Commit Graph

1392 Commits

Author SHA1 Message Date
ru
ce971426f4 mdoc(7) police: Removed redundant .Ns calls. 2002-08-13 16:07:28 +00:00
blackend
38c0bac808 Correct URL to the FAQ
MFC after:	1 week
2002-07-31 10:05:00 +00:00
blackend
8ce62b66d8 Correct links to Handbook's pages, old URLs does not work anymore.
MFC after:	1 week
2002-07-30 21:04:26 +00:00
brian
ae9417246c Do a case insensitive comparison when comparing the ms-chap response
string.
2002-07-30 08:09:26 +00:00
brian
0ffeeffe3e Remove unused calls to inet_addr() 2002-07-18 18:50:05 +00:00
brian
d046f882cc Back out the previous revision
Objected to by: Andre Oppermann <oppermann@pipeline.ch>

After Andre's objection, I've re-examined rfc 2759 and noted that it
says that the domain name shouldn't be used when generating the
NT-Response field.  So it looks like the bug is in freeradius rather
than in ppp.
2002-07-04 23:33:35 +00:00
brian
9ba6d06dcf If we've given a domain name prefix as the authentication name, strip
it off before passing it on to the RADIUS server for authentication.
2002-07-03 20:51:13 +00:00
brian
a8c83ef89c Don't trust the MPPE key lengths passed back from the RADIUS server.
Instead, use the correct values based on the number of bits actually
negotiated.

Spotted by: Sergey Korolew <ds@rt.balakovo.ru>
2002-07-02 00:47:24 +00:00
brian
c90db9b98a Remove some misleading/wrong diagnostics 2002-07-02 00:12:24 +00:00
brian
ab92b92516 Show the port number (tty slot, pppoe session id etc) under
``show physical''.
2002-06-30 01:46:22 +00:00
brian
8368fc422d When a netgraph message is read, look for another before returning.
This removes a bad latency problem during initial setup where we
end up waiting for too long before reading the connected message
and time the connection out.

Problem figured out by:	Andre Albsmeier <andre@albsmeier.net>
2002-06-29 18:49:08 +00:00
brian
edd536143a Don't use SignalBundle if it's not set
Submitted by: Federico G. Schwindt <fgsch@olimpo.com.br>
2002-06-28 09:33:25 +00:00
brian
9e2f577390 Complain about (and fix) misformatted RADIUS attributes rather than silently
fixing them.
2002-06-28 09:18:15 +00:00
brian
fa2f229525 When a RADIUS server is being used, don't use MPPE unless the RADIUS
server says it's ok.
2002-06-28 08:46:21 +00:00
brian
20a617c09d Add a hack to handle RADIUS responses from peers that forget that
there's an ``Ident'' field in the MS-CHAP2-Response and
MS-CHAP-Error attributes.

The RADIATOR server seems to be guilty of this.
2002-06-23 23:38:06 +00:00
brian
cd63f26c91 Don't expect NUL terminated data in all netgraph messages received.
Only display message hook values we understand.
2002-06-22 21:01:47 +00:00
brian
50179a5819 Compensate for dodgy Win98/WinME MSCHAPv2 responses later in the code
path... after we've talked to any RADIUS servers involved, so that we
haven't touched the data before it gets to the server.

Make it clearer in the code that this compensation is done by setting
a flag to a value of zero, a flag which rfc2759 says *MUST* be zero.

While we're here, don't bother passing the peer challenge into
radius_Authenticate().  It's already part of the key we're passing in
(this becomes obvious now that I've structured that data...).

This ``fix'' doesn't help to authenticate Win98/WinME users in my test
environment as ports/net/freeradius seems to ignore the flag
completely anyway, but it may help with other RADIUS servers.
2002-06-17 01:12:38 +00:00
brian
6ff6823d37 A better prinflike fix... 2002-06-15 08:03:59 +00:00
brian
72243fc694 Remove whitespace at the end of lines. 2002-06-15 08:03:30 +00:00
brian
fbed14fd88 Fix a printflike format error 2002-06-15 01:36:36 +00:00
brian
017c077056 Remove a forgotten diagnostic 2002-06-15 01:35:03 +00:00
brian
514fa7d23f If a RAD_FILTER_ID is supplied by the RADIUS server, treat it as an
additional label from ppp.linkup & ppp.linkdown to load.

Suggested and mostly submitted by: andrew pavlov <and@kremenchug.net>
2002-06-12 23:45:15 +00:00
brian
9412fc32d2 Bump the version number to reflect the recent RADIUS commits 2002-06-12 23:00:12 +00:00
brian
81be549dd2 Don't forget to process the Ident field on the front of
RAD_MICROSOFT_MS_CHAP_ERROR and RAD_MICROSOFT_MS_CHAP2_SUCCESS
messages, and remove the hack in chap.c to ignore that ident field
on the client side.

This anomoly was hacked around during development, and I forgot to
go back and fix it properly.

Spotted by: Sergey Korolew <ds@rt.balakovo.ru>
2002-06-12 21:36:07 +00:00
brian
64df596967 Understand the following Microsoft Vendor Specific RADIUS attributes:
RAD_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY
  RAD_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES
  RAD_MICROSOFT_MS_MPPE_RECV_KEY
  RAD_MICROSOFT_MS_MPPE_SEND_KEY

These attributes may be supplied by a RADIUS server when MSCHAPv2 is
used to authenticate.

It *should* now be possible to build ppp with -DNODES and still support
CHAP/MSCHAP/MSCHAPv2/MPPE via a RADIUS server, but the code isn't yet
smart enough to do that (building with -DNODES just looses these
facilities).

