drivers/net/wan/syncppp.c

   1 /*
   2  *      NET3:   A (fairly minimal) implementation of synchronous PPP for Linux
   3  *              as well as a CISCO HDLC implementation. See the copyright
   4  *              message below for the original source.
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the license, or (at your option) any later version.
  10  *
  11  *      Note however. This code is also used in a different form by FreeBSD.
  12  *      Therefore when making any non OS specific change please consider
  13  *      contributing it back to the original author under the terms
  14  *      below in addition.
  15  *              -- Alan
  16  *
  17  *      Port for Linux-2.1 by Jan "Yenya" Kasprzak <kas@fi.muni.cz>
  18  */
  19
  20 /*
  21  * Synchronous PPP/Cisco link level subroutines.
  22  * Keepalive protocol implemented in both Cisco and PPP modes.
  23  *
  24  * Copyright (C) 1994 Cronyx Ltd.
  25  * Author: Serge Vakulenko, <vak@zebub.msk.su>
  26  *
  27  * This software is distributed with NO WARRANTIES, not even the implied
  28  * warranties for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  29  *
  30  * Authors grant any other persons or organisations permission to use
  31  * or modify this software as long as this message is kept with the software,
  32  * all derivative works or modified versions.
  33  *
  34  * Version 1.9, Wed Oct  4 18:58:15 MSK 1995
  35  *
  36  * $Id: syncppp.c,v 1.18 2000/04/11 05:25:31 asj Exp $
  37  */
  38 #undef DEBUG
  39
  40 #include <linux/module.h>
  41 #include <linux/kernel.h>
  42 #include <linux/errno.h>
  43 #include <linux/init.h>
  44 #include <linux/if_arp.h>
  45 #include <linux/skbuff.h>
  46 #include <linux/route.h>
  47 #include <linux/netdevice.h>
  48 #include <linux/inetdevice.h>
  49 #include <linux/random.h>
  50 #include <linux/pkt_sched.h>
  51 #include <linux/spinlock.h>
  52 #include <linux/rcupdate.h>
  53
  54 #include <net/syncppp.h>
  55
  56 #include <asm/byteorder.h>
  57 #include <asm/uaccess.h>
  58
  59 #define MAXALIVECNT     6               /* max. alive packets */
  60
  61 #define PPP_ALLSTATIONS 0xff            /* All-Stations broadcast address */
  62 #define PPP_UI          0x03            /* Unnumbered Information */
  63 #define PPP_IP          0x0021          /* Internet Protocol */
  64 #define PPP_ISO         0x0023          /* ISO OSI Protocol */
  65 #define PPP_XNS         0x0025          /* Xerox NS Protocol */
  66 #define PPP_IPX         0x002b          /* Novell IPX Protocol */
  67 #define PPP_LCP         0xc021          /* Link Control Protocol */
  68 #define PPP_IPCP        0x8021          /* Internet Protocol Control Protocol */
  69
  70 #define LCP_CONF_REQ    1               /* PPP LCP configure request */
  71 #define LCP_CONF_ACK    2               /* PPP LCP configure acknowledge */
  72 #define LCP_CONF_NAK    3               /* PPP LCP configure negative ack */
  73 #define LCP_CONF_REJ    4               /* PPP LCP configure reject */
  74 #define LCP_TERM_REQ    5               /* PPP LCP terminate request */
  75 #define LCP_TERM_ACK    6               /* PPP LCP terminate acknowledge */
  76 #define LCP_CODE_REJ    7               /* PPP LCP code reject */
  77 #define LCP_PROTO_REJ   8               /* PPP LCP protocol reject */
  78 #define LCP_ECHO_REQ    9               /* PPP LCP echo request */
  79 #define LCP_ECHO_REPLY  10              /* PPP LCP echo reply */
  80 #define LCP_DISC_REQ    11              /* PPP LCP discard request */
  81
  82 #define LCP_OPT_MRU             1       /* maximum receive unit */
  83 #define LCP_OPT_ASYNC_MAP       2       /* async control character map */
  84 #define LCP_OPT_AUTH_PROTO      3       /* authentication protocol */
  85 #define LCP_OPT_QUAL_PROTO      4       /* quality protocol */
  86 #define LCP_OPT_MAGIC           5       /* magic number */
  87 #define LCP_OPT_RESERVED        6       /* reserved */
  88 #define LCP_OPT_PROTO_COMP      7       /* protocol field compression */
  89 #define LCP_OPT_ADDR_COMP       8       /* address/control field compression */
  90
  91 #define IPCP_CONF_REQ   LCP_CONF_REQ    /* PPP IPCP configure request */
  92 #define IPCP_CONF_ACK   LCP_CONF_ACK    /* PPP IPCP configure acknowledge */
  93 #define IPCP_CONF_NAK   LCP_CONF_NAK    /* PPP IPCP configure negative ack */
  94 #define IPCP_CONF_REJ   LCP_CONF_REJ    /* PPP IPCP configure reject */
  95 #define IPCP_TERM_REQ   LCP_TERM_REQ    /* PPP IPCP terminate request */
  96 #define IPCP_TERM_ACK   LCP_TERM_ACK    /* PPP IPCP terminate acknowledge */
  97 #define IPCP_CODE_REJ   LCP_CODE_REJ    /* PPP IPCP code reject */
  98
  99 #define CISCO_MULTICAST         0x8f    /* Cisco multicast address */
 100 #define CISCO_UNICAST           0x0f    /* Cisco unicast address */
 101 #define CISCO_KEEPALIVE         0x8035  /* Cisco keepalive protocol */
 102 #define CISCO_ADDR_REQ          0       /* Cisco address request */
 103 #define CISCO_ADDR_REPLY        1       /* Cisco address reply */
 104 #define CISCO_KEEPALIVE_REQ     2       /* Cisco keepalive request */
 105
 106 struct ppp_header {
 107         u8 address;
 108         u8 control;
 109         u16 protocol;
 110 };
 111 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
 112
 113 struct lcp_header {
 114         u8 type;
 115         u8 ident;
 116         u16 len;
 117 };
 118 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
 119
 120 struct cisco_packet {
 121         u32 type;
 122         u32 par1;
 123         u32 par2;
 124         u16 rel;
 125         u16 time0;
 126         u16 time1;
 127 };
 128 #define CISCO_PACKET_LEN 18
 129 #define CISCO_BIG_PACKET_LEN 20
 130
 131 static struct sppp *spppq;
 132 static struct timer_list sppp_keepalive_timer;
 133 static DEFINE_SPINLOCK(spppq_lock);
 134
 135 /* global xmit queue for sending packets while spinlock is held */
 136 static struct sk_buff_head tx_queue;
 137
 138 static void sppp_keepalive (unsigned long dummy);
 139 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
 140         u8 ident, u16 len, void *data);
 141 static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2);
 142 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *m);
 143 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *m);
 144 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *m);
 145 static void sppp_lcp_open (struct sppp *sp);
 146 static void sppp_ipcp_open (struct sppp *sp);
 147 static int sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
 148         int len, u32 *magic);
 149 static void sppp_cp_timeout (unsigned long arg);
 150 static char *sppp_lcp_type_name (u8 type);
 151 static char *sppp_ipcp_type_name (u8 type);
 152 static void sppp_print_bytes (u8 *p, u16 len);
 153
 154 static int debug;
 155
 156 /* Flush global outgoing packet queue to dev_queue_xmit().
 157  *
 158  * dev_queue_xmit() must be called with interrupts enabled
 159  * which means it can't be called with spinlocks held.
 160  * If a packet needs to be sent while a spinlock is held,
 161  * then put the packet into tx_queue, and call sppp_flush_xmit()
 162  * after spinlock is released.
