xref: /netbsd-src/sys/net/if_spppsubr.c (revision e89934bbf778a6d6d6894877c4da59d0c7835b0f)
1 /*	$NetBSD: if_spppsubr.c,v 1.167 2017/01/16 15:44:46 christos Exp $	 */
2 
3 /*
4  * Synchronous PPP/Cisco link level subroutines.
5  * Keepalive protocol implemented in both Cisco and PPP modes.
6  *
7  * Copyright (C) 1994-1996 Cronyx Engineering Ltd.
8  * Author: Serge Vakulenko, <vak@cronyx.ru>
9  *
10  * Heavily revamped to conform to RFC 1661.
11  * Copyright (C) 1997, Joerg Wunsch.
12  *
13  * RFC2472 IPv6CP support.
14  * Copyright (C) 2000, Jun-ichiro itojun Hagino <itojun@iijlab.net>.
15  *
16  * Redistribution and use in source and binary forms, with or without
17  * modification, are permitted provided that the following conditions are met:
18  * 1. Redistributions of source code must retain the above copyright notice,
19  *    this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright notice,
21  *    this list of conditions and the following disclaimer in the documentation
22  *    and/or other materials provided with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
25  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE
28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  *
36  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
37  *
38  * From: if_spppsubr.c,v 1.39 1998/04/04 13:26:03 phk Exp
39  *
40  * From: Id: if_spppsubr.c,v 1.23 1999/02/23 14:47:50 hm Exp
41  */
42 
43 #include <sys/cdefs.h>
44 __KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.167 2017/01/16 15:44:46 christos Exp $");
45 
46 #if defined(_KERNEL_OPT)
47 #include "opt_inet.h"
48 #include "opt_modular.h"
49 #include "opt_compat_netbsd.h"
50 #include "opt_net_mpsafe.h"
51 #endif
52 
53 
54 #include <sys/param.h>
55 #include <sys/proc.h>
56 #include <sys/systm.h>
57 #include <sys/kernel.h>
58 #include <sys/sockio.h>
59 #include <sys/socket.h>
60 #include <sys/syslog.h>
61 #include <sys/malloc.h>
62 #include <sys/mbuf.h>
63 #include <sys/callout.h>
64 #include <sys/md5.h>
65 #include <sys/inttypes.h>
66 #include <sys/kauth.h>
67 #include <sys/cprng.h>
68 #include <sys/module.h>
69 #include <sys/workqueue.h>
70 #include <sys/atomic.h>
71 
72 #include <net/if.h>
73 #include <net/netisr.h>
74 #include <net/if_types.h>
75 #include <net/route.h>
76 #include <net/ppp_defs.h>
77 
78 #include <netinet/in.h>
79 #include <netinet/in_systm.h>
80 #include <netinet/in_var.h>
81 #ifdef INET
82 #include <netinet/ip.h>
83 #include <netinet/tcp.h>
84 #endif
85 #include <net/ethertypes.h>
86 
87 #ifdef INET6
88 #include <netinet6/scope6_var.h>
89 #endif
90 
91 #include <net/if_sppp.h>
92 #include <net/if_spppvar.h>
93 
94 #ifdef NET_MPSAFE
95 #define SPPPSUBR_MPSAFE	1
96 #endif
97 
98 #define	LCP_KEEPALIVE_INTERVAL		10	/* seconds between checks */
99 #define LOOPALIVECNT     		3	/* loopback detection tries */
100 #define DEFAULT_MAXALIVECNT    		3	/* max. missed alive packets */
101 #define	DEFAULT_NORECV_TIME		15	/* before we get worried */
102 #define DEFAULT_MAX_AUTH_FAILURES	5	/* max. auth. failures */
103 
104 /*
105  * Interface flags that can be set in an ifconfig command.
106  *
107  * Setting link0 will make the link passive, i.e. it will be marked
108  * as being administrative openable, but won't be opened to begin
109  * with.  Incoming calls will be answered, or subsequent calls with
110  * -link1 will cause the administrative open of the LCP layer.
111  *
112  * Setting link1 will cause the link to auto-dial only as packets
113  * arrive to be sent.
114  *
115  * Setting IFF_DEBUG will syslog the option negotiation and state
116  * transitions at level kern.debug.  Note: all logs consistently look
117  * like
118  *
119  *   <if-name><unit>: <proto-name> <additional info...>
120  *
121  * with <if-name><unit> being something like "bppp0", and <proto-name>
122  * being one of "lcp", "ipcp", "cisco", "chap", "pap", etc.
123  */
124 
125 #define IFF_PASSIVE	IFF_LINK0	/* wait passively for connection */
126 #define IFF_AUTO	IFF_LINK1	/* auto-dial on output */
127 
128 #define CONF_REQ	1		/* PPP configure request */
129 #define CONF_ACK	2		/* PPP configure acknowledge */
130 #define CONF_NAK	3		/* PPP configure negative ack */
131 #define CONF_REJ	4		/* PPP configure reject */
132 #define TERM_REQ	5		/* PPP terminate request */
133 #define TERM_ACK	6		/* PPP terminate acknowledge */
134 #define CODE_REJ	7		/* PPP code reject */
135 #define PROTO_REJ	8		/* PPP protocol reject */
136 #define ECHO_REQ	9		/* PPP echo request */
137 #define ECHO_REPLY	10		/* PPP echo reply */
138 #define DISC_REQ	11		/* PPP discard request */
139 
140 #define LCP_OPT_MRU		1	/* maximum receive unit */
141 #define LCP_OPT_ASYNC_MAP	2	/* async control character map */
142 #define LCP_OPT_AUTH_PROTO	3	/* authentication protocol */
143 #define LCP_OPT_QUAL_PROTO	4	/* quality protocol */
144 #define LCP_OPT_MAGIC		5	/* magic number */
145 #define LCP_OPT_RESERVED	6	/* reserved */
146 #define LCP_OPT_PROTO_COMP	7	/* protocol field compression */
147 #define LCP_OPT_ADDR_COMP	8	/* address/control field compression */
148 
149 #define IPCP_OPT_ADDRESSES	1	/* both IP addresses; deprecated */
150 #define IPCP_OPT_COMPRESSION	2	/* IP compression protocol */
151 #define IPCP_OPT_ADDRESS	3	/* local IP address */
152 #define	IPCP_OPT_PRIMDNS	129	/* primary remote dns address */
153 #define	IPCP_OPT_SECDNS		131	/* secondary remote dns address */
154 
155 #define IPCP_UPDATE_LIMIT	8	/* limit of pending IP updating job */
156 #define IPCP_SET_ADDRS		1	/* marker for IP address setting job */
157 #define IPCP_CLEAR_ADDRS	2	/* marker for IP address clearing job */
158 
159 #define IPV6CP_OPT_IFID		1	/* interface identifier */
160 #define IPV6CP_OPT_COMPRESSION	2	/* IPv6 compression protocol */
161 
162 #define PAP_REQ			1	/* PAP name/password request */
163 #define PAP_ACK			2	/* PAP acknowledge */
164 #define PAP_NAK			3	/* PAP fail */
165 
166 #define CHAP_CHALLENGE		1	/* CHAP challenge request */
167 #define CHAP_RESPONSE		2	/* CHAP challenge response */
168 #define CHAP_SUCCESS		3	/* CHAP response ok */
169 #define CHAP_FAILURE		4	/* CHAP response failed */
170 
171 #define CHAP_MD5		5	/* hash algorithm - MD5 */
172 
173 #define CISCO_MULTICAST		0x8f	/* Cisco multicast address */
174 #define CISCO_UNICAST		0x0f	/* Cisco unicast address */
175 #define CISCO_KEEPALIVE		0x8035	/* Cisco keepalive protocol */
176 #define CISCO_ADDR_REQ		0	/* Cisco address request */
177 #define CISCO_ADDR_REPLY	1	/* Cisco address reply */
178 #define CISCO_KEEPALIVE_REQ	2	/* Cisco keepalive request */
179 
180 /* states are named and numbered according to RFC 1661 */
181 #define STATE_INITIAL	0
182 #define STATE_STARTING	1
183 #define STATE_CLOSED	2
184 #define STATE_STOPPED	3
185 #define STATE_CLOSING	4
186 #define STATE_STOPPING	5
187 #define STATE_REQ_SENT	6
188 #define STATE_ACK_RCVD	7
189 #define STATE_ACK_SENT	8
190 #define STATE_OPENED	9
191 
192 struct ppp_header {
193 	uint8_t address;
194 	uint8_t control;
195 	uint16_t protocol;
196 } __packed;
197 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
198 
199 struct lcp_header {
200 	uint8_t type;
201 	uint8_t ident;
202 	uint16_t len;
203 } __packed;
204 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
205 
206 struct cisco_packet {
207 	uint32_t type;
208 	uint32_t par1;
209 	uint32_t par2;
210 	uint16_t rel;
211 	uint16_t time0;
212 	uint16_t time1;
213 } __packed;
214 #define CISCO_PACKET_LEN 18
215 
216 /*
217  * We follow the spelling and capitalization of RFC 1661 here, to make
218  * it easier comparing with the standard.  Please refer to this RFC in
219  * case you can't make sense out of these abbreviation; it will also
220  * explain the semantics related to the various events and actions.
221  */
222 struct cp {
223 	u_short	proto;		/* PPP control protocol number */
224 	u_char protoidx;	/* index into state table in struct sppp */
225 	u_char flags;
226 #define CP_LCP		0x01	/* this is the LCP */
227 #define CP_AUTH		0x02	/* this is an authentication protocol */
228 #define CP_NCP		0x04	/* this is a NCP */
229 #define CP_QUAL		0x08	/* this is a quality reporting protocol */
230 	const char *name;	/* name of this control protocol */
231 	/* event handlers */
232 	void	(*Up)(struct sppp *sp);
233 	void	(*Down)(struct sppp *sp);
234 	void	(*Open)(struct sppp *sp);
235 	void	(*Close)(struct sppp *sp);
236 	void	(*TO)(void *sp);
237 	int	(*RCR)(struct sppp *sp, struct lcp_header *h, int len);
238 	void	(*RCN_rej)(struct sppp *sp, struct lcp_header *h, int len);
239 	void	(*RCN_nak)(struct sppp *sp, struct lcp_header *h, int len);
240 	/* actions */
241 	void	(*tlu)(struct sppp *sp);
242 	void	(*tld)(struct sppp *sp);
243 	void	(*tls)(struct sppp *sp);
244 	void	(*tlf)(struct sppp *sp);
245 	void	(*scr)(struct sppp *sp);
246 };
247 
248 static struct sppp *spppq;
249 static kmutex_t *spppq_lock = NULL;
250 static callout_t keepalive_ch;
251 
252 #define SPPPQ_LOCK()	if (spppq_lock) \
253 				mutex_enter(spppq_lock);
254 #define SPPPQ_UNLOCK()	if (spppq_lock) \
255 				mutex_exit(spppq_lock);
256 
257 #ifdef INET
258 #ifndef SPPPSUBR_MPSAFE
259 /*
260  * The following disgusting hack gets around the problem that IP TOS
261  * can't be set yet.  We want to put "interactive" traffic on a high
262  * priority queue.  To decide if traffic is interactive, we check that
263  * a) it is TCP and b) one of its ports is telnet, rlogin or ftp control.
264  *
265  * XXX is this really still necessary?  - joerg -
266  */
267 static u_short interactive_ports[8] = {
268 	0,	513,	0,	0,
269 	0,	21,	0,	23,
270 };
271 #define INTERACTIVE(p)	(interactive_ports[(p) & 7] == (p))
272 #endif /* SPPPSUBR_MPSAFE */
273 #endif
274 
275 /* almost every function needs these */
276 #define STDDCL							\
277 	struct ifnet *ifp = &sp->pp_if;				\
278 	int debug = ifp->if_flags & IFF_DEBUG
279 
280 static int sppp_output(struct ifnet *ifp, struct mbuf *m,
281 		       const struct sockaddr *dst, const struct rtentry *rt);
282 
283 static void sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2);
284 static void sppp_cisco_input(struct sppp *sp, struct mbuf *m);
285 
286 static void sppp_cp_input(const struct cp *cp, struct sppp *sp,
287 			  struct mbuf *m);
288 static void sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
289 			 u_char ident, u_short len, void *data);
290 /* static void sppp_cp_timeout(void *arg); */
291 static void sppp_cp_change_state(const struct cp *cp, struct sppp *sp,
292 				 int newstate);
293 static void sppp_auth_send(const struct cp *cp,
294 			   struct sppp *sp, unsigned int type, unsigned int id,
295 			   ...);
296 
297 static void sppp_up_event(const struct cp *cp, struct sppp *sp);
298 static void sppp_down_event(const struct cp *cp, struct sppp *sp);
299 static void sppp_open_event(const struct cp *cp, struct sppp *sp);
300 static void sppp_close_event(const struct cp *cp, struct sppp *sp);
301 static void sppp_to_event(const struct cp *cp, struct sppp *sp);
302 
303 static void sppp_null(struct sppp *sp);
304 
305 static void sppp_lcp_init(struct sppp *sp);
306 static void sppp_lcp_up(struct sppp *sp);
307 static void sppp_lcp_down(struct sppp *sp);
308 static void sppp_lcp_open(struct sppp *sp);
309 static void sppp_lcp_close(struct sppp *sp);
310 static void sppp_lcp_TO(void *sp);
311 static int sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
312 static void sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
313 static void sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
314 static void sppp_lcp_tlu(struct sppp *sp);
315 static void sppp_lcp_tld(struct sppp *sp);
316 static void sppp_lcp_tls(struct sppp *sp);
317 static void sppp_lcp_tlf(struct sppp *sp);
318 static void sppp_lcp_scr(struct sppp *sp);
319 static void sppp_lcp_check_and_close(struct sppp *sp);
320 static int sppp_ncp_check(struct sppp *sp);
321 
322 static void sppp_ipcp_init(struct sppp *sp);
323 static void sppp_ipcp_up(struct sppp *sp);
324 static void sppp_ipcp_down(struct sppp *sp);
325 static void sppp_ipcp_open(struct sppp *sp);
326 static void sppp_ipcp_close(struct sppp *sp);
327 static void sppp_ipcp_TO(void *sp);
328 static int sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len);
329 static void sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
330 static void sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
331 static void sppp_ipcp_tlu(struct sppp *sp);
332 static void sppp_ipcp_tld(struct sppp *sp);
333 static void sppp_ipcp_tls(struct sppp *sp);
334 static void sppp_ipcp_tlf(struct sppp *sp);
335 static void sppp_ipcp_scr(struct sppp *sp);
336 
337 static void sppp_ipv6cp_init(struct sppp *sp);
338 static void sppp_ipv6cp_up(struct sppp *sp);
339 static void sppp_ipv6cp_down(struct sppp *sp);
340 static void sppp_ipv6cp_open(struct sppp *sp);
341 static void sppp_ipv6cp_close(struct sppp *sp);
342 static void sppp_ipv6cp_TO(void *sp);
343 static int sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len);
344 static void sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len);
345 static void sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len);
346 static void sppp_ipv6cp_tlu(struct sppp *sp);
347 static void sppp_ipv6cp_tld(struct sppp *sp);
348 static void sppp_ipv6cp_tls(struct sppp *sp);
349 static void sppp_ipv6cp_tlf(struct sppp *sp);
350 static void sppp_ipv6cp_scr(struct sppp *sp);
351 
352 static void sppp_pap_input(struct sppp *sp, struct mbuf *m);
353 static void sppp_pap_init(struct sppp *sp);
354 static void sppp_pap_open(struct sppp *sp);
355 static void sppp_pap_close(struct sppp *sp);
356 static void sppp_pap_TO(void *sp);
357 static void sppp_pap_my_TO(void *sp);
358 static void sppp_pap_tlu(struct sppp *sp);
359 static void sppp_pap_tld(struct sppp *sp);
360 static void sppp_pap_scr(struct sppp *sp);
361 
362 static void sppp_chap_input(struct sppp *sp, struct mbuf *m);
363 static void sppp_chap_init(struct sppp *sp);
364 static void sppp_chap_open(struct sppp *sp);
365 static void sppp_chap_close(struct sppp *sp);
366 static void sppp_chap_TO(void *sp);
367 static void sppp_chap_tlu(struct sppp *sp);
368 static void sppp_chap_tld(struct sppp *sp);
369 static void sppp_chap_scr(struct sppp *sp);
370 
371 static const char *sppp_auth_type_name(u_short proto, u_char type);
372 static const char *sppp_cp_type_name(u_char type);
373 static const char *sppp_dotted_quad(uint32_t addr);
374 static const char *sppp_ipcp_opt_name(u_char opt);
375 #ifdef INET6
376 static const char *sppp_ipv6cp_opt_name(u_char opt);
377 #endif
378 static const char *sppp_lcp_opt_name(u_char opt);
379 static const char *sppp_phase_name(int phase);
380 static const char *sppp_proto_name(u_short proto);
381 static const char *sppp_state_name(int state);
382 static int sppp_params(struct sppp *sp, u_long cmd, void *data);
383 #ifdef INET
384 static void sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst,
385 			      uint32_t *srcmask);
386 static void sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp);
387 static void sppp_set_ip_addrs(struct sppp *sp);
388 static void sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp);
389 static void sppp_clear_ip_addrs(struct sppp *sp);
390 static void sppp_update_ip_addrs_work(struct work *wk, void *arg);
391 #endif
392 static void sppp_keepalive(void *dummy);
393 static void sppp_phase_network(struct sppp *sp);
394 static void sppp_print_bytes(const u_char *p, u_short len);
395 static void sppp_print_string(const char *p, u_short len);
396 #ifdef INET6
397 static void sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src,
398 				struct in6_addr *dst, struct in6_addr *srcmask);
399 #ifdef IPV6CP_MYIFID_DYN
400 static void sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src);
401 static void sppp_gen_ip6_addr(struct sppp *sp, const struct in6_addr *src);
402 #endif
403 static void sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *src);
404 #endif
405 
406 /* our control protocol descriptors */
407 static const struct cp lcp = {
408 	PPP_LCP, IDX_LCP, CP_LCP, "lcp",
409 	sppp_lcp_up, sppp_lcp_down, sppp_lcp_open, sppp_lcp_close,
410 	sppp_lcp_TO, sppp_lcp_RCR, sppp_lcp_RCN_rej, sppp_lcp_RCN_nak,
411 	sppp_lcp_tlu, sppp_lcp_tld, sppp_lcp_tls, sppp_lcp_tlf,
412 	sppp_lcp_scr
413 };
414 
415 static const struct cp ipcp = {
416 	PPP_IPCP, IDX_IPCP,
417 #ifdef INET
418 	CP_NCP,	/*don't run IPCP if there's no IPv4 support*/
419 #else
420 	0,
421 #endif
422 	"ipcp",
423 	sppp_ipcp_up, sppp_ipcp_down, sppp_ipcp_open, sppp_ipcp_close,
424 	sppp_ipcp_TO, sppp_ipcp_RCR, sppp_ipcp_RCN_rej, sppp_ipcp_RCN_nak,
425 	sppp_ipcp_tlu, sppp_ipcp_tld, sppp_ipcp_tls, sppp_ipcp_tlf,
426 	sppp_ipcp_scr
427 };
428 
429 static const struct cp ipv6cp = {
430 	PPP_IPV6CP, IDX_IPV6CP,
431 #ifdef INET6	/*don't run IPv6CP if there's no IPv6 support*/
432 	CP_NCP,
433 #else
434 	0,
435 #endif
436 	"ipv6cp",
437 	sppp_ipv6cp_up, sppp_ipv6cp_down, sppp_ipv6cp_open, sppp_ipv6cp_close,
438 	sppp_ipv6cp_TO, sppp_ipv6cp_RCR, sppp_ipv6cp_RCN_rej, sppp_ipv6cp_RCN_nak,
439 	sppp_ipv6cp_tlu, sppp_ipv6cp_tld, sppp_ipv6cp_tls, sppp_ipv6cp_tlf,
440 	sppp_ipv6cp_scr
441 };
442 
443 static const struct cp pap = {
444 	PPP_PAP, IDX_PAP, CP_AUTH, "pap",
445 	sppp_null, sppp_null, sppp_pap_open, sppp_pap_close,
446 	sppp_pap_TO, 0, 0, 0,
447 	sppp_pap_tlu, sppp_pap_tld, sppp_null, sppp_null,
448 	sppp_pap_scr
449 };
450 
451 static const struct cp chap = {
452 	PPP_CHAP, IDX_CHAP, CP_AUTH, "chap",
453 	sppp_null, sppp_null, sppp_chap_open, sppp_chap_close,
454 	sppp_chap_TO, 0, 0, 0,
455 	sppp_chap_tlu, sppp_chap_tld, sppp_null, sppp_null,
456 	sppp_chap_scr
457 };
458 
459 static const struct cp *cps[IDX_COUNT] = {
460 	&lcp,			/* IDX_LCP */
461 	&ipcp,			/* IDX_IPCP */
462 	&ipv6cp,		/* IDX_IPV6CP */
463 	&pap,			/* IDX_PAP */
464 	&chap,			/* IDX_CHAP */
465 };
466 
467 static void
468 sppp_change_phase(struct sppp *sp, int phase)
469 {
470 	STDDCL;
471 
472 	KASSERT(sppp_locked(sp));
473 
474 	if (sp->pp_phase == phase)
475 		return;
476 
477 	sp->pp_phase = phase;
478 
479 	if (phase == SPPP_PHASE_NETWORK)
480 		if_link_state_change(ifp, LINK_STATE_UP);
481 	else
482 		if_link_state_change(ifp, LINK_STATE_DOWN);
483 
484 	if (debug)
485 	{
486 		log(LOG_INFO, "%s: phase %s\n", ifp->if_xname,
487 			sppp_phase_name(sp->pp_phase));
488 	}
489 }
490 
491 /*
492  * Exported functions, comprising our interface to the lower layer.
493  */
494 
495 /*
496  * Process the received packet.
497  */
498 void
499 sppp_input(struct ifnet *ifp, struct mbuf *m)
500 {
501 	struct ppp_header *h = NULL;
502 	pktqueue_t *pktq = NULL;
503 	struct ifqueue *inq = NULL;
504 	uint16_t protocol;
505 	struct sppp *sp = (struct sppp *)ifp;
506 	int debug = ifp->if_flags & IFF_DEBUG;
507 	int isr = 0;
508 
509 	KASSERT(!sppp_locked(sp));
510 
511 	sppp_lock_enter(sp);
512 
513 	if (ifp->if_flags & IFF_UP) {
514 		/* Count received bytes, add hardware framing */
515 		ifp->if_ibytes += m->m_pkthdr.len + sp->pp_framebytes;
516 		/* Note time of last receive */
517 		sp->pp_last_receive = time_uptime;
518 	}
519 
520 	if (m->m_pkthdr.len <= PPP_HEADER_LEN) {
521 		/* Too small packet, drop it. */
522 		if (debug)
523 			log(LOG_DEBUG,
524 			    "%s: input packet is too small, %d bytes\n",
525 			    ifp->if_xname, m->m_pkthdr.len);
526 	  drop:
527 		++ifp->if_ierrors;
528 		++ifp->if_iqdrops;
529 		m_freem(m);
530 		sppp_lock_exit(sp);
531 		return;
532 	}
533 
534 	if (sp->pp_flags & PP_NOFRAMING) {
535 		memcpy(&protocol, mtod(m, void *), 2);
536 		protocol = ntohs(protocol);
537 		m_adj(m, 2);
538 	} else {
539 
540 		/* Get PPP header. */
541 		h = mtod(m, struct ppp_header *);
542 		m_adj(m, PPP_HEADER_LEN);
543 
544 		switch (h->address) {
545 		case PPP_ALLSTATIONS:
546 			if (h->control != PPP_UI)
547 				goto invalid;
548 			if (sp->pp_flags & PP_CISCO) {
549 				if (debug)
550 					log(LOG_DEBUG,
551 					    "%s: PPP packet in Cisco mode "
552 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
553 					    ifp->if_xname,
554 					    h->address, h->control, ntohs(h->protocol));
555 				goto drop;
556 			}
557 			break;
558 		case CISCO_MULTICAST:
559 		case CISCO_UNICAST:
560 			/* Don't check the control field here (RFC 1547). */
561 			if (! (sp->pp_flags & PP_CISCO)) {
562 				if (debug)
563 					log(LOG_DEBUG,
564 					    "%s: Cisco packet in PPP mode "
565 					    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
566 					    ifp->if_xname,
567 					    h->address, h->control, ntohs(h->protocol));
568 				goto drop;
569 			}
570 			switch (ntohs(h->protocol)) {
571 			default:
572 				++ifp->if_noproto;
573 				goto invalid;
574 			case CISCO_KEEPALIVE:
575 				sppp_lock_exit(sp);
576 				sppp_cisco_input((struct sppp *) ifp, m);
577 				m_freem(m);
578 				return;
579 #ifdef INET
580 			case ETHERTYPE_IP:
581 				pktq = ip_pktq;
582 				break;
583 #endif
584 #ifdef INET6
585 			case ETHERTYPE_IPV6:
586 				pktq = ip6_pktq;
587 				break;
588 #endif
589 			}
590 			goto queue_pkt;
591 		default:        /* Invalid PPP packet. */
592 		  invalid:
593 			if (debug)
594 				log(LOG_DEBUG,
595 				    "%s: invalid input packet "
596 				    "<addr=0x%x ctrl=0x%x proto=0x%x>\n",
597 				    ifp->if_xname,
598 				    h->address, h->control, ntohs(h->protocol));
599 			goto drop;
600 		}
601 		protocol = ntohs(h->protocol);
602 	}
603 
604 	switch (protocol) {
605 	default:
606 		if (sp->state[IDX_LCP] == STATE_OPENED) {
607 			uint16_t prot = htons(protocol);
608 			sppp_cp_send(sp, PPP_LCP, PROTO_REJ,
609 			    ++sp->pp_seq[IDX_LCP], m->m_pkthdr.len + 2,
610 			    &prot);
611 		}
612 		if (debug)
613 			log(LOG_DEBUG,
614 			    "%s: invalid input protocol "
615 			    "<proto=0x%x>\n", ifp->if_xname, ntohs(protocol));
616 		++ifp->if_noproto;
617 		goto drop;
618 	case PPP_LCP:
619 		sppp_lock_exit(sp);
620 		sppp_cp_input(&lcp, sp, m);
621 		m_freem(m);
622 		return;
623 	case PPP_PAP:
624 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
625 			sppp_lock_exit(sp);
626 			sppp_pap_input(sp, m);
627 		} else
628 			sppp_lock_exit(sp);
629 		m_freem(m);
630 		return;
631 	case PPP_CHAP:
632 		if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
633 			sppp_lock_exit(sp);
634 			sppp_chap_input(sp, m);
635 		} else
636 			sppp_lock_exit(sp);
637 		m_freem(m);
638 		return;
639 #ifdef INET
640 	case PPP_IPCP:
641 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
642 			sppp_lock_exit(sp);
643 			sppp_cp_input(&ipcp, sp, m);
644 		} else
645 			sppp_lock_exit(sp);
646 		m_freem(m);
647 		return;
648 	case PPP_IP:
649 		if (sp->state[IDX_IPCP] == STATE_OPENED) {
650 			sp->pp_last_activity = time_uptime;
651 			pktq = ip_pktq;
652 		}
653 		break;
654 #endif
655 #ifdef INET6
656 	case PPP_IPV6CP:
657 		if (sp->pp_phase == SPPP_PHASE_NETWORK) {
658 			sppp_lock_exit(sp);
659 			sppp_cp_input(&ipv6cp, sp, m);
660 		} else
661 			sppp_lock_exit(sp);
662 		m_freem(m);
663 		return;
664 
665 	case PPP_IPV6:
666 		if (sp->state[IDX_IPV6CP] == STATE_OPENED) {
667 			sp->pp_last_activity = time_uptime;
668 			pktq = ip6_pktq;
669 		}
670 		break;
671 #endif
672 	}
673 
674 queue_pkt:
675 	if ((ifp->if_flags & IFF_UP) == 0 || (!inq && !pktq)) {
676 		goto drop;
677 	}
678 
679 	sppp_lock_exit(sp);
680 	/* Check queue. */
681 	if (__predict_true(pktq)) {
682 		if (__predict_false(!pktq_enqueue(pktq, m, 0))) {
683 			sppp_lock_enter(sp);
684 			goto drop;
685 		}
686 		return;
687 	}
688 
689 	IFQ_LOCK(inq);
690 	if (IF_QFULL(inq)) {
691 		/* Queue overflow. */
692 		IF_DROP(inq);
693 		IFQ_UNLOCK(inq);
694 		if (debug)
695 			log(LOG_DEBUG, "%s: protocol queue overflow\n",
696 				ifp->if_xname);
697 		sppp_lock_enter(sp);
698 		goto drop;
699 	}
700 	IF_ENQUEUE(inq, m);
701 	IFQ_UNLOCK(inq);
702 	schednetisr(isr);
703 }
704 
705 /*
706  * Enqueue transmit packet.
