sys/netgraph/ng_pppoe.c

   1
   2 /*
   3  * ng_pppoe.c
   4  *
   5  * Copyright (c) 1996-1999 Whistle Communications, Inc.
   6  * All rights reserved.
   7  *
   8  * Subject to the following obligations and disclaimer of warranty, use and
   9  * redistribution of this software, in source or object code forms, with or
  10  * without modifications are expressly permitted by Whistle Communications;
  11  * provided, however, that:
  12  * 1. Any and all reproductions of the source or object code must include the
  13  *    copyright notice above and the following disclaimer of warranties; and
  14  * 2. No rights are granted, in any manner or form, to use Whistle
  15  *    Communications, Inc. trademarks, including the mark "WHISTLE
  16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
  17  *    such appears in the above copyright notice or in the software.
  18  *
  19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
  20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
  21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
  22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
  23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
  24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
  25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
  26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
  27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
  28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
  29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
  30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
  32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
  35  * OF SUCH DAMAGE.
  36  *
  37  * Author: Julian Elischer <julian@whistle.com>
  38  *
  39  * $FreeBSD$
  40  * $Whistle: ng_pppoe.c,v 1.10 1999/11/01 09:24:52 julian Exp $
  41  */
  42 #if 0
  43 #define AAA printf("pppoe: %s\n", __FUNCTION__ );
  44 #define BBB printf("-%d-", __LINE__ );
  45 #else
  46 #define AAA
  47 #define BBB
  48 #endif
  49
  50 #include <sys/param.h>
  51 #include <sys/systm.h>
  52 #include <sys/kernel.h>
  53 #include <sys/mbuf.h>
  54 #include <sys/malloc.h>
  55 #include <sys/errno.h>
  56 #include <net/ethernet.h>
  57
  58 #include <netgraph/ng_message.h>
  59 #include <netgraph/netgraph.h>
  60 #include <netgraph/ng_pppoe.h>
  61
  62 #define SIGNOFF "session closed"
  63
  64 /*
  65  * This section contains the netgraph method declarations for the
  66  * sample node. These methods define the netgraph 'type'.
  67  */
  68
  69 static ng_constructor_t ng_pppoe_constructor;
  70 static ng_rcvmsg_t      ng_pppoe_rcvmsg;
  71 static ng_shutdown_t    ng_pppoe_rmnode;
  72 static ng_newhook_t     ng_pppoe_newhook;
  73 static ng_connect_t     ng_pppoe_connect;
  74 static ng_rcvdata_t     ng_pppoe_rcvdata;
  75 static ng_disconnect_t  ng_pppoe_disconnect;
  76
  77 /* Netgraph node type descriptor */
  78 static struct ng_type typestruct = {
  79         NG_VERSION,
  80         NG_PPPOE_NODE_TYPE,
  81         NULL,
  82         ng_pppoe_constructor,
  83         ng_pppoe_rcvmsg,
  84         ng_pppoe_rmnode,
  85         ng_pppoe_newhook,
  86         NULL,
  87         ng_pppoe_connect,
  88         ng_pppoe_rcvdata,
  89         ng_pppoe_rcvdata,
  90         ng_pppoe_disconnect,
  91         NULL
  92 };
  93 NETGRAPH_INIT(pppoe, &typestruct);
  94
  95 /*
  96  * States for the session state machine.
  97  * These have no meaning if there is no hook attached yet.
  98  */
  99 enum state {
 100     PPPOE_SNONE=0,      /* [both] Initial state */
 101     PPPOE_LISTENING,    /* [Daemon] Listening for discover initiation pkt */
 102     PPPOE_SINIT,        /* [Client] Sent discovery initiation */
 103     PPPOE_PRIMED,       /* [Server] Awaiting PADI from daemon */
 104     PPPOE_SOFFER,       /* [Server] Sent offer message  (got PADI)*/
 105     PPPOE_SREQ,         /* [Client] Sent a Request */
 106     PPPOE_NEWCONNECTED, /* [Server] Connection established, No data received */
 107     PPPOE_CONNECTED,    /* [Both] Connection established, Data received */
 108     PPPOE_DEAD          /* [Both] */
 109 };
 110
 111 #define NUMTAGS 20 /* number of tags we are set up to work with */
 112
 113 /*
 114  * Information we store for each hook on each node for negotiating the
 115  * session. The mbuf and cluster are freed once negotiation has completed.
 116  * The whole negotiation block is then discarded.
 117  */
 118
 119 struct sess_neg {
 120         struct mbuf             *m; /* holds cluster with last sent packet */
 121         union   packet          *pkt; /* points within the above cluster */
 122         struct callout_handle   timeout_handle;   /* see timeout(9) */
 123         u_int                   timeout; /* 0,1,2,4,8,16 etc. seconds */
 124         u_int                   numtags;
 125         struct pppoe_tag        *tags[NUMTAGS];
 126         u_int                   service_len;
 127         u_int                   ac_name_len;
 128
 129         struct datatag          service;
 130         struct datatag          ac_name;
 131 };
 132 typedef struct sess_neg *negp;
 133
 134 /*
 135  * Session information that is needed after connection.
 136  */
 137 struct session {
 138         hook_p                  hook;
 139         u_int16_t               Session_ID;
 140         struct session          *hash_next; /* not yet uesed */
 141         enum state              state;
 142         char                    creator[NG_NODELEN + 1]; /* who to notify */
 143         struct pppoe_full_hdr   pkt_hdr;        /* used when connected */
 144         negp                    neg;            /* used when negotiating */
 145 };
 146 typedef struct session *sessp;
 147
 148 /*
 149  * Information we store for each node
 150  */
 151 struct PPPOE {
 152         node_p          node;           /* back pointer to node */
 153         hook_p          ethernet_hook;
 154         hook_p          debug_hook;
 155         u_int           packets_in;     /* packets in from ethernet */
 156         u_int           packets_out;    /* packets out towards ethernet */
 157         u_int32_t       flags;
 158         /*struct session *buckets[HASH_SIZE];*/ /* not yet used */
 159 };
 160 typedef struct PPPOE *priv_p;
 161
 162 const struct ether_header eh_prototype =
 163         {{0xff,0xff,0xff,0xff,0xff,0xff},
 164          {0x00,0x00,0x00,0x00,0x00,0x00},
 165          ETHERTYPE_PPPOE_DISC};
 166
 167 union uniq {
 168         char bytes[sizeof(void *)];
 169         void * pointer;
 170         };
 171
 172 #define LEAVE(x) do { error = x; goto quit; } while(0)
 173 static void     pppoe_start(sessp sp);
 174 static void     sendpacket(sessp sp);
 175 static void     pppoe_ticker(void *arg);
 176 static struct pppoe_tag* scan_tags(sessp        sp, struct pppoe_hdr* ph);
 177 static  int     pppoe_send_event(sessp sp, enum cmd cmdid);
 178
 179 /*************************************************************************
 180  * Some basic utilities  from the Linux version with author's permission.*
 181  * Author:      Michal Ostrowski <mostrows@styx.uwaterloo.ca>            *
 182  ************************************************************************/
 183
 184 /*
 185  * Generate a new session id
 186  * XXX find out the FreeBSD locking scheme.