Sponsored by: Monzoon
2002-06-12 00:33:17 +00:00
brian
e96dc1713c Cast pid_t to long for printf()ing
Obtained from:	OpenBSD
2002-06-06 01:39:46 +00:00
brian
be443b894f Add a missing ``a''. 2002-06-03 21:36:20 +00:00
brian
f1bf75d03d Don't send a RAD_NAS_IP_ADDRESS attribute as RAD_NAS_IDENTIFIER is
sufficient.

In fact, using both breaks the radiator RADIUS daemon when used with
a db as it maps both attributes to the same field value and then
fails the insert.

I decided to remove RAD_NAS_IP_ADDRESS on the basis that rfc2138 says:

      An Access-Request MUST contain a User-Name attribute.  It SHOULD
      contain either a NAS-IP-Address attribute or NAS-Identifier
      attribute (or both, although that is not recommended).  It MUST

despite the fact that this not recommended bit was removed from the
updated rfc.
2002-06-02 14:27:02 +00:00
brian
6fc921d693 Coerce pid_t to long rather than int for better portability.
Suggested by: Theo de Raadt <deraadt@openbsd.org>
2002-05-27 23:19:53 +00:00
brian
debad274d2 Increase the maximum FSM option length to 50 2002-05-22 21:17:13 +00:00
brian
e2e6ae2d7a Add some missing #includes that weren't required due to namespace polution
in our headers.

Submitted by: bde
2002-05-22 21:08:58 +00:00
brian
d6c7357cf3 Mention our support of the authentication side of rfc2548 2002-05-21 10:54:07 +00:00
brian
d2110d3eba Document RAD_MICROSOFT_MS_CHAP2_SUCCESS. 2002-05-18 23:58:15 +00:00
brian
3c3efb7e19 Put back <string.h> 2002-05-17 00:44:54 +00:00
brian
a821e645fa Add some OpenBSD includes 2002-05-16 14:47:19 +00:00
brian
098eb79132 Fix a mis-placed #else/#endif 2002-05-16 14:28:32 +00:00
brian
6efbe1505f Handle MS-CHAPv2 authentication correctly via the RADIUS server (if it's
configured).
Handle internal failures in radius_Authenticate() correctly.
Bump the ppp version number.

This doesn't yet work with MPPE.  More will follow.

Sponsored by: Mozoon
2002-05-16 13:34:20 +00:00
brian
06388d2280 Fix an include for NetBSD 2002-05-14 17:50:25 +00:00
brian
09439a23da Avoid a rather bizarre warning from gcc 3.1:
/usr/src/usr.sbin/ppp/cbcp.c:566:61: warning: trigraph ??! ignored
2002-05-14 13:32:30 +00:00
brian
c2da7c8697 o Clean up some #includes
o Bump version number to 3.0.4
o When talking to a RADIUS server, provide a NAS-Port-Type.

  When the NAS-Port-Type is Ethernet, provide a NAS-Port value equal
  to the SESSIONID from the environment in direct mode or the
  NGM_PPPOE_SESSIONID message in other modes.  If no SESSIONID is found,
  default to the interface index in client mode or zero in server mode.

  When the NAS-Port-Type is ISDN, set the NAS-Port to the minor number
  of the physical device (ie, the N in /dev/i4brbchN).

  This makes it easier for the RADIUS server to identify the client
  WRT accounting data etc.

Prompted by:	lsz8425 <lsz8425@mail.cd.hn.cn>
2002-05-14 12:55:39 +00:00
brian
def93d7c3c Calculate the number of open links properly when deciding on whether to
just send PROTO_IP packets when we've got only one link up in multi-link
mode.

Problem noted by:	Adrian Close <adrian@fernhilltec.com.au>
MFC after:		1 week
2002-05-14 00:59:28 +00:00
brian
f9345cd242 Fix a syntax error 2002-05-13 20:25:47 +00:00
brian
e7542a26ed We don't need to include arpa/inet.h here. In fact, only FreeBSD needs
netinet/in.h.
2002-05-11 17:04:01 +00:00
brian
80f4fb7cc7 #include netinet/in.h when !__FreeBSD__ to silence some warnings from
the inclusion of arpa/inet.h
2002-05-11 10:54:45 +00:00
brian
02509bfc4b NetBSD keeps des.h in /usr/include/openssl these days 2002-05-11 03:47:15 +00:00
brian
1947582c12 Add support for MS-CHAP authentication via a RADIUS server.
Add support for Reply-Message and MS-CHAP-Error.

Sponsored by:	Monzoon
2002-05-10 03:11:35 +00:00
brian
87ffeeba8e Don't corrupt MP fragments when they're put back on the front of our
inbound queue.

Submitted by:	"Amit K. Rao" <arao@niksun.com>
PR:		37813
MFC after:	1 week

Also fix a typo while I'm here.
2002-05-07 12:48:45 +00:00
brian
920f339ee0 Understand the Session-Timeout RADIUS attribute
Store the Filter-Id attribute (we don't do anything with it yet)

Submitted mostly by: andrew pavlov <and@kremenchug.net>
2002-05-07 10:06:54 +00:00
brian
7bc3ad5ab7 Tweak a data type from char * to u_char * 2002-05-04 21:47:43 +00:00
brian
e2ff55c530 Make ``set mru'' require a context. In multi-link mode, there's no
point in being allowed to ``set mru'' for the MP lcp layer.

Spotted by:	Richard Browne <richb@timestone.com.au>
MFC after:	1 month
2002-05-04 19:38:43 +00:00
brian
d6c25b14c5 Bump the version to mark the fixed FSM TLD ordering 2002-05-01 10:08:10 +00:00
brian
e9f489edca If we receive a config request while Open, call TLD *before* decoding
the request as TLD may initialise fields that are set when decoding the
request.