707  */
708 static int
709 sppp_output(struct ifnet *ifp, struct mbuf *m,
710     const struct sockaddr *dst, const struct rtentry *rt)
711 {
712 	struct sppp *sp = (struct sppp *) ifp;
713 	struct ppp_header *h = NULL;
714 #ifndef SPPPSUBR_MPSAFE
715 	struct ifqueue *ifq = NULL;		/* XXX */
716 #endif
717 	int s, error = 0;
718 	uint16_t protocol;
719 
720 	s = splnet();
721 
722 	sppp_lock_enter(sp);
723 	sp->pp_last_activity = time_uptime;
724 
725 	if ((ifp->if_flags & IFF_UP) == 0 ||
726 	    (ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == 0) {
727 		sppp_lock_exit(sp);
728 		m_freem(m);
729 		splx(s);
730 		return (ENETDOWN);
731 	}
732 
733 	if ((ifp->if_flags & (IFF_RUNNING | IFF_AUTO)) == IFF_AUTO) {
734 		/*
735 		 * Interface is not yet running, but auto-dial.  Need
736 		 * to start LCP for it.
737 		 */
738 		ifp->if_flags |= IFF_RUNNING;
739 		splx(s);
740 		lcp.Open(sp);
741 		s = splnet();
742 	}
743 
744 	/*
745 	 * If the queueing discipline needs packet classification,
746 	 * do it before prepending link headers.
747 	 */
748 	IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family);
749 
750 #ifdef INET
751 	if (dst->sa_family == AF_INET) {
752 		struct ip *ip = NULL;
753 #ifndef SPPPSUBR_MPSAFE
754 		struct tcphdr *th = NULL;
755 #endif
756 
757 		if (m->m_len >= sizeof(struct ip)) {
758 			ip = mtod(m, struct ip *);
759 #ifndef SPPPSUBR_MPSAFE
760 			if (ip->ip_p == IPPROTO_TCP &&
761 			    m->m_len >= sizeof(struct ip) + (ip->ip_hl << 2) +
762 			    sizeof(struct tcphdr)) {
763 				th = (struct tcphdr *)
764 				    ((char *)ip + (ip->ip_hl << 2));
765 			}
766 #endif
767 		} else
768 			ip = NULL;
769 
770 		/*
771 		 * When using dynamic local IP address assignment by using
772 		 * 0.0.0.0 as a local address, the first TCP session will
773 		 * not connect because the local TCP checksum is computed
774 		 * using 0.0.0.0 which will later become our real IP address
775 		 * so the TCP checksum computed at the remote end will
776 		 * become invalid. So we
777 		 * - don't let packets with src ip addr 0 thru
778 		 * - we flag TCP packets with src ip 0 as an error
779 		 */
780 		if (ip && ip->ip_src.s_addr == INADDR_ANY) {
781 			uint8_t proto = ip->ip_p;
782 
783 			sppp_lock_exit(sp);
784 			m_freem(m);
785 			splx(s);
786 			if (proto == IPPROTO_TCP)
787 				return (EADDRNOTAVAIL);
788 			else
789 				return (0);
790 		}
791 
792 #ifndef SPPPSUBR_MPSAFE
793 		/*
794 		 * Put low delay, telnet, rlogin and ftp control packets
795 		 * in front of the queue.
796 		 */
797 		if (!IF_QFULL(&sp->pp_fastq) &&
798 		    ((ip && (ip->ip_tos & IPTOS_LOWDELAY)) ||
799 		     (th && (INTERACTIVE(ntohs(th->th_sport)) ||
800 		      INTERACTIVE(ntohs(th->th_dport))))))
801 			ifq = &sp->pp_fastq;
802 #endif /* !SPPPSUBR_MPSAFE */
803 	}
804 #endif
805 
806 #ifdef INET6
807 	if (dst->sa_family == AF_INET6) {
808 		/* XXX do something tricky here? */
809 	}
810 #endif
811 
812 	if ((sp->pp_flags & PP_NOFRAMING) == 0) {
813 		/*
814 		 * Prepend general data packet PPP header. For now, IP only.
815 		 */
816 		M_PREPEND(m, PPP_HEADER_LEN, M_DONTWAIT);
817 		if (! m) {
818 			if (ifp->if_flags & IFF_DEBUG)
819 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
820 					ifp->if_xname);
821 			++ifp->if_oerrors;
822 			sppp_lock_exit(sp);
823 			splx(s);
824 			return (ENOBUFS);
825 		}
826 		/*
827 		 * May want to check size of packet
828 		 * (albeit due to the implementation it's always enough)
829 		 */
830 		h = mtod(m, struct ppp_header *);
831 		if (sp->pp_flags & PP_CISCO) {
832 			h->address = CISCO_UNICAST;        /* unicast address */
833 			h->control = 0;
834 		} else {
835 			h->address = PPP_ALLSTATIONS;        /* broadcast address */
836 			h->control = PPP_UI;                 /* Unnumbered Info */
837 		}
838 	}
839 
840 	switch (dst->sa_family) {
841 #ifdef INET
842 	case AF_INET:   /* Internet Protocol */
843 		if (sp->pp_flags & PP_CISCO)
844 			protocol = htons(ETHERTYPE_IP);
845 		else {
846 			/*
847 			 * Don't choke with an ENETDOWN early.  It's
848 			 * possible that we just started dialing out,
849 			 * so don't drop the packet immediately.  If
850 			 * we notice that we run out of buffer space
851 			 * below, we will however remember that we are
852 			 * not ready to carry IP packets, and return
853 			 * ENETDOWN, as opposed to ENOBUFS.
854 			 */
855 			protocol = htons(PPP_IP);
856 			if (sp->state[IDX_IPCP] != STATE_OPENED)
857 				error = ENETDOWN;
858 		}
859 		break;
860 #endif
861 #ifdef INET6
862 	case AF_INET6:   /* Internet Protocol version 6 */
863 		if (sp->pp_flags & PP_CISCO)
864 			protocol = htons(ETHERTYPE_IPV6);
865 		else {
866 			/*
867 			 * Don't choke with an ENETDOWN early.  It's
868 			 * possible that we just started dialing out,
869 			 * so don't drop the packet immediately.  If
870 			 * we notice that we run out of buffer space
871 			 * below, we will however remember that we are
872 			 * not ready to carry IP packets, and return
873 			 * ENETDOWN, as opposed to ENOBUFS.
874 			 */
875 			protocol = htons(PPP_IPV6);
876 			if (sp->state[IDX_IPV6CP] != STATE_OPENED)
877 				error = ENETDOWN;
878 		}
879 		break;
880 #endif
881 	default:
882 		m_freem(m);
883 		++ifp->if_oerrors;
884 		sppp_lock_exit(sp);
885 		splx(s);
886 		return (EAFNOSUPPORT);
887 	}
888 
889 	if (sp->pp_flags & PP_NOFRAMING) {
890 		M_PREPEND(m, 2, M_DONTWAIT);
891 		if (m == NULL) {
892 			if (ifp->if_flags & IFF_DEBUG)
893 				log(LOG_DEBUG, "%s: no memory for transmit header\n",
894 					ifp->if_xname);
895 			++ifp->if_oerrors;
896 			sppp_lock_exit(sp);
897 			splx(s);
898 			return (ENOBUFS);
899 		}
900 		*mtod(m, uint16_t *) = protocol;
901 	} else {
902 		h->protocol = protocol;
903 	}
904 
905 
906 #ifdef SPPPSUBR_MPSAFE
907 	error = if_transmit_lock(ifp, m);
908 	if (error == 0)
909 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
910 #else /* !SPPPSUBR_MPSAFE */
911 	error = ifq_enqueue2(ifp, ifq, m);
912 
913 	if (error == 0) {
914 		/*
915 		 * Count output packets and bytes.
916 		 * The packet length includes header + additional hardware
917 		 * framing according to RFC 1333.
918 		 */
919 		if (!(ifp->if_flags & IFF_OACTIVE)) {
920 			sppp_lock_exit(sp);
921 			if_start_lock(ifp);
922 			sppp_lock_enter(sp);
923 		}
924 		ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
925 	}
926 #endif /* !SPPPSUBR_MPSAFE */
927 	sppp_lock_exit(sp);
928 	splx(s);
929 	return error;
930 }
931 
932 static int
933 sppp_mediachange(struct ifnet *ifp)
934 {
935 
936 	return (0);
937 }
938 
939 static void
940 sppp_mediastatus(struct ifnet *ifp, struct ifmediareq *imr)
941 {
942 	struct sppp *sp = (struct sppp *)ifp;
943 	KASSERT(!sppp_locked(sp));
944 
945 	sppp_lock_enter(sp);
946 	switch (ifp->if_link_state) {
947 	case LINK_STATE_UP:
948 		imr->ifm_status = IFM_AVALID | IFM_ACTIVE;
949 		break;
950 	case LINK_STATE_DOWN:
951 		imr->ifm_status = IFM_AVALID;
952 		break;
953 	default:
954 		/* Should be impossible as we set link state down in attach. */
955 		imr->ifm_status = 0;
956 		break;
957 	}
958 	sppp_lock_exit(sp);
959 }
960 
961 void
962 sppp_attach(struct ifnet *ifp)
963 {
964 	struct sppp *sp = (struct sppp *) ifp;
965 
966 	/* Initialize keepalive handler. */
967 	if (! spppq) {
968 		callout_init(&keepalive_ch, 0);
969 		callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
970 	}
971 
972 	if (! spppq_lock)
973 		spppq_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET);
974 
975 	/* Insert new entry into the keepalive list. */
976 	sp->pp_next = spppq;
977 	spppq = sp;
978 
979 	sp->pp_if.if_type = IFT_PPP;
980 	sp->pp_if.if_output = sppp_output;
981 	sp->pp_fastq.ifq_maxlen = 32;
982 	sp->pp_cpq.ifq_maxlen = 20;
983 	sp->pp_loopcnt = 0;
984 	sp->pp_alivecnt = 0;
985 	sp->pp_last_activity = 0;
986 	sp->pp_last_receive = 0;
987 	sp->pp_maxalive = DEFAULT_MAXALIVECNT;
988 	sp->pp_max_noreceive = DEFAULT_NORECV_TIME;
989 	sp->pp_idle_timeout = 0;
990 	memset(&sp->pp_seq[0], 0, sizeof(sp->pp_seq));
991 	memset(&sp->pp_rseq[0], 0, sizeof(sp->pp_rseq));
992 	sp->pp_auth_failures = 0;
993 	sp->pp_max_auth_fail = DEFAULT_MAX_AUTH_FAILURES;
994 	sp->pp_phase = SPPP_PHASE_DEAD;
995 	sp->pp_up = lcp.Up;
996 	sp->pp_down = lcp.Down;
997 	sp->pp_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_SOFTNET);
998 
999 	if_alloc_sadl(ifp);
1000 
1001 	/* Lets not beat about the bush, we know we're down. */
1002 	ifp->if_link_state = LINK_STATE_DOWN;
1003 	/* There is no media for PPP, but it's needed to report link status. */
1004 	ifmedia_init(&sp->pp_im, 0, sppp_mediachange, sppp_mediastatus);
1005 
1006 	memset(&sp->myauth, 0, sizeof sp->myauth);
1007 	memset(&sp->hisauth, 0, sizeof sp->hisauth);
1008 	sppp_lcp_init(sp);
1009 	sppp_ipcp_init(sp);
1010 	sppp_ipv6cp_init(sp);
1011 	sppp_pap_init(sp);
1012 	sppp_chap_init(sp);
1013 }
1014 
1015 void
1016 sppp_detach(struct ifnet *ifp)
1017 {
1018 	struct sppp **q, *p, *sp = (struct sppp *) ifp;
1019 
1020 	sppp_lock_enter(sp);
1021 	/* Remove the entry from the keepalive list. */
1022 	SPPPQ_LOCK();
1023 	for (q = &spppq; (p = *q); q = &p->pp_next)
1024 		if (p == sp) {
1025 			*q = p->pp_next;
1026 			break;
1027 		}
1028 
1029 	/* to avoid workqueue enqueued */
1030 	atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1);
1031 	workqueue_destroy(sp->ipcp.update_addrs_wq);
1032 	pcq_destroy(sp->ipcp.update_addrs_q);
1033 
1034 	/* Stop keepalive handler. */
1035 	if (! spppq) {
1036 		callout_stop(&keepalive_ch);
1037 	}
1038 	SPPPQ_UNLOCK();
1039 
1040 	callout_stop(&sp->ch[IDX_LCP]);
1041 	callout_stop(&sp->ch[IDX_IPCP]);
1042 	callout_stop(&sp->ch[IDX_PAP]);
1043 	callout_stop(&sp->ch[IDX_CHAP]);
1044 #ifdef INET6
1045 	callout_stop(&sp->ch[IDX_IPV6CP]);
1046 #endif
1047 	callout_stop(&sp->pap_my_to_ch);
1048 
1049 	/* free authentication info */
1050 	if (sp->myauth.name) free(sp->myauth.name, M_DEVBUF);
1051 	if (sp->myauth.secret) free(sp->myauth.secret, M_DEVBUF);
1052 	if (sp->hisauth.name) free(sp->hisauth.name, M_DEVBUF);
1053 	if (sp->hisauth.secret) free(sp->hisauth.secret, M_DEVBUF);
1054 
1055 	/* Safety - shouldn't be needed as there is no media to set. */
1056 	ifmedia_delete_instance(&sp->pp_im, IFM_INST_ANY);
1057 
1058 	sppp_lock_exit(sp);
1059 	if (sp->pp_lock)
1060 		mutex_obj_free(sp->pp_lock);
1061 
1062 }
1063 
1064 /*
1065  * Flush the interface output queue.
1066  */
1067 void
1068 sppp_flush(struct ifnet *ifp)
1069 {
1070 	struct sppp *sp = (struct sppp *) ifp;
1071 
1072 	IFQ_PURGE(&sp->pp_if.if_snd);
1073 	IF_PURGE(&sp->pp_fastq);
1074 	IF_PURGE(&sp->pp_cpq);
1075 }
1076 
1077 /*
1078  * Check if the output queue is empty.
1079  */
1080 int
1081 sppp_isempty(struct ifnet *ifp)
1082 {
1083 	struct sppp *sp = (struct sppp *) ifp;
1084 	int empty, s;
1085 
1086 	KASSERT(!sppp_locked(sp));
1087 
1088 	s = splnet();
1089 	sppp_lock_enter(sp);
1090 	empty = IF_IS_EMPTY(&sp->pp_fastq) && IF_IS_EMPTY(&sp->pp_cpq) &&
1091 		IFQ_IS_EMPTY(&sp->pp_if.if_snd);
1092 	sppp_lock_exit(sp);
1093 	splx(s);
1094 	return (empty);
1095 }
1096 
1097 /*
1098  * Get next packet to send.
1099  */
1100 struct mbuf *
1101 sppp_dequeue(struct ifnet *ifp)
1102 {
1103 	struct sppp *sp = (struct sppp *) ifp;
1104 	struct mbuf *m;
1105 	int s;
1106 
1107 	s = splnet();
1108 	sppp_lock_enter(sp);
1109 	/*
1110 	 * Process only the control protocol queue until we have at
1111 	 * least one NCP open.
1112 	 *
1113 	 * Do always serve all three queues in Cisco mode.
1114 	 */
1115 	IF_DEQUEUE(&sp->pp_cpq, m);
1116 	if (m == NULL &&
1117 	    (sppp_ncp_check(sp) || (sp->pp_flags & PP_CISCO) != 0)) {
1118 		IF_DEQUEUE(&sp->pp_fastq, m);
1119 		if (m == NULL)
1120 			IFQ_DEQUEUE(&sp->pp_if.if_snd, m);
1121 	}
1122 	sppp_lock_exit(sp);
1123 	splx(s);
1124 	return m;
1125 }
1126 
1127 /*
1128  * Process an ioctl request.  Called on low priority level.
1129  */
1130 int
1131 sppp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1132 {
1133 	struct lwp *l = curlwp;	/* XXX */
1134 	struct ifreq *ifr = (struct ifreq *) data;
1135 	struct ifaddr *ifa = (struct ifaddr *) data;
1136 	struct sppp *sp = (struct sppp *) ifp;
1137 	int s, error=0, going_up, going_down, newmode;
1138 
1139 	s = splnet();
1140 	switch (cmd) {
1141 	case SIOCINITIFADDR:
1142 		ifa->ifa_rtrequest = p2p_rtrequest;
1143 		break;
1144 
1145 	case SIOCSIFFLAGS:
1146 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1147 			break;
1148 
1149 		sppp_lock_enter(sp);
1150 		going_up = ifp->if_flags & IFF_UP &&
1151 			(ifp->if_flags & IFF_RUNNING) == 0;
1152 		going_down = (ifp->if_flags & IFF_UP) == 0 &&
1153 			ifp->if_flags & IFF_RUNNING;
1154 		newmode = ifp->if_flags & (IFF_AUTO | IFF_PASSIVE);
1155 		if (newmode == (IFF_AUTO | IFF_PASSIVE)) {
1156 			/* sanity */
1157 			newmode = IFF_PASSIVE;
1158 			ifp->if_flags &= ~IFF_AUTO;
1159 		}
1160 
1161 		if (going_up || going_down) {
1162 			lcp.Close(sp);
1163 		}
1164 		if (going_up && newmode == 0) {
1165 			/* neither auto-dial nor passive */
1166 			ifp->if_flags |= IFF_RUNNING;
1167 			if (!(sp->pp_flags & PP_CISCO))
1168 				lcp.Open(sp);
1169 		} else if (going_down) {
1170 			sppp_flush(ifp);
1171 			ifp->if_flags &= ~IFF_RUNNING;
1172 		}
1173 		sppp_lock_exit(sp);
1174 		break;
1175 
1176 	case SIOCSIFMTU:
1177 		if (ifr->ifr_mtu < PPP_MINMRU ||
1178 		    ifr->ifr_mtu > sp->lcp.their_mru) {
1179 			error = EINVAL;
1180 			break;
1181 		}
1182 		/*FALLTHROUGH*/
1183 	case SIOCGIFMTU:
1184 		if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
1185 			error = 0;
1186 		break;
1187 	case SIOCADDMULTI:
1188 	case SIOCDELMULTI:
1189 		break;
1190 
1191 	case SPPPSETAUTHCFG:
1192 	case SPPPSETLCPCFG:
1193 	case SPPPSETIDLETO:
1194 	case SPPPSETAUTHFAILURE:
1195 	case SPPPSETDNSOPTS:
1196 	case SPPPSETKEEPALIVE:
1197 #if defined(COMPAT_50) || defined(MODULAR)
1198 	case __SPPPSETIDLETO50:
1199 	case __SPPPSETKEEPALIVE50:
1200 #endif /* COMPAT_50 || MODULAR */
1201 		error = kauth_authorize_network(l->l_cred,
1202 		    KAUTH_NETWORK_INTERFACE,
1203 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
1204 		    NULL);
1205 		if (error)
1206 			break;
1207 		error = sppp_params(sp, cmd, data);
1208 		break;
1209 
1210 	case SPPPGETAUTHCFG:
1211 	case SPPPGETLCPCFG:
1212 	case SPPPGETAUTHFAILURES:
1213 		error = kauth_authorize_network(l->l_cred,
1214 		    KAUTH_NETWORK_INTERFACE,
1215 		    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd,
1216 		    NULL);
1217 		if (error)
1218 			break;
1219 		error = sppp_params(sp, cmd, data);
1220 		break;
1221 
1222 	case SPPPGETSTATUS:
1223 	case SPPPGETSTATUSNCP:
1224 	case SPPPGETIDLETO:
1225 	case SPPPGETDNSOPTS:
1226 	case SPPPGETDNSADDRS:
1227 	case SPPPGETKEEPALIVE:
1228 #if defined(COMPAT_50) || defined(MODULAR)
1229 	case __SPPPGETIDLETO50:
1230 	case __SPPPGETKEEPALIVE50:
1231 #endif /* COMPAT_50 || MODULAR */
1232 		error = sppp_params(sp, cmd, data);
1233 		break;
1234 
1235 	case SIOCGIFMEDIA:
1236 		error = ifmedia_ioctl(ifp, ifr, &sp->pp_im, cmd);
1237 		break;
1238 
1239 	default:
1240 		error = ifioctl_common(ifp, cmd, data);
1241 		break;
1242 	}
1243 	splx(s);
1244 	return (error);
1245 }
1246 
1247 
1248 /*
1249  * Cisco framing implementation.
1250  */
1251 
1252 /*
1253  * Handle incoming Cisco keepalive protocol packets.
1254  */
1255 static void
1256 sppp_cisco_input(struct sppp *sp, struct mbuf *m)
1257 {
1258 	STDDCL;
1259 	struct cisco_packet *h;
1260 #ifdef INET
1261 	uint32_t me, mymask = 0;	/* XXX: GCC */
1262 #endif
1263 
1264 	KASSERT(!sppp_locked(sp));
1265 
1266 	sppp_lock_enter(sp);
1267 
1268 	if (m->m_pkthdr.len < CISCO_PACKET_LEN) {
1269 		if (debug)
1270 			log(LOG_DEBUG,
1271 			    "%s: cisco invalid packet length: %d bytes\n",
1272 			    ifp->if_xname, m->m_pkthdr.len);
1273 		sppp_lock_exit(sp);
1274 		return;
1275 	}
1276 	h = mtod(m, struct cisco_packet *);
1277 	if (debug)
1278 		log(LOG_DEBUG,
1279 		    "%s: cisco input: %d bytes "
1280 		    "<0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
1281 		    ifp->if_xname, m->m_pkthdr.len,
1282 		    ntohl(h->type), h->par1, h->par2, (u_int)h->rel,
1283 		    (u_int)h->time0, (u_int)h->time1);
1284 	switch (ntohl(h->type)) {
1285 	default:
1286 		if (debug)
1287 			addlog("%s: cisco unknown packet type: 0x%x\n",
1288 			       ifp->if_xname, ntohl(h->type));
1289 		break;
1290 	case CISCO_ADDR_REPLY:
1291 		/* Reply on address request, ignore */
1292 		break;
1293 	case CISCO_KEEPALIVE_REQ:
1294 		sp->pp_alivecnt = 0;
1295 		sp->pp_rseq[IDX_LCP] = ntohl(h->par1);
1296 		if (sp->pp_seq[IDX_LCP] == sp->pp_rseq[IDX_LCP]) {
1297 			/* Local and remote sequence numbers are equal.
1298 			 * Probably, the line is in loopback mode. */
1299 			if (sp->pp_loopcnt >= LOOPALIVECNT) {
1300 				printf ("%s: loopback\n",
1301 					ifp->if_xname);
1302 				sp->pp_loopcnt = 0;
1303 				if (ifp->if_flags & IFF_UP) {
1304 					sppp_lock_exit(sp);
1305 					if_down(ifp);
1306 					sppp_lock_enter(sp);
1307 					IF_PURGE(&sp->pp_cpq);
1308 				}
1309 			}
1310 			++sp->pp_loopcnt;
1311 
1312 			/* Generate new local sequence number */
1313 			sp->pp_seq[IDX_LCP] = cprng_fast32();
1314 			break;
1315 		}
1316 		sp->pp_loopcnt = 0;
1317 		if (! (ifp->if_flags & IFF_UP) &&
1318 		    (ifp->if_flags & IFF_RUNNING)) {
1319 			sppp_lock_exit(sp);
1320 			if_up(ifp);
1321 			sppp_lock_enter(sp);
1322 		}
1323 		break;
1324 	case CISCO_ADDR_REQ:
1325 #ifdef INET
1326 		sppp_lock_exit(sp);
1327 		sppp_get_ip_addrs(sp, &me, 0, &mymask);
1328 		if (me != 0L)
1329 			sppp_cisco_send(sp, CISCO_ADDR_REPLY, me, mymask);
1330 #endif
1331 		sppp_lock_enter(sp);
1332 		break;
1333 	}
1334 	sppp_lock_exit(sp);
1335 }
1336 
1337 /*
1338  * Send Cisco keepalive packet.
1339  */
1340 static void
1341 sppp_cisco_send(struct sppp *sp, int type, int32_t par1, int32_t par2)
1342 {
1343 	STDDCL;
1344 	struct ppp_header *h;
1345 	struct cisco_packet *ch;
1346 	struct mbuf *m;
1347 	uint32_t t;
1348 
1349 	KASSERT(sppp_locked(sp));
1350 
1351 	t = time_uptime * 1000;
1352 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1353 	if (! m)
1354 		return;
1355 	m->m_pkthdr.len = m->m_len = PPP_HEADER_LEN + CISCO_PACKET_LEN;
1356 	m_reset_rcvif(m);
1357 
1358 	h = mtod(m, struct ppp_header *);
1359 	h->address = CISCO_MULTICAST;
1360 	h->control = 0;
1361 	h->protocol = htons(CISCO_KEEPALIVE);
1362 
1363 	ch = (struct cisco_packet *)(h + 1);
1364 	ch->type = htonl(type);
1365 	ch->par1 = htonl(par1);
1366 	ch->par2 = htonl(par2);
1367 	ch->rel = -1;
1368 
1369 	ch->time0 = htons((u_short)(t >> 16));
1370 	ch->time1 = htons((u_short) t);
1371 
1372 	if (debug)
1373 		log(LOG_DEBUG,
1374 		    "%s: cisco output: <0x%x 0x%x 0x%x 0x%x 0x%x-0x%x>\n",
1375 			ifp->if_xname, ntohl(ch->type), ch->par1,
1376 			ch->par2, (u_int)ch->rel, (u_int)ch->time0,
1377 			(u_int)ch->time1);
1378 
1379 	if (IF_QFULL(&sp->pp_cpq)) {
1380 		IF_DROP(&sp->pp_fastq);
1381 		IF_DROP(&ifp->if_snd);
1382 		m_freem(m);
1383 		++ifp->if_oerrors;
1384 		return;
1385 	} else
1386 		IF_ENQUEUE(&sp->pp_cpq, m);
1387 	if (! (ifp->if_flags & IFF_OACTIVE)) {
1388 		sppp_lock_exit(sp);
1389 		if_start_lock(ifp);
1390 		sppp_lock_enter(sp);
1391 	}
1392 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1393 }
1394 
1395 /*
1396  * PPP protocol implementation.
1397  */
1398 
1399 /*
1400  * Send PPP control protocol packet.
1401  */
1402 static void
1403 sppp_cp_send(struct sppp *sp, u_short proto, u_char type,
1404 	     u_char ident, u_short len, void *data)
1405 {
1406 	STDDCL;
1407 	struct lcp_header *lh;
1408 	struct mbuf *m;
1409 	size_t pkthdrlen;
1410 
1411 	KASSERT(sppp_locked(sp));
1412 
1413 	pkthdrlen = (sp->pp_flags & PP_NOFRAMING) ? 2 : PPP_HEADER_LEN;
1414 
1415 	if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN)
1416 		len = MHLEN - pkthdrlen - LCP_HEADER_LEN;
1417 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1418 	if (! m)
1419 		return;
1420 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
1421 	m_reset_rcvif(m);
1422 
1423 	if (sp->pp_flags & PP_NOFRAMING) {
1424 		*mtod(m, uint16_t *) = htons(proto);
1425 		lh = (struct lcp_header *)(mtod(m, uint8_t *) + 2);
1426 	} else {
1427 		struct ppp_header *h;
1428 		h = mtod(m, struct ppp_header *);
1429 		h->address = PPP_ALLSTATIONS;        /* broadcast address */
1430 		h->control = PPP_UI;                 /* Unnumbered Info */
1431 		h->protocol = htons(proto);         /* Link Control Protocol */
1432 		lh = (struct lcp_header *)(h + 1);
1433 	}
1434 	lh->type = type;
1435 	lh->ident = ident;
1436 	lh->len = htons(LCP_HEADER_LEN + len);
1437 	if (len)
1438 		memcpy(lh + 1, data, len);
1439 
1440 	if (debug) {
1441 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
1442 		    ifp->if_xname,
1443 		    sppp_proto_name(proto),
1444 		    sppp_cp_type_name(lh->type), lh->ident, ntohs(lh->len));
1445 		if (len)
1446 			sppp_print_bytes((u_char *)(lh + 1), len);
1447 		addlog(">\n");
1448 	}
1449 	if (IF_QFULL(&sp->pp_cpq)) {
1450 		IF_DROP(&sp->pp_fastq);
1451 		IF_DROP(&ifp->if_snd);
1452 		m_freem(m);
1453 		++ifp->if_oerrors;
1454 		return;
1455 	} else
1456 		IF_ENQUEUE(&sp->pp_cpq, m);
1457 
1458 	if (! (ifp->if_flags & IFF_OACTIVE)) {
1459 		sppp_lock_exit(sp);
1460 		if_start_lock(ifp);
1461 		sppp_lock_enter(sp);
1462 	}
1463 
1464 	ifp->if_obytes += m->m_pkthdr.len + sp->pp_framebytes;
1465 }
1466 
1467 /*
1468  * Handle incoming PPP control protocol packets.
