sys/netgraph7/ng_pppoe.c

   1 /*
   2  * ng_pppoe.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 1996-1999 Whistle Communications, Inc.
   7  * All rights reserved.
   8  *
   9  * Subject to the following obligations and disclaimer of warranty, use and
  10  * redistribution of this software, in source or object code forms, with or
  11  * without modifications are expressly permitted by Whistle Communications;
  12  * provided, however, that:
  13  * 1. Any and all reproductions of the source or object code must include the
  14  *    copyright notice above and the following disclaimer of warranties; and
  15  * 2. No rights are granted, in any manner or form, to use Whistle
  16  *    Communications, Inc. trademarks, including the mark "WHISTLE
  17  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
  18  *    such appears in the above copyright notice or in the software.
  19  *
  20  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
  21  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
  22  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
  23  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
  24  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
  25  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
  26  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
  27  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
  28  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
  29  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
  30  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
  31  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
  32  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
  33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  35  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
  36  * OF SUCH DAMAGE.
  37  *
  38  * Author: Julian Elischer <julian@freebsd.org>
  39  *
  40  * $FreeBSD: src/sys/netgraph/ng_pppoe.c,v 1.94 2008/03/03 19:36:03 mav Exp $
  41  * $Whistle: ng_pppoe.c,v 1.10 1999/11/01 09:24:52 julian Exp $
  42  */
  43
  44 #include <sys/param.h>
  45 #include <sys/systm.h>
  46 #include <sys/kernel.h>
  47 #include <sys/ktr.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/malloc.h>
  50 #include <sys/errno.h>
  51 #include <sys/syslog.h>
  52 #include <net/ethernet.h>
  53
  54 #include <netgraph/ng_message.h>
  55 #include <netgraph/netgraph.h>
  56 #include <netgraph/ng_parse.h>
  57 #include <netgraph/ng_pppoe.h>
  58 #include <netgraph/ng_ether.h>
  59
  60 #ifdef NG_SEPARATE_MALLOC
  61 MALLOC_DEFINE(M_NETGRAPH_PPPOE, "netgraph_pppoe", "netgraph pppoe node");
  62 #else
  63 #define M_NETGRAPH_PPPOE M_NETGRAPH
  64 #endif
  65
  66 #define SIGNOFF "session closed"
  67
  68 /*
  69  * This section contains the netgraph method declarations for the
  70  * pppoe node. These methods define the netgraph pppoe 'type'.
  71  */
  72
  73 static ng_constructor_t ng_pppoe_constructor;
  74 static ng_rcvmsg_t      ng_pppoe_rcvmsg;
  75 static ng_shutdown_t    ng_pppoe_shutdown;
  76 static ng_newhook_t     ng_pppoe_newhook;
  77 static ng_connect_t     ng_pppoe_connect;
  78 static ng_rcvdata_t     ng_pppoe_rcvdata;
  79 static ng_rcvdata_t     ng_pppoe_rcvdata_ether;
  80 static ng_rcvdata_t     ng_pppoe_rcvdata_debug;
  81 static ng_disconnect_t  ng_pppoe_disconnect;
  82
  83 /* Parse type for struct ngpppoe_init_data */
  84 static const struct ng_parse_struct_field ngpppoe_init_data_type_fields[]
  85         = NG_PPPOE_INIT_DATA_TYPE_INFO;
  86 static const struct ng_parse_type ngpppoe_init_data_state_type = {
  87         &ng_parse_struct_type,
  88         &ngpppoe_init_data_type_fields
  89 };
  90
  91 /* Parse type for struct ngpppoe_sts */
  92 static const struct ng_parse_struct_field ng_pppoe_sts_type_fields[]
  93         = NG_PPPOE_STS_TYPE_INFO;
  94 static const struct ng_parse_type ng_pppoe_sts_state_type = {
  95         &ng_parse_struct_type,
  96         &ng_pppoe_sts_type_fields
  97 };
  98
  99 /* List of commands and how to convert arguments to/from ASCII */
 100 static const struct ng_cmdlist ng_pppoe_cmds[] = {
 101         {
 102           NGM_PPPOE_COOKIE,
 103           NGM_PPPOE_CONNECT,
 104           "pppoe_connect",
 105           &ngpppoe_init_data_state_type,
 106           NULL
 107         },
 108         {
 109           NGM_PPPOE_COOKIE,
 110           NGM_PPPOE_LISTEN,
 111           "pppoe_listen",
 112           &ngpppoe_init_data_state_type,
 113           NULL
 114         },
 115         {
 116           NGM_PPPOE_COOKIE,
 117           NGM_PPPOE_OFFER,
 118           "pppoe_offer",
 119           &ngpppoe_init_data_state_type,
 120           NULL
 121         },
 122         {
 123           NGM_PPPOE_COOKIE,
 124           NGM_PPPOE_SERVICE,
 125           "pppoe_service",
 126           &ngpppoe_init_data_state_type,
 127           NULL
 128         },
 129         {
 130           NGM_PPPOE_COOKIE,
 131           NGM_PPPOE_SUCCESS,
 132           "pppoe_success",
 133           &ng_pppoe_sts_state_type,
 134           NULL
 135         },
 136         {
 137           NGM_PPPOE_COOKIE,
 138           NGM_PPPOE_FAIL,
 139           "pppoe_fail",
 140           &ng_pppoe_sts_state_type,
 141           NULL
 142         },
 143         {
 144           NGM_PPPOE_COOKIE,
 145           NGM_PPPOE_CLOSE,
 146           "pppoe_close",
 147           &ng_pppoe_sts_state_type,
 148           NULL
 149         },
 150         {
 151           NGM_PPPOE_COOKIE,
 152           NGM_PPPOE_SETMODE,
 153           "pppoe_setmode",
 154           &ng_parse_string_type,
 155           NULL
 156         },
 157         {
 158           NGM_PPPOE_COOKIE,
 159           NGM_PPPOE_GETMODE,
 160           "pppoe_getmode",
 161           NULL,
 162           &ng_parse_string_type
 163         },
 164         {
 165           NGM_PPPOE_COOKIE,
 166           NGM_PPPOE_SETENADDR,
 167           "setenaddr",
 168           &ng_parse_enaddr_type,
 169           NULL
 170         },
 171         { 0 }
 172 };
 173
 174 /* Netgraph node type descriptor */
 175 static struct ng_type typestruct = {
 176         .version =      NG_ABI_VERSION,
 177         .name =         NG_PPPOE_NODE_TYPE,
 178         .constructor =  ng_pppoe_constructor,
 179         .rcvmsg =       ng_pppoe_rcvmsg,
 180         .shutdown =     ng_pppoe_shutdown,
 181         .newhook =      ng_pppoe_newhook,
 182         .connect =      ng_pppoe_connect,
 183         .rcvdata =      ng_pppoe_rcvdata,
 184         .disconnect =   ng_pppoe_disconnect,
 185         .cmdlist =      ng_pppoe_cmds,
 186 };
 187 NETGRAPH_INIT(pppoe, &typestruct);
 188
 189 /*
 190  * States for the session state machine.
 191  * These have no meaning if there is no hook attached yet.
 192  */
 193 enum state {
 194     PPPOE_SNONE=0,      /* [both] Initial state */
 195     PPPOE_LISTENING,    /* [Daemon] Listening for discover initiation pkt */
 196     PPPOE_SINIT,        /* [Client] Sent discovery initiation */
 197     PPPOE_PRIMED,       /* [Server] Awaiting PADI from daemon */
 198     PPPOE_SOFFER,       /* [Server] Sent offer message  (got PADI)*/
 199     PPPOE_SREQ,         /* [Client] Sent a Request */
 200     PPPOE_NEWCONNECTED, /* [Server] Connection established, No data received */
 201     PPPOE_CONNECTED,    /* [Both] Connection established, Data received */
 202     PPPOE_DEAD          /* [Both] */
 203 };
 204
 205 #define NUMTAGS 20 /* number of tags we are set up to work with */
 206
 207 /*
 208  * Information we store for each hook on each node for negotiating the
 209  * session. The mbuf and cluster are freed once negotiation has completed.
 210  * The whole negotiation block is then discarded.
 211  */
 212
 213 struct sess_neg {
 214         struct mbuf             *m; /* holds cluster with last sent packet */
 215         union   packet          *pkt; /* points within the above cluster */
 216         struct callout          handle;   /* see timeout(9) */
 217         u_int                   timeout; /* 0,1,2,4,8,16 etc. seconds */
 218         u_int                   numtags;
 219         const struct pppoe_tag  *tags[NUMTAGS];
 220         u_int                   service_len;
 221         u_int                   ac_name_len;
 222
 223         struct datatag          service;
 224         struct datatag          ac_name;
 225 };
 226 typedef struct sess_neg *negp;
 227
 228 /*
 229  * Session information that is needed after connection.
 230  */
 231 struct sess_con {
 232         hook_p                  hook;
 233         uint16_t                Session_ID;
 234         enum state              state;
 235         ng_ID_t                 creator;        /* who to notify */
 236         struct pppoe_full_hdr   pkt_hdr;        /* used when connected */
 237         negp                    neg;            /* used when negotiating */
 238         LIST_ENTRY(sess_con)    sessions;
 239 };
 240 typedef struct sess_con *sessp;
 241
 242 #define SESSHASHSIZE    0x0100
 243 #define SESSHASH(x)     (((x) ^ ((x) >> 8)) & (SESSHASHSIZE - 1))
 244
 245 struct sess_hash_entry {
 246         struct mtx      mtx;
 247         LIST_HEAD(hhead, sess_con) head;
 248 };
 249
 250 /*
 251  * Information we store for each node
 252  */
 253 struct PPPoE {
 254         node_p          node;           /* back pointer to node */
 255         hook_p          ethernet_hook;
 256         hook_p          debug_hook;
 257         u_int           packets_in;     /* packets in from ethernet */
 258         u_int           packets_out;    /* packets out towards ethernet */
 259         uint32_t        flags;
 260 #define COMPAT_3COM     0x00000001
 261 #define COMPAT_DLINK    0x00000002
 262         struct ether_header     eh;
 263         LIST_HEAD(, sess_con) listeners;
 264         struct sess_hash_entry  sesshash[SESSHASHSIZE];
 265 };
 266 typedef struct PPPoE *priv_p;
 267
 268 union uniq {
 269         char bytes[sizeof(void *)];
 270         void *pointer;
 271 };
 272
 273 #define LEAVE(x) do { error = x; goto quit; } while(0)
 274 static void     pppoe_start(sessp sp);
 275 static void     pppoe_ticker(node_p node, hook_p hook, void *arg1, int arg2);
 276 static const    struct pppoe_tag *scan_tags(sessp sp,
 277                         const struct pppoe_hdr* ph);
 278 static  int     pppoe_send_event(sessp sp, enum cmd cmdid);
 279
 280 /*************************************************************************
 281  * Some basic utilities  from the Linux version with author's permission.*
 282  * Author:      Michal Ostrowski <mostrows@styx.uwaterloo.ca>            *
 283  ************************************************************************/
 284
 285
 286
 287 /*
 288  * Return the location where the next tag can be put
 289  */
 290 static __inline const struct pppoe_tag*
 291 next_tag(const struct pppoe_hdr* ph)
 292 {
 293         return (const struct pppoe_tag*)(((const char*)&ph->tag[0])
 294             + ntohs(ph->length));
 295 }
 296
 297 /*
 298  * Look for a tag of a specific type.
 299  * Don't trust any length the other end says,
 300  * but assume we already sanity checked ph->length.
 301  */
 302 static const struct pppoe_tag*
 303 get_tag(const struct pppoe_hdr* ph, uint16_t idx)
 304 {
 305         const char *const end = (const char *)next_tag(ph);
 306         const struct pppoe_tag *pt = &ph->tag[0];
 307         const char *ptn;
 308
 309         /*
 310          * Keep processing tags while a tag header will still fit.
 311          */
 312         while((const char*)(pt + 1) <= end) {
 313                 /*
 314                  * If the tag data would go past the end of the packet, abort.
 315                  */
 316                 ptn = (((const char *)(pt + 1)) + ntohs(pt->tag_len));
 317                 if (ptn > end) {
 318                         CTR2(KTR_NET, "%20s: invalid length for tag %d",
 319                             __func__, idx);
 320                         return (NULL);
 321                 }
 322                 if (pt->tag_type == idx) {
 323                         CTR2(KTR_NET, "%20s: found tag %d", __func__, idx);
 324                         return (pt);
 325                 }
 326
 327                 pt = (const struct pppoe_tag*)ptn;
 328         }
 329
 330         CTR2(KTR_NET, "%20s: not found tag %d", __func__, idx);
 331         return (NULL);
 332 }
 333
 334 /**************************************************************************
 335  * Inlines to initialise or add tags to a session's tag list.
 336  **************************************************************************/
 337 /*
 338  * Initialise the session's tag list.
 339  */
 340 static void
 341 init_tags(sessp sp)
 342 {
 343         KASSERT(sp->neg != NULL, ("%s: no neg", __func__));
 344         sp->neg->numtags = 0;
 345 }
 346
 347 static void
 348 insert_tag(sessp sp, const struct pppoe_tag *tp)
 349 {
 350         negp neg = sp->neg;
 351         int i;
 352
 353         KASSERT(neg != NULL, ("%s: no neg", __func__));
 354         if ((i = neg->numtags++) < NUMTAGS) {
 355                 neg->tags[i] = tp;
 356         } else {
 357                 log(LOG_NOTICE, "ng_pppoe: asked to add too many tags to "
 358                     "packet\n");
 359                 neg->numtags--;
 360         }
 361 }
 362
 363 /*
 364  * Make up a packet, using the tags filled out for the session.
 365  *
 366  * Assume that the actual pppoe header and ethernet header
 367  * are filled out externally to this routine.
 368  * Also assume that neg->wh points to the correct
 369  * location at the front of the buffer space.
 370  */
 371 static void
 372 make_packet(sessp sp) {
 373         struct pppoe_full_hdr *wh = &sp->neg->pkt->pkt_header;
 374         const struct pppoe_tag **tag;
 375         char *dp;
 376         int count;
 377         int tlen;
 378         uint16_t length = 0;
 379
 380         KASSERT((sp->neg != NULL) && (sp->neg->m != NULL),
 381             ("%s: called from wrong state", __func__));
 382         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
 383
 384         dp = (char *)wh->ph.tag;
 385         for (count = 0, tag = sp->neg->tags;
 386             ((count < sp->neg->numtags) && (count < NUMTAGS));
 387             tag++, count++) {
 388                 tlen = ntohs((*tag)->tag_len) + sizeof(**tag);
 389                 if ((length + tlen) > (ETHER_MAX_LEN - 4 - sizeof(*wh))) {
 390                         log(LOG_NOTICE, "ng_pppoe: tags too long\n");
 391                         sp->neg->numtags = count;
 392                         break;  /* XXX chop off what's too long */
 393                 }
 394                 bcopy(*tag, (char *)dp, tlen);
 395                 length += tlen;
 396                 dp += tlen;
 397         }
 398         wh->ph.length = htons(length);
 399         sp->neg->m->m_len = length + sizeof(*wh);
 400         sp->neg->m->m_pkthdr.len = length + sizeof(*wh);
 401 }
 402
 403 /**************************************************************************
 404  * Routines to match a service.                                           *
 405  **************************************************************************/
 406
 407 /*
 408  * Find a hook that has a service string that matches that
 409  * we are seeking. For now use a simple string.
 410  * In the future we may need something like regexp().
 411  *
 412  * Null string is a wildcard (ANY service), according to RFC2516.
 413  * And historical FreeBSD wildcard is also "*".
 414  */
 415
 416 static hook_p
 417 pppoe_match_svc(node_p node, const struct pppoe_tag *tag)
 418 {
 419         const priv_p privp = NG_NODE_PRIVATE(node);
 420         sessp sp;
 421
 422         LIST_FOREACH(sp, &privp->listeners, sessions) {
 423                 negp neg = sp->neg;
 424
 425                 /* Empty Service-Name matches any service. */
 426                 if (neg->service_len == 0)
 427                         break;
 428
 429                 /* Special case for a blank or "*" service name (wildcard). */
 430                 if (neg->service_len == 1 && neg->service.data[0] == '*')
 431                         break;
 432
 433                 /* If the lengths don't match, that aint it. */
 434                 if (neg->service_len != ntohs(tag->tag_len))
 435                         continue;
 436
 437                 if (strncmp(tag->tag_data, neg->service.data,
 438                     ntohs(tag->tag_len)) == 0)
 439                         break;
 440         }
 441         CTR3(KTR_NET, "%20s: matched %p for %s", __func__,
 442             sp?sp->hook:NULL, tag->tag_data);
 443
 444         return (sp?sp->hook:NULL);
 445 }
 446
 447 /*
 448  * Broadcast the PADI packet in m0 to all listening hooks.
 449  * This routine is called when a PADI with empty Service-Name
 450  * tag is received. Client should receive PADOs with all
 451  * available services.
 452  */
 453 static int
 454 pppoe_broadcast_padi(node_p node, struct mbuf *m0)
 455 {
 456         const priv_p privp = NG_NODE_PRIVATE(node);
 457         sessp sp;
 458         int error = 0;
 459
 460         LIST_FOREACH(sp, &privp->listeners, sessions) {
 461                 struct mbuf *m;
 462
 463                 m = m_dup(m0, M_DONTWAIT);
 464                 if (m == NULL)
 465                         return (ENOMEM);
 466                 NG_SEND_DATA_ONLY(error, sp->hook, m);
 467                 if (error)
 468                         return (error);
 469         }
 470
 471         return (0);
 472 }
 473
 474 /*
 475  * Find a hook, which name equals to given service.
 476  */
 477 static hook_p
 478 pppoe_find_svc(node_p node, const char *svc_name, int svc_len)
 479 {
 480         const priv_p privp = NG_NODE_PRIVATE(node);
 481         sessp sp;
 482
 483         LIST_FOREACH(sp, &privp->listeners, sessions) {
 484                 negp neg = sp->neg;
 485
 486                 if (neg->service_len == svc_len &&
 487                     strncmp(svc_name, neg->service.data, svc_len) == 0)
 488                         return (sp->hook);
 489         }
 490
 491         return (NULL);
 492 }
 493
 494 /**************************************************************************
 495  * Routines to find a particular session that matches an incoming packet. *
 496  **************************************************************************/
 497 /* Find free session and add to hash. */
 498 static uint16_t
 499 pppoe_getnewsession(sessp sp)
 500 {
 501         const priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(sp->hook));
 502         static uint16_t pppoe_sid = 1;
 503         sessp   tsp;
 504         uint16_t val, hash;
 505
 506 restart:
 507         /* Atomicity is not needed here as value will be checked. */
 508         val = pppoe_sid++;
 509         /* Spec says 0xFFFF is reserved, also don't use 0x0000. */
 510         if (val == 0xffff || val == 0x0000)
 511                 val = pppoe_sid = 1;
 512
 513         /* Check it isn't already in use. */
 514         hash = SESSHASH(val);
 515         mtx_lock(&privp->sesshash[hash].mtx);
 516         LIST_FOREACH(tsp, &privp->sesshash[hash].head, sessions) {
 517                 if (tsp->Session_ID == val)
 518                         break;
 519         }
 520         if (!tsp) {
 521                 sp->Session_ID = val;
 522                 LIST_INSERT_HEAD(&privp->sesshash[hash].head, sp, sessions);
 523         }
 524         mtx_unlock(&privp->sesshash[hash].mtx);
 525         if (tsp)
 526                 goto restart;
 527
 528         CTR2(KTR_NET, "%20s: new sid %d", __func__, val);
 529
 530         return (val);
 531 }
 532
 533 /* Add specified session to hash. */
 534 static void
 535 pppoe_addsession(sessp sp)
 536 {
 537         const priv_p    privp = NG_NODE_PRIVATE(NG_HOOK_NODE(sp->hook));
 538         uint16_t        hash = SESSHASH(sp->Session_ID);
 539
 540         mtx_lock(&privp->sesshash[hash].mtx);
 541         LIST_INSERT_HEAD(&privp->sesshash[hash].head, sp, sessions);
 542         mtx_unlock(&privp->sesshash[hash].mtx);
 543 }
 544
 545 /* Delete specified session from hash. */
 546 static void
 547 pppoe_delsession(sessp sp)
 548 {
 549         const priv_p    privp = NG_NODE_PRIVATE(NG_HOOK_NODE(sp->hook));
 550         uint16_t        hash = SESSHASH(sp->Session_ID);
 551
 552         mtx_lock(&privp->sesshash[hash].mtx);
 553         LIST_REMOVE(sp, sessions);
 554         mtx_unlock(&privp->sesshash[hash].mtx);
 555 }
 556
 557 /* Find matching peer/session combination. */
 558 static sessp
 559 pppoe_findsession(priv_p privp, const struct pppoe_full_hdr *wh)
 560 {
 561         uint16_t        session = ntohs(wh->ph.sid);
 562         uint16_t        hash = SESSHASH(session);
 563         sessp           sp = NULL;
 564
 565         mtx_lock(&privp->sesshash[hash].mtx);
 566         LIST_FOREACH(sp, &privp->sesshash[hash].head, sessions) {
 567                 if (sp->Session_ID == session &&
 568                     bcmp(sp->pkt_hdr.eh.ether_dhost,
 569                      wh->eh.ether_shost, ETHER_ADDR_LEN) == 0) {
 570                         break;
 571                 }
 572         }
 573         mtx_unlock(&privp->sesshash[hash].mtx);
 574         CTR3(KTR_NET, "%20s: matched %p for %d", __func__, sp?sp->hook:NULL,
 575             session);
 576
 577         return (sp);
 578 }
 579
 580 static hook_p
 581 pppoe_finduniq(node_p node, const struct pppoe_tag *tag)
 582 {
 583         hook_p  hook = NULL;
 584         union uniq uniq;
 585
 586         bcopy(tag->tag_data, uniq.bytes, sizeof(void *));
 587         /* Cycle through all known hooks. */
 588         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 589                 /* Skip any nonsession hook. */
 590                 if (NG_HOOK_PRIVATE(hook) == NULL)
 591                         continue;
 592                 if (uniq.pointer == NG_HOOK_PRIVATE(hook))
 593                         break;
 594         }
 595         CTR3(KTR_NET, "%20s: matched %p for %p", __func__, hook, uniq.pointer);
 596
 597         return (hook);
 598 }
 599
 600 /**************************************************************************
 601  * Start of Netgraph entrypoints.                                         *
 602  **************************************************************************/
 603
 604 /*
 605  * Allocate the private data structure and link it with node.
 606  */
 607 static int
 608 ng_pppoe_constructor(node_p node)
 609 {
 610         priv_p  privp;
 611         int     i;
 612
 613         /* Initialize private descriptor. */
 614         privp = malloc(sizeof(*privp), M_NETGRAPH_PPPOE, M_NOWAIT | M_ZERO);
 615         if (privp == NULL)
 616                 return (ENOMEM);
 617
 618         /* Link structs together; this counts as our one reference to *node. */
 619         NG_NODE_SET_PRIVATE(node, privp);
 620         privp->node = node;
 621
 622         /* Initialize to standard mode. */
 623         memset(&privp->eh.ether_dhost, 0xff, ETHER_ADDR_LEN);
 624         privp->eh.ether_type = ETHERTYPE_PPPOE_DISC;
 625
 626         LIST_INIT(&privp->listeners);
 627         for (i = 0; i < SESSHASHSIZE; i++) {
 628             mtx_init(&privp->sesshash[i].mtx, "PPPoE hash mutex", NULL, MTX_DEF);
 629             LIST_INIT(&privp->sesshash[i].head);
 630         }
 631
 632         CTR3(KTR_NET, "%20s: created node [%x] (%p)",
 633             __func__, node->nd_ID, node);
 634
 635         return (0);
 636 }
 637
 638 /*
 639  * Give our ok for a hook to be added...
 640  * point the hook's private info to the hook structure.
 641  *
 642  * The following hook names are special:
 643  *  "ethernet":  the hook that should be connected to a NIC.
 644  *  "debug":    copies of data sent out here  (when I write the code).
 645  * All other hook names need only be unique. (the framework checks this).
 646  */
 647 static int
 648 ng_pppoe_newhook(node_p node, hook_p hook, const char *name)
 649 {
 650         const priv_p privp = NG_NODE_PRIVATE(node);
 651         sessp sp;
 652
 653         if (strcmp(name, NG_PPPOE_HOOK_ETHERNET) == 0) {
 654                 privp->ethernet_hook = hook;
 655                 NG_HOOK_SET_RCVDATA(hook, ng_pppoe_rcvdata_ether);
 656         } else if (strcmp(name, NG_PPPOE_HOOK_DEBUG) == 0) {
 657                 privp->debug_hook = hook;
 658                 NG_HOOK_SET_RCVDATA(hook, ng_pppoe_rcvdata_debug);
 659         } else {
 660                 /*
 661                  * Any other unique name is OK.
 662                  * The infrastructure has already checked that it's unique,
 663                  * so just allocate it and hook it in.
 664                  */
 665                 sp = malloc(sizeof(*sp), M_NETGRAPH_PPPOE, M_NOWAIT | M_ZERO);
 666                 if (sp == NULL)
 667                         return (ENOMEM);
 668
 669                 NG_HOOK_SET_PRIVATE(hook, sp);
 670                 sp->hook = hook;
 671         }
 672         CTR5(KTR_NET, "%20s: node [%x] (%p) connected hook %s (%p)",
 673             __func__, node->nd_ID, node, name, hook);
 674
 675         return(0);
 676 }
 677
 678 /*
 679  * Hook has been added successfully. Request the MAC address of
 680  * the underlying Ethernet node.
 681  */
 682 static int
 683 ng_pppoe_connect(hook_p hook)
 684 {
 685         const priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
 686         struct ng_mesg *msg;
 687         int error;
 688
 689         if (hook != privp->ethernet_hook)
 690                 return (0);
 691
 692         /*
 693          * If this is Ethernet hook, then request MAC address
 694          * from our downstream.
 695          */
 696         NG_MKMESSAGE(msg, NGM_ETHER_COOKIE, NGM_ETHER_GET_ENADDR, 0, M_NOWAIT);
 697         if (msg == NULL)
 698                 return (ENOBUFS);
 699
 700         /*
 701          * Our hook and peer hook have HK_INVALID flag set,
 702          * so we can't use NG_SEND_MSG_HOOK() macro here.
 703          */
 704         NG_SEND_MSG_ID(error, privp->node, msg,
 705             NG_NODE_ID(NG_PEER_NODE(privp->ethernet_hook)),
 706             NG_NODE_ID(privp->node));
 707
 708         return (error);
 709 }
 710 /*
 711  * Get a netgraph control message.
 712  * Check it is one we understand. If needed, send a response.
 713  * We sometimes save the address for an async action later.
 714  * Always free the message.
 715  */
 716 static int
 717 ng_pppoe_rcvmsg(node_p node, item_p item, hook_p lasthook)
 718 {
 719         priv_p privp = NG_NODE_PRIVATE(node);
 720         struct ngpppoe_init_data *ourmsg = NULL;
 721         struct ng_mesg *resp = NULL;
 722         int error = 0;
 723         hook_p hook = NULL;
 724         sessp sp = NULL;
 725         negp neg = NULL;
 726         struct ng_mesg *msg;
 727
 728         NGI_GET_MSG(item, msg);
 729         CTR5(KTR_NET, "%20s: node [%x] (%p) got message %d with cookie %d",
 730             __func__, node->nd_ID, node, msg->header.cmd,
 731             msg->header.typecookie);
 732
 733         /* Deal with message according to cookie and command. */
 734         switch (msg->header.typecookie) {
 735         case NGM_PPPOE_COOKIE:
 736                 switch (msg->header.cmd) {
 737                 case NGM_PPPOE_CONNECT:
 738                 case NGM_PPPOE_LISTEN:
 739                 case NGM_PPPOE_OFFER:
 740                 case NGM_PPPOE_SERVICE:
 741                         ourmsg = (struct ngpppoe_init_data *)msg->data;
 742                         if (msg->header.arglen < sizeof(*ourmsg)) {
 743                                 log(LOG_ERR, "ng_pppoe[%x]: init data too "
 744                                     "small\n", node->nd_ID);
 745                                 LEAVE(EMSGSIZE);
 746                         }
 747                         if (msg->header.arglen - sizeof(*ourmsg) >
 748                             PPPOE_SERVICE_NAME_SIZE) {
 749                                 log(LOG_ERR, "ng_pppoe[%x]: service name "
 750                                     "too big\n", node->nd_ID);
 751                                 LEAVE(EMSGSIZE);
 752                         }
 753                         if (msg->header.arglen - sizeof(*ourmsg) <
 754                             ourmsg->data_len) {
 755                                 log(LOG_ERR, "ng_pppoe[%x]: init data has bad "
 756                                     "length, %d should be %zd\n", node->nd_ID,
 757                                     ourmsg->data_len,
 758                                     msg->header.arglen - sizeof (*ourmsg));
 759                                 LEAVE(EMSGSIZE);
 760                         }
 761
 762                         /* Make sure strcmp will terminate safely. */
 763                         ourmsg->hook[sizeof(ourmsg->hook) - 1] = '\0';
 764
 765                         /* Find hook by name. */
 766                         hook = ng_findhook(node, ourmsg->hook);
 767                         if (hook == NULL)
 768                                 LEAVE(ENOENT);
 769
 770                         sp = NG_HOOK_PRIVATE(hook);
 771                         if (sp == NULL)
 772                                 LEAVE(EINVAL);
 773
 774                         if (msg->header.cmd == NGM_PPPOE_LISTEN) {
 775                                 /*
 776                                  * Ensure we aren't already listening for this
 777                                  * service.
 778                                  */
 779                                 if (pppoe_find_svc(node, ourmsg->data,
 780                                     ourmsg->data_len) != NULL)
 781                                         LEAVE(EEXIST);
 782                         }
 783
 784                         /*
 785                          * PPPOE_SERVICE advertisments are set up
 786                          * on sessions that are in PRIMED state.
 787                          */
 788                         if (msg->header.cmd == NGM_PPPOE_SERVICE)
 789                                 break;
 790
 791                         if (sp->state != PPPOE_SNONE) {
 792                                 log(LOG_NOTICE, "ng_pppoe[%x]: Session already "
 793                                     "active\n", node->nd_ID);
 794                                 LEAVE(EISCONN);
 795                         }
 796
 797                         /*
 798                          * Set up prototype header.
 799                          */
 800                         neg = malloc(sizeof(*neg), M_NETGRAPH_PPPOE,
 801                             M_NOWAIT | M_ZERO);
 802
 803                         if (neg == NULL)
 804                                 LEAVE(ENOMEM);
 805
 806                         neg->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
 807                         if (neg->m == NULL) {
 808                                 free(neg, M_NETGRAPH_PPPOE);
 809                                 LEAVE(ENOBUFS);
 810                         }
 811                         neg->m->m_pkthdr.rcvif = NULL;
 812                         sp->neg = neg;
 813                         ng_callout_init(&neg->handle);
 814                         neg->m->m_len = sizeof(struct pppoe_full_hdr);
 815                         neg->pkt = mtod(neg->m, union packet*);
 816                         memcpy((void *)&neg->pkt->pkt_header.eh,
 817                             &privp->eh, sizeof(struct ether_header));
 818                         neg->pkt->pkt_header.ph.ver = 0x1;
 819                         neg->pkt->pkt_header.ph.type = 0x1;
 820                         neg->pkt->pkt_header.ph.sid = 0x0000;
 821                         neg->timeout = 0;
 822
 823                         sp->creator = NGI_RETADDR(item);
 824                 }
 825                 switch (msg->header.cmd) {
 826                 case NGM_PPPOE_GET_STATUS:
 827                     {
 828                         struct ngpppoestat *stats;
 829
 830                         NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
 831                         if (!resp)
 832                                 LEAVE(ENOMEM);
 833
 834                         stats = (struct ngpppoestat *) resp->data;
 835                         stats->packets_in = privp->packets_in;
 836                         stats->packets_out = privp->packets_out;
 837                         break;
 838                     }
 839                 case NGM_PPPOE_CONNECT:
 840                     {
 841                         /*
 842                          * Check the hook exists and is Uninitialised.
 843                          * Send a PADI request, and start the timeout logic.
 844                          * Store the originator of this message so we can send
 845                          * a success of fail message to them later.
 846                          * Move the session to SINIT.
 847                          * Set up the session to the correct state and
 848                          * start it.
 849                          */
 850                         int     i, acnlen = 0, acnsep = 0, srvlen;
 851                         for (i = 0; i < ourmsg->data_len; i++) {
 852                                 if (ourmsg->data[i] == '\\') {
 853                                         acnlen = i;
 854                                         acnsep = 1;
 855                                         break;
 856                                 }
 857                         }
 858                         srvlen = ourmsg->data_len - acnlen - acnsep;
 859
 860                         bcopy(ourmsg->data, neg->ac_name.data, acnlen);
 861                         neg->ac_name_len = acnlen;
 862
 863                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 864                         neg->service.hdr.tag_len = htons((uint16_t)srvlen);
 865                         bcopy(ourmsg->data + acnlen + acnsep,
 866                             neg->service.data, srvlen);
 867                         neg->service_len = srvlen;
 868                         pppoe_start(sp);
 869                         break;
 870                     }
 871                 case NGM_PPPOE_LISTEN:
 872                         /*
 873                          * Check the hook exists and is Uninitialised.
 874                          * Install the service matching string.
 875                          * Store the originator of this message so we can send
 876                          * a success of fail message to them later.
 877                          * Move the hook to 'LISTENING'
 878                          */
 879                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 880                         neg->service.hdr.tag_len =
 881                             htons((uint16_t)ourmsg->data_len);
 882
 883                         if (ourmsg->data_len)
 884                                 bcopy(ourmsg->data, neg->service.data,
 885                                     ourmsg->data_len);
 886                         neg->service_len = ourmsg->data_len;
 887                         neg->pkt->pkt_header.ph.code = PADT_CODE;
 888                         /*
 889                          * Wait for PADI packet coming from Ethernet.
 890                          */
 891                         sp->state = PPPOE_LISTENING;
 892                         LIST_INSERT_HEAD(&privp->listeners, sp, sessions);
 893                         break;
 894                 case NGM_PPPOE_OFFER:
 895                         /*
 896                          * Check the hook exists and is Uninitialised.
 897                          * Store the originator of this message so we can send
 898                          * a success of fail message to them later.
 899                          * Store the AC-Name given and go to PRIMED.
 900                          */
 901                         neg->ac_name.hdr.tag_type = PTT_AC_NAME;
 902                         neg->ac_name.hdr.tag_len =
 903                             htons((uint16_t)ourmsg->data_len);
 904                         if (ourmsg->data_len)
 905                                 bcopy(ourmsg->data, neg->ac_name.data,
 906                                     ourmsg->data_len);
 907                         neg->ac_name_len = ourmsg->data_len;
 908                         neg->pkt->pkt_header.ph.code = PADO_CODE;
 909                         /*
 910                          * Wait for PADI packet coming from hook.
 911                          */
 912                         sp->state = PPPOE_PRIMED;
 913                         break;
 914                 case NGM_PPPOE_SERVICE:
 915                         /*
 916                          * Check the session is primed.
 917                          * for now just allow ONE service to be advertised.
 918                          * If you do it twice you just overwrite.
 919                          */
 920                         if (sp->state != PPPOE_PRIMED) {
 921                                 log(LOG_NOTICE, "ng_pppoe[%x]: session not "
 922                                     "primed\n", node->nd_ID);
 923                                 LEAVE(EISCONN);
 924                         }
 925                         neg = sp->neg;
 926                         neg->service.hdr.tag_type = PTT_SRV_NAME;
 927                         neg->service.hdr.tag_len =
 928                             htons((uint16_t)ourmsg->data_len);
 929
 930                         if (ourmsg->data_len)
 931                                 bcopy(ourmsg->data, neg->service.data,
 932                                     ourmsg->data_len);
 933                         neg->service_len = ourmsg->data_len;
 934                         break;
 935                 case NGM_PPPOE_SETMODE:
 936                     {
 937                         char *s;
 938                         size_t len;
 939
 940                         if (msg->header.arglen == 0)
 941                                 LEAVE(EINVAL);
 942
 943                         s = (char *)msg->data;
 944                         len = msg->header.arglen - 1;
 945
 946                         /* Search for matching mode string. */
 947                         if (len == strlen(NG_PPPOE_STANDARD) &&
 948                             (strncmp(NG_PPPOE_STANDARD, s, len) == 0)) {
 949                                 privp->flags = 0;
 950                                 privp->eh.ether_type = ETHERTYPE_PPPOE_DISC;
 951                                 break;
 952                         }
 953                         if (len == strlen(NG_PPPOE_3COM) &&
 954                             (strncmp(NG_PPPOE_3COM, s, len) == 0)) {
 955                                 privp->flags |= COMPAT_3COM;
 956                                 privp->eh.ether_type =
 957                                     ETHERTYPE_PPPOE_3COM_DISC;
 958                                 break;
 959                         }
 960                         if (len == strlen(NG_PPPOE_DLINK) &&
 961                             (strncmp(NG_PPPOE_DLINK, s, len) == 0)) {
 962                                 privp->flags |= COMPAT_DLINK;
 963                                 break;
 964                         }
 965                         error = EINVAL;
 966                         break;
 967                     }
 968                 case NGM_PPPOE_GETMODE:
 969                     {
 970                         char *s;
 971                         size_t len = 0;
 972
 973                         if (privp->flags == 0)
 974                                 len += strlen(NG_PPPOE_STANDARD) + 1;
 975                         if (privp->flags & COMPAT_3COM)
 976                                 len += strlen(NG_PPPOE_3COM) + 1;
 977                         if (privp->flags & COMPAT_DLINK)
 978                                 len += strlen(NG_PPPOE_DLINK) + 1;
 979
 980                         NG_MKRESPONSE(resp, msg, len, M_NOWAIT);
 981                         if (resp == NULL)
 982                                 LEAVE(ENOMEM);
 983
 984                         s = (char *)resp->data;
 985                         if (privp->flags == 0) {
 986                                 len = strlen(NG_PPPOE_STANDARD);
 987                                 strlcpy(s, NG_PPPOE_STANDARD, len + 1);
 988                                 break;
 989                         }
 990                         if (privp->flags & COMPAT_3COM) {
 991                                 len = strlen(NG_PPPOE_3COM);
 992                                 strlcpy(s, NG_PPPOE_3COM, len + 1);
 993                                 s += len;
 994                         }
 995                         if (privp->flags & COMPAT_DLINK) {
 996                                 if (s != resp->data)
 997                                         *s++ = '|';
 998                                 len = strlen(NG_PPPOE_DLINK);
 999                                 strlcpy(s, NG_PPPOE_DLINK, len + 1);
1000                         }
1001                         break;
1002                     }
1003                 case NGM_PPPOE_SETENADDR:
1004                         if (msg->header.arglen != ETHER_ADDR_LEN)
1005                                 LEAVE(EINVAL);
1006                         bcopy(msg->data, &privp->eh.ether_shost,
1007                             ETHER_ADDR_LEN);
1008                         break;
1009                 default:
1010                         LEAVE(EINVAL);
1011                 }
1012                 break;
1013         case NGM_ETHER_COOKIE:
1014                 if (!(msg->header.flags & NGF_RESP))
1015                         LEAVE(EINVAL);
1016                 switch (msg->header.cmd) {
1017                 case NGM_ETHER_GET_ENADDR:
1018                         if (msg->header.arglen != ETHER_ADDR_LEN)
1019                                 LEAVE(EINVAL);
1020                         bcopy(msg->data, &privp->eh.ether_shost,
1021                             ETHER_ADDR_LEN);
1022                         break;
1023                 default:
1024                         LEAVE(EINVAL);
1025                 }
1026                 break;
1027         default:
1028                 LEAVE(EINVAL);
1029         }
1030
1031         /* Take care of synchronous response, if any. */
1032 quit:
1033         CTR2(KTR_NET, "%20s: returning %d", __func__, error);
1034         NG_RESPOND_MSG(error, node, item, resp);
1035         /* Free the message and return. */
1036         NG_FREE_MSG(msg);
1037         return(error);
1038 }
1039
1040 /*
1041  * Start a client into the first state. A separate function because
1042  * it can be needed if the negotiation times out.
1043  */
1044 static void
1045 pppoe_start(sessp sp)
1046 {
1047         hook_p  hook = sp->hook;
1048         node_p  node = NG_HOOK_NODE(hook);
1049         priv_p  privp = NG_NODE_PRIVATE(node);
1050         negp    neg = sp->neg;
1051         struct {
1052                 struct pppoe_tag hdr;
1053                 union   uniq    data;
1054         } __packed uniqtag;
1055         struct  mbuf *m0;
1056         int     error;
1057
1058         /*
1059          * Kick the state machine into starting up.
1060          */
1061         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
1062         sp->state = PPPOE_SINIT;
1063         /*
1064          * Reset the packet header to broadcast. Since we are
1065          * in a client mode use configured ethertype.
1066          */
1067         memcpy((void *)&neg->pkt->pkt_header.eh, &privp->eh,
1068             sizeof(struct ether_header));
1069         neg->pkt->pkt_header.ph.code = PADI_CODE;
1070         uniqtag.hdr.tag_type = PTT_HOST_UNIQ;
1071         uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(uniqtag.data));
1072         uniqtag.data.pointer = sp;
1073         init_tags(sp);
1074         insert_tag(sp, &uniqtag.hdr);
1075         insert_tag(sp, &neg->service.hdr);
1076         make_packet(sp);
1077         /*
1078          * Send packet and prepare to retransmit it after timeout.
1079          */
1080         ng_callout(&neg->handle, node, hook, PPPOE_INITIAL_TIMEOUT * hz,
1081             pppoe_ticker, NULL, 0);
1082         neg->timeout = PPPOE_INITIAL_TIMEOUT * 2;
1083         m0 = m_copypacket(neg->m, M_DONTWAIT);
1084         NG_SEND_DATA_ONLY(error, privp->ethernet_hook, m0);
1085 }
1086
1087 static int
1088 send_acname(sessp sp, const struct pppoe_tag *tag)
1089 {
1090         int error, tlen;
1091         struct ng_mesg *msg;
1092         struct ngpppoe_sts *sts;
1093
1094         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
1095
1096         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_ACNAME,
1097             sizeof(struct ngpppoe_sts), M_NOWAIT);
1098         if (msg == NULL)
1099                 return (ENOMEM);
1100
1101         sts = (struct ngpppoe_sts *)msg->data;
1102         tlen = min(NG_HOOKSIZ - 1, ntohs(tag->tag_len));
1103         strncpy(sts->hook, tag->tag_data, tlen);
1104         sts->hook[tlen] = '\0';
1105         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, 0);
1106
1107         return (error);
1108 }
1109
1110 static int
1111 send_sessionid(sessp sp)
1112 {
1113         int error;
1114         struct ng_mesg *msg;
1115
1116         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
1117
1118         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, NGM_PPPOE_SESSIONID,
1119             sizeof(uint16_t), M_NOWAIT);
1120         if (msg == NULL)
1121                 return (ENOMEM);
1122
1123         *(uint16_t *)msg->data = sp->Session_ID;
1124         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, 0);
1125
1126         return (error);
1127 }
1128
1129 /*
1130  * Receive data from session hook and do something with it.
1131  */
1132 static int
1133 ng_pppoe_rcvdata(hook_p hook, item_p item)
1134 {
1135         node_p                  node = NG_HOOK_NODE(hook);
1136         const priv_p            privp = NG_NODE_PRIVATE(node);
1137         sessp                   sp = NG_HOOK_PRIVATE(hook);
1138         struct pppoe_full_hdr   *wh;
1139         struct mbuf             *m;
1140         int                     error;
1141
1142         CTR6(KTR_NET, "%20s: node [%x] (%p) received %p on \"%s\" (%p)",
1143             __func__, node->nd_ID, node, item, hook->hk_name, hook);
1144
1145         NGI_GET_M(item, m);
1146         switch (sp->state) {
1147         case    PPPOE_NEWCONNECTED:
1148         case    PPPOE_CONNECTED: {
1149                 /*
1150                  * Remove PPP address and control fields, if any.
1151                  * For example, ng_ppp(4) always sends LCP packets
1152                  * with address and control fields as required by
1153                  * generic PPP. PPPoE is an exception to the rule.
1154                  */
1155                 if (m->m_pkthdr.len >= 2) {
1156                         if (m->m_len < 2 && !(m = m_pullup(m, 2)))
1157                                 LEAVE(ENOBUFS);
1158                         if (mtod(m, u_char *)[0] == 0xff &&
1159                             mtod(m, u_char *)[1] == 0x03)
1160                                 m_adj(m, 2);
1161                 }
1162                 /*
1163                  * Bang in a pre-made header, and set the length up
1164                  * to be correct. Then send it to the ethernet driver.
1165                  */
1166                 M_PREPEND(m, sizeof(*wh), M_DONTWAIT);
1167                 if (m == NULL)
1168                         LEAVE(ENOBUFS);
1169
1170                 wh = mtod(m, struct pppoe_full_hdr *);
1171                 bcopy(&sp->pkt_hdr, wh, sizeof(*wh));
1172                 wh->ph.length = htons(m->m_pkthdr.len - sizeof(*wh));
1173                 NG_FWD_NEW_DATA(error, item, privp->ethernet_hook, m);
1174                 privp->packets_out++;
1175                 break;
1176                 }
1177         case    PPPOE_PRIMED: {
1178                 struct {
1179                         struct pppoe_tag hdr;
1180                         union   uniq    data;
1181                 } __packed      uniqtag;
1182                 const struct pppoe_tag  *tag;
1183                 struct mbuf     *m0;
1184                 const struct pppoe_hdr  *ph;
1185                 negp            neg = sp->neg;
1186                 uint16_t        session;
1187                 uint16_t        length;
1188                 uint8_t         code;
1189
1190                 /*
1191                  * A PADI packet is being returned by the application
1192                  * that has set up this hook. This indicates that it
1193                  * wants us to offer service.
1194                  */
1195                 if (m->m_len < sizeof(*wh)) {
1196                         m = m_pullup(m, sizeof(*wh));
1197                         if (m == NULL)
1198                                 LEAVE(ENOBUFS);
1199                 }
1200                 wh = mtod(m, struct pppoe_full_hdr *);
1201                 ph = &wh->ph;
1202                 session = ntohs(wh->ph.sid);
1203                 length = ntohs(wh->ph.length);
1204                 code = wh->ph.code;
1205                 /* Use peers mode in session. */
1206                 neg->pkt->pkt_header.eh.ether_type = wh->eh.ether_type;
1207                 if (code != PADI_CODE)
1208                         LEAVE(EINVAL);
1209                 ng_uncallout(&neg->handle, node);
1210
1211                 /*
1212                  * This is the first time we hear
1213                  * from the client, so note it's
1214                  * unicast address, replacing the
1215                  * broadcast address.
1216                  */
1217                 bcopy(wh->eh.ether_shost,
1218                         neg->pkt->pkt_header.eh.ether_dhost,
1219                         ETHER_ADDR_LEN);
1220                 sp->state = PPPOE_SOFFER;
1221                 neg->timeout = 0;
1222                 neg->pkt->pkt_header.ph.code = PADO_CODE;
1223
1224                 /*
1225                  * Start working out the tags to respond with.
1226                  */
1227                 uniqtag.hdr.tag_type = PTT_AC_COOKIE;
1228                 uniqtag.hdr.tag_len = htons((u_int16_t)sizeof(sp));
1229                 uniqtag.data.pointer = sp;
1230                 init_tags(sp);
1231                 insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1232                 if ((tag = get_tag(ph, PTT_SRV_NAME)))
1233                         insert_tag(sp, tag);      /* return service */
1234                 /*
1235                  * If we have a NULL service request
1236                  * and have an extra service defined in this hook,
1237                  * then also add a tag for the extra service.
1238                  * XXX this is a hack. eventually we should be able
1239                  * to support advertising many services, not just one
1240                  */
1241                 if (((tag == NULL) || (tag->tag_len == 0)) &&
1242                     (neg->service.hdr.tag_len != 0)) {
1243                         insert_tag(sp, &neg->service.hdr); /* SERVICE */
1244                 }
1245                 if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1246                         insert_tag(sp, tag); /* returned hostunique */
1247                 insert_tag(sp, &uniqtag.hdr);
1248                 scan_tags(sp, ph);
1249                 make_packet(sp);
1250                 /*
1251                  * Send the offer but if they don't respond
1252                  * in PPPOE_OFFER_TIMEOUT seconds, forget about it.
1253                  */
1254                 ng_callout(&neg->handle, node, hook, PPPOE_OFFER_TIMEOUT * hz,
1255                     pppoe_ticker, NULL, 0);
1256                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1257                 NG_FWD_NEW_DATA(error, item, privp->ethernet_hook, m0);
1258                 privp->packets_out++;
1259                 break;
1260                 }
1261
1262         /*
1263          * Packets coming from the hook make no sense
1264          * to sessions in the rest of states. Throw them away.
1265          */
1266         default:
1267                 LEAVE(ENETUNREACH);
1268         }
1269 quit:
1270         if (item)
1271                 NG_FREE_ITEM(item);
1272         NG_FREE_M(m);
1273         return (error);
1274 }
1275
1276 /*
1277  * Receive data from ether and do something with it.
1278  */
1279 static int
1280 ng_pppoe_rcvdata_ether(hook_p hook, item_p item)
1281 {
1282         node_p                  node = NG_HOOK_NODE(hook);
1283         const priv_p            privp = NG_NODE_PRIVATE(node);
1284         sessp                   sp = NG_HOOK_PRIVATE(hook);
1285         const struct pppoe_tag  *utag = NULL, *tag = NULL;
1286         const struct pppoe_full_hdr *wh;
1287         const struct pppoe_hdr  *ph;
1288         negp                    neg = NULL;
1289         struct mbuf             *m;
1290         hook_p                  sendhook;
1291         int                     error = 0;
1292         uint16_t                session;
1293         uint16_t                length;
1294         uint8_t                 code;
1295         struct  mbuf            *m0;
1296
1297         CTR6(KTR_NET, "%20s: node [%x] (%p) received %p on \"%s\" (%p)",
1298             __func__, node->nd_ID, node, item, hook->hk_name, hook);
1299
1300         NGI_GET_M(item, m);
1301         /*
1302          * Dig out various fields from the packet.
1303          * Use them to decide where to send it.
1304          */
1305         privp->packets_in++;
1306         if( m->m_len < sizeof(*wh)) {
1307                 m = m_pullup(m, sizeof(*wh)); /* Checks length */
1308                 if (m == NULL) {
1309                         log(LOG_NOTICE, "ng_pppoe[%x]: couldn't "
1310                             "m_pullup(wh)\n", node->nd_ID);
1311                         LEAVE(ENOBUFS);
1312                 }
1313         }
1314         wh = mtod(m, struct pppoe_full_hdr *);
1315         length = ntohs(wh->ph.length);
1316         switch(wh->eh.ether_type) {
1317         case    ETHERTYPE_PPPOE_3COM_DISC: /* fall through */
1318         case    ETHERTYPE_PPPOE_DISC:
1319                 /*
1320                  * We need to try to make sure that the tag area
1321                  * is contiguous, or we could wander off the end
1322                  * of a buffer and make a mess.
1323                  * (Linux wouldn't have this problem).
1324                  */
1325                 if (m->m_pkthdr.len <= MHLEN) {
1326                         if( m->m_len < m->m_pkthdr.len) {
1327                                 m = m_pullup(m, m->m_pkthdr.len);
1328                                 if (m == NULL) {
1329                                         log(LOG_NOTICE, "ng_pppoe[%x]: "
1330                                             "couldn't m_pullup(pkthdr)\n",
1331                                             node->nd_ID);
1332                                         LEAVE(ENOBUFS);
1333                                 }
1334                         }
1335                 }
1336                 if (m->m_len != m->m_pkthdr.len) {
1337                         /*
1338                          * It's not all in one piece.
1339                          * We need to do extra work.
1340                          * Put it into a cluster.
1341                          */
1342                         struct mbuf *n;
1343                         n = m_dup(m, M_DONTWAIT);
1344                         m_freem(m);
1345                         m = n;
1346                         if (m) {
1347                                 /* just check we got a cluster */
1348                                 if (m->m_len != m->m_pkthdr.len) {
1349                                         m_freem(m);
1350                                         m = NULL;
1351                                 }
1352                         }
1353                         if (m == NULL) {
1354                                 log(LOG_NOTICE, "ng_pppoe[%x]: packet "
1355                                     "fragmented\n", node->nd_ID);
1356                                 LEAVE(EMSGSIZE);
1357                         }
1358                 }
1359                 wh = mtod(m, struct pppoe_full_hdr *);
1360                 length = ntohs(wh->ph.length);
1361                 ph = &wh->ph;
1362                 session = ntohs(wh->ph.sid);
1363                 code = wh->ph.code;
1364
1365                 switch(code) {
1366                 case    PADI_CODE:
1367                         /*
1368                          * We are a server:
1369                          * Look for a hook with the required service and send
1370                          * the ENTIRE packet up there. It should come back to
1371                          * a new hook in PRIMED state. Look there for further
1372                          * processing.
1373                          */
1374                         tag = get_tag(ph, PTT_SRV_NAME);
1375                         if (tag == NULL) {
1376                                 CTR1(KTR_NET, "%20s: PADI w/o Service-Name",
1377                                     __func__);
1378                                 LEAVE(ENETUNREACH);
1379                         }
1380
1381                         /*
1382                          * First, try to match Service-Name against our
1383                          * listening hooks. If no success and we are in D-Link
1384                          * compat mode and Service-Name is empty, then we
1385                          * broadcast the PADI to all listening hooks.
1386                          */
1387                         sendhook = pppoe_match_svc(node, tag);
1388                         if (sendhook != NULL)
1389                                 NG_FWD_NEW_DATA(error, item, sendhook, m);
1390                         else if (privp->flags & COMPAT_DLINK &&
1391                                  ntohs(tag->tag_len) == 0)
1392                                 error = pppoe_broadcast_padi(node, m);
1393                         else
1394                                 error = ENETUNREACH;
1395                         break;
1396                 case    PADO_CODE:
1397                         /*
1398                          * We are a client:
1399                          * Use the host_uniq tag to find the hook this is in
1400                          * response to. Received #2, now send #3
1401                          * For now simply accept the first we receive.
1402                          */
1403                         utag = get_tag(ph, PTT_HOST_UNIQ);
1404                         if ((utag == NULL) ||
1405                             (ntohs(utag->tag_len) != sizeof(sp))) {
1406                                 log(LOG_NOTICE, "ng_pppoe[%x]: no host "
1407                                     "unique field\n", node->nd_ID);
1408                                 LEAVE(ENETUNREACH);
1409                         }
1410
1411                         sendhook = pppoe_finduniq(node, utag);
1412                         if (sendhook == NULL) {
1413                                 log(LOG_NOTICE, "ng_pppoe[%x]: no "
1414                                     "matching session\n", node->nd_ID);
1415                                 LEAVE(ENETUNREACH);
1416                         }
1417
1418                         /*
1419                          * Check the session is in the right state.
1420                          * It needs to be in PPPOE_SINIT.
1421                          */
1422                         sp = NG_HOOK_PRIVATE(sendhook);
1423                         if (sp->state == PPPOE_SREQ ||
1424                             sp->state == PPPOE_CONNECTED) {
1425                                 break;  /* Multiple PADO is OK. */
1426                         }
1427                         if (sp->state != PPPOE_SINIT) {
1428                                 log(LOG_NOTICE, "ng_pppoe[%x]: session "
1429                                     "in wrong state\n", node->nd_ID);
1430                                 LEAVE(ENETUNREACH);
1431                         }
1432                         neg = sp->neg;
1433                         /* If requested specific AC-name, check it. */
1434                         if (neg->ac_name_len) {
1435                                 tag = get_tag(ph, PTT_AC_NAME);
1436                                 if (!tag) {
1437                                         /* No PTT_AC_NAME in PADO */
1438                                         break;
1439                                 }
1440                                 if (neg->ac_name_len != htons(tag->tag_len) ||
1441                                     strncmp(neg->ac_name.data, tag->tag_data,
1442                                     neg->ac_name_len) != 0) {
1443                                         break;
1444                                 }
1445                         }
1446                         sp->state = PPPOE_SREQ;
1447                         ng_uncallout(&neg->handle, node);
1448
1449                         /*
1450                          * This is the first time we hear
1451                          * from the server, so note it's
1452                          * unicast address, replacing the
1453                          * broadcast address .
1454                          */
1455                         bcopy(wh->eh.ether_shost,
1456                                 neg->pkt->pkt_header.eh.ether_dhost,
1457                                 ETHER_ADDR_LEN);
1458                         neg->timeout = 0;
1459                         neg->pkt->pkt_header.ph.code = PADR_CODE;
1460                         init_tags(sp);
1461                         insert_tag(sp, utag);           /* Host Unique */
1462                         if ((tag = get_tag(ph, PTT_AC_COOKIE)))
1463                                 insert_tag(sp, tag);    /* return cookie */
1464                         if ((tag = get_tag(ph, PTT_AC_NAME))) {
1465                                 insert_tag(sp, tag);    /* return it */
1466                                 send_acname(sp, tag);
1467                         }
1468                         insert_tag(sp, &neg->service.hdr); /* Service */
1469                         scan_tags(sp, ph);
1470                         make_packet(sp);
1471                         sp->state = PPPOE_SREQ;
1472                         ng_callout(&neg->handle, node, sp->hook,
1473                             PPPOE_INITIAL_TIMEOUT * hz,
1474                             pppoe_ticker, NULL, 0);
1475                         neg->timeout = PPPOE_INITIAL_TIMEOUT * 2;
1476                         m0 = m_copypacket(neg->m, M_DONTWAIT);
1477                         NG_FWD_NEW_DATA(error, item, privp->ethernet_hook, m0);
1478                         break;
1479                 case    PADR_CODE:
1480                         /*
1481                          * We are a server:
1482                          * Use the ac_cookie tag to find the
1483                          * hook this is in response to.
1484                          */
1485                         utag = get_tag(ph, PTT_AC_COOKIE);
1486                         if ((utag == NULL) ||
1487                             (ntohs(utag->tag_len) != sizeof(sp))) {
1488                                 LEAVE(ENETUNREACH);
1489                         }
1490
1491                         sendhook = pppoe_finduniq(node, utag);
1492                         if (sendhook == NULL)
1493                                 LEAVE(ENETUNREACH);
1494
1495                         /*
1496                          * Check the session is in the right state.
1497                          * It needs to be in PPPOE_SOFFER or PPPOE_NEWCONNECTED.
1498                          * If the latter, then this is a retry by the client,
1499                          * so be nice, and resend.
1500                          */
1501                         sp = NG_HOOK_PRIVATE(sendhook);
1502                         if (sp->state == PPPOE_NEWCONNECTED) {
1503                                 /*
1504                                  * Whoa! drop back to resend that PADS packet.
1505                                  * We should still have a copy of it.
1506                                  */
1507                                 sp->state = PPPOE_SOFFER;
1508                         } else if (sp->state != PPPOE_SOFFER)
1509                                 LEAVE (ENETUNREACH);
1510                         neg = sp->neg;
1511                         ng_uncallout(&neg->handle, node);
1512                         neg->pkt->pkt_header.ph.code = PADS_CODE;
1513                         if (sp->Session_ID == 0) {
1514                                 neg->pkt->pkt_header.ph.sid =
1515                                     htons(pppoe_getnewsession(sp));
1516                         }
1517                         send_sessionid(sp);
1518                         neg->timeout = 0;
1519                         /*
1520                          * start working out the tags to respond with.
1521                          */
1522                         init_tags(sp);
1523                         insert_tag(sp, &neg->ac_name.hdr); /* AC_NAME */
1524                         if ((tag = get_tag(ph, PTT_SRV_NAME)))
1525                                 insert_tag(sp, tag);/* return service */
1526                         if ((tag = get_tag(ph, PTT_HOST_UNIQ)))
1527                                 insert_tag(sp, tag); /* return it */
1528                         insert_tag(sp, utag);   /* ac_cookie */
1529                         scan_tags(sp, ph);
1530                         make_packet(sp);
1531                         sp->state = PPPOE_NEWCONNECTED;
1532
1533                         /* Send the PADS without a timeout - we're now connected. */
1534                         m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1535                         NG_FWD_NEW_DATA(error, item, privp->ethernet_hook, m0);
1536
1537                         /*
1538                          * Having sent the last Negotiation header,
1539                          * Set up the stored packet header to be correct for
1540                          * the actual session. But keep the negotialtion stuff
1541                          * around in case we need to resend this last packet.
1542                          * We'll discard it when we move from NEWCONNECTED
1543                          * to CONNECTED
1544                          */
1545                         sp->pkt_hdr = neg->pkt->pkt_header;
1546                         /* Configure ethertype depending on what
1547                          * ethertype was used at discovery phase */
1548                         if (sp->pkt_hdr.eh.ether_type ==
1549                             ETHERTYPE_PPPOE_3COM_DISC)
1550                                 sp->pkt_hdr.eh.ether_type
1551                                         = ETHERTYPE_PPPOE_3COM_SESS;
1552                         else
1553                                 sp->pkt_hdr.eh.ether_type
1554                                         = ETHERTYPE_PPPOE_SESS;
1555                         sp->pkt_hdr.ph.code = 0;
1556                         pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1557                         break;
1558                 case    PADS_CODE:
1559                         /*
1560                          * We are a client:
1561                          * Use the host_uniq tag to find the hook this is in
1562                          * response to. Take the session ID and store it away.
1563                          * Also make sure the pre-made header is correct and
1564                          * set us into Session mode.
1565                          */
1566                         utag = get_tag(ph, PTT_HOST_UNIQ);
1567                         if ((utag == NULL) ||
1568                             (ntohs(utag->tag_len) != sizeof(sp))) {
1569                                 LEAVE (ENETUNREACH);
1570                         }
1571                         sendhook = pppoe_finduniq(node, utag);
1572                         if (sendhook == NULL)
1573                                 LEAVE(ENETUNREACH);
1574
1575                         /*
1576                          * Check the session is in the right state.
1577                          * It needs to be in PPPOE_SREQ.
1578                          */
1579                         sp = NG_HOOK_PRIVATE(sendhook);
1580                         if (sp->state != PPPOE_SREQ)
1581                                 LEAVE(ENETUNREACH);
1582                         neg = sp->neg;
1583                         ng_uncallout(&neg->handle, node);
1584                         neg->pkt->pkt_header.ph.sid = wh->ph.sid;
1585                         sp->Session_ID = ntohs(wh->ph.sid);
1586                         pppoe_addsession(sp);
1587                         send_sessionid(sp);
1588                         neg->timeout = 0;
1589                         sp->state = PPPOE_CONNECTED;
1590                         /*
1591                          * Now we have gone to Connected mode,
1592                          * Free all resources needed for negotiation.
1593                          * Keep a copy of the header we will be using.
1594                          */
1595                         sp->pkt_hdr = neg->pkt->pkt_header;
1596                         if (privp->flags & COMPAT_3COM)
1597                                 sp->pkt_hdr.eh.ether_type
1598                                         = ETHERTYPE_PPPOE_3COM_SESS;
1599                         else
1600                                 sp->pkt_hdr.eh.ether_type
1601                                         = ETHERTYPE_PPPOE_SESS;
1602                         sp->pkt_hdr.ph.code = 0;
1603                         m_freem(neg->m);
1604                         free(sp->neg, M_NETGRAPH_PPPOE);
1605                         sp->neg = NULL;
1606                         pppoe_send_event(sp, NGM_PPPOE_SUCCESS);
1607                         break;
1608                 case    PADT_CODE:
1609                         /*
1610                          * Find matching peer/session combination.
1611                          */
1612                         sp = pppoe_findsession(privp, wh);
1613                         if (sp == NULL)
1614                                 LEAVE(ENETUNREACH);
1615                         /* Disconnect that hook. */
1616                         ng_rmhook_self(sp->hook);
1617                         break;
1618                 default:
1619                         LEAVE(EPFNOSUPPORT);
1620                 }
1621                 break;
1622         case    ETHERTYPE_PPPOE_3COM_SESS:
1623         case    ETHERTYPE_PPPOE_SESS:
1624                 /*
1625                  * Find matching peer/session combination.
1626                  */
1627                 sp = pppoe_findsession(privp, wh);
1628                 if (sp == NULL)
1629                         LEAVE (ENETUNREACH);
1630                 m_adj(m, sizeof(*wh));
1631
1632                 /* If packet too short, dump it. */
1633                 if (m->m_pkthdr.len < length)
1634                         LEAVE(EMSGSIZE);
1635                 /* Also need to trim excess at the end */
1636                 if (m->m_pkthdr.len > length) {
1637                         m_adj(m, -((int)(m->m_pkthdr.len - length)));
1638                 }
1639                 if ( sp->state != PPPOE_CONNECTED) {
1640                         if (sp->state == PPPOE_NEWCONNECTED) {
1641                                 sp->state = PPPOE_CONNECTED;
1642                                 /*
1643                                  * Now we have gone to Connected mode,
1644                                  * Free all resources needed for negotiation.
1645                                  * Be paranoid about whether there may be
1646                                  * a timeout.
1647                                  */
1648                                 m_freem(sp->neg->m);
1649                                 ng_uncallout(&sp->neg->handle, node);
1650                                 free(sp->neg, M_NETGRAPH_PPPOE);
1651                                 sp->neg = NULL;
1652                         } else {
1653                                 LEAVE (ENETUNREACH);
1654                         }
1655                 }
1656                 NG_FWD_NEW_DATA(error, item, sp->hook, m);
1657                 break;
1658         default:
1659                 LEAVE(EPFNOSUPPORT);
1660         }
1661 quit:
1662         if (item)
1663                 NG_FREE_ITEM(item);
1664         NG_FREE_M(m);
1665         return (error);
1666 }
1667
1668 /*
1669  * Receive data from debug hook and bypass it to ether.
1670  */
1671 static int
1672 ng_pppoe_rcvdata_debug(hook_p hook, item_p item)
1673 {
1674         node_p          node = NG_HOOK_NODE(hook);
1675         const priv_p    privp = NG_NODE_PRIVATE(node);
1676         int             error;
1677
1678         CTR6(KTR_NET, "%20s: node [%x] (%p) received %p on \"%s\" (%p)",
1679             __func__, node->nd_ID, node, item, hook->hk_name, hook);
1680
1681         NG_FWD_ITEM_HOOK(error, item, privp->ethernet_hook);
1682         privp->packets_out++;
1683         return (error);
1684 }
1685
1686 /*
1687  * Do local shutdown processing..
1688  * If we are a persistant device, we might refuse to go away, and
1689  * we'd only remove our links and reset ourself.
1690  */
1691 static int
1692 ng_pppoe_shutdown(node_p node)
1693 {
1694         const priv_p privp = NG_NODE_PRIVATE(node);
1695         int     i;
1696
1697         for (i = 0; i < SESSHASHSIZE; i++)
1698             mtx_destroy(&privp->sesshash[i].mtx);
1699         NG_NODE_SET_PRIVATE(node, NULL);
1700         NG_NODE_UNREF(privp->node);
1701         free(privp, M_NETGRAPH_PPPOE);
1702         return (0);
1703 }
1704
1705 /*
1706  * Hook disconnection
1707  *
1708  * Clean up all dangling links and information about the session/hook.
1709  * For this type, removal of the last link destroys the node.
1710  */
1711 static int
1712 ng_pppoe_disconnect(hook_p hook)
1713 {
1714         node_p node = NG_HOOK_NODE(hook);
1715         priv_p privp = NG_NODE_PRIVATE(node);
1716         sessp   sp;
1717
1718         if (hook == privp->debug_hook) {
1719                 privp->debug_hook = NULL;
1720         } else if (hook == privp->ethernet_hook) {
1721                 privp->ethernet_hook = NULL;
1722                 if (NG_NODE_IS_VALID(node))
1723                         ng_rmnode_self(node);
1724         } else {
1725                 sp = NG_HOOK_PRIVATE(hook);
1726                 if (sp->state != PPPOE_SNONE ) {
1727                         pppoe_send_event(sp, NGM_PPPOE_CLOSE);
1728                 }
1729                 /*
1730                  * According to the spec, if we are connected,
1731                  * we should send a DISC packet if we are shutting down
1732                  * a session.
1733                  */
1734                 if ((privp->ethernet_hook)
1735                 && ((sp->state == PPPOE_CONNECTED)
1736                  || (sp->state == PPPOE_NEWCONNECTED))) {
1737                         struct mbuf *m;
1738
1739                         /* Generate a packet of that type. */
1740                         MGETHDR(m, M_DONTWAIT, MT_DATA);
1741                         if (m == NULL)
1742                                 log(LOG_NOTICE, "ng_pppoe[%x]: session out of "
1743                                     "mbufs\n", node->nd_ID);
1744                         else {
1745                                 struct pppoe_full_hdr *wh;
1746                                 struct pppoe_tag *tag;
1747                                 int     msglen = strlen(SIGNOFF);
1748                                 int     error = 0;
1749
1750                                 m->m_pkthdr.rcvif = NULL;
1751                                 m->m_pkthdr.len = m->m_len = sizeof(*wh);
1752                                 wh = mtod(m, struct pppoe_full_hdr *);
1753                                 bcopy(&sp->pkt_hdr, wh, sizeof(*wh));
1754
1755                                 /* Revert the stored header to DISC/PADT mode. */
1756                                 wh->ph.code = PADT_CODE;
1757                                 /*
1758                                  * Configure ethertype depending on what
1759                                  * was used during sessions stage.
1760                                  */
1761                                 if (wh->eh.ether_type ==
1762                                     ETHERTYPE_PPPOE_3COM_SESS)
1763                                         wh->eh.ether_type = ETHERTYPE_PPPOE_3COM_DISC;
1764                                 else
1765                                         wh->eh.ether_type = ETHERTYPE_PPPOE_DISC;
1766                                 /*
1767                                  * Add a General error message and adjust
1768                                  * sizes.
1769                                  */
1770                                 tag = wh->ph.tag;
1771                                 tag->tag_type = PTT_GEN_ERR;
1772                                 tag->tag_len = htons((u_int16_t)msglen);
1773                                 strncpy(tag->tag_data, SIGNOFF, msglen);
1774                                 m->m_pkthdr.len = (m->m_len += sizeof(*tag) +
1775                                     msglen);
1776                                 wh->ph.length = htons(sizeof(*tag) + msglen);
1777                                 NG_SEND_DATA_ONLY(error,
1778                                         privp->ethernet_hook, m);
1779                         }
1780                 }
1781                 if (sp->state == PPPOE_LISTENING)
1782                         LIST_REMOVE(sp, sessions);
1783                 else if (sp->Session_ID)
1784                         pppoe_delsession(sp);
1785                 /*
1786                  * As long as we have somewhere to store the timeout handle,
1787                  * we may have a timeout pending.. get rid of it.
1788                  */
1789                 if (sp->neg) {
1790                         ng_uncallout(&sp->neg->handle, node);
1791                         if (sp->neg->m)
1792                                 m_freem(sp->neg->m);
1793                         free(sp->neg, M_NETGRAPH_PPPOE);
1794                 }
1795                 free(sp, M_NETGRAPH_PPPOE);
1796                 NG_HOOK_SET_PRIVATE(hook, NULL);
1797         }
1798         if ((NG_NODE_NUMHOOKS(node) == 0) &&
1799             (NG_NODE_IS_VALID(node)))
1800                 ng_rmnode_self(node);
1801         return (0);
1802 }
1803
1804 /*
1805  * Timeouts come here.
1806  */
1807 static void
1808 pppoe_ticker(node_p node, hook_p hook, void *arg1, int arg2)
1809 {
1810         priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1811         sessp   sp = NG_HOOK_PRIVATE(hook);
1812         negp    neg = sp->neg;
1813         struct mbuf *m0 = NULL;
1814         int     error = 0;
1815
1816         CTR6(KTR_NET, "%20s: node [%x] (%p) hook \"%s\" (%p) session %d",
1817             __func__, node->nd_ID, node, hook->hk_name, hook, sp->Session_ID);
1818         switch(sp->state) {
1819                 /*
1820                  * Resend the last packet, using an exponential backoff.
1821                  * After a period of time, stop growing the backoff,
1822                  * And either leave it, or revert to the start.
1823                  */
1824         case    PPPOE_SINIT:
1825         case    PPPOE_SREQ:
1826                 /* Timeouts on these produce resends. */
1827                 m0 = m_copypacket(sp->neg->m, M_DONTWAIT);
1828                 NG_SEND_DATA_ONLY( error, privp->ethernet_hook, m0);
1829                 ng_callout(&neg->handle, node, hook, neg->timeout * hz,
1830                     pppoe_ticker, NULL, 0);
1831                 if ((neg->timeout <<= 1) > PPPOE_TIMEOUT_LIMIT) {
1832                         if (sp->state == PPPOE_SREQ) {
1833                                 /* Revert to SINIT mode. */
1834                                 pppoe_start(sp);
1835                         } else {
1836                                 neg->timeout = PPPOE_TIMEOUT_LIMIT;
1837                         }
1838                 }
1839                 break;
1840         case    PPPOE_PRIMED:
1841         case    PPPOE_SOFFER:
1842                 /* A timeout on these says "give up" */
1843                 ng_rmhook_self(hook);
1844                 break;
1845         default:
1846                 /* Timeouts have no meaning in other states. */
1847                 log(LOG_NOTICE, "ng_pppoe[%x]: unexpected timeout\n",
1848                     node->nd_ID);
1849         }
1850 }
1851
1852 /*
1853  * Parse an incoming packet to see if any tags should be copied to the
1854  * output packet. Don't do any tags that have been handled in the main
1855  * state machine.
1856  */
1857 static const struct pppoe_tag*
1858 scan_tags(sessp sp, const struct pppoe_hdr* ph)
1859 {
1860         const char *const end = (const char *)next_tag(ph);
1861         const char *ptn;
1862         const struct pppoe_tag *pt = &ph->tag[0];
1863
1864         /*
1865          * Keep processing tags while a tag header will still fit.
1866          */
1867         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
1868
1869         while((const char*)(pt + 1) <= end) {
1870                 /*
1871                  * If the tag data would go past the end of the packet, abort.
1872                  */
1873                 ptn = (((const char *)(pt + 1)) + ntohs(pt->tag_len));
1874                 if(ptn > end)
1875                         return NULL;
1876
1877                 switch (pt->tag_type) {
1878                 case    PTT_RELAY_SID:
1879                         insert_tag(sp, pt);
1880                         break;
1881                 case    PTT_EOL:
1882                         return NULL;
1883                 case    PTT_SRV_NAME:
1884                 case    PTT_AC_NAME:
1885                 case    PTT_HOST_UNIQ:
1886                 case    PTT_AC_COOKIE:
1887                 case    PTT_VENDOR:
1888                 case    PTT_SRV_ERR:
1889                 case    PTT_SYS_ERR:
1890                 case    PTT_GEN_ERR:
1891                         break;
1892                 }
1893                 pt = (const struct pppoe_tag*)ptn;
1894         }
1895         return NULL;
1896 }
1897
1898 static  int
1899 pppoe_send_event(sessp sp, enum cmd cmdid)
1900 {
1901         int error;
1902         struct ng_mesg *msg;
1903         struct ngpppoe_sts *sts;
1904
1905         CTR2(KTR_NET, "%20s: called %d", __func__, sp->Session_ID);
1906
1907         NG_MKMESSAGE(msg, NGM_PPPOE_COOKIE, cmdid,
1908                         sizeof(struct ngpppoe_sts), M_NOWAIT);
1909         if (msg == NULL)
1910                 return (ENOMEM);
1911         sts = (struct ngpppoe_sts *)msg->data;
1912         strncpy(sts->hook, NG_HOOK_NAME(sp->hook), NG_HOOKSIZ);
1913         NG_SEND_MSG_ID(error, NG_HOOK_NODE(sp->hook), msg, sp->creator, 0);
1914         return (error);
1915 }