1/* $NetBSD: if_pppoe.c,v 1.119 2016/11/18 08:13:02 knakahara Exp $ */
2
3/*-
4 * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Martin Husemann <martin@NetBSD.org>.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.119 2016/11/18 08:13:02 knakahara Exp $");
34
35#ifdef _KERNEL_OPT
36#include "pppoe.h"
37#include "opt_pppoe.h"
38#endif
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/callout.h>
44#include <sys/malloc.h>
45#include <sys/mbuf.h>
46#include <sys/socket.h>
47#include <sys/proc.h>
48#include <sys/ioctl.h>
49#include <sys/kauth.h>
50#include <sys/intr.h>
51#include <sys/socketvar.h>
52#include <sys/device.h>
53#include <sys/module.h>
54#include <sys/sysctl.h>
55
56#include <net/if.h>
57#include <net/if_types.h>
58#include <net/if_ether.h>
59#include <net/if_sppp.h>
60#include <net/if_spppvar.h>
61#include <net/if_pppoe.h>
62
63#include <net/bpf.h>
64
65#include "ioconf.h"
66
67struct pppoehdr {
68 uint8_t vertype;
69 uint8_t code;
70 uint16_t session;
71 uint16_t plen;
72} __packed;
73
74struct pppoetag {
75 uint16_t tag;
76 uint16_t len;
77} __packed;
78
79#define PPPOE_HEADERLEN sizeof(struct pppoehdr)
80#define PPPOE_OVERHEAD (PPPOE_HEADERLEN + 2)
81#define PPPOE_VERTYPE 0x11 /* VER=1, TYPE = 1 */
82
83#define PPPOE_TAG_EOL 0x0000 /* end of list */
84#define PPPOE_TAG_SNAME 0x0101 /* service name */
85#define PPPOE_TAG_ACNAME 0x0102 /* access concentrator name */
86#define PPPOE_TAG_HUNIQUE 0x0103 /* host unique */
87#define PPPOE_TAG_ACCOOKIE 0x0104 /* AC cookie */
88#define PPPOE_TAG_VENDOR 0x0105 /* vendor specific */
89#define PPPOE_TAG_RELAYSID 0x0110 /* relay session id */
90#define PPPOE_TAG_MAX_PAYLOAD 0x0120 /* max payload */
91#define PPPOE_TAG_SNAME_ERR 0x0201 /* service name error */
92#define PPPOE_TAG_ACSYS_ERR 0x0202 /* AC system error */
93#define PPPOE_TAG_GENERIC_ERR 0x0203 /* generic error */
94
95#define PPPOE_CODE_PADI 0x09 /* Active Discovery Initiation */
96#define PPPOE_CODE_PADO 0x07 /* Active Discovery Offer */
97#define PPPOE_CODE_PADR 0x19 /* Active Discovery Request */
98#define PPPOE_CODE_PADS 0x65 /* Active Discovery Session confirmation */
99#define PPPOE_CODE_PADT 0xA7 /* Active Discovery Terminate */
100
101/* two byte PPP protocol discriminator, then IP data */
102#define PPPOE_MAXMTU (ETHERMTU - PPPOE_OVERHEAD)
103
104/* Add a 16 bit unsigned value to a buffer pointed to by PTR */
105#define PPPOE_ADD_16(PTR, VAL) \
106 *(PTR)++ = (VAL) / 256; \
107 *(PTR)++ = (VAL) % 256
108
109/* Add a complete PPPoE header to the buffer pointed to by PTR */
110#define PPPOE_ADD_HEADER(PTR, CODE, SESS, LEN) \
111 *(PTR)++ = PPPOE_VERTYPE; \
112 *(PTR)++ = (CODE); \
113 PPPOE_ADD_16(PTR, SESS); \
114 PPPOE_ADD_16(PTR, LEN)
115
116#define PPPOE_DISC_TIMEOUT (hz*5) /* base for quick timeout calculation */
117#define PPPOE_SLOW_RETRY (hz*60) /* persistent retry interval */
118#define PPPOE_RECON_FAST (hz*15) /* first retry after auth failure */
119#define PPPOE_RECON_IMMEDIATE (hz/10) /* "no delay" reconnect */
120#define PPPOE_DISC_MAXPADI 4 /* retry PADI four times (quickly) */
121#define PPPOE_DISC_MAXPADR 2 /* retry PADR twice */
122
123#ifdef PPPOE_SERVER
124/* from if_spppsubr.c */
125#define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */
126#endif
127
128struct pppoe_softc {
129 struct sppp sc_sppp; /* contains a struct ifnet as first element */
130 LIST_ENTRY(pppoe_softc) sc_list;
131 struct ifnet *sc_eth_if; /* ethernet interface we are using */
132
133 int sc_state; /* discovery phase or session connected */
134 struct ether_addr sc_dest; /* hardware address of concentrator */
135 uint16_t sc_session; /* PPPoE session id */
136
137 char *sc_service_name; /* if != NULL: requested name of service */
138 char *sc_concentrator_name; /* if != NULL: requested concentrator id */
139 uint8_t *sc_ac_cookie; /* content of AC cookie we must echo back */
140 size_t sc_ac_cookie_len; /* length of cookie data */
141 uint8_t *sc_relay_sid; /* content of relay SID we must echo back */
142 size_t sc_relay_sid_len; /* length of relay SID data */
143#ifdef PPPOE_SERVER
144 uint8_t *sc_hunique; /* content of host unique we must echo back */
145 size_t sc_hunique_len; /* length of host unique */
146#endif
147 callout_t sc_timeout; /* timeout while not in session state */
148 int sc_padi_retried; /* number of PADI retries already done */
149 int sc_padr_retried; /* number of PADR retries already done */
150};
151
152/* incoming traffic will be queued here */
153struct ifqueue ppoediscinq = { .ifq_maxlen = IFQ_MAXLEN };
154struct ifqueue ppoeinq = { .ifq_maxlen = IFQ_MAXLEN };
155
156void *pppoe_softintr = NULL;
157static void pppoe_softintr_handler(void *);
158
159extern int sppp_ioctl(struct ifnet *, unsigned long, void *);
160
161/* input routines */
162static void pppoeintr(void);
163static void pppoe_disc_input(struct mbuf *);
164static void pppoe_dispatch_disc_pkt(struct mbuf *, int);
165static void pppoe_data_input(struct mbuf *);
166static void pppoe_enqueue(struct ifqueue *, struct mbuf *);
167
168/* management routines */
169static int pppoe_connect(struct pppoe_softc *);
170static int pppoe_disconnect(struct pppoe_softc *);
171static void pppoe_abort_connect(struct pppoe_softc *);
172static int pppoe_ioctl(struct ifnet *, unsigned long, void *);
173static void pppoe_tls(struct sppp *);
174static void pppoe_tlf(struct sppp *);
175static void pppoe_start(struct ifnet *);
176static void pppoe_clear_softc(struct pppoe_softc *, const char *);
177
178/* internal timeout handling */
179static void pppoe_timeout(void *);
180
181/* sending actual protocol controll packets */
182static int pppoe_send_padi(struct pppoe_softc *);
183static int pppoe_send_padr(struct pppoe_softc *);
184#ifdef PPPOE_SERVER
185static int pppoe_send_pado(struct pppoe_softc *);
186static int pppoe_send_pads(struct pppoe_softc *);
187#endif
188static int pppoe_send_padt(struct ifnet *, u_int, const uint8_t *);
189
190/* raw output */
191static int pppoe_output(struct pppoe_softc *, struct mbuf *);
192
193/* internal helper functions */
194static struct pppoe_softc * pppoe_find_softc_by_session(u_int, struct ifnet *);
195static struct pppoe_softc * pppoe_find_softc_by_hunique(uint8_t *, size_t, struct ifnet *);
196static struct mbuf *pppoe_get_mbuf(size_t len);
197
198static int pppoe_ifattach_hook(void *, struct mbuf **, struct ifnet *, int);
199
200static LIST_HEAD(pppoe_softc_head, pppoe_softc) pppoe_softc_list;
201
202static int pppoe_clone_create(struct if_clone *, int);
203static int pppoe_clone_destroy(struct ifnet *);
204
205static bool pppoe_term_unknown = false;
206
207static struct sysctllog *pppoe_sysctl_clog;
208static void sysctl_net_pppoe_setup(struct sysctllog **);
209
210static struct if_clone pppoe_cloner =
211 IF_CLONE_INITIALIZER("pppoe", pppoe_clone_create, pppoe_clone_destroy);
212
213/* ARGSUSED */
214void
215pppoeattach(int count)
216{
217
218 /*
219 * Nothing to do here, initialization is handled by the
220 * module initialization code in pppoeinit() below).