1469  */
1470 static void
1471 sppp_cp_input(const struct cp *cp, struct sppp *sp, struct mbuf *m)
1472 {
1473 	STDDCL;
1474 	struct lcp_header *h;
1475 	int printlen, len = m->m_pkthdr.len;
1476 	int rv;
1477 	u_char *p;
1478 	uint32_t u32;
1479 
1480 	KASSERT(!sppp_locked(sp));
1481 	if (len < 4) {
1482 		if (debug)
1483 			log(LOG_DEBUG,
1484 			    "%s: %s invalid packet length: %d bytes\n",
1485 			    ifp->if_xname, cp->name, len);
1486 		return;
1487 	}
1488 	h = mtod(m, struct lcp_header *);
1489 	if (debug) {
1490 		printlen = ntohs(h->len);
1491 		log(LOG_DEBUG,
1492 		    "%s: %s input(%s): <%s id=0x%x len=%d",
1493 		    ifp->if_xname, cp->name,
1494 		    sppp_state_name(sp->state[cp->protoidx]),
1495 		    sppp_cp_type_name(h->type), h->ident, printlen);
1496 		if (len < printlen)
1497 			printlen = len;
1498 		if (printlen > 4)
1499 			sppp_print_bytes((u_char *)(h + 1), printlen - 4);
1500 		addlog(">\n");
1501 	}
1502 	if (len > ntohs(h->len))
1503 		len = ntohs(h->len);
1504 	p = (u_char *)(h + 1);
1505 	switch (h->type) {
1506 	case CONF_REQ:
1507 		if (len < 4) {
1508 			if (debug)
1509 				addlog("%s: %s invalid conf-req length %d\n",
1510 				       ifp->if_xname, cp->name,
1511 				       len);
1512 			sppp_lock_enter(sp);
1513 			++ifp->if_ierrors;
1514 			sppp_lock_exit(sp);
1515 			break;
1516 		}
1517 		/* handle states where RCR doesn't get a SCA/SCN */
1518 		sppp_lock_enter(sp);
1519 		switch (sp->state[cp->protoidx]) {
1520 		case STATE_CLOSING:
1521 		case STATE_STOPPING:
1522 			sppp_lock_exit(sp);
1523 			return;
1524 		case STATE_CLOSED:
1525 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident,
1526 				     0, 0);
1527 			sppp_lock_exit(sp);
1528 			return;
1529 		}
1530 		rv = (cp->RCR)(sp, h, len);
1531 		if (rv < 0) {
1532 			/* fatal error, shut down */
1533 			(cp->tld)(sp);
1534 			sppp_lcp_tlf(sp);
1535 			sppp_lock_exit(sp);
1536 			return;
1537 		}
1538 		switch (sp->state[cp->protoidx]) {
1539 		case STATE_OPENED:
1540 			(cp->tld)(sp);
1541 			(cp->scr)(sp);
1542 			/* fall through... */
1543 		case STATE_ACK_SENT:
1544 		case STATE_REQ_SENT:
1545 			sppp_cp_change_state(cp, sp, rv?
1546 					     STATE_ACK_SENT: STATE_REQ_SENT);
1547 			break;
1548 		case STATE_STOPPED:
1549 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1550 			(cp->scr)(sp);
1551 			sppp_cp_change_state(cp, sp, rv?
1552 					     STATE_ACK_SENT: STATE_REQ_SENT);
1553 			break;
1554 		case STATE_ACK_RCVD:
1555 			if (rv) {
1556 				sppp_cp_change_state(cp, sp, STATE_OPENED);
1557 				if (debug)
1558 					log(LOG_DEBUG, "%s: %s tlu\n",
1559 					    ifp->if_xname,
1560 					    cp->name);
1561 				(cp->tlu)(sp);
1562 			} else
1563 				sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1564 			break;
1565 		default:
1566 			sppp_lock_enter(sp);
1567 			printf("%s: %s illegal %s in state %s\n",
1568 			       ifp->if_xname, cp->name,
1569 			       sppp_cp_type_name(h->type),
1570 			       sppp_state_name(sp->state[cp->protoidx]));
1571 			++ifp->if_ierrors;
1572 		}
1573 		sppp_lock_exit(sp);
1574 		break;
1575 	case CONF_ACK:
1576 		sppp_lock_enter(sp);
1577 		if (h->ident != sp->confid[cp->protoidx]) {
1578 			if (debug)
1579 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
1580 				       ifp->if_xname, cp->name,
1581 				       h->ident, sp->confid[cp->protoidx]);
1582 			++ifp->if_ierrors;
1583 			sppp_lock_exit(sp);
1584 			break;
1585 		}
1586 		switch (sp->state[cp->protoidx]) {
1587 		case STATE_CLOSED:
1588 		case STATE_STOPPED:
1589 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1590 			break;
1591 		case STATE_CLOSING:
1592 		case STATE_STOPPING:
1593 			break;
1594 		case STATE_REQ_SENT:
1595 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1596 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1597 			break;
1598 		case STATE_OPENED:
1599 			(cp->tld)(sp);
1600 			/* fall through */
1601 		case STATE_ACK_RCVD:
1602 			(cp->scr)(sp);
1603 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1604 			break;
1605 		case STATE_ACK_SENT:
1606 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1607 			sppp_cp_change_state(cp, sp, STATE_OPENED);
1608 			if (debug)
1609 				log(LOG_DEBUG, "%s: %s tlu\n",
1610 				       ifp->if_xname, cp->name);
1611 			(cp->tlu)(sp);
1612 			break;
1613 		default:
1614 			printf("%s: %s illegal %s in state %s\n",
1615 			       ifp->if_xname, cp->name,
1616 			       sppp_cp_type_name(h->type),
1617 			       sppp_state_name(sp->state[cp->protoidx]));
1618 			++ifp->if_ierrors;
1619 		}
1620 		sppp_lock_exit(sp);
1621 		break;
1622 	case CONF_NAK:
1623 	case CONF_REJ:
1624 		sppp_lock_enter(sp);
1625 		if (h->ident != sp->confid[cp->protoidx]) {
1626 			if (debug)
1627 				addlog("%s: %s id mismatch 0x%x != 0x%x\n",
1628 				       ifp->if_xname, cp->name,
1629 				       h->ident, sp->confid[cp->protoidx]);
1630 			++ifp->if_ierrors;
1631 			sppp_lock_exit(sp);
1632 			break;
1633 		}
1634 		if (h->type == CONF_NAK)
1635 			(cp->RCN_nak)(sp, h, len);
1636 		else /* CONF_REJ */
1637 			(cp->RCN_rej)(sp, h, len);
1638 
1639 		switch (sp->state[cp->protoidx]) {
1640 		case STATE_CLOSED:
1641 		case STATE_STOPPED:
1642 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1643 			break;
1644 		case STATE_REQ_SENT:
1645 		case STATE_ACK_SENT:
1646 			sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1647 			(cp->scr)(sp);
1648 			break;
1649 		case STATE_OPENED:
1650 			(cp->tld)(sp);
1651 			/* fall through */
1652 		case STATE_ACK_RCVD:
1653 			sppp_cp_change_state(cp, sp, STATE_ACK_SENT);
1654 			(cp->scr)(sp);
1655 			break;
1656 		case STATE_CLOSING:
1657 		case STATE_STOPPING:
1658 			break;
1659 		default:
1660 			printf("%s: %s illegal %s in state %s\n",
1661 			       ifp->if_xname, cp->name,
1662 			       sppp_cp_type_name(h->type),
1663 			       sppp_state_name(sp->state[cp->protoidx]));
1664 			++ifp->if_ierrors;
1665 		}
1666 		sppp_lock_exit(sp);
1667 		break;
1668 
1669 	case TERM_REQ:
1670 		sppp_lock_enter(sp);
1671 		switch (sp->state[cp->protoidx]) {
1672 		case STATE_ACK_RCVD:
1673 		case STATE_ACK_SENT:
1674 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1675 			/* fall through */
1676 		case STATE_CLOSED:
1677 		case STATE_STOPPED:
1678 		case STATE_CLOSING:
1679 		case STATE_STOPPING:
1680 		case STATE_REQ_SENT:
1681 		  sta:
1682 			/* Send Terminate-Ack packet. */
1683 			if (debug)
1684 				log(LOG_DEBUG, "%s: %s send terminate-ack\n",
1685 				    ifp->if_xname, cp->name);
1686 			sppp_cp_send(sp, cp->proto, TERM_ACK, h->ident, 0, 0);
1687 			break;
1688 		case STATE_OPENED:
1689 			(cp->tld)(sp);
1690 			sp->rst_counter[cp->protoidx] = 0;
1691 			sppp_cp_change_state(cp, sp, STATE_STOPPING);
1692 			goto sta;
1693 		default:
1694 			printf("%s: %s illegal %s in state %s\n",
1695 			       ifp->if_xname, cp->name,
1696 			       sppp_cp_type_name(h->type),
1697 			       sppp_state_name(sp->state[cp->protoidx]));
1698 			++ifp->if_ierrors;
1699 		}
1700 		sppp_lock_exit(sp);
1701 		break;
1702 	case TERM_ACK:
1703 		sppp_lock_enter(sp);
1704 		switch (sp->state[cp->protoidx]) {
1705 		case STATE_CLOSED:
1706 		case STATE_STOPPED:
1707 		case STATE_REQ_SENT:
1708 		case STATE_ACK_SENT:
1709 			break;
1710 		case STATE_CLOSING:
1711 			(cp->tlf)(sp);
1712 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
1713 			sppp_lcp_check_and_close(sp);
1714 			break;
1715 		case STATE_STOPPING:
1716 			(cp->tlf)(sp);
1717 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
1718 			sppp_lcp_check_and_close(sp);
1719 			break;
1720 		case STATE_ACK_RCVD:
1721 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1722 			break;
1723 		case STATE_OPENED:
1724 			(cp->tld)(sp);
1725 			(cp->scr)(sp);
1726 			sppp_cp_change_state(cp, sp, STATE_ACK_RCVD);
1727 			break;
1728 		default:
1729 			printf("%s: %s illegal %s in state %s\n",
1730 			       ifp->if_xname, cp->name,
1731 			       sppp_cp_type_name(h->type),
1732 			       sppp_state_name(sp->state[cp->protoidx]));
1733 			++ifp->if_ierrors;
1734 		}
1735 		sppp_lock_exit(sp);
1736 		break;
1737 	case CODE_REJ:
1738 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1739 		sppp_lock_enter(sp);
1740 		log(LOG_INFO,
1741 		    "%s: %s: ignoring RXJ (%s) for code ?, "
1742 		    "danger will robinson\n",
1743 		    ifp->if_xname, cp->name,
1744 		    sppp_cp_type_name(h->type));
1745 		switch (sp->state[cp->protoidx]) {
1746 		case STATE_CLOSED:
1747 		case STATE_STOPPED:
1748 		case STATE_REQ_SENT:
1749 		case STATE_ACK_SENT:
1750 		case STATE_CLOSING:
1751 		case STATE_STOPPING:
1752 		case STATE_OPENED:
1753 			break;
1754 		case STATE_ACK_RCVD:
1755 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1756 			break;
1757 		default:
1758 			printf("%s: %s illegal %s in state %s\n",
1759 			       ifp->if_xname, cp->name,
1760 			       sppp_cp_type_name(h->type),
1761 			       sppp_state_name(sp->state[cp->protoidx]));
1762 			++ifp->if_ierrors;
1763 		}
1764 		sppp_lock_exit(sp);
1765 		break;
1766 	case PROTO_REJ:
1767 	    {
1768 		int catastrophic;
1769 		const struct cp *upper;
1770 		int i;
1771 		uint16_t proto;
1772 
1773 		catastrophic = 0;
1774 		upper = NULL;
1775 		proto = p[0] << 8 | p[1];
1776 		for (i = 0; i < IDX_COUNT; i++) {
1777 			if (cps[i]->proto == proto) {
1778 				upper = cps[i];
1779 				break;
1780 			}
1781 		}
1782 		if (upper == NULL)
1783 			catastrophic++;
1784 
1785 		sppp_lock_enter(sp);
1786 
1787 		if (debug)
1788 			log(LOG_INFO,
1789 			    "%s: %s: RXJ%c (%s) for proto 0x%x (%s/%s)\n",
1790 			    ifp->if_xname, cp->name, catastrophic ? '-' : '+',
1791 			    sppp_cp_type_name(h->type), proto,
1792 			    upper ? upper->name : "unknown",
1793 			    upper ? sppp_state_name(sp->state[upper->protoidx]) : "?");
1794 
1795 		/*
1796 		 * if we got RXJ+ against conf-req, the peer does not implement
1797 		 * this particular protocol type.  terminate the protocol.
1798 		 */
1799 		if (upper && !catastrophic) {
1800 			if (sp->state[upper->protoidx] == STATE_REQ_SENT) {
1801 				upper->Close(sp);
1802 				sppp_lock_exit(sp);
1803 				break;
1804 			}
1805 		}
1806 
1807 		/* XXX catastrophic rejects (RXJ-) aren't handled yet. */
1808 		switch (sp->state[cp->protoidx]) {
1809 		case STATE_CLOSED:
1810 		case STATE_STOPPED:
1811 		case STATE_REQ_SENT:
1812 		case STATE_ACK_SENT:
1813 		case STATE_CLOSING:
1814 		case STATE_STOPPING:
1815 		case STATE_OPENED:
1816 			break;
1817 		case STATE_ACK_RCVD:
1818 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1819 			break;
1820 		default:
1821 			printf("%s: %s illegal %s in state %s\n",
1822 			       ifp->if_xname, cp->name,
1823 			       sppp_cp_type_name(h->type),
1824 			       sppp_state_name(sp->state[cp->protoidx]));
1825 			++ifp->if_ierrors;
1826 		}
1827 		sppp_lock_exit(sp);
1828 		break;
1829 	    }
1830 	case DISC_REQ:
1831 		if (cp->proto != PPP_LCP)
1832 			goto illegal;
1833 		/* Discard the packet. */
1834 		break;
1835 	case ECHO_REQ:
1836 		if (cp->proto != PPP_LCP)
1837 			goto illegal;
1838 		sppp_lock_enter(sp);
1839 		if (sp->state[cp->protoidx] != STATE_OPENED) {
1840 			if (debug)
1841 				addlog("%s: lcp echo req but lcp closed\n",
1842 				       ifp->if_xname);
1843 			++ifp->if_ierrors;
1844 			sppp_lock_exit(sp);
1845 			break;
1846 		}
1847 		if (len < 8) {
1848 			if (debug)
1849 				addlog("%s: invalid lcp echo request "
1850 				       "packet length: %d bytes\n",
1851 				       ifp->if_xname, len);
1852 			sppp_lock_exit(sp);
1853 			break;
1854 		}
1855 		memcpy(&u32, h + 1, sizeof u32);
1856 		if (ntohl(u32) == sp->lcp.magic) {
1857 			/* Line loopback mode detected. */
1858 			printf("%s: loopback\n", ifp->if_xname);
1859 			if_down(ifp);
1860 			IF_PURGE(&sp->pp_cpq);
1861 
1862 			/* Shut down the PPP link. */
1863 			/* XXX */
1864 			lcp.Down(sp);
1865 			lcp.Up(sp);
1866 			sppp_lock_exit(sp);
1867 			break;
1868 		}
1869 		u32 = htonl(sp->lcp.magic);
1870 		memcpy(h + 1, &u32, sizeof u32);
1871 		if (debug)
1872 			addlog("%s: got lcp echo req, sending echo rep\n",
1873 			       ifp->if_xname);
1874 		sppp_cp_send(sp, PPP_LCP, ECHO_REPLY, h->ident, len - 4,
1875 		    h + 1);
1876 		sppp_lock_exit(sp);
1877 		break;
1878 	case ECHO_REPLY:
1879 		if (cp->proto != PPP_LCP)
1880 			goto illegal;
1881 		sppp_lock_enter(sp);
1882 		if (h->ident != sp->lcp.echoid) {
1883 			++ifp->if_ierrors;
1884 			sppp_lock_exit(sp);
1885 			break;
1886 		}
1887 		if (len < 8) {
1888 			if (debug)
1889 				addlog("%s: lcp invalid echo reply "
1890 				       "packet length: %d bytes\n",
1891 				       ifp->if_xname, len);
1892 			sppp_lock_exit(sp);
1893 			break;
1894 		}
1895 		if (debug)
1896 			addlog("%s: lcp got echo rep\n",
1897 			       ifp->if_xname);
1898 		memcpy(&u32, h + 1, sizeof u32);
1899 		if (ntohl(u32) != sp->lcp.magic)
1900 			sp->pp_alivecnt = 0;
1901 		sppp_lock_exit(sp);
1902 		break;
1903 	default:
1904 		/* Unknown packet type -- send Code-Reject packet. */
1905 	  illegal:
1906 		sppp_lock_enter(sp);
1907 		if (debug)
1908 			addlog("%s: %s send code-rej for 0x%x\n",
1909 			       ifp->if_xname, cp->name, h->type);
1910 		sppp_cp_send(sp, cp->proto, CODE_REJ,
1911 		    ++sp->pp_seq[cp->protoidx], m->m_pkthdr.len, h);
1912 		++ifp->if_ierrors;
1913 		sppp_lock_exit(sp);
1914 	}
1915 }
1916 
1917 
1918 /*
1919  * The generic part of all Up/Down/Open/Close/TO event handlers.
1920  * Basically, the state transition handling in the automaton.
1921  */
1922 static void
1923 sppp_up_event(const struct cp *cp, struct sppp *sp)
1924 {
1925 	STDDCL;
1926 
1927 	KASSERT(sppp_locked(sp));
1928 
1929 	if (debug)
1930 		log(LOG_DEBUG, "%s: %s up(%s)\n",
1931 		    ifp->if_xname, cp->name,
1932 		    sppp_state_name(sp->state[cp->protoidx]));
1933 
1934 	switch (sp->state[cp->protoidx]) {
1935 	case STATE_INITIAL:
1936 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
1937 		break;
1938 	case STATE_STARTING:
1939 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
1940 		(cp->scr)(sp);
1941 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
1942 		break;
1943 	default:
1944 		printf("%s: %s illegal up in state %s\n",
1945 		       ifp->if_xname, cp->name,
1946 		       sppp_state_name(sp->state[cp->protoidx]));
1947 	}
1948 }
1949 
1950 static void
1951 sppp_down_event(const struct cp *cp, struct sppp *sp)
1952 {
1953 	STDDCL;
1954 
1955 	KASSERT(sppp_locked(sp));
1956 
1957 	if (debug)
1958 		log(LOG_DEBUG, "%s: %s down(%s)\n",
1959 		    ifp->if_xname, cp->name,
1960 		    sppp_state_name(sp->state[cp->protoidx]));
1961 
1962 	switch (sp->state[cp->protoidx]) {
1963 	case STATE_CLOSED:
1964 	case STATE_CLOSING:
1965 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
1966 		break;
1967 	case STATE_STOPPED:
1968 		(cp->tls)(sp);
1969 		/* fall through */
1970 	case STATE_STOPPING:
1971 	case STATE_REQ_SENT:
1972 	case STATE_ACK_RCVD:
1973 	case STATE_ACK_SENT:
1974 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1975 		break;
1976 	case STATE_OPENED:
1977 		(cp->tld)(sp);
1978 		sppp_cp_change_state(cp, sp, STATE_STARTING);
1979 		break;
1980 	default:
1981 		printf("%s: %s illegal down in state %s\n",
1982 		       ifp->if_xname, cp->name,
1983 		       sppp_state_name(sp->state[cp->protoidx]));
1984 	}
1985 }
1986 
1987 
1988 static void
1989 sppp_open_event(const struct cp *cp, struct sppp *sp)
1990 {
1991 	STDDCL;
1992 
1993 	KASSERT(sppp_locked(sp));
1994 
1995 	if (debug)
1996 		log(LOG_DEBUG, "%s: %s open(%s)\n",
1997 		    ifp->if_xname, cp->name,
1998 		    sppp_state_name(sp->state[cp->protoidx]));
1999 
2000 	switch (sp->state[cp->protoidx]) {
2001 	case STATE_INITIAL:
2002 		sppp_cp_change_state(cp, sp, STATE_STARTING);
2003 		(cp->tls)(sp);
2004 		break;
2005 	case STATE_STARTING:
2006 		break;
2007 	case STATE_CLOSED:
2008 		sp->rst_counter[cp->protoidx] = sp->lcp.max_configure;
2009 		(cp->scr)(sp);
2010 		sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2011 		break;
2012 	case STATE_STOPPED:
2013 	case STATE_STOPPING:
2014 	case STATE_REQ_SENT:
2015 	case STATE_ACK_RCVD:
2016 	case STATE_ACK_SENT:
2017 	case STATE_OPENED:
2018 		break;
2019 	case STATE_CLOSING:
2020 		sppp_cp_change_state(cp, sp, STATE_STOPPING);
2021 		break;
2022 	}
2023 }
2024 
2025 
2026 static void
2027 sppp_close_event(const struct cp *cp, struct sppp *sp)
2028 {
2029 	STDDCL;
2030 
2031 	KASSERT(sppp_locked(sp));
2032 
2033 	if (debug)
2034 		log(LOG_DEBUG, "%s: %s close(%s)\n",
2035 		    ifp->if_xname, cp->name,
2036 		    sppp_state_name(sp->state[cp->protoidx]));
2037 
2038 	switch (sp->state[cp->protoidx]) {
2039 	case STATE_INITIAL:
2040 	case STATE_CLOSED:
2041 	case STATE_CLOSING:
2042 		break;
2043 	case STATE_STARTING:
2044 		sppp_cp_change_state(cp, sp, STATE_INITIAL);
2045 		(cp->tlf)(sp);
2046 		break;
2047 	case STATE_STOPPED:
2048 		sppp_cp_change_state(cp, sp, STATE_CLOSED);
2049 		break;
2050 	case STATE_STOPPING:
2051 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
2052 		break;
2053 	case STATE_OPENED:
2054 		(cp->tld)(sp);
2055 		/* fall through */
2056 	case STATE_REQ_SENT:
2057 	case STATE_ACK_RCVD:
2058 	case STATE_ACK_SENT:
2059 		sp->rst_counter[cp->protoidx] = sp->lcp.max_terminate;
2060 		sppp_cp_send(sp, cp->proto, TERM_REQ,
2061 		    ++sp->pp_seq[cp->protoidx], 0, 0);
2062 		sppp_cp_change_state(cp, sp, STATE_CLOSING);
2063 		break;
2064 	}
2065 }
2066 
2067 static void
2068 sppp_to_event(const struct cp *cp, struct sppp *sp)
2069 {
2070 	STDDCL;
2071 	int s;
2072 
2073 	KASSERT(sppp_locked(sp));
2074 
2075 	s = splnet();
2076 
2077 	if (debug)
2078 		log(LOG_DEBUG, "%s: %s TO(%s) rst_counter = %d\n",
2079 		    ifp->if_xname, cp->name,
2080 		    sppp_state_name(sp->state[cp->protoidx]),
2081 		    sp->rst_counter[cp->protoidx]);
2082 
2083 	if (--sp->rst_counter[cp->protoidx] < 0)
2084 		/* TO- event */
2085 		switch (sp->state[cp->protoidx]) {
2086 		case STATE_CLOSING:
2087 			(cp->tlf)(sp);
2088 			sppp_cp_change_state(cp, sp, STATE_CLOSED);
2089 			sppp_lcp_check_and_close(sp);
2090 			break;
2091 		case STATE_STOPPING:
2092 			(cp->tlf)(sp);
2093 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
2094 			sppp_lcp_check_and_close(sp);
2095 			break;
2096 		case STATE_REQ_SENT:
2097 		case STATE_ACK_RCVD:
2098 		case STATE_ACK_SENT:
2099 			(cp->tlf)(sp);
2100 			sppp_cp_change_state(cp, sp, STATE_STOPPED);
2101 			sppp_lcp_check_and_close(sp);
2102 			break;
2103 		}
2104 	else
2105 		/* TO+ event */
2106 		switch (sp->state[cp->protoidx]) {
2107 		case STATE_CLOSING:
2108 		case STATE_STOPPING:
2109 			sppp_cp_send(sp, cp->proto, TERM_REQ,
2110 			    ++sp->pp_seq[cp->protoidx], 0, 0);
2111 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
2112 			    cp->TO, sp);
2113 			break;
2114 		case STATE_REQ_SENT:
2115 		case STATE_ACK_RCVD:
2116 			(cp->scr)(sp);
2117 			/* sppp_cp_change_state() will restart the timer */
2118 			sppp_cp_change_state(cp, sp, STATE_REQ_SENT);
2119 			break;
2120 		case STATE_ACK_SENT:
2121 			(cp->scr)(sp);
2122 			callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
2123 			    cp->TO, sp);
2124 			break;
2125 		}
2126 
2127 	splx(s);
2128 }
2129 
2130 /*
2131  * Change the state of a control protocol in the state automaton.
2132  * Takes care of starting/stopping the restart timer.
2133  */
2134 void
2135 sppp_cp_change_state(const struct cp *cp, struct sppp *sp, int newstate)
2136 {
2137 	KASSERT(sppp_locked(sp));
2138 
2139 	sp->state[cp->protoidx] = newstate;
2140 	callout_stop(&sp->ch[cp->protoidx]);
2141 	switch (newstate) {
2142 	case STATE_INITIAL:
2143 	case STATE_STARTING:
2144 	case STATE_CLOSED:
2145 	case STATE_STOPPED:
2146 	case STATE_OPENED:
2147 		break;
2148 	case STATE_CLOSING:
2149 	case STATE_STOPPING:
2150 	case STATE_REQ_SENT:
2151 	case STATE_ACK_RCVD:
2152 	case STATE_ACK_SENT:
2153 		callout_reset(&sp->ch[cp->protoidx], sp->lcp.timeout,
2154 		    cp->TO, sp);
2155 		break;
2156 	}
2157 }
2158 
2159 /*
2160  *--------------------------------------------------------------------------*
2161  *                                                                          *
2162  *                         The LCP implementation.                          *
2163  *                                                                          *
2164  *--------------------------------------------------------------------------*
2165  */
2166 static void
2167 sppp_lcp_init(struct sppp *sp)
2168 {
2169 	sppp_lock_enter(sp);
2170 	sp->lcp.opts = (1 << LCP_OPT_MAGIC);
2171 	sp->lcp.magic = 0;
2172 	sp->state[IDX_LCP] = STATE_INITIAL;
2173 	sp->fail_counter[IDX_LCP] = 0;
2174 	sp->pp_seq[IDX_LCP] = 0;
2175 	sp->pp_rseq[IDX_LCP] = 0;
2176 	sp->lcp.protos = 0;
2177 
2178 	/*
2179 	 * Initialize counters and timeout values.  Note that we don't
2180 	 * use the 3 seconds suggested in RFC 1661 since we are likely
2181 	 * running on a fast link.  XXX We should probably implement
2182 	 * the exponential backoff option.  Note that these values are
2183 	 * relevant for all control protocols, not just LCP only.
2184 	 */
2185 	sp->lcp.timeout = 1 * hz;
2186 	sp->lcp.max_terminate = 2;
2187 	sp->lcp.max_configure = 10;
2188 	sp->lcp.max_failure = 10;
2189 	callout_init(&sp->ch[IDX_LCP], 0);
2190 	sppp_lock_exit(sp);
2191 }
2192 
2193 static void
2194 sppp_lcp_up(struct sppp *sp)
2195 {
2196 	STDDCL;
2197 
2198 	KASSERT(sppp_locked(sp));
2199 
2200 	/* Initialize activity timestamp: opening a connection is an activity */
2201 	sp->pp_last_receive = sp->pp_last_activity = time_uptime;
2202 
2203 	/*
2204 	 * If this interface is passive or dial-on-demand, and we are
2205 	 * still in Initial state, it means we've got an incoming
2206 	 * call.  Activate the interface.
2207 	 */
2208 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) != 0) {
2209 		if (debug)
2210 			log(LOG_DEBUG,
2211 			    "%s: Up event", ifp->if_xname);
2212 		ifp->if_flags |= IFF_RUNNING;
2213 		if (sp->state[IDX_LCP] == STATE_INITIAL) {
2214 			if (debug)
2215 				addlog("(incoming call)\n");
2216 			sp->pp_flags |= PP_CALLIN;
2217 			lcp.Open(sp);
2218 		} else if (debug)
2219 			addlog("\n");
2220 	} else if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0 &&
2221 		   (sp->state[IDX_LCP] == STATE_INITIAL)) {
2222 			ifp->if_flags |= IFF_RUNNING;
2223 			lcp.Open(sp);
2224 	}
2225 
2226 	sppp_up_event(&lcp, sp);
2227 }
2228 
2229 static void
2230 sppp_lcp_down(struct sppp *sp)
2231 {
2232 	STDDCL;
2233 
2234 	KASSERT(sppp_locked(sp));
2235 
2236 	sppp_down_event(&lcp, sp);
2237 
2238 	/*
2239 	 * If this is neither a dial-on-demand nor a passive
2240 	 * interface, simulate an ``ifconfig down'' action, so the
2241 	 * administrator can force a redial by another ``ifconfig
2242 	 * up''.  XXX For leased line operation, should we immediately
2243 	 * try to reopen the connection here?
