Home | History | Annotate | Line # | Download | only in net
if_pppoe.c revision 1.15
      1 /* $NetBSD: if_pppoe.c,v 1.15 2002/01/04 12:21:25 martin Exp $ */
      2 
      3 /*
      4  * Copyright (c) 2001 Martin Husemann. All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     25  * SUCH DAMAGE.
     26  *
     27  */
     28 
     29 #include <sys/cdefs.h>
     30 __KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.15 2002/01/04 12:21:25 martin Exp $");
     31 
     32 #include "pppoe.h"
     33 #include "bpfilter.h"
     34 
     35 #include <sys/param.h>
     36 #include <sys/systm.h>
     37 #include <sys/kernel.h>
     38 #include <sys/callout.h>
     39 #include <sys/malloc.h>
     40 #include <sys/mbuf.h>
     41 #include <sys/socket.h>
     42 #include <sys/proc.h>
     43 #include <sys/ioctl.h>
     44 #include <net/if.h>
     45 #include <net/if_types.h>
     46 #include <net/if_ether.h>
     47 #include <net/if_sppp.h>
     48 #include <net/if_spppvar.h>
     49 #include <net/if_pppoe.h>
     50 
     51 #if NBPFILTER > 0
     52 #include <net/bpf.h>
     53 #endif
     54 
     55 #undef PPPOE_DEBUG		/* XXX - remove this or make it an option */
     56 /* #define PPPOE_DEBUG 1 */
     57 
     58 #define PPPOE_HEADERLEN	6
     59 #define	PPPOE_VERTYPE	0x11	/* VER=1, TYPE = 1 */
     60 
     61 #define	PPPOE_TAG_EOL		0x0000		/* end of list */
     62 #define	PPPOE_TAG_SNAME		0x0101		/* service name */
     63 #define	PPPOE_TAG_ACNAME	0x0102		/* access concentrator name */
     64 #define	PPPOE_TAG_HUNIQUE	0x0103		/* host unique */
     65 #define	PPPOE_TAG_ACCOOKIE	0x0104		/* AC cookie */
     66 #define	PPPOE_TAG_VENDOR	0x0105		/* vendor specific */
     67 #define	PPPOE_TAG_RELAYSID	0x0110		/* relay session id */
     68 #define	PPPOE_TAG_SNAME_ERR	0x0201		/* service name error */
     69 #define	PPPOE_TAG_ACSYS_ERR	0x0202		/* AC system error */
     70 #define	PPPOE_TAG_GENERIC_ERR	0x0203		/* gerneric error */
     71 
     72 #define PPPOE_CODE_PADI		0x09		/* Active Discovery Initiation */
     73 #define	PPPOE_CODE_PADO		0x07		/* Active Discovery Offer */
     74 #define	PPPOE_CODE_PADR		0x19		/* Active Discovery Request */
     75 #define	PPPOE_CODE_PADS		0x65		/* Active Discovery Session confirmation */
     76 #define	PPPOE_CODE_PADT		0xA7		/* Active Discovery Terminate */
     77 
     78 /* Read a 16 bit unsigned value from a buffer */
     79 #define PPPOE_READ_16(PTR, VAL)				\
     80 		(VAL) = ((PTR)[0] << 8) | (PTR)[1];	\
     81 		(PTR)+=2
     82 
     83 /* Add a 16 bit unsigned value to a buffer pointed to by PTR */
     84 #define	PPPOE_ADD_16(PTR, VAL)			\
     85 		*(PTR)++ = (VAL) / 256;		\
     86 		*(PTR)++ = (VAL) % 256
     87 
     88 /* Add a complete PPPoE header to the buffer pointed to by PTR */
     89 #define PPPOE_ADD_HEADER(PTR, CODE, SESS, LEN)	\
     90 		*(PTR)++ = PPPOE_VERTYPE;	\
     91 		*(PTR)++ = (CODE);		\
     92 		PPPOE_ADD_16(PTR, SESS);	\
     93 		PPPOE_ADD_16(PTR, LEN)
     94 
     95 #define	PPPOE_DISC_TIMEOUT	(hz*5)	/* base for quick timeout calculation */
     96 #define	PPPOE_SLOW_RETRY	(hz*240)	/* persistent retry interval */
     97 #define PPPOE_DISC_MAXPADI	4	/* retry PADI four times (quickly) */
     98 #define	PPPOE_DISC_MAXPADR	2	/* retry PADR twice */
     99 
    100 struct pppoe_softc {
    101 	struct sppp sc_sppp;		/* contains a struct ifnet as first element */
    102 	LIST_ENTRY(pppoe_softc) sc_list;
    103 	struct ifnet *sc_eth_if;	/* ethernet interface we are using */
    104 
    105 	int sc_state;			/* discovery phase or session connected */
    106 	struct ether_addr sc_dest;	/* hardware address of concentrator */
    107 	u_int16_t sc_session;		/* PPPoE session id */
    108 
    109 	char *sc_service_name;		/* if != NULL: requested name of service */
    110 	char *sc_concentrator_name;	/* if != NULL: requested concentrator id */
    111 	u_int8_t *sc_ac_cookie;		/* content of AC cookie we must echo back */
    112 	size_t sc_ac_cookie_len;	/* length of cookie data */
    113 	struct callout sc_timeout;	/* timeout while not in session state */
    114 	int sc_padi_retried;		/* number of PADI retries already done */
    115 	int sc_padr_retried;		/* number of PADR retries already done */
    116 };
    117 
    118 /* incoming traffic will be queued here */
    119 struct ifqueue ppoediscinq = { NULL };
    120 struct ifqueue ppoeinq = { NULL };
    121 
    122 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    123 void * pppoe_softintr = NULL;
    124 static void pppoe_softintr_handler(void *);
    125 #else
    126 struct callout pppoe_softintr = CALLOUT_INITIALIZER;
