git.oblomov.eu Git - linux-2.6/blob - drivers/net/wan/syncppp.c

   1 /*
   2  *      NET3:   A (fairly minimal) implementation of synchronous PPP for Linux
   3  *              as well as a CISCO HDLC implementation. See the copyright
   4  *              message below for the original source.
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the license, or (at your option) any later version.
  10  *
  11  *      Note however. This code is also used in a different form by FreeBSD.
  12  *      Therefore when making any non OS specific change please consider
  13  *      contributing it back to the original author under the terms
  14  *      below in addition.
  15  *              -- Alan
  16  *
  17  *      Port for Linux-2.1 by Jan "Yenya" Kasprzak <kas@fi.muni.cz>
  18  */
  19
  20 /*
  21  * Synchronous PPP/Cisco link level subroutines.
  22  * Keepalive protocol implemented in both Cisco and PPP modes.
  23  *
  24  * Copyright (C) 1994 Cronyx Ltd.
  25  * Author: Serge Vakulenko, <vak@zebub.msk.su>
  26  *
  27  * This software is distributed with NO WARRANTIES, not even the implied
  28  * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  29  *
  30  * Authors grant any other persons or organisations permission to use
  31  * or modify this software as long as this message is kept with the software,
  32  * all derivative works or modified versions.
  33  *
  34  * Version 1.9, Wed Oct  4 18:58:15 MSK 1995
  35  *
  36  * $Id: syncppp.c,v 1.18 2000/04/11 05:25:31 asj Exp $
  37  */
  38 #undef DEBUG
  39
  40 #include <linux/config.h>
  41 #include <linux/module.h>
  42 #include <linux/kernel.h>
  43 #include <linux/errno.h>
  44 #include <linux/init.h>
  45 #include <linux/if_arp.h>
  46 #include <linux/skbuff.h>
  47 #include <linux/route.h>
  48 #include <linux/netdevice.h>
  49 #include <linux/inetdevice.h>
  50 #include <linux/random.h>
  51 #include <linux/pkt_sched.h>
  52 #include <linux/spinlock.h>
  53 #include <linux/rcupdate.h>
  54
  55 #include <net/syncppp.h>
  56
  57 #include <asm/byteorder.h>
  58 #include <asm/uaccess.h>
  59
  60 #define MAXALIVECNT     6               /* max. alive packets */
  61
  62 #define PPP_ALLSTATIONS 0xff            /* All-Stations broadcast address */
  63 #define PPP_UI          0x03            /* Unnumbered Information */
  64 #define PPP_IP          0x0021          /* Internet Protocol */
  65 #define PPP_ISO         0x0023          /* ISO OSI Protocol */
  66 #define PPP_XNS         0x0025          /* Xerox NS Protocol */
  67 #define PPP_IPX         0x002b          /* Novell IPX Protocol */
  68 #define PPP_LCP         0xc021          /* Link Control Protocol */
  69 #define PPP_IPCP        0x8021          /* Internet Protocol Control Protocol */
  70
  71 #define LCP_CONF_REQ    1               /* PPP LCP configure request */
  72 #define LCP_CONF_ACK    2               /* PPP LCP configure acknowledge */
  73 #define LCP_CONF_NAK    3               /* PPP LCP configure negative ack */
  74 #define LCP_CONF_REJ    4               /* PPP LCP configure reject */
  75 #define LCP_TERM_REQ    5               /* PPP LCP terminate request */
  76 #define LCP_TERM_ACK    6               /* PPP LCP terminate acknowledge */
  77 #define LCP_CODE_REJ    7               /* PPP LCP code reject */
  78 #define LCP_PROTO_REJ   8               /* PPP LCP protocol reject */
  79 #define LCP_ECHO_REQ    9               /* PPP LCP echo request */
  80 #define LCP_ECHO_REPLY  10              /* PPP LCP echo reply */
  81 #define LCP_DISC_REQ    11              /* PPP LCP discard request */
  82
  83 #define LCP_OPT_MRU             1       /* maximum receive unit */
  84 #define LCP_OPT_ASYNC_MAP       2       /* async control character map */
  85 #define LCP_OPT_AUTH_PROTO      3       /* authentication protocol */
  86 #define LCP_OPT_QUAL_PROTO      4       /* quality protocol */
  87 #define LCP_OPT_MAGIC           5       /* magic number */
  88 #define LCP_OPT_RESERVED        6       /* reserved */
  89 #define LCP_OPT_PROTO_COMP      7       /* protocol field compression */
  90 #define LCP_OPT_ADDR_COMP       8       /* address/control field compression */
  91
  92 #define IPCP_CONF_REQ   LCP_CONF_REQ    /* PPP IPCP configure request */
  93 #define IPCP_CONF_ACK   LCP_CONF_ACK    /* PPP IPCP configure acknowledge */
  94 #define IPCP_CONF_NAK   LCP_CONF_NAK    /* PPP IPCP configure negative ack */
  95 #define IPCP_CONF_REJ   LCP_CONF_REJ    /* PPP IPCP configure reject */
  96 #define IPCP_TERM_REQ   LCP_TERM_REQ    /* PPP IPCP terminate request */
  97 #define IPCP_TERM_ACK   LCP_TERM_ACK    /* PPP IPCP terminate acknowledge */
  98 #define IPCP_CODE_REJ   LCP_CODE_REJ    /* PPP IPCP code reject */
  99
 100 #define CISCO_MULTICAST         0x8f    /* Cisco multicast address */
 101 #define CISCO_UNICAST           0x0f    /* Cisco unicast address */
 102 #define CISCO_KEEPALIVE         0x8035  /* Cisco keepalive protocol */
 103 #define CISCO_ADDR_REQ          0       /* Cisco address request */
 104 #define CISCO_ADDR_REPLY        1       /* Cisco address reply */
 105 #define CISCO_KEEPALIVE_REQ     2       /* Cisco keepalive request */
 106
 107 struct ppp_header {
 108         u8 address;
 109         u8 control;
 110         u16 protocol;
 111 };
 112 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
 113
 114 struct lcp_header {
 115         u8 type;
 116         u8 ident;
 117         u16 len;
 118 };
 119 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
 120
 121 struct cisco_packet {
 122         u32 type;
 123         u32 par1;
 124         u32 par2;
 125         u16 rel;
 126         u16 time0;
 127         u16 time1;
 128 };
 129 #define CISCO_PACKET_LEN 18
 130 #define CISCO_BIG_PACKET_LEN 20
 131
 132 static struct sppp *spppq;
 133 static struct timer_list sppp_keepalive_timer;
 134 static DEFINE_SPINLOCK(spppq_lock);
 135
 136 /* global xmit queue for sending packets while spinlock is held */
 137 static struct sk_buff_head tx_queue;
 138
 139 static void sppp_keepalive (unsigned long dummy);
 140 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
 141         u8 ident, u16 len, void *data);
 142 static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2);
 143 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *m);
 144 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *m);
 145 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *m);
 146 static void sppp_lcp_open (struct sppp *sp);
 147 static void sppp_ipcp_open (struct sppp *sp);
 148 static int sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
 149         int len, u32 *magic);
 150 static void sppp_cp_timeout (unsigned long arg);
 151 static char *sppp_lcp_type_name (u8 type);
 152 static char *sppp_ipcp_type_name (u8 type);
 153 static void sppp_print_bytes (u8 *p, u16 len);
 154
 155 static int debug;
 156
 157 /* Flush global outgoing packet queue to dev_queue_xmit().
 158  *
 159  * dev_queue_xmit() must be called with interrupts enabled
 160  * which means it can't be called with spinlocks held.
