1 /* $NetBSD: if_pppoe.c,v 1.104 2015/08/24 22:21:26 pooka Exp $ */ 2 3 /*- 4 * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Martin Husemann <martin@NetBSD.org>. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.104 2015/08/24 22:21:26 pooka Exp $"); 34 35 #include "pppoe.h" 36 37 #ifdef _KERNEL_OPT 38 #include "opt_pppoe.h" 39 #endif 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/kernel.h> 44 #include <sys/callout.h> 45 #include <sys/malloc.h> 46 #include <sys/mbuf.h> 47 #include <sys/socket.h> 48 #include <sys/proc.h> 49 #include <sys/ioctl.h> 50 #include <sys/kauth.h> 51 #include <sys/intr.h> 52 #include <sys/socketvar.h> 53 54 #include <net/if.h> 55 #include <net/if_types.h> 56 #include <net/if_ether.h> 57 #include <net/if_sppp.h> 58 #include <net/if_spppvar.h> 59 #include <net/if_pppoe.h> 60 61 #include <net/bpf.h> 62 63 #include "ioconf.h" 64 65 #undef PPPOE_DEBUG /* XXX - remove this or make it an option */ 66 /* #define PPPOE_DEBUG 1 */ 67 68 struct pppoehdr { 69 uint8_t vertype; 70 uint8_t code; 71 uint16_t session; 72 uint16_t plen; 73 } __packed; 74 75 struct pppoetag { 76 uint16_t tag; 77 uint16_t len; 78 } __packed; 79 80 #define PPPOE_HEADERLEN sizeof(struct pppoehdr) 81 #define PPPOE_OVERHEAD (PPPOE_HEADERLEN + 2) 82 #define PPPOE_VERTYPE 0x11 /* VER=1, TYPE = 1 */ 83 84 #define PPPOE_TAG_EOL 0x0000 /* end of list */ 85 #define PPPOE_TAG_SNAME 0x0101 /* service name */ 86 #define PPPOE_TAG_ACNAME 0x0102 /* access concentrator name */ 87 #define PPPOE_TAG_HUNIQUE 0x0103 /* host unique */ 88 #define PPPOE_TAG_ACCOOKIE 0x0104 /* AC cookie */ 89 #define PPPOE_TAG_VENDOR 0x0105 /* vendor specific */ 90 #define PPPOE_TAG_RELAYSID 0x0110 /* relay session id */ 91 #define PPPOE_TAG_MAX_PAYLOAD 0x0120 /* max payload */ 92 #define PPPOE_TAG_SNAME_ERR 0x0201 /* service name error */ 93 #define PPPOE_TAG_ACSYS_ERR 0x0202 /* AC system error */ 94 #define PPPOE_TAG_GENERIC_ERR 0x0203 /* generic error */ 95 96 #define PPPOE_CODE_PADI 0x09 /* Active Discovery Initiation */ 97 #define PPPOE_CODE_PADO 0x07 /* Active Discovery Offer */ 98 #define PPPOE_CODE_PADR 0x19 /* Active Discovery Request */ 99 #define PPPOE_CODE_PADS 0x65 /* Active Discovery Session confirmation */ 100 #define PPPOE_CODE_PADT 0xA7 /* Active Discovery Terminate */ 101 102 /* two byte PPP protocol discriminator, then IP data */ 103 #define PPPOE_MAXMTU (ETHERMTU - PPPOE_OVERHEAD) 104 105 /* Add a 16 bit unsigned value to a buffer pointed to by PTR */ 106 #define PPPOE_ADD_16(PTR, VAL) \ 107 *(PTR)++ = (VAL) / 256; \ 108 *(PTR)++ = (VAL) % 256 109 110 /* Add a complete PPPoE header to the buffer pointed to by PTR */ 111 #define PPPOE_ADD_HEADER(PTR, CODE, SESS, LEN) \ 112 *(PTR)++ = PPPOE_VERTYPE; \ 113 *(PTR)++ = (CODE); \ 114 PPPOE_ADD_16(PTR, SESS); \ 115 PPPOE_ADD_16(PTR, LEN) 116 117 #define PPPOE_DISC_TIMEOUT (hz*5) /* base for quick timeout calculation */ 118 #define PPPOE_SLOW_RETRY (hz*60) /* persistent retry interval */ 119 #define PPPOE_RECON_FAST (hz*15) /* first retry after auth failure */ 120 #define PPPOE_RECON_IMMEDIATE (hz/10) /* "no delay" reconnect */ 121 #define PPPOE_DISC_MAXPADI 4 /* retry PADI four times (quickly) */ 122 #define PPPOE_DISC_MAXPADR 2 /* retry PADR twice */ 123 124 #ifdef PPPOE_SERVER 125 /* from if_spppsubr.c */ 126 #define IFF_PASSIVE IFF_LINK0 /* wait passively for connection */ 127 #endif 128 129 struct pppoe_softc { 130 struct sppp sc_sppp; /* contains a struct ifnet as first element */ 131 LIST_ENTRY(pppoe_softc) sc_list; 132 struct ifnet *sc_eth_if; /* ethernet interface we are using */ 133 134 int sc_state; /* discovery phase or session connected */ 135 struct ether_addr sc_dest; /* hardware address of concentrator */ 136 uint16_t sc_session; /* PPPoE session id */ 137 138 char *sc_service_name; /* if != NULL: requested name of service */ 139 char *sc_concentrator_name; /* if != NULL: requested concentrator id */ 140 uint8_t *sc_ac_cookie; /* content of AC cookie we must echo back */ 141 size_t sc_ac_cookie_len; /* length of cookie data */ 142 uint8_t *sc_relay_sid; /* content of relay SID we must echo back */ 143 size_t sc_relay_sid_len; /* length of relay SID data */ 144 #ifdef PPPOE_SERVER 145 uint8_t *sc_hunique; /* content of host unique we must echo back */ 146 size_t sc_hunique_len; /* length of host unique */ 147 #endif 148 callout_t sc_timeout; /* timeout while not in session state */ 149 int sc_padi_retried; /* number of PADI retries already done */ 150 int sc_padr_retried; /* number of PADR retries already done */ 151 }; 152 153 /* incoming traffic will be queued here */ 154 struct ifqueue ppoediscinq = { .ifq_maxlen = IFQ_MAXLEN }; 155 struct ifqueue ppoeinq = { .ifq_maxlen = IFQ_MAXLEN }; 156 157 void *pppoe_softintr = NULL; 158 static void pppoe_softintr_handler(void *); 159 160 extern int sppp_ioctl(struct ifnet *, unsigned long, void *); 161 162 /* input routines */ 163 static void pppoe_input(void); 164 static void pppoe_disc_input(struct mbuf *); 165 static void pppoe_dispatch_disc_pkt(struct mbuf *, int); 166 static void pppoe_data_input(struct mbuf *); 167 168 /* management routines */ 169 static int pppoe_connect(struct pppoe_softc *); 170 static int pppoe_disconnect(struct pppoe_softc *); 171 static void pppoe_abort_connect(struct pppoe_softc *); 172 static int pppoe_ioctl(struct ifnet *, unsigned long, void *); 173 static void pppoe_tls(struct sppp *); 174 static void pppoe_tlf(struct sppp *); 175 static void pppoe_start(struct ifnet *); 176 static void pppoe_clear_softc(struct pppoe_softc *, const char *); 177 178 /* internal timeout handling */ 179 static void pppoe_timeout(void *); 180 181 /* sending actual protocol controll packets */ 182 static int pppoe_send_padi(struct pppoe_softc *); 183 static int pppoe_send_padr(struct pppoe_softc *); 184 #ifdef PPPOE_SERVER 185 static int pppoe_send_pado(struct pppoe_softc *); 186 static int pppoe_send_pads(struct pppoe_softc *); 187 #endif 188 static int pppoe_send_padt(struct ifnet *, u_int, const uint8_t *); 189 190 /* raw output */ 191 static int pppoe_output(struct pppoe_softc *, struct mbuf *); 192 193 /* internal helper functions */ 194 static struct pppoe_softc * pppoe_find_softc_by_session(u_int, struct ifnet *); 195 static struct pppoe_softc * pppoe_find_softc_by_hunique(uint8_t *, size_t, struct ifnet *); 196 static struct mbuf *pppoe_get_mbuf(size_t len); 197 198 static int pppoe_ifattach_hook(void *, struct mbuf **, struct ifnet *, int); 199 200 static LIST_HEAD(pppoe_softc_head, pppoe_softc) pppoe_softc_list; 201 202 static int pppoe_clone_create(struct if_clone *, int); 203 static int pppoe_clone_destroy(struct ifnet *); 204 205 static struct if_clone pppoe_cloner = 206 IF_CLONE_INITIALIZER("pppoe", pppoe_clone_create, pppoe_clone_destroy); 207 208 /* ARGSUSED */ 209 void 210 pppoeattach(int count) 211 { 212 LIST_INIT(&pppoe_softc_list); 213 if_clone_attach(&pppoe_cloner); 214 215 pppoe_softintr = softint_establish(SOFTINT_NET, pppoe_softintr_handler, NULL); 216 } 217 218 static int 219 pppoe_clone_create(struct if_clone *ifc, int unit) 220 { 221 struct pppoe_softc *sc; 222 223 sc = malloc(sizeof(struct pppoe_softc), M_DEVBUF, M_WAITOK|M_ZERO); 224 225 if_initname(&sc->sc_sppp.pp_if, "pppoe", unit); 226 sc->sc_sppp.pp_if.if_softc = sc; 227 sc->sc_sppp.pp_if.if_mtu = PPPOE_MAXMTU; 228 sc->sc_sppp.pp_if.if_flags = IFF_SIMPLEX|IFF_POINTOPOINT|IFF_MULTICAST; 229 sc->sc_sppp.pp_if.if_type = IFT_PPP; 230 sc->sc_sppp.pp_if.if_hdrlen = sizeof(struct ether_header) + PPPOE_HEADERLEN; 231 sc->sc_sppp.pp_if.if_dlt = DLT_PPP_ETHER; 232 sc->sc_sppp.pp_flags |= PP_KEEPALIVE | /* use LCP keepalive */ 233 PP_NOFRAMING; /* no serial encapsulation */ 234 sc->sc_sppp.pp_if.if_ioctl = pppoe_ioctl; 235 IFQ_SET_MAXLEN(&sc->sc_sppp.pp_if.if_snd, IFQ_MAXLEN); 236 IFQ_SET_READY(&sc->sc_sppp.pp_if.if_snd); 237 238 /* changed to real address later */ 239 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest)); 240 241 callout_init(&sc->sc_timeout, 0); 242 243 sc->sc_sppp.pp_if.if_start = pppoe_start; 244 sc->sc_sppp.pp_tls = pppoe_tls; 245 sc->sc_sppp.pp_tlf = pppoe_tlf; 246 sc->sc_sppp.pp_framebytes = PPPOE_HEADERLEN; /* framing added to ppp packets */ 247 248 if_attach(&sc->sc_sppp.pp_if); 249 sppp_attach(&sc->sc_sppp.pp_if); 250 251 bpf_attach(&sc->sc_sppp.pp_if, DLT_PPP_ETHER, 0); 252 if (LIST_EMPTY(&pppoe_softc_list)) { 253 pfil_add_hook(pppoe_ifattach_hook, NULL, PFIL_IFNET, if_pfil); 254 } 255 LIST_INSERT_HEAD(&pppoe_softc_list, sc, sc_list); 256 return 0; 257 } 258 259 static int 260 pppoe_clone_destroy(struct ifnet *ifp) 261 { 262 struct pppoe_softc * sc = ifp->if_softc; 263 264 callout_stop(&sc->sc_timeout); 265 LIST_REMOVE(sc, sc_list); 266 if (LIST_EMPTY(&pppoe_softc_list)) { 267 pfil_remove_hook(pppoe_ifattach_hook, NULL, PFIL_IFNET, if_pfil); 268 } 269 bpf_detach(ifp); 270 sppp_detach(&sc->sc_sppp.pp_if); 271 if_detach(ifp); 272 if (sc->sc_concentrator_name) 273 free(sc->sc_concentrator_name, M_DEVBUF); 274 if (sc->sc_service_name) 275 free(sc->sc_service_name, M_DEVBUF); 276 if (sc->sc_ac_cookie) 277 free(sc->sc_ac_cookie, M_DEVBUF); 278 if (sc->sc_relay_sid) 279 free(sc->sc_relay_sid, M_DEVBUF); 280 callout_destroy(&sc->sc_timeout); 281 free(sc, M_DEVBUF); 282 283 return (0); 284 } 285 286 /* 287 * Find the interface handling the specified session. 288 * Note: O(number of sessions open), this is a client-side only, mean 289 * and lean implementation, so number of open sessions typically should 290 * be 1. 291 */ 292 static struct pppoe_softc * 293 pppoe_find_softc_by_session(u_int session, struct ifnet *rcvif) 294 { 295 struct pppoe_softc *sc; 296 297 if (session == 0) 298 return NULL; 299 300 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) { 301 if (sc->sc_state == PPPOE_STATE_SESSION 302 && sc->sc_session == session 303 && sc->sc_eth_if == rcvif) 304 return sc; 305 } 306 return NULL; 307 } 308 309 /* Check host unique token passed and return appropriate softc pointer, 310 * or NULL if token is bogus. */ 311 static struct pppoe_softc * 312 pppoe_find_softc_by_hunique(uint8_t *token, size_t len, struct ifnet *rcvif) 313 { 314 struct pppoe_softc *sc, *t; 315 316 if (LIST_EMPTY(&pppoe_softc_list)) 317 return NULL; 318 319 if (len != sizeof sc) 320 return NULL; 321 memcpy(&t, token, len); 322 323 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) 324 if (sc == t) break; 325 326 if (sc == NULL) { 327 #ifdef PPPOE_DEBUG 328 printf("pppoe: alien host unique tag, no session found\n"); 329 #endif 330 return NULL; 331 } 332 333 /* should be safe to access *sc now */ 334 if (sc->sc_state < PPPOE_STATE_PADI_SENT || sc->sc_state >= PPPOE_STATE_SESSION) { 335 printf("%s: host unique tag found, but it belongs to a connection in state %d\n", 336 sc->sc_sppp.pp_if.if_xname, sc->sc_state); 337 return NULL; 338 } 339 if (sc->sc_eth_if != rcvif) { 340 printf("%s: wrong interface, not accepting host unique\n", 341 sc->sc_sppp.pp_if.if_xname); 342 return NULL; 343 } 344 return sc; 345 } 346 347 static void 348 pppoe_softintr_handler(void *dummy) 349 { 350 /* called at splsoftnet() */ 