sys/netgraph/ng_pppoe.c

   1
   2 /*
   3  * ng_pppoe.c
   4  *
   5  * Copyright (c) 1996-1999 Whistle Communications, Inc.
   6  * All rights reserved.
   7  *
   8  * Subject to the following obligations and disclaimer of warranty, use and
   9  * redistribution of this software, in source or object code forms, with or
  10  * without modifications are expressly permitted by Whistle Communications;
  11  * provided, however, that:
  12  * 1. Any and all reproductions of the source or object code must include the
  13  *    copyright notice above and the following disclaimer of warranties; and
  14  * 2. No rights are granted, in any manner or form, to use Whistle
  15  *    Communications, Inc. trademarks, including the mark "WHISTLE
  16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
  17  *    such appears in the above copyright notice or in the software.
  18  *
  19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
  20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
  21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
  22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
  23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
  24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
  25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
  26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
  27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
  28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
  29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
  30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
  32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
  35  * OF SUCH DAMAGE.
  36  *
  37  * Author: Julian Elischer <julian@freebsd.org>
  38  *
  39  * $FreeBSD$
  40  * $Whistle: ng_pppoe.c,v 1.10 1999/11/01 09:24:52 julian Exp $
  41  */
  42 #if 0
  43 #define AAA printf("pppoe: %s\n", __func__ );
  44 #define BBB printf("-%d-", __LINE__ );
  45 #else
  46 #define AAA
  47 #define BBB
  48 #endif
  49
  50 #include <sys/param.h>
  51 #include <sys/systm.h>
  52 #include <sys/kernel.h>
  53 #include <sys/mbuf.h>
  54 #include <sys/malloc.h>
  55 #include <sys/errno.h>
  56 #include <sys/sysctl.h>
  57 #include <net/ethernet.h>
  58
  59 #include <netgraph/ng_message.h>
  60 #include <netgraph/netgraph.h>
  61 #include <netgraph/ng_parse.h>
  62 #include <netgraph/ng_pppoe.h>
  63
  64 #ifdef NG_SEPARATE_MALLOC
  65 MALLOC_DEFINE(M_NETGRAPH_PPPOE, "netgraph_pppoe", "netgraph pppoe node");
  66 #else
  67 #define M_NETGRAPH_PPPOE M_NETGRAPH
  68 #endif
  69
  70 #define SIGNOFF "session closed"
  71 #define OFFSETOF(s, e) ((char *)&((s *)0)->e - (char *)((s *)0))
  72
  73 /*
  74  * This section contains the netgraph method declarations for the
  75  * pppoe node. These methods define the netgraph pppoe 'type'.
  76  */
  77
  78 static ng_constructor_t ng_pppoe_constructor;
  79 static ng_rcvmsg_t      ng_pppoe_rcvmsg;
  80 static ng_shutdown_t    ng_pppoe_shutdown;
  81 static ng_newhook_t     ng_pppoe_newhook;
  82 static ng_connect_t     ng_pppoe_connect;
  83 static ng_rcvdata_t     ng_pppoe_rcvdata;
  84 static ng_disconnect_t  ng_pppoe_disconnect;
  85
  86 /* Parse type for struct ngpppoe_init_data */
  87 static const struct ng_parse_struct_field ngpppoe_init_data_type_fields[]
  88         = NG_PPPOE_INIT_DATA_TYPE_INFO;
  89 static const struct ng_parse_type ngpppoe_init_data_state_type = {
  90         &ng_parse_struct_type,
  91         &ngpppoe_init_data_type_fields
  92 };
  93
  94 /* Parse type for struct ngpppoe_sts */
  95 static const struct ng_parse_struct_field ng_pppoe_sts_type_fields[]
  96         = NG_PPPOE_STS_TYPE_INFO;
  97 static const struct ng_parse_type ng_pppoe_sts_state_type = {
  98         &ng_parse_struct_type,
  99         &ng_pppoe_sts_type_fields
 100 };
 101
 102 /* List of commands and how to convert arguments to/from ASCII */
 103 static const struct ng_cmdlist ng_pppoe_cmds[] = {
 104         {
 105           NGM_PPPOE_COOKIE,
 106           NGM_PPPOE_CONNECT,
 107           "pppoe_connect",
 108           &ngpppoe_init_data_state_type,
 109           NULL
 110         },
 111         {
 112           NGM_PPPOE_COOKIE,
 113           NGM_PPPOE_LISTEN,
 114           "pppoe_listen",
 115           &ngpppoe_init_data_state_type,
 116           NULL
 117         },
 118         {
 119           NGM_PPPOE_COOKIE,
 120           NGM_PPPOE_OFFER,
 121           "pppoe_offer",
 122           &ngpppoe_init_data_state_type,
 123           NULL
 124         },
 125         {
 126           NGM_PPPOE_COOKIE,
 127           NGM_PPPOE_SERVICE,
 128           "pppoe_service",
 129           &ngpppoe_init_data_state_type,
 130           NULL
 131         },
 132         {
 133           NGM_PPPOE_COOKIE,
 134           NGM_PPPOE_SUCCESS,
 135           "pppoe_success",
 136           &ng_pppoe_sts_state_type,
 137           NULL
 138         },
 139         {
 140           NGM_PPPOE_COOKIE,
 141           NGM_PPPOE_FAIL,
 142           "pppoe_fail",
 143           &ng_pppoe_sts_state_type,
 144           NULL
 145         },
 146         {
 147           NGM_PPPOE_COOKIE,
 148           NGM_PPPOE_CLOSE,
 149           "pppoe_close",
 150           &ng_pppoe_sts_state_type,
 151           NULL
 152         },
 153         { 0 }
 154 };
 155
 156 /* Netgraph node type descriptor */
 157 static struct ng_type typestruct = {
 158         NG_ABI_VERSION,
 159         NG_PPPOE_NODE_TYPE,
 160         NULL,
 161         ng_pppoe_constructor,
 162         ng_pppoe_rcvmsg,
 163         ng_pppoe_shutdown,
 164         ng_pppoe_newhook,
 165         NULL,
 166         ng_pppoe_connect,
 167         ng_pppoe_rcvdata,
 168         ng_pppoe_disconnect,
 169         ng_pppoe_cmds
 170 };
 171 NETGRAPH_INIT(pppoe, &typestruct);
 172 /* Depend on ng_ether so we can use the Ethernet parse type */
 173 MODULE_DEPEND(ng_pppoe, ng_ether, 1, 1, 1);
 174
 175 /*
 176  * States for the session state machine.
 177  * These have no meaning if there is no hook attached yet.
 178  */
 179 enum state {
 180     PPPOE_SNONE=0,      /* [both] Initial state */
 181     PPPOE_LISTENING,    /* [Daemon] Listening for discover initiation pkt */
 182     PPPOE_SINIT,        /* [Client] Sent discovery initiation */
 183     PPPOE_PRIMED,       /* [Server] Awaiting PADI from daemon */
 184     PPPOE_SOFFER,       /* [Server] Sent offer message  (got PADI)*/
 185     PPPOE_SREQ,         /* [Client] Sent a Request */
 186     PPPOE_NEWCONNECTED, /* [Server] Connection established, No data received */
 187     PPPOE_CONNECTED,    /* [Both] Connection established, Data received */
 188     PPPOE_DEAD          /* [Both] */
 189 };
 190
 191 #define NUMTAGS 20 /* number of tags we are set up to work with */
 192
 193 /*
 194  * Information we store for each hook on each node for negotiating the
 195  * session. The mbuf and cluster are freed once negotiation has completed.
 196  * The whole negotiation block is then discarded.
 197  */
 198
 199 struct sess_neg {
 200         struct mbuf             *m; /* holds cluster with last sent packet */
 201         union   packet          *pkt; /* points within the above cluster */
 202         struct callout_handle   timeout_handle;   /* see timeout(9) */
 203         u_int                   timeout; /* 0,1,2,4,8,16 etc. seconds */
 204         u_int                   numtags;
 205         const struct pppoe_tag  *tags[NUMTAGS];
 206         u_int                   service_len;
 207         u_int                   ac_name_len;
 208
 209         struct datatag          service;
 210         struct datatag          ac_name;
 211 };
 212 typedef struct sess_neg *negp;
 213
 214 /*
 215  * Session information that is needed after connection.