 161  * If a packet needs to be sent while a spinlock is held,
 162  * then put the packet into tx_queue, and call sppp_flush_xmit()
 163  * after spinlock is released.
 164  */
 165 static void sppp_flush_xmit(void)
 166 {
 167         struct sk_buff *skb;
 168         while ((skb = skb_dequeue(&tx_queue)) != NULL)
 169                 dev_queue_xmit(skb);
 170 }
 171
 172 /*
 173  *      Interface down stub
 174  */
 175
 176 static void if_down(struct net_device *dev)
 177 {
 178         struct sppp *sp = (struct sppp *)sppp_of(dev);
 179
 180         sp->pp_link_state=SPPP_LINK_DOWN;
 181 }
 182
 183 /*
 184  * Timeout routine activations.
 185  */
 186
 187 static void sppp_set_timeout(struct sppp *p,int s)
 188 {
 189         if (! (p->pp_flags & PP_TIMO))
 190         {
 191                 init_timer(&p->pp_timer);
 192                 p->pp_timer.function=sppp_cp_timeout;
 193                 p->pp_timer.expires=jiffies+s*HZ;
 194                 p->pp_timer.data=(unsigned long)p;
 195                 p->pp_flags |= PP_TIMO;
 196                 add_timer(&p->pp_timer);
 197         }
 198 }
 199
 200 static void sppp_clear_timeout(struct sppp *p)
 201 {
 202         if (p->pp_flags & PP_TIMO)
 203         {
 204                 del_timer(&p->pp_timer);
 205                 p->pp_flags &= ~PP_TIMO;
 206         }
 207 }
 208
 209 /**
 210  *      sppp_input -    receive and process a WAN PPP frame
 211  *      @skb:   The buffer to process
 212  *      @dev:   The device it arrived on
 213  *
 214  *      This can be called directly by cards that do not have
 215  *      timing constraints but is normally called from the network layer
 216  *      after interrupt servicing to process frames queued via netif_rx().
 217  *
 218  *      We process the options in the card. If the frame is destined for
 219  *      the protocol stacks then it requeues the frame for the upper level
 220  *      protocol. If it is a control from it is processed and discarded
 221  *      here.
 222  */
 223
 224 static void sppp_input (struct net_device *dev, struct sk_buff *skb)
 225 {
 226         struct ppp_header *h;
 227         struct sppp *sp = (struct sppp *)sppp_of(dev);
 228         unsigned long flags;
 229
 230         skb->dev=dev;
 231         skb->mac.raw=skb->data;
 232
 233         if (dev->flags & IFF_RUNNING)
 234         {
 235                 /* Count received bytes, add FCS and one flag */
 236                 sp->ibytes+= skb->len + 3;
 237                 sp->ipkts++;
 238         }
 239
 240         if (!pskb_may_pull(skb, PPP_HEADER_LEN)) {
 241                 /* Too small packet, drop it. */
 242                 if (sp->pp_flags & PP_DEBUG)
 243                         printk (KERN_DEBUG "%s: input packet is too small, %d bytes\n",
 244                                 dev->name, skb->len);
 245                 kfree_skb(skb);
 246                 return;
 247         }
 248
 249         /* Get PPP header. */
 250         h = (struct ppp_header *)skb->data;
 251         skb_pull(skb,sizeof(struct ppp_header));
 252
 253         spin_lock_irqsave(&sp->lock, flags);
 254
 255         switch (h->address) {
 256         default:        /* Invalid PPP packet. */
 257                 goto invalid;
 258         case PPP_ALLSTATIONS:
 259                 if (h->control != PPP_UI)
 260                         goto invalid;
 261                 if (sp->pp_flags & PP_CISCO) {
 262                         if (sp->pp_flags & PP_DEBUG)
 263                                 printk (KERN_WARNING "%s: PPP packet in Cisco mode <0x%x 0x%x 0x%x>\n",
 264                                         dev->name,
 265                                         h->address, h->control, ntohs (h->protocol));
 266                         goto drop;
 267                 }
 268                 switch (ntohs (h->protocol)) {
 269                 default:
 270                         if (sp->lcp.state == LCP_STATE_OPENED)
 271                                 sppp_cp_send (sp, PPP_LCP, LCP_PROTO_REJ,
 272                                         ++sp->pp_seq, skb->len + 2,
 273                                         &h->protocol);
 274                         if (sp->pp_flags & PP_DEBUG)
 275                                 printk (KERN_WARNING "%s: invalid input protocol <0x%x 0x%x 0x%x>\n",
 276                                         dev->name,
 277                                         h->address, h->control, ntohs (h->protocol));
 278                         goto drop;
 279                 case PPP_LCP:
 280                         sppp_lcp_input (sp, skb);
 281                         goto drop;
 282                 case PPP_IPCP:
 283                         if (sp->lcp.state == LCP_STATE_OPENED)
 284                                 sppp_ipcp_input (sp, skb);
 285                         else
 286                                 printk(KERN_DEBUG "IPCP when still waiting LCP finish.\n");
 287                         goto drop;
 288                 case PPP_IP:
 289                         if (sp->ipcp.state == IPCP_STATE_OPENED) {
 290                                 if(sp->pp_flags&PP_DEBUG)
 291                                         printk(KERN_DEBUG "Yow an IP frame.\n");
 292                                 skb->protocol=htons(ETH_P_IP);
 293                                 netif_rx(skb);
 294                                 dev->last_rx = jiffies;
 295                                 goto done;
 296                         }
 297                         break;
 298 #ifdef IPX
 299                 case PPP_IPX:
 300                         /* IPX IPXCP not implemented yet */
 301                         if (sp->lcp.state == LCP_STATE_OPENED) {
 302                                 skb->protocol=htons(ETH_P_IPX);
 303                                 netif_rx(skb);
 304                                 dev->last_rx = jiffies;
 305                                 goto done;
 306                         }
 307                         break;
 308 #endif
 309                 }
 310                 break;
 311         case CISCO_MULTICAST:
 312         case CISCO_UNICAST:
 313                 /* Don't check the control field here (RFC 1547). */
 314                 if (! (sp->pp_flags & PP_CISCO)) {
 315                         if (sp->pp_flags & PP_DEBUG)
 316                                 printk (KERN_WARNING "%s: Cisco packet in PPP mode <0x%x 0x%x 0x%x>\n",
 317                                         dev->name,
 318                                         h->address, h->control, ntohs (h->protocol));
 319                         goto drop;
 320                 }
 321                 switch (ntohs (h->protocol)) {
 322                 default:
 323                         goto invalid;
 324                 case CISCO_KEEPALIVE:
 325                         sppp_cisco_input (sp, skb);
 326                         goto drop;
 327 #ifdef CONFIG_INET
 328                 case ETH_P_IP:
 329                         skb->protocol=htons(ETH_P_IP);
 330                         netif_rx(skb);
 331                         dev->last_rx = jiffies;
 332                         goto done;
 333 #endif
 334 #ifdef CONFIG_IPX
 335                 case ETH_P_IPX:
 336                         skb->protocol=htons(ETH_P_IPX);
 337                         netif_rx(skb);
 338                         dev->last_rx = jiffies;
 339                         goto done;
 340 #endif
 341                 }
 342                 break;
 343         }
 344         goto drop;
 345
 346 invalid:
 347         if (sp->pp_flags & PP_DEBUG)
 348                 printk (KERN_WARNING "%s: invalid input packet <0x%x 0x%x 0x%x>\n",
 349                         dev->name, h->address, h->control, ntohs (h->protocol));
 350 drop:
 351         kfree_skb(skb);
 352 done:
 353         spin_unlock_irqrestore(&sp->lock, flags);
 354         sppp_flush_xmit();
 355         return;
 356 }
 357
 358 /*
 359  *      Handle transmit packets.