221 */
222}
223
224static void
225pppoeinit(void)
226{
227
228 LIST_INIT(&pppoe_softc_list);
229 if_clone_attach(&pppoe_cloner);
230
231 pppoe_softintr = softint_establish(SOFTINT_NET, pppoe_softintr_handler,
232 NULL);
233 sysctl_net_pppoe_setup(&pppoe_sysctl_clog);
234
235 IFQ_LOCK_INIT(&ppoediscinq);
236 IFQ_LOCK_INIT(&ppoeinq);
237}
238
239static int
240pppoedetach(void)
241{
242 int error = 0;
243
244 if (!LIST_EMPTY(&pppoe_softc_list))
245 error = EBUSY;
246
247 if (error == 0) {
248 if_clone_detach(&pppoe_cloner);
249 softint_disestablish(pppoe_softintr);
250 /* Remove our sysctl sub-tree */
251 sysctl_teardown(&pppoe_sysctl_clog);
252 }
253
254 return error;
255}
256
257static int
258pppoe_clone_create(struct if_clone *ifc, int unit)
259{
260 struct pppoe_softc *sc;
261
262 sc = malloc(sizeof(struct pppoe_softc), M_DEVBUF, M_WAITOK|M_ZERO);
263
264 if_initname(&sc->sc_sppp.pp_if, "pppoe", unit);
265 sc->sc_sppp.pp_if.if_softc = sc;
266 sc->sc_sppp.pp_if.if_mtu = PPPOE_MAXMTU;
267 sc->sc_sppp.pp_if.if_flags = IFF_SIMPLEX|IFF_POINTOPOINT|IFF_MULTICAST;
268 sc->sc_sppp.pp_if.if_type = IFT_PPP;
269 sc->sc_sppp.pp_if.if_hdrlen = sizeof(struct ether_header) + PPPOE_HEADERLEN;
270 sc->sc_sppp.pp_if.if_dlt = DLT_PPP_ETHER;
271 sc->sc_sppp.pp_flags |= PP_KEEPALIVE | /* use LCP keepalive */
272 PP_NOFRAMING; /* no serial encapsulation */
273 sc->sc_sppp.pp_if.if_ioctl = pppoe_ioctl;
274 IFQ_SET_MAXLEN(&sc->sc_sppp.pp_if.if_snd, IFQ_MAXLEN);
275 IFQ_SET_READY(&sc->sc_sppp.pp_if.if_snd);
276
277 /* changed to real address later */
278 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
279
280 callout_init(&sc->sc_timeout, 0);
281
282 sc->sc_sppp.pp_if.if_start = pppoe_start;
283 sc->sc_sppp.pp_tls = pppoe_tls;
284 sc->sc_sppp.pp_tlf = pppoe_tlf;
285 sc->sc_sppp.pp_framebytes = PPPOE_HEADERLEN; /* framing added to ppp packets */
286
287 if_initialize(&sc->sc_sppp.pp_if);
288 sc->sc_sppp.pp_if.if_percpuq = if_percpuq_create(&sc->sc_sppp.pp_if);
289 sppp_attach(&sc->sc_sppp.pp_if);
290 if_register(&sc->sc_sppp.pp_if);
291
292 bpf_attach(&sc->sc_sppp.pp_if, DLT_PPP_ETHER, 0);
293 if (LIST_EMPTY(&pppoe_softc_list)) {
294 pfil_add_hook(pppoe_ifattach_hook, NULL, PFIL_IFNET, if_pfil);
295 }
296 LIST_INSERT_HEAD(&pppoe_softc_list, sc, sc_list);
297 return 0;
298}
299
300static int
301pppoe_clone_destroy(struct ifnet *ifp)
302{
303 struct pppoe_softc * sc = ifp->if_softc;
304
305 callout_stop(&sc->sc_timeout);
306 LIST_REMOVE(sc, sc_list);
307 if (LIST_EMPTY(&pppoe_softc_list)) {
308 pfil_remove_hook(pppoe_ifattach_hook, NULL, PFIL_IFNET, if_pfil);
309 }
310 bpf_detach(ifp);
311 sppp_detach(&sc->sc_sppp.pp_if);
312 if_detach(ifp);
313 if (sc->sc_concentrator_name)
314 free(sc->sc_concentrator_name, M_DEVBUF);
315 if (sc->sc_service_name)
316 free(sc->sc_service_name, M_DEVBUF);
317 if (sc->sc_ac_cookie)
318 free(sc->sc_ac_cookie, M_DEVBUF);
319 if (sc->sc_relay_sid)
320 free(sc->sc_relay_sid, M_DEVBUF);
321 callout_destroy(&sc->sc_timeout);
322 free(sc, M_DEVBUF);
323
324 return (0);
325}
326
327/*
328 * Find the interface handling the specified session.
329 * Note: O(number of sessions open), this is a client-side only, mean
330 * and lean implementation, so number of open sessions typically should
331 * be 1.