2244 	 */
2245 	if ((ifp->if_flags & (IFF_AUTO | IFF_PASSIVE)) == 0) {
2246 		if (debug)
2247 			log(LOG_INFO,
2248 			    "%s: Down event (carrier loss), taking interface down.\n",
2249 			    ifp->if_xname);
2250 		sppp_lock_exit(sp);
2251 		if_down(ifp);
2252 		sppp_lock_enter(sp);
2253 	} else {
2254 		if (debug)
2255 			log(LOG_DEBUG,
2256 			    "%s: Down event (carrier loss)\n",
2257 			    ifp->if_xname);
2258 	}
2259 	sp->pp_flags &= ~PP_CALLIN;
2260 	if (sp->state[IDX_LCP] != STATE_INITIAL)
2261 		lcp.Close(sp);
2262 	ifp->if_flags &= ~IFF_RUNNING;
2263 }
2264 
2265 static void
2266 sppp_lcp_open(struct sppp *sp)
2267 {
2268 	KASSERT(sppp_locked(sp));
2269 
2270 	if (sp->pp_if.if_mtu < PP_MTU) {
2271 		sp->lcp.mru = sp->pp_if.if_mtu;
2272 		sp->lcp.opts |= (1 << LCP_OPT_MRU);
2273 	} else
2274 		sp->lcp.mru = PP_MTU;
2275 	sp->lcp.their_mru = PP_MTU;
2276 
2277 	/*
2278 	 * If we are authenticator, negotiate LCP_AUTH
2279 	 */
2280 	if (sp->hisauth.proto != 0)
2281 		sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
2282 	else
2283 		sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2284 	sp->pp_flags &= ~PP_NEEDAUTH;
2285 	sppp_open_event(&lcp, sp);
2286 }
2287 
2288 static void
2289 sppp_lcp_close(struct sppp *sp)
2290 {
2291 	KASSERT(sppp_locked(sp));
2292 	sppp_close_event(&lcp, sp);
2293 }
2294 
2295 static void
2296 sppp_lcp_TO(void *cookie)
2297 {
2298 	struct sppp *sp = (struct sppp*)cookie;
2299 	KASSERT(!sppp_locked(sp));
2300 
2301 	sppp_lock_enter(sp);
2302 	sppp_to_event(&lcp, sp);
2303 	sppp_lock_exit(sp);
2304 }
2305 
2306 /*
2307  * Analyze a configure request.  Return true if it was agreeable, and
2308  * caused action sca, false if it has been rejected or nak'ed, and
2309  * caused action scn.  (The return value is used to make the state
2310  * transition decision in the state automaton.)
2311  */
2312 static int
2313 sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
2314 {
2315 	STDDCL;
2316 	u_char *buf, *r, *p, l, blen;
2317 	int origlen, rlen;
2318 	uint32_t nmagic;
2319 	u_short authproto;
2320 
2321 	KASSERT(sppp_locked(sp));
2322 
2323 	len -= 4;
2324 	origlen = len;
2325 	buf = r = malloc (blen = len, M_TEMP, M_NOWAIT);
2326 	if (! buf)
2327 		return (0);
2328 
2329 	if (debug)
2330 		log(LOG_DEBUG, "%s: lcp parse opts:",
2331 		    ifp->if_xname);
2332 
2333 	/* pass 1: check for things that need to be rejected */
2334 	p = (void *)(h + 1);
2335 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
2336 		/* Sanity check option length */
2337 		if (l > len) {
2338 			/*
2339 			 * Malicious option - drop immediately.
2340 			 * XXX Maybe we should just RXJ it?
2341 			 */
2342 			addlog("%s: received malicious LCP option 0x%02x, "
2343 			    "length 0x%02x, (len: 0x%02x) dropping.\n", ifp->if_xname,
2344 			    p[0], l, len);
2345 			goto drop;
2346 		}
2347 		if (debug)
2348 			addlog(" %s", sppp_lcp_opt_name(*p));
2349 		switch (*p) {
2350 		case LCP_OPT_MAGIC:
2351 			/* Magic number. */
2352 			/* fall through, both are same length */
2353 		case LCP_OPT_ASYNC_MAP:
2354 			/* Async control character map. */
2355 			if (len >= 6 || l == 6)
2356 				continue;
2357 			if (debug)
2358 				addlog(" [invalid]");
2359 			break;
2360 		case LCP_OPT_MRU:
2361 			/* Maximum receive unit. */
2362 			if (len >= 4 && l == 4)
2363 				continue;
2364 			if (debug)
2365 				addlog(" [invalid]");
2366 			break;
2367 		case LCP_OPT_AUTH_PROTO:
2368 			if (len < 4) {
2369 				if (debug)
2370 					addlog(" [invalid]");
2371 				break;
2372 			}
2373 			authproto = (p[2] << 8) + p[3];
2374 			if (authproto == PPP_CHAP && l != 5) {
2375 				if (debug)
2376 					addlog(" [invalid chap len]");
2377 				break;
2378 			}
2379 			if (sp->myauth.proto == 0) {
2380 				/* we are not configured to do auth */
2381 				if (debug)
2382 					addlog(" [not configured]");
2383 				break;
2384 			}
2385 			/*
2386 			 * Remote want us to authenticate, remember this,
2387 			 * so we stay in SPPP_PHASE_AUTHENTICATE after LCP got
2388 			 * up.
2389 			 */
2390 			sp->pp_flags |= PP_NEEDAUTH;
2391 			continue;
2392 		default:
2393 			/* Others not supported. */
2394 			if (debug)
2395 				addlog(" [rej]");
2396 			break;
2397 		}
2398 		if (rlen + l > blen) {
2399 			if (debug)
2400 				addlog(" [overflow]");
2401 			continue;
2402 		}
2403 		/* Add the option to rejected list. */
2404 		memcpy(r, p, l);
2405 		r += l;
2406 		rlen += l;
2407 	}
2408 	if (rlen) {
2409 		if (debug)
2410 			addlog(" send conf-rej\n");
2411 		sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2412 		goto end;
2413 	} else if (debug)
2414 		addlog("\n");
2415 
2416 	/*
2417 	 * pass 2: check for option values that are unacceptable and
2418 	 * thus require to be nak'ed.
2419 	 */
2420 	if (debug)
2421 		log(LOG_DEBUG, "%s: lcp parse opt values: ",
2422 		    ifp->if_xname);
2423 
2424 	p = (void *)(h + 1);
2425 	len = origlen;
2426 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
2427 		if (debug)
2428 			addlog(" %s", sppp_lcp_opt_name(*p));
2429 		switch (*p) {
2430 		case LCP_OPT_MAGIC:
2431 			/* Magic number -- extract. */
2432 			nmagic = (uint32_t)p[2] << 24 |
2433 				(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
2434 			if (nmagic != sp->lcp.magic) {
2435 				if (debug)
2436 					addlog(" 0x%x", nmagic);
2437 				continue;
2438 			}
2439 			/*
2440 			 * Local and remote magics equal -- loopback?
2441 			 */
2442 			if (sp->pp_loopcnt >= LOOPALIVECNT*5) {
2443 				printf ("%s: loopback\n",
2444 					ifp->if_xname);
2445 				sp->pp_loopcnt = 0;
2446 				if (ifp->if_flags & IFF_UP) {
2447 					sppp_lock_exit(sp);
2448 					if_down(ifp);
2449 					sppp_lock_enter(sp);
2450 					IF_PURGE(&sp->pp_cpq);
2451 					/* XXX ? */
2452 					lcp.Down(sp);
2453 					lcp.Up(sp);
2454 				}
2455 			} else if (debug)
2456 				addlog(" [glitch]");
2457 			++sp->pp_loopcnt;
2458 			/*
2459 			 * We negate our magic here, and NAK it.  If
2460 			 * we see it later in an NAK packet, we
2461 			 * suggest a new one.
2462 			 */
2463 			nmagic = ~sp->lcp.magic;
2464 			/* Gonna NAK it. */
2465 			p[2] = nmagic >> 24;
2466 			p[3] = nmagic >> 16;
2467 			p[4] = nmagic >> 8;
2468 			p[5] = nmagic;
2469 			break;
2470 
2471 		case LCP_OPT_ASYNC_MAP:
2472 			/*
2473 			 * Async control character map -- just ignore it.
2474 			 *
2475 			 * Quote from RFC 1662, chapter 6:
2476 			 * To enable this functionality, synchronous PPP
2477 			 * implementations MUST always respond to the
2478 			 * Async-Control-Character-Map Configuration
2479 			 * Option with the LCP Configure-Ack.  However,
2480 			 * acceptance of the Configuration Option does
2481 			 * not imply that the synchronous implementation
2482 			 * will do any ACCM mapping.  Instead, all such
2483 			 * octet mapping will be performed by the
2484 			 * asynchronous-to-synchronous converter.
2485 			 */
2486 			continue;
2487 
2488 		case LCP_OPT_MRU:
2489 			/*
2490 			 * Maximum receive unit.  Always agreeable,
2491 			 * but ignored by now.
2492 			 */
2493 			sp->lcp.their_mru = p[2] * 256 + p[3];
2494 			if (debug)
2495 				addlog(" %ld", sp->lcp.their_mru);
2496 			continue;
2497 
2498 		case LCP_OPT_AUTH_PROTO:
2499 			authproto = (p[2] << 8) + p[3];
2500 			if (sp->myauth.proto != authproto) {
2501 				/* not agreed, nak */
2502 				if (debug)
2503 					addlog(" [mine %s != his %s]",
2504 					       sppp_proto_name(sp->myauth.proto),
2505 					       sppp_proto_name(authproto));
2506 				p[2] = sp->myauth.proto >> 8;
2507 				p[3] = sp->myauth.proto;
2508 				break;
2509 			}
2510 			if (authproto == PPP_CHAP && p[4] != CHAP_MD5) {
2511 				if (debug)
2512 					addlog(" [chap not MD5]");
2513 				p[4] = CHAP_MD5;
2514 				break;
2515 			}
2516 			continue;
2517 		}
2518 		if (rlen + l > blen) {
2519 			if (debug)
2520 				addlog(" [overflow]");
2521 			continue;
2522 		}
2523 		/* Add the option to nak'ed list. */
2524 		memcpy(r, p, l);
2525 		r += l;
2526 		rlen += l;
2527 	}
2528 	if (rlen) {
2529 		if (++sp->fail_counter[IDX_LCP] >= sp->lcp.max_failure) {
2530 			if (debug)
2531 				addlog(" max_failure (%d) exceeded, "
2532 				       "send conf-rej\n",
2533 				       sp->lcp.max_failure);
2534 			sppp_cp_send(sp, PPP_LCP, CONF_REJ, h->ident, rlen, buf);
2535 		} else {
2536 			if (debug)
2537 				addlog(" send conf-nak\n");
2538 			sppp_cp_send(sp, PPP_LCP, CONF_NAK, h->ident, rlen, buf);
2539 		}
2540 		goto end;
2541 	} else {
2542 		if (debug)
2543 			addlog(" send conf-ack\n");
2544 		sp->fail_counter[IDX_LCP] = 0;
2545 		sp->pp_loopcnt = 0;
2546 		sppp_cp_send(sp, PPP_LCP, CONF_ACK, h->ident, origlen, h + 1);
2547 	}
2548 
2549  end:
2550 	free(buf, M_TEMP);
2551 	return (rlen == 0);
2552 
2553  drop:
2554 	free(buf, M_TEMP);
2555 	return -1;
2556 }
2557 
2558 /*
2559  * Analyze the LCP Configure-Reject option list, and adjust our
2560  * negotiation.
2561  */
2562 static void
2563 sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
2564 {
2565 	STDDCL;
2566 	u_char *buf, *p, l;
2567 
2568 	KASSERT(sppp_locked(sp));
2569 
2570 	len -= 4;
2571 	buf = malloc (len, M_TEMP, M_NOWAIT);
2572 	if (!buf)
2573 		return;
2574 
2575 	if (debug)
2576 		log(LOG_DEBUG, "%s: lcp rej opts:",
2577 		    ifp->if_xname);
2578 
2579 	p = (void *)(h + 1);
2580 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
2581 		/* Sanity check option length */
2582 		if (l > len) {
2583 			/*
2584 			 * Malicious option - drop immediately.
2585 			 * XXX Maybe we should just RXJ it?
2586 			 */
2587 			addlog("%s: received malicious LCP option, "
2588 			    "dropping.\n", ifp->if_xname);
2589 			goto drop;
2590 		}
2591 		if (debug)
2592 			addlog(" %s", sppp_lcp_opt_name(*p));
2593 		switch (*p) {
2594 		case LCP_OPT_MAGIC:
2595 			/* Magic number -- can't use it, use 0 */
2596 			sp->lcp.opts &= ~(1 << LCP_OPT_MAGIC);
2597 			sp->lcp.magic = 0;
2598 			break;
2599 		case LCP_OPT_MRU:
2600 			/*
2601 			 * We try to negotiate a lower MRU if the underlying
2602 			 * link's MTU is less than PP_MTU (e.g. PPPoE). If the
2603 			 * peer rejects this lower rate, fallback to the
2604 			 * default.
2605 			 */
2606 			if (debug) {
2607 				addlog("%s: warning: peer rejected our MRU of "
2608 				    "%ld bytes. Defaulting to %d bytes\n",
2609 				    ifp->if_xname, sp->lcp.mru, PP_MTU);
2610 			}
2611 			sp->lcp.opts &= ~(1 << LCP_OPT_MRU);
2612 			sp->lcp.mru = PP_MTU;
2613 			break;
2614 		case LCP_OPT_AUTH_PROTO:
2615 			/*
2616 			 * Peer doesn't want to authenticate himself,
2617 			 * deny unless this is a dialout call, and
2618 			 * SPPP_AUTHFLAG_NOCALLOUT is set.
2619 			 */
2620 			if ((sp->pp_flags & PP_CALLIN) == 0 &&
2621 			    (sp->hisauth.flags & SPPP_AUTHFLAG_NOCALLOUT) != 0) {
2622 				if (debug)
2623 					addlog(" [don't insist on auth "
2624 					       "for callout]");
2625 				sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
2626 				break;
2627 			}
2628 			if (debug)
2629 				addlog("[access denied]\n");
2630 			lcp.Close(sp);
2631 			break;
2632 		}
2633 	}
2634 	if (debug)
2635 		addlog("\n");
2636 drop:
2637 	free(buf, M_TEMP);
2638 	return;
2639 }
2640 
2641 /*
2642  * Analyze the LCP Configure-NAK option list, and adjust our
2643  * negotiation.
2644  */
2645 static void
2646 sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
2647 {
2648 	STDDCL;
2649 	u_char *buf, *p, l, blen;
2650 	uint32_t magic;
2651 
2652 	KASSERT(sppp_locked(sp));
2653 
2654 	len -= 4;
2655 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
2656 	if (!buf)
2657 		return;
2658 
2659 	if (debug)
2660 		log(LOG_DEBUG, "%s: lcp nak opts:",
2661 		    ifp->if_xname);
2662 
2663 	p = (void *)(h + 1);
2664 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
2665 		/* Sanity check option length */
2666 		if (l > len) {
2667 			/*
2668 			 * Malicious option - drop immediately.
2669 			 * XXX Maybe we should just RXJ it?
2670 			 */
2671 			addlog("%s: received malicious LCP option, "
2672 			    "dropping.\n", ifp->if_xname);
2673 			goto drop;
2674 		}
2675 		if (debug)
2676 			addlog(" %s", sppp_lcp_opt_name(*p));
2677 		switch (*p) {
2678 		case LCP_OPT_MAGIC:
2679 			/* Magic number -- renegotiate */
2680 			if ((sp->lcp.opts & (1 << LCP_OPT_MAGIC)) &&
2681 			    len >= 6 && l == 6) {
2682 				magic = (uint32_t)p[2] << 24 |
2683 					(uint32_t)p[3] << 16 | p[4] << 8 | p[5];
2684 				/*
2685 				 * If the remote magic is our negated one,
2686 				 * this looks like a loopback problem.
2687 				 * Suggest a new magic to make sure.
2688 				 */
2689 				if (magic == ~sp->lcp.magic) {
2690 					if (debug)
2691 						addlog(" magic glitch");
2692 					sp->lcp.magic = cprng_fast32();
2693 				} else {
2694 					sp->lcp.magic = magic;
2695 					if (debug)
2696 						addlog(" %d", magic);
2697 				}
2698 			}
2699 			break;
2700 		case LCP_OPT_MRU:
2701 			/*
2702 			 * Peer wants to advise us to negotiate an MRU.
2703 			 * Agree on it if it's reasonable, or use
2704 			 * default otherwise.
2705 			 */
2706 			if (len >= 4 && l == 4) {
2707 				u_int mru = p[2] * 256 + p[3];
2708 				if (debug)
2709 					addlog(" %d", mru);
2710 				if (mru < PPP_MINMRU || mru > sp->pp_if.if_mtu)
2711 					mru = sp->pp_if.if_mtu;
2712 				sp->lcp.mru = mru;
2713 				sp->lcp.opts |= (1 << LCP_OPT_MRU);
2714 			}
2715 			break;
2716 		case LCP_OPT_AUTH_PROTO:
2717 			/*
2718 			 * Peer doesn't like our authentication method,
2719 			 * deny.
2720 			 */
2721 			if (debug)
2722 				addlog("[access denied]\n");
2723 			lcp.Close(sp);
2724 			break;
2725 		}
2726 	}
2727 	if (debug)
2728 		addlog("\n");
2729 drop:
2730 	free(buf, M_TEMP);
2731 	return;
2732 }
2733 
2734 static void
2735 sppp_lcp_tlu(struct sppp *sp)
2736 {
2737 	struct ifnet *ifp = &sp->pp_if;
2738 	int i;
2739 	uint32_t mask;
2740 
2741 	KASSERT(sppp_locked(sp));
2742 
2743 	/* XXX ? */
2744 	if (! (ifp->if_flags & IFF_UP) &&
2745 	    (ifp->if_flags & IFF_RUNNING)) {
2746 		/* Coming out of loopback mode. */
2747 		sppp_lock_exit(sp);
2748 		if_up(ifp);
2749 		sppp_lock_enter(sp);
2750 	}
2751 
2752 	for (i = 0; i < IDX_COUNT; i++)
2753 		if ((cps[i])->flags & CP_QUAL)
2754 			(cps[i])->Open(sp);
2755 
2756 	if ((sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0 ||
2757 	    (sp->pp_flags & PP_NEEDAUTH) != 0)
2758 		sppp_change_phase(sp, SPPP_PHASE_AUTHENTICATE);
2759 	else
2760 		sppp_change_phase(sp, SPPP_PHASE_NETWORK);
2761 
2762 	/*
2763 	 * Open all authentication protocols.  This is even required
2764 	 * if we already proceeded to network phase, since it might be
2765 	 * that remote wants us to authenticate, so we might have to
2766 	 * send a PAP request.  Undesired authentication protocols
2767 	 * don't do anything when they get an Open event.
2768 	 */
2769 	for (i = 0; i < IDX_COUNT; i++)
2770 		if ((cps[i])->flags & CP_AUTH)
2771 			(cps[i])->Open(sp);
2772 
2773 	if (sp->pp_phase == SPPP_PHASE_NETWORK) {
2774 		/* Notify all NCPs. */
2775 		for (i = 0; i < IDX_COUNT; i++)
2776 			if ((cps[i])->flags & CP_NCP)
2777 				(cps[i])->Open(sp);
2778 	}
2779 
2780 	/* Send Up events to all started protos. */
2781 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) {
2782 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
2783 			(cps[i])->Up(sp);
2784 		}
2785 	}
2786 
2787 	/* notify low-level driver of state change */
2788 	if (sp->pp_chg)
2789 		sp->pp_chg(sp, (int)sp->pp_phase);
2790 
2791 	if (sp->pp_phase == SPPP_PHASE_NETWORK)
2792 		/* if no NCP is starting, close down */
2793 		sppp_lcp_check_and_close(sp);
2794 }
2795 
2796 static void
2797 sppp_lcp_tld(struct sppp *sp)
2798 {
2799 	int i;
2800 	uint32_t mask;
2801 
2802 	KASSERT(sppp_locked(sp));
2803 
2804 	sppp_change_phase(sp, SPPP_PHASE_TERMINATE);
2805 
2806 	/*
2807 	 * Take upper layers down.  We send the Down event first and
2808 	 * the Close second to prevent the upper layers from sending
2809 	 * ``a flurry of terminate-request packets'', as the RFC
2810 	 * describes it.
2811 	 */
2812 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1) {
2813 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_LCP) == 0) {
2814 			(cps[i])->Down(sp);
2815 			(cps[i])->Close(sp);
2816 		}
2817 	}
2818 }
2819 
2820 static void
2821 sppp_lcp_tls(struct sppp *sp)
2822 {
2823 
2824 	KASSERT(sppp_locked(sp));
2825 
2826 	if (sp->pp_max_auth_fail != 0 && sp->pp_auth_failures >= sp->pp_max_auth_fail) {
2827 		printf("%s: authentication failed %d times, not retrying again\n",
2828 		sp->pp_if.if_xname, sp->pp_auth_failures);
2829 		sppp_lock_exit(sp);
2830 		if_down(&sp->pp_if);
2831 		sppp_lock_enter(sp);
2832 		return;
2833 	}
2834 
2835 	sppp_change_phase(sp, SPPP_PHASE_ESTABLISH);
2836 
2837 	/* Notify lower layer if desired. */
2838 	if (sp->pp_tls)
2839 		(sp->pp_tls)(sp);
2840 }
2841 
2842 static void
2843 sppp_lcp_tlf(struct sppp *sp)
2844 {
2845 	KASSERT(sppp_locked(sp));
2846 
2847 	sppp_change_phase(sp, SPPP_PHASE_DEAD);
2848 
2849 	/* Notify lower layer if desired. */
2850 	if (sp->pp_tlf)
2851 		(sp->pp_tlf)(sp);
2852 }
2853 
2854 static void
2855 sppp_lcp_scr(struct sppp *sp)
2856 {
2857 	char opt[6 /* magicnum */ + 4 /* mru */ + 5 /* chap */];
2858 	int i = 0;
2859 	u_short authproto;
2860 
2861 	KASSERT(sppp_locked(sp));
2862 
2863 	if (sp->lcp.opts & (1 << LCP_OPT_MAGIC)) {
2864 		if (! sp->lcp.magic)
2865 			sp->lcp.magic = cprng_fast32();
2866 		opt[i++] = LCP_OPT_MAGIC;
2867 		opt[i++] = 6;
2868 		opt[i++] = sp->lcp.magic >> 24;
2869 		opt[i++] = sp->lcp.magic >> 16;
2870 		opt[i++] = sp->lcp.magic >> 8;
2871 		opt[i++] = sp->lcp.magic;
2872 	}
2873 
2874 	if (sp->lcp.opts & (1 << LCP_OPT_MRU)) {
2875 		opt[i++] = LCP_OPT_MRU;
2876 		opt[i++] = 4;
2877 		opt[i++] = sp->lcp.mru >> 8;
2878 		opt[i++] = sp->lcp.mru;
2879 	}
2880 
2881 	if (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) {
2882 		authproto = sp->hisauth.proto;
2883 		opt[i++] = LCP_OPT_AUTH_PROTO;
2884 		opt[i++] = authproto == PPP_CHAP? 5: 4;
2885 		opt[i++] = authproto >> 8;
2886 		opt[i++] = authproto;
2887 		if (authproto == PPP_CHAP)
2888 			opt[i++] = CHAP_MD5;
2889 	}
2890 
2891 	sp->confid[IDX_LCP] = ++sp->pp_seq[IDX_LCP];
2892 	sppp_cp_send(sp, PPP_LCP, CONF_REQ, sp->confid[IDX_LCP], i, &opt);
2893 }
2894 
2895 /*
2896  * Check the open NCPs, return true if at least one NCP is open.
2897  */
2898 static int
2899 sppp_ncp_check(struct sppp *sp)
2900 {
2901 	int i, mask;
2902 
2903 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
2904 		if ((sp->lcp.protos & mask) && (cps[i])->flags & CP_NCP)
2905 			return 1;
2906 	return 0;
2907 }
2908 
2909 /*
2910  * Re-check the open NCPs and see if we should terminate the link.
2911  * Called by the NCPs during their tlf action handling.
2912  */
2913 static void
2914 sppp_lcp_check_and_close(struct sppp *sp)
2915 {
2916 	KASSERT(sppp_locked(sp));
2917 
2918 	if (sp->pp_phase < SPPP_PHASE_NETWORK)
2919 		/* don't bother, we are already going down */
2920 		return;
2921 
2922 	if (sppp_ncp_check(sp))
2923 		return;
2924 	lcp.Close(sp);
2925 }
2926 
2927 
2928 /*
2929  *--------------------------------------------------------------------------*
2930  *                                                                          *
2931  *                        The IPCP implementation.                          *
2932  *                                                                          *
2933  *--------------------------------------------------------------------------*
2934  */
2935 
2936 static void
2937 sppp_ipcp_init(struct sppp *sp)
2938 {
2939 	int error;
2940 
2941 	sppp_lock_enter(sp);
2942 	sp->ipcp.opts = 0;
2943 	sp->ipcp.flags = 0;
2944 	sp->state[IDX_IPCP] = STATE_INITIAL;
2945 	sp->fail_counter[IDX_IPCP] = 0;
2946 	sp->pp_seq[IDX_IPCP] = 0;
2947 	sp->pp_rseq[IDX_IPCP] = 0;
2948 	callout_init(&sp->ch[IDX_IPCP], 0);
2949 
2950 	error = workqueue_create(&sp->ipcp.update_addrs_wq, "ipcp_update_addrs",
2951 	    sppp_update_ip_addrs_work, sp, PRI_SOFTNET, IPL_NET, 0);
2952 	if (error)
2953 		panic("%s: update_addrs workqueue_create failed (%d)\n",
2954 		    __func__, error);
2955 	sp->ipcp.update_addrs_q = pcq_create(IPCP_UPDATE_LIMIT, KM_SLEEP);
2956 
2957 	sp->ipcp.update_addrs_enqueued = 0;
2958 	sppp_lock_exit(sp);
2959 }
2960 
2961 static void
2962 sppp_ipcp_up(struct sppp *sp)
2963 {
2964 	KASSERT(sppp_locked(sp));
2965 	sppp_up_event(&ipcp, sp);
2966 }
2967 
2968 static void
2969 sppp_ipcp_down(struct sppp *sp)
2970 {
2971 	KASSERT(sppp_locked(sp));
2972 	sppp_down_event(&ipcp, sp);
2973 }
2974 
2975 static void
2976 sppp_ipcp_open(struct sppp *sp)
2977 {
2978 	STDDCL;
2979 	uint32_t myaddr, hisaddr;
2980 
2981 	KASSERT(sppp_locked(sp));
2982 
2983 	sp->ipcp.flags &= ~(IPCP_HISADDR_SEEN|IPCP_MYADDR_SEEN|IPCP_MYADDR_DYN|IPCP_HISADDR_DYN);
2984 	sp->ipcp.req_myaddr = 0;
2985 	sp->ipcp.req_hisaddr = 0;
2986 	memset(&sp->dns_addrs, 0, sizeof sp->dns_addrs);
2987 
2988 #ifdef INET
2989 	sppp_get_ip_addrs(sp, &myaddr, &hisaddr, 0);
2990 #else
2991 	myaddr = hisaddr = 0;
2992 #endif
2993 	/*
2994 	 * If we don't have his address, this probably means our
2995 	 * interface doesn't want to talk IP at all.  (This could
2996 	 * be the case if somebody wants to speak only IPX, for
2997 	 * example.)  Don't open IPCP in this case.
2998 	 */
2999 	if (hisaddr == 0) {
3000 		/* XXX this message should go away */
3001 		if (debug)
3002 			log(LOG_DEBUG, "%s: ipcp_open(): no IP interface\n",
3003 			    ifp->if_xname);
3004 		return;
3005 	}
3006 
3007 	if (myaddr == 0) {
3008 		/*
3009 		 * I don't have an assigned address, so i need to
3010 		 * negotiate my address.
3011 		 */
3012 		sp->ipcp.flags |= IPCP_MYADDR_DYN;
3013 		sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
3014 	}
3015 	if (hisaddr == 1) {
3016 		/*
3017 		 * XXX - remove this hack!
3018 		 * remote has no valid address, we need to get one assigned.
3019 		 */
3020 		sp->ipcp.flags |= IPCP_HISADDR_DYN;
3021 	}
3022 	sppp_open_event(&ipcp, sp);
3023 }
3024 
3025 static void
3026 sppp_ipcp_close(struct sppp *sp)
3027 {
3028 
3029 	KASSERT(sppp_locked(sp));
3030 	sppp_close_event(&ipcp, sp);
3031 
3032 #ifdef INET
3033 	if (sp->ipcp.flags & (IPCP_MYADDR_DYN|IPCP_HISADDR_DYN))
3034 		/*
3035 		 * Some address was dynamic, clear it again.
3036 		 */
3037 		sppp_clear_ip_addrs(sp);
3038 #endif
3039 }
3040 
3041 static void
3042 sppp_ipcp_TO(void *cookie)
3043 {
3044 	struct sppp *sp = cookie;
3045 
3046 	KASSERT(!sppp_locked(sp));
3047 
3048 	sppp_lock_enter(sp);
3049 	sppp_to_event(&ipcp, (struct sppp *)cookie);
3050 	sppp_lock_exit(sp);
3051 }
3052 
3053 /*
3054  * Analyze a configure request.  Return true if it was agreeable, and
3055  * caused action sca, false if it has been rejected or nak'ed, and
3056  * caused action scn.  (The return value is used to make the state
3057  * transition decision in the state automaton.)
