1 /** $MirOS: src/sys/net/if_spppsubr.c,v 1.11 2011/11/20 18:54:48 tg Exp $ */
2 /* $OpenBSD: if_spppsubr.c,v 1.34 2005/06/08 06:55:33 henning Exp $ */
3 /*
4 * Synchronous PPP/Cisco link level subroutines.
5 * Keepalive protocol implemented in both Cisco and PPP modes.
6 *
7 * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
8 * Author: Serge Vakulenko, <vak@cronyx.ru>
9 *
10 * Heavily revamped to conform to RFC 1661.
11 * Copyright (C) 1997, Joerg Wunsch.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions are met:
15 * 1. Redistributions of source code must retain the above copyright notice,
16 * this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright notice,
18 * this list of conditions and the following disclaimer in the documentation
19 * and/or other materials provided with the distribution.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
22 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
25 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * From: Version 2.6, Tue May 12 17:10:39 MSD 1998
34 */
35
36 #include <sys/param.h>
37
38 #if defined (__FreeBSD__)
39 #include "opt_inet.h"
40 #include "opt_ipx.h"
41 #endif
42
43 #ifdef NetBSD1_3
44 # if NetBSD1_3 > 6
45 # include "opt_inet.h"
46 # include "opt_iso.h"
47 # endif
48 #endif
49
50 #ifdef __OpenBSD__
51 #define HIDE
52 #else
53 #define HIDE static
54 #endif
55
56 #include <sys/systm.h>
57 #include <sys/kernel.h>
58 #include <sys/sockio.h>
59 #include <sys/socket.h>
60 #include <sys/syslog.h>
61 #include <sys/malloc.h>
62 #include <sys/mbuf.h>
63
64 #if defined (__OpenBSD__)
65 #include <sys/timeout.h>
66 #include <syskern/md5.h>
67 #else
68 #include <sys/md5.h>
69 #endif
70
71 #include <net/if.h>
72 #include <net/netisr.h>
73 #include <net/if_types.h>
74
75 #if defined (__FreeBSD__) || defined(__OpenBSD_) || defined(__NetBSD__)
76 #include <machine/random.h>
77 #endif
78 #include <dev/rndvar.h>
79 #if defined (__NetBSD__) || defined (__OpenBSD__)
80 #include <machine/cpu.h> /* XXX for softnet */
81 #endif
82 #include <sys/stdarg.h>
83
84 #ifdef INET
85 #include <netinet/in.h>
86 #include <netinet/in_systm.h>
87 #include <netinet/in_var.h>
88 #include <netinet/ip.h>
89 #include <netinet/tcp.h>
90 # if defined (__FreeBSD__) || defined (__OpenBSD__)
91 # include <netinet/if_ether.h>
92 # else
93 # include <net/ethertypes.h>
94 # endif
95 #else
96 # error Huh? sppp without INET?
97 #endif
98
99 #ifdef IPX
100 #include <netipx/ipx.h>
101 #include <netipx/ipx_if.h>
102 #endif
103
104 #include <net/if_sppp.h>
105
106 #if defined (__FreeBSD__)
107 # define UNTIMEOUT(fun, arg, handle) \
108 untimeout(fun, arg, handle)
109 #elif defined(__OpenBSD__)
110 # define UNTIMEOUT(fun, arg, handle) \
111 timeout_del(&(handle))
112 #else
113 # define UNTIMEOUT(fun, arg, handle) \
114 untimeout(fun, arg)
115 #endif
116
117 #define LOOPALIVECNT 3 /* loopback detection tries */
118 #define MAXALIVECNT 3 /* max. missed alive packets */
119 #define NORECV_TIME 15 /* before we get worried */
120
121 /*XXX*/
122 static void
getmicrouptime(struct timeval * tv)123 getmicrouptime(struct timeval *tv)
124 {
125 tv->tv_sec = time.tv_sec - boottime.tv_sec;
126 tv->tv_usec = 0;
127 }
128 /*XXX*/
129
130 /*
131 * Interface flags that can be set in an ifconfig command.
132 *
133 * Setting link0 will make the link passive, i.e. it will be marked
134 * as being administrative openable, but won't be opened to begin
135 * with. Incoming calls will be answered, or subsequent calls with
136 * -link1 will cause the administrative open of the LCP layer.
137 *
138 * Setting link1 will cause the link to auto-dial only as packets
139 * arrive to be sent.
140 *
141 * Setting IFF_DEBUG will syslog the option negotiation and state
142 * transitions at level kern.debug. Note: all logs consistently look
143 * like
144 *
145 * <if-name><unit>: <proto-name> <additional info...>
146 *
147 * with <if-name><unit> being something like "bppp0", and <proto-name>
148 * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
149 */
150
151 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */
152 #define IFF_AUTO IFF_LINK1 /* auto-dial on output */
153
154 #define PPP_ALLSTATIONS 0xff /* All-Stations broadcast address */
155 #define PPP_UI 0x03 /* Unnumbered Information */
156 #define PPP_IP 0x0021 /* Internet Protocol */
157 #define PPP_ISO 0x0023 /* ISO OSI Protocol */
158 #define PPP_XNS 0x0025 /* Xerox NS Protocol */
159 #define PPP_IPX 0x002b /* Novell IPX Protocol */
160 #define PPP_LCP 0xc021 /* Link Control Protocol */
161 #define PPP_PAP 0xc023 /* Password Authentication Protocol */
162 #define PPP_CHAP 0xc223 /* Challenge-Handshake Auth Protocol */
163 #define PPP_IPCP 0x8021 /* Internet Protocol Control Protocol */
164
165 #define CONF_REQ 1 /* PPP configure request */
166 #define CONF_ACK 2 /* PPP configure acknowledge */
167 #define CONF_NAK 3 /* PPP configure negative ack */
168 #define CONF_REJ 4 /* PPP configure reject */
169 #define TERM_REQ 5 /* PPP terminate request */
170 #define TERM_ACK 6 /* PPP terminate acknowledge */
171 #define CODE_REJ 7 /* PPP code reject */
172 #define PROTO_REJ 8 /* PPP protocol reject */
173 #define ECHO_REQ 9 /* PPP echo request */
174 #define ECHO_REPLY 10 /* PPP echo reply */
175 #define DISC_REQ 11 /* PPP discard request */
176
177 #define LCP_OPT_MRU 1 /* maximum receive unit */
178 #define LCP_OPT_ASYNC_MAP 2 /* async control character map */
179 #define LCP_OPT_AUTH_PROTO 3 /* authentication protocol */
180 #define LCP_OPT_QUAL_PROTO 4 /* quality protocol */
181 #define LCP_OPT_MAGIC 5 /* magic number */
182 #define LCP_OPT_RESERVED 6 /* reserved */
183 #define LCP_OPT_PROTO_COMP 7 /* protocol field compression */
184 #define LCP_OPT_ADDR_COMP 8 /* address/control field compression */
185
186 #define IPCP_OPT_ADDRESSES 1 /* both IP addresses; deprecated */
187 #define IPCP_OPT_COMPRESSION 2 /* IP compression protocol (VJ) */
188 #define IPCP_OPT_ADDRESS 3 /* local IP address */
189
190 #define PAP_REQ 1 /* PAP name/password request */
191 #define PAP_ACK 2 /* PAP acknowledge */
192 #define PAP_NAK 3 /* PAP fail */
193
194 #define CHAP_CHALLENGE 1 /* CHAP challenge request */
195 #define CHAP_RESPONSE 2 /* CHAP challenge response */
196 #define CHAP_SUCCESS 3 /* CHAP response ok */
197 #define CHAP_FAILURE 4 /* CHAP response failed */
198
199 #define CHAP_MD5 5 /* hash algorithm - MD5 */
200
201 #define CISCO_MULTICAST 0x8f /* Cisco multicast address */
202 #define CISCO_UNICAST 0x0f /* Cisco unicast address */
203 #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */
204 #define CISCO_ADDR_REQ 0 /* Cisco address request */
205 #define CISCO_ADDR_REPLY 1 /* Cisco address reply */
206 #define CISCO_KEEPALIVE_REQ 2 /* Cisco keepalive request */
207
208 /* states are named and numbered according to RFC 1661 */
209 #define STATE_INITIAL 0
210 #define STATE_STARTING 1
211 #define STATE_CLOSED 2
212 #define STATE_STOPPED 3
213 #define STATE_CLOSING 4
214 #define STATE_STOPPING 5
215 #define STATE_REQ_SENT 6
216 #define STATE_ACK_RCVD 7
217 #define STATE_ACK_SENT 8
218 #define STATE_OPENED 9
219
220 struct ppp_header {
221 u_char address;
222 u_char control;
223 u_short protocol;
224 };
225 #define PPP_HEADER_LEN sizeof (struct ppp_header)
226
227 struct lcp_header {
228 u_char type;
229 u_char ident;
230 u_short len;
231 };
232 #define LCP_HEADER_LEN sizeof (struct lcp_header)
233
234 struct cisco_packet {
235 u_long type;
236 u_long par1;
237 u_long par2;
238 u_short rel;
239 u_short time0;
240 u_short time1;
241 };
242 #define CISCO_PACKET_LEN 18
243
244 /*
245 * We follow the spelling and capitalization of RFC 1661 here, to make
246 * it easier comparing with the standard. Please refer to this RFC in
247 * case you can't make sense out of these abbreviation; it will also
248 * explain the semantics related to the various events and actions.
249 */
250 struct cp {
251 u_short proto; /* PPP control protocol number */
252 u_char protoidx; /* index into state table in struct sppp */
253 u_char flags;
254 #define CP_LCP 0x01 /* this is the LCP */
255 #define CP_AUTH 0x02 /* this is an authentication protocol */
256 #define CP_NCP 0x04 /* this is a NCP */
257 #define CP_QUAL 0x08 /* this is a quality reporting protocol */
258 const char *name; /* name of this control protocol */
259 /* event handlers */
260 void (*Up)(struct sppp *sp);
261 void (*Down)(struct sppp *sp);
262 void (*Open)(struct sppp *sp);
263 void (*Close)(struct sppp *sp);
264 void (*TO)(void *sp);
265 int (*RCR)(struct sppp *sp, struct lcp_header *h, int len);
266 void (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
267 void (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
268 /* actions */
269 void (*tlu)(struct sppp *sp);
270 void (*tld)(struct sppp *sp);
271 void (*tls)(struct sppp *sp);
272 void (*tlf)(struct sppp *sp);
273 void (*scr)(struct sppp *sp);
274 };
275
276 static struct sppp *spppq;
277 #if defined (__OpenBSD__)
278 static struct timeout keepalive_ch;
279 #endif
280 #if defined (__FreeBSD__)
281 static struct callout_handle keepalive_ch;
282 #endif
283
284 #if defined (__FreeBSD__)
285 #define SPP_FMT "%s%d: "
286 #define SPP_ARGS(ifp) (ifp)->if_name, (ifp)->if_unit
287 #else
288 #define SPP_FMT "%s: "
289 #define SPP_ARGS(ifp) (ifp)->if_xname
290 #endif
291
292 /*
293 * The following disgusting hack gets around the problem that IP TOS
294 * can't be set yet. We want to put "interactive" traffic on a high
295 * priority queue. To decide if traffic is interactive, we check that
296 * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
297 *
298 * XXX is this really still necessary? - joerg -
299 */
300 static u_short interactive_ports[8] = {
301 0, 513, 0, 0,
302 0, 21, 0, 23,
303 };
304 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
305
306 /* almost every function needs these */
307 #define STDDCL \
308 struct ifnet *ifp = &sp->pp_if; \
309 int debug = ifp->if_flags & IFF_DEBUG
310
311 HIDE int sppp_output(struct ifnet *ifp, struct mbuf *m,
312 struct sockaddr *dst, struct rtentry *rt);
313
314 HIDE void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2);
315 HIDE void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
316
317 HIDE void sppp_cp_input(const struct cp *cp, struct sppp *sp,
318 struct mbuf *m);
319 HIDE void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
320 u_char ident, u_short len, void *data);
321 #ifdef notyet
322 HIDE void sppp_cp_timeout(void *arg);
323 #endif
324 HIDE void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
325 int newstate);
326 HIDE void sppp_auth_send(const struct cp *cp,
327 struct sppp *sp, unsigned int type, u_char id,
328 ...);
329
330 HIDE void sppp_up_event(const struct cp *cp, struct sppp *sp);
331 HIDE void sppp_down_event(const struct cp *cp, struct sppp *sp);
332 HIDE void sppp_open_event(const struct cp *cp, struct sppp *sp);
333 HIDE void sppp_close_event(const struct cp *cp, struct sppp *sp);
334 HIDE void sppp_increasing_timeout(const struct cp *cp, struct sppp *sp);
335 HIDE void sppp_to_event(const struct cp *cp, struct sppp *sp);
336
337 HIDE void sppp_null(struct sppp *sp);
338
339 HIDE void sppp_lcp_init(struct sppp *sp);
340 HIDE void sppp_lcp_up(struct sppp *sp);
341 HIDE void sppp_lcp_down(struct sppp *sp);
342 HIDE void sppp_lcp_open(struct sppp *sp);
343 HIDE void sppp_lcp_close(struct sppp *sp);
344 HIDE void sppp_lcp_TO(void *sp);
345 HIDE int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
346 HIDE void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
347 HIDE void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
348 HIDE void sppp_lcp_tlu(struct sppp *sp);
349 HIDE void sppp_lcp_tld(struct sppp *sp);
350 HIDE void sppp_lcp_tls(struct sppp *sp);
351 HIDE void sppp_lcp_tlf(struct sppp *sp);
352 HIDE void sppp_lcp_scr(struct sppp *sp);
353 HIDE void sppp_lcp_check_and_close(struct sppp *sp);
354 HIDE int sppp_ncp_check(struct sppp *sp);
355
356 HIDE void sppp_ipcp_init(struct sppp *sp);
357 HIDE void sppp_ipcp_up(struct sppp *sp);
358 HIDE void sppp_ipcp_down(struct sppp *sp);
359 HIDE void sppp_ipcp_open(struct sppp *sp);
360 HIDE void sppp_ipcp_close(struct sppp *sp);
361 HIDE void sppp_ipcp_TO(void *sp);
362 HIDE int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
363 HIDE void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
364 HIDE void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
365 HIDE void sppp_ipcp_tlu(struct sppp *sp);
366 HIDE void sppp_ipcp_tld(struct sppp *sp);
367 HIDE void sppp_ipcp_tls(struct sppp *sp);
368 HIDE void sppp_ipcp_tlf(struct sppp *sp);
369 HIDE void sppp_ipcp_scr(struct sppp *sp);
370
371 HIDE void sppp_pap_input(struct sppp *sp, struct mbuf *m);
372 HIDE void sppp_pap_init(struct sppp *sp);
373 HIDE void sppp_pap_open(struct sppp *sp);
374 HIDE void sppp_pap_close(struct sppp *sp);
375 HIDE void sppp_pap_TO(void *sp);
376 HIDE void sppp_pap_my_TO(void *sp);
377 HIDE void sppp_pap_tlu(struct sppp *sp);
378 HIDE void sppp_pap_tld(struct sppp *sp);
379 HIDE void sppp_pap_scr(struct sppp *sp);
380
381 HIDE void sppp_chap_input(struct sppp *sp, struct mbuf *m);
382 HIDE void sppp_chap_init(struct sppp *sp);
383 HIDE void sppp_chap_open(struct sppp *sp);
384 HIDE void sppp_chap_close(struct sppp *sp);
385 HIDE void sppp_chap_TO(void *sp);
386 HIDE void sppp_chap_tlu(struct sppp *sp);
387 HIDE void sppp_chap_tld(struct sppp *sp);
388 HIDE void sppp_chap_scr(struct sppp *sp);
389
390 HIDE const char *sppp_auth_type_name(u_short proto, u_char type);
391 HIDE const char *sppp_cp_type_name(u_char type);
392 HIDE const char *sppp_dotted_quad(u_long addr);
393 HIDE const char *sppp_ipcp_opt_name(u_char opt);
394 HIDE const char *sppp_lcp_opt_name(u_char opt);
395 HIDE const char *sppp_phase_name(enum ppp_phase phase);
396 HIDE const char *sppp_proto_name(u_short proto);
397 HIDE const char *sppp_state_name(int state);
398 HIDE int sppp_params(struct sppp *sp, u_long cmd, void *data);
399 HIDE int sppp_strnlen(u_char *p, int max);
400 HIDE void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst,
401 u_long *srcmask);
402 HIDE void sppp_keepalive(void *dummy);
403 HIDE void sppp_phase_network(struct sppp *sp);
404 HIDE void sppp_print_bytes(const u_char *p, u_short len);
405 HIDE void sppp_print_string(const char *p, u_short len);
406 HIDE void sppp_qflush(struct ifqueue *ifq);
407 HIDE void sppp_set_ip_addr(struct sppp *sp, u_long src);
408
409 /* our control protocol descriptors */
410 static const struct cp lcp = {
411 PPP_LCP, IDX_LCP, CP_LCP, "lcp",
412 sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
413 sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
414 sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
415 sppp_lcp_scr
416 };
417
418 static const struct cp ipcp = {
419 PPP_IPCP, IDX_IPCP, CP_NCP, "ipcp",
420 sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
421 sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
422 sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
423 sppp_ipcp_scr
424 };
425
426 static const struct cp pap = {
427 PPP_PAP, IDX_PAP, CP_AUTH, "pap",
428 sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
429 sppp_pap_TO, 0, 0, 0,
430 sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
431 sppp_pap_scr
432 };
433
434 static const struct cp chap = {
435 PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
436 sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
437 sppp_chap_TO, 0, 0, 0,
438 sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
439 sppp_chap_scr
440 };
441
442 static const struct cp *cps[IDX_COUNT] = {
443 &lcp, /* IDX_LCP */
444 &ipcp, /* IDX_IPCP */
445 &pap, /* IDX_PAP */
446 &chap, /* IDX_CHAP */
447 };
448
449
450 /*
451 * Exported functions, comprising our interface to the lower layer.
452 */
453
454 #if defined(__OpenBSD__)
455 /* Workaround */
456 void
spppattach(struct ifnet * ifp)457 spppattach(struct ifnet *ifp)
458 {
459 }
460 #endif
461
462 /*
463 * Process the received packet.