 360  */
 361
 362 static int sppp_hard_header(struct sk_buff *skb, struct net_device *dev, __u16 type,
 363                 void *daddr, void *saddr, unsigned int len)
 364 {
 365         struct sppp *sp = (struct sppp *)sppp_of(dev);
 366         struct ppp_header *h;
 367         skb_push(skb,sizeof(struct ppp_header));
 368         h=(struct ppp_header *)skb->data;
 369         if(sp->pp_flags&PP_CISCO)
 370         {
 371                 h->address = CISCO_UNICAST;
 372                 h->control = 0;
 373         }
 374         else
 375         {
 376                 h->address = PPP_ALLSTATIONS;
 377                 h->control = PPP_UI;
 378         }
 379         if(sp->pp_flags & PP_CISCO)
 380         {
 381                 h->protocol = htons(type);
 382         }
 383         else switch(type)
 384         {
 385                 case ETH_P_IP:
 386                         h->protocol = htons(PPP_IP);
 387                         break;
 388                 case ETH_P_IPX:
 389                         h->protocol = htons(PPP_IPX);
 390                         break;
 391         }
 392         return sizeof(struct ppp_header);
 393 }
 394
 395 static int sppp_rebuild_header(struct sk_buff *skb)
 396 {
 397         return 0;
 398 }
 399
 400 /*
 401  * Send keepalive packets, every 10 seconds.
 402  */
 403
 404 static void sppp_keepalive (unsigned long dummy)
 405 {
 406         struct sppp *sp;
 407         unsigned long flags;
 408
 409         spin_lock_irqsave(&spppq_lock, flags);
 410
 411         for (sp=spppq; sp; sp=sp->pp_next)
 412         {
 413                 struct net_device *dev = sp->pp_if;
 414
 415                 /* Keepalive mode disabled or channel down? */
 416                 if (! (sp->pp_flags & PP_KEEPALIVE) ||
 417                     ! (dev->flags & IFF_UP))
 418                         continue;
 419
 420                 spin_lock(&sp->lock);
 421
 422                 /* No keepalive in PPP mode if LCP not opened yet. */
 423                 if (! (sp->pp_flags & PP_CISCO) &&
 424                     sp->lcp.state != LCP_STATE_OPENED) {
 425                         spin_unlock(&sp->lock);
 426                         continue;
 427                 }
 428
 429                 if (sp->pp_alivecnt == MAXALIVECNT) {
 430                         /* No keepalive packets got.  Stop the interface. */
 431                         printk (KERN_WARNING "%s: protocol down\n", dev->name);
 432                         if_down (dev);
 433                         if (! (sp->pp_flags & PP_CISCO)) {
 434                                 /* Shut down the PPP link. */
 435                                 sp->lcp.magic = jiffies;
 436                                 sp->lcp.state = LCP_STATE_CLOSED;
 437                                 sp->ipcp.state = IPCP_STATE_CLOSED;
 438                                 sppp_clear_timeout (sp);
 439                                 /* Initiate negotiation. */
 440                                 sppp_lcp_open (sp);
 441                         }
 442                 }
 443                 if (sp->pp_alivecnt <= MAXALIVECNT)
 444                         ++sp->pp_alivecnt;
 445                 if (sp->pp_flags & PP_CISCO)
 446                         sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
 447                                 sp->pp_rseq);
 448                 else if (sp->lcp.state == LCP_STATE_OPENED) {
 449                         long nmagic = htonl (sp->lcp.magic);
 450                         sp->lcp.echoid = ++sp->pp_seq;
 451                         sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REQ,
 452                                 sp->lcp.echoid, 4, &nmagic);
 453                 }
 454
 455                 spin_unlock(&sp->lock);
 456         }
 457         spin_unlock_irqrestore(&spppq_lock, flags);
 458         sppp_flush_xmit();
 459         sppp_keepalive_timer.expires=jiffies+10*HZ;
 460         add_timer(&sppp_keepalive_timer);
 461 }
 462
 463 /*
 464  * Handle incoming PPP Link Control Protocol packets.
 465  */
 466
 467 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *skb)
 468 {
 469         struct lcp_header *h;
 470         struct net_device *dev = sp->pp_if;
 471         int len = skb->len;
 472         u8 *p, opt[6];
 473         u32 rmagic;
 474
 475         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
 476                 if (sp->pp_flags & PP_DEBUG)
 477                         printk (KERN_WARNING "%s: invalid lcp packet length: %d bytes\n",
 478                                 dev->name, len);
 479                 return;
 480         }
 481         h = (struct lcp_header *)skb->data;
 482         skb_pull(skb,sizeof(struct lcp_header *));
 483
 484         if (sp->pp_flags & PP_DEBUG)
 485         {
 486                 char state = '?';
 487                 switch (sp->lcp.state) {
 488                 case LCP_STATE_CLOSED:   state = 'C'; break;
 489                 case LCP_STATE_ACK_RCVD: state = 'R'; break;
 490                 case LCP_STATE_ACK_SENT: state = 'S'; break;
 491                 case LCP_STATE_OPENED:   state = 'O'; break;
 492                 }
 493                 printk (KERN_WARNING "%s: lcp input(%c): %d bytes <%s id=%xh len=%xh",
 494                         dev->name, state, len,
 495                         sppp_lcp_type_name (h->type), h->ident, ntohs (h->len));
 496                 if (len > 4)
 497                         sppp_print_bytes ((u8*) (h+1), len-4);
 498                 printk (">\n");
 499         }
 500         if (len > ntohs (h->len))
 501                 len = ntohs (h->len);
 502         switch (h->type) {
 503         default:
 504                 /* Unknown packet type -- send Code-Reject packet. */
 505                 sppp_cp_send (sp, PPP_LCP, LCP_CODE_REJ, ++sp->pp_seq,
 506                         skb->len, h);
 507                 break;
 508         case LCP_CONF_REQ:
 509                 if (len < 4) {
 510                         if (sp->pp_flags & PP_DEBUG)
 511                                 printk (KERN_DEBUG"%s: invalid lcp configure request packet length: %d bytes\n",
 512                                         dev->name, len);
 513                         break;
 514                 }
 515                 if (len>4 && !sppp_lcp_conf_parse_options (sp, h, len, &rmagic))
 516                         goto badreq;
 517                 if (rmagic == sp->lcp.magic) {
 518                         /* Local and remote magics equal -- loopback? */
 519                         if (sp->pp_loopcnt >= MAXALIVECNT*5) {
 520                                 printk (KERN_WARNING "%s: loopback\n",
 521                                         dev->name);
 522                                 sp->pp_loopcnt = 0;
 523                                 if (dev->flags & IFF_UP) {
 524                                         if_down (dev);
 525                                 }
 526                         } else if (sp->pp_flags & PP_DEBUG)
 527                                 printk (KERN_DEBUG "%s: conf req: magic glitch\n",
 528                                         dev->name);
 529                         ++sp->pp_loopcnt;
 530
 531                         /* MUST send Conf-Nack packet. */
 532                         rmagic = ~sp->lcp.magic;
 533                         opt[0] = LCP_OPT_MAGIC;
 534                         opt[1] = sizeof (opt);
 535                         opt[2] = rmagic >> 24;
 536                         opt[3] = rmagic >> 16;
 537                         opt[4] = rmagic >> 8;
 538                         opt[5] = rmagic;
 539                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_NAK,
 540                                 h->ident, sizeof (opt), &opt);
 541 badreq:
 542                         switch (sp->lcp.state) {