3058  */
3059 static int
3060 sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3061 {
3062 	u_char *buf, *r, *p, l, blen;
3063 	struct ifnet *ifp = &sp->pp_if;
3064 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
3065 	uint32_t hisaddr, desiredaddr;
3066 
3067 	KASSERT(sppp_locked(sp));
3068 	len -= 4;
3069 	origlen = len;
3070 	/*
3071 	 * Make sure to allocate a buf that can at least hold a
3072 	 * conf-nak with an `address' option.  We might need it below.
3073 	 */
3074 	blen = len < 6 ? 6 : len;
3075 	buf = r = malloc (blen, M_TEMP, M_NOWAIT);
3076 	if (! buf)
3077 		return (0);
3078 
3079 	/* pass 1: see if we can recognize them */
3080 	if (debug)
3081 		log(LOG_DEBUG, "%s: ipcp parse opts:",
3082 		    ifp->if_xname);
3083 	p = (void *)(h + 1);
3084 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3085 		/* Sanity check option length */
3086 		if (l > len) {
3087 			/* XXX should we just RXJ? */
3088 			addlog("%s: malicious IPCP option received, dropping\n",
3089 			    ifp->if_xname);
3090 			goto drop;
3091 		}
3092 		if (debug)
3093 			addlog(" %s", sppp_ipcp_opt_name(*p));
3094 		switch (*p) {
3095 #ifdef notyet
3096 		case IPCP_OPT_COMPRESSION:
3097 			if (len >= 6 && l >= 6) {
3098 				/* correctly formed compress option */
3099 				continue;
3100 			}
3101 			if (debug)
3102 				addlog(" [invalid]");
3103 			break;
3104 #endif
3105 		case IPCP_OPT_ADDRESS:
3106 			if (len >= 6 && l == 6) {
3107 				/* correctly formed address option */
3108 				continue;
3109 			}
3110 			if (debug)
3111 				addlog(" [invalid]");
3112 			break;
3113 		default:
3114 			/* Others not supported. */
3115 			if (debug)
3116 				addlog(" [rej]");
3117 			break;
3118 		}
3119 		/* Add the option to rejected list. */
3120 		if (rlen + l > blen) {
3121 			if (debug)
3122 				addlog(" [overflow]");
3123 			continue;
3124 		}
3125 		memcpy(r, p, l);
3126 		r += l;
3127 		rlen += l;
3128 	}
3129 	if (rlen) {
3130 		if (debug)
3131 			addlog(" send conf-rej\n");
3132 		sppp_cp_send(sp, PPP_IPCP, CONF_REJ, h->ident, rlen, buf);
3133 		goto end;
3134 	} else if (debug)
3135 		addlog("\n");
3136 
3137 	/* pass 2: parse option values */
3138 	if (sp->ipcp.flags & IPCP_HISADDR_SEEN)
3139 		hisaddr = sp->ipcp.req_hisaddr;	/* we already aggreed on that */
3140 	else
3141 #ifdef INET
3142 		sppp_get_ip_addrs(sp, 0, &hisaddr, 0);	/* user configuration */
3143 #else
3144 		hisaddr = 0;
3145 #endif
3146 	if (debug)
3147 		log(LOG_DEBUG, "%s: ipcp parse opt values: ",
3148 		       ifp->if_xname);
3149 	p = (void *)(h + 1);
3150 	len = origlen;
3151 	for (rlen=0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3152 		if (debug)
3153 			addlog(" %s", sppp_ipcp_opt_name(*p));
3154 		switch (*p) {
3155 #ifdef notyet
3156 		case IPCP_OPT_COMPRESSION:
3157 			continue;
3158 #endif
3159 		case IPCP_OPT_ADDRESS:
3160 			desiredaddr = p[2] << 24 | p[3] << 16 |
3161 				p[4] << 8 | p[5];
3162 			if (desiredaddr == hisaddr ||
3163 		    	   ((sp->ipcp.flags & IPCP_HISADDR_DYN) && desiredaddr != 0)) {
3164 				/*
3165 			 	* Peer's address is same as our value,
3166 			 	* this is agreeable.  Gonna conf-ack
3167 			 	* it.
3168 			 	*/
3169 				if (debug)
3170 					addlog(" %s [ack]",
3171 				       		sppp_dotted_quad(hisaddr));
3172 				/* record that we've seen it already */
3173 				sp->ipcp.flags |= IPCP_HISADDR_SEEN;
3174 				sp->ipcp.req_hisaddr = desiredaddr;
3175 				hisaddr = desiredaddr;
3176 				continue;
3177 			}
3178 			/*
3179 		 	* The address wasn't agreeable.  This is either
3180 		 	* he sent us 0.0.0.0, asking to assign him an
3181 		 	* address, or he send us another address not
3182 		 	* matching our value.  Either case, we gonna
3183 		 	* conf-nak it with our value.
3184 		 	*/
3185 			if (debug) {
3186 				if (desiredaddr == 0)
3187 					addlog(" [addr requested]");
3188 				else
3189 					addlog(" %s [not agreed]",
3190 				       		sppp_dotted_quad(desiredaddr));
3191 			}
3192 
3193 			p[2] = hisaddr >> 24;
3194 			p[3] = hisaddr >> 16;
3195 			p[4] = hisaddr >> 8;
3196 			p[5] = hisaddr;
3197 			break;
3198 		}
3199 		if (rlen + l > blen) {
3200 			if (debug)
3201 				addlog(" [overflow]");
3202 			continue;
3203 		}
3204 		/* Add the option to nak'ed list. */
3205 		memcpy(r, p, l);
3206 		r += l;
3207 		rlen += l;
3208 	}
3209 
3210 	/*
3211 	 * If we are about to conf-ack the request, but haven't seen
3212 	 * his address so far, gonna conf-nak it instead, with the
3213 	 * `address' option present and our idea of his address being
3214 	 * filled in there, to request negotiation of both addresses.
3215 	 *
3216 	 * XXX This can result in an endless req - nak loop if peer
3217 	 * doesn't want to send us his address.  Q: What should we do
3218 	 * about it?  XXX  A: implement the max-failure counter.
3219 	 */
3220 	if (rlen == 0 && !(sp->ipcp.flags & IPCP_HISADDR_SEEN)) {
3221 		buf[0] = IPCP_OPT_ADDRESS;
3222 		buf[1] = 6;
3223 		buf[2] = hisaddr >> 24;
3224 		buf[3] = hisaddr >> 16;
3225 		buf[4] = hisaddr >> 8;
3226 		buf[5] = hisaddr;
3227 		rlen = 6;
3228 		if (debug)
3229 			addlog(" still need hisaddr");
3230 	}
3231 
3232 	if (rlen) {
3233 		if (debug)
3234 			addlog(" send conf-nak\n");
3235 		sppp_cp_send(sp, PPP_IPCP, CONF_NAK, h->ident, rlen, buf);
3236 	} else {
3237 		if (debug)
3238 			addlog(" send conf-ack\n");
3239 		sppp_cp_send(sp, PPP_IPCP, CONF_ACK, h->ident, origlen, h + 1);
3240 	}
3241 
3242  end:
3243 	free(buf, M_TEMP);
3244 	return (rlen == 0);
3245 
3246  drop:
3247 	free(buf, M_TEMP);
3248 	return -1;
3249 }
3250 
3251 /*
3252  * Analyze the IPCP Configure-Reject option list, and adjust our
3253  * negotiation.
3254  */
3255 static void
3256 sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3257 {
3258 	u_char *buf, *p, l, blen;
3259 	struct ifnet *ifp = &sp->pp_if;
3260 	int debug = ifp->if_flags & IFF_DEBUG;
3261 
3262 	KASSERT(sppp_locked(sp));
3263 
3264 	len -= 4;
3265 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
3266 	if (!buf)
3267 		return;
3268 
3269 	if (debug)
3270 		log(LOG_DEBUG, "%s: ipcp rej opts:",
3271 		    ifp->if_xname);
3272 
3273 	p = (void *)(h + 1);
3274 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3275 		/* Sanity check option length */
3276 		if (l > len) {
3277 			/* XXX should we just RXJ? */
3278 			addlog("%s: malicious IPCP option received, dropping\n",
3279 			    ifp->if_xname);
3280 			goto drop;
3281 		}
3282 		if (debug)
3283 			addlog(" %s", sppp_ipcp_opt_name(*p));
3284 		switch (*p) {
3285 		case IPCP_OPT_ADDRESS:
3286 			/*
3287 			 * Peer doesn't grok address option.  This is
3288 			 * bad.  XXX  Should we better give up here?
3289 			 */
3290 			sp->ipcp.opts &= ~(1 << IPCP_OPT_ADDRESS);
3291 			break;
3292 #ifdef notyet
3293 		case IPCP_OPT_COMPRESS:
3294 			sp->ipcp.opts &= ~(1 << IPCP_OPT_COMPRESS);
3295 			break;
3296 #endif
3297 		}
3298 	}
3299 	if (debug)
3300 		addlog("\n");
3301 drop:
3302 	free(buf, M_TEMP);
3303 	return;
3304 }
3305 
3306 /*
3307  * Analyze the IPCP Configure-NAK option list, and adjust our
3308  * negotiation.
3309  */
3310 static void
3311 sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3312 {
3313 	u_char *p, l;
3314 	struct ifnet *ifp = &sp->pp_if;
3315 	int debug = ifp->if_flags & IFF_DEBUG;
3316 	uint32_t wantaddr;
3317 
3318 	KASSERT(sppp_locked(sp));
3319 
3320 	len -= 4;
3321 
3322 	if (debug)
3323 		log(LOG_DEBUG, "%s: ipcp nak opts:",
3324 		    ifp->if_xname);
3325 
3326 	p = (void *)(h + 1);
3327 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3328 		/* Sanity check option length */
3329 		if (l > len) {
3330 			/* XXX should we just RXJ? */
3331 			addlog("%s: malicious IPCP option received, dropping\n",
3332 			    ifp->if_xname);
3333 			return;
3334 		}
3335 		if (debug)
3336 			addlog(" %s", sppp_ipcp_opt_name(*p));
3337 		switch (*p) {
3338 		case IPCP_OPT_ADDRESS:
3339 			/*
3340 			 * Peer doesn't like our local IP address.  See
3341 			 * if we can do something for him.  We'll drop
3342 			 * him our address then.
3343 			 */
3344 			if (len >= 6 && l == 6) {
3345 				wantaddr = p[2] << 24 | p[3] << 16 |
3346 					p[4] << 8 | p[5];
3347 				sp->ipcp.opts |= (1 << IPCP_OPT_ADDRESS);
3348 				if (debug)
3349 					addlog(" [wantaddr %s]",
3350 					       sppp_dotted_quad(wantaddr));
3351 				/*
3352 				 * When doing dynamic address assignment,
3353 				 * we accept his offer.  Otherwise, we
3354 				 * ignore it and thus continue to negotiate
3355 				 * our already existing value.
3356 				 */
3357 				if (sp->ipcp.flags & IPCP_MYADDR_DYN) {
3358 					if (debug)
3359 						addlog(" [agree]");
3360 					sp->ipcp.flags |= IPCP_MYADDR_SEEN;
3361 					sp->ipcp.req_myaddr = wantaddr;
3362 				}
3363 			}
3364 			break;
3365 
3366 		case IPCP_OPT_PRIMDNS:
3367 			if (len >= 6 && l == 6) {
3368 				sp->dns_addrs[0] = p[2] << 24 | p[3] << 16 |
3369 					p[4] << 8 | p[5];
3370 			}
3371 			break;
3372 
3373 		case IPCP_OPT_SECDNS:
3374 			if (len >= 6 && l == 6) {
3375 				sp->dns_addrs[1] = p[2] << 24 | p[3] << 16 |
3376 					p[4] << 8 | p[5];
3377 			}
3378 			break;
3379 #ifdef notyet
3380 		case IPCP_OPT_COMPRESS:
3381 			/*
3382 			 * Peer wants different compression parameters.
3383 			 */
3384 			break;
3385 #endif
3386 		}
3387 	}
3388 	if (debug)
3389 		addlog("\n");
3390 }
3391 
3392 static void
3393 sppp_ipcp_tlu(struct sppp *sp)
3394 {
3395 #ifdef INET
3396 	KASSERT(sppp_locked(sp));
3397 	/* we are up. Set addresses and notify anyone interested */
3398 	sppp_set_ip_addrs(sp);
3399 #endif
3400 }
3401 
3402 static void
3403 sppp_ipcp_tld(struct sppp *sp)
3404 {
3405 }
3406 
3407 static void
3408 sppp_ipcp_tls(struct sppp *sp)
3409 {
3410 	KASSERT(sppp_locked(sp));
3411 	/* indicate to LCP that it must stay alive */
3412 	sp->lcp.protos |= (1 << IDX_IPCP);
3413 }
3414 
3415 static void
3416 sppp_ipcp_tlf(struct sppp *sp)
3417 {
3418 	KASSERT(sppp_locked(sp));
3419 	/* we no longer need LCP */
3420 	sp->lcp.protos &= ~(1 << IDX_IPCP);
3421 }
3422 
3423 static void
3424 sppp_ipcp_scr(struct sppp *sp)
3425 {
3426 	uint8_t opt[6 /* compression */ + 6 /* address */ + 12 /* dns addresses */];
3427 #ifdef INET
3428 	uint32_t ouraddr;
3429 #endif
3430 	int i = 0;
3431 
3432 	KASSERT(sppp_locked(sp));
3433 
3434 #ifdef notyet
3435 	if (sp->ipcp.opts & (1 << IPCP_OPT_COMPRESSION)) {
3436 		opt[i++] = IPCP_OPT_COMPRESSION;
3437 		opt[i++] = 6;
3438 		opt[i++] = 0;	/* VJ header compression */
3439 		opt[i++] = 0x2d; /* VJ header compression */
3440 		opt[i++] = max_slot_id;
3441 		opt[i++] = comp_slot_id;
3442 	}
3443 #endif
3444 
3445 #ifdef INET
3446 	if (sp->ipcp.opts & (1 << IPCP_OPT_ADDRESS)) {
3447 		if (sp->ipcp.flags & IPCP_MYADDR_SEEN)
3448 			ouraddr = sp->ipcp.req_myaddr;	/* not sure if this can ever happen */
3449 		else
3450 			sppp_get_ip_addrs(sp, &ouraddr, 0, 0);
3451 		opt[i++] = IPCP_OPT_ADDRESS;
3452 		opt[i++] = 6;
3453 		opt[i++] = ouraddr >> 24;
3454 		opt[i++] = ouraddr >> 16;
3455 		opt[i++] = ouraddr >> 8;
3456 		opt[i++] = ouraddr;
3457 	}
3458 #endif
3459 
3460 	if (sp->query_dns & 1) {
3461 		opt[i++] = IPCP_OPT_PRIMDNS;
3462 		opt[i++] = 6;
3463 		opt[i++] = sp->dns_addrs[0] >> 24;
3464 		opt[i++] = sp->dns_addrs[0] >> 16;
3465 		opt[i++] = sp->dns_addrs[0] >> 8;
3466 		opt[i++] = sp->dns_addrs[0];
3467 	}
3468 	if (sp->query_dns & 2) {
3469 		opt[i++] = IPCP_OPT_SECDNS;
3470 		opt[i++] = 6;
3471 		opt[i++] = sp->dns_addrs[1] >> 24;
3472 		opt[i++] = sp->dns_addrs[1] >> 16;
3473 		opt[i++] = sp->dns_addrs[1] >> 8;
3474 		opt[i++] = sp->dns_addrs[1];
3475 	}
3476 
3477 	sp->confid[IDX_IPCP] = ++sp->pp_seq[IDX_IPCP];
3478 	sppp_cp_send(sp, PPP_IPCP, CONF_REQ, sp->confid[IDX_IPCP], i, &opt);
3479 }
3480 
3481 
3482 /*
3483  *--------------------------------------------------------------------------*
3484  *                                                                          *
3485  *                      The IPv6CP implementation.                          *
3486  *                                                                          *
3487  *--------------------------------------------------------------------------*
3488  */
3489 
3490 #ifdef INET6
3491 static void
3492 sppp_ipv6cp_init(struct sppp *sp)
3493 {
3494 	sppp_lock_enter(sp);
3495 	sp->ipv6cp.opts = 0;
3496 	sp->ipv6cp.flags = 0;
3497 	sp->state[IDX_IPV6CP] = STATE_INITIAL;
3498 	sp->fail_counter[IDX_IPV6CP] = 0;
3499 	sp->pp_seq[IDX_IPV6CP] = 0;
3500 	sp->pp_rseq[IDX_IPV6CP] = 0;
3501 	callout_init(&sp->ch[IDX_IPV6CP], 0);
3502 	sppp_lock_exit(sp);
3503 }
3504 
3505 static void
3506 sppp_ipv6cp_up(struct sppp *sp)
3507 {
3508 	KASSERT(sppp_locked(sp));
3509 	sppp_up_event(&ipv6cp, sp);
3510 }
3511 
3512 static void
3513 sppp_ipv6cp_down(struct sppp *sp)
3514 {
3515 	KASSERT(sppp_locked(sp));
3516 	sppp_down_event(&ipv6cp, sp);
3517 }
3518 
3519 static void
3520 sppp_ipv6cp_open(struct sppp *sp)
3521 {
3522 	STDDCL;
3523 	struct in6_addr myaddr, hisaddr;
3524 
3525 	KASSERT(sppp_locked(sp));
3526 
3527 #ifdef IPV6CP_MYIFID_DYN
3528 	sp->ipv6cp.flags &= ~(IPV6CP_MYIFID_SEEN|IPV6CP_MYIFID_DYN);
3529 #else
3530 	sp->ipv6cp.flags &= ~IPV6CP_MYIFID_SEEN;
3531 #endif
3532 
3533 	sppp_get_ip6_addrs(sp, &myaddr, &hisaddr, 0);
3534 	/*
3535 	 * If we don't have our address, this probably means our
3536 	 * interface doesn't want to talk IPv6 at all.  (This could
3537 	 * be the case if somebody wants to speak only IPX, for
3538 	 * example.)  Don't open IPv6CP in this case.
3539 	 */
3540 	if (IN6_IS_ADDR_UNSPECIFIED(&myaddr)) {
3541 		/* XXX this message should go away */
3542 		if (debug)
3543 			log(LOG_DEBUG, "%s: ipv6cp_open(): no IPv6 interface\n",
3544 			    ifp->if_xname);
3545 		return;
3546 	}
3547 
3548 	sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3549 	sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3550 	sppp_open_event(&ipv6cp, sp);
3551 }
3552 
3553 static void
3554 sppp_ipv6cp_close(struct sppp *sp)
3555 {
3556 	KASSERT(sppp_locked(sp));
3557 	sppp_close_event(&ipv6cp, sp);
3558 }
3559 
3560 static void
3561 sppp_ipv6cp_TO(void *cookie)
3562 {
3563 	struct sppp *sp = cookie;
3564 	KASSERT(!sppp_locked(sp));
3565 
3566 	sppp_lock_enter(sp);
3567 	sppp_to_event(&ipv6cp, (struct sppp *)cookie);
3568 	sppp_lock_exit(sp);
3569 }
3570 
3571 /*
3572  * Analyze a configure request.  Return true if it was agreeable, and
3573  * caused action sca, false if it has been rejected or nak'ed, and
3574  * caused action scn.  (The return value is used to make the state
3575  * transition decision in the state automaton.)
3576  */
3577 static int
3578 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
3579 {
3580 	u_char *buf, *r, *p, l, blen;
3581 	struct ifnet *ifp = &sp->pp_if;
3582 	int rlen, origlen, debug = ifp->if_flags & IFF_DEBUG;
3583 	struct in6_addr myaddr, desiredaddr, suggestaddr;
3584 	int ifidcount;
3585 	int type;
3586 	int collision, nohisaddr;
3587 	char ip6buf[INET6_ADDRSTRLEN];
3588 
3589 	KASSERT(sppp_locked(sp));
3590 
3591 	len -= 4;
3592 	origlen = len;
3593 	/*
3594 	 * Make sure to allocate a buf that can at least hold a
3595 	 * conf-nak with an `address' option.  We might need it below.
3596 	 */
3597 	blen = len < 6 ? 6 : len;
3598 	buf = r = malloc (blen, M_TEMP, M_NOWAIT);
3599 	if (! buf)
3600 		return (0);
3601 
3602 	/* pass 1: see if we can recognize them */
3603 	if (debug)
3604 		log(LOG_DEBUG, "%s: ipv6cp parse opts:",
3605 		    ifp->if_xname);
3606 	p = (void *)(h + 1);
3607 	ifidcount = 0;
3608 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3609 		/* Sanity check option length */
3610 		if (l > len) {
3611 			/* XXX just RXJ? */
3612 			addlog("%s: received malicious IPCPv6 option, "
3613 			    "dropping\n", ifp->if_xname);
3614 			goto drop;
3615 		}
3616 		if (debug)
3617 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3618 		switch (*p) {
3619 		case IPV6CP_OPT_IFID:
3620 			if (len >= 10 && l == 10 && ifidcount == 0) {
3621 				/* correctly formed address option */
3622 				ifidcount++;
3623 				continue;
3624 			}
3625 			if (debug)
3626 				addlog(" [invalid]");
3627 			break;
3628 #ifdef notyet
3629 		case IPV6CP_OPT_COMPRESSION:
3630 			if (len >= 4 && l >= 4) {
3631 				/* correctly formed compress option */
3632 				continue;
3633 			}
3634 			if (debug)
3635 				addlog(" [invalid]");
3636 			break;
3637 #endif
3638 		default:
3639 			/* Others not supported. */
3640 			if (debug)
3641 				addlog(" [rej]");
3642 			break;
3643 		}
3644 		if (rlen + l > blen) {
3645 			if (debug)
3646 				addlog(" [overflow]");
3647 			continue;
3648 		}
3649 		/* Add the option to rejected list. */
3650 		memcpy(r, p, l);
3651 		r += l;
3652 		rlen += l;
3653 	}
3654 	if (rlen) {
3655 		if (debug)
3656 			addlog(" send conf-rej\n");
3657 		sppp_cp_send(sp, PPP_IPV6CP, CONF_REJ, h->ident, rlen, buf);
3658 		goto end;
3659 	} else if (debug)
3660 		addlog("\n");
3661 
3662 	/* pass 2: parse option values */
3663 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
3664 	if (debug)
3665 		log(LOG_DEBUG, "%s: ipv6cp parse opt values: ",
3666 		       ifp->if_xname);
3667 	p = (void *)(h + 1);
3668 	len = origlen;
3669 	type = CONF_ACK;
3670 	for (rlen = 0; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3671 		if (debug)
3672 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3673 		switch (*p) {
3674 #ifdef notyet
3675 		case IPV6CP_OPT_COMPRESSION:
3676 			continue;
3677 #endif
3678 		case IPV6CP_OPT_IFID:
3679 			memset(&desiredaddr, 0, sizeof(desiredaddr));
3680 			memcpy(&desiredaddr.s6_addr[8], &p[2], 8);
3681 			collision = (memcmp(&desiredaddr.s6_addr[8],
3682 					&myaddr.s6_addr[8], 8) == 0);
3683 			nohisaddr = IN6_IS_ADDR_UNSPECIFIED(&desiredaddr);
3684 
3685 			desiredaddr.s6_addr16[0] = htons(0xfe80);
3686 			(void)in6_setscope(&desiredaddr, &sp->pp_if, NULL);
3687 
3688 			if (!collision && !nohisaddr) {
3689 				/* no collision, hisaddr known - Conf-Ack */
3690 				type = CONF_ACK;
3691 
3692 				if (debug) {
3693 					addlog(" %s [%s]",
3694 					    IN6_PRINT(ip6buf, &desiredaddr),
3695 					    sppp_cp_type_name(type));
3696 				}
3697 				continue;
3698 			}
3699 
3700 			memset(&suggestaddr, 0, sizeof(suggestaddr));
3701 			if (collision && nohisaddr) {
3702 				/* collision, hisaddr unknown - Conf-Rej */
3703 				type = CONF_REJ;
3704 				memset(&p[2], 0, 8);
3705 			} else {
3706 				/*
3707 				 * - no collision, hisaddr unknown, or
3708 				 * - collision, hisaddr known
3709 				 * Conf-Nak, suggest hisaddr
3710 				 */
3711 				type = CONF_NAK;
3712 				sppp_suggest_ip6_addr(sp, &suggestaddr);
3713 				memcpy(&p[2], &suggestaddr.s6_addr[8], 8);
3714 			}
3715 			if (debug)
3716 				addlog(" %s [%s]", IN6_PRINT(ip6buf, &desiredaddr),
3717 				    sppp_cp_type_name(type));
3718 			break;
3719 		}
3720 		if (rlen + l > blen) {
3721 			if (debug)
3722 				addlog(" [overflow]");
3723 			continue;
3724 		}
3725 		/* Add the option to nak'ed list. */
3726 		memcpy(r, p, l);
3727 		r += l;
3728 		rlen += l;
3729 	}
3730 
3731 	if (rlen == 0 && type == CONF_ACK) {
3732 		if (debug)
3733 			addlog(" send %s\n", sppp_cp_type_name(type));
3734 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, origlen, h + 1);
3735 	} else {
3736 #ifdef notdef
3737 		if (type == CONF_ACK)
3738 			panic("IPv6CP RCR: CONF_ACK with non-zero rlen");
3739 #endif
3740 
3741 		if (debug) {
3742 			addlog(" send %s suggest %s\n",
3743 			    sppp_cp_type_name(type), IN6_PRINT(ip6buf, &suggestaddr));
3744 		}
3745 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
3746 	}
3747 
3748  end:
3749 	free(buf, M_TEMP);
3750 	return (rlen == 0);
3751 
3752  drop:
3753 	free(buf, M_TEMP);
3754 	return -1;
3755 }
3756 
3757 /*
3758  * Analyze the IPv6CP Configure-Reject option list, and adjust our
3759  * negotiation.
3760  */
3761 static void
3762 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
3763 {
3764 	u_char *buf, *p, l, blen;
3765 	struct ifnet *ifp = &sp->pp_if;
3766 	int debug = ifp->if_flags & IFF_DEBUG;
3767 
3768 	KASSERT(sppp_locked(sp));
3769 
3770 	len -= 4;
3771 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
3772 	if (!buf)
3773 		return;
3774 
3775 	if (debug)
3776 		log(LOG_DEBUG, "%s: ipv6cp rej opts:",
3777 		    ifp->if_xname);
3778 
3779 	p = (void *)(h + 1);
3780 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3781 		if (l > len) {
3782 			/* XXX just RXJ? */
3783 			addlog("%s: received malicious IPCPv6 option, "
3784 			    "dropping\n", ifp->if_xname);
3785 			goto drop;
3786 		}
3787 		if (debug)
3788 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3789 		switch (*p) {
3790 		case IPV6CP_OPT_IFID:
3791 			/*
3792 			 * Peer doesn't grok address option.  This is
3793 			 * bad.  XXX  Should we better give up here?
3794 			 */
3795 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_IFID);
3796 			break;
3797 #ifdef notyet
3798 		case IPV6CP_OPT_COMPRESS:
3799 			sp->ipv6cp.opts &= ~(1 << IPV6CP_OPT_COMPRESS);
3800 			break;
3801 #endif
3802 		}
3803 	}
3804 	if (debug)
3805 		addlog("\n");
3806 drop:
3807 	free(buf, M_TEMP);
3808 	return;
3809 }
3810 
3811 /*
3812  * Analyze the IPv6CP Configure-NAK option list, and adjust our
3813  * negotiation.
3814  */
3815 static void
3816 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
3817 {
3818 	u_char *buf, *p, l, blen;
3819 	struct ifnet *ifp = &sp->pp_if;
3820 	int debug = ifp->if_flags & IFF_DEBUG;
3821 	struct in6_addr suggestaddr;
3822 	char ip6buf[INET6_ADDRSTRLEN];
3823 
3824 	KASSERT(sppp_locked(sp));
3825 
3826 	len -= 4;
3827 	buf = malloc (blen = len, M_TEMP, M_NOWAIT);
3828 	if (!buf)
3829 		return;
3830 
3831 	if (debug)
3832 		log(LOG_DEBUG, "%s: ipv6cp nak opts:",
3833 		    ifp->if_xname);
3834 
3835 	p = (void *)(h + 1);
3836 	for (; len > 1 && (l = p[1]) != 0; len -= l, p += l) {
3837 		if (l > len) {
3838 			/* XXX just RXJ? */
3839 			addlog("%s: received malicious IPCPv6 option, "
3840 			    "dropping\n", ifp->if_xname);
3841 			goto drop;
3842 		}
3843 		if (debug)
3844 			addlog(" %s", sppp_ipv6cp_opt_name(*p));
3845 		switch (*p) {
3846 		case IPV6CP_OPT_IFID:
3847 			/*
3848 			 * Peer doesn't like our local ifid.  See
3849 			 * if we can do something for him.  We'll drop
3850 			 * him our address then.