MFC after:	1 week
2002-05-01 10:04:49 +00:00
brian
e8c453a543 Allow the peer to modify the LQR interval 2002-05-01 07:49:07 +00:00
des
4d6b787d2d Usage style sweep: spell "usage" with a small 'u'.
Also change one case of blatant __progname abuse (several more remain)
This commit does not touch anything in src/{contrib,crypto,gnu}/.
2002-04-22 13:44:47 +00:00
brian
734c0c9c89 Don't load the netgraph line discipline. When it's in use, TIOCMGET
fails and on loss of carrier, the device doesn't become selectable with
0 bytes to read.

Problem reported by: ache
2002-04-21 02:00:29 +00:00
brian
f57b9edeb5 Add variable substitutions for SOCKNAME, IPOCTETSIN, IPOCTETSOUT, IPPACKETSIN,
IPPACKETSOUT, IPV6OCTETSIN, IPV6OCTETSOUT, IPV6PACKETSIN, IPV6PACKETSOUT,
OCTETSIN, OCTETSOUT, PACKETSIN, PACKETSOUT and SOCKNAME.
2002-04-17 12:38:59 +00:00
brian
f84972208c Don't display an extraneous ``: '' with some packets in/packets out diagnostics 2002-04-16 23:57:21 +00:00
brian
b86a2d03f8 Make the way FSM options are processed easier to read by using structures
instead of u_char *.

The changes are cosmetic except:

  RecvConfigAck() now displays the options that are being ACK'd
  Huge (bogus) options sent from the peer won't cause an infinite loop
  SendIdent and ReceiveIdent are displayed consistenlty with other FSM data
  LCP AUTHPROTO options that aren't understood are NAK'd, not REJ'd
2002-04-16 23:57:09 +00:00
brian
99e79d7fa0 When it's necessary to kldload tun(4), don't forget to re-try to open
tun0.

Submitted by:	qhwt@myrealbox.com
2002-04-15 00:14:40 +00:00
hosokawa
cce077344b Get tun P2P address from the local pool if RADIUS server returned
255.255.255.254 as client ipaddr.

Reviewed-By:	freebsd-net mailing list
2002-04-04 08:43:00 +00:00
brian
5e89c7151f Fix a typo 2002-03-31 01:57:06 +00:00
brian
ab4711b90a Add a missing ``#ifndef NONETGRAPH'' 2002-03-31 01:56:34 +00:00
brian
b222d9573a Remove some extraneous whitespace 2002-03-31 01:51:15 +00:00
brian
05e0b92acd Include arpa/inet.h 2002-03-31 01:36:08 +00:00
ru
ea17e5024d Fix CLEANFILES. 2002-03-30 17:57:51 +00:00
brian
631238220a Add a sprinkling of mp_Down() calls to ensure that we don't think that
the multi-link NCP is up when it isn't.
2002-03-30 12:52:55 +00:00
brian
4aad533fbf Don't use the RTF_GATEWAY flag and pass the RTA_GATEWAY address when updating
routes.
2002-03-30 12:50:49 +00:00
brian
1dda0c6402 Add a missing break 2002-03-30 12:47:29 +00:00
brian
ee9763124d Merge the NETGRAPH branch into HEAD. tty devices now use netgraph's line
discipline to do the async escaping, but no other benefits are available yet.

Change ``ifdef HAVE_DES'' to ``ifndef NODES'' for consistency.

Make the Makefile a little more sane WRT RELEASE_CRUNCH.
2002-03-30 12:30:09 +00:00
brian
a80a96a3d8 Fix a typo
Submitted by:	dirk
2002-03-25 14:14:31 +00:00
ru
fbd982bb93 mdoc(7) police: .Va -> .Ev. 2002-03-15 17:03:05 +00:00
brian
783a07fdf2 Use the return value from snprintf() to keep a track of the length of
the display string in MPPEDispOpts.

PR:		35836
MFC After:	2 weeks
2002-03-13 10:21:19 +00:00
brian
e3b5feb1f5 Handle B460800 and B921600 being defined in <termios.h> 2002-03-12 16:05:26 +00:00
brian
ca8983659d Don't drop the last character from ut_line in ID0logout().
PR:		35531
MFC after:	2 weeks
2002-03-05 13:03:11 +00:00
brian
e1efcab9b5 Don't blow away ``set escape'' settings when we've completed the
login phase.  Just initialise the correct parts.

Originially submitted by:	Vladimir B. Machulsky <bofhmail@yahoo.com>
2002-03-04 10:08:57 +00:00
brian
9e9f75c5de Document NGM_PPPOE_ACNAME handling. 2002-02-20 15:53:47 +00:00
brian
1af410bad4 Handle NGM_PPPOE_ACNAME messages.
Submitted by:	Andre Albsmeier <andre@albsmeier.net>
Approved by:	julian
2002-02-20 15:52:20 +00:00
mike
bcee06d42c o Move NTOHL() and associated macros into <sys/param.h>. These are
deprecated in favor of the POSIX-defined lowercase variants.
o Change all occurrences of NTOHL() and associated marcros in the
  source tree to use the lowercase function variants.
o Add missing license bits to sparc64's <machine/endian.h>.
  Approved by: jake
o Clean up <machine/endian.h> files.
o Remove unused __uint16_swap_uint32() from i386's <machine/endian.h>.
o Remove prototypes for non-existent bswapXX() functions.
o Include <machine/endian.h> in <arpa/inet.h> to define the
  POSIX-required ntohl() family of functions.
o Do similar things to expose the ntohl() family in libstand, <netinet/in.h>,
  and <sys/param.h>.
o Prepend underscores to the ntohl() family to help deal with
  complexities associated with having MD (asm and inline) versions, and
  having to prevent exposure of these functions in other headers that
  happen to make use of endian-specific defines.
o Create weak aliases to the canonical function name to help deal with
  third-party software forgetting to include an appropriate header.
o Remove some now unneeded pollution from <sys/types.h>.
o Add missing <arpa/inet.h> includes in userland.