 163  */
 164 static void sppp_flush_xmit(void)
 165 {
 166         struct sk_buff *skb;
 167         while ((skb = skb_dequeue(&tx_queue)) != NULL)
 168                 dev_queue_xmit(skb);
 169 }
 170
 171 /*
 172  *      Interface down stub
 173  */
 174
 175 static void if_down(struct net_device *dev)
 176 {
 177         struct sppp *sp = (struct sppp *)sppp_of(dev);
 178
 179         sp->pp_link_state=SPPP_LINK_DOWN;
 180 }
 181
 182 /*
 183  * Timeout routine activations.
 184  */
 185
 186 static void sppp_set_timeout(struct sppp *p,int s)
 187 {
 188         if (! (p->pp_flags & PP_TIMO))
 189         {
 190                 init_timer(&p->pp_timer);
 191                 p->pp_timer.function=sppp_cp_timeout;
 192                 p->pp_timer.expires=jiffies+s*HZ;
 193                 p->pp_timer.data=(unsigned long)p;
 194                 p->pp_flags |= PP_TIMO;
 195                 add_timer(&p->pp_timer);
 196         }
 197 }
 198
 199 static void sppp_clear_timeout(struct sppp *p)
 200 {
 201         if (p->pp_flags & PP_TIMO)
 202         {
 203                 del_timer(&p->pp_timer);
 204                 p->pp_flags &= ~PP_TIMO;
 205         }
 206 }
 207
 208 /**
 209  *      sppp_input -    receive and process a WAN PPP frame
 210  *      @skb:   The buffer to process
 211  *      @dev:   The device it arrived on
 212  *
 213  *      This can be called directly by cards that do not have
 214  *      timing constraints but is normally called from the network layer
 215  *      after interrupt servicing to process frames queued via netif_rx().
 216  *
 217  *      We process the options in the card. If the frame is destined for
 218  *      the protocol stacks then it requeues the frame for the upper level
 219  *      protocol. If it is a control from it is processed and discarded
 220  *      here.
 221  */
 222
 223 static void sppp_input (struct net_device *dev, struct sk_buff *skb)
 224 {
 225         struct ppp_header *h;
 226         struct sppp *sp = (struct sppp *)sppp_of(dev);
 227         unsigned long flags;
 228
 229         skb->dev=dev;
 230         skb->mac.raw=skb->data;
 231
 232         if (dev->flags & IFF_RUNNING)
 233         {
 234                 /* Count received bytes, add FCS and one flag */
 235                 sp->ibytes+= skb->len + 3;
 236                 sp->ipkts++;
 237         }
 238
 239         if (!pskb_may_pull(skb, PPP_HEADER_LEN)) {
 240                 /* Too small packet, drop it. */
 241                 if (sp->pp_flags & PP_DEBUG)
 242                         printk (KERN_DEBUG "%s: input packet is too small, %d bytes\n",
 243                                 dev->name, skb->len);
 244                 kfree_skb(skb);
 245                 return;
 246         }
 247
 248         /* Get PPP header. */
 249         h = (struct ppp_header *)skb->data;
 250         skb_pull(skb,sizeof(struct ppp_header));
 251
 252         spin_lock_irqsave(&sp->lock, flags);
 253
 254         switch (h->address) {
 255         default:        /* Invalid PPP packet. */
 256                 goto invalid;
 257         case PPP_ALLSTATIONS:
 258                 if (h->control != PPP_UI)
 259                         goto invalid;
 260                 if (sp->pp_flags & PP_CISCO) {
 261                         if (sp->pp_flags & PP_DEBUG)
 262                                 printk (KERN_WARNING "%s: PPP packet in Cisco mode <0x%x 0x%x 0x%x>\n",
 263                                         dev->name,
 264                                         h->address, h->control, ntohs (h->protocol));
 265                         goto drop;
 266                 }
 267                 switch (ntohs (h->protocol)) {
 268                 default:
 269                         if (sp->lcp.state == LCP_STATE_OPENED)
 270                                 sppp_cp_send (sp, PPP_LCP, LCP_PROTO_REJ,
 271                                         ++sp->pp_seq, skb->len + 2,
 272                                         &h->protocol);
 273                         if (sp->pp_flags & PP_DEBUG)
 274                                 printk (KERN_WARNING "%s: invalid input protocol <0x%x 0x%x 0x%x>\n",
 275                                         dev->name,
 276                                         h->address, h->control, ntohs (h->protocol));
 277                         goto drop;
 278                 case PPP_LCP:
 279                         sppp_lcp_input (sp, skb);
 280                         goto drop;
 281                 case PPP_IPCP:
 282                         if (sp->lcp.state == LCP_STATE_OPENED)
 283                                 sppp_ipcp_input (sp, skb);
 284                         else
 285                                 printk(KERN_DEBUG "IPCP when still waiting LCP finish.\n");
 286                         goto drop;
 287                 case PPP_IP:
 288                         if (sp->ipcp.state == IPCP_STATE_OPENED) {
 289                                 if(sp->pp_flags&PP_DEBUG)
 290                                         printk(KERN_DEBUG "Yow an IP frame.\n");
 291                                 skb->protocol=htons(ETH_P_IP);
 292                                 netif_rx(skb);
 293                                 dev->last_rx = jiffies;
 294                                 goto done;
 295                         }
 296                         break;
 297 #ifdef IPX
 298                 case PPP_IPX:
 299                         /* IPX IPXCP not implemented yet */
 300                         if (sp->lcp.state == LCP_STATE_OPENED) {
 301                                 skb->protocol=htons(ETH_P_IPX);
 302                                 netif_rx(skb);
 303                                 dev->last_rx = jiffies;
 304                                 goto done;
 305                         }
 306                         break;
 307 #endif
 308                 }
 309                 break;
 310         case CISCO_MULTICAST:
 311         case CISCO_UNICAST:
 312                 /* Don't check the control field here (RFC 1547). */
 313                 if (! (sp->pp_flags & PP_CISCO)) {
 314                         if (sp->pp_flags & PP_DEBUG)
 315                                 printk (KERN_WARNING "%s: Cisco packet in PPP mode <0x%x 0x%x 0x%x>\n",
 316                                         dev->name,
 317                                         h->address, h->control, ntohs (h->protocol));
 318                         goto drop;
 319                 }
 320                 switch (ntohs (h->protocol)) {
 321                 default:
 322                         goto invalid;
 323                 case CISCO_KEEPALIVE:
 324                         sppp_cisco_input (sp, skb);
 325                         goto drop;
 326 #ifdef CONFIG_INET
 327                 case ETH_P_IP:
 328                         skb->protocol=htons(ETH_P_IP);
 329                         netif_rx(skb);
 330                         dev->last_rx = jiffies;
 331                         goto done;
 332 #endif
 333 #ifdef CONFIG_IPX
 334                 case ETH_P_IPX:
 335                         skb->protocol=htons(ETH_P_IPX);
 336                         netif_rx(skb);
 337                         dev->last_rx = jiffies;
 338                         goto done;
 339 #endif
 340                 }
 341                 break;
 342         }
 343         goto drop;
 344
 345 invalid:
 346         if (sp->pp_flags & PP_DEBUG)
 347                 printk (KERN_WARNING "%s: invalid input packet <0x%x 0x%x 0x%x>\n",
 348                         dev->name, h->address, h->control, ntohs (h->protocol));
 349 drop:
 350         kfree_skb(skb);
 351 done:
 352         spin_unlock_irqrestore(&sp->lock, flags);
 353         sppp_flush_xmit();
 354         return;
 355 }
 356
 357 /*
 358  *      Handle transmit packets.