332 */
333static struct pppoe_softc *
334pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif)
335{
336 struct pppoe_softc *sc;
337
338 if (session == 0)
339 return NULL;
340
341 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) {
342 if (sc->sc_state == PPPOE_STATE_SESSION
343 && sc->sc_session == session
344 && sc->sc_eth_if == rcvif)
345 return sc;
346 }
347 return NULL;
348}
349
350/* Check host unique token passed and return appropriate softc pointer,
351 * or NULL if token is bogus. */
352static struct pppoe_softc *
353pppoe_find_softc_by_hunique(uint8_t *token, size_t len, struct ifnet *rcvif)
354{
355 struct pppoe_softc *sc, *t;
356
357 if (LIST_EMPTY(&pppoe_softc_list))
358 return NULL;
359
360 if (len != sizeof sc)
361 return NULL;
362 memcpy(&t, token, len);
363
364 LIST_FOREACH(sc, &pppoe_softc_list, sc_list)
365 if (sc == t) break;
366
367 if (sc == NULL) {
368#ifdef PPPOE_DEBUG
369 printf("pppoe: alien host unique tag, no session found\n");
370#endif
371 return NULL;
372 }
373
374 /* should be safe to access *sc now */
375 if (sc->sc_state < PPPOE_STATE_PADI_SENT || sc->sc_state >= PPPOE_STATE_SESSION) {
376 printf("%s: host unique tag found, but it belongs to a connection in state %d\n",
377 sc->sc_sppp.pp_if.if_xname, sc->sc_state);
378 return NULL;
379 }
380 if (sc->sc_eth_if != rcvif) {
381 printf("%s: wrong interface, not accepting host unique\n",
382 sc->sc_sppp.pp_if.if_xname);
383 return NULL;
384 }
385 return sc;
386}
387
388static void
389pppoe_softintr_handler(void *dummy)
390{
391 /* called at splsoftnet() */
392 mutex_enter(softnet_lock);
393 pppoeintr();
394 mutex_exit(softnet_lock);
395}
396
397/* called at appropriate protection level */
398static void
399pppoeintr(void)
400{
401 struct mbuf *m;
402 int disc_done, data_done;
403
404 do {
405 disc_done = 0;
406 data_done = 0;
407 for (;;) {
408 IFQ_LOCK(&ppoediscinq);
409 IF_DEQUEUE(&ppoediscinq, m);
410 IFQ_UNLOCK(&ppoediscinq);
411 if (m == NULL) break;
412 disc_done = 1;
413 pppoe_disc_input(m);
414 }
415
416 for (;;) {
417 IFQ_LOCK(&ppoeinq);
418 IF_DEQUEUE(&ppoeinq, m);
419 IFQ_UNLOCK(&ppoeinq);
420 if (m == NULL) break;
421 data_done = 1;
422 pppoe_data_input(m);
423 }
424 } while (disc_done || data_done);
425}
426
427/* analyze and handle a single received packet while not in session state */
428static void
429pppoe_dispatch_disc_pkt(struct mbuf *m, int off)
430{
431 uint16_t tag, len;
432 uint16_t session, plen;
433 struct pppoe_softc *sc;
434 const char *err_msg, *devname;
435 char *error;
436 uint8_t *ac_cookie;
437 size_t ac_cookie_len;
438 uint8_t *relay_sid;
439 size_t relay_sid_len;
440#ifdef PPPOE_SERVER
441 uint8_t *hunique;
442 size_t hunique_len;
443#endif
444 struct pppoehdr *ph;
445 struct pppoetag *pt;
446 struct mbuf *n;
447 int noff, err, errortag;
448 struct ether_header *eh;
449
450 devname = "pppoe"; /* as long as we don't know which instance */
451 err_msg = NULL;
452 errortag = 0;
453 if (m->m_len < sizeof(*eh)) {
454 m = m_pullup(m, sizeof(*eh));
455 if (!m)
456 goto done;
457 }
458 eh = mtod(m, struct ether_header *);
459 off += sizeof(*eh);
460
461 ac_cookie = NULL;
462 ac_cookie_len = 0;
463 relay_sid = NULL;
464 relay_sid_len = 0;
465#ifdef PPPOE_SERVER
466 hunique = NULL;
467 hunique_len = 0;
468#endif
469 session = 0;
470 if (m->m_pkthdr.len - off <= PPPOE_HEADERLEN) {
471 printf("pppoe: packet too short: %d\n", m->m_pkthdr.len);
472 goto done;
473 }
474
475 n = m_pulldown(m, off, sizeof(*ph), &noff);
476 if (!n) {
477 printf("pppoe: could not get PPPoE header\n");
478 m = NULL;
479 goto done;
480 }
481 ph = (struct pppoehdr *)(mtod(n, char *) + noff);
482 if (ph->vertype != PPPOE_VERTYPE) {
483 printf("pppoe: unknown version/type packet: 0x%x\n",
484 ph->vertype);
485 goto done;
486 }
487 session = ntohs(ph->session);
488 plen = ntohs(ph->plen);
489 off += sizeof(*ph);
490
491 if (plen + off > m->m_pkthdr.len) {
492 printf("pppoe: packet content does not fit: data available = %d, packet size = %u\n",
493 m->m_pkthdr.len - off, plen);
494 goto done;
495 }
496 m_adj(m, off + plen - m->m_pkthdr.len); /* ignore trailing garbage */
497 tag = 0;
498 len = 0;
499 sc = NULL;
500 while (off + sizeof(*pt) <= m->m_pkthdr.len) {
501 n = m_pulldown(m, off, sizeof(*pt), &noff);
502 if (!n) {
503 printf("%s: parse error\n", devname);
504 m = NULL;
505 goto done;
506 }
507 pt = (struct pppoetag *)(mtod(n, char *) + noff);
508 tag = ntohs(pt->tag);
509 len = ntohs(pt->len);
510 if (off + len + sizeof(*pt) > m->m_pkthdr.len) {
511 printf("pppoe: tag 0x%x len 0x%x is too long\n",
512 tag, len);
513 goto done;
514 }
515 switch (tag) {
516 case PPPOE_TAG_EOL:
517 goto breakbreak;
518 case PPPOE_TAG_SNAME:
519 break; /* ignored */
520 case PPPOE_TAG_ACNAME:
521 error = NULL;
522 if (sc != NULL && len > 0) {
523 error = malloc(len+1, M_TEMP, M_NOWAIT);
524 if (error) {
525 n = m_pulldown(m, off + sizeof(*pt),
526 len, &noff);
527 if (n) {
528 strlcpy(error,
529 mtod(n, char*) + noff,
530 len);
531 }
532 printf("%s: connected to %s\n",
533 devname, error);
534 free(error, M_TEMP);
535 }
536 }
537 break; /* ignored */
538 case PPPOE_TAG_HUNIQUE: {
539 struct ifnet *rcvif;
540 int s;
541 if (sc != NULL)
542 break;
543 n = m_pulldown(m, off + sizeof(*pt), len, &noff);
544 if (!n) {
545 m = NULL;
546 err_msg = "TAG HUNIQUE ERROR";
547 break;
548 }
549#ifdef PPPOE_SERVER
550 hunique = mtod(n, uint8_t *) + noff;
551 hunique_len = len;
552#endif
553 rcvif = m_get_rcvif(m, &s);
554 sc = pppoe_find_softc_by_hunique(mtod(n, char *) + noff,
555 len, rcvif);
556 m_put_rcvif(rcvif, &s);
557 if (sc != NULL)
558 devname = sc->sc_sppp.pp_if.if_xname;
559 break;
560 }
561 case PPPOE_TAG_ACCOOKIE:
562 if (ac_cookie == NULL) {
563 n = m_pulldown(m, off + sizeof(*pt), len,
564 &noff);
565 if (!n) {
566 err_msg = "TAG ACCOOKIE ERROR";
567 m = NULL;
568 break;
569 }
570 ac_cookie = mtod(n, char *) + noff;
571 ac_cookie_len = len;
572 }
573 break;
574 case PPPOE_TAG_RELAYSID:
575 if (relay_sid == NULL) {
576 n = m_pulldown(m, off + sizeof(*pt), len,
577 &noff);
578 if (!n) {
579 err_msg = "TAG RELAYSID ERROR";
580 m = NULL;
581 break;
582 }
583 relay_sid = mtod(n, char *) + noff;
584 relay_sid_len = len;
585 }
586 break;
587 case PPPOE_TAG_SNAME_ERR:
588 err_msg = "SERVICE NAME ERROR";
589 errortag = 1;
590 break;
591 case PPPOE_TAG_ACSYS_ERR:
592 err_msg = "AC SYSTEM ERROR";
593 errortag = 1;
594 break;
595 case PPPOE_TAG_GENERIC_ERR:
596 err_msg = "GENERIC ERROR";
597 errortag = 1;
598 break;
599 }
600 if (err_msg) {
601 error = NULL;
602 if (errortag && len) {
603 error = malloc(len+1, M_TEMP, M_NOWAIT);
604 n = m_pulldown(m, off + sizeof(*pt), len,
605 &noff);
606 if (n && error) {
607 strlcpy(error,
608 mtod(n, char *) + noff, len);
609 }
610 }
611 if (error) {
612 printf("%s: %s: %s\n", devname,
613 err_msg, error);
614 free(error, M_TEMP);
615 } else
616 printf("%s: %s\n", devname, err_msg);
617 if (errortag || m == NULL)
618 goto done;
619 }
620 off += sizeof(*pt) + len;
621 }
622breakbreak:;
623 switch (ph->code) {
624 case PPPOE_CODE_PADI:
625#ifdef PPPOE_SERVER
626 /*
627 * got service name, concentrator name, and/or host unique.
628 * ignore if we have no interfaces with IFF_PASSIVE|IFF_UP.