Tested on:	alpha, i386
Reviewed by:	bde, jake, tmm
2002-02-18 20:35:27 +00:00
brian
2cd83c2da4 Detect if a udp socket on STDIN_FILENO is connected by calling
getpeername() and don't set PASSIVE mode if it's is.
2002-01-23 23:36:35 +00:00
brian
153455a7d2 Cross reference the NETWORK ADDRESS TRANSLATION section when describing
the -nat flag.

Requested by:	eivind
2002-01-23 21:11:33 +00:00
brian
c6d68beab8 socket()s first argument should be a protocol family rather than an
address family.
2002-01-16 14:03:52 +00:00
brian
414245183e socket's first argument is an address family, not a protocol family. 2002-01-16 13:15:47 +00:00
brian
94cf97175f When authenticating a name containing a ``\'', attempt to autenticate
using the part after the ``\'' if the original name is not found.

This allows M$ clients to use domain\user as their authname.

Reviewed by: Ian West <ian@niw.com.au>
2002-01-08 11:24:39 +00:00
brian
2d4ab797ed Consider PROTO_IPV6 as compressible by CCP.
Spotted by: Nick Sayer <nsayer@quack.kfu.com>
2001-12-09 01:29:12 +00:00
brian
bf75c90bd9 Pay attention to failures to SIOCAIFADDR and SIOCDIFFADDR. 2001-11-30 14:01:21 +00:00
brian
6423ccba92 Don't provide an RTA_GATEWAY sockaddr when we write RTM_CHANGE messages
to the routing socket.

The local address on a point-to-point interface is not actually a
gateway address - despite it appearing in the second column of
netstat -r's output.  Providing a gateway to an RTM_CHANGE will
currently change the route's interface so that it's using the
specified gateway - not what we want.

Patiently explained to me by:	ru
2001-11-30 14:01:20 +00:00
brian
496e7d9901 Add some DEBUG logging to tell us when interface addresses are being
added and removed
2001-11-30 14:01:18 +00:00
brian
244dad812b Remove the hack that ensures that rt_Update() works on FreeBSD. Now
that the ncpaddr code doesn't create default routes with non-zero
masks, everything works as it should.
2001-11-23 19:20:45 +00:00
brian
d8f0ad876a When writing messages to the routing socket, round sockaddr sizes
up in the same way that we expect them to be when we read them.

This is a no-op on i386 and probably on alphas, as we currently
only support AF_INET and AF_INET6.
2001-11-23 17:19:36 +00:00
brian
e37212b653 Be paranoid about non-zero netmasks being associated with INET addresses
of 0.0.0.0.

The OpenBSD PF_ROUTE/NET_RT_DUMP sysctl is sending back routes with
RTAX_NETMASK set, but the corresponding sockaddr being 4 zero bytes
(with an address family of zero).  ppp was getting confused by this
and ending up interpreting it as a 0.0.0.0/32 routing table
destination and subsequently failing to do anything with the route.

Specifically, after this fix, ppp under OpenBSD can successfully
change and delete the default route again !
2001-11-23 17:19:27 +00:00
brian
5f83a6b610 Remove an unused variable (oops) 2001-11-23 15:47:04 +00:00
brian
274cbc8854 Don't adjust_linklocal() when pulling a sockaddr out of an ncpaddr or
ncprange structure.

Don't write() the netmask for IPv6 sockaddrs to the routing socket if
the prefixlen is 128.

It seems that messages written to the routing socket with the scopeid
set for link local addresses are not understood.  Instead, we have to
put the scopeid in the 5th and 6th bytes of the address (see
adjust_linklocal() in ncpaddr.c).  I think this may be a bug in the
KAME implementation - it should really understand both forms.
2001-11-23 12:39:20 +00:00
brian
ffae273af1 Remove a bogus log_Id() decl 2001-11-23 11:15:35 +00:00
brian
c382139ffc Fix usage for the log command 2001-11-23 11:07:43 +00:00
brian
798ae959dd Whitespace tweak 2001-11-23 10:46:28 +00:00
brian
3d0a99567d Expand the first argument of the ``log'' command if it's a variable. 2001-11-22 04:23:49 +00:00
brian
b75f43a062 Document that an UPTIME variable is now available 2001-11-22 01:44:23 +00:00
brian
8b244d6bae Remove unused variables 2001-11-04 16:19:05 +00:00
brian
6a1de171ac Add a ``log'' command for logging specific information.
Add an ``UPTIME'' variable to indicate the bundle uptime.

It's now possible to put something like this in ppp.linkdown
for a server setup:

  MYADDR:
    log Session closing: User USER, address HISADDR, up UPTIME

Fixed some memory leakage with commands that expand words.
Made some functions static.
Fixed a diagnostic bug (iface add .... SIOCDIFADDR)
2001-11-03 21:45:32 +00:00
brian
0c094f30d4 Call CCP protocol -1 ``none'' 2001-11-03 19:29:30 +00:00
brian
c6127e6abf cmott@scientech.com -> cm@linktel.net
Requested by: Charless Mott <cmott@scientech.com>
2001-11-03 11:36:17 +00:00
brian
5106c4a534 Don't avoid setting a 0 second timer in datalink_StartDialTimer() by
not setting any timer.  Instead, set a 1 millisecond timer.

This ensures that ppp will come out of it's select() call after
losing carrier in -ddial mode with a reconnect period of 0 and
going to ST_OPENING, rather than waiting indefinitely for some
other event to wake ppp up.

Bump the ppp version number to indicate the event.