 216  */
 217 struct sess_con {
 218         hook_p                  hook;
 219         u_int16_t               Session_ID;
 220         enum state              state;
 221         ng_ID_t                 creator;                /* who to notify */
 222         struct pppoe_full_hdr   pkt_hdr;        /* used when connected */
 223         negp                    neg;            /* used when negotiating */
 224         /*struct sess_con       *hash_next;*/   /* not yet used */
 225 };
 226 typedef struct sess_con *sessp;
 227
 228 /*
 229  * Information we store for each node
 230  */
 231 struct PPPOE {
 232         node_p          node;           /* back pointer to node */
 233         hook_p          ethernet_hook;
 234         hook_p          debug_hook;
 235         u_int           packets_in;     /* packets in from ethernet */
 236         u_int           packets_out;    /* packets out towards ethernet */
 237         u_int32_t       flags;
 238         /*struct sess_con *buckets[HASH_SIZE];*/        /* not yet used */
 239 };
 240 typedef struct PPPOE *priv_p;
 241
 242 struct ether_header eh_prototype =
 243         {{0xff,0xff,0xff,0xff,0xff,0xff},
 244          {0x00,0x00,0x00,0x00,0x00,0x00},
 245          ETHERTYPE_PPPOE_DISC};
 246
 247 static int nonstandard;
 248 static int
 249 ngpppoe_set_ethertype(SYSCTL_HANDLER_ARGS)
 250 {
 251         int error;
 252         int val;
 253
 254         val = nonstandard;
 255         error = sysctl_handle_int(oidp, &val, sizeof(int), req);
 256         if (error != 0 || req->newptr == NULL)
 257                 return (error);
 258         if (val == 1) {
 259                 nonstandard = 1;
 260                 eh_prototype.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
 261         } else {
 262                 nonstandard = 0;
 263                 eh_prototype.ether_type = ETHERTYPE_PPPOE_DISC;
 264         }
 265         return (0);
 266 }
 267
 268 SYSCTL_PROC(_net_graph, OID_AUTO, nonstandard_pppoe, CTLTYPE_INT | CTLFLAG_RW,
 269     0, sizeof(int), ngpppoe_set_ethertype, "I", "select normal or stupid ISP");
 270
 271 union uniq {
 272         char bytes[sizeof(void *)];
 273         void * pointer;
 274         };
 275
 276 #define LEAVE(x) do { error = x; goto quit; } while(0)
 277 static void     pppoe_start(sessp sp);
 278 static void     sendpacket(sessp sp);
 279 static void     pppoe_ticker(void *arg);
 280 static const    struct pppoe_tag *scan_tags(sessp sp,
 281                         const struct pppoe_hdr* ph);
 282 static  int     pppoe_send_event(sessp sp, enum cmd cmdid);
 283
 284 /*************************************************************************
 285  * Some basic utilities  from the Linux version with author's permission.*
 286  * Author:      Michal Ostrowski <mostrows@styx.uwaterloo.ca>            *
 287  ************************************************************************/
 288
 289 /*
 290  * Generate a new session id
 291  * XXX find out the FreeBSD locking scheme.
 292  */
 293 static u_int16_t
 294 get_new_sid(node_p node)
 295 {
 296         static int pppoe_sid = 10;
 297         sessp sp;
 298         hook_p  hook;
 299         u_int16_t val;
 300         priv_p privp = NG_NODE_PRIVATE(node);
 301
 302 AAA
 303 restart:
 304         val = pppoe_sid++;
 305         /*
 306          * Spec says 0xFFFF is reserved.
 307          * Also don't use 0x0000
 308          */
 309         if (val == 0xffff) {
 310                 pppoe_sid = 20;
 311                 goto restart;
 312         }
 313
 314         /* Check it isn't already in use */
 315         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 316                 /* don't check special hooks */
 317                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 318                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 319                         continue;
 320                 sp = NG_HOOK_PRIVATE(hook);
 321                 if (sp->Session_ID == val)
 322                         goto restart;
 323         }
 324
 325         return val;
 326 }
 327
 328
 329 /*
 330  * Return the location where the next tag can be put
 331  */
 332 static __inline const struct pppoe_tag*
 333 next_tag(const struct pppoe_hdr* ph)
 334 {
 335         return (const struct pppoe_tag*)(((const char*)&ph->tag[0])
 336             + ntohs(ph->length));
 337 }
 338
 339 /*
 340  * Look for a tag of a specific type
 341  * Don't trust any length the other end says.
 342  * but assume we already sanity checked ph->length.
 343  */
 344 static const struct pppoe_tag*
 345 get_tag(const struct pppoe_hdr* ph, u_int16_t idx)
 346 {
 347         const char *const end = (const char *)next_tag(ph);
 348         const char *ptn;
 349         const struct pppoe_tag *pt = &ph->tag[0];
 350         /*
 351          * Keep processing tags while a tag header will still fit.
 352          */
 353 AAA
 354         while((const char*)(pt + 1) <= end) {
 355             /*
 356              * If the tag data would go past the end of the packet, abort.
 357              */
 358             ptn = (((const char *)(pt + 1)) + ntohs(pt->tag_len));
 359             if(ptn > end)
 360                 return NULL;
 361
 362             if(pt->tag_type == idx)
 363                 return pt;
 364
 365             pt = (const struct pppoe_tag*)ptn;
 366         }
 367         return NULL;
 368 }
 369
 370 /**************************************************************************
 371  * inlines to initialise or add tags to a session's tag list,
 372  **************************************************************************/
 373 /*
 374  * Initialise the session's tag list
 375  */
 376 static void
 377 init_tags(sessp sp)
 378 {
 379 AAA
 380         if(sp->neg == NULL) {
 381                 printf("pppoe: asked to init NULL neg pointer\n");
 382                 return;
 383         }
 384         sp->neg->numtags = 0;
 385 }
 386
 387 static void
 388 insert_tag(sessp sp, const struct pppoe_tag *tp)
 389 {
 390         int     i;
 391         negp neg;
 392
 393 AAA
 394         if((neg = sp->neg) == NULL) {
 395                 printf("pppoe: asked to use NULL neg pointer\n");
 396                 return;
 397         }
 398         if ((i = neg->numtags++) < NUMTAGS) {
 399                 neg->tags[i] = tp;
 400         } else {
 401                 printf("pppoe: asked to add too many tags to packet\n");
 402                 neg->numtags--;
 403         }
 404 }
 405
 406 /*
 407  * Make up a packet, using the tags filled out for the session.
 408  *
 409  * Assume that the actual pppoe header and ethernet header
 410  * are filled out externally to this routine.
 411  * Also assume that neg->wh points to the correct
 412  * location at the front of the buffer space.
 413  */
 414 static void
 415 make_packet(sessp sp) {
 416         struct pppoe_full_hdr *wh = &sp->neg->pkt->pkt_header;
 417         const struct pppoe_tag **tag;
 418         char *dp;
 419         int count;
 420         int tlen;
 421         u_int16_t length = 0;
 422
 423 AAA
 424         if ((sp->neg == NULL) || (sp->neg->m == NULL)) {
 425                 printf("pppoe: make_packet called from wrong state\n");
 426         }
 427         dp = (char *)wh->ph.tag;
 428         for (count = 0, tag = sp->neg->tags;
 429             ((count < sp->neg->numtags) && (count < NUMTAGS));
 430             tag++, count++) {
 431                 tlen = ntohs((*tag)->tag_len) + sizeof(**tag);
 432                 if ((length + tlen) > (ETHER_MAX_LEN - 4 - sizeof(*wh))) {
 433                         printf("pppoe: tags too long\n");
 434                         sp->neg->numtags = count;
 435                         break;  /* XXX chop off what's too long */
 436                 }
 437                 bcopy(*tag, (char *)dp, tlen);
 438                 length += tlen;
 439                 dp += tlen;
 440         }
 441         wh->ph.length = htons(length);
 442         sp->neg->m->m_len = length + sizeof(*wh);
 443         sp->neg->m->m_pkthdr.len = length + sizeof(*wh);
 444 }
 445
 446 /**************************************************************************
 447  * Routine to match a service offered                                     *
 448  **************************************************************************/
 449 /*
 450  * Find a hook that has a service string that matches that
 451  * we are seeking. for now use a simple string.
 452  * In the future we may need something like regexp().