    127 void pppoe_softintr_handler(void*);
    128 #endif
    129 
    130 extern int sppp_ioctl(struct ifnet *ifp, unsigned long cmd, void *data);
    131 
    132 /* input routines */
    133 static void pppoe_input(void);
    134 static void pppoe_disc_input(struct mbuf *m);
    135 static void pppoe_dispatch_disc_pkt(u_int8_t *p, size_t size, struct ifnet *rcvif, struct ether_header *eh);
    136 static void pppoe_data_input(struct mbuf *m);
    137 
    138 /* management routines */
    139 void pppoeattach(int count);
    140 static int pppoe_connect(struct pppoe_softc *sc);
    141 static int pppoe_disconnect(struct pppoe_softc *sc);
    142 static void pppoe_abort_connect(struct pppoe_softc *sc);
    143 static int pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, caddr_t data);
    144 static void pppoe_tls(struct sppp *sp);
    145 static void pppoe_tlf(struct sppp *sp);
    146 static void pppoe_start(struct ifnet *ifp);
    147 
    148 /* internal timeout handling */
    149 static void pppoe_timeout(void*);
    150 
    151 /* sending actual protocol controll packets */
    152 static int pppoe_send_padi(struct pppoe_softc *sc);
    153 static int pppoe_send_padr(struct pppoe_softc *sc);
    154 static int pppoe_send_padt(struct pppoe_softc *sc);
    155 
    156 /* raw output */
    157 static int pppoe_output(struct pppoe_softc *sc, struct mbuf *m);
    158 
    159 /* internal helper functions */
    160 static struct pppoe_softc * pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif);
    161 static struct pppoe_softc * pppoe_find_softc_by_hunique(u_int8_t *token, size_t len, struct ifnet *rcvif);
    162 
    163 LIST_HEAD(pppoe_softc_head, pppoe_softc) pppoe_softc_list;
    164 
    165 int     pppoe_clone_create __P((struct if_clone *, int));
    166 void    pppoe_clone_destroy __P((struct ifnet *));
    167 
    168 struct if_clone pppoe_cloner =
    169     IF_CLONE_INITIALIZER("pppoe", pppoe_clone_create, pppoe_clone_destroy);
    170 
    171 /* ARGSUSED */
    172 void
    173 pppoeattach(count)
    174 	int count;
    175 {
    176 	LIST_INIT(&pppoe_softc_list);
    177 	if_clone_attach(&pppoe_cloner);
    178 
    179 	ppoediscinq.ifq_maxlen = IFQ_MAXLEN;
    180 	ppoeinq.ifq_maxlen = IFQ_MAXLEN;
    181 
    182 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    183 	pppoe_softintr = softintr_establish(IPL_SOFTNET, pppoe_softintr_handler, NULL);
    184 #endif
    185 }
    186 
    187 int
    188 pppoe_clone_create(ifc, unit)
    189 	struct if_clone *ifc;
    190 	int unit;
    191 {
    192 	struct pppoe_softc *sc;
    193 
    194 	sc = malloc(sizeof(struct pppoe_softc), M_DEVBUF, M_WAITOK);
    195 	memset(sc, 0, sizeof(struct pppoe_softc));
    196 
    197 	sprintf(sc->sc_sppp.pp_if.if_xname, "pppoe%d", unit);
    198 	sc->sc_sppp.pp_if.if_softc = sc;
    199 	sc->sc_sppp.pp_if.if_mtu = ETHERMTU - PPPOE_HEADERLEN - 2; /* two byte PPP protocol discriminator, then IP data */
    200 	sc->sc_sppp.pp_if.if_flags = IFF_SIMPLEX|IFF_POINTOPOINT|IFF_MULTICAST;
    201 	sc->sc_sppp.pp_if.if_type = IFT_PPP;
    202 	sc->sc_sppp.pp_if.if_hdrlen = sizeof(struct ether_header)+PPPOE_HEADERLEN;
    203 	sc->sc_sppp.pp_if.if_dlt = DLT_PPP_ETHER;
    204 	sc->sc_sppp.pp_flags |= PP_KEEPALIVE|	/* use LCP keepalive */
    205 				PP_NOFRAMING;	/* no serial encapsulation */
    206 	sc->sc_sppp.pp_if.if_ioctl = pppoe_ioctl;
    207 	IFQ_SET_MAXLEN(&sc->sc_sppp.pp_if.if_snd, IFQ_MAXLEN);
    208 	IFQ_SET_READY(&sc->sc_sppp.pp_if.if_snd);
    209 
    210 	/* changed to real address later */
    211 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    212 
    213 	callout_init(&sc->sc_timeout);
    214 
    215 	sc->sc_sppp.pp_if.if_start = pppoe_start;
    216 	sc->sc_sppp.pp_tls = pppoe_tls;
    217 	sc->sc_sppp.pp_tlf = pppoe_tlf;
    218 	sc->sc_sppp.pp_framebytes = PPPOE_HEADERLEN;	/* framing added to ppp packets */
    219 
    220 	if_attach(&sc->sc_sppp.pp_if);
    221 	sppp_attach(&sc->sc_sppp.pp_if);
    222 
    223 #if NBPFILTER > 0
    224 	bpfattach(&sc->sc_sppp.pp_if, DLT_PPP_ETHER, 0);
    225 #endif
    226 	LIST_INSERT_HEAD(&pppoe_softc_list, sc, sc_list);
    227 	return 0;
    228 }
    229 
    230 void
    231 pppoe_clone_destroy(ifp)
    232 	struct ifnet *ifp;
    233 {
    234 	struct pppoe_softc * sc = ifp->if_softc;
    235 
    236 	LIST_REMOVE(sc, sc_list);
    237 #if NBPFILTER > 0
    238 	bpfdetach(ifp);
    239 #endif
    240 	sppp_detach(&sc->sc_sppp.pp_if);
    241 	if_detach(ifp);
    242 	free(sc, M_DEVBUF);
    243 }
    244 
    245 /*
    246  * Find the interface handling the specified session.