MFC after: 3 days
2001-10-23 13:52:19 +00:00
peter
2e67ce5d64 ia64 support. Due to the bogus placement of some i4b includes, it is
i386-only, even though it would work on all the isa-capable platforms.
Change the NOI4B so that instead of excluding alpha, it only includes i386.
2001-10-23 10:20:24 +00:00
brian
4a51aeed51 Include the right i4b files for NetBSD 2001-10-19 15:56:56 +00:00
brian
381bbd2320 Fix AUTH callback negotiations.
MFC after: 1 week
2001-10-18 08:48:04 +00:00
brian
f9a9a183bf When the peer fails to specify an MRU and a 1500 byte MRU is not
allowed either because of the transport or configuration, send a
MRU NAK only once, then allow the negotiations to proceed.

rfc1661 says that 1500 should always be allowed and rfc2516 says
that 1492 is the maximum for PPPoE.  This changes ppp so that it
only weakly suggests 1492, then goes with the default (leaving
the problem in the hands of the peer WRT how they set their MTU).

MFC after: 1 week
2001-10-18 08:47:56 +00:00
dwmalone
86cf053ae0 Hopefully improve control message passing over Unix domain sockets.
1) Allow the sending of more than one control message at a time
over a unix domain socket. This should cover the PR 29499.

2) This requires that unp_{ex,in}ternalize and unp_scan understand
mbufs with more than one control message at a time.

3) Internalize and externalize used to work on the mbuf in-place.
This made life quite complicated and the code for sizeof(int) <
sizeof(file *) could end up doing the wrong thing. The patch always
create a new mbuf/cluster now. This resulted in the change of the
prototype for the domain externalise function.

4) You can now send SCM_TIMESTAMP messages.

5) Always use CMSG_DATA(cm) to determine the start where the data
in unp_{ex,in}ternalize. It was using ((struct cmsghdr *)cm + 1)
in some places, which gives the wrong alignment on the alpha.
(NetBSD made this fix some time ago).

This results in an ABI change for discriptor passing and creds
passing on the alpha. (Probably on the IA64 and Spare ports too).

6) Fix userland programs to use CMSG_* macros too.

7) Be more careful about freeing mbufs containing (file *)s.
This is made possible by the prototype change of externalise.

PR:		29499
MFC after:	6 weeks
2001-10-04 13:11:48 +00:00
ru
1020d31fd1 Keep up with sys/net/rtsock.c,v 1.58.
Prodded by:	brian
2001-09-21 16:14:53 +00:00
brian
5903e1d51b sigpause() -> sigsuspend()
sigblock() -> sigprocmask()
2001-09-13 10:03:30 +00:00
brian
a03bd6b238 Correct alignment issues
Obtained from: OpenBSD
2001-09-13 10:03:20 +00:00
brian
2887552f52 Spell syslog.conf correctly
Submitted by:	Tony Finch <dot@dotat.at>
PR:		30545
2001-09-13 09:06:51 +00:00
brian
d99614d082 Fix a diagnostic 2001-09-04 22:07:56 +00:00
brian
5151b2478a Some cosmetic changes to sync with OpenBSD 2001-08-27 19:08:43 +00:00
brian
350c4e6271 Send a reset request for every packet received when our encryption
dictionaries are out of sync.

This avoids the complications that happen when our original reset
request gets lost in transit (quite likely in hind sight, given a
lossy link) when we end up ignoring the peer for the next (up to)
256 packets.

Submitted by:	Nick Sayer <nsayer@quack.kfu.com>
2001-08-27 10:42:21 +00:00
brian
5053d4fa27 Handle return values of 0 from NgRecvMsg() properly. 2001-08-24 14:53:41 +00:00
brian
2286423a99 o Enable IFF_MULTICAST when first opening the tun device (and keep the flag
when we ioctl(TUNSIFINFO) under OpenBSD)
o Don't bring the interface up immediately
o Don't complain about unrecognised interface flags in ``show iface''.
2001-08-21 11:07:58 +00:00
brian
9e766e7f13 Handle snprintf() returning < 0 (not just -1)
MFC after:	2 weeks
2001-08-20 15:09:34 +00:00
brian
7ac94dd0fb Properly change old interface addresses so that their destination is
255.255.255.255 if our new destination address conflicts.
2001-08-20 11:06:21 +00:00
brian
c400ea8f0c Add some comments to explain what's going on here 2001-08-20 10:25:23 +00:00
brian
0630cc6224 When attempting to change the default route, don't write the gateway
and mask to the routing socket, otherwise the update fails.

Warning provided by: markm

The code here was broken for FreeBSD when IPv6 support was added, but
was fixed for OpenBSD.  OpenBSD expects the gateway and mask to be
supplied and fails the update otherwise.
2001-08-20 00:46:33 +00:00
brian
b379a150f1 Add some casts.
Not spotted by: FreeBSD's gcc version 2.95.3 20010315 (release)
Spotted by: OpenBSD's gcc version 2.95.3 20010125 (prerelease)
2001-08-19 22:23:28 +00:00
brian
5d20b14f87 Add a missing % in a format string.
Not spotted by: FreeBSD's gcc version 2.95.3 20010315 (release)
Spotted by: OpenBSD's gcc version 2.95.3 20010125 (prerelease)
2001-08-19 22:23:23 +00:00
brian
317909c436 Avoid a compiler warning
Not spotted by: FreeBSD's gcc version 2.95.3 20010315 (release)
Spotted by: OpenBSD's gcc version 2.95.3 20010125 (prerelease)
2001-08-19 22:23:22 +00:00
brian
d100840eb7 Better handling for the return of snprintf(). 2001-08-18 22:43:11 +00:00
brian
1f224ee69c If AF_INET6 isn't available in the kernel, revert to creating AF_INET
listening sockets in ``set server''.
2001-08-18 19:16:56 +00:00
brian
bf052a7555 Back out the previous fix to deal with kernels that don't support IPv6,
and implement a far more subtle and correct fix.

