1 /***********************************************************************
5 * Perform PPPoE discovery
7 * Copyright (C) 1999 by Roaring Penguin Software Inc.
9 ***********************************************************************/
11 static char const RCSID[] =
12 "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
20 #include <pppd/pppd.h>
28 #ifdef HAVE_SYS_TIME_H
40 #ifdef USE_LINUX_PACKET
41 #include <sys/ioctl.h>
47 /* Calculate time remaining until *exp, return 0 if now >= *exp */
48 static int time_left(struct timeval *diff, struct timeval *exp)
52 if (get_time(&now) < 0) {
53 error("get_time: %m");
57 if (now.tv_sec > exp->tv_sec
58 || (now.tv_sec == exp->tv_sec && now.tv_usec >= exp->tv_usec))
61 diff->tv_sec = exp->tv_sec - now.tv_sec;
62 diff->tv_usec = exp->tv_usec - now.tv_usec;
63 if (diff->tv_usec < 0) {
64 diff->tv_usec += 1000000;
71 /**********************************************************************
72 *%FUNCTION: parseForHostUniq
77 * extra -- user-supplied pointer. This is assumed to be a pointer to int.
81 * If a HostUnique tag is found which matches our PID, sets *extra to 1.
82 ***********************************************************************/
84 parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
87 PPPoETag *tag = extra;
89 if (type == TAG_HOST_UNIQ && len == ntohs(tag->length))
90 tag->length = memcmp(data, tag->payload, len);
93 /**********************************************************************
94 *%FUNCTION: packetIsForMe
96 * conn -- PPPoE connection info
97 * packet -- a received PPPoE packet
99 * 1 if packet is for this PPPoE daemon; 0 otherwise.
101 * If we are using the Host-Unique tag, verifies that packet contains
102 * our unique identifier.
103 ***********************************************************************/
105 packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
107 PPPoETag hostUniq = conn->hostUniq;
109 /* If packet is not directed to our MAC address, forget it */
110 if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
112 /* If we're not using the Host-Unique tag, then accept the packet */
113 if (!conn->hostUniq.length) return 1;
115 parsePacket(packet, parseForHostUniq, &hostUniq);
116 return !hostUniq.length;
119 /**********************************************************************
120 *%FUNCTION: parsePADOTags
125 * extra -- extra user data. Should point to a PacketCriteria structure
126 * which gets filled in according to selected AC name and service
131 * Picks interesting tags out of a PADO packet
132 ***********************************************************************/
134 parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
137 struct PacketCriteria *pc = (struct PacketCriteria *) extra;
138 PPPoEConnection *conn = pc->conn;
145 if (pppoe_verbose >= 1) {
146 info("Access-Concentrator: %.*s", (int) len, data);
148 if (conn->acName && len == strlen(conn->acName) &&
149 !strncmp((char *) data, conn->acName, len)) {
153 case TAG_SERVICE_NAME:
154 pc->seenServiceName = 1;
155 if (pppoe_verbose >= 1 && len > 0) {
156 info("Service-Name: %.*s", (int) len, data);
158 if (conn->serviceName && len == strlen(conn->serviceName) &&
159 !strncmp((char *) data, conn->serviceName, len)) {
160 pc->serviceNameOK = 1;
164 if (pppoe_verbose >= 1) {
167 ptr += sprintf(ptr, "Cookie:");
168 /* Print first 20 bytes of cookie */
169 for (i=0; i<len && i < 20; i++) {
170 ptr += sprintf(ptr, " %02x", (unsigned) data[i]);
172 if (i < len) ptr += sprintf(ptr, "...");
175 if (conn->discoveryState != STATE_RECEIVED_PADO) {
176 conn->cookie.type = htons(type);
177 conn->cookie.length = htons(len);
178 memcpy(conn->cookie.payload, data, len);
181 case TAG_RELAY_SESSION_ID:
182 if (pppoe_verbose >= 1) {
185 ptr += sprintf(ptr, "Relay-ID:");
186 /* Print first 20 bytes of relay ID */
187 for (i=0; i<len && i < 20; i++) {
188 ptr += printf(ptr, " %02x", (unsigned) data[i]);
190 if (i < len) ptr += printf(ptr, "...");
193 if (conn->discoveryState != STATE_RECEIVED_PADO) {
194 conn->relayId.type = htons(type);
195 conn->relayId.length = htons(len);
196 memcpy(conn->relayId.payload, data, len);
199 case TAG_PPP_MAX_PAYLOAD:
200 if (len == sizeof(mru)) {
201 memcpy(&mru, data, sizeof(mru));
203 info("Max-Payload: %u", (unsigned) mru);
204 if (mru >= ETH_PPPOE_MTU && conn->discoveryState != STATE_RECEIVED_PADO) {
209 conn->seenMaxPayload = 1;
213 case TAG_SERVICE_NAME_ERROR:
214 error("PADO: Service-Name-Error: %.*s", (int) len, data);
217 case TAG_AC_SYSTEM_ERROR:
218 error("PADO: System-Error: %.*s", (int) len, data);
221 case TAG_GENERIC_ERROR:
222 error("PADO: Generic-Error: %.*s", (int) len, data);
228 /**********************************************************************
229 *%FUNCTION: parsePADSTags
234 * extra -- extra user data (pointer to PPPoEConnection structure)
238 * Picks interesting tags out of a PADS packet
239 ***********************************************************************/
241 parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
244 PPPoEConnection *conn = (PPPoEConnection *) extra;
247 case TAG_SERVICE_NAME:
248 if (pppoe_verbose >= 1 && len > 0) {
249 info("PADS: Service-Name: '%.*s'", (int) len, data);
252 case TAG_PPP_MAX_PAYLOAD:
253 if (len == sizeof(mru)) {
254 memcpy(&mru, data, sizeof(mru));
256 if (mru >= ETH_PPPOE_MTU) {
261 conn->seenMaxPayload = 1;
265 case TAG_SERVICE_NAME_ERROR:
266 error("PADS: Service-Name-Error: %.*s", (int) len, data);
269 case TAG_AC_SYSTEM_ERROR:
270 error("PADS: System-Error: %.*s", (int) len, data);
273 case TAG_GENERIC_ERROR:
274 error("PADS: Generic-Error: %.*s", (int) len, data);
277 case TAG_RELAY_SESSION_ID:
278 conn->relayId.type = htons(type);
279 conn->relayId.length = htons(len);
280 memcpy(conn->relayId.payload, data, len);
285 /***********************************************************************
288 * conn -- PPPoEConnection structure
292 * Sends a PADI packet
293 ***********************************************************************/
295 sendPADI(PPPoEConnection *conn)
298 unsigned char *cursor = packet.payload;
299 PPPoETag *svc = (PPPoETag *) (&packet.payload);
300 UINT16_t namelen = 0;
302 int omit_service_name = 0;
304 if (conn->serviceName) {
305 namelen = (UINT16_t) strlen(conn->serviceName);
306 if (!strcmp(conn->serviceName, "NO-SERVICE-NAME-NON-RFC-COMPLIANT")) {
307 omit_service_name = 1;
311 /* Set destination to Ethernet broadcast address */
312 memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
313 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
315 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
316 packet.vertype = PPPOE_VER_TYPE(1, 1);
317 packet.code = CODE_PADI;
320 if (!omit_service_name) {
321 plen = TAG_HDR_SIZE + namelen;
322 CHECK_ROOM(cursor, packet.payload, plen);
324 svc->type = TAG_SERVICE_NAME;
325 svc->length = htons(namelen);
327 if (conn->serviceName) {
328 memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
330 cursor += namelen + TAG_HDR_SIZE;
335 /* If we're using Host-Uniq, copy it over */
336 if (conn->hostUniq.length) {
337 int len = ntohs(conn->hostUniq.length);
338 CHECK_ROOM(cursor, packet.payload, len + TAG_HDR_SIZE);
339 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
340 cursor += len + TAG_HDR_SIZE;
341 plen += len + TAG_HDR_SIZE;
344 /* Add our maximum MTU/MRU */
345 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
347 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
348 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
349 maxPayload.length = htons(sizeof(mru));
350 memcpy(maxPayload.payload, &mru, sizeof(mru));
351 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
352 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
353 cursor += sizeof(mru) + TAG_HDR_SIZE;
354 plen += sizeof(mru) + TAG_HDR_SIZE;
357 packet.length = htons(plen);
359 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
362 /**********************************************************************
363 *%FUNCTION: waitForPADO
365 * conn -- PPPoEConnection structure
366 * timeout -- how long to wait (in seconds)
370 * Waits for a PADO packet and copies useful information
371 ***********************************************************************/
373 waitForPADO(PPPoEConnection *conn, int timeout)
378 struct timeval expire_at;
383 struct PacketCriteria pc;
385 pc.acNameOK = (conn->acName) ? 0 : 1;
386 pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
388 pc.seenServiceName = 0;
389 conn->seenMaxPayload = 0;
391 if (get_time(&expire_at) < 0) {
392 error("get_time (waitForPADO): %m");
395 expire_at.tv_sec += timeout;
398 if (BPF_BUFFER_IS_EMPTY) {
399 if (!time_left(&tv, &expire_at))
400 return; /* Timed out */
403 FD_SET(conn->discoverySocket, &readable);
406 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
407 if (r >= 0 || errno != EINTR || got_sigterm) break;
410 error("select (waitForPADO): %m");
414 return; /* Timed out */
419 receivePacket(conn->discoverySocket, &packet, &len);
422 if (ntohs(packet.length) + HDR_SIZE > len) {
423 error("Bogus PPPoE length field (%u)",
424 (unsigned int) ntohs(packet.length));
429 /* If it's not a Discovery packet, loop again */
430 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
433 /* If it's not for us, loop again */
434 if (!packetIsForMe(conn, &packet)) continue;
436 if (packet.code == CODE_PADO) {
437 if (NOT_UNICAST(packet.ethHdr.h_source)) {
438 error("Ignoring PADO packet from non-unicast MAC address");
442 && memcmp(packet.ethHdr.h_source, conn->req_peer_mac, ETH_ALEN) != 0) {
443 warn("Ignoring PADO packet from wrong MAC address");
446 if (parsePacket(&packet, parsePADOTags, &pc) < 0)
450 if (!pc.seenACName) {
451 error("Ignoring PADO packet with no AC-Name tag");
454 if (!pc.seenServiceName) {
455 error("Ignoring PADO packet with no Service-Name tag");
458 if (pppoe_verbose >= 1) {
459 info("AC-Ethernet-Address: %02x:%02x:%02x:%02x:%02x:%02x",
460 (unsigned) packet.ethHdr.h_source[0],
461 (unsigned) packet.ethHdr.h_source[1],
462 (unsigned) packet.ethHdr.h_source[2],
463 (unsigned) packet.ethHdr.h_source[3],
464 (unsigned) packet.ethHdr.h_source[4],
465 (unsigned) packet.ethHdr.h_source[5]);
466 info("--------------------------------------------------");
469 if (pc.acNameOK && pc.serviceNameOK && conn->discoveryState != STATE_RECEIVED_PADO) {
470 memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
471 conn->discoveryState = STATE_RECEIVED_PADO;
474 } while (pppoe_verbose >= 1 || conn->discoveryState != STATE_RECEIVED_PADO);
477 /***********************************************************************
480 * conn -- PPPoE connection structur
484 * Sends a PADR packet
485 ***********************************************************************/
487 sendPADR(PPPoEConnection *conn)
490 PPPoETag *svc = (PPPoETag *) packet.payload;
491 unsigned char *cursor = packet.payload;
493 UINT16_t namelen = 0;
496 if (conn->serviceName) {
497 namelen = (UINT16_t) strlen(conn->serviceName);
499 plen = TAG_HDR_SIZE + namelen;
500 CHECK_ROOM(cursor, packet.payload, plen);
502 memcpy(packet.ethHdr.h_dest, conn->peerEth, ETH_ALEN);
503 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
505 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
506 packet.vertype = PPPOE_VER_TYPE(1, 1);
507 packet.code = CODE_PADR;
510 svc->type = TAG_SERVICE_NAME;
511 svc->length = htons(namelen);
512 if (conn->serviceName) {
513 memcpy(svc->payload, conn->serviceName, namelen);
515 cursor += namelen + TAG_HDR_SIZE;
517 /* If we're using Host-Uniq, copy it over */
518 if (conn->hostUniq.length) {
519 int len = ntohs(conn->hostUniq.length);
520 CHECK_ROOM(cursor, packet.payload, len+TAG_HDR_SIZE);
521 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
522 cursor += len + TAG_HDR_SIZE;
523 plen += len + TAG_HDR_SIZE;
526 /* Add our maximum MTU/MRU */
527 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
529 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
530 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
531 maxPayload.length = htons(sizeof(mru));
532 memcpy(maxPayload.payload, &mru, sizeof(mru));
533 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
534 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
535 cursor += sizeof(mru) + TAG_HDR_SIZE;
536 plen += sizeof(mru) + TAG_HDR_SIZE;
539 /* Copy cookie and relay-ID if needed */
540 if (conn->cookie.type) {
541 CHECK_ROOM(cursor, packet.payload,
542 ntohs(conn->cookie.length) + TAG_HDR_SIZE);
543 memcpy(cursor, &conn->cookie, ntohs(conn->cookie.length) + TAG_HDR_SIZE);
544 cursor += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
545 plen += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
548 if (conn->relayId.type) {
549 CHECK_ROOM(cursor, packet.payload,
550 ntohs(conn->relayId.length) + TAG_HDR_SIZE);
551 memcpy(cursor, &conn->relayId, ntohs(conn->relayId.length) + TAG_HDR_SIZE);
552 cursor += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
553 plen += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
556 packet.length = htons(plen);
557 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
560 /**********************************************************************
561 *%FUNCTION: waitForPADS
563 * conn -- PPPoE connection info
564 * timeout -- how long to wait (in seconds)
568 * Waits for a PADS packet and copies useful information
569 ***********************************************************************/
571 waitForPADS(PPPoEConnection *conn, int timeout)
576 struct timeval expire_at;
581 if (get_time(&expire_at) < 0) {
582 error("get_time (waitForPADS): %m");
585 expire_at.tv_sec += timeout;
589 if (BPF_BUFFER_IS_EMPTY) {
590 if (!time_left(&tv, &expire_at))
591 return; /* Timed out */
594 FD_SET(conn->discoverySocket, &readable);
597 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
598 if (r >= 0 || errno != EINTR || got_sigterm) break;
601 error("select (waitForPADS): %m");
605 return; /* Timed out */
609 receivePacket(conn->discoverySocket, &packet, &len);
612 if (ntohs(packet.length) + HDR_SIZE > len) {
613 error("Bogus PPPoE length field (%u)",
614 (unsigned int) ntohs(packet.length));
619 /* If it's not a Discovery packet, loop again */
620 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
623 /* If it's not from the AC, it's not for me */
624 if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
626 /* If it's not for us, loop again */
627 if (!packetIsForMe(conn, &packet)) continue;
630 if (packet.code == CODE_PADS) {
631 /* Parse for goodies */
632 if (parsePacket(&packet, parsePADSTags, conn) < 0)
636 conn->discoveryState = STATE_SESSION;
639 } while (conn->discoveryState != STATE_SESSION);
641 /* Don't bother with ntohs; we'll just end up converting it back... */
642 conn->session = packet.session;
644 info("PPP session is %d", (int) ntohs(conn->session));
646 /* RFC 2516 says session id MUST NOT be zero or 0xFFFF */
647 if (ntohs(conn->session) == 0 || ntohs(conn->session) == 0xFFFF) {
648 error("Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
652 /**********************************************************************
653 *%FUNCTION: discovery1
655 * conn -- PPPoE connection info structure
659 * Performs the PPPoE discovery phase 1
660 ***********************************************************************/
662 discovery1(PPPoEConnection *conn)
664 int padiAttempts = 0;
665 int timeout = conn->discoveryTimeout;
669 if (got_sigterm || padiAttempts > conn->discoveryAttempts) {
670 warn("Timeout waiting for PADO packets");
671 close(conn->discoverySocket);
672 conn->discoverySocket = -1;
676 conn->discoveryState = STATE_SENT_PADI;
677 waitForPADO(conn, timeout);
680 } while (conn->discoveryState == STATE_SENT_PADI);
683 /**********************************************************************
684 *%FUNCTION: discovery2
686 * conn -- PPPoE connection info structure
690 * Performs the PPPoE discovery phase 2
691 ***********************************************************************/
693 discovery2(PPPoEConnection *conn)
695 int padrAttempts = 0;
696 int timeout = conn->discoveryTimeout;
700 if (got_sigterm || padrAttempts > conn->discoveryAttempts) {
701 warn("Timeout waiting for PADS packets");
702 close(conn->discoverySocket);
703 conn->discoverySocket = -1;
707 conn->discoveryState = STATE_SENT_PADR;
708 waitForPADS(conn, timeout);
710 } while (conn->discoveryState == STATE_SENT_PADR);
712 if (!conn->seenMaxPayload) {
713 /* RFC 4638: MUST limit MTU/MRU to 1492 */
714 if (conn->mtu > ETH_PPPOE_MTU)
715 conn->mtu = ETH_PPPOE_MTU;
716 if (conn->mru > ETH_PPPOE_MTU)
717 conn->mru = ETH_PPPOE_MTU;
721 close(conn->discoverySocket);
722 conn->discoverySocket = -1;
723 conn->discoveryState = STATE_SESSION;