summaryrefslogtreecommitdiffstats
path: root/usr.sbin/ppp/ccp.c
Commit message (Collapse)AuthorAgeFilesLines
* Include the correct file (stdarg.h) and use va_list rather than _BSD_VA_LIST_brian2002-08-271-0/+1
| | | | Suggested by: mike
* Remove some misleading/wrong diagnosticsbrian2002-07-021-5/+1
|
* Remove whitespace at the end of lines.brian2002-06-151-1/+1
|
* Understand the following Microsoft Vendor Specific RADIUS attributes:brian2002-06-121-5/+8
| | | | | | | | | | | | | | | | | RAD_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES RAD_MICROSOFT_MS_MPPE_RECV_KEY RAD_MICROSOFT_MS_MPPE_SEND_KEY These attributes may be supplied by a RADIUS server when MSCHAPv2 is used to authenticate. It *should* now be possible to build ppp with -DNODES and still support CHAP/MSCHAP/MSCHAPv2/MPPE via a RADIUS server, but the code isn't yet smart enough to do that (building with -DNODES just looses these facilities). Sponsored by: Monzoon
* o Clean up some #includesbrian2002-05-141-1/+0
| | | | | | | | | | | | | | | | | | o Bump version number to 3.0.4 o When talking to a RADIUS server, provide a NAS-Port-Type. When the NAS-Port-Type is Ethernet, provide a NAS-Port value equal to the SESSIONID from the environment in direct mode or the NGM_PPPOE_SESSIONID message in other modes. If no SESSIONID is found, default to the interface index in client mode or zero in server mode. When the NAS-Port-Type is ISDN, set the NAS-Port to the minor number of the physical device (ie, the N in /dev/i4brbchN). This makes it easier for the RADIUS server to identify the client WRT accounting data etc. Prompted by: lsz8425 <lsz8425@mail.cd.hn.cn>
* Make the way FSM options are processed easier to read by using structuresbrian2002-04-161-68/+42
| | | | | | | | | | | instead of u_char *. The changes are cosmetic except: RecvConfigAck() now displays the options that are being ACK'd Huge (bogus) options sent from the peer won't cause an infinite loop SendIdent and ReceiveIdent are displayed consistenlty with other FSM data LCP AUTHPROTO options that aren't understood are NAK'd, not REJ'd
* Merge the NETGRAPH branch into HEAD. tty devices now use netgraph's linebrian2002-03-301-5/+5
| | | | | | | | discipline to do the async escaping, but no other benefits are available yet. Change ``ifdef HAVE_DES'' to ``ifndef NODES'' for consistency. Make the Makefile a little more sane WRT RELEASE_CRUNCH.
* Call CCP protocol -1 ``none''brian2001-11-031-1/+4
|
* o Add ipv6 support, abstracting most NCP addresses into opaquebrian2001-08-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structures (well, they're treated as opaque). It's now possible to manage IPv6 interface addresses and routing table entries and to filter IPV6 traffic whether encapsulated or not. IPV6CP support is crude for now, and hasn't been tested against any other implementations. RADIUS and IPv6 are independent of eachother for now. ppp.linkup/ppp.linkdown aren't currently used by IPV6CP o Understand all protocols(5) in filter rules rather than only a select few. o Allow a mask specification for the ``delete'' command. It's now possible to specifically delete one of two conflicting routes. o When creating and deleting proxy arp entries, do it for all IPv4 interface addresses rather than doing it just for the ``current'' peer address. o When iface-alias isn't in effect, don't blow away manually (via ``iface add'') added interface addresses. o When listening on a tcp server (diagnostic) socket, bind so that a tcp46 socket is created -- allowing both IPv4 and IPv6 connections. o When displaying ICMP traffic, don't display the icmp type twice. When display traffic, display at least some information about unrecognised traffic. o Bump version Inspired after filtering work by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org>
* Don't try to dereference the -1th ccp algorithm array entry when webrian2001-07-071-1/+1
| | | | open CCP with no algorithm.
* Spell stateful properlybrian2001-07-061-1/+1
| | | | | Inconsistently done by: brian Spotted by: ru
* Reduce the interface MTU by 2 when MPPE has been successfully negotiated.brian2001-07-031-1/+31
| | | | | | This is necessary because MPPE will combine the protocol id with the payload received on the tun interface, encrypt it, then prepend its own protocol id, effectively increasing the payload by two bytes.
