kernel: Add a number of missing crit_exit, lwkt_reltoken, rel_mplock, etc.
[dragonfly.git] / sys / net / sppp / if_spppsubr.c
1 /*
2  * Synchronous PPP/Cisco link level subroutines.
3  * Keepalive protocol implemented in both Cisco and PPP modes.
4  *
5  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
6  * Author: Serge Vakulenko, <vak@cronyx.ru>
7  *
8  * Heavily revamped to conform to RFC 1661.
9  * Copyright (C) 1997, 2001 Joerg Wunsch.
10  *
11  * This software is distributed with NO WARRANTIES, not even the implied
12  * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13  *
14  * Authors grant any other persons or organisations permission to use
15  * or modify this software as long as this message is kept with the software,
16  * all derivative works or modified versions.
17  *
18  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
19  *
20  * $FreeBSD: src/sys/net/if_spppsubr.c,v 1.59.2.13 2002/07/03 15:44:41 joerg Exp $
21  */
22
23 #include <sys/param.h>
24 #include <sys/libkern.h>
25
26 #include "opt_inet.h"
27 #include "opt_inet6.h"
28
29 #include <sys/systm.h>
30 #include <sys/kernel.h>
31 #include <sys/module.h>
32 #include <sys/sockio.h>
33 #include <sys/socket.h>
34 #include <sys/syslog.h>
35 #include <sys/random.h>
36 #include <sys/thread2.h>
37 #include <sys/malloc.h>
38 #include <sys/mbuf.h>
39 #include <sys/md5.h>
40
41 #include <net/if.h>
42 #include <net/ifq_var.h>
43 #include <net/netisr.h>
44 #include <net/if_types.h>
45 #include <net/route.h>
46 #include <netinet/in.h>
47 #include <netinet/in_systm.h>
48 #include <netinet/ip.h>
49 #include <net/slcompress.h>
50
51 #include <machine/stdarg.h>
52
53 #include <netinet/in_var.h>
54
55 #ifdef INET
56 #include <netinet/tcp.h>
57 #endif
58
59 #include <netinet/if_ether.h>
60
61 #include "if_sppp.h"
62
63 #define IOCTL_CMD_T     u_long
64 #define MAXALIVECNT     3               /* max. alive packets */
65
66 /*
67  * Interface flags that can be set in an ifconfig command.
68  *
69  * Setting link0 will make the link passive, i.e. it will be marked
70  * as being administrative openable, but won't be opened to begin
71  * with.  Incoming calls will be answered, or subsequent calls with
72  * -link1 will cause the administrative open of the LCP layer.
73  *
74  * Setting link1 will cause the link to auto-dial only as packets
75  * arrive to be sent.
76  *
77  * Setting IFF_DEBUG will syslog the option negotiation and state
78  * transitions at level kern.debug.  Note: all logs consistently look
79  * like
80  *
81  *   <if-name><unit>: <proto-name> <additional info...>
82  *
83  * with <if-name><unit> being something like "bppp0", and <proto-name>
84  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
85  */
86
87 #define IFF_PASSIVE     IFF_LINK0       /* wait passively for connection */
88 #define IFF_AUTO        IFF_LINK1       /* auto-dial on output */
89 #define IFF_CISCO       IFF_LINK2       /* auto-dial on output */
90
91 #define PPP_ALLSTATIONS 0xff            /* All-Stations broadcast address */
92 #define PPP_UI          0x03            /* Unnumbered Information */
93 #define PPP_IP          0x0021          /* Internet Protocol */
94 #define PPP_ISO         0x0023          /* ISO OSI Protocol */
95 #define PPP_XNS         0x0025          /* Xerox NS Protocol */
96 #define PPP_VJ_COMP     0x002d          /* VJ compressed TCP/IP */
97 #define PPP_VJ_UCOMP    0x002f          /* VJ uncompressed TCP/IP */
98 #define PPP_IPV6        0x0057          /* Internet Protocol Version 6 */
99 #define PPP_LCP         0xc021          /* Link Control Protocol */
100 #define PPP_PAP         0xc023          /* Password Authentication Protocol */
101 #define PPP_CHAP        0xc223          /* Challenge-Handshake Auth Protocol */
102 #define PPP_IPCP        0x8021          /* Internet Protocol Control Protocol */
103 #define PPP_IPV6CP      0x8057          /* IPv6 Control Protocol */
104
105 #define CONF_REQ        1               /* PPP configure request */
106 #define CONF_ACK        2               /* PPP configure acknowledge */
107 #define CONF_NAK        3               /* PPP configure negative ack */
108 #define CONF_REJ        4               /* PPP configure reject */
109 #define TERM_REQ        5               /* PPP terminate request */
110 #define TERM_ACK        6               /* PPP terminate acknowledge */
111 #define CODE_REJ        7               /* PPP code reject */
112 #define PROTO_REJ       8               /* PPP protocol reject */
113 #define ECHO_REQ        9               /* PPP echo request */
114 #define ECHO_REPLY      10              /* PPP echo reply */
115 #define DISC_REQ        11              /* PPP discard request */
116
117 #define LCP_OPT_MRU             1       /* maximum receive unit */
118 #define LCP_OPT_ASYNC_MAP       2       /* async control character map */
119 #define LCP_OPT_AUTH_PROTO      3       /* authentication protocol */
120 #define LCP_OPT_QUAL_PROTO      4       /* quality protocol */
121 #define LCP_OPT_MAGIC           5       /* magic number */
122 #define LCP_OPT_RESERVED        6       /* reserved */
123 #define LCP_OPT_PROTO_COMP      7       /* protocol field compression */
124 #define LCP_OPT_ADDR_COMP       8       /* address/control field compression */
125
126 #define IPCP_OPT_ADDRESSES      1       /* both IP addresses; deprecated */
127 #define IPCP_OPT_COMPRESSION    2       /* IP compression protocol (VJ) */
128 #define IPCP_OPT_ADDRESS        3       /* local IP address */
129
130 #define IPV6CP_OPT_IFID 1       /* interface identifier */
131 #define IPV6CP_OPT_COMPRESSION  2       /* IPv6 compression protocol */
132
133 #define IPCP_COMP_VJ            0x2d    /* Code for VJ compression */
134
135 #define PAP_REQ                 1       /* PAP name/password request */
136 #define PAP_ACK                 2       /* PAP acknowledge */
137 #define PAP_NAK                 3       /* PAP fail */
138
139 #define CHAP_CHALLENGE          1       /* CHAP challenge request */
140 #define CHAP_RESPONSE           2       /* CHAP challenge response */
141 #define CHAP_SUCCESS            3       /* CHAP response ok */
142 #define CHAP_FAILURE            4       /* CHAP response failed */
143
144 #define CHAP_MD5                5       /* hash algorithm - MD5 */
145
146 #define CISCO_MULTICAST         0x8f    /* Cisco multicast address */
147 #define CISCO_UNICAST           0x0f    /* Cisco unicast address */
148 #define CISCO_KEEPALIVE         0x8035  /* Cisco keepalive protocol */
149 #define CISCO_ADDR_REQ          0       /* Cisco address request */
150 #define CISCO_ADDR_REPLY        1       /* Cisco address reply */
151 #define CISCO_KEEPALIVE_REQ     2       /* Cisco keepalive request */
152
153 /* states are named and numbered according to RFC 1661 */
154 #define STATE_INITIAL   0
155 #define STATE_STARTING  1
156 #define STATE_CLOSED    2
157 #define STATE_STOPPED   3
158 #define STATE_CLOSING   4
159 #define STATE_STOPPING  5
160 #define STATE_REQ_SENT  6
161 #define STATE_ACK_RCVD  7
162 #define STATE_ACK_SENT  8
163 #define STATE_OPENED    9
164
165 struct ppp_header {
166         u_char address;
167         u_char control;
168         u_short protocol;
169 } __attribute__((__packed__));
170 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
171
172 struct lcp_header {
173         u_char type;
174         u_char ident;
175         u_short len;
176 } __attribute__((__packed__));
177 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
178
179 struct cisco_packet {
180         u_long type;
181         u_long par1;
182         u_long par2;
183         u_short rel;
184         u_short time0;
185         u_short time1;
186 } __attribute__((__packed__));
187 #define CISCO_PACKET_LEN        sizeof (struct cisco_packet)
188
189 /*
190  * We follow the spelling and capitalization of RFC 1661 here, to make
191  * it easier comparing with the standard.  Please refer to this RFC in
192  * case you can't make sense out of these abbreviation; it will also
193  * explain the semantics related to the various events and actions.
194  */
195 struct cp {
196         u_short proto;          /* PPP control protocol number */
197         u_char protoidx;        /* index into state table in struct sppp */
198         u_char flags;
199 #define CP_LCP          0x01    /* this is the LCP */
200 #define CP_AUTH         0x02    /* this is an authentication protocol */
201 #define CP_NCP          0x04    /* this is a NCP */
202 #define CP_QUAL         0x08    /* this is a quality reporting protocol */
203         const char *name;       /* name of this control protocol */
204         /* event handlers */
205         void    (*Up)(struct sppp *sp);
206         void    (*Down)(struct sppp *sp);
207         void    (*Open)(struct sppp *sp);
208         void    (*Close)(struct sppp *sp);
209         void    (*TO)(void *sp);
210         int     (*RCR)(struct sppp *sp, struct lcp_header *h, int len);
211         void    (*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
212         void    (*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
213         /* actions */
214         void    (*tlu)(struct sppp *sp);
215         void    (*tld)(struct sppp *sp);
216         void    (*tls)(struct sppp *sp);
217         void    (*tlf)(struct sppp *sp);
218         void    (*scr)(struct sppp *sp);
219 };
220
221 static struct sppp *spppq;
222 static struct callout keepalive_timeout;
223
224 #define SPP_FMT         "%s: "
225 #define SPP_ARGS(ifp)   (ifp)->if_xname
226
227 #ifdef INET
228 /*
229  * The following disgusting hack gets around the problem that IP TOS
230  * can't be set yet.  We want to put "interactive" traffic on a high
231  * priority queue.  To decide if traffic is interactive, we check that
232  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
233  *
234  * XXX is this really still necessary?  - joerg -
235  */
236 static u_short interactive_ports[8] = {
237         0,      513,    0,      0,
238         0,      21,     0,      23,
239 };
240 #define INTERACTIVE(p) (interactive_ports[(p) & 7] == (p))
241 #endif
242
243 /* almost every function needs these */
244 #define STDDCL                                                  \
245         struct ifnet *ifp = &sp->pp_if;                         \
246         int debug = ifp->if_flags & IFF_DEBUG
247
248 static int sppp_output(struct ifnet *ifp, struct mbuf *m,
249                        struct sockaddr *dst, struct rtentry *rt);
250
251 static void sppp_cisco_send(struct sppp *sp, int type, long par1, long par2);
252 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
253
254 static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
255                           struct mbuf *m);
256 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
257                          u_char ident, u_short len, void *data);
258 /* static void sppp_cp_timeout(void *arg); */
259 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
260                                  int newstate);
261 static void sppp_auth_send(const struct cp *cp,
262                            struct sppp *sp, unsigned int type, unsigned int id,
263                            ...);
264
265 static void sppp_up_event(const struct cp *cp, struct sppp *sp);
266 static void sppp_down_event(const struct cp *cp, struct sppp *sp);
267 static void sppp_open_event(const struct cp *cp, struct sppp *sp);
268 static void sppp_close_event(const struct cp *cp, struct sppp *sp);
269 static void sppp_to_event(const struct cp *cp, struct sppp *sp);
270
271 static void sppp_null(struct sppp *sp);
272
273 static void sppp_lcp_init(struct sppp *sp);
274 static void sppp_lcp_up(struct sppp *sp);
275 static void sppp_lcp_down(struct sppp *sp);
276 static void sppp_lcp_open(struct sppp *sp);
277 static void sppp_lcp_close(struct sppp *sp);
278 static void sppp_lcp_TO(void *sp);
279 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
280 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
281 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
282 static void sppp_lcp_tlu(struct sppp *sp);
283 static void sppp_lcp_tld(struct sppp *sp);
284 static void sppp_lcp_tls(struct sppp *sp);
285 static void sppp_lcp_tlf(struct sppp *sp);
286 static void sppp_lcp_scr(struct sppp *sp);
287 static void sppp_lcp_check_and_close(struct sppp *sp);
288 static int sppp_ncp_check(struct sppp *sp);
289
290 static void sppp_ipcp_init(struct sppp *sp);
291 static void sppp_ipcp_up(struct sppp *sp);
292 static void sppp_ipcp_down(struct sppp *sp);
293 static void sppp_ipcp_open(struct sppp *sp);
294 static void sppp_ipcp_close(struct sppp *sp);
295 static void sppp_ipcp_TO(void *sp);
296 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
297 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
298 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
299 static void sppp_ipcp_tlu(struct sppp *sp);
300 static void sppp_ipcp_tld(struct sppp *sp);
301 static void sppp_ipcp_tls(struct sppp *sp);
302 static void sppp_ipcp_tlf(struct sppp *sp);
303 static void sppp_ipcp_scr(struct sppp *sp);
304
305 static void sppp_ipv6cp_init(struct sppp *sp);
306 static void sppp_ipv6cp_up(struct sppp *sp);
307 static void sppp_ipv6cp_down(struct sppp *sp);
308 static void sppp_ipv6cp_open(struct sppp *sp);
309 static void sppp_ipv6cp_close(struct sppp *sp);
310 static void sppp_ipv6cp_TO(void *sp);
311 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
312 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
313 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
314 static void sppp_ipv6cp_tlu(struct sppp *sp);
315 static void sppp_ipv6cp_tld(struct sppp *sp);
316 static void sppp_ipv6cp_tls(struct sppp *sp);
317 static void sppp_ipv6cp_tlf(struct sppp *sp);
318 static void sppp_ipv6cp_scr(struct sppp *sp);
319
320 static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
321 static void sppp_pap_init(struct sppp *sp);
322 static void sppp_pap_open(struct sppp *sp);
323 static void sppp_pap_close(struct sppp *sp);
324 static void sppp_pap_TO(void *sp);
325 static void sppp_pap_my_TO(void *sp);
326 static void sppp_pap_tlu(struct sppp *sp);
327 static void sppp_pap_tld(struct sppp *sp);
328 static void sppp_pap_scr(struct sppp *sp);
329
330 static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
331 static void sppp_chap_init(struct sppp *sp);
332 static void sppp_chap_open(struct sppp *sp);
333 static void sppp_chap_close(struct sppp *sp);
334 static void sppp_chap_TO(void *sp);
335 static void sppp_chap_tlu(struct sppp *sp);
336 static void sppp_chap_tld(struct sppp *sp);
337 static void sppp_chap_scr(struct sppp *sp);
338
339 static const char *sppp_auth_type_name(u_short proto, u_char type);
340 static const char *sppp_cp_type_name(u_char type);
341 static const char *sppp_dotted_quad(u_long addr);
342 static const char *sppp_ipcp_opt_name(u_char opt);
343 #ifdef INET6
344 static const char *sppp_ipv6cp_opt_name(u_char opt);
345 #endif
346 static const char *sppp_lcp_opt_name(u_char opt);
347 static const char *sppp_phase_name(enum ppp_phase phase);
348 static const char *sppp_proto_name(u_short proto);
349 static const char *sppp_state_name(int state);
350 static int sppp_params(struct sppp *sp, u_long cmd, void *data);
351 static int sppp_strnlen(u_char *p, int max);
352 static void sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst,
353                               u_long *srcmask);
354 static void sppp_keepalive(void *dummy);
355 static void sppp_phase_network(struct sppp *sp);
356 static void sppp_print_bytes(const u_char *p, u_short len);
357 static void sppp_print_string(const char *p, u_short len);
358 static void sppp_set_ip_addr(struct sppp *sp, u_long src);
359 #ifdef INET6
360 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
361                                struct in6_addr *dst, struct in6_addr *srcmask);
362 #ifdef IPV6CP_MYIFID_DYN
363 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
364 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
365 #endif
366 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
367 #endif
368
369 /* our control protocol descriptors */
370 static const struct cp lcp = {
371         PPP_LCP, IDX_LCP, CP_LCP, "lcp",
372         sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
373         sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
374         sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
375         sppp_lcp_scr
376 };
377
378 static const struct cp ipcp = {
379         PPP_IPCP, IDX_IPCP, CP_NCP, "ipcp",
380         sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
381         sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
382         sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
383         sppp_ipcp_scr
384 };
385
386 static const struct cp ipv6cp = {
387         PPP_IPV6CP, IDX_IPV6CP,
388 #ifdef INET6    /*don't run IPv6CP if there's no IPv6 support*/
389         CP_NCP,
390 #else
391         0,
392 #endif
393         "ipv6cp",
394         sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
395         sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
396         sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
397         sppp_ipv6cp_scr
398 };
399
400 static const struct cp pap = {
401         PPP_PAP, IDX_PAP, CP_AUTH, "pap",
402         sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
403         sppp_pap_TO, 0, 0, 0,
404         sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
405         sppp_pap_scr
406 };
407
408 static const struct cp chap = {
409         PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
410         sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
411         sppp_chap_TO, 0, 0, 0,
412         sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
413         sppp_chap_scr
414 };
415
416 static const struct cp *cps[IDX_COUNT] = {
417         &lcp,                   /* IDX_LCP */
418         &ipcp,                  /* IDX_IPCP */
419         &ipv6cp,                /* IDX_IPV6CP */
420         &pap,                   /* IDX_PAP */
421         &chap,                  /* IDX_CHAP */
422 };
423
424 static int
425 sppp_modevent(module_t mod, int type, void *unused)
426 {
427         switch (type) {
428         case MOD_LOAD:
429                 callout_init(&keepalive_timeout);
430                 break;
431         case MOD_UNLOAD:
432                 return EACCES;
433                 break;
434         default:
435                 break;
436         }
437         return 0;
438 }
439 static moduledata_t spppmod = {
440         "sppp",
441         sppp_modevent,
442         0
443 };
444 MODULE_VERSION(sppp, 1);
445 DECLARE_MODULE(sppp, spppmod, SI_SUB_DRIVERS, SI_ORDER_ANY);
446
447 /*
448  * Exported functions, comprising our interface to the lower layer.
