1 /***********************************************************************
5 * Perform PPPoE discovery
7 * Copyright (C) 1999 by Roaring Penguin Software Inc.
9 ***********************************************************