464 */
465 void
sppp_input(struct ifnet * ifp,struct mbuf * m)466 sppp_input(struct ifnet *ifp, struct mbuf *m)
467 {
468 struct ppp_header *h, ht;
469 struct ifqueue *inq = 0;
470 struct sppp *sp = (struct sppp *)ifp;
471 struct timeval tv;
472 int debug = ifp->if_flags & IFF_DEBUG;
473 int s;
474
475 if (ifp->if_flags & IFF_UP) {
476 /* Count received bytes, add hardware framing */
477 ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
478 /* Note time of last receive */
479 getmicrouptime(&tv);
480 sp->pp_last_receive = tv.tv_sec;
481 }
482
483 if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
484 /* Too small packet, drop it. */
485 if (debug)
486 log(LOG_DEBUG,
487 SPP_FMT "input packet is too small, %d bytes\n",
488 SPP_ARGS(ifp), m->m_pkthdr.len);
489 drop:
490 ++ifp->if_ierrors;
491 ++ifp->if_iqdrops;
492 m_freem (m);
493 return;
494 }
495
496 if (sp->pp_flags & PP_NOFRAMING) {
497 memcpy(&ht.protocol, mtod(m, void *), 2);
498 m_adj(m, 2);
499 ht.control = PPP_UI;
500 ht.address = PPP_ALLSTATIONS;
501 h = &ht;
502 } else {
503 /* Get PPP header. */
504 h = mtod (m, struct ppp_header*);
505 m_adj (m, PPP_HEADER_LEN);
506 }
507
508 switch (h->address) {
509 case PPP_ALLSTATIONS:
510 if (h->control != PPP_UI)
511 goto invalid;
512 if (sp->pp_flags & PP_CISCO) {
513 if (debug)
514 log(LOG_DEBUG,
515 SPP_FMT "PPP packet in Cisco mode "
516 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
517 SPP_ARGS(ifp),
518 h->address, h->control, ntohs(h->protocol));
519 goto drop;
520 }
521 switch (ntohs (h->protocol)) {
522 default:
523 if (sp->state[IDX_LCP] == STATE_OPENED)
524 sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
525 ++sp->pp_seq, m->m_pkthdr.len + 2,
526 &h->protocol);
527 if (debug)
528 log(LOG_DEBUG,
529 SPP_FMT "invalid input protocol "
530 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
531 SPP_ARGS(ifp),
532 h->address, h->control, ntohs(h->protocol));
533 ++ifp->if_noproto;
534 goto drop;
535 case PPP_LCP:
536 sppp_cp_input(&lcp, sp, m);
537 m_freem (m);
538 return;
539 case PPP_PAP:
540 if (sp->pp_phase >= PHASE_AUTHENTICATE)
541 sppp_pap_input(sp, m);
542 m_freem (m);
543 return;
544 case PPP_CHAP:
545 if (sp->pp_phase >= PHASE_AUTHENTICATE)
546 sppp_chap_input(sp, m);
547 m_freem (m);
548 return;
549 #ifdef INET
550 case PPP_IPCP:
551 if (sp->pp_phase == PHASE_NETWORK)
552 sppp_cp_input(&ipcp, sp, m);
553 m_freem (m);
554 return;
555 case PPP_IP:
556 if (sp->state[IDX_IPCP] == STATE_OPENED) {
557 schednetisr (NETISR_IP);
558 inq = &ipintrq;
559 sp->pp_last_activity = tv.tv_sec;
560 }
561 break;
562 #endif
563 #ifdef IPX
564 case PPP_IPX:
565 /* IPX IPXCP not implemented yet */
566 if (sp->pp_phase == PHASE_NETWORK) {
567 schednetisr (NETISR_IPX);
568 inq = &ipxintrq;
569 }
570 break;
571 #endif
572 }
573 break;
574 case CISCO_MULTICAST:
575 case CISCO_UNICAST:
576 /* Don't check the control field here (RFC 1547). */
577 if (! (sp->pp_flags & PP_CISCO)) {
578 if (debug)
579 log(LOG_DEBUG,
580 SPP_FMT "Cisco packet in PPP mode "
581 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
582 SPP_ARGS(ifp),
583 h->address, h->control, ntohs(h->protocol));
584 goto drop;
585 }
586 switch (ntohs (h->protocol)) {
587 default:
588 ++ifp->if_noproto;
589 goto invalid;
590 case CISCO_KEEPALIVE:
591 sppp_cisco_input ((struct sppp*) ifp, m);
592 m_freem (m);
593 return;
594 #ifdef INET
595 case ETHERTYPE_IP:
596 schednetisr (NETISR_IP);
597 inq = &ipintrq;
598 break;
599 #endif
600 #ifdef IPX
601 case ETHERTYPE_IPX:
602 schednetisr (NETISR_IPX);
603 inq = &ipxintrq;
604 break;
605 #endif
606 }
607 break;
608 default: /* Invalid PPP packet. */
609 invalid:
610 if (debug)
611 log(LOG_DEBUG,
612 SPP_FMT "invalid input packet "
613 "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
614 SPP_ARGS(ifp),
615 h->address, h->control, ntohs(h->protocol));
616 goto drop;
617 }
618
619 if (! (ifp->if_flags & IFF_UP) || ! inq)
620 goto drop;
621
622 /* Check queue. */
623 s = splimp();
624 if (IF_QFULL (inq)) {
625 /* Queue overflow. */
626 IF_DROP(inq);
627 splx(s);
628 if (debug)
629 log(LOG_DEBUG, SPP_FMT "protocol queue overflow\n",
630 SPP_ARGS(ifp));
631 if (!inq->ifq_congestion)
632 if_congestion(inq);
633 goto drop;
634 }
635 IF_ENQUEUE(inq, m);
636 splx(s);
637 }
638
639 /*
640 * Enqueue transmit packet.
641 */
642 HIDE int
sppp_output(struct ifnet * ifp,struct mbuf * m,struct sockaddr * dst,struct rtentry * rt)643 sppp_output(struct ifnet *ifp, struct mbuf *m,
644 struct sockaddr *dst, struct rtentry *rt)
645 {
646 struct sppp *sp = (struct sppp*) ifp;
647 struct ppp_header *h;
648 struct ifqueue *ifq = NULL;
649 struct timeval tv;
650 int s, len, rv = 0;
651 u_int16_t protocol;
652
653 s = splimp();
654
655 getmicrouptime(&tv);
656 sp->pp_last_activity = tv.tv_sec;
657
658 if ((ifp->if_flags & IFF_UP) == 0 ||
659 (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
660 m_freem (m);
661 splx (s);
662 return (ENETDOWN);
663 }
664
665 if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
666 /*
667 * Interface is not yet running, but auto-dial. Need
668 * to start LCP for it.
669 */
670 ifp->if_flags |= IFF_RUNNING;
671 splx(s);
672 lcp.Open(sp);
673 s = splimp();
674 }
675
676 #ifdef INET
677 /*
678 * Put low delay, telnet, rlogin and ftp control packets
679 * in front of the queue.
680 */
681 if (dst->sa_family == AF_INET) {
682 struct ip *ip = NULL;
683 struct tcphdr *th = NULL;
684
685 if (m->m_len >= sizeof(struct ip)) {
686 ip = mtod(m, struct ip *);
687 if (ip->ip_p == IPPROTO_TCP &&
688 m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
689 sizeof(struct tcphdr)) {
690 th = (struct tcphdr *)
691 ((caddr_t)ip + (ip->ip_hl << 2));
692 }
693 }
694 /*
695 * When using dynamic local IP address assignment by using
696 * 0.0.0.0 as a local address, the first TCP session will
697 * not connect because the local TCP checksum is computed
698 * using 0.0.0.0 which will later become our real IP address
699 * so the TCP checksum computed at the remote end will
700 * become invalid. So we
701 * - don't let packets with src ip addr 0 thru
702 * - we flag TCP packets with src ip 0 as an error
703 */
704
705 if(ip && ip->ip_src.s_addr == INADDR_ANY) {
706 u_int8_t proto = ip->ip_p;
707
708 m_freem(m);
709 splx(s);
710 if(proto == IPPROTO_TCP)
711 return (EADDRNOTAVAIL);
712 else
713 return (0);
714 }
715
716 if (!IF_QFULL(&sp->pp_fastq) &&
717 ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
718 (th && (INTERACTIVE(ntohs(th->th_sport)) ||
719 INTERACTIVE(ntohs(th->th_dport))))))
720 ifq = &sp->pp_fastq;
721 }
722 #endif
723
724 if (sp->pp_flags & PP_NOFRAMING)
725 goto skip_header;
726 /*
727 * Prepend general data packet PPP header. For now, IP only.
728 */
729 M_PREPEND (m, PPP_HEADER_LEN, M_DONTWAIT);
730 if (!m) {
731 if (ifp->if_flags & IFF_DEBUG)
732 log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
733 SPP_ARGS(ifp));
734 ++ifp->if_oerrors;
735 splx (s);
736 return (ENOBUFS);
737 }
738 /*
739 * May want to check size of packet
740 * (albeit due to the implementation it's always enough)
741 */
742 h = mtod (m, struct ppp_header*);
743 if (sp->pp_flags & PP_CISCO) {
744 h->address = CISCO_UNICAST; /* unicast address */
745 h->control = 0;
746 } else {
747 h->address = PPP_ALLSTATIONS; /* broadcast address */
748 h->control = PPP_UI; /* Unnumbered Info */
749 }
750
751 skip_header:
752 switch (dst->sa_family) {
753 #ifdef INET
754 case AF_INET: /* Internet Protocol */
755 if (sp->pp_flags & PP_CISCO)
756 protocol = htons (ETHERTYPE_IP);
757 else {
758 /*
759 * Don't choke with an ENETDOWN early. It's
760 * possible that we just started dialing out,
761 * so don't drop the packet immediately. If
762 * we notice that we run out of buffer space
763 * below, we will however remember that we are
764 * not ready to carry IP packets, and return
765 * ENETDOWN, as opposed to ENOBUFS.
766 */
767 protocol = htons(PPP_IP);
768 if (sp->state[IDX_IPCP] != STATE_OPENED)
769 rv = ENETDOWN;
770 }
771 break;
772 #endif
773 #ifdef IPX
774 case AF_IPX: /* Novell IPX Protocol */
775 protocol = htons ((sp->pp_flags & PP_CISCO) ?
776 ETHERTYPE_IPX : PPP_IPX);
777 break;
778 #endif
779 default:
780 m_freem(m);
781 ++ifp->if_oerrors;
782 splx(s);
783 return (EAFNOSUPPORT);
784 }
785
786 if (sp->pp_flags & PP_NOFRAMING) {
787 M_PREPEND(m, 2, M_DONTWAIT);
788 if (m == NULL) {
789 if (ifp->if_flags & IFF_DEBUG)
790 log(LOG_DEBUG, SPP_FMT
791 "no memory for transmit header\n",
792 SPP_ARGS(ifp));
793 ++ifp->if_oerrors;
794 splx(s);
795 return (ENOBUFS);
796 }
797 *mtod(m, u_int16_t *) = protocol;
798 } else
799 h->protocol = protocol;
800
801 /*
802 * Queue message on interface, and start output if interface
803 * not yet active.
804 */
805 len = m->m_pkthdr.len;
806 if (ifq != NULL
807 #ifdef ALTQ
808 && ALTQ_IS_ENABLED(&ifp->if_snd) == 0
809 #endif
810 ) {
811 if (IF_QFULL (ifq)) {
812 IF_DROP (&ifp->if_snd);
813 m_freem (m);
814 if (rv == 0)
815 rv = ENOBUFS;
816 } else
817 IF_ENQUEUE (ifq, m);
818 } else
819 IFQ_ENQUEUE(&ifp->if_snd, m, NULL, rv);
820
821 if (rv != 0) {
822 ++ifp->if_oerrors;
823 splx (s);
824 return (rv);
825 }
826
827 if (!(ifp->if_flags & IFF_OACTIVE))
828 (*ifp->if_start) (ifp);
829
830 /*
831 * Count output packets and bytes.
832 * The packet length includes header, FCS and 1 flag,
833 * according to RFC 1333.
834 */
835 ifp->if_obytes += len + sp->pp_framebytes;
836 splx (s);
837 return (0);
838 }
839
840 void
sppp_attach(struct ifnet * ifp)841 sppp_attach(struct ifnet *ifp)
842 {
843 struct sppp *sp = (struct sppp*) ifp;
844
845 /* Initialize keepalive handler. */
846 if (! spppq) {
847 #if defined (__FreeBSD__)
848 keepalive_ch = timeout(sppp_keepalive, 0, hz * 10);
849 #elif defined(__OpenBSD__)
850 timeout_set(&keepalive_ch, sppp_keepalive, NULL);
851 timeout_add(&keepalive_ch, hz * 10);
852 #endif
853 }
854
855 /* Insert new entry into the keepalive list. */
856 sp->pp_next = spppq;
857 spppq = sp;
858
859 sp->pp_if.if_type = IFT_PPP;
860 sp->pp_if.if_output = sppp_output;
861 IFQ_SET_MAXLEN(&sp->pp_if.if_snd, 50);
862 sp->pp_fastq.ifq_maxlen = 50;
863 sp->pp_cpq.ifq_maxlen = 50;
864 sp->pp_loopcnt = 0;
865 sp->pp_alivecnt = 0;
866 sp->pp_last_activity = 0;
867 sp->pp_last_receive = 0;
868 sp->pp_seq = 0;
869 sp->pp_rseq = 0;
870 sp->pp_phase = PHASE_DEAD;
871 sp->pp_up = lcp.Up;
872 sp->pp_down = lcp.Down;
873
874 sppp_lcp_init(sp);
875 sppp_ipcp_init(sp);
876 sppp_pap_init(sp);
877 sppp_chap_init(sp);
878 }
879
880 void
sppp_detach(struct ifnet * ifp)881 sppp_detach(struct ifnet *ifp)
882 {
883 struct sppp **q, *p, *sp = (struct sppp*) ifp;
884 int i;
885
886 /* Remove the entry from the keepalive list. */
887 for (q = &spppq; (p = *q); q = &p->pp_next)
888 if (p == sp) {
889 *q = p->pp_next;
890 break;
891 }
892
893 /* Stop keepalive handler. */
894 if (! spppq)
895 UNTIMEOUT(sppp_keepalive, 0, keepalive_ch);
896
897 for (i = 0; i < IDX_COUNT; i++)
898 UNTIMEOUT((cps[i])->TO, (void *)sp, sp->ch[i]);
899 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
900 }
901
902 /*
903 * Flush the interface output queue.
904 */
905 void
sppp_flush(struct ifnet * ifp)906 sppp_flush(struct ifnet *ifp)
907 {
908 struct sppp *sp = (struct sppp*) ifp;
909
910 IFQ_PURGE(&sp->pp_if.if_snd);
911 sppp_qflush (&sp->pp_fastq);
912 sppp_qflush (&sp->pp_cpq);
913 }
914
915 /*
916 * Check if the output queue is empty.
917 */
918 int
sppp_isempty(struct ifnet * ifp)919 sppp_isempty(struct ifnet *ifp)
920 {
921 struct sppp *sp = (struct sppp*) ifp;
922 int empty, s;
923
924 s = splimp();
925 empty = !sp->pp_fastq.ifq_head && !sp->pp_cpq.ifq_head &&
926 IFQ_IS_EMPTY(&sp->pp_if.if_snd);
927 splx(s);
928 return (empty);
929 }
930
931 /*
932 * Get next packet to send.
933 */
934 struct mbuf *
sppp_dequeue(struct ifnet * ifp)935 sppp_dequeue(struct ifnet *ifp)
936 {
937 struct sppp *sp = (struct sppp*) ifp;
938 struct mbuf *m;
939 int s;
940
941 s = splimp();
942 /*
943 * Process only the control protocol queue until we have at
944 * least one NCP open.
945 *
946 * Do always serve all three queues in Cisco mode.
947 */
948 IF_DEQUEUE(&sp->pp_cpq, m);
949 if (m == NULL &&
950 (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
951 IF_DEQUEUE(&sp->pp_fastq, m);
952 if (m == NULL)
953 IFQ_DEQUEUE (&sp->pp_if.if_snd, m);
954 }
955 splx(s);
956 return m;
957 }
958
959 /*
960 * Pick the next packet, do not remove it from the queue.
961 */
962 struct mbuf *
sppp_pick(struct ifnet * ifp)963 sppp_pick(struct ifnet *ifp)
964 {
965 struct sppp *sp = (struct sppp*)ifp;
966 struct mbuf *m;
967 int s;
968
969 s= splimp ();
970
971 m = sp->pp_cpq.ifq_head;
972 if (m == NULL &&
973 (sp->pp_phase == PHASE_NETWORK ||
974 (sp->pp_flags & PP_CISCO) != 0))
975 if ((m = sp->pp_fastq.ifq_head) == NULL)
976 IFQ_POLL(&sp->pp_if.if_snd, m);
977 splx (s);
978 return (m);
979 }
980
981 /*
982 * Process an ioctl request. Called on low priority level.
983 */
984 int
sppp_ioctl(struct ifnet * ifp,u_long cmd,void * data)985 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
986 {
987 struct ifreq *ifr = (struct ifreq*) data;
988 struct sppp *sp = (struct sppp*) ifp;
989 int s, rv, going_up, going_down, newmode;
990
991 s = splimp();
992 rv = 0;
993 switch (cmd) {
994 case SIOCAIFADDR:
995 case SIOCSIFDSTADDR:
996 break;
997
998 case SIOCSIFADDR:
999 if_up(ifp);
1000 /* fall through... */
1001
1002 case SIOCSIFFLAGS:
1003 going_up = (ifp->if_flags & IFF_UP) &&
1004 (ifp->if_flags & IFF_RUNNING) == 0;
1005 going_down = (ifp->if_flags & IFF_UP) == 0 &&
1006 (ifp->if_flags & IFF_RUNNING);
1007 newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
1008 if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
1009 /* sanity */
1010 newmode = IFF_PASSIVE;
1011 ifp->if_flags &= ~IFF_AUTO;
1012 }
1013
1014 if (going_up || going_down)
1015 if (!(sp->pp_flags & PP_CISCO))
1016 lcp.Close(sp);
1017
1018 if (going_up && newmode == 0) {
1019 /* neither auto-dial nor passive */
1020 ifp->if_flags |= IFF_RUNNING;
1021 if (!(sp->pp_flags & PP_CISCO))
1022 lcp.Open(sp);
1023 } else if (going_down) {
1024 sppp_flush(ifp);
1025 ifp->if_flags &= ~IFF_RUNNING;
1026 }
1027 break;
1028
1029 #ifdef SIOCSIFMTU
1030 case SIOCSIFMTU:
1031 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) {
1032 splx(s);
1033 return (EINVAL);
1034 }
1035 ifp->if_mtu = ifr->ifr_mtu;
1036 break;
1037 #endif
1038 #ifdef SLIOCSETMTU
1039 case SLIOCSETMTU:
1040 if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) {
1041 splx(s);
1042 return (EINVAL);
1043 }
1044 ifp->if_mtu = *(short*)data;
1045 break;
1046 #endif
1047 #ifdef SIOCGIFMTU
1048 case SIOCGIFMTU:
1049 ifr->ifr_mtu = ifp->if_mtu;
1050 break;
1051 #endif
1052 #ifdef SLIOCGETMTU
1053 case SLIOCGETMTU:
1054 *(short*)data = ifp->if_mtu;
1055 break;
1056 #endif
1057 case SIOCADDMULTI:
1058 case SIOCDELMULTI:
1059 break;
1060
1061 case SIOCGIFGENERIC:
1062 case SIOCSIFGENERIC:
1063 rv = sppp_params(sp, cmd, data);
1064 break;
1065
1066 default:
1067 rv = ENOTTY;
1068 }
1069 splx(s);
1070 return rv;
1071 }
1072
1073
1074 /*
1075 * Cisco framing implementation.
1076 */
1077
1078 /*
1079 * Handle incoming Cisco keepalive protocol packets.