449  */
450
451 /*
452  * Process the received packet.
453  */
454 void
455 sppp_input(struct ifnet *ifp, struct mbuf *m)
456 {
457         struct ppp_header *h;
458         int isr = -1;
459         struct sppp *sp = (struct sppp *)ifp;
460         u_char *iphdr;
461         int hlen, vjlen, do_account = 0;
462         int debug = ifp->if_flags & IFF_DEBUG;
463
464         if (ifp->if_flags & IFF_UP)
465                 /* Count received bytes, add FCS and one flag */
466                 IFNET_STAT_INC(ifp, ibytes, m->m_pkthdr.len + 3);
467
468         if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
469                 /* Too small packet, drop it. */
470                 if (debug)
471                         log(LOG_DEBUG,
472                             SPP_FMT "input packet is too small, %d bytes\n",
473                             SPP_ARGS(ifp), m->m_pkthdr.len);
474 drop:
475                 m_freem (m);
476 drop2:
477                 IFNET_STAT_INC(ifp, ierrors, 1);
478                 IFNET_STAT_INC(ifp, iqdrops, 1);
479                 return;
480         }
481
482         /* Get PPP header. */
483         h = mtod (m, struct ppp_header*);
484         m_adj (m, PPP_HEADER_LEN);
485
486         switch (h->address) {
487         case PPP_ALLSTATIONS:
488                 if (h->control != PPP_UI)
489                         goto invalid;
490                 if (sp->pp_mode == IFF_CISCO) {
491                         if (debug)
492                                 log(LOG_DEBUG,
493                                     SPP_FMT "PPP packet in Cisco mode "
494                                     "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
495                                     SPP_ARGS(ifp),
496                                     h->address, h->control, ntohs(h->protocol));
497                         goto drop;
498                 }
499                 switch (ntohs (h->protocol)) {
500                 default:
501                         if (debug)
502                                 log(LOG_DEBUG,
503                                     SPP_FMT "rejecting protocol "
504                                     "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
505                                     SPP_ARGS(ifp),
506                                     h->address, h->control, ntohs(h->protocol));
507                         if (sp->state[IDX_LCP] == STATE_OPENED)
508                                 sppp_cp_send (sp, PPP_LCP, PROTO_REJ,
509                                         ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
510                                         &h->protocol);
511                         IFNET_STAT_INC(ifp, noproto, 1);
512                         goto drop;
513                 case PPP_LCP:
514                         sppp_cp_input(&lcp, sp, m);
515                         m_freem (m);
516                         return;
517                 case PPP_PAP:
518                         if (sp->pp_phase >= PHASE_AUTHENTICATE)
519                                 sppp_pap_input(sp, m);
520                         m_freem (m);
521                         return;
522                 case PPP_CHAP:
523                         if (sp->pp_phase >= PHASE_AUTHENTICATE)
524                                 sppp_chap_input(sp, m);
525                         m_freem (m);
526                         return;
527 #ifdef INET
528                 case PPP_IPCP:
529                         if (sp->pp_phase == PHASE_NETWORK)
530                                 sppp_cp_input(&ipcp, sp, m);
531                         m_freem (m);
532                         return;
533                 case PPP_IP:
534                         if (sp->state[IDX_IPCP] == STATE_OPENED) {
535                                 isr = NETISR_IP;
536                         }
537                         do_account++;
538                         break;
539                 case PPP_VJ_COMP:
540                         if (sp->state[IDX_IPCP] == STATE_OPENED) {
541                                 if ((vjlen =
542                                      sl_uncompress_tcp_core(mtod(m, u_char *),
543                                                             m->m_len, m->m_len,
544                                                             TYPE_COMPRESSED_TCP,
545                                                             sp->pp_comp,
546                                                             &iphdr, &hlen)) <= 0) {
547                                         if (debug)
548                                                 log(LOG_INFO,
549                             SPP_FMT "VJ uncompress failed on compressed packet\n",
550                                                     SPP_ARGS(ifp));
551                                         goto drop;
552                                 }
553
554                                 /*
555                                  * Trim the VJ header off the packet, and prepend
556                                  * the uncompressed IP header (which will usually
557                                  * end up in two chained mbufs since there's not
558                                  * enough leading space in the existing mbuf).
559                                  */
560                                 m_adj(m, vjlen);
561                                 M_PREPEND(m, hlen, MB_DONTWAIT);
562                                 if (m == NULL)
563                                         goto drop2;
564                                 bcopy(iphdr, mtod(m, u_char *), hlen);
565
566                                 isr = NETISR_IP;
567                         }
568                         do_account++;
569                         break;
570                 case PPP_VJ_UCOMP:
571                         if (sp->state[IDX_IPCP] == STATE_OPENED) {
572                                 if (sl_uncompress_tcp_core(mtod(m, u_char *),
573                                                            m->m_len, m->m_len,
574                                                            TYPE_UNCOMPRESSED_TCP,
575                                                            sp->pp_comp,
576                                                            &iphdr, &hlen) != 0) {
577                                         if (debug)
578                                                 log(LOG_INFO,
579                             SPP_FMT "VJ uncompress failed on uncompressed packet\n",
580                                                     SPP_ARGS(ifp));
581                                         goto drop;
582                                 }
583                                 isr = NETISR_IP;
584                         }
585                         do_account++;
586                         break;
587 #endif
588 #ifdef INET6
589                 case PPP_IPV6CP:
590                         if (sp->pp_phase == PHASE_NETWORK)
591                             sppp_cp_input(&ipv6cp, sp, m);
592                         m_freem (m);
593                         return;
594
595                 case PPP_IPV6:
596                         if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
597                                 isr = NETISR_IPV6;
598                         }
599                         do_account++;
600                         break;
601 #endif
602                 }
603                 break;
604         case CISCO_MULTICAST:
605         case CISCO_UNICAST:
606                 /* Don't check the control field here (RFC 1547). */
607                 if (sp->pp_mode != IFF_CISCO) {
608                         if (debug)
609                                 log(LOG_DEBUG,
610                                     SPP_FMT "Cisco packet in PPP mode "
611                                     "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
612                                     SPP_ARGS(ifp),
613                                     h->address, h->control, ntohs(h->protocol));
614                         goto drop;
615                 }
616                 switch (ntohs (h->protocol)) {
617                 default:
618                         IFNET_STAT_INC(ifp, noproto, 1);
619                         goto invalid;
620                 case CISCO_KEEPALIVE:
621                         sppp_cisco_input ((struct sppp*) ifp, m);
622                         m_freem (m);
623                         return;
624 #ifdef INET
625                 case ETHERTYPE_IP:
626                         isr = NETISR_IP;
627                         do_account++;
628                         break;
629 #endif
630 #ifdef INET6
631                 case ETHERTYPE_IPV6:
632                         isr = NETISR_IPV6;
633                         do_account++;
634                         break;
635 #endif
636                 }
637                 break;
638         default:        /* Invalid PPP packet. */
639           invalid:
640                 if (debug)
641                         log(LOG_DEBUG,
642                             SPP_FMT "invalid input packet "
643                             "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
644                             SPP_ARGS(ifp),
645                             h->address, h->control, ntohs(h->protocol));
646                 goto drop;
647         }
648
649         if (! (ifp->if_flags & IFF_UP) || isr < 0)
650                 goto drop;
651
652         /* Check queue. */
653
654         netisr_queue(isr, m);
655
656         /*
657          * Do only account for network packets, not for control
658          * packets.  This is used by some subsystems to detect
659          * idle lines.
660          */
661         if (do_account)
662                 sp->pp_last_recv = time_uptime;
663 }
664
665 /*
666  * Enqueue transmit packet.
667  */
668 static int
669 sppp_output_serialized(struct ifnet *ifp, struct ifaltq_subque *ifsq,
670     struct mbuf *m, struct sockaddr *dst, struct rtentry *rt)
671 {
672         struct sppp *sp = (struct sppp*) ifp;
673         struct ppp_header *h;
674         struct ifqueue *ifq = NULL;
675         int rv = 0;
676         int ipproto = PPP_IP;
677         int debug = ifp->if_flags & IFF_DEBUG;
678         struct altq_pktattr pktattr;
679
680         crit_enter();
681
682         if ((ifp->if_flags & IFF_UP) == 0 ||
683             (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
684 #ifdef INET6
685           drop:
686 #endif
687                 m_freem (m);
688                 crit_exit();
689                 return (ENETDOWN);
690         }
691
692         if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
693 #ifdef INET6
694                 /*
695                  * XXX
696                  *
697                  * Hack to prevent the initialization-time generated
698                  * IPv6 multicast packet to erroneously cause a
699                  * dialout event in case IPv6 has been
700                  * administratively disabled on that interface.
701                  */
702                 if (dst->sa_family == AF_INET6 &&
703                     !(sp->confflags & CONF_ENABLE_IPV6))
704                         goto drop;
705 #endif
706                 /*
707                  * Interface is not yet running, but auto-dial.  Need
708                  * to start LCP for it.
709                  */
710                 ifp->if_flags |= IFF_RUNNING;
711                 crit_exit();
712                 lcp.Open(sp);
713                 crit_enter();
714         }
715
716         /*
717          * if the queueing discipline needs packet classification,
718          * do it before prepending link headers.
719          */
720         ifq_classify(&ifp->if_snd, m, dst->sa_family, &pktattr);
721
722 #ifdef INET
723         if (dst->sa_family == AF_INET) {
724                 /* XXX Check mbuf length here? */
725                 struct ip *ip = mtod (m, struct ip*);
726                 struct tcphdr *tcp = (struct tcphdr*) ((long*)ip + ip->ip_hl);
727
728                 /*
729                  * When using dynamic local IP address assignment by using
730                  * 0.0.0.0 as a local address, the first TCP session will
731                  * not connect because the local TCP checksum is computed
732                  * using 0.0.0.0 which will later become our real IP address
733                  * so the TCP checksum computed at the remote end will
734                  * become invalid. So we
735                  * - don't let packets with src ip addr 0 thru
736                  * - we flag TCP packets with src ip 0 as an error
737                  */
738
739                 if(ip->ip_src.s_addr == INADDR_ANY)     /* -hm */
740                 {
741                         m_freem(m);
742                         crit_exit();
743                         if(ip->ip_p == IPPROTO_TCP)
744                                 return(EADDRNOTAVAIL);
745                         else
746                                 return(0);
747                 }
748
749                 /*
750                  * Put low delay, telnet, rlogin and ftp control packets
751                  * in front of the queue.
752                  */
753                 if (IF_QFULL (&sp->pp_fastq))
754                         ;
755                 else if (ip->ip_tos & IPTOS_LOWDELAY)
756                         ifq = &sp->pp_fastq;
757                 else if (m->m_len < sizeof *ip + sizeof *tcp)
758                         ;
759                 else if (ip->ip_p != IPPROTO_TCP)
760                         ;
761                 else if (INTERACTIVE (ntohs (tcp->th_sport)))
762                         ifq = &sp->pp_fastq;
763                 else if (INTERACTIVE (ntohs (tcp->th_dport)))
764                         ifq = &sp->pp_fastq;
765
766                 /*
767                  * Do IP Header compression
768                  */
769                 if (sp->pp_mode != IFF_CISCO && (sp->ipcp.flags & IPCP_VJ) &&
770                     ip->ip_p == IPPROTO_TCP)
771                         switch (sl_compress_tcp(m, ip, sp->pp_comp,
772                                                 sp->ipcp.compress_cid)) {
773                         case TYPE_COMPRESSED_TCP:
774                                 ipproto = PPP_VJ_COMP;
775                                 break;
776                         case TYPE_UNCOMPRESSED_TCP:
777                                 ipproto = PPP_VJ_UCOMP;
778                                 break;
779                         case TYPE_IP:
780                                 ipproto = PPP_IP;
781                                 break;
782                         default:
783                                 m_freem(m);
784                                 crit_exit();
785                                 return (EINVAL);
786                         }
787         }
788 #endif
789
790 #ifdef INET6
791         if (dst->sa_family == AF_INET6) {
792                 /* XXX do something tricky here? */
793         }
794 #endif
795
796         /*
797          * Prepend general data packet PPP header. For now, IP only.
798          */
799         M_PREPEND (m, PPP_HEADER_LEN, MB_DONTWAIT);
800         if (! m) {
801                 if (debug)
802                         log(LOG_DEBUG, SPP_FMT "no memory for transmit header\n",
803                                 SPP_ARGS(ifp));
804                 IFNET_STAT_INC(ifp, oerrors, 1);
805                 crit_exit();
806                 return (ENOBUFS);
807         }
808         /*
809          * May want to check size of packet
810          * (albeit due to the implementation it's always enough)
811          */
812         h = mtod (m, struct ppp_header*);
813         if (sp->pp_mode == IFF_CISCO) {
814                 h->address = CISCO_UNICAST;        /* unicast address */
815                 h->control = 0;
816         } else {
817                 h->address = PPP_ALLSTATIONS;        /* broadcast address */
818                 h->control = PPP_UI;                 /* Unnumbered Info */
819         }
820
821         switch (dst->sa_family) {
822 #ifdef INET
823         case AF_INET:   /* Internet Protocol */
824                 if (sp->pp_mode == IFF_CISCO)
825                         h->protocol = htons (ETHERTYPE_IP);
826                 else {
827                         /*
828                          * Don't choke with an ENETDOWN early.  It's
829                          * possible that we just started dialing out,
830                          * so don't drop the packet immediately.  If
831                          * we notice that we run out of buffer space
832                          * below, we will however remember that we are
833                          * not ready to carry IP packets, and return
834                          * ENETDOWN, as opposed to ENOBUFS.
835                          */
836                         h->protocol = htons(ipproto);
837                         if (sp->state[IDX_IPCP] != STATE_OPENED)
838                                 rv = ENETDOWN;
839                 }
840                 break;
841 #endif
842 #ifdef INET6
843         case AF_INET6:   /* Internet Protocol */
844                 if (sp->pp_mode == IFF_CISCO)
845                         h->protocol = htons (ETHERTYPE_IPV6);
846                 else {
847                         /*
848                          * Don't choke with an ENETDOWN early.  It's
849                          * possible that we just started dialing out,
850                          * so don't drop the packet immediately.  If
851                          * we notice that we run out of buffer space
852                          * below, we will however remember that we are
853                          * not ready to carry IP packets, and return
854                          * ENETDOWN, as opposed to ENOBUFS.
855                          */
856                         h->protocol = htons(PPP_IPV6);
857                         if (sp->state[IDX_IPV6CP] != STATE_OPENED)
858                                 rv = ENETDOWN;
859                 }
860                 break;
861 #endif
862         default:
863                 m_freem (m);
864                 IFNET_STAT_INC(ifp, oerrors, 1);
865                 crit_exit();
866                 return (EAFNOSUPPORT);
867         }
868
869         /*
870          * Queue message on interface, and start output if interface
871          * not yet active.
872          */
873         if (ifq != NULL) {
874                 if (IF_QFULL(ifq)) {
875                         IF_DROP(ifq);
876                         m_freem(m);
877                         rv = ENOBUFS;
878                 } else {
879                         IF_ENQUEUE(ifq, m);
880                         rv = 0;
881                 }
882         } else {
883                 rv = ifsq_enqueue(ifsq, m, &pktattr);
884         }
885         if (rv) {
886                 IFNET_STAT_INC(ifp, oerrors, 1);
887                 crit_exit();
888                 return(rv);
889         }
890         if (!ifsq_is_oactive(ifsq))
891                 (*ifp->if_start) (ifp, ifsq);
892
893         /*
894          * Count output packets and bytes.