The reason behind the infinite loop was that ppp was trying to make up
initial IPv6 numbers and wasn't giving up when it failed unexpectedly to
assign the addresses it just fabricated to it's interface (thinking that
the reason was because another interface was using the same address).
It now attempts this up to 100 times before just failing and trying to
muddle along (in reality, this should never happen more than a couple
of times unless our random number generator doesn't work).

Also, when IPv6 is not available, don't even try to assign the IPv6
interface address in the first place...
2001-08-18 19:07:13 +00:00
brian
cfa5d0ff52 Run correctly on a machine built without AF_INET6 support 2001-08-18 13:04:52 +00:00
brian
fb43a54a68 Build properly with -DNOINET6 2001-08-18 12:31:54 +00:00
brian
7fdf4b8b81 Build properly with -DNOIPV6 2001-08-18 12:30:41 +00:00
brian
e029be4212 Add two missing includes 2001-08-16 16:58:12 +00:00
brian
b12d9337ec Remove an unused variable 2001-08-16 16:58:02 +00:00
ru
e009d64b80 mdoc(7) police: markup nit, removed whitespace at EOL. 2001-08-16 08:26:04 +00:00
brian
9311b9a0c6 Specify the gateway address when updating the MTU and send/recv pipe
sizes on a route.

IMHO this shouldn't be necessary (the destination & mask/prefixlen
should be enough), but without it, the default route update under
OpenBSD will fail.

Thanks to: Russell T Hunt <alaric@MIT.EDU>
2001-08-16 02:01:05 +00:00
brian
435f044654 Fix a couple of forgotten comments 2001-08-16 02:00:55 +00:00
brian
1b1f9ae878 Probe for the availability of AF_INET6 at startup. If it's not
available, default ipv6cp to disabled and refuse to let the user
enable it.
2001-08-15 13:53:38 +00:00
brian
bbebfb9f8c Don't show a prefixlen when a destination address is present
in ``show iface''.
2001-08-15 13:05:39 +00:00
brian
db01b7581a Add a missing newline 2001-08-15 12:48:09 +00:00
brian
c0bbf51bca Don't forget to attache the sticky route change to the ncp structure.
PR:	29726
2001-08-15 12:47:51 +00:00
brian
7ff7ff405e Avoid calling bits2mask4() when bits is -1. 2001-08-15 12:07:39 +00:00
brian
de3feff3f8 o Add ipv6 support, abstracting most NCP addresses into opaque
structures (well, they're treated as opaque).

  It's now possible to manage IPv6 interface addresses and routing
  table entries and to filter IPV6 traffic whether encapsulated or
  not.

  IPV6CP support is crude for now, and hasn't been tested against
  any other implementations.

  RADIUS and IPv6 are independent of eachother for now.

  ppp.linkup/ppp.linkdown aren't currently used by IPV6CP

o Understand all protocols(5) in filter rules rather than only a select
  few.

o Allow a mask specification for the ``delete'' command.  It's now
  possible to specifically delete one of two conflicting routes.

o When creating and deleting proxy arp entries, do it for all IPv4
  interface addresses rather than doing it just for the ``current''
  peer address.

o When iface-alias isn't in effect, don't blow away manually (via ``iface
  add'') added interface addresses.

o When listening on a tcp server (diagnostic) socket, bind so that a
  tcp46 socket is created -- allowing both IPv4 and IPv6 connections.

o When displaying ICMP traffic, don't display the icmp type twice.
  When display traffic, display at least some information about unrecognised
  traffic.

o Bump version

Inspired after filtering work by: Makoto MATSUSHITA <matusita@jp.FreeBSD.org>
2001-08-14 16:05:52 +00:00
ru
4e5771e1b8 mdoc(7) police: s/OpenBSD/.Ox/ where appropriate. 2001-08-13 16:43:02 +00:00
brian
5317e49dea Preprocess ppp.8.m4 into ppp.8, taking into account any compile time
options used to build ppp.

Currently, this is a no-op and only handles LOCALNAT and LOCALRAD cases.

This will be used for the upcoming ipv6 changes, and allows a shared
man page between OpenBSD and FreeBSD.
2001-08-11 18:27:14 +00:00
brian
72b206d9b8 Change copyright to BSD-style copyright.
Ok'd by:	Gabor Kincses <gabor@acm.org>
2001-08-10 17:42:58 +00:00
ru
4345758876 mdoc(7) police:
Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.
2001-08-07 15:48:51 +00:00
brian
238b01d898 Warn when a CHAP81 SUCCESS packet is invalid due to an incorrect S= value. 2001-08-03 09:28:21 +00:00
brian
967f33f3bc The wrong-last-byte bug on win98 chap responses is also in winME 2001-08-02 20:12:48 +00:00
brian
c98910abd5 Add a ``nat punch_fw'' command for punching FTP and IRC DCC holes through
the firewall.
2001-08-02 10:16:32 +00:00
brian
704f051282 Don't include a NUL at the end of our CHAP SUCCESS packet.
When encryption (MPPE) is enabled, WindowsME and Windows98 both
fail because of the extra byte, suggesting that they autheticated
successfully in their log and then dropping the connection, telling
the user that the peer doesn't support compatible encryption
options.

MFC after: 1 week
2001-07-31 21:36:00 +00:00
brian
160b405b91 Remove an irritating diagnostic emitted to LogPHASE when a
static proxy arp entry is deleted.

Rename a function (for consistency) and remove some whitespace
(for readability).

MFC after:	1 week
2001-07-31 15:19:07 +00:00
brian
8466587a00 When we receive a CHAP81 challenge response, we always expect the last
byte of the packet to contain '\0'.

Windows 98 gets this wrong, dropping garbage into the last byte and
failing authentication.