 543                         case LCP_STATE_OPENED:
 544                                 /* Initiate renegotiation. */
 545                                 sppp_lcp_open (sp);
 546                                 /* fall through... */
 547                         case LCP_STATE_ACK_SENT:
 548                                 /* Go to closed state. */
 549                                 sp->lcp.state = LCP_STATE_CLOSED;
 550                                 sp->ipcp.state = IPCP_STATE_CLOSED;
 551                         }
 552                         break;
 553                 }
 554                 /* Send Configure-Ack packet. */
 555                 sp->pp_loopcnt = 0;
 556                 if (sp->lcp.state != LCP_STATE_OPENED) {
 557                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
 558                                         h->ident, len-4, h+1);
 559                 }
 560                 /* Change the state. */
 561                 switch (sp->lcp.state) {
 562                 case LCP_STATE_CLOSED:
 563                         sp->lcp.state = LCP_STATE_ACK_SENT;
 564                         break;
 565                 case LCP_STATE_ACK_RCVD:
 566                         sp->lcp.state = LCP_STATE_OPENED;
 567                         sppp_ipcp_open (sp);
 568                         break;
 569                 case LCP_STATE_OPENED:
 570                         /* Remote magic changed -- close session. */
 571                         sp->lcp.state = LCP_STATE_CLOSED;
 572                         sp->ipcp.state = IPCP_STATE_CLOSED;
 573                         /* Initiate renegotiation. */
 574                         sppp_lcp_open (sp);
 575                         /* Send ACK after our REQ in attempt to break loop */
 576                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
 577                                         h->ident, len-4, h+1);
 578                         sp->lcp.state = LCP_STATE_ACK_SENT;
 579                         break;
 580                 }
 581                 break;
 582         case LCP_CONF_ACK:
 583                 if (h->ident != sp->lcp.confid)
 584                         break;
 585                 sppp_clear_timeout (sp);
 586                 if ((sp->pp_link_state != SPPP_LINK_UP) &&
 587                     (dev->flags & IFF_UP)) {
 588                         /* Coming out of loopback mode. */
 589                         sp->pp_link_state=SPPP_LINK_UP;
 590                         printk (KERN_INFO "%s: protocol up\n", dev->name);
 591                 }
 592                 switch (sp->lcp.state) {
 593                 case LCP_STATE_CLOSED:
 594                         sp->lcp.state = LCP_STATE_ACK_RCVD;
 595                         sppp_set_timeout (sp, 5);
 596                         break;
 597                 case LCP_STATE_ACK_SENT:
 598                         sp->lcp.state = LCP_STATE_OPENED;
 599                         sppp_ipcp_open (sp);
 600                         break;
 601                 }
 602                 break;
 603         case LCP_CONF_NAK:
 604                 if (h->ident != sp->lcp.confid)
 605                         break;
 606                 p = (u8*) (h+1);
 607                 if (len>=10 && p[0] == LCP_OPT_MAGIC && p[1] >= 4) {
 608                         rmagic = (u32)p[2] << 24 |
 609                                 (u32)p[3] << 16 | p[4] << 8 | p[5];
 610                         if (rmagic == ~sp->lcp.magic) {
 611                                 int newmagic;
 612                                 if (sp->pp_flags & PP_DEBUG)
 613                                         printk (KERN_DEBUG "%s: conf nak: magic glitch\n",
 614                                                 dev->name);
 615                                 get_random_bytes(&newmagic, sizeof(newmagic));
 616                                 sp->lcp.magic += newmagic;
 617                         } else
 618                                 sp->lcp.magic = rmagic;
 619                         }
 620                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
 621                         /* Go to closed state. */
 622                         sp->lcp.state = LCP_STATE_CLOSED;
 623                         sp->ipcp.state = IPCP_STATE_CLOSED;
 624                 }
 625                 /* The link will be renegotiated after timeout,
 626                  * to avoid endless req-nack loop. */
 627                 sppp_clear_timeout (sp);
 628                 sppp_set_timeout (sp, 2);
 629                 break;
 630         case LCP_CONF_REJ:
 631                 if (h->ident != sp->lcp.confid)
 632                         break;
 633                 sppp_clear_timeout (sp);
 634                 /* Initiate renegotiation. */
 635                 sppp_lcp_open (sp);
 636                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
 637                         /* Go to closed state. */
 638                         sp->lcp.state = LCP_STATE_CLOSED;
 639                         sp->ipcp.state = IPCP_STATE_CLOSED;
 640                 }
 641                 break;
 642         case LCP_TERM_REQ:
 643                 sppp_clear_timeout (sp);
 644                 /* Send Terminate-Ack packet. */
 645                 sppp_cp_send (sp, PPP_LCP, LCP_TERM_ACK, h->ident, 0, NULL);
 646                 /* Go to closed state. */
 647                 sp->lcp.state = LCP_STATE_CLOSED;
 648                 sp->ipcp.state = IPCP_STATE_CLOSED;
 649                 /* Initiate renegotiation. */
 650                 sppp_lcp_open (sp);
 651                 break;
 652         case LCP_TERM_ACK:
 653         case LCP_CODE_REJ:
 654         case LCP_PROTO_REJ:
 655                 /* Ignore for now. */
 656                 break;
 657         case LCP_DISC_REQ:
 658                 /* Discard the packet. */
 659                 break;
 660         case LCP_ECHO_REQ:
 661                 if (sp->lcp.state != LCP_STATE_OPENED)
 662                         break;
 663                 if (len < 8) {
 664                         if (sp->pp_flags & PP_DEBUG)
 665                                 printk (KERN_WARNING "%s: invalid lcp echo request packet length: %d bytes\n",
 666                                         dev->name, len);
 667                         break;
 668                 }
 669                 if (ntohl (*(long*)(h+1)) == sp->lcp.magic) {
 670                         /* Line loopback mode detected. */
 671                         printk (KERN_WARNING "%s: loopback\n", dev->name);
 672                         if_down (dev);
 673
 674                         /* Shut down the PPP link. */
 675                         sp->lcp.state = LCP_STATE_CLOSED;
 676                         sp->ipcp.state = IPCP_STATE_CLOSED;
 677                         sppp_clear_timeout (sp);
 678                         /* Initiate negotiation. */
 679                         sppp_lcp_open (sp);
 680                         break;
 681                 }
 682                 *(long*)(h+1) = htonl (sp->lcp.magic);
 683                 sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REPLY, h->ident, len-4, h+1);
 684                 break;
 685         case LCP_ECHO_REPLY:
 686                 if (h->ident != sp->lcp.echoid)
 687                         break;
 688                 if (len < 8) {
 689                         if (sp->pp_flags & PP_DEBUG)
 690                                 printk (KERN_WARNING "%s: invalid lcp echo reply packet length: %d bytes\n",
 691                                         dev->name, len);
 692                         break;
 693                 }
 694                 if (ntohl (*(long*)(h+1)) != sp->lcp.magic)
 695                 sp->pp_alivecnt = 0;
 696                 break;
 697         }
 698 }
 699
 700 /*
 701  * Handle incoming Cisco keepalive protocol packets.