895          * The packet length includes header, FCS and 1 flag,
896          * according to RFC 1333.
897          */
898         IFNET_STAT_INC(ifp, obytes, m->m_pkthdr.len + 3);
899
900         /*
901          * Unlike in sppp_input(), we can always bump the timestamp
902          * here since sppp_output() is only called on behalf of
903          * network-layer traffic; control-layer traffic is handled
904          * by sppp_cp_send().
905          */
906         sp->pp_last_sent = time_uptime;
907
908         crit_exit();
909         return (0);
910 }
911
912 static int
913 sppp_output(struct ifnet *ifp, struct mbuf *m,
914             struct sockaddr *dst, struct rtentry *rt)
915 {
916         struct ifaltq_subque *ifsq = ifq_get_subq_default(&ifp->if_snd);
917         int error;
918
919         ifsq_serialize_hw(ifsq);
920         error = sppp_output_serialized(ifp, ifsq, m, dst, rt);
921         ifsq_deserialize_hw(ifsq);
922
923         return error;
924 }
925
926 void
927 sppp_attach(struct ifnet *ifp)
928 {
929         struct sppp *sp = (struct sppp*) ifp;
930
931         /* Initialize keepalive handler. */
932         if (!spppq) {
933                 callout_reset(&keepalive_timeout, hz * 10,
934                                 sppp_keepalive, NULL);
935         }
936         /* Insert new entry into the keepalive list. */
937         sp->pp_next = spppq;
938         spppq = sp;
939
940         sp->pp_if.if_mtu = PP_MTU;
941         sp->pp_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
942         sp->pp_if.if_type = IFT_PPP;
943         sp->pp_if.if_output = sppp_output;
944 #if 0
945         sp->pp_flags = PP_KEEPALIVE;
946 #endif
947         ifq_set_maxlen(&sp->pp_if.if_snd, 32);
948         sp->pp_fastq.ifq_maxlen = 32;
949         sp->pp_cpq.ifq_maxlen = 20;
950         sp->pp_loopcnt = 0;
951         sp->pp_alivecnt = 0;
952         bzero(&sp->pp_seq[0], sizeof(sp->pp_seq));
953         bzero(&sp->pp_rseq[0], sizeof(sp->pp_rseq));
954         sp->pp_phase = PHASE_DEAD;
955         sp->pp_up = lcp.Up;
956         sp->pp_down = lcp.Down;
957         sp->pp_last_recv = sp->pp_last_sent = time_uptime;
958         sp->confflags = 0;
959 #ifdef INET
960         sp->confflags |= CONF_ENABLE_VJ;
961 #endif
962 #ifdef INET6
963         sp->confflags |= CONF_ENABLE_IPV6;
964 #endif
965         sp->pp_comp = kmalloc(sizeof(struct slcompress), M_TEMP, M_WAITOK);
966         sl_compress_init(sp->pp_comp, -1);
967         sppp_lcp_init(sp);
968         sppp_ipcp_init(sp);
969         sppp_ipv6cp_init(sp);
970         sppp_pap_init(sp);
971         sppp_chap_init(sp);
972 }
973
974 void
975 sppp_detach(struct ifnet *ifp)
976 {
977         struct sppp **q, *p, *sp = (struct sppp*) ifp;
978         int i;
979
980         /* Remove the entry from the keepalive list. */
981         for (q = &spppq; (p = *q); q = &p->pp_next)
982                 if (p == sp) {
983                         *q = p->pp_next;
984                         break;
985                 }
986
987         /* Stop keepalive handler. */
988         if (!spppq)
989                 callout_stop(&keepalive_timeout);
990
991         for (i = 0; i < IDX_COUNT; i++)
992                 callout_stop(&sp->timeout[i]);
993         callout_stop(&sp->pap_my_to);
994 }
995
996 /*
997  * Flush the interface output queue.
998  */
999 void
1000 sppp_flush(struct ifnet *ifp)
1001 {
1002         struct sppp *sp = (struct sppp*) ifp;
1003
1004         ifq_purge_all(&sp->pp_if.if_snd);
1005         IF_DRAIN(&sp->pp_fastq);
1006         IF_DRAIN(&sp->pp_cpq);
1007 }
1008
1009 /*
1010  * Check if the output queue is empty.
1011  */
1012 int
1013 sppp_isempty(struct ifnet *ifp)
1014 {
1015         struct sppp *sp = (struct sppp*) ifp;
1016         int empty;
1017
1018         crit_enter();
1019         empty = IF_QEMPTY(&sp->pp_fastq) && IF_QEMPTY(&sp->pp_cpq) &&
1020                 ifsq_is_empty(ifq_get_subq_default(&sp->pp_if.if_snd));
1021         crit_exit();
1022         return (empty);
1023 }
1024
1025 /*
1026  * Get next packet to send.
1027  */
1028 struct mbuf *
1029 sppp_dequeue(struct ifnet *ifp)
1030 {
1031         struct sppp *sp = (struct sppp*) ifp;
1032         struct mbuf *m;
1033
1034         crit_enter();
1035
1036         /*
1037          * Process only the control protocol queue until we have at
1038          * least one NCP open.
1039          *
1040          * Do always serve all three queues in Cisco mode.
1041          */
1042         IF_DEQUEUE(&sp->pp_cpq, m);
1043         if (m == NULL &&
1044             (sppp_ncp_check(sp) || sp->pp_mode == IFF_CISCO)) {
1045                 IF_DEQUEUE(&sp->pp_fastq, m);
1046                 if (m == NULL) {
1047                         m = ifsq_dequeue(
1048                             ifq_get_subq_default(&sp->pp_if.if_snd));
1049                 }
1050         }
1051
1052         crit_exit();
1053         return m;
1054 }
1055
1056 /*
1057  * Pick the next packet, do not remove it from the queue.
1058  */
1059 struct mbuf *
1060 sppp_pick(struct ifnet *ifp)
1061 {
1062         struct sppp *sp = (struct sppp*)ifp;
1063         struct mbuf *m;
1064
1065         crit_enter();
1066
1067         m = sp->pp_cpq.ifq_head;
1068         if (m == NULL &&
1069             (sp->pp_phase == PHASE_NETWORK || sp->pp_mode == IFF_CISCO)) {
1070                 if ((m = sp->pp_fastq.ifq_head) == NULL)
1071                         m = ifsq_poll(ifq_get_subq_default(&sp->pp_if.if_snd));
1072         }
1073
1074         crit_exit();
1075         return (m);
1076 }
1077
1078 /*
1079  * Process an ioctl request.  Called on low priority level.
1080  */
1081 int
1082 sppp_ioctl(struct ifnet *ifp, IOCTL_CMD_T cmd, void *data)
1083 {
1084         struct ifreq *ifr = (struct ifreq*) data;
1085         struct sppp *sp = (struct sppp*) ifp;
1086         int rv, going_up, going_down, newmode;
1087
1088         crit_enter();
1089
1090         rv = 0;
1091         switch (cmd) {
1092         case SIOCAIFADDR:
1093         case SIOCSIFDSTADDR:
1094                 break;
1095
1096         case SIOCSIFADDR:
1097                 /* set the interface "up" when assigning an IP address */
1098                 ifp->if_flags |= IFF_UP;
1099                 /* fall through... */
1100
1101         case SIOCSIFFLAGS:
1102                 going_up = ifp->if_flags & IFF_UP &&
1103                         (ifp->if_flags & IFF_RUNNING) == 0;
1104                 going_down = (ifp->if_flags & IFF_UP) == 0 &&
1105                         ifp->if_flags & IFF_RUNNING;
1106
1107                 newmode = ifp->if_flags & IFF_PASSIVE;
1108                 if (!newmode)
1109                         newmode = ifp->if_flags & IFF_AUTO;
1110                 if (!newmode)
1111                         newmode = ifp->if_flags & IFF_CISCO;
1112                 ifp->if_flags &= ~(IFF_PASSIVE | IFF_AUTO | IFF_CISCO);
1113                 ifp->if_flags |= newmode;
1114
1115                 if (newmode != sp->pp_mode) {
1116                         going_down = 1;
1117                         if (!going_up)
1118                                 going_up = ifp->if_flags & IFF_RUNNING;
1119                 }
1120
1121                 if (going_down) {
1122                         if (sp->pp_mode != IFF_CISCO)
1123                                 lcp.Close(sp);
1124                         else if (sp->pp_tlf)
1125                                 (sp->pp_tlf)(sp);
1126                         sppp_flush(ifp);
1127                         ifp->if_flags &= ~IFF_RUNNING;
1128                         sp->pp_mode = newmode;
1129                 }
1130
1131                 if (going_up) {
1132                         if (sp->pp_mode != IFF_CISCO)
1133                                 lcp.Close(sp);
1134                         sp->pp_mode = newmode;
1135                         if (sp->pp_mode == 0) {
1136                                 ifp->if_flags |= IFF_RUNNING;
1137                                 lcp.Open(sp);
1138                         }
1139                         if (sp->pp_mode == IFF_CISCO) {
1140                                 if (sp->pp_tls)
1141                                         (sp->pp_tls)(sp);
1142                                 ifp->if_flags |= IFF_RUNNING;
1143                         }
1144                 }
1145
1146                 break;
1147
1148 #ifdef SIOCSIFMTU
1149 #ifndef ifr_mtu
1150 #define ifr_mtu ifr_metric
1151 #endif
1152         case SIOCSIFMTU:
1153                 if (ifr->ifr_mtu < 128 || ifr->ifr_mtu > sp->lcp.their_mru) {
1154                         crit_exit();
1155                         return (EINVAL);
1156                 }
1157                 ifp->if_mtu = ifr->ifr_mtu;
1158                 break;
1159 #endif
1160 #ifdef SLIOCSETMTU
1161         case SLIOCSETMTU:
1162                 if (*(short*)data < 128 || *(short*)data > sp->lcp.their_mru) {
1163                         crit_exit();
1164                         return (EINVAL);
1165                 }
1166                 ifp->if_mtu = *(short*)data;
1167                 break;
1168 #endif
1169 #ifdef SIOCGIFMTU
1170         case SIOCGIFMTU:
1171                 ifr->ifr_mtu = ifp->if_mtu;
1172                 break;
1173 #endif
1174 #ifdef SLIOCGETMTU
1175         case SLIOCGETMTU:
1176                 *(short*)data = ifp->if_mtu;
1177                 break;
1178 #endif
1179         case SIOCADDMULTI:
1180         case SIOCDELMULTI:
1181                 break;
1182
1183         case SIOCGIFGENERIC:
1184         case SIOCSIFGENERIC:
1185                 rv = sppp_params(sp, cmd, data);
1186                 break;
1187
1188         default:
1189                 rv = ENOTTY;
1190         }
1191
1192         crit_exit();
1193         return rv;
1194 }
1195
1196 /*
1197  * Cisco framing implementation.
1198  */
1199
1200 /*
1201  * Handle incoming Cisco keepalive protocol packets.
1202  */
1203 static void
1204 sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1205 {
1206         STDDCL;
1207         struct cisco_packet *h;
1208         u_long me, mymask;
1209
1210         if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1211                 if (debug)
1212                         log(LOG_DEBUG,
1213                             SPP_FMT "cisco invalid packet length: %d bytes\n",
1214                             SPP_ARGS(ifp), m->m_pkthdr.len);
1215                 return;
1216         }
1217         h = mtod (m, struct cisco_packet*);
1218         if (debug)
1219                 log(LOG_DEBUG,
1220                     SPP_FMT "cisco input: %d bytes "
1221                     "<0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1222                     SPP_ARGS(ifp), m->m_pkthdr.len,
1223                     (u_long)ntohl (h->type), h->par1, h->par2, (u_int)h->rel,
1224                     (u_int)h->time0, (u_int)h->time1);
1225         switch (ntohl (h->type)) {
1226         default:
1227                 if (debug)
1228                         log(-1, SPP_FMT "cisco unknown packet type: 0x%lx\n",
1229                                SPP_ARGS(ifp), (u_long)ntohl (h->type));
1230                 break;
1231         case CISCO_ADDR_REPLY:
1232                 /* Reply on address request, ignore */
1233                 break;
1234         case CISCO_KEEPALIVE_REQ:
1235                 sp->pp_alivecnt = 0;
1236                 sp->pp_rseq[IDX_LCP] = ntohl (h->par1);
1237                 if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
1238                         /* Local and remote sequence numbers are equal.
1239                          * Probably, the line is in loopback mode. */
1240                         if (sp->pp_loopcnt >= MAXALIVECNT) {
1241                                 kprintf (SPP_FMT "loopback\n",
1242                                         SPP_ARGS(ifp));
1243                                 sp->pp_loopcnt = 0;
1244                                 if (ifp->if_flags & IFF_UP) {
1245                                         if_down (ifp);
1246                                         IF_DRAIN(&sp->pp_cpq);
1247                                 }
1248                         }
1249                         ++sp->pp_loopcnt;
1250
1251                         /* Generate new local sequence number */
1252                         sp->pp_seq[IDX_LCP] = krandom();
1253                         break;
1254                 }
1255                 sp->pp_loopcnt = 0;
1256                 if (! (ifp->if_flags & IFF_UP) &&
1257                     (ifp->if_flags & IFF_RUNNING)) {
1258                         if_up(ifp);
1259                         kprintf (SPP_FMT "up\n", SPP_ARGS(ifp));
1260                 }
1261                 break;
1262         case CISCO_ADDR_REQ:
1263                 sppp_get_ip_addrs(sp, &me, 0, &mymask);
1264                 if (me != 0L)
1265                         sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1266                 break;
1267         }
1268 }
1269
1270 /*
1271  * Send Cisco keepalive packet.
1272  */
1273 static void
1274 sppp_cisco_send(struct sppp *sp, int type, long par1, long par2)
1275 {
1276         STDDCL;
1277         struct ppp_header *h;
1278         struct cisco_packet *ch;
1279         struct mbuf *m;
1280         struct timeval tv;
1281         struct ifaltq_subque *ifsq;
1282
1283         getmicrouptime(&tv);
1284
1285         MGETHDR (m, MB_DONTWAIT, MT_DATA);
1286         if (! m)
1287                 return;
1288         m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1289         m->m_pkthdr.rcvif = 0;
1290
1291         h = mtod (m, struct ppp_header*);
1292         h->address = CISCO_MULTICAST;
1293         h->control = 0;
1294         h->protocol = htons (CISCO_KEEPALIVE);
1295
1296         ch = (struct cisco_packet*) (h + 1);
1297         ch->type = htonl (type);
1298         ch->par1 = htonl (par1);
1299         ch->par2 = htonl (par2);
1300         ch->rel = -1;
1301
1302         ch->time0 = htons ((u_short) (tv.tv_sec >> 16));
1303         ch->time1 = htons ((u_short) tv.tv_sec);
1304
1305         if (debug)
1306                 log(LOG_DEBUG,
1307                     SPP_FMT "cisco output: <0x%lx 0x%lx 0x%lx 0x%x 0x%x-0x%x>\n",
1308                         SPP_ARGS(ifp), (u_long)ntohl (ch->type), ch->par1,
1309                         ch->par2, (u_int)ch->rel, (u_int)ch->time0, (u_int)ch->time1);
1310
1311         if (IF_QFULL (&sp->pp_cpq)) {
1312                 IF_DROP (&sp->pp_fastq);
1313                 m_freem (m);
1314         } else
1315                 IF_ENQUEUE (&sp->pp_cpq, m);
1316         ifsq = ifq_get_subq_default(&ifp->if_snd);
1317         if (!ifsq_is_oactive(ifsq))
1318                 (*ifp->if_start) (ifp, ifsq);
1319         IFNET_STAT_INC(ifp, obytes, m->m_pkthdr.len + 3);
1320 }
1321
1322 /*
1323  * PPP protocol implementation.
1324  */
1325
1326 /*
1327  * Send PPP control protocol packet.
