Home | History | Annotate | Line # | Download | only in net
if_pppoe.c revision 1.11
      1 /* $NetBSD: if_pppoe.c,v 1.11 2001/12/10 23:23:24 martin Exp $ */
      2 
      3 /*
      4  * Copyright (c) 2001 Martin Husemann. All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     25  * SUCH DAMAGE.
     26  *
     27  */
     28 
     29 #include <sys/cdefs.h>
     30 __KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.11 2001/12/10 23:23:24 martin Exp $");
     31 
     32 #include "pppoe.h"
     33 #include "bpfilter.h"
     34 
     35 #include <sys/param.h>
     36 #include <sys/systm.h>
     37 #include <sys/kernel.h>
     38 #include <sys/callout.h>
     39 #include <sys/malloc.h>
     40 #include <sys/mbuf.h>
     41 #include <sys/socket.h>
     42 #include <sys/proc.h>
     43 #include <sys/ioctl.h>
     44 #include <net/if.h>
     45 #include <net/if_types.h>
     46 #include <net/if_ether.h>
     47 #include <net/if_sppp.h>
     48 #include <net/if_pppoe.h>
     49 
     50 #if NBPFILTER > 0
     51 #include <net/bpf.h>
     52 #endif
     53 
     54 #undef PPPOE_DEBUG		/* XXX - remove this or make it an option */
     55 /* #define PPPOE_DEBUG 1 */
     56 
     57 #define PPPOE_HEADERLEN	6
     58 #define	PPPOE_VERTYPE	0x11	/* VER=1, TYPE = 1 */
     59 
     60 #define	PPPOE_TAG_EOL		0x0000		/* end of list */
     61 #define	PPPOE_TAG_SNAME		0x0101		/* service name */
     62 #define	PPPOE_TAG_ACNAME	0x0102		/* access concentrator name */
     63 #define	PPPOE_TAG_HUNIQUE	0x0103		/* host unique */
     64 #define	PPPOE_TAG_ACCOOKIE	0x0104		/* AC cookie */
     65 #define	PPPOE_TAG_VENDOR	0x0105		/* vendor specific */
     66 #define	PPPOE_TAG_RELAYSID	0x0110		/* relay session id */
     67 #define	PPPOE_TAG_SNAME_ERR	0x0201		/* service name error */
     68 #define	PPPOE_TAG_ACSYS_ERR	0x0202		/* AC system error */
     69 #define	PPPOE_TAG_GENERIC_ERR	0x0203		/* gerneric error */
     70 
     71 #define PPPOE_CODE_PADI		0x09		/* Active Discovery Initiation */
     72 #define	PPPOE_CODE_PADO		0x07		/* Active Discovery Offer */
     73 #define	PPPOE_CODE_PADR		0x19		/* Active Discovery Request */
     74 #define	PPPOE_CODE_PADS		0x65		/* Active Discovery Session confirmation */
     75 #define	PPPOE_CODE_PADT		0xA7		/* Active Discovery Terminate */
     76 
     77 /* Read a 16 bit unsigned value from a buffer */
     78 #define PPPOE_READ_16(PTR, VAL)				\
     79 		(VAL) = ((PTR)[0] << 8) | (PTR)[1];	\
     80 		(PTR)+=2
     81 
     82 /* Add a 16 bit unsigned value to a buffer pointed to by PTR */
     83 #define	PPPOE_ADD_16(PTR, VAL)			\
     84 		*(PTR)++ = (VAL) / 256;		\
     85 		*(PTR)++ = (VAL) % 256
     86 
     87 /* Add a complete PPPoE header to the buffer pointed to by PTR */
     88 #define PPPOE_ADD_HEADER(PTR, CODE, SESS, LEN)	\
     89 		*(PTR)++ = PPPOE_VERTYPE;	\
     90 		*(PTR)++ = (CODE);		\
     91 		PPPOE_ADD_16(PTR, SESS);	\
     92 		PPPOE_ADD_16(PTR, LEN)
     93 
     94 struct pppoe_softc {
     95 	struct sppp sc_sppp;		/* contains a struct ifnet as first element */
     96 	LIST_ENTRY(pppoe_softc) sc_list;
     97 	struct ifnet *sc_eth_if;	/* ethernet interface we are using */
     98 
     99 #define	PPPOE_DISC_TIMEOUT	hz/5
    100 #define PPPOE_DISC_MAXPADI	4	/* retry PADI four times */
    101 #define	PPPOE_DISC_MAXPADR	2	/* retry PADR twice */
    102 
    103 #define PPPOE_STATE_INITIAL	0
    104 #define PPPOE_STATE_PADI_SENT	1
    105 #define	PPPOE_STATE_PADR_SENT	2
    106 #define	PPPOE_STATE_SESSION	3
    107 #define	PPPOE_STATE_CLOSING	4
    108 	int sc_state;			/* discovery phase or session connected */
    109 	struct ether_addr sc_dest;	/* hardware address of concentrator */
    110 	u_int16_t sc_session;		/* PPPoE session id */
    111 
    112 	char *sc_service_name;		/* if != NULL: requested name of service */
    113 	char *sc_concentrator_name;	/* if != NULL: requested concentrator id */
    114 	u_int8_t *sc_ac_cookie;		/* content of AC cookie we must echo back */
    115 	size_t sc_ac_cookie_len;	/* length of cookie data */
    116 	struct callout sc_timeout;	/* timeout while not in session state */
    117 	int sc_padi_retried;		/* number of PADI retries already done */
    118 	int sc_padr_retried;		/* number of PADR retries already done */
    119 };
    120 
    121 /* incoming traffic will be queued here */
    122 struct ifqueue ppoediscinq = { NULL };
    123 struct ifqueue ppoeinq = { NULL };
    124 
    125 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    126 void * pppoe_softintr = NULL;
    127 static void pppoe_softintr_handler(void *);
    128 #else
    129 struct callout pppoe_softintr = CALLOUT_INITIALIZER;
