mp.c

ppp协议实现源代码

/*
 * Multilink PPP example code.
 *
 * Assumptions:
 *
 *	Input data is in linear buffers, which probably
 *	isn't the case for many implementations, and input
 *	buffers have sufficient leading and trailing padding
 *	to allow for any expansion necessary.
 *
 *	Strict adherence to RFC 1661 is desired, which may not
 *	necessarily be the case for the protocol field.
 *
 *	Underlying machine has 8-bit bytes and a fairly modern
 *	architecture.
 *
 * This code may be used for any purpose as long as the author's
 * copyright is cited in any source code distributed.  This code
 * is also available electronically from the author's web site.
 *
 * http://people.ne.mediaone.net/carlson/ppp
 *
 * http://www.workingcode.com/ppp
 *
 * Copyright 1997 by James Carlson and Working Code
 */

#include <stdlib.h>
#include <syslog.h>

#include "sysdep.h"
#include "mp.h"

/* Contains information for a single fragment awaiting reassembly. */
struct mp_fragment {
    struct mp_fragment *next;	/* Next fragment in sequence */
    int length;			/* Length of this fragment */
    uint32 seq;			/* Sequence number */
    octet flags;		/* Begin/end flags */
    octet data[1];		/* Data */
};

/* State data needed for MP level between bundle and links */
struct mp_state {
    struct mp_state *next;	/* Next MP bundle in system */
    struct ppp_link *lptr;	/* Pointer to bundle-level session */
    struct ppp_link *links;	/* Pointer to member links */
    struct ppp_link *in_on;	/* Link over which last packet arrived */
    struct ppp_link *next_out_link;	/* Next output link to use */
    int numlinks;		/* Number member links */
    BOOLEAN snd_short_seq;	/* Send short sequence numbers */
    BOOLEAN rcv_short_seq;	/* Accept short sequence numbers */
    uint32 send_seq;		/* Next sequence number to send */
    struct mp_fragment *frags;	/* List of received fragments */
};

/* List of all MP sessions in system */
static struct mp_state *global_mp_list = NULL;

/*
 * Locate a given NCP handler by PPP protocol ID.
 */
static struct xcp_state *
find_xcp(struct ppp_link *lptr, uint16 proto)
{
    struct xcp_state *xcp;

    for (xcp = lptr->xcp_list; xcp != NULL; xcp = xcp->next)
	if (xcp->proto == proto)
	    break;
    return xcp;
}

/*
 * Send an LCP reject for an unknown protocol.
 */
static void
send_lcp_protocol_reject(struct ppp_link *lptr, uint16 proto,
			 octet *indata, int inlen)
{
    struct xcp_state *xcp;

    xcp = find_xcp(lptr,PPP_PROTO_LCP);
    if (xcp == NULL || xcp->state != Opened)
	return;
    syslog(LOG_DEBUG,"Unknown protocol %04X; rejecting.",proto);

    /* Add LCP protocol reject header */
    indata -= 6;
    indata[0] = PROTO_REJ;
    indata[1] = ++xcp->id_number;
    indata[2] = inlen >> 8;
    indata[3] = inlen & 0xFF;
    indata[4] = proto >> 8;
    indata[5] = proto & 0xFF;
    inlen += 6;
    (*xcp->send_data)(xcp,indata,inlen);
}

/*
 * Next level handler above HDLC or AHDLC.  Assumes that CRC has been
 * verified and removed, and that all escaping (transparency)
 * characters have been handled.  The PPP processing continues here by
 * decoding the address and control fields, then by demultiplexing
 * based on the PPP protocol number.
 */
void
link_receive(struct ppp_link *lptr, octet *indata, int inlen)
{
    uint16 proto;
    struct xcp_state *xcp;

    if (inlen < 2)
	return;

    /* Handle address and control field compression */
    if (lptr->acfc_in) {
	if (indata[0] == 0xFF && indata[1] == 0x03) {
	    indata += 2;
	    inlen -= 2;
	}
    } else {
	if (indata[0] != 0xFF || indata[1] != 0x03) {
	    lptr->frame_drops++;
	    return;
	}
	indata += 2;
	inlen -= 2;
    }

    /* Handle protocol field compression */
    if (lptr->pfc_in) {
	if (inlen < 1)
	    return;
	proto = *indata++;
	inlen--;
	if (!(proto & 1)) {
	    if (inlen < 1)
		return;
	    proto = (proto << 8) | *indata++;
	    inlen--;
	}
    } else {
	if (inlen < 2)
	    return;
	proto = (indata[0] << 8) | indata[1];
	inlen -= 2;
	indata += 2;
    }

    /* Discard frames with illegal protocol fields. */
    if ((proto & 0x101) != 1) {
	lptr->frame_drops++;
	return;
    }