1328  */
1329 static void
1330 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1331              u_char ident, u_short len, void *data)
1332 {
1333         STDDCL;
1334         struct ppp_header *h;
1335         struct lcp_header *lh;
1336         struct mbuf *m;
1337         struct ifaltq_subque *ifsq;
1338
1339         if (len > MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN)
1340                 len = MHLEN - PPP_HEADER_LEN - LCP_HEADER_LEN;
1341         MGETHDR (m, MB_DONTWAIT, MT_DATA);
1342         if (! m)
1343                 return;
1344         m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + LCP_HEADER_LEN + len;
1345         m->m_pkthdr.rcvif = 0;
1346
1347         h = mtod (m, struct ppp_header*);
1348         h->address = PPP_ALLSTATIONS;        /* broadcast address */
1349         h->control = PPP_UI;                 /* Unnumbered Info */
1350         h->protocol = htons (proto);         /* Link Control Protocol */
1351
1352         lh = (struct lcp_header*) (h + 1);
1353         lh->type = type;
1354         lh->ident = ident;
1355         lh->len = htons (LCP_HEADER_LEN + len);
1356         if (len)
1357                 bcopy (data, lh+1, len);
1358
1359         if (debug) {
1360                 log(LOG_DEBUG, SPP_FMT "%s output <%s id=0x%x len=%d",
1361                     SPP_ARGS(ifp),
1362                     sppp_proto_name(proto),
1363                     sppp_cp_type_name (lh->type), lh->ident,
1364                     ntohs (lh->len));
1365                 sppp_print_bytes ((u_char*) (lh+1), len);
1366                 log(-1, ">\n");
1367         }
1368         if (IF_QFULL (&sp->pp_cpq)) {
1369                 IF_DROP (&sp->pp_fastq);
1370                 m_freem (m);
1371                 IFNET_STAT_INC(ifp, oerrors, 1);
1372         } else
1373                 IF_ENQUEUE (&sp->pp_cpq, m);
1374         ifsq = ifq_get_subq_default(&ifp->if_snd);
1375         if (!ifsq_is_oactive(ifsq))
1376                 (*ifp->if_start) (ifp, ifsq);
1377         IFNET_STAT_INC(ifp, obytes, m->m_pkthdr.len + 3);
1378 }
1379
1380 /*
1381  * Handle incoming PPP control protocol packets.
1382  */
1383 static void
1384 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1385 {
1386         STDDCL;
1387         struct lcp_header *h;
1388         int printlen, len = m->m_pkthdr.len;
1389         int rv;
1390         u_char *p;
1391
1392         if (len < 4) {
1393                 if (debug)
1394                         log(LOG_DEBUG,
1395                             SPP_FMT "%s invalid packet length: %d bytes\n",
1396                             SPP_ARGS(ifp), cp->name, len);
1397                 return;
1398         }
1399         h = mtod (m, struct lcp_header*);
1400         if (debug) {
1401                 printlen = ntohs(h->len);
1402                 log(LOG_DEBUG,
1403                     SPP_FMT "%s input(%s): <%s id=0x%x len=%d",
1404                     SPP_ARGS(ifp), cp->name,
1405                     sppp_state_name(sp->state[cp->protoidx]),
1406                     sppp_cp_type_name (h->type), h->ident, printlen);
1407                 if (len < printlen)
1408                         printlen = len;
1409                 if (printlen > 4)
1410                         sppp_print_bytes ((u_char*) (h+1), printlen - 4);
1411                 log(-1, ">\n");
1412         }
1413         if (len > ntohs (h->len))
1414                 len = ntohs (h->len);
1415         p = (u_char *)(h + 1);
1416         switch (h->type) {
1417         case CONF_REQ:
1418                 if (len < 4) {
1419                         if (debug)
1420                                 log(-1, SPP_FMT "%s invalid conf-req length %d\n",
1421                                        SPP_ARGS(ifp), cp->name,
1422                                        len);
1423                         IFNET_STAT_INC(ifp, ierrors, 1);
1424                         break;
1425                 }
1426                 /* handle states where RCR doesn't get a SCA/SCN */
1427                 switch (sp->state[cp->protoidx]) {
1428                 case STATE_CLOSING:
1429                 case STATE_STOPPING:
1430                         return;
1431                 case STATE_CLOSED:
1432                         sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1433                                      0, 0);
1434                         return;
1435                 }
1436                 rv = (cp->RCR)(sp, h, len);
1437                 if (rv < 0) {
1438                         /* fatal error, shut down */
1439                         (cp->tld)(sp);
1440                         sppp_lcp_tlf(sp);
1441                         return;
1442                 }
1443                 switch (sp->state[cp->protoidx]) {
1444                 case STATE_OPENED:
1445                         (cp->tld)(sp);
1446                         (cp->scr)(sp);
1447                         /* fall through... */
1448                 case STATE_ACK_SENT:
1449                 case STATE_REQ_SENT:
1450                         /*
1451                          * sppp_cp_change_state() have the side effect of
1452                          * restarting the timeouts. We want to avoid that
1453                          * if the state don't change, otherwise we won't
1454                          * ever timeout and resend a configuration request
1455                          * that got lost.
1456                          */
1457                         if (sp->state[cp->protoidx] == (rv ? STATE_ACK_SENT:
1458                             STATE_REQ_SENT))
1459                                 break;
1460                         sppp_cp_change_state(cp, sp, rv?
1461                                              STATE_ACK_SENT: STATE_REQ_SENT);
1462                         break;
1463                 case STATE_STOPPED:
1464                         sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1465                         (cp->scr)(sp);
1466                         sppp_cp_change_state(cp, sp, rv?
1467                                              STATE_ACK_SENT: STATE_REQ_SENT);
1468                         break;
1469                 case STATE_ACK_RCVD:
1470                         if (rv) {
1471                                 sppp_cp_change_state(cp, sp, STATE_OPENED);
1472                                 if (debug)
1473                                         log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1474                                             SPP_ARGS(ifp),
1475                                             cp->name);
1476                                 (cp->tlu)(sp);
1477                         } else
1478                                 sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1479                         break;
1480                 default:
1481                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1482                                SPP_ARGS(ifp), cp->name,
1483                                sppp_cp_type_name(h->type),
1484                                sppp_state_name(sp->state[cp->protoidx]));
1485                         IFNET_STAT_INC(ifp, ierrors, 1);
1486                 }
1487                 break;
1488         case CONF_ACK:
1489                 if (h->ident != sp->confid[cp->protoidx]) {
1490                         if (debug)
1491                                 log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1492                                        SPP_ARGS(ifp), cp->name,
1493                                        h->ident, sp->confid[cp->protoidx]);
1494                         IFNET_STAT_INC(ifp, ierrors, 1);
1495                         break;
1496                 }
1497                 switch (sp->state[cp->protoidx]) {
1498                 case STATE_CLOSED:
1499                 case STATE_STOPPED:
1500                         sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1501                         break;
1502                 case STATE_CLOSING:
1503                 case STATE_STOPPING:
1504                         break;
1505                 case STATE_REQ_SENT:
1506                         sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1507                         sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1508                         break;
1509                 case STATE_OPENED:
1510                         (cp->tld)(sp);
1511                         /* fall through */
1512                 case STATE_ACK_RCVD:
1513                         (cp->scr)(sp);
1514                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1515                         break;
1516                 case STATE_ACK_SENT:
1517                         sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1518                         sppp_cp_change_state(cp, sp, STATE_OPENED);
1519                         if (debug)
1520                                 log(LOG_DEBUG, SPP_FMT "%s tlu\n",
1521                                        SPP_ARGS(ifp), cp->name);
1522                         (cp->tlu)(sp);
1523                         break;
1524                 default:
1525                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1526                                SPP_ARGS(ifp), cp->name,
1527                                sppp_cp_type_name(h->type),
1528                                sppp_state_name(sp->state[cp->protoidx]));
1529                         IFNET_STAT_INC(ifp, ierrors, 1);
1530                 }
1531                 break;
1532         case CONF_NAK:
1533         case CONF_REJ:
1534                 if (h->ident != sp->confid[cp->protoidx]) {
1535                         if (debug)
1536                                 log(-1, SPP_FMT "%s id mismatch 0x%x != 0x%x\n",
1537                                        SPP_ARGS(ifp), cp->name,
1538                                        h->ident, sp->confid[cp->protoidx]);
1539                         IFNET_STAT_INC(ifp, ierrors, 1);
1540                         break;
1541                 }
1542                 if (h->type == CONF_NAK)
1543                         (cp->RCN_nak)(sp, h, len);
1544                 else /* CONF_REJ */
1545                         (cp->RCN_rej)(sp, h, len);
1546
1547                 switch (sp->state[cp->protoidx]) {
1548                 case STATE_CLOSED:
1549                 case STATE_STOPPED:
1550                         sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1551                         break;
1552                 case STATE_REQ_SENT:
1553                 case STATE_ACK_SENT:
1554                         sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1555                         /*
1556                          * Slow things down a bit if we think we might be
1557                          * in loopback. Depend on the timeout to send the
1558                          * next configuration request.
1559                          */
1560                         if (sp->pp_loopcnt)
1561                                 break;
1562                         (cp->scr)(sp);
1563                         break;
1564                 case STATE_OPENED:
1565                         (cp->tld)(sp);
1566                         /* fall through */
1567                 case STATE_ACK_RCVD:
1568                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1569                         (cp->scr)(sp);
1570                         break;
1571                 case STATE_CLOSING:
1572                 case STATE_STOPPING:
1573                         break;
1574                 default:
1575                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1576                                SPP_ARGS(ifp), cp->name,
1577                                sppp_cp_type_name(h->type),
1578                                sppp_state_name(sp->state[cp->protoidx]));
1579                         IFNET_STAT_INC(ifp, ierrors, 1);
1580                 }
1581                 break;
1582
1583         case TERM_REQ:
1584                 switch (sp->state[cp->protoidx]) {
1585                 case STATE_ACK_RCVD:
1586                 case STATE_ACK_SENT:
1587                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1588                         /* fall through */
1589                 case STATE_CLOSED:
1590                 case STATE_STOPPED:
1591                 case STATE_CLOSING:
1592                 case STATE_STOPPING:
1593                 case STATE_REQ_SENT:
1594                   sta:
1595                         /* Send Terminate-Ack packet. */
1596                         if (debug)
1597                                 log(LOG_DEBUG, SPP_FMT "%s send terminate-ack\n",
1598                                     SPP_ARGS(ifp), cp->name);
1599                         sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1600                         break;
1601                 case STATE_OPENED:
1602                         (cp->tld)(sp);
1603                         sp->rst_counter[cp->protoidx] = 0;
1604                         sppp_cp_change_state(cp, sp, STATE_STOPPING);
1605                         goto sta;
1606                         break;
1607                 default:
1608                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1609                                SPP_ARGS(ifp), cp->name,
1610                                sppp_cp_type_name(h->type),
1611                                sppp_state_name(sp->state[cp->protoidx]));
1612                         IFNET_STAT_INC(ifp, ierrors, 1);
1613                 }
1614                 break;
1615         case TERM_ACK:
1616                 switch (sp->state[cp->protoidx]) {
1617                 case STATE_CLOSED:
1618                 case STATE_STOPPED:
1619                 case STATE_REQ_SENT:
1620                 case STATE_ACK_SENT:
1621                         break;
1622                 case STATE_CLOSING:
1623                         sppp_cp_change_state(cp, sp, STATE_CLOSED);
1624                         (cp->tlf)(sp);
1625                         break;
1626                 case STATE_STOPPING:
1627                         sppp_cp_change_state(cp, sp, STATE_STOPPED);
1628                         (cp->tlf)(sp);
1629                         break;
1630                 case STATE_ACK_RCVD:
1631                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1632                         break;
1633                 case STATE_OPENED:
1634                         (cp->tld)(sp);
1635                         (cp->scr)(sp);
1636                         sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1637                         break;
1638                 default:
1639                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1640                                SPP_ARGS(ifp), cp->name,
1641                                sppp_cp_type_name(h->type),
1642                                sppp_state_name(sp->state[cp->protoidx]));
1643                         IFNET_STAT_INC(ifp, ierrors, 1);
1644                 }
1645                 break;
1646         case CODE_REJ:
1647                 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1648                 log(LOG_INFO,
1649                     SPP_FMT "%s: ignoring RXJ (%s) for proto 0x%x, "
1650                     "danger will robinson\n",
1651                     SPP_ARGS(ifp), cp->name,
1652                     sppp_cp_type_name(h->type), ntohs(*((u_short *)p)));
1653                 switch (sp->state[cp->protoidx]) {
1654                 case STATE_CLOSED:
1655                 case STATE_STOPPED:
1656                 case STATE_REQ_SENT:
1657                 case STATE_ACK_SENT:
1658                 case STATE_CLOSING:
1659                 case STATE_STOPPING:
1660                 case STATE_OPENED:
1661                         break;
1662                 case STATE_ACK_RCVD:
1663                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1664                         break;
1665                 default:
1666                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1667                                SPP_ARGS(ifp), cp->name,
1668                                sppp_cp_type_name(h->type),
1669                                sppp_state_name(sp->state[cp->protoidx]));
1670                         IFNET_STAT_INC(ifp, ierrors, 1);
1671                 }
1672                 break;
1673         case PROTO_REJ:
1674             {
1675                 int catastrophic;
1676                 const struct cp *upper;
1677                 int i;
1678                 u_int16_t proto;
1679
1680                 catastrophic = 0;
1681                 upper = NULL;
1682                 proto = ntohs(*((u_int16_t *)p));
1683                 for (i = 0; i < IDX_COUNT; i++) {
1684                         if (cps[i]->proto == proto) {
1685                                 upper = cps[i];
1686                                 break;
1687                         }
1688                 }
1689                 if (upper == NULL)
1690                         catastrophic++;
1691
1692                 if (catastrophic || debug)
1693                         log(catastrophic? LOG_INFO: LOG_DEBUG,
1694                             SPP_FMT "%s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
1695                             SPP_ARGS(ifp), cp->name, catastrophic ? '-' : '+',
1696                             sppp_cp_type_name(h->type), proto,
1697                             upper ? upper->name : "unknown",
1698                             upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
1699
1700                 /*
1701                  * if we got RXJ+ against conf-req, the peer does not implement
1702                  * this particular protocol type.  terminate the protocol.
1703                  */
1704                 if (upper && !catastrophic) {
1705                         if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
1706                                 upper->Close(sp);
1707                                 break;
1708                         }
1709                 }
1710
1711                 /* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1712                 switch (sp->state[cp->protoidx]) {
1713                 case STATE_CLOSED:
1714                 case STATE_STOPPED:
1715                 case STATE_REQ_SENT:
1716                 case STATE_ACK_SENT:
1717                 case STATE_CLOSING:
1718                 case STATE_STOPPING:
1719                 case STATE_OPENED:
1720                         break;
1721                 case STATE_ACK_RCVD:
1722                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1723                         break;
1724                 default:
1725                         kprintf(SPP_FMT "%s illegal %s in state %s\n",
1726                                SPP_ARGS(ifp), cp->name,
1727                                sppp_cp_type_name(h->type),
1728                                sppp_state_name(sp->state[cp->protoidx]));
1729                         IFNET_STAT_INC(ifp, ierrors, 1);
1730                 }
1731                 break;
1732             }
1733         case DISC_REQ:
1734                 if (cp->proto != PPP_LCP)
1735                         goto illegal;
1736                 /* Discard the packet. */
1737                 break;
1738         case ECHO_REQ:
1739                 if (cp->proto != PPP_LCP)
1740                         goto illegal;
1741                 if (sp->state[cp->protoidx] != STATE_OPENED) {
1742                         if (debug)
1743                                 log(-1, SPP_FMT "lcp echo req but lcp closed\n",
1744                                        SPP_ARGS(ifp));
1745                         IFNET_STAT_INC(ifp, ierrors, 1);
1746                         break;
1747                 }
1748                 if (len < 8) {
1749                         if (debug)
1750                                 log(-1, SPP_FMT "invalid lcp echo request "
1751                                        "packet length: %d bytes\n",
1752                                        SPP_ARGS(ifp), len);
1753                         break;
1754                 }
1755                 if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
1756                     ntohl (*(long*)(h+1)) == sp->lcp.magic) {
1757                         /* Line loopback mode detected. */
1758                         kprintf(SPP_FMT "loopback\n", SPP_ARGS(ifp));
1759                         sp->pp_loopcnt = MAXALIVECNT * 5;
1760                         if_down (ifp);
1761                         IF_DRAIN(&sp->pp_cpq);
1762
1763                         /* Shut down the PPP link. */
1764                         /* XXX */
1765                         lcp.Down(sp);
1766                         lcp.Up(sp);
1767                         break;
1768                 }
1769                 *(long*)(h+1) = htonl (sp->lcp.magic);
1770                 if (debug)
1771                         log(-1, SPP_FMT "got lcp echo req, sending echo rep\n",
1772                                SPP_ARGS(ifp));
1773                 sppp_cp_send (sp, PPP_LCP, ECHO_REPLY, h->ident, len-4, h+1);
1774                 break;
1775         case ECHO_REPLY:
1776                 if (cp->proto != PPP_LCP)
1777                         goto illegal;
1778                 if (h->ident != sp->lcp.echoid) {
1779                         IFNET_STAT_INC(ifp, ierrors, 1);
1780                         break;
1781                 }
1782                 if (len < 8) {
1783                         if (debug)
1784                                 log(-1, SPP_FMT "lcp invalid echo reply "
1785                                        "packet length: %d bytes\n",
1786                                        SPP_ARGS(ifp), len);
1787                         break;
1788                 }
1789                 if (debug)
1790                         log(-1, SPP_FMT "lcp got echo rep\n",
1791                                SPP_ARGS(ifp));
1792                 if (!(sp->lcp.opts & (1 << LCP_OPT_MAGIC)) ||
1793                     ntohl (*(long*)(h+1)) != sp->lcp.magic)
1794                         sp->pp_alivecnt = 0;
1795                 break;
1796         default:
1797                 /* Unknown packet type -- send Code-Reject packet. */
1798           illegal:
1799                 if (debug)
1800                         log(-1, SPP_FMT "%s send code-rej for 0x%x\n",
1801                                SPP_ARGS(ifp), cp->name, h->type);
1802                 sppp_cp_send(sp, cp->proto, CODE_REJ,
1803                              ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
1804                 IFNET_STAT_INC(ifp, ierrors, 1);
1805         }
1806 }
1807
1808
1809 /*
1810  * The generic part of all Up/Down/Open/Close/TO event handlers.