* Add support for stateful MPPE (microsoft encryption) providingbrian2001-06-181-21/+115
| | | | | | | | | | | | | | | encryption compatibility with Windows 2000. Stateful encryption uses less CPU but is bad on lossy transports. The ``set mppe'' command has been expanded. If it's used with any arguments, ppp will insist on encryption, closing LCP if the other end refuses. Unfortunately, Microsoft have abused the CCP reset request so that receiving a reset request does not result in a reset ack when using MPPE... Sponsored by: Monzoon Networks AG and FreeBSD Services Limited
* Convert IIJ copyrights to BSD copyrights.brian2001-06-131-19/+25
| | | | Approved by: Toshiharu OHNO <tohno@sirius.ocn.ne.jp>
* Add a ``Usable'' function to the ccp switch. The functionbrian2001-02-041-1/+9
| | | | | | | | | | | | | is called prior to sending a CCP configure request for a given protocol. The default is to send the request, but this is overridden for MPPE which checks to see if the lcp negotiations agreed CHAP81, and if not fails. Use the same function to decide if we should reject peer requests for MPPE. This should get rid of those boring messages about not being able to initialise MPPE when we don't negotiate CHAP81.
* Accept MSCHAPv2 by default.brian2000-11-191-1/+1
| | | | Enable and accept MPPE by default.
* Pass the correct output options to the ccp output initialisationbrian2000-11-071-2/+21
| | | | | | | routine rather than passing it the first requested output option. Ensure that options are freed correctly even if we don't reach TLU.
* Move the MPPE keysize display in ``show ccp''.brian2000-10-301-2/+2
|
* Various whitespace changes.brian2000-10-301-2/+2
| | | | Make some functions static.
* Add MPPE and MSChap v2 support (denied and disabled by default)brian2000-10-301-1/+17
| | | | Submitted by: Ustimenko Semen <semen@iclub.nsu.ru>
* Support link identification from rfc1570brian2000-07-191-2/+2
| | | | Two new commands are available; ``ident'' and ``sendident''.
* When ppp can't identify the relevant name, don't use "???", usebrian2000-03-141-30/+27
| | | | <nnn> or <0xxxx> instead.
* Add a bunch of `const's and fix a typo.brian1999-12-271-3/+3
| | | | Submitted by: Rich Neswold <rneswold@MCS.Net>
* Cosmetic: Make struct mbuf more like kernel mbufs.brian1999-12-201-7/+7
|
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Add ISDN support via isdnd & i4b. This requires versionbrian1999-08-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | 0.81.1 of the i4b code - namely support of the I4B_VR_REQ ioctl via the i4brbchX device. Ppp controls the phone number, but idle timers and SYNC/RAW decisions are still made by isdnd (in isdnd.rc). This involves a new datalink state machine phase. The ``wait for carrier'' phase happens after dialing but before logging in. The whole dial state should really be abstracted so that each device type can deal with it in its own way (thinking about PPPoE) - but that'll have to wait. The ``set cd'' symantics remain the same for tty devices, but we now delay until we either get CD or timeout waiting (at which time we drop the link if we require CD). For i4b devices we always insist on carrier. Thanks to hm@ for his help, and especially for pointing out that I *don't* need to re-implement isdnd (that was a huge waste of time !) :-]
* o Alter the mbuf type as it's processed by different layers.brian1999-06-021-11/+32
| | | | | | | | o Show more information about missing MP fragments in ``show mp''. o Do away with mbuf_Log(). It was showing mbuf stats twice on receipt of LCP/CCP/IPCP packets.... ???!!? o Pre-allocate a bit extra when creating LQR packets to avoid having to allocate another mbuf in mbuf_Prepend().
* Allow ``host:port/udp'' devices and support ``host:port/tcp'' asbrian1999-05-121-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | being the same as the previous (still supported) ``host:port'' syntax for tcp socket devices. A udp device uses synchronous ppp rather than async, and avoids the double-retransmit overhead that comes with ppp over tcp (it's usually a bad idea to transport IP over a reliable transport that itself is using an unreliable transport). PPP over UDP provides througput of ** 1.5Mb per second ** with all compression disabled, maxing out a PPro/200 when running ppp twice, back-to-back. This proves that PPPoE is plausable in userland.... This change adds a few more handler functions to struct device and allows derivations of struct device (which may contain their own data etc) to pass themselves through the unix domain socket for MP. ** At last **, struct physical has lost all the tty crud ! iov2physical() is now smart enough to restore the correct stack of layers so that MP servers will work again. The version number has bumped as our MP link transfer contents have changed (they now may contain a `struct device'). Don't extract the protocol twice in MP mode (resulting in protocol rejects for every MP packet). This was broken with my original layering changes. Add ``Physical'' and ``Sync'' log levels for logging the relevent raw packets and add protocol-tracking LogDEBUG stuff in various LayerPush & LayerPull functions. Assign our physical device name for incoming tcp connections by calling getpeername(). Assign our physical device name for incoming udp connections from the address retrieved by the first recvfrom().
* Deal with the fact that as we now mbuf_Read the fsmbrian1999-05-091-4/+2
| | | | | | | | | header in fsm_Input() we often end up with a NULL mbuf. Deal with a possible NULL mbuf being passed into mbuf_Prepend(). Adjust some spacing to make things more consistent.
