Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
[linux-2.6] / drivers / net / wan / syncppp.c
1 /*
2  *      NET3:   A (fairly minimal) implementation of synchronous PPP for Linux
3  *              as well as a CISCO HDLC implementation. See the copyright 
4  *              message below for the original source.
5  *
6  *      This program is free software; you can redistribute it and/or
7  *      modify it under the terms of the GNU General Public License
8  *      as published by the Free Software Foundation; either version
9  *      2 of the license, or (at your option) any later version.
10  *
11  *      Note however. This code is also used in a different form by FreeBSD.
12  *      Therefore when making any non OS specific change please consider
13  *      contributing it back to the original author under the terms
14  *      below in addition.
15  *              -- Alan
16  *
17  *      Port for Linux-2.1 by Jan "Yenya" Kasprzak <kas@fi.muni.cz>
18  */
19
20 /*
21  * Synchronous PPP/Cisco link level subroutines.
22  * Keepalive protocol implemented in both Cisco and PPP modes.
23  *
24  * Copyright (C) 1994 Cronyx Ltd.
25  * Author: Serge Vakulenko, <vak@zebub.msk.su>
26  *
27  * This software is distributed with NO WARRANTIES, not even the implied
28  * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
29  *
30  * Authors grant any other persons or organisations permission to use
31  * or modify this software as long as this message is kept with the software,
32  * all derivative works or modified versions.
33  *
34  * Version 1.9, Wed Oct  4 18:58:15 MSK 1995
35  *
36  * $Id: syncppp.c,v 1.18 2000/04/11 05:25:31 asj Exp $
37  */
38 #undef DEBUG
39
40 #include <linux/module.h>
41 #include <linux/kernel.h>
42 #include <linux/errno.h>
43 #include <linux/init.h>
44 #include <linux/if_arp.h>
45 #include <linux/skbuff.h>
46 #include <linux/route.h>
47 #include <linux/netdevice.h>
48 #include <linux/inetdevice.h>
49 #include <linux/random.h>
50 #include <linux/pkt_sched.h>
51 #include <linux/spinlock.h>
52 #include <linux/rcupdate.h>
53
54 #include <net/net_namespace.h>
55 #include <net/syncppp.h>
56
57 #include <asm/byteorder.h>
58 #include <asm/uaccess.h>
59
60 #define MAXALIVECNT     6               /* max. alive packets */
61
62 #define PPP_ALLSTATIONS 0xff            /* All-Stations broadcast address */
63 #define PPP_UI          0x03            /* Unnumbered Information */
64 #define PPP_IP          0x0021          /* Internet Protocol */
65 #define PPP_ISO         0x0023          /* ISO OSI Protocol */
66 #define PPP_XNS         0x0025          /* Xerox NS Protocol */
67 #define PPP_IPX         0x002b          /* Novell IPX Protocol */
68 #define PPP_LCP         0xc021          /* Link Control Protocol */
69 #define PPP_IPCP        0x8021          /* Internet Protocol Control Protocol */
70
71 #define LCP_CONF_REQ    1               /* PPP LCP configure request */
72 #define LCP_CONF_ACK    2               /* PPP LCP configure acknowledge */
73 #define LCP_CONF_NAK    3               /* PPP LCP configure negative ack */
74 #define LCP_CONF_REJ    4               /* PPP LCP configure reject */
75 #define LCP_TERM_REQ    5               /* PPP LCP terminate request */
76 #define LCP_TERM_ACK    6               /* PPP LCP terminate acknowledge */
77 #define LCP_CODE_REJ    7               /* PPP LCP code reject */
78 #define LCP_PROTO_REJ   8               /* PPP LCP protocol reject */
79 #define LCP_ECHO_REQ    9               /* PPP LCP echo request */
80 #define LCP_ECHO_REPLY  10              /* PPP LCP echo reply */
81 #define LCP_DISC_REQ    11              /* PPP LCP discard request */
82
83 #define LCP_OPT_MRU             1       /* maximum receive unit */
84 #define LCP_OPT_ASYNC_MAP       2       /* async control character map */
85 #define LCP_OPT_AUTH_PROTO      3       /* authentication protocol */
86 #define LCP_OPT_QUAL_PROTO      4       /* quality protocol */
87 #define LCP_OPT_MAGIC           5       /* magic number */
88 #define LCP_OPT_RESERVED        6       /* reserved */
89 #define LCP_OPT_PROTO_COMP      7       /* protocol field compression */
90 #define LCP_OPT_ADDR_COMP       8       /* address/control field compression */
91
92 #define IPCP_CONF_REQ   LCP_CONF_REQ    /* PPP IPCP configure request */
93 #define IPCP_CONF_ACK   LCP_CONF_ACK    /* PPP IPCP configure acknowledge */
94 #define IPCP_CONF_NAK   LCP_CONF_NAK    /* PPP IPCP configure negative ack */
95 #define IPCP_CONF_REJ   LCP_CONF_REJ    /* PPP IPCP configure reject */
96 #define IPCP_TERM_REQ   LCP_TERM_REQ    /* PPP IPCP terminate request */
97 #define IPCP_TERM_ACK   LCP_TERM_ACK    /* PPP IPCP terminate acknowledge */
98 #define IPCP_CODE_REJ   LCP_CODE_REJ    /* PPP IPCP code reject */
99
100 #define CISCO_MULTICAST         0x8f    /* Cisco multicast address */
101 #define CISCO_UNICAST           0x0f    /* Cisco unicast address */
102 #define CISCO_KEEPALIVE         0x8035  /* Cisco keepalive protocol */
103 #define CISCO_ADDR_REQ          0       /* Cisco address request */
104 #define CISCO_ADDR_REPLY        1       /* Cisco address reply */
105 #define CISCO_KEEPALIVE_REQ     2       /* Cisco keepalive request */
106
107 struct ppp_header {
108         u8 address;
109         u8 control;
110         __be16 protocol;
111 };
112 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
113
114 struct lcp_header {
115         u8 type;
116         u8 ident;
117         __be16 len;
118 };
119 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
120
121 struct cisco_packet {
122         __be32 type;
123         __be32 par1;
124         __be32 par2;
125         __be16 rel;
126         __be16 time0;
127         __be16 time1;
128 };
129 #define CISCO_PACKET_LEN 18
130 #define CISCO_BIG_PACKET_LEN 20
131
132 static struct sppp *spppq;
133 static struct timer_list sppp_keepalive_timer;
134 static DEFINE_SPINLOCK(spppq_lock);
135
136 /* global xmit queue for sending packets while spinlock is held */
137 static struct sk_buff_head tx_queue;
138
139 static void sppp_keepalive (unsigned long dummy);
140 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
141         u8 ident, u16 len, void *data);
142 static void sppp_cisco_send (struct sppp *sp, int type, u32 par1, u32 par2);
143 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *m);
144 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *m);
145 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *m);
146 static void sppp_lcp_open (struct sppp *sp);
147 static void sppp_ipcp_open (struct sppp *sp);
148 static int sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
149         int len, u32 *magic);
150 static void sppp_cp_timeout (unsigned long arg);
151 static char *sppp_lcp_type_name (u8 type);
152 static char *sppp_ipcp_type_name (u8 type);
153 static void sppp_print_bytes (u8 *p, u16 len);
154
155 static int debug;
156
157 /* Flush global outgoing packet queue to dev_queue_xmit().
