From dmitry@atlantis.dp.ua  Fri Apr  4 14:42:59 2003
Return-Path: <dmitry@atlantis.dp.ua>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4673B37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  4 Apr 2003 14:42:59 -0800 (PST)
Received: from smtp.atlantis.dp.ua (smtp.atlantis.dp.ua [193.108.46.231])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C745943F3F
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  4 Apr 2003 14:42:56 -0800 (PST)
	(envelope-from dmitry@atlantis.dp.ua)
Received: from atlantis.dp.ua (localhost [127.0.0.1])
	by smtp.atlantis.dp.ua (8.12.6p2/8.12.6) with ESMTP id h34MglL1025434
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 5 Apr 2003 01:42:47 +0300 (EEST)
	(envelope-from dmitry@atlantis.dp.ua)
Received: (from dmitry@localhost)
	by atlantis.dp.ua (8.12.6p2/8.12.6/Submit) id h34MgkHn025424;
	Sat, 5 Apr 2003 01:42:46 +0300 (EEST)
	(envelope-from dmitry)
Message-Id: <200304042242.h34MgkHn025424@atlantis.dp.ua>
Date: Sat, 5 Apr 2003 01:42:46 +0300 (EEST)
From: Dmitry Pryanishnikov <dmitry@atlantis.dp.ua>
Reply-To: Dmitry Pryanishnikov <dmitry@atlantis.dp.ua>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [PATCH] pppd(8) incorrect CBCP response for admin-specified number
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         50613
>Category:       bin
>Synopsis:       [PATCH] pppd(8) incorrect CBCP response for admin-specified number
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    delphij
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 04 14:50:04 PST 2003
>Closed-Date:    Sat Dec 11 11:41:13 GMT 2004
>Last-Modified:  Sat Dec 11 11:41:13 GMT 2004
>Originator:     Dmitry Pryanishnikov
>Release:        FreeBSD 4.7-RELEASE i386
>Organization:
Atlantis ISP
>Environment:
System: FreeBSD atlantis.atlantis.dp.ua 4.7-RELEASE FreeBSD 4.7-RELEASE #2: Mon Feb 24 17:35:38 EET 2003 root@atlantis.atlantis.dp.ua:/usr/src/sys/compile/ATLANTIS i386

>Description:
   pppd(8) can be used for requesting callback from an access server via CBCP
by specifying parameter

callback <phone-number>

Access server can use two types of callback: callback to user-specified number
and callback to administrator specified number. In the last case, phone-number
will be ignored and pppd just sets callback delay in CBCP response packet.
However, this type of CBCP doesn't work with Ascend MAX4060, CBCP never
finished:

Apr  5 00:33:10 homelynx pppd[2152]: cbcp_open
Apr  5 00:33:10 homelynx pppd[2152]: rcvd [CBCP Request id=0x1 < AdminDefined delay = 0>]
Apr  5 00:33:10 homelynx pppd[2152]: length: 3
Apr  5 00:33:10 homelynx pppd[2152]: user admin defined allowed
Apr  5 00:33:10 homelynx pppd[2152]: cbcp_resp cb_type=8
Apr  5 00:33:10 homelynx pppd[2152]: cbcp_resp CONF_ADMIN
Apr  5 00:33:10 homelynx pppd[2152]: sent [CBCP Response id=0x1 < AdminDefined delay = 5 number = >]
Apr  5 00:33:19 homelynx pppd[2152]: sent [LCP EchoReq id=0x1 magic=0x20880b5d]
Apr  5 00:33:19 homelynx pppd[2152]: rcvd [LCP EchoRep id=0x1 magic=0x0]
Apr  5 00:33:29 homelynx pppd[2152]: sent [LCP EchoReq id=0x2 magic=0x20880b5d]

It's easy to see (number= ) that pppd(8) transmits extra zero byte at the end
of response packet, which confuses MAX. In Microsoft's CBCP specification
clearly said that only callback delay must be present in this type of response.

>How-To-Repeat:
   Try to request a callback from MAX4060 which uses CBCP callback to
administrator specified phone number using

pppd callback <phone-number> 

(<phone-number> can be any string, it's ignored for this type of callback).