351 mutex_enter(softnet_lock); 352 pppoe_input(); 353 mutex_exit(softnet_lock); 354 } 355 356 /* called at appropriate protection level */ 357 static void 358 pppoe_input(void) 359 { 360 struct mbuf *m; 361 int s, disc_done, data_done; 362 363 do { 364 disc_done = 0; 365 data_done = 0; 366 for (;;) { 367 s = splnet(); 368 IF_DEQUEUE(&ppoediscinq, m); 369 splx(s); 370 if (m == NULL) break; 371 disc_done = 1; 372 pppoe_disc_input(m); 373 } 374 375 for (;;) { 376 s = splnet(); 377 IF_DEQUEUE(&ppoeinq, m); 378 splx(s); 379 if (m == NULL) break; 380 data_done = 1; 381 pppoe_data_input(m); 382 } 383 } while (disc_done || data_done); 384 } 385 386 /* analyze and handle a single received packet while not in session state */ 387 static void 388 pppoe_dispatch_disc_pkt(struct mbuf *m, int off) 389 { 390 uint16_t tag, len; 391 uint16_t session, plen; 392 struct pppoe_softc *sc; 393 const char *err_msg, *devname; 394 char *error; 395 uint8_t *ac_cookie; 396 size_t ac_cookie_len; 397 uint8_t *relay_sid; 398 size_t relay_sid_len; 399 #ifdef PPPOE_SERVER 400 uint8_t *hunique; 401 size_t hunique_len; 402 #endif 403 struct pppoehdr *ph; 404 struct pppoetag *pt; 405 struct mbuf *n; 406 int noff, err, errortag; 407 struct ether_header *eh; 408 409 devname = "pppoe"; /* as long as we don't know which instance */ 410 err_msg = NULL; 411 errortag = 0; 412 if (m->m_len < sizeof(*eh)) { 413 m = m_pullup(m, sizeof(*eh)); 414 if (!m) 415 goto done; 416 } 417 eh = mtod(m, struct ether_header *); 418 off += sizeof(*eh); 419 420 ac_cookie = NULL; 421 ac_cookie_len = 0; 422 relay_sid = NULL; 423 relay_sid_len = 0; 424 #ifdef PPPOE_SERVER 425 hunique = NULL; 426 hunique_len = 0; 427 #endif 428 session = 0; 429 if (m->m_pkthdr.len - off <= PPPOE_HEADERLEN) { 430 printf("pppoe: packet too short: %d\n", m->m_pkthdr.len); 431 goto done; 432 } 433 434 n = m_pulldown(m, off, sizeof(*ph), &noff); 435 if (!n) { 436 printf("pppoe: could not get PPPoE header\n"); 437 m = NULL; 438 goto done; 439 } 440 ph = (struct pppoehdr *)(mtod(n, char *) + noff); 441 if (ph->vertype != PPPOE_VERTYPE) { 442 printf("pppoe: unknown version/type packet: 0x%x\n", 443 ph->vertype); 444 goto done; 445 } 446 session = ntohs(ph->session); 447 plen = ntohs(ph->plen); 448 off += sizeof(*ph); 449 450 if (plen + off > m->m_pkthdr.len) { 451 printf("pppoe: packet content does not fit: data available = %d, packet size = %u\n", 452 m->m_pkthdr.len - off, plen); 453 goto done; 454 } 455 m_adj(m, off + plen - m->m_pkthdr.len); /* ignore trailing garbage */ 456 tag = 0; 457 len = 0; 458 sc = NULL; 459 while (off + sizeof(*pt) <= m->m_pkthdr.len) { 460 n = m_pulldown(m, off, sizeof(*pt), &noff); 461 if (!n) { 462 printf("%s: parse error\n", devname); 463 m = NULL; 464 goto done; 465 } 466 pt = (struct pppoetag *)(mtod(n, char *) + noff); 467 tag = ntohs(pt->tag); 468 len = ntohs(pt->len); 469 if (off + len + sizeof(*pt) > m->m_pkthdr.len) { 470 printf("pppoe: tag 0x%x len 0x%x is too long\n", 471 tag, len); 472 goto done; 473 } 474 switch (tag) { 475 case PPPOE_TAG_EOL: 476 goto breakbreak; 477 case PPPOE_TAG_SNAME: 478 break; /* ignored */ 479 case PPPOE_TAG_ACNAME: 480 error = NULL; 481 if (sc != NULL && len > 0) { 482 error = malloc(len+1, M_TEMP, M_NOWAIT); 483 if (error) { 484 n = m_pulldown(m, off + sizeof(*pt), 485 len, &noff); 486 if (n) { 487 strncpy(error, 488 mtod(n, char*) + noff, 489 len); 490 error[len] = '\0'; 491 } 492 printf("%s: connected to %s\n", 493 devname, error); 494 free(error, M_TEMP); 495 } 496 } 497 break; /* ignored */ 498 case PPPOE_TAG_HUNIQUE: 499 if (sc != NULL) 500 break; 501 n = m_pulldown(m, off + sizeof(*pt), len, &noff); 502 if (!n) { 503 m = NULL; 504 err_msg = "TAG HUNIQUE ERROR"; 505 break; 506 } 507 #ifdef PPPOE_SERVER 508 hunique = mtod(n, uint8_t *) + noff; 509 hunique_len = len; 510 #endif 511 sc = pppoe_find_softc_by_hunique(mtod(n, char *) + noff, 512 len, m->m_pkthdr.rcvif); 513 if (sc != NULL) 514 devname = sc->sc_sppp.pp_if.if_xname; 515 break; 516 case PPPOE_TAG_ACCOOKIE: 517 if (ac_cookie == NULL) { 518 n = m_pulldown(m, off + sizeof(*pt), len, 519 &noff); 520 if (!n) { 521 err_msg = "TAG ACCOOKIE ERROR"; 522 m = NULL; 523 break; 524 } 525 ac_cookie = mtod(n, char *) + noff; 526 ac_cookie_len = len; 527 } 528 break; 529 case PPPOE_TAG_RELAYSID: 530 if (relay_sid == NULL) { 531 n = m_pulldown(m, off + sizeof(*pt), len, 532 &noff); 533 if (!n) { 534 err_msg = "TAG RELAYSID ERROR"; 535 m = NULL; 536 break; 537 } 538 relay_sid = mtod(n, char *) + noff; 539 relay_sid_len = len; 540 } 541 break; 542 case PPPOE_TAG_SNAME_ERR: 543 err_msg = "SERVICE NAME ERROR"; 544 errortag = 1; 545 break; 546 case PPPOE_TAG_ACSYS_ERR: 547 err_msg = "AC SYSTEM ERROR"; 548 errortag = 1; 549 break; 550 case PPPOE_TAG_GENERIC_ERR: 551 err_msg = "GENERIC ERROR"; 552 errortag = 1; 553 break; 554 } 555 if (err_msg) { 556 error = NULL; 557 if (errortag && len) { 558 error = malloc(len+1, M_TEMP, M_NOWAIT); 559 n = m_pulldown(m, off + sizeof(*pt), len, 560 &noff); 561 if (n && error) { 562 strncpy(error, 563 mtod(n, char *) + noff, len); 564 error[len] = '\0'; 565 } 566 } 567 if (error) { 568 printf("%s: %s: %s\n", devname, 569 err_msg, error); 570 free(error, M_TEMP); 571 } else 572 printf("%s: %s\n", devname, err_msg); 573 if (errortag || m == NULL) 574 goto done; 575 } 576 off += sizeof(*pt) + len; 577 } 578 breakbreak:; 579 switch (ph->code) { 580 case PPPOE_CODE_PADI: 581 #ifdef PPPOE_SERVER 582 /* 583 * got service name, concentrator name, and/or host unique. 