 453  * for testing allow a null string to match 1st found and a null service
 454  * to match all requests. Also make '*' do the same.
 455  */
 456
 457 #define NG_MATCH_EXACT  1
 458 #define NG_MATCH_ANY    2
 459
 460 static hook_p
 461 pppoe_match_svc(node_p node, const char *svc_name, int svc_len, int match)
 462 {
 463         sessp   sp      = NULL;
 464         negp    neg     = NULL;
 465         priv_p  privp   = NG_NODE_PRIVATE(node);
 466         hook_p  allhook = NULL;
 467         hook_p  hook;
 468
 469 AAA
 470         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 471
 472                 /* skip any hook that is debug or ethernet */
 473                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 474                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 475                         continue;
 476                 sp = NG_HOOK_PRIVATE(hook);
 477
 478                 /* Skip any sessions which are not in LISTEN mode. */
 479                 if ( sp->state != PPPOE_LISTENING)
 480                         continue;
 481
 482                 neg = sp->neg;
 483
 484                 /* Special case for a blank or "*" service name (wildcard) */
 485                 if (match == NG_MATCH_ANY && neg->service_len == 1 &&
 486                     neg->service.data[0] == '*') {
 487                         allhook = hook;
 488                         continue;
 489                 }
 490
 491                 /* If the lengths don't match, that aint it. */
 492                 if (neg->service_len != svc_len)
 493                         continue;
 494
 495                 /* An exact match? */
 496                 if (svc_len == 0)
 497                         break;
 498
 499                 if (strncmp(svc_name, neg->service.data, svc_len) == 0)
 500                         break;
 501         }
 502         return (hook ? hook : allhook);
 503 }
 504 /**************************************************************************
 505  * Routine to find a particular session that matches an incoming packet   *
 506  **************************************************************************/
 507 static hook_p
 508 pppoe_findsession(node_p node, const struct pppoe_full_hdr *wh)
 509 {
 510         sessp   sp = NULL;
 511         hook_p hook = NULL;
 512         priv_p  privp = NG_NODE_PRIVATE(node);
 513         u_int16_t       session = ntohs(wh->ph.sid);
 514
 515         /*
 516          * find matching peer/session combination.
 517          */
 518 AAA
 519         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 520                 /* don't check special hooks */
 521                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 522                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook)) {
 523                         continue;
 524                 }
 525                 sp = NG_HOOK_PRIVATE(hook);
 526                 if ( ( (sp->state == PPPOE_CONNECTED)
 527                     || (sp->state == PPPOE_NEWCONNECTED) )
 528                 && (sp->Session_ID == session)
 529                 && (bcmp(sp->pkt_hdr.eh.ether_dhost,
 530                     wh->eh.ether_shost,
 531                     ETHER_ADDR_LEN)) == 0) {
 532                         break;
 533                 }
 534         }
 535         return (hook);
 536 }
 537
 538 static hook_p
 539 pppoe_finduniq(node_p node, const struct pppoe_tag *tag)
 540 {
 541         hook_p hook = NULL;
 542         priv_p  privp = NG_NODE_PRIVATE(node);
 543         union uniq              uniq;
 544
 545 AAA
 546         bcopy(tag->tag_data, uniq.bytes, sizeof(void *));
 547         /* cycle through all known hooks */
 548         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 549                 /* don't check special hooks */
 550                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 551                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 552                         continue;
 553                 if (uniq.pointer == NG_HOOK_PRIVATE(hook))
 554                         break;
 555         }
 556         return (hook);
 557 }
 558
 559 /**************************************************************************
 560  * start of Netgraph entrypoints                                          *
 561  **************************************************************************/
 562
 563 /*
 564  * Allocate the private data structure and the generic node
 565  * and link them together.
 566  *
 567  * ng_make_node_common() returns with a generic node struct
 568  * with a single reference for us.. we transfer it to the
 569  * private structure.. when we free the private struct we must
 570  * unref the node so it gets freed too.
 571  */
 572 static int
 573 ng_pppoe_constructor(node_p node)
 574 {
 575         priv_p privdata;
 576
 577 AAA
 578         /* Initialize private descriptor */
 579         MALLOC(privdata, priv_p, sizeof(*privdata), M_NETGRAPH_PPPOE,
 580             M_NOWAIT | M_ZERO);
 581         if (privdata == NULL)
 582                 return (ENOMEM);
 583
 584         /* Link structs together; this counts as our one reference to *nodep */
 585         NG_NODE_SET_PRIVATE(node, privdata);
 586         privdata->node = node;
 587         return (0);
 588 }
 589
 590 /*
 591  * Give our ok for a hook to be added...
 592  * point the hook's private info to the hook structure.
 593  *
 594  * The following hook names are special:
 595  *  Ethernet:  the hook that should be connected to a NIC.
 596  *  debug:      copies of data sent out here  (when I write the code).
 597  * All other hook names need only be unique. (the framework checks this).
 598  */
 599 static int
 600 ng_pppoe_newhook(node_p node, hook_p hook, const char *name)
 601 {
 602         const priv_p privp = NG_NODE_PRIVATE(node);
 603         sessp sp;
 604
 605 AAA
 606         if (strcmp(name, NG_PPPOE_HOOK_ETHERNET) == 0) {
 607                 privp->ethernet_hook = hook;
 608                 NG_HOOK_SET_PRIVATE(hook, &privp->ethernet_hook);
 609         } else if (strcmp(name, NG_PPPOE_HOOK_DEBUG) == 0) {
 610                 privp->debug_hook = hook;
 611                 NG_HOOK_SET_PRIVATE(hook, &privp->debug_hook);
 612         } else {
 613                 /*
 614                  * Any other unique name is OK.
 615                  * The infrastructure has already checked that it's unique,
 616                  * so just allocate it and hook it in.
 617                  */
 618                 MALLOC(sp, sessp, sizeof(*sp), M_NETGRAPH_PPPOE, M_NOWAIT | M_ZERO);
 619                 if (sp == NULL) {
 620                                 return (ENOMEM);
 621                 }
 622
 623                 NG_HOOK_SET_PRIVATE(hook, sp);
 624                 sp->hook = hook;
 625         }
 626         return(0);
 627 }
 628
 629 /*
 630  * Get a netgraph control message.
 631  * Check it is one we understand. If needed, send a response.
 632  * We sometimes save the address for an async action later.
 633  * Always free the message.
 634  */
 635 static int
 636 ng_pppoe_rcvmsg(node_p node, item_p item, hook_p lasthook)
 637 {
 638         priv_p privp = NG_NODE_PRIVATE(node);
 639         struct ngpppoe_init_data *ourmsg = NULL;
 640         struct ng_mesg *resp = NULL;
 641         int error = 0;
 642         hook_p hook = NULL;
 643         sessp sp = NULL;
 644         negp neg = NULL;
 645         struct ng_mesg *msg;
 646
 647 AAA
 648         NGI_GET_MSG(item, msg);
 649         /* Deal with message according to cookie and command */
 650         switch (msg->header.typecookie) {
 651         case NGM_PPPOE_COOKIE:
 652                 switch (msg->header.cmd) {
 653                 case NGM_PPPOE_CONNECT:
 654                 case NGM_PPPOE_LISTEN:
 655                 case NGM_PPPOE_OFFER:
 656                 case NGM_PPPOE_SERVICE:
 657                         ourmsg = (struct ngpppoe_init_data *)msg->data;
 658                         if (msg->header.arglen < sizeof(*ourmsg)) {
 659                                 printf("pppoe: init data too small\n");
 660                                 LEAVE(EMSGSIZE);
 661                         }
 662                         if (msg->header.arglen - sizeof(*ourmsg) >
 663                             PPPOE_SERVICE_NAME_SIZE) {
 664                                 printf("pppoe_rcvmsg: service name too big");
 665                                 LEAVE(EMSGSIZE);
 666                         }
 667                         if (msg->header.arglen - sizeof(*ourmsg) <
 668                             ourmsg->data_len) {
 669                                 printf("pppoe: init data has bad length,"
 670                                     " %d should be %d\n", ourmsg->data_len,
 671                                     msg->header.arglen - sizeof (*ourmsg));
 672                                 LEAVE(EMSGSIZE);
 673                         }
 674
 675                         /* make sure strcmp will terminate safely */
 676                         ourmsg->hook[sizeof(ourmsg->hook) - 1] = '\0';
 677
 678                         /* cycle through all known hooks */
 679                         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 680                                 if (NG_HOOK_NAME(hook)
 681                                 && strcmp(NG_HOOK_NAME(hook), ourmsg->hook) == 0)
 682                                         break;
 683                         }
 684                         if (hook == NULL) {
 685                                 LEAVE(ENOENT);
 686                         }
 687                         if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 688                         ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook)) {
 689                                 LEAVE(EINVAL);
 690                         }
 691                         sp = NG_HOOK_PRIVATE(hook);
 692
 693                         if (msg->header.cmd == NGM_PPPOE_LISTEN) {
 694                                 /*
 695                                  * Ensure we aren't already listening for this
 696                                  * service.