 187  */
 188 static u_int16_t
 189 get_new_sid(node_p node)
 190 {
 191         static int pppoe_sid = 10;
 192         sessp sp;
 193         hook_p  hook;
 194         u_int16_t val;
 195         priv_p privp = node->private;
 196
 197 AAA
 198 restart:
 199         val = pppoe_sid++;
 200         /*
 201          * Spec says 0xFFFF is reserved.
 202          * Also don't use 0x0000
 203          */
 204         if (val == 0xffff) {
 205                 pppoe_sid = 20;
 206                 goto restart;
 207         }
 208
 209         /* Check it isn't already in use */
 210         LIST_FOREACH(hook, &node->hooks, hooks) {
 211                 /* don't check special hooks */
 212                 if ((hook->private == &privp->debug_hook)
 213                 ||  (hook->private == &privp->ethernet_hook))
 214                         continue;
 215                 sp = hook->private;
 216                 if (sp->Session_ID == val)
 217                         goto restart;
 218         }
 219
 220         return val;
 221 }
 222
 223
 224 /*
 225  * Return the location where the next tag can be put
 226  */
 227 static __inline struct pppoe_tag*
 228 next_tag(struct pppoe_hdr* ph)
 229 {
 230         return (struct pppoe_tag*)(((char*)&ph->tag[0]) + ntohs(ph->length));
 231 }
 232
 233 /*
 234  * Look for a tag of a specific type
 235  * Don't trust any length the other end says.
 236  * but assume we already sanity checked ph->length.
 237  */
 238 static struct pppoe_tag*
 239 get_tag(struct pppoe_hdr* ph, u_int16_t idx)
 240 {
 241         char *end = (char *)next_tag(ph);
 242         char *ptn;
 243         struct pppoe_tag *pt = &ph->tag[0];
 244         /*
 245          * Keep processing tags while a tag header will still fit.
 246          */
 247 AAA
 248         while((char*)(pt + 1) <= end) {
 249             /*
 250              * If the tag data would go past the end of the packet, abort.
 251              */
 252             ptn = (((char *)(pt + 1)) + ntohs(pt->tag_len));
 253             if(ptn > end)
 254                 return NULL;
 255
 256             if(pt->tag_type == idx)
 257                 return pt;
 258
 259             pt = (struct pppoe_tag*)ptn;
 260         }
 261         return NULL;
 262 }
 263
 264 /**************************************************************************
 265  * inlines to initialise or add tags to a session's tag list,
 266  **************************************************************************/
 267 /*
 268  * Initialise the session's tag list
 269  */
 270 static void
 271 init_tags(sessp sp)
 272 {
 273 AAA
 274         if(sp->neg == NULL) {
 275                 printf("pppoe: asked to init NULL neg pointer\n");
 276                 return;
 277         }
 278         sp->neg->numtags = 0;
 279 }
 280
 281 static void
 282 insert_tag(sessp sp, struct pppoe_tag *tp)
 283 {
 284         int     i;
 285         negp neg;
 286
 287 AAA
 288         if((neg = sp->neg) == NULL) {
 289                 printf("pppoe: asked to use NULL neg pointer\n");
 290                 return;
 291         }
 292         if ((i = neg->numtags++) < NUMTAGS) {
 293                 neg->tags[i] = tp;
 294         } else {
 295                 printf("pppoe: asked to add too many tags to packet\n");
 296                 neg->numtags--;
 297         }
 298 }
 299
 300 /*
 301  * Make up a packet, using the tags filled out for the session.
 302  *
 303  * Assume that the actual pppoe header and ethernet header
 304  * are filled out externally to this routine.
 305  * Also assume that neg->wh points to the correct
 306  * location at the front of the buffer space.
 307  */
 308 static void
 309 make_packet(sessp sp) {
 310         struct pppoe_full_hdr *wh = &sp->neg->pkt->pkt_header;
 311         struct pppoe_tag **tag;
 312         char *dp;
 313         int count;
 314         int tlen;
 315         u_int16_t length = 0;
 316
 317 AAA
 318         if ((sp->neg == NULL) || (sp->neg->m == NULL)) {
 319                 printf("pppoe: make_packet called from wrong state\n");
 320         }
 321         dp = (char *)wh->ph.tag;
 322         for (count = 0, tag = sp->neg->tags;
 323             ((count < sp->neg->numtags) && (count < NUMTAGS));
 324             tag++, count++) {
 325                 tlen = ntohs((*tag)->tag_len) + sizeof(**tag);
 326                 if ((length + tlen) > (ETHER_MAX_LEN - 4 - sizeof(*wh))) {
 327                         printf("pppoe: tags too long\n");
 328                         sp->neg->numtags = count;
 329                         break;  /* XXX chop off what's too long */
 330                 }
 331                 bcopy((char *)*tag, (char *)dp, tlen);
 332                 length += tlen;
 333                 dp += tlen;
 334         }
 335         wh->ph.length = htons(length);
 336         sp->neg->m->m_len = length + sizeof(*wh);
 337         sp->neg->m->m_pkthdr.len = length + sizeof(*wh);
 338 }
 339
 340 /**************************************************************************
 341  * Routine to match a service offered                                     *
 342  **************************************************************************/
 343 /*
 344  * Find a hook that has a service string that matches that
 345  * we are seeking. for now use a simple string.
 346  * In the future we may need something like regexp().
 347  * for testing allow a null string to match 1st found and a null service
 348  * to match all requests. Also make '*' do the same.
 349  */
 350 static hook_p
 351 pppoe_match_svc(node_p node, char *svc_name, int svc_len)
 352 {
 353         sessp   sp      = NULL;
 354         negp    neg     = NULL;
 355         priv_p  privp   = node->private;
 356         hook_p hook;
 357
 358 AAA
 359         LIST_FOREACH(hook, &node->hooks, hooks) {
 360
 361                 /* skip any hook that is debug or ethernet */
 362                 if ((hook->private == &privp->debug_hook)
 363                 ||  (hook->private == &privp->ethernet_hook))
 364                         continue;
 365                 sp = hook->private;
 366
 367                 /* Skip any sessions which are not in LISTEN mode. */
 368                 if ( sp->state != PPPOE_LISTENING)
 369                         continue;
 370
 371                 neg = sp->neg;
 372                 /* XXX check validity of this */
 373                 /* special case, NULL request. match 1st found. */
 374                 if (svc_len == 0)
 375                         break;
 376
 377                 /* XXX check validity of this */
 378                 /* Special case for a blank or "*" service name (wildcard) */
 379                 if ((neg->service_len == 0)
 380                 ||  ((neg->service_len == 1)
 381                   && (neg->service.data[0] == '*'))) {
 382                         break;
 383                 }
 384
 385                 /* If the lengths don't match, that aint it. */
 386                 if (neg->service_len != svc_len)
 387                         continue;
 388
 389                 /* An exact match? */
 390                 if (strncmp(svc_name, neg->service.data, svc_len) == 0)
 391                         break;
 392         }
 393         return (hook);
 394 }
 395 /**************************************************************************
 396  * Routine to find a particular session that matches an incoming packet   *
 397  **************************************************************************/
 398 static hook_p
 399 pppoe_findsession(node_p node, struct pppoe_full_hdr *wh)
 400 {
 401         sessp   sp = NULL;
 402         hook_p hook = NULL;
 403         priv_p  privp = node->private;
 404         u_int16_t       session = ntohs(wh->ph.sid);
 405
 406         /*
 407          * find matching peer/session combination.