 359  */
 360
 361 static int sppp_hard_header(struct sk_buff *skb, struct net_device *dev, __u16 type,
 362                 void *daddr, void *saddr, unsigned int len)
 363 {
 364         struct sppp *sp = (struct sppp *)sppp_of(dev);
 365         struct ppp_header *h;
 366         skb_push(skb,sizeof(struct ppp_header));
 367         h=(struct ppp_header *)skb->data;
 368         if(sp->pp_flags&PP_CISCO)
 369         {
 370                 h->address = CISCO_UNICAST;
 371                 h->control = 0;
 372         }
 373         else
 374         {
 375                 h->address = PPP_ALLSTATIONS;
 376                 h->control = PPP_UI;
 377         }
 378         if(sp->pp_flags & PP_CISCO)
 379         {
 380                 h->protocol = htons(type);
 381         }
 382         else switch(type)
 383         {
 384                 case ETH_P_IP:
 385                         h->protocol = htons(PPP_IP);
 386                         break;
 387                 case ETH_P_IPX:
 388                         h->protocol = htons(PPP_IPX);
 389                         break;
 390         }
 391         return sizeof(struct ppp_header);
 392 }
 393
 394 static int sppp_rebuild_header(struct sk_buff *skb)
 395 {
 396         return 0;
 397 }
 398
 399 /*
 400  * Send keepalive packets, every 10 seconds.
 401  */
 402
 403 static void sppp_keepalive (unsigned long dummy)
 404 {
 405         struct sppp *sp;
 406         unsigned long flags;
 407
 408         spin_lock_irqsave(&spppq_lock, flags);
 409
 410         for (sp=spppq; sp; sp=sp->pp_next)
 411         {
 412                 struct net_device *dev = sp->pp_if;
 413
 414                 /* Keepalive mode disabled or channel down? */
 415                 if (! (sp->pp_flags & PP_KEEPALIVE) ||
 416                     ! (dev->flags & IFF_UP))
 417                         continue;
 418
 419                 spin_lock(&sp->lock);
 420
 421                 /* No keepalive in PPP mode if LCP not opened yet. */
 422                 if (! (sp->pp_flags & PP_CISCO) &&
 423                     sp->lcp.state != LCP_STATE_OPENED) {
 424                         spin_unlock(&sp->lock);
 425                         continue;
 426                 }
 427
 428                 if (sp->pp_alivecnt == MAXALIVECNT) {
 429                         /* No keepalive packets got.  Stop the interface. */
 430                         printk (KERN_WARNING "%s: protocol down\n", dev->name);
 431                         if_down (dev);
 432                         if (! (sp->pp_flags & PP_CISCO)) {
 433                                 /* Shut down the PPP link. */
 434                                 sp->lcp.magic = jiffies;
 435                                 sp->lcp.state = LCP_STATE_CLOSED;
 436                                 sp->ipcp.state = IPCP_STATE_CLOSED;
 437                                 sppp_clear_timeout (sp);
 438                                 /* Initiate negotiation. */
 439                                 sppp_lcp_open (sp);
 440                         }
 441                 }
 442                 if (sp->pp_alivecnt <= MAXALIVECNT)
 443                         ++sp->pp_alivecnt;
 444                 if (sp->pp_flags & PP_CISCO)
 445                         sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
 446                                 sp->pp_rseq);
 447                 else if (sp->lcp.state == LCP_STATE_OPENED) {
 448                         long nmagic = htonl (sp->lcp.magic);
 449                         sp->lcp.echoid = ++sp->pp_seq;
 450                         sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REQ,
 451                                 sp->lcp.echoid, 4, &nmagic);
 452                 }
 453
 454                 spin_unlock(&sp->lock);
 455         }
 456         spin_unlock_irqrestore(&spppq_lock, flags);
 457         sppp_flush_xmit();
 458         sppp_keepalive_timer.expires=jiffies+10*HZ;
 459         add_timer(&sppp_keepalive_timer);
 460 }
 461
 462 /*
 463  * Handle incoming PPP Link Control Protocol packets.
 464  */
 465
 466 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *skb)
 467 {
 468         struct lcp_header *h;
 469         struct net_device *dev = sp->pp_if;
 470         int len = skb->len;
 471         u8 *p, opt[6];
 472         u32 rmagic;
 473
 474         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
 475                 if (sp->pp_flags & PP_DEBUG)
 476                         printk (KERN_WARNING "%s: invalid lcp packet length: %d bytes\n",
 477                                 dev->name, len);
 478                 return;
 479         }
 480         h = (struct lcp_header *)skb->data;
 481         skb_pull(skb,sizeof(struct lcp_header *));
 482
 483         if (sp->pp_flags & PP_DEBUG)
 484         {
 485                 char state = '?';
 486                 switch (sp->lcp.state) {
 487                 case LCP_STATE_CLOSED:   state = 'C'; break;
 488                 case LCP_STATE_ACK_RCVD: state = 'R'; break;
 489                 case LCP_STATE_ACK_SENT: state = 'S'; break;
 490                 case LCP_STATE_OPENED:   state = 'O'; break;
 491                 }
 492                 printk (KERN_WARNING "%s: lcp input(%c): %d bytes <%s id=%xh len=%xh",
 493                         dev->name, state, len,
 494                         sppp_lcp_type_name (h->type), h->ident, ntohs (h->len));
 495                 if (len > 4)
 496                         sppp_print_bytes ((u8*) (h+1), len-4);
 497                 printk (">\n");
 498         }
 499         if (len > ntohs (h->len))
 500                 len = ntohs (h->len);
 501         switch (h->type) {
 502         default:
 503                 /* Unknown packet type -- send Code-Reject packet. */
 504                 sppp_cp_send (sp, PPP_LCP, LCP_CODE_REJ, ++sp->pp_seq,
 505                         skb->len, h);
 506                 break;
 507         case LCP_CONF_REQ:
 508                 if (len < 4) {
 509                         if (sp->pp_flags & PP_DEBUG)
 510                                 printk (KERN_DEBUG"%s: invalid lcp configure request packet length: %d bytes\n",
 511                                         dev->name, len);
 512                         break;
 513                 }
 514                 if (len>4 && !sppp_lcp_conf_parse_options (sp, h, len, &rmagic))
 515                         goto badreq;
 516                 if (rmagic == sp->lcp.magic) {
 517                         /* Local and remote magics equal -- loopback? */
 518                         if (sp->pp_loopcnt >= MAXALIVECNT*5) {
 519                                 printk (KERN_WARNING "%s: loopback\n",
 520                                         dev->name);
 521                                 sp->pp_loopcnt = 0;
 522                                 if (dev->flags & IFF_UP) {
 523                                         if_down (dev);
 524                                 }
 525                         } else if (sp->pp_flags & PP_DEBUG)
 526                                 printk (KERN_DEBUG "%s: conf req: magic glitch\n",
 527                                         dev->name);
 528                         ++sp->pp_loopcnt;
 529
 530                         /* MUST send Conf-Nack packet. */
 531                         rmagic = ~sp->lcp.magic;
 532                         opt[0] = LCP_OPT_MAGIC;
 533                         opt[1] = sizeof (opt);
 534                         opt[2] = rmagic >> 24;
 535                         opt[3] = rmagic >> 16;
 536                         opt[4] = rmagic >> 8;
 537                         opt[5] = rmagic;
 538                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_NAK,
 539                                 h->ident, sizeof (opt), &opt);
 540 badreq:
 541                         switch (sp->lcp.state) {
 542                         case LCP_STATE_OPENED:
 543                                 /* Initiate renegotiation. */
 544                                 sppp_lcp_open (sp);
 545                                 /* fall through... */
 546                         case LCP_STATE_ACK_SENT:
 547                                 /* Go to closed state. */
 548                                 sp->lcp.state = LCP_STATE_CLOSED;
 549                                 sp->ipcp.state = IPCP_STATE_CLOSED;
 550                         }
 551                         break;
 552                 }
 553                 /* Send Configure-Ack packet. */
 554                 sp->pp_loopcnt = 0;
 555                 if (sp->lcp.state != LCP_STATE_OPENED) {
 556                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
 557                                         h->ident, len-4, h+1);