    247  * Note: O(number of sessions open), this is a client-side only, mean
    248  * and lean implementation, so number of open sessions typically should
    249  * be 1.
    250  */
    251 static struct pppoe_softc *
    252 pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif)
    253 {
    254 	struct pppoe_softc *sc;
    255 
    256 	if (session == 0) return NULL;
    257 
    258 	LIST_FOREACH(sc, &pppoe_softc_list, sc_list) {
    259 		if (sc->sc_state == PPPOE_STATE_SESSION
    260 		    && sc->sc_session == session) {
    261 			if (sc->sc_eth_if == rcvif)
    262 				return sc;
    263 			else
    264 				return NULL;
    265 		}
    266 	}
    267 	return NULL;
    268 }
    269 
    270 /* Check host unique token passed and return appropriate softc pointer,
    271  * or NULL if token is bogus. */
    272 static struct pppoe_softc *
    273 pppoe_find_softc_by_hunique(u_int8_t *token, size_t len, struct ifnet *rcvif)
    274 {
    275 	struct pppoe_softc *sc, *t;
    276 
    277 	if (LIST_EMPTY(&pppoe_softc_list)) return NULL;
    278 
    279 	if (len != sizeof sc) return NULL;
    280 	memcpy(&t, token, len);
    281 
    282 	LIST_FOREACH(sc, &pppoe_softc_list, sc_list)
    283 		if (sc == t) break;
    284 
    285 	if (sc != t) {
    286 #ifdef PPPOE_DEBUG
    287 		printf("pppoe: alien host unique tag, no session found\n");
    288 #endif
    289 		return NULL;
    290 	}
    291 
    292 	/* should be safe to access *sc now */
    293 	if (sc->sc_state < PPPOE_STATE_PADI_SENT || sc->sc_state >= PPPOE_STATE_SESSION) {
    294 		printf("%s: host unique tag found, but it belongs to a connection in state %d\n",
    295 			sc->sc_sppp.pp_if.if_xname, sc->sc_state);
    296 		return NULL;
    297 	}
    298 	if (sc->sc_eth_if != rcvif) {
    299 		printf("%s: wrong interface, not accepting host unique\n",
    300 			sc->sc_sppp.pp_if.if_xname);
    301 		return NULL;
    302 	}
    303 	return sc;
    304 }
    305 
    306 #ifdef __HAVE_GENERIC_SOFT_INTERRUPTS
    307 static void pppoe_softintr_handler(void *dummy)
    308 {
    309 	/* called at splsoftnet() */
    310 	pppoe_input();
    311 }
    312 #else
    313 void pppoe_softintr_handler(void *dummy)
    314 {
    315 	int s = splnet();
    316 	pppoe_input();
    317 	callout_deactivate(&pppoe_softintr);
    318 	splx(s);
    319 }
    320 #endif
    321 
    322 /* called at appropriate protection level */
    323 static void
    324 pppoe_input()
    325 {
    326 	struct mbuf *m;
    327 	int s, disc_done, data_done;
    328 
    329 	do {
    330 		disc_done = 0;
    331 		data_done = 0;
    332 		for (;;) {
    333 			s = splnet();
    334 			IF_DEQUEUE(&ppoediscinq, m);
    335 			splx(s);
    336 			if (m == NULL) break;
    337 			disc_done = 1;
    338 			pppoe_disc_input(m);
    339 		}
    340 
    341 		for (;;) {
    342 			s = splnet();
    343 			IF_DEQUEUE(&ppoeinq, m);
    344 			splx(s);
    345 			if (m == NULL) break;
    346 			data_done = 1;
    347 			pppoe_data_input(m);
    348 		}
    349 	} while (disc_done || data_done);
    350 }
    351 
    352 /* analyze and handle a single received packet while not in session state */
    353 static void pppoe_dispatch_disc_pkt(u_int8_t *p, size_t size, struct ifnet *rcvif, struct ether_header *eh)
    354 {
    355 	u_int16_t tag, len;
    356 	u_int8_t vertype, code;
    357 	u_int16_t session, plen;
    358 	struct pppoe_softc *sc;
    359 	const char *err_msg = NULL;
    360 	u_int8_t * ac_cookie;
    361 	size_t ac_cookie_len;
    362 
    363 	ac_cookie = NULL;
    364 	ac_cookie_len = 0;
    365 	session = 0;
    366 	if (size <= PPPOE_HEADERLEN) {
    367 		printf("pppoe: packet too short: %ld\n", (long)size);
    368 		return;
    369 	}
    370 	vertype = *p++;
    371 	if (vertype != PPPOE_VERTYPE) {
    372 		printf("pppoe: unknown version/type packet: 0x%x\n", vertype);
    373 		return;
    374 	}
    375 	code = *p++;
    376 	PPPOE_READ_16(p, session);
    377 	PPPOE_READ_16(p, plen);
    378 	size -= PPPOE_HEADERLEN;
    379 
    380 	if (plen > size) {
    381 		printf("pppoe: packet content does not fit: data available = %ld, packet size = %ld\n",
    382 			(long)size, (long)plen);
    383 		return;
    384 	}
    385 	size = plen;	/* ignore trailing garbage */
    386 	tag = 0;
    387 	len = 0;
    388 	sc = NULL;
    389 	while (size > 4) {
    390 		PPPOE_READ_16(p, tag);
    391 		PPPOE_READ_16(p, len);
    392 		if (len > size) {
    393 			printf("pppoe: tag 0x%x len 0x%x is too long\n", tag, len);
    394 			return;
    395 		}
    396 		switch (tag) {
    397 		case PPPOE_TAG_EOL:
    398 			size = 0; break;
    399 		case PPPOE_TAG_SNAME:
    400 			break;	/* ignored */
    401 		case PPPOE_TAG_ACNAME:
    402 			break;	/* ignored */
    403 		case PPPOE_TAG_HUNIQUE:
    404 			if (sc == NULL)
    405 				sc = pppoe_find_softc_by_hunique(p, len, rcvif);