158  *
159  * dev_queue_xmit() must be called with interrupts enabled
160  * which means it can't be called with spinlocks held.
161  * If a packet needs to be sent while a spinlock is held,
162  * then put the packet into tx_queue, and call sppp_flush_xmit()
163  * after spinlock is released.
164  */
165 static void sppp_flush_xmit(void)
166 {
167         struct sk_buff *skb;
168         while ((skb = skb_dequeue(&tx_queue)) != NULL)
169                 dev_queue_xmit(skb);
170 }
171
172 /*
173  *      Interface down stub
174  */     
175
176 static void if_down(struct net_device *dev)
177 {
178         struct sppp *sp = (struct sppp *)sppp_of(dev);
179
180         sp->pp_link_state=SPPP_LINK_DOWN;
181 }
182
183 /*
184  * Timeout routine activations.
185  */
186
187 static void sppp_set_timeout(struct sppp *p,int s) 
188 {
189         if (! (p->pp_flags & PP_TIMO)) 
190         {
191                 init_timer(&p->pp_timer);
192                 p->pp_timer.function=sppp_cp_timeout;
193                 p->pp_timer.expires=jiffies+s*HZ;
194                 p->pp_timer.data=(unsigned long)p;
195                 p->pp_flags |= PP_TIMO;
196                 add_timer(&p->pp_timer);
197         }
198 }
199
200 static void sppp_clear_timeout(struct sppp *p)
201 {
202         if (p->pp_flags & PP_TIMO) 
203         {
204                 del_timer(&p->pp_timer);
205                 p->pp_flags &= ~PP_TIMO; 
206         }
207 }
208
209 /**
210  *      sppp_input -    receive and process a WAN PPP frame
211  *      @skb:   The buffer to process
212  *      @dev:   The device it arrived on
213  *
214  *      This can be called directly by cards that do not have
215  *      timing constraints but is normally called from the network layer
216  *      after interrupt servicing to process frames queued via netif_rx().
217  *
218  *      We process the options in the card. If the frame is destined for
219  *      the protocol stacks then it requeues the frame for the upper level
220  *      protocol. If it is a control from it is processed and discarded
221  *      here.
222  */
223  
224 static void sppp_input (struct net_device *dev, struct sk_buff *skb)
225 {
226         struct ppp_header *h;
227         struct sppp *sp = (struct sppp *)sppp_of(dev);
228         unsigned long flags;
229
230         skb->dev=dev;
231         skb_reset_mac_header(skb);
232
233         if (!pskb_may_pull(skb, PPP_HEADER_LEN)) {
234                 /* Too small packet, drop it. */
235                 if (sp->pp_flags & PP_DEBUG)
236                         printk (KERN_DEBUG "%s: input packet is too small, %d bytes\n",
237                                 dev->name, skb->len);
238                 kfree_skb(skb);
239                 return;
240         }
241
242         /* Get PPP header. */
243         h = (struct ppp_header *)skb->data;
244         skb_pull(skb,sizeof(struct ppp_header));
245
246         spin_lock_irqsave(&sp->lock, flags);
247         
248         switch (h->address) {
249         default:        /* Invalid PPP packet. */
250                 goto invalid;
251         case PPP_ALLSTATIONS:
252                 if (h->control != PPP_UI)
253                         goto invalid;
254                 if (sp->pp_flags & PP_CISCO) {
255                         if (sp->pp_flags & PP_DEBUG)
256                                 printk (KERN_WARNING "%s: PPP packet in Cisco mode <0x%x 0x%x 0x%x>\n",
257                                         dev->name,
258                                         h->address, h->control, ntohs (h->protocol));
259                         goto drop;
260                 }
261                 switch (ntohs (h->protocol)) {
262                 default:
263                         if (sp->lcp.state == LCP_STATE_OPENED)
264                                 sppp_cp_send (sp, PPP_LCP, LCP_PROTO_REJ,
265                                         ++sp->pp_seq, skb->len + 2,
266                                         &h->protocol);
267                         if (sp->pp_flags & PP_DEBUG)
268                                 printk (KERN_WARNING "%s: invalid input protocol <0x%x 0x%x 0x%x>\n",
269                                         dev->name,
270                                         h->address, h->control, ntohs (h->protocol));
271                         goto drop;
272                 case PPP_LCP:
273                         sppp_lcp_input (sp, skb);
274                         goto drop;
275                 case PPP_IPCP:
276                         if (sp->lcp.state == LCP_STATE_OPENED)
277                                 sppp_ipcp_input (sp, skb);
278                         else
279                                 printk(KERN_DEBUG "IPCP when still waiting LCP finish.\n");
280                         goto drop;
281                 case PPP_IP:
282                         if (sp->ipcp.state == IPCP_STATE_OPENED) {
283                                 if(sp->pp_flags&PP_DEBUG)
284                                         printk(KERN_DEBUG "Yow an IP frame.\n");
285                                 skb->protocol=htons(ETH_P_IP);
286                                 netif_rx(skb);
287                                 dev->last_rx = jiffies;
288                                 goto done;
289                         }
290                         break;
291 #ifdef IPX
292                 case PPP_IPX:
293                         /* IPX IPXCP not implemented yet */
294                         if (sp->lcp.state == LCP_STATE_OPENED) {
295                                 skb->protocol=htons(ETH_P_IPX);
296                                 netif_rx(skb);
297                                 dev->last_rx = jiffies;
298                                 goto done;
299                         }
300                         break;
301 #endif
302                 }
303                 break;
304         case CISCO_MULTICAST:
305         case CISCO_UNICAST:
306                 /* Don't check the control field here (RFC 1547). */
307                 if (! (sp->pp_flags & PP_CISCO)) {
308                         if (sp->pp_flags & PP_DEBUG)
309                                 printk (KERN_WARNING "%s: Cisco packet in PPP mode <0x%x 0x%x 0x%x>\n",
310                                         dev->name,
311                                         h->address, h->control, ntohs (h->protocol));
312                         goto drop;
313                 }
314                 switch (ntohs (h->protocol)) {
315                 default:
316                         goto invalid;
317                 case CISCO_KEEPALIVE:
318                         sppp_cisco_input (sp, skb);
319                         goto drop;
320 #ifdef CONFIG_INET
321                 case ETH_P_IP:
322                         skb->protocol=htons(ETH_P_IP);
323                         netif_rx(skb);
324                         dev->last_rx = jiffies;
325                         goto done;
326 #endif
327 #ifdef CONFIG_IPX
328                 case ETH_P_IPX:
329                         skb->protocol=htons(ETH_P_IPX);
330                         netif_rx(skb);
331                         dev->last_rx = jiffies;
332                         goto done;
333 #endif
334                 }
335                 break;
336         }
337         goto drop;
338
339 invalid:
340         if (sp->pp_flags & PP_DEBUG)
341                 printk (KERN_WARNING "%s: invalid input packet <0x%x 0x%x 0x%x>\n",
342                         dev->name, h->address, h->control, ntohs (h->protocol));
343 drop:
344         kfree_skb(skb);
345 done:
346         spin_unlock_irqrestore(&sp->lock, flags);
347         sppp_flush_xmit();
348         return;
349 }
350
351 /*
352  *      Handle transmit packets.