* o Redesign the layering mechanism and make the aliasing code part ofbrian1999-05-081-33/+37
| | | | | | | | | | | | | | | | | | | | | the layering. We now ``stack'' layers as soon as we open the device (when we figure out what we're dealing with). A static set of `dispatch' routines are also declared for dealing with incoming packets after they've been `pulled' up through the stacked layers. Physical devices are now assigned handlers based on the device type when they're opened. For the moment there are three device types; ttys, execs and tcps. o Increment version number to 2.2 o Make an entry in [uw]tmp for non-tty -direct invocations (after pap/chap authentication). o Make throughput counters quad_t's o Account for the absolute number of mbuf malloc()s and free()s in ``show mem''. o ``show modem'' becomes ``show physical''.
* Handle receiving more than one acceptable CCP REQbrian1999-05-021-3/+5
| | | | | during one negotiation session without REJecting everything from the second REQuest.
* Avoid a few warnings on the alphabrian1999-03-311-1/+2
|
* Tone down the log levels (Log{ERROR,WARN} -> LogCCP)brian1999-03-111-5/+5
| | | | | | | | | | | | when we've simply missed a packet. When our Predictor1 CRC is wrong (implying we've dropped a packet), don't send a ResetReq(). Instead, send another CCP ConfigReq(). *shrug* My tests show this as being far worse than the ResetReq as we may have further Nak/Rejs etc and we're basically resetting both our incoming and outgoing compression dictionaries, but rfc1978 says the ConfigReq is correct, so we'd better go along...
* Allow control over the number of ConfigREQ & TermREQ attemptsbrian1999-02-261-9/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that are made in each of the FSMs (LCP, CCP & IPCP) and the number of REQs/Challenges for PAP/CHAP by accepting more arguments in the ``set {c,ip,l}cpretry'' and ``set {ch,p}apretry'' commands. Change the non-convergence thresholds to 3 times the number of configured REQ tries (rather than the previous fixed ``10''). We now notice repeated NAKs and REJs rather than just REQs. Don't suggest that CHAP 0x05 isn't supported when it's not configured. Fix some bugs that expose themselves with smaller numbers of retries: o Handle instantaneous disconnects (set device /dev/null) correctly by stopping all fsm timers in fsm2initial. o Don't forget to uu_unlock() devices that are files but are not ttys (set device /dev/zero). Fix a *HORRENDOUS* bug in RFC1661 (already fixed for an Open event in state ``Closed''): According to the state transition table, a RCR+ or RCR- received in the ``Stopped'' state are supposed to InitRestartCounter, SendConfigReq and SendConfig{Ack,Nak}. However, in ``Stopped'', we haven't yet done a TLS (or the last thing we did is a TLF). We must therefore do the TLS at this point ! This was never noticed before because LCP and CCP used not use LayerStart() for anything interesting, and IPCP tends to go into Stopped then get a Down because of an LCP RTR rather than getting a RCR again.
* Decouple pap & chap output routines from the correspondingbrian1999-02-061-2/+1
| | | | | | | | | | | | | | | | | | | | | | | input routines and take advantage of the new init/continue interface in libradius. This allows a timely response on other links in an MP setup while RADIUS requests are in progress as well as the ability to handle other data from the peer in parallel. It should also make the future addition of PAM support trivial. While I'm in there, validate pap & chap header IDs if ``idcheck'' is enabled (the default) for other FSM packet types. NOTE: This involved integrating the generation of chap challenges and the validation of chap responses (and commenting what's going on in those routines). I currently have no way of testing ppps ability to respond to M$Chap CHALLENGEs correctly, so if someone could do the honours, it'd be much appreciated (it *looks* ok!). Sponsored by: Internet Business Solutions Ltd., Switzerland
* Initial RADIUS support (using libradius). See the man page forbrian1999-01-281-2/+5
| | | | | | | | | | | | | | | | | | | details. Compiling with -DNORADIUS (the default for `release') removes support. TODO: The functionality in libradius::rad_send_request() needs to be supplied as a set of routines so that ppp doesn't have to wait indefinitely for the radius server(s). Instead, we need to get a descriptor back, select() on the descriptor, and ask libradius to service it when necessary. For now, ppp blocks SIGALRM while in rad_send_request(), so it misses PAP/CHAP retries & timeouts if they occur. Only PAP is functional. When CHAP is attempted, libradius complains that no User-Password has been specified... rfc2138 says that it *mustn't* be used for CHAP :-( Sponsored by: Internet Business Solutions Ltd., Switzerland
* Fix some OpenBSD/alpha warningsbrian1998-08-261-1/+2
|
* Put the IP buffer queues into struct ipcp.brian1998-08-261-3/+3
| | | | Forgotten by: me
* o Support callback types NONE, E.164, AUTH and CBCP.brian1998-08-071-3/+2
| | | | | | | | | | | | | | (see the new ``set callback'' and ``set cbcp'' commands) o Add a ``cbcp'' log level and mbuf type. o Don't dump core when \T is given in ``set login'' or ``set hangup''. o Allow ``*'' and blanks as placeholders in ppp.secret and allow a fifth field for specifying auth/cbcp dialback parameters. o Remove a few extraneous #includes o Define the default number of REQs (restart counter) in defs.h rather than hardcoding ``5'' all over the place. o Fix a few man page inconsistencies.