1080 */
1081 HIDE void
sppp_cisco_input(struct sppp * sp,struct mbuf * m)1082 sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1083 {
1084 STDDCL;
1085 struct cisco_packet *h;
1086 u_long me, mymask;
1087
1088 if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1089 if (debug)
1090 log(LOG_DEBUG,
1091 SPP_FMT "cisco invalid packet length: %d bytes\n",
1092 SPP_ARGS(ifp), m->m_pkthdr.len);
1093 return;
1094 }
1095 h = mtod (m, struct cisco_packet*);
1096 if (debug)
1097 log(LOG_DEBUG,
1098 SPP_FMT "cisco input: %d bytes "
1099 "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1100 SPP_ARGS(ifp), m->m_pkthdr.len,
1101 (u_long)ntohl (h->type), (u_long)h->par1, (u_long)h->par2, (u_int)h->rel,
1102 (u_int)h->time0, (u_int)h->time1);
1103 switch (ntohl (h->type)) {
1104 default:
1105 if (debug)
1106 addlog(SPP_FMT "cisco unknown packet type: 0x%lx\n",
1107 SPP_ARGS(ifp), (u_long)ntohl (h->type));
1108 break;
1109 case CISCO_ADDR_REPLY:
1110 /* Reply on address request, ignore */
1111 break;
1112 case CISCO_KEEPALIVE_REQ:
1113 sp->pp_alivecnt = 0;
1114 sp->pp_rseq = ntohl (h->par1);
1115 if (sp->pp_seq == sp->pp_rseq) {
1116 /* Local and remote sequence numbers are equal.
1117 * Probably, the line is in loopback mode. */
1118 if (sp->pp_loopcnt >= LOOPALIVECNT) {
1119 printf (SPP_FMT "loopback\n",
1120 SPP_ARGS(ifp));
1121 sp->pp_loopcnt = 0;
1122 if (ifp->if_flags & IFF_UP) {
1123 if_down (ifp);
1124 sppp_qflush (&sp->pp_cpq);
1125 }
1126 }
1127 ++sp->pp_loopcnt;
1128
1129 /* Generate new local sequence number */
1130 sp->pp_seq = arc4random();
1131 break;
1132 }
1133 sp->pp_loopcnt = 0;
1134 if (! (ifp->if_flags & IFF_UP) &&
1135 (ifp->if_flags & IFF_RUNNING)) {
1136 if_up(ifp);
1137 printf (SPP_FMT "up\n", SPP_ARGS(ifp));
1138 }
1139 break;
1140 case CISCO_ADDR_REQ:
1141 sppp_get_ip_addrs(sp, &me, 0, &mymask);
1142 if (me != 0L)
1143 sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1144 break;
1145 }
1146 }
1147
1148 /*
1149 * Send Cisco keepalive packet.
1150 */
1151 HIDE void
sppp_cisco_send(struct sppp * sp,int type,long par1,long par2)1152 sppp_cisco_send(struct sppp *sp, int type, long par1, long par2)
1153 {
1154 STDDCL;
1155 struct ppp_header *h;
1156 struct cisco_packet *ch;
1157 struct mbuf *m;
1158 struct timeval tv;
1159
1160 getmicrouptime(&tv);
1161
1162 MGETHDR (m, M_DONTWAIT, MT_DATA);
1163 if (! m)
1164 return;
1165 m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1166 m->m_pkthdr.rcvif = 0;
1167
1168 h = mtod (m, struct ppp_header*);
1169 h->address = CISCO_MULTICAST;
1170 h->control = 0;
1171 h->protocol = htons (CISCO_KEEPALIVE);
1172
1173 ch = (struct cisco_packet*) (h + 1);
1174 ch->type = htonl (type);
1175 ch->par1 = htonl (par1);
1176 ch->par2 = htonl (par2);
1177 ch->rel = -1;
1178
1179 ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
1180 ch->time1 = htons ((u_short) tv.tv_sec);
1181
1182 if (debug)
1183 log(LOG_DEBUG,
1184 SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1185 SPP_ARGS(ifp), (u_long)ntohl (ch->type), (u_long)ch->par1,
1186 (u_long)ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
1187
1188 if (IF_QFULL (&sp->pp_cpq)) {
1189 IF_DROP (&sp->pp_fastq);
1190 IF_DROP (&ifp->if_snd);
1191 m_freem (m);
1192 m = NULL;
1193 } else
1194 IF_ENQUEUE (&sp->pp_cpq, m);
1195 if (! (ifp->if_flags & IFF_OACTIVE))
1196 (*ifp->if_start) (ifp);
1197 if (m != NULL)
1198 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1199 }
1200
1201 /*
1202 * PPP protocol implementation.
1203 */
1204
1205 /*
1206 * Send PPP control protocol packet.
1207 */
1208 HIDE void
sppp_cp_send(struct sppp * sp,u_short proto,u_char type,u_char ident,u_short len,void * data)1209 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1210 u_char ident, u_short len, void *data)
1211 {
1212 STDDCL;
1213 struct ppp_header *h;
1214 struct lcp_header *lh;
1215 struct mbuf *m;
1216 size_t pkthdrlen;
1217
1218 pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
1219
1220 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
1221 len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
1222 MGETHDR (m, M_DONTWAIT, MT_DATA);
1223 if (! m)
1224 return;
1225 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
1226 m->m_pkthdr.rcvif = 0;
1227
1228 if (sp->pp_flags & PP_NOFRAMING) {
1229 *mtod(m, u_int16_t *) = htons(proto);
1230 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
1231 } else {
1232 h = mtod (m, struct ppp_header*);
1233 h->address = PPP_ALLSTATIONS; /* broadcast address */
1234 h->control = PPP_UI; /* Unnumbered Info */
1235 h->protocol = htons (proto); /* Link Control Protocol */
1236 lh = (struct lcp_header*) (h + 1);
1237 }
1238 lh->type = type;
1239 lh->ident = ident;
1240 lh->len = htons (LCP_HEADER_LEN + len);
1241 if (len)
1242 bcopy (data, lh+1, len);
1243
1244 if (debug) {
1245 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
1246 SPP_ARGS(ifp),
1247 sppp_proto_name(proto),
1248 sppp_cp_type_name (lh->type), lh->ident,
1249 ntohs (lh->len));
1250 if (len)
1251 sppp_print_bytes ((u_char*) (lh+1), len);
1252 addlog(">\n");
1253 }
1254 if (IF_QFULL (&sp->pp_cpq)) {
1255 IF_DROP (&sp->pp_fastq);
1256 IF_DROP (&ifp->if_snd);
1257 m_freem (m);
1258 ++ifp->if_oerrors;
1259 m = NULL;
1260 } else
1261 IF_ENQUEUE (&sp->pp_cpq, m);
1262 if (!(ifp->if_flags & IFF_OACTIVE))
1263 (*ifp->if_start) (ifp);
1264 if (m != NULL)
1265 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1266 }
1267
1268 /*
1269 * Handle incoming PPP control protocol packets.
1270 */
1271 HIDE void
sppp_cp_input(const struct cp * cp,struct sppp * sp,struct mbuf * m)1272 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1273 {
1274 STDDCL;
1275 struct lcp_header *h;
1276 int printlen, len = m->m_pkthdr.len;
1277 int rv;
1278 u_char *p;
1279
1280 if (len < 4) {
1281 if (debug)
1282 log(LOG_DEBUG,
1283 SPP_FMT "%s invalid packet length: %d bytes\n",
1284 SPP_ARGS(ifp), cp->name, len);
1285 return;
1286 }
1287 h = mtod (m, struct lcp_header*);
1288 if (debug) {
1289 printlen = ntohs(h->len);
1290 log(LOG_DEBUG,
1291 SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
1292 SPP_ARGS(ifp), cp->name,
1293 sppp_state_name(sp->state[cp->protoidx]),
1294 sppp_cp_type_name(h->type), h->ident, printlen);
1295 if (len < printlen)
1296 printlen = len;
1297 if (printlen > 4)
1298 sppp_print_bytes((u_char *)(h + 1), printlen - 4);
1299 addlog(">\n");
1300 }
1301 if (len > ntohs (h->len))
1302 len = ntohs (h->len);
1303 p = (u_char *)(h + 1);
1304 switch (h->type) {
1305 case CONF_REQ:
1306 if (len < 4) {
1307 if (debug)
1308 addlog(SPP_FMT "%s invalid conf-req length %d\n",
1309 SPP_ARGS(ifp), cp->name,
1310 len);
1311 ++ifp->if_ierrors;
1312 break;
1313 }
1314 /* handle states where RCR doesn't get a SCA/SCN */
1315 switch (sp->state[cp->protoidx]) {
1316 case STATE_CLOSING:
1317 case STATE_STOPPING:
1318 return;
1319 case STATE_CLOSED:
1320 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1321 0, 0);
1322 return;
1323 }
1324 rv = (cp->RCR)(sp, h, len);
1325 /* silently drop illegal packets */
1326 if (rv < 0)
1327 return;
1328 switch (sp->state[cp->protoidx]) {
1329 case STATE_OPENED:
1330 sppp_cp_change_state(cp, sp, rv?
1331 STATE_ACK_SENT: STATE_REQ_SENT);
1332 (cp->tld)(sp);
1333 (cp->scr)(sp);
1334 break;
1335 case STATE_ACK_SENT:
1336 case STATE_REQ_SENT:
1337 sppp_cp_change_state(cp, sp, rv?
1338 STATE_ACK_SENT: STATE_REQ_SENT);
1339 break;
1340 case STATE_STOPPED:
1341 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1342 sppp_cp_change_state(cp, sp, rv?
1343 STATE_ACK_SENT: STATE_REQ_SENT);
1344 (cp->scr)(sp);
1345 break;
1346 case STATE_ACK_RCVD:
1347 if (rv) {
1348 sppp_cp_change_state(cp, sp, STATE_OPENED);
1349 if (debug)
1350 log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1351 SPP_ARGS(ifp),
1352 cp->name);
1353 (cp->tlu)(sp);
1354 } else
1355 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1356 break;
1357 default:
1358 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1359 SPP_ARGS(ifp), cp->name,
1360 sppp_cp_type_name(h->type),
1361 sppp_state_name(sp->state[cp->protoidx])); */
1362 ++ifp->if_ierrors;
1363 }
1364 break;
1365 case CONF_ACK:
1366 if (h->ident != sp->confid[cp->protoidx]) {
1367 if (debug)
1368 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1369 SPP_ARGS(ifp), cp->name,
1370 h->ident, sp->confid[cp->protoidx]);
1371 ++ifp->if_ierrors;
1372 break;
1373 }
1374 switch (sp->state[cp->protoidx]) {
1375 case STATE_CLOSED:
1376 case STATE_STOPPED:
1377 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1378 break;
1379 case STATE_CLOSING:
1380 case STATE_STOPPING:
1381 break;
1382 case STATE_REQ_SENT:
1383 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1384 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1385 break;
1386 case STATE_OPENED:
1387 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1388 (cp->tld)(sp);
1389 (cp->scr)(sp);
1390 break;
1391 case STATE_ACK_RCVD:
1392 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1393 (cp->scr)(sp);
1394 break;
1395 case STATE_ACK_SENT:
1396 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1397 sppp_cp_change_state(cp, sp, STATE_OPENED);
1398 if (debug)
1399 log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1400 SPP_ARGS(ifp), cp->name);
1401 (cp->tlu)(sp);
1402 break;
1403 default:
1404 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1405 SPP_ARGS(ifp), cp->name,
1406 sppp_cp_type_name(h->type),
1407 sppp_state_name(sp->state[cp->protoidx])); */
1408 ++ifp->if_ierrors;
1409 }
1410 break;
1411 case CONF_NAK:
1412 case CONF_REJ:
1413 if (h->ident != sp->confid[cp->protoidx]) {
1414 if (debug)
1415 addlog(SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1416 SPP_ARGS(ifp), cp->name,
1417 h->ident, sp->confid[cp->protoidx]);
1418 ++ifp->if_ierrors;
1419 break;
1420 }
1421 if (h->type == CONF_NAK)
1422 (cp->RCN_nak)(sp, h, len);
1423 else /* CONF_REJ */
1424 (cp->RCN_rej)(sp, h, len);
1425
1426 switch (sp->state[cp->protoidx]) {
1427 case STATE_CLOSED:
1428 case STATE_STOPPED:
1429 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1430 break;
1431 case STATE_REQ_SENT:
1432 case STATE_ACK_SENT:
1433 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1434 (cp->scr)(sp);
1435 break;
1436 case STATE_OPENED:
1437 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1438 (cp->tld)(sp);
1439 (cp->scr)(sp);
1440 break;
1441 case STATE_ACK_RCVD:
1442 sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1443 (cp->scr)(sp);
1444 break;
1445 case STATE_CLOSING:
1446 case STATE_STOPPING:
1447 break;
1448 default:
1449 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1450 SPP_ARGS(ifp), cp->name,
1451 sppp_cp_type_name(h->type),
1452 sppp_state_name(sp->state[cp->protoidx])); */
1453 ++ifp->if_ierrors;
1454 }
1455 break;
1456
1457 case TERM_REQ:
1458 switch (sp->state[cp->protoidx]) {
1459 case STATE_ACK_RCVD:
1460 case STATE_ACK_SENT:
1461 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1462 /* fall through */
1463 case STATE_CLOSED:
1464 case STATE_STOPPED:
1465 case STATE_CLOSING:
1466 case STATE_STOPPING:
1467 case STATE_REQ_SENT:
1468 sta:
1469 /* Send Terminate-Ack packet. */
1470 if (debug)
1471 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
1472 SPP_ARGS(ifp), cp->name);
1473 sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1474 break;
1475 case STATE_OPENED:
1476 sp->rst_counter[cp->protoidx] = 0;
1477 sppp_cp_change_state(cp, sp, STATE_STOPPING);
1478 (cp->tld)(sp);
1479 goto sta;
1480 break;
1481 default:
1482 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1483 SPP_ARGS(ifp), cp->name,
1484 sppp_cp_type_name(h->type),
1485 sppp_state_name(sp->state[cp->protoidx])); */
1486 ++ifp->if_ierrors;
1487 }
1488 break;
1489 case TERM_ACK:
1490 switch (sp->state[cp->protoidx]) {
1491 case STATE_CLOSED:
1492 case STATE_STOPPED:
1493 case STATE_REQ_SENT:
1494 case STATE_ACK_SENT:
1495 break;
1496 case STATE_CLOSING:
1497 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1498 (cp->tlf)(sp);
1499 break;
1500 case STATE_STOPPING:
1501 sppp_cp_change_state(cp, sp, STATE_STOPPED);
1502 (cp->tlf)(sp);
1503 break;
1504 case STATE_ACK_RCVD:
1505 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1506 break;
1507 case STATE_OPENED:
1508 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1509 (cp->tld)(sp);
1510 (cp->scr)(sp);
1511 break;
1512 default:
1513 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1514 SPP_ARGS(ifp), cp->name,
1515 sppp_cp_type_name(h->type),
1516 sppp_state_name(sp->state[cp->protoidx])); */
1517 ++ifp->if_ierrors;
1518 }
1519 break;
1520 case CODE_REJ:
1521 case PROTO_REJ:
1522 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1523 log(LOG_INFO,
1524 SPP_FMT "%s: ignoring RXJ (%s) for proto 0x%x, "
1525 "danger will robinson\n",
1526 SPP_ARGS(ifp), cp->name,
1527 sppp_cp_type_name(h->type), ntohs(*((u_short *)p)));
1528 switch (sp->state[cp->protoidx]) {
1529 case STATE_CLOSED:
1530 case STATE_STOPPED:
1531 case STATE_REQ_SENT:
1532 case STATE_ACK_SENT:
1533 case STATE_CLOSING:
1534 case STATE_STOPPING:
1535 case STATE_OPENED:
1536 break;
1537 case STATE_ACK_RCVD:
1538 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1539 break;
1540 default:
1541 /* printf(SPP_FMT "%s illegal %s in state %s\n",
1542 SPP_ARGS(ifp), cp->name,
1543 sppp_cp_type_name(h->type),
1544 sppp_state_name(sp->state[cp->protoidx])); */
1545 ++ifp->if_ierrors;
1546 }
1547 break;
1548 case DISC_REQ:
1549 if (cp->proto != PPP_LCP)
1550 goto illegal;
1551 /* Discard the packet. */
1552 break;
1553 case ECHO_REQ:
1554 if (cp->proto != PPP_LCP)
1555 goto illegal;
1556 if (sp->state[cp->protoidx] != STATE_OPENED) {
1557 if (debug)
1558 addlog(SPP_FMT "lcp echo req but lcp closed\n",
1559 SPP_ARGS(ifp));
1560 ++ifp->if_ierrors;
1561 break;
1562 }
1563 if (len < 8) {
1564 if (debug)
1565 addlog(SPP_FMT "invalid lcp echo request "
1566 "packet length: %d bytes\n",
1567 SPP_ARGS(ifp), len);
1568 break;
1569 }
1570 if (ntohl (*(long*)(h+1)) == sp->lcp.magic) {
1571 /* Line loopback mode detected. */
1572 printf(SPP_FMT "loopback\n", SPP_ARGS(ifp));
1573 /* Shut down the PPP link. */
1574 lcp.Close(sp);
1575 break;
1576 }
1577 *(long*)(h+1) = htonl (sp->lcp.magic);
1578 if (debug)
1579 addlog(SPP_FMT "got lcp echo req, sending echo rep\n",
1580 SPP_ARGS(ifp));
1581 sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
1582 break;
1583 case ECHO_REPLY:
1584 if (cp->proto != PPP_LCP)
1585 goto illegal;
1586 if (h->ident != sp->lcp.echoid) {
1587 ++ifp->if_ierrors;
1588 break;
1589 }
1590 if (len < 8) {
1591 if (debug)
1592 addlog(SPP_FMT "lcp invalid echo reply "
1593 "packet length: %d bytes\n",
1594 SPP_ARGS(ifp), len);
1595 break;
1596 }
1597 if (debug)
1598 addlog(SPP_FMT "lcp got echo rep\n",
1599 SPP_ARGS(ifp));
1600 if (ntohl (*(long*)(h+1)) != sp->lcp.magic)
1601 sp->pp_alivecnt = 0;
1602 break;
1603 default:
1604 /* Unknown packet type -- send Code-Reject packet. */
1605 illegal:
1606 if (debug)
1607 addlog(SPP_FMT "%s send code-rej for 0x%x\n",
1608 SPP_ARGS(ifp), cp->name, h->type);
1609 sppp_cp_send(sp, cp->proto, CODE_REJ, ++sp->pp_seq,
1610 m->m_pkthdr.len, h);
1611 ++ifp->if_ierrors;
1612 }
1613 }
1614
1615
1616 /*
1617 * The generic part of all Up/Down/Open/Close/TO event handlers.
1618 * Basically, the state transition handling in the automaton.