353  */
354  
355 static int sppp_hard_header(struct sk_buff *skb,
356                             struct net_device *dev, __u16 type,
357                             const void *daddr, const void *saddr,
358                             unsigned int len)
359 {
360         struct sppp *sp = (struct sppp *)sppp_of(dev);
361         struct ppp_header *h;
362         skb_push(skb,sizeof(struct ppp_header));
363         h=(struct ppp_header *)skb->data;
364         if(sp->pp_flags&PP_CISCO)
365         {
366                 h->address = CISCO_UNICAST;
367                 h->control = 0;
368         }
369         else
370         {
371                 h->address = PPP_ALLSTATIONS;
372                 h->control = PPP_UI;
373         }
374         if(sp->pp_flags & PP_CISCO)
375         {
376                 h->protocol = htons(type);
377         }
378         else switch(type)
379         {
380                 case ETH_P_IP:
381                         h->protocol = htons(PPP_IP);
382                         break;
383                 case ETH_P_IPX:
384                         h->protocol = htons(PPP_IPX);
385                         break;
386         }
387         return sizeof(struct ppp_header);
388 }
389
390 static const struct header_ops sppp_header_ops = {
391         .create = sppp_hard_header,
392 };
393
394 /*
395  * Send keepalive packets, every 10 seconds.
396  */
397
398 static void sppp_keepalive (unsigned long dummy)
399 {
400         struct sppp *sp;
401         unsigned long flags;
402
403         spin_lock_irqsave(&spppq_lock, flags);
404
405         for (sp=spppq; sp; sp=sp->pp_next) 
406         {
407                 struct net_device *dev = sp->pp_if;
408
409                 /* Keepalive mode disabled or channel down? */
410                 if (! (sp->pp_flags & PP_KEEPALIVE) ||
411                     ! (dev->flags & IFF_UP))
412                         continue;
413
414                 spin_lock(&sp->lock);
415
416                 /* No keepalive in PPP mode if LCP not opened yet. */
417                 if (! (sp->pp_flags & PP_CISCO) &&
418                     sp->lcp.state != LCP_STATE_OPENED) {
419                         spin_unlock(&sp->lock);
420                         continue;
421                 }
422
423                 if (sp->pp_alivecnt == MAXALIVECNT) {
424                         /* No keepalive packets got.  Stop the interface. */
425                         printk (KERN_WARNING "%s: protocol down\n", dev->name);
426                         if_down (dev);
427                         if (! (sp->pp_flags & PP_CISCO)) {
428                                 /* Shut down the PPP link. */
429                                 sp->lcp.magic = jiffies;
430                                 sp->lcp.state = LCP_STATE_CLOSED;
431                                 sp->ipcp.state = IPCP_STATE_CLOSED;
432                                 sppp_clear_timeout (sp);
433                                 /* Initiate negotiation. */
434                                 sppp_lcp_open (sp);
435                         }
436                 }
437                 if (sp->pp_alivecnt <= MAXALIVECNT)
438                         ++sp->pp_alivecnt;
439                 if (sp->pp_flags & PP_CISCO)
440                         sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
441                                 sp->pp_rseq);
442                 else if (sp->lcp.state == LCP_STATE_OPENED) {
443                         __be32 nmagic = htonl (sp->lcp.magic);
444                         sp->lcp.echoid = ++sp->pp_seq;
445                         sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REQ,
446                                 sp->lcp.echoid, 4, &nmagic);
447                 }
448
449                 spin_unlock(&sp->lock);
450         }
451         spin_unlock_irqrestore(&spppq_lock, flags);
452         sppp_flush_xmit();
453         sppp_keepalive_timer.expires=jiffies+10*HZ;
454         add_timer(&sppp_keepalive_timer);
455 }
456
457 /*
458  * Handle incoming PPP Link Control Protocol packets.
459  */
460  
461 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *skb)
462 {
463         struct lcp_header *h;
464         struct net_device *dev = sp->pp_if;
465         int len = skb->len;
466         u8 *p, opt[6];
467         u32 rmagic = 0;
468
469         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
470                 if (sp->pp_flags & PP_DEBUG)
471                         printk (KERN_WARNING "%s: invalid lcp packet length: %d bytes\n",
472                                 dev->name, len);
473                 return;
474         }
475         h = (struct lcp_header *)skb->data;
476         skb_pull(skb,sizeof(struct lcp_header *));
477         
478         if (sp->pp_flags & PP_DEBUG) 
479         {
480                 char state = '?';
481                 switch (sp->lcp.state) {
482                 case LCP_STATE_CLOSED:   state = 'C'; break;
483                 case LCP_STATE_ACK_RCVD: state = 'R'; break;
484                 case LCP_STATE_ACK_SENT: state = 'S'; break;
485                 case LCP_STATE_OPENED:   state = 'O'; break;
486                 }
487                 printk (KERN_WARNING "%s: lcp input(%c): %d bytes <%s id=%xh len=%xh",
488                         dev->name, state, len,
489                         sppp_lcp_type_name (h->type), h->ident, ntohs (h->len));
490                 if (len > 4)
491                         sppp_print_bytes ((u8*) (h+1), len-4);
492                 printk (">\n");
493         }
494         if (len > ntohs (h->len))
495                 len = ntohs (h->len);
496         switch (h->type) {
497         default:
498                 /* Unknown packet type -- send Code-Reject packet. */
499                 sppp_cp_send (sp, PPP_LCP, LCP_CODE_REJ, ++sp->pp_seq,
500                         skb->len, h);
501                 break;
502         case LCP_CONF_REQ:
503                 if (len < 4) {
504                         if (sp->pp_flags & PP_DEBUG)
505                                 printk (KERN_DEBUG"%s: invalid lcp configure request packet length: %d bytes\n",
506                                         dev->name, len);
507                         break;
508                 }
509                 if (len>4 && !sppp_lcp_conf_parse_options (sp, h, len, &rmagic))
510                         goto badreq;
511                 if (rmagic == sp->lcp.magic) {
512                         /* Local and remote magics equal -- loopback? */
513                         if (sp->pp_loopcnt >= MAXALIVECNT*5) {
514                                 printk (KERN_WARNING "%s: loopback\n",
515                                         dev->name);
516                                 sp->pp_loopcnt = 0;
517                                 if (dev->flags & IFF_UP) {
518                                         if_down (dev);
519                                 }
520                         } else if (sp->pp_flags & PP_DEBUG)
521                                 printk (KERN_DEBUG "%s: conf req: magic glitch\n",
522                                         dev->name);
523                         ++sp->pp_loopcnt;
524
525                         /* MUST send Conf-Nack packet. */
526                         rmagic = ~sp->lcp.magic;
527                         opt[0] = LCP_OPT_MAGIC;
528                         opt[1] = sizeof (opt);
529                         opt[2] = rmagic >> 24;
530                         opt[3] = rmagic >> 16;
531                         opt[4] = rmagic >> 8;
532                         opt[5] = rmagic;
533                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_NAK,
534                                 h->ident, sizeof (opt), &opt);
535 badreq:
536                         switch (sp->lcp.state) {
537                         case LCP_STATE_OPENED:
538                                 /* Initiate renegotiation. */
539                                 sppp_lcp_open (sp);
540                                 /* fall through... */
541                         case LCP_STATE_ACK_SENT:
542                                 /* Go to closed state. */
543                                 sp->lcp.state = LCP_STATE_CLOSED;
544                                 sp->ipcp.state = IPCP_STATE_CLOSED;
545                         }
546                         break;
547                 }
548                 /* Send Configure-Ack packet. */
549                 sp->pp_loopcnt = 0;
550                 if (sp->lcp.state != LCP_STATE_OPENED) {
551                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