Now, we notice this and whinge to our log file that we're compensating
for the corrupt data.
2001-07-31 08:21:39 +00:00
brian
635801f2ed If the peer REJects our MRU REQ, stop REQing it -- *EVEN* if we're
doing PPPoE and the default MRU is therefore too big.

When negotiating with win2k, we ask for MRU 1492 and the win2k box
NAKs us saying ``MRU 1492''.  This doesn't make sense to me.  When
we continue to request MRU 1492, the win2k box eventually REJs our
MRU.  This fix allows negotiations to continue at that point,
bringing the link up and potentially allowing the win2k box to send
us frames that are too large.  AFAICT this is better than failing
to bring the link up.... probably !

I have no idea how to do the equivalent of ``route get'' or
``ifconfig -a'' under win2k, so I can't tell what MTU it actually
ends up using.

I believe the bug is in win2k (it's certainly mis-negotiating).
I'll MFC given the release engineers permission as code freeze
begins on August 1.

PR:		29277
MFC after:	3 days
2001-07-30 17:04:39 +00:00
brian
8ab0acdbe9 Change permissions back to 4554/554
Suggested by:	kris
2001-07-28 11:58:41 +00:00
brian
933d065af2 If the peer sends a REQ without the IPADDR option, only reject it
once.  If they repeat the request (again without the IPADDR option)
ACK it.

I've had reports that some ppp implementations will not assign
themselves an IP number.  This should negotiate with such things.

MFC after:	3 days
2001-07-28 11:32:08 +00:00
brian
f19a3f3d63 Handle peer REQ/NAKs of >1500 byte MRUs when we have no preference.
MFC after: 3 days
2001-07-26 11:33:53 +00:00
brian
47bc6ecf64 Change permissions from [4]554 to [4]551
MFC after: 3 days
2001-07-25 11:44:04 +00:00
obrien
9c97c8f02d Perform a major cleanup of the usr.sbin Makefiles.
These are not perfectly in agreement with each other style-wise, but they
are orders of orders of magnitude more consistent style-wise than before.
2001-07-20 06:20:32 +00:00
obrien
be022bb715 Remove GCC'isms in CFLAGS. 2001-07-20 04:23:13 +00:00
brian
0906f6dada Bring the PPPoE Ethernet interface up *BEFORE* we send the node a
CONNECT message.

MFC after: 1 week
2001-07-18 09:33:45 +00:00
brian
adc22e971c Ignore (with a warning message) mtu/mru configurations that are greater
than the maximum physical values.

MFC after: 1 week
2001-07-17 01:06:13 +00:00
brian
27ff1556c8 TCPMSS adjusts all TCP SYN packets, not just outgoing ones.
Pointed out by: ru
2001-07-16 17:02:10 +00:00
dd
911ca14c87 Remove whitespace at EOL. 2001-07-15 08:06:20 +00:00
brian
c29f79581e Perform MSS fixups on incoming packets as well as outgoing.
MFC after: 1 week
2001-07-13 02:04:19 +00:00
dd
eaa6ee03b8 mdoc(7) police: remove extraneous .Pp before and/or after .Sh. 2001-07-09 09:54:33 +00:00
brian
ef44874abb Fix the type of the last arg to execl()
Obtained from: OpenBSD
2001-07-09 08:17:47 +00:00
brian
e5e53f5188 Staticise the OpenBSD SHA1_End() function 2001-07-09 00:45:57 +00:00
brian
e3b3f682a9 Stay (backwards-)compatible with OpenBSD's groff 2001-07-09 00:13:49 +00:00
brian
a3c5f8aba8 Add a ``nat proto'' command -- similar to natd(8)'s -redirect_proto switch.
MFC after: 3 weeks
2001-07-09 00:07:56 +00:00
brian
c11e4967f8 Don't try to dereference the -1th ccp algorithm array entry when we
open CCP with no algorithm.
2001-07-07 13:12:07 +00:00
brian
b93f87d791 When we miss one or more packets in stateful mode *and* need to
perform a key change, *and* our sequence numbers have wrapped,
ensure that the number of key changes is calculated correctly.

The previous code counted down from a negative number to zero,
re-encrypting the current key on each iteration - this took some
time and strangely enough got the answer wrong !!!

Fix a(nother) spelling mistake while I'm there.
2001-07-07 03:06:20 +00:00
brian
92b94fe6a1 Spell stateful properly
Inconsistently done by:	brian
Spotted by:		ru
2001-07-06 23:45:32 +00:00
ru
e1827422c1 mdoc(7) police: removed hard sentence breaks, sorted xrefs. 2001-07-05 11:01:12 +00:00
brian
b44d6474df Make the last fix work properly on descriptors 1 and 2 (not just 0) 2001-07-04 09:32:34 +00:00
brian
746c94eef4 Handle any of descriptors 0, 1 or 2 being closed when we're
envoked -- don't use them (as return values from open()), then
(say) close(STDIN_FILENO) when daemonising.

This is done by grabbing 3 descriptors to /dev/null at startup and
releasing them after we've daemonised.

MFC after: 1 week
2001-07-04 03:34:20 +00:00
brian
0deba2c342 Reduce the interface MTU by 2 when MPPE has been successfully negotiated.
This is necessary because MPPE will combine the protocol id with the
payload received on the tun interface, encrypt it, then prepend its
own protocol id, effectively increasing the payload by two bytes.
2001-07-03 22:20:19 +00:00
brian
c6b698395d Don't accept chap80lm by default - it doesn't work.
MFC after: 1 week
2001-07-03 22:20:11 +00:00
brian
da14c6a0f2 Silence some gcc warnings 2001-07-03 22:20:06 +00:00
brian
9251775bc4 Do away with the ``err'' variable.
Inspired by: kris
2001-07-03 01:02:26 +00:00
kris
be14d2652a Silence some of the -Wnon-const-format warnings and add __printflike()
to a function prototype which needs it.