 702  */
 703
 704 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
 705 {
 706         struct cisco_packet *h;
 707         struct net_device *dev = sp->pp_if;
 708
 709         if (!pskb_may_pull(skb, sizeof(struct cisco_packet))
 710             || (skb->len != CISCO_PACKET_LEN
 711                 && skb->len != CISCO_BIG_PACKET_LEN)) {
 712                 if (sp->pp_flags & PP_DEBUG)
 713                         printk (KERN_WARNING "%s: invalid cisco packet length: %d bytes\n",
 714                                 dev->name,  skb->len);
 715                 return;
 716         }
 717         h = (struct cisco_packet *)skb->data;
 718         skb_pull(skb, sizeof(struct cisco_packet*));
 719         if (sp->pp_flags & PP_DEBUG)
 720                 printk (KERN_WARNING "%s: cisco input: %d bytes <%xh %xh %xh %xh %xh-%xh>\n",
 721                         dev->name,  skb->len,
 722                         ntohl (h->type), h->par1, h->par2, h->rel,
 723                         h->time0, h->time1);
 724         switch (ntohl (h->type)) {
 725         default:
 726                 if (sp->pp_flags & PP_DEBUG)
 727                         printk (KERN_WARNING "%s: unknown cisco packet type: 0x%x\n",
 728                                 dev->name,  ntohl (h->type));
 729                 break;
 730         case CISCO_ADDR_REPLY:
 731                 /* Reply on address request, ignore */
 732                 break;
 733         case CISCO_KEEPALIVE_REQ:
 734                 sp->pp_alivecnt = 0;
 735                 sp->pp_rseq = ntohl (h->par1);
 736                 if (sp->pp_seq == sp->pp_rseq) {
 737                         /* Local and remote sequence numbers are equal.
 738                          * Probably, the line is in loopback mode. */
 739                         int newseq;
 740                         if (sp->pp_loopcnt >= MAXALIVECNT) {
 741                                 printk (KERN_WARNING "%s: loopback\n",
 742                                         dev->name);
 743                                 sp->pp_loopcnt = 0;
 744                                 if (dev->flags & IFF_UP) {
 745                                         if_down (dev);
 746                                 }
 747                         }
 748                         ++sp->pp_loopcnt;
 749
 750                         /* Generate new local sequence number */
 751                         get_random_bytes(&newseq, sizeof(newseq));
 752                         sp->pp_seq ^= newseq;
 753                         break;
 754                 }
 755                 sp->pp_loopcnt = 0;
 756                 if (sp->pp_link_state==SPPP_LINK_DOWN &&
 757                     (dev->flags & IFF_UP)) {
 758                         sp->pp_link_state=SPPP_LINK_UP;
 759                         printk (KERN_INFO "%s: protocol up\n", dev->name);
 760                 }
 761                 break;
 762         case CISCO_ADDR_REQ:
 763                 /* Stolen from net/ipv4/devinet.c -- SIOCGIFADDR ioctl */
 764                 {
 765                 struct in_device *in_dev;
 766                 struct in_ifaddr *ifa;
 767                 u32 addr = 0, mask = ~0; /* FIXME: is the mask correct? */
 768 #ifdef CONFIG_INET
 769                 rcu_read_lock();
 770                 if ((in_dev = __in_dev_get_rcu(dev)) != NULL)
 771                 {
 772                         for (ifa=in_dev->ifa_list; ifa != NULL;
 773                                 ifa=ifa->ifa_next) {
 774                                 if (strcmp(dev->name, ifa->ifa_label) == 0)
 775                                 {
 776                                         addr = ifa->ifa_local;
 777                                         mask = ifa->ifa_mask;
 778                                         break;
 779                                 }
 780                         }
 781                 }
 782                 rcu_read_unlock();
 783 #endif
 784                 /* I hope both addr and mask are in the net order */
 785                 sppp_cisco_send (sp, CISCO_ADDR_REPLY, addr, mask);
 786                 break;
 787                 }
 788         }
 789 }
 790
 791
 792 /*
 793  * Send PPP LCP packet.
 794  */
 795
 796 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
 797         u8 ident, u16 len, void *data)
 798 {
 799         struct ppp_header *h;
 800         struct lcp_header *lh;
 801         struct sk_buff *skb;
 802         struct net_device *dev = sp->pp_if;
 803
 804         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+LCP_HEADER_LEN+len,
 805                 GFP_ATOMIC);
 806         if (skb==NULL)
 807                 return;
 808
 809         skb_reserve(skb,dev->hard_header_len);
 810
 811         h = (struct ppp_header *)skb_put(skb, sizeof(struct ppp_header));
 812         h->address = PPP_ALLSTATIONS;        /* broadcast address */
 813         h->control = PPP_UI;                 /* Unnumbered Info */
 814         h->protocol = htons (proto);         /* Link Control Protocol */
 815
 816         lh = (struct lcp_header *)skb_put(skb, sizeof(struct lcp_header));
 817         lh->type = type;
 818         lh->ident = ident;
 819         lh->len = htons (LCP_HEADER_LEN + len);
 820
 821         if (len)
 822                 memcpy(skb_put(skb,len),data, len);
 823
 824         if (sp->pp_flags & PP_DEBUG) {
 825                 printk (KERN_WARNING "%s: %s output <%s id=%xh len=%xh",
 826                         dev->name,
 827                         proto==PPP_LCP ? "lcp" : "ipcp",
 828                         proto==PPP_LCP ? sppp_lcp_type_name (lh->type) :
 829                         sppp_ipcp_type_name (lh->type), lh->ident,
 830                         ntohs (lh->len));
 831                 if (len)
 832                         sppp_print_bytes ((u8*) (lh+1), len);
 833                 printk (">\n");
 834         }
 835         sp->obytes += skb->len;
 836         /* Control is high priority so it doesn't get queued behind data */
 837         skb->priority=TC_PRIO_CONTROL;
 838         skb->dev = dev;
 839         skb_queue_tail(&tx_queue, skb);
 840 }
 841
 842 /*
 843  * Send Cisco keepalive packet.
 844  */
 845
 846 static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2)
 847 {
 848         struct ppp_header *h;
 849         struct cisco_packet *ch;
 850         struct sk_buff *skb;
 851         struct net_device *dev = sp->pp_if;
 852         u32 t = jiffies * 1000/HZ;
 853
 854         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+CISCO_PACKET_LEN,
 855                 GFP_ATOMIC);
 856
 857         if(skb==NULL)
 858                 return;
 859
 860         skb_reserve(skb, dev->hard_header_len);
 861         h = (struct ppp_header *)skb_put (skb, sizeof(struct ppp_header));
 862         h->address = CISCO_MULTICAST;
 863         h->control = 0;
 864         h->protocol = htons (CISCO_KEEPALIVE);
 865
 866         ch = (struct cisco_packet*)skb_put(skb, CISCO_PACKET_LEN);
 867         ch->type = htonl (type);
 868         ch->par1 = htonl (par1);
 869         ch->par2 = htonl (par2);
 870         ch->rel = -1;
 871         ch->time0 = htons ((u16) (t >> 16));
 872         ch->time1 = htons ((u16) t);
 873
 874         if (sp->pp_flags & PP_DEBUG)
 875                 printk (KERN_WARNING "%s: cisco output: <%xh %xh %xh %xh %xh-%xh>\n",
 876                         dev->name,  ntohl (ch->type), ch->par1,
 877                         ch->par2, ch->rel, ch->time0, ch->time1);
 878         sp->obytes += skb->len;
 879         skb->priority=TC_PRIO_CONTROL;
 880         skb->dev = dev;
 881         skb_queue_tail(&tx_queue, skb);
 882 }
 883
 884 /**
 885  *      sppp_close - close down a synchronous PPP or Cisco HDLC link
 886  *      @dev: The network device to drop the link of
 887  *
 888  *      This drops the logical interface to the channel. It is not
 889  *      done politely as we assume we will also be dropping DTR. Any
 890  *      timeouts are killed.