3851 			 */
3852 			if (len < 10 || l != 10)
3853 				break;
3854 			memset(&suggestaddr, 0, sizeof(suggestaddr));
3855 			suggestaddr.s6_addr16[0] = htons(0xfe80);
3856 			(void)in6_setscope(&suggestaddr, &sp->pp_if, NULL);
3857 			memcpy(&suggestaddr.s6_addr[8], &p[2], 8);
3858 
3859 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
3860 			if (debug)
3861 				addlog(" [suggestaddr %s]",
3862 				       IN6_PRINT(ip6buf, &suggestaddr));
3863 #ifdef IPV6CP_MYIFID_DYN
3864 			/*
3865 			 * When doing dynamic address assignment,
3866 			 * we accept his offer.
3867 			 */
3868 			if (sp->ipv6cp.flags & IPV6CP_MYIFID_DYN) {
3869 				struct in6_addr lastsuggest;
3870 				/*
3871 				 * If <suggested myaddr from peer> equals to
3872 				 * <hisaddr we have suggested last time>,
3873 				 * we have a collision.  generate new random
3874 				 * ifid.
3875 				 */
3876 				sppp_suggest_ip6_addr(&lastsuggest);
3877 				if (IN6_ARE_ADDR_EQUAL(&suggestaddr,
3878 						 lastsuggest)) {
3879 					if (debug)
3880 						addlog(" [random]");
3881 					sppp_gen_ip6_addr(sp, &suggestaddr);
3882 				}
3883 				sppp_set_ip6_addr(sp, &suggestaddr, 0);
3884 				if (debug)
3885 					addlog(" [agree]");
3886 				sp->ipv6cp.flags |= IPV6CP_MYIFID_SEEN;
3887 			}
3888 #else
3889 			/*
3890 			 * Since we do not do dynamic address assignment,
3891 			 * we ignore it and thus continue to negotiate
3892 			 * our already existing value.  This can possibly
3893 			 * go into infinite request-reject loop.
3894 			 *
3895 			 * This is not likely because we normally use
3896 			 * ifid based on MAC-address.
3897 			 * If you have no ethernet card on the node, too bad.
3898 			 * XXX should we use fail_counter?
3899 			 */
3900 #endif
3901 			break;
3902 #ifdef notyet
3903 		case IPV6CP_OPT_COMPRESS:
3904 			/*
3905 			 * Peer wants different compression parameters.
3906 			 */
3907 			break;
3908 #endif
3909 		}
3910 	}
3911 	if (debug)
3912 		addlog("\n");
3913 drop:
3914 	free(buf, M_TEMP);
3915 	return;
3916 }
3917 
3918 static void
3919 sppp_ipv6cp_tlu(struct sppp *sp)
3920 {
3921 	KASSERT(sppp_locked(sp));
3922 	/* we are up - notify isdn daemon */
3923 	if (sp->pp_con)
3924 		sp->pp_con(sp);
3925 }
3926 
3927 static void
3928 sppp_ipv6cp_tld(struct sppp *sp)
3929 {
3930 }
3931 
3932 static void
3933 sppp_ipv6cp_tls(struct sppp *sp)
3934 {
3935 	KASSERT(sppp_locked(sp));
3936 	/* indicate to LCP that it must stay alive */
3937 	sp->lcp.protos |= (1 << IDX_IPV6CP);
3938 }
3939 
3940 static void
3941 sppp_ipv6cp_tlf(struct sppp *sp)
3942 {
3943 	KASSERT(sppp_locked(sp));
3944 	/* we no longer need LCP */
3945 	sp->lcp.protos &= ~(1 << IDX_IPV6CP);
3946 }
3947 
3948 static void
3949 sppp_ipv6cp_scr(struct sppp *sp)
3950 {
3951 	char opt[10 /* ifid */ + 4 /* compression, minimum */];
3952 	struct in6_addr ouraddr;
3953 	int i = 0;
3954 
3955 	KASSERT(sppp_locked(sp));
3956 
3957 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_IFID)) {
3958 		sppp_get_ip6_addrs(sp, &ouraddr, 0, 0);
3959 		opt[i++] = IPV6CP_OPT_IFID;
3960 		opt[i++] = 10;
3961 		memcpy(&opt[i], &ouraddr.s6_addr[8], 8);
3962 		i += 8;
3963 	}
3964 
3965 #ifdef notyet
3966 	if (sp->ipv6cp.opts & (1 << IPV6CP_OPT_COMPRESSION)) {
3967 		opt[i++] = IPV6CP_OPT_COMPRESSION;
3968 		opt[i++] = 4;
3969 		opt[i++] = 0;	/* TBD */
3970 		opt[i++] = 0;	/* TBD */
3971 		/* variable length data may follow */
3972 	}
3973 #endif
3974 
3975 	sp->confid[IDX_IPV6CP] = ++sp->pp_seq[IDX_IPV6CP];
3976 	sppp_cp_send(sp, PPP_IPV6CP, CONF_REQ, sp->confid[IDX_IPV6CP], i, &opt);
3977 }
3978 #else /*INET6*/
3979 static void
3980 sppp_ipv6cp_init(struct sppp *sp)
3981 {
3982 }
3983 
3984 static void
3985 sppp_ipv6cp_up(struct sppp *sp)
3986 {
3987 }
3988 
3989 static void
3990 sppp_ipv6cp_down(struct sppp *sp)
3991 {
3992 }
3993 
3994 static void
3995 sppp_ipv6cp_open(struct sppp *sp)
3996 {
3997 }
3998 
3999 static void
4000 sppp_ipv6cp_close(struct sppp *sp)
4001 {
4002 }
4003 
4004 static void
4005 sppp_ipv6cp_TO(void *sp)
4006 {
4007 }
4008 
4009 static int
4010 sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h,
4011 		int len)
4012 {
4013 	return 0;
4014 }
4015 
4016 static void
4017 sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h,
4018 		    int len)
4019 {
4020 }
4021 
4022 static void
4023 sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h,
4024 		    int len)
4025 {
4026 }
4027 
4028 static void
4029 sppp_ipv6cp_tlu(struct sppp *sp)
4030 {
4031 }
4032 
4033 static void
4034 sppp_ipv6cp_tld(struct sppp *sp)
4035 {
4036 }
4037 
4038 static void
4039 sppp_ipv6cp_tls(struct sppp *sp)
4040 {
4041 }
4042 
4043 static void
4044 sppp_ipv6cp_tlf(struct sppp *sp)
4045 {
4046 }
4047 
4048 static void
4049 sppp_ipv6cp_scr(struct sppp *sp)
4050 {
4051 }
4052 #endif /*INET6*/
4053 
4054 
4055 /*
4056  *--------------------------------------------------------------------------*
4057  *                                                                          *
4058  *                        The CHAP implementation.                          *
4059  *                                                                          *
4060  *--------------------------------------------------------------------------*
4061  */
4062 
4063 /*
4064  * The authentication protocols don't employ a full-fledged state machine as
4065  * the control protocols do, since they do have Open and Close events, but
4066  * not Up and Down, nor are they explicitly terminated.  Also, use of the
4067  * authentication protocols may be different in both directions (this makes
4068  * sense, think of a machine that never accepts incoming calls but only
4069  * calls out, it doesn't require the called party to authenticate itself).
4070  *
4071  * Our state machine for the local authentication protocol (we are requesting
4072  * the peer to authenticate) looks like:
4073  *
4074  *						    RCA-
4075  *	      +--------------------------------------------+
4076  *	      V					    scn,tld|
4077  *	  +--------+			       Close   +---------+ RCA+
4078  *	  |	   |<----------------------------------|	 |------+
4079  *   +--->| Closed |				TO*    | Opened	 | sca	|
4080  *   |	  |	   |-----+		       +-------|	 |<-----+
4081  *   |	  +--------+ irc |		       |       +---------+
4082  *   |	    ^		 |		       |	   ^
4083  *   |	    |		 |		       |	   |
4084  *   |	    |		 |		       |	   |
4085  *   |	 TO-|		 |		       |	   |
4086  *   |	    |tld  TO+	 V		       |	   |
4087  *   |	    |	+------->+		       |	   |
4088  *   |	    |	|	 |		       |	   |
4089  *   |	  +--------+	 V		       |	   |
4090  *   |	  |	   |<----+<--------------------+	   |
4091  *   |	  | Req-   | scr				   |
4092  *   |	  | Sent   |					   |
4093  *   |	  |	   |					   |
4094  *   |	  +--------+					   |
4095  *   | RCA- |	| RCA+					   |
4096  *   +------+	+------------------------------------------+
4097  *   scn,tld	  sca,irc,ict,tlu
4098  *
4099  *
4100  *   with:
4101  *
4102  *	Open:	LCP reached authentication phase
4103  *	Close:	LCP reached terminate phase
4104  *
4105  *	RCA+:	received reply (pap-req, chap-response), acceptable
4106  *	RCN:	received reply (pap-req, chap-response), not acceptable
4107  *	TO+:	timeout with restart counter >= 0
4108  *	TO-:	timeout with restart counter < 0
4109  *	TO*:	reschedule timeout for CHAP
4110  *
4111  *	scr:	send request packet (none for PAP, chap-challenge)
4112  *	sca:	send ack packet (pap-ack, chap-success)
4113  *	scn:	send nak packet (pap-nak, chap-failure)
4114  *	ict:	initialize re-challenge timer (CHAP only)
4115  *
4116  *	tlu:	this-layer-up, LCP reaches network phase
4117  *	tld:	this-layer-down, LCP enters terminate phase
4118  *
4119  * Note that in CHAP mode, after sending a new challenge, while the state
4120  * automaton falls back into Req-Sent state, it doesn't signal a tld
4121  * event to LCP, so LCP remains in network phase.  Only after not getting
4122  * any response (or after getting an unacceptable response), CHAP closes,
4123  * causing LCP to enter terminate phase.
4124  *
4125  * With PAP, there is no initial request that can be sent.  The peer is
4126  * expected to send one based on the successful negotiation of PAP as
4127  * the authentication protocol during the LCP option negotiation.
4128  *
4129  * Incoming authentication protocol requests (remote requests
4130  * authentication, we are peer) don't employ a state machine at all,
4131  * they are simply answered.  Some peers [Ascend P50 firmware rev
4132  * 4.50] react allergically when sending IPCP/IPv6CP requests while they are
4133  * still in authentication phase (thereby violating the standard that
4134  * demands that these NCP packets are to be discarded), so we keep
4135  * track of the peer demanding us to authenticate, and only proceed to
4136  * phase network once we've seen a positive acknowledge for the
4137  * authentication.
4138  */
4139 
4140 /*
4141  * Handle incoming CHAP packets.
4142  */
4143 void
4144 sppp_chap_input(struct sppp *sp, struct mbuf *m)
4145 {
4146 	STDDCL;
4147 	struct lcp_header *h;
4148 	int len, x;
4149 	u_char *value, *name, digest[sizeof(sp->myauth.challenge)], dsize;
4150 	int value_len, name_len;
4151 	MD5_CTX ctx;
4152 
4153 	KASSERT(!sppp_locked(sp));
4154 
4155 	len = m->m_pkthdr.len;
4156 	if (len < 4) {
4157 		if (debug)
4158 			log(LOG_DEBUG,
4159 			    "%s: chap invalid packet length: %d bytes\n",
4160 			    ifp->if_xname, len);
4161 		return;
4162 	}
4163 	h = mtod(m, struct lcp_header *);
4164 	if (len > ntohs(h->len))
4165 		len = ntohs(h->len);
4166 
4167 	switch (h->type) {
4168 	/* challenge, failure and success are his authproto */
4169 	case CHAP_CHALLENGE:
4170 		sppp_lock_enter(sp);
4171 		if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
4172 			/* can't do anything useful */
4173 			sp->pp_auth_failures++;
4174 			printf("%s: chap input without my name and my secret being set\n",
4175 				ifp->if_xname);
4176 			sppp_lock_exit(sp);
4177 			break;
4178 		}
4179 		value = 1 + (u_char *)(h + 1);
4180 		value_len = value[-1];
4181 		name = value + value_len;
4182 		name_len = len - value_len - 5;
4183 		if (name_len < 0) {
4184 			if (debug) {
4185 				log(LOG_DEBUG,
4186 				    "%s: chap corrupted challenge "
4187 				    "<%s id=0x%x len=%d",
4188 				    ifp->if_xname,
4189 				    sppp_auth_type_name(PPP_CHAP, h->type),
4190 				    h->ident, ntohs(h->len));
4191 				if (len > 4)
4192 					sppp_print_bytes((u_char *)(h + 1),
4193 					    len - 4);
4194 				addlog(">\n");
4195 			}
4196 			sppp_lock_exit(sp);
4197 			break;
4198 		}
4199 
4200 		if (debug) {
4201 			log(LOG_DEBUG,
4202 			    "%s: chap input <%s id=0x%x len=%d name=",
4203 			    ifp->if_xname,
4204 			    sppp_auth_type_name(PPP_CHAP, h->type), h->ident,
4205 			    ntohs(h->len));
4206 			sppp_print_string((char *) name, name_len);
4207 			addlog(" value-size=%d value=", value_len);
4208 			sppp_print_bytes(value, value_len);
4209 			addlog(">\n");
4210 		}
4211 
4212 		/* Compute reply value. */
4213 		MD5Init(&ctx);
4214 		MD5Update(&ctx, &h->ident, 1);
4215 		MD5Update(&ctx, sp->myauth.secret, sp->myauth.secret_len);
4216 		MD5Update(&ctx, value, value_len);
4217 		MD5Final(digest, &ctx);
4218 		dsize = sizeof digest;
4219 
4220 		sppp_auth_send(&chap, sp, CHAP_RESPONSE, h->ident,
4221 			       sizeof dsize, (const char *)&dsize,
4222 			       sizeof digest, digest,
4223 			       sp->myauth.name_len,
4224 			       sp->myauth.name,
4225 			       0);
4226 		sppp_lock_exit(sp);
4227 		break;
4228 
4229 	case CHAP_SUCCESS:
4230 		sppp_lock_enter(sp);
4231 		if (debug) {
4232 			log(LOG_DEBUG, "%s: chap success",
4233 			    ifp->if_xname);
4234 			if (len > 4) {
4235 				addlog(": ");
4236 				sppp_print_string((char *)(h + 1), len - 4);
4237 			}
4238 			addlog("\n");
4239 		}
4240 		x = splnet();
4241 		sp->pp_auth_failures = 0;
4242 		sp->pp_flags &= ~PP_NEEDAUTH;
4243 		if (sp->myauth.proto == PPP_CHAP &&
4244 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
4245 		    (sp->lcp.protos & (1 << IDX_CHAP)) == 0) {
4246 			/*
4247 			 * We are authenticator for CHAP but didn't
4248 			 * complete yet.  Leave it to tlu to proceed
4249 			 * to network phase.
4250 			 */
4251 			splx(x);
4252 			sppp_lock_exit(sp);
4253 			break;
4254 		}
4255 		splx(x);
4256 		sppp_phase_network(sp);
4257 		sppp_lock_exit(sp);
4258 		break;
4259 
4260 	case CHAP_FAILURE:
4261 		x = splnet();
4262 		sppp_lock_enter(sp);
4263 		sp->pp_auth_failures++;
4264 		splx(x);
4265 		if (debug) {
4266 			log(LOG_INFO, "%s: chap failure",
4267 			    ifp->if_xname);
4268 			if (len > 4) {
4269 				addlog(": ");
4270 				sppp_print_string((char *)(h + 1), len - 4);
4271 			}
4272 			addlog("\n");
4273 		} else
4274 			log(LOG_INFO, "%s: chap failure\n",
4275 			    ifp->if_xname);
4276 		sppp_lock_exit(sp);
4277 		/* await LCP shutdown by authenticator */
4278 		break;
4279 
4280 	/* response is my authproto */
4281 	case CHAP_RESPONSE:
4282 		sppp_lock_enter(sp);
4283 		if (sp->hisauth.secret == NULL) {
4284 			/* can't do anything useful */
4285 			printf("%s: chap input without his secret being set\n",
4286 			    ifp->if_xname);
4287 			sppp_lock_exit(sp);
4288 		    break;
4289 		}
4290 		value = 1 + (u_char *)(h + 1);
4291 		value_len = value[-1];
4292 		name = value + value_len;
4293 		name_len = len - value_len - 5;
4294 		if (name_len < 0) {
4295 			if (debug) {
4296 				log(LOG_DEBUG,
4297 				    "%s: chap corrupted response "
4298 				    "<%s id=0x%x len=%d",
4299 				    ifp->if_xname,
4300 				    sppp_auth_type_name(PPP_CHAP, h->type),
4301 				    h->ident, ntohs(h->len));
4302 				if (len > 4)
4303 					sppp_print_bytes((u_char *)(h + 1),
4304 					    len - 4);
4305 				addlog(">\n");
4306 			}
4307 			sppp_lock_exit(sp);
4308 			break;
4309 		}
4310 		if (h->ident != sp->confid[IDX_CHAP]) {
4311 			if (debug)
4312 				log(LOG_DEBUG,
4313 				    "%s: chap dropping response for old ID "
4314 				    "(got %d, expected %d)\n",
4315 				    ifp->if_xname,
4316 				    h->ident, sp->confid[IDX_CHAP]);
4317 			sppp_lock_exit(sp);
4318 			break;
4319 		}
4320 		if (sp->hisauth.name != NULL &&
4321 		    (name_len != sp->hisauth.name_len
4322 		    || memcmp(name, sp->hisauth.name, name_len) != 0)) {
4323 			log(LOG_INFO, "%s: chap response, his name ",
4324 			    ifp->if_xname);
4325 			sppp_print_string(name, name_len);
4326 			addlog(" != expected ");
4327 			sppp_print_string(sp->hisauth.name,
4328 					  sp->hisauth.name_len);
4329 			addlog("\n");
4330 		    goto chap_failure;
4331 		}
4332 		if (debug) {
4333 			log(LOG_DEBUG, "%s: chap input(%s) "
4334 			    "<%s id=0x%x len=%d name=",
4335 			    ifp->if_xname,
4336 			    sppp_state_name(sp->state[IDX_CHAP]),
4337 			    sppp_auth_type_name(PPP_CHAP, h->type),
4338 			    h->ident, ntohs(h->len));
4339 			sppp_print_string((char *)name, name_len);
4340 			addlog(" value-size=%d value=", value_len);
4341 			sppp_print_bytes(value, value_len);
4342 			addlog(">\n");
4343 		}
4344 		if (value_len != sizeof(sp->hisauth.challenge)) {
4345 			if (debug)
4346 				log(LOG_DEBUG,
4347 				    "%s: chap bad hash value length: "
4348 				    "%d bytes, should be %zu\n",
4349 				    ifp->if_xname, value_len,
4350 				    sizeof(sp->hisauth.challenge));
4351 			goto chap_failure;
4352 		}
4353 
4354 		MD5Init(&ctx);
4355 		MD5Update(&ctx, &h->ident, 1);
4356 		MD5Update(&ctx, sp->hisauth.secret, sp->hisauth.secret_len);
4357 		MD5Update(&ctx, sp->hisauth.challenge, sizeof(sp->hisauth.challenge));
4358 		MD5Final(digest, &ctx);
4359 
4360 #define FAILMSG "Failed..."
4361 #define SUCCMSG "Welcome!"
4362 
4363 		if (value_len != sizeof digest ||
4364 		    memcmp(digest, value, value_len) != 0) {
4365 chap_failure:
4366 			KASSERT(sppp_locked(sp));
4367 			/* action scn, tld */
4368 			x = splnet();
4369 			sp->pp_auth_failures++;
4370 			splx(x);
4371 			sppp_auth_send(&chap, sp, CHAP_FAILURE, h->ident,
4372 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
4373 				       0);
4374 			chap.tld(sp);
4375 			sppp_lock_exit(sp);
4376 			break;
4377 		}
4378 		sp->pp_auth_failures = 0;
4379 		/* action sca, perhaps tlu */
4380 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT ||
4381 		    sp->state[IDX_CHAP] == STATE_OPENED)
4382 			sppp_auth_send(&chap, sp, CHAP_SUCCESS, h->ident,
4383 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
4384 				       0);
4385 		if (sp->state[IDX_CHAP] == STATE_REQ_SENT) {
4386 			sppp_cp_change_state(&chap, sp, STATE_OPENED);
4387 			chap.tlu(sp);
4388 		}
4389 		sppp_lock_exit(sp);
4390 		break;
4391 
4392 	default:
4393 		/* Unknown CHAP packet type -- ignore. */
4394 		sppp_lock_enter(sp);
4395 		if (debug) {
4396 			log(LOG_DEBUG, "%s: chap unknown input(%s) "
4397 			    "<0x%x id=0x%xh len=%d",
4398 			    ifp->if_xname,
4399 			    sppp_state_name(sp->state[IDX_CHAP]),
4400 			    h->type, h->ident, ntohs(h->len));
4401 			if (len > 4)
4402 				sppp_print_bytes((u_char *)(h + 1), len - 4);
4403 			addlog(">\n");
4404 		}
4405 		sppp_lock_exit(sp);
4406 		break;
4407 
4408 	}
4409 }
4410 
4411 void
4412 sppp_lock_enter(struct sppp *sp)
4413 {
4414 	if (sp->pp_lock)
4415 		mutex_enter(sp->pp_lock);
4416 }
4417 
4418 void
4419 sppp_lock_exit(struct sppp *sp)
4420 {
4421 	if (sp->pp_lock)
4422 		mutex_exit(sp->pp_lock);
4423 }
4424 
4425 int
4426 sppp_locked(struct sppp *sp)
4427 {
4428 	return (!(sp->pp_lock) || mutex_owned(sp->pp_lock));
4429 }
4430 
4431 static void
4432 sppp_chap_init(struct sppp *sp)
4433 {
4434 	sppp_lock_enter(sp);
4435 	/* Chap doesn't have STATE_INITIAL at all. */
4436 	sp->state[IDX_CHAP] = STATE_CLOSED;
4437 	sp->fail_counter[IDX_CHAP] = 0;
4438 	sp->pp_seq[IDX_CHAP] = 0;
4439 	sp->pp_rseq[IDX_CHAP] = 0;
4440 	callout_init(&sp->ch[IDX_CHAP], 0);
4441 	sppp_lock_exit(sp);
4442 }
4443 
4444 static void
4445 sppp_chap_open(struct sppp *sp)
4446 {
4447 	KASSERT(sppp_locked(sp));
4448 	if (sp->hisauth.proto == PPP_CHAP &&
4449 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
4450 		/* we are authenticator for CHAP, start it */
4451 		chap.scr(sp);
4452 		sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4453 		sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
4454 	}
4455 	/* nothing to be done if we are peer, await a challenge */
4456 }
4457 
4458 static void
4459 sppp_chap_close(struct sppp *sp)
4460 {
4461 	KASSERT(sppp_locked(sp));
4462 
4463 	if (sp->state[IDX_CHAP] != STATE_CLOSED)
4464 		sppp_cp_change_state(&chap, sp, STATE_CLOSED);
4465 }
4466 
4467 static void
4468 sppp_chap_TO(void *cookie)
4469 {
4470 	struct sppp *sp = (struct sppp *)cookie;
4471 	STDDCL;
4472 	int s;
4473 
4474 	KASSERT(!sppp_locked(sp));
4475 
4476 	s = splnet();
4477 	sppp_lock_enter(sp);
4478 
4479 	if (debug)
4480 		log(LOG_DEBUG, "%s: chap TO(%s) rst_counter = %d\n",
4481 		    ifp->if_xname,
4482 		    sppp_state_name(sp->state[IDX_CHAP]),
4483 		    sp->rst_counter[IDX_CHAP]);
4484 
4485 	if (--sp->rst_counter[IDX_CHAP] < 0)
4486 		/* TO- event */
4487 		switch (sp->state[IDX_CHAP]) {
4488 		case STATE_REQ_SENT:
4489 			chap.tld(sp);
4490 			sppp_cp_change_state(&chap, sp, STATE_CLOSED);
4491 			break;
4492 		}
4493 	else
4494 		/* TO+ (or TO*) event */
4495 		switch (sp->state[IDX_CHAP]) {
4496 		case STATE_OPENED:
4497 			/* TO* event */
4498 			sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4499 			/* fall through */
4500 		case STATE_REQ_SENT:
4501 			chap.scr(sp);
4502 			/* sppp_cp_change_state() will restart the timer */
4503 			sppp_cp_change_state(&chap, sp, STATE_REQ_SENT);
4504 			break;
4505 		}
4506 
4507 	sppp_lock_exit(sp);
4508 	splx(s);
4509 }
4510 
4511 static void
4512 sppp_chap_tlu(struct sppp *sp)
4513 {
4514 	STDDCL;
4515 	int i, x;
4516 
4517 	KASSERT(sppp_locked(sp));
4518 	i = 0;
4519 	sp->rst_counter[IDX_CHAP] = sp->lcp.max_configure;
4520 
4521 	/*
4522 	 * Some broken CHAP implementations (Conware CoNet, firmware
4523 	 * 4.0.?) don't want to re-authenticate their CHAP once the
4524 	 * initial challenge-response exchange has taken place.
4525 	 * Provide for an option to avoid rechallenges.
4526 	 */
4527 	if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0) {
4528 		/*
4529 		 * Compute the re-challenge timeout.  This will yield
4530 		 * a number between 300 and 810 seconds.
4531 		 */
4532 		i = 300 + ((unsigned)(cprng_fast32() & 0xff00) >> 7);
4533 
4534 		callout_reset(&sp->ch[IDX_CHAP], i * hz, chap.TO, sp);
4535 	}
4536 
4537 	if (debug) {
4538 		log(LOG_DEBUG,
4539 		    "%s: chap %s, ",
4540 		    ifp->if_xname,
4541 		    sp->pp_phase == SPPP_PHASE_NETWORK? "reconfirmed": "tlu");
4542 		if ((sp->hisauth.flags & SPPP_AUTHFLAG_NORECHALLENGE) == 0)
4543 			addlog("next re-challenge in %d seconds\n", i);
4544 		else
4545 			addlog("re-challenging supressed\n");
4546 	}
4547 
4548 	x = splnet();
4549 	sp->pp_auth_failures = 0;
4550 	/* indicate to LCP that we need to be closed down */
4551 	sp->lcp.protos |= (1 << IDX_CHAP);
4552 
4553 	if (sp->pp_flags & PP_NEEDAUTH) {
4554 		/*
4555 		 * Remote is authenticator, but his auth proto didn't
4556 		 * complete yet.  Defer the transition to network
4557 		 * phase.
4558 		 */
4559 		splx(x);
4560 		return;
4561 	}
4562 	splx(x);
4563 
4564 	/*
4565 	 * If we are already in phase network, we are done here.  This
4566 	 * is the case if this is a dummy tlu event after a re-challenge.
4567 	 */
4568 	if (sp->pp_phase != SPPP_PHASE_NETWORK)
4569 		sppp_phase_network(sp);
4570 }
4571 
4572 static void
4573 sppp_chap_tld(struct sppp *sp)
4574 {
4575 	STDDCL;
4576 
4577 	KASSERT(sppp_locked(sp));
4578 
4579 	if (debug)
4580 		log(LOG_DEBUG, "%s: chap tld\n", ifp->if_xname);
4581 	callout_stop(&sp->ch[IDX_CHAP]);
4582 	sp->lcp.protos &= ~(1 << IDX_CHAP);
4583 
4584 	lcp.Close(sp);
4585 }
4586 
4587 static void
4588 sppp_chap_scr(struct sppp *sp)
4589 {
4590 	uint32_t *ch;
4591 	u_char clen = 4 * sizeof(uint32_t);
4592 
4593 	KASSERT(sppp_locked(sp));
4594 
4595 	if (sp->hisauth.name == NULL) {
4596 	    /* can't do anything useful */
4597 	    printf("%s: chap starting without his name being set\n",
4598 	    	sp->pp_if.if_xname);
4599 	    return;
4600 	}
4601 
4602 	/* Compute random challenge. */
4603 	ch = (uint32_t *)sp->hisauth.challenge;
4604 	cprng_strong(kern_cprng, ch, clen, 0);
4605 
4606 	sp->confid[IDX_CHAP] = ++sp->pp_seq[IDX_CHAP];
4607 
4608 	sppp_auth_send(&chap, sp, CHAP_CHALLENGE, sp->confid[IDX_CHAP],
4609 		       sizeof clen, (const char *)&clen,
4610 		       sizeof(sp->hisauth.challenge), sp->hisauth.challenge,
4611 		       0);
4612 }
4613 
4614 /*
4615  *--------------------------------------------------------------------------*
4616  *                                                                          *
4617  *                        The PAP implementation.                           *
4618  *                                                                          *
4619  *--------------------------------------------------------------------------*
4620  */
4621 /*
4622  * For PAP, we need to keep a little state also if we are the peer, not the
4623  * authenticator.  This is since we don't get a request to authenticate, but
4624  * have to repeatedly authenticate ourself until we got a response (or the
4625  * retry counter is expired).
4626  */
4627 
4628 /*
4629  * Handle incoming PAP packets.  */
4630 static void
4631 sppp_pap_input(struct sppp *sp, struct mbuf *m)
4632 {
4633 	STDDCL;
4634 	struct lcp_header *h;
4635 	int len, x;
4636 	u_char mlen;
4637 	char *name, *secret;
4638 	int name_len, secret_len;
4639 
4640 	KASSERT(!sppp_locked(sp));
4641 
4642 	/*
4643 	 * Malicious input might leave this uninitialized, so
4644 	 * init to an impossible value.