 558                 }
 559                 /* Change the state. */
 560                 switch (sp->lcp.state) {
 561                 case LCP_STATE_CLOSED:
 562                         sp->lcp.state = LCP_STATE_ACK_SENT;
 563                         break;
 564                 case LCP_STATE_ACK_RCVD:
 565                         sp->lcp.state = LCP_STATE_OPENED;
 566                         sppp_ipcp_open (sp);
 567                         break;
 568                 case LCP_STATE_OPENED:
 569                         /* Remote magic changed -- close session. */
 570                         sp->lcp.state = LCP_STATE_CLOSED;
 571                         sp->ipcp.state = IPCP_STATE_CLOSED;
 572                         /* Initiate renegotiation. */
 573                         sppp_lcp_open (sp);
 574                         /* Send ACK after our REQ in attempt to break loop */
 575                         sppp_cp_send (sp, PPP_LCP, LCP_CONF_ACK,
 576                                         h->ident, len-4, h+1);
 577                         sp->lcp.state = LCP_STATE_ACK_SENT;
 578                         break;
 579                 }
 580                 break;
 581         case LCP_CONF_ACK:
 582                 if (h->ident != sp->lcp.confid)
 583                         break;
 584                 sppp_clear_timeout (sp);
 585                 if ((sp->pp_link_state != SPPP_LINK_UP) &&
 586                     (dev->flags & IFF_UP)) {
 587                         /* Coming out of loopback mode. */
 588                         sp->pp_link_state=SPPP_LINK_UP;
 589                         printk (KERN_INFO "%s: protocol up\n", dev->name);
 590                 }
 591                 switch (sp->lcp.state) {
 592                 case LCP_STATE_CLOSED:
 593                         sp->lcp.state = LCP_STATE_ACK_RCVD;
 594                         sppp_set_timeout (sp, 5);
 595                         break;
 596                 case LCP_STATE_ACK_SENT:
 597                         sp->lcp.state = LCP_STATE_OPENED;
 598                         sppp_ipcp_open (sp);
 599                         break;
 600                 }
 601                 break;
 602         case LCP_CONF_NAK:
 603                 if (h->ident != sp->lcp.confid)
 604                         break;
 605                 p = (u8*) (h+1);
 606                 if (len>=10 && p[0] == LCP_OPT_MAGIC && p[1] >= 4) {
 607                         rmagic = (u32)p[2] << 24 |
 608                                 (u32)p[3] << 16 | p[4] << 8 | p[5];
 609                         if (rmagic == ~sp->lcp.magic) {
 610                                 int newmagic;
 611                                 if (sp->pp_flags & PP_DEBUG)
 612                                         printk (KERN_DEBUG "%s: conf nak: magic glitch\n",
 613                                                 dev->name);
 614                                 get_random_bytes(&newmagic, sizeof(newmagic));
 615                                 sp->lcp.magic += newmagic;
 616                         } else
 617                                 sp->lcp.magic = rmagic;
 618                         }
 619                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
 620                         /* Go to closed state. */
 621                         sp->lcp.state = LCP_STATE_CLOSED;
 622                         sp->ipcp.state = IPCP_STATE_CLOSED;
 623                 }
 624                 /* The link will be renegotiated after timeout,
 625                  * to avoid endless req-nack loop. */
 626                 sppp_clear_timeout (sp);
 627                 sppp_set_timeout (sp, 2);
 628                 break;
 629         case LCP_CONF_REJ:
 630                 if (h->ident != sp->lcp.confid)
 631                         break;
 632                 sppp_clear_timeout (sp);
 633                 /* Initiate renegotiation. */
 634                 sppp_lcp_open (sp);
 635                 if (sp->lcp.state != LCP_STATE_ACK_SENT) {
 636                         /* Go to closed state. */
 637                         sp->lcp.state = LCP_STATE_CLOSED;
 638                         sp->ipcp.state = IPCP_STATE_CLOSED;
 639                 }
 640                 break;
 641         case LCP_TERM_REQ:
 642                 sppp_clear_timeout (sp);
 643                 /* Send Terminate-Ack packet. */
 644                 sppp_cp_send (sp, PPP_LCP, LCP_TERM_ACK, h->ident, 0, NULL);
 645                 /* Go to closed state. */
 646                 sp->lcp.state = LCP_STATE_CLOSED;
 647                 sp->ipcp.state = IPCP_STATE_CLOSED;
 648                 /* Initiate renegotiation. */
 649                 sppp_lcp_open (sp);
 650                 break;
 651         case LCP_TERM_ACK:
 652         case LCP_CODE_REJ:
 653         case LCP_PROTO_REJ:
 654                 /* Ignore for now. */
 655                 break;
 656         case LCP_DISC_REQ:
 657                 /* Discard the packet. */
 658                 break;
 659         case LCP_ECHO_REQ:
 660                 if (sp->lcp.state != LCP_STATE_OPENED)
 661                         break;
 662                 if (len < 8) {
 663                         if (sp->pp_flags & PP_DEBUG)
 664                                 printk (KERN_WARNING "%s: invalid lcp echo request packet length: %d bytes\n",
 665                                         dev->name, len);
 666                         break;
 667                 }
 668                 if (ntohl (*(long*)(h+1)) == sp->lcp.magic) {
 669                         /* Line loopback mode detected. */
 670                         printk (KERN_WARNING "%s: loopback\n", dev->name);
 671                         if_down (dev);
 672
 673                         /* Shut down the PPP link. */
 674                         sp->lcp.state = LCP_STATE_CLOSED;
 675                         sp->ipcp.state = IPCP_STATE_CLOSED;
 676                         sppp_clear_timeout (sp);
 677                         /* Initiate negotiation. */
 678                         sppp_lcp_open (sp);
 679                         break;
 680                 }
 681                 *(long*)(h+1) = htonl (sp->lcp.magic);
 682                 sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REPLY, h->ident, len-4, h+1);
 683                 break;
 684         case LCP_ECHO_REPLY:
 685                 if (h->ident != sp->lcp.echoid)
 686                         break;
 687                 if (len < 8) {
 688                         if (sp->pp_flags & PP_DEBUG)
 689                                 printk (KERN_WARNING "%s: invalid lcp echo reply packet length: %d bytes\n",
 690                                         dev->name, len);
 691                         break;
 692                 }
 693                 if (ntohl (*(long*)(h+1)) != sp->lcp.magic)
 694                 sp->pp_alivecnt = 0;
 695                 break;
 696         }
 697 }
 698
 699 /*
 700  * Handle incoming Cisco keepalive protocol packets.
 701  */
 702
 703 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
 704 {
 705         struct cisco_packet *h;
 706         struct net_device *dev = sp->pp_if;
 707
 708         if (!pskb_may_pull(skb, sizeof(struct cisco_packet))
 709             || (skb->len != CISCO_PACKET_LEN
 710                 && skb->len != CISCO_BIG_PACKET_LEN)) {
 711                 if (sp->pp_flags & PP_DEBUG)
 712                         printk (KERN_WARNING "%s: invalid cisco packet length: %d bytes\n",
 713                                 dev->name,  skb->len);
 714                 return;
 715         }
 716         h = (struct cisco_packet *)skb->data;
 717         skb_pull(skb, sizeof(struct cisco_packet*));
 718         if (sp->pp_flags & PP_DEBUG)
 719                 printk (KERN_WARNING "%s: cisco input: %d bytes <%xh %xh %xh %xh %xh-%xh>\n",
 720                         dev->name,  skb->len,
 721                         ntohl (h->type), h->par1, h->par2, h->rel,
 722                         h->time0, h->time1);
 723         switch (ntohl (h->type)) {
 724         default:
 725                 if (sp->pp_flags & PP_DEBUG)
 726                         printk (KERN_WARNING "%s: unknown cisco packet type: 0x%x\n",
 727                                 dev->name,  ntohl (h->type));
 728                 break;
 729         case CISCO_ADDR_REPLY:
 730                 /* Reply on address request, ignore */
 731                 break;
 732         case CISCO_KEEPALIVE_REQ:
 733                 sp->pp_alivecnt = 0;
 734                 sp->pp_rseq = ntohl (h->par1);
 735                 if (sp->pp_seq == sp->pp_rseq) {
 736                         /* Local and remote sequence numbers are equal.