629 */
630 if (LIST_EMPTY(&pppoe_softc_list))
631 goto done;
632 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) {
633 if (!(sc->sc_sppp.pp_if.if_flags & IFF_UP))
634 continue;
635 if (!(sc->sc_sppp.pp_if.if_flags & IFF_PASSIVE))
636 continue;
637 if (sc->sc_state == PPPOE_STATE_INITIAL)
638 break;
639 }
640 if (sc == NULL) {
641/* printf("pppoe: free passive interface is not found\n");*/
642 goto done;
643 }
644 if (hunique) {
645 if (sc->sc_hunique)
646 free(sc->sc_hunique, M_DEVBUF);
647 sc->sc_hunique = malloc(hunique_len, M_DEVBUF,
648 M_DONTWAIT);
649 if (sc->sc_hunique == NULL)
650 goto done;
651 sc->sc_hunique_len = hunique_len;
652 memcpy(sc->sc_hunique, hunique, hunique_len);
653 }
654 memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
655 sc->sc_state = PPPOE_STATE_PADO_SENT;
656 pppoe_send_pado(sc);
657 break;
658#endif /* PPPOE_SERVER */
659 case PPPOE_CODE_PADR:
660#ifdef PPPOE_SERVER
661 /*
662 * get sc from ac_cookie if IFF_PASSIVE
663 */
664 if (ac_cookie == NULL) {
665 /* be quiet if there is not a single pppoe instance */
666 printf("pppoe: received PADR but not includes ac_cookie\n");
667 goto done;
668 }
669 sc = pppoe_find_softc_by_hunique(ac_cookie,
670 ac_cookie_len,
671 m_get_rcvif_NOMPSAFE(m));
672 if (sc == NULL) {
673 /* be quiet if there is not a single pppoe instance */
674 if (!LIST_EMPTY(&pppoe_softc_list))
675 printf("pppoe: received PADR but could not find request for it\n");
676 goto done;
677 }
678 if (sc->sc_state != PPPOE_STATE_PADO_SENT) {
679 printf("%s: received unexpected PADR\n",
680 sc->sc_sppp.pp_if.if_xname);
681 goto done;
682 }
683 if (hunique) {
684 if (sc->sc_hunique)
685 free(sc->sc_hunique, M_DEVBUF);
686 sc->sc_hunique = malloc(hunique_len, M_DEVBUF,
687 M_DONTWAIT);
688 if (sc->sc_hunique == NULL)
689 goto done;
690 sc->sc_hunique_len = hunique_len;
691 memcpy(sc->sc_hunique, hunique, hunique_len);
692 }
693 pppoe_send_pads(sc);
694 sc->sc_state = PPPOE_STATE_SESSION;
695 sc->sc_sppp.pp_up(&sc->sc_sppp);
696 break;
697#else
698 /* ignore, we are no access concentrator */
699 goto done;
700#endif /* PPPOE_SERVER */
701 case PPPOE_CODE_PADO:
702 if (sc == NULL) {
703 /* be quiet if there is not a single pppoe instance */
704 if (!LIST_EMPTY(&pppoe_softc_list))
705 printf("pppoe: received PADO but could not find request for it\n");
706 goto done;
707 }
708 if (sc->sc_state != PPPOE_STATE_PADI_SENT) {
709 printf("%s: received unexpected PADO\n",
710 sc->sc_sppp.pp_if.if_xname);
711 goto done;
712 }
713 if (ac_cookie) {
714 if (sc->sc_ac_cookie)
715 free(sc->sc_ac_cookie, M_DEVBUF);
716 sc->sc_ac_cookie = malloc(ac_cookie_len, M_DEVBUF,
717 M_DONTWAIT);
718 if (sc->sc_ac_cookie == NULL) {
719 printf("%s: FATAL: could not allocate memory "
720 "for AC cookie\n",
721 sc->sc_sppp.pp_if.if_xname);
722 goto done;
723 }
724 sc->sc_ac_cookie_len = ac_cookie_len;
725 memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
726 }
727 if (relay_sid) {
728 if (sc->sc_relay_sid)
729 free(sc->sc_relay_sid, M_DEVBUF);
730 sc->sc_relay_sid = malloc(relay_sid_len, M_DEVBUF,
731 M_DONTWAIT);
732 if (sc->sc_relay_sid == NULL) {
733 printf("%s: FATAL: could not allocate memory "
734 "for relay SID\n",
735 sc->sc_sppp.pp_if.if_xname);
736 goto done;
737 }
738 sc->sc_relay_sid_len = relay_sid_len;
739 memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
740 }
741 memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
742 callout_stop(&sc->sc_timeout);
743 sc->sc_padr_retried = 0;
744 sc->sc_state = PPPOE_STATE_PADR_SENT;
745 if ((err = pppoe_send_padr(sc)) != 0) {
746 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
747 printf("%s: failed to send PADR, "
748 "error=%d\n", sc->sc_sppp.pp_if.if_xname,
749 err);
750 }
751 callout_reset(&sc->sc_timeout,
752 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padr_retried),
753 pppoe_timeout, sc);
754 break;
755 case PPPOE_CODE_PADS:
756 if (sc == NULL)
757 goto done;
758 sc->sc_session = session;
759 callout_stop(&sc->sc_timeout);
760 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
761 printf("%s: session 0x%x connected\n",
762 sc->sc_sppp.pp_if.if_xname, session);
763 sc->sc_state = PPPOE_STATE_SESSION;
764 sc->sc_sppp.pp_up(&sc->sc_sppp); /* notify upper layers */
765 break;
766 case PPPOE_CODE_PADT: {
767 struct ifnet *rcvif;
768 int s;
769
770 rcvif = m_get_rcvif(m, &s);
771 sc = pppoe_find_softc_by_session(session, rcvif);
772 m_put_rcvif(rcvif, &s);
773 if (sc == NULL)
774 goto done;
775 pppoe_clear_softc(sc, "received PADT");
776 break;
777 }
778 default:
779 printf("%s: unknown code (0x%04x) session = 0x%04x\n",
780 sc? sc->sc_sppp.pp_if.if_xname : "pppoe",
781 ph->code, session);
782 break;
783 }
784
785done:
786 if (m)
787 m_freem(m);
788 return;
789}
790
791static void
792pppoe_disc_input(struct mbuf *m)
793{
794
795 /* avoid error messages if there is not a single pppoe instance */
796 if (!LIST_EMPTY(&pppoe_softc_list)) {
797 KASSERT(m->m_flags & M_PKTHDR);
798 pppoe_dispatch_disc_pkt(m, 0);
799 } else
800 m_freem(m);
801}
802
803static void
804pppoe_data_input(struct mbuf *m)
805{
806 uint16_t session, plen;
807 struct pppoe_softc *sc;
808 struct pppoehdr *ph;
809 struct ifnet *rcvif;
810 struct psref psref;
811 uint8_t shost[ETHER_ADDR_LEN];
812
813 KASSERT(m->m_flags & M_PKTHDR);
814
815 if (pppoe_term_unknown)
816 memcpy(shost, mtod(m, struct ether_header*)->ether_shost,
817 ETHER_ADDR_LEN);
818 m_adj(m, sizeof(struct ether_header));
819 if (m->m_pkthdr.len <= PPPOE_HEADERLEN) {
820 printf("pppoe (data): dropping too short packet: %d bytes\n",
821 m->m_pkthdr.len);
822 goto drop;
823 }
824
825 if (m->m_len < sizeof(*ph)) {
826 m = m_pullup(m, sizeof(*ph));
827 if (!m) {
828 printf("pppoe: could not get PPPoE header\n");
829 return;
830 }
831 }
832 ph = mtod(m, struct pppoehdr *);
833