584 * ignore if we have no interfaces with IFF_PASSIVE|IFF_UP. 585 */ 586 if (LIST_EMPTY(&pppoe_softc_list)) 587 goto done; 588 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) { 589 if (!(sc->sc_sppp.pp_if.if_flags & IFF_UP)) 590 continue; 591 if (!(sc->sc_sppp.pp_if.if_flags & IFF_PASSIVE)) 592 continue; 593 if (sc->sc_state == PPPOE_STATE_INITIAL) 594 break; 595 } 596 if (sc == NULL) { 597 /* printf("pppoe: free passive interface is not found\n");*/ 598 goto done; 599 } 600 if (hunique) { 601 if (sc->sc_hunique) 602 free(sc->sc_hunique, M_DEVBUF); 603 sc->sc_hunique = malloc(hunique_len, M_DEVBUF, 604 M_DONTWAIT); 605 if (sc->sc_hunique == NULL) 606 goto done; 607 sc->sc_hunique_len = hunique_len; 608 memcpy(sc->sc_hunique, hunique, hunique_len); 609 } 610 memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest); 611 sc->sc_state = PPPOE_STATE_PADO_SENT; 612 pppoe_send_pado(sc); 613 break; 614 #endif /* PPPOE_SERVER */ 615 case PPPOE_CODE_PADR: 616 #ifdef PPPOE_SERVER 617 /* 618 * get sc from ac_cookie if IFF_PASSIVE 619 */ 620 if (ac_cookie == NULL) { 621 /* be quiet if there is not a single pppoe instance */ 622 printf("pppoe: received PADR but not includes ac_cookie\n"); 623 goto done; 624 } 625 sc = pppoe_find_softc_by_hunique(ac_cookie, 626 ac_cookie_len, 627 m->m_pkthdr.rcvif); 628 if (sc == NULL) { 629 /* be quiet if there is not a single pppoe instance */ 630 if (!LIST_EMPTY(&pppoe_softc_list)) 631 printf("pppoe: received PADR but could not find request for it\n"); 632 goto done; 633 } 634 if (sc->sc_state != PPPOE_STATE_PADO_SENT) { 635 printf("%s: received unexpected PADR\n", 636 sc->sc_sppp.pp_if.if_xname); 637 goto done; 638 } 639 if (hunique) { 640 if (sc->sc_hunique) 641 free(sc->sc_hunique, M_DEVBUF); 642 sc->sc_hunique = malloc(hunique_len, M_DEVBUF, 643 M_DONTWAIT); 644 if (sc->sc_hunique == NULL) 645 goto done; 646 sc->sc_hunique_len = hunique_len; 647 memcpy(sc->sc_hunique, hunique, hunique_len); 648 } 649 pppoe_send_pads(sc); 650 sc->sc_state = PPPOE_STATE_SESSION; 651 sc->sc_sppp.pp_up(&sc->sc_sppp); 652 break; 653 #else 654 /* ignore, we are no access concentrator */ 655 goto done; 656 #endif /* PPPOE_SERVER */ 657 case PPPOE_CODE_PADO: 658 if (sc == NULL) { 659 /* be quiet if there is not a single pppoe instance */ 660 if (!LIST_EMPTY(&pppoe_softc_list)) 661 printf("pppoe: received PADO but could not find request for it\n"); 662 goto done; 663 } 664 if (sc->sc_state != PPPOE_STATE_PADI_SENT) { 665 printf("%s: received unexpected PADO\n", 666 sc->sc_sppp.pp_if.if_xname); 667 goto done; 668 } 669 if (ac_cookie) { 670 if (sc->sc_ac_cookie) 671 free(sc->sc_ac_cookie, M_DEVBUF); 672 sc->sc_ac_cookie = malloc(ac_cookie_len, M_DEVBUF, 673 M_DONTWAIT); 674 if (sc->sc_ac_cookie == NULL) { 675 printf("%s: FATAL: could not allocate memory " 676 "for AC cookie\n", 677 sc->sc_sppp.pp_if.if_xname); 678 goto done; 679 } 680 sc->sc_ac_cookie_len = ac_cookie_len; 681 memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len); 682 } 683 if (relay_sid) { 684 if (sc->sc_relay_sid) 685 free(sc->sc_relay_sid, M_DEVBUF); 686 sc->sc_relay_sid = malloc(relay_sid_len, M_DEVBUF, 687 M_DONTWAIT); 688 if (sc->sc_relay_sid == NULL) { 689 printf("%s: FATAL: could not allocate memory " 690 "for relay SID\n", 691 sc->sc_sppp.pp_if.if_xname); 692 goto done; 693 } 694 sc->sc_relay_sid_len = relay_sid_len; 695 memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len); 696 } 697 memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest); 698 callout_stop(&sc->sc_timeout); 699 sc->sc_padr_retried = 0; 700 sc->sc_state = PPPOE_STATE_PADR_SENT; 701 if ((err = pppoe_send_padr(sc)) != 0) { 702 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 703 printf("%s: failed to send PADR, " 704 "error=%d\n", sc->sc_sppp.pp_if.if_xname, 705 err); 706 } 707 callout_reset(&sc->sc_timeout, 708 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padr_retried), 709 pppoe_timeout, sc); 710 break; 711 case PPPOE_CODE_PADS: 712 if (sc == NULL) 713 goto done; 714 sc->sc_session = session; 715 callout_stop(&sc->sc_timeout); 716 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 717 printf("%s: session 0x%x connected\n", 718 sc->sc_sppp.pp_if.if_xname, session); 719 sc->sc_state = PPPOE_STATE_SESSION; 720 sc->sc_sppp.pp_up(&sc->sc_sppp); /* notify upper layers */ 721 break; 722 case PPPOE_CODE_PADT: 723 sc = pppoe_find_softc_by_session(session, m->m_pkthdr.rcvif); 724 if (sc == NULL) 725 goto done; 726 pppoe_clear_softc(sc, "received PADT"); 727 break; 728 default: 729 printf("%s: unknown code (0x%04x) session = 0x%04x\n", 730 sc? sc->sc_sppp.pp_if.if_xname : "pppoe", 731 ph->code, session); 732 break; 733 } 734 735 done: 736 if (m) 737 m_freem(m); 738 return; 739 } 740 741 static void 742 pppoe_disc_input(struct mbuf *m) 743 { 744 745 /* avoid error messages if there is not a single pppoe instance */ 746 if (!LIST_EMPTY(&pppoe_softc_list)) { 747 KASSERT(m->m_flags & M_PKTHDR); 748 pppoe_dispatch_disc_pkt(m, 0); 749 } else 750 m_freem(m); 751 } 752 753 static void 754 pppoe_data_input(struct mbuf *m) 755 { 756 uint16_t session, plen; 757 struct pppoe_softc *sc; 758 struct pppoehdr *ph; 759 #ifdef PPPOE_TERM_UNKNOWN_SESSIONS 760 uint8_t shost[ETHER_ADDR_LEN]; 761 #endif 762 763 KASSERT(m->m_flags & M_PKTHDR); 764 765 #ifdef PPPOE_TERM_UNKNOWN_SESSIONS 766 memcpy(shost, mtod(m, struct ether_header*)->ether_shost, ETHER_ADDR_LEN); 767 #endif 768 m_adj(m, sizeof(struct ether_header)); 769 if (m->m_pkthdr.len <= PPPOE_HEADERLEN) { 770 printf("pppoe (data): dropping too short packet: %d