    406 			break;
    407 		case PPPOE_TAG_ACCOOKIE:
    408 			if (ac_cookie == NULL) {
    409 				ac_cookie = p;
    410 				ac_cookie_len = len;
    411 			}
    412 			break;
    413 		case PPPOE_TAG_SNAME_ERR:
    414 			err_msg = "SERVICE NAME ERROR";
    415 			break;
    416 		case PPPOE_TAG_ACSYS_ERR:
    417 			err_msg = "AC SYSTEM ERROR";
    418 			break;
    419 		case PPPOE_TAG_GENERIC_ERR:
    420 			err_msg = "GENERIC ERROR";
    421 			break;
    422 		}
    423 		if (err_msg) {
    424 			printf("%s: %s\n", sc? sc->sc_sppp.pp_if.if_xname : "pppoe",
    425 					err_msg);
    426 			return;
    427 		}
    428 		if (size >= 0) {
    429 			size -= 4 + len;
    430 			if (len > 0)
    431 				p += len;
    432 		}
    433 	}
    434 	switch (code) {
    435 	case PPPOE_CODE_PADI:
    436 	case PPPOE_CODE_PADR:
    437 		/* ignore, we are no access concentrator */
    438 		return;
    439 	case PPPOE_CODE_PADO:
    440 		if (sc == NULL) {
    441 			printf("pppoe: received PADO but could not find request for it\n");
    442 			return;
    443 		}
    444 		if (sc->sc_state != PPPOE_STATE_PADI_SENT) {
    445 			printf("%s: received unexpected PADO\n", sc->sc_sppp.pp_if.if_xname);
    446 			return;
    447 		}
    448 		if (ac_cookie) {
    449 			sc->sc_ac_cookie = malloc(ac_cookie_len, M_DEVBUF, M_DONTWAIT);
    450 			if (sc->sc_ac_cookie == NULL)
    451 				return;
    452 			sc->sc_ac_cookie_len = ac_cookie_len;
    453 			memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
    454 		}
    455 		memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
    456 		callout_stop(&sc->sc_timeout);
    457 		sc->sc_padr_retried = 0;
    458 		sc->sc_state = PPPOE_STATE_PADR_SENT;
    459 		if (pppoe_send_padr(sc) == 0)
    460 			callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padr_retried), pppoe_timeout, sc);
    461 		else
    462 			pppoe_abort_connect(sc);
    463 		break;
    464 	case PPPOE_CODE_PADS:
    465 		if (sc == NULL)
    466 			return;
    467 		sc->sc_session = session;
    468 		callout_stop(&sc->sc_timeout);
    469 		printf("%s: session 0x%x connected\n", sc->sc_sppp.pp_if.if_xname, session);
    470 		sc->sc_state = PPPOE_STATE_SESSION;
    471 		sc->sc_sppp.pp_up(&sc->sc_sppp);	/* notify upper layers */
    472 		break;
    473 	case PPPOE_CODE_PADT:
    474 		if (sc == NULL)
    475 			return;
    476                 /* stop timer (we might be about to transmit a PADT ourself) */
    477                 callout_stop(&sc->sc_timeout);
    478                 /* signal upper layer */
    479                 printf("%s: session 0x%x terminated, received PADT\n", sc->sc_sppp.pp_if.if_xname, session);
    480                 /* clean up softc */
    481                 sc->sc_state = PPPOE_STATE_INITIAL;
    482                 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    483                 if (sc->sc_ac_cookie) {
    484                         free(sc->sc_ac_cookie, M_MBUF);
    485                         sc->sc_ac_cookie = NULL;
    486                 }
    487                 sc->sc_ac_cookie_len = 0;
    488                 sc->sc_session = 0;
    489                 sc->sc_sppp.pp_down(&sc->sc_sppp);
    490                 break;
    491         default:
    492                 printf("%s: unknown code (0x%04x) session = 0x%04x\n",
    493                     sc? sc->sc_sppp.pp_if.if_xname : "pppoe",
    494                     code, session);
    495                 break;
    496         }
    497 }
    498 
    499 static void
    500 pppoe_disc_input(struct mbuf *m)
    501 {
    502         u_int8_t *p;
    503         struct ether_header *eh;
    504 
    505         eh = mtod(m, struct ether_header*);
    506         m_adj(m, sizeof(struct ether_header));
    507         p = mtod(m, u_int8_t*);
    508         KASSERT(m->m_flags & M_PKTHDR);
    509         pppoe_dispatch_disc_pkt(p, m->m_len, m->m_pkthdr.rcvif, eh);
    510         m_free(m);
    511 }
    512 
    513 static void
    514 pppoe_data_input(struct mbuf *m)
    515 {
    516         u_int8_t *p, vertype;
    517         u_int16_t session, plen, code;
    518         struct pppoe_softc *sc;
    519 
    520         KASSERT(m->m_flags & M_PKTHDR);
    521 
    522         m_adj(m, sizeof(struct ether_header));
    523         if (m->m_pkthdr.len <= PPPOE_HEADERLEN) {
    524                 printf("pppoe (data): dropping too short packet: %ld bytes\n", (long)m->m_pkthdr.len);
    525                 goto drop;
    526         }
    527 
    528         p = mtod(m, u_int8_t*);
    529 
    530         vertype = *p++;
    531         if (vertype != PPPOE_VERTYPE) {
    532                 printf("pppoe (data): unknown version/type packet: 0x%x\n", vertype);
    533                 goto drop;
    534         }
    535 
    536         code = *p++;
    537         if (code != 0)