    130 void pppoe_softintr_handler(void*);
    131 #endif
    132 
    133 extern int sppp_ioctl(struct ifnet *ifp, unsigned long cmd, void *data);
    134 
    135 /* input routines */
    136 static void pppoe_input(void);
    137 static void pppoe_disc_input(struct mbuf *m);
    138 static void pppoe_dispatch_disc_pkt(u_int8_t *p, size_t size, struct ifnet *rcvif, struct ether_header *eh);
    139 static void pppoe_data_input(struct mbuf *m);
    140 
    141 /* management routines */
    142 void pppoeattach(int count);
    143 static int pppoe_connect(struct pppoe_softc *sc);
    144 static int pppoe_disconnect(struct pppoe_softc *sc);
    145 static void pppoe_abort_connect(struct pppoe_softc *sc);
    146 static int pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, caddr_t data);
    147 static void pppoe_tls(struct sppp *sp);
    148 static void pppoe_tlf(struct sppp *sp);
    149 static void pppoe_start(struct ifnet *ifp);
    150 
    151 /* internal timeout handling */
    152 static void pppoe_timeout(void*);
    153 
    154 /* sending actual protocol controll packets */
    155 static int pppoe_send_padi(struct pppoe_softc *sc);
    156 static int pppoe_send_padr(struct pppoe_softc *sc);
    157 static int pppoe_send_padt(struct pppoe_softc *sc);
    158 
    159 /* raw output */
    160 static int pppoe_output(struct pppoe_softc *sc, struct mbuf *m);
    161 
    162 /* internal helper functions */
    163 static struct pppoe_softc * pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif);
    164 static struct pppoe_softc * pppoe_find_softc_by_hunique(u_int8_t *token, size_t len, struct ifnet *rcvif);
    165 
    166 LIST_HEAD(pppoe_softc_head, pppoe_softc) pppoe_softc_list;
    167 
    168 int     pppoe_clone_create __P((struct if_clone *, int));
    169 void    pppoe_clone_destroy __P((struct ifnet *));
    170 
    171 struct if_clone pppoe_cloner =
    172     IF_CLONE_INITIALIZER("pppoe", pppoe_clone_create, pppoe_clone_destroy);
    173 
    174 /* ARGSUSED */
    175 void
    176 pppoeattach(count)
    177 	int count;
    178 {
    179 	LIST_INIT(&pppoe_softc_list);
    180 	if_clone_attach(&pppoe_cloner);
    181 
    182 	ppoediscinq.ifq_maxlen = IFQ_MAXLEN;
    183 	ppoeinq.ifq_maxlen = IFQ_MAXLEN;
    184 
    185 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    186 	pppoe_softintr = softintr_establish(IPL_SOFTNET, pppoe_softintr_handler, NULL);
    187 #endif
    188 }
    189 
    190 int
    191 pppoe_clone_create(ifc, unit)
    192 	struct if_clone *ifc;
    193 	int unit;
    194 {
    195 	struct pppoe_softc *sc;
    196 
    197 	sc = malloc(sizeof(struct pppoe_softc), M_DEVBUF, M_WAITOK);
    198 	memset(sc, 0, sizeof(struct pppoe_softc));
    199 
    200 	sprintf(sc->sc_sppp.pp_if.if_xname, "pppoe%d", unit);
    201 	sc->sc_sppp.pp_if.if_softc = sc;
    202 	sc->sc_sppp.pp_if.if_mtu = ETHERMTU - PPPOE_HEADERLEN - 2; /* two byte PPP protocol discriminator, then IP data */
    203 	sc->sc_sppp.pp_if.if_flags = IFF_SIMPLEX|IFF_POINTOPOINT|IFF_MULTICAST;
    204 	sc->sc_sppp.pp_if.if_type = IFT_PPP;
    205 	sc->sc_sppp.pp_if.if_hdrlen = sizeof(struct ether_header)+PPPOE_HEADERLEN;
    206 	sc->sc_sppp.pp_if.if_dlt = DLT_PPP_ETHER;
    207 	sc->sc_sppp.pp_flags |= PP_KEEPALIVE|	/* use LCP keepalive */
    208 				PP_NOFRAMING;	/* no serial encapsulation */
    209 	sc->sc_sppp.pp_if.if_ioctl = pppoe_ioctl;
    210 	IFQ_SET_MAXLEN(&sc->sc_sppp.pp_if.if_snd, IFQ_MAXLEN);
    211 	IFQ_SET_READY(&sc->sc_sppp.pp_if.if_snd);
    212 
    213 	/* changed to real address later */
    214 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    215 
    216 	callout_init(&sc->sc_timeout);
    217 
    218 	sc->sc_sppp.pp_if.if_start = pppoe_start;
    219 	sc->sc_sppp.pp_tls = pppoe_tls;
    220 	sc->sc_sppp.pp_tlf = pppoe_tlf;
    221 	sc->sc_sppp.pp_framebytes = PPPOE_HEADERLEN;	/* framing added to ppp packets */
    222 
    223 	if_attach(&sc->sc_sppp.pp_if);
    224 	sppp_attach(&sc->sc_sppp.pp_if);
    225 
    226 #if NBPFILTER > 0
    227 	bpfattach(&sc->sc_sppp.pp_if, DLT_PPP_ETHER, 0);
    228 #endif
    229 	LIST_INSERT_HEAD(&pppoe_softc_list, sc, sc_list);
    230 	return 0;
    231 }
    232 
    233 void
    234 pppoe_clone_destroy(ifp)
    235 	struct ifnet *ifp;
    236 {
    237 	struct pppoe_softc * sc = ifp->if_softc;
    238 
    239 	LIST_REMOVE(sc, sc_list);
    240 #if NBPFILTER > 0
    241 	bpfdetach(ifp);
    242 #endif
    243 	sppp_detach(&sc->sc_sppp.pp_if);
    244 	if_detach(ifp);
    245 	free(sc, M_DEVBUF);
    246 }
    247 
    248 /*
    249  * Find the interface handling the specified session.