 891  */
 892
 893 int sppp_close (struct net_device *dev)
 894 {
 895         struct sppp *sp = (struct sppp *)sppp_of(dev);
 896         unsigned long flags;
 897
 898         spin_lock_irqsave(&sp->lock, flags);
 899         sp->pp_link_state = SPPP_LINK_DOWN;
 900         sp->lcp.state = LCP_STATE_CLOSED;
 901         sp->ipcp.state = IPCP_STATE_CLOSED;
 902         sppp_clear_timeout (sp);
 903         spin_unlock_irqrestore(&sp->lock, flags);
 904
 905         return 0;
 906 }
 907
 908 EXPORT_SYMBOL(sppp_close);
 909
 910 /**
 911  *      sppp_open - open a synchronous PPP or Cisco HDLC link
 912  *      @dev:   Network device to activate
 913  *
 914  *      Close down any existing synchronous session and commence
 915  *      from scratch. In the PPP case this means negotiating LCP/IPCP
 916  *      and friends, while for Cisco HDLC we simply need to start sending
 917  *      keepalives
 918  */
 919
 920 int sppp_open (struct net_device *dev)
 921 {
 922         struct sppp *sp = (struct sppp *)sppp_of(dev);
 923         unsigned long flags;
 924
 925         sppp_close(dev);
 926
 927         spin_lock_irqsave(&sp->lock, flags);
 928         if (!(sp->pp_flags & PP_CISCO)) {
 929                 sppp_lcp_open (sp);
 930         }
 931         sp->pp_link_state = SPPP_LINK_DOWN;
 932         spin_unlock_irqrestore(&sp->lock, flags);
 933         sppp_flush_xmit();
 934
 935         return 0;
 936 }
 937
 938 EXPORT_SYMBOL(sppp_open);
 939
 940 /**
 941  *      sppp_reopen - notify of physical link loss
 942  *      @dev: Device that lost the link
 943  *
 944  *      This function informs the synchronous protocol code that
 945  *      the underlying link died (for example a carrier drop on X.21)
 946  *
 947  *      We increment the magic numbers to ensure that if the other end
 948  *      failed to notice we will correctly start a new session. It happens
 949  *      do to the nature of telco circuits is that you can lose carrier on
 950  *      one endonly.
 951  *
 952  *      Having done this we go back to negotiating. This function may
 953  *      be called from an interrupt context.
 954  */
 955
 956 int sppp_reopen (struct net_device *dev)
 957 {
 958         struct sppp *sp = (struct sppp *)sppp_of(dev);
 959         unsigned long flags;
 960
 961         sppp_close(dev);
 962
 963         spin_lock_irqsave(&sp->lock, flags);
 964         if (!(sp->pp_flags & PP_CISCO))
 965         {
 966                 sp->lcp.magic = jiffies;
 967                 ++sp->pp_seq;
 968                 sp->lcp.state = LCP_STATE_CLOSED;
 969                 sp->ipcp.state = IPCP_STATE_CLOSED;
 970                 /* Give it a moment for the line to settle then go */
 971                 sppp_set_timeout (sp, 1);
 972         }
 973         sp->pp_link_state=SPPP_LINK_DOWN;
 974         spin_unlock_irqrestore(&sp->lock, flags);
 975
 976         return 0;
 977 }
 978
 979 EXPORT_SYMBOL(sppp_reopen);
 980
 981 /**
 982  *      sppp_change_mtu - Change the link MTU
 983  *      @dev:   Device to change MTU on
 984  *      @new_mtu: New MTU
 985  *
 986  *      Change the MTU on the link. This can only be called with
 987  *      the link down. It returns an error if the link is up or
 988  *      the mtu is out of range.
 989  */
 990
 991 static int sppp_change_mtu(struct net_device *dev, int new_mtu)
 992 {
 993         if(new_mtu<128||new_mtu>PPP_MTU||(dev->flags&IFF_UP))
 994                 return -EINVAL;
 995         dev->mtu=new_mtu;
 996         return 0;
 997 }
 998
 999 /**
1000  *      sppp_do_ioctl - Ioctl handler for ppp/hdlc
1001  *      @dev: Device subject to ioctl
1002  *      @ifr: Interface request block from the user
1003  *      @cmd: Command that is being issued
1004  *
1005  *      This function handles the ioctls that may be issued by the user
1006  *      to control the settings of a PPP/HDLC link. It does both busy
1007  *      and security checks. This function is intended to be wrapped by
1008  *      callers who wish to add additional ioctl calls of their own.
1009  */
1010
1011 int sppp_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1012 {
1013         struct sppp *sp = (struct sppp *)sppp_of(dev);
1014
1015         if(dev->flags&IFF_UP)
1016                 return -EBUSY;
1017
1018         if(!capable(CAP_NET_ADMIN))
1019                 return -EPERM;
1020
1021         switch(cmd)
1022         {
1023                 case SPPPIOCCISCO:
1024                         sp->pp_flags|=PP_CISCO;
1025                         dev->type = ARPHRD_HDLC;
1026                         break;
1027                 case SPPPIOCPPP:
1028                         sp->pp_flags&=~PP_CISCO;
1029                         dev->type = ARPHRD_PPP;
1030                         break;
1031                 case SPPPIOCDEBUG:
1032                         sp->pp_flags&=~PP_DEBUG;
1033                         if(ifr->ifr_flags)
1034                                 sp->pp_flags|=PP_DEBUG;
1035                         break;
1036                 case SPPPIOCGFLAGS:
1037                         if(copy_to_user(ifr->ifr_data, &sp->pp_flags, sizeof(sp->pp_flags)))
1038                                 return -EFAULT;
1039                         break;
1040                 case SPPPIOCSFLAGS:
1041                         if(copy_from_user(&sp->pp_flags, ifr->ifr_data, sizeof(sp->pp_flags)))
1042                                 return -EFAULT;
1043                         break;
1044                 default:
1045                         return -EINVAL;
1046         }
1047         return 0;
1048 }
1049
1050 EXPORT_SYMBOL(sppp_do_ioctl);
1051
1052 /**
1053  *      sppp_attach - attach synchronous PPP/HDLC to a device
1054  *      @pd:    PPP device to initialise
1055  *
1056  *      This initialises the PPP/HDLC support on an interface. At the
1057  *      time of calling the dev element must point to the network device
1058  *      that this interface is attached to. The interface should not yet
1059  *      be registered.
1060  */
1061
1062 void sppp_attach(struct ppp_device *pd)
1063 {
1064         struct net_device *dev = pd->dev;
1065         struct sppp *sp = &pd->sppp;
1066         unsigned long flags;
1067
1068         /* Make sure embedding is safe for sppp_of */
1069         BUG_ON(sppp_of(dev) != sp);
1070
1071         spin_lock_irqsave(&spppq_lock, flags);
1072         /* Initialize keepalive handler. */
1073         if (! spppq)
1074         {
1075                 init_timer(&sppp_keepalive_timer);
1076                 sppp_keepalive_timer.expires=jiffies+10*HZ;
1077                 sppp_keepalive_timer.function=sppp_keepalive;
1078                 add_timer(&sppp_keepalive_timer);
1079         }
1080         /* Insert new entry into the keepalive list. */
1081         sp->pp_next = spppq;
1082         spppq = sp;
1083         spin_unlock_irqrestore(&spppq_lock, flags);
1084
1085         sp->pp_loopcnt = 0;
1086         sp->pp_alivecnt = 0;
1087         sp->pp_seq = 0;
1088         sp->pp_rseq = 0;
1089         sp->pp_flags = PP_KEEPALIVE|PP_CISCO|debug;/*PP_DEBUG;*/
1090         sp->lcp.magic = 0;
1091         sp->lcp.state = LCP_STATE_CLOSED;
1092         sp->ipcp.state = IPCP_STATE_CLOSED;
1093         sp->pp_if = dev;
1094         spin_lock_init(&sp->lock);
1095
1096         /*
1097          *      Device specific setup. All but interrupt handler and
1098          *      hard_start_xmit.