bytes\n", 771 m->m_pkthdr.len); 772 goto drop; 773 } 774 775 if (m->m_len < sizeof(*ph)) { 776 m = m_pullup(m, sizeof(*ph)); 777 if (!m) { 778 printf("pppoe: could not get PPPoE header\n"); 779 return; 780 } 781 } 782 ph = mtod(m, struct pppoehdr *); 783 784 if (ph->vertype != PPPOE_VERTYPE) { 785 printf("pppoe (data): unknown version/type packet: 0x%x\n", 786 ph->vertype); 787 goto drop; 788 } 789 if (ph->code != 0) 790 goto drop; 791 792 session = ntohs(ph->session); 793 sc = pppoe_find_softc_by_session(session, m->m_pkthdr.rcvif); 794 if (sc == NULL) { 795 #ifdef PPPOE_TERM_UNKNOWN_SESSIONS 796 printf("pppoe: input for unknown session 0x%x, sending PADT\n", 797 session); 798 pppoe_send_padt(m->m_pkthdr.rcvif, session, shost); 799 #endif 800 goto drop; 801 } 802 803 plen = ntohs(ph->plen); 804 805 bpf_mtap(&sc->sc_sppp.pp_if, m); 806 807 m_adj(m, PPPOE_HEADERLEN); 808 809 #ifdef PPPOE_DEBUG 810 { 811 struct mbuf *p; 812 813 printf("%s: pkthdr.len=%d, pppoe.len=%d", 814 sc->sc_sppp.pp_if.if_xname, 815 m->m_pkthdr.len, plen); 816 p = m; 817 while (p) { 818 printf(" l=%d", p->m_len); 819 p = p->m_next; 820 } 821 printf("\n"); 822 } 823 #endif 824 825 if (m->m_pkthdr.len < plen) 826 goto drop; 827 828 /* fix incoming interface pointer (not the raw ethernet interface anymore) */ 829 m->m_pkthdr.rcvif = &sc->sc_sppp.pp_if; 830 831 /* pass packet up and account for it */ 832 sc->sc_sppp.pp_if.if_ipackets++; 833 sppp_input(&sc->sc_sppp.pp_if, m); 834 return; 835 836 drop: 837 m_freem(m); 838 } 839 840 static int 841 pppoe_output(struct pppoe_softc *sc, struct mbuf *m) 842 { 843 struct sockaddr dst; 844 struct ether_header *eh; 845 uint16_t etype; 846 847 if (sc->sc_eth_if == NULL) { 848 m_freem(m); 849 return EIO; 850 } 851 852 memset(&dst, 0, sizeof dst); 853 dst.sa_family = AF_UNSPEC; 854 eh = (struct ether_header*)&dst.sa_data; 855 etype = sc->sc_state == PPPOE_STATE_SESSION ? ETHERTYPE_PPPOE : ETHERTYPE_PPPOEDISC; 856 eh->ether_type = htons(etype); 857 memcpy(&eh->ether_dhost, &sc->sc_dest, sizeof sc->sc_dest); 858 859 #ifdef PPPOE_DEBUG 860 printf("%s (%x) state=%d, session=0x%x output -> %s, len=%d\n", 861 sc->sc_sppp.pp_if.if_xname, etype, 862 sc->sc_state, sc->sc_session, 863 ether_sprintf((const unsigned char *)&sc->sc_dest), m->m_pkthdr.len); 864 #endif 865 866 m->m_flags &= ~(M_BCAST|M_MCAST); 867 sc->sc_sppp.pp_if.if_opackets++; 868 return sc->sc_eth_if->if_output(sc->sc_eth_if, m, &dst, NULL); 869 } 870 871 static int 872 pppoe_ioctl(struct ifnet *ifp, unsigned long cmd, void *data) 873 { 874 struct lwp *l = curlwp; /* XXX */ 875 struct pppoe_softc *sc = (struct pppoe_softc*)ifp; 876 struct ifreq *ifr = data; 877 int error = 0; 878 879 switch (cmd) { 880 case PPPOESETPARMS: 881 { 882 struct pppoediscparms *parms = (struct pppoediscparms*)data; 883 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_INTERFACE, 884 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 885 NULL) != 0) 886 return (EPERM); 887 if (parms->eth_ifname[0] != 0) { 888 struct ifnet *eth_if; 889 890 eth_if = ifunit(parms->eth_ifname); 891 if (eth_if == NULL || eth_if->if_dlt != DLT_EN10MB) { 892 sc->sc_eth_if = NULL; 893 return ENXIO; 894 } 895 896 if (sc->sc_sppp.pp_if.if_mtu != 897 eth_if->if_mtu - PPPOE_OVERHEAD) { 898 sc->sc_sppp.pp_if.if_mtu = eth_if->if_mtu - 899 PPPOE_OVERHEAD; 900 } 901 sc->sc_eth_if = eth_if; 902 } 903 if (parms->ac_name != NULL) { 904 size_t s; 905 char *b = malloc(parms->ac_name_len + 1, M_DEVBUF, 906 M_WAITOK); 907 if (b == NULL) 908 return ENOMEM; 909 error = copyinstr(parms->ac_name, b, 910 parms->ac_name_len+1, &s); 911 if (error != 0) { 912 free(b, M_DEVBUF); 913 return error; 914 } 915 if (s != parms->ac_name_len+1) { 916 free(b, M_DEVBUF); 917 return EINVAL; 918 } 919 if (sc->sc_concentrator_name) 920 free(sc->sc_concentrator_name, M_DEVBUF); 921 sc->sc_concentrator_name = b; 922 } 923 if (parms->service_name != NULL) { 924 size_t s; 925 char *b = malloc(parms->service_name_len + 1, M_DEVBUF, 926 M_WAITOK); 927 if (b == NULL) 928 return ENOMEM; 929 error = copyinstr(parms->service_name, b, 930 parms->service_name_len+1, &s); 931 if (error != 0) { 932 free(b, M_DEVBUF); 933 return error; 934 } 935 if (s != parms->service_name_len+1) { 936 free(b, M_DEVBUF); 937 return EINVAL; 938 } 939 if (sc->sc_service_name) 940 free(sc->sc_service_name, M_DEVBUF); 941 sc->sc_service_name = b; 942 } 943 return 0; 944 } 945 break; 946 case PPPOEGETPARMS: 947 { 948 struct pppoediscparms *parms = (struct pppoediscparms*)data; 949 memset(parms, 0, sizeof *parms); 950 if (sc->sc_eth_if) 951 strncpy(parms->ifname, sc->sc_eth_if->if_xname, IFNAMSIZ); 952 return 0; 953 } 954 break; 955 case PPPOEGETSESSION: 956 { 957 struct pppoeconnectionstate *state = (struct pppoeconnectionstate*)data; 958 state->state = sc->sc_state; 959 state->session_id = sc->sc_session; 960 state->padi_retry_no = sc->sc_padi_retried; 961 state->padr_retry_no = sc->sc_padr_retried; 962 return 0; 963 } 964 break; 965 case SIOCSIFFLAGS: 966 /* 967 * Prevent running re-establishment timers overriding 968 * administrators choice. 969 */ 970 if ((ifr->ifr_flags & IFF_UP) == 0 971 && sc->sc_state >= PPPOE_STATE_PADI_SENT 972 && sc->sc_state < PPPOE_STATE_SESSION) { 973 callout_stop(&sc->sc_timeout); 974 sc->sc_state = PPPOE_STATE_INITIAL; 975 sc->sc_padi_retried = 0; 976 sc->sc_padr_retried = 0; 977 memcpy(&sc->sc_dest, etherbroadcastaddr, 978 sizeof(sc->sc_dest)); 979 } 980 return sppp_ioctl(ifp, cmd, data); 981 case SIOCSIFMTU: 982 if (ifr->ifr_mtu > (sc->sc_eth_if == NULL ? 983 PPPOE_MAXMTU : (sc->sc_eth_if->if_mtu - PPPOE_OVERHEAD))) { 984 return EINVAL; 985 } 986 /*FALLTHROUGH*/ 987 default: 988 return sppp_ioctl(ifp, cmd, data); 989 } 990 return 0; 991 } 992 993 /* 994 * Allocate a mbuf/cluster with space to store the given data length 995 * of payload, leaving space for prepending an ethernet header 996 * in front. 997 */ 998 static struct mbuf * 999 pppoe_get_mbuf(size_t len) 1000 { 1001 struct mbuf *m; 1002 1003 MGETHDR(m, M_DONTWAIT, MT_DATA); 1004 if (m == NULL) 1005 return NULL; 1006 if (len + sizeof(struct ether_header) > MHLEN) { 1007 MCLGET(m, M_DONTWAIT); 1008 if ((m->m_flags & M_EXT) == 0) { 1009 m_free(m); 1010 return NULL; 1011 } 1012 } 1013 m->m_data += sizeof(struct ether_header); 1014 m->m_len = len; 1015 m->m_pkthdr.len = len; 1016 m->m_pkthdr.rcvif = NULL; 1017 1018 return m; 1019 } 1020 1021 static int 1022 pppoe_send_padi(struct pppoe_softc *sc) 1023 { 1024 struct mbuf *m0; 1025 int len, l1 = 0, l2 = 0; /* XXX: gcc */ 1026 uint8_t *p; 1027 1028 if (sc->sc_state >PPPOE_STATE_PADI_SENT) 1029 panic("pppoe_send_padi in state %d", sc->sc_state); 1030 1031 /* calculate length of frame (excluding ethernet header + pppoe header) */ 1032 len = 2 + 2 + 2 + 2 + sizeof sc; /* service name tag is required, host unique is send too */ 1033 if (sc->sc_service_name != NULL) { 1034 l1 = strlen(sc->sc_service_name); 1035 len += l1; 1036 } 1037 if (sc->sc_concentrator_name != NULL) { 1038 l2 = strlen(sc->sc_concentrator_name); 1039 len += 2 + 2 + l2; 1040 } 1041 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) { 1042 len += 2 + 2 + 2; 1043 } 1044 1045 /* allocate a buffer */ 1046 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN); /* header len + payload len */ 1047 if (!m0) 1048 return ENOBUFS; 1049 1050 /* fill in pkt */ 1051 p = mtod(m0, uint8_t *); 1052 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADI, 0, len); 1053 PPPOE_ADD_16(p, PPPOE_TAG_SNAME); 1054 if (sc->sc_service_name != NULL) { 1055 PPPOE_ADD_16(p, l1); 1056 memcpy(p, sc->sc_service_name, l1); 1057 p += l1; 1058 } else { 1059 PPPOE_ADD_16(p, 0); 1060 } 1061 if (sc->sc_concentrator_name != NULL) { 1062 PPPOE_ADD_16(p, PPPOE_TAG_ACNAME); 1063 PPPOE_ADD_16(p, l2); 1064 memcpy(p, sc->sc_concentrator_name, l2); 1065 p += l2; 1066 } 1067 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE); 1068 PPPOE_ADD_16(p, sizeof(sc)); 1069 memcpy(p, &sc, sizeof sc); 1070 p += sizeof(sc); 1071 1072 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) { 1073 PPPOE_ADD_16(p, PPPOE_TAG_MAX_PAYLOAD); 1074 PPPOE_ADD_16(p, 2); 1075 PPPOE_ADD_16(p, (uint16_t)sc->sc_sppp.pp_if.if_mtu); 1076 } 1077 1078 #ifdef PPPOE_DEBUG 1079 p += sizeof sc; 1080 if (p - mtod(m0, uint8_t *) != len + PPPOE_HEADERLEN) 1081 panic("pppoe_send_padi: garbled output len, should be %ld, is %ld", 1082 (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, uint8_t *))); 1083 #endif 1084 1085 /* send pkt */ 1086 return pppoe_output(sc, m0); 1087 } 1088 1089 static void 1090 pppoe_timeout(void *arg) 1091 { 1092 int x, retry_wait, err; 1093 struct pppoe_softc *sc = (struct pppoe_softc*)arg; 1094 1095 #ifdef PPPOE_DEBUG 1096 printf("%s: timeout\n", sc->sc_sppp.pp_if.if_xname); 1097 #endif 1098 1099 switch (sc->sc_state) { 1100 case PPPOE_STATE_INITIAL: 1101 /* delayed connect from pppoe_tls() */ 1102 pppoe_connect(sc); 1103 break; 1104 case PPPOE_STATE_PADI_SENT: 1105 /* 1106 * We have two basic ways of retrying: 1107 * - Quick retry mode: try a few times in short sequence 1108 * - Slow retry mode: we already had a connection successfully 1109 * established and will try infinitely (without user 1110 * intervention) 1111 * We only enter slow retry mode if IFF_LINK1 (aka autodial) 1112 * is not set. 1113 */ 1114 1115 /* initialize for quick retry mode */ 1116 retry_wait = PPPOE_DISC_TIMEOUT * (1 + sc->sc_padi_retried); 1117 1118 x = splnet(); 1119 sc->sc_padi_retried++; 1120 if (sc->sc_padi_retried >= PPPOE_DISC_MAXPADI) { 1121 if ((sc->sc_sppp.pp_if.if_flags & IFF_LINK1) == 0) { 1122 /* slow retry mode */ 1123 retry_wait = PPPOE_SLOW_RETRY; 1124 } else { 1125 pppoe_abort_connect(sc); 1126 splx(x); 1127 return; 1128 } 1129 } 1130 if ((err = pppoe_send_padi(sc)) != 0) { 1131 sc->sc_padi_retried--; 1132 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1133 printf("%s: failed to transmit PADI, " 1134 "error=%d\n", 1135 sc->sc_sppp.pp_if.if_xname, err); 1136 } 1137 callout_reset(&sc->sc_timeout, retry_wait, 1138 pppoe_timeout, sc); 1139 splx(x); 1140 break; 1141 1142 case PPPOE_STATE_PADR_SENT: 1143 x = splnet(); 1144 sc->sc_padr_retried++; 1145 if (sc->sc_padr_retried >= PPPOE_DISC_MAXPADR) { 1146 memcpy(&sc->sc_dest, etherbroadcastaddr, 1147 sizeof(sc->sc_dest)); 1148 sc->sc_state = PPPOE_STATE_PADI_SENT; 1149 sc->sc_padr_retried = 0; 1150 if ((err = pppoe_send_padi(sc)) != 0) { 1151 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1152 printf("%s: failed to send PADI" 1153 ", error=%d\n", 1154 sc->sc_sppp.pp_if.if_xname, 1155 err); 1156 } 1157 callout_reset(&sc->sc_timeout, 1158 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padi_retried), 1159 pppoe_timeout, sc); 1160 splx(x); 1161 return; 1162 } 1163 if ((err = pppoe_send_padr(sc)) != 0) { 1164 sc->sc_padr_retried--; 1165 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1166 printf("%s: failed to send PADR, " 1167 "error=%d\n", sc->sc_sppp.pp_if.if_xname, 1168 err); 1169 } 1170 callout_reset(&sc->sc_timeout, 1171 PPPOE_DISC_TIMEOUT * (1 + sc->sc_padr_retried), 1172 pppoe_timeout, sc); 1173 splx(x); 1174 break; 