1811  * Basically, the state transition handling in the automaton.
1812  */
1813 static void
1814 sppp_up_event(const struct cp *cp, struct sppp *sp)
1815 {
1816         STDDCL;
1817
1818         if (debug)
1819                 log(LOG_DEBUG, SPP_FMT "%s up(%s)\n",
1820                     SPP_ARGS(ifp), cp->name,
1821                     sppp_state_name(sp->state[cp->protoidx]));
1822
1823         switch (sp->state[cp->protoidx]) {
1824         case STATE_INITIAL:
1825                 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1826                 break;
1827         case STATE_STARTING:
1828                 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1829                 (cp->scr)(sp);
1830                 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1831                 break;
1832         default:
1833                 kprintf(SPP_FMT "%s illegal up in state %s\n",
1834                        SPP_ARGS(ifp), cp->name,
1835                        sppp_state_name(sp->state[cp->protoidx]));
1836         }
1837 }
1838
1839 static void
1840 sppp_down_event(const struct cp *cp, struct sppp *sp)
1841 {
1842         STDDCL;
1843
1844         if (debug)
1845                 log(LOG_DEBUG, SPP_FMT "%s down(%s)\n",
1846                     SPP_ARGS(ifp), cp->name,
1847                     sppp_state_name(sp->state[cp->protoidx]));
1848
1849         switch (sp->state[cp->protoidx]) {
1850         case STATE_CLOSED:
1851         case STATE_CLOSING:
1852                 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1853                 break;
1854         case STATE_STOPPED:
1855                 sppp_cp_change_state(cp, sp, STATE_STARTING);
1856                 (cp->tls)(sp);
1857                 break;
1858         case STATE_STOPPING:
1859         case STATE_REQ_SENT:
1860         case STATE_ACK_RCVD:
1861         case STATE_ACK_SENT:
1862                 sppp_cp_change_state(cp, sp, STATE_STARTING);
1863                 break;
1864         case STATE_OPENED:
1865                 (cp->tld)(sp);
1866                 sppp_cp_change_state(cp, sp, STATE_STARTING);
1867                 break;
1868         default:
1869                 kprintf(SPP_FMT "%s illegal down in state %s\n",
1870                        SPP_ARGS(ifp), cp->name,
1871                        sppp_state_name(sp->state[cp->protoidx]));
1872         }
1873 }
1874
1875
1876 static void
1877 sppp_open_event(const struct cp *cp, struct sppp *sp)
1878 {
1879         STDDCL;
1880
1881         if (debug)
1882                 log(LOG_DEBUG, SPP_FMT "%s open(%s)\n",
1883                     SPP_ARGS(ifp), cp->name,
1884                     sppp_state_name(sp->state[cp->protoidx]));
1885
1886         switch (sp->state[cp->protoidx]) {
1887         case STATE_INITIAL:
1888                 sppp_cp_change_state(cp, sp, STATE_STARTING);
1889                 (cp->tls)(sp);
1890                 break;
1891         case STATE_STARTING:
1892                 break;
1893         case STATE_CLOSED:
1894                 sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1895                 (cp->scr)(sp);
1896                 sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1897                 break;
1898         case STATE_STOPPED:
1899                 /*
1900                  * Try escaping stopped state.  This seems to bite
1901                  * people occasionally, in particular for IPCP,
1902                  * presumably following previous IPCP negotiation
1903                  * aborts.  Somehow, we must have missed a Down event
1904                  * which would have caused a transition into starting
1905                  * state, so as a bandaid we force the Down event now.
1906                  * This effectively implements (something like the)
1907                  * `restart' option mentioned in the state transition
1908                  * table of RFC 1661.
1909                  */
1910                 sppp_cp_change_state(cp, sp, STATE_STARTING);
1911                 (cp->tls)(sp);
1912                 break;
1913         case STATE_STOPPING:
1914         case STATE_REQ_SENT:
1915         case STATE_ACK_RCVD:
1916         case STATE_ACK_SENT:
1917         case STATE_OPENED:
1918                 break;
1919         case STATE_CLOSING:
1920                 sppp_cp_change_state(cp, sp, STATE_STOPPING);
1921                 break;
1922         }
1923 }
1924
1925
1926 static void
1927 sppp_close_event(const struct cp *cp, struct sppp *sp)
1928 {
1929         STDDCL;
1930
1931         if (debug)
1932                 log(LOG_DEBUG, SPP_FMT "%s close(%s)\n",
1933                     SPP_ARGS(ifp), cp->name,
1934                     sppp_state_name(sp->state[cp->protoidx]));
1935
1936         switch (sp->state[cp->protoidx]) {
1937         case STATE_INITIAL:
1938         case STATE_CLOSED:
1939         case STATE_CLOSING:
1940                 break;
1941         case STATE_STARTING:
1942                 sppp_cp_change_state(cp, sp, STATE_INITIAL);
1943                 (cp->tlf)(sp);
1944                 break;
1945         case STATE_STOPPED:
1946                 sppp_cp_change_state(cp, sp, STATE_CLOSED);
1947                 break;
1948         case STATE_STOPPING:
1949                 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1950                 break;
1951         case STATE_OPENED:
1952                 (cp->tld)(sp);
1953                 /* fall through */
1954         case STATE_REQ_SENT:
1955         case STATE_ACK_RCVD:
1956         case STATE_ACK_SENT:
1957                 sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
1958                 sppp_cp_send(sp, cp->proto, TERM_REQ,
1959                              ++sp->pp_seq[cp->protoidx], 0, 0);
1960                 sppp_cp_change_state(cp, sp, STATE_CLOSING);
1961                 break;
1962         }
1963 }
1964
1965 static void
1966 sppp_to_event(const struct cp *cp, struct sppp *sp)
1967 {
1968         STDDCL;
1969
1970         crit_enter();
1971
1972         if (debug)
1973                 log(LOG_DEBUG, SPP_FMT "%s TO(%s) rst_counter = %d\n",
1974                     SPP_ARGS(ifp), cp->name,
1975                     sppp_state_name(sp->state[cp->protoidx]),
1976                     sp->rst_counter[cp->protoidx]);
1977
1978         if (--sp->rst_counter[cp->protoidx] < 0)
1979                 /* TO- event */
1980                 switch (sp->state[cp->protoidx]) {
1981                 case STATE_CLOSING:
1982                         sppp_cp_change_state(cp, sp, STATE_CLOSED);
1983                         (cp->tlf)(sp);
1984                         break;
1985                 case STATE_STOPPING:
1986                         sppp_cp_change_state(cp, sp, STATE_STOPPED);
1987                         (cp->tlf)(sp);
1988                         break;
1989                 case STATE_REQ_SENT:
1990                 case STATE_ACK_RCVD:
1991                 case STATE_ACK_SENT:
1992                         sppp_cp_change_state(cp, sp, STATE_STOPPED);
1993                         (cp->tlf)(sp);
1994                         break;
1995                 }
1996         else
1997                 /* TO+ event */
1998                 switch (sp->state[cp->protoidx]) {
1999                 case STATE_CLOSING:
2000                 case STATE_STOPPING:
2001                         sppp_cp_send(sp, cp->proto, TERM_REQ,
2002                                      ++sp->pp_seq[cp->protoidx], 0, 0);
2003                         callout_reset(&sp->timeout[cp->protoidx],
2004                                         sp->lcp.timeout, cp->TO, sp);
2005                         break;
2006                 case STATE_REQ_SENT:
2007                 case STATE_ACK_RCVD:
2008                         (cp->scr)(sp);
2009                         /* sppp_cp_change_state() will restart the timer */
2010                         sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2011                         break;
2012                 case STATE_ACK_SENT:
2013                         (cp->scr)(sp);
2014                         callout_reset(&sp->timeout[cp->protoidx],
2015                                         sp->lcp.timeout, cp->TO, sp);
2016                         break;
2017                 }
2018
2019         crit_exit();
2020 }
2021
2022 /*
2023  * Change the state of a control protocol in the state automaton.
2024  * Takes care of starting/stopping the restart timer.
2025  */
2026 void
2027 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
2028 {
2029         sp->state[cp->protoidx] = newstate;
2030         callout_stop(&sp->timeout[cp->protoidx]);
2031
2032         switch (newstate) {
2033         case STATE_INITIAL:
2034         case STATE_STARTING:
2035         case STATE_CLOSED:
2036         case STATE_STOPPED:
2037         case STATE_OPENED:
2038                 break;
2039         case STATE_CLOSING:
2040         case STATE_STOPPING:
2041         case STATE_REQ_SENT:
2042         case STATE_ACK_RCVD:
2043         case STATE_ACK_SENT:
2044                 callout_reset(&sp->timeout[cp->protoidx], 
2045                                 sp->lcp.timeout, cp->TO, sp);
2046                 break;
2047         }
2048 }
2049
2050 /*
2051  *--------------------------------------------------------------------------*
2052  *                                                                          *
2053  *                         The LCP implementation.                          *
2054  *                                                                          *
2055  *--------------------------------------------------------------------------*
2056  */
2057 static void
2058 sppp_lcp_init(struct sppp *sp)
2059 {
2060         sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2061         sp->lcp.magic = 0;
2062         sp->state[IDX_LCP] = STATE_INITIAL;
2063         sp->fail_counter[IDX_LCP] = 0;
2064         sp->pp_seq[IDX_LCP] = 0;
2065         sp->pp_rseq[IDX_LCP] = 0;
2066         sp->lcp.protos = 0;
2067         sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
2068
2069         /* Note that these values are  relevant for all control protocols */
2070         sp->lcp.timeout = 3 * hz;
2071         sp->lcp.max_terminate = 2;
2072         sp->lcp.max_configure = 10;
2073         sp->lcp.max_failure = 10;
2074         callout_init(&sp->timeout[IDX_LCP]);
2075 }
2076
2077 static void
2078 sppp_lcp_up(struct sppp *sp)
2079 {
2080         STDDCL;
2081
2082         sp->pp_alivecnt = 0;
2083         sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2084         sp->lcp.magic = 0;
2085         sp->lcp.protos = 0;
2086         sp->lcp.mru = sp->lcp.their_mru = PP_MTU;
2087         /*
2088          * If this interface is passive or dial-on-demand, and we are
2089          * still in Initial state, it means we've got an incoming
2090          * call.  Activate the interface.
2091          */
2092         if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
2093                 if (debug)
2094                         log(LOG_DEBUG,
2095                             SPP_FMT "Up event", SPP_ARGS(ifp));
2096                 ifp->if_flags |= IFF_RUNNING;
2097                 if (sp->state[IDX_LCP] == STATE_INITIAL) {
2098                         if (debug)
2099                                 log(-1, "(incoming call)\n");
2100                         sp->pp_flags |= PP_CALLIN;
2101                         lcp.Open(sp);
2102                 } else if (debug)
2103                         log(-1, "\n");
2104         } else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
2105                    (sp->state[IDX_LCP] == STATE_INITIAL)) {
2106                 ifp->if_flags |= IFF_RUNNING;
2107                 lcp.Open(sp);
2108         }
2109
2110         sppp_up_event(&lcp, sp);
2111 }
2112
2113 static void
2114 sppp_lcp_down(struct sppp *sp)
2115 {
2116         STDDCL;
2117
2118         sppp_down_event(&lcp, sp);
2119
2120         /*
2121          * If this is neither a dial-on-demand nor a passive
2122          * interface, simulate an ``ifconfig down'' action, so the
2123          * administrator can force a redial by another ``ifconfig
2124          * up''.  XXX For leased line operation, should we immediately
2125          * try to reopen the connection here?
2126          */
2127         if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
2128                 log(LOG_INFO,
2129                     SPP_FMT "Down event, taking interface down.\n",
2130                     SPP_ARGS(ifp));
2131                 if_down(ifp);
2132         } else {
2133                 if (debug)
2134                         log(LOG_DEBUG,
2135                             SPP_FMT "Down event (carrier loss)\n",
2136                             SPP_ARGS(ifp));
2137                 sp->pp_flags &= ~PP_CALLIN;
2138                 if (sp->state[IDX_LCP] != STATE_INITIAL)
2139                         lcp.Close(sp);
2140                 ifp->if_flags &= ~IFF_RUNNING;
2141         }
2142 }
2143
2144 static void
2145 sppp_lcp_open(struct sppp *sp)
2146 {
2147         /*
2148          * If we are authenticator, negotiate LCP_AUTH
2149          */
2150         if (sp->hisauth.proto != 0)
2151                 sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
2152         else
2153                 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2154         sp->pp_flags &= ~PP_NEEDAUTH;
2155         sppp_open_event(&lcp, sp);
2156 }
2157
2158 static void
2159 sppp_lcp_close(struct sppp *sp)
2160 {
2161         sppp_close_event(&lcp, sp);
2162 }
2163
2164 static void
2165 sppp_lcp_TO(void *cookie)
2166 {
2167         sppp_to_event(&lcp, (struct sppp *)cookie);
2168 }
2169
2170 /*
2171  * Analyze a configure request.  Return true if it was agreeable, and
2172  * caused action sca, false if it has been rejected or nak'ed, and
2173  * caused action scn.  (The return value is used to make the state
2174  * transition decision in the state automaton.)
2175  */
2176 static int
2177 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2178 {
2179         STDDCL;
2180         u_char *buf, *r, *p;
2181         int origlen, rlen;
2182         u_long nmagic;
2183         u_short authproto;
2184
2185         len -= 4;
2186         origlen = len;
2187         buf = r = kmalloc (len, M_TEMP, M_INTWAIT);
2188
2189         if (debug)
2190                 log(LOG_DEBUG, SPP_FMT "lcp parse opts: ",
2191                     SPP_ARGS(ifp));
2192
2193         /* pass 1: check for things that need to be rejected */
2194         p = (void*) (h+1);
2195         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2196                 /* Sanity check option length */
2197                 if (p[1] > len) {
2198                         /* Malicious option - drop immediately.
2199                          * XXX Maybe we should just RXJ it?
2200                          */
2201                          log(-1, "%s: received malicious LCP option 0x%02x, "
2202                              "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname,
2203                              p[0], p[1], len);
2204                         goto drop;
2205                 }
2206                 if (debug)
2207                         log(-1, " %s ", sppp_lcp_opt_name(*p));
2208                 switch (*p) {
2209                 case LCP_OPT_MAGIC:
2210                         /* Magic number. */
2211                         if (len >= 6 && p[1] == 6)
2212                                 continue;
2213                         if (debug)
2214                                 log(-1, "[invalid] ");
2215                         break;
2216                 case LCP_OPT_ASYNC_MAP:
2217                         /* Async control character map. */
2218                         if (len >= 6 && p[1] == 6)
2219                                 continue;
2220                         if (debug)
2221                                 log(-1, "[invalid] ");
2222                         break;
2223                 case LCP_OPT_MRU:
2224                         /* Maximum receive unit. */
2225                         if (len >= 4 && p[1] == 4)
2226                                 continue;
2227                         if (debug)
2228                                 log(-1, "[invalid] ");
2229                         break;
2230                 case LCP_OPT_AUTH_PROTO:
2231                         if (len < 4) {
2232                                 if (debug)
2233                                         log(-1, "[invalid] ");
2234                                 break;
2235                         }
2236                         authproto = (p[2] << 8) + p[3];
2237                         if (authproto == PPP_CHAP && p[1] != 5) {
2238                                 if (debug)
2239                                         log(-1, "[invalid chap len] ");
2240                                 break;
2241                         }
2242                         if (sp->myauth.proto == 0) {
2243                                 /* we are not configured to do auth */
2244                                 if (debug)
2245                                         log(-1, "[not configured] ");
2246                                 break;
2247                         }
2248                         /*
2249                          * Remote want us to authenticate, remember this,
2250                          * so we stay in PHASE_AUTHENTICATE after LCP got
2251                          * up.