    250  * Note: O(number of sessions open), this is a client-side only, mean
    251  * and lean implementation, so number of open sessions typically should
    252  * be 1.
    253  */
    254 static struct pppoe_softc *
    255 pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif)
    256 {
    257 	struct pppoe_softc *sc;
    258 
    259 	if (session == 0) return NULL;
    260 
    261 	LIST_FOREACH(sc, &pppoe_softc_list, sc_list) {
    262 		if (sc->sc_state == PPPOE_STATE_SESSION
    263 		    && sc->sc_session == session) {
    264 			if (sc->sc_eth_if == rcvif)
    265 				return sc;
    266 			else
    267 				return NULL;
    268 		}
    269 	}
    270 	return NULL;
    271 }
    272 
    273 /* Check host unique token passed and return appropriate softc pointer,
    274  * or NULL if token is bogus. */
    275 static struct pppoe_softc *
    276 pppoe_find_softc_by_hunique(u_int8_t *token, size_t len, struct ifnet *rcvif)
    277 {
    278 	struct pppoe_softc *sc, *t;
    279 
    280 	if (LIST_EMPTY(&pppoe_softc_list)) return NULL;
    281 
    282 	if (len != sizeof sc) return NULL;
    283 	memcpy(&t, token, len);
    284 
    285 	LIST_FOREACH(sc, &pppoe_softc_list, sc_list)
    286 		if (sc == t) break;
    287 
    288 	if (sc != t) {
    289 #ifdef PPPOE_DEBUG
    290 		printf("pppoe: invalid host unique value\n");
    291 #endif
    292 		return NULL;
    293 	}
    294 
    295 	/* should be safe to access *sc now */
    296 	if (sc->sc_state < PPPOE_STATE_PADI_SENT || sc->sc_state >= PPPOE_STATE_SESSION) {
    297 #ifdef PPPOE_DEBUG
    298 		printf("%s: state=%d, not accepting host unique\n",
    299 			sc->sc_sppp.pp_if.if_xname, sc->sc_state);
    300 #endif
    301 		return NULL;
    302 	}
    303 	if (sc->sc_eth_if != rcvif) {
    304 #ifdef PPPOE_DEBUG
    305 		printf("%s: wrong interface, not accepting host unique\n",
    306 			sc->sc_sppp.pp_if.if_xname);
    307 #endif
    308 		return NULL;
    309 	}
    310 	return sc;
    311 }
    312 
    313 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    314 static void pppoe_softintr_handler(void *dummy)
    315 {
    316 	/* called at splsoftnet() */
    317 	pppoe_input();
    318 }
    319 #else
    320 void pppoe_softintr_handler(void *dummy)
    321 {
    322 	int s = splnet();
    323 	pppoe_input();
    324 	callout_deactivate(&pppoe_softintr);
    325 	splx(s);
    326 }
    327 #endif
    328 
    329 /* called at appropriate protection level */
    330 static void
    331 pppoe_input()
    332 {
    333 	struct mbuf *m;
    334 	int s, disc_done, data_done;
    335 
    336 	do {
    337 		disc_done = 0;
    338 		data_done = 0;
    339 		for (;;) {
    340 			s = splnet();
    341 			IF_DEQUEUE(&ppoediscinq, m);
    342 			splx(s);
    343 			if (m == NULL) break;
    344 			disc_done = 1;
    345 			pppoe_disc_input(m);
    346 		}
    347 
    348 		for (;;) {
    349 			s = splnet();
    350 			IF_DEQUEUE(&ppoeinq, m);
    351 			splx(s);
    352 			if (m == NULL) break;
    353 			data_done = 1;
    354 			pppoe_data_input(m);
    355 		}
    356 	} while (disc_done || data_done);
    357 }
    358 
    359 /* analyze and handle a single received packet while not in session state */
    360 static void pppoe_dispatch_disc_pkt(u_int8_t *p, size_t size, struct ifnet *rcvif, struct ether_header *eh)
    361 {
    362 	u_int16_t tag, len;
    363 	u_int8_t vertype, code;
    364 	u_int16_t session, plen;
    365 	struct pppoe_softc *sc;
    366 	const char *err_msg = NULL;
    367 	u_int8_t * ac_cookie;
    368 	size_t ac_cookie_len;
    369 
    370 	ac_cookie = NULL;
    371 	ac_cookie_len = 0;
    372 	session = 0;
    373 	if (size <= PPPOE_HEADERLEN) {
    374 		printf("pppoe: packet too short: %ld\n", (long)size);
    375 		return;
    376 	}
    377 	vertype = *p++;
    378 	if (vertype != PPPOE_VERTYPE) {
    379 		printf("pppoe: unknown version/type packet: 0x%x\n", vertype);
    380 		return;
    381 	}
    382 	code = *p++;
    383 	PPPOE_READ_16(p, session);
    384 	PPPOE_READ_16(p, plen);
    385 	size -= PPPOE_HEADERLEN;
    386 
    387 	if (plen > size) {