 737                          * Probably, the line is in loopback mode. */
 738                         int newseq;
 739                         if (sp->pp_loopcnt >= MAXALIVECNT) {
 740                                 printk (KERN_WARNING "%s: loopback\n",
 741                                         dev->name);
 742                                 sp->pp_loopcnt = 0;
 743                                 if (dev->flags & IFF_UP) {
 744                                         if_down (dev);
 745                                 }
 746                         }
 747                         ++sp->pp_loopcnt;
 748
 749                         /* Generate new local sequence number */
 750                         get_random_bytes(&newseq, sizeof(newseq));
 751                         sp->pp_seq ^= newseq;
 752                         break;
 753                 }
 754                 sp->pp_loopcnt = 0;
 755                 if (sp->pp_link_state==SPPP_LINK_DOWN &&
 756                     (dev->flags & IFF_UP)) {
 757                         sp->pp_link_state=SPPP_LINK_UP;
 758                         printk (KERN_INFO "%s: protocol up\n", dev->name);
 759                 }
 760                 break;
 761         case CISCO_ADDR_REQ:
 762                 /* Stolen from net/ipv4/devinet.c -- SIOCGIFADDR ioctl */
 763                 {
 764                 struct in_device *in_dev;
 765                 struct in_ifaddr *ifa;
 766                 __be32 addr = 0, mask = ~0; /* FIXME: is the mask correct? */
 767 #ifdef CONFIG_INET
 768                 rcu_read_lock();
 769                 if ((in_dev = __in_dev_get_rcu(dev)) != NULL)
 770                 {
 771                         for (ifa=in_dev->ifa_list; ifa != NULL;
 772                                 ifa=ifa->ifa_next) {
 773                                 if (strcmp(dev->name, ifa->ifa_label) == 0)
 774                                 {
 775                                         addr = ifa->ifa_local;
 776                                         mask = ifa->ifa_mask;
 777                                         break;
 778                                 }
 779                         }
 780                 }
 781                 rcu_read_unlock();
 782 #endif
 783                 /* I hope both addr and mask are in the net order */
 784                 sppp_cisco_send (sp, CISCO_ADDR_REPLY, addr, mask);
 785                 break;
 786                 }
 787         }
 788 }
 789
 790
 791 /*
 792  * Send PPP LCP packet.
 793  */
 794
 795 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
 796         u8 ident, u16 len, void *data)
 797 {
 798         struct ppp_header *h;
 799         struct lcp_header *lh;
 800         struct sk_buff *skb;
 801         struct net_device *dev = sp->pp_if;
 802
 803         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+LCP_HEADER_LEN+len,
 804                 GFP_ATOMIC);
 805         if (skb==NULL)
 806                 return;
 807
 808         skb_reserve(skb,dev->hard_header_len);
 809
 810         h = (struct ppp_header *)skb_put(skb, sizeof(struct ppp_header));
 811         h->address = PPP_ALLSTATIONS;        /* broadcast address */
 812         h->control = PPP_UI;                 /* Unnumbered Info */
 813         h->protocol = htons (proto);         /* Link Control Protocol */
 814
 815         lh = (struct lcp_header *)skb_put(skb, sizeof(struct lcp_header));
 816         lh->type = type;
 817         lh->ident = ident;
 818         lh->len = htons (LCP_HEADER_LEN + len);
 819
 820         if (len)
 821                 memcpy(skb_put(skb,len),data, len);
 822
 823         if (sp->pp_flags & PP_DEBUG) {
 824                 printk (KERN_WARNING "%s: %s output <%s id=%xh len=%xh",
 825                         dev->name,
 826                         proto==PPP_LCP ? "lcp" : "ipcp",
 827                         proto==PPP_LCP ? sppp_lcp_type_name (lh->type) :
 828                         sppp_ipcp_type_name (lh->type), lh->ident,
 829                         ntohs (lh->len));
 830                 if (len)
 831                         sppp_print_bytes ((u8*) (lh+1), len);
 832                 printk (">\n");
 833         }
 834         sp->obytes += skb->len;
 835         /* Control is high priority so it doesn't get queued behind data */
 836         skb->priority=TC_PRIO_CONTROL;
 837         skb->dev = dev;
 838         skb_queue_tail(&tx_queue, skb);
 839 }
 840
 841 /*
 842  * Send Cisco keepalive packet.
 843  */
 844
 845 static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2)
 846 {
 847         struct ppp_header *h;
 848         struct cisco_packet *ch;
 849         struct sk_buff *skb;
 850         struct net_device *dev = sp->pp_if;
 851         u32 t = jiffies * 1000/HZ;
 852
 853         skb=alloc_skb(dev->hard_header_len+PPP_HEADER_LEN+CISCO_PACKET_LEN,
 854                 GFP_ATOMIC);
 855
 856         if(skb==NULL)
 857                 return;
 858
 859         skb_reserve(skb, dev->hard_header_len);
 860         h = (struct ppp_header *)skb_put (skb, sizeof(struct ppp_header));
 861         h->address = CISCO_MULTICAST;
 862         h->control = 0;
 863         h->protocol = htons (CISCO_KEEPALIVE);
 864
 865         ch = (struct cisco_packet*)skb_put(skb, CISCO_PACKET_LEN);
 866         ch->type = htonl (type);
 867         ch->par1 = htonl (par1);
 868         ch->par2 = htonl (par2);
 869         ch->rel = -1;
 870         ch->time0 = htons ((u16) (t >> 16));
 871         ch->time1 = htons ((u16) t);
 872
 873         if (sp->pp_flags & PP_DEBUG)
 874                 printk (KERN_WARNING "%s: cisco output: <%xh %xh %xh %xh %xh-%xh>\n",
 875                         dev->name,  ntohl (ch->type), ch->par1,
 876                         ch->par2, ch->rel, ch->time0, ch->time1);
 877         sp->obytes += skb->len;
 878         skb->priority=TC_PRIO_CONTROL;
 879         skb->dev = dev;
 880         skb_queue_tail(&tx_queue, skb);
 881 }
 882
 883 /**
 884  *      sppp_close - close down a synchronous PPP or Cisco HDLC link
 885  *      @dev: The network device to drop the link of
 886  *
 887  *      This drops the logical interface to the channel. It is not
 888  *      done politely as we assume we will also be dropping DTR. Any
 889  *      timeouts are killed.