1175 case PPPOE_STATE_CLOSING: 1176 pppoe_disconnect(sc); 1177 break; 1178 default: 1179 return; /* all done, work in peace */ 1180 } 1181 } 1182 1183 /* Start a connection (i.e. initiate discovery phase) */ 1184 static int 1185 pppoe_connect(struct pppoe_softc *sc) 1186 { 1187 int x, err; 1188 1189 if (sc->sc_state != PPPOE_STATE_INITIAL) 1190 return EBUSY; 1191 1192 #ifdef PPPOE_SERVER 1193 /* wait PADI if IFF_PASSIVE */ 1194 if ((sc->sc_sppp.pp_if.if_flags & IFF_PASSIVE)) 1195 return 0; 1196 #endif 1197 x = splnet(); 1198 /* save state, in case we fail to send PADI */ 1199 sc->sc_state = PPPOE_STATE_PADI_SENT; 1200 sc->sc_padr_retried = 0; 1201 err = pppoe_send_padi(sc); 1202 if (err != 0 && sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1203 printf("%s: failed to send PADI, error=%d\n", 1204 sc->sc_sppp.pp_if.if_xname, err); 1205 callout_reset(&sc->sc_timeout, PPPOE_DISC_TIMEOUT, pppoe_timeout, sc); 1206 splx(x); 1207 return err; 1208 } 1209 1210 /* disconnect */ 1211 static int 1212 pppoe_disconnect(struct pppoe_softc *sc) 1213 { 1214 int err, x; 1215 1216 x = splnet(); 1217 1218 if (sc->sc_state < PPPOE_STATE_SESSION) 1219 err = EBUSY; 1220 else { 1221 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1222 printf("%s: disconnecting\n", 1223 sc->sc_sppp.pp_if.if_xname); 1224 err = pppoe_send_padt(sc->sc_eth_if, sc->sc_session, (const uint8_t *)&sc->sc_dest); 1225 } 1226 1227 /* cleanup softc */ 1228 sc->sc_state = PPPOE_STATE_INITIAL; 1229 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest)); 1230 if (sc->sc_ac_cookie) { 1231 free(sc->sc_ac_cookie, M_DEVBUF); 1232 sc->sc_ac_cookie = NULL; 1233 } 1234 sc->sc_ac_cookie_len = 0; 1235 if (sc->sc_relay_sid) { 1236 free(sc->sc_relay_sid, M_DEVBUF); 1237 sc->sc_relay_sid = NULL; 1238 } 1239 sc->sc_relay_sid_len = 0; 1240 #ifdef PPPOE_SERVER 1241 if (sc->sc_hunique) { 1242 free(sc->sc_hunique, M_DEVBUF); 1243 sc->sc_hunique = NULL; 1244 } 1245 sc->sc_hunique_len = 0; 1246 #endif 1247 sc->sc_session = 0; 1248 1249 /* notify upper layer */ 1250 sc->sc_sppp.pp_down(&sc->sc_sppp); 1251 1252 splx(x); 1253 1254 return err; 1255 } 1256 1257 /* Connection attempt aborted */ 1258 static void 1259 pppoe_abort_connect(struct pppoe_softc *sc) 1260 { 1261 printf("%s: could not establish connection\n", 1262 sc->sc_sppp.pp_if.if_xname); 1263 sc->sc_state = PPPOE_STATE_CLOSING; 1264 1265 /* notify upper layer */ 1266 sc->sc_sppp.pp_down(&sc->sc_sppp); 1267 1268 /* clear connection state */ 1269 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest)); 1270 sc->sc_state = PPPOE_STATE_INITIAL; 1271 } 1272 1273 /* Send a PADR packet */ 1274 static int 1275 pppoe_send_padr(struct pppoe_softc *sc) 1276 { 1277 struct mbuf *m0; 1278 uint8_t *p; 1279 size_t len, l1 = 0; /* XXX: gcc */ 1280 1281 if (sc->sc_state != PPPOE_STATE_PADR_SENT) 1282 return EIO; 1283 1284 len = 2 + 2 + 2 + 2 + sizeof(sc); /* service name, host unique */ 1285 if (sc->sc_service_name != NULL) { /* service name tag maybe empty */ 1286 l1 = strlen(sc->sc_service_name); 1287 len += l1; 1288 } 1289 if (sc->sc_ac_cookie_len > 0) 1290 len += 2 + 2 + sc->sc_ac_cookie_len; /* AC cookie */ 1291 if (sc->sc_relay_sid_len > 0) 1292 len += 2 + 2 + sc->sc_relay_sid_len; /* Relay SID */ 1293 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) { 1294 len += 2 + 2 + 2; 1295 } 1296 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN); 1297 if (!m0) 1298 return ENOBUFS; 1299 p = mtod(m0, uint8_t *); 1300 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADR, 0, len); 1301 PPPOE_ADD_16(p, PPPOE_TAG_SNAME); 1302 if (sc->sc_service_name != NULL) { 1303 PPPOE_ADD_16(p, l1); 1304 memcpy(p, sc->sc_service_name, l1); 1305 p += l1; 1306 } else { 1307 PPPOE_ADD_16(p, 0); 1308 } 1309 if (sc->sc_ac_cookie_len > 0) { 1310 PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE); 1311 PPPOE_ADD_16(p, sc->sc_ac_cookie_len); 1312 memcpy(p, sc->sc_ac_cookie, sc->sc_ac_cookie_len); 1313 p += sc->sc_ac_cookie_len; 1314 } 1315 if (sc->sc_relay_sid_len > 0) { 1316 PPPOE_ADD_16(p, PPPOE_TAG_RELAYSID); 1317 PPPOE_ADD_16(p, sc->sc_relay_sid_len); 1318 memcpy(p, sc->sc_relay_sid, sc->sc_relay_sid_len); 1319 p += sc->sc_relay_sid_len; 1320 } 1321 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE); 1322 PPPOE_ADD_16(p, sizeof(sc)); 1323 memcpy(p, &sc, sizeof sc); 1324 p += sizeof(sc); 1325 1326 if (sc->sc_sppp.pp_if.if_mtu > PPPOE_MAXMTU) { 1327 PPPOE_ADD_16(p, PPPOE_TAG_MAX_PAYLOAD); 1328 PPPOE_ADD_16(p, 2); 1329 PPPOE_ADD_16(p, (uint16_t)sc->sc_sppp.pp_if.if_mtu); 1330 } 1331 1332 #ifdef PPPOE_DEBUG 1333 p += sizeof sc; 1334 if (p - mtod(m0, uint8_t *) != len + PPPOE_HEADERLEN) 1335 panic("pppoe_send_padr: garbled output len, should be %ld, is %ld", 1336 (long)(len + PPPOE_HEADERLEN), (long)(p - mtod(m0, uint8_t *))); 1337 #endif 1338 1339 return pppoe_output(sc, m0); 1340 } 1341 1342 /* send a PADT packet */ 1343 static int 1344 pppoe_send_padt(struct ifnet *outgoing_if, u_int session, const uint8_t *dest) 1345 { 1346 struct ether_header *eh; 1347 struct sockaddr dst; 1348 struct mbuf *m0; 1349 uint8_t *p; 1350 1351 m0 = pppoe_get_mbuf(PPPOE_HEADERLEN); 1352 if (!m0) 1353 return EIO; 1354 p = mtod(m0, uint8_t *); 1355 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADT, session, 0); 1356 1357 memset(&dst, 0, sizeof dst); 1358 dst.sa_family = AF_UNSPEC; 1359 eh = (struct ether_header*)&dst.sa_data; 1360 eh->ether_type = htons(ETHERTYPE_PPPOEDISC); 1361 memcpy(&eh->ether_dhost, dest, ETHER_ADDR_LEN); 1362 1363 m0->m_flags &= ~(M_BCAST|M_MCAST); 1364 