4645 	 */
4646 	secret_len = -1;
4647 
4648 	len = m->m_pkthdr.len;
4649 	if (len < 5) {
4650 		if (debug)
4651 			log(LOG_DEBUG,
4652 			    "%s: pap invalid packet length: %d bytes\n",
4653 			    ifp->if_xname, len);
4654 		return;
4655 	}
4656 	h = mtod(m, struct lcp_header *);
4657 	if (len > ntohs(h->len))
4658 		len = ntohs(h->len);
4659 	switch (h->type) {
4660 	/* PAP request is my authproto */
4661 	case PAP_REQ:
4662 		sppp_lock_enter(sp);
4663 		if (sp->hisauth.name == NULL || sp->hisauth.secret == NULL) {
4664 			/* can't do anything useful */
4665 			printf("%s: "
4666 			    "pap request without his name and his secret being set\n",
4667 			    ifp->if_xname);
4668 			sppp_lock_exit(sp);
4669 			break;
4670 		}
4671 		name = 1 + (u_char *)(h + 1);
4672 		name_len = name[-1];
4673 		secret = name + name_len + 1;
4674 		if (name_len > len - 6 ||
4675 		    (secret_len = secret[-1]) > len - 6 - name_len) {
4676 			if (debug) {
4677 				log(LOG_DEBUG, "%s: pap corrupted input "
4678 				    "<%s id=0x%x len=%d",
4679 				    ifp->if_xname,
4680 				    sppp_auth_type_name(PPP_PAP, h->type),
4681 				    h->ident, ntohs(h->len));
4682 				if (len > 4)
4683 					sppp_print_bytes((u_char *)(h + 1),
4684 					    len - 4);
4685 				addlog(">\n");
4686 			}
4687 			sppp_lock_exit(sp);
4688 			break;
4689 		}
4690 		if (debug) {
4691 			log(LOG_DEBUG, "%s: pap input(%s) "
4692 			    "<%s id=0x%x len=%d name=",
4693 			    ifp->if_xname,
4694 			    sppp_state_name(sp->state[IDX_PAP]),
4695 			    sppp_auth_type_name(PPP_PAP, h->type),
4696 			    h->ident, ntohs(h->len));
4697 			sppp_print_string((char *)name, name_len);
4698 			addlog(" secret=");
4699 			sppp_print_string((char *)secret, secret_len);
4700 			addlog(">\n");
4701 		}
4702 		if (name_len != sp->hisauth.name_len ||
4703 		    secret_len != sp->hisauth.secret_len ||
4704 		    memcmp(name, sp->hisauth.name, name_len) != 0 ||
4705 		    memcmp(secret, sp->hisauth.secret, secret_len) != 0) {
4706 			/* action scn, tld */
4707 			sp->pp_auth_failures++;
4708 			mlen = sizeof(FAILMSG) - 1;
4709 			sppp_auth_send(&pap, sp, PAP_NAK, h->ident,
4710 				       sizeof mlen, (const char *)&mlen,
4711 				       sizeof(FAILMSG) - 1, (const u_char *)FAILMSG,
4712 				       0);
4713 			pap.tld(sp);
4714 			sppp_lock_exit(sp);
4715 			break;
4716 		}
4717 		/* action sca, perhaps tlu */
4718 		if (sp->state[IDX_PAP] == STATE_REQ_SENT ||
4719 		    sp->state[IDX_PAP] == STATE_OPENED) {
4720 			mlen = sizeof(SUCCMSG) - 1;
4721 			sppp_auth_send(&pap, sp, PAP_ACK, h->ident,
4722 				       sizeof mlen, (const char *)&mlen,
4723 				       sizeof(SUCCMSG) - 1, (const u_char *)SUCCMSG,
4724 				       0);
4725 		}
4726 		if (sp->state[IDX_PAP] == STATE_REQ_SENT) {
4727 			sppp_cp_change_state(&pap, sp, STATE_OPENED);
4728 			pap.tlu(sp);
4729 		}
4730 		sppp_lock_exit(sp);
4731 		break;
4732 
4733 	/* ack and nak are his authproto */
4734 	case PAP_ACK:
4735 		sppp_lock_enter(sp);
4736 		callout_stop(&sp->pap_my_to_ch);
4737 		if (debug) {
4738 			log(LOG_DEBUG, "%s: pap success",
4739 			    ifp->if_xname);
4740 			name = 1 + (u_char *)(h + 1);
4741 			name_len = name[-1];
4742 			if (len > 5 && name_len < len+4) {
4743 				addlog(": ");
4744 				sppp_print_string(name, name_len);
4745 			}
4746 			addlog("\n");
4747 		}
4748 		x = splnet();
4749 		sp->pp_auth_failures = 0;
4750 		sp->pp_flags &= ~PP_NEEDAUTH;
4751 		if (sp->myauth.proto == PPP_PAP &&
4752 		    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) &&
4753 		    (sp->lcp.protos & (1 << IDX_PAP)) == 0) {
4754 			/*
4755 			 * We are authenticator for PAP but didn't
4756 			 * complete yet.  Leave it to tlu to proceed
4757 			 * to network phase.
4758 			 */
4759 			splx(x);
4760 			sppp_lock_exit(sp);
4761 			break;
4762 		}
4763 		splx(x);
4764 		sppp_phase_network(sp);
4765 		sppp_lock_exit(sp);
4766 		break;
4767 
4768 	case PAP_NAK:
4769 		sppp_lock_enter(sp);
4770 		callout_stop(&sp->pap_my_to_ch);
4771 		sp->pp_auth_failures++;
4772 		if (debug) {
4773 			log(LOG_INFO, "%s: pap failure",
4774 			    ifp->if_xname);
4775 			name = 1 + (u_char *)(h + 1);
4776 			name_len = name[-1];
4777 			if (len > 5 && name_len < len+4) {
4778 				addlog(": ");
4779 				sppp_print_string(name, name_len);
4780 			}
4781 			addlog("\n");
4782 		} else
4783 			log(LOG_INFO, "%s: pap failure\n",
4784 			    ifp->if_xname);
4785 		/* await LCP shutdown by authenticator */
4786 		sppp_lock_exit(sp);
4787 		break;
4788 
4789 	default:
4790 		/* Unknown PAP packet type -- ignore. */
4791 		sppp_lock_enter(sp);
4792 		if (debug) {
4793 			log(LOG_DEBUG, "%s: pap corrupted input "
4794 			    "<0x%x id=0x%x len=%d",
4795 			    ifp->if_xname,
4796 			    h->type, h->ident, ntohs(h->len));
4797 			if (len > 4)
4798 				sppp_print_bytes((u_char *)(h + 1), len - 4);
4799 			addlog(">\n");
4800 		}
4801 		sppp_lock_exit(sp);
4802 		break;
4803 
4804 	}
4805 }
4806 
4807 static void
4808 sppp_pap_init(struct sppp *sp)
4809 {
4810 	/* PAP doesn't have STATE_INITIAL at all. */
4811 	sppp_lock_enter(sp);
4812 	sp->state[IDX_PAP] = STATE_CLOSED;
4813 	sp->fail_counter[IDX_PAP] = 0;
4814 	sp->pp_seq[IDX_PAP] = 0;
4815 	sp->pp_rseq[IDX_PAP] = 0;
4816 	callout_init(&sp->ch[IDX_PAP], 0);
4817 	callout_init(&sp->pap_my_to_ch, 0);
4818 	sppp_lock_exit(sp);
4819 }
4820 
4821 static void
4822 sppp_pap_open(struct sppp *sp)
4823 {
4824 	KASSERT(sppp_locked(sp));
4825 
4826 	if (sp->hisauth.proto == PPP_PAP &&
4827 	    (sp->lcp.opts & (1 << LCP_OPT_AUTH_PROTO)) != 0) {
4828 		/* we are authenticator for PAP, start our timer */
4829 		sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4830 		sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4831 	}
4832 	if (sp->myauth.proto == PPP_PAP) {
4833 		/* we are peer, send a request, and start a timer */
4834 		pap.scr(sp);
4835 		callout_reset(&sp->pap_my_to_ch, sp->lcp.timeout,
4836 		    sppp_pap_my_TO, sp);
4837 	}
4838 }
4839 
4840 static void
4841 sppp_pap_close(struct sppp *sp)
4842 {
4843 	KASSERT(sppp_locked(sp));
4844 	if (sp->state[IDX_PAP] != STATE_CLOSED)
4845 		sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4846 }
4847 
4848 /*
4849  * That's the timeout routine if we are authenticator.  Since the
4850  * authenticator is basically passive in PAP, we can't do much here.
4851  */
4852 static void
4853 sppp_pap_TO(void *cookie)
4854 {
4855 	struct sppp *sp = (struct sppp *)cookie;
4856 	STDDCL;
4857 	int s;
4858 
4859 	KASSERT(!sppp_locked(sp));
4860 
4861 	s = splnet();
4862 	sppp_lock_enter(sp);
4863 	if (debug)
4864 		log(LOG_DEBUG, "%s: pap TO(%s) rst_counter = %d\n",
4865 		    ifp->if_xname,
4866 		    sppp_state_name(sp->state[IDX_PAP]),
4867 		    sp->rst_counter[IDX_PAP]);
4868 
4869 	if (--sp->rst_counter[IDX_PAP] < 0)
4870 		/* TO- event */
4871 		switch (sp->state[IDX_PAP]) {
4872 		case STATE_REQ_SENT:
4873 			pap.tld(sp);
4874 			sppp_cp_change_state(&pap, sp, STATE_CLOSED);
4875 			break;
4876 		}
4877 	else
4878 		/* TO+ event, not very much we could do */
4879 		switch (sp->state[IDX_PAP]) {
4880 		case STATE_REQ_SENT:
4881 			/* sppp_cp_change_state() will restart the timer */
4882 			sppp_cp_change_state(&pap, sp, STATE_REQ_SENT);
4883 			break;
4884 		}
4885 
4886 	sppp_lock_exit(sp);
4887 	splx(s);
4888 }
4889 
4890 /*
4891  * That's the timeout handler if we are peer.  Since the peer is active,
4892  * we need to retransmit our PAP request since it is apparently lost.
4893  * XXX We should impose a max counter.
4894  */
4895 static void
4896 sppp_pap_my_TO(void *cookie)
4897 {
4898 	struct sppp *sp = (struct sppp *)cookie;
4899 	STDDCL;
4900 
4901 	KASSERT(!sppp_locked(sp));
4902 
4903 	sppp_lock_enter(sp);
4904 	if (debug)
4905 		log(LOG_DEBUG, "%s: pap peer TO\n",
4906 		    ifp->if_xname);
4907 
4908 	pap.scr(sp);
4909 	sppp_lock_exit(sp);
4910 }
4911 
4912 static void
4913 sppp_pap_tlu(struct sppp *sp)
4914 {
4915 	STDDCL;
4916 	int x;
4917 
4918 	KASSERT(sppp_locked(sp));
4919 	sp->rst_counter[IDX_PAP] = sp->lcp.max_configure;
4920 
4921 	if (debug)
4922 		log(LOG_DEBUG, "%s: %s tlu\n",
4923 		    ifp->if_xname, pap.name);
4924 
4925 	x = splnet();
4926 	sp->pp_auth_failures = 0;
4927 	/* indicate to LCP that we need to be closed down */
4928 	sp->lcp.protos |= (1 << IDX_PAP);
4929 
4930 	if (sp->pp_flags & PP_NEEDAUTH) {
4931 		/*
4932 		 * Remote is authenticator, but his auth proto didn't
4933 		 * complete yet.  Defer the transition to network
4934 		 * phase.
4935 		 */
4936 		splx(x);
4937 		return;
4938 	}
4939 	splx(x);
4940 	sppp_phase_network(sp);
4941 }
4942 
4943 static void
4944 sppp_pap_tld(struct sppp *sp)
4945 {
4946 	STDDCL;
4947 
4948 	KASSERT(sppp_locked(sp));
4949 
4950 	if (debug)
4951 		log(LOG_DEBUG, "%s: pap tld\n", ifp->if_xname);
4952 	callout_stop(&sp->ch[IDX_PAP]);
4953 	callout_stop(&sp->pap_my_to_ch);
4954 	sp->lcp.protos &= ~(1 << IDX_PAP);
4955 
4956 	lcp.Close(sp);
4957 }
4958 
4959 static void
4960 sppp_pap_scr(struct sppp *sp)
4961 {
4962 	u_char idlen, pwdlen;
4963 
4964 	KASSERT(sppp_locked(sp));
4965 
4966 	if (sp->myauth.secret == NULL || sp->myauth.name == NULL) {
4967 	    /* can't do anything useful */
4968 	    printf("%s: pap starting without my name and secret being set\n",
4969 	    	sp->pp_if.if_xname);
4970 	    return;
4971 	}
4972 
4973 	sp->confid[IDX_PAP] = ++sp->pp_seq[IDX_PAP];
4974 	pwdlen = sp->myauth.secret_len;
4975 	idlen = sp->myauth.name_len;
4976 
4977 	sppp_auth_send(&pap, sp, PAP_REQ, sp->confid[IDX_PAP],
4978 		       sizeof idlen, (const char *)&idlen,
4979 		       idlen, sp->myauth.name,
4980 		       sizeof pwdlen, (const char *)&pwdlen,
4981 		       pwdlen, sp->myauth.secret,
4982 		       0);
4983 }
4984 
4985 /*
4986  * Random miscellaneous functions.
4987  */
4988 
4989 /*
4990  * Send a PAP or CHAP proto packet.
4991  *
4992  * Varadic function, each of the elements for the ellipsis is of type
4993  * ``size_t mlen, const u_char *msg''.  Processing will stop iff
4994  * mlen == 0.
4995  * NOTE: never declare variadic functions with types subject to type
4996  * promotion (i.e. u_char). This is asking for big trouble depending
4997  * on the architecture you are on...
4998  */
4999 
5000 static void
5001 sppp_auth_send(const struct cp *cp, struct sppp *sp,
5002                unsigned int type, unsigned int id,
5003 	       ...)
5004 {
5005 	STDDCL;
5006 	struct lcp_header *lh;
5007 	struct mbuf *m;
5008 	u_char *p;
5009 	int len;
5010 	size_t pkthdrlen;
5011 	unsigned int mlen;
5012 	const char *msg;
5013 	va_list ap;
5014 
5015 	KASSERT(sppp_locked(sp));
5016 
5017 	MGETHDR(m, M_DONTWAIT, MT_DATA);
5018 	if (! m)
5019 		return;
5020 	m_reset_rcvif(m);
5021 
5022 	if (sp->pp_flags & PP_NOFRAMING) {
5023 		*mtod(m, uint16_t *) = htons(cp->proto);
5024 		pkthdrlen = 2;
5025 		lh = (struct lcp_header *)(mtod(m, uint8_t *)+2);
5026 	} else {
5027 		struct ppp_header *h;
5028 		h = mtod(m, struct ppp_header *);
5029 		h->address = PPP_ALLSTATIONS;		/* broadcast address */
5030 		h->control = PPP_UI;			/* Unnumbered Info */
5031 		h->protocol = htons(cp->proto);
5032 		pkthdrlen = PPP_HEADER_LEN;
5033 
5034 		lh = (struct lcp_header *)(h + 1);
5035 	}
5036 
5037 	lh->type = type;
5038 	lh->ident = id;
5039 	p = (u_char *)(lh + 1);
5040 
5041 	va_start(ap, id);
5042 	len = 0;
5043 
5044 	while ((mlen = (unsigned int)va_arg(ap, size_t)) != 0) {
5045 		msg = va_arg(ap, const char *);
5046 		len += mlen;
5047 		if (len > MHLEN - pkthdrlen - LCP_HEADER_LEN) {
5048 			va_end(ap);
5049 			m_freem(m);
5050 			return;
5051 		}
5052 
5053 		memcpy(p, msg, mlen);
5054 		p += mlen;
5055 	}
5056 	va_end(ap);
5057 
5058 	m->m_pkthdr.len = m->m_len = pkthdrlen + LCP_HEADER_LEN + len;
5059 	lh->len = htons(LCP_HEADER_LEN + len);
5060 
5061 	if (debug) {
5062 		log(LOG_DEBUG, "%s: %s output <%s id=0x%x len=%d",
5063 		    ifp->if_xname, cp->name,
5064 		    sppp_auth_type_name(cp->proto, lh->type),
5065 		    lh->ident, ntohs(lh->len));
5066 		if (len)
5067 			sppp_print_bytes((u_char *)(lh + 1), len);
5068 		addlog(">\n");
5069 	}
5070 	if (IF_QFULL(&sp->pp_cpq)) {
5071 		IF_DROP(&sp->pp_fastq);
5072 		IF_DROP(&ifp->if_snd);
5073 		m_freem(m);
5074 		++ifp->if_oerrors;
5075 		return;
5076 	} else
5077 		IF_ENQUEUE(&sp->pp_cpq, m);
5078 	if (! (ifp->if_flags & IFF_OACTIVE)) {
5079 		sppp_lock_exit(sp);
5080 		if_start_lock(ifp);
5081 		sppp_lock_enter(sp);
5082 	}
5083 	ifp->if_obytes += m->m_pkthdr.len + 3;
5084 }
5085 
5086 /*
5087  * Send keepalive packets, every 10 seconds.
5088  */
5089 static void
5090 sppp_keepalive(void *dummy)
5091 {
5092 	struct sppp *sp;
5093 	int s;
5094 	time_t now;
5095 
5096 	SPPPQ_LOCK();
5097 
5098 	s = splnet();
5099 	now = time_uptime;
5100 	for (sp=spppq; sp; sp=sp->pp_next) {
5101 		struct ifnet *ifp = NULL;
5102 
5103 		sppp_lock_enter(sp);
5104 		ifp = &sp->pp_if;
5105 
5106 		/* check idle timeout */
5107 		if ((sp->pp_idle_timeout != 0) && (ifp->if_flags & IFF_RUNNING)
5108 		    && (sp->pp_phase == SPPP_PHASE_NETWORK)) {
5109 		    /* idle timeout is enabled for this interface */
5110 		    if ((now-sp->pp_last_activity) >= sp->pp_idle_timeout) {
5111 		    	if (ifp->if_flags & IFF_DEBUG)
5112 			    printf("%s: no activity for %lu seconds\n",
5113 				sp->pp_if.if_xname,
5114 				(unsigned long)(now-sp->pp_last_activity));
5115 			lcp.Close(sp);
5116 			sppp_lock_exit(sp);
5117 			continue;
5118 		    }
5119 		}
5120 
5121 		/* Keepalive mode disabled or channel down? */
5122 		if (! (sp->pp_flags & PP_KEEPALIVE) ||
5123 		    ! (ifp->if_flags & IFF_RUNNING)) {
5124 			sppp_lock_exit(sp);
5125 			continue;
5126 		}
5127 
5128 
5129 		/* No keepalive in PPP mode if LCP not opened yet. */
5130 		if (! (sp->pp_flags & PP_CISCO) &&
5131 		    sp->pp_phase < SPPP_PHASE_AUTHENTICATE) {
5132 			sppp_lock_exit(sp);
5133 			continue;
5134 		}
5135 
5136 		/* No echo reply, but maybe user data passed through? */
5137 		if ((now - sp->pp_last_receive) < sp->pp_max_noreceive) {
5138 			sp->pp_alivecnt = 0;
5139 			sppp_lock_exit(sp);
5140 			continue;
5141 		}
5142 
5143 		if (sp->pp_alivecnt >= sp->pp_maxalive) {
5144 			/* No keepalive packets got.  Stop the interface. */
5145 			sppp_lock_exit(sp);
5146 			if_down (ifp);
5147 			sppp_lock_enter(sp);
5148 			IF_PURGE(&sp->pp_cpq);
5149 			if (! (sp->pp_flags & PP_CISCO)) {
5150 				printf("%s: LCP keepalive timed out, going to restart the connection\n",
5151 					ifp->if_xname);
5152 				sp->pp_alivecnt = 0;
5153 
5154 				/* we are down, close all open protocols */
5155 				lcp.Close(sp);
5156 
5157 				/* And now prepare LCP to reestablish the link, if configured to do so. */
5158 				sppp_cp_change_state(&lcp, sp, STATE_STOPPED);
5159 
5160 				/* Close connection immediately, completition of this
5161 				 * will summon the magic needed to reestablish it. */
5162 				if (sp->pp_tlf)
5163 					sp->pp_tlf(sp);
5164 
5165 				sppp_lock_exit(sp);
5166 				continue;
5167 			}
5168 		}
5169 		if (sp->pp_alivecnt < sp->pp_maxalive)
5170 			++sp->pp_alivecnt;
5171 		if (sp->pp_flags & PP_CISCO)
5172 			sppp_cisco_send(sp, CISCO_KEEPALIVE_REQ,
5173 			    ++sp->pp_seq[IDX_LCP], sp->pp_rseq[IDX_LCP]);
5174 		else if (sp->pp_phase >= SPPP_PHASE_AUTHENTICATE) {
5175 			int32_t nmagic = htonl(sp->lcp.magic);
5176 			sp->lcp.echoid = ++sp->pp_seq[IDX_LCP];
5177 			sppp_cp_send(sp, PPP_LCP, ECHO_REQ,
5178 				sp->lcp.echoid, 4, &nmagic);
5179 		}
5180 
5181 		sppp_lock_exit(sp);
5182 	}
5183 	splx(s);
5184 	callout_reset(&keepalive_ch, hz * LCP_KEEPALIVE_INTERVAL, sppp_keepalive, NULL);
5185 
5186 	SPPPQ_UNLOCK();
5187 }
5188 
5189 #ifdef INET
5190 /*
5191  * Get both IP addresses.
5192  */
5193 static void
5194 sppp_get_ip_addrs(struct sppp *sp, uint32_t *src, uint32_t *dst, uint32_t *srcmask)
5195 {
5196 	struct ifnet *ifp = &sp->pp_if;
5197 	struct ifaddr *ifa;
5198 	struct sockaddr_in *si, *sm;
5199 	uint32_t ssrc, ddst;
5200 
5201 	sm = NULL;
5202 	ssrc = ddst = 0;
5203 	/*
5204 	 * Pick the first AF_INET address from the list,
5205 	 * aliases don't make any sense on a p2p link anyway.
5206 	 */
5207 	si = 0;
5208 	IFADDR_READER_FOREACH(ifa, ifp) {
5209 		if (ifa->ifa_addr->sa_family == AF_INET) {
5210 			si = (struct sockaddr_in *)ifa->ifa_addr;
5211 			sm = (struct sockaddr_in *)ifa->ifa_netmask;
5212 			if (si)
5213 				break;
5214 		}
5215 	}
5216 	if (ifa) {
5217 		if (si && si->sin_addr.s_addr) {
5218 			ssrc = si->sin_addr.s_addr;
5219 			if (srcmask)
5220 				*srcmask = ntohl(sm->sin_addr.s_addr);
5221 		}
5222 
5223 		si = (struct sockaddr_in *)ifa->ifa_dstaddr;
5224 		if (si && si->sin_addr.s_addr)
5225 			ddst = si->sin_addr.s_addr;
5226 	}
5227 
5228 	if (dst) *dst = ntohl(ddst);
5229 	if (src) *src = ntohl(ssrc);
5230 }
5231 
5232 /*
5233  * Set IP addresses.  Must be called at splnet.
5234  * If an address is 0, leave it the way it is.
5235  */
5236 static void
5237 sppp_set_ip_addrs_work(struct work *wk, struct sppp *sp)
5238 {
5239 	STDDCL;
5240 	struct ifaddr *ifa;
5241 	struct sockaddr_in *si, *dest;
5242 	uint32_t myaddr = 0, hisaddr = 0;
5243 	int s;
5244 
5245 	/*
5246 	 * Pick the first AF_INET address from the list,
5247 	 * aliases don't make any sense on a p2p link anyway.
5248 	 */
5249 	si = dest = NULL;
5250 	s = pserialize_read_enter();
5251 	IFADDR_READER_FOREACH(ifa, ifp) {
5252 		if (ifa->ifa_addr->sa_family == AF_INET) {
5253 			si = (struct sockaddr_in *)ifa->ifa_addr;
5254 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
5255 			break;
5256 		}
5257 	}
5258 	pserialize_read_exit(s);
5259 
5260 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) && (sp->ipcp.flags & IPCP_MYADDR_SEEN))
5261 		myaddr = sp->ipcp.req_myaddr;
5262 	else if (si != NULL)
5263 		myaddr = ntohl(si->sin_addr.s_addr);
5264 
5265 	if ((sp->ipcp.flags & IPCP_HISADDR_DYN) && (sp->ipcp.flags & IPCP_HISADDR_SEEN))
5266 		hisaddr = sp->ipcp.req_hisaddr;
5267 	else if (dest != NULL)
5268 		hisaddr = ntohl(dest->sin_addr.s_addr);
5269 
5270 	if (si != NULL && dest != NULL) {
5271 		int error;
5272 		struct sockaddr_in new_sin = *si;
5273 		struct sockaddr_in new_dst = *dest;
5274 
5275 		if (myaddr != 0)
5276 			new_sin.sin_addr.s_addr = htonl(myaddr);
5277 		if (hisaddr != 0) {
5278 			new_dst.sin_addr.s_addr = htonl(hisaddr);
5279 			if (new_dst.sin_addr.s_addr != dest->sin_addr.s_addr)
5280 				sp->ipcp.saved_hisaddr = dest->sin_addr.s_addr;
5281 		}
5282 
5283 		in_addrhash_remove(ifatoia(ifa));
5284 
5285 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
5286 
5287 		in_addrhash_insert(ifatoia(ifa));
5288 
5289 		if (debug && error)
5290 		{
5291 			log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n",
5292 			    ifp->if_xname, __func__, error);
5293 		}
5294 		if (!error) {
5295 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
5296 		}
5297 	}
5298 
5299 	if (ifp->if_mtu > sp->lcp.their_mru) {
5300 		sp->pp_saved_mtu = ifp->if_mtu;
5301 		ifp->if_mtu = sp->lcp.their_mru;
5302 		if (debug)
5303 			log(LOG_DEBUG,
5304 			    "%s: setting MTU to %" PRIu64 " bytes\n",
5305 			    ifp->if_xname, ifp->if_mtu);
5306 	}
5307 
5308 	if (sp->pp_con)
5309 		sp->pp_con(sp);
5310 }
5311 
5312 static void
5313 sppp_set_ip_addrs(struct sppp *sp)
5314 {
5315 	struct ifnet *ifp = &sp->pp_if;
5316 
5317 	if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_SET_ADDRS)) {
5318 		log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n",
5319 		    ifp->if_xname);
5320 		return;
5321 	}
5322 
5323 	if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1)
5324 		return;
5325 
5326 	workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL);
5327 }
5328 
5329 /*
5330  * Clear IP addresses.  Must be called at splnet.
5331  */
5332 static void
5333 sppp_clear_ip_addrs_work(struct work *wk, struct sppp *sp)
5334 {
5335 	STDDCL;
5336 	struct ifaddr *ifa;
5337 	struct sockaddr_in *si, *dest;
5338 	int s;
5339 
5340 	/*
5341 	 * Pick the first AF_INET address from the list,
5342 	 * aliases don't make any sense on a p2p link anyway.
5343 	 */
5344 	si = dest = NULL;
5345 	s = pserialize_read_enter();
5346 	IFADDR_READER_FOREACH(ifa, ifp) {
5347 		if (ifa->ifa_addr->sa_family == AF_INET) {
5348 			si = (struct sockaddr_in *)ifa->ifa_addr;
5349 			dest = (struct sockaddr_in *)ifa->ifa_dstaddr;
5350 			break;
5351 		}
5352 	}
5353 	pserialize_read_exit(s);
5354 
5355 	if (si != NULL) {
5356 		struct sockaddr_in new_sin = *si;
5357 		struct sockaddr_in new_dst = *dest;
5358 		int error;
5359 
5360 		if (sp->ipcp.flags & IPCP_MYADDR_DYN)
5361 			new_sin.sin_addr.s_addr = 0;
5362 		if (sp->ipcp.flags & IPCP_HISADDR_DYN)
5363 			new_dst.sin_addr.s_addr = sp->ipcp.saved_hisaddr;
5364 
5365 		in_addrhash_remove(ifatoia(ifa));
5366 
5367 		error = in_ifinit(ifp, ifatoia(ifa), &new_sin, &new_dst, 0);
5368 
5369 		in_addrhash_insert(ifatoia(ifa));
5370 
5371 		if (debug && error)
5372 		{
5373 			log(LOG_DEBUG, "%s: %s: in_ifinit failed, error=%d\n",
5374 			    ifp->if_xname, __func__, error);
5375 		}
5376 		if (!error) {
5377 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR, ifa);
5378 		}
5379 	}
5380 
5381 	if (sp->pp_saved_mtu > 0) {
5382 		ifp->if_mtu = sp->pp_saved_mtu;
5383 		sp->pp_saved_mtu = 0;
5384 		if (debug)
5385 			log(LOG_DEBUG,
5386 			    "%s: resetting MTU to %" PRIu64 " bytes\n",
5387 			    ifp->if_xname, ifp->if_mtu);
5388 	}
5389 }
5390 
5391 static void
5392 sppp_clear_ip_addrs(struct sppp *sp)
5393 {
5394 	struct ifnet *ifp = &sp->pp_if;
5395 
5396 	if (!pcq_put(sp->ipcp.update_addrs_q, (void *)IPCP_CLEAR_ADDRS)) {
5397 		log(LOG_WARNING, "%s: cannot enqueued, ignore sppp_clear_ip_addrs\n",
5398 		    ifp->if_xname);
5399 		return;
5400 	}
5401 
5402 	if (atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 1) == 1)
5403 		return;
5404 
5405 	workqueue_enqueue(sp->ipcp.update_addrs_wq, &sp->ipcp.update_addrs_wk, NULL);
5406 }
5407 
5408 static void
5409 sppp_update_ip_addrs_work(struct work *wk, void *arg)
5410 {
5411 	struct sppp *sp = arg;
5412 	void *work;
5413 
5414 	atomic_swap_uint(&sp->ipcp.update_addrs_enqueued, 0);
5415 
5416 	while ((work = pcq_get(sp->ipcp.update_addrs_q)) != NULL) {
5417 		int update = (intptr_t)work;
5418 
5419 		if (update == IPCP_SET_ADDRS)
5420 			sppp_set_ip_addrs_work(wk, sp);
5421 		else if (update == IPCP_CLEAR_ADDRS)
5422 			sppp_clear_ip_addrs_work(wk, sp);
5423 	}
5424 }
5425 #endif
5426 
5427 #ifdef INET6
5428 /*
5429  * Get both IPv6 addresses.