834 if (ph->vertype != PPPOE_VERTYPE) {
835 printf("pppoe (data): unknown version/type packet: 0x%x\n",
836 ph->vertype);
837 goto drop;
838 }
839 if (ph->code != 0)
840 goto drop;
841
842 session = ntohs(ph->session);
843 rcvif = m_get_rcvif_psref(m, &psref);
844 if (__predict_false(rcvif == NULL))
845 goto drop;
846 sc = pppoe_find_softc_by_session(session, rcvif);
847 if (sc == NULL) {
848 if (pppoe_term_unknown) {
849 printf("pppoe: input for unknown session %#x, "
850 "sending PADT\n", session);
851 pppoe_send_padt(rcvif, session, shost);
852 }
853 m_put_rcvif_psref(rcvif, &psref);
854 goto drop;
855 }
856 m_put_rcvif_psref(rcvif, &psref);
857
858 plen = ntohs(ph->plen);
859
860 bpf_mtap(&sc->sc_sppp.pp_if, m);
861
862 m_adj(m, PPPOE_HEADERLEN);
863
864#ifdef PPPOE_DEBUG
865 {
866 struct mbuf *p;
867
868 printf("%s: pkthdr.len=%d, pppoe.len=%d",
869 sc->sc_sppp.pp_if.if_xname,
870 m->m_pkthdr.len, plen);
871 p = m;
872 while (p) {
873 printf(" l=%d", p->m_len);
874 p = p->m_next;
875 }
876 printf("\n");
877 }
878#endif
879
880 if (m->m_pkthdr.len < plen)
881 goto drop;
882
883 /* fix incoming interface pointer (not the raw ethernet interface anymore) */
884 m_set_rcvif(m, &sc->sc_sppp.pp_if);
885
886 /* pass packet up and account for it */
887 sc->sc_sppp.pp_if.if_ipackets++;
888 sppp_input(&sc->sc_sppp.pp_if, m);
889 return;
890
891drop:
892 m_freem(m);
893}
894
895static int
896pppoe_output(struct pppoe_softc *sc, struct mbuf *m)
897{
898 struct sockaddr dst;
899 struct ether_header *eh;
900 uint16_t etype;
901
902 if (sc->sc_eth_if == NULL) {
903 m_freem(m);
904 return EIO;
905 }
906
907 memset(&dst, 0, sizeof dst);
908 dst.sa_family = AF_UNSPEC;
909 eh = (struct ether_header*)&dst.sa_data;
910 etype = sc->sc_state == PPPOE_STATE_SESSION ? ETHERTYPE_PPPOE : ETHERTYPE_PPPOEDISC;
911 eh->ether_type = htons(etype);
912 memcpy(&eh->ether_dhost, &sc->sc_dest, sizeof sc->sc_dest);
913
914#ifdef PPPOE_DEBUG
915 printf("%s (%x) state=%d, session=0x%x output -> %s, len=%d\n",
916 sc->sc_sppp.pp_if.if_xname, etype,
917 sc->sc_state, sc->sc_session,
918 ether_sprintf((const unsigned char *)&sc->sc_dest), m->m_pkthdr.len);
919#endif
920
921 m->m_flags &= ~(M_BCAST|M_MCAST);
922 sc->sc_sppp.pp_if.if_opackets++;
923 return if_output_lock(sc->sc_eth_if, sc->sc_eth_if, m, &dst, NULL);
924}
925
926static int
927pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, void *data)
928{
929 struct lwp *l = curlwp; /* XXX */
930 struct pppoe_softc *sc = (struct pppoe_softc*)ifp;
931 struct ifreq *ifr = data;
932 int error = 0;
933
934 switch (cmd) {
935 case PPPOESETPARMS:
936 {
937 struct pppoediscparms *parms = (struct pppoediscparms*)data;
938 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_INTERFACE,
939 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
940 NULL) != 0)
941 return (EPERM);
942 if (parms->eth_ifname[0] != 0) {
943 struct ifnet *eth_if;
944
945 eth_if = ifunit(parms->eth_ifname);
946 if (eth_if == NULL || eth_if->if_dlt != DLT_EN10MB) {
947 sc->sc_eth_if = NULL;
948 return ENXIO;
949 }
950
951 if (sc->sc_sppp.pp_if.if_mtu !=
952 eth_if->if_mtu - PPPOE_OVERHEAD) {
953 sc->sc_sppp.pp_if.if_mtu = eth_if->if_mtu -
954 PPPOE_OVERHEAD;
955 }
956 sc->sc_eth_if = eth_if;
957 }
958 if (parms->ac_name != NULL) {
959 size_t s;
960 char *b = malloc(parms->ac_name_len + 1, M_DEVBUF,
961 M_WAITOK);
962 if (b == NULL)
963 return ENOMEM;
964 error = copyinstr(parms->ac_name, b,
965 parms->ac_name_len+1, &s);
966 if (error != 0) {
967 free(b, M_DEVBUF);
968 return error;
969 }
970 if (s != parms->ac_name_len+1) {
971 free(b, M_DEVBUF);
972 return EINVAL;
973 }
974 if (sc->sc_concentrator_name)
975 free(sc->sc_concentrator_name, M_DEVBUF);
976 sc->sc_concentrator_name = b;
977 }
978 if (parms->service_name != NULL) {
979 size_t s;
980 char *b = malloc(parms->service_name_len + 1, M_DEVBUF,
981 M_WAITOK);
982 if (b == NULL)
983 return ENOMEM;
984 error = copyinstr(parms->service_name, b,
985 parms->service_name_len+1, &s);
986 if (error != 0) {
987 free(b, M_DEVBUF);
988 return error;
989 }
990 if (s != parms->service_name_len+1) {
991 free(b, M_DEVBUF);
992 return EINVAL;
993 }
994 if (sc->sc_service_name)
995 free(sc->sc_service_name, M_DEVBUF);
996 sc->sc_service_name = b;
997 }
998 return 0;
999 }
1000 break;
1001 case PPPOEGETPARMS:
1002 {
1003 struct pppoediscparms *parms = (struct pppoediscparms*)data;
1004 memset(parms, 0, sizeof *parms);
1005 if (sc->sc_eth_if)
1006 strlcpy(parms->ifname, sc->sc_eth_if->if_xname,
1007 sizeof(parms->ifname));
1008 return 0;
1009 }
1010 break;
1011 case PPPOEGETSESSION:
1012 {
1013 struct pppoeconnectionstate *state = (struct pppoeconnectionstate*)data;
1014 state->state = sc->sc_state;
1015 state->session_id = sc->sc_session;
1016 state->padi_retry_no = sc->sc_padi_retried;
1017 state->padr_retry_no = sc->sc_padr_retried;
1018 return 0;
1019 }
1020 break;
1021 case SIOCSIFFLAGS:
1022 /*
1023 * Prevent running re-establishment timers overriding
1024 * administrators choice.
1025 */
1026 if ((ifr->ifr_flags & IFF_UP) == 0
1027 && sc->sc_state >= PPPOE_STATE_PADI_SENT
1028 && sc->sc_state < PPPOE_STATE_SESSION) {
1029 callout_stop(&sc->sc_timeout);
1030 sc->sc_state = PPPOE_STATE_INITIAL;
1031 sc->sc_padi_retried = 0;
1032 sc->sc_padr_retried = 0;
1033 memcpy(&sc->sc_dest, etherbroadcastaddr,
1034 sizeof(sc->sc_dest));
1035 }
1036 return sppp_ioctl(ifp, cmd, data);
1037 case SIOCSIFMTU:
1038 if (ifr->ifr_mtu > (sc->sc_eth_if == NULL ?
1039 PPPOE_MAXMTU : (sc->sc_eth_if->if_mtu - PPPOE_OVERHEAD))) {
1040 return EINVAL;
1041 }
1042 /*FALLTHROUGH*/
1043 default:
1044 return sppp_ioctl(ifp, cmd, data);
1045 }
1046 return 0;
1047}
1048
1049/*
1050 * Allocate a mbuf/cluster with space to store the given data length
1051 * of payload, leaving space for prepending an ethernet header
1052 * in front.