    538                 goto drop;
    539 
    540         PPPOE_READ_16(p, session);
    541         sc = pppoe_find_softc_by_session(session, m->m_pkthdr.rcvif);
    542         if (sc == NULL)
    543                 goto drop;
    544 
    545         PPPOE_READ_16(p, plen);
    546 
    547 #if NBPFILTER > 0
    548         if(sc->sc_sppp.pp_if.if_bpf)
    549                 bpf_mtap(sc->sc_sppp.pp_if.if_bpf, m);
    550 #endif
    551 
    552         m_adj(m, PPPOE_HEADERLEN);
    553 
    554 #ifdef PPPOE_DEBUG
    555         {
    556                 struct mbuf *p;
    557 
    558                 printf("%s: pkthdr.len=%d, pppoe.len=%d",
    559                         sc->sc_sppp.pp_if.if_xname,
    560                         m->m_pkthdr.len, plen);
    561                 p = m;
    562                 while (p) {
    563                         printf(" l=%d", p->m_len);
    564                         p = p->m_next;
    565                 }
    566                 printf("\n");
    567         }
    568 #endif
    569 
    570         if (m->m_pkthdr.len < plen)
    571                 goto drop;
    572 
    573         /* fix incoming interface pointer (not the raw ethernet interface anymore) */
    574         m->m_pkthdr.rcvif = &sc->sc_sppp.pp_if;
    575 
    576         /* pass packet up and account for it */
    577         sc->sc_sppp.pp_if.if_ipackets++;
    578         sppp_input(&sc->sc_sppp.pp_if, m);
    579         return;
    580 
    581 drop:
    582         m_free(m);
    583 }
    584 
    585 static int
    586 pppoe_output(struct pppoe_softc *sc, struct mbuf *m)
    587 {
    588         struct sockaddr dst;
    589         struct ether_header *eh;
    590         u_int16_t etype;
    591 
    592         if (sc->sc_eth_if == NULL)
    593                 return EIO;
    594 
    595         memset(&dst, 0, sizeof dst);
    596         dst.sa_family = AF_UNSPEC;
    597         eh = (struct ether_header*)&dst.sa_data;
    598         etype = sc->sc_state == PPPOE_STATE_SESSION? ETHERTYPE_PPPOE : ETHERTYPE_PPPOEDISC;
    599         eh->ether_type = htons(etype);
    600         memcpy(&eh->ether_dhost, &sc->sc_dest, sizeof sc->sc_dest);
    601 
    602 #ifdef PPPOE_DEBUG
    603         printf("%s (%x) state=%d, session=0x%x output -> %s, len=%d\n",
    604             sc->sc_sppp.pp_if.if_xname, etype,
    605             sc->sc_state, sc->sc_session,
    606 	    ether_sprintf((const unsigned char *)&sc->sc_dest), m->m_pkthdr.len);
    607 #endif
    608 
    609 	sc->sc_sppp.pp_if.if_opackets++;
    610 	return sc->sc_eth_if->if_output(sc->sc_eth_if, m, &dst, NULL);
    611 }
    612 
    613 static int
    614 pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, caddr_t data)
    615 {
    616 	struct proc *p = curproc;	/* XXX */
    617 	struct pppoe_softc *sc = (struct pppoe_softc*)ifp;
    618 	int error = 0;
    619 
    620 	switch (cmd) {
    621 	case PPPOESETPARMS:
    622 	{
    623 		struct pppoediscparms *parms = (struct pppoediscparms*)data;
    624 		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
    625 			return error;
    626 		if (parms->eth_ifname[0] != 0) {
    627 			sc->sc_eth_if = ifunit(parms->eth_ifname);
    628 			if (sc->sc_eth_if == NULL)
    629 				return ENXIO;
    630 		}
    631 		if (parms->ac_name) {
    632 			size_t s;
    633 			char * p = malloc(parms->ac_name_len + 1, M_DEVBUF, M_WAITOK);
    634 			copyinstr(parms->ac_name, p, parms->ac_name_len, &s);
    635 			if (sc->sc_concentrator_name)
    636 				free(sc->sc_concentrator_name, M_DEVBUF);
    637 			sc->sc_concentrator_name = p;
    638 		}
    639 		if (parms->service_name) {
    640 			size_t s;
    641 			char * p = malloc(parms->service_name_len + 1, M_DEVBUF, M_WAITOK);
    642 			copyinstr(parms->service_name, p, parms->service_name_len, &s);
    643 			if (sc->sc_service_name)
    644 				free(sc->sc_service_name, M_DEVBUF);
    645 			sc->sc_service_name = p;
    646 		}
    647 		return 0;
    648 	}
    649 	break;
    650 	case PPPOEGETPARMS:
    651 	{
    652 		struct pppoediscparms *parms = (struct pppoediscparms*)data;
    653 		memset(parms, 0, sizeof *parms);
    654 		if (sc->sc_eth_if)
    655 			strncpy(parms->ifname, sc->sc_eth_if->if_xname, IFNAMSIZ);
    656 		return 0;
    657 	}
    658 	break;
    659 	case PPPOEGETSESSION:
    660 	{
    661 		struct pppoeconnectionstate *state = (struct pppoeconnectionstate*)data;
    662 		state->state = sc->sc_state;
    663 		state->session_id = sc->sc_session;
    664 		state->padi_retry_no = sc->sc_padi_retried;
    665 		state->padr_retry_no = sc->sc_padr_retried;
    666 		return 0;
    667 	}
    668 	break;
    669 	case SIOCSIFFLAGS:
    670 	{
    671 		struct ifreq *ifr = (struct ifreq*) data;
    672 		/*
    673 		 * Prevent running re-establishment timers overriding
    674 		 * administrators choice.