 408          */
 409 AAA
 410         LIST_FOREACH(hook, &node->hooks, hooks) {
 411                 /* don't check special hooks */
 412                 if ((hook->private == &privp->debug_hook)
 413                 ||  (hook->private == &privp->ethernet_hook)) {
 414                         continue;
 415                 }
 416                 sp = hook->private;
 417                 if ( ( (sp->state == PPPOE_CONNECTED)
 418                     || (sp->state == PPPOE_NEWCONNECTED) )
 419                 && (sp->Session_ID == session)
 420                 && (bcmp(sp->pkt_hdr.eh.ether_dhost,
 421                     wh->eh.ether_shost,
 422                     ETHER_ADDR_LEN)) == 0) {
 423                         break;
 424                 }
 425         }
 426         return (hook);
 427 }
 428
 429 static hook_p
 430 pppoe_finduniq(node_p node, struct pppoe_tag *tag)
 431 {
 432         hook_p hook = NULL;
 433         priv_p  privp = node->private;
 434         union uniq              uniq;
 435
 436 AAA
 437         bcopy(tag->tag_data, uniq.bytes, sizeof(void *));
 438         /* cycle through all known hooks */
 439         LIST_FOREACH(hook, &node->hooks, hooks) {
 440                 /* don't check special hooks */
 441                 if ((hook->private == &privp->debug_hook)
 442                 ||  (hook->private == &privp->ethernet_hook))
 443                         continue;
 444                 if (uniq.pointer == hook->private)
 445                         break;
 446         }
 447         return (hook);
 448 }
 449
 450 /**************************************************************************
 451  * start of Netgraph entrypoints                                          *
 452  **************************************************************************/
 453
 454 /*
 455  * Allocate the private data structure and the generic node
 456  * and link them together.
 457  *
 458  * ng_make_node_common() returns with a generic node struct
 459  * with a single reference for us.. we transfer it to the
 460  * private structure.. when we free the private struct we must
 461  * unref the node so it gets freed too.
 462  *
 463  * If this were a device node than this work would be done in the attach()
 464  * routine and the constructor would return EINVAL as you should not be able
 465  * to creatednodes that depend on hardware (unless you can add the hardware :)
 466  */
 467 static int
 468 ng_pppoe_constructor(node_p *nodep)
 469 {
 470         priv_p privdata;
 471         int error;
 472
 473 AAA
 474         /* Initialize private descriptor */
 475         MALLOC(privdata, priv_p, sizeof(*privdata), M_NETGRAPH, M_WAITOK);
 476         if (privdata == NULL)
 477                 return (ENOMEM);
 478         bzero(privdata, sizeof(*privdata));
 479
 480         /* Call the 'generic' (ie, superclass) node constructor */
 481         if ((error = ng_make_node_common(&typestruct, nodep))) {
 482                 FREE(privdata, M_NETGRAPH);
 483                 return (error);
 484         }
 485
 486         /* Link structs together; this counts as our one reference to *nodep */
 487         (*nodep)->private = privdata;
 488         privdata->node = *nodep;
 489         return (0);
 490 }
 491
 492 /*
 493  * Give our ok for a hook to be added...
 494  * point the hook's private info to the hook structure.
 495  *
 496  * The following hook names are special:
 497  *  Ethernet:  the hook that should be connected to a NIC.
 498  *  debug:      copies of data sent out here  (when I write the code).
 499  */
 500 static int
 501 ng_pppoe_newhook(node_p node, hook_p hook, const char *name)
 502 {
 503         const priv_p privp = node->private;
 504         sessp sp;
 505
 506 AAA
 507         if (strcmp(name, NG_PPPOE_HOOK_ETHERNET) == 0) {
 508                 privp->ethernet_hook = hook;
 509                 hook->private = &privp->ethernet_hook;
 510         } else if (strcmp(name, NG_PPPOE_HOOK_DEBUG) == 0) {
 511                 privp->debug_hook = hook;
 512                 hook->private = &privp->debug_hook;
 513         } else {
 514                 /*
 515                  * Any other unique name is OK.
 516                  * The infrastructure has already checked that it's unique,
 517                  * so just allocate it and hook it in.
 518                  */
 519                 MALLOC(sp, sessp, sizeof(*sp), M_NETGRAPH, M_WAITOK);
 520                 if (sp == NULL) {
 521                                 return (ENOMEM);
 522                 }
 523                 bzero(sp, sizeof(*sp));
 524
 525                 hook->private = sp;
 526                 sp->hook = hook;
 527         }
 528         return(0);
 529 }
 530
 531 /*
 532  * Get a netgraph control message.
 533  * Check it is one we understand. If needed, send a response.
 534  * We sometimes save the address for an async action later.
 535  * Always free the message.
 536  */
 537 static int
 538 ng_pppoe_rcvmsg(node_p node, struct ng_mesg *msg, const char *retaddr,
 539                 struct ng_mesg **rptr, hook_p lasthook)
 540 {
 541         priv_p privp = node->private;
 542         struct ngpppoe_init_data *ourmsg = NULL;
 543         struct ng_mesg *resp = NULL;
 544         int error = 0;
 545         hook_p hook = NULL;
 546         sessp sp = NULL;
 547         negp neg = NULL;
 548
 549 AAA
 550         /* Deal with message according to cookie and command */
 551         switch (msg->header.typecookie) {
 552         case NGM_PPPOE_COOKIE:
 553                 switch (msg->header.cmd) {
 554                 case NGM_PPPOE_CONNECT:
 555                 case NGM_PPPOE_LISTEN:
 556                 case NGM_PPPOE_OFFER:
 557                         ourmsg = (struct ngpppoe_init_data *)msg->data;
 558                         if (( sizeof(*ourmsg) > msg->header.arglen)
 559                         || ((sizeof(*ourmsg) + ourmsg->data_len)
 560                             > msg->header.arglen)) {
 561                                 printf("pppoe_rcvmsg: bad arg size");
 562                                 LEAVE(EMSGSIZE);
 563                         }
 564                         if (ourmsg->data_len > PPPOE_SERVICE_NAME_SIZE) {
 565                                 printf("pppoe: init data too long (%d)\n",
 566                                                         ourmsg->data_len);
 567                                 LEAVE(EMSGSIZE);
 568                         }
 569                         /* make sure strcmp will terminate safely */
 570                         ourmsg->hook[sizeof(ourmsg->hook) - 1] = '\0';
 571
 572                         /* cycle through all known hooks */
 573                         LIST_FOREACH(hook, &node->hooks, hooks) {
 574                                 if (hook->name
 575                                 && strcmp(hook->name, ourmsg->hook) == 0)
 576                                         break;
 577                         }
 578                         if (hook == NULL) {
 579                                 LEAVE(ENOENT);
 580                         }
 581                         if ((hook->private == &privp->debug_hook)
 582                         ||  (hook->private == &privp->ethernet_hook)) {
 583                                 LEAVE(EINVAL);
 584                         }
 585                         sp = hook->private;
 586                         if (sp->state |= PPPOE_SNONE) {
 587                                 printf("pppoe: Session already active\n");
 588                                 LEAVE(EISCONN);
 589                         }
 590
 591                         /*
 592                          * set up prototype header
 593                          */
 594                         MALLOC(neg, negp, sizeof(*neg), M_NETGRAPH, M_WAITOK);
 595