    388 		printf("pppoe: packet content does not fit: data available = %ld, packet size = %ld\n",
    389 			(long)size, (long)plen);
    390 		return;
    391 	}
    392 	size = plen;	/* ignore trailing garbage */
    393 	tag = 0;
    394 	len = 0;
    395 	sc = NULL;
    396 	while (size > 4) {
    397 		PPPOE_READ_16(p, tag);
    398 		PPPOE_READ_16(p, len);
    399 		if (len > size) {
    400 			printf("pppoe: tag 0x%x len 0x%x is too long\n", tag, len);
    401 			return;
    402 		}
    403 		switch (tag) {
    404 		case PPPOE_TAG_EOL:
    405 			size = 0; break;
    406 		case PPPOE_TAG_SNAME:
    407 			break;	/* ignored */
    408 		case PPPOE_TAG_ACNAME:
    409 			break;	/* ignored */
    410 		case PPPOE_TAG_HUNIQUE:
    411 			if (sc == NULL)
    412 				sc = pppoe_find_softc_by_hunique(p, len, rcvif);
    413 			break;
    414 		case PPPOE_TAG_ACCOOKIE:
    415 			if (ac_cookie == NULL) {
    416 				ac_cookie = p;
    417 				ac_cookie_len = len;
    418 			}
    419 			break;
    420 		case PPPOE_TAG_SNAME_ERR:
    421 			err_msg = "SERVICE NAME ERROR";
    422 			break;
    423 		case PPPOE_TAG_ACSYS_ERR:
    424 			err_msg = "AC SYSTEM ERROR";
    425 			break;
    426 		case PPPOE_TAG_GENERIC_ERR:
    427 			err_msg = "GENERIC ERROR";
    428 			break;
    429 		}
    430 		if (err_msg) {
    431 			printf("%s: %s\n", sc? sc->sc_sppp.pp_if.if_xname : "pppoe",
    432 					err_msg);
    433 			return;
    434 		}
    435 		if (size >= 0) {
    436 			size -= 4 + len;
    437 			if (len > 0)
    438 				p += len;
    439 		}
    440 	}
    441 	switch (code) {
    442 	case PPPOE_CODE_PADI:
    443 	case PPPOE_CODE_PADR:
    444 		/* ignore, we are no access concentrator */
    445 		return;
    446 	case PPPOE_CODE_PADO:
    447 		if (sc == NULL) {
    448 			printf("pppoe: received PADO but could not find request for it\n");
    449 			return;
    450 		}
    451 		if (sc->sc_state != PPPOE_STATE_PADI_SENT) {
    452 			printf("%s: received unexpected PADO\n", sc->sc_sppp.pp_if.if_xname);
    453 			return;
    454 		}
    455 		if (ac_cookie) {
    456 			sc->sc_ac_cookie = malloc(ac_cookie_len, M_DEVBUF, M_DONTWAIT);
    457 			if (sc->sc_ac_cookie == NULL)
    458 				return;
    459 			sc->sc_ac_cookie_len = ac_cookie_len;
    460 			memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
    461 		}
    462 		memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
    463 		callout_stop(&sc->sc_timeout);
    464 		sc->sc_padr_retried = 0;
    465 		sc->sc_state = PPPOE_STATE_PADR_SENT;
    466 		if (pppoe_send_padr(sc) == 0)
    467 			callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padr_retried), pppoe_timeout, sc);
    468 		else
    469 			pppoe_abort_connect(sc);
    470 		break;
    471 	case PPPOE_CODE_PADS:
    472 		if (sc == NULL)
    473 			return;
    474 		sc->sc_session = session;
    475 		callout_stop(&sc->sc_timeout);
    476 		printf("%s: session 0x%x connected\n", sc->sc_sppp.pp_if.if_xname, session);
    477 		sc->sc_state = PPPOE_STATE_SESSION;
    478 		sc->sc_sppp.pp_up(&sc->sc_sppp);	/* notify upper layers */
    479 		break;
    480 	case PPPOE_CODE_PADT:
    481 		if (sc == NULL)
    482 			return;
    483                 /* stop timer (we might be about to transmit a PADT ourself) */
    484                 callout_stop(&sc->sc_timeout);
    485                 /* signal upper layer */
    486                 printf("%s: session 0x%x terminated, received PADT\n", sc->sc_sppp.pp_if.if_xname, session);
    487                 /* clean up softc */
    488                 sc->sc_state = PPPOE_STATE_INITIAL;
    489                 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    490                 if (sc->sc_ac_cookie) {
    491                         free(sc->sc_ac_cookie, M_MBUF);
    492                         sc->sc_ac_cookie = NULL;
    493                 }
    494                 sc->sc_ac_cookie_len = 0;
    495                 sc->sc_session = 0;
    496                 sc->sc_sppp.pp_down(&sc->sc_sppp);
    497                 break;
    498         default:
    499                 printf("%s: unknown code (0x%04x) session = 0x%04x\n",
    500                     sc? sc->sc_sppp.pp_if.if_xname : "pppoe",
    501                     code, session);
    502                 break;
    503         }
    504 }
    505 
    506 static void
    507 pppoe_disc_input(struct mbuf *m)
    508 {
    509         u_int8_t *p;
    510         struct ether_header *eh;
    511 
    512         eh = mtod(m, struct ether_header*);
    513         m_adj(m, sizeof(struct ether_header));
    514         p = mtod(m, u_int8_t*);
    515         KASSERT(m->m_flags & M_PKTHDR);
    516         pppoe_dispatch_disc_pkt(p, m->m_len, m->m_pkthdr.rcvif, eh);
    517         m_free(m);
    518 }
    519 
    520 static void
    521 pppoe_data_input(struct mbuf *m)
    522 {
    523         u_int8_t *p, vertype;
    524         u_int16_t session, plen, code;
    525         struct pppoe_softc *sc;
    526 
    527         KASSERT(m->m_flags & M_PKTHDR);
    528 
    529         m_adj(m, sizeof(struct ether_header));
    530         if (m->m_pkthdr.len <= PPPOE_HEADERLEN) {
    531                 printf("pppoe (data): dropping too short packet: %ld bytes\n", (long)m->m_pkthdr.len);
    532                 goto drop;
    533         }
    534 
    535         p = mtod(m, u_int8_t*);
    536 
    537         vertype = *p++;
    538         if (vertype != PPPOE_VERTYPE) {
    539                 printf("pppoe (data): unknown version/type packet: 0x%x\n", vertype);
    540                 goto drop;
    541         }
    542 
    543         code = *p++;
    544         if (code != 0)
    545                 goto drop;
    546 
    547         PPPOE_READ_16(p, session);
    548         sc = pppoe_find_softc_by_session(session, m->m_pkthdr.rcvif);
    549         if (sc == NULL)
    550                 goto drop;
    551 
    552         PPPOE_READ_16(p, plen);
    553 
    554 #if NBPFILTER > 0
    555         if(sc->sc_sppp.pp_if.if_bpf)
    556                 bpf_mtap(sc->sc_sppp.pp_if.if_bpf, m);
    557 #endif
    558 
    559         m_adj(m, PPPOE_HEADERLEN);
    560 
    561 #ifdef PPPOE_DEBUG
    562         {
    563                 struct mbuf *p;
    564 
    565                 printf("%s: pkthdr.len=%d, pppoe.len=%d",
    566                         sc->sc_sppp.pp_if.if_xname,
    567                         m->m_pkthdr.len, plen);
    568                 p = m;
    569                 while (p) {
    570                         printf(" l=%d", p->m_len);
    571                         p = p->m_next;
    572                 }
    573                 printf("\n");
    574         }
    575 #endif
    576 
    577         if (m->m_pkthdr.len < plen)
    578                 goto drop;
    579 
    580         /* fix incoming interface pointer (not the raw ethernet interface anymore) */
    581         m->m_pkthdr.rcvif = &sc->sc_sppp.pp_if;
    582 
    583         /* pass packet up */
    584         sppp_input(&sc->sc_sppp.pp_if, m);
    585         return;
    586 
    587 drop:
    588         m_free(m);
    589 }
    590 
    591 static int
    592 pppoe_output(struct pppoe_softc *sc, struct mbuf *m)
    593 {
    594         struct sockaddr dst;
    595         struct ether_header *eh;
    596         u_int16_t etype;
    597 
    598         if (sc->sc_eth_if == NULL)
    599                 return EIO;
    600 
    601         memset(&dst, 0, sizeof dst);
    602         dst.sa_family = AF_UNSPEC;
    603         eh = (struct ether_header*)&dst.sa_data;
    604         etype = sc->sc_state == PPPOE_STATE_SESSION? ETHERTYPE_PPPOE : ETHERTYPE_PPPOEDISC;
    605         eh->ether_type = htons(etype);
    606         memcpy(&eh->ether_dhost, &sc->sc_dest, sizeof sc->sc_dest);
    607 
    608 #ifdef PPPOE_DEBUG
    609         printf("%s (%x) state=%d, session=0x%x output -> %s, len=%d\n",
    610             sc->sc_sppp.pp_if.if_xname, etype,
    611             sc->sc_state, sc->sc_session,
    612 	    ether_sprintf((const unsigned char *)&sc->sc_dest), m->m_pkthdr.len);
    613 #endif
    614 
    615 	return sc->sc_eth_if->if_output(sc->sc_eth_if, m, &dst, NULL);