2252                          */
2253                         sp->pp_flags |= PP_NEEDAUTH;
2254                         continue;
2255                 default:
2256                         /* Others not supported. */
2257                         if (debug)
2258                                 log(-1, "[rej] ");
2259                         break;
2260                 }
2261                 /* Add the option to rejected list. */
2262                 bcopy (p, r, p[1]);
2263                 r += p[1];
2264                 rlen += p[1];
2265         }
2266         if (rlen) {
2267                 if (debug)
2268                         log(-1, " send conf-rej\n");
2269                 sppp_cp_send (sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2270                 return 0;
2271         } else if (debug)
2272                 log(-1, "\n");
2273
2274         /*
2275          * pass 2: check for option values that are unacceptable and
2276          * thus require to be nak'ed.
2277          */
2278         if (debug)
2279                 log(LOG_DEBUG, SPP_FMT "lcp parse opt values: ",
2280                     SPP_ARGS(ifp));
2281
2282         p = (void*) (h+1);
2283         len = origlen;
2284         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2285                 if (debug)
2286                         log(-1, " %s ", sppp_lcp_opt_name(*p));
2287                 switch (*p) {
2288                 case LCP_OPT_MAGIC:
2289                         /* Magic number -- extract. */
2290                         nmagic = (u_long)p[2] << 24 |
2291                                 (u_long)p[3] << 16 | p[4] << 8 | p[5];
2292                         if (nmagic != sp->lcp.magic) {
2293                                 sp->pp_loopcnt = 0;
2294                                 if (debug)
2295                                         log(-1, "0x%lx ", nmagic);
2296                                 continue;
2297                         }
2298                         if (debug && sp->pp_loopcnt < MAXALIVECNT*5)
2299                                 log(-1, "[glitch] ");
2300                         ++sp->pp_loopcnt;
2301                         /*
2302                          * We negate our magic here, and NAK it.  If
2303                          * we see it later in an NAK packet, we
2304                          * suggest a new one.
2305                          */
2306                         nmagic = ~sp->lcp.magic;
2307                         /* Gonna NAK it. */
2308                         p[2] = nmagic >> 24;
2309                         p[3] = nmagic >> 16;
2310                         p[4] = nmagic >> 8;
2311                         p[5] = nmagic;
2312                         break;
2313
2314                 case LCP_OPT_ASYNC_MAP:
2315                         /*
2316                          * Async control character map -- just ignore it.
2317                          *
2318                          * Quote from RFC 1662, chapter 6:
2319                          * To enable this functionality, synchronous PPP
2320                          * implementations MUST always respond to the
2321                          * Async-Control-Character-Map Configuration
2322                          * Option with the LCP Configure-Ack.  However,
2323                          * acceptance of the Configuration Option does
2324                          * not imply that the synchronous implementation
2325                          * will do any ACCM mapping.  Instead, all such
2326                          * octet mapping will be performed by the
2327                          * asynchronous-to-synchronous converter.
2328                          */
2329                         continue;
2330
2331                 case LCP_OPT_MRU:
2332                         /*
2333                          * Maximum receive unit.  Always agreeable,
2334                          * but ignored by now.
2335                          */
2336                         sp->lcp.their_mru = p[2] * 256 + p[3];
2337                         if (debug)
2338                                 log(-1, "%lu ", sp->lcp.their_mru);
2339                         continue;
2340
2341                 case LCP_OPT_AUTH_PROTO:
2342                         authproto = (p[2] << 8) + p[3];
2343                         if (sp->myauth.proto != authproto) {
2344                                 /* not agreed, nak */
2345                                 if (debug)
2346                                         log(-1, "[mine %s != his %s] ",
2347                                                sppp_proto_name(sp->hisauth.proto),
2348                                                sppp_proto_name(authproto));
2349                                 p[2] = sp->myauth.proto >> 8;
2350                                 p[3] = sp->myauth.proto;
2351                                 break;
2352                         }
2353                         if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2354                                 if (debug)
2355                                         log(-1, "[chap not MD5] ");
2356                                 p[4] = CHAP_MD5;
2357                                 break;
2358                         }
2359                         continue;
2360                 }
2361                 /* Add the option to nak'ed list. */
2362                 bcopy (p, r, p[1]);
2363                 r += p[1];
2364                 rlen += p[1];
2365         }
2366         if (rlen) {
2367                 /*
2368                  * Local and remote magics equal -- loopback?
2369                  */
2370                 if (sp->pp_loopcnt >= MAXALIVECNT*5) {
2371                         if (sp->pp_loopcnt == MAXALIVECNT*5)
2372                                 kprintf (SPP_FMT "loopback\n",
2373                                         SPP_ARGS(ifp));
2374                         if (ifp->if_flags & IFF_UP) {
2375                                 if_down(ifp);
2376                                 IF_DRAIN(&sp->pp_cpq);
2377                                 /* XXX ? */
2378                                 lcp.Down(sp);
2379                                 lcp.Up(sp);
2380                         }
2381                 } else if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2382                         if (debug)
2383                                 log(-1, " max_failure (%d) exceeded, "
2384                                        "send conf-rej\n",
2385                                        sp->lcp.max_failure);
2386                         sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2387                 } else {
2388                         if (debug)
2389                                 log(-1, " send conf-nak\n");
2390                         sppp_cp_send (sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2391                 }
2392         } else {
2393                 if (debug)
2394                         log(-1, " send conf-ack\n");
2395                 sp->fail_counter[IDX_LCP] = 0;
2396                 sp->pp_loopcnt = 0;
2397                 sppp_cp_send (sp, PPP_LCP, CONF_ACK,
2398                               h->ident, origlen, h+1);
2399         }
2400
2401         kfree (buf, M_TEMP);
2402         return (rlen == 0);
2403
2404 drop:
2405         kfree(buf, M_TEMP);
2406         return (-1);
2407 }
2408
2409 /*
2410  * Analyze the LCP Configure-Reject option list, and adjust our
2411  * negotiation.
2412  */
2413 static void
2414 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2415 {
2416         STDDCL;
2417         u_char *buf, *p;
2418
2419         len -= 4;
2420         buf = kmalloc (len, M_TEMP, M_INTWAIT);
2421
2422         if (debug)
2423                 log(LOG_DEBUG, SPP_FMT "lcp rej opts: ",
2424                     SPP_ARGS(ifp));
2425
2426         p = (void*) (h+1);
2427         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2428                 /* Sanity check option length */
2429                 if (p[1] > len) {
2430                         /*
2431                          * Malicious option - drop immediately.
2432                          * XXX Maybe we should just RXJ it?
2433                          */
2434                         log(-1, "%s: received malicious LCP option, "
2435                             "dropping.\n", ifp->if_xname);
2436                         goto drop;
2437                 }
2438                 if (debug)
2439                         log(-1, " %s ", sppp_lcp_opt_name(*p));
2440                 switch (*p) {
2441                 case LCP_OPT_MAGIC:
2442                         /* Magic number -- can't use it, use 0 */
2443                         sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2444                         sp->lcp.magic = 0;
2445                         break;
2446                 case LCP_OPT_MRU:
2447                         /*
2448                          * Should not be rejected anyway, since we only
2449                          * negotiate a MRU if explicitly requested by
2450                          * peer.
2451                          */
2452                         sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2453                         break;
2454                 case LCP_OPT_AUTH_PROTO:
2455                         /*
2456                          * Peer doesn't want to authenticate himself,
2457                          * deny unless this is a dialout call, and
2458                          * AUTHFLAG_NOCALLOUT is set.
2459                          */
2460                         if ((sp->pp_flags & PP_CALLIN) == 0 &&
2461                             (sp->hisauth.flags & AUTHFLAG_NOCALLOUT) != 0) {
2462                                 if (debug)
2463                                         log(-1, "[don't insist on auth "
2464                                                "for callout]");
2465                                 sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2466                                 break;
2467                         }
2468                         if (debug)
2469                                 log(-1, "[access denied]\n");
2470                         lcp.Close(sp);
2471                         break;
2472                 }
2473         }
2474         if (debug)
2475                 log(-1, "\n");
2476 drop:
2477         kfree (buf, M_TEMP);
2478         return;
2479 }
2480
2481 /*
2482  * Analyze the LCP Configure-NAK option list, and adjust our
2483  * negotiation.
2484  */
2485 static void
2486 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2487 {
2488         STDDCL;
2489         u_char *buf, *p;
2490         u_long magic;
2491
2492         len -= 4;
2493         buf = kmalloc (len, M_TEMP, M_INTWAIT);
2494
2495         if (debug)
2496                 log(LOG_DEBUG, SPP_FMT "lcp nak opts: ",
2497                     SPP_ARGS(ifp));
2498
2499         p = (void*) (h+1);
2500         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
2501                 /* Sanity check option length */
2502                 if (p[1] > len) {
2503                         /*
2504                          * Malicious option - drop immediately.
2505                          * XXX Maybe we should just RXJ it?
2506                          */
2507                         log(-1, "%s: received malicious LCP option, "
2508                             "dropping.\n", ifp->if_xname);
2509                         goto drop;
2510                 }
2511                 if (debug)
2512                         log(-1, " %s ", sppp_lcp_opt_name(*p));
2513                 switch (*p) {
2514                 case LCP_OPT_MAGIC:
2515                         /* Magic number -- renegotiate */
2516                         if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2517                             len >= 6 && p[1] == 6) {
2518                                 magic = (u_long)p[2] << 24 |
2519                                         (u_long)p[3] << 16 | p[4] << 8 | p[5];
2520                                 /*
2521                                  * If the remote magic is our negated one,
2522                                  * this looks like a loopback problem.
2523                                  * Suggest a new magic to make sure.
2524                                  */
2525                                 if (magic == ~sp->lcp.magic) {
2526                                         if (debug)
2527                                                 log(-1, "magic glitch ");
2528                                         sp->lcp.magic = krandom();
2529                                 } else {
2530                                         sp->lcp.magic = magic;
2531                                         if (debug)
2532                                                 log(-1, "%lu ", magic);
2533                                 }
2534                         }
2535                         break;
2536                 case LCP_OPT_MRU:
2537                         /*
2538                          * Peer wants to advise us to negotiate an MRU.
2539                          * Agree on it if it's reasonable, or use
2540                          * default otherwise.
2541                          */
2542                         if (len >= 4 && p[1] == 4) {
2543                                 u_int mru = p[2] * 256 + p[3];
2544                                 if (debug)
2545                                         log(-1, "%d ", mru);
2546                                 if (mru < PP_MTU || mru > PP_MAX_MRU)
2547                                         mru = PP_MTU;
2548                                 sp->lcp.mru = mru;
2549                                 sp->lcp.opts |= (1 << LCP_OPT_MRU);
2550                         }
2551                         break;
2552                 case LCP_OPT_AUTH_PROTO:
2553                         /*
2554                          * Peer doesn't like our authentication method,
2555                          * deny.
2556                          */
2557                         if (debug)
2558                                 log(-1, "[access denied]\n");
2559                         lcp.Close(sp);
2560                         break;
2561                 }
2562         }
2563         if (debug)
2564                 log(-1, "\n");
2565 drop:
2566         kfree (buf, M_TEMP);
2567         return;
2568 }
2569
2570 static void
2571 sppp_lcp_tlu(struct sppp *sp)
2572 {
2573         STDDCL;
2574         int i;
2575         u_long mask;
2576
2577         /* XXX ? */
2578         if (! (ifp->if_flags & IFF_UP) &&
2579             (ifp->if_flags & IFF_RUNNING)) {
2580                 /* Coming out of loopback mode. */
2581                 if_up(ifp);
2582                 kprintf (SPP_FMT "up\n", SPP_ARGS(ifp));
2583         }
2584
2585         for (i = 0; i < IDX_COUNT; i++)
2586                 if ((cps[i])->flags & CP_QUAL)
2587                         (cps[i])->Open(sp);
2588
2589         if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2590             (sp->pp_flags & PP_NEEDAUTH) != 0)
2591                 sp->pp_phase = PHASE_AUTHENTICATE;
2592         else
2593                 sp->pp_phase = PHASE_NETWORK;
2594
2595         if (debug)
2596                 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2597                     sppp_phase_name(sp->pp_phase));
2598
2599         /*
2600          * Open all authentication protocols.  This is even required
2601          * if we already proceeded to network phase, since it might be
2602          * that remote wants us to authenticate, so we might have to
2603          * send a PAP request.  Undesired authentication protocols
2604          * don't do anything when they get an Open event.
2605          */
2606         for (i = 0; i < IDX_COUNT; i++)
2607                 if ((cps[i])->flags & CP_AUTH)
2608                         (cps[i])->Open(sp);
2609
2610         if (sp->pp_phase == PHASE_NETWORK) {
2611                 /* Notify all NCPs. */
2612                 for (i = 0; i < IDX_COUNT; i++)
2613                         if (((cps[i])->flags & CP_NCP) &&
2614                             /*
2615                              * XXX
2616                              * Hack to administratively disable IPv6 if
2617                              * not desired.  Perhaps we should have another
2618                              * flag for this, but right now, we can make
2619                              * all struct cp's read/only.
2620                              */
2621                             (cps[i] != &ipv6cp ||
2622                              (sp->confflags & CONF_ENABLE_IPV6)))
2623                                 (cps[i])->Open(sp);
2624         }
2625
2626         /* Send Up events to all started protos. */
2627         for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2628                 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0)
2629                         (cps[i])->Up(sp);
2630
2631         /* notify low-level driver of state change */
2632         if (sp->pp_chg)
2633                 sp->pp_chg(sp, (int)sp->pp_phase);
2634         
2635         if (sp->pp_phase == PHASE_NETWORK)
2636                 /* if no NCP is starting, close down */
2637                 sppp_lcp_check_and_close(sp);
2638 }
2639
2640 static void
2641 sppp_lcp_tld(struct sppp *sp)
2642 {
2643         STDDCL;
2644         int i;
2645         u_long mask;
2646
2647         sp->pp_phase = PHASE_TERMINATE;
2648
2649         if (debug)
2650                 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2651                     sppp_phase_name(sp->pp_phase));
2652
2653         /*
2654          * Take upper layers down.  We send the Down event first and
2655          * the Close second to prevent the upper layers from sending
2656          * ``a flurry of terminate-request packets'', as the RFC
2657          * describes it.
2658          */
2659         for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2660                 if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
2661                         (cps[i])->Down(sp);
2662                         (cps[i])->Close(sp);
2663                 }
2664 }
2665
2666 static void
2667 sppp_lcp_tls(struct sppp *sp)
2668 {
2669         STDDCL;
2670
2671         sp->pp_phase = PHASE_ESTABLISH;
2672
2673         if (debug)
2674                 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2675                     sppp_phase_name(sp->pp_phase));
2676
2677         /* Notify lower layer if desired. */
2678         if (sp->pp_tls)
2679                 (sp->pp_tls)(sp);
2680         else
2681                 (sp->pp_up)(sp);
2682 }
2683
2684 static void
2685 sppp_lcp_tlf(struct sppp *sp)
2686 {
2687         STDDCL;
2688
2689         sp->pp_phase = PHASE_DEAD;
2690         if (debug)
2691                 log(LOG_DEBUG, SPP_FMT "phase %s\n", SPP_ARGS(ifp),
2692                     sppp_phase_name(sp->pp_phase));
2693
2694         /* Notify lower layer if desired. */
2695         if (sp->pp_tlf)
2696                 (sp->pp_tlf)(sp);
2697         else
2698                 (sp->pp_down)(sp);
2699 }
2700
2701 static void
2702 sppp_lcp_scr(struct sppp *sp)
2703 {
2704         char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2705         int i = 0;
2706         u_short authproto;
2707
2708         if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2709                 if (! sp->lcp.magic)
2710                         sp->lcp.magic = krandom();
2711                 opt[i++] = LCP_OPT_MAGIC;
2712                 opt[i++] = 6;
2713                 opt[i++] = sp->lcp.magic >> 24;
2714                 opt[i++] = sp->lcp.magic >> 16;
2715                 opt[i++] = sp->lcp.magic >> 8;
2716                 opt[i++] = sp->lcp.magic;
2717         }
2718
2719         if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2720                 opt[i++] = LCP_OPT_MRU;
2721                 opt[i++] = 4;
2722                 opt[i++] = sp->lcp.mru >> 8;
2723                 opt[i++] = sp->lcp.mru;
2724         }
2725
2726         if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2727                 authproto = sp->hisauth.proto;
2728                 opt[i++] = LCP_OPT_AUTH_PROTO;
2729                 opt[i++] = authproto == PPP_CHAP? 5: 4;
2730                 opt[i++] = authproto >> 8;
2731                 opt[i++] = authproto;
2732                 if (authproto == PPP_CHAP)
2733                         opt[i++] = CHAP_MD5;
2734         }
2735
2736         sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
2737         sppp_cp_send (sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
2738 }
2739
2740 /*
2741  * Check the open NCPs, return true if at least one NCP is open.