 890  */
 891
 892 int sppp_close (struct net_device *dev)
 893 {
 894         struct sppp *sp = (struct sppp *)sppp_of(dev);
 895         unsigned long flags;
 896
 897         spin_lock_irqsave(&sp->lock, flags);
 898         sp->pp_link_state = SPPP_LINK_DOWN;
 899         sp->lcp.state = LCP_STATE_CLOSED;
 900         sp->ipcp.state = IPCP_STATE_CLOSED;
 901         sppp_clear_timeout (sp);
 902         spin_unlock_irqrestore(&sp->lock, flags);
 903
 904         return 0;
 905 }
 906
 907 EXPORT_SYMBOL(sppp_close);
 908
 909 /**
 910  *      sppp_open - open a synchronous PPP or Cisco HDLC link
 911  *      @dev:   Network device to activate
 912  *
 913  *      Close down any existing synchronous session and commence
 914  *      from scratch. In the PPP case this means negotiating LCP/IPCP
 915  *      and friends, while for Cisco HDLC we simply need to start sending
 916  *      keepalives
 917  */
 918
 919 int sppp_open (struct net_device *dev)
 920 {
 921         struct sppp *sp = (struct sppp *)sppp_of(dev);
 922         unsigned long flags;
 923
 924         sppp_close(dev);
 925
 926         spin_lock_irqsave(&sp->lock, flags);
 927         if (!(sp->pp_flags & PP_CISCO)) {
 928                 sppp_lcp_open (sp);
 929         }
 930         sp->pp_link_state = SPPP_LINK_DOWN;
 931         spin_unlock_irqrestore(&sp->lock, flags);
 932         sppp_flush_xmit();
 933
 934         return 0;
 935 }
 936
 937 EXPORT_SYMBOL(sppp_open);
 938
 939 /**
 940  *      sppp_reopen - notify of physical link loss
 941  *      @dev: Device that lost the link
 942  *
 943  *      This function informs the synchronous protocol code that
 944  *      the underlying link died (for example a carrier drop on X.21)
 945  *
 946  *      We increment the magic numbers to ensure that if the other end
 947  *      failed to notice we will correctly start a new session. It happens
 948  *      do to the nature of telco circuits is that you can lose carrier on
 949  *      one endonly.
 950  *
 951  *      Having done this we go back to negotiating. This function may
 952  *      be called from an interrupt context.
 953  */
 954
 955 int sppp_reopen (struct net_device *dev)
 956 {
 957         struct sppp *sp = (struct sppp *)sppp_of(dev);
 958         unsigned long flags;
 959
 960         sppp_close(dev);
 961
 962         spin_lock_irqsave(&sp->lock, flags);
 963         if (!(sp->pp_flags & PP_CISCO))
 964         {
 965                 sp->lcp.magic = jiffies;
 966                 ++sp->pp_seq;
 967                 sp->lcp.state = LCP_STATE_CLOSED;
 968                 sp->ipcp.state = IPCP_STATE_CLOSED;
 969                 /* Give it a moment for the line to settle then go */
 970                 sppp_set_timeout (sp, 1);
 971         }
 972         sp->pp_link_state=SPPP_LINK_DOWN;
 973         spin_unlock_irqrestore(&sp->lock, flags);
 974
 975         return 0;
 976 }
 977
 978 EXPORT_SYMBOL(sppp_reopen);
 979
 980 /**
 981  *      sppp_change_mtu - Change the link MTU
 982  *      @dev:   Device to change MTU on
 983  *      @new_mtu: New MTU
 984  *
 985  *      Change the MTU on the link. This can only be called with
 986  *      the link down. It returns an error if the link is up or
 987  *      the mtu is out of range.
 988  */
 989
 990 static int sppp_change_mtu(struct net_device *dev, int new_mtu)
 991 {
 992         if(new_mtu<128||new_mtu>PPP_MTU||(dev->flags&IFF_UP))
 993                 return -EINVAL;
 994         dev->mtu=new_mtu;
 995         return 0;
 996 }
 997
 998 /**
 999  *      sppp_do_ioctl - Ioctl handler for ppp/hdlc
1000  *      @dev: Device subject to ioctl
1001  *      @ifr: Interface request block from the user
1002  *      @cmd: Command that is being issued
1003  *
1004  *      This function handles the ioctls that may be issued by the user
1005  *      to control the settings of a PPP/HDLC link. It does both busy
1006  *      and security checks. This function is intended to be wrapped by
1007  *      callers who wish to add additional ioctl calls of their own.
1008  */
1009
1010 int sppp_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1011 {
1012         struct sppp *sp = (struct sppp *)sppp_of(dev);
1013
1014         if(dev->flags&IFF_UP)
1015                 return -EBUSY;
1016
1017         if(!capable(CAP_NET_ADMIN))
1018                 return -EPERM;
1019
1020         switch(cmd)
1021         {
1022                 case SPPPIOCCISCO:
1023                         sp->pp_flags|=PP_CISCO;
1024                         dev->type = ARPHRD_HDLC;
1025                         break;
1026                 case SPPPIOCPPP:
1027                         sp->pp_flags&=~PP_CISCO;
1028                         dev->type = ARPHRD_PPP;
1029                         break;
1030                 case SPPPIOCDEBUG:
1031                         sp->pp_flags&=~PP_DEBUG;
1032                         if(ifr->ifr_flags)
1033                                 sp->pp_flags|=PP_DEBUG;
1034                         break;
1035                 case SPPPIOCGFLAGS:
1036                         if(copy_to_user(ifr->ifr_data, &sp->pp_flags, sizeof(sp->pp_flags)))
1037                                 return -EFAULT;
1038                         break;
1039                 case SPPPIOCSFLAGS:
1040                         if(copy_from_user(&sp->pp_flags, ifr->ifr_data, sizeof(sp->pp_flags)))
1041                                 return -EFAULT;
1042                         break;
1043                 default:
1044                         return -EINVAL;
1045         }
1046         return 0;
1047 }
1048
1049 EXPORT_SYMBOL(sppp_do_ioctl);
1050
1051 /**
1052  *      sppp_attach - attach synchronous PPP/HDLC to a device
1053  *      @pd:    PPP device to initialise
1054  *
1055  *      This initialises the PPP/HDLC support on an interface. At the
1056  *      time of calling the dev element must point to the network device
1057  *      that this interface is attached to. The interface should not yet
1058  *      be registered.
1059  */
1060
1061 void sppp_attach(struct ppp_device *pd)
1062 {
1063         struct net_device *dev = pd->dev;
1064         struct sppp *sp = &pd->sppp;
1065         unsigned long flags;
1066
1067         /* Make sure embedding is safe for sppp_of */
1068         BUG_ON(sppp_of(dev) != sp);
1069
1070         spin_lock_irqsave(&spppq_lock, flags);
1071         /* Initialize keepalive handler. */
1072         if (! spppq)
1073         {
1074                 init_timer(&sppp_keepalive_timer);
1075                 sppp_keepalive_timer.expires=jiffies+10*HZ;
1076                 sppp_keepalive_timer.function=sppp_keepalive;
1077                 add_timer(&sppp_keepalive_timer);
1078         }
1079         /* Insert new entry into the keepalive list. */
1080         sp->pp_next = spppq;
1081         spppq = sp;
1082         spin_unlock_irqrestore(&spppq_lock, flags);
1083
1084         sp->pp_loopcnt = 0;
1085         sp->pp_alivecnt = 0;
1086         sp->pp_seq = 0;
1087         sp->pp_rseq = 0;
1088         sp->pp_flags = PP_KEEPALIVE|PP_CISCO|debug;/*PP_DEBUG;*/
1089         sp->lcp.magic = 0;
1090         sp->lcp.state = LCP_STATE_CLOSED;
1091         sp->ipcp.state = IPCP_STATE_CLOSED;
1092         sp->pp_if = dev;
1093         spin_lock_init(&sp->lock);
1094
1095         /*
1096          *      Device specific setup. All but interrupt handler and
1097          *      hard_start_xmit.