    675 		 */
    676 		if ((ifr->ifr_flags & IFF_UP) == 0
    677 		     && sc->sc_state >= PPPOE_STATE_PADI_SENT
    678 		     && sc->sc_state < PPPOE_STATE_SESSION) {
    679 			callout_stop(&sc->sc_timeout);
    680 			sc->sc_state = PPPOE_STATE_INITIAL;
    681 			sc->sc_padi_retried = 0;
    682 			sc->sc_padr_retried = 0;
    683 			memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    684 		}
    685 	}
    686 	/* FALLTHROUGH */
    687 	default:
    688 		return sppp_ioctl(ifp, cmd, data);
    689 	}
    690 	return 0;
    691 }
    692 
    693 /*
    694  * Allocate a mbuf/cluster with space to store the given data length
    695  * of payload, leaving space for prepending an ethernet header
    696  * in front.
    697  */
    698 static struct mbuf *
    699 pppoe_get_mbuf(size_t len)
    700 {
    701 	struct mbuf *m;
    702 
    703 	MGETHDR(m, M_DONTWAIT, MT_DATA);
    704 	if (m == NULL)
    705 		return NULL;
    706 	if (len+sizeof(struct ether_header) > MHLEN) {
    707 		MCLGET(m, M_DONTWAIT);
    708 		if ((m->m_flags & M_EXT) == 0) {
    709 			struct mbuf *n;
    710 			MFREE(m, n);
    711 			return 0;
    712 		}
    713 	}
    714 	m->m_data += sizeof(struct ether_header);
    715 	m->m_len = len;
    716 	m->m_pkthdr.len = len;
    717 	m->m_pkthdr.rcvif = NULL;
    718 
    719 	return m;
    720 }
    721 
    722 static int
    723 pppoe_send_padi(struct pppoe_softc *sc)
    724 {
    725 	struct mbuf *m0;
    726 	int len, l1, l2;
    727 	u_int8_t *p;
    728 
    729 	if (sc->sc_state >PPPOE_STATE_PADI_SENT)
    730 		panic("pppoe_send_padi in state %d", sc->sc_state);
    731 
    732 	/* calculate length of frame (excluding ethernet header + pppoe header) */
    733 	len = 2+2+2+2+sizeof sc;	/* service name tag is required, host unique is send too */
    734 	if (sc->sc_service_name != NULL) {
    735 		l1 = strlen(sc->sc_service_name);
    736 		len += l1;
    737 	}
    738 	if (sc->sc_concentrator_name != NULL) {
    739 		l2 = strlen(sc->sc_concentrator_name);
    740 		len += 2+2+l2;
    741 	}
    742 
    743 	/* allocate a buffer */
    744 	m0 = pppoe_get_mbuf(len+PPPOE_HEADERLEN);	/* header len + payload len */
    745 	if (!m0) return ENOBUFS;
    746 
    747 	/* fill in pkt */
    748 	p = mtod(m0, u_int8_t*);
    749 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADI, 0, len);
    750 	PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
    751 	if (sc->sc_service_name != NULL) {
    752 		PPPOE_ADD_16(p, l1);
    753 		memcpy(p, sc->sc_service_name, l1);
    754 		p += l1;
    755 	} else {
    756 		PPPOE_ADD_16(p, 0);
    757 	}
    758 	if (sc->sc_concentrator_name != NULL) {
    759 		PPPOE_ADD_16(p, PPPOE_TAG_ACNAME);
    760 		PPPOE_ADD_16(p, l2);
    761 		memcpy(p, sc->sc_concentrator_name, l2);
    762 		p += l2;
    763 	}
    764 	PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
    765 	PPPOE_ADD_16(p, sizeof(sc));
    766 	memcpy(p, &sc, sizeof sc);
    767 
    768 #ifdef PPPOE_DEBUG
    769 	p += sizeof sc;
    770 	if (p - mtod(m0, u_int8_t*) != len + PPPOE_HEADERLEN)
    771 		panic("pppoe_send_padi: garbled output len, should be %ld, is %ld",
    772 		    (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, u_int8_t*)));
    773 #endif
    774 
    775 	/* send pkt */
    776 	return pppoe_output(sc, m0);
    777 }
    778 
    779 static void
    780 pppoe_timeout(void *arg)
    781 {
    782 	int x, retry_wait;
    783 	struct pppoe_softc *sc = (struct pppoe_softc*)arg;
    784 
    785 #ifdef PPPOE_DEBUG
    786 	printf("%s: timeout\n", sc->sc_sppp.pp_if.if_xname);
    787 #endif
    788 
    789 	switch (sc->sc_state) {
    790 	case PPPOE_STATE_PADI_SENT:
    791 		/*
    792 		 * We have two basic ways of retrying:
    793 		 *  - Quick retry mode: try a few times in short sequence
    794 		 *  - Slow retry mode: we already had a connection successfully
    795 		 *    established and will try infinitely (without user
    796 		 *    intervention)
    797 		 * We only enter slow retry mode if IFF_LINK1 (aka autodial)
    798 		 * is not set and we already had a successfull connection.