552                                         h->ident, len-4, h+1);
553                 }
554                 /* Change the state. */
555                 switch (sp->lcp.state) {
556                 case LCP_STATE_CLOSED:
557                         sp->lcp.state = LCP_STATE_ACK_SENT;
558                         break;
559                 case LCP_STATE_ACK_RCVD:
560                         sp->lcp.state = LCP_STATE_OPENED;
561                         sppp_ipcp_open (sp);
562                         break;
563                 case LCP_STATE_OPENED:
564                         /* Remote magic changed -- close session. */
565                         sp->lcp.state = LCP_STATE_CLOSED;
566                         sp->ipcp.state = IPCP_STATE_CLOSED;
567                         /* Initiate renegotiation. */
568                         sppp_lcp_open (sp);
569                         /* Send ACK after our REQ in attempt to break loop */
570                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
571                                         h->ident, len-4, h+1);
572                         sp->lcp.state = LCP_STATE_ACK_SENT;
573                         break;
574                 }
575                 break;
576         case LCP_CONF_ACK:
577                 if (h->ident != sp->lcp.confid)
578                         break;
579                 sppp_clear_timeout (sp);
580                 if ((sp->pp_link_state != SPPP_LINK_UP) &&
581                     (dev->flags & IFF_UP)) {
582                         /* Coming out of loopback mode. */
583                         sp->pp_link_state=SPPP_LINK_UP;
584                         printk (KERN_INFO "%s: protocol up\n", dev->name);
585                 }
586                 switch (sp->lcp.state) {
587                 case LCP_STATE_CLOSED:
588                         sp->lcp.state = LCP_STATE_ACK_RCVD;
589                         sppp_set_timeout (sp, 5);
590                         break;
591                 case LCP_STATE_ACK_SENT:
592                         sp->lcp.state = LCP_STATE_OPENED;
593                         sppp_ipcp_open (sp);
594                         break;
595                 }
596                 break;
597         case LCP_CONF_NAK:
598                 if (h->ident != sp->lcp.confid)
599                         break;
600                 p = (u8*) (h+1);
601                 if (len>=10 && p[0] == LCP_OPT_MAGIC && p[1] >= 4) {
602                         rmagic = (u32)p[2] << 24 |
603                                 (u32)p[3] << 16 | p[4] << 8 | p[5];
604                         if (rmagic == ~sp->lcp.magic) {
605                                 int newmagic;
606                                 if (sp->pp_flags & PP_DEBUG)
607                                         printk (KERN_DEBUG "%s: conf nak: magic glitch\n",
608                                                 dev->name);
609                                 get_random_bytes(&newmagic, sizeof(newmagic));
610                                 sp->lcp.magic += newmagic;
611                         } else
612                                 sp->lcp.magic = rmagic;
613                         }
614                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
615                         /* Go to closed state. */
616                         sp->lcp.state = LCP_STATE_CLOSED;
617                         sp->ipcp.state = IPCP_STATE_CLOSED;
618                 }
619                 /* The link will be renegotiated after timeout,
620                  * to avoid endless req-nack loop. */
621                 sppp_clear_timeout (sp);
622                 sppp_set_timeout (sp, 2);
623                 break;
624         case LCP_CONF_REJ:
625                 if (h->ident != sp->lcp.confid)
626                         break;
627                 sppp_clear_timeout (sp);
628                 /* Initiate renegotiation. */
629                 sppp_lcp_open (sp);
630                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
631                         /* Go to closed state. */
632                         sp->lcp.state = LCP_STATE_CLOSED;
633                         sp->ipcp.state = IPCP_STATE_CLOSED;
634                 }
635                 break;
636         case LCP_TERM_REQ:
637                 sppp_clear_timeout (sp);
638                 /* Send Terminate-Ack packet. */
639                 sppp_cp_send (sp, PPP_LCP, LCP_TERM_ACK, h->ident, 0, NULL);
640                 /* Go to closed state. */
641                 sp->lcp.state = LCP_STATE_CLOSED;
642                 sp->ipcp.state = IPCP_STATE_CLOSED;
643                 /* Initiate renegotiation. */
644                 sppp_lcp_open (sp);
645                 break;
646         case LCP_TERM_ACK:
647         case LCP_CODE_REJ:
648         case LCP_PROTO_REJ:
649                 /* Ignore for now. */
650                 break;
651         case LCP_DISC_REQ:
652                 /* Discard the packet. */
653                 break;
654         case LCP_ECHO_REQ:
655                 if (sp->lcp.state != LCP_STATE_OPENED)
656                         break;
657                 if (len < 8) {
658                         if (sp->pp_flags & PP_DEBUG)
659                                 printk (KERN_WARNING "%s: invalid lcp echo request packet length: %d bytes\n",
660                                         dev->name, len);
661                         break;
662                 }
663                 if (ntohl (*(__be32*)(h+1)) == sp->lcp.magic) {
664                         /* Line loopback mode detected. */
665                         printk (KERN_WARNING "%s: loopback\n", dev->name);
666                         if_down (dev);
667
668                         /* Shut down the PPP link. */
669                         sp->lcp.state = LCP_STATE_CLOSED;
670                         sp->ipcp.state = IPCP_STATE_CLOSED;
671                         sppp_clear_timeout (sp);
672                         /* Initiate negotiation. */
673                         sppp_lcp_open (sp);
674                         break;
675                 }
676                 *(__be32 *)(h+1) = htonl (sp->lcp.magic);
677                 sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REPLY, h->ident, len-4, h+1);
678                 break;
679         case LCP_ECHO_REPLY:
680                 if (h->ident != sp->lcp.echoid)
681                         break;
682                 if (len < 8) {
683                         if (sp->pp_flags & PP_DEBUG)
684                                 printk (KERN_WARNING "%s: invalid lcp echo reply packet length: %d bytes\n",
685                                         dev->name, len);
686                         break;
687                 }
688                 if (ntohl(*(__be32 *)(h+1)) != sp->lcp.magic)
689                 sp->pp_alivecnt = 0;
690                 break;
691         }
692 }
693
694 /*
695  * Handle incoming Cisco keepalive protocol packets.
696  */
697
698 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
699 {
700         struct cisco_packet *h;
701         struct net_device *dev = sp->pp_if;
702
703         if (!pskb_may_pull(skb, sizeof(struct cisco_packet))
704             || (skb->len != CISCO_PACKET_LEN
705                 && skb->len != CISCO_BIG_PACKET_LEN)) {
706                 if (sp->pp_flags & PP_DEBUG)
707                         printk (KERN_WARNING "%s: invalid cisco packet length: %d bytes\n",
708                                 dev->name,  skb->len);
709                 return;
710         }
711         h = (struct cisco_packet *)skb->data;
712         skb_pull(skb, sizeof(struct cisco_packet*));
713         if (sp->pp_flags & PP_DEBUG)
714                 printk (KERN_WARNING "%s: cisco input: %d bytes <%xh %xh %xh %xh %xh-%xh>\n",
715                         dev->name,  skb->len,
716                         ntohl (h->type), h->par1, h->par2, h->rel,
717                         h->time0, h->time1);
718         switch (ntohl (h->type)) {
719         default:
720                 if (sp->pp_flags & PP_DEBUG)
721                         printk (KERN_WARNING "%s: unknown cisco packet type: 0x%x\n",
722                                 dev->name,  ntohl (h->type));
723                 break;
724         case CISCO_ADDR_REPLY:
725                 /* Reply on address request, ignore */
726                 break;
727         case CISCO_KEEPALIVE_REQ:
728                 sp->pp_alivecnt = 0;
729                 sp->pp_rseq = ntohl (h->par1);
730                 if (sp->pp_seq == sp->pp_rseq) {
731                         /* Local and remote sequence numbers are equal.