 697                                  */
 698                                 if (pppoe_match_svc(node, ourmsg->data,
 699                                     ourmsg->data_len, NG_MATCH_EXACT) != NULL) {
 700                                         LEAVE(EEXIST);
 701                                 }
 702                         }
 703
 704                         /*
 705                          * PPPOE_SERVICE advertisments are set up
 706                          * on sessions that are in PRIMED state.
 707                          */
 708                         if (msg->header.cmd == NGM_PPPOE_SERVICE) {
 709                                 break;
 710                         }
 711                         if (sp->state |= PPPOE_SNONE) {
 712                                 printf("pppoe: Session already active\n");
 713                                 LEAVE(EISCONN);
 714                         }
 715
 716                         /*
 717                          * set up prototype header
 718                          */
 719                         MALLOC(neg, negp, sizeof(*neg), M_NETGRAPH_PPPOE,
 720                             M_NOWAIT | M_ZERO);
 721
 722                         if (neg == NULL) {
 723                                 printf("pppoe: Session out of memory\n");
 724                                 LEAVE(ENOMEM);
 725                         }
 726                         MGETHDR(neg->m, M_DONTWAIT, MT_DATA);
 727                         if(neg->m == NULL) {
 728                                 printf("pppoe: Session out of mbufs\n");
 729                                 FREE(neg, M_NETGRAPH_PPPOE);
 730                                 LEAVE(ENOBUFS);
 731                         }
 732                         neg->m->m_pkthdr.rcvif = NULL;
 733                         MCLGET(neg->m, M_DONTWAIT);
 734                         if ((neg->m->m_flags & M_EXT) == 0) {
 735                                 printf("pppoe: Session out of mcls\n");
 736                                 m_freem(neg->m);
 737                                 FREE(neg, M_NETGRAPH_PPPOE);
 738                                 LEAVE(ENOBUFS);
 739                         }
 740                         sp->neg = neg;
 741                         callout_handle_init( &neg->timeout_handle);
 742                         neg->m->m_len = sizeof(struct pppoe_full_hdr);
 743                         neg->pkt = mtod(neg->m, union packet*);
 744                         neg->pkt->pkt_header.eh = eh_prototype;
 745                         neg->pkt->pkt_header.ph.ver = 0x1;
 746                         neg->pkt->pkt_header.ph.type = 0x1;
 747                         neg->pkt->pkt_header.ph.sid = 0x0000;
 748                         neg->timeout = 0;
 749
 750                         sp->creator = NGI_RETADDR(item);
 751                 }
 752                 switch (msg->header.cmd) {
 753                 case NGM_PPPOE_GET_STATUS:
 754                     {
 755                         struct ngpppoestat *stats;
 756
 757                         NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
 758                         if (!resp) {
 759                                 LEAVE(ENOMEM);
 760                         }
 761                         stats = (struct ngpppoestat *) resp->data;
 762                         stats->packets_in = privp->packets_in;
 763                         stats->packets_out = privp->packets_out;
 764                         break;
 765                     }
 766                 case NGM_PPPOE_CONNECT:
 767                         /*
 768                          * Check the hook exists and is Uninitialised.
 769                          * Send a PADI request, and start the timeout logic.
 770                          * Store the originator of this message so we can send
 771                          * a success of fail message to them later.
 772                          * Move the session to SINIT
 773                          * Set up the session to the correct state and
 774                          * start it.
 775                          */
 776                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 777                         neg->service.hdr.tag_len =
 778                             htons((u_int16_t)ourmsg->data_len);
 779                         if (ourmsg->data_len)
 780                                 bcopy(ourmsg->data, neg->service.data,
 781                                     ourmsg->data_len);
 782                         neg->service_len = ourmsg->data_len;
 783                         pppoe_start(sp);
 784                         break;
 785                 case NGM_PPPOE_LISTEN:
 786                         /*
 787                          * Check the hook exists and is Uninitialised.
 788                          * Install the service matching string.
 789                          * Store the originator of this message so we can send
 790                          * a success of fail message to them later.
 791                          * Move the hook to 'LISTENING'
 792                          */
 793                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 794                         neg->service.hdr.tag_len =
 795                             htons((u_int16_t)ourmsg->data_len);
 796
 797                         if (ourmsg->data_len)
 798                                 bcopy(ourmsg->data, neg->service.data,
 799                                     ourmsg->data_len);
 800                         neg->service_len = ourmsg->data_len;
 801                         neg->pkt->pkt_header.ph.code = PADT_CODE;
 802                         /*
 803                          * wait for PADI packet coming from ethernet
 804                          */
 805                         sp->state = PPPOE_LISTENING;
 806                         break;
 807                 case NGM_PPPOE_OFFER:
 808                         /*
 809                          * Check the hook exists and is Uninitialised.
 810                          * Store the originator of this message so we can send
 811                          * a success of fail message to them later.
 812                          * Store the AC-Name given and go to PRIMED.
 813                          */
 814                         neg->ac_name.hdr.tag_type = PTT_AC_NAME;
 815                         neg->ac_name.hdr.tag_len =
 816                             htons((u_int16_t)ourmsg->data_len);
 817                         if (ourmsg->data_len)
 818                                 bcopy(ourmsg->data, neg->ac_name.data,
 819                                     ourmsg->data_len);
 820                         neg->ac_name_len = ourmsg->data_len;
 821                         neg->pkt->pkt_header.ph.code = PADO_CODE;
 822                         /*
 823                          * Wait for PADI packet coming from hook
 824                          */
 825                         sp->state = PPPOE_PRIMED;
 826                         break;
 827                 case NGM_PPPOE_SERVICE:
 828                         /*
 829                          * Check the session is primed.
 830                          * for now just allow ONE service to be advertised.
 831                          * If you do it twice you just overwrite.
 832                          */
 833                         if (sp->state != PPPOE_PRIMED) {
 834                                 printf("pppoe: Session not primed\n");
 835                                 LEAVE(EISCONN);
 836                         }
 837                         neg = sp->neg;
 838                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 839                         neg->service.hdr.tag_len =
 840                             htons((u_int16_t)ourmsg->data_len);
 841
 842                         if (ourmsg->data_len)
 843                                 bcopy(ourmsg->data, neg->service.data,
 844                                     ourmsg->data_len);
 845                         neg->service_len = ourmsg->data_len;
 846                         break;
 847                 default:
 848                         LEAVE(EINVAL);
 849                 }
 850                 break;
 851         default:
 852                 LEAVE(EINVAL);
 853         }
 854
 855         /* Take care of synchronous response, if any */
 856 quit:
 857         NG_RESPOND_MSG(error, node, item, resp);
 858         /* Free the message and return */
 859         NG_FREE_MSG(msg);
 860         return(error);
 861 }
 862
 863 /*
 864  * Start a client into the first state. A separate function because
 865  * it can be needed if the negotiation times out.