2742  */
2743 static int
2744 sppp_ncp_check(struct sppp *sp)
2745 {
2746         int i, mask;
2747
2748         for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2749                 if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
2750                         return 1;
2751         return 0;
2752 }
2753
2754 /*
2755  * Re-check the open NCPs and see if we should terminate the link.
2756  * Called by the NCPs during their tlf action handling.
2757  */
2758 static void
2759 sppp_lcp_check_and_close(struct sppp *sp)
2760 {
2761
2762         if (sp->pp_phase < PHASE_NETWORK)
2763                 /* don't bother, we are already going down */
2764                 return;
2765
2766         if (sppp_ncp_check(sp))
2767                 return;
2768
2769         lcp.Close(sp);
2770 }
2771
2772 /*
2773  *--------------------------------------------------------------------------*
2774  *                                                                          *
2775  *                        The IPCP implementation.                          *
2776  *                                                                          *
2777  *--------------------------------------------------------------------------*
2778  */
2779
2780 static void
2781 sppp_ipcp_init(struct sppp *sp)
2782 {
2783         sp->ipcp.opts = 0;
2784         sp->ipcp.flags = 0;
2785         sp->state[IDX_IPCP] = STATE_INITIAL;
2786         sp->fail_counter[IDX_IPCP] = 0;
2787         sp->pp_seq[IDX_IPCP] = 0;
2788         sp->pp_rseq[IDX_IPCP] = 0;
2789         callout_init(&sp->timeout[IDX_IPCP]);
2790 }
2791
2792 static void
2793 sppp_ipcp_up(struct sppp *sp)
2794 {
2795         sppp_up_event(&ipcp, sp);
2796 }
2797
2798 static void
2799 sppp_ipcp_down(struct sppp *sp)
2800 {
2801         sppp_down_event(&ipcp, sp);
2802 }
2803
2804 static void
2805 sppp_ipcp_open(struct sppp *sp)
2806 {
2807         STDDCL;
2808         u_long myaddr, hisaddr;
2809
2810         sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN | IPCP_MYADDR_SEEN |
2811                             IPCP_MYADDR_DYN | IPCP_VJ);
2812         sp->ipcp.opts = 0;
2813
2814         sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
2815         /*
2816          * If we don't have his address, this probably means our
2817          * interface doesn't want to talk IP at all.  (This could
2818          * be the case if somebody wants to speak only IPX, for
2819          * example.)  Don't open IPCP in this case.
2820          */
2821         if (hisaddr == 0L) {
2822                 /* XXX this message should go away */
2823                 if (debug)
2824                         log(LOG_DEBUG, SPP_FMT "ipcp_open(): no IP interface\n",
2825                             SPP_ARGS(ifp));
2826                 return;
2827         }
2828         if (myaddr == 0L) {
2829                 /*
2830                  * I don't have an assigned address, so i need to
2831                  * negotiate my address.
2832                  */
2833                 sp->ipcp.flags |= IPCP_MYADDR_DYN;
2834                 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
2835         } else
2836                 sp->ipcp.flags |= IPCP_MYADDR_SEEN;
2837         if (sp->confflags & CONF_ENABLE_VJ) {
2838                 sp->ipcp.opts |= (1 << IPCP_OPT_COMPRESSION);
2839                 sp->ipcp.max_state = MAX_STATES - 1;
2840                 sp->ipcp.compress_cid = 1;
2841         }
2842         sppp_open_event(&ipcp, sp);
2843 }
2844
2845 static void
2846 sppp_ipcp_close(struct sppp *sp)
2847 {
2848         sppp_close_event(&ipcp, sp);
2849         if (sp->ipcp.flags & IPCP_MYADDR_DYN)
2850                 /*
2851                  * My address was dynamic, clear it again.
2852                  */
2853                 sppp_set_ip_addr(sp, 0L);
2854 }
2855
2856 static void
2857 sppp_ipcp_TO(void *cookie)
2858 {
2859         sppp_to_event(&ipcp, (struct sppp *)cookie);
2860 }
2861
2862 /*
2863  * Analyze a configure request.  Return true if it was agreeable, and
2864  * caused action sca, false if it has been rejected or nak'ed, and
2865  * caused action scn.  (The return value is used to make the state
2866  * transition decision in the state automaton.)
2867  */
2868 static int
2869 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2870 {
2871         u_char *buf, *r, *p;
2872         struct ifnet *ifp = &sp->pp_if;
2873         int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
2874         u_long hisaddr, desiredaddr;
2875         int gotmyaddr = 0;
2876         int desiredcomp;
2877
2878         len -= 4;
2879         origlen = len;
2880         /*
2881          * Make sure to allocate a buf that can at least hold a
2882          * conf-nak with an `address' option.  We might need it below.
2883          */
2884         buf = r = kmalloc ((len < 6? 6: len), M_TEMP, M_INTWAIT);
2885
2886         /* pass 1: see if we can recognize them */
2887         if (debug)
2888                 log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
2889                     SPP_ARGS(ifp));
2890         p = (void*) (h+1);
2891         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2892                 /* Sanity check option length */
2893                 if (p[1] > len) {
2894                         /* XXX should we just RXJ? */
2895                         log(-1, "%s: malicious IPCP option received, dropping\n",
2896                             ifp->if_xname);
2897                         goto drop;
2898                 }
2899                 if (debug)
2900                         log(-1, " %s ", sppp_ipcp_opt_name(*p));
2901                 switch (*p) {
2902                 case IPCP_OPT_COMPRESSION:
2903                         if (!(sp->confflags & CONF_ENABLE_VJ)) {
2904                                 /* VJ compression administratively disabled */
2905                                 if (debug)
2906                                         log(-1, "[locally disabled] ");
2907                                 break;
2908                         }
2909                         /*
2910                          * In theory, we should only conf-rej an
2911                          * option that is shorter than RFC 1618
2912                          * requires (i.e. < 4), and should conf-nak
2913                          * anything else that is not VJ.  However,
2914                          * since our algorithm always uses the
2915                          * original option to NAK it with new values,
2916                          * things would become more complicated.  In
2917                          * pratice, the only commonly implemented IP
2918                          * compression option is VJ anyway, so the
2919                          * difference is negligible.
2920                          */
2921                         if (len >= 6 && p[1] == 6) {
2922                                 /*
2923                                  * correctly formed compression option
2924                                  * that could be VJ compression
2925                                  */
2926                                 continue;
2927                         }
2928                         if (debug)
2929                                 log(-1, "optlen %d [invalid/unsupported] ",
2930                                     p[1]);
2931                         break;
2932                 case IPCP_OPT_ADDRESS:
2933                         if (len >= 6 && p[1] == 6) {
2934                                 /* correctly formed address option */
2935                                 continue;
2936                         }
2937                         if (debug)
2938                                 log(-1, "[invalid] ");
2939                         break;
2940                 default:
2941                         /* Others not supported. */
2942                         if (debug)
2943                                 log(-1, "[rej] ");
2944                         break;
2945                 }
2946                 /* Add the option to rejected list. */
2947                 bcopy (p, r, p[1]);
2948                 r += p[1];
2949                 rlen += p[1];
2950         }
2951         if (rlen) {
2952                 if (debug)
2953                         log(-1, " send conf-rej\n");
2954                 sppp_cp_send (sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
2955                 return 0;
2956         } else if (debug)
2957                 log(-1, "\n");
2958
2959         /* pass 2: parse option values */
2960         sppp_get_ip_addrs(sp, 0, &hisaddr, 0);
2961         if (debug)
2962                 log(LOG_DEBUG, SPP_FMT "ipcp parse opt values: ",
2963                        SPP_ARGS(ifp));
2964         p = (void*) (h+1);
2965         len = origlen;
2966         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
2967                 if (debug)
2968                         log(-1, " %s ", sppp_ipcp_opt_name(*p));
2969                 switch (*p) {
2970                 case IPCP_OPT_COMPRESSION:
2971                         desiredcomp = p[2] << 8 | p[3];
2972                         /* We only support VJ */
2973                         if (desiredcomp == IPCP_COMP_VJ) {
2974                                 if (debug)
2975                                         log(-1, "VJ [ack] ");
2976                                 sp->ipcp.flags |= IPCP_VJ;
2977                                 sl_compress_init(sp->pp_comp, p[4]);
2978                                 sp->ipcp.max_state = p[4];
2979                                 sp->ipcp.compress_cid = p[5];
2980                                 continue;
2981                         }
2982                         if (debug)
2983                                 log(-1, "compproto %#04x [not supported] ",
2984                                     desiredcomp);
2985                         p[2] = IPCP_COMP_VJ >> 8;
2986                         p[3] = IPCP_COMP_VJ;
2987                         p[4] = sp->ipcp.max_state;
2988                         p[5] = sp->ipcp.compress_cid;
2989                         break;
2990                 case IPCP_OPT_ADDRESS:
2991                         /* This is the address he wants in his end */
2992                         desiredaddr = p[2] << 24 | p[3] << 16 |
2993                                 p[4] << 8 | p[5];
2994                         if (desiredaddr == hisaddr ||
2995                             (hisaddr >= 1 && hisaddr <= 254 && desiredaddr != 0)) {
2996                                 /*
2997                                  * Peer's address is same as our value,
2998                                  * or we have set it to 0.0.0.* to
2999                                  * indicate that we do not really care,
3000                                  * this is agreeable.  Gonna conf-ack
3001                                  * it.
3002                                  */
3003                                 if (debug)
3004                                         log(-1, "%s [ack] ",
3005                                                 sppp_dotted_quad(hisaddr));
3006                                 /* record that we've seen it already */
3007                                 sp->ipcp.flags |= IPCP_HISADDR_SEEN;
3008                                 continue;
3009                         }
3010                         /*
3011                          * The address wasn't agreeable.  This is either
3012                          * he sent us 0.0.0.0, asking to assign him an
3013                          * address, or he send us another address not
3014                          * matching our value.  Either case, we gonna
3015                          * conf-nak it with our value.
3016                          * XXX: we should "rej" if hisaddr == 0
3017                          */
3018                         if (debug) {
3019                                 if (desiredaddr == 0)
3020                                         log(-1, "[addr requested] ");
3021                                 else
3022                                         log(-1, "%s [not agreed] ",
3023                                                 sppp_dotted_quad(desiredaddr));
3024
3025                         }
3026                         p[2] = hisaddr >> 24;
3027                         p[3] = hisaddr >> 16;
3028                         p[4] = hisaddr >> 8;
3029                         p[5] = hisaddr;
3030                         break;
3031                 }
3032                 /* Add the option to nak'ed list. */
3033                 bcopy (p, r, p[1]);
3034                 r += p[1];
3035                 rlen += p[1];
3036         }
3037
3038         /*
3039          * If we are about to conf-ack the request, but haven't seen
3040          * his address so far, gonna conf-nak it instead, with the
3041          * `address' option present and our idea of his address being
3042          * filled in there, to request negotiation of both addresses.
3043          *
3044          * XXX This can result in an endless req - nak loop if peer
3045          * doesn't want to send us his address.  Q: What should we do
3046          * about it?  XXX  A: implement the max-failure counter.
3047          */
3048         if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN) && !gotmyaddr) {
3049                 buf[0] = IPCP_OPT_ADDRESS;
3050                 buf[1] = 6;
3051                 buf[2] = hisaddr >> 24;
3052                 buf[3] = hisaddr >> 16;
3053                 buf[4] = hisaddr >> 8;
3054                 buf[5] = hisaddr;
3055                 rlen = 6;
3056                 if (debug)
3057                         log(-1, "still need hisaddr ");
3058         }
3059
3060         if (rlen) {
3061                 if (debug)
3062                         log(-1, " send conf-nak\n");
3063                 sppp_cp_send (sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
3064         } else {
3065                 if (debug)
3066                         log(-1, " send conf-ack\n");
3067                 sppp_cp_send (sp, PPP_IPCP, CONF_ACK,
3068                               h->ident, origlen, h+1);
3069         }
3070
3071         kfree (buf, M_TEMP);
3072         return (rlen == 0);
3073
3074 drop:
3075         kfree(buf, M_TEMP);
3076         return (-1);
3077 }
3078
3079 /*
3080  * Analyze the IPCP Configure-Reject option list, and adjust our
3081  * negotiation.
3082  */
3083 static void
3084 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3085 {
3086         u_char *buf, *p;
3087         struct ifnet *ifp = &sp->pp_if;
3088         int debug = ifp->if_flags & IFF_DEBUG;
3089
3090         len -= 4;
3091         buf = kmalloc (len, M_TEMP, M_INTWAIT);
3092
3093         if (debug)
3094                 log(LOG_DEBUG, SPP_FMT "ipcp rej opts: ",
3095                     SPP_ARGS(ifp));
3096
3097         p = (void*) (h+1);
3098         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3099                 /* Sanity check option length */
3100                 if (p[1] > len) {
3101                         /* XXX should we just RXJ? */
3102                         log(-1, "%s: malicious IPCP option received, dropping\n",
3103                             ifp->if_xname);
3104                         goto drop;
3105                 }
3106                 if (debug)
3107                         log(-1, " %s ", sppp_ipcp_opt_name(*p));
3108                 switch (*p) {
3109                 case IPCP_OPT_COMPRESSION:
3110                         sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESSION);
3111                         break;
3112                 case IPCP_OPT_ADDRESS:
3113                         /*
3114                          * Peer doesn't grok address option.  This is
3115                          * bad.  XXX  Should we better give up here?
3116                          * XXX We could try old "addresses" option...
3117                          */
3118                         sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
3119                         break;
3120                 }
3121         }
3122         if (debug)
3123                 log(-1, "\n");
3124 drop:
3125         kfree (buf, M_TEMP);
3126         return;
3127 }
3128
3129 /*
3130  * Analyze the IPCP Configure-NAK option list, and adjust our
3131  * negotiation.
3132  */
3133 static void
3134 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3135 {
3136         u_char *buf, *p;
3137         struct ifnet *ifp = &sp->pp_if;
3138         int debug = ifp->if_flags & IFF_DEBUG;
3139         int desiredcomp;
3140         u_long wantaddr;
3141
3142         len -= 4;
3143         buf = kmalloc (len, M_TEMP, M_INTWAIT);
3144
3145         if (debug)
3146                 log(LOG_DEBUG, SPP_FMT "ipcp nak opts: ",
3147                     SPP_ARGS(ifp));
3148
3149         p = (void*) (h+1);
3150         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3151                 /* Sanity check option length */
3152                 if (p[1] > len) {
3153                         /* XXX should we just RXJ? */
3154                         log(-1, "%s: malicious IPCP option received, dropping\n",
3155                             ifp->if_xname);
3156                         return;
3157                 }
3158                 if (debug)
3159                         log(-1, " %s ", sppp_ipcp_opt_name(*p));
3160                 switch (*p) {
3161                 case IPCP_OPT_COMPRESSION:
3162                         if (len >= 6 && p[1] == 6) {
3163                                 desiredcomp = p[2] << 8 | p[3];
3164                                 if (debug)
3165                                         log(-1, "[wantcomp %#04x] ",
3166                                                 desiredcomp);
3167                                 if (desiredcomp == IPCP_COMP_VJ) {
3168                                         sl_compress_init(sp->pp_comp, p[4]);
3169                                         sp->ipcp.max_state = p[4];
3170                                         sp->ipcp.compress_cid = p[5];
3171                                         if (debug)
3172                                                 log(-1, "[agree] ");
3173                                 } else
3174                                         sp->ipcp.opts &=
3175                                                 ~(1 << IPCP_OPT_COMPRESSION);
3176                         }
3177                         break;
3178                 case IPCP_OPT_ADDRESS:
3179                         /*
3180                          * Peer doesn't like our local IP address.  See
3181                          * if we can do something for him.  We'll drop
3182                          * him our address then.
3183                          */
3184                         if (len >= 6 && p[1] == 6) {
3185                                 wantaddr = p[2] << 24 | p[3] << 16 |
3186                                         p[4] << 8 | p[5];
3187                                 sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
3188                                 if (debug)
3189                                         log(-1, "[wantaddr %s] ",
3190                                                sppp_dotted_quad(wantaddr));
3191                                 /*
3192                                  * When doing dynamic address assignment,
3193                                  * we accept his offer.  Otherwise, we
3194                                  * ignore it and thus continue to negotiate
3195                                  * our already existing value.