    616 }
    617 
    618 static int
    619 pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, caddr_t data)
    620 {
    621 	struct proc *p = curproc;	/* XXX */
    622 	struct pppoe_softc *sc = (struct pppoe_softc*)ifp;
    623 	int error = 0;
    624 
    625 	switch (cmd) {
    626 	case PPPOESETPARMS:
    627 	{
    628 		struct pppoediscparms *parms = (struct pppoediscparms*)data;
    629 		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
    630 			return error;
    631 		if (parms->eth_ifname[0] != 0) {
    632 			sc->sc_eth_if = ifunit(parms->eth_ifname);
    633 			if (sc->sc_eth_if == NULL)
    634 				return ENXIO;
    635 		}
    636 		if (parms->ac_name) {
    637 			size_t s;
    638 			char * p = malloc(parms->ac_name_len + 1, M_DEVBUF, M_WAITOK);
    639 			copyinstr(parms->ac_name, p, parms->ac_name_len, &s);
    640 			if (sc->sc_concentrator_name)
    641 				free(sc->sc_concentrator_name, M_DEVBUF);
    642 			sc->sc_concentrator_name = p;
    643 		}
    644 		if (parms->service_name) {
    645 			size_t s;
    646 			char * p = malloc(parms->service_name_len + 1, M_DEVBUF, M_WAITOK);
    647 			copyinstr(parms->service_name, p, parms->service_name_len, &s);
    648 			if (sc->sc_service_name)
    649 				free(sc->sc_service_name, M_DEVBUF);
    650 			sc->sc_service_name = p;
    651 		}
    652 		return 0;
    653 	}
    654 	break;
    655 	case PPPOEGETPARMS:
    656 	{
    657 		struct pppoediscparms *parms = (struct pppoediscparms*)data;
    658 		memset(parms, 0, sizeof *parms);
    659 		if (sc->sc_eth_if)
    660 			strncpy(parms->ifname, sc->sc_eth_if->if_xname, IFNAMSIZ);
    661 		return 0;
    662 	}
    663 	break;
    664 	default:
    665 		return sppp_ioctl(ifp, cmd, data);
    666 	}
    667 	return 0;
    668 }
    669 
    670 /*
    671  * Allocate a mbuf/cluster with space to store the given data length
    672  * of payload, leaving space for prepending an ethernet header
    673  * in front.
    674  */
    675 static struct mbuf *
    676 pppoe_get_mbuf(size_t len)
    677 {
    678 	struct mbuf *m;
    679 
    680 	MGETHDR(m, M_DONTWAIT, MT_DATA);
    681 	if (m == NULL)
    682 		return NULL;
    683 	if (len+sizeof(struct ether_header) > MHLEN) {
    684 		MCLGET(m, M_DONTWAIT);
    685 		if ((m->m_flags & M_EXT) == 0) {
    686 			struct mbuf *n;
    687 			MFREE(m, n);
    688 			return 0;
    689 		}
    690 	}
    691 	m->m_data += sizeof(struct ether_header);
    692 	m->m_len = len;
    693 	m->m_pkthdr.len = len;
    694 	m->m_pkthdr.rcvif = NULL;
    695 
    696 	return m;
    697 }
    698 
    699 static int
    700 pppoe_send_padi(struct pppoe_softc *sc)
    701 {
    702 	struct mbuf *m0;
    703 	int len, l1, l2;
    704 	u_int8_t *p;
    705 
    706 	if (sc->sc_state >PPPOE_STATE_PADI_SENT)
    707 		panic("pppoe_send_padi in state %d", sc->sc_state);
    708 
    709 	/* calculate length of frame (excluding ethernet header + pppoe header) */
    710 	len = 2+2+2+2+sizeof sc;	/* service name tag is required, host unique is send too */
    711 	if (sc->sc_service_name != NULL) {
    712 		l1 = strlen(sc->sc_service_name);
    713 		len += l1;
    714 	}
    715 	if (sc->sc_concentrator_name != NULL) {
    716 		l2 = strlen(sc->sc_concentrator_name);
    717 		len += 2+2+l2;
    718 	}
    719 
    720 	/* allocate a buffer */
    721 	m0 = pppoe_get_mbuf(len+PPPOE_HEADERLEN);	/* header len + payload len */
    722 	if (!m0) return ENOBUFS;
    723 
    724 	/* fill in pkt */
    725 	p = mtod(m0, u_int8_t*);
    726 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADI, 0, len);
    727 	PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
    728 	if (sc->sc_service_name != NULL) {
    729 		PPPOE_ADD_16(p, l1);
    730 		memcpy(p, sc->sc_service_name, l1);
    731 		p += l1;
    732 	} else {
    733 		PPPOE_ADD_16(p, 0);
    734 	}
    735 	if (sc->sc_concentrator_name != NULL) {
    736 		PPPOE_ADD_16(p, PPPOE_TAG_ACNAME);
    737 		PPPOE_ADD_16(p, l2);
    738 		memcpy(p, sc->sc_concentrator_name, l2);
    739 		p += l2;
    740 	}
    741 	PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