1619 */
1620 HIDE void
sppp_up_event(const struct cp * cp,struct sppp * sp)1621 sppp_up_event(const struct cp *cp, struct sppp *sp)
1622 {
1623 STDDCL;
1624
1625 if (debug)
1626 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
1627 SPP_ARGS(ifp), cp->name,
1628 sppp_state_name(sp->state[cp->protoidx]));
1629
1630 switch (sp->state[cp->protoidx]) {
1631 case STATE_INITIAL:
1632 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1633 break;
1634 case STATE_STARTING:
1635 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1636 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1637 (cp->scr)(sp);
1638 break;
1639 default:
1640 /* printf(SPP_FMT "%s illegal up in state %s\n",
1641 SPP_ARGS(ifp), cp->name,
1642 sppp_state_name(sp->state[cp->protoidx])); */
1643 break;
1644 }
1645 }
1646
1647 HIDE void
sppp_down_event(const struct cp * cp,struct sppp * sp)1648 sppp_down_event(const struct cp *cp, struct sppp *sp)
1649 {
1650 STDDCL;
1651
1652 if (debug)
1653 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
1654 SPP_ARGS(ifp), cp->name,
1655 sppp_state_name(sp->state[cp->protoidx]));
1656
1657 switch (sp->state[cp->protoidx]) {
1658 case STATE_CLOSED:
1659 case STATE_CLOSING:
1660 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1661 break;
1662 case STATE_STOPPED:
1663 sppp_cp_change_state(cp, sp, STATE_STARTING);
1664 (cp->tls)(sp);
1665 break;
1666 case STATE_STOPPING:
1667 case STATE_REQ_SENT:
1668 case STATE_ACK_RCVD:
1669 case STATE_ACK_SENT:
1670 sppp_cp_change_state(cp, sp, STATE_STARTING);
1671 break;
1672 case STATE_OPENED:
1673 sppp_cp_change_state(cp, sp, STATE_STARTING);
1674 (cp->tld)(sp);
1675 break;
1676 default:
1677 /* printf(SPP_FMT "%s illegal down in state %s\n",
1678 SPP_ARGS(ifp), cp->name,
1679 sppp_state_name(sp->state[cp->protoidx])); */
1680 break;
1681 }
1682 }
1683
1684
1685 HIDE void
sppp_open_event(const struct cp * cp,struct sppp * sp)1686 sppp_open_event(const struct cp *cp, struct sppp *sp)
1687 {
1688 STDDCL;
1689
1690 if (debug)
1691 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
1692 SPP_ARGS(ifp), cp->name,
1693 sppp_state_name(sp->state[cp->protoidx]));
1694
1695 switch (sp->state[cp->protoidx]) {
1696 case STATE_INITIAL:
1697 sppp_cp_change_state(cp, sp, STATE_STARTING);
1698 (cp->tls)(sp);
1699 break;
1700 case STATE_STARTING:
1701 break;
1702 case STATE_CLOSED:
1703 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1704 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1705 (cp->scr)(sp);
1706 break;
1707 case STATE_STOPPED:
1708 case STATE_STOPPING:
1709 case STATE_REQ_SENT:
1710 case STATE_ACK_RCVD:
1711 case STATE_ACK_SENT:
1712 case STATE_OPENED:
1713 break;
1714 case STATE_CLOSING:
1715 sppp_cp_change_state(cp, sp, STATE_STOPPING);
1716 break;
1717 }
1718 }
1719
1720
1721 HIDE void
sppp_close_event(const struct cp * cp,struct sppp * sp)1722 sppp_close_event(const struct cp *cp, struct sppp *sp)
1723 {
1724 STDDCL;
1725
1726 if (debug)
1727 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
1728 SPP_ARGS(ifp), cp->name,
1729 sppp_state_name(sp->state[cp->protoidx]));
1730
1731 switch (sp->state[cp->protoidx]) {
1732 case STATE_INITIAL:
1733 case STATE_CLOSED:
1734 case STATE_CLOSING:
1735 break;
1736 case STATE_STARTING:
1737 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1738 (cp->tlf)(sp);
1739 break;
1740 case STATE_STOPPED:
1741 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1742 break;
1743 case STATE_STOPPING:
1744 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1745 break;
1746 case STATE_OPENED:
1747 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1748 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1749 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
1750 (cp->tld)(sp);
1751 break;
1752 case STATE_REQ_SENT:
1753 case STATE_ACK_RCVD:
1754 case STATE_ACK_SENT:
1755 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1756 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq, 0, 0);
1757 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1758 break;
1759 }
1760 }
1761
1762 HIDE void
sppp_increasing_timeout(const struct cp * cp,struct sppp * sp)1763 sppp_increasing_timeout (const struct cp *cp, struct sppp *sp)
1764 {
1765 int timo;
1766
1767 timo = sp->lcp.max_configure - sp->rst_counter[cp->protoidx];
1768 if (timo < 1)
1769 timo = 1;
1770 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
1771 sp->ch[cp->protoidx] =
1772 timeout(cp->TO, (void *)sp, timo * sp->lcp.timeout);
1773 #elif defined(__OpenBSD__)
1774 timeout_set(&sp->ch[cp->protoidx], cp->TO, (void *)sp);
1775 timeout_add(&sp->ch[cp->protoidx], timo * sp->lcp.timeout);
1776 #endif
1777 }
1778
1779 HIDE void
sppp_to_event(const struct cp * cp,struct sppp * sp)1780 sppp_to_event(const struct cp *cp, struct sppp *sp)
1781 {
1782 STDDCL;
1783 int s;
1784
1785 s = splimp();
1786 if (debug)
1787 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
1788 SPP_ARGS(ifp), cp->name,
1789 sppp_state_name(sp->state[cp->protoidx]),
1790 sp->rst_counter[cp->protoidx]);
1791
1792 if (--sp->rst_counter[cp->protoidx] < 0)
1793 /* TO- event */
1794 switch (sp->state[cp->protoidx]) {
1795 case STATE_CLOSING:
1796 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1797 (cp->tlf)(sp);
1798 break;
1799 case STATE_STOPPING:
1800 sppp_cp_change_state(cp, sp, STATE_STOPPED);
1801 (cp->tlf)(sp);
1802 break;
1803 case STATE_REQ_SENT:
1804 case STATE_ACK_RCVD:
1805 case STATE_ACK_SENT:
1806 sppp_cp_change_state(cp, sp, STATE_STOPPED);
1807 (cp->tlf)(sp);
1808 break;
1809 }
1810 else
1811 /* TO+ event */
1812 switch (sp->state[cp->protoidx]) {
1813 case STATE_CLOSING:
1814 case STATE_STOPPING:
1815 sppp_cp_send(sp, cp->proto, TERM_REQ, ++sp->pp_seq,
1816 0, 0);
1817 sppp_increasing_timeout (cp, sp);
1818 break;
1819 case STATE_REQ_SENT:
1820 case STATE_ACK_RCVD:
1821 /* sppp_cp_change_state() will restart the timer */
1822 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1823 (cp->scr)(sp);
1824 break;
1825 case STATE_ACK_SENT:
1826 sppp_increasing_timeout (cp, sp);
1827 (cp->scr)(sp);
1828 break;
1829 }
1830
1831 splx(s);
1832 }
1833
1834 /*
1835 * Change the state of a control protocol in the state automaton.
1836 * Takes care of starting/stopping the restart timer.
1837 */
1838 void
sppp_cp_change_state(const struct cp * cp,struct sppp * sp,int newstate)1839 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
1840 {
1841 STDDCL;
1842
1843 if (debug && sp->state[cp->protoidx] != newstate)
1844 log(LOG_DEBUG, SPP_FMT "%s %s->%s\n",
1845 SPP_ARGS(ifp), cp->name,
1846 sppp_state_name(sp->state[cp->protoidx]),
1847 sppp_state_name(newstate));
1848 sp->state[cp->protoidx] = newstate;
1849
1850 switch (newstate) {
1851 case STATE_INITIAL:
1852 case STATE_STARTING:
1853 case STATE_CLOSED:
1854 case STATE_STOPPED:
1855 case STATE_OPENED:
1856 UNTIMEOUT(cp->TO, (void *)sp, sp->ch[cp->protoidx]);
1857 break;
1858 case STATE_CLOSING:
1859 case STATE_STOPPING:
1860 case STATE_REQ_SENT:
1861 case STATE_ACK_RCVD:
1862 case STATE_ACK_SENT:
1863 if (!timeout_pending(&sp->ch[cp->protoidx]))
1864 sppp_increasing_timeout (cp, sp);
1865 break;
1866 }
1867 }
1868 /*
1869 *--------------------------------------------------------------------------*
1870 * *
1871 * The LCP implementation. *
1872 * *
1873 *--------------------------------------------------------------------------*
1874 */
1875 HIDE void
sppp_lcp_init(struct sppp * sp)1876 sppp_lcp_init(struct sppp *sp)
1877 {
1878 sp->lcp.opts = (1 << LCP_OPT_MAGIC);
1879 sp->lcp.magic = 0;
1880 sp->state[IDX_LCP] = STATE_INITIAL;
1881 sp->fail_counter[IDX_LCP] = 0;
1882 sp->lcp.protos = 0;
1883 sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
1884
1885 /*
1886 * Initialize counters and timeout values. Note that we don't
1887 * use the 3 seconds suggested in RFC 1661 since we are likely
1888 * running on a fast link. XXX We should probably implement
1889 * the exponential backoff option. Note that these values are
1890 * relevant for all control protocols, not just LCP only.
1891 */
1892 sp->lcp.timeout = 1 * hz;
1893 sp->lcp.max_terminate = 2;
1894 sp->lcp.max_configure = 10;
1895 sp->lcp.max_failure = 10;
1896 #if defined (__FreeBSD__)
1897 callout_handle_init(&sp->ch[IDX_LCP]);
1898 #endif
1899 }
1900
1901 HIDE void
sppp_lcp_up(struct sppp * sp)1902 sppp_lcp_up(struct sppp *sp)
1903 {
1904 STDDCL;
1905 struct timeval tv;
1906
1907 if (sp->pp_flags & PP_CISCO)
1908 return;
1909
1910 sp->pp_alivecnt = 0;
1911 sp->lcp.opts = (1 << LCP_OPT_MAGIC);
1912 sp->lcp.magic = 0;
1913 sp->lcp.protos = 0;
1914 sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
1915
1916 getmicrouptime(&tv);
1917 sp->pp_last_receive = sp->pp_last_activity = tv.tv_sec;
1918
1919 /*
1920 * If this interface is passive or dial-on-demand, and we are
1921 * still in Initial state, it means we've got an incoming
1922 * call. Activate the interface.
1923 */
1924 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
1925 if (debug)
1926 log(LOG_DEBUG,
1927 SPP_FMT "Up event", SPP_ARGS(ifp));
1928 ifp->if_flags |= IFF_RUNNING;
1929 if (sp->state[IDX_LCP] == STATE_INITIAL) {
1930 if (debug)
1931 addlog("(incoming call)\n");
1932 sp->pp_flags |= PP_CALLIN;
1933 lcp.Open(sp);
1934 } else if (debug)
1935 addlog("\n");
1936 } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
1937 (sp->state[IDX_LCP] == STATE_INITIAL)) {
1938 ifp->if_flags |= IFF_RUNNING;
1939 lcp.Open(sp);
1940 }
1941
1942 sppp_up_event(&lcp, sp);
1943 }
1944
1945 HIDE void
sppp_lcp_down(struct sppp * sp)1946 sppp_lcp_down(struct sppp *sp)
1947 {
1948 STDDCL;
1949
1950 if (sp->pp_flags & PP_CISCO)
1951 return;
1952
1953 sppp_down_event(&lcp, sp);
1954
1955 /*
1956 * If this is neither a dial-on-demand nor a passive
1957 * interface, simulate an ``ifconfig down'' action, so the
1958 * administrator can force a redial by another ``ifconfig
1959 * up''. XXX For leased line operation, should we immediately
1960 * try to reopen the connection here?
1961 */
1962 if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
1963 if (debug)
1964 log(LOG_DEBUG, SPP_FMT "Down event (carrier loss), "
1965 "taking interface down.", SPP_ARGS(ifp));
1966 if_down(ifp);
1967 } else {
1968 if (debug)
1969 log(LOG_DEBUG, SPP_FMT "Down event (carrier loss)\n",
1970 SPP_ARGS(ifp));
1971 }
1972
1973 if (sp->state[IDX_LCP] != STATE_INITIAL)
1974 lcp.Close(sp);
1975 sp->pp_flags &= ~PP_CALLIN;
1976 ifp->if_flags &= ~IFF_RUNNING;
1977 sppp_flush(ifp);
1978 }
1979
1980 HIDE void
sppp_lcp_open(struct sppp * sp)1981 sppp_lcp_open(struct sppp *sp)
1982 {
1983 /*
1984 * If we are authenticator, negotiate LCP_AUTH
1985 */
1986 if (sp->hisauth.proto != 0)
1987 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
1988 else
1989 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
1990 sp->pp_flags &= ~PP_NEEDAUTH;
1991 sppp_open_event(&lcp, sp);
1992 }
1993
1994 HIDE void
sppp_lcp_close(struct sppp * sp)1995 sppp_lcp_close(struct sppp *sp)
1996 {
1997 sppp_close_event(&lcp, sp);
1998 }
1999
2000 HIDE void
sppp_lcp_TO(void * cookie)2001 sppp_lcp_TO(void *cookie)
2002 {
2003 sppp_to_event(&lcp, (struct sppp *)cookie);
2004 }
2005
2006 /*
2007 * Analyze a configure request. Return true if it was agreeable, and
2008 * caused action sca, false if it has been rejected or nak'ed, and
2009 * caused action scn. (The return value is used to make the state
2010 * transition decision in the state automaton.)
2011 */
2012 HIDE int
sppp_lcp_RCR(struct sppp * sp,struct lcp_header * h,int len)2013 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2014 {
2015 STDDCL;
2016 u_char *buf, *r, *p;
2017 int origlen, rlen;
2018 u_long nmagic;
2019 u_short authproto;
2020
2021 len -= 4;
2022 origlen = len;
2023 buf = r = malloc (len, M_TEMP, M_NOWAIT);
2024 if (! buf)
2025 return (0);
2026
2027 if (debug)
2028 log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
2029 SPP_ARGS(ifp));
2030
2031 /* pass 1: check for things that need to be rejected */
2032 p = (void*) (h+1);
2033 for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
2034 if (p[1] < 2 || p[1] > len) {
2035 free(buf, M_TEMP);
2036 return (-1);
2037 }
2038 if (debug)
2039 addlog("%s ", sppp_lcp_opt_name(*p));
2040 switch (*p) {
2041 case LCP_OPT_MAGIC:
2042 /* Magic number. */
2043 /* fall through, both are same length */
2044 case LCP_OPT_ASYNC_MAP:
2045 /* Async control character map. */
2046 if (len >= 6 && p[1] == 6)
2047 continue;
2048 if (debug)
2049 addlog("[invalid] ");
2050 break;
2051 case LCP_OPT_MRU:
2052 /* Maximum receive unit. */
2053 if (len >= 4 && p[1] == 4)
2054 continue;
2055 if (debug)
2056 addlog("[invalid] ");
2057 break;
2058 case LCP_OPT_AUTH_PROTO:
2059 if (len < 4) {
2060 if (debug)
2061 addlog("[invalid] ");
2062 break;
2063 }
2064 authproto = (p[2] << 8) + p[3];
2065 if (authproto == PPP_CHAP && p[1] != 5) {
2066 if (debug)
2067 addlog("[invalid chap len] ");
2068 break;
2069 }
2070 if (sp->myauth.proto == 0) {
2071 /* we are not configured to do auth */
2072 if (debug)
2073 addlog("[not configured] ");
2074 break;
2075 }
2076 /*
2077 * Remote want us to authenticate, remember this,
2078 * so we stay in PHASE_AUTHENTICATE after LCP got
2079 * up.
2080 */
2081 sp->pp_flags |= PP_NEEDAUTH;
2082 continue;
2083 default:
2084 /* Others not supported. */
2085 if (debug)
2086 addlog("[rej] ");
2087 break;
2088 }
2089 /* Add the option to rejected list. */
2090 bcopy (p, r, p[1]);
2091 r += p[1];
2092 rlen += p[1];
2093 }
2094 if (rlen) {
2095 if (debug)
2096 addlog(" send conf-rej\n");
2097 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2098 goto end;
2099 } else if (debug)
2100 addlog("\n");
2101
2102 /*
2103 * pass 2: check for option values that are unacceptable and
2104 * thus require to be nak'ed.
2105 */
2106 if (debug)
2107 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
2108 SPP_ARGS(ifp));
2109
2110 p = (void*) (h+1);
2111 len = origlen;
2112 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2113 /* Sanity check option length */
2114 if (p[1] > len) {
2115 /*
2116 * Malicious option - drop imediately.
2117 * XXX Maybe we should just RXJ it?
2118 */
2119 addlog("%s: received malicious LCP option 0x%02x, "
2120 "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname,
2121 p[0], p[1], len);
2122 goto drop;
2123 }
2124 if (debug)
2125 addlog("%s ", sppp_lcp_opt_name(*p));
2126 switch (*p) {
2127 case LCP_OPT_MAGIC:
2128 /* Magic number -- extract. */
2129 nmagic = (u_long)p[2] << 24 |
2130 (u_long)p[3] << 16 | p[4] << 8 | p[5];
2131 if (nmagic != sp->lcp.magic) {
2132 if (debug)
2133 addlog("0x%lx ", nmagic);
2134 continue;
2135 }
2136 if (debug)
2137 addlog("[glitch] ");
2138 ++sp->pp_loopcnt;
2139 /*
2140 * We negate our magic here, and NAK it. If
2141 * we see it later in an NAK packet, we
2142 * suggest a new one.
2143 */
2144 nmagic = ~sp->lcp.magic;
2145 /* Gonna NAK it. */
2146 p[2] = nmagic >> 24;
2147 p[3] = nmagic >> 16;
2148 p[4] = nmagic >> 8;
2149 p[5] = nmagic;
2150 break;
2151
2152 case LCP_OPT_ASYNC_MAP:
2153 /* Async control character map -- check to be zero. */
2154 if (! p[2] && ! p[3] && ! p[4] && ! p[5]) {
2155 if (debug)
2156 addlog("[empty] ");
2157 continue;
2158 }
2159 if (debug)
2160 addlog("[non-empty] ");
2161 /* suggest a zero one */
2162 p[2] = p[3] = p[4] = p[5] = 0;
2163 break;
2164
2165 case LCP_OPT_MRU:
2166 /*
2167 * Maximum receive unit. Always agreeable,
2168 * but ignored by now.
