HIDE void 5278 sppp_set_phase(struct sppp *sp) 5279 { 5280 STDDCL; 5281 int lstate, s; 5282 5283 if (debug) 5284 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp), 5285 sppp_phase_name(sp->pp_phase)); 5286 5287 /* set link state */ 5288 if (sp->pp_phase == PHASE_NETWORK) 5289 lstate = LINK_STATE_UP; 5290 else 5291 lstate = LINK_STATE_DOWN; 5292 5293 if (ifp->if_link_state != lstate) { 5294 ifp->if_link_state = lstate; 5295 s = splsoftnet(); 5296 if_link_state_change(ifp); 5297 splx(s); 5298 } 5299 } 5300