732                          * Probably, the line is in loopback mode. */
733                         int newseq;
734                         if (sp->pp_loopcnt >= MAXALIVECNT) {
735                                 printk (KERN_WARNING "%s: loopback\n",
736                                         dev->name);
737                                 sp->pp_loopcnt = 0;
738                                 if (dev->flags & IFF_UP) {
739                                         if_down (dev);
740                                 }
741                         }
742                         ++sp->pp_loopcnt;
743
744                         /* Generate new local sequence number */
745                         get_random_bytes(&newseq, sizeof(newseq));
746                         sp->pp_seq ^= newseq;
747                         break;
748                 }
749                 sp->pp_loopcnt = 0;
750                 if (sp->pp_link_state==SPPP_LINK_DOWN &&
751                     (dev->flags & IFF_UP)) {
752                         sp->pp_link_state=SPPP_LINK_UP;
753                         printk (KERN_INFO "%s: protocol up\n", dev->name);
754                 }
755                 break;
756         case CISCO_ADDR_REQ:
757                 /* Stolen from net/ipv4/devinet.c -- SIOCGIFADDR ioctl */
758                 {
759                 struct in_device *in_dev;
760                 struct in_ifaddr *ifa;
761                 __be32 addr = 0, mask = htonl(~0U); /* FIXME: is the mask correct? */
762 #ifdef CONFIG_INET
763                 rcu_read_lock();
764                 if ((in_dev = __in_dev_get_rcu(dev)) != NULL)
765                 {
766                         for (ifa=in_dev->ifa_list; ifa != NULL;
767                                 ifa=ifa->ifa_next) {
768                                 if (strcmp(dev->name, ifa->ifa_label) == 0) 
769                                 {
770                                         addr = ifa->ifa_local;
771                                         mask = ifa->ifa_mask;
772                                         break;
773                                 }
774                         }
775                 }
776                 rcu_read_unlock();
777 #endif          
778                 sppp_cisco_send (sp, CISCO_ADDR_REPLY, ntohl(addr), ntohl(mask));
779                 break;
780                 }
781         }
782 }
783
784
785 /*
786  * Send PPP LCP packet.
787  */
788
789 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
790         u8 ident, u16 len, void *data)
791 {
792         struct ppp_header *h;
793         struct lcp_header *lh;
794         struct sk_buff *skb;
795         struct net_device *dev = sp->pp_if;
796
797         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+LCP_HEADER_LEN+len,
798                 GFP_ATOMIC);
799         if (skb==NULL)
800                 return;
801
802         skb_reserve(skb,dev->hard_header_len);
803         
804         h = (struct ppp_header *)skb_put(skb, sizeof(struct ppp_header));
805         h->address = PPP_ALLSTATIONS;        /* broadcast address */
806         h->control = PPP_UI;                 /* Unnumbered Info */
807         h->protocol = htons (proto);         /* Link Control Protocol */
808
809         lh = (struct lcp_header *)skb_put(skb, sizeof(struct lcp_header));
810         lh->type = type;
811         lh->ident = ident;
812         lh->len = htons (LCP_HEADER_LEN + len);
813
814         if (len)
815                 memcpy(skb_put(skb,len),data, len);
816
817         if (sp->pp_flags & PP_DEBUG) {
818                 printk (KERN_WARNING "%s: %s output <%s id=%xh len=%xh",
819                         dev->name, 
820                         proto==PPP_LCP ? "lcp" : "ipcp",
821                         proto==PPP_LCP ? sppp_lcp_type_name (lh->type) :
822                         sppp_ipcp_type_name (lh->type), lh->ident,
823                         ntohs (lh->len));
824                 if (len)
825                         sppp_print_bytes ((u8*) (lh+1), len);
826                 printk (">\n");
827         }
828         /* Control is high priority so it doesn't get queued behind data */
829         skb->priority=TC_PRIO_CONTROL;
830         skb->dev = dev;
831         skb_queue_tail(&tx_queue, skb);
832 }
833
834 /*
835  * Send Cisco keepalive packet.
836  */
837
838 static void sppp_cisco_send (struct sppp *sp, int type, u32 par1, u32 par2)
839 {
840         struct ppp_header *h;
841         struct cisco_packet *ch;
842         struct sk_buff *skb;
843         struct net_device *dev = sp->pp_if;
844         u32 t = jiffies * 1000/HZ;
845
846         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+CISCO_PACKET_LEN,
847                 GFP_ATOMIC);
848
849         if(skb==NULL)
850                 return;
851                 
852         skb_reserve(skb, dev->hard_header_len);
853         h = (struct ppp_header *)skb_put (skb, sizeof(struct ppp_header));
854         h->address = CISCO_MULTICAST;
855         h->control = 0;
856         h->protocol = htons (CISCO_KEEPALIVE);
857
858         ch = (struct cisco_packet*)skb_put(skb, CISCO_PACKET_LEN);
859         ch->type = htonl (type);
860         ch->par1 = htonl (par1);
861         ch->par2 = htonl (par2);
862         ch->rel = htons(0xffff);
863         ch->time0 = htons ((u16) (t >> 16));
864         ch->time1 = htons ((u16) t);
865
866         if (sp->pp_flags & PP_DEBUG)
867                 printk (KERN_WARNING "%s: cisco output: <%xh %xh %xh %xh %xh-%xh>\n",
868                         dev->name,  ntohl (ch->type), ch->par1,
869                         ch->par2, ch->rel, ch->time0, ch->time1);
870         skb->priority=TC_PRIO_CONTROL;
871         skb->dev = dev;
872         skb_queue_tail(&tx_queue, skb);
873 }
874
875 /**
876  *      sppp_close - close down a synchronous PPP or Cisco HDLC link
877  *      @dev: The network device to drop the link of
878  *
879  *      This drops the logical interface to the channel. It is not
880  *      done politely as we assume we will also be dropping DTR. Any
881  *      timeouts are killed.
882  */
883
884 int sppp_close (struct net_device *dev)
885 {
886         struct sppp *sp = (struct sppp *)sppp_of(dev);
887         unsigned long flags;
888
889         spin_lock_irqsave(&sp->lock, flags);
890         sp->pp_link_state = SPPP_LINK_DOWN;
891         sp->lcp.state = LCP_STATE_CLOSED;
892         sp->ipcp.state = IPCP_STATE_CLOSED;
893         sppp_clear_timeout (sp);
894         spin_unlock_irqrestore(&sp->lock, flags);
895
896         return 0;
897 }
898
899 EXPORT_SYMBOL(sppp_close);
900
901 /**
902  *      sppp_open - open a synchronous PPP or Cisco HDLC link
903  *      @dev:   Network device to activate
904  *      
905  *      Close down any existing synchronous session and commence
906  *      from scratch. In the PPP case this means negotiating LCP/IPCP
907  *      and friends, while for Cisco HDLC we simply need to start sending
908  *      keepalives
909  */
910
911 int sppp_open (struct net_device *dev)
912 {
913         struct sppp *sp = (struct sppp *)sppp_of(dev);
914         unsigned long flags;
915
916         sppp_close(dev);
917
918         spin_lock_irqsave(&sp->lock, flags);
919         if (!(sp->pp_flags & PP_CISCO)) {
920                 sppp_lcp_open (sp);
921         }
922         sp->pp_link_state = SPPP_LINK_DOWN;
923         spin_unlock_irqrestore(&sp->lock, flags);
924         sppp_flush_xmit();
925
926         return 0;
927 }
928
929 EXPORT_SYMBOL(sppp_open);
930
931 /**
932  *      sppp_reopen - notify of physical link loss
933  *      @dev: Device that lost the link
934  *
935  *      This function informs the synchronous protocol code that
936  *      the underlying link died (for example a carrier drop on X.21)
937  *
938  *      We increment the magic numbers to ensure that if the other end
939  *      failed to notice we will correctly start a new session. It happens
940  *      do to the nature of telco circuits is that you can lose carrier on
941  *      one endonly.