 596                         if (neg == NULL) {
 597                                 printf("pppoe: Session out of memory\n");
 598                                 LEAVE(ENOMEM);
 599                         }
 600                         bzero(neg, sizeof(*neg));
 601                         MGETHDR(neg->m, M_DONTWAIT, MT_DATA);
 602                         if(neg->m == NULL) {
 603                                 printf("pppoe: Session out of mbufs\n");
 604                                 FREE(neg, M_NETGRAPH);
 605                                 LEAVE(ENOBUFS);
 606                         }
 607                         neg->m->m_pkthdr.rcvif = NULL;
 608                         MCLGET(neg->m, M_DONTWAIT);
 609                         if ((neg->m->m_flags & M_EXT) == 0) {
 610                                 printf("pppoe: Session out of mcls\n");
 611                                 m_freem(neg->m);
 612                                 FREE(neg, M_NETGRAPH);
 613                                 LEAVE(ENOBUFS);
 614                         }
 615                         sp->neg = neg;
 616                         callout_handle_init( &neg->timeout_handle);
 617                         neg->m->m_len = sizeof(struct pppoe_full_hdr);
 618                         neg->pkt = mtod(neg->m, union packet*);
 619                         neg->pkt->pkt_header.eh = eh_prototype;
 620                         neg->pkt->pkt_header.ph.ver = 0x1;
 621                         neg->pkt->pkt_header.ph.type = 0x1;
 622                         neg->pkt->pkt_header.ph.sid = 0x0000;
 623                         neg->timeout = 0;
 624
 625                         strncpy(sp->creator, retaddr, NG_NODELEN);
 626                         sp->creator[NG_NODELEN] = '\0';
 627                 }
 628                 switch (msg->header.cmd) {
 629                 case NGM_PPPOE_GET_STATUS:
 630                     {
 631                         struct ngpppoestat *stats;
 632
 633                         NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
 634                         if (!resp) {
 635                                 LEAVE(ENOMEM);
 636                         }
 637                         stats = (struct ngpppoestat *) resp->data;
 638                         stats->packets_in = privp->packets_in;
 639                         stats->packets_out = privp->packets_out;
 640                         break;
 641                     }
 642                 case NGM_PPPOE_CONNECT:
 643                         /*
 644                          * Check the hook exists and is Uninitialised.
 645                          * Send a PADI request, and start the timeout logic.
 646                          * Store the originator of this message so we can send
 647                          * a success of fail message to them later.
 648                          * Move the session to SINIT
 649                          * Set up the session to the correct state and
 650                          * start it.
 651                          */
 652                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 653                         neg->service.hdr.tag_len =
 654                                         htons((u_int16_t)ourmsg->data_len);
 655                         if (ourmsg->data_len) {
 656                                 bcopy(ourmsg->data,
 657                                         neg->service.data, ourmsg->data_len);
 658                         }
 659                         neg->service_len = ourmsg->data_len;
 660                         pppoe_start(sp);
 661                         break;
 662                 case NGM_PPPOE_LISTEN:
 663                         /*
 664                          * Check the hook exists and is Uninitialised.
 665                          * Install the service matching string.
 666                          * Store the originator of this message so we can send
 667                          * a success of fail message to them later.
 668                          * Move the hook to 'LISTENING'
 669
 670                          */
 671                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 672                         neg->service.hdr.tag_len =
 673                                         htons((u_int16_t)ourmsg->data_len);
 674
 675                         if (ourmsg->data_len) {
 676                                 bcopy(ourmsg->data,
 677                                         neg->service.data, ourmsg->data_len);
 678                         }
 679                         neg->service_len = ourmsg->data_len;
 680                         neg->pkt->pkt_header.ph.code = PADT_CODE;
 681                         /*
 682                          * wait for PADI packet coming from ethernet
 683                          */
 684                         sp->state = PPPOE_LISTENING;
 685                         break;
 686                 case NGM_PPPOE_OFFER:
 687                         /*
 688                          * Check the hook exists and is Uninitialised.
 689                          * Store the originator of this message so we can send
 690                          * a success of fail message to them later.
 691                          * Store the AC-Name given and go to PRIMED.
 692                          */
 693                         neg->ac_name.hdr.tag_type = PTT_AC_NAME;
 694                         neg->ac_name.hdr.tag_len =
 695                                         htons((u_int16_t)ourmsg->data_len);
 696                         if (ourmsg->data_len) {
 697                                 bcopy(ourmsg->data,
 698                                         neg->ac_name.data, ourmsg->data_len);
 699                         }
 700                         neg->ac_name_len = ourmsg->data_len;
 701                         neg->pkt->pkt_header.ph.code = PADO_CODE;
 702                         /*
 703                          * Wait for PADI packet coming from hook
 704                          */
 705                         sp->state = PPPOE_PRIMED;
 706                         break;
 707                 default:
 708                         LEAVE(EINVAL);
 709                 }
 710                 break;
 711         default:
 712                 LEAVE(EINVAL);
 713         }
 714
 715         /* Take care of synchronous response, if any */
 716         if (rptr)
 717                 *rptr = resp;
 718         else if (resp)
 719                 FREE(resp, M_NETGRAPH);
 720
 721         /* Free the message and return */
 722 quit:
 723         FREE(msg, M_NETGRAPH);
 724         return(error);
 725 }
 726
 727 /*
 728  * Start a client into the first state. A separate function because
 729  * it can be needed if the negotiation times out.
 730  */
 731 static void
 732 pppoe_start(sessp sp)
 733 {
 734         struct {
 735                 struct pppoe_tag hdr;
 736                 union   uniq    data;
 737         } uniqtag;
 738
 739         /*
 740          * kick the state machine into starting up
 741          */
 742 AAA
 743         sp->state = PPPOE_SINIT;
 744         /* reset the packet header to broadcast */
 745         sp->neg->pkt->pkt_header.eh = eh_prototype;
 746         sp->neg->pkt->pkt_header.ph.code = PADI_CODE;
 747         uniqtag.hdr.tag_type = PTT_HOST_UNIQ;
 748         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(uniqtag.data));
 749         uniqtag.data.pointer = sp;
 750         init_tags(sp);
 751         insert_tag(sp, &sp->neg->service.hdr);
 752         insert_tag(sp, &uniqtag.hdr);
 753         make_packet(sp);
 754         sendpacket(sp);
 755 }
 756
 757 /*
 758  * Receive data, and do something with it.
 759  * The caller will never free m or meta, so
 760  * if we use up this data or abort we must free BOTH of these.