2169 */
2170 sp->lcp.their_mru = p[2] * 256 + p[3];
2171 if (debug)
2172 addlog("%lu ", sp->lcp.their_mru);
2173 continue;
2174
2175 case LCP_OPT_AUTH_PROTO:
2176 authproto = (p[2] << 8) + p[3];
2177 if (sp->myauth.proto != authproto) {
2178 /* not agreed, nak */
2179 if (debug)
2180 addlog("[mine %s != his %s] ",
2181 sppp_proto_name(sp->hisauth.proto),
2182 sppp_proto_name(authproto));
2183 p[2] = sp->myauth.proto >> 8;
2184 p[3] = sp->myauth.proto;
2185 break;
2186 }
2187 if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2188 if (debug)
2189 addlog("[chap not MD5] ");
2190 p[4] = CHAP_MD5;
2191 break;
2192 }
2193 continue;
2194 }
2195 /* Add the option to nak'ed list. */
2196 bcopy (p, r, p[1]);
2197 r += p[1];
2198 rlen += p[1];
2199 }
2200 if (rlen) {
2201 if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2202 if (debug)
2203 addlog(" max_failure (%d) exceeded, "
2204 "send conf-rej\n",
2205 sp->lcp.max_failure);
2206 sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2207 } else {
2208 if (debug)
2209 addlog(" send conf-nak\n");
2210 sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2211 }
2212 goto end;
2213 } else {
2214 if (debug)
2215 addlog("send conf-ack\n");
2216 sp->fail_counter[IDX_LCP] = 0;
2217 sp->pp_loopcnt = 0;
2218 sppp_cp_send (sp, PPP_LCP, CONF_ACK,
2219 h->ident, origlen, h+1);
2220 }
2221
2222 end:
2223 free(buf, M_TEMP);
2224 return (rlen == 0);
2225
2226 drop:
2227 free(buf, M_TEMP);
2228 return (-1);
2229 }
2230
2231 /*
2232 * Analyze the LCP Configure-Reject option list, and adjust our
2233 * negotiation.
2234 */
2235 HIDE void
sppp_lcp_RCN_rej(struct sppp * sp,struct lcp_header * h,int len)2236 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2237 {
2238 STDDCL;
2239 u_char *p;
2240
2241 len -= 4;
2242
2243 if (debug)
2244 log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
2245 SPP_ARGS(ifp));
2246
2247 p = (void*) (h+1);
2248 for (; len > 1; len -= p[1], p += p[1]) {
2249 if (p[1] < 2 || p[1] > len)
2250 return;
2251 if (debug)
2252 addlog("%s ", sppp_lcp_opt_name(*p));
2253 switch (*p) {
2254 case LCP_OPT_MAGIC:
2255 /* Magic number -- can't use it, use 0 */
2256 sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2257 sp->lcp.magic = 0;
2258 break;
2259 case LCP_OPT_MRU:
2260 /*
2261 * Should not be rejected anyway, since we only
2262 * negotiate a MRU if explicitly requested by
2263 * peer.
2264 */
2265 sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2266 break;
2267 case LCP_OPT_AUTH_PROTO:
2268 /*
2269 * Peer doesn't want to authenticate himself,
2270 * deny unless this is a dialout call, and
2271 * AUTHFLAG_NOCALLOUT is set.
2272 */
2273 if ((sp->pp_flags & PP_CALLIN) == 0 &&
2274 (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
2275 if (debug)
2276 addlog("[don't insist on auth "
2277 "for callout]");
2278 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2279 break;
2280 }
2281 if (debug)
2282 addlog("[access denied]\n");
2283 lcp.Close(sp);
2284 break;
2285 }
2286 }
2287 if (debug)
2288 addlog("\n");
2289 }
2290
2291 /*
2292 * Analyze the LCP Configure-NAK option list, and adjust our
2293 * negotiation.
2294 */
2295 HIDE void
sppp_lcp_RCN_nak(struct sppp * sp,struct lcp_header * h,int len)2296 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2297 {
2298 STDDCL;
2299 u_char *p;
2300 u_long magic;
2301
2302 len -= 4;
2303
2304 if (debug)
2305 log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
2306 SPP_ARGS(ifp));
2307
2308 p = (void*) (h+1);
2309 for (; len > 1; len -= p[1], p += p[1]) {
2310 if (p[1] < 2 || p[1] > len)
2311 return;
2312 if (debug)
2313 addlog("%s ", sppp_lcp_opt_name(*p));
2314 switch (*p) {
2315 case LCP_OPT_MAGIC:
2316 /* Magic number -- renegotiate */
2317 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2318 len >= 6 && p[1] == 6) {
2319 magic = (u_long)p[2] << 24 |
2320 (u_long)p[3] << 16 | p[4] << 8 | p[5];
2321 /*
2322 * If the remote magic is our negated one,
2323 * this looks like a loopback problem.
2324 * Suggest a new magic to make sure.
2325 */
2326 if (magic == ~sp->lcp.magic) {
2327 if (debug)
2328 addlog("magic glitch ");
2329 sp->lcp.magic = arc4random();
2330 } else {
2331 sp->lcp.magic = magic;
2332 if (debug)
2333 addlog("%lu ", magic);
2334 }
2335 }
2336 break;
2337 case LCP_OPT_MRU:
2338 /*
2339 * Peer wants to advise us to negotiate an MRU.
2340 * Agree on it if it's reasonable, or use
2341 * default otherwise.
2342 */
2343 if (len >= 4 && p[1] == 4) {
2344 u_int mru = p[2] * 256 + p[3];
2345 if (debug)
2346 addlog("%d ", mru);
2347 if (mru < PP_MTU || mru > PP_MAX_MRU)
2348 mru = PP_MTU;
2349 sp->lcp.mru = mru;
2350 sp->lcp.opts |= (1 << LCP_OPT_MRU);
2351 }
2352 break;
2353 case LCP_OPT_AUTH_PROTO:
2354 /*
2355 * Peer doesn't like our authentication method,
2356 * deny.
2357 */
2358 if (debug)
2359 addlog("[access denied]\n");
2360 lcp.Close(sp);
2361 break;
2362 }
2363 }
2364 if (debug)
2365 addlog("\n");
2366 }
2367
2368 HIDE void
sppp_lcp_tlu(struct sppp * sp)2369 sppp_lcp_tlu(struct sppp *sp)
2370 {
2371 struct ifnet *ifp = &sp->pp_if;
2372 int i;
2373 u_long mask;
2374
2375 /* XXX ? */
2376 if (! (ifp->if_flags & IFF_UP) &&
2377 (ifp->if_flags & IFF_RUNNING)) {
2378 /* Coming out of loopback mode. */
2379 if_up(ifp);
2380 printf (SPP_FMT "up\n", SPP_ARGS(ifp));
2381 }
2382
2383 for (i = 0; i < IDX_COUNT; i++)
2384 if ((cps[i])->flags & CP_QUAL)
2385 (cps[i])->Open(sp);
2386
2387 if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2388 (sp->pp_flags & PP_NEEDAUTH) != 0)
2389 sp->pp_phase = PHASE_AUTHENTICATE;
2390 else
2391 sp->pp_phase = PHASE_NETWORK;
2392
2393 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2394 sppp_phase_name(sp->pp_phase));
2395
2396 /*
2397 * Open all authentication protocols. This is even required
2398 * if we already proceeded to network phase, since it might be
2399 * that remote wants us to authenticate, so we might have to
2400 * send a PAP request. Undesired authentication protocols
2401 * don't do anything when they get an Open event.
2402 */
2403 for (i = 0; i < IDX_COUNT; i++)
2404 if ((cps[i])->flags & CP_AUTH)
2405 (cps[i])->Open(sp);
2406
2407 if (sp->pp_phase == PHASE_NETWORK) {
2408 /* Notify all NCPs. */
2409 for (i = 0; i < IDX_COUNT; i++)
2410 if ((cps[i])->flags & CP_NCP)
2411 (cps[i])->Open(sp);
2412 }
2413
2414 /* Send Up events to all started protos. */
2415 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2416 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0)
2417 (cps[i])->Up(sp);
2418
2419 /* notify low-level driver of state change */
2420 if (sp->pp_chg)
2421 sp->pp_chg(sp, (int)sp->pp_phase);
2422
2423 if (sp->pp_phase == PHASE_NETWORK)
2424 /* if no NCP is starting, close down */
2425 sppp_lcp_check_and_close(sp);
2426 }
2427
2428 HIDE void
sppp_lcp_tld(struct sppp * sp)2429 sppp_lcp_tld(struct sppp *sp)
2430 {
2431 struct ifnet *ifp = &sp->pp_if;
2432 int i;
2433 u_long mask;
2434
2435 sp->pp_phase = PHASE_TERMINATE;
2436
2437 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2438 sppp_phase_name(sp->pp_phase));
2439
2440 /*
2441 * Take upper layers down. We send the Down event first and
2442 * the Close second to prevent the upper layers from sending
2443 * ``a flurry of terminate-request packets'', as the RFC
2444 * describes it.
2445 */
2446 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2447 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_LCP) == 0) {
2448 (cps[i])->Down(sp);
2449 (cps[i])->Close(sp);
2450 }
2451 }
2452
2453 HIDE void
sppp_lcp_tls(struct sppp * sp)2454 sppp_lcp_tls(struct sppp *sp)
2455 {
2456 struct ifnet *ifp = &sp->pp_if;
2457
2458 sp->pp_phase = PHASE_ESTABLISH;
2459
2460 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2461 sppp_phase_name(sp->pp_phase));
2462
2463 /* Notify lower layer if desired. */
2464 if (sp->pp_tls)
2465 (sp->pp_tls)(sp);
2466 }
2467
2468 HIDE void
sppp_lcp_tlf(struct sppp * sp)2469 sppp_lcp_tlf(struct sppp *sp)
2470 {
2471 struct ifnet *ifp = &sp->pp_if;
2472
2473 sp->pp_phase = PHASE_DEAD;
2474 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2475 sppp_phase_name(sp->pp_phase));
2476
2477 /* Notify lower layer if desired. */
2478 if (sp->pp_tlf)
2479 (sp->pp_tlf)(sp);
2480 }
2481
2482 HIDE void
sppp_lcp_scr(struct sppp * sp)2483 sppp_lcp_scr(struct sppp *sp)
2484 {
2485 char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2486 int i = 0;
2487 u_short authproto;
2488
2489 if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2490 if (! sp->lcp.magic)
2491 sp->lcp.magic = arc4random();
2492 opt[i++] = LCP_OPT_MAGIC;
2493 opt[i++] = 6;
2494 opt[i++] = sp->lcp.magic >> 24;
2495 opt[i++] = sp->lcp.magic >> 16;
2496 opt[i++] = sp->lcp.magic >> 8;
2497 opt[i++] = sp->lcp.magic;
2498 }
2499
2500 if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2501 opt[i++] = LCP_OPT_MRU;
2502 opt[i++] = 4;
2503 opt[i++] = sp->lcp.mru >> 8;
2504 opt[i++] = sp->lcp.mru;
2505 }
2506
2507 if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2508 authproto = sp->hisauth.proto;
2509 opt[i++] = LCP_OPT_AUTH_PROTO;
2510 opt[i++] = authproto == PPP_CHAP? 5: 4;
2511 opt[i++] = authproto >> 8;
2512 opt[i++] = authproto;
2513 if (authproto == PPP_CHAP)
2514 opt[i++] = CHAP_MD5;
2515 }
2516
2517 sp->confid[IDX_LCP] = ++sp->pp_seq;
2518 sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
2519 }
2520
2521 /*
2522 * Check the open NCPs, return true if at least one NCP is open.
2523 */
2524 HIDE int
sppp_ncp_check(struct sppp * sp)2525 sppp_ncp_check(struct sppp *sp)
2526 {
2527 int i, mask;
2528
2529 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2530 if (sp->lcp.protos & mask && (cps[i])->flags & CP_NCP)
2531 return 1;
2532 return 0;
2533 }
2534
2535 /*
2536 * Re-check the open NCPs and see if we should terminate the link.
2537 * Called by the NCPs during their tlf action handling.
2538 */
2539 HIDE void
sppp_lcp_check_and_close(struct sppp * sp)2540 sppp_lcp_check_and_close(struct sppp *sp)
2541 {
2542
2543 if (sp->pp_phase < PHASE_NETWORK)
2544 /* don't bother, we are already going down */
2545 return;
2546
2547 if (sppp_ncp_check(sp))
2548 return;
2549
2550 lcp.Close(sp);
2551 }
2552 /*
2553 *--------------------------------------------------------------------------*
2554 * *
2555 * The IPCP implementation. *
2556 * *
2557 *--------------------------------------------------------------------------*
2558 */
2559
2560 HIDE void
sppp_ipcp_init(struct sppp * sp)2561 sppp_ipcp_init(struct sppp *sp)
2562 {
2563 sp->ipcp.opts = 0;
2564 sp->ipcp.flags = 0;
2565 sp->state[IDX_IPCP] = STATE_INITIAL;
2566 sp->fail_counter[IDX_IPCP] = 0;
2567 #if defined (__FreeBSD__)
2568 callout_handle_init(&sp->ch[IDX_IPCP]);
2569 #endif
2570 }
2571
2572 HIDE void
sppp_ipcp_up(struct sppp * sp)2573 sppp_ipcp_up(struct sppp *sp)
2574 {
2575 sppp_up_event(&ipcp, sp);
2576 }
2577
2578 HIDE void
sppp_ipcp_down(struct sppp * sp)2579 sppp_ipcp_down(struct sppp *sp)
2580 {
2581 sppp_down_event(&ipcp, sp);
2582 }
2583
2584 HIDE void
sppp_ipcp_open(struct sppp * sp)2585 sppp_ipcp_open(struct sppp *sp)
2586 {
2587 STDDCL;
2588 u_long myaddr, hisaddr;
2589
2590 sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
2591 /*
2592 * If we don't have his address, this probably means our
2593 * interface doesn't want to talk IP at all. (This could
2594 * be the case if somebody wants to speak only IPX, for
2595 * example.) Don't open IPCP in this case.
2596 */
2597 if (hisaddr == 0L) {
2598 /* XXX this message should go away */
2599 if (debug)
2600 log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
2601 SPP_ARGS(ifp));
2602 return;
2603 }
2604
2605 if (myaddr == 0L) {
2606 /*
2607 * I don't have an assigned address, so i need to
2608 * negotiate my address.
2609 */
2610 sp->ipcp.flags |= IPCP_MYADDR_DYN;
2611 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2612 }
2613 sppp_open_event(&ipcp, sp);
2614 }
2615
2616 HIDE void
sppp_ipcp_close(struct sppp * sp)2617 sppp_ipcp_close(struct sppp *sp)
2618 {
2619 sppp_close_event(&ipcp, sp);
2620 if (sp->ipcp.flags & IPCP_MYADDR_DYN)
2621 /*
2622 * My address was dynamic, clear it again.
2623 */
2624 sppp_set_ip_addr(sp, 0L);
2625 }
2626
2627 HIDE void
sppp_ipcp_TO(void * cookie)2628 sppp_ipcp_TO(void *cookie)
2629 {
2630 sppp_to_event(&ipcp, (struct sppp *)cookie);
2631 }
2632
2633 /*
2634 * Analyze a configure request. Return true if it was agreeable, and
2635 * caused action sca, false if it has been rejected or nak'ed, and
2636 * caused action scn. (The return value is used to make the state
2637 * transition decision in the state automaton.)
2638 */
2639 HIDE int
sppp_ipcp_RCR(struct sppp * sp,struct lcp_header * h,int len)2640 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2641 {
2642 u_char *buf, *r, *p;
2643 struct ifnet *ifp = &sp->pp_if;
2644 int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
2645 u_long hisaddr, desiredaddr;
2646
2647 len -= 4;
2648 origlen = len;
2649 /*
2650 * Make sure to allocate a buf that can at least hold a
2651 * conf-nak with an `address' option. We might need it below.
2652 */
2653 buf = r = malloc ((len < 6? 6: len), M_TEMP, M_NOWAIT);
2654 if (! buf)
2655 return (0);
2656
2657 /* pass 1: see if we can recognize them */
2658 if (debug)
2659 log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
2660 SPP_ARGS(ifp));
2661 p = (void*) (h+1);
2662 for (rlen = 0; len > 1; len -= p[1], p += p[1]) {
2663 if (p[1] < 2 || p[1] > len) {
2664 free(buf, M_TEMP);
2665 return (-1);
2666 }
2667 if (debug)
2668 addlog("%s ", sppp_ipcp_opt_name(*p));
2669 switch (*p) {
2670 #ifdef notyet
2671 case IPCP_OPT_COMPRESSION:
2672 if (len >= 6 && p[1] >= 6) {
2673 /* correctly formed compress option */
2674 continue;
2675 }
2676 if (debug)
2677 addlog("[invalid] ");
2678 break;
2679 #endif
2680 case IPCP_OPT_ADDRESS:
2681 if (len >= 6 && p[1] == 6) {
2682 /* correctly formed address option */
2683 continue;
2684 }
2685 if (debug)
2686 addlog("[invalid] ");
2687 break;
2688 default:
2689 /* Others not supported. */
2690 if (debug)
2691 addlog("[rej] ");
2692 break;
2693 }
2694 /* Add the option to rejected list. */
2695 bcopy (p, r, p[1]);
2696 r += p[1];
2697 rlen += p[1];
2698 }
2699 if (rlen) {
2700 if (debug)
2701 addlog(" send conf-rej\n");
2702 sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
2703 goto end;
2704 } else if (debug)
2705 addlog("\n");
2706
2707 /* pass 2: parse option values */
2708 sppp_get_ip_addrs(sp, 0, &hisaddr, 0);
2709 if (debug)
2710 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
2711 SPP_ARGS(ifp));
2712 p = (void*) (h+1);
2713 len = origlen;
2714 for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2715 if (debug)
2716 addlog(" %s ", sppp_ipcp_opt_name(*p));
2717 switch (*p) {
2718 #ifdef notyet
2719 case IPCP_OPT_COMPRESSION:
2720 continue;
2721 #endif
2722 case IPCP_OPT_ADDRESS:
2723 desiredaddr = p[2] << 24 | p[3] << 16 |
2724 p[4] << 8 | p[5];
2725 if (desiredaddr == hisaddr ||
2726 (hisaddr == 1 && desiredaddr != 0)) {
2727 /*
2728 * Peer's address is same as our value,
2729 * or we have set it to 0.0.0.1 to
2730 * indicate that we do not really care,
2731 * this is agreeable. Gonna conf-ack
2732 * it.
2733 */
2734 if (debug)
2735 addlog("%s [ack] ",
2736 sppp_dotted_quad(desiredaddr));
2737 /* record that we've seen it already */
2738 sp->ipcp.flags |= IPCP_HISADDR_SEEN;
2739 continue;
2740 }
2741 /*
2742 * The address wasn't agreeable. This is either
2743 * he sent us 0.0.0.0, asking to assign him an
2744 * address, or he send us another address not
2745 * matching our value. Either case, we gonna
2746 * conf-nak it with our value.
2747 */
2748 if (debug) {
2749 if (desiredaddr == 0)
2750 addlog("[addr requested] ");
2751 else
2752 addlog("%s [not agreed] ",
2753 sppp_dotted_quad(desiredaddr));
2754 }
2755
2756 p[2] = hisaddr >> 24;
2757 p[3] = hisaddr >> 16;
2758 p[4] = hisaddr >> 8;
2759 p[5] = hisaddr;
2760 break;
2761 }
2762 /* Add the option to nak'ed list. */
2763 bcopy (p, r, p[1]);
2764 r += p[1];
2765 rlen += p[1];
2766 }
2767
2768 /*
2769 * If we are about to conf-ack the request, but haven't seen
2770 * his address so far, gonna conf-nak it instead, with the
2771 * `address' option present and our idea of his address being
2772 * filled in there, to request negotiation of both addresses.