942  *
943  *      Having done this we go back to negotiating. This function may
944  *      be called from an interrupt context.
945  */
946  
947 int sppp_reopen (struct net_device *dev)
948 {
949         struct sppp *sp = (struct sppp *)sppp_of(dev);
950         unsigned long flags;
951
952         sppp_close(dev);
953
954         spin_lock_irqsave(&sp->lock, flags);
955         if (!(sp->pp_flags & PP_CISCO))
956         {
957                 sp->lcp.magic = jiffies;
958                 ++sp->pp_seq;
959                 sp->lcp.state = LCP_STATE_CLOSED;
960                 sp->ipcp.state = IPCP_STATE_CLOSED;
961                 /* Give it a moment for the line to settle then go */
962                 sppp_set_timeout (sp, 1);
963         } 
964         sp->pp_link_state=SPPP_LINK_DOWN;
965         spin_unlock_irqrestore(&sp->lock, flags);
966
967         return 0;
968 }
969
970 EXPORT_SYMBOL(sppp_reopen);
971
972 /**
973  *      sppp_change_mtu - Change the link MTU
974  *      @dev:   Device to change MTU on
975  *      @new_mtu: New MTU
976  *
977  *      Change the MTU on the link. This can only be called with
978  *      the link down. It returns an error if the link is up or
979  *      the mtu is out of range.
980  */
981  
982 static int sppp_change_mtu(struct net_device *dev, int new_mtu)
983 {
984         if(new_mtu<128||new_mtu>PPP_MTU||(dev->flags&IFF_UP))
985                 return -EINVAL;
986         dev->mtu=new_mtu;
987         return 0;
988 }
989
990 /**
991  *      sppp_do_ioctl - Ioctl handler for ppp/hdlc
992  *      @dev: Device subject to ioctl
993  *      @ifr: Interface request block from the user
994  *      @cmd: Command that is being issued
995  *      
996  *      This function handles the ioctls that may be issued by the user
997  *      to control the settings of a PPP/HDLC link. It does both busy
998  *      and security checks. This function is intended to be wrapped by
999  *      callers who wish to add additional ioctl calls of their own.
1000  */
1001  
1002 int sppp_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1003 {
1004         struct sppp *sp = (struct sppp *)sppp_of(dev);
1005
1006         if(dev->flags&IFF_UP)
1007                 return -EBUSY;
1008                 
1009         if(!capable(CAP_NET_ADMIN))
1010                 return -EPERM;
1011         
1012         switch(cmd)
1013         {
1014                 case SPPPIOCCISCO:
1015                         sp->pp_flags|=PP_CISCO;
1016                         dev->type = ARPHRD_HDLC;
1017                         break;
1018                 case SPPPIOCPPP:
1019                         sp->pp_flags&=~PP_CISCO;
1020                         dev->type = ARPHRD_PPP;
1021                         break;
1022                 case SPPPIOCDEBUG:
1023                         sp->pp_flags&=~PP_DEBUG;
1024                         if(ifr->ifr_flags)
1025                                 sp->pp_flags|=PP_DEBUG;
1026                         break;
1027                 case SPPPIOCGFLAGS:
1028                         if(copy_to_user(ifr->ifr_data, &sp->pp_flags, sizeof(sp->pp_flags)))
1029                                 return -EFAULT;
1030                         break;
1031                 case SPPPIOCSFLAGS:
1032                         if(copy_from_user(&sp->pp_flags, ifr->ifr_data, sizeof(sp->pp_flags)))
1033                                 return -EFAULT;
1034                         break;
1035                 default:
1036                         return -EINVAL;
1037         }
1038         return 0;
1039 }
1040
1041 EXPORT_SYMBOL(sppp_do_ioctl);
1042
1043 /**
1044  *      sppp_attach - attach synchronous PPP/HDLC to a device
1045  *      @pd:    PPP device to initialise
1046  *
1047  *      This initialises the PPP/HDLC support on an interface. At the
1048  *      time of calling the dev element must point to the network device
1049  *      that this interface is attached to. The interface should not yet
1050  *      be registered. 
1051  */
1052  
1053 void sppp_attach(struct ppp_device *pd)
1054 {
1055         struct net_device *dev = pd->dev;
1056         struct sppp *sp = &pd->sppp;
1057         unsigned long flags;
1058
1059         /* Make sure embedding is safe for sppp_of */
1060         BUG_ON(sppp_of(dev) != sp);
1061
1062         spin_lock_irqsave(&spppq_lock, flags);
1063         /* Initialize keepalive handler. */
1064         if (! spppq)
1065         {
1066                 init_timer(&sppp_keepalive_timer);
1067                 sppp_keepalive_timer.expires=jiffies+10*HZ;
1068                 sppp_keepalive_timer.function=sppp_keepalive;
1069                 add_timer(&sppp_keepalive_timer);
1070         }
1071         /* Insert new entry into the keepalive list. */
1072         sp->pp_next = spppq;
1073         spppq = sp;
1074         spin_unlock_irqrestore(&spppq_lock, flags);
1075
1076         sp->pp_loopcnt = 0;
1077         sp->pp_alivecnt = 0;
1078         sp->pp_seq = 0;
1079         sp->pp_rseq = 0;
1080         sp->pp_flags = PP_KEEPALIVE|PP_CISCO|debug;/*PP_DEBUG;*/
1081         sp->lcp.magic = 0;
1082         sp->lcp.state = LCP_STATE_CLOSED;
1083         sp->ipcp.state = IPCP_STATE_CLOSED;
1084         sp->pp_if = dev;
1085         spin_lock_init(&sp->lock);
1086         
1087         /* 
1088          *      Device specific setup. All but interrupt handler and
1089          *      hard_start_xmit.
1090          */
1091          
1092         dev->header_ops = &sppp_header_ops;
1093
1094         dev->tx_queue_len = 10;
1095         dev->type = ARPHRD_HDLC;
1096         dev->addr_len = 0;
1097         dev->hard_header_len = sizeof(struct ppp_header);
1098         dev->mtu = PPP_MTU;
1099         /*
1100          *      These 4 are callers but MUST also call sppp_ functions
1101          */
1102         dev->do_ioctl = sppp_do_ioctl;
1103 #if 0
1104         dev->get_stats = NULL;          /* Let the driver override these */
1105         dev->open = sppp_open;
1106         dev->stop = sppp_close;
1107 #endif  
1108         dev->change_mtu = sppp_change_mtu;
1109         dev->flags = IFF_MULTICAST|IFF_POINTOPOINT|IFF_NOARP;
1110 }
1111
1112 EXPORT_SYMBOL(sppp_attach);
1113
1114 /**
1115  *      sppp_detach - release PPP resources from a device
1116  *      @dev:   Network device to release
1117  *
1118  *      Stop and free up any PPP/HDLC resources used by this
1119  *      interface. This must be called before the device is
1120  *      freed.