3196                                  * XXX: Bogus, if he said no once, he'll
3197                                  * just say no again, might as well die.
3198                                  */
3199                                 if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
3200                                         sppp_set_ip_addr(sp, wantaddr);
3201                                         if (debug)
3202                                                 log(-1, "[agree] ");
3203                                         sp->ipcp.flags |= IPCP_MYADDR_SEEN;
3204                                 }
3205                         }
3206                         break;
3207                 }
3208         }
3209         if (debug)
3210                 log(-1, "\n");
3211         kfree (buf, M_TEMP);
3212         return;
3213 }
3214
3215 static void
3216 sppp_ipcp_tlu(struct sppp *sp)
3217 {
3218         /* we are up - notify isdn daemon */
3219         if (sp->pp_con)
3220                 sp->pp_con(sp);
3221 }
3222
3223 static void
3224 sppp_ipcp_tld(struct sppp *sp)
3225 {
3226 }
3227
3228 static void
3229 sppp_ipcp_tls(struct sppp *sp)
3230 {
3231         /* indicate to LCP that it must stay alive */
3232         sp->lcp.protos |= (1 << IDX_IPCP);
3233 }
3234
3235 static void
3236 sppp_ipcp_tlf(struct sppp *sp)
3237 {
3238         /* we no longer need LCP */
3239         sp->lcp.protos &= ~(1 << IDX_IPCP);
3240         sppp_lcp_check_and_close(sp);
3241 }
3242
3243 static void
3244 sppp_ipcp_scr(struct sppp *sp)
3245 {
3246         char opt[6 /* compression */ + 6 /* address */];
3247         u_long ouraddr;
3248         int i = 0;
3249
3250         if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
3251                 opt[i++] = IPCP_OPT_COMPRESSION;
3252                 opt[i++] = 6;
3253                 opt[i++] = IPCP_COMP_VJ >> 8;
3254                 opt[i++] = IPCP_COMP_VJ;
3255                 opt[i++] = sp->ipcp.max_state;
3256                 opt[i++] = sp->ipcp.compress_cid;
3257         }
3258         if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
3259                 sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
3260                 opt[i++] = IPCP_OPT_ADDRESS;
3261                 opt[i++] = 6;
3262                 opt[i++] = ouraddr >> 24;
3263                 opt[i++] = ouraddr >> 16;
3264                 opt[i++] = ouraddr >> 8;
3265                 opt[i++] = ouraddr;
3266         }
3267
3268         sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
3269         sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
3270 }
3271
3272 /*
3273  *--------------------------------------------------------------------------*
3274  *                                                                          *
3275  *                      The IPv6CP implementation.                          *
3276  *                                                                          *
3277  *--------------------------------------------------------------------------*
3278  */
3279
3280 #ifdef INET6
3281 static void
3282 sppp_ipv6cp_init(struct sppp *sp)
3283 {
3284         sp->ipv6cp.opts = 0;
3285         sp->ipv6cp.flags = 0;
3286         sp->state[IDX_IPV6CP] = STATE_INITIAL;
3287         sp->fail_counter[IDX_IPV6CP] = 0;
3288         sp->pp_seq[IDX_IPV6CP] = 0;
3289         sp->pp_rseq[IDX_IPV6CP] = 0;
3290         callout_init(&sp->timeout[IDX_IPV6CP]);
3291 }
3292
3293 static void
3294 sppp_ipv6cp_up(struct sppp *sp)
3295 {
3296         sppp_up_event(&ipv6cp, sp);
3297 }
3298
3299 static void
3300 sppp_ipv6cp_down(struct sppp *sp)
3301 {
3302         sppp_down_event(&ipv6cp, sp);
3303 }
3304
3305 static void
3306 sppp_ipv6cp_open(struct sppp *sp)
3307 {
3308         STDDCL;
3309         struct in6_addr myaddr, hisaddr;
3310
3311 #ifdef IPV6CP_MYIFID_DYN
3312         sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
3313 #else
3314         sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
3315 #endif
3316
3317         sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
3318         /*
3319          * If we don't have our address, this probably means our
3320          * interface doesn't want to talk IPv6 at all.  (This could
3321          * be the case if somebody wants to speak only IPX, for
3322          * example.)  Don't open IPv6CP in this case.
3323          */
3324         if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
3325                 /* XXX this message should go away */
3326                 if (debug)
3327                         log(LOG_DEBUG, SPP_FMT "ipv6cp_open(): no IPv6 interface\n",
3328                             SPP_ARGS(ifp));
3329                 return;
3330         }
3331
3332         sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3333         sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3334         sppp_open_event(&ipv6cp, sp);
3335 }
3336
3337 static void
3338 sppp_ipv6cp_close(struct sppp *sp)
3339 {
3340         sppp_close_event(&ipv6cp, sp);
3341 }
3342
3343 static void
3344 sppp_ipv6cp_TO(void *cookie)
3345 {
3346         sppp_to_event(&ipv6cp, (struct sppp *)cookie);
3347 }
3348
3349 /*
3350  * Analyze a configure request.  Return true if it was agreeable, and
3351  * caused action sca, false if it has been rejected or nak'ed, and
3352  * caused action scn.  (The return value is used to make the state
3353  * transition decision in the state automaton.)
3354  */
3355 static int
3356 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3357 {
3358         u_char *buf, *r, *p;
3359         struct ifnet *ifp = &sp->pp_if;
3360         int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
3361         struct in6_addr myaddr, desiredaddr, suggestaddr;
3362         int ifidcount;
3363         int type;
3364         int collision, nohisaddr;
3365
3366         len -= 4;
3367         origlen = len;
3368         /*
3369          * Make sure to allocate a buf that can at least hold a
3370          * conf-nak with an `address' option.  We might need it below.
3371          */
3372         buf = r = kmalloc ((len < 6? 6: len), M_TEMP, M_INTWAIT);
3373
3374         /* pass 1: see if we can recognize them */
3375         if (debug)
3376                 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opts:",
3377                     SPP_ARGS(ifp));
3378         p = (void*) (h+1);
3379         ifidcount = 0;
3380         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3381                 /* Sanity check option length */
3382                 if (p[1] > len) {
3383                         /* XXX just RXJ? */
3384                         log(-1, "%s: received malicious IPCPv6 option, "
3385                             "dropping\n", ifp->if_xname);
3386                         goto drop;
3387                 }
3388                 if (debug)
3389                         log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3390                 switch (*p) {
3391                 case IPV6CP_OPT_IFID:
3392                         if (len >= 10 && p[1] == 10 && ifidcount == 0) {
3393                                 /* correctly formed address option */
3394                                 ifidcount++;
3395                                 continue;
3396                         }
3397                         if (debug)
3398                                 log(-1, " [invalid]");
3399                         break;
3400 #ifdef notyet
3401                 case IPV6CP_OPT_COMPRESSION:
3402                         if (len >= 4 && p[1] >= 4) {
3403                                 /* correctly formed compress option */
3404                                 continue;
3405                         }
3406                         if (debug)
3407                                 log(-1, " [invalid]");
3408                         break;
3409 #endif
3410                 default:
3411                         /* Others not supported. */
3412                         if (debug)
3413                                 log(-1, " [rej]");
3414                         break;
3415                 }
3416                 /* Add the option to rejected list. */
3417                 bcopy (p, r, p[1]);
3418                 r += p[1];
3419                 rlen += p[1];
3420         }
3421         if (rlen) {
3422                 if (debug)
3423                         log(-1, " send conf-rej\n");
3424                 sppp_cp_send (sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
3425                 goto end;
3426         } else if (debug)
3427                 log(-1, "\n");
3428
3429         /* pass 2: parse option values */
3430         sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
3431         if (debug)
3432                 log(LOG_DEBUG, SPP_FMT "ipv6cp parse opt values: ",
3433                     SPP_ARGS(ifp));
3434         p = (void*) (h+1);
3435         len = origlen;
3436         type = CONF_ACK;
3437         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
3438                 if (debug)
3439                         log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3440                 switch (*p) {
3441 #ifdef notyet
3442                 case IPV6CP_OPT_COMPRESSION:
3443                         continue;
3444 #endif
3445                 case IPV6CP_OPT_IFID:
3446                         bzero(&desiredaddr, sizeof(desiredaddr));
3447                         bcopy(&p[2], &desiredaddr.s6_addr[8], 8);
3448                         collision = (bcmp(&desiredaddr.s6_addr[8],
3449                                           &myaddr.s6_addr[8], 8) == 0);
3450                         nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
3451
3452                         desiredaddr.s6_addr16[0] = htons(0xfe80);
3453                         desiredaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
3454
3455                         if (!collision && !nohisaddr) {
3456                                 /* no collision, hisaddr known - Conf-Ack */
3457                                 type = CONF_ACK;
3458
3459                                 if (debug) {
3460                                         log(-1, " %s [%s]",
3461                                                ip6_sprintf(&desiredaddr),
3462                                                sppp_cp_type_name(type));
3463                                 }
3464                                 continue;
3465                         }
3466
3467                         bzero(&suggestaddr, sizeof(suggestaddr));
3468                         if (collision && nohisaddr) {
3469                                 /* collision, hisaddr unknown - Conf-Rej */
3470                                 type = CONF_REJ;
3471                                 bzero(&p[2], 8);
3472                         } else {
3473                                 /*
3474                                  * - no collision, hisaddr unknown, or
3475                                  * - collision, hisaddr known
3476                                  * Conf-Nak, suggest hisaddr
3477                                  */
3478                                 type = CONF_NAK;
3479                                 sppp_suggest_ip6_addr(sp, &suggestaddr);
3480                                 bcopy(&suggestaddr.s6_addr[8], &p[2], 8);
3481                         }
3482                         if (debug)
3483                                 log(-1, " %s [%s]", ip6_sprintf(&desiredaddr),
3484                                        sppp_cp_type_name(type));
3485                         break;
3486                 }
3487                 /* Add the option to nak'ed list. */
3488                 bcopy (p, r, p[1]);
3489                 r += p[1];
3490                 rlen += p[1];
3491         }
3492
3493         if (rlen == 0 && type == CONF_ACK) {
3494                 if (debug)
3495                         log(-1, " send %s\n", sppp_cp_type_name(type));
3496                 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, origlen, h+1);
3497         } else {
3498 #ifdef DIAGNOSTIC
3499                 if (type == CONF_ACK)
3500                         panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
3501 #endif
3502
3503                 if (debug) {
3504                         log(-1, " send %s suggest %s\n",
3505                                sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
3506                 }
3507                 sppp_cp_send (sp, PPP_IPV6CP, type, h->ident, rlen, buf);
3508         }
3509
3510  end:
3511         kfree (buf, M_TEMP);
3512         return (rlen == 0);
3513
3514 drop:
3515         kfree(buf, M_TEMP);
3516         return (-1);
3517 }
3518
3519 /*
3520  * Analyze the IPv6CP Configure-Reject option list, and adjust our
3521  * negotiation.
3522  */
3523 static void
3524 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3525 {
3526         u_char *buf, *p;
3527         struct ifnet *ifp = &sp->pp_if;
3528         int debug = ifp->if_flags & IFF_DEBUG;
3529
3530         len -= 4;
3531         buf = kmalloc (len, M_TEMP, M_INTWAIT);
3532
3533         if (debug)
3534                 log(LOG_DEBUG, SPP_FMT "ipv6cp rej opts:",
3535                     SPP_ARGS(ifp));
3536
3537         p = (void*) (h+1);
3538         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3539                 if (p[1] > len) {
3540                         /* XXX just RXJ? */
3541                         log(-1, "%s: received malicious IPCPv6 option, "
3542                             "dropping\n", ifp->if_xname);
3543                         goto drop;
3544                 }
3545                 if (debug)
3546                         log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3547                 switch (*p) {
3548                 case IPV6CP_OPT_IFID:
3549                         /*
3550                          * Peer doesn't grok address option.  This is
3551                          * bad.  XXX  Should we better give up here?
3552                          */
3553                         sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
3554                         break;
3555 #ifdef notyet
3556                 case IPV6CP_OPT_COMPRESS:
3557                         sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
3558                         break;
3559 #endif
3560                 }
3561         }
3562         if (debug)
3563                 log(-1, "\n");
3564 drop:
3565         kfree (buf, M_TEMP);
3566         return;
3567 }
3568
3569 /*
3570  * Analyze the IPv6CP Configure-NAK option list, and adjust our
3571  * negotiation.
3572  */
3573 static void
3574 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3575 {
3576         u_char *buf, *p;
3577         struct ifnet *ifp = &sp->pp_if;
3578         int debug = ifp->if_flags & IFF_DEBUG;
3579         struct in6_addr suggestaddr;
3580
3581         len -= 4;
3582         buf = kmalloc (len, M_TEMP, M_INTWAIT);
3583
3584         if (debug)
3585                 log(LOG_DEBUG, SPP_FMT "ipv6cp nak opts:",
3586                     SPP_ARGS(ifp));
3587
3588         p = (void*) (h+1);
3589         for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
3590                 if (p[1] > len) {
3591                         /* XXX just RXJ? */
3592                         log(-1, "%s: received malicious IPCPv6 option, "
3593                             "dropping\n", ifp->if_xname);
3594                         goto drop;
3595                 }
3596                 if (debug)
3597                         log(-1, " %s", sppp_ipv6cp_opt_name(*p));
3598                 switch (*p) {
3599                 case IPV6CP_OPT_IFID:
3600                         /*
3601                          * Peer doesn't like our local ifid.  See
3602                          * if we can do something for him.  We'll drop
3603                          * him our address then.
3604                          */
3605                         if (len < 10 || p[1] != 10)
3606                                 break;
3607                         bzero(&suggestaddr, sizeof(suggestaddr));
3608                         suggestaddr.s6_addr16[0] = htons(0xfe80);
3609                         suggestaddr.s6_addr16[1] = htons(sp->pp_if.if_index);
3610                         bcopy(&p[2], &suggestaddr.s6_addr[8], 8);
3611
3612                         sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3613                         if (debug)
3614                                 log(-1, " [suggestaddr %s]",
3615                                        ip6_sprintf(&suggestaddr));
3616 #ifdef IPV6CP_MYIFID_DYN
3617                         /*
3618                          * When doing dynamic address assignment,
3619                          * we accept his offer.
3620                          */
3621                         if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
3622                                 struct in6_addr lastsuggest;
3623                                 /*
3624                                  * If <suggested myaddr from peer> equals to
3625                                  * <hisaddr we have suggested last time>,
3626                                  * we have a collision.  generate new random
3627                                  * ifid.
3628                                  */
3629                                 sppp_suggest_ip6_addr(&lastsuggest);
3630                                 if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
3631                                                        lastsuggest)) {
3632                                         if (debug)
3633                                                 log(-1, " [random]");
3634                                         sppp_gen_ip6_addr(sp, &suggestaddr);
3635                                 }
3636                                 sppp_set_ip6_addr(sp, &suggestaddr, 0);
3637                                 if (debug)
3638                                         log(-1, " [agree]");
3639                                 sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3640                         }
3641 #else
3642                         /*
3643                          * Since we do not do dynamic address assignment,
3644                          * we ignore it and thus continue to negotiate
3645                          * our already existing value.  This can possibly
3646                          * go into infinite request-reject loop.
3647                          *
3648                          * This is not likely because we normally use
3649                          * ifid based on MAC-address.
3650                          * If you have no ethernet card on the node, too bad.
3651                          * XXX should we use fail_counter?
3652                          */
3653 #endif
3654                         break;
3655 #ifdef notyet
3656                 case IPV6CP_OPT_COMPRESS:
3657                         /*
3658                          * Peer wants different compression parameters.
3659                          */
3660                         break;
3661 #endif
3662                 }
3663         }
3664         if (debug)
3665                 log(-1, "\n");
3666 drop:
3667         kfree (buf, M_TEMP);
3668         return;
3669 }
3670 static void
3671 sppp_ipv6cp_tlu(struct sppp *sp)
3672 {
3673         /* we are up - notify isdn daemon */
3674         if (sp->pp_con)
3675                 sp->pp_con(sp);
3676 }
3677
3678 static void
3679 sppp_ipv6cp_tld(struct sppp *sp)
3680 {
3681 }
3682
3683 static void
3684 sppp_ipv6cp_tls(struct sppp *sp)
3685 {
3686         /* indicate to LCP that it must stay alive */
3687         sp->lcp.protos |= (1 << IDX_IPV6CP);
3688 }
3689
3690 static void
3691 sppp_ipv6cp_tlf(struct sppp *sp)
3692 {
3693
3694 #if 0   /* need #if 0 to close IPv6CP properly */
3695         /* we no longer need LCP */
3696         sp->lcp.protos &= ~(1 << IDX_IPV6CP);
3697         sppp_lcp_check_and_close(sp);
3698 #endif
3699 }
3700