 866  */
 867 static void
 868 pppoe_start(sessp sp)
 869 {
 870         struct {
 871                 struct pppoe_tag hdr;
 872                 union   uniq    data;
 873         } __attribute ((packed)) uniqtag;
 874
 875         /*
 876          * kick the state machine into starting up
 877          */
 878 AAA
 879         sp->state = PPPOE_SINIT;
 880         /* reset the packet header to broadcast */
 881         sp->neg->pkt->pkt_header.eh = eh_prototype;
 882         sp->neg->pkt->pkt_header.ph.code = PADI_CODE;
 883         uniqtag.hdr.tag_type = PTT_HOST_UNIQ;
 884         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(uniqtag.data));
 885         uniqtag.data.pointer = sp;
 886         init_tags(sp);
 887         insert_tag(sp, &uniqtag.hdr);
 888         insert_tag(sp, &sp->neg->service.hdr);
 889         make_packet(sp);
 890         sendpacket(sp);
 891 }
 892
 893 static int
 894 send_acname(sessp sp, const struct pppoe_tag *tag)
 895 {
 896         int error;
 897         struct ng_mesg *msg;
 898         struct ngpppoe_sts *sts;
 899
 900         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_ACNAME,
 901             sizeof(struct ngpppoe_sts), M_NOWAIT);
 902         if (msg == NULL)
 903                 return (ENOMEM);
 904
 905         sts = (struct ngpppoe_sts *)msg->data;
 906         strncpy(sts->hook, tag->tag_data,
 907             min(NG_HOOKLEN + 1, ntohs(tag->tag_len)));
 908         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
 909
 910         return (error);
 911 }
 912
 913 static int
 914 send_sessionid(sessp sp)
 915 {
 916         int error;
 917         struct ng_mesg *msg;
 918
 919         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_SESSIONID,
 920             sizeof(u_int16_t), M_NOWAIT);
 921         if (msg == NULL)
 922                 return (ENOMEM);
 923
 924         *(u_int16_t *)msg->data = sp->Session_ID;
 925         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
 926
 927         return (error);
 928 }
 929
 930 /*
 931  * Receive data, and do something with it.
 932  * The caller will never free m or meta, so
 933  * if we use up this data or abort we must free BOTH of these.
 934  */
 935 static int
 936 ng_pppoe_rcvdata(hook_p hook, item_p item)
 937 {
 938         node_p                  node = NG_HOOK_NODE(hook);
 939         const priv_p            privp = NG_NODE_PRIVATE(node);
 940         sessp                   sp = NG_HOOK_PRIVATE(hook);
 941         const struct pppoe_full_hdr *wh;
 942         const struct pppoe_hdr  *ph;
 943         int                     error = 0;
 944         u_int16_t               session;
 945         u_int16_t               length;
 946         u_int8_t                code;
 947         const struct pppoe_tag  *utag = NULL, *tag = NULL;
 948         hook_p                  sendhook;
 949         struct {
 950                 struct pppoe_tag hdr;
 951                 union   uniq    data;
 952         } __attribute ((packed)) uniqtag;
 953         negp                    neg = NULL;
 954         struct mbuf             *m;
 955
 956 AAA
 957         NGI_GET_M(item, m);
 958         if (NG_HOOK_PRIVATE(hook) == &privp->debug_hook) {
 959                 /*
 960                  * Data from the debug hook gets sent without modification
 961                  * straight to the ethernet.
 962                  */
 963                 NG_FWD_ITEM_HOOK( error, item, privp->ethernet_hook);
 964                 privp->packets_out++;
 965         } else if (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook) {
 966                 /*
 967                  * Incoming data.
 968                  * Dig out various fields from the packet.
 969                  * use them to decide where to send it.
 970                  */
 971
 972                 privp->packets_in++;
 973                 if( m->m_len < sizeof(*wh)) {
 974                         m = m_pullup(m, sizeof(*wh)); /* Checks length */
 975                         if (m == NULL) {
 976                                 printf("couldn't m_pullup\n");
 977                                 LEAVE(ENOBUFS);
 978                         }
 979                 }
 980                 wh = mtod(m, struct pppoe_full_hdr *);
 981                 length = ntohs(wh->ph.length);
 982                 switch(wh->eh.ether_type) {
 983                 case    ETHERTYPE_PPPOE_STUPID_DISC:
 984                         nonstandard = 1;
 985                         eh_prototype.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
 986                         /* fall through */
 987                 case    ETHERTYPE_PPPOE_DISC:
 988                         /*
 989                          * We need to try to make sure that the tag area
 990                          * is contiguous, or we could wander off the end
 991                          * of a buffer and make a mess.
 992                          * (Linux wouldn't have this problem).
 993                          */
 994                         if (m->m_pkthdr.len <= MHLEN) {
 995                                 if( m->m_len < m->m_pkthdr.len) {
 996                                         m = m_pullup(m, m->m_pkthdr.len);
 997                                         if (m == NULL) {
 998                                                 printf("couldn't m_pullup\n");
 999                                                 LEAVE(ENOBUFS);
1000                                         }
1001                                 }
1002                         }
1003                         if (m->m_len != m->m_pkthdr.len) {
1004                                 /*
1005                                  * It's not all in one piece.
1006                                  * We need to do extra work.
1007                                  * Put it into a cluster.
1008                                  */
1009                                 struct mbuf *n;
1010                                 n = m_dup(m, M_DONTWAIT);
1011                                 m_freem(m);
1012                                 m = n;
1013                                 if (m) {
1014                                         /* just check we got a cluster */
1015                                         if (m->m_len != m->m_pkthdr.len) {
1016                                                 m_freem(m);
1017                                                 m = NULL;
1018                                         }
1019                                 }
1020                                 if (m == NULL) {
1021                                         printf("packet fragmented\n");
1022                                         LEAVE(EMSGSIZE);
1023                                 }
1024                         }
1025                         wh = mtod(m, struct pppoe_full_hdr *);
1026                         length = ntohs(wh->ph.length);
1027                         ph = &wh->ph;
1028                         session = ntohs(wh->ph.sid);
1029                         code = wh->ph.code;
1030
1031                         switch(code) {
1032                         case    PADI_CODE:
1033                                 /*
1034                                  * We are a server:
1035                                  * Look for a hook with the required service
1036                                  * and send the ENTIRE packet up there.
1037                                  * It should come back to a new hook in
1038                                  * PRIMED state. Look there for further
1039                                  * processing.
1040                                  */
1041                                 tag = get_tag(ph, PTT_SRV_NAME);
1042                                 if (tag == NULL) {
1043                                         printf("no service tag\n");
1044                                         LEAVE(ENETUNREACH);
1045                                 }
1046                                 sendhook = pppoe_match_svc(NG_HOOK_NODE(hook),
1047                                         tag->tag_data, ntohs(tag->tag_len),
1048                                         NG_MATCH_ANY);
1049                                 if (sendhook) {
1050                                         NG_FWD_NEW_DATA(error, item,
1051                                                                 sendhook, m);
1052                                 } else {
1053                                         LEAVE(ENETUNREACH);
1054                                 }
1055                                 break;
1056                         case    PADO_CODE:
1057                                 /*
1058                                  * We are a client:
1059                                  * Use the host_uniq tag to find the
1060                                  * hook this is in response to.
1061                                  * Received #2, now send #3
1062                                  * For now simply accept the first we receive.
1063                                  */
1064                                 utag = get_tag(ph, PTT_HOST_UNIQ);
1065                                 if ((utag == NULL)
1066                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1067                                         printf("no host unique field\n");
1068                                         LEAVE(ENETUNREACH);
1069                                 }
1070
1071                                 sendhook = pppoe_finduniq(node, utag);
1072                                 if (sendhook == NULL) {
1073                                         printf("no matching session\n");
1074                                         LEAVE(ENETUNREACH);
1075                                 }
1076
1077                                 /*
1078                                  * Check the session is in the right state.
1079                                  * It needs to be in PPPOE_SINIT.
1080                                  */
1081                                 sp = NG_HOOK_PRIVATE(sendhook);
1082                                 if (sp->state != PPPOE_SINIT) {
1083                                         printf("session in wrong state\n");
1084                                         LEAVE(ENETUNREACH);
1085                                 }
1086                                 neg = sp->neg;
1087                                 untimeout(pppoe_ticker, sendhook,
1088                                     neg->timeout_handle);
1089
1090                                 /*
1091                                  * This is the first time we hear
1092                                  * from the server, so note it's
1093                                  * unicast address, replacing the
1094                                  * broadcast address .