>Fix:
   Patch is really trivial, it just removes dummy zero byte at the end of
packet:

--- cbcp.c.orig	Sat Aug 28 04:19:00 1999
+++ cbcp.c	Sat Apr  5 00:48:20 2003
@@ -343,10 +343,9 @@
     if (cb_type & ( 1 << CB_CONF_ADMIN ) ) {
 	syslog(LOG_DEBUG, "cbcp_resp CONF_ADMIN");
         PUTCHAR(CB_CONF_ADMIN, bufp);
-	len = 3 + 1;
+	len = 3;
 	PUTCHAR(len , bufp);
 	PUTCHAR(5, bufp); /* delay */
-	PUTCHAR(0, bufp);
 	cbcp_send(us, CBCP_RESP, buf, len);
 	return;
     }

After applying this patch CBCP works correctly:

Apr  5 00:50:34 homelynx pppd[2497]: cbcp_open
Apr  5 00:50:34 homelynx pppd[2497]: rcvd [CBCP Request id=0x1 < AdminDefined delay = 0>]
Apr  5 00:50:34 homelynx pppd[2497]: length: 3
Apr  5 00:50:34 homelynx pppd[2497]: user admin defined allowed
Apr  5 00:50:34 homelynx pppd[2497]: cbcp_resp cb_type=8
Apr  5 00:50:34 homelynx pppd[2497]: cbcp_resp CONF_ADMIN
Apr  5 00:50:34 homelynx pppd[2497]: sent [CBCP Response id=0x1 < AdminDefined delay = 5>]
Apr  5 00:50:34 homelynx pppd[2497]: rcvd [CBCP Ack id=0x1 < AdminDefined delay = 5>]
Apr  5 00:50:34 homelynx pppd[2497]: sent [LCP TermReq id=0x2 "Call me back, please"]
Apr  5 00:50:34 homelynx pppd[2497]: rcvd [LCP TermAck id=0x2]
   
>Release-Note:
>Audit-Trail:

From: dmitry@atlantis.dp.ua
To: freebsd-gnats-submit@FreeBSD.org, dmitry@atlantis.dp.ua
Cc:  
Subject: Re: bin/50613: [PATCH] pppd(8) incorrect CBCP re
Date: Tue, 8 Apr 2003 17:39:14 +0300 (EEST)

 It seems that pppd(8) also incorrectly responces "No callback" type. One
 can specify "callback number" option, call MAX4060 unit with CBCP enabled,
 but no Ascend-CBCP-Mode RADIUS attribute specified, any CBCP will also
 never finish. Below is cumulative patch for both problems:
 
 --- cbcp.c.orig Sat Aug 28 04:19:00 1999
 +++ cbcp.c      Tue Apr  8 17:05:00 2003
 @@ -343,10 +343,9 @@
      if (cb_type & ( 1 << CB_CONF_ADMIN ) ) {
         syslog(LOG_DEBUG, "cbcp_resp CONF_ADMIN");
          PUTCHAR(CB_CONF_ADMIN, bufp);
 -       len = 3 + 1;
 +       len = 3;
         PUTCHAR(len , bufp);
         PUTCHAR(5, bufp); /* delay */
 -       PUTCHAR(0, bufp);
         cbcp_send(us, CBCP_RESP, buf, len);
         return;
      }
 @@ -354,9 +353,8 @@
      if (cb_type & ( 1 << CB_CONF_NO ) ) {
          syslog(LOG_DEBUG, "cbcp_resp CONF_NO");
         PUTCHAR(CB_CONF_NO, bufp);
 -       len = 3;
 +       len = 2;
         PUTCHAR(len , bufp);
 -       PUTCHAR(0, bufp);
         cbcp_send(us, CBCP_RESP, buf, len);
         (*ipcp_protent.open)(us->us_unit);
         return;
 
 Microsoft's CBCP specification says:
 
 3.2.1 No Callback
     The Caller requests not to be called back at all. The Callback Type
     is set to 1.
     No Callback address or Callback Delay field is supplied.
 
 pppd(8) session log before patch (callback number specified, MAX4060 instructed
 not to call back):
 
 Apr  8 17:01:32 homelynx pppd[242]: cbcp_open
 Apr  8 17:01:32 homelynx pppd[242]: rcvd [CBCP Request id=0x1 < NoCallback>]
 Apr  8 17:01:32 homelynx pppd[242]: length: 2
 Apr  8 17:01:32 homelynx pppd[242]: no callback allowed
 Apr  8 17:01:32 homelynx pppd[242]: cbcp_resp cb_type=2
 Apr  8 17:01:32 homelynx pppd[242]: cbcp_resp CONF_NO
 Apr  8 17:01:32 homelynx pppd[242]: sent [CBCP Response id=0x1 < NoCallback dela
 y = 0>]
 Apr  8 17:01:32 homelynx pppd[242]: sent [IPCP ConfReq id=0x1 <addr 192.168.27.1
 3> <compress VJ 0f 01>]
 Apr  8 17:01:41 homelynx last message repeated 3 times
 