* The CCP layer now behaves as follows:brian1998-06-301-4/+12
| | | | | | | | | | | | | o If we've denied and disabled all compression protocols, stay in ST_INITIAL and do an LCP protocol reject if we receive any CCP packets. o If we've disabled all compression protocols, go to ST_STOPPED and wait for the other side to ask for something. o If we've got anything enabled, start REQing as soon as the auth layer is up. o If we're in multilink mode, than the link level CCP goes straight to ST_STOPPED irrespective of what's configured so that we never try to compress compressed stuff by default.
* o Fix remaining sizeof problems for 64 bit machines.brian1998-06-271-7/+7
| | | | | | | | | | o Allow ``set ....'' when we have multiple links but aren't in multilink mode. o Do a TLS when we receive a ``Open'' event in ``Closed'' state, despite the rfc state transition table. This is clearly an error in the RFC as TLS cannot have yet been called (without TLF) in the ``Closed'' state. I've posted a message to comp.protocols.ppp for confirmation.
* Add ``ipcp'' as an optional argument to ``open'', and makebrian1998-06-251-7/+8
| | | | | | | | | open capable of re-negotiatiating the various layers. It is now possible to change various link options and then re-open the relevant layer, making the changes effective - for example, switching off VJ compression or starting ECHO LQRs on-the-fly.
* Fix a rather nasty use of `static'. This caused a SEGVbrian1998-06-151-2/+2
| | | | | when running ``link * load label'' as we ended up recursing back into command_Interpret after nuking our command arg list.
* o If all CCPs are disabled & denied, don't send a REQ - just enterbrian1998-05-231-1/+13
| | | | STOPPED state waiting for the peer to say something.
* MFMP: Make ppp multilink capable.brian1998-05-211-199/+357
| | | | See the file README.changes, and re-read the man page.
* Don't leak memory when the peer sends PROTO_COMPD packetsbrian1998-02-181-2/+2
| | | | without negotiating compression first.
* Remove unused #includes.brian1998-01-211-2/+1
| | | | | | Make various bits static. Remove unused variables. Submitted by: eivind
* Allow an optional delay when specifying "set openmode active".brian1998-01-201-5/+6
| | | | | | | | | | | | | | | | The delay defaults to 1 sec (as it always has) unless we've done a ~p in interactive mode or we've actually detected a HDLC frame. This is now cleanly implemented (via async timers) so that it is possible for LCP to come up despite the delay if an LCP REQ is received. This will hopefully solve situations with slow servers or slirp scenarios (where ECHO is left on the port for a second or so before the peer enters packet mode). Also, ~p in interactive mode no longer changes the value of the default openmode delay and -dedicated mode enters packet mode in the right state according to the value of openmode.
* Implement Reset{Req,Ack} properly, as per rfc 1962.brian1998-01-101-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (I completely mis-read the rfc last time 'round!) This means: o Better CCP/WARN Reset diagnostics. o After we've sent a REQ and before we've received an ACK, we drop incoming compressed data and send another REQ. o Before sending an ACK, re-sequence all pending PRI_NORMAL data in the modem queue so that pending packets won't get to the peer *after* the ResetAck. o Send ACKs with the `identifier' from the REQ frame. o After we've received a correct ACK, duplicate ACKs are ok (and will reset our history). o Incorrect ACKs (not matching the last REQ) are moaned about and dropped. Also, o Calculate the correct FCS after compressing a packet. DEFLATE *may* produce an mbuf with more than a single link in the chain, but HdlcOutput didn't know how to calculate the FCS :-( o Make `struct fsm'::reqid a u_char, not an int. This fix will prevent us from sending id `255' 2,000,000,000 times before wrapping to `0' for another 2,000,000,000 sends :-/ o Bump the version number a little. The end result: DEFLATE now works over an unreliable link layer. I can txfr a 1.5Mb kernel over a (rather bad) null-modem cable at an average of 21679 bytes per second using rcp. Repeat after me: Don't test compression using a loopback ppp/tcp setup as we never lose packets and therefore never have to reset!
* Initialize CcpInfo protocols to -1 (none, not OUI).brian1998-01-041-12/+14
| | | | Don't Call Term() for an algorithm that hasn't been Init()d.
OpenPOWER on IntegriCloud