1095                                  */
1096                                 bcopy(wh->eh.ether_shost,
1097                                         neg->pkt->pkt_header.eh.ether_dhost,
1098                                         ETHER_ADDR_LEN);
1099                                 neg->timeout = 0;
1100                                 neg->pkt->pkt_header.ph.code = PADR_CODE;
1101                                 init_tags(sp);
1102                                 insert_tag(sp, utag);      /* Host Unique */
1103                                 if ((tag = get_tag(ph, PTT_AC_COOKIE)))
1104                                         insert_tag(sp, tag); /* return cookie */
1105                                 if ((tag = get_tag(ph, PTT_AC_NAME))) {
1106                                         insert_tag(sp, tag); /* return it */
1107                                         send_acname(sp, tag);
1108                                 }
1109                                 insert_tag(sp, &neg->service.hdr); /* Service */
1110                                 scan_tags(sp, ph);
1111                                 make_packet(sp);
1112                                 sp->state = PPPOE_SREQ;
1113                                 sendpacket(sp);
1114                                 break;
1115                         case    PADR_CODE:
1116
1117                                 /*
1118                                  * We are a server:
1119                                  * Use the ac_cookie tag to find the
1120                                  * hook this is in response to.
1121                                  */
1122                                 utag = get_tag(ph, PTT_AC_COOKIE);
1123                                 if ((utag == NULL)
1124                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1125                                         LEAVE(ENETUNREACH);
1126                                 }
1127
1128                                 sendhook = pppoe_finduniq(node, utag);
1129                                 if (sendhook == NULL) {
1130                                         LEAVE(ENETUNREACH);
1131                                 }
1132
1133                                 /*
1134                                  * Check the session is in the right state.
1135                                  * It needs to be in PPPOE_SOFFER
1136                                  * or PPPOE_NEWCONNECTED. If the latter,
1137                                  * then this is a retry by the client.
1138                                  * so be nice, and resend.
1139                                  */
1140                                 sp = NG_HOOK_PRIVATE(sendhook);
1141                                 if (sp->state == PPPOE_NEWCONNECTED) {
1142                                         /*
1143                                          * Whoa! drop back to resend that
1144                                          * PADS packet.
1145                                          * We should still have a copy of it.
1146                                          */
1147                                         sp->state = PPPOE_SOFFER;
1148                                 }
1149                                 if (sp->state != PPPOE_SOFFER) {
1150                                         LEAVE (ENETUNREACH);
1151                                         break;
1152                                 }
1153                                 neg = sp->neg;
1154                                 untimeout(pppoe_ticker, sendhook,
1155                                     neg->timeout_handle);
1156                                 neg->pkt->pkt_header.ph.code = PADS_CODE;
1157                                 if (sp->Session_ID == 0)
1158                                         neg->pkt->pkt_header.ph.sid =
1159                                             htons(sp->Session_ID
1160                                                 = get_new_sid(node));
1161                                 send_sessionid(sp);
1162                                 neg->timeout = 0;
1163                                 /*
1164                                  * start working out the tags to respond with.
1165                                  */
1166                                 init_tags(sp);
1167                                 insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1168                                 if ((tag = get_tag(ph, PTT_SRV_NAME)))
1169                                         insert_tag(sp, tag);/* return service */
1170                                 if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1171                                         insert_tag(sp, tag); /* return it */
1172                                 insert_tag(sp, utag);   /* ac_cookie */
1173                                 scan_tags(sp, ph);
1174                                 make_packet(sp);
1175                                 sp->state = PPPOE_NEWCONNECTED;
1176                                 sendpacket(sp);
1177                                 /*
1178                                  * Having sent the last Negotiation header,
1179                                  * Set up the stored packet header to
1180                                  * be correct for the actual session.
1181                                  * But keep the negotialtion stuff
1182                                  * around in case we need to resend this last
1183                                  * packet. We'll discard it when we move
1184                                  * from NEWCONNECTED to CONNECTED
1185                                  */
1186                                 sp->pkt_hdr = neg->pkt->pkt_header;
1187                                 if (nonstandard)
1188                                         sp->pkt_hdr.eh.ether_type
1189                                                 = ETHERTYPE_PPPOE_STUPID_SESS;
1190                                 else
1191                                         sp->pkt_hdr.eh.ether_type
1192                                                 = ETHERTYPE_PPPOE_SESS;
1193                                 sp->pkt_hdr.ph.code = 0;
1194                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1195                                 break;
1196                         case    PADS_CODE:
1197                                 /*
1198                                  * We are a client:
1199                                  * Use the host_uniq tag to find the
1200                                  * hook this is in response to.
1201                                  * take the session ID and store it away.
1202                                  * Also make sure the pre-made header is
1203                                  * correct and set us into Session mode.
1204                                  */
1205                                 utag = get_tag(ph, PTT_HOST_UNIQ);
1206                                 if ((utag == NULL)
1207                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1208                                         LEAVE (ENETUNREACH);
1209                                         break;
1210                                 }
1211                                 sendhook = pppoe_finduniq(node, utag);
1212                                 if (sendhook == NULL) {
1213                                         LEAVE(ENETUNREACH);
1214                                 }
1215
1216                                 /*
1217                                  * Check the session is in the right state.
1218                                  * It needs to be in PPPOE_SREQ.
1219                                  */
1220                                 sp = NG_HOOK_PRIVATE(sendhook);
1221                                 if (sp->state != PPPOE_SREQ) {
1222                                         LEAVE(ENETUNREACH);
1223                                 }
1224                                 neg = sp->neg;
1225                                 untimeout(pppoe_ticker, sendhook,
1226                                     neg->timeout_handle);
1227                                 neg->pkt->pkt_header.ph.sid = wh->ph.sid;
1228                                 sp->Session_ID = ntohs(wh->ph.sid);
1229                                 send_sessionid(sp);
1230                                 neg->timeout = 0;
1231                                 sp->state = PPPOE_CONNECTED;
1232                                 /*
1233                                  * Now we have gone to Connected mode,
1234                                  * Free all resources needed for
1235                                  * negotiation.
1236                                  * Keep a copy of the header we will be using.
1237                                  */
1238                                 sp->pkt_hdr = neg->pkt->pkt_header;
1239                                 if (nonstandard)
1240                                         sp->pkt_hdr.eh.ether_type
1241                                                 = ETHERTYPE_PPPOE_STUPID_SESS;
1242                                 else
1243                                         sp->pkt_hdr.eh.ether_type
1244                                                 = ETHERTYPE_PPPOE_SESS;
1245                                 sp->pkt_hdr.ph.code = 0;
1246                                 m_freem(neg->m);
1247                                 FREE(sp->neg, M_NETGRAPH_PPPOE);
1248                                 sp->neg = NULL;
1249                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1250                                 break;
1251                         case    PADT_CODE:
1252                                 /*
1253                                  * Send a 'close' message to the controlling
1254                                  * process (the one that set us up);
1255                                  * And then tear everything down.
1256                                  *
1257                                  * Find matching peer/session combination.
1258                                  */
1259                                 sendhook = pppoe_findsession(node, wh);
1260                                 if (sendhook == NULL) {
1261                                         LEAVE(ENETUNREACH);
1262                                 }
1263                                 /* send message to creator */
1264                                 /* close hook */
1265                                 if (sendhook) {
1266                                         ng_rmhook_self(sendhook);
1267                                 }
1268                                 break;
1269                         default:
1270                                 LEAVE(EPFNOSUPPORT);
1271                         }
1272                         break;
1273                 case    ETHERTYPE_PPPOE_STUPID_SESS:
1274                 case    ETHERTYPE_PPPOE_SESS:
1275                         /*
1276                          * find matching peer/session combination.
1277                          */
1278                         sendhook = pppoe_findsession(node, wh);
1279                         if (sendhook == NULL) {
1280                                 LEAVE (ENETUNREACH);
1281                                 break;
1282                         }
1283                         sp = NG_HOOK_PRIVATE(sendhook);
1284                         m_adj(m, sizeof(*wh));
1285                         if (m->m_pkthdr.len < length) {
1286                                 /* Packet too short, dump it */
1287                                 LEAVE(EMSGSIZE);
1288                         }
1289
1290                         /* Also need to trim excess at the end */
1291                         if (m->m_pkthdr.len > length) {
1292                                 m_adj(m, -((int)(m->m_pkthdr.len - length)));
1293                         }
1294                         if ( sp->state != PPPOE_CONNECTED) {
1295                                 if (sp->state == PPPOE_NEWCONNECTED) {
1296                                         sp->state = PPPOE_CONNECTED;
1297                                         /*
1298                                          * Now we have gone to Connected mode,
1299                                          * Free all resources needed for
1300                                          * negotiation. Be paranoid about
1301                                          * whether there may be a timeout.