 After patch:
 
 Apr  8 17:06:36 homelynx pppd[366]: cbcp_open
 Apr  8 17:06:36 homelynx pppd[366]: rcvd [CBCP Request id=0x1 < NoCallback>]
 Apr  8 17:06:36 homelynx pppd[366]: length: 2
 Apr  8 17:06:36 homelynx pppd[366]: no callback allowed
 Apr  8 17:06:36 homelynx pppd[366]: cbcp_resp cb_type=2
 Apr  8 17:06:36 homelynx pppd[366]: cbcp_resp CONF_NO
 Apr  8 17:06:36 homelynx pppd[366]: sent [CBCP Response id=0x1 < NoCallback>]
 Apr  8 17:06:36 homelynx pppd[366]: sent [IPCP ConfReq id=0x1 <addr 192.168.27.1
 3> <compress VJ 0f 01>]
 Apr  8 17:06:37 homelynx pppd[366]: rcvd [CBCP Ack id=0x1 < NoCallback>]
 Apr  8 17:06:37 homelynx pppd[366]: sent [LCP TermReq id=0x2 "Call me back, plea
 se"]
 
 
 

From: Dmitry Pryanishnikov <dmitry@atlantis.dp.ua>
To: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org
Cc:  
Subject: Re: bin/50613: [PATCH] pppd(8) incorrect CBCP response for
 admin-specified number
Date: Fri, 19 Nov 2004 12:30:24 +0200 (EET)

 Hello!
 
   Due to changes in cbcp.c my previuos patch won't apply - I've regenerated
 it to match cbcp.c version "1.4.2.1 2004/11/18 15:21:41 delphij"
 
 --- cbcp.c.orig	Fri Nov 19 12:17:56 2004
 +++ cbcp.c	Fri Nov 19 12:27:34 2004
 @@ -345,10 +345,9 @@
       if (cb_type & ( 1 << CB_CONF_ADMIN ) ) {
           syslog(LOG_DEBUG, "cbcp_resp CONF_ADMIN");
           PUTCHAR(CB_CONF_ADMIN, bufp);
 -        len = 3 + 1;
 +        len = 3;
           PUTCHAR(len , bufp);
           PUTCHAR(5, bufp); /* delay */
 -        PUTCHAR(0, bufp);
           cbcp_send(us, CBCP_RESP, buf, len);
           return;
       }
 @@ -356,9 +355,8 @@
       if (cb_type & ( 1 << CB_CONF_NO ) ) {
           syslog(LOG_DEBUG, "cbcp_resp CONF_NO");
           PUTCHAR(CB_CONF_NO, bufp);
 -        len = 3;
 +        len = 2;
           PUTCHAR(len , bufp);
 -        PUTCHAR(0, bufp);
           cbcp_send(us, CBCP_RESP, buf, len);
           (*ipcp_protent.open)(us->us_unit);
           return;
 
 
 Sincerely, Dmitry
 -- 
 Atlantis ISP, System Administrator
 e-mail:  dmitry@atlantis.dp.ua
 nic-hdl: LYNX-RIPE
Responsible-Changed-From-To: freebsd-bugs->delphij 
Responsible-Changed-By: delphij 
Responsible-Changed-When: Sat Nov 20 15:50:01 GMT 2004 
Responsible-Changed-Why:  
Take. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=50613 
State-Changed-From-To: open->patched 
State-Changed-By: delphij 
State-Changed-When: Mon Dec 6 15:55:41 GMT 2004 
State-Changed-Why:  
Patched in 6-CURRENT, will MFC after a settlement period, and 4.11-RELEASE 
if approved by re@.  Thanks for your submission! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=50613 
State-Changed-From-To: patched->closed 
State-Changed-By: delphij 
State-Changed-When: Sat Dec 11 11:40:41 GMT 2004 
State-Changed-Why:  
MFC'ed to RELENG_5 and RELENG_4.  Thanks for your submission! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=50613 
>Unformatted:
