sys/netgraph/ng_pppoe.c

   1
   2 /*
   3  * ng_pppoe.c
   4  *
   5  * Copyright (c) 1996-1999 Whistle Communications, Inc.
   6  * All rights reserved.
   7  *
   8  * Subject to the following obligations and disclaimer of warranty, use and
   9  * redistribution of this software, in source or object code forms, with or
  10  * without modifications are expressly permitted by Whistle Communications;
  11  * provided, however, that:
  12  * 1. Any and all reproductions of the source or object code must include the
  13  *    copyright notice above and the following disclaimer of warranties; and
  14  * 2. No rights are granted, in any manner or form, to use Whistle
  15  *    Communications, Inc. trademarks, including the mark "WHISTLE
  16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
  17  *    such appears in the above copyright notice or in the software.
  18  *
  19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
  20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
  21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
  22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
  23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
  24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
  25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
  26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
  27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
  28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
  29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
  30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
  32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
  35  * OF SUCH DAMAGE.
  36  *
  37  * Author: Julian Elischer <julian@freebsd.org>
  38  *
  39  * $FreeBSD$
  40  * $Whistle: ng_pppoe.c,v 1.10 1999/11/01 09:24:52 julian Exp $
  41  */
  42 #if 0
  43 #define AAA printf("pppoe: %s\n", __func__ );
  44 #define BBB printf("-%d-", __LINE__ );
  45 #else
  46 #define AAA
  47 #define BBB
  48 #endif
  49
  50 #include <sys/param.h>
  51 #include <sys/systm.h>
  52 #include <sys/kernel.h>
  53 #include <sys/mbuf.h>
  54 #include <sys/malloc.h>
  55 #include <sys/errno.h>
  56 #include <sys/sysctl.h>
  57 #include <net/ethernet.h>
  58
  59 #include <netgraph/ng_message.h>
  60 #include <netgraph/netgraph.h>
  61 #include <netgraph/ng_parse.h>
  62 #include <netgraph/ng_pppoe.h>
  63
  64 #ifdef NG_SEPARATE_MALLOC
  65 MALLOC_DEFINE(M_NETGRAPH_PPPOE, "netgraph_pppoe", "netgraph pppoe node");
  66 #else
  67 #define M_NETGRAPH_PPPOE M_NETGRAPH
  68 #endif
  69
  70 #define SIGNOFF "session closed"
  71 #define OFFSETOF(s, e) ((char *)&((s *)0)->e - (char *)((s *)0))
  72
  73 /*
  74  * This section contains the netgraph method declarations for the
  75  * pppoe node. These methods define the netgraph pppoe 'type'.
  76  */
  77
  78 static ng_constructor_t ng_pppoe_constructor;
  79 static ng_rcvmsg_t      ng_pppoe_rcvmsg;
  80 static ng_shutdown_t    ng_pppoe_shutdown;
  81 static ng_newhook_t     ng_pppoe_newhook;
  82 static ng_connect_t     ng_pppoe_connect;
  83 static ng_rcvdata_t     ng_pppoe_rcvdata;
  84 static ng_disconnect_t  ng_pppoe_disconnect;
  85
  86 /* Parse type for struct ngpppoe_init_data */
  87 static const struct ng_parse_struct_info ngpppoe_init_data_type_info
  88         = NG_PPPOE_INIT_DATA_TYPE_INFO;
  89 static const struct ng_parse_type ngpppoe_init_data_state_type = {
  90         &ng_parse_struct_type,
  91         &ngpppoe_init_data_type_info
  92 };
  93
  94 /* Parse type for struct ngpppoe_sts */
  95 static const struct ng_parse_struct_info ng_pppoe_sts_type_info
  96         = NG_PPPOE_STS_TYPE_INFO;
  97 static const struct ng_parse_type ng_pppoe_sts_state_type = {
  98         &ng_parse_struct_type,
  99         &ng_pppoe_sts_type_info
 100 };
 101
 102 /* List of commands and how to convert arguments to/from ASCII */
 103 static const struct ng_cmdlist ng_pppoe_cmds[] = {
 104         {
 105           NGM_PPPOE_COOKIE,
 106           NGM_PPPOE_CONNECT,
 107           "pppoe_connect",
 108           &ngpppoe_init_data_state_type,
 109           NULL
 110         },
 111         {
 112           NGM_PPPOE_COOKIE,
 113           NGM_PPPOE_LISTEN,
 114           "pppoe_listen",
 115           &ngpppoe_init_data_state_type,
 116           NULL
 117         },
 118         {
 119           NGM_PPPOE_COOKIE,
 120           NGM_PPPOE_OFFER,
 121           "pppoe_offer",
 122           &ngpppoe_init_data_state_type,
 123           NULL
 124         },
 125         {
 126           NGM_PPPOE_COOKIE,
 127           NGM_PPPOE_SERVICE,
 128           "pppoe_service",
 129           &ngpppoe_init_data_state_type,
 130           NULL
 131         },
 132         {
 133           NGM_PPPOE_COOKIE,
 134           NGM_PPPOE_SUCCESS,
 135           "pppoe_success",
 136           &ng_pppoe_sts_state_type,
 137           NULL
 138         },
 139         {
 140           NGM_PPPOE_COOKIE,
 141           NGM_PPPOE_FAIL,
 142           "pppoe_fail",
 143           &ng_pppoe_sts_state_type,
 144           NULL
 145         },
 146         {
 147           NGM_PPPOE_COOKIE,
 148           NGM_PPPOE_CLOSE,
 149           "pppoe_close",
 150           &ng_pppoe_sts_state_type,
 151           NULL
 152         },
 153         { 0 }
 154 };
 155
 156 /* Netgraph node type descriptor */
 157 static struct ng_type typestruct = {
 158         NG_ABI_VERSION,
 159         NG_PPPOE_NODE_TYPE,
 160         NULL,
 161         ng_pppoe_constructor,
 162         ng_pppoe_rcvmsg,
 163         ng_pppoe_shutdown,
 164         ng_pppoe_newhook,
 165         NULL,
 166         ng_pppoe_connect,
 167         ng_pppoe_rcvdata,
 168         ng_pppoe_disconnect,
 169         ng_pppoe_cmds
 170 };
 171 NETGRAPH_INIT(pppoe, &typestruct);
 172 /* Depend on ng_ether so we can use the Ethernet parse type */
 173 MODULE_DEPEND(ng_pppoe, ng_ether, 1, 1, 1);
 174
 175 /*
 176  * States for the session state machine.
 177  * These have no meaning if there is no hook attached yet.
 178  */
 179 enum state {
 180     PPPOE_SNONE=0,      /* [both] Initial state */
 181     PPPOE_LISTENING,    /* [Daemon] Listening for discover initiation pkt */
 182     PPPOE_SINIT,        /* [Client] Sent discovery initiation */
 183     PPPOE_PRIMED,       /* [Server] Awaiting PADI from daemon */
 184     PPPOE_SOFFER,       /* [Server] Sent offer message  (got PADI)*/
 185     PPPOE_SREQ,         /* [Client] Sent a Request */
 186     PPPOE_NEWCONNECTED, /* [Server] Connection established, No data received */
 187     PPPOE_CONNECTED,    /* [Both] Connection established, Data received */
 188     PPPOE_DEAD          /* [Both] */
 189 };
 190
 191 #define NUMTAGS 20 /* number of tags we are set up to work with */
 192
 193 /*
 194  * Information we store for each hook on each node for negotiating the
 195  * session. The mbuf and cluster are freed once negotiation has completed.
 196  * The whole negotiation block is then discarded.
 197  */
 198
 199 struct sess_neg {
 200         struct mbuf             *m; /* holds cluster with last sent packet */
 201         union   packet          *pkt; /* points within the above cluster */
 202         struct callout_handle   timeout_handle;   /* see timeout(9) */
 203         u_int                   timeout; /* 0,1,2,4,8,16 etc. seconds */
 204         u_int                   numtags;
 205         struct pppoe_tag        *tags[NUMTAGS];
 206         u_int                   service_len;
 207         u_int                   ac_name_len;
 208
 209         struct datatag          service;
 210         struct datatag          ac_name;
 211 };
 212 typedef struct sess_neg *negp;
 213
 214 /*
 215  * Session information that is needed after connection.
 216  */
 217 struct sess_con {
 218         hook_p                  hook;
 219         u_int16_t               Session_ID;
 220         enum state              state;
 221         ng_ID_t                 creator;                /* who to notify */
 222         struct pppoe_full_hdr   pkt_hdr;        /* used when connected */
 223         negp                    neg;            /* used when negotiating */
 224         /*struct sess_con       *hash_next;*/   /* not yet used */
 225 };
 226 typedef struct sess_con *sessp;
 227
 228 /*
 229  * Information we store for each node
 230  */
 231 struct PPPOE {
 232         node_p          node;           /* back pointer to node */
 233         hook_p          ethernet_hook;
 234         hook_p          debug_hook;
 235         u_int           packets_in;     /* packets in from ethernet */
 236         u_int           packets_out;    /* packets out towards ethernet */
 237         u_int32_t       flags;
 238         /*struct sess_con *buckets[HASH_SIZE];*/        /* not yet used */
 239 };
 240 typedef struct PPPOE *priv_p;
 241
 242 struct ether_header eh_prototype =
 243         {{0xff,0xff,0xff,0xff,0xff,0xff},
 244          {0x00,0x00,0x00,0x00,0x00,0x00},
 245          ETHERTYPE_PPPOE_DISC};
 246
 247 static int nonstandard;
 248 static int
 249 ngpppoe_set_ethertype(SYSCTL_HANDLER_ARGS)
 250 {
 251         int error;
 252         int val;
 253
 254         val = nonstandard;
 255         error = sysctl_handle_int(oidp, &val, sizeof(int), req);
 256         if (error != 0 || req->newptr == NULL)
 257                 return (error);
 258         if (val == 1) {
 259                 nonstandard = 1;
 260                 eh_prototype.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
 261         } else {
 262                 nonstandard = 0;
 263                 eh_prototype.ether_type = ETHERTYPE_PPPOE_DISC;
 264         }
 265         return (0);
 266 }
 267
 268 SYSCTL_PROC(_net_graph, OID_AUTO, nonstandard_pppoe, CTLTYPE_INT | CTLFLAG_RW,
 269     0, sizeof(int), ngpppoe_set_ethertype, "I", "select normal or stupid ISP");
 270
 271 union uniq {
 272         char bytes[sizeof(void *)];
 273         void * pointer;
 274         };
 275
 276 #define LEAVE(x) do { error = x; goto quit; } while(0)
 277 static void     pppoe_start(sessp sp);
 278 static void     sendpacket(sessp sp);
 279 static void     pppoe_ticker(void *arg);
 280 static struct pppoe_tag* scan_tags(sessp        sp, struct pppoe_hdr* ph);
 281 static  int     pppoe_send_event(sessp sp, enum cmd cmdid);
 282
 283 /*************************************************************************
 284  * Some basic utilities  from the Linux version with author's permission.*
 285  * Author:      Michal Ostrowski <mostrows@styx.uwaterloo.ca>            *
 286  ************************************************************************/
 287
 288 /*
 289  * Generate a new session id
 290  * XXX find out the FreeBSD locking scheme.
 291  */
 292 static u_int16_t
 293 get_new_sid(node_p node)
 294 {
 295         static int pppoe_sid = 10;
 296         sessp sp;
 297         hook_p  hook;
 298         u_int16_t val;
 299         priv_p privp = NG_NODE_PRIVATE(node);
 300
 301 AAA
 302 restart:
 303         val = pppoe_sid++;
 304         /*
 305          * Spec says 0xFFFF is reserved.
 306          * Also don't use 0x0000
 307          */
 308         if (val == 0xffff) {
 309                 pppoe_sid = 20;
 310                 goto restart;
 311         }
 312
 313         /* Check it isn't already in use */
 314         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 315                 /* don't check special hooks */
 316                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 317                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 318                         continue;
 319                 sp = NG_HOOK_PRIVATE(hook);
 320                 if (sp->Session_ID == val)
 321                         goto restart;
 322         }
 323
 324         return val;
 325 }
 326
 327
 328 /*
 329  * Return the location where the next tag can be put
 330  */
 331 static __inline struct pppoe_tag*
 332 next_tag(struct pppoe_hdr* ph)
 333 {
 334         return (struct pppoe_tag*)(((char*)&ph->tag[0]) + ntohs(ph->length));
 335 }
 336
 337 /*
 338  * Look for a tag of a specific type
 339  * Don't trust any length the other end says.
 340  * but assume we already sanity checked ph->length.
 341  */
 342 static struct pppoe_tag*
 343 get_tag(struct pppoe_hdr* ph, u_int16_t idx)
 344 {
 345         char *end = (char *)next_tag(ph);
 346         char *ptn;
 347         struct pppoe_tag *pt = &ph->tag[0];
 348         /*
 349          * Keep processing tags while a tag header will still fit.
 350          */
 351 AAA
 352         while((char*)(pt + 1) <= end) {
 353             /*
 354              * If the tag data would go past the end of the packet, abort.
 355              */
 356             ptn = (((char *)(pt + 1)) + ntohs(pt->tag_len));
 357             if(ptn > end)
 358                 return NULL;
 359
 360             if(pt->tag_type == idx)
 361                 return pt;
 362
 363             pt = (struct pppoe_tag*)ptn;
 364         }
 365         return NULL;
 366 }
 367
 368 /**************************************************************************
 369  * inlines to initialise or add tags to a session's tag list,
 370  **************************************************************************/
 371 /*
 372  * Initialise the session's tag list
 373  */
 374 static void
 375 init_tags(sessp sp)
 376 {
 377 AAA
 378         if(sp->neg == NULL) {
 379                 printf("pppoe: asked to init NULL neg pointer\n");
 380                 return;
 381         }
 382         sp->neg->numtags = 0;
 383 }
 384
 385 static void
 386 insert_tag(sessp sp, struct pppoe_tag *tp)
 387 {
 388         int     i;
 389         negp neg;
 390
 391 AAA
 392         if((neg = sp->neg) == NULL) {
 393                 printf("pppoe: asked to use NULL neg pointer\n");
 394                 return;
 395         }
 396         if ((i = neg->numtags++) < NUMTAGS) {
 397                 neg->tags[i] = tp;
 398         } else {
 399                 printf("pppoe: asked to add too many tags to packet\n");
 400                 neg->numtags--;
 401         }
 402 }
 403
 404 /*
 405  * Make up a packet, using the tags filled out for the session.
 406  *
 407  * Assume that the actual pppoe header and ethernet header
 408  * are filled out externally to this routine.
 409  * Also assume that neg->wh points to the correct
 410  * location at the front of the buffer space.
 411  */
 412 static void
 413 make_packet(sessp sp) {
 414         struct pppoe_full_hdr *wh = &sp->neg->pkt->pkt_header;
 415         struct pppoe_tag **tag;
 416         char *dp;
 417         int count;
 418         int tlen;
 419         u_int16_t length = 0;
 420
 421 AAA
 422         if ((sp->neg == NULL) || (sp->neg->m == NULL)) {
 423                 printf("pppoe: make_packet called from wrong state\n");
 424         }
 425         dp = (char *)wh->ph.tag;
 426         for (count = 0, tag = sp->neg->tags;
 427             ((count < sp->neg->numtags) && (count < NUMTAGS));
 428             tag++, count++) {
 429                 tlen = ntohs((*tag)->tag_len) + sizeof(**tag);
 430                 if ((length + tlen) > (ETHER_MAX_LEN - 4 - sizeof(*wh))) {
 431                         printf("pppoe: tags too long\n");
 432                         sp->neg->numtags = count;
 433                         break;  /* XXX chop off what's too long */
 434                 }
 435                 bcopy((char *)*tag, (char *)dp, tlen);
 436                 length += tlen;
 437                 dp += tlen;
 438         }
 439         wh->ph.length = htons(length);
 440         sp->neg->m->m_len = length + sizeof(*wh);
 441         sp->neg->m->m_pkthdr.len = length + sizeof(*wh);
 442 }
 443
 444 /**************************************************************************
 445  * Routine to match a service offered                                     *
 446  **************************************************************************/
 447 /*
 448  * Find a hook that has a service string that matches that
 449  * we are seeking. for now use a simple string.
 450  * In the future we may need something like regexp().
 451  * for testing allow a null string to match 1st found and a null service
 452  * to match all requests. Also make '*' do the same.
 453  */
 454
 455 #define NG_MATCH_EXACT  1
 456 #define NG_MATCH_ANY    2
 457
 458 static hook_p
 459 pppoe_match_svc(node_p node, char *svc_name, int svc_len, int match)
 460 {
 461         sessp   sp      = NULL;
 462         negp    neg     = NULL;
 463         priv_p  privp   = NG_NODE_PRIVATE(node);
 464         hook_p  allhook = NULL;
 465         hook_p  hook;
 466
 467 AAA
 468         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 469
 470                 /* skip any hook that is debug or ethernet */
 471                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 472                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 473                         continue;
 474                 sp = NG_HOOK_PRIVATE(hook);
 475
 476                 /* Skip any sessions which are not in LISTEN mode. */
 477                 if ( sp->state != PPPOE_LISTENING)
 478                         continue;
 479
 480                 neg = sp->neg;
 481
 482                 /* Special case for a blank or "*" service name (wildcard) */
 483                 if (match == NG_MATCH_ANY && neg->service_len == 1 &&
 484                     neg->service.data[0] == '*') {
 485                         allhook = hook;
 486                         continue;
 487                 }
 488
 489                 /* If the lengths don't match, that aint it. */
 490                 if (neg->service_len != svc_len)
 491                         continue;
 492
 493                 /* An exact match? */
 494                 if (svc_len == 0)
 495                         break;
 496
 497                 if (strncmp(svc_name, neg->service.data, svc_len) == 0)
 498                         break;
 499         }
 500         return (hook ? hook : allhook);
 501 }
 502 /**************************************************************************
 503  * Routine to find a particular session that matches an incoming packet   *
 504  **************************************************************************/
 505 static hook_p
 506 pppoe_findsession(node_p node, struct pppoe_full_hdr *wh)
 507 {
 508         sessp   sp = NULL;
 509         hook_p hook = NULL;
 510         priv_p  privp = NG_NODE_PRIVATE(node);
 511         u_int16_t       session = ntohs(wh->ph.sid);
 512
 513         /*
 514          * find matching peer/session combination.
 515          */
 516 AAA
 517         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 518                 /* don't check special hooks */
 519                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 520                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook)) {
 521                         continue;
 522                 }
 523                 sp = NG_HOOK_PRIVATE(hook);
 524                 if ( ( (sp->state == PPPOE_CONNECTED)
 525                     || (sp->state == PPPOE_NEWCONNECTED) )
 526                 && (sp->Session_ID == session)
 527                 && (bcmp(sp->pkt_hdr.eh.ether_dhost,
 528                     wh->eh.ether_shost,
 529                     ETHER_ADDR_LEN)) == 0) {
 530                         break;
 531                 }
 532         }
 533         return (hook);
 534 }
 535
 536 static hook_p
 537 pppoe_finduniq(node_p node, struct pppoe_tag *tag)
 538 {
 539         hook_p hook = NULL;
 540         priv_p  privp = NG_NODE_PRIVATE(node);
 541         union uniq              uniq;
 542
 543 AAA
 544         bcopy(tag->tag_data, uniq.bytes, sizeof(void *));
 545         /* cycle through all known hooks */
 546         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 547                 /* don't check special hooks */
 548                 if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 549                 ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook))
 550                         continue;
 551                 if (uniq.pointer == NG_HOOK_PRIVATE(hook))
 552                         break;
 553         }
 554         return (hook);
 555 }
 556
 557 /**************************************************************************
 558  * start of Netgraph entrypoints                                          *
 559  **************************************************************************/
 560
 561 /*
 562  * Allocate the private data structure and the generic node
 563  * and link them together.
 564  *
 565  * ng_make_node_common() returns with a generic node struct
 566  * with a single reference for us.. we transfer it to the
 567  * private structure.. when we free the private struct we must
 568  * unref the node so it gets freed too.
 569  */
 570 static int
 571 ng_pppoe_constructor(node_p node)
 572 {
 573         priv_p privdata;
 574
 575 AAA
 576         /* Initialize private descriptor */
 577         MALLOC(privdata, priv_p, sizeof(*privdata), M_NETGRAPH_PPPOE,
 578             M_NOWAIT | M_ZERO);
 579         if (privdata == NULL)
 580                 return (ENOMEM);
 581
 582         /* Link structs together; this counts as our one reference to *nodep */
 583         NG_NODE_SET_PRIVATE(node, privdata);
 584         privdata->node = node;
 585         return (0);
 586 }
 587
 588 /*
 589  * Give our ok for a hook to be added...
 590  * point the hook's private info to the hook structure.
 591  *
 592  * The following hook names are special:
 593  *  Ethernet:  the hook that should be connected to a NIC.
 594  *  debug:      copies of data sent out here  (when I write the code).
 595  * All other hook names need only be unique. (the framework checks this).
 596  */
 597 static int
 598 ng_pppoe_newhook(node_p node, hook_p hook, const char *name)
 599 {
 600         const priv_p privp = NG_NODE_PRIVATE(node);
 601         sessp sp;
 602
 603 AAA
 604         if (strcmp(name, NG_PPPOE_HOOK_ETHERNET) == 0) {
 605                 privp->ethernet_hook = hook;
 606                 NG_HOOK_SET_PRIVATE(hook, &privp->ethernet_hook);
 607         } else if (strcmp(name, NG_PPPOE_HOOK_DEBUG) == 0) {
 608                 privp->debug_hook = hook;
 609                 NG_HOOK_SET_PRIVATE(hook, &privp->debug_hook);
 610         } else {
 611                 /*
 612                  * Any other unique name is OK.
 613                  * The infrastructure has already checked that it's unique,
 614                  * so just allocate it and hook it in.
 615                  */
 616                 MALLOC(sp, sessp, sizeof(*sp), M_NETGRAPH_PPPOE, M_NOWAIT | M_ZERO);
 617                 if (sp == NULL) {
 618                                 return (ENOMEM);
 619                 }
 620
 621                 NG_HOOK_SET_PRIVATE(hook, sp);
 622                 sp->hook = hook;
 623         }
 624         return(0);
 625 }
 626
 627 /*
 628  * Get a netgraph control message.
 629  * Check it is one we understand. If needed, send a response.
 630  * We sometimes save the address for an async action later.
 631  * Always free the message.
 632  */
 633 static int
 634 ng_pppoe_rcvmsg(node_p node, item_p item, hook_p lasthook)
 635 {
 636         priv_p privp = NG_NODE_PRIVATE(node);
 637         struct ngpppoe_init_data *ourmsg = NULL;
 638         struct ng_mesg *resp = NULL;
 639         int error = 0;
 640         hook_p hook = NULL;
 641         sessp sp = NULL;
 642         negp neg = NULL;
 643         struct ng_mesg *msg;
 644
 645 AAA
 646         NGI_GET_MSG(item, msg);
 647         /* Deal with message according to cookie and command */
 648         switch (msg->header.typecookie) {
 649         case NGM_PPPOE_COOKIE:
 650                 switch (msg->header.cmd) {
 651                 case NGM_PPPOE_CONNECT:
 652                 case NGM_PPPOE_LISTEN:
 653                 case NGM_PPPOE_OFFER:
 654                 case NGM_PPPOE_SERVICE:
 655                         ourmsg = (struct ngpppoe_init_data *)msg->data;
 656                         if (msg->header.arglen < sizeof(*ourmsg)) {
 657                                 printf("pppoe: init data too small\n");
 658                                 LEAVE(EMSGSIZE);
 659                         }
 660                         if (msg->header.arglen - sizeof(*ourmsg) >
 661                             PPPOE_SERVICE_NAME_SIZE) {
 662                                 printf("pppoe_rcvmsg: service name too big");
 663                                 LEAVE(EMSGSIZE);
 664                         }
 665                         if (msg->header.arglen - sizeof(*ourmsg) <
 666                             ourmsg->data_len) {
 667                                 printf("pppoe: init data has bad length,"
 668                                     " %d should be %d\n", ourmsg->data_len,
 669                                     msg->header.arglen - sizeof (*ourmsg));
 670                                 LEAVE(EMSGSIZE);
 671                         }
 672
 673                         /* make sure strcmp will terminate safely */
 674                         ourmsg->hook[sizeof(ourmsg->hook) - 1] = '\0';
 675
 676                         /* cycle through all known hooks */
 677                         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 678                                 if (NG_HOOK_NAME(hook)
 679                                 && strcmp(NG_HOOK_NAME(hook), ourmsg->hook) == 0)
 680                                         break;
 681                         }
 682                         if (hook == NULL) {
 683                                 LEAVE(ENOENT);
 684                         }
 685                         if ((NG_HOOK_PRIVATE(hook) == &privp->debug_hook)
 686                         ||  (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook)) {
 687                                 LEAVE(EINVAL);
 688                         }
 689                         sp = NG_HOOK_PRIVATE(hook);
 690
 691                         if (msg->header.cmd == NGM_PPPOE_LISTEN) {
 692                                 /*
 693                                  * Ensure we aren't already listening for this
 694                                  * service.
 695                                  */
 696                                 if (pppoe_match_svc(node, ourmsg->data,
 697                                     ourmsg->data_len, NG_MATCH_EXACT) != NULL) {
 698                                         LEAVE(EEXIST);
 699                                 }
 700                         }
 701
 702                         /*
 703                          * PPPOE_SERVICE advertisments are set up
 704                          * on sessions that are in PRIMED state.
 705                          */
 706                         if (msg->header.cmd == NGM_PPPOE_SERVICE) {
 707                                 break;
 708                         }
 709                         if (sp->state |= PPPOE_SNONE) {
 710                                 printf("pppoe: Session already active\n");
 711                                 LEAVE(EISCONN);
 712                         }
 713
 714                         /*
 715                          * set up prototype header
 716                          */
 717                         MALLOC(neg, negp, sizeof(*neg), M_NETGRAPH_PPPOE,
 718                             M_NOWAIT | M_ZERO);
 719
 720                         if (neg == NULL) {
 721                                 printf("pppoe: Session out of memory\n");
 722                                 LEAVE(ENOMEM);
 723                         }
 724                         MGETHDR(neg->m, M_DONTWAIT, MT_DATA);
 725                         if(neg->m == NULL) {
 726                                 printf("pppoe: Session out of mbufs\n");
 727                                 FREE(neg, M_NETGRAPH_PPPOE);
 728                                 LEAVE(ENOBUFS);
 729                         }
 730                         neg->m->m_pkthdr.rcvif = NULL;
 731                         MCLGET(neg->m, M_DONTWAIT);
 732                         if ((neg->m->m_flags & M_EXT) == 0) {
 733                                 printf("pppoe: Session out of mcls\n");
 734                                 m_freem(neg->m);
 735                                 FREE(neg, M_NETGRAPH_PPPOE);
 736                                 LEAVE(ENOBUFS);
 737                         }
 738                         sp->neg = neg;
 739                         callout_handle_init( &neg->timeout_handle);
 740                         neg->m->m_len = sizeof(struct pppoe_full_hdr);
 741                         neg->pkt = mtod(neg->m, union packet*);
 742                         neg->pkt->pkt_header.eh = eh_prototype;
 743                         neg->pkt->pkt_header.ph.ver = 0x1;
 744                         neg->pkt->pkt_header.ph.type = 0x1;
 745                         neg->pkt->pkt_header.ph.sid = 0x0000;
 746                         neg->timeout = 0;
 747
 748                         sp->creator = NGI_RETADDR(item);
 749                 }
 750                 switch (msg->header.cmd) {
 751                 case NGM_PPPOE_GET_STATUS:
 752                     {
 753                         struct ngpppoestat *stats;
 754
 755                         NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
 756                         if (!resp) {
 757                                 LEAVE(ENOMEM);
 758                         }
 759                         stats = (struct ngpppoestat *) resp->data;
 760                         stats->packets_in = privp->packets_in;
 761                         stats->packets_out = privp->packets_out;
 762                         break;
 763                     }
 764                 case NGM_PPPOE_CONNECT:
 765                         /*
 766                          * Check the hook exists and is Uninitialised.
 767                          * Send a PADI request, and start the timeout logic.
 768                          * Store the originator of this message so we can send
 769                          * a success of fail message to them later.
 770                          * Move the session to SINIT
 771                          * Set up the session to the correct state and
 772                          * start it.
 773                          */
 774                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 775                         neg->service.hdr.tag_len =
 776                             htons((u_int16_t)ourmsg->data_len);
 777                         if (ourmsg->data_len)
 778                                 bcopy(ourmsg->data, neg->service.data,
 779                                     ourmsg->data_len);
 780                         neg->service_len = ourmsg->data_len;
 781                         pppoe_start(sp);
 782                         break;
 783                 case NGM_PPPOE_LISTEN:
 784                         /*
 785                          * Check the hook exists and is Uninitialised.
 786                          * Install the service matching string.
 787                          * Store the originator of this message so we can send
 788                          * a success of fail message to them later.
 789                          * Move the hook to 'LISTENING'
 790                          */
 791                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 792                         neg->service.hdr.tag_len =
 793                             htons((u_int16_t)ourmsg->data_len);
 794
 795                         if (ourmsg->data_len)
 796                                 bcopy(ourmsg->data, neg->service.data,
 797                                     ourmsg->data_len);
 798                         neg->service_len = ourmsg->data_len;
 799                         neg->pkt->pkt_header.ph.code = PADT_CODE;
 800                         /*
 801                          * wait for PADI packet coming from ethernet
 802                          */
 803                         sp->state = PPPOE_LISTENING;
 804                         break;
 805                 case NGM_PPPOE_OFFER:
 806                         /*
 807                          * Check the hook exists and is Uninitialised.
 808                          * Store the originator of this message so we can send
 809                          * a success of fail message to them later.
 810                          * Store the AC-Name given and go to PRIMED.
 811                          */
 812                         neg->ac_name.hdr.tag_type = PTT_AC_NAME;
 813                         neg->ac_name.hdr.tag_len =
 814                             htons((u_int16_t)ourmsg->data_len);
 815                         if (ourmsg->data_len)
 816                                 bcopy(ourmsg->data, neg->ac_name.data,
 817                                     ourmsg->data_len);
 818                         neg->ac_name_len = ourmsg->data_len;
 819                         neg->pkt->pkt_header.ph.code = PADO_CODE;
 820                         /*
 821                          * Wait for PADI packet coming from hook
 822                          */
 823                         sp->state = PPPOE_PRIMED;
 824                         break;
 825                 case NGM_PPPOE_SERVICE:
 826                         /*
 827                          * Check the session is primed.
 828                          * for now just allow ONE service to be advertised.
 829                          * If you do it twice you just overwrite.
 830                          */
 831                         if (sp->state != PPPOE_PRIMED) {
 832                                 printf("pppoe: Session not primed\n");
 833                                 LEAVE(EISCONN);
 834                         }
 835                         neg = sp->neg;
 836                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 837                         neg->service.hdr.tag_len =
 838                             htons((u_int16_t)ourmsg->data_len);
 839
 840                         if (ourmsg->data_len)
 841                                 bcopy(ourmsg->data, neg->service.data,
 842                                     ourmsg->data_len);
 843                         neg->service_len = ourmsg->data_len;
 844                         break;
 845                 default:
 846                         LEAVE(EINVAL);
 847                 }
 848                 break;
 849         default:
 850                 LEAVE(EINVAL);
 851         }
 852
 853         /* Take care of synchronous response, if any */
 854 quit:
 855         NG_RESPOND_MSG(error, node, item, resp);
 856         /* Free the message and return */
 857         NG_FREE_MSG(msg);
 858         return(error);
 859 }
 860
 861 /*
 862  * Start a client into the first state. A separate function because
 863  * it can be needed if the negotiation times out.
 864  */
 865 static void
 866 pppoe_start(sessp sp)
 867 {
 868         struct {
 869                 struct pppoe_tag hdr;
 870                 union   uniq    data;
 871         } __attribute ((packed)) uniqtag;
 872
 873         /*
 874          * kick the state machine into starting up
 875          */
 876 AAA
 877         sp->state = PPPOE_SINIT;
 878         /* reset the packet header to broadcast */
 879         sp->neg->pkt->pkt_header.eh = eh_prototype;
 880         sp->neg->pkt->pkt_header.ph.code = PADI_CODE;
 881         uniqtag.hdr.tag_type = PTT_HOST_UNIQ;
 882         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(uniqtag.data));
 883         uniqtag.data.pointer = sp;
 884         init_tags(sp);
 885         insert_tag(sp, &uniqtag.hdr);
 886         insert_tag(sp, &sp->neg->service.hdr);
 887         make_packet(sp);
 888         sendpacket(sp);
 889 }
 890
 891 static int
 892 send_acname(sessp sp, struct pppoe_tag *tag)
 893 {
 894         int error;
 895         struct ng_mesg *msg;
 896         struct ngpppoe_sts *sts;
 897
 898         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_ACNAME,
 899             sizeof(struct ngpppoe_sts), M_NOWAIT);
 900         if (msg == NULL)
 901                 return (ENOMEM);
 902
 903         sts = (struct ngpppoe_sts *)msg->data;
 904         strncpy(sts->hook, tag->tag_data,
 905             min(NG_HOOKLEN + 1, ntohs(tag->tag_len)));
 906         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
 907
 908         return (error);
 909 }
 910
 911 static int
 912 send_sessionid(sessp sp)
 913 {
 914         int error;
 915         struct ng_mesg *msg;
 916
 917         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_SESSIONID,
 918             sizeof(u_int16_t), M_NOWAIT);
 919         if (msg == NULL)
 920                 return (ENOMEM);
 921
 922         *(u_int16_t *)msg->data = sp->Session_ID;
 923         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
 924
 925         return (error);
 926 }
 927
 928 /*
 929  * Receive data, and do something with it.
 930  * The caller will never free m or meta, so
 931  * if we use up this data or abort we must free BOTH of these.
 932  */
 933 static int
 934 ng_pppoe_rcvdata(hook_p hook, item_p item)
 935 {
 936         node_p                  node = NG_HOOK_NODE(hook);
 937         const priv_p            privp = NG_NODE_PRIVATE(node);
 938         sessp                   sp = NG_HOOK_PRIVATE(hook);
 939         struct pppoe_full_hdr   *wh;
 940         struct pppoe_hdr        *ph;
 941         int                     error = 0;
 942         u_int16_t               session;
 943         u_int16_t               length;
 944         u_int8_t                code;
 945         struct pppoe_tag        *utag = NULL, *tag = NULL;
 946         hook_p                  sendhook;
 947         struct {
 948                 struct pppoe_tag hdr;
 949                 union   uniq    data;
 950         } __attribute ((packed)) uniqtag;
 951         negp                    neg = NULL;
 952         struct mbuf             *m;
 953
 954 AAA
 955         NGI_GET_M(item, m);
 956         if (NG_HOOK_PRIVATE(hook) == &privp->debug_hook) {
 957                 /*
 958                  * Data from the debug hook gets sent without modification
 959                  * straight to the ethernet.
 960                  */
 961                 NG_FWD_ITEM_HOOK( error, item, privp->ethernet_hook);
 962                 privp->packets_out++;
 963         } else if (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook) {
 964                 /*
 965                  * Incoming data.
 966                  * Dig out various fields from the packet.
 967                  * use them to decide where to send it.
 968                  */
 969
 970                 privp->packets_in++;
 971                 if( m->m_len < sizeof(*wh)) {
 972                         m = m_pullup(m, sizeof(*wh)); /* Checks length */
 973                         if (m == NULL) {
 974                                 printf("couldn't m_pullup\n");
 975                                 LEAVE(ENOBUFS);
 976                         }
 977                 }
 978                 wh = mtod(m, struct pppoe_full_hdr *);
 979                 length = ntohs(wh->ph.length);
 980                 switch(wh->eh.ether_type) {
 981                 case    ETHERTYPE_PPPOE_STUPID_DISC:
 982                         nonstandard = 1;
 983                         eh_prototype.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
 984                         /* fall through */
 985                 case    ETHERTYPE_PPPOE_DISC:
 986                         /*
 987                          * We need to try to make sure that the tag area
 988                          * is contiguous, or we could wander off the end
 989                          * of a buffer and make a mess.
 990                          * (Linux wouldn't have this problem).
 991                          */
 992                         if (m->m_pkthdr.len <= MHLEN) {
 993                                 if( m->m_len < m->m_pkthdr.len) {
 994                                         m = m_pullup(m, m->m_pkthdr.len);
 995                                         if (m == NULL) {
 996                                                 printf("couldn't m_pullup\n");
 997                                                 LEAVE(ENOBUFS);
 998                                         }
 999                                 }
1000                         }
1001                         if (m->m_len != m->m_pkthdr.len) {
1002                                 /*
1003                                  * It's not all in one piece.
1004                                  * We need to do extra work.
1005                                  * Put it into a cluster.
1006                                  */
1007                                 struct mbuf *n;
1008                                 n = m_dup(m, M_DONTWAIT);
1009                                 m_freem(m);
1010                                 m = n;
1011                                 if (m) {
1012                                         /* just check we got a cluster */
1013                                         if (m->m_len != m->m_pkthdr.len) {
1014                                                 m_freem(m);
1015                                                 m = NULL;
1016                                         }
1017                                 }
1018                                 if (m == NULL) {
1019                                         printf("packet fragmented\n");
1020                                         LEAVE(EMSGSIZE);
1021                                 }
1022                         }
1023                         wh = mtod(m, struct pppoe_full_hdr *);
1024                         length = ntohs(wh->ph.length);
1025                         ph = &wh->ph;
1026                         session = ntohs(wh->ph.sid);
1027                         code = wh->ph.code;
1028
1029                         switch(code) {
1030                         case    PADI_CODE:
1031                                 /*
1032                                  * We are a server:
1033                                  * Look for a hook with the required service
1034                                  * and send the ENTIRE packet up there.
1035                                  * It should come back to a new hook in
1036                                  * PRIMED state. Look there for further
1037                                  * processing.
1038                                  */
1039                                 tag = get_tag(ph, PTT_SRV_NAME);
1040                                 if (tag == NULL) {
1041                                         printf("no service tag\n");
1042                                         LEAVE(ENETUNREACH);
1043                                 }
1044                                 sendhook = pppoe_match_svc(NG_HOOK_NODE(hook),
1045                                         tag->tag_data, ntohs(tag->tag_len),
1046                                         NG_MATCH_ANY);
1047                                 if (sendhook) {
1048                                         NG_FWD_NEW_DATA(error, item,
1049                                                                 sendhook, m);
1050                                 } else {
1051                                         LEAVE(ENETUNREACH);
1052                                 }
1053                                 break;
1054                         case    PADO_CODE:
1055                                 /*
1056                                  * We are a client:
1057                                  * Use the host_uniq tag to find the
1058                                  * hook this is in response to.
1059                                  * Received #2, now send #3
1060                                  * For now simply accept the first we receive.
1061                                  */
1062                                 utag = get_tag(ph, PTT_HOST_UNIQ);
1063                                 if ((utag == NULL)
1064                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1065                                         printf("no host unique field\n");
1066                                         LEAVE(ENETUNREACH);
1067                                 }
1068
1069                                 sendhook = pppoe_finduniq(node, utag);
1070                                 if (sendhook == NULL) {
1071                                         printf("no matching session\n");
1072                                         LEAVE(ENETUNREACH);
1073                                 }
1074
1075                                 /*
1076                                  * Check the session is in the right state.
1077                                  * It needs to be in PPPOE_SINIT.
1078                                  */
1079                                 sp = NG_HOOK_PRIVATE(sendhook);
1080                                 if (sp->state != PPPOE_SINIT) {
1081                                         printf("session in wrong state\n");
1082                                         LEAVE(ENETUNREACH);
1083                                 }
1084                                 neg = sp->neg;
1085                                 untimeout(pppoe_ticker, sendhook,
1086                                     neg->timeout_handle);
1087
1088                                 /*
1089                                  * This is the first time we hear
1090                                  * from the server, so note it's
1091                                  * unicast address, replacing the
1092                                  * broadcast address .
1093                                  */
1094                                 bcopy(wh->eh.ether_shost,
1095                                         neg->pkt->pkt_header.eh.ether_dhost,
1096                                         ETHER_ADDR_LEN);
1097                                 neg->timeout = 0;
1098                                 neg->pkt->pkt_header.ph.code = PADR_CODE;
1099                                 init_tags(sp);
1100                                 insert_tag(sp, utag);      /* Host Unique */
1101                                 if ((tag = get_tag(ph, PTT_AC_COOKIE)))
1102                                         insert_tag(sp, tag); /* return cookie */
1103                                 if ((tag = get_tag(ph, PTT_AC_NAME))) {
1104                                         insert_tag(sp, tag); /* return it */
1105                                         send_acname(sp, tag);
1106                                 }
1107                                 insert_tag(sp, &neg->service.hdr); /* Service */
1108                                 scan_tags(sp, ph);
1109                                 make_packet(sp);
1110                                 sp->state = PPPOE_SREQ;
1111                                 sendpacket(sp);
1112                                 break;
1113                         case    PADR_CODE:
1114
1115                                 /*
1116                                  * We are a server:
1117                                  * Use the ac_cookie tag to find the
1118                                  * hook this is in response to.
1119                                  */
1120                                 utag = get_tag(ph, PTT_AC_COOKIE);
1121                                 if ((utag == NULL)
1122                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1123                                         LEAVE(ENETUNREACH);
1124                                 }
1125
1126                                 sendhook = pppoe_finduniq(node, utag);
1127                                 if (sendhook == NULL) {
1128                                         LEAVE(ENETUNREACH);
1129                                 }
1130
1131                                 /*
1132                                  * Check the session is in the right state.
1133                                  * It needs to be in PPPOE_SOFFER
1134                                  * or PPPOE_NEWCONNECTED. If the latter,
1135                                  * then this is a retry by the client.
1136                                  * so be nice, and resend.
1137                                  */
1138                                 sp = NG_HOOK_PRIVATE(sendhook);
1139                                 if (sp->state == PPPOE_NEWCONNECTED) {
1140                                         /*
1141                                          * Whoa! drop back to resend that
1142                                          * PADS packet.
1143                                          * We should still have a copy of it.
1144                                          */
1145                                         sp->state = PPPOE_SOFFER;
1146                                 }
1147                                 if (sp->state != PPPOE_SOFFER) {
1148                                         LEAVE (ENETUNREACH);
1149                                         break;
1150                                 }
1151                                 neg = sp->neg;
1152                                 untimeout(pppoe_ticker, sendhook,
1153                                     neg->timeout_handle);
1154                                 neg->pkt->pkt_header.ph.code = PADS_CODE;
1155                                 if (sp->Session_ID == 0)
1156                                         neg->pkt->pkt_header.ph.sid =
1157                                             htons(sp->Session_ID
1158                                                 = get_new_sid(node));
1159                                 send_sessionid(sp);
1160                                 neg->timeout = 0;
1161                                 /*
1162                                  * start working out the tags to respond with.
1163                                  */
1164                                 init_tags(sp);
1165                                 insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1166                                 if ((tag = get_tag(ph, PTT_SRV_NAME)))
1167                                         insert_tag(sp, tag);/* return service */
1168                                 if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1169                                         insert_tag(sp, tag); /* return it */
1170                                 insert_tag(sp, utag);   /* ac_cookie */
1171                                 scan_tags(sp, ph);
1172                                 make_packet(sp);
1173                                 sp->state = PPPOE_NEWCONNECTED;
1174                                 sendpacket(sp);
1175                                 /*
1176                                  * Having sent the last Negotiation header,
1177                                  * Set up the stored packet header to
1178                                  * be correct for the actual session.
1179                                  * But keep the negotialtion stuff
1180                                  * around in case we need to resend this last
1181                                  * packet. We'll discard it when we move
1182                                  * from NEWCONNECTED to CONNECTED
1183                                  */
1184                                 sp->pkt_hdr = neg->pkt->pkt_header;
1185                                 if (nonstandard)
1186                                         sp->pkt_hdr.eh.ether_type
1187                                                 = ETHERTYPE_PPPOE_STUPID_SESS;
1188                                 else
1189                                         sp->pkt_hdr.eh.ether_type
1190                                                 = ETHERTYPE_PPPOE_SESS;
1191                                 sp->pkt_hdr.ph.code = 0;
1192                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1193                                 break;
1194                         case    PADS_CODE:
1195                                 /*
1196                                  * We are a client:
1197                                  * Use the host_uniq tag to find the
1198                                  * hook this is in response to.
1199                                  * take the session ID and store it away.
1200                                  * Also make sure the pre-made header is
1201                                  * correct and set us into Session mode.
1202                                  */
1203                                 utag = get_tag(ph, PTT_HOST_UNIQ);
1204                                 if ((utag == NULL)
1205                                 || (ntohs(utag->tag_len) != sizeof(sp))) {
1206                                         LEAVE (ENETUNREACH);
1207                                         break;
1208                                 }
1209                                 sendhook = pppoe_finduniq(node, utag);
1210                                 if (sendhook == NULL) {
1211                                         LEAVE(ENETUNREACH);
1212                                 }
1213
1214                                 /*
1215                                  * Check the session is in the right state.
1216                                  * It needs to be in PPPOE_SREQ.
1217                                  */
1218                                 sp = NG_HOOK_PRIVATE(sendhook);
1219                                 if (sp->state != PPPOE_SREQ) {
1220                                         LEAVE(ENETUNREACH);
1221                                 }
1222                                 neg = sp->neg;
1223                                 untimeout(pppoe_ticker, sendhook,
1224                                     neg->timeout_handle);
1225                                 neg->pkt->pkt_header.ph.sid = wh->ph.sid;
1226                                 sp->Session_ID = ntohs(wh->ph.sid);
1227                                 send_sessionid(sp);
1228                                 neg->timeout = 0;
1229                                 sp->state = PPPOE_CONNECTED;
1230                                 /*
1231                                  * Now we have gone to Connected mode,
1232                                  * Free all resources needed for
1233                                  * negotiation.
1234                                  * Keep a copy of the header we will be using.
1235                                  */
1236                                 sp->pkt_hdr = neg->pkt->pkt_header;
1237                                 if (nonstandard)
1238                                         sp->pkt_hdr.eh.ether_type
1239                                                 = ETHERTYPE_PPPOE_STUPID_SESS;
1240                                 else
1241                                         sp->pkt_hdr.eh.ether_type
1242                                                 = ETHERTYPE_PPPOE_SESS;
1243                                 sp->pkt_hdr.ph.code = 0;
1244                                 m_freem(neg->m);
1245                                 FREE(sp->neg, M_NETGRAPH_PPPOE);
1246                                 sp->neg = NULL;
1247                                 pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1248                                 break;
1249                         case    PADT_CODE:
1250                                 /*
1251                                  * Send a 'close' message to the controlling
1252                                  * process (the one that set us up);
1253                                  * And then tear everything down.
1254                                  *
1255                                  * Find matching peer/session combination.
1256                                  */
1257                                 sendhook = pppoe_findsession(node, wh);
1258                                 if (sendhook == NULL) {
1259                                         LEAVE(ENETUNREACH);
1260                                 }
1261                                 /* send message to creator */
1262                                 /* close hook */
1263                                 if (sendhook) {
1264                                         ng_rmhook_self(sendhook);
1265                                 }
1266                                 break;
1267                         default:
1268                                 LEAVE(EPFNOSUPPORT);
1269                         }
1270                         break;
1271                 case    ETHERTYPE_PPPOE_STUPID_SESS:
1272                 case    ETHERTYPE_PPPOE_SESS:
1273                         /*
1274                          * find matching peer/session combination.
1275                          */
1276                         sendhook = pppoe_findsession(node, wh);
1277                         if (sendhook == NULL) {
1278                                 LEAVE (ENETUNREACH);
1279                                 break;
1280                         }
1281                         sp = NG_HOOK_PRIVATE(sendhook);
1282                         m_adj(m, sizeof(*wh));
1283                         if (m->m_pkthdr.len < length) {
1284                                 /* Packet too short, dump it */
1285                                 LEAVE(EMSGSIZE);
1286                         }
1287
1288                         /* Also need to trim excess at the end */
1289                         if (m->m_pkthdr.len > length) {
1290                                 m_adj(m, -((int)(m->m_pkthdr.len - length)));
1291                         }
1292                         if ( sp->state != PPPOE_CONNECTED) {
1293                                 if (sp->state == PPPOE_NEWCONNECTED) {
1294                                         sp->state = PPPOE_CONNECTED;
1295                                         /*
1296                                          * Now we have gone to Connected mode,
1297                                          * Free all resources needed for
1298                                          * negotiation. Be paranoid about
1299                                          * whether there may be a timeout.
1300                                          */
1301                                         m_freem(sp->neg->m);
1302                                         untimeout(pppoe_ticker, sendhook,
1303                                                 sp->neg->timeout_handle);
1304                                         FREE(sp->neg, M_NETGRAPH_PPPOE);
1305                                         sp->neg = NULL;
1306                                 } else {
1307                                         LEAVE (ENETUNREACH);
1308                                         break;
1309                                 }
1310                         }
1311                         NG_FWD_NEW_DATA( error, item, sendhook, m);
1312                         break;
1313                 default:
1314                         LEAVE(EPFNOSUPPORT);
1315                 }
1316         } else {
1317                 /*
1318                  *      Not ethernet or debug hook..
1319                  *
1320                  * The packet has come in on a normal hook.
1321                  * We need to find out what kind of hook,
1322                  * So we can decide how to handle it.
1323                  * Check the hook's state.
1324                  */
1325                 sp = NG_HOOK_PRIVATE(hook);
1326                 switch (sp->state) {
1327                 case    PPPOE_NEWCONNECTED:
1328                 case    PPPOE_CONNECTED: {
1329                         static const u_char addrctrl[] = { 0xff, 0x03 };
1330                         struct pppoe_full_hdr *wh;
1331
1332                         /*
1333                          * Remove PPP address and control fields, if any.
1334                          * For example, ng_ppp(4) always sends LCP packets
1335                          * with address and control fields as required by
1336                          * generic PPP. PPPoE is an exception to the rule.
1337                          */
1338                         if (m->m_pkthdr.len >= 2) {
1339                                 if (m->m_len < 2 && !(m = m_pullup(m, 2)))
1340                                         LEAVE(ENOBUFS);
1341                                 if (bcmp(mtod(m, u_char *), addrctrl, 2) == 0)
1342                                         m_adj(m, 2);
1343                         }
1344                         /*
1345                          * Bang in a pre-made header, and set the length up
1346                          * to be correct. Then send it to the ethernet driver.
1347                          * But first correct the length.
1348                          */
1349                         sp->pkt_hdr.ph.length = htons((short)(m->m_pkthdr.len));
1350                         M_PREPEND(m, sizeof(*wh), M_DONTWAIT);
1351                         if (m == NULL) {
1352                                 LEAVE(ENOBUFS);
1353                         }
1354                         wh = mtod(m, struct pppoe_full_hdr *);
1355                         bcopy(&sp->pkt_hdr, wh, sizeof(*wh));
1356                         NG_FWD_NEW_DATA( error, item, privp->ethernet_hook, m);
1357                         privp->packets_out++;
1358                         break;
1359                         }
1360                 case    PPPOE_PRIMED:
1361                         /*
1362                          * A PADI packet is being returned by the application
1363                          * that has set up this hook. This indicates that it
1364                          * wants us to offer service.
1365                          */
1366                         neg = sp->neg;
1367                         if (m->m_len < sizeof(*wh)) {
1368                                 m = m_pullup(m, sizeof(*wh));
1369                                 if (m == NULL) {
1370                                         LEAVE(ENOBUFS);
1371                                 }
1372                         }
1373                         wh = mtod(m, struct pppoe_full_hdr *);
1374                         ph = &wh->ph;
1375                         session = ntohs(wh->ph.sid);
1376                         length = ntohs(wh->ph.length);
1377                         code = wh->ph.code;
1378                         if ( code != PADI_CODE) {
1379                                 LEAVE(EINVAL);
1380                         };
1381                         untimeout(pppoe_ticker, hook,
1382                                     neg->timeout_handle);
1383
1384                         /*
1385                          * This is the first time we hear
1386                          * from the client, so note it's
1387                          * unicast address, replacing the
1388                          * broadcast address.
1389                          */
1390                         bcopy(wh->eh.ether_shost,
1391                                 neg->pkt->pkt_header.eh.ether_dhost,
1392                                 ETHER_ADDR_LEN);
1393                         sp->state = PPPOE_SOFFER;
1394                         neg->timeout = 0;
1395                         neg->pkt->pkt_header.ph.code = PADO_CODE;
1396
1397                         /*
1398                          * start working out the tags to respond with.
1399                          */
1400                         uniqtag.hdr.tag_type = PTT_AC_COOKIE;
1401                         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(sp));
1402                         uniqtag.data.pointer = sp;
1403                         init_tags(sp);
1404                         insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1405                         if ((tag = get_tag(ph, PTT_SRV_NAME)))
1406                                 insert_tag(sp, tag);      /* return service */
1407                         /*
1408                          * If we have a NULL service request
1409                          * and have an extra service defined in this hook,
1410                          * then also add a tag for the extra service.
1411                          * XXX this is a hack. eventually we should be able
1412                          * to support advertising many services, not just one
1413                          */
1414                         if (((tag == NULL) || (tag->tag_len == 0))
1415                         && (neg->service.hdr.tag_len != 0)) {
1416                                 insert_tag(sp, &neg->service.hdr); /* SERVICE */
1417                         }
1418                         if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1419                                 insert_tag(sp, tag); /* returned hostunique */
1420                         insert_tag(sp, &uniqtag.hdr);
1421                         scan_tags(sp, ph);
1422                         make_packet(sp);
1423                         sendpacket(sp);
1424                         break;
1425
1426                 /*
1427                  * Packets coming from the hook make no sense
1428                  * to sessions in these states. Throw them away.
1429                  */
1430                 case    PPPOE_SINIT:
1431                 case    PPPOE_SREQ:
1432                 case    PPPOE_SOFFER:
1433                 case    PPPOE_SNONE:
1434                 case    PPPOE_LISTENING:
1435                 case    PPPOE_DEAD:
1436                 default:
1437                         LEAVE(ENETUNREACH);
1438                 }
1439         }
1440 quit:
1441         if (item)
1442                 NG_FREE_ITEM(item);
1443         NG_FREE_M(m);
1444         return error;
1445 }
1446
1447 /*
1448  * Do local shutdown processing..
1449  * If we are a persistant device, we might refuse to go away, and
1450  * we'd only remove our links and reset ourself.
1451  */
1452 static int
1453 ng_pppoe_shutdown(node_p node)
1454 {
1455         const priv_p privdata = NG_NODE_PRIVATE(node);
1456
1457 AAA
1458         NG_NODE_SET_PRIVATE(node, NULL);
1459         NG_NODE_UNREF(privdata->node);
1460         FREE(privdata, M_NETGRAPH_PPPOE);
1461         return (0);
1462 }
1463
1464 /*
1465  * This is called once we've already connected a new hook to the other node.
1466  * It gives us a chance to balk at the last minute.
1467  */
1468 static int
1469 ng_pppoe_connect(hook_p hook)
1470 {
1471         /* be really amiable and just say "YUP that's OK by me! " */
1472         return (0);
1473 }
1474
1475 /*
1476  * Hook disconnection
1477  *
1478  * Clean up all dangling links and information about the session/hook.
1479  * For this type, removal of the last link destroys the node
1480  */
1481 static int
1482 ng_pppoe_disconnect(hook_p hook)
1483 {
1484         node_p node = NG_HOOK_NODE(hook);
1485         priv_p privp = NG_NODE_PRIVATE(node);
1486         sessp   sp;
1487         int     hooks;
1488
1489 AAA
1490         hooks = NG_NODE_NUMHOOKS(node); /* this one already not counted */
1491         if (NG_HOOK_PRIVATE(hook) == &privp->debug_hook) {
1492                 privp->debug_hook = NULL;
1493         } else if (NG_HOOK_PRIVATE(hook) == &privp->ethernet_hook) {
1494                 privp->ethernet_hook = NULL;
1495                 if (NG_NODE_IS_VALID(node))
1496                         ng_rmnode_self(node);
1497         } else {
1498                 sp = NG_HOOK_PRIVATE(hook);
1499                 if (sp->state != PPPOE_SNONE ) {
1500                         pppoe_send_event(sp, NGM_PPPOE_CLOSE);
1501                 }
1502                 /*
1503                  * According to the spec, if we are connected,
1504                  * we should send a DISC packet if we are shutting down
1505                  * a session.