1302                                          */
1303                                         m_freem(sp->neg->m);
1304                                         untimeout(pppoe_ticker, sendhook,
1305                                                 sp->neg->timeout_handle);
1306                                         FREE(sp->neg, M_NETGRAPH_PPPOE);
1307                                         sp->neg = NULL;
1308                                 } else {
1309                                         LEAVE (ENETUNREACH);
1310                                         break;
1311                                 }
1312                         }
1313                         NG_FWD_NEW_DATA( error, item, sendhook, m);
1314                         break;
1315                 default:
1316                         LEAVE(EPFNOSUPPORT);
1317                 }
1318         } else {
1319                 /*
1320                  *      Not ethernet or debug hook..
1321                  *
1322                  * The packet has come in on a normal hook.
1323                  * We need to find out what kind of hook,
1324                  * So we can decide how to handle it.
1325                  * Check the hook's state.
1326                  */
1327                 sp = NG_HOOK_PRIVATE(hook);
1328                 switch (sp->state) {
1329                 case    PPPOE_NEWCONNECTED:
1330                 case    PPPOE_CONNECTED: {
1331                         static const u_char addrctrl[] = { 0xff, 0x03 };
1332                         struct pppoe_full_hdr *wh;
1333
1334                         /*
1335                          * Remove PPP address and control fields, if any.
1336                          * For example, ng_ppp(4) always sends LCP packets
1337                          * with address and control fields as required by
1338                          * generic PPP. PPPoE is an exception to the rule.
1339                          */
1340                         if (m->m_pkthdr.len >= 2) {
1341                                 if (m->m_len < 2 && !(m = m_pullup(m, 2)))
1342                                         LEAVE(ENOBUFS);
1343                                 if (bcmp(mtod(m, u_char *), addrctrl, 2) == 0)
1344                                         m_adj(m, 2);
1345                         }
1346                         /*
1347                          * Bang in a pre-made header, and set the length up
1348                          * to be correct. Then send it to the ethernet driver.
1349                          * But first correct the length.
1350                          */
1351                         sp->pkt_hdr.ph.length = htons((short)(m->m_pkthdr.len));
1352                         M_PREPEND(m, sizeof(*wh), M_DONTWAIT);
1353                         if (m == NULL) {
1354                                 LEAVE(ENOBUFS);
1355                         }
1356                         wh = mtod(m, struct pppoe_full_hdr *);
1357                         bcopy(&sp->pkt_hdr, wh, sizeof(*wh));
1358                         NG_FWD_NEW_DATA( error, item, privp->ethernet_hook, m);
1359                         privp->packets_out++;
1360                         break;
1361                         }
1362                 case    PPPOE_PRIMED:
1363                         /*
1364                          * A PADI packet is being returned by the application
1365                          * that has set up this hook. This indicates that it
1366                          * wants us to offer service.
1367                          */
1368                         neg = sp->neg;
1369                         if (m->m_len < sizeof(*wh)) {
1370                                 m = m_pullup(m, sizeof(*wh));
1371                                 if (m == NULL) {
1372                                         LEAVE(ENOBUFS);
1373                                 }
1374                         }
1375                         wh = mtod(m, struct pppoe_full_hdr *);
1376                         ph = &wh->ph;
1377                         session = ntohs(wh->ph.sid);
1378                         length = ntohs(wh->ph.length);
1379                         code = wh->ph.code;
1380                         if ( code != PADI_CODE) {
1381                                 LEAVE(EINVAL);
1382                         };
1383                         untimeout(pppoe_ticker, hook,
1384                                     neg->timeout_handle);
1385
1386                         /*
1387                          * This is the first time we hear
1388                          * from the client, so note it's
1389                          * unicast address, replacing the
1390                          * broadcast address.
1391                          */
1392                         bcopy(wh->eh.ether_shost,
1393                                 neg->pkt->pkt_header.eh.ether_dhost,
1394                                 ETHER_ADDR_LEN);
1395                         sp->state = PPPOE_SOFFER;
1396                         neg->timeout = 0;
1397                         neg->pkt->pkt_header.ph.code = PADO_CODE;
1398
1399                         /*
1400                          * start working out the tags to respond with.
1401                          */
1402                         uniqtag.hdr.tag_type = PTT_AC_COOKIE;
1403                         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(sp));
1404                         uniqtag.data.pointer = sp;
1405                         init_tags(sp);
1406                         insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1407                         if ((tag = get_tag(ph, PTT_SRV_NAME)))
1408                                 insert_tag(sp, tag);      /* return service */
1409                         /*
1410                          * If we have a NULL service request
1411                          * and have an extra service defined in this hook,
1412                          * then also add a tag for the extra service.
1413                          * XXX this is a hack. eventually we should be able
1414                          * to support advertising many services, not just one
1415                          */
1416                         if (((tag == NULL) || (tag->tag_len == 0))
1417                         && (neg->service.hdr.tag_len != 0)) {
1418                                 insert_tag(sp, &neg->service.hdr); /* SERVICE */
1419                         }
1420                         if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1421                                 insert_tag(sp, tag); /* returned hostunique */
1422                         insert_tag(sp, &uniqtag.hdr);
1423                         scan_tags(sp, ph);
1424                         make_packet(sp);
1425                         sendpacket(sp);
1426                         break;
1427
1428                 /*
1429                  * Packets coming from the hook make no sense
1430                  * to sessions in these states. Throw them away.
1431                  */
1432                 case    PPPOE_SINIT:
1433                 case    PPPOE_SREQ:
1434                 case    PPPOE_SOFFER:
1435                 case    PPPOE_SNONE:
1436                 case    PPPOE_LISTENING:
1437                 case    PPPOE_DEAD:
1438                 default:
1439                         LEAVE(ENETUNREACH);
1440                 }
1441         }
1442 quit:
1443         if (item)
1444                 NG_FREE_ITEM(item);
1445         NG_FREE_M(m);
1446         return error;
1447 }
1448
1449 /*
1450  * Do local shutdown processing..
1451  * If we are a persistant device, we might refuse to go away, and
1452  * we'd only remove our links and reset ourself.
1453  */
1454 static int
1455 ng_pppoe_shutdown(node_p node)
1456 {
1457         const priv_p privdata = NG_NODE_PRIVATE(node);
1458
1459 AAA
1460         NG_NODE_SET_PRIVATE(node, NULL);
1461         NG_NODE_UNREF(privdata->node);
1462         FREE(privdata, M_NETGRAPH_PPPOE);
1463         return (0);
1464 }
1465
1466 /*
1467  * This is called once we've already connected a new hook to the other node.
1468  * It gives us a chance to balk at the last minute.
1469  */
1470 static int
1471 ng_pppoe_connect(hook_p hook)
1472 {
1473         /* be really amiable and just say "YUP that's OK by me! " */
1474         return (0);
1475 }
1476
1477 /*
1478  * Hook disconnection
1479  *
1480  * Clean up all dangling links and information about the session/hook.
1481  * For this type, removal of the last link destroys the node
1482  */
1483 static int
1484 ng_pppoe_disconnect(hook_p hook)
1485 {
1486         node_p node = NG_HOOK_NODE(hook);
1487         priv_p privp = NG_NODE_PRIVATE(node);
1488         sessp   sp;
1489         int     hooks;
1490
1491 AAA
1492         hooks = NG_NODE_NUMHOOKS(node); /* this one already not counted */
1493         if (NG_HOOK_PRIVATE(hook) == &privp->debug_hook) {
1494                 privp->debug_hook = NULL;
1495         } else if (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook) {
1496                 privp->ethernet_hook = NULL;
1497                 if (NG_NODE_IS_VALID(node))
1498                         ng_rmnode_self(node);
1499         } else {
1500                 sp = NG_HOOK_PRIVATE(hook);
1501                 if (sp->state != PPPOE_SNONE ) {
1502                         pppoe_send_event(sp, NGM_PPPOE_CLOSE);
1503                 }
1504                 /*
1505                  * According to the spec, if we are connected,
1506                  * we should send a DISC packet if we are shutting down
1507                  * a session.