1099          */
1100
1101         dev->hard_header = sppp_hard_header;
1102         dev->rebuild_header = sppp_rebuild_header;
1103         dev->tx_queue_len = 10;
1104         dev->type = ARPHRD_HDLC;
1105         dev->addr_len = 0;
1106         dev->hard_header_len = sizeof(struct ppp_header);
1107         dev->mtu = PPP_MTU;
1108         /*
1109          *      These 4 are callers but MUST also call sppp_ functions
1110          */
1111         dev->do_ioctl = sppp_do_ioctl;
1112 #if 0
1113         dev->get_stats = NULL;          /* Let the driver override these */
1114         dev->open = sppp_open;
1115         dev->stop = sppp_close;
1116 #endif
1117         dev->change_mtu = sppp_change_mtu;
1118         dev->hard_header_cache = NULL;
1119         dev->header_cache_update = NULL;
1120         dev->flags = IFF_MULTICAST|IFF_POINTOPOINT|IFF_NOARP;
1121 }
1122
1123 EXPORT_SYMBOL(sppp_attach);
1124
1125 /**
1126  *      sppp_detach - release PPP resources from a device
1127  *      @dev:   Network device to release
1128  *
1129  *      Stop and free up any PPP/HDLC resources used by this
1130  *      interface. This must be called before the device is
1131  *      freed.
1132  */
1133
1134 void sppp_detach (struct net_device *dev)
1135 {
1136         struct sppp **q, *p, *sp = (struct sppp *)sppp_of(dev);
1137         unsigned long flags;
1138
1139         spin_lock_irqsave(&spppq_lock, flags);
1140         /* Remove the entry from the keepalive list. */
1141         for (q = &spppq; (p = *q); q = &p->pp_next)
1142                 if (p == sp) {
1143                         *q = p->pp_next;
1144                         break;
1145                 }
1146
1147         /* Stop keepalive handler. */
1148         if (! spppq)
1149                 del_timer(&sppp_keepalive_timer);
1150         sppp_clear_timeout (sp);
1151         spin_unlock_irqrestore(&spppq_lock, flags);
1152 }
1153
1154 EXPORT_SYMBOL(sppp_detach);
1155
1156 /*
1157  * Analyze the LCP Configure-Request options list
1158  * for the presence of unknown options.
1159  * If the request contains unknown options, build and
1160  * send Configure-reject packet, containing only unknown options.
1161  */
1162 static int
1163 sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
1164         int len, u32 *magic)
1165 {
1166         u8 *buf, *r, *p;
1167         int rlen;
1168
1169         len -= 4;
1170         buf = r = kmalloc (len, GFP_ATOMIC);
1171         if (! buf)
1172                 return (0);
1173
1174         p = (void*) (h+1);
1175         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
1176                 switch (*p) {
1177                 case LCP_OPT_MAGIC:
1178                         /* Magic number -- extract. */
1179                         if (len >= 6 && p[1] == 6) {
1180                                 *magic = (u32)p[2] << 24 |
1181                                         (u32)p[3] << 16 | p[4] << 8 | p[5];
1182                                 continue;
1183                         }
1184                         break;
1185                 case LCP_OPT_ASYNC_MAP:
1186                         /* Async control character map -- check to be zero. */
1187                         if (len >= 6 && p[1] == 6 && ! p[2] && ! p[3] &&
1188                             ! p[4] && ! p[5])
1189                                 continue;
1190                         break;
1191                 case LCP_OPT_MRU:
1192                         /* Maximum receive unit -- always OK. */
1193                         continue;
1194                 default:
1195                         /* Others not supported. */
1196                         break;
1197                 }
1198                 /* Add the option to rejected list. */
1199                 memcpy(r, p, p[1]);
1200                 r += p[1];
1201                 rlen += p[1];
1202         }
1203         if (rlen)
1204                 sppp_cp_send (sp, PPP_LCP, LCP_CONF_REJ, h->ident, rlen, buf);
1205         kfree(buf);
1206         return (rlen == 0);
1207 }
1208
1209 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *skb)
1210 {
1211         struct lcp_header *h;
1212         struct net_device *dev = sp->pp_if;
1213         int len = skb->len;
1214
1215         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
1216                 if (sp->pp_flags & PP_DEBUG)
1217                         printk (KERN_WARNING "%s: invalid ipcp packet length: %d bytes\n",
1218                                 dev->name,  len);
1219                 return;
1220         }
1221         h = (struct lcp_header *)skb->data;
1222         skb_pull(skb,sizeof(struct lcp_header));
1223         if (sp->pp_flags & PP_DEBUG) {
1224                 printk (KERN_WARNING "%s: ipcp input: %d bytes <%s id=%xh len=%xh",
1225                         dev->name,  len,
1226                         sppp_ipcp_type_name (h->type), h->ident, ntohs (h->len));
1227                 if (len > 4)
1228                         sppp_print_bytes ((u8*) (h+1), len-4);
1229                 printk (">\n");
1230         }
1231         if (len > ntohs (h->len))
1232                 len = ntohs (h->len);
1233         switch (h->type) {
1234         default:
1235                 /* Unknown packet type -- send Code-Reject packet. */
1236                 sppp_cp_send (sp, PPP_IPCP, IPCP_CODE_REJ, ++sp->pp_seq, len, h);
1237                 break;
1238         case IPCP_CONF_REQ:
1239                 if (len < 4) {
1240                         if (sp->pp_flags & PP_DEBUG)
1241                                 printk (KERN_WARNING "%s: invalid ipcp configure request packet length: %d bytes\n",
1242                                         dev->name, len);
1243                         return;
1244                 }
1245                 if (len > 4) {
1246                         sppp_cp_send (sp, PPP_IPCP, LCP_CONF_REJ, h->ident,
1247                                 len-4, h+1);
1248
1249                         switch (sp->ipcp.state) {
1250                         case IPCP_STATE_OPENED:
1251                                 /* Initiate renegotiation. */
1252                                 sppp_ipcp_open (sp);
1253                                 /* fall through... */
1254                         case IPCP_STATE_ACK_SENT:
1255                                 /* Go to closed state. */
1256                                 sp->ipcp.state = IPCP_STATE_CLOSED;
1257                         }
1258                 } else {
1259                         /* Send Configure-Ack packet. */
1260                         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_ACK, h->ident,
1261                                 0, NULL);
1262                         /* Change the state. */
1263                         if (sp->ipcp.state == IPCP_STATE_ACK_RCVD)
1264                                 sp->ipcp.state = IPCP_STATE_OPENED;
1265                         else
1266                                 sp->ipcp.state = IPCP_STATE_ACK_SENT;
1267                 }
1268                 break;
1269         case IPCP_CONF_ACK:
1270                 if (h->ident != sp->ipcp.confid)
1271                         break;
1272                 sppp_clear_timeout (sp);
1273                 switch (sp->ipcp.state) {
1274                 case IPCP_STATE_CLOSED:
1275                         sp->ipcp.state = IPCP_STATE_ACK_RCVD;
1276                         sppp_set_timeout (sp, 5);
1277                         break;
1278                 case IPCP_STATE_ACK_SENT:
1279                         sp->ipcp.state = IPCP_STATE_OPENED;
1280                         break;
1281                 }
1282                 break;
1283         case IPCP_CONF_NAK:
1284         case IPCP_CONF_REJ:
1285                 if (h->ident != sp->ipcp.confid)
1286                         break;
1287                 sppp_clear_timeout (sp);
1288                         /* Initiate renegotiation. */
1289                 sppp_ipcp_open (sp);
1290                 if (sp->ipcp.state != IPCP_STATE_ACK_SENT)
1291                         /* Go to closed state. */
1292                         sp->ipcp.state = IPCP_STATE_CLOSED;
1293                 break;
1294         case IPCP_TERM_REQ:
1295                 /* Send Terminate-Ack packet. */
1296                 sppp_cp_send (sp, PPP_IPCP, IPCP_TERM_ACK, h->ident, 0, NULL);
1297                 /* Go to closed state. */
1298                 sp->ipcp.state = IPCP_STATE_CLOSED;
1299                 /* Initiate renegotiation. */
1300                 sppp_ipcp_open (sp);
1301                 break;
1302         case IPCP_TERM_ACK:
1303                 /* Ignore for now. */
1304         case IPCP_CODE_REJ:
1305                 /* Ignore for now. */
1306                 break;
1307         }
1308 }
1309
1310 static void sppp_lcp_open (struct sppp *sp)
1311 {
1312         char opt[6];
1313
1314         if (! sp->lcp.magic)
1315                 sp->lcp.magic = jiffies;
1316         opt[0] = LCP_OPT_MAGIC;
1317         opt[1] = sizeof (opt);
1318         opt[2] = sp->lcp.magic >> 24;
1319         opt[3] = sp->lcp.magic >> 16;
1320         opt[4] = sp->lcp.magic >> 8;
1321         opt[5] = sp->lcp.magic;
1322         sp->lcp.confid = ++sp->pp_seq;
1323         sppp_cp_send (sp, PPP_LCP, LCP_CONF_REQ, sp->lcp.confid,
1324                 sizeof (opt), &opt);
1325         sppp_set_timeout (sp, 2);
1326 }
1327
1328 static void sppp_ipcp_open (struct sppp *sp)
1329 {
1330         sp->ipcp.confid = ++sp->pp_seq;
1331         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_REQ, sp->ipcp.confid, 0, NULL);
1332         sppp_set_timeout (sp, 2);
1333 }
1334
1335 /*
1336  * Process PPP control protocol timeouts.