1098          */
1099
1100         dev->hard_header = sppp_hard_header;
1101         dev->rebuild_header = sppp_rebuild_header;
1102         dev->tx_queue_len = 10;
1103         dev->type = ARPHRD_HDLC;
1104         dev->addr_len = 0;
1105         dev->hard_header_len = sizeof(struct ppp_header);
1106         dev->mtu = PPP_MTU;
1107         /*
1108          *      These 4 are callers but MUST also call sppp_ functions
1109          */
1110         dev->do_ioctl = sppp_do_ioctl;
1111 #if 0
1112         dev->get_stats = NULL;          /* Let the driver override these */
1113         dev->open = sppp_open;
1114         dev->stop = sppp_close;
1115 #endif
1116         dev->change_mtu = sppp_change_mtu;
1117         dev->hard_header_cache = NULL;
1118         dev->header_cache_update = NULL;
1119         dev->flags = IFF_MULTICAST|IFF_POINTOPOINT|IFF_NOARP;
1120 }
1121
1122 EXPORT_SYMBOL(sppp_attach);
1123
1124 /**
1125  *      sppp_detach - release PPP resources from a device
1126  *      @dev:   Network device to release
1127  *
1128  *      Stop and free up any PPP/HDLC resources used by this
1129  *      interface. This must be called before the device is
1130  *      freed.
1131  */
1132
1133 void sppp_detach (struct net_device *dev)
1134 {
1135         struct sppp **q, *p, *sp = (struct sppp *)sppp_of(dev);
1136         unsigned long flags;
1137
1138         spin_lock_irqsave(&spppq_lock, flags);
1139         /* Remove the entry from the keepalive list. */
1140         for (q = &spppq; (p = *q); q = &p->pp_next)
1141                 if (p == sp) {
1142                         *q = p->pp_next;
1143                         break;
1144                 }
1145
1146         /* Stop keepalive handler. */
1147         if (! spppq)
1148                 del_timer(&sppp_keepalive_timer);
1149         sppp_clear_timeout (sp);
1150         spin_unlock_irqrestore(&spppq_lock, flags);
1151 }
1152
1153 EXPORT_SYMBOL(sppp_detach);
1154
1155 /*
1156  * Analyze the LCP Configure-Request options list
1157  * for the presence of unknown options.
1158  * If the request contains unknown options, build and
1159  * send Configure-reject packet, containing only unknown options.
1160  */
1161 static int
1162 sppp_lcp_conf_parse_options (struct sppp *sp, struct lcp_header *h,
1163         int len, u32 *magic)
1164 {
1165         u8 *buf, *r, *p;
1166         int rlen;
1167
1168         len -= 4;
1169         buf = r = kmalloc (len, GFP_ATOMIC);
1170         if (! buf)
1171                 return (0);
1172
1173         p = (void*) (h+1);
1174         for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
1175                 switch (*p) {
1176                 case LCP_OPT_MAGIC:
1177                         /* Magic number -- extract. */
1178                         if (len >= 6 && p[1] == 6) {
1179                                 *magic = (u32)p[2] << 24 |
1180                                         (u32)p[3] << 16 | p[4] << 8 | p[5];
1181                                 continue;
1182                         }
1183                         break;
1184                 case LCP_OPT_ASYNC_MAP:
1185                         /* Async control character map -- check to be zero. */
1186                         if (len >= 6 && p[1] == 6 && ! p[2] && ! p[3] &&
1187                             ! p[4] && ! p[5])
1188                                 continue;
1189                         break;
1190                 case LCP_OPT_MRU:
1191                         /* Maximum receive unit -- always OK. */
1192                         continue;
1193                 default:
1194                         /* Others not supported. */
1195                         break;
1196                 }
1197                 /* Add the option to rejected list. */
1198                 memcpy(r, p, p[1]);
1199                 r += p[1];
1200                 rlen += p[1];
1201         }
1202         if (rlen)
1203                 sppp_cp_send (sp, PPP_LCP, LCP_CONF_REJ, h->ident, rlen, buf);
1204         kfree(buf);
1205         return (rlen == 0);
1206 }
1207
1208 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *skb)
1209 {
1210         struct lcp_header *h;
1211         struct net_device *dev = sp->pp_if;
1212         int len = skb->len;
1213
1214         if (!pskb_may_pull(skb, sizeof(struct lcp_header))) {
1215                 if (sp->pp_flags & PP_DEBUG)
1216                         printk (KERN_WARNING "%s: invalid ipcp packet length: %d bytes\n",
1217                                 dev->name,  len);
1218                 return;
1219         }
1220         h = (struct lcp_header *)skb->data;
1221         skb_pull(skb,sizeof(struct lcp_header));
1222         if (sp->pp_flags & PP_DEBUG) {
1223                 printk (KERN_WARNING "%s: ipcp input: %d bytes <%s id=%xh len=%xh",
1224                         dev->name,  len,
1225                         sppp_ipcp_type_name (h->type), h->ident, ntohs (h->len));
1226                 if (len > 4)
1227                         sppp_print_bytes ((u8*) (h+1), len-4);
1228                 printk (">\n");
1229         }
1230         if (len > ntohs (h->len))
1231                 len = ntohs (h->len);
1232         switch (h->type) {
1233         default:
1234                 /* Unknown packet type -- send Code-Reject packet. */
1235                 sppp_cp_send (sp, PPP_IPCP, IPCP_CODE_REJ, ++sp->pp_seq, len, h);
1236                 break;
1237         case IPCP_CONF_REQ:
1238                 if (len < 4) {
1239                         if (sp->pp_flags & PP_DEBUG)
1240                                 printk (KERN_WARNING "%s: invalid ipcp configure request packet length: %d bytes\n",
1241                                         dev->name, len);
1242                         return;
1243                 }
1244                 if (len > 4) {
1245                         sppp_cp_send (sp, PPP_IPCP, LCP_CONF_REJ, h->ident,
1246                                 len-4, h+1);
1247
1248                         switch (sp->ipcp.state) {
1249                         case IPCP_STATE_OPENED:
1250                                 /* Initiate renegotiation. */
1251                                 sppp_ipcp_open (sp);
1252                                 /* fall through... */
1253                         case IPCP_STATE_ACK_SENT:
1254                                 /* Go to closed state. */
1255                                 sp->ipcp.state = IPCP_STATE_CLOSED;
1256                         }
1257                 } else {
1258                         /* Send Configure-Ack packet. */
1259                         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_ACK, h->ident,
1260                                 0, NULL);
1261                         /* Change the state. */
1262                         if (sp->ipcp.state == IPCP_STATE_ACK_RCVD)
1263                                 sp->ipcp.state = IPCP_STATE_OPENED;
1264                         else
1265                                 sp->ipcp.state = IPCP_STATE_ACK_SENT;
1266                 }
1267                 break;
1268         case IPCP_CONF_ACK:
1269                 if (h->ident != sp->ipcp.confid)
1270                         break;
1271                 sppp_clear_timeout (sp);
1272                 switch (sp->ipcp.state) {
1273                 case IPCP_STATE_CLOSED:
1274                         sp->ipcp.state = IPCP_STATE_ACK_RCVD;
1275                         sppp_set_timeout (sp, 5);
1276                         break;
1277                 case IPCP_STATE_ACK_SENT:
1278                         sp->ipcp.state = IPCP_STATE_OPENED;
1279                         break;
1280                 }
1281                 break;
1282         case IPCP_CONF_NAK:
1283         case IPCP_CONF_REJ:
1284                 if (h->ident != sp->ipcp.confid)
1285                         break;
1286                 sppp_clear_timeout (sp);
1287                         /* Initiate renegotiation. */
1288                 sppp_ipcp_open (sp);
1289                 if (sp->ipcp.state != IPCP_STATE_ACK_SENT)
1290                         /* Go to closed state. */
1291                         sp->ipcp.state = IPCP_STATE_CLOSED;
1292                 break;
1293         case IPCP_TERM_REQ:
1294                 /* Send Terminate-Ack packet. */
1295                 sppp_cp_send (sp, PPP_IPCP, IPCP_TERM_ACK, h->ident, 0, NULL);
1296                 /* Go to closed state. */
1297                 sp->ipcp.state = IPCP_STATE_CLOSED;
1298                 /* Initiate renegotiation. */
1299                 sppp_ipcp_open (sp);
1300                 break;
1301         case IPCP_TERM_ACK:
1302                 /* Ignore for now. */
1303         case IPCP_CODE_REJ:
1304                 /* Ignore for now. */
1305                 break;
1306         }
1307 }
1308
1309 static void sppp_lcp_open (struct sppp *sp)
1310 {
1311         char opt[6];
1312
1313         if (! sp->lcp.magic)
1314                 sp->lcp.magic = jiffies;
1315         opt[0] = LCP_OPT_MAGIC;
1316         opt[1] = sizeof (opt);
1317         opt[2] = sp->lcp.magic >> 24;
1318         opt[3] = sp->lcp.magic >> 16;
1319         opt[4] = sp->lcp.magic >> 8;
1320         opt[5] = sp->lcp.magic;
1321         sp->lcp.confid = ++sp->pp_seq;
1322         sppp_cp_send (sp, PPP_LCP, LCP_CONF_REQ, sp->lcp.confid,
1323                 sizeof (opt), &opt);
1324         sppp_set_timeout (sp, 2);
1325 }
1326
1327 static void sppp_ipcp_open (struct sppp *sp)
1328 {
1329         sp->ipcp.confid = ++sp->pp_seq;
1330         sppp_cp_send (sp, PPP_IPCP, IPCP_CONF_REQ, sp->ipcp.confid, 0, NULL);
1331         sppp_set_timeout (sp, 2);
1332 }
1333
1334 /*
1335  * Process PPP control protocol timeouts.