2773 *
2774 * XXX This can result in an endless req - nak loop if peer
2775 * doesn't want to send us his address. Q: What should we do
2776 * about it? XXX A: implement the max-failure counter.
2777 */
2778 if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
2779 buf[0] = IPCP_OPT_ADDRESS;
2780 buf[1] = 6;
2781 buf[2] = hisaddr >> 24;
2782 buf[3] = hisaddr >> 16;
2783 buf[4] = hisaddr >> 8;
2784 buf[5] = hisaddr;
2785 rlen = 6;
2786 if (debug)
2787 addlog("still need hisaddr ");
2788 }
2789
2790 if (rlen) {
2791 if (debug)
2792 addlog(" send conf-nak\n");
2793 sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
2794 } else {
2795 if (debug)
2796 addlog(" send conf-ack\n");
2797 sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
2798 h->ident, origlen, h+1);
2799 }
2800
2801 end:
2802 free(buf, M_TEMP);
2803 return (rlen == 0);
2804 }
2805
2806 /*
2807 * Analyze the IPCP Configure-Reject option list, and adjust our
2808 * negotiation.
2809 */
2810 HIDE void
sppp_ipcp_RCN_rej(struct sppp * sp,struct lcp_header * h,int len)2811 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2812 {
2813 u_char *p;
2814 struct ifnet *ifp = &sp->pp_if;
2815 int debug = ifp->if_flags & IFF_DEBUG;
2816
2817 len -= 4;
2818
2819 if (debug)
2820 log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
2821 SPP_ARGS(ifp));
2822
2823 p = (void*) (h+1);
2824 for (; len > 1; len -= p[1], p += p[1]) {
2825 if (p[1] < 2 || p[1] > len)
2826 return;
2827 if (debug)
2828 addlog("%s ", sppp_ipcp_opt_name(*p));
2829 switch (*p) {
2830 case IPCP_OPT_ADDRESS:
2831 /*
2832 * Peer doesn't grok address option. This is
2833 * bad. XXX Should we better give up here?
2834 */
2835 sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
2836 break;
2837 #ifdef notyet
2838 case IPCP_OPT_COMPRESS:
2839 sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
2840 break;
2841 #endif
2842 }
2843 }
2844 if (debug)
2845 addlog("\n");
2846 }
2847
2848 /*
2849 * Analyze the IPCP Configure-NAK option list, and adjust our
2850 * negotiation.
2851 */
2852 HIDE void
sppp_ipcp_RCN_nak(struct sppp * sp,struct lcp_header * h,int len)2853 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2854 {
2855 u_char *p;
2856 struct ifnet *ifp = &sp->pp_if;
2857 int debug = ifp->if_flags & IFF_DEBUG;
2858 u_long wantaddr;
2859
2860 len -= 4;
2861
2862 if (debug)
2863 log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
2864 SPP_ARGS(ifp));
2865
2866 p = (void*) (h+1);
2867 for (; len > 1; len -= p[1], p += p[1]) {
2868 if (p[1] < 2 || p[1] > len)
2869 return;
2870 if (debug)
2871 addlog("%s ", sppp_ipcp_opt_name(*p));
2872 switch (*p) {
2873 case IPCP_OPT_ADDRESS:
2874 /*
2875 * Peer doesn't like our local IP address. See
2876 * if we can do something for him. We'll drop
2877 * him our address then.
2878 */
2879 if (len >= 6 && p[1] == 6) {
2880 wantaddr = p[2] << 24 | p[3] << 16 |
2881 p[4] << 8 | p[5];
2882 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2883 if (debug)
2884 addlog("[wantaddr %s] ",
2885 sppp_dotted_quad(wantaddr));
2886 /*
2887 * When doing dynamic address assignment,
2888 * we accept his offer. Otherwise, we
2889 * ignore it and thus continue to negotiate
2890 * our already existing value.
2891 */
2892 if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
2893 sppp_set_ip_addr(sp, wantaddr);
2894 if (debug)
2895 addlog("[agree] ");
2896 }
2897 }
2898 break;
2899 #ifdef notyet
2900 case IPCP_OPT_COMPRESS:
2901 /*
2902 * Peer wants different compression parameters.
2903 */
2904 break;
2905 #endif
2906 }
2907 }
2908 if (debug)
2909 addlog("\n");
2910 }
2911
2912 HIDE void
sppp_ipcp_tlu(struct sppp * sp)2913 sppp_ipcp_tlu(struct sppp *sp)
2914 {
2915 }
2916
2917 HIDE void
sppp_ipcp_tld(struct sppp * sp)2918 sppp_ipcp_tld(struct sppp *sp)
2919 {
2920 }
2921
2922 HIDE void
sppp_ipcp_tls(struct sppp * sp)2923 sppp_ipcp_tls(struct sppp *sp)
2924 {
2925 /* indicate to LCP that it must stay alive */
2926 sp->lcp.protos |= (1 << IDX_IPCP);
2927 }
2928
2929 HIDE void
sppp_ipcp_tlf(struct sppp * sp)2930 sppp_ipcp_tlf(struct sppp *sp)
2931 {
2932 /* we no longer need LCP */
2933 sp->lcp.protos &= ~(1 << IDX_IPCP);
2934 sppp_lcp_check_and_close(sp);
2935 }
2936
2937 HIDE void
sppp_ipcp_scr(struct sppp * sp)2938 sppp_ipcp_scr(struct sppp *sp)
2939 {
2940 char opt[6 /* compression */ + 6 /* address */];
2941 u_long ouraddr;
2942 int i = 0;
2943
2944 #ifdef notyet
2945 if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
2946 opt[i++] = IPCP_OPT_COMPRESSION;
2947 opt[i++] = 6;
2948 opt[i++] = 0; /* VJ header compression */
2949 opt[i++] = 0x2d; /* VJ header compression */
2950 opt[i++] = max_slot_id;
2951 opt[i++] = comp_slot_id;
2952 }
2953 #endif
2954
2955 if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
2956 sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
2957 opt[i++] = IPCP_OPT_ADDRESS;
2958 opt[i++] = 6;
2959 opt[i++] = ouraddr >> 24;
2960 opt[i++] = ouraddr >> 16;
2961 opt[i++] = ouraddr >> 8;
2962 opt[i++] = ouraddr;
2963 }
2964
2965 sp->confid[IDX_IPCP] = ++sp->pp_seq;
2966 sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
2967 }
2968
2969
2970 /*
2971 *--------------------------------------------------------------------------*
2972 * *
2973 * The CHAP implementation. *
2974 * *
2975 *--------------------------------------------------------------------------*
2976 */
2977
2978 /*
2979 * The authentication protocols don't employ a full-fledged state machine as
2980 * the control protocols do, since they do have Open and Close events, but
2981 * not Up and Down, nor are they explicitly terminated. Also, use of the
2982 * authentication protocols may be different in both directions (this makes
2983 * sense, think of a machine that never accepts incoming calls but only
2984 * calls out, it doesn't require the called party to authenticate itself).
2985 *
2986 * Our state machine for the local authentication protocol (we are requesting
2987 * the peer to authenticate) looks like:
2988 *
2989 * RCA-
2990 * +--------------------------------------------+
2991 * V scn,tld|
2992 * +--------+ Close +---------+ RCA+
2993 * | |<----------------------------------| |------+
2994 * +--->| Closed | TO* | Opened | sca |
2995 * | | |-----+ +-------| |<-----+
2996 * | +--------+ irc | | +---------+
2997 * | ^ | | ^
2998 * | | | | |
2999 * | | | | |
3000 * | TO-| | | |
3001 * | |tld TO+ V | |
3002 * | | +------->+ | |
3003 * | | | | | |
3004 * | +--------+ V | |
3005 * | | |<----+<--------------------+ |
3006 * | | Req- | scr |
3007 * | | Sent | |
3008 * | | | |
3009 * | +--------+ |
3010 * | RCA- | | RCA+ |
3011 * +------+ +------------------------------------------+
3012 * scn,tld sca,irc,ict,tlu
3013 *
3014 *
3015 * with:
3016 *
3017 * Open: LCP reached authentication phase
3018 * Close: LCP reached terminate phase
3019 *
3020 * RCA+: received reply (pap-req, chap-response), acceptable
3021 * RCN: received reply (pap-req, chap-response), not acceptable
3022 * TO+: timeout with restart counter >= 0
3023 * TO-: timeout with restart counter < 0
3024 * TO*: reschedule timeout for CHAP
3025 *
3026 * scr: send request packet (none for PAP, chap-challenge)
3027 * sca: send ack packet (pap-ack, chap-success)
3028 * scn: send nak packet (pap-nak, chap-failure)
3029 * ict: initialize re-challenge timer (CHAP only)
3030 *
3031 * tlu: this-layer-up, LCP reaches network phase
3032 * tld: this-layer-down, LCP enters terminate phase
3033 *
3034 * Note that in CHAP mode, after sending a new challenge, while the state
3035 * automaton falls back into Req-Sent state, it doesn't signal a tld
3036 * event to LCP, so LCP remains in network phase. Only after not getting
3037 * any response (or after getting an unacceptable response), CHAP closes,
3038 * causing LCP to enter terminate phase.
3039 *
3040 * With PAP, there is no initial request that can be sent. The peer is
3041 * expected to send one based on the successful negotiation of PAP as
3042 * the authentication protocol during the LCP option negotiation.
3043 *
3044 * Incoming authentication protocol requests (remote requests
3045 * authentication, we are peer) don't employ a state machine at all,
3046 * they are simply answered. Some peers [Ascend P50 firmware rev
3047 * 4.50] react allergically when sending IPCP requests while they are
3048 * still in authentication phase (thereby violating the standard that
3049 * demands that these NCP packets are to be discarded), so we keep
3050 * track of the peer demanding us to authenticate, and only proceed to
3051 * phase network once we've seen a positive acknowledge for the
3052 * authentication.
3053 */
3054
3055 /*
3056 * Handle incoming CHAP packets.
3057 */
3058 void
sppp_chap_input(struct sppp * sp,struct mbuf * m)3059 sppp_chap_input(struct sppp *sp, struct mbuf *m)
3060 {
3061 STDDCL;
3062 struct lcp_header *h;
3063 int len, x;
3064 u_char *value, *name, digest[AUTHKEYLEN], dsize;
3065 int value_len, name_len;
3066 MD5_CTX ctx;
3067
3068 len = m->m_pkthdr.len;
3069 if (len < 4) {
3070 if (debug)
3071 log(LOG_DEBUG,
3072 SPP_FMT "chap invalid packet length: %d bytes\n",
3073 SPP_ARGS(ifp), len);
3074 return;
3075 }
3076 h = mtod (m, struct lcp_header*);
3077 if (len > ntohs (h->len))
3078 len = ntohs (h->len);
3079
3080 switch (h->type) {
3081 /* challenge, failure and success are his authproto */
3082 case CHAP_CHALLENGE:
3083 value = 1 + (u_char*)(h+1);
3084 value_len = value[-1];
3085 name = value + value_len;
3086 name_len = len - value_len - 5;
3087 if (name_len < 0) {
3088 if (debug) {
3089 log(LOG_DEBUG,
3090 SPP_FMT "chap corrupted challenge "
3091 "<%s id=0x%x len=%d",
3092 SPP_ARGS(ifp),
3093 sppp_auth_type_name(PPP_CHAP, h->type),
3094 h->ident, ntohs(h->len));
3095 if (len > 4)
3096 sppp_print_bytes((u_char*) (h+1), len-4);
3097 addlog(">\n");
3098 }
3099 break;
3100 }
3101
3102 if (debug) {
3103 log(LOG_DEBUG,
3104 SPP_FMT "chap input <%s id=0x%x len=%d name=",
3105 SPP_ARGS(ifp),
3106 sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
3107 ntohs(h->len));
3108 sppp_print_string((char*) name, name_len);
3109 addlog(" value-size=%d value=", value_len);
3110 sppp_print_bytes(value, value_len);
3111 addlog(">\n");
3112 }
3113
3114 /* Compute reply value. */
3115 MD5Init(&ctx);
3116 MD5Update(&ctx, &h->ident, 1);
3117 MD5Update(&ctx, sp->myauth.secret,
3118 sppp_strnlen(sp->myauth.secret, AUTHKEYLEN));
3119 MD5Update(&ctx, value, value_len);
3120 MD5Final(digest, &ctx);
3121 dsize = sizeof digest;
3122
3123 sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
3124 sizeof dsize, (const char *)&dsize,
3125 sizeof digest, digest,
3126 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
3127 sp->myauth.name,
3128 0);
3129 break;
3130
3131 case CHAP_SUCCESS:
3132 if (debug) {
3133 log(LOG_DEBUG, SPP_FMT "chap success",
3134 SPP_ARGS(ifp));
3135 if (len > 4) {
3136 addlog(": ");
3137 sppp_print_string((char*)(h + 1), len - 4);
3138 }
3139 addlog("\n");
3140 }
3141 x = splimp();
3142 sp->pp_flags &= ~PP_NEEDAUTH;
3143 if (sp->myauth.proto == PPP_CHAP &&
3144 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3145 (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
3146 /*
3147 * We are authenticator for CHAP but didn't
3148 * complete yet. Leave it to tlu to proceed
3149 * to network phase.
3150 */
3151 splx(x);
3152 break;
3153 }
3154 splx(x);
3155 sppp_phase_network(sp);
3156 break;
3157
3158 case CHAP_FAILURE:
3159 if (debug) {
3160 log(LOG_INFO, SPP_FMT "chap failure",
3161 SPP_ARGS(ifp));
3162 if (len > 4) {
3163 addlog(": ");
3164 sppp_print_string((char*)(h + 1), len - 4);
3165 }
3166 addlog("\n");
3167 } else
3168 log(LOG_INFO, SPP_FMT "chap failure\n",
3169 SPP_ARGS(ifp));
3170 /* await LCP shutdown by authenticator */
3171 break;
3172
3173 /* response is my authproto */
3174 case CHAP_RESPONSE:
3175 value = 1 + (u_char*)(h+1);
3176 value_len = value[-1];
3177 name = value + value_len;
3178 name_len = len - value_len - 5;
3179 if (name_len < 0) {
3180 if (debug) {
3181 log(LOG_DEBUG,
3182 SPP_FMT "chap corrupted response "
3183 "<%s id=0x%x len=%d",
3184 SPP_ARGS(ifp),
3185 sppp_auth_type_name(PPP_CHAP, h->type),
3186 h->ident, ntohs(h->len));
3187 if (len > 4)
3188 sppp_print_bytes((u_char*)(h+1), len-4);
3189 addlog(">\n");
3190 }
3191 break;
3192 }
3193 if (h->ident != sp->confid[IDX_CHAP]) {
3194 if (debug)
3195 log(LOG_DEBUG,
3196 SPP_FMT "chap dropping response for old ID "
3197 "(got %d, expected %d)\n",
3198 SPP_ARGS(ifp),
3199 h->ident, sp->confid[IDX_CHAP]);
3200 break;
3201 }
3202 if (name_len != sppp_strnlen(sp->hisauth.name, AUTHNAMELEN)
3203 || bcmp(name, sp->hisauth.name, name_len) != 0) {
3204 log(LOG_INFO, SPP_FMT "chap response, his name ",
3205 SPP_ARGS(ifp));
3206 sppp_print_string(name, name_len);
3207 addlog(" != expected ");
3208 sppp_print_string(sp->hisauth.name,
3209 sppp_strnlen(sp->hisauth.name, AUTHNAMELEN));
3210 addlog("\n");
3211 }
3212 if (debug) {
3213 log(LOG_DEBUG, SPP_FMT "chap input(%s) "
3214 "<%s id=0x%x len=%d name=",
3215 SPP_ARGS(ifp),
3216 sppp_state_name(sp->state[IDX_CHAP]),
3217 sppp_auth_type_name(PPP_CHAP, h->type),
3218 h->ident, ntohs (h->len));
3219 sppp_print_string((char*)name, name_len);
3220 addlog(" value-size=%d value=", value_len);
3221 sppp_print_bytes(value, value_len);
3222 addlog(">\n");
3223 }
3224 if (value_len != AUTHKEYLEN) {
3225 if (debug)
3226 log(LOG_DEBUG,
3227 SPP_FMT "chap bad hash value length: "
3228 "%d bytes, should be %d\n",
3229 SPP_ARGS(ifp), value_len,
3230 AUTHKEYLEN);
3231 break;
3232 }
3233
3234 MD5Init(&ctx);
3235 MD5Update(&ctx, &h->ident, 1);
3236 MD5Update(&ctx, sp->hisauth.secret,
3237 sppp_strnlen(sp->hisauth.secret, AUTHKEYLEN));
3238 MD5Update(&ctx, sp->myauth.challenge, AUTHKEYLEN);
3239 MD5Final(digest, &ctx);
3240
3241 #define FAILMSG "Failed..."
3242 #define SUCCMSG "Welcome!"
3243
3244 if (value_len != sizeof digest ||
3245 bcmp(digest, value, value_len) != 0) {
3246 /* action scn, tld */
3247 sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
3248 sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
3249 0);
3250 chap.tld(sp);
3251 break;
3252 }
3253 /* action sca, perhaps tlu */
3254 if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
3255 sp->state[IDX_CHAP] == STATE_OPENED)
3256 sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
3257 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
3258 0);
3259 if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
3260 sppp_cp_change_state(&chap, sp, STATE_OPENED);
3261 chap.tlu(sp);
3262 }
3263 break;
3264
3265 default:
3266 /* Unknown CHAP packet type -- ignore. */
3267 if (debug) {
3268 log(LOG_DEBUG, SPP_FMT "chap unknown input(%s) "
3269 "<0x%x id=0x%xh len=%d",
3270 SPP_ARGS(ifp),
3271 sppp_state_name(sp->state[IDX_CHAP]),
3272 h->type, h->ident, ntohs(h->len));
3273 if (len > 4)
3274 sppp_print_bytes((u_char*)(h+1), len-4);
3275 addlog(">\n");
3276 }
3277 break;
3278
3279 }
3280 }
3281
3282 HIDE void
sppp_chap_init(struct sppp * sp)3283 sppp_chap_init(struct sppp *sp)
3284 {
3285 /* Chap doesn't have STATE_INITIAL at all. */
3286 sp->state[IDX_CHAP] = STATE_CLOSED;
3287 sp->fail_counter[IDX_CHAP] = 0;
3288 #if defined (__FreeBSD__)
3289 callout_handle_init(&sp->ch[IDX_CHAP]);
3290 #endif
3291 }
3292
3293 HIDE void
sppp_chap_open(struct sppp * sp)3294 sppp_chap_open(struct sppp *sp)
3295 {
3296 if (sp->myauth.proto == PPP_CHAP &&
3297 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
3298 /* we are authenticator for CHAP, start it */
3299 chap.scr(sp);
3300 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3301 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
3302 }
3303 /* nothing to be done if we are peer, await a challenge */
3304 }
3305
3306 HIDE void
sppp_chap_close(struct sppp * sp)3307 sppp_chap_close(struct sppp *sp)
3308 {
3309 if (sp->state[IDX_CHAP] != STATE_CLOSED)
3310 sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3311 }
3312
3313 HIDE void
sppp_chap_TO(void * cookie)3314 sppp_chap_TO(void *cookie)
3315 {
3316 struct sppp *sp = (struct sppp *)cookie;
3317 STDDCL;
3318 int s;
3319
3320 s = splimp();
3321 if (debug)
3322 log(LOG_DEBUG, SPP_FMT "chap TO(%s) rst_counter = %d\n",
3323 SPP_ARGS(ifp),
3324 sppp_state_name(sp->state[IDX_CHAP]),
3325 sp->rst_counter[IDX_CHAP]);
3326
3327 if (--sp->rst_counter[IDX_CHAP] < 0)
3328 /* TO- event */
3329 switch (sp->state[IDX_CHAP]) {
3330 case STATE_REQ_SENT:
3331 chap.tld(sp);
3332 sppp_cp_change_state(&chap, sp, STATE_CLOSED);
3333 break;
3334 }
3335 else
3336 /* TO+ (or TO*) event */
3337 switch (sp->state[IDX_CHAP]) {
3338 case STATE_OPENED:
3339 /* TO* event */
3340 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3341 /* fall through */
3342 case STATE_REQ_SENT:
3343 chap.scr(sp);
3344 /* sppp_cp_change_state() will restart the timer */
3345 sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
3346 break;
3347 }
3348
3349 splx(s);
3350 }
3351
3352 HIDE void
sppp_chap_tlu(struct sppp * sp)3353 sppp_chap_tlu(struct sppp *sp)
3354 {
3355 STDDCL;
3356 int i = 0, x;
3357
3358 i = 0;
3359 sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
3360
3361 /*
3362 * Some broken CHAP implementations (Conware CoNet, firmware
3363 * 4.0.?) don't want to re-authenticate their CHAP once the
3364 * initial challenge-response exchange has taken place.