1121  */
1122  
1123 void sppp_detach (struct net_device *dev)
1124 {
1125         struct sppp **q, *p, *sp = (struct sppp *)sppp_of(dev);
1126         unsigned long flags;
1127
1128         spin_lock_irqsave(&spppq_lock, flags);
1129         /* Remove the entry from the keepalive list. */
1130         for (q = &spppq; (p = *q); q = &p->pp_next)
1131                 if (p == sp) {
1132                         *q = p->pp_next;
1133                         break;
1134                 }
1135
1136         /* Stop keepalive handler. */
1137         if (! spppq)
1138                 del_timer(&sppp_keepalive_timer);
1139         sppp_clear_timeout (sp);
1140         spin_unlock_irqrestore(&spppq_lock, flags);
1141 }
1142
1143 EXPORT_SYMBOL(sppp_detach);
1144
1145 /*
1146  * Analyze the LCP Configure-Request options list
1147  * for the presence of unknown options.
1148  * If the request contains unknown options, build and
1149  * send Configure-reject packet, containing only unknown options.
1150  */
1151 static int
1152 sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
1153         int len, u32 *magic)
1154 {
1155         u8 *buf, *r, *p;
1156         int rlen;
1157
1158         len -= 4;
1159         buf = r = kmalloc (len, GFP_ATOMIC);
1160         if (! buf)
1161                 return (0);
1162
1163         p = (void*) (h+1);
1164         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
1165                 switch (*p) {
1166                 case LCP_OPT_MAGIC:
1167                         /* Magic number -- extract. */
1168                         if (len >= 6 && p[1] == 6) {
1169                                 *magic = (u32)p[2] << 24 |
1170                                         (u32)p[3] << 16 | p[4] << 8 | p[5];
1171                                 continue;
1172                         }
1173                         break;
1174                 case LCP_OPT_ASYNC_MAP:
1175                         /* Async control character map -- check to be zero. */
1176                         if (len >= 6 && p[1] == 6 && ! p[2] && ! p[3] &&
1177                             ! p[4] && ! p[5])
1178                                 continue;
1179                         break;
1180                 case LCP_OPT_MRU:
1181                         /* Maximum receive unit -- always OK. */
1182                         continue;
1183                 default:
1184                         /* Others not supported. */
1185                         break;
1186                 }
1187                 /* Add the option to rejected list. */
1188                 memcpy(r, p, p[1]);
1189                 r += p[1];
1190                 rlen += p[1];
1191         }
1192         if (rlen)
1193                 sppp_cp_send (sp, PPP_LCP, LCP_CONF_REJ, h->ident, rlen, buf);
1194         kfree(buf);
1195         return (rlen == 0);
1196 }
1197
1198 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *skb)
1199 {
1200         struct lcp_header *h;
1201         struct net_device *dev = sp->pp_if;
1202         int len = skb->len;
1203
1204         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
1205                 if (sp->pp_flags & PP_DEBUG)
1206                         printk (KERN_WARNING "%s: invalid ipcp packet length: %d bytes\n",
1207                                 dev->name,  len);
1208                 return;
1209         }
1210         h = (struct lcp_header *)skb->data;
1211         skb_pull(skb,sizeof(struct lcp_header));
1212         if (sp->pp_flags & PP_DEBUG) {
1213                 printk (KERN_WARNING "%s: ipcp input: %d bytes <%s id=%xh len=%xh",
1214                         dev->name,  len,
1215                         sppp_ipcp_type_name (h->type), h->ident, ntohs (h->len));
1216                 if (len > 4)
1217                         sppp_print_bytes ((u8*) (h+1), len-4);
1218                 printk (">\n");
1219         }
1220         if (len > ntohs (h->len))
1221                 len = ntohs (h->len);
1222         switch (h->type) {
1223         default:
1224                 /* Unknown packet type -- send Code-Reject packet. */
1225                 sppp_cp_send (sp, PPP_IPCP, IPCP_CODE_REJ, ++sp->pp_seq, len, h);
1226                 break;
1227         case IPCP_CONF_REQ:
1228                 if (len < 4) {
1229                         if (sp->pp_flags & PP_DEBUG)
1230                                 printk (KERN_WARNING "%s: invalid ipcp configure request packet length: %d bytes\n",
1231                                         dev->name, len);
1232                         return;
1233                 }
1234                 if (len > 4) {
1235                         sppp_cp_send (sp, PPP_IPCP, LCP_CONF_REJ, h->ident,
1236                                 len-4, h+1);
1237
1238                         switch (sp->ipcp.state) {
1239                         case IPCP_STATE_OPENED:
1240                                 /* Initiate renegotiation. */
1241                                 sppp_ipcp_open (sp);
1242                                 /* fall through... */
1243                         case IPCP_STATE_ACK_SENT:
1244                                 /* Go to closed state. */
1245                                 sp->ipcp.state = IPCP_STATE_CLOSED;
1246                         }
1247                 } else {
1248                         /* Send Configure-Ack packet. */
1249                         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_ACK, h->ident,
1250                                 0, NULL);
1251                         /* Change the state. */
1252                         if (sp->ipcp.state == IPCP_STATE_ACK_RCVD)
1253                                 sp->ipcp.state = IPCP_STATE_OPENED;
1254                         else
1255                                 sp->ipcp.state = IPCP_STATE_ACK_SENT;
1256                 }
1257                 break;
1258         case IPCP_CONF_ACK:
1259                 if (h->ident != sp->ipcp.confid)
1260                         break;
1261                 sppp_clear_timeout (sp);
1262                 switch (sp->ipcp.state) {
1263                 case IPCP_STATE_CLOSED:
1264                         sp->ipcp.state = IPCP_STATE_ACK_RCVD;
1265                         sppp_set_timeout (sp, 5);
1266                         break;
1267                 case IPCP_STATE_ACK_SENT:
1268                         sp->ipcp.state = IPCP_STATE_OPENED;
1269                         break;
1270                 }
1271                 break;
1272         case IPCP_CONF_NAK:
1273         case IPCP_CONF_REJ:
1274                 if (h->ident != sp->ipcp.confid)
1275                         break;
1276                 sppp_clear_timeout (sp);
1277                         /* Initiate renegotiation. */
1278                 sppp_ipcp_open (sp);
1279                 if (sp->ipcp.state != IPCP_STATE_ACK_SENT)
1280                         /* Go to closed state. */
1281                         sp->ipcp.state = IPCP_STATE_CLOSED;
1282                 break;
1283         case IPCP_TERM_REQ:
1284                 /* Send Terminate-Ack packet. */
1285                 sppp_cp_send (sp, PPP_IPCP, IPCP_TERM_ACK, h->ident, 0, NULL);
1286                 /* Go to closed state. */
1287                 sp->ipcp.state = IPCP_STATE_CLOSED;
1288                 /* Initiate renegotiation. */
1289                 sppp_ipcp_open (sp);
1290                 break;
1291         case IPCP_TERM_ACK:
1292                 /* Ignore for now. */
1293         case IPCP_CODE_REJ:
1294                 /* Ignore for now. */
1295                 break;
1296         }
1297 }
1298
1299 static void sppp_lcp_open (struct sppp *sp)
1300 {
1301         char opt[6];
1302
1303         if (! sp->lcp.magic)
1304                 sp->lcp.magic = jiffies;
1305         opt[0] = LCP_OPT_MAGIC;
1306         opt[1] = sizeof (opt);
1307         opt[2] = sp->lcp.magic >> 24;
1308         opt[3] = sp->lcp.magic >> 16;
1309         opt[4] = sp->lcp.magic >> 8;
1310         opt[5] = sp->lcp.magic;
1311         sp->lcp.confid = ++sp->pp_seq;
1312         sppp_cp_send (sp, PPP_LCP, LCP_CONF_REQ, sp->lcp.confid,
1313                 sizeof (opt), &opt);
1314         sppp_set_timeout (sp, 2);
1315 }
1316
1317 static void sppp_ipcp_open (struct sppp *sp)
1318 {
1319         sp->ipcp.confid = ++sp->pp_seq;
1320         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_REQ, sp->ipcp.confid, 0, NULL);
1321         sppp_set_timeout (sp, 2);
1322 }
1323
1324 /*
1325  * Process PPP control protocol timeouts.