    /*
     * If per-link ECP is used, then we have to do this first.  This
     * must be done here because demultiplexing when MP is in use is
     * done at the MP bundle level, not at the link level.
     *
     * For better security, it may be desirable to discard any non-LCP,
     * non-ECP packets when ECP is in open state.  This provides some
     * protection against attackers who are able to insert data on the
     * line.
     */
    if (lptr->ecp_in_use && proto == PPP_PROTO_EP_LINK) {
	xcp = find_xcp(lptr,proto);
	indata = ecp_decrypt(xcp,indata,&inlen);
	if (indata == NULL)
	    return;
	if (inlen < 1)
	    return;
	proto = *indata++;
	inlen--;
	if (!(proto & 1)) {
	    if (inlen < 1)
		return;
	    proto = (proto << 8) | *indata++;
	    inlen--;
	}
    }

    /*
     * If we're doing per-link CCP, then we have to do it before normal
     * demultiplexing because CCP usually needs to inspect all data and
     * because demultiplexing on an MP system is done at the bundle
     * level.
     */
    if (lptr->ccp_in_use) {
	xcp = find_xcp(lptr,PPP_PROTO_CP_LINK);
	if (proto == PPP_PROTO_CP_LINK) {
	    indata = ccp_uncompress(xcp,indata,&inlen);
	    if (indata == NULL)
		return;
	    if (inlen < 1)
		return;
	    proto = *indata++;
	    inlen--;
	    if (!(proto & 1)) {
		if (inlen < 1)
		    return;
		proto = (proto << 8) | *indata++;
		inlen--;
	    }
	} else
	    ccp_uncompressed(xcp,proto,indata,inlen);
    }

    /*
     * If we're a link in an MP bundle, then send to NCP at bundle level
     * when necessary.  Most LCP messages should be handled at the link
     * level.  Protocol-Reject (code 8), though, should go to the bundle
     * level, since it is used to shut down NCPs.  One might consider
     * sending the Time-Remaining message to the bundle level as well,
     * depending on system architecture.
     *
     * Note that LCP should disconnect this link from the bundle if it
     * leaves the Open state.
     */
    if (lptr->mp != NULL &&
	(proto != PPP_PROTO_LCP || indata[0] == 8)) {
	lptr->mp->in_on = lptr;
	xcp = find_xcp(lptr->mp->lptr,proto);
    } else
	xcp = find_xcp(lptr,proto);

    /* Dispatch to appropriate handler now. */
    if (xcp != NULL)
	(*xcp->handler)(xcp,indata,inlen);
    else {
	/* No handler for this protocol, log it and reject it. */
	send_lcp_protocol_reject(lptr,proto,indata,inlen);
    }
}

/*
 * Add address, control, and protocol fields.
 */
static int
add_acf_and_pf(struct ppp_link *lptr, octet *outdata, uint16 proto)
{
    octet *ood = outdata;

    if (lptr->pfc_out && (proto & 0xFF00) == 0)
	*--outdata = proto & 0xFF;
    else {
	*--outdata = proto & 0xFF;
	*--outdata = proto >> 8;
    }

    if (!lptr->acfc_out && proto != PPP_PROTO_LCP) {
	*--outdata = 0x03;
	*--outdata = 0xFF;
    }

    return ood-outdata;
}

/*
 * Standard (non-MP) PPP output routine.
 */
static void
normal_output(struct ppp_link *link, octet *outdata, int outlen, uint16 proto)
{
    int i;

    i = add_acf_and_pf(link,outdata,proto);
    outdata -= i;
    outlen += i;
    (*link->user_output)(link->handle,outdata,outlen);
}

/*
 * This routine replaces the normal link_output routine for the bundle
 * level PPP link.
 */
static void
mp_output(struct ppp_link *lptr, octet *outdata, int outlen, uint16 proto)
{
    struct mp_state *mp = lptr->mp;
    struct ppp_link *ind_lptr;
    int fragsize,len,hdrsize;
    octet flags;

    /* Prepend a compressed protocol ID field */
    if (proto <= 0xFF) {
	*--outdata = proto;
	outlen++;
    } else { 
	*--outdata = proto & 0xFF;
	*--outdata = proto >> 8;
	outlen += 2;
    }

    /* Figure output fragment size */
    if (outlen < MIN_FRAG_SIZE)
	fragsize = outlen;
    else
	fragsize = (outlen+mp->numlinks-1)/mp->numlinks;
    if (mp->snd_short_seq)
	hdrsize = 2;
    else
	hdrsize = 4;

    /* Loop over packet and transmit fragments. */
    flags = MP_BEGIN;
    ind_lptr = mp->next_out_link;
    while (outlen > 0) {
	if (ind_lptr == NULL) {
	    ind_lptr = mp->links;
	    if (ind_lptr == NULL)
		break;
	}
	len = outlen;
	if (len > fragsize)
	    len = fragsize;
	if (len > ind_lptr->mtu-hdrsize)
	    len = ind_lptr->mtu-hdrsize;
	if ((outlen -= len) == 0)
	    flags |= MP_END;