1336  */
1337
1338 static void sppp_cp_timeout (unsigned long arg)
1339 {
1340         struct sppp *sp = (struct sppp*) arg;
1341         unsigned long flags;
1342
1343         spin_lock_irqsave(&sp->lock, flags);
1344
1345         sp->pp_flags &= ~PP_TIMO;
1346         if (! (sp->pp_if->flags & IFF_UP) || (sp->pp_flags & PP_CISCO)) {
1347                 spin_unlock_irqrestore(&sp->lock, flags);
1348                 return;
1349         }
1350         switch (sp->lcp.state) {
1351         case LCP_STATE_CLOSED:
1352                 /* No ACK for Configure-Request, retry. */
1353                 sppp_lcp_open (sp);
1354                 break;
1355         case LCP_STATE_ACK_RCVD:
1356                 /* ACK got, but no Configure-Request for peer, retry. */
1357                 sppp_lcp_open (sp);
1358                 sp->lcp.state = LCP_STATE_CLOSED;
1359                 break;
1360         case LCP_STATE_ACK_SENT:
1361                 /* ACK sent but no ACK for Configure-Request, retry. */
1362                 sppp_lcp_open (sp);
1363                 break;
1364         case LCP_STATE_OPENED:
1365                 /* LCP is already OK, try IPCP. */
1366                 switch (sp->ipcp.state) {
1367                 case IPCP_STATE_CLOSED:
1368                         /* No ACK for Configure-Request, retry. */
1369                         sppp_ipcp_open (sp);
1370                         break;
1371                 case IPCP_STATE_ACK_RCVD:
1372                         /* ACK got, but no Configure-Request for peer, retry. */
1373                         sppp_ipcp_open (sp);
1374                         sp->ipcp.state = IPCP_STATE_CLOSED;
1375                         break;
1376                 case IPCP_STATE_ACK_SENT:
1377                         /* ACK sent but no ACK for Configure-Request, retry. */
1378                         sppp_ipcp_open (sp);
1379                         break;
1380                 case IPCP_STATE_OPENED:
1381                         /* IPCP is OK. */
1382                         break;
1383                 }
1384                 break;
1385         }
1386         spin_unlock_irqrestore(&sp->lock, flags);
1387         sppp_flush_xmit();
1388 }
1389
1390 static char *sppp_lcp_type_name (u8 type)
1391 {
1392         static char buf [8];
1393         switch (type) {
1394         case LCP_CONF_REQ:   return ("conf-req");
1395         case LCP_CONF_ACK:   return ("conf-ack");
1396         case LCP_CONF_NAK:   return ("conf-nack");
1397         case LCP_CONF_REJ:   return ("conf-rej");
1398         case LCP_TERM_REQ:   return ("term-req");
1399         case LCP_TERM_ACK:   return ("term-ack");
1400         case LCP_CODE_REJ:   return ("code-rej");
1401         case LCP_PROTO_REJ:  return ("proto-rej");
1402         case LCP_ECHO_REQ:   return ("echo-req");
1403         case LCP_ECHO_REPLY: return ("echo-reply");
1404         case LCP_DISC_REQ:   return ("discard-req");
1405         }
1406         sprintf (buf, "%xh", type);
1407         return (buf);
1408 }
1409
1410 static char *sppp_ipcp_type_name (u8 type)
1411 {
1412         static char buf [8];
1413         switch (type) {
1414         case IPCP_CONF_REQ:   return ("conf-req");
1415         case IPCP_CONF_ACK:   return ("conf-ack");
1416         case IPCP_CONF_NAK:   return ("conf-nack");
1417         case IPCP_CONF_REJ:   return ("conf-rej");
1418         case IPCP_TERM_REQ:   return ("term-req");
1419         case IPCP_TERM_ACK:   return ("term-ack");
1420         case IPCP_CODE_REJ:   return ("code-rej");
1421         }
1422         sprintf (buf, "%xh", type);
1423         return (buf);
1424 }
1425
1426 static void sppp_print_bytes (u_char *p, u16 len)
1427 {
1428         printk (" %x", *p++);
1429         while (--len > 0)
1430                 printk ("-%x", *p++);
1431 }
1432
1433 /**
1434  *      sppp_rcv -      receive and process a WAN PPP frame
1435  *      @skb:   The buffer to process
1436  *      @dev:   The device it arrived on
1437  *      @p: Unused
1438  *      @orig_dev: Unused
1439  *
1440  *      Protocol glue. This drives the deferred processing mode the poorer
1441  *      cards use. This can be called directly by cards that do not have
1442  *      timing constraints but is normally called from the network layer
1443  *      after interrupt servicing to process frames queued via netif_rx.
1444  */
1445
1446 static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
1447 {
1448         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
1449                 return NET_RX_DROP;
1450         sppp_input(dev,skb);
1451         return 0;
1452 }
1453
1454 static struct packet_type sppp_packet_type = {
1455         .type   = __constant_htons(ETH_P_WAN_PPP),
1456         .func   = sppp_rcv,
1457 };
1458
1459 static char banner[] __initdata =
1460         KERN_INFO "Cronyx Ltd, Synchronous PPP and CISCO HDLC (c) 1994\n"
1461         KERN_INFO "Linux port (c) 1998 Building Number Three Ltd & "
1462                   "Jan \"Yenya\" Kasprzak.\n";
1463
1464 static int __init sync_ppp_init(void)
1465 {
1466         if(debug)
1467                 debug=PP_DEBUG;
1468         printk(banner);
1469         skb_queue_head_init(&tx_queue);
1470         dev_add_pack(&sppp_packet_type);
1471         return 0;
1472 }
1473
1474
1475 static void __exit sync_ppp_cleanup(void)
1476 {
1477         dev_remove_pack(&sppp_packet_type);
1478 }
1479
1480 module_init(sync_ppp_init);
1481 module_exit(sync_ppp_cleanup);
1482 module_param(debug, int, 0);
1483 MODULE_LICENSE("GPL");
1484