1326  */
1327  
1328 static void sppp_cp_timeout (unsigned long arg)
1329 {
1330         struct sppp *sp = (struct sppp*) arg;
1331         unsigned long flags;
1332
1333         spin_lock_irqsave(&sp->lock, flags);
1334
1335         sp->pp_flags &= ~PP_TIMO;
1336         if (! (sp->pp_if->flags & IFF_UP) || (sp->pp_flags & PP_CISCO)) {
1337                 spin_unlock_irqrestore(&sp->lock, flags);
1338                 return;
1339         }
1340         switch (sp->lcp.state) {
1341         case LCP_STATE_CLOSED:
1342                 /* No ACK for Configure-Request, retry. */
1343                 sppp_lcp_open (sp);
1344                 break;
1345         case LCP_STATE_ACK_RCVD:
1346                 /* ACK got, but no Configure-Request for peer, retry. */
1347                 sppp_lcp_open (sp);
1348                 sp->lcp.state = LCP_STATE_CLOSED;
1349                 break;
1350         case LCP_STATE_ACK_SENT:
1351                 /* ACK sent but no ACK for Configure-Request, retry. */
1352                 sppp_lcp_open (sp);
1353                 break;
1354         case LCP_STATE_OPENED:
1355                 /* LCP is already OK, try IPCP. */
1356                 switch (sp->ipcp.state) {
1357                 case IPCP_STATE_CLOSED:
1358                         /* No ACK for Configure-Request, retry. */
1359                         sppp_ipcp_open (sp);
1360                         break;
1361                 case IPCP_STATE_ACK_RCVD:
1362                         /* ACK got, but no Configure-Request for peer, retry. */
1363                         sppp_ipcp_open (sp);
1364                         sp->ipcp.state = IPCP_STATE_CLOSED;
1365                         break;
1366                 case IPCP_STATE_ACK_SENT:
1367                         /* ACK sent but no ACK for Configure-Request, retry. */
1368                         sppp_ipcp_open (sp);
1369                         break;
1370                 case IPCP_STATE_OPENED:
1371                         /* IPCP is OK. */
1372                         break;
1373                 }
1374                 break;
1375         }
1376         spin_unlock_irqrestore(&sp->lock, flags);
1377         sppp_flush_xmit();
1378 }
1379
1380 static char *sppp_lcp_type_name (u8 type)
1381 {
1382         static char buf [8];
1383         switch (type) {
1384         case LCP_CONF_REQ:   return ("conf-req");
1385         case LCP_CONF_ACK:   return ("conf-ack");
1386         case LCP_CONF_NAK:   return ("conf-nack");
1387         case LCP_CONF_REJ:   return ("conf-rej");
1388         case LCP_TERM_REQ:   return ("term-req");
1389         case LCP_TERM_ACK:   return ("term-ack");
1390         case LCP_CODE_REJ:   return ("code-rej");
1391         case LCP_PROTO_REJ:  return ("proto-rej");
1392         case LCP_ECHO_REQ:   return ("echo-req");
1393         case LCP_ECHO_REPLY: return ("echo-reply");
1394         case LCP_DISC_REQ:   return ("discard-req");
1395         }
1396         sprintf (buf, "%xh", type);
1397         return (buf);
1398 }
1399
1400 static char *sppp_ipcp_type_name (u8 type)
1401 {
1402         static char buf [8];
1403         switch (type) {
1404         case IPCP_CONF_REQ:   return ("conf-req");
1405         case IPCP_CONF_ACK:   return ("conf-ack");
1406         case IPCP_CONF_NAK:   return ("conf-nack");
1407         case IPCP_CONF_REJ:   return ("conf-rej");
1408         case IPCP_TERM_REQ:   return ("term-req");
1409         case IPCP_TERM_ACK:   return ("term-ack");
1410         case IPCP_CODE_REJ:   return ("code-rej");
1411         }
1412         sprintf (buf, "%xh", type);
1413         return (buf);
1414 }
1415
1416 static void sppp_print_bytes (u_char *p, u16 len)
1417 {
1418         printk (" %x", *p++);
1419         while (--len > 0)
1420                 printk ("-%x", *p++);
1421 }
1422
1423 /**
1424  *      sppp_rcv -      receive and process a WAN PPP frame
1425  *      @skb:   The buffer to process
1426  *      @dev:   The device it arrived on
1427  *      @p: Unused
1428  *      @orig_dev: Unused
1429  *
1430  *      Protocol glue. This drives the deferred processing mode the poorer
1431  *      cards use. This can be called directly by cards that do not have
1432  *      timing constraints but is normally called from the network layer
1433  *      after interrupt servicing to process frames queued via netif_rx.
1434  */
1435
1436 static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
1437 {
1438         if (dev_net(dev) != &init_net) {
1439                 kfree_skb(skb);
1440                 return 0;
1441         }
1442
1443         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
1444                 return NET_RX_DROP;
1445         sppp_input(dev,skb);
1446         return 0;
1447 }
1448
1449 static struct packet_type sppp_packet_type = {
1450         .type   = __constant_htons(ETH_P_WAN_PPP),
1451         .func   = sppp_rcv,
1452 };
1453
1454 static char banner[] __initdata = 
1455         KERN_INFO "Cronyx Ltd, Synchronous PPP and CISCO HDLC (c) 1994\n"
1456         KERN_INFO "Linux port (c) 1998 Building Number Three Ltd & "
1457                   "Jan \"Yenya\" Kasprzak.\n";
1458
1459 static int __init sync_ppp_init(void)
1460 {
1461         if(debug)
1462                 debug=PP_DEBUG;
1463         printk(banner);
1464         skb_queue_head_init(&tx_queue);
1465         dev_add_pack(&sppp_packet_type);
1466         return 0;
1467 }
1468
1469
1470 static void __exit sync_ppp_cleanup(void)
1471 {
1472         dev_remove_pack(&sppp_packet_type);
1473 }
1474
1475 module_init(sync_ppp_init);
1476 module_exit(sync_ppp_cleanup);
1477 module_param(debug, int, 0);
1478 MODULE_LICENSE("GPL");
1479