    742 	PPPOE_ADD_16(p, sizeof(sc));
    743 	memcpy(p, &sc, sizeof sc);
    744 
    745 #ifdef PPPOE_DEBUG
    746 	p += sizeof sc;
    747 	if (p - mtod(m0, u_int8_t*) != len + PPPOE_HEADERLEN)
    748 		panic("pppoe_send_padi: garbled output len, should be %ld, is %ld",
    749 		    (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, u_int8_t*)));
    750 #endif
    751 
    752 	/* send pkt */
    753 	return pppoe_output(sc, m0);
    754 }
    755 
    756 static void
    757 pppoe_timeout(void *arg)
    758 {
    759 	int x;
    760 	struct pppoe_softc *sc = (struct pppoe_softc*)arg;
    761 
    762 #ifdef PPPOE_DEBUG
    763 	printf("%s: timeout\n", sc->sc_sppp.pp_if.if_xname);
    764 #endif
    765 
    766 	switch (sc->sc_state) {
    767 	case PPPOE_STATE_PADI_SENT:
    768 		x = splnet();
    769 		sc->sc_padi_retried++;
    770 		if (sc->sc_padi_retried >= PPPOE_DISC_MAXPADI) {
    771 			pppoe_abort_connect(sc);
    772 			splx(x);
    773 			return;
    774 		}
    775 		if (pppoe_send_padi(sc) == 0)
    776 			callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padi_retried), pppoe_timeout, sc);
    777 		else
    778 			pppoe_abort_connect(sc);
    779 		splx(x);
    780 		break;
    781 
    782 	case PPPOE_STATE_PADR_SENT:
    783 		x = splnet();
    784 		sc->sc_padr_retried++;
    785 		if (sc->sc_padr_retried >= PPPOE_DISC_MAXPADR) {
    786 			memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    787 			sc->sc_state = PPPOE_STATE_PADI_SENT;
    788 			sc->sc_padr_retried = 0;
    789 			if (pppoe_send_padi(sc) == 0)
    790 				callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padi_retried), pppoe_timeout, sc);
    791 			else
    792 				pppoe_abort_connect(sc);
    793 			splx(x);
    794 			return;
    795 		}
    796 		if (pppoe_send_padr(sc) == 0)
    797 			callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padr_retried), pppoe_timeout, sc);
    798 		else
    799 			pppoe_abort_connect(sc);
    800 		splx(x);
    801 		break;
    802 	case PPPOE_STATE_CLOSING:
    803 		pppoe_disconnect(sc);
    804 		break;
    805 	default:
    806 		return;	/* all done, work in peace */
    807 	}
    808 }
    809 
    810 /* Start a connection (i.e. initiate discovery phase) */
    811 static int
    812 pppoe_connect(struct pppoe_softc *sc)
    813 {
    814 	int x, err;
    815 
    816 	if (sc->sc_state != PPPOE_STATE_INITIAL)
    817 		return EBUSY;
    818 
    819 	x = splnet();
    820 	sc->sc_state = PPPOE_STATE_PADI_SENT;
    821 	sc->sc_padr_retried = 0;
    822 	err = pppoe_send_padi(sc);
    823 	if (err == 0)
    824 		callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT, pppoe_timeout, sc);
    825 	else
    826 		pppoe_abort_connect(sc);
    827 	splx(x);
    828 	return err;
    829 }
    830 
    831 /* disconnect */
    832 static int
    833 pppoe_disconnect(struct pppoe_softc *sc)
    834 {
    835 	int err, x;
    836 
    837 	x = splnet();
    838 
    839 	if (sc->sc_state < PPPOE_STATE_SESSION)
    840 		err = EBUSY;
    841 	else {
    842 		printf("%s: disconnecting\n", sc->sc_sppp.pp_if.if_xname);
    843 		err = pppoe_send_padt(sc);
    844 	}
    845 
    846 	/* cleanup softc */
    847 	sc->sc_state = PPPOE_STATE_INITIAL;
    848 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    849 	if (sc->sc_ac_cookie) {
    850 		free(sc->sc_ac_cookie, M_MBUF);
    851 		sc->sc_ac_cookie = NULL;
    852 	}
    853 	sc->sc_ac_cookie_len = 0;
    854 	sc->sc_session = 0;
    855 
    856 	/* notify upper layer */
    857 	sc->sc_sppp.pp_down(&sc->sc_sppp);
    858 
    859 	splx(x);
    860 
    861 	return err;
    862 }
    863 
    864 /* Connection attempt aborted */
    865 static void
    866 pppoe_abort_connect(struct pppoe_softc *sc)
    867 {
    868 	printf("%s: could not establish connection\n",
    869 		sc->sc_sppp.pp_if.if_xname);
    870 	sc->sc_state = PPPOE_STATE_INITIAL;
    871 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    872 
    873 	/* notify upper layer */
    874 	sc->sc_sppp.pp_down(&sc->sc_sppp);
    875 }
    876 