1053 */
1054static struct mbuf *
1055pppoe_get_mbuf(size_t len)
1056{
1057 struct mbuf *m;
1058
1059 MGETHDR(m, M_DONTWAIT, MT_DATA);
1060 if (m == NULL)
1061 return NULL;
1062 if (len + sizeof(struct ether_header) > MHLEN) {
1063 MCLGET(m, M_DONTWAIT);
1064 if ((m->m_flags & M_EXT) == 0) {
1065 m_free(m);
1066 return NULL;
1067 }
1068 }
1069 m->m_data += sizeof(struct ether_header);
1070 m->m_len = len;
1071 m->m_pkthdr.len = len;
1072 m_reset_rcvif(m);
1073
1074 return m;
1075}
1076
1077static int
1078pppoe_send_padi(struct pppoe_softc *sc)
1079{
1080 struct mbuf *m0;
1081 int len, l1 = 0, l2 = 0; /* XXX: gcc */
1082 uint8_t *p;
1083
1084 if (sc->sc_state >PPPOE_STATE_PADI_SENT)
1085 panic("pppoe_send_padi in state %d", sc->sc_state);
1086
1087 /* calculate length of frame (excluding ethernet header + pppoe header) */
1088 len = 2 + 2 + 2 + 2 + sizeof sc; /* service name tag is required, host unique is send too */
1089 if (sc->sc_service_name != NULL) {
1090 l1 = strlen(sc->sc_service_name);
1091 len += l1;
1092 }
1093 if (sc->sc_concentrator_name != NULL) {
1094 l2 = strlen(sc->sc_concentrator_name);
1095 len += 2 + 2 + l2;
1096 }
1097 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) {
1098 len += 2 + 2 + 2;
1099 }
1100
1101 /* allocate a buffer */
1102 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN); /* header len + payload len */
1103 if (!m0)
1104 return ENOBUFS;
1105
1106 /* fill in pkt */
1107 p = mtod(m0, uint8_t *);
1108 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADI, 0, len);
1109 PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
1110 if (sc->sc_service_name != NULL) {
1111 PPPOE_ADD_16(p, l1);
1112 memcpy(p, sc->sc_service_name, l1);
1113 p += l1;
1114 } else {
1115 PPPOE_ADD_16(p, 0);
1116 }
1117 if (sc->sc_concentrator_name != NULL) {
1118 PPPOE_ADD_16(p, PPPOE_TAG_ACNAME);
1119 PPPOE_ADD_16(p, l2);
1120 memcpy(p, sc->sc_concentrator_name, l2);
1121 p += l2;
1122 }
1123 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
1124 PPPOE_ADD_16(p, sizeof(sc));
1125 memcpy(p, &sc, sizeof sc);
1126 p += sizeof(sc);
1127
1128 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) {
1129 PPPOE_ADD_16(p, PPPOE_TAG_MAX_PAYLOAD);
1130 PPPOE_ADD_16(p, 2);
1131 PPPOE_ADD_16(p, (uint16_t)sc->sc_sppp.pp_if.if_mtu);
1132 }
1133
1134#ifdef PPPOE_DEBUG
1135 p += sizeof sc;
1136 if (p - mtod(m0, uint8_t *) != len + PPPOE_HEADERLEN)
1137 panic("pppoe_send_padi: garbled output len, should be %ld, is %ld",
1138 (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, uint8_t *)));
1139#endif
1140
1141 /* send pkt */
1142 return pppoe_output(sc, m0);
1143}
1144
1145static void
1146pppoe_timeout(void *arg)
1147{
1148 int x, retry_wait, err;
1149 struct pppoe_softc *sc = (struct pppoe_softc*)arg;
1150
1151#ifdef PPPOE_DEBUG
1152 printf("%s: timeout\n", sc->sc_sppp.pp_if.if_xname);
1153#endif
1154
1155 switch (sc->sc_state) {
1156 case PPPOE_STATE_INITIAL:
1157 /* delayed connect from pppoe_tls() */
1158 pppoe_connect(sc);
1159 break;
1160 case PPPOE_STATE_PADI_SENT:
1161 /*
1162 * We have two basic ways of retrying:
1163 * - Quick retry mode: try a few times in short sequence
1164 * - Slow retry mode: we already had a connection successfully
1165 * established and will try infinitely (without user
1166 * intervention)
1167 * We only enter slow retry mode if IFF_LINK1 (aka autodial)
1168 * is not set.
1169 */
1170
1171 /* initialize for quick retry mode */
1172 retry_wait = PPPOE_DISC_TIMEOUT * (1 + sc->sc_padi_retried);
1173
1174 x = splnet();
1175 sc->sc_padi_retried++;
1176 if (sc->sc_padi_retried >= PPPOE_DISC_MAXPADI) {
1177 if ((sc->sc_sppp.pp_if.if_flags & IFF_LINK1) == 0) {
1178 /* slow retry mode */
1179 retry_wait = PPPOE_SLOW_RETRY;
1180 } else {
1181 pppoe_abort_connect(sc);
1182 splx(x);
1183 return;
1184 }
1185 }
1186 if ((err = pppoe_send_padi(sc)) != 0) {
1187 sc->sc_padi_retried--;
1188 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1189 printf("%s: failed to transmit PADI, "
1190 "error=%d\n",
1191 sc->sc_sppp.pp_if.if_xname, err);
1192 }
1193 callout_reset(&sc->sc_timeout, retry_wait,
1194 pppoe_timeout, sc);
1195 splx(x);
1196 break;
1197
1198 case PPPOE_STATE_PADR_SENT:
1199 x = splnet();
1200 sc->sc_padr_retried++;
1201 if (sc->sc_padr_retried >= PPPOE_DISC_MAXPADR) {
1202 memcpy(&sc->sc_dest, etherbroadcastaddr,
1203 sizeof(sc->sc_dest));
1204 sc->sc_state = PPPOE_STATE_PADI_SENT;
1205 sc->sc_padr_retried = 0;
1206 if ((err = pppoe_send_padi(sc)) != 0) {
1207 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1208 printf("%s: failed to send PADI"
1209 ", error=%d\n",
1210 sc->sc_sppp.pp_if.if_xname,
1211 err);
1212 }
1213 callout_reset(&sc->sc_timeout,
1214 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padi_retried),
1215 pppoe_timeout, sc);
1216 splx(x);
1217 return;
1218 }
1219 if ((err = pppoe_send_padr(sc)) != 0) {
1220 sc->sc_padr_retried--;
1221 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1222 printf("%s: failed to send PADR, "
1223 "error=%d\n", sc->sc_sppp.pp_if.if_xname,
1224 err);
1225 }
1226 callout_reset(&sc->sc_timeout,
1227 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padr_retried),
1228 pppoe_timeout, sc);
1229 splx(x);
1230 break;
1231 case PPPOE_STATE_CLOSING:
1232 pppoe_disconnect(sc);
1233 break;
1234 default:
1235 return; /* all done, work in peace */
1236 }
1237}
1238
1239/* Start a connection (i.e. initiate discovery phase) */
1240static int
1241pppoe_connect(struct pppoe_softc *sc)
1242{
1243 int x, err;
1244
1245 if (sc->sc_state != PPPOE_STATE_INITIAL)
1246 return EBUSY;
1247
1248#ifdef PPPOE_SERVER
1249 /* wait PADI if IFF_PASSIVE */
1250 if ((sc->sc_sppp.pp_if.if_flags & IFF_PASSIVE))
1251 return 0;
1252#endif
1253 x = splnet();
1254 /* save state, in case we fail to send PADI */
1255 sc->sc_state = PPPOE_STATE_PADI_SENT;
1256 sc->sc_padr_retried = 0;
1257 err = pppoe_send_padi(sc);
1258 if (err != 0 && sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1259 printf("%s: failed to send PADI, error=%d\n",
1260 sc->sc_sppp.pp_if.if_xname, err);
1261 callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT, pppoe_timeout, sc);
1262 splx(x);
1263 return err;
1264}
1265
1266/* disconnect */
1267static int
1268pppoe_disconnect(struct pppoe_softc *sc)
1269{
1270 int err, x;
1271
1272 x = splnet();
1273
1274 if (sc->sc_state < PPPOE_STATE_SESSION)
1275 err = EBUSY;
1276 else {
1277 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1278 printf("%s: disconnecting\n",
1279 sc->sc_sppp.pp_if.if_xname);
1280 err = pppoe_send_padt(sc->sc_eth_if, sc->sc_session, (const uint8_t *)&sc->sc_dest);
1281 }
1282
1283 /* cleanup softc */
1284 sc->sc_state = PPPOE_STATE_INITIAL;