5430  */
5431 static void
5432 sppp_get_ip6_addrs(struct sppp *sp, struct in6_addr *src, struct in6_addr *dst,
5433 		   struct in6_addr *srcmask)
5434 {
5435 	struct ifnet *ifp = &sp->pp_if;
5436 	struct ifaddr *ifa;
5437 	struct sockaddr_in6 *si, *sm;
5438 	struct in6_addr ssrc, ddst;
5439 
5440 	sm = NULL;
5441 	memset(&ssrc, 0, sizeof(ssrc));
5442 	memset(&ddst, 0, sizeof(ddst));
5443 	/*
5444 	 * Pick the first link-local AF_INET6 address from the list,
5445 	 * aliases don't make any sense on a p2p link anyway.
5446 	 */
5447 	si = 0;
5448 	IFADDR_READER_FOREACH(ifa, ifp)
5449 		if (ifa->ifa_addr->sa_family == AF_INET6) {
5450 			si = (struct sockaddr_in6 *)ifa->ifa_addr;
5451 			sm = (struct sockaddr_in6 *)ifa->ifa_netmask;
5452 			if (si && IN6_IS_ADDR_LINKLOCAL(&si->sin6_addr))
5453 				break;
5454 		}
5455 	if (ifa) {
5456 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr)) {
5457 			memcpy(&ssrc, &si->sin6_addr, sizeof(ssrc));
5458 			if (srcmask) {
5459 				memcpy(srcmask, &sm->sin6_addr,
5460 				    sizeof(*srcmask));
5461 			}
5462 		}
5463 
5464 		si = (struct sockaddr_in6 *)ifa->ifa_dstaddr;
5465 		if (si && !IN6_IS_ADDR_UNSPECIFIED(&si->sin6_addr))
5466 			memcpy(&ddst, &si->sin6_addr, sizeof(ddst));
5467 	}
5468 
5469 	if (dst)
5470 		memcpy(dst, &ddst, sizeof(*dst));
5471 	if (src)
5472 		memcpy(src, &ssrc, sizeof(*src));
5473 }
5474 
5475 #ifdef IPV6CP_MYIFID_DYN
5476 /*
5477  * Generate random ifid.
5478  */
5479 static void
5480 sppp_gen_ip6_addr(struct sppp *sp, struct in6_addr *addr)
5481 {
5482 	/* TBD */
5483 }
5484 
5485 /*
5486  * Set my IPv6 address.  Must be called at splnet.
5487  */
5488 static void
5489 sppp_set_ip6_addr(struct sppp *sp, const struct in6_addr *src)
5490 {
5491 	STDDCL;
5492 	struct ifaddr *ifa;
5493 	struct sockaddr_in6 *sin6;
5494 
5495 	/*
5496 	 * Pick the first link-local AF_INET6 address from the list,
5497 	 * aliases don't make any sense on a p2p link anyway.
5498 	 */
5499 
5500 	sin6 = NULL;
5501 	IFADDR_READER_FOREACH(ifa, ifp)
5502 	{
5503 		if (ifa->ifa_addr->sa_family == AF_INET6)
5504 		{
5505 			sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
5506 			if (sin6 && IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5507 				break;
5508 		}
5509 	}
5510 
5511 	if (ifa && sin6)
5512 	{
5513 		int error;
5514 		struct sockaddr_in6 new_sin6 = *sin6;
5515 
5516 		memcpy(&new_sin6.sin6_addr, src, sizeof(new_sin6.sin6_addr));
5517 		error = in6_ifinit(ifp, ifatoia6(ifa), &new_sin6, 1);
5518 		if (debug && error)
5519 		{
5520 			log(LOG_DEBUG, "%s: %s: in6_ifinit failed, error=%d\n",
5521 			    ifp->if_xname, __func__, error);
5522 		}
5523 		if (!error) {
5524 			pfil_run_addrhooks(if_pfil, SIOCAIFADDR_IN6, ifa);
5525 		}
5526 	}
5527 }
5528 #endif
5529 
5530 /*
5531  * Suggest a candidate address to be used by peer.
5532  */
5533 static void
5534 sppp_suggest_ip6_addr(struct sppp *sp, struct in6_addr *suggest)
5535 {
5536 	struct in6_addr myaddr;
5537 	struct timeval tv;
5538 
5539 	sppp_get_ip6_addrs(sp, &myaddr, 0, 0);
5540 
5541 	myaddr.s6_addr[8] &= ~0x02;	/* u bit to "local" */
5542 	microtime(&tv);
5543 	if ((tv.tv_usec & 0xff) == 0 && (tv.tv_sec & 0xff) == 0) {
5544 		myaddr.s6_addr[14] ^= 0xff;
5545 		myaddr.s6_addr[15] ^= 0xff;
5546 	} else {
5547 		myaddr.s6_addr[14] ^= (tv.tv_usec & 0xff);
5548 		myaddr.s6_addr[15] ^= (tv.tv_sec & 0xff);
5549 	}
5550 	if (suggest)
5551 		memcpy(suggest, &myaddr, sizeof(myaddr));
5552 }
5553 #endif /*INET6*/
5554 
5555 /*
5556  * Process ioctl requests specific to the PPP interface.
5557  * Permissions have already been checked.
5558  */
5559 static int
5560 sppp_params(struct sppp *sp, u_long cmd, void *data)
5561 {
5562 	switch (cmd) {
5563 	case SPPPGETAUTHCFG:
5564 	    {
5565 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
5566 		int error;
5567 		size_t len;
5568 
5569 		sppp_lock_enter(sp);
5570 
5571 		cfg->myauthflags = sp->myauth.flags;
5572 		cfg->hisauthflags = sp->hisauth.flags;
5573 		strlcpy(cfg->ifname, sp->pp_if.if_xname, sizeof(cfg->ifname));
5574 		cfg->hisauth = 0;
5575 		if (sp->hisauth.proto)
5576 		    cfg->hisauth = (sp->hisauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
5577 		cfg->myauth = 0;
5578 		if (sp->myauth.proto)
5579 		    cfg->myauth = (sp->myauth.proto == PPP_PAP) ? SPPP_AUTHPROTO_PAP : SPPP_AUTHPROTO_CHAP;
5580 		if (cfg->myname_length == 0) {
5581 		    if (sp->myauth.name != NULL)
5582 			cfg->myname_length = sp->myauth.name_len + 1;
5583 		} else {
5584 		    if (sp->myauth.name == NULL) {
5585 			cfg->myname_length = 0;
5586 		    } else {
5587 			len = sp->myauth.name_len + 1;
5588 
5589 			sppp_lock_exit(sp);
5590 
5591 			if (cfg->myname_length < len)
5592 			    return (ENAMETOOLONG);
5593 			error = copyout(sp->myauth.name, cfg->myname, len);
5594 			if (error) return error;
5595 
5596 			sppp_lock_enter(sp);
5597 		    }
5598 		}
5599 		if (cfg->hisname_length == 0) {
5600 		    if (sp->hisauth.name != NULL)
5601 			cfg->hisname_length = sp->hisauth.name_len + 1;
5602 		} else {
5603 		    if (sp->hisauth.name == NULL) {
5604 		    	cfg->hisname_length = 0;
5605 		    } else {
5606 			len = sp->hisauth.name_len + 1;
5607 
5608 			sppp_lock_exit(sp);
5609 			if (cfg->hisname_length < len)
5610 			    return (ENAMETOOLONG);
5611 			error = copyout(sp->hisauth.name, cfg->hisname, len);
5612 			if (error) return error;
5613 			sppp_lock_enter(sp);
5614 		    }
5615 		}
5616 		sppp_lock_exit(sp);
5617 	    }
5618 	    break;
5619 	case SPPPSETAUTHCFG:
5620 	    {
5621 		struct spppauthcfg *cfg = (struct spppauthcfg *)data;
5622 		int error;
5623 
5624 		sppp_lock_enter(sp);
5625 
5626 		if (sp->myauth.name) {
5627 			free(sp->myauth.name, M_DEVBUF);
5628 			sp->myauth.name = NULL;
5629 		}
5630 		if (sp->myauth.secret) {
5631 			free(sp->myauth.secret, M_DEVBUF);
5632 			sp->myauth.secret = NULL;
5633 		}
5634 		if (sp->hisauth.name) {
5635 			free(sp->hisauth.name, M_DEVBUF);
5636 			sp->hisauth.name = NULL;
5637 		}
5638 		if (sp->hisauth.secret) {
5639 			free(sp->hisauth.secret, M_DEVBUF);
5640 			sp->hisauth.secret = NULL;
5641 		}
5642 
5643 		if (cfg->hisname != NULL && cfg->hisname_length > 0) {
5644 			if (cfg->hisname_length >= MCLBYTES) {
5645 				sppp_lock_exit(sp);
5646 				return (ENAMETOOLONG);
5647 			}
5648 			sp->hisauth.name = malloc(cfg->hisname_length, M_DEVBUF, M_WAITOK);
5649 			error = copyin(cfg->hisname, sp->hisauth.name, cfg->hisname_length);
5650 			if (error) {
5651 				free(sp->hisauth.name, M_DEVBUF);
5652 				sp->hisauth.name = NULL;
5653 				sppp_lock_exit(sp);
5654 				return error;
5655 			}
5656 			sp->hisauth.name_len = cfg->hisname_length - 1;
5657 			sp->hisauth.name[sp->hisauth.name_len] = 0;
5658 		}
5659 		if (cfg->hissecret != NULL && cfg->hissecret_length > 0) {
5660 			if (cfg->hissecret_length >= MCLBYTES) {
5661 				sppp_lock_exit(sp);
5662 				return (ENAMETOOLONG);
5663 			}
5664 			sp->hisauth.secret = malloc(cfg->hissecret_length,
5665 			    M_DEVBUF, M_WAITOK);
5666 			error = copyin(cfg->hissecret, sp->hisauth.secret,
5667 			    cfg->hissecret_length);
5668 			if (error) {
5669 				free(sp->hisauth.secret, M_DEVBUF);
5670 				sp->hisauth.secret = NULL;
5671 				sppp_lock_exit(sp);
5672 				return error;
5673 			}
5674 			sp->hisauth.secret_len = cfg->hissecret_length - 1;
5675 			sp->hisauth.secret[sp->hisauth.secret_len] = 0;
5676 		}
5677 		if (cfg->myname != NULL && cfg->myname_length > 0) {
5678 			if (cfg->myname_length >= MCLBYTES) {
5679 				sppp_lock_exit(sp);
5680 				return (ENAMETOOLONG);
5681 			}
5682 			sp->myauth.name = malloc(cfg->myname_length, M_DEVBUF, M_WAITOK);
5683 			error = copyin(cfg->myname, sp->myauth.name, cfg->myname_length);
5684 			if (error) {
5685 				free(sp->myauth.name, M_DEVBUF);
5686 				sp->myauth.name = NULL;
5687 				sppp_lock_exit(sp);
5688 				return error;
5689 			}
5690 			sp->myauth.name_len = cfg->myname_length - 1;
5691 			sp->myauth.name[sp->myauth.name_len] = 0;
5692 		}
5693 		if (cfg->mysecret != NULL && cfg->mysecret_length > 0) {
5694 			if (cfg->mysecret_length >= MCLBYTES) {
5695 				sppp_lock_exit(sp);
5696 				return (ENAMETOOLONG);
5697 			}
5698 			sp->myauth.secret = malloc(cfg->mysecret_length,
5699 			    M_DEVBUF, M_WAITOK);
5700 			error = copyin(cfg->mysecret, sp->myauth.secret,
5701 			    cfg->mysecret_length);
5702 			if (error) {
5703 				free(sp->myauth.secret, M_DEVBUF);
5704 				sp->myauth.secret = NULL;
5705 				sppp_lock_exit(sp);
5706 				return error;
5707 			}
5708 			sp->myauth.secret_len = cfg->mysecret_length - 1;
5709 			sp->myauth.secret[sp->myauth.secret_len] = 0;
5710 		}
5711 		sp->myauth.flags = cfg->myauthflags;
5712 		if (cfg->myauth)
5713 		    sp->myauth.proto = (cfg->myauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
5714 		sp->hisauth.flags = cfg->hisauthflags;
5715 		if (cfg->hisauth)
5716 		    sp->hisauth.proto = (cfg->hisauth == SPPP_AUTHPROTO_PAP) ? PPP_PAP : PPP_CHAP;
5717 		sp->pp_auth_failures = 0;
5718 		if (sp->hisauth.proto != 0)
5719 		    sp->lcp.opts |= (1 << LCP_OPT_AUTH_PROTO);
5720 		else
5721 		    sp->lcp.opts &= ~(1 << LCP_OPT_AUTH_PROTO);
5722 
5723 		sppp_lock_exit(sp);
5724 	    }
5725 	    break;
5726 	case SPPPGETLCPCFG:
5727 	    {
5728 		struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
5729 		sppp_lock_enter(sp);
5730 		lcpp->lcp_timeout = sp->lcp.timeout;
5731 		sppp_lock_exit(sp);
5732 	    }
5733 	    break;
5734 	case SPPPSETLCPCFG:
5735 	    {
5736 		struct sppplcpcfg *lcpp = (struct sppplcpcfg *)data;
5737 		sppp_lock_enter(sp);
5738 		sp->lcp.timeout = lcpp->lcp_timeout;
5739 		sppp_lock_exit(sp);
5740 	    }
5741 	    break;
5742 	case SPPPGETSTATUS:
5743 	    {
5744 		struct spppstatus *status = (struct spppstatus *)data;
5745 		sppp_lock_enter(sp);
5746 		status->phase = sp->pp_phase;
5747 		sppp_lock_exit(sp);
5748 	    }
5749 	    break;
5750 	case SPPPGETSTATUSNCP:
5751 	    {
5752 		struct spppstatusncp *status = (struct spppstatusncp *)data;
5753 		sppp_lock_enter(sp);
5754 		status->phase = sp->pp_phase;
5755 		sppp_lock_exit(sp);
5756 		status->ncpup = sppp_ncp_check(sp);
5757 	    }
5758 	    break;
5759 	case SPPPGETIDLETO:
5760 	    {
5761 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
5762 		sppp_lock_enter(sp);
5763 		to->idle_seconds = sp->pp_idle_timeout;
5764 		sppp_lock_exit(sp);
5765 	    }
5766 	    break;
5767 	case SPPPSETIDLETO:
5768 	    {
5769 	    	struct spppidletimeout *to = (struct spppidletimeout *)data;
5770 		sppp_lock_enter(sp);
5771 		sp->pp_idle_timeout = to->idle_seconds;
5772 		sppp_lock_exit(sp);
5773 	    }
5774 	    break;
5775 	case SPPPSETAUTHFAILURE:
5776 	    {
5777 	    	struct spppauthfailuresettings *afsettings = (struct spppauthfailuresettings *)data;
5778 		sppp_lock_enter(sp);
5779 		sp->pp_max_auth_fail = afsettings->max_failures;
5780 		sp->pp_auth_failures = 0;
5781 		sppp_lock_exit(sp);
5782 	    }
5783 	    break;
5784 	case SPPPGETAUTHFAILURES:
5785 	    {
5786 	    	struct spppauthfailurestats *stats = (struct spppauthfailurestats *)data;
5787 		sppp_lock_enter(sp);
5788 		stats->auth_failures = sp->pp_auth_failures;
5789 		stats->max_failures = sp->pp_max_auth_fail;
5790 		sppp_lock_exit(sp);
5791 	    }
5792 	    break;
5793 	case SPPPSETDNSOPTS:
5794 	    {
5795 		struct spppdnssettings *req = (struct spppdnssettings *)data;
5796 		sppp_lock_enter(sp);
5797 		sp->query_dns = req->query_dns & 3;
5798 		sppp_lock_exit(sp);
5799 	    }
5800 	    break;
5801 	case SPPPGETDNSOPTS:
5802 	    {
5803 		struct spppdnssettings *req = (struct spppdnssettings *)data;
5804 		sppp_lock_enter(sp);
5805 		req->query_dns = sp->query_dns;
5806 		sppp_lock_exit(sp);
5807 	    }
5808 	    break;
5809 	case SPPPGETDNSADDRS:
5810 	    {
5811 		struct spppdnsaddrs *addrs = (struct spppdnsaddrs *)data;
5812 		sppp_lock_enter(sp);
5813 		memcpy(&addrs->dns, &sp->dns_addrs, sizeof addrs->dns);
5814 		sppp_lock_exit(sp);
5815 	    }
5816 	    break;
5817 	case SPPPGETKEEPALIVE:
5818 	    {
5819 	    	struct spppkeepalivesettings *settings =
5820 		     (struct spppkeepalivesettings*)data;
5821 		sppp_lock_enter(sp);
5822 		settings->maxalive = sp->pp_maxalive;
5823 		settings->max_noreceive = sp->pp_max_noreceive;
5824 		sppp_lock_exit(sp);
5825 	    }
5826 	    break;
5827 	case SPPPSETKEEPALIVE:
5828 	    {
5829 	    	struct spppkeepalivesettings *settings =
5830 		     (struct spppkeepalivesettings*)data;
5831 		sppp_lock_enter(sp);
5832 		sp->pp_maxalive = settings->maxalive;
5833 		sp->pp_max_noreceive = settings->max_noreceive;
5834 		sppp_lock_exit(sp);
5835 	    }
5836 	    break;
5837 #if defined(COMPAT_50) || defined(MODULAR)
5838 	case __SPPPGETIDLETO50:
5839 	    {
5840 	    	struct spppidletimeout50 *to = (struct spppidletimeout50 *)data;
5841 		sppp_lock_enter(sp);
5842 		to->idle_seconds = (uint32_t)sp->pp_idle_timeout;
5843 		sppp_lock_exit(sp);
5844 	    }
5845 	    break;
5846 	case __SPPPSETIDLETO50:
5847 	    {
5848 		struct spppidletimeout50 *to = (struct spppidletimeout50 *)data;
5849 		sppp_lock_enter(sp);
5850 		sp->pp_idle_timeout = (time_t)to->idle_seconds;
5851 		sppp_lock_exit(sp);
5852 	    }
5853 	    break;
5854 	case __SPPPGETKEEPALIVE50:
5855 	    {
5856 	    	struct spppkeepalivesettings50 *settings =
5857 		     (struct spppkeepalivesettings50*)data;
5858 		sppp_lock_enter(sp);
5859 		settings->maxalive = sp->pp_maxalive;
5860 		settings->max_noreceive = (uint32_t)sp->pp_max_noreceive;
5861 		sppp_lock_exit(sp);
5862 	    }
5863 	    break;
5864 	case __SPPPSETKEEPALIVE50:
5865 	    {
5866 	    	struct spppkeepalivesettings50 *settings =
5867 		     (struct spppkeepalivesettings50*)data;
5868 		sppp_lock_enter(sp);
5869 		sp->pp_maxalive = settings->maxalive;
5870 		sp->pp_max_noreceive = (time_t)settings->max_noreceive;
5871 		sppp_lock_exit(sp);
5872 	    }
5873 	    break;
5874 #endif /* COMPAT_50 || MODULAR */
5875 	default:
5876 		return (EINVAL);
5877 	}
5878 
5879 	return (0);
5880 }
5881 
5882 static void
5883 sppp_phase_network(struct sppp *sp)
5884 {
5885 	int i;
5886 	uint32_t mask;
5887 
5888 	KASSERT(sppp_locked(sp));
5889 
5890 	sppp_change_phase(sp, SPPP_PHASE_NETWORK);
5891 
5892 	/* Notify NCPs now. */
5893 	for (i = 0; i < IDX_COUNT; i++)
5894 		if ((cps[i])->flags & CP_NCP)
5895 			(cps[i])->Open(sp);
5896 
5897 	/* Send Up events to all NCPs. */
5898 	for (i = 0, mask = 1; i < IDX_COUNT; i++, mask <<= 1)
5899 		if ((sp->lcp.protos & mask) && ((cps[i])->flags & CP_NCP)) {
5900 			(cps[i])->Up(sp);
5901 		}
5902 
5903 	/* if no NCP is starting, all this was in vain, close down */
5904 	sppp_lcp_check_and_close(sp);
5905 }
5906 
5907 
5908 static const char *
5909 sppp_cp_type_name(u_char type)
5910 {
5911 	static char buf[12];
5912 	switch (type) {
5913 	case CONF_REQ:   return "conf-req";
5914 	case CONF_ACK:   return "conf-ack";
5915 	case CONF_NAK:   return "conf-nak";
5916 	case CONF_REJ:   return "conf-rej";
5917 	case TERM_REQ:   return "term-req";
5918 	case TERM_ACK:   return "term-ack";
5919 	case CODE_REJ:   return "code-rej";
5920 	case PROTO_REJ:  return "proto-rej";
5921 	case ECHO_REQ:   return "echo-req";
5922 	case ECHO_REPLY: return "echo-reply";
5923 	case DISC_REQ:   return "discard-req";
5924 	}
5925 	snprintf(buf, sizeof(buf), "0x%x", type);
5926 	return buf;
5927 }
5928 
5929 static const char *
5930 sppp_auth_type_name(u_short proto, u_char type)
5931 {
5932 	static char buf[32];
5933 	const char *name;
5934 
5935 	switch (proto) {
5936 	case PPP_CHAP:
5937 		switch (type) {
5938 		case CHAP_CHALLENGE:	return "challenge";
5939 		case CHAP_RESPONSE:	return "response";
5940 		case CHAP_SUCCESS:	return "success";
5941 		case CHAP_FAILURE:	return "failure";
5942 		default:		name = "chap"; break;
5943 		}
5944 		break;
5945 
5946 	case PPP_PAP:
5947 		switch (type) {
5948 		case PAP_REQ:		return "req";
5949 		case PAP_ACK:		return "ack";
5950 		case PAP_NAK:		return "nak";
5951 		default:		name = "pap";	break;
5952 		}
5953 		break;
5954 
5955 	default:
5956 		name = "bad";
5957 		break;
5958 	}
5959 
5960 	snprintf(buf, sizeof(buf), "%s(%#x) %#x", name, proto, type);
5961 	return buf;
5962 }
5963 
5964 static const char *
5965 sppp_lcp_opt_name(u_char opt)
5966 {
5967 	static char buf[12];
5968 	switch (opt) {
5969 	case LCP_OPT_MRU:		return "mru";
5970 	case LCP_OPT_ASYNC_MAP:		return "async-map";
5971 	case LCP_OPT_AUTH_PROTO:	return "auth-proto";
5972 	case LCP_OPT_QUAL_PROTO:	return "qual-proto";
5973 	case LCP_OPT_MAGIC:		return "magic";
5974 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
5975 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
5976 	}
5977 	snprintf(buf, sizeof(buf), "0x%x", opt);
5978 	return buf;
5979 }
5980 
5981 static const char *
5982 sppp_ipcp_opt_name(u_char opt)
5983 {
5984 	static char buf[12];
5985 	switch (opt) {
5986 	case IPCP_OPT_ADDRESSES:	return "addresses";
5987 	case IPCP_OPT_COMPRESSION:	return "compression";
5988 	case IPCP_OPT_ADDRESS:		return "address";
5989 	}
5990 	snprintf(buf, sizeof(buf), "0x%x", opt);
5991 	return buf;
5992 }
5993 
5994 #ifdef INET6
5995 static const char *
5996 sppp_ipv6cp_opt_name(u_char opt)
5997 {
5998 	static char buf[12];
5999 	switch (opt) {
6000 	case IPV6CP_OPT_IFID:		return "ifid";
6001 	case IPV6CP_OPT_COMPRESSION:	return "compression";
6002 	}
6003 	snprintf(buf, sizeof(buf), "0x%x", opt);
6004 	return buf;
6005 }
6006 #endif
6007 
6008 static const char *
6009 sppp_state_name(int state)
6010 {
6011 	switch (state) {
6012 	case STATE_INITIAL:	return "initial";
6013 	case STATE_STARTING:	return "starting";
6014 	case STATE_CLOSED:	return "closed";
6015 	case STATE_STOPPED:	return "stopped";
6016 	case STATE_CLOSING:	return "closing";
6017 	case STATE_STOPPING:	return "stopping";
6018 	case STATE_REQ_SENT:	return "req-sent";
6019 	case STATE_ACK_RCVD:	return "ack-rcvd";
6020 	case STATE_ACK_SENT:	return "ack-sent";
6021 	case STATE_OPENED:	return "opened";
6022 	}
6023 	return "illegal";
6024 }
6025 
6026 static const char *
6027 sppp_phase_name(int phase)
6028 {
6029 	switch (phase) {
6030 	case SPPP_PHASE_DEAD:		return "dead";
6031 	case SPPP_PHASE_ESTABLISH:	return "establish";
6032 	case SPPP_PHASE_TERMINATE:	return "terminate";
6033 	case SPPP_PHASE_AUTHENTICATE: 	return "authenticate";
6034 	case SPPP_PHASE_NETWORK:	return "network";
6035 	}
6036 	return "illegal";
6037 }
6038 
6039 static const char *
6040 sppp_proto_name(u_short proto)
6041 {
6042 	static char buf[12];
6043 	switch (proto) {
6044 	case PPP_LCP:	return "lcp";
6045 	case PPP_IPCP:	return "ipcp";
6046 	case PPP_PAP:	return "pap";
6047 	case PPP_CHAP:	return "chap";
6048 	case PPP_IPV6CP: return "ipv6cp";
6049 	}
6050 	snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto);
6051 	return buf;
6052 }
6053 
6054 static void
6055 sppp_print_bytes(const u_char *p, u_short len)
6056 {
6057 	addlog(" %02x", *p++);
6058 	while (--len > 0)
6059 		addlog("-%02x", *p++);
6060 }
6061 
6062 static void
6063 sppp_print_string(const char *p, u_short len)
6064 {
6065 	u_char c;
6066 
6067 	while (len-- > 0) {
6068 		c = *p++;
6069 		/*
6070 		 * Print only ASCII chars directly.  RFC 1994 recommends
6071 		 * using only them, but we don't rely on it.  */
6072 		if (c < ' ' || c > '~')
6073 			addlog("\\x%x", c);
6074 		else
6075 			addlog("%c", c);
6076 	}
6077 }
6078 
6079 static const char *
6080 sppp_dotted_quad(uint32_t addr)
6081 {
6082 	static char s[16];
6083 	snprintf(s, sizeof(s), "%d.%d.%d.%d",
6084 		(int)((addr >> 24) & 0xff),
6085 		(int)((addr >> 16) & 0xff),
6086 		(int)((addr >> 8) & 0xff),
6087 		(int)(addr & 0xff));
6088 	return s;
6089 }
6090 
6091 /* a dummy, used to drop uninteresting events */
6092 static void
6093 sppp_null(struct sppp *unused)
6094 {
6095 	/* do just nothing */
6096 }
6097 /*
6098  * This file is large.  Tell emacs to highlight it nevertheless.
6099  *
6100  * Local Variables:
6101  * hilit-auto-highlight-maxout: 120000
6102  * End:
6103  */
6104 
6105 /*
6106  * Module glue
6107  */
6108 MODULE(MODULE_CLASS_MISC, sppp_subr, NULL);
6109 
6110 static int
6111 sppp_subr_modcmd(modcmd_t cmd, void *arg)
6112 {
6113         switch (cmd) {
6114         case MODULE_CMD_INIT:
6115         case MODULE_CMD_FINI:
6116                 return 0;
6117         case MODULE_CMD_STAT:
6118         case MODULE_CMD_AUTOUNLOAD:
6119         default:
6120                 return ENOTTY;
6121         }
6122 }
6123 
6124