 761  */
 762 static int
 763 ng_pppoe_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 764                 struct mbuf **ret_m, meta_p *ret_meta)
 765 {
 766         node_p                  node = hook->node;
 767         const priv_p            privp = node->private;
 768         sessp                   sp = hook->private;
 769         struct pppoe_full_hdr   *wh;
 770         struct pppoe_hdr        *ph;
 771         int                     error = 0;
 772         u_int16_t               session;
 773         u_int16_t               length;
 774         u_int8_t                code;
 775         struct pppoe_tag        *utag = NULL, *tag = NULL;
 776         hook_p                  sendhook;
 777         struct {
 778                 struct pppoe_tag hdr;
 779                 union   uniq    data;
 780         } uniqtag;
 781         negp                    neg = NULL;
 782
 783 AAA
 784         if (hook->private == &privp->debug_hook) {
 785                 /*
 786                  * Data from the debug hook gets sent without modification
 787                  * straight to the ethernet.
 788                  */
 789                 NG_SEND_DATA( error, privp->ethernet_hook, m, meta);
 790                 privp->packets_out++;
 791         } else if (hook->private == &privp->ethernet_hook) {
 792                 /*
 793                  * Incoming data.
 794                  * Dig out various fields from the packet.
 795                  * use them to decide where to send it.
 796                  */
 797
 798                 privp->packets_in++;
 799                 if( m->m_len < sizeof(*wh)) {
 800                         m = m_pullup(m, sizeof(*wh)); /* Checks length */
 801                         if (m == NULL) {
 802                                 printf("couldn't m_pullup\n");
 803                                 LEAVE(ENOBUFS);
 804                         }
 805                 }
 806                 wh = mtod(m, struct pppoe_full_hdr *);
 807                 ph = &wh->ph;
 808                 session = ntohs(wh->ph.sid);
 809                 length = ntohs(wh->ph.length);
 810                 code = wh->ph.code;
 811                 switch(wh->eh.ether_type) {
 812                 case    ETHERTYPE_PPPOE_DISC:
 813                         /*
 814                          * We need to try to make sure that the tag area
 815                          * is contiguous, or we could wander off the end
 816                          * of a buffer and make a mess.
 817                          * (Linux wouldn't have this problem).
 818                          */
 819 /*XXX fix this mess */
 820
 821                         if (m->m_pkthdr.len <= MHLEN) {
 822                                 if( m->m_len < m->m_pkthdr.len) {
 823                                         m = m_pullup(m, m->m_pkthdr.len);
 824                                         if (m == NULL) {
 825                                                 printf("couldn't m_pullup\n");
 826                                                 LEAVE(ENOBUFS);
 827                                         }
 828                                 }
 829                         }
 830                         if (m->m_len != m->m_pkthdr.len) {
 831                                 /*
 832                                  * It's not all in one piece.
 833                                  * We need to do extra work.
 834                                  */
 835                                 printf("packet fragmented\n");
 836                                 LEAVE(EMSGSIZE);
 837                         }
 838
 839                         switch(code) {
 840                         case    PADI_CODE:
 841                                 /*
 842                                  * We are a server:
 843                                  * Look for a hook with the required service
 844                                  * and send the ENTIRE packet up there.
 845                                  * It should come back to a new hook in
 846                                  * PRIMED state. Look there for further
 847                                  * processing.
 848                                  */
 849                                 tag = get_tag(ph, PTT_SRV_NAME);
 850                                 if (tag == NULL) {
 851                                         printf("no service tag\n");
 852                                         LEAVE(ENETUNREACH);
 853                                 }
 854                                 sendhook = pppoe_match_svc(hook->node,
 855                                         tag->tag_data, ntohs(tag->tag_len));
 856                                 if (sendhook) {
 857                                         NG_SEND_DATA(error, sendhook, m, meta);
 858                                 } else {
 859                                         printf("no such service\n");
 860                                         LEAVE(ENETUNREACH);
 861                                 }
 862                                 break;
 863                         case    PADO_CODE:
 864                                 /*
 865                                  * We are a client:
 866                                  * Use the host_uniq tag to find the
 867                                  * hook this is in response to.
 868                                  * Received #2, now send #3
 869                                  * For now simply accept the first we receive.
 870                                  */
 871                                 utag = get_tag(ph, PTT_HOST_UNIQ);
 872                                 if ((utag == NULL)
 873                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
 874                                         printf("no host unique field\n");
 875                                         LEAVE(ENETUNREACH);
 876                                 }
 877
 878                                 sendhook = pppoe_finduniq(node, utag);
 879                                 if (sendhook == NULL) {
 880                                         printf("no matching session\n");
 881                                         LEAVE(ENETUNREACH);
 882                                 }
 883
 884                                 /*
 885                                  * Check the session is in the right state.
 886                                  * It needs to be in PPPOE_SINIT.
 887                                  */
 888                                 sp = sendhook->private;
 889                                 if (sp->state != PPPOE_SINIT) {
 890                                         printf("session in wrong state\n");
 891                                         LEAVE(ENETUNREACH);
 892                                 }
 893                                 neg = sp->neg;
 894                                 untimeout(pppoe_ticker, sendhook,
 895                                     neg->timeout_handle);
 896
 897                                 /*
 898                                  * This is the first time we hear
 899                                  * from the server, so note it's
 900                                  * unicast address, replacing the
 901                                  * broadcast address .
 902                                  */
 903                                 bcopy(wh->eh.ether_shost,
 904                                         neg->pkt->pkt_header.eh.ether_dhost,
 905                                         ETHER_ADDR_LEN);
 906                                 neg->timeout = 0;
 907                                 neg->pkt->pkt_header.ph.code = PADR_CODE;
 908                                 init_tags(sp);
 909                                 insert_tag(sp, &neg->service.hdr); /* Service */
 910                                 if ((tag = get_tag(ph, PTT_AC_COOKIE)))
 911                                         insert_tag(sp, tag); /* return cookie */
 912                                 if ((tag = get_tag(ph, PTT_AC_NAME)))
 913                                         insert_tag(sp, tag); /* return it */
 914                                 insert_tag(sp, utag);      /* Host Unique */
 915                                 scan_tags(sp, ph);
 916                                 make_packet(sp);
 917                                 sp->state = PPPOE_SREQ;
 918                                 sendpacket(sp);
 919                                 break;
 920                         case    PADR_CODE:
 921
 922                                 /*
 923                                  * We are a server:
 924                                  * Use the ac_cookie tag to find the
 925                                  * hook this is in response to.
 926                                  */
 927                                 utag = get_tag(ph, PTT_AC_COOKIE);
 928                                 if ((utag == NULL)
 929                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
 930                                         LEAVE(ENETUNREACH);
 931                                 }
 932
 933                                 sendhook = pppoe_finduniq(node, utag);
 934                                 if (sendhook == NULL) {
 935                                         LEAVE(ENETUNREACH);
 936                                 }
 937
 938                                 /*
 939                                  * Check the session is in the right state.
 940                                  * It needs to be in PPPOE_SOFFER
 941                                  * or PPPOE_NEWCONNECTED. If the latter,
 942                                  * then this is a retry by the client.
 943                                  * so be nice, and resend.
 944                                  */
 945                                 sp = sendhook->private;
 946                                 if (sp->state == PPPOE_NEWCONNECTED) {
 947                                         /*
 948                                          * Whoa! drop back to resend that
 949                                          * PADS packet.
 950                                          * We should still have a copy of it.
 951                                          */
 952                                         sp->state = PPPOE_SOFFER;
 953                                 }
 954                                 if (sp->state != PPPOE_SOFFER) {
 955                                         LEAVE (ENETUNREACH);
 956                                         break;
 957                                 }
 958                                 neg = sp->neg;
 959                                 untimeout(pppoe_ticker, sendhook,
 960                                     neg->timeout_handle);
 961                                 neg->pkt->pkt_header.ph.code = PADS_CODE;
 962                                 if (sp->Session_ID == 0)
 963                                         neg->pkt->pkt_header.ph.sid =
 964                                             htons(sp->Session_ID
 965                                                 = get_new_sid(node));
 966                                 neg->timeout = 0;
 967                                 /*
 968                                  * start working out the tags to respond with.
 969                                  */
 970                                 init_tags(sp);
 971                                 insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
 972                                 if ((tag = get_tag(ph, PTT_SRV_NAME)))
 973                                         insert_tag(sp, tag);/* return service */
 974                                 if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
 975                                         insert_tag(sp, tag); /* return it */
 976                                 insert_tag(sp, utag);   /* ac_cookie */
 977                                 scan_tags(sp, ph);
 978                                 make_packet(sp);
 979                                 sp->state = PPPOE_NEWCONNECTED;
 980                                 sendpacket(sp);
 981                                 /*
 982                                  * Having sent the last Negotiation header,
 983                                  * Set up the stored packet header to
 984                                  * be correct for the actual session.
 985                                  * But keep the negotialtion stuff
 986                                  * around in case we need to resend this last
 987                                  * packet. We'll discard it when we move
 988                                  * from NEWCONNECTED to CONNECTED
 989                                  */
 990                                 sp->pkt_hdr = neg->pkt->pkt_header;
 991                                 sp->pkt_hdr.eh.ether_type
 992                                                 = ETHERTYPE_PPPOE_SESS;
 993                                 sp->pkt_hdr.ph.code = 0;
 994                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
 995                                 break;
 996                         case    PADS_CODE:
 997                                 /*
 998                                  * We are a client:
 999                                  * Use the host_uniq tag to find the
1000                                  * hook this is in response to.
1001                                  * take the session ID and store it away.
1002                                  * Also make sure the pre-made header is
1003                                  * correct and set us into Session mode.
1004                                  */
1005                                 utag = get_tag(ph, PTT_HOST_UNIQ);
1006                                 if ((utag == NULL)
1007                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1008                                         LEAVE (ENETUNREACH);
1009                                         break;
1010                                 }
1011                                 sendhook = pppoe_finduniq(node, utag);
1012                                 if (sendhook == NULL) {
1013                                         LEAVE(ENETUNREACH);
1014                                 }
1015
1016                                 /*
1017                                  * Check the session is in the right state.
1018                                  * It needs to be in PPPOE_SREQ.
1019                                  */
1020                                 sp = sendhook->private;
1021                                 if (sp->state != PPPOE_SREQ) {
1022                                         LEAVE(ENETUNREACH);
1023                                 }
1024                                 neg = sp->neg;
1025                                 untimeout(pppoe_ticker, sendhook,
1026                                     neg->timeout_handle);
1027                                 neg->pkt->pkt_header.ph.sid = wh->ph.sid;
1028                                 sp->Session_ID = ntohs(wh->ph.sid);
1029                                 neg->timeout = 0;
1030                                 sp->state = PPPOE_CONNECTED;
1031                                 /*
1032                                  * Now we have gone to Connected mode,
1033                                  * Free all resources needed for
1034                                  * negotiation.
1035                                  * Keep a copy of the header we will be using.
1036                                  */
1037                                 sp->pkt_hdr = neg->pkt->pkt_header;
1038                                 sp->pkt_hdr.eh.ether_type
1039                                                 = ETHERTYPE_PPPOE_SESS;
1040                                 sp->pkt_hdr.ph.code = 0;
1041                                 m_freem(neg->m);
1042                                 FREE(sp->neg, M_NETGRAPH);
1043                                 sp->neg = NULL;
1044                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1045                                 break;
1046                         case    PADT_CODE:
1047                                 /*
1048                                  * Send a 'close' message to the controlling
1049                                  * process (the one that set us up);
1050                                  * And then tear everything down.
1051                                  *
1052                                  * Find matching peer/session combination.
1053                                  */
1054                                 sendhook = pppoe_findsession(node, wh);
1055                                 NG_FREE_DATA(m, meta); /* no longer needed */
1056                                 if (sendhook == NULL) {
1057                                         LEAVE(ENETUNREACH);
1058                                 }
1059                                 /* send message to creator */
1060                                 /* close hook */
1061                                 if (sendhook) {
1062                                         ng_destroy_hook(sendhook);
1063                                 }
1064                                 break;
1065                         default:
1066                                 LEAVE(EPFNOSUPPORT);
1067                         }
1068                         break;
1069                 case    ETHERTYPE_PPPOE_SESS:
1070                         /*
1071                          * find matching peer/session combination.
1072                          */
1073                         sendhook = pppoe_findsession(node, wh);
1074                         if (sendhook == NULL) {
1075                                 LEAVE (ENETUNREACH);
1076                                 break;
1077                         }
1078                         sp = sendhook->private;
1079                         m_adj(m, sizeof(*wh));
1080                         if (m->m_pkthdr.len < length) {
1081                                 /* Packet too short, dump it */
1082                                 LEAVE(EMSGSIZE);
1083                         }
1084
1085                         /* Also need to trim excess at the end */
1086                         if (m->m_pkthdr.len > length) {
1087                                 m_adj(m, -((int)(m->m_pkthdr.len - length)));
1088                         }
1089                         if ( sp->state != PPPOE_CONNECTED) {
1090                                 if (sp->state == PPPOE_NEWCONNECTED) {
1091                                         sp->state = PPPOE_CONNECTED;
1092                                         /*
1093                                          * Now we have gone to Connected mode,
1094                                          * Free all resources needed for
1095                                          * negotiation. Be paranoid about
1096                                          * whether there may be a timeout.
1097                                          */
1098                                         m_freem(sp->neg->m);
1099                                         untimeout(pppoe_ticker, sendhook,
1100                                                 sp->neg->timeout_handle);
1101                                         FREE(sp->neg, M_NETGRAPH);
1102                                         sp->neg = NULL;
1103                                 } else {
1104                                         LEAVE (ENETUNREACH);
1105                                         break;
1106                                 }
1107                         }
1108                         NG_SEND_DATA( error, sendhook, m, meta);
1109                         break;
1110                 default:
1111                         LEAVE(EPFNOSUPPORT);
1112                 }
1113         } else {
1114                 /*
1115                  *      Not ethernet or debug hook..
1116                  *
1117                  * The packet has come in on a normal hook.
1118                  * We need to find out what kind of hook,
1119                  * So we can decide how to handle it.
1120                  * Check the hook's state.
1121                  */
1122                 sp = hook->private;
1123                 switch (sp->state) {
1124                 case    PPPOE_NEWCONNECTED:
1125                 case    PPPOE_CONNECTED: {
1126                         struct pppoe_full_hdr *wh;
1127                         /*
1128                          * Bang in a pre-made header, and set the length up
1129                          * to be correct. Then send it to the ethernet driver.
1130                          * But first correct the length.
1131                          */
1132                         sp->pkt_hdr.ph.length = htons((short)(m->m_pkthdr.len));
1133                         M_PREPEND(m, sizeof(*wh), M_DONTWAIT);
1134                         if (m == NULL) {
1135                                 LEAVE(ENOBUFS);
1136                         }
1137                         wh = mtod(m, struct pppoe_full_hdr *);
1138                         bcopy(&sp->pkt_hdr, wh, sizeof(*wh));
1139                         NG_SEND_DATA( error, privp->ethernet_hook, m, meta);
1140                         privp->packets_out++;
1141                         break;
1142                         }
1143                 case    PPPOE_PRIMED:
1144                         /*
1145                          * A PADI packet is being returned by the application
1146                          * that has set up this hook. This indicates that it
1147                          * wants us to offer service.
1148                          */
1149                         neg = sp->neg;
1150                         if (m->m_len < sizeof(*wh)) {
1151                                 m = m_pullup(m, sizeof(*wh));
1152                                 if (m == NULL) {
1153                                         LEAVE(ENOBUFS);
1154                                 }
1155                         }
1156                         wh = mtod(m, struct pppoe_full_hdr *);
1157                         ph = &wh->ph;
1158                         session = ntohs(wh->ph.sid);
1159                         length = ntohs(wh->ph.length);
1160                         code = wh->ph.code;
1161                         if ( code != PADI_CODE) {
1162                                 LEAVE(EINVAL);
1163                         };
1164                         untimeout(pppoe_ticker, hook,
1165                                     neg->timeout_handle);
1166
1167                         /*
1168                          * This is the first time we hear
1169                          * from the client, so note it's
1170                          * unicast address, replacing the
1171                          * broadcast address.
1172                          */
1173                         bcopy(wh->eh.ether_shost,
1174                                 neg->pkt->pkt_header.eh.ether_dhost,
1175                                 ETHER_ADDR_LEN);
1176                         sp->state = PPPOE_SOFFER;
1177                         neg->timeout = 0;
1178                         neg->pkt->pkt_header.ph.code = PADO_CODE;
1179
1180                         /*
1181                          * start working out the tags to respond with.
1182                          */
1183                         uniqtag.hdr.tag_type = PTT_AC_COOKIE;
1184                         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(sp));
1185                         uniqtag.data.pointer = sp;
1186                         init_tags(sp);
1187                         insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1188                         if ((tag = get_tag(ph, PTT_SRV_NAME)))
1189                                 insert_tag(sp, tag);      /* return service */
1190                         if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1191                                 insert_tag(sp, tag); /* returned hostunique */
1192                         insert_tag(sp, &uniqtag.hdr);
1193                         /* XXX maybe put the tag in the session store */
1194                         scan_tags(sp, ph);
1195                         make_packet(sp);
1196                         sendpacket(sp);
1197                         break;
1198
1199                 /*
1200                  * Packets coming from the hook make no sense
1201                  * to sessions in these states. Throw them away.
1202                  */
1203                 case    PPPOE_SINIT:
1204                 case    PPPOE_SREQ:
1205                 case    PPPOE_SOFFER:
1206                 case    PPPOE_SNONE:
1207                 case    PPPOE_LISTENING:
1208                 case    PPPOE_DEAD:
1209                 default:
1210                         LEAVE(ENETUNREACH);
1211                 }
1212         }
1213 quit:
1214         NG_FREE_DATA(m, meta);
1215         return error;
1216 }
1217
1218 /*
1219  * Do local shutdown processing..
1220  * If we are a persistant device, we might refuse to go away, and
1221  * we'd only remove our links and reset ourself.
1222  */
1223 static int
1224 ng_pppoe_rmnode(node_p node)
1225 {
1226         const priv_p privdata = node->private;
1227
1228 AAA
1229         node->flags |= NG_INVALID;
1230         ng_cutlinks(node);
1231         ng_unname(node);
1232         node->private = NULL;
1233         ng_unref(privdata->node);
1234         FREE(privdata, M_NETGRAPH);
1235         return (0);
1236 }
1237
1238 /*
1239  * This is called once we've already connected a new hook to the other node.
1240  * It gives us a chance to balk at the last minute.
1241  */
1242 static int
1243 ng_pppoe_connect(hook_p hook)
1244 {
1245         /* be really amiable and just say "YUP that's OK by me! " */
1246         return (0);
1247 }
1248
1249 /*
1250  * Hook disconnection
1251  *
1252  * Clean up all dangling links and information about the session/hook.
1253  * For this type, removal of the last link destroys the node
1254  */
1255 static int
1256 ng_pppoe_disconnect(hook_p hook)
1257 {
1258         node_p node = hook->node;
1259         priv_p privp = node->private;
1260         sessp   sp;
1261         int     hooks;
1262
1263 AAA
1264         hooks = node->numhooks; /* this one already not counted */
1265         if (hook->private == &privp->debug_hook) {
1266                 privp->debug_hook = NULL;
1267         } else if (hook->private == &privp->ethernet_hook) {
1268                 privp->ethernet_hook = NULL;
1269                 ng_rmnode(node);
1270         } else {
1271                 sp = hook->private;
1272                 if (sp->state != PPPOE_SNONE ) {
1273                         pppoe_send_event(sp, NGM_PPPOE_CLOSE);
1274                 }
1275                 /*
1276                  * According to the spec, if we are connected,
1277                  * we should send a DISC packet if we are shutting down
1278                  * a session.
1279                  */
1280                 if ((privp->ethernet_hook)
1281                 && ((sp->state == PPPOE_CONNECTED)
1282                  || (sp->state == PPPOE_NEWCONNECTED))) {
1283                         struct mbuf *m;
1284                         struct pppoe_full_hdr *wh;
1285                         struct pppoe_tag *tag;
1286                         int     msglen = strlen(SIGNOFF);
1287                         void *dummy = NULL;
1288                         int error = 0;
1289
1290                         /* revert the stored header to DISC/PADT mode */
1291                         wh = &sp->pkt_hdr;
1292                         wh->ph.code = PADT_CODE;
1293                         wh->eh.ether_type = ETHERTYPE_PPPOE_DISC;
1294
1295                         /* generate a packet of that type */
1296                         MGETHDR(m, M_DONTWAIT, MT_DATA);
1297                         if(m == NULL)
1298                                 printf("pppoe: Session out of mbufs\n");
1299                         else {
1300                                 m->m_pkthdr.rcvif = NULL;
1301                                 m->m_pkthdr.len = m->m_len = sizeof(*wh);
1302                                 bcopy((caddr_t)wh, mtod(m, caddr_t),
1303                                     sizeof(*wh));
1304                                 /*
1305                                  * Add a General error message and adjust
1306                                  * sizes
1307                                  */
1308                                 wh = mtod(m, struct pppoe_full_hdr *);
1309                                 tag = wh->ph.tag;
1310                                 tag->tag_type = PTT_GEN_ERR;
1311                                 tag->tag_len = htons((u_int16_t)msglen);
1312                                 strncpy(tag->tag_data, SIGNOFF, msglen);
1313                                 m->m_pkthdr.len = (m->m_len += sizeof(*tag) +
1314                                     msglen);
1315                                 wh->ph.length = htons(sizeof(*tag) + msglen);
1316                                 NG_SEND_DATA(error, privp->ethernet_hook, m,
1317                                     dummy);
1318                         }
1319                 }
1320                 /*
1321                  * As long as we have somewhere to store teh timeout handle,
1322                  * we may have a timeout pending.. get rid of it.
1323                  */
1324                 if (sp->neg) {
1325                         untimeout(pppoe_ticker, hook, sp->neg->timeout_handle);
1326                         if (sp->neg->m)
1327                                 m_freem(sp->neg->m);
1328                         FREE(sp->neg, M_NETGRAPH);
1329                 }
1330                 FREE(sp, M_NETGRAPH);
1331                 hook->private = NULL;
1332                 /* work out how many session hooks there are */
1333                 /* Node goes away on last session hook removal */
1334                 if (privp->ethernet_hook) hooks -= 1;
1335                 if (privp->debug_hook) hooks -= 1;
1336         }
1337         if (node->numhooks == 0)
1338                 ng_rmnode(node);
1339         return (0);
1340 }
1341
1342 /*
1343  * timeouts come here.
1344  */
1345 static void
1346 pppoe_ticker(void *arg)
1347 {
1348         int s = splnet();
1349         hook_p hook = arg;
1350         sessp   sp = hook->private;
1351         negp    neg = sp->neg;
1352         int     error = 0;
1353         struct mbuf *m0 = NULL;
1354         priv_p privp = hook->node->private;
1355         meta_p dummy = NULL;
1356
1357 AAA
1358         switch(sp->state) {
1359                 /*
1360                  * resend the last packet, using an exponential backoff.
1361                  * After a period of time, stop growing the backoff,
1362                  * and either leave it, or revert to the start.
1363                  */
1364         case    PPPOE_SINIT:
1365         case    PPPOE_SREQ:
1366                 /* timeouts on these produce resends */
1367                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1368                 NG_SEND_DATA( error, privp->ethernet_hook, m0, dummy);
1369                 neg->timeout_handle = timeout(pppoe_ticker,
1370                                         hook, neg->timeout * hz);
1371                 if ((neg->timeout <<= 1) > PPPOE_TIMEOUT_LIMIT) {
1372                         if (sp->state == PPPOE_SREQ) {
1373                                 /* revert to SINIT mode */
1374                                 pppoe_start(sp);
1375                         } else {
1376                                 neg->timeout = PPPOE_TIMEOUT_LIMIT;
1377                         }
1378                 }
1379                 break;
1380         case    PPPOE_PRIMED:
1381         case    PPPOE_SOFFER:
1382                 /* a timeout on these says "give up" */
1383                 ng_destroy_hook(hook);
1384                 break;
1385         default:
1386                 /* timeouts have no meaning in other states */
1387                 printf("pppoe: unexpected timeout\n");
1388         }
1389         splx(s);
1390 }
1391
1392
1393 static void
1394 sendpacket(sessp sp)
1395 {
1396         int     error = 0;
1397         struct mbuf *m0 = NULL;
1398         hook_p hook = sp->hook;
1399         negp    neg = sp->neg;
1400         priv_p  privp = hook->node->private;
1401         meta_p dummy = NULL;
1402
1403 AAA
1404         switch(sp->state) {
1405         case    PPPOE_LISTENING:
1406         case    PPPOE_DEAD:
1407         case    PPPOE_SNONE:
1408         case    PPPOE_CONNECTED:
1409                 printf("pppoe: sendpacket: unexpected state\n");
1410                 break;
1411
1412         case    PPPOE_NEWCONNECTED:
1413                 /* send the PADS without a timeout - we're now connected */
1414                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1415                 NG_SEND_DATA( error, privp->ethernet_hook, m0, dummy);
1416                 break;
1417
1418         case    PPPOE_PRIMED:
1419                 /* No packet to send, but set up the timeout */
1420                 neg->timeout_handle = timeout(pppoe_ticker,
1421                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1422                 break;
1423
1424         case    PPPOE_SOFFER:
1425                 /*
1426                  * send the offer but if they don't respond
1427                  * in PPPOE_OFFER_TIMEOUT seconds, forget about it.
1428                  */
1429                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1430                 NG_SEND_DATA( error, privp->ethernet_hook, m0, dummy);
1431                 neg->timeout_handle = timeout(pppoe_ticker,
1432                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1433                 break;
1434
1435         case    PPPOE_SINIT:
1436         case    PPPOE_SREQ:
1437                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1438                 NG_SEND_DATA( error, privp->ethernet_hook, m0, dummy);
1439                 neg->timeout_handle = timeout(pppoe_ticker, hook,
1440                                         (hz * PPPOE_INITIAL_TIMEOUT));
1441                 neg->timeout = PPPOE_INITIAL_TIMEOUT * 2;
1442                 break;
1443
1444         default:
1445                 error = EINVAL;
1446                 printf("pppoe: timeout: bad state\n");
1447         }
1448         /* return (error); */
1449 }
1450
1451 /*
1452  * Parse an incoming packet to see if any tags should be copied to the
1453  * output packet. Don't do any tags that have been handled in the main
1454  * state machine.
1455  */
1456 static struct pppoe_tag*
1457 scan_tags(sessp sp, struct pppoe_hdr* ph)
1458 {
1459         char *end = (char *)next_tag(ph);
1460         char *ptn;
1461         struct pppoe_tag *pt = &ph->tag[0];
1462         /*
1463          * Keep processing tags while a tag header will still fit.
1464          */
1465 AAA
1466         while((char*)(pt + 1) <= end) {
1467                 /*
1468                  * If the tag data would go past the end of the packet, abort.
1469                  */
1470                 ptn = (((char *)(pt + 1)) + ntohs(pt->tag_len));
1471                 if(ptn > end)
1472                         return NULL;
1473
1474                 switch (pt->tag_type) {
1475                 case    PTT_RELAY_SID:
1476                         insert_tag(sp, pt);
1477                         break;
1478                 case    PTT_EOL:
1479                         return NULL;
1480                 case    PTT_SRV_NAME:
1481                 case    PTT_AC_NAME:
1482                 case    PTT_HOST_UNIQ:
1483                 case    PTT_AC_COOKIE:
1484                 case    PTT_VENDOR:
1485                 case    PTT_SRV_ERR:
1486                 case    PTT_SYS_ERR:
1487                 case    PTT_GEN_ERR:
1488                         break;
1489                 }
1490                 pt = (struct pppoe_tag*)ptn;
1491         }
1492         return NULL;
1493 }
1494
1495 static  int
1496 pppoe_send_event(sessp sp, enum cmd cmdid)
1497 {
1498         int error;
1499         struct ng_mesg *msg;
1500         struct ngpppoe_sts *sts;
1501
1502 AAA
1503         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, cmdid,
1504                         sizeof(struct ngpppoe_sts), M_NOWAIT);
1505         sts = (struct ngpppoe_sts *)msg->data;
1506         strncpy(sts->hook, sp->hook->name, NG_HOOKLEN + 1);
1507         error = ng_send_msg(sp->hook->node, msg, sp->creator, NULL);
1508         return (error);
1509 }