1285 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
1286 if (sc->sc_ac_cookie) {
1287 free(sc->sc_ac_cookie, M_DEVBUF);
1288 sc->sc_ac_cookie = NULL;
1289 }
1290 sc->sc_ac_cookie_len = 0;
1291 if (sc->sc_relay_sid) {
1292 free(sc->sc_relay_sid, M_DEVBUF);
1293 sc->sc_relay_sid = NULL;
1294 }
1295 sc->sc_relay_sid_len = 0;
1296#ifdef PPPOE_SERVER
1297 if (sc->sc_hunique) {
1298 free(sc->sc_hunique, M_DEVBUF);
1299 sc->sc_hunique = NULL;
1300 }
1301 sc->sc_hunique_len = 0;
1302#endif
1303 sc->sc_session = 0;
1304
1305 /* notify upper layer */
1306 sc->sc_sppp.pp_down(&sc->sc_sppp);
1307
1308 splx(x);
1309
1310 return err;
1311}
1312
1313/* Connection attempt aborted */
1314static void
1315pppoe_abort_connect(struct pppoe_softc *sc)
1316{
1317 printf("%s: could not establish connection\n",
1318 sc->sc_sppp.pp_if.if_xname);
1319 sc->sc_state = PPPOE_STATE_CLOSING;
1320
1321 /* notify upper layer */
1322 sc->sc_sppp.pp_down(&sc->sc_sppp);
1323
1324 /* clear connection state */
1325 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
1326 sc->sc_state = PPPOE_STATE_INITIAL;
1327}
1328
1329/* Send a PADR packet */
1330static int
1331pppoe_send_padr(struct pppoe_softc *sc)
1332{
1333 struct mbuf *m0;
1334 uint8_t *p;
1335 size_t len, l1 = 0; /* XXX: gcc */
1336
1337 if (sc->sc_state != PPPOE_STATE_PADR_SENT)
1338 return EIO;
1339
1340 len = 2 + 2 + 2 + 2 + sizeof(sc); /* service name, host unique */
1341 if (sc->sc_service_name != NULL) { /* service name tag maybe empty */
1342 l1 = strlen(sc->sc_service_name);
1343 len += l1;
1344 }
1345 if (sc->sc_ac_cookie_len > 0)
1346 len += 2 + 2 + sc->sc_ac_cookie_len; /* AC cookie */
1347 if (sc->sc_relay_sid_len > 0)
1348 len += 2 + 2 + sc->sc_relay_sid_len; /* Relay SID */
1349 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) {
1350 len += 2 + 2 + 2;
1351 }
1352 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN);
1353 if (!m0)
1354 return ENOBUFS;
1355 p = mtod(m0, uint8_t *);
1356 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADR, 0, len);
1357 PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
1358 if (sc->sc_service_name != NULL) {
1359 PPPOE_ADD_16(p, l1);
1360 memcpy(p, sc->sc_service_name, l1);
1361 p += l1;
1362 } else {
1363 PPPOE_ADD_16(p, 0);
1364 }
1365 if (sc->sc_ac_cookie_len > 0) {
1366 PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE);
1367 PPPOE_ADD_16(p, sc->sc_ac_cookie_len);
1368 memcpy(p, sc->sc_ac_cookie, sc->sc_ac_cookie_len);
1369 p += sc->sc_ac_cookie_len;
1370 }
1371 if (sc->sc_relay_sid_len > 0) {
1372 PPPOE_ADD_16(p, PPPOE_TAG_RELAYSID);
1373 PPPOE_ADD_16(p, sc->sc_relay_sid_len);
1374 memcpy(p, sc->sc_relay_sid, sc->sc_relay_sid_len);
1375 p += sc->sc_relay_sid_len;
1376 }
1377 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
1378 PPPOE_ADD_16(p, sizeof(sc));
1379 memcpy(p, &sc, sizeof sc);
1380 p += sizeof(sc);
1381
1382 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) {
1383 PPPOE_ADD_16(p, PPPOE_TAG_MAX_PAYLOAD);
1384 PPPOE_ADD_16(p, 2);
1385 PPPOE_ADD_16(p, (uint16_t)sc->sc_sppp.pp_if.if_mtu);
1386 }
1387
1388#ifdef PPPOE_DEBUG
1389 p += sizeof sc;
1390 if (p - mtod(m0, uint8_t *) != len + PPPOE_HEADERLEN)
1391 panic("pppoe_send_padr: garbled output len, should be %ld, is %ld",
1392 (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, uint8_t *)));
1393#endif
1394
1395 return pppoe_output(sc, m0);
1396}
1397
1398/* send a PADT packet */
1399static int
1400pppoe_send_padt(struct ifnet *outgoing_if, u_int session, const uint8_t *dest)
1401{
1402 struct ether_header *eh;
1403 struct sockaddr dst;
1404 struct mbuf *m0;
1405 uint8_t *p;
1406
1407 m0 = pppoe_get_mbuf(PPPOE_HEADERLEN);
1408 if (!m0)
1409 return EIO;
1410 p = mtod(m0, uint8_t *);
1411 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADT, session, 0);
1412
1413 memset(&dst, 0, sizeof dst);
1414 dst.sa_family = AF_UNSPEC;
1415 eh = (struct ether_header*)&dst.sa_data;
1416 eh->ether_type = htons(ETHERTYPE_PPPOEDISC);
1417 memcpy(&eh->ether_dhost, dest, ETHER_ADDR_LEN);
1418
1419 m0->m_flags &= ~(M_BCAST|M_MCAST);
1420 return if_output_lock(outgoing_if, outgoing_if, m0, &dst, NULL);
1421}
1422
1423#ifdef PPPOE_SERVER
1424static int
1425pppoe_send_pado(struct pppoe_softc *sc)
1426{
1427 struct mbuf *m0;
1428 uint8_t *p;
1429 size_t len;
1430
1431 if (sc->sc_state != PPPOE_STATE_PADO_SENT)
1432 return EIO;
1433
1434 /* calc length */
1435 len = 0;
1436 /* include ac_cookie */
1437 len += 2 + 2 + sizeof(sc);
1438 /* include hunique */
1439 len += 2 + 2 + sc->sc_hunique_len;
1440 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN);
1441 if (!m0)
1442 return EIO;
1443 p = mtod(m0, uint8_t *);
1444 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADO, 0, len);
1445 PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE);
1446 PPPOE_ADD_16(p, sizeof(sc));
1447 memcpy(p, &sc, sizeof(sc));
1448 p += sizeof(sc);
1449 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
1450 PPPOE_ADD_16(p, sc->sc_hunique_len);
1451 memcpy(p, sc->sc_hunique, sc->sc_hunique_len);
1452 return pppoe_output(sc, m0);
1453}
1454
1455static int
1456pppoe_send_pads(struct pppoe_softc *sc)
1457{
1458 struct bintime bt;
1459 struct mbuf *m0;
1460 uint8_t *p;
1461 size_t len, l1 = 0; /* XXX: gcc */
1462
1463 if (sc->sc_state != PPPOE_STATE_PADO_SENT)
1464 return EIO;
1465
1466 getbinuptime(&bt);
1467 sc->sc_session = bt.sec % 0xff + 1;
1468 /* calc length */
1469 len = 0;
1470 /* include hunique */
1471 len += 2 + 2 + 2 + 2 + sc->sc_hunique_len; /* service name, host unique*/
1472 if (sc->sc_service_name != NULL) { /* service name tag maybe empty */
1473 l1 = strlen(sc->sc_service_name);
1474 len += l1;
1475 }
1476 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN);
1477 if (!m0)
1478 return ENOBUFS;
1479 p = mtod(m0, uint8_t *);
1480 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADS, sc->sc_session, len);
1481 PPPOE_ADD_16(p, PPPOE_TAG_SNAME);
1482 if (sc->sc_service_name != NULL) {
1483 PPPOE_ADD_16(p, l1);
1484 memcpy(p, sc->sc_service_name, l1);
1485 p += l1;
1486 } else {
1487 PPPOE_ADD_16(p, 0);
1488 }
1489 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE);
1490 PPPOE_ADD_16(p, sc->sc_hunique_len);
1491 memcpy(p, sc->sc_hunique, sc->sc_hunique_len);
1492 return pppoe_output(sc, m0);
1493}
1494#endif
1495
1496static void
1497pppoe_tls(struct sppp *sp)
1498{
1499 struct pppoe_softc *sc = (void *)sp;
1500 int wtime;
1501
1502 if (sc->sc_state != PPPOE_STATE_INITIAL)
1503 return;
1504
1505 if (sc->sc_sppp.pp_phase == SPPP_PHASE_ESTABLISH &&
1506 sc->sc_sppp.pp_auth_failures > 0) {
1507 /*
1508 * Delay trying to reconnect a bit more - the peer
1509 * might have failed to contact its radius server.
1510 */
1511 wtime = PPPOE_RECON_FAST * sc->sc_sppp.pp_auth_failures;
1512 if (wtime > PPPOE_SLOW_RETRY)
1513 wtime = PPPOE_SLOW_RETRY;
1514 } else {
1515 wtime = PPPOE_RECON_IMMEDIATE;
1516 }
1517 callout_reset(&sc->sc_timeout, wtime, pppoe_timeout, sc);
1518}
1519
1520static void
1521pppoe_tlf(struct sppp *sp)
1522{
1523 struct pppoe_softc *sc = (void *)sp;
1524 if (sc->sc_state < PPPOE_STATE_SESSION)
1525 return;
1526 /*
1527 * Do not call pppoe_disconnect here, the upper layer state
1528 * machine gets confused by this. We must return from this
1529 * function and defer disconnecting to the timeout handler.
1530 */
1531 sc->sc_state = PPPOE_STATE_CLOSING;
1532 callout_reset(&sc->sc_timeout, hz/50, pppoe_timeout, sc);
1533}
1534
1535static void
1536pppoe_start(struct ifnet *ifp)
1537{
1538 struct pppoe_softc *sc = (void *)ifp;
1539 struct mbuf *m;
1540 uint8_t *p;
1541 size_t len;
1542
1543 if (sppp_isempty(ifp))
1544 return;
1545
1546 /* are we ready to process data yet? */
1547 if (sc->sc_state < PPPOE_STATE_SESSION) {
1548 sppp_flush(&sc->sc_sppp.pp_if);
1549 return;
1550 }
1551
1552 while ((m = sppp_dequeue(ifp)) != NULL) {
1553 len = m->m_pkthdr.len;
1554 M_PREPEND(m, PPPOE_HEADERLEN, M_DONTWAIT);
1555 if (m == NULL) {
1556 ifp->if_oerrors++;
1557 continue;
1558 }
1559 p = mtod(m, uint8_t *);
1560 PPPOE_ADD_HEADER(p, 0, sc->sc_session, len);
1561
1562 bpf_mtap(&sc->sc_sppp.pp_if, m);
1563
1564 pppoe_output(sc, m);
1565 }
1566}
1567
1568
1569static int
1570pppoe_ifattach_hook(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
1571{
1572 struct pppoe_softc *sc;
1573 int s;
1574
1575 if (mp != (struct mbuf **)PFIL_IFNET_DETACH)
1576 return 0;
1577
1578 s = splnet();
1579 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) {
1580 if (sc->sc_eth_if != ifp)
1581 continue;
1582 if (sc->sc_sppp.pp_if.if_flags & IFF_UP) {
1583 sc->sc_sppp.pp_if.if_flags &= ~(IFF_UP|IFF_RUNNING);
1584 printf("%s: ethernet interface detached, going down\n",
1585 sc->sc_sppp.pp_if.if_xname);
1586 }
1587 sc->sc_eth_if = NULL;
1588 pppoe_clear_softc(sc, "ethernet interface detached");
1589 }
1590 splx(s);
1591
1592 return 0;
1593}
1594
1595static void
1596pppoe_clear_softc(struct pppoe_softc *sc, const char *message)
1597{
1598 /* stop timer */
1599 callout_stop(&sc->sc_timeout);
1600 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG)
1601 printf("%s: session 0x%x terminated, %s\n",
1602 sc->sc_sppp.pp_if.if_xname, sc->sc_session, message);
1603
1604 /* fix our state */
1605 sc->sc_state = PPPOE_STATE_INITIAL;
1606
1607 /* signal upper layer */
1608 sc->sc_sppp.pp_down(&sc->sc_sppp);
1609
1610 /* clean up softc */
1611 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest));
1612 if (sc->sc_ac_cookie) {
1613 free(sc->sc_ac_cookie, M_DEVBUF);
1614 sc->sc_ac_cookie = NULL;
1615 }
1616 if (sc->sc_relay_sid) {
1617 free(sc->sc_relay_sid, M_DEVBUF);
1618 sc->sc_relay_sid = NULL;
1619 }
1620 sc->sc_ac_cookie_len = 0;
1621 sc->sc_session = 0;
1622}
1623
1624static void
1625pppoe_enqueue(struct ifqueue *inq, struct mbuf *m)
1626{
1627 if (m->m_flags & M_PROMISC) {
1628 m_free(m);
1629 return;
1630 }
1631
1632#ifndef PPPOE_SERVER
1633 if (m->m_flags & (M_MCAST | M_BCAST)) {
1634 m_free(m);
1635 return;
1636 }
1637#endif
1638
1639 IFQ_LOCK(inq);
1640 if (IF_QFULL(inq)) {
1641 IF_DROP(inq);
1642 IFQ_UNLOCK(inq);
1643 m_freem(m);
1644 } else {
1645 IF_ENQUEUE(inq, m);
1646 IFQ_UNLOCK(inq);
1647 softint_schedule(pppoe_softintr);
1648 }
1649 return;
1650}
1651
1652void
1653pppoe_input(struct ifnet *ifp, struct mbuf *m)
1654{
1655 pppoe_enqueue(&ppoeinq, m);
1656 return;
1657}
1658
1659void
1660pppoedisc_input(struct ifnet *ifp, struct mbuf *m)
1661{
1662 pppoe_enqueue(&ppoediscinq, m);
1663 return;
1664}
1665
1666static void
1667sysctl_net_pppoe_setup(struct sysctllog **clog)
1668{
1669 const struct sysctlnode *node = NULL;
1670
1671 sysctl_createv(clog, 0, NULL, &node,
1672 CTLFLAG_PERMANENT,
1673 CTLTYPE_NODE, "pppoe",
1674 SYSCTL_DESCR("PPPOE protocol"),
1675 NULL, 0, NULL, 0,
1676 CTL_NET, CTL_CREATE, CTL_EOL);
1677
1678 if (node == NULL)
1679 return;
1680
1681 sysctl_createv(clog, 0, &node, NULL,
1682 CTLFLAG_PERMANENT | CTLFLAG_READONLY,
1683 CTLTYPE_BOOL, "term_unknown",
1684 SYSCTL_DESCR("Terminate unknown sessions"),
1685 NULL, 0, &pppoe_term_unknown, sizeof(pppoe_term_unknown),
1686 CTL_CREATE, CTL_EOL);
1687}
1688
1689/*
1690 * Module infrastructure
1691 */
1692#include "if_module.h"
1693
1694IF_MODULE(MODULE_CLASS_DRIVER, pppoe, "sppp_subr")
1695