    877 /* Send a PADR packet */
    878 static int
    879 pppoe_send_padr(struct pppoe_softc *sc)
    880 {
    881 	struct mbuf *m0;
    882 	u_int8_t *p;
    883 	size_t len, l1;
    884 
    885 	if (sc->sc_state != PPPOE_STATE_PADR_SENT)
    886 		return EIO;
    887 
    888 	len = 2+2+2+2+sizeof(sc);			/* service name, host unique */
    889 	if (sc->sc_service_name != NULL) {		/* service name tag maybe empty */
    890 		l1 = strlen(sc->sc_service_name);
    891 		len += l1;
    892 	}
    893 	if (sc->sc_ac_cookie_len > 0)
    894 		len += 2+2+sc->sc_ac_cookie_len;	/* AC cookie */
    895 	m0 = pppoe_get_mbuf(len+PPPOE_HEADERLEN);
    896 	if (!m0) return ENOBUFS;
    897 	p = mtod(m0, u_int8_t*);
    898 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADR, 0, len);
    899 	PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
    900 	if (sc->sc_service_name != NULL) {
    901 		PPPOE_ADD_16(p, l1);
    902 		memcpy(p, sc->sc_service_name, l1);
    903 		p += l1;
    904 	} else {
    905 		PPPOE_ADD_16(p, 0);
    906 	}
    907 	if (sc->sc_ac_cookie_len > 0) {
    908 		PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE);
    909 		PPPOE_ADD_16(p, sc->sc_ac_cookie_len);
    910 		memcpy(p, sc->sc_ac_cookie, sc->sc_ac_cookie_len);
    911 		p += sc->sc_ac_cookie_len;
    912 	}
    913 	PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
    914 	PPPOE_ADD_16(p, sizeof(sc));
    915 	memcpy(p, &sc, sizeof sc);
    916 
    917 #ifdef PPPOE_DEBUG
    918 	p += sizeof sc;
    919 	if (p - mtod(m0, u_int8_t*) != len + PPPOE_HEADERLEN)
    920 		panic("pppoe_send_padr: garbled output len, should be %ld, is %ld",
    921 			(long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, u_int8_t*)));
    922 #endif
    923 
    924 	return pppoe_output(sc, m0);
    925 }
    926 
    927 /* send a PADT packet */
    928 static int
    929 pppoe_send_padt(struct pppoe_softc *sc)
    930 {
    931 	struct mbuf *m0;
    932 	u_int8_t *p;
    933 
    934 	if (sc->sc_state < PPPOE_STATE_SESSION)
    935 		return EIO;
    936 
    937 #ifdef PPPOE_DEBUG
    938 	printf("%s: sending PADT\n", sc->sc_sppp.pp_if.if_xname);
    939 #endif
    940 	m0 = pppoe_get_mbuf(PPPOE_HEADERLEN);
    941 	if (!m0) return ENOBUFS;
    942 	p = mtod(m0, u_int8_t*);
    943 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADT, sc->sc_session, 0);
    944 	return pppoe_output(sc, m0);
    945 }
    946 
    947 static void
    948 pppoe_tls(struct sppp *sp)
    949 {
    950 	struct pppoe_softc *sc = (void*)sp;
    951 	if (sc->sc_state != PPPOE_STATE_INITIAL)
    952 		return;
    953 	pppoe_connect(sc);
    954 }
    955 
    956 static void
    957 pppoe_tlf(struct sppp *sp)
    958 {
    959 	struct pppoe_softc *sc = (void*)sp;
    960 	if (sc->sc_state < PPPOE_STATE_SESSION)
    961 		return;
    962 	/*
    963 	 * Do not call pppoe_disconnect here, the upper layer state
    964 	 * machine gets confused by this. We must return from this
    965 	 * function and defer disconnecting to the timeout handler.
    966 	 */
    967 	sc->sc_state = PPPOE_STATE_CLOSING;
    968 	callout_reset(&sc->sc_timeout, hz/100, pppoe_timeout, sc);
    969 }
    970 
    971 static void
    972 pppoe_start(struct ifnet *ifp)
    973 {
    974 	struct pppoe_softc *sc = (void*)ifp;
    975 	struct mbuf *m;
    976 	u_int8_t *p;
    977 	size_t len;
    978 
    979 	if (sppp_isempty(ifp))
    980 		return;
    981 
    982 	/* are we read to proccess data yet? */
    983 	if (sc->sc_state < PPPOE_STATE_SESSION) {
    984 		sppp_flush(&sc->sc_sppp.pp_if);
    985 		return;
    986 	}
    987 
    988 	while ((m = sppp_dequeue(ifp)) != NULL) {
    989 		len = m->m_pkthdr.len;
    990 		M_PREPEND(m, PPPOE_HEADERLEN, M_DONTWAIT);
    991 		if (m == NULL) {
    992 			m_free(m);
    993 			break;
    994 		}
    995 		p = mtod(m, u_int8_t*);
    996 		PPPOE_ADD_HEADER(p, 0, sc->sc_session, len);
    997 
    998 #if NBPFILTER > 0
    999 		if(sc->sc_sppp.pp_if.if_bpf)
   1000 			bpf_mtap(sc->sc_sppp.pp_if.if_bpf, m);
   1001 #endif
   1002 
   1003 		pppoe_output(sc, m);
   1004 	}
   1005 }
   1006