1508                  */
1509                 if ((privp->ethernet_hook)
1510                 && ((sp->state == PPPOE_CONNECTED)
1511                  || (sp->state == PPPOE_NEWCONNECTED))) {
1512                         struct mbuf *m;
1513                         struct pppoe_full_hdr *wh;
1514                         struct pppoe_tag *tag;
1515                         int     msglen = strlen(SIGNOFF);
1516                         int error = 0;
1517
1518                         /* revert the stored header to DISC/PADT mode */
1519                         wh = &sp->pkt_hdr;
1520                         wh->ph.code = PADT_CODE;
1521                         if (nonstandard)
1522                                 wh->eh.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
1523                         else
1524                                 wh->eh.ether_type = ETHERTYPE_PPPOE_DISC;
1525
1526                         /* generate a packet of that type */
1527                         MGETHDR(m, M_DONTWAIT, MT_DATA);
1528                         if(m == NULL)
1529                                 printf("pppoe: Session out of mbufs\n");
1530                         else {
1531                                 m->m_pkthdr.rcvif = NULL;
1532                                 m->m_pkthdr.len = m->m_len = sizeof(*wh);
1533                                 bcopy((caddr_t)wh, mtod(m, caddr_t),
1534                                     sizeof(*wh));
1535                                 /*
1536                                  * Add a General error message and adjust
1537                                  * sizes
1538                                  */
1539                                 wh = mtod(m, struct pppoe_full_hdr *);
1540                                 tag = wh->ph.tag;
1541                                 tag->tag_type = PTT_GEN_ERR;
1542                                 tag->tag_len = htons((u_int16_t)msglen);
1543                                 strncpy(tag->tag_data, SIGNOFF, msglen);
1544                                 m->m_pkthdr.len = (m->m_len += sizeof(*tag) +
1545                                     msglen);
1546                                 wh->ph.length = htons(sizeof(*tag) + msglen);
1547                                 NG_SEND_DATA_ONLY(error,
1548                                         privp->ethernet_hook, m);
1549                         }
1550                 }
1551                 /*
1552                  * As long as we have somewhere to store the timeout handle,
1553                  * we may have a timeout pending.. get rid of it.
1554                  */
1555                 if (sp->neg) {
1556                         untimeout(pppoe_ticker, hook, sp->neg->timeout_handle);
1557                         if (sp->neg->m)
1558                                 m_freem(sp->neg->m);
1559                         FREE(sp->neg, M_NETGRAPH_PPPOE);
1560                 }
1561                 FREE(sp, M_NETGRAPH_PPPOE);
1562                 NG_HOOK_SET_PRIVATE(hook, NULL);
1563                 /* work out how many session hooks there are */
1564                 /* Node goes away on last session hook removal */
1565                 if (privp->ethernet_hook) hooks -= 1;
1566                 if (privp->debug_hook) hooks -= 1;
1567         }
1568         if ((NG_NODE_NUMHOOKS(node) == 0)
1569         && (NG_NODE_IS_VALID(node)))
1570                 ng_rmnode_self(node);
1571         return (0);
1572 }
1573
1574 /*
1575  * timeouts come here.
1576  */
1577 static void
1578 pppoe_ticker(void *arg)
1579 {
1580         int s = splnet();
1581         hook_p hook = arg;
1582         sessp   sp = NG_HOOK_PRIVATE(hook);
1583         negp    neg = sp->neg;
1584         int     error = 0;
1585         struct mbuf *m0 = NULL;
1586         priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1587
1588 AAA
1589         switch(sp->state) {
1590                 /*
1591                  * resend the last packet, using an exponential backoff.
1592                  * After a period of time, stop growing the backoff,
1593                  * and either leave it, or revert to the start.
1594                  */
1595         case    PPPOE_SINIT:
1596         case    PPPOE_SREQ:
1597                 /* timeouts on these produce resends */
1598                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1599                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1600                 neg->timeout_handle = timeout(pppoe_ticker,
1601                                         hook, neg->timeout * hz);
1602                 if ((neg->timeout <<= 1) > PPPOE_TIMEOUT_LIMIT) {
1603                         if (sp->state == PPPOE_SREQ) {
1604                                 /* revert to SINIT mode */
1605                                 pppoe_start(sp);
1606                         } else {
1607                                 neg->timeout = PPPOE_TIMEOUT_LIMIT;
1608                         }
1609                 }
1610                 break;
1611         case    PPPOE_PRIMED:
1612         case    PPPOE_SOFFER:
1613                 /* a timeout on these says "give up" */
1614                 ng_rmhook_self(hook);
1615                 break;
1616         default:
1617                 /* timeouts have no meaning in other states */
1618                 printf("pppoe: unexpected timeout\n");
1619         }
1620         splx(s);
1621 }
1622
1623
1624 static void
1625 sendpacket(sessp sp)
1626 {
1627         int     error = 0;
1628         struct mbuf *m0 = NULL;
1629         hook_p hook = sp->hook;
1630         negp    neg = sp->neg;
1631         priv_p  privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1632
1633 AAA
1634         switch(sp->state) {
1635         case    PPPOE_LISTENING:
1636         case    PPPOE_DEAD:
1637         case    PPPOE_SNONE:
1638         case    PPPOE_CONNECTED:
1639                 printf("pppoe: sendpacket: unexpected state\n");
1640                 break;
1641
1642         case    PPPOE_NEWCONNECTED:
1643                 /* send the PADS without a timeout - we're now connected */
1644                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1645                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1646                 break;
1647
1648         case    PPPOE_PRIMED:
1649                 /* No packet to send, but set up the timeout */
1650                 neg->timeout_handle = timeout(pppoe_ticker,
1651                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1652                 break;
1653
1654         case    PPPOE_SOFFER:
1655                 /*
1656                  * send the offer but if they don't respond
1657                  * in PPPOE_OFFER_TIMEOUT seconds, forget about it.
1658                  */
1659                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1660                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1661                 neg->timeout_handle = timeout(pppoe_ticker,
1662                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1663                 break;
1664
1665         case    PPPOE_SINIT:
1666         case    PPPOE_SREQ:
1667                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1668                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1669                 neg->timeout_handle = timeout(pppoe_ticker, hook,
1670                                         (hz * PPPOE_INITIAL_TIMEOUT));
1671                 neg->timeout = PPPOE_INITIAL_TIMEOUT * 2;
1672                 break;
1673
1674         default:
1675                 error = EINVAL;
1676                 printf("pppoe: timeout: bad state\n");
1677         }
1678         /* return (error); */
1679 }
1680
1681 /*
1682  * Parse an incoming packet to see if any tags should be copied to the
1683  * output packet. Don't do any tags that have been handled in the main
1684  * state machine.
1685  */
1686 static const struct pppoe_tag*
1687 scan_tags(sessp sp, const struct pppoe_hdr* ph)
1688 {
1689         const char *const end = (const char *)next_tag(ph);
1690         const char *ptn;
1691         const struct pppoe_tag *pt = &ph->tag[0];
1692         /*
1693          * Keep processing tags while a tag header will still fit.
1694          */
1695 AAA
1696         while((const char*)(pt + 1) <= end) {
1697                 /*
1698                  * If the tag data would go past the end of the packet, abort.
1699                  */
1700                 ptn = (((const char *)(pt + 1)) + ntohs(pt->tag_len));
1701                 if(ptn > end)
1702                         return NULL;
1703
1704                 switch (pt->tag_type) {
1705                 case    PTT_RELAY_SID:
1706                         insert_tag(sp, pt);
1707                         break;
1708                 case    PTT_EOL:
1709                         return NULL;
1710                 case    PTT_SRV_NAME:
1711                 case    PTT_AC_NAME:
1712                 case    PTT_HOST_UNIQ:
1713                 case    PTT_AC_COOKIE:
1714                 case    PTT_VENDOR:
1715                 case    PTT_SRV_ERR:
1716                 case    PTT_SYS_ERR:
1717                 case    PTT_GEN_ERR:
1718                         break;
1719                 }
1720                 pt = (const struct pppoe_tag*)ptn;
1721         }
1722         return NULL;
1723 }
1724
1725 static  int
1726 pppoe_send_event(sessp sp, enum cmd cmdid)
1727 {
1728         int error;
1729         struct ng_mesg *msg;
1730         struct ngpppoe_sts *sts;
1731
1732 AAA
1733         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, cmdid,
1734                         sizeof(struct ngpppoe_sts), M_NOWAIT);
1735         if (msg == NULL)
1736                 return (ENOMEM);
1737         sts = (struct ngpppoe_sts *)msg->data;
1738         strncpy(sts->hook, NG_HOOK_NAME(sp->hook), NG_HOOKLEN + 1);
1739         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
1740         return (error);
1741 }