1506                  */
1507                 if ((privp->ethernet_hook)
1508                 && ((sp->state == PPPOE_CONNECTED)
1509                  || (sp->state == PPPOE_NEWCONNECTED))) {
1510                         struct mbuf *m;
1511                         struct pppoe_full_hdr *wh;
1512                         struct pppoe_tag *tag;
1513                         int     msglen = strlen(SIGNOFF);
1514                         int error = 0;
1515
1516                         /* revert the stored header to DISC/PADT mode */
1517                         wh = &sp->pkt_hdr;
1518                         wh->ph.code = PADT_CODE;
1519                         if (nonstandard)
1520                                 wh->eh.ether_type = ETHERTYPE_PPPOE_STUPID_DISC;
1521                         else
1522                                 wh->eh.ether_type = ETHERTYPE_PPPOE_DISC;
1523
1524                         /* generate a packet of that type */
1525                         MGETHDR(m, M_DONTWAIT, MT_DATA);
1526                         if(m == NULL)
1527                                 printf("pppoe: Session out of mbufs\n");
1528                         else {
1529                                 m->m_pkthdr.rcvif = NULL;
1530                                 m->m_pkthdr.len = m->m_len = sizeof(*wh);
1531                                 bcopy((caddr_t)wh, mtod(m, caddr_t),
1532                                     sizeof(*wh));
1533                                 /*
1534                                  * Add a General error message and adjust
1535                                  * sizes
1536                                  */
1537                                 wh = mtod(m, struct pppoe_full_hdr *);
1538                                 tag = wh->ph.tag;
1539                                 tag->tag_type = PTT_GEN_ERR;
1540                                 tag->tag_len = htons((u_int16_t)msglen);
1541                                 strncpy(tag->tag_data, SIGNOFF, msglen);
1542                                 m->m_pkthdr.len = (m->m_len += sizeof(*tag) +
1543                                     msglen);
1544                                 wh->ph.length = htons(sizeof(*tag) + msglen);
1545                                 NG_SEND_DATA_ONLY(error,
1546                                         privp->ethernet_hook, m);
1547                         }
1548                 }
1549                 /*
1550                  * As long as we have somewhere to store the timeout handle,
1551                  * we may have a timeout pending.. get rid of it.
1552                  */
1553                 if (sp->neg) {
1554                         untimeout(pppoe_ticker, hook, sp->neg->timeout_handle);
1555                         if (sp->neg->m)
1556                                 m_freem(sp->neg->m);
1557                         FREE(sp->neg, M_NETGRAPH_PPPOE);
1558                 }
1559                 FREE(sp, M_NETGRAPH_PPPOE);
1560                 NG_HOOK_SET_PRIVATE(hook, NULL);
1561                 /* work out how many session hooks there are */
1562                 /* Node goes away on last session hook removal */
1563                 if (privp->ethernet_hook) hooks -= 1;
1564                 if (privp->debug_hook) hooks -= 1;
1565         }
1566         if ((NG_NODE_NUMHOOKS(node) == 0)
1567         && (NG_NODE_IS_VALID(node)))
1568                 ng_rmnode_self(node);
1569         return (0);
1570 }
1571
1572 /*
1573  * timeouts come here.
1574  */
1575 static void
1576 pppoe_ticker(void *arg)
1577 {
1578         int s = splnet();
1579         hook_p hook = arg;
1580         sessp   sp = NG_HOOK_PRIVATE(hook);
1581         negp    neg = sp->neg;
1582         int     error = 0;
1583         struct mbuf *m0 = NULL;
1584         priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1585
1586 AAA
1587         switch(sp->state) {
1588                 /*
1589                  * resend the last packet, using an exponential backoff.
1590                  * After a period of time, stop growing the backoff,
1591                  * and either leave it, or revert to the start.
1592                  */
1593         case    PPPOE_SINIT:
1594         case    PPPOE_SREQ:
1595                 /* timeouts on these produce resends */
1596                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1597                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1598                 neg->timeout_handle = timeout(pppoe_ticker,
1599                                         hook, neg->timeout * hz);
1600                 if ((neg->timeout <<= 1) > PPPOE_TIMEOUT_LIMIT) {
1601                         if (sp->state == PPPOE_SREQ) {
1602                                 /* revert to SINIT mode */
1603                                 pppoe_start(sp);
1604                         } else {
1605                                 neg->timeout = PPPOE_TIMEOUT_LIMIT;
1606                         }
1607                 }
1608                 break;
1609         case    PPPOE_PRIMED:
1610         case    PPPOE_SOFFER:
1611                 /* a timeout on these says "give up" */
1612                 ng_rmhook_self(hook);
1613                 break;
1614         default:
1615                 /* timeouts have no meaning in other states */
1616                 printf("pppoe: unexpected timeout\n");
1617         }
1618         splx(s);
1619 }
1620
1621
1622 static void
1623 sendpacket(sessp sp)
1624 {
1625         int     error = 0;
1626         struct mbuf *m0 = NULL;
1627         hook_p hook = sp->hook;
1628         negp    neg = sp->neg;
1629         priv_p  privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1630
1631 AAA
1632         switch(sp->state) {
1633         case    PPPOE_LISTENING:
1634         case    PPPOE_DEAD:
1635         case    PPPOE_SNONE:
1636         case    PPPOE_CONNECTED:
1637                 printf("pppoe: sendpacket: unexpected state\n");
1638                 break;
1639
1640         case    PPPOE_NEWCONNECTED:
1641                 /* send the PADS without a timeout - we're now connected */
1642                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1643                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1644                 break;
1645
1646         case    PPPOE_PRIMED:
1647                 /* No packet to send, but set up the timeout */
1648                 neg->timeout_handle = timeout(pppoe_ticker,
1649                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1650                 break;
1651
1652         case    PPPOE_SOFFER:
1653                 /*
1654                  * send the offer but if they don't respond
1655                  * in PPPOE_OFFER_TIMEOUT seconds, forget about it.
1656                  */
1657                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1658                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1659                 neg->timeout_handle = timeout(pppoe_ticker,
1660                                         hook, PPPOE_OFFER_TIMEOUT * hz);
1661                 break;
1662
1663         case    PPPOE_SINIT:
1664         case    PPPOE_SREQ:
1665                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1666                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1667                 neg->timeout_handle = timeout(pppoe_ticker, hook,
1668                                         (hz * PPPOE_INITIAL_TIMEOUT));
1669                 neg->timeout = PPPOE_INITIAL_TIMEOUT * 2;
1670                 break;
1671
1672         default:
1673                 error = EINVAL;
1674                 printf("pppoe: timeout: bad state\n");
1675         }
1676         /* return (error); */
1677 }
1678
1679 /*
1680  * Parse an incoming packet to see if any tags should be copied to the
1681  * output packet. Don't do any tags that have been handled in the main
1682  * state machine.
1683  */
1684 static struct pppoe_tag*
1685 scan_tags(sessp sp, struct pppoe_hdr* ph)
1686 {
1687         char *end = (char *)next_tag(ph);
1688         char *ptn;
1689         struct pppoe_tag *pt = &ph->tag[0];
1690         /*
1691          * Keep processing tags while a tag header will still fit.
1692          */
1693 AAA
1694         while((char*)(pt + 1) <= end) {
1695                 /*
1696                  * If the tag data would go past the end of the packet, abort.
1697                  */
1698                 ptn = (((char *)(pt + 1)) + ntohs(pt->tag_len));
1699                 if(ptn > end)
1700                         return NULL;
1701
1702                 switch (pt->tag_type) {
1703                 case    PTT_RELAY_SID:
1704                         insert_tag(sp, pt);
1705                         break;
1706                 case    PTT_EOL:
1707                         return NULL;
1708                 case    PTT_SRV_NAME:
1709                 case    PTT_AC_NAME:
1710                 case    PTT_HOST_UNIQ:
1711                 case    PTT_AC_COOKIE:
1712                 case    PTT_VENDOR:
1713                 case    PTT_SRV_ERR:
1714                 case    PTT_SYS_ERR:
1715                 case    PTT_GEN_ERR:
1716                         break;
1717                 }
1718                 pt = (struct pppoe_tag*)ptn;
1719         }
1720         return NULL;
1721 }
1722
1723 static  int
1724 pppoe_send_event(sessp sp, enum cmd cmdid)
1725 {
1726         int error;
1727         struct ng_mesg *msg;
1728         struct ngpppoe_sts *sts;
1729
1730 AAA
1731         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, cmdid,
1732                         sizeof(struct ngpppoe_sts), M_NOWAIT);
1733         if (msg == NULL)
1734                 return (ENOMEM);
1735         sts = (struct ngpppoe_sts *)msg->data;
1736         strncpy(sts->hook, NG_HOOK_NAME(sp->hook), NG_HOOKLEN + 1);
1737         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, NULL);
1738         return (error);
1739 }