3365 * Provide for an option to avoid rechallenges.
3366 */
3367 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0) {
3368 /*
3369 * Compute the re-challenge timeout. This will yield
3370 * a number between 300 and 810 seconds.
3371 */
3372 i = 300 + (arc4random() & 0x01fe);
3373
3374 #if defined (__FreeBSD__)
3375 sp->ch[IDX_CHAP] = timeout(chap.TO, (void *)sp, i * hz);
3376 #elif defined(__OpenBSD__)
3377 timeout_set(&sp->ch[IDX_CHAP], chap.TO, (void *)sp);
3378 timeout_add(&sp->ch[IDX_CHAP], i * hz);
3379 #endif
3380 }
3381
3382 if (debug) {
3383 log(LOG_DEBUG,
3384 SPP_FMT "chap %s, ",
3385 SPP_ARGS(ifp),
3386 sp->pp_phase == PHASE_NETWORK? "reconfirmed": "tlu");
3387 if ((sp->hisauth.flags & AUTHFLAG_NORECHALLENGE) == 0)
3388 addlog("next re-challenge in %d seconds\n", i);
3389 else
3390 addlog("re-challenging supressed\n");
3391 }
3392
3393 x = splimp();
3394 /* indicate to LCP that we need to be closed down */
3395 sp->lcp.protos |= (1 << IDX_CHAP);
3396
3397 if (sp->pp_flags & PP_NEEDAUTH) {
3398 /*
3399 * Remote is authenticator, but his auth proto didn't
3400 * complete yet. Defer the transition to network
3401 * phase.
3402 */
3403 splx(x);
3404 return;
3405 }
3406 splx(x);
3407
3408 /*
3409 * If we are already in phase network, we are done here. This
3410 * is the case if this is a dummy tlu event after a re-challenge.
3411 */
3412 if (sp->pp_phase != PHASE_NETWORK)
3413 sppp_phase_network(sp);
3414 }
3415
3416 HIDE void
sppp_chap_tld(struct sppp * sp)3417 sppp_chap_tld(struct sppp *sp)
3418 {
3419 STDDCL;
3420
3421 if (debug)
3422 log(LOG_DEBUG, SPP_FMT "chap tld\n", SPP_ARGS(ifp));
3423 UNTIMEOUT(chap.TO, (void *)sp, sp->ch[IDX_CHAP]);
3424 sp->lcp.protos &= ~(1 << IDX_CHAP);
3425
3426 lcp.Close(sp);
3427 }
3428
3429 HIDE void
sppp_chap_scr(struct sppp * sp)3430 sppp_chap_scr(struct sppp *sp)
3431 {
3432 u_int32_t *ch;
3433 u_char clen;
3434
3435 /* Compute random challenge. */
3436 ch = (u_int32_t *)sp->myauth.challenge;
3437 ch[0] = arc4random();
3438 ch[1] = arc4random();
3439 ch[2] = arc4random();
3440 ch[3] = arc4random();
3441 clen = AUTHKEYLEN;
3442
3443 sp->confid[IDX_CHAP] = ++sp->pp_seq;
3444
3445 sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
3446 sizeof clen, (const char *)&clen,
3447 (size_t)AUTHKEYLEN, sp->myauth.challenge,
3448 (size_t)sppp_strnlen(sp->myauth.name, AUTHNAMELEN),
3449 sp->myauth.name,
3450 0);
3451 }
3452 /*
3453 *--------------------------------------------------------------------------*
3454 * *
3455 * The PAP implementation. *
3456 * *
3457 *--------------------------------------------------------------------------*
3458 */
3459 /*
3460 * For PAP, we need to keep a little state also if we are the peer, not the
3461 * authenticator. This is since we don't get a request to authenticate, but
3462 * have to repeatedly authenticate ourself until we got a response (or the
3463 * retry counter is expired).
3464 */
3465
3466 /*
3467 * Handle incoming PAP packets. */
3468 HIDE void
sppp_pap_input(struct sppp * sp,struct mbuf * m)3469 sppp_pap_input(struct sppp *sp, struct mbuf *m)
3470 {
3471 STDDCL;
3472 struct lcp_header *h;
3473 int len, x;
3474 u_char *name, *passwd, mlen;
3475 int name_len, passwd_len;
3476
3477 len = m->m_pkthdr.len;
3478 if (len < 5) {
3479 if (debug)
3480 log(LOG_DEBUG,
3481 SPP_FMT "pap invalid packet length: %d bytes\n",
3482 SPP_ARGS(ifp), len);
3483 return;
3484 }
3485 h = mtod (m, struct lcp_header*);
3486 if (len > ntohs (h->len))
3487 len = ntohs (h->len);
3488 switch (h->type) {
3489 /* PAP request is my authproto */
3490 case PAP_REQ:
3491 name = 1 + (u_char*)(h+1);
3492 name_len = name[-1];
3493 passwd = name + name_len + 1;
3494 if (name_len > len - 6 ||
3495 (passwd_len = passwd[-1]) > len - 6 - name_len) {
3496 if (debug) {
3497 log(LOG_DEBUG, SPP_FMT "pap corrupted input "
3498 "<%s id=0x%x len=%d",
3499 SPP_ARGS(ifp),
3500 sppp_auth_type_name(PPP_PAP, h->type),
3501 h->ident, ntohs(h->len));
3502 if (len > 4)
3503 sppp_print_bytes((u_char*)(h+1), len-4);
3504 addlog(">\n");
3505 }
3506 break;
3507 }
3508 if (debug) {
3509 log(LOG_DEBUG, SPP_FMT "pap input(%s) "
3510 "<%s id=0x%x len=%d name=",
3511 SPP_ARGS(ifp),
3512 sppp_state_name(sp->state[IDX_PAP]),
3513 sppp_auth_type_name(PPP_PAP, h->type),
3514 h->ident, ntohs(h->len));
3515 sppp_print_string((char*)name, name_len);
3516 addlog(" passwd=");
3517 sppp_print_string((char*)passwd, passwd_len);
3518 addlog(">\n");
3519 }
3520 if (name_len > AUTHNAMELEN ||
3521 passwd_len > AUTHKEYLEN ||
3522 bcmp(name, sp->hisauth.name, name_len) != 0 ||
3523 bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
3524 /* action scn, tld */
3525 mlen = sizeof(FAILMSG) - 1;
3526 sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
3527 sizeof mlen, (const char *)&mlen,
3528 sizeof(FAILMSG) - 1, (u_char *)FAILMSG,
3529 0);
3530 pap.tld(sp);
3531 break;
3532 }
3533 /* action sca, perhaps tlu */
3534 if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
3535 sp->state[IDX_PAP] == STATE_OPENED) {
3536 mlen = sizeof(SUCCMSG) - 1;
3537 sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
3538 sizeof mlen, (const char *)&mlen,
3539 sizeof(SUCCMSG) - 1, (u_char *)SUCCMSG,
3540 0);
3541 }
3542 if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
3543 sppp_cp_change_state(&pap, sp, STATE_OPENED);
3544 pap.tlu(sp);
3545 }
3546 break;
3547
3548 /* ack and nak are his authproto */
3549 case PAP_ACK:
3550 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3551 if (debug) {
3552 log(LOG_DEBUG, SPP_FMT "pap success",
3553 SPP_ARGS(ifp));
3554 name_len = *((char *)h);
3555 if (len > 5 && name_len) {
3556 addlog(": ");
3557 sppp_print_string((char*)(h+1), name_len);
3558 }
3559 addlog("\n");
3560 }
3561 x = splimp();
3562 sp->pp_flags &= ~PP_NEEDAUTH;
3563 if (sp->myauth.proto == PPP_PAP &&
3564 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
3565 (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
3566 /*
3567 * We are authenticator for PAP but didn't
3568 * complete yet. Leave it to tlu to proceed
3569 * to network phase.
3570 */
3571 splx(x);
3572 break;
3573 }
3574 splx(x);
3575 sppp_phase_network(sp);
3576 break;
3577
3578 case PAP_NAK:
3579 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3580 if (debug) {
3581 log(LOG_INFO, SPP_FMT "pap failure",
3582 SPP_ARGS(ifp));
3583 name_len = *((char *)h);
3584 if (len > 5 && name_len) {
3585 addlog(": ");
3586 sppp_print_string((char*)(h+1), name_len);
3587 }
3588 addlog("\n");
3589 } else
3590 log(LOG_INFO, SPP_FMT "pap failure\n",
3591 SPP_ARGS(ifp));
3592 /* await LCP shutdown by authenticator */
3593 break;
3594
3595 default:
3596 /* Unknown PAP packet type -- ignore. */
3597 if (debug) {
3598 log(LOG_DEBUG, SPP_FMT "pap corrupted input "
3599 "<0x%x id=0x%x len=%d",
3600 SPP_ARGS(ifp),
3601 h->type, h->ident, ntohs(h->len));
3602 if (len > 4)
3603 sppp_print_bytes((u_char*)(h+1), len-4);
3604 addlog(">\n");
3605 }
3606 break;
3607
3608 }
3609 }
3610
3611 HIDE void
sppp_pap_init(struct sppp * sp)3612 sppp_pap_init(struct sppp *sp)
3613 {
3614 /* PAP doesn't have STATE_INITIAL at all. */
3615 sp->state[IDX_PAP] = STATE_CLOSED;
3616 sp->fail_counter[IDX_PAP] = 0;
3617 #if defined (__FreeBSD__)
3618 callout_handle_init(&sp->ch[IDX_PAP]);
3619 callout_handle_init(&sp->pap_my_to_ch);
3620 #endif
3621 }
3622
3623 HIDE void
sppp_pap_open(struct sppp * sp)3624 sppp_pap_open(struct sppp *sp)
3625 {
3626 if (sp->hisauth.proto == PPP_PAP &&
3627 (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
3628 /* we are authenticator for PAP, start our timer */
3629 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
3630 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
3631 }
3632 if (sp->myauth.proto == PPP_PAP) {
3633 /* we are peer, send a request, and start a timer */
3634 pap.scr(sp);
3635 #if defined (__FreeBSD__)
3636 sp->pap_my_to_ch =
3637 timeout(sppp_pap_my_TO, (void *)sp, sp->lcp.timeout);
3638 #elif defined (__OpenBSD__)
3639 timeout_set(&sp->pap_my_to_ch, sppp_pap_my_TO, (void *)sp);
3640 timeout_add(&sp->pap_my_to_ch, sp->lcp.timeout);
3641 #endif
3642 }
3643 }
3644
3645 HIDE void
sppp_pap_close(struct sppp * sp)3646 sppp_pap_close(struct sppp *sp)
3647 {
3648 if (sp->state[IDX_PAP] != STATE_CLOSED)
3649 sppp_cp_change_state(&pap, sp, STATE_CLOSED);
3650 }
3651
3652 /*
3653 * That's the timeout routine if we are authenticator. Since the
3654 * authenticator is basically passive in PAP, we can't do much here.
3655 */
3656 HIDE void
sppp_pap_TO(void * cookie)3657 sppp_pap_TO(void *cookie)
3658 {
3659 struct sppp *sp = (struct sppp *)cookie;
3660 STDDCL;
3661 int s;
3662
3663 s = splimp();
3664 if (debug)
3665 log(LOG_DEBUG, SPP_FMT "pap TO(%s) rst_counter = %d\n",
3666 SPP_ARGS(ifp),
3667 sppp_state_name(sp->state[IDX_PAP]),
3668 sp->rst_counter[IDX_PAP]);
3669
3670 if (--sp->rst_counter[IDX_PAP] < 0)
3671 /* TO- event */
3672 switch (sp->state[IDX_PAP]) {
3673 case STATE_REQ_SENT:
3674 pap.tld(sp);
3675 sppp_cp_change_state(&pap, sp, STATE_CLOSED);
3676 break;
3677 }
3678 else
3679 /* TO+ event, not very much we could do */
3680 switch (sp->state[IDX_PAP]) {
3681 case STATE_REQ_SENT:
3682 /* sppp_cp_change_state() will restart the timer */
3683 sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
3684 break;
3685 }
3686
3687 splx(s);
3688 }
3689
3690 /*
3691 * That's the timeout handler if we are peer. Since the peer is active,
3692 * we need to retransmit our PAP request since it is apparently lost.
3693 * XXX We should impose a max counter.
3694 */
3695 HIDE void
sppp_pap_my_TO(void * cookie)3696 sppp_pap_my_TO(void *cookie)
3697 {
3698 struct sppp *sp = (struct sppp *)cookie;
3699 STDDCL;
3700
3701 if (debug)
3702 log(LOG_DEBUG, SPP_FMT "pap peer TO\n",
3703 SPP_ARGS(ifp));
3704
3705 pap.scr(sp);
3706 }
3707
3708 HIDE void
sppp_pap_tlu(struct sppp * sp)3709 sppp_pap_tlu(struct sppp *sp)
3710 {
3711 STDDCL;
3712 int x;
3713
3714 sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
3715
3716 if (debug)
3717 log(LOG_DEBUG, SPP_FMT "%s tlu\n",
3718 SPP_ARGS(ifp), pap.name);
3719
3720 x = splimp();
3721 /* indicate to LCP that we need to be closed down */
3722 sp->lcp.protos |= (1 << IDX_PAP);
3723
3724 if (sp->pp_flags & PP_NEEDAUTH) {
3725 /*
3726 * Remote is authenticator, but his auth proto didn't
3727 * complete yet. Defer the transition to network
3728 * phase.
3729 */
3730 splx(x);
3731 return;
3732 }
3733 splx(x);
3734 sppp_phase_network(sp);
3735 }
3736
3737 HIDE void
sppp_pap_tld(struct sppp * sp)3738 sppp_pap_tld(struct sppp *sp)
3739 {
3740 STDDCL;
3741
3742 if (debug)
3743 log(LOG_DEBUG, SPP_FMT "pap tld\n", SPP_ARGS(ifp));
3744 UNTIMEOUT(pap.TO, (void *)sp, sp->ch[IDX_PAP]);
3745 UNTIMEOUT(sppp_pap_my_TO, (void *)sp, sp->pap_my_to_ch);
3746 sp->lcp.protos &= ~(1 << IDX_PAP);
3747
3748 lcp.Close(sp);
3749 }
3750
3751 HIDE void
sppp_pap_scr(struct sppp * sp)3752 sppp_pap_scr(struct sppp *sp)
3753 {
3754 u_char idlen, pwdlen;
3755
3756 sp->confid[IDX_PAP] = ++sp->pp_seq;
3757 pwdlen = sppp_strnlen(sp->myauth.secret, AUTHKEYLEN);
3758 idlen = sppp_strnlen(sp->myauth.name, AUTHNAMELEN);
3759
3760 sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
3761 sizeof idlen, (const char *)&idlen,
3762 (size_t)idlen, sp->myauth.name,
3763 sizeof pwdlen, (const char *)&pwdlen,
3764 (size_t)pwdlen, sp->myauth.secret,
3765 0);
3766 }
3767 /*
3768 * Random miscellaneous functions.
3769 */
3770
3771 /*
3772 * Send a PAP or CHAP proto packet.
3773 *
3774 * Varadic function, each of the elements for the ellipsis is of type
3775 * ``size_t mlen, const u_char *msg''. Processing will stop iff
3776 * mlen == 0.
3777 */
3778
3779 HIDE void
sppp_auth_send(const struct cp * cp,struct sppp * sp,unsigned int type,u_char id,...)3780 sppp_auth_send(const struct cp *cp, struct sppp *sp,
3781 unsigned int type, u_char id, ...)
3782 {
3783 STDDCL;
3784 struct ppp_header *h;
3785 struct lcp_header *lh;
3786 struct mbuf *m;
3787 u_char *p;
3788 int len;
3789 size_t pkthdrlen;
3790 unsigned int mlen;
3791 const char *msg;
3792 va_list ap;
3793
3794 MGETHDR (m, M_DONTWAIT, MT_DATA);
3795 if (! m)
3796 return;
3797 m->m_pkthdr.rcvif = 0;
3798
3799 if (sp->pp_flags & PP_NOFRAMING) {
3800 *mtod(m, u_int16_t *) = htons(cp->proto);
3801 pkthdrlen = 2;
3802 lh = (struct lcp_header *)(mtod(m, u_int8_t *) + 2);
3803 } else {
3804 h = mtod (m, struct ppp_header*);
3805 h->address = PPP_ALLSTATIONS; /* broadcast address */
3806 h->control = PPP_UI; /* Unnumbered Info */
3807 h->protocol = htons(cp->proto);
3808 pkthdrlen = PPP_HEADER_LEN;
3809 lh = (struct lcp_header*)(h + 1);
3810 }
3811
3812 lh->type = type;
3813 lh->ident = id;
3814 p = (u_char*) (lh+1);
3815
3816 va_start(ap, id);
3817 len = 0;
3818
3819 while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
3820 msg = va_arg(ap, const char *);
3821 len += mlen;
3822 if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
3823 va_end(ap);
3824 m_freem(m);
3825 return;
3826 }
3827
3828 bcopy(msg, p, mlen);
3829 p += mlen;
3830 }
3831 va_end(ap);
3832
3833 m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
3834 lh->len = htons (LCP_HEADER_LEN + len);
3835
3836 if (debug) {
3837 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
3838 SPP_ARGS(ifp), cp->name,
3839 sppp_auth_type_name(cp->proto, lh->type),
3840 lh->ident, ntohs(lh->len));
3841 if (len)
3842 sppp_print_bytes((u_char*) (lh+1), len);
3843 addlog(">\n");
3844 }
3845 if (IF_QFULL (&sp->pp_cpq)) {
3846 IF_DROP (&sp->pp_fastq);
3847 IF_DROP (&ifp->if_snd);
3848 m_freem (m);
3849 ++ifp->if_oerrors;
3850 m = NULL;
3851 } else
3852 IF_ENQUEUE (&sp->pp_cpq, m);
3853 if (! (ifp->if_flags & IFF_OACTIVE))
3854 (*ifp->if_start) (ifp);
3855 if (m != NULL)
3856 ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
3857 }
3858
3859 /*
3860 * Flush interface queue.