	/*
	 * Add an MP header.  WARNING:  Corrupts previous output data!
	 * The link_output routine has to block until all data have been
	 * copied into a local buffer or transmitted.  (Scatter/gather
	 * is the usual way to handle this, but not in this simple
	 * example.)
	 */
	*--outdata = mp->send_seq & 0xFF;
	if (mp->snd_short_seq)
	    *--outdata = ((mp->send_seq>>8) & 0xF) | flags;
	else {
	    *--outdata = (mp->send_seq>>8) & 0xFF;
	    *--outdata = (mp->send_seq>>16) & 0xFF;
	    *--outdata = flags;
	    len += 2;
	}
	len += 2;
	(*ind_lptr->link_output)(ind_lptr,outdata,len,PPP_PROTO_MP);
	flags = 0;
	outdata += len;
	mp->send_seq++;
	ind_lptr = ind_lptr->next;
    }
    mp->next_out_link = ind_lptr;
}

/*
 * MP input handler.  Does reassembly and demultiplexing.
 *
 * The modular arithmetic tests done are a little tricky, so they're
 * commented with the equivalent regular arithmetic test.
 *
 * Comments indicating where the PPP system can be notified of lost
 * packets are also included, as are notes identifying peer
 * misbehavior.
 *
 * "link" is bundle level state pointer.  "lptr" is link level for
 * received data.
 */
static void
mp_handler(struct xcp_state *mpxcp, octet *indata, int inlen)
{
    struct ppp_link *lptr,*link = mpxcp->link, *ltmp;
    struct mp_state *mp = link->mp;
    struct mp_fragment *frag,*newfrag,*start,*nextf;
    int flags;
    uint32 newseq,thisseq,sbit,smask,minseq;
    static char buffer[MAX_MRRU];
    char *bp;
    uint16 proto;
    struct xcp_state *xcp;

    /* Get pointer to link on which this message came in. */
    lptr = mp->in_on;

    /* Decode MP flags and sequence number. */
    flags = indata[0];
    if (mp->rcv_short_seq) {
	if (inlen < 2 || (indata[0] & 0x30) != 0) {
	    syslog(LOG_NOTICE,"corrupted MP header");
	    return;
	}
	newseq = ((indata[0] & 0xF) << 8) | indata[1];
	indata += 2;
	inlen -= 2;
	sbit = 0x800;
    } else {
	if (inlen < 4 || (indata[0] & 0x3F) != 0) {
	    syslog(LOG_NOTICE,"corrupted MP header");
	    return;
	}
	newseq = (indata[1] << 16) | (indata[2] << 8) | indata[3];
	indata += 4;
	inlen -= 4;
	sbit = 0x800000;
    }
    smask = (sbit << 1) - 1;

    /* if newseq < lptr->seq */
    if (((newseq-lptr->seq) & sbit) != 0) {
	syslog(LOG_DEBUG,"out-of-order packet %lu on link %p",newseq,lptr);
	return;
    }

    /* Find minimum sequence number over all links and save at bundle level. */
    minseq = lptr->seq = newseq;
    for (ltmp = mp->links; ltmp != NULL; ltmp = ltmp->next)
	/* if ltmp->seq < minseq */
	if (((ltmp->seq-minseq) & sbit) != 0)
	    minseq = ltmp->seq;
    link->seq = minseq;
    /* syslog(LOG_DEBUG,"handling sequence %lu; minimum is %lu",newseq,
       minseq);*/

    /* Create fragment record for this new message. */
    newfrag = (struct mp_fragment *)malloc(sizeof(*newfrag)+inlen);
    if (newfrag == NULL) {
	syslog(LOG_ERR,"MP storage allocation failure; fragment dropped.");
	if (flags & MP_END)
	    /* Packet has been dropped. */
	    link->frame_drops++;
	return;
    }
    newfrag->flags = flags;
    newfrag->seq = newseq;
    newfrag->length = inlen;
    memcpy(newfrag->data,indata,inlen);

    /* If this new fragment is before the first one, then enqueue it now. */
    if ((frag = mp->frags) == NULL ||
	/* newseq < frag->seq */
	((newseq-frag->seq) & sbit) != 0) {
	newfrag->next = frag;
	mp->frags = newfrag;
	newfrag = NULL;
    }

    /* Loop over fragments and update the list */
    start = NULL;
    frag = mp->frags;
    if (frag->flags & MP_BEGIN)
	start = frag;
    mp->frags = NULL;
    while (start != NULL || newfrag != NULL) {

    nextfrag:
	thisseq = frag->seq;
	nextf = frag->next;

	/* Drop any duplicate fragments */
	if (newfrag != NULL && thisseq == newseq) {
	    syslog(LOG_DEBUG,"dropped duplicate sequence %lu",thisseq);
	    free(newfrag);
	    newfrag = NULL;