Approved by:	brian
MFC After:	2 weeks
2001-07-02 12:27:49 +00:00
brian
96c4f4c55f Avoid using too many args for ``set m[tr]u''
This needs to work with OpenBSD's groff too :(
2001-06-20 19:55:58 +00:00
brian
12a7d2d747 Call va_start/va_end for each call to vfprintf
Obtained from: OpenBSD
2001-06-18 23:24:26 +00:00
brian
e0acd9811e Add support for stateful MPPE (microsoft encryption) providing
encryption compatibility with Windows 2000.  Stateful encryption
uses less CPU but is bad on lossy transports.

The ``set mppe'' command has been expanded.  If it's used with any
arguments, ppp will insist on encryption, closing LCP if the other
end refuses.

Unfortunately, Microsoft have abused the CCP reset request so that
receiving a reset request does not result in a reset ack when using
MPPE...

Sponsored by:	Monzoon Networks AG and FreeBSD Services Limited
2001-06-18 15:00:22 +00:00
brian
14263ff751 Handle hardware-imposed MTU/MRU limitations. PPPoE will no longer
allow MRU/MTU negotiations to exceed 1492.

Add an optional ``max'' specifier to ``set m[rt]u'', ie.

	set mtu max 1480

Bump the ppp version number.

Sponsored by:	Monzoon Networks AG and FreeBSD Services Limited
2001-06-18 14:59:36 +00:00
brian
0ec923a7cf Correct the arg count after parsing a line with an unescaped # that isn't
preceeded with whitespace.

MFC after: 3 weeks
2001-06-15 13:58:06 +00:00
brian
52cb477a72 Convert IIJ copyrights to BSD copyrights.
Approved by: Toshiharu OHNO <tohno@sirius.ocn.ne.jp>
2001-06-13 21:52:19 +00:00
sobomax
0c29f662fa Correct cross-references:
ng_bpf.8    --> ng_bpf.4
  ng_ether.8  --> ng_ether.4
  ng_iface.8  --> ng_iface.4
  ng_pppoe.8  --> ng_pppoe.4
  ng_socket.8 --> ng_socket.4
  ng_tty.8    --> ng_tty.4
  ng_{type}.4 --> /dev/null

MFC after:	1 week
2001-06-05 12:40:03 +00:00
brian
425630304c Renamed to README.nat 2001-06-04 14:40:06 +00:00
brian
0afc2da42b Add BSD style copyrights (with permission from Charles Mott where appropriate)
Deprecate -alias further (after a repo-copy)
2001-06-04 14:38:29 +00:00
brian
39c721b4d0 Fix an alignment error
PR:		27766
Submitted by:	Sudish Joseph <sudish@mindspring.com>
MFC after:	2 weeks
2001-05-30 15:52:24 +00:00
brian
bd7ad7312a Don't say ``Enter pause (-1) for redialing when we're using a random interval.
Show the calculated random value instead.

Suggested by: Bill Richter <richterb@binkley.foothill.net>
2001-05-22 19:42:14 +00:00
brian
39c66e3d7a If we don't receive a TY_IPADDR option as part of a configure request, NAK
as if we received one with 0.0.0.0 as the argument.
2001-05-22 09:03:30 +00:00
brian
bba3cec519 Bring the interface IFF_UP from ipcp_InterfaceUp() (called from IPCP's
TLU event handler).

This used to be done as a side effect of SIOCAIFADDR'ing the interface,
but now that duplicate SIOCAIFADDRs are optimised out, we can't depend
on that behaviour.
2001-05-11 23:42:03 +00:00
brian
58f11f683b Handle situations where we've already got a P2P interface address
of a/x -> b and then negotiate a/x -> c by simply expecting SIOCAIFADDR
to do the change.

This was broken by the last commit that optimised out the deletion and
re-addition of the same a/x -> b combination, and forgot to compare
the old/new destination addresses.

Conveniently enough, this problem didn't effect setups where the
default route goes via the ppp link, and most other setups don't
care what the the destination address is actually set to.  It broke
test environments where ppp connects to the local machine rather
badly though....
2001-05-02 16:35:24 +00:00
brian
aece142b9a Fix some quotes and mention that it's usually necessary to train
your modem to the correct speed when setting up an incoming getty.
2001-04-26 13:10:59 +00:00
brian
d487445d05 Handle IP over IP (IPPROTO_IPV4) properly.
We now unwrap IP/IP and apply filter rules to both the outer
  layer (with ``set filter blah x.x.x.x y.y.y.y ipip'') and to
  the payload (reinterpreted by the filter rules).

  ``set log tcp/ip'' will now show both the outer wrapper and
  the (reinterpreted) payload contents.
2001-04-24 02:13:34 +00:00
brian
0e306cda1d kldload ng_pppoe as necessary 2001-04-10 08:31:13 +00:00
brian
658db5529c It's possible to kldload netgraph (as well as the other ng_* bits),
so do it if required.
2001-04-05 22:53:35 +00:00
brian
6359851d32 When we change the interface MTU, run through the routing table and tweak
all route MTUs too.
2001-04-05 02:23:48 +00:00
brian
626603131b Be a bit more persistent when the NET_RT_IFLIST sysctl returns ENOMEM
rather than dropping out immediately.
2001-04-03 08:21:28 +00:00
brian
281e45eb31 Don't say ``PPP enabled'' if we're given the -quiet switch 2001-04-03 08:20:20 +00:00
brian
9e1dc5332d Don't assume challenges and responses don't contain embedded '\0's.
Mschapv2 response generation may produce embedded NULs... causing
us to send a bogus response to the radius server and end up
failing the client's valid response.

Problem pointed out by: Eugene Vigovskiy <vigov@com2com.ru>
2001-04-01 22:39:17 +00:00