    799 		 */
    800 
    801 		/* initialize for quick retry mode */
    802 		retry_wait = PPPOE_DISC_TIMEOUT*(1+sc->sc_padi_retried);
    803 
    804 		x = splnet();
    805 		sc->sc_padi_retried++;
    806 		if (sc->sc_padi_retried >= PPPOE_DISC_MAXPADI) {
    807 			if ((sc->sc_sppp.pp_if.if_flags & IFF_LINK1) == 0
    808 			   && sc->sc_sppp.pp_if.if_ibytes) {
    809 			    /* slow retry mode */
    810 			    retry_wait = PPPOE_SLOW_RETRY;
    811 			} else {
    812 			    pppoe_abort_connect(sc);
    813 			    splx(x);
    814 			    return;
    815 			}
    816 		}
    817 		if (pppoe_send_padi(sc) == 0)
    818 			callout_reset(&sc->sc_timeout, retry_wait, pppoe_timeout, sc);
    819 		else
    820 			pppoe_abort_connect(sc);
    821 		splx(x);
    822 		break;
    823 
    824 	case PPPOE_STATE_PADR_SENT:
    825 		x = splnet();
    826 		sc->sc_padr_retried++;
    827 		if (sc->sc_padr_retried >= PPPOE_DISC_MAXPADR) {
    828 			memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    829 			sc->sc_state = PPPOE_STATE_PADI_SENT;
    830 			sc->sc_padr_retried = 0;
    831 			if (pppoe_send_padi(sc) == 0)
    832 				callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padi_retried), pppoe_timeout, sc);
    833 			else
    834 				pppoe_abort_connect(sc);
    835 			splx(x);
    836 			return;
    837 		}
    838 		if (pppoe_send_padr(sc) == 0)
    839 			callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT*(1+sc->sc_padr_retried), pppoe_timeout, sc);
    840 		else
    841 			pppoe_abort_connect(sc);
    842 		splx(x);
    843 		break;
    844 	case PPPOE_STATE_CLOSING:
    845 		pppoe_disconnect(sc);
    846 		break;
    847 	default:
    848 		return;	/* all done, work in peace */
    849 	}
    850 }
    851 
    852 /* Start a connection (i.e. initiate discovery phase) */
    853 static int
    854 pppoe_connect(struct pppoe_softc *sc)
    855 {
    856 	int x, err;
    857 
    858 	if (sc->sc_state != PPPOE_STATE_INITIAL)
    859 		return EBUSY;
    860 
    861 	x = splnet();
    862 	sc->sc_state = PPPOE_STATE_PADI_SENT;
    863 	sc->sc_padr_retried = 0;
    864 	err = pppoe_send_padi(sc);
    865 	if (err == 0)
    866 		callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT, pppoe_timeout, sc);
    867 	else
    868 		pppoe_abort_connect(sc);
    869 	splx(x);
    870 	return err;
    871 }
    872 
    873 /* disconnect */
    874 static int
    875 pppoe_disconnect(struct pppoe_softc *sc)
    876 {
    877 	int err, x;
    878 
    879 	x = splnet();
    880 
    881 	if (sc->sc_state < PPPOE_STATE_SESSION)
    882 		err = EBUSY;
    883 	else {
    884 		printf("%s: disconnecting\n", sc->sc_sppp.pp_if.if_xname);
    885 		err = pppoe_send_padt(sc);
    886 	}
    887 
    888 	/* cleanup softc */
    889 	sc->sc_state = PPPOE_STATE_INITIAL;
    890 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    891 	if (sc->sc_ac_cookie) {
    892 		free(sc->sc_ac_cookie, M_MBUF);
    893 		sc->sc_ac_cookie = NULL;
    894 	}
    895 	sc->sc_ac_cookie_len = 0;
    896 	sc->sc_session = 0;
    897 
    898 	/* notify upper layer */
    899 	sc->sc_sppp.pp_down(&sc->sc_sppp);
    900 
    901 	splx(x);
    902 
    903 	return err;
    904 }
    905 
    906 /* Connection attempt aborted */
    907 static void
    908 pppoe_abort_connect(struct pppoe_softc *sc)
    909 {
    910 	printf("%s: could not establish connection\n",
    911 		sc->sc_sppp.pp_if.if_xname);
    912 	sc->sc_state = PPPOE_STATE_INITIAL;
    913 	memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
    914 
    915 	/* notify upper layer */
    916 	sc->sc_sppp.pp_down(&sc->sc_sppp);
    917 }
    918 
    919 /* Send a PADR packet */
    920 static int
    921 pppoe_send_padr(struct pppoe_softc *sc)
    922 {
    923 	struct mbuf *m0;
    924 	u_int8_t *p;
    925 	size_t len, l1;
    926 
    927 	if (sc->sc_state != PPPOE_STATE_PADR_SENT)
    928 		return EIO;
    929 
    930 	len = 2+2+2+2+sizeof(sc);			/* service name, host unique */
    931 	if (sc->sc_service_name != NULL) {		/* service name tag maybe empty */
    932 		l1 = strlen(sc->sc_service_name);
    933 		len += l1;
    934 	}
    935 	if (sc->sc_ac_cookie_len > 0)
    936 		len += 2+2+sc->sc_ac_cookie_len;	/* AC cookie */
    937 	m0 = pppoe_get_mbuf(len+PPPOE_HEADERLEN);
    938 	if (!m0) return ENOBUFS;
    939 	p = mtod(m0, u_int8_t*);
    940 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADR, 0, len);
    941 	PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
    942 	if (sc->sc_service_name != NULL) {
    943 		PPPOE_ADD_16(p, l1);
    944 		memcpy(p, sc->sc_service_name, l1);
    945 		p += l1;
    946 	} else {
    947 		PPPOE_ADD_16(p, 0);
    948 	}
    949 	if (sc->sc_ac_cookie_len > 0) {
    950 		PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE);
    951 		PPPOE_ADD_16(p, sc->sc_ac_cookie_len);
    952 		memcpy(p, sc->sc_ac_cookie, sc->sc_ac_cookie_len);
    953 		p += sc->sc_ac_cookie_len;
    954 	}
    955 	PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
    956 	PPPOE_ADD_16(p, sizeof(sc));
    957 	memcpy(p, &sc, sizeof sc);
    958 
    959 #ifdef PPPOE_DEBUG
    960 	p += sizeof sc;
    961 	if (p - mtod(m0, u_int8_t*) != len + PPPOE_HEADERLEN)
    962 		panic("pppoe_send_padr: garbled output len, should be %ld, is %ld",
    963 			(long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, u_int8_t*)));
    964 #endif
    965 
    966 	return pppoe_output(sc, m0);
    967 }
    968 
    969 /* send a PADT packet */
    970 static int
    971 pppoe_send_padt(struct pppoe_softc *sc)
    972 {
    973 	struct mbuf *m0;
    974 	u_int8_t *p;
    975 
    976 	if (sc->sc_state < PPPOE_STATE_SESSION)
    977 		return EIO;
    978 
    979 #ifdef PPPOE_DEBUG
    980 	printf("%s: sending PADT\n", sc->sc_sppp.pp_if.if_xname);
    981 #endif
    982 	m0 = pppoe_get_mbuf(PPPOE_HEADERLEN);
    983 	if (!m0) return ENOBUFS;
    984 	p = mtod(m0, u_int8_t*);
    985 	PPPOE_ADD_HEADER(p, PPPOE_CODE_PADT, sc->sc_session, 0);
    986 	return pppoe_output(sc, m0);
    987 }
    988 
    989 static void
    990 pppoe_tls(struct sppp *sp)
    991 {
    992 	struct pppoe_softc *sc = (void*)sp;
    993 	if (sc->sc_state != PPPOE_STATE_INITIAL)
    994 		return;
    995 	pppoe_connect(sc);
    996 }
    997 
    998 static void
    999 pppoe_tlf(struct sppp *sp)
   1000 {
   1001 	struct pppoe_softc *sc = (void*)sp;
   1002 	if (sc->sc_state < PPPOE_STATE_SESSION)
   1003 		return;
   1004 	/*
   1005 	 * Do not call pppoe_disconnect here, the upper layer state
   1006 	 * machine gets confused by this. We must return from this
   1007 	 * function and defer disconnecting to the timeout handler.
   1008 	 */
   1009 	sc->sc_state = PPPOE_STATE_CLOSING;
   1010 	callout_reset(&sc->sc_timeout, hz/50, pppoe_timeout, sc);
   1011 }
   1012 
   1013 static void
   1014 pppoe_start(struct ifnet *ifp)
   1015 {
   1016 	struct pppoe_softc *sc = (void*)ifp;
   1017 	struct mbuf *m;
   1018 	u_int8_t *p;
   1019 	size_t len;
   1020 
   1021 	if (sppp_isempty(ifp))
   1022 		return;
   1023 
   1024 	/* are we read to proccess data yet? */
   1025 	if (sc->sc_state < PPPOE_STATE_SESSION) {
   1026 		sppp_flush(&sc->sc_sppp.pp_if);
   1027 		return;
   1028 	}
   1029 
   1030 	while ((m = sppp_dequeue(ifp)) != NULL) {
   1031 		len = m->m_pkthdr.len;
   1032 		M_PREPEND(m, PPPOE_HEADERLEN, M_DONTWAIT);
   1033 		if (m == NULL) {
   1034 			m_free(m);
   1035 			break;
   1036 		}
   1037 		p = mtod(m, u_int8_t*);
   1038 		PPPOE_ADD_HEADER(p, 0, sc->sc_session, len);
   1039 
   1040 #if NBPFILTER > 0
   1041 		if(sc->sc_sppp.pp_if.if_bpf)
   1042 			bpf_mtap(sc->sc_sppp.pp_if.if_bpf, m);
   1043 #endif
   1044 
   1045 		pppoe_output(sc, m);
   1046 	}
   1047 }
   1048