return outgoing_if->if_output(outgoing_if, m0, &dst, NULL); 1365 } 1366 1367 #ifdef PPPOE_SERVER 1368 static int 1369 pppoe_send_pado(struct pppoe_softc *sc) 1370 { 1371 struct mbuf *m0; 1372 uint8_t *p; 1373 size_t len; 1374 1375 if (sc->sc_state != PPPOE_STATE_PADO_SENT) 1376 return EIO; 1377 1378 /* calc length */ 1379 len = 0; 1380 /* include ac_cookie */ 1381 len += 2 + 2 + sizeof(sc); 1382 /* include hunique */ 1383 len += 2 + 2 + sc->sc_hunique_len; 1384 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN); 1385 if (!m0) 1386 return EIO; 1387 p = mtod(m0, uint8_t *); 1388 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADO, 0, len); 1389 PPPOE_ADD_16(p, PPPOE_TAG_ACCOOKIE); 1390 PPPOE_ADD_16(p, sizeof(sc)); 1391 memcpy(p, &sc, sizeof(sc)); 1392 p += sizeof(sc); 1393 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE); 1394 PPPOE_ADD_16(p, sc->sc_hunique_len); 1395 memcpy(p, sc->sc_hunique, sc->sc_hunique_len); 1396 return pppoe_output(sc, m0); 1397 } 1398 1399 static int 1400 pppoe_send_pads(struct pppoe_softc *sc) 1401 { 1402 struct bintime bt; 1403 struct mbuf *m0; 1404 uint8_t *p; 1405 size_t len, l1 = 0; /* XXX: gcc */ 1406 1407 if (sc->sc_state != PPPOE_STATE_PADO_SENT) 1408 return EIO; 1409 1410 getbinuptime(&bt); 1411 sc->sc_session = bt.sec % 0xff + 1; 1412 /* calc length */ 1413 len = 0; 1414 /* include hunique */ 1415 len += 2 + 2 + 2 + 2 + sc->sc_hunique_len; /* service name, host unique*/ 1416 if (sc->sc_service_name != NULL) { /* service name tag maybe empty */ 1417 l1 = strlen(sc->sc_service_name); 1418 len += l1; 1419 } 1420 m0 = pppoe_get_mbuf(len + PPPOE_HEADERLEN); 1421 if (!m0) 1422 return ENOBUFS; 1423 p = mtod(m0, uint8_t *); 1424 PPPOE_ADD_HEADER(p, PPPOE_CODE_PADS, sc->sc_session, len); 1425 PPPOE_ADD_16(p, PPPOE_TAG_SNAME); 1426 if (sc->sc_service_name != NULL) { 1427 PPPOE_ADD_16(p, l1); 1428 memcpy(p, sc->sc_service_name, l1); 1429 p += l1; 1430 } else { 1431 PPPOE_ADD_16(p, 0); 1432 } 1433 PPPOE_ADD_16(p, PPPOE_TAG_HUNIQUE); 1434 PPPOE_ADD_16(p, sc->sc_hunique_len); 1435 memcpy(p, sc->sc_hunique, sc->sc_hunique_len); 1436 return pppoe_output(sc, m0); 1437 } 1438 #endif 1439 1440 static void 1441 pppoe_tls(struct sppp *sp) 1442 { 1443 struct pppoe_softc *sc = (void *)sp; 1444 int wtime; 1445 1446 if (sc->sc_state != PPPOE_STATE_INITIAL) 1447 return; 1448 1449 if (sc->sc_sppp.pp_phase == SPPP_PHASE_ESTABLISH && 1450 sc->sc_sppp.pp_auth_failures > 0) { 1451 /* 1452 * Delay trying to reconnect a bit more - the peer 1453 * might have failed to contact its radius server. 1454 */ 1455 wtime = PPPOE_RECON_FAST * sc->sc_sppp.pp_auth_failures; 1456 if (wtime > PPPOE_SLOW_RETRY) 1457 wtime = PPPOE_SLOW_RETRY; 1458 } else { 1459 wtime = PPPOE_RECON_IMMEDIATE; 1460 } 1461 callout_reset(&sc->sc_timeout, wtime, pppoe_timeout, sc); 1462 } 1463 1464 static void 1465 pppoe_tlf(struct sppp *sp) 1466 { 1467 struct pppoe_softc *sc = (void *)sp; 1468 if (sc->sc_state < PPPOE_STATE_SESSION) 1469 return; 1470 /* 1471 * Do not call pppoe_disconnect here, the upper layer state 1472 * machine gets confused by this. We must return from this 1473 * function and defer disconnecting to the timeout handler. 1474 */ 1475 sc->sc_state = PPPOE_STATE_CLOSING; 1476 callout_reset(&sc->sc_timeout, hz/50, pppoe_timeout, sc); 1477 } 1478 1479 static void 1480 pppoe_start(struct ifnet *ifp) 1481 { 1482 struct pppoe_softc *sc = (void *)ifp; 1483 struct mbuf *m; 1484 uint8_t *p; 1485 size_t len; 1486 1487 if (sppp_isempty(ifp)) 1488 return; 1489 1490 /* are we ready to process data yet? */ 1491 if (sc->sc_state < PPPOE_STATE_SESSION) { 1492 sppp_flush(&sc->sc_sppp.pp_if); 1493 return; 1494 } 1495 1496 while ((m = sppp_dequeue(ifp)) != NULL) { 1497 len = m->m_pkthdr.len; 1498 M_PREPEND(m, PPPOE_HEADERLEN, M_DONTWAIT); 1499 if (m == NULL) { 1500 ifp->if_oerrors++; 1501 continue; 1502 } 1503 p = mtod(m, uint8_t *); 1504 PPPOE_ADD_HEADER(p, 0, sc->sc_session, len); 1505 1506 bpf_mtap(&sc->sc_sppp.pp_if, m); 1507 1508 pppoe_output(sc, m); 1509 } 1510 } 1511 1512 1513 static int 1514 pppoe_ifattach_hook(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 1515 { 1516 struct pppoe_softc *sc; 1517 int s; 1518 1519 if (mp != (struct mbuf **)PFIL_IFNET_DETACH) 1520 return 0; 1521 1522 s = splnet(); 1523 LIST_FOREACH(sc, &pppoe_softc_list, sc_list) { 1524 if (sc->sc_eth_if != ifp) 1525 continue; 1526 if (sc->sc_sppp.pp_if.if_flags & IFF_UP) { 1527 sc->sc_sppp.pp_if.if_flags &= ~(IFF_UP|IFF_RUNNING); 1528 printf("%s: ethernet interface detached, going down\n", 1529 sc->sc_sppp.pp_if.if_xname); 1530 } 1531 sc->sc_eth_if = NULL; 1532 pppoe_clear_softc(sc, "ethernet interface detached"); 1533 } 1534 splx(s); 1535 1536 return 0; 1537 } 1538 1539 static void 1540 pppoe_clear_softc(struct pppoe_softc *sc, const char *message) 1541 { 1542 /* stop timer */ 1543 callout_stop(&sc->sc_timeout); 1544 if (sc->sc_sppp.pp_if.if_flags & IFF_DEBUG) 1545 printf("%s: session 0x%x terminated, %s\n", 1546 sc->sc_sppp.pp_if.if_xname, sc->sc_session, message); 1547 1548 /* fix our state */ 1549 sc->sc_state = PPPOE_STATE_INITIAL; 1550 1551 /* signal upper layer */ 1552 sc->sc_sppp.pp_down(&sc->sc_sppp); 1553 1554 /* clean up softc */ 1555 memcpy(&sc->sc_dest, etherbroadcastaddr, sizeof(sc->sc_dest)); 1556 if (sc->sc_ac_cookie) { 1557 free(sc->sc_ac_cookie, M_DEVBUF); 1558 sc->sc_ac_cookie = NULL; 1559 } 1560 if (sc->sc_relay_sid) { 1561 free(sc->sc_relay_sid, M_DEVBUF); 1562 sc->sc_relay_sid = NULL; 1563 } 1564 sc->sc_ac_cookie_len = 0; 1565 sc->sc_session = 0; 1566 } 1567