3861 */
3862 HIDE void
sppp_qflush(struct ifqueue * ifq)3863 sppp_qflush(struct ifqueue *ifq)
3864 {
3865 struct mbuf *m, *n;
3866
3867 n = ifq->ifq_head;
3868 while ((m = n)) {
3869 n = m->m_act;
3870 m_freem (m);
3871 }
3872 ifq->ifq_head = 0;
3873 ifq->ifq_tail = 0;
3874 ifq->ifq_len = 0;
3875 }
3876
3877 /*
3878 * Send keepalive packets, every 10 seconds.
3879 */
3880 HIDE void
sppp_keepalive(void * dummy)3881 sppp_keepalive(void *dummy)
3882 {
3883 struct sppp *sp;
3884 int s;
3885 struct timeval tv;
3886
3887 s = splimp();
3888 getmicrouptime(&tv);
3889 for (sp=spppq; sp; sp=sp->pp_next) {
3890 struct ifnet *ifp = &sp->pp_if;
3891
3892 /* Keepalive mode disabled or channel down? */
3893 if (! (sp->pp_flags & PP_KEEPALIVE) ||
3894 ! (ifp->if_flags & IFF_RUNNING))
3895 continue;
3896
3897 /* No keepalive in PPP mode if LCP not opened yet. */
3898 if (! (sp->pp_flags & PP_CISCO) &&
3899 sp->pp_phase < PHASE_AUTHENTICATE)
3900 continue;
3901
3902 /* No echo reply, but maybe user data passed through? */
3903 if (!(sp->pp_flags & PP_CISCO) &&
3904 (tv.tv_sec - sp->pp_last_receive) < NORECV_TIME) {
3905 sp->pp_alivecnt = 0;
3906 continue;
3907 }
3908
3909 if (sp->pp_alivecnt >= MAXALIVECNT) {
3910 /* No keepalive packets got. Stop the interface. */
3911 if_down (ifp);
3912 sppp_qflush (&sp->pp_cpq);
3913 if (! (sp->pp_flags & PP_CISCO)) {
3914 printf (SPP_FMT "LCP keepalive timeout\n",
3915 SPP_ARGS(ifp));
3916 sp->pp_alivecnt = 0;
3917
3918 /* we are down, close all open protocols */
3919 lcp.Close(sp);
3920
3921 /* And now prepare LCP to reestablish the link, if configured to do so. */
3922 sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
3923
3924 /* Close connection imediatly, completition of this
3925 * will summon the magic needed to reestablish it. */
3926 sp->pp_tlf(sp);
3927 continue;
3928 }
3929 }
3930 if (sp->pp_alivecnt < MAXALIVECNT)
3931 ++sp->pp_alivecnt;
3932 if (sp->pp_flags & PP_CISCO)
3933 sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
3934 sp->pp_rseq);
3935 else if (sp->pp_phase >= PHASE_AUTHENTICATE) {
3936 unsigned long nmagic = htonl (sp->lcp.magic);
3937 sp->lcp.echoid = ++sp->pp_seq;
3938 sppp_cp_send (sp, PPP_LCP, ECHO_REQ,
3939 sp->lcp.echoid, 4, &nmagic);
3940 }
3941 }
3942 splx(s);
3943 #if defined (__FreeBSD__)
3944 keepalive_ch = timeout(sppp_keepalive, 0, hz * 10);
3945 #endif
3946 #if defined (__OpenBSD__)
3947 timeout_add(&keepalive_ch, hz * 10);
3948 #endif
3949 }
3950
3951 /*
3952 * Get both IP addresses.
3953 */
3954 HIDE void
sppp_get_ip_addrs(struct sppp * sp,u_long * src,u_long * dst,u_long * srcmask)3955 sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask)
3956 {
3957 struct ifnet *ifp = &sp->pp_if;
3958 struct ifaddr *ifa;
3959 struct sockaddr_in *si, *sm = 0;
3960 u_long ssrc, ddst;
3961
3962 sm = NULL;
3963 ssrc = ddst = 0L;
3964 /*
3965 * Pick the first AF_INET address from the list,
3966 * aliases don't make any sense on a p2p link anyway.
3967 */
3968 #if defined (__FreeBSD__)
3969 for (ifa = ifp->if_addrhead.tqh_first, si = 0;
3970 ifa;
3971 ifa = ifa->ifa_link.tqe_next)
3972 #else
3973 si = 0;
3974 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
3975 #endif
3976 {
3977 if (ifa->ifa_addr->sa_family == AF_INET) {
3978 si = (struct sockaddr_in *)ifa->ifa_addr;
3979 sm = (struct sockaddr_in *)ifa->ifa_netmask;
3980 if (si)
3981 break;
3982 }
3983 }
3984 if (ifa) {
3985 if (si && si->sin_addr.s_addr) {
3986 ssrc = si->sin_addr.s_addr;
3987 if (srcmask)
3988 *srcmask = ntohl(sm->sin_addr.s_addr);
3989 }
3990
3991 si = (struct sockaddr_in *)ifa->ifa_dstaddr;
3992 if (si && si->sin_addr.s_addr)
3993 ddst = si->sin_addr.s_addr;
3994 }
3995
3996 if (dst) *dst = ntohl(ddst);
3997 if (src) *src = ntohl(ssrc);
3998 }
3999
4000 /*
4001 * Set my IP address. Must be called at splimp.
4002 */
4003 HIDE void
sppp_set_ip_addr(struct sppp * sp,u_long src)4004 sppp_set_ip_addr(struct sppp *sp, u_long src)
4005 {
4006 struct ifnet *ifp = &sp->pp_if;
4007 struct ifaddr *ifa;
4008 struct sockaddr_in *si;
4009
4010 /*
4011 * Pick the first AF_INET address from the list,
4012 * aliases don't make any sense on a p2p link anyway.
4013 */
4014
4015 #if defined (__FreeBSD__)
4016 for (ifa = ifp->if_addrhead.tqh_first, si = 0;
4017 ifa;
4018 ifa = ifa->ifa_link.tqe_next)
4019 #else
4020 si = 0;
4021 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
4022 #endif
4023 {
4024 if (ifa->ifa_addr->sa_family == AF_INET)
4025 {
4026 si = (struct sockaddr_in *)ifa->ifa_addr;
4027 if (si)
4028 break;
4029 }
4030 }
4031
4032 if (ifa && si) {
4033 int error, debug = ifp->if_flags & IFF_DEBUG;
4034 si->sin_addr.s_addr = htonl(src);
4035 dohooks(ifp->if_addrhooks, 0);
4036 error = in_ifinit(ifp, ifatoia(ifa), si, 1);
4037 if (debug && error){
4038 log(LOG_DEBUG, SPP_FMT "sppp_set_ip_addrs: in_ifinit "
4039 "failed, error=%d\n", SPP_ARGS(ifp), error);
4040 }
4041 }
4042 }
4043
4044 HIDE int
sppp_params(struct sppp * sp,u_long cmd,void * data)4045 sppp_params(struct sppp *sp, u_long cmd, void *data)
4046 {
4047 struct ifreq *ifr = (struct ifreq *)data;
4048 struct spppreq spr;
4049
4050 if (copyin((caddr_t)ifr->ifr_data, &spr, sizeof spr) != 0)
4051 return EFAULT;
4052
4053 switch (spr.cmd) {
4054 case (int)SPPPIOGDEFS:
4055 if (cmd != SIOCGIFGENERIC)
4056 return EINVAL;
4057 /*
4058 * We copy over the entire current state, but clean
4059 * out some of the stuff we don't wanna pass up.
4060 * Remember, SIOCGIFGENERIC is unprotected, and can be
4061 * called by any user. No need to ever get PAP or
4062 * CHAP secrets back to userland anyway.
4063 */
4064 bcopy(sp, &spr.defs, sizeof(struct sppp));
4065 bzero(spr.defs.myauth.secret, AUTHKEYLEN);
4066 bzero(spr.defs.myauth.challenge, AUTHKEYLEN);
4067 bzero(spr.defs.hisauth.secret, AUTHKEYLEN);
4068 bzero(spr.defs.hisauth.challenge, AUTHKEYLEN);
4069 return copyout(&spr, (caddr_t)ifr->ifr_data, sizeof spr);
4070
4071 case (int)SPPPIOSDEFS:
4072 if (cmd != SIOCSIFGENERIC)
4073 return EINVAL;
4074 /*
4075 * We have a very specific idea of which fields we allow
4076 * being passed back from userland, so to not clobber our
4077 * current state. For one, we only allow setting
4078 * anything if LCP is in dead phase. Once the LCP
4079 * negotiations started, the authentication settings must
4080 * not be changed again. (The administrator can force an
4081 * ifconfig down in order to get LCP back into dead
4082 * phase.)
4083 *
4084 * Also, we only allow for authentication parameters to be
4085 * specified.
4086 *
4087 * XXX Should allow to set or clear pp_flags.
4088 *
4089 * Finally, if the respective authentication protocol to
4090 * be used is set differently than 0, but the secret is
4091 * passed as all zeros, we don't trash the existing secret.
4092 * This allows an administrator to change the system name
4093 * only without clobbering the secret (which he didn't get
4094 * back in a previous SPPPIOGDEFS call). However, the
4095 * secrets are cleared if the authentication protocol is
4096 * reset to 0.
4097 */
4098 if (sp->pp_phase != PHASE_DEAD)
4099 return EBUSY;
4100
4101 if ((spr.defs.myauth.proto != 0 && spr.defs.myauth.proto != PPP_PAP &&
4102 spr.defs.myauth.proto != PPP_CHAP) ||
4103 (spr.defs.hisauth.proto != 0 && spr.defs.hisauth.proto != PPP_PAP &&
4104 spr.defs.hisauth.proto != PPP_CHAP))
4105 return EINVAL;
4106
4107 if (spr.defs.myauth.proto == 0)
4108 /* resetting myauth */
4109 bzero(&sp->myauth, sizeof sp->myauth);
4110 else {
4111 /* setting/changing myauth */
4112 sp->myauth.proto = spr.defs.myauth.proto;
4113 bcopy(spr.defs.myauth.name, sp->myauth.name, AUTHNAMELEN);
4114 if (spr.defs.myauth.secret[0] != '\0')
4115 bcopy(spr.defs.myauth.secret, sp->myauth.secret,
4116 AUTHKEYLEN);
4117 }
4118 if (spr.defs.hisauth.proto == 0)
4119 /* resetting hisauth */
4120 bzero(&sp->hisauth, sizeof sp->hisauth);
4121 else {
4122 /* setting/changing hisauth */
4123 sp->hisauth.proto = spr.defs.hisauth.proto;
4124 sp->hisauth.flags = spr.defs.hisauth.flags;
4125 bcopy(spr.defs.hisauth.name, sp->hisauth.name, AUTHNAMELEN);
4126 if (spr.defs.hisauth.secret[0] != '\0')
4127 bcopy(spr.defs.hisauth.secret, sp->hisauth.secret,
4128 AUTHKEYLEN);
4129 }
4130 break;
4131
4132 default:
4133 return EINVAL;
4134 }
4135
4136 return 0;
4137 }
4138
4139 HIDE void
sppp_phase_network(struct sppp * sp)4140 sppp_phase_network(struct sppp *sp)
4141 {
4142 struct ifnet *ifp = &sp->pp_if;
4143 int i;
4144 u_long mask;
4145
4146 sp->pp_phase = PHASE_NETWORK;
4147
4148 log(LOG_INFO, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
4149 sppp_phase_name(sp->pp_phase));
4150
4151 /* Notify NCPs now. */
4152 for (i = 0; i < IDX_COUNT; i++)
4153 if ((cps[i])->flags & CP_NCP)
4154 (cps[i])->Open(sp);
4155
4156 /* Send Up events to all NCPs. */
4157 for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
4158 if (sp->lcp.protos & mask && ((cps[i])->flags & CP_NCP))
4159 (cps[i])->Up(sp);
4160
4161 /* if no NCP is starting, all this was in vain, close down */
4162 sppp_lcp_check_and_close(sp);
4163 }
4164
4165
4166 HIDE const char *
sppp_cp_type_name(u_char type)4167 sppp_cp_type_name(u_char type)
4168 {
4169 static char buf[12];
4170 switch (type) {
4171 case CONF_REQ: return "conf-req";
4172 case CONF_ACK: return "conf-ack";
4173 case CONF_NAK: return "conf-nak";
4174 case CONF_REJ: return "conf-rej";
4175 case TERM_REQ: return "term-req";
4176 case TERM_ACK: return "term-ack";
4177 case CODE_REJ: return "code-rej";
4178 case PROTO_REJ: return "proto-rej";
4179 case ECHO_REQ: return "echo-req";
4180 case ECHO_REPLY: return "echo-reply";
4181 case DISC_REQ: return "discard-req";
4182 }
4183 snprintf (buf, sizeof buf, "0x%x", type);
4184 return buf;
4185 }
4186
4187 HIDE const char *
sppp_auth_type_name(u_short proto,u_char type)4188 sppp_auth_type_name(u_short proto, u_char type)
4189 {
4190 static char buf[12];
4191 switch (proto) {
4192 case PPP_CHAP:
4193 switch (type) {
4194 case CHAP_CHALLENGE: return "challenge";
4195 case CHAP_RESPONSE: return "response";
4196 case CHAP_SUCCESS: return "success";
4197 case CHAP_FAILURE: return "failure";
4198 }
4199 case PPP_PAP:
4200 switch (type) {
4201 case PAP_REQ: return "req";
4202 case PAP_ACK: return "ack";
4203 case PAP_NAK: return "nak";
4204 }
4205 }
4206 snprintf (buf, sizeof buf, "0x%x", type);
4207 return buf;
4208 }
4209
4210 HIDE const char *
sppp_lcp_opt_name(u_char opt)4211 sppp_lcp_opt_name(u_char opt)
4212 {
4213 static char buf[12];
4214 switch (opt) {
4215 case LCP_OPT_MRU: return "mru";
4216 case LCP_OPT_ASYNC_MAP: return "async-map";
4217 case LCP_OPT_AUTH_PROTO: return "auth-proto";
4218 case LCP_OPT_QUAL_PROTO: return "qual-proto";
4219 case LCP_OPT_MAGIC: return "magic";
4220 case LCP_OPT_PROTO_COMP: return "proto-comp";
4221 case LCP_OPT_ADDR_COMP: return "addr-comp";
4222 }
4223 snprintf (buf, sizeof buf, "0x%x", opt);
4224 return buf;
4225 }
4226
4227 HIDE const char *
sppp_ipcp_opt_name(u_char opt)4228 sppp_ipcp_opt_name(u_char opt)
4229 {
4230 static char buf[12];
4231 switch (opt) {
4232 case IPCP_OPT_ADDRESSES: return "addresses";
4233 case IPCP_OPT_COMPRESSION: return "compression";
4234 case IPCP_OPT_ADDRESS: return "address";
4235 }
4236 snprintf (buf, sizeof buf, "0x%x", opt);
4237 return buf;
4238 }
4239
4240 HIDE const char *
sppp_state_name(int state)4241 sppp_state_name(int state)
4242 {
4243 switch (state) {
4244 case STATE_INITIAL: return "initial";
4245 case STATE_STARTING: return "starting";
4246 case STATE_CLOSED: return "closed";
4247 case STATE_STOPPED: return "stopped";
4248 case STATE_CLOSING: return "closing";
4249 case STATE_STOPPING: return "stopping";
4250 case STATE_REQ_SENT: return "req-sent";
4251 case STATE_ACK_RCVD: return "ack-rcvd";
4252 case STATE_ACK_SENT: return "ack-sent";
4253 case STATE_OPENED: return "opened";
4254 }
4255 return "illegal";
4256 }
4257
4258 HIDE const char *
sppp_phase_name(enum ppp_phase phase)4259 sppp_phase_name(enum ppp_phase phase)
4260 {
4261 switch (phase) {
4262 case PHASE_DEAD: return "dead";
4263 case PHASE_ESTABLISH: return "establish";
4264 case PHASE_TERMINATE: return "terminate";
4265 case PHASE_AUTHENTICATE: return "authenticate";
4266 case PHASE_NETWORK: return "network";
4267 }
4268 return "illegal";
4269 }
4270
4271 HIDE const char *
sppp_proto_name(u_short proto)4272 sppp_proto_name(u_short proto)
4273 {
4274 static char buf[12];
4275 switch (proto) {
4276 case PPP_LCP: return "lcp";
4277 case PPP_IPCP: return "ipcp";
4278 case PPP_PAP: return "pap";
4279 case PPP_CHAP: return "chap";
4280 }
4281 snprintf(buf, sizeof buf, "0x%x", (unsigned)proto);
4282 return buf;
4283 }
4284
4285 HIDE void
sppp_print_bytes(const u_char * p,u_short len)4286 sppp_print_bytes(const u_char *p, u_short len)
4287 {
4288 addlog(" %02x", *p++);
4289 while (--len > 0)
4290 addlog("-%02x", *p++);
4291 }
4292
4293 HIDE void
sppp_print_string(const char * p,u_short len)4294 sppp_print_string(const char *p, u_short len)
4295 {
4296 u_char c;
4297
4298 while (len-- > 0) {
4299 c = *p++;
4300 /*
4301 * Print only ASCII chars directly. RFC 1994 recommends
4302 * using only them, but we don't rely on it. */
4303 if (c < ' ' || c > '~')
4304 addlog("\\x%x", c);
4305 else
4306 addlog("%c", c);
4307 }
4308 }
4309
4310 HIDE const char *
sppp_dotted_quad(u_long addr)4311 sppp_dotted_quad(u_long addr)
4312 {
4313 static char s[16];
4314 snprintf(s, sizeof s, "%d.%d.%d.%d",
4315 (int)((addr >> 24) & 0xff),
4316 (int)((addr >> 16) & 0xff),
4317 (int)((addr >> 8) & 0xff),
4318 (int)(addr & 0xff));
4319 return s;
4320 }
4321
4322 HIDE int
sppp_strnlen(u_char * p,int max)4323 sppp_strnlen(u_char *p, int max)
4324 {
4325 int len;
4326
4327 for (len = 0; len < max && *p; ++p)
4328 ++len;
4329 return len;
4330 }
4331
4332 /* a dummy, used to drop uninteresting events */
4333 HIDE void
sppp_null(struct sppp * unused)4334 sppp_null(struct sppp *unused)
4335 {
4336 /* do just nothing */
4337 }
4338 /*
4339 * This file is large. Tell emacs to highlight it nevertheless.
4340 *
4341 * Local Variables:
4342 * hilit-auto-highlight-maxout: 120000
4343 * End:
4344 */
4345