1337  */
1338
1339 static void sppp_cp_timeout (unsigned long arg)
1340 {
1341         struct sppp *sp = (struct sppp*) arg;
1342         unsigned long flags;
1343
1344         spin_lock_irqsave(&sp->lock, flags);
1345
1346         sp->pp_flags &= ~PP_TIMO;
1347         if (! (sp->pp_if->flags & IFF_UP) || (sp->pp_flags & PP_CISCO)) {
1348                 spin_unlock_irqrestore(&sp->lock, flags);
1349                 return;
1350         }
1351         switch (sp->lcp.state) {
1352         case LCP_STATE_CLOSED:
1353                 /* No ACK for Configure-Request, retry. */
1354                 sppp_lcp_open (sp);
1355                 break;
1356         case LCP_STATE_ACK_RCVD:
1357                 /* ACK got, but no Configure-Request for peer, retry. */
1358                 sppp_lcp_open (sp);
1359                 sp->lcp.state = LCP_STATE_CLOSED;
1360                 break;
1361         case LCP_STATE_ACK_SENT:
1362                 /* ACK sent but no ACK for Configure-Request, retry. */
1363                 sppp_lcp_open (sp);
1364                 break;
1365         case LCP_STATE_OPENED:
1366                 /* LCP is already OK, try IPCP. */
1367                 switch (sp->ipcp.state) {
1368                 case IPCP_STATE_CLOSED:
1369                         /* No ACK for Configure-Request, retry. */
1370                         sppp_ipcp_open (sp);
1371                         break;
1372                 case IPCP_STATE_ACK_RCVD:
1373                         /* ACK got, but no Configure-Request for peer, retry. */
1374                         sppp_ipcp_open (sp);
1375                         sp->ipcp.state = IPCP_STATE_CLOSED;
1376                         break;
1377                 case IPCP_STATE_ACK_SENT:
1378                         /* ACK sent but no ACK for Configure-Request, retry. */
1379                         sppp_ipcp_open (sp);
1380                         break;
1381                 case IPCP_STATE_OPENED:
1382                         /* IPCP is OK. */
1383                         break;
1384                 }
1385                 break;
1386         }
1387         spin_unlock_irqrestore(&sp->lock, flags);
1388         sppp_flush_xmit();
1389 }
1390
1391 static char *sppp_lcp_type_name (u8 type)
1392 {
1393         static char buf [8];
1394         switch (type) {
1395         case LCP_CONF_REQ:   return ("conf-req");
1396         case LCP_CONF_ACK:   return ("conf-ack");
1397         case LCP_CONF_NAK:   return ("conf-nack");
1398         case LCP_CONF_REJ:   return ("conf-rej");
1399         case LCP_TERM_REQ:   return ("term-req");
1400         case LCP_TERM_ACK:   return ("term-ack");
1401         case LCP_CODE_REJ:   return ("code-rej");
1402         case LCP_PROTO_REJ:  return ("proto-rej");
1403         case LCP_ECHO_REQ:   return ("echo-req");
1404         case LCP_ECHO_REPLY: return ("echo-reply");
1405         case LCP_DISC_REQ:   return ("discard-req");
1406         }
1407         sprintf (buf, "%xh", type);
1408         return (buf);
1409 }
1410
1411 static char *sppp_ipcp_type_name (u8 type)
1412 {
1413         static char buf [8];
1414         switch (type) {
1415         case IPCP_CONF_REQ:   return ("conf-req");
1416         case IPCP_CONF_ACK:   return ("conf-ack");
1417         case IPCP_CONF_NAK:   return ("conf-nack");
1418         case IPCP_CONF_REJ:   return ("conf-rej");
1419         case IPCP_TERM_REQ:   return ("term-req");
1420         case IPCP_TERM_ACK:   return ("term-ack");
1421         case IPCP_CODE_REJ:   return ("code-rej");
1422         }
1423         sprintf (buf, "%xh", type);
1424         return (buf);
1425 }
1426
1427 static void sppp_print_bytes (u_char *p, u16 len)
1428 {
1429         printk (" %x", *p++);
1430         while (--len > 0)
1431                 printk ("-%x", *p++);
1432 }
1433
1434 /**
1435  *      sppp_rcv -      receive and process a WAN PPP frame
1436  *      @skb:   The buffer to process
1437  *      @dev:   The device it arrived on
1438  *      @p: Unused
1439  *      @orig_dev: Unused
1440  *
1441  *      Protocol glue. This drives the deferred processing mode the poorer
1442  *      cards use. This can be called directly by cards that do not have
1443  *      timing constraints but is normally called from the network layer
1444  *      after interrupt servicing to process frames queued via netif_rx.
1445  */
1446
1447 static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
1448 {
1449         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
1450                 return NET_RX_DROP;
1451         sppp_input(dev,skb);
1452         return 0;
1453 }
1454
1455 static struct packet_type sppp_packet_type = {
1456         .type   = __constant_htons(ETH_P_WAN_PPP),
1457         .func   = sppp_rcv,
1458 };
1459
1460 static char banner[] __initdata =
1461         KERN_INFO "Cronyx Ltd, Synchronous PPP and CISCO HDLC (c) 1994\n"
1462         KERN_INFO "Linux port (c) 1998 Building Number Three Ltd & "
1463                   "Jan \"Yenya\" Kasprzak.\n";
1464
1465 static int __init sync_ppp_init(void)
1466 {
1467         if(debug)
1468                 debug=PP_DEBUG;
1469         printk(banner);
1470         skb_queue_head_init(&tx_queue);
1471         dev_add_pack(&sppp_packet_type);
1472         return 0;
1473 }
1474
1475
1476 static void __exit sync_ppp_cleanup(void)
1477 {
1478         dev_remove_pack(&sppp_packet_type);
1479 }
1480
1481 module_init(sync_ppp_init);
1482 module_exit(sync_ppp_cleanup);
1483 module_param(debug, int, 0);
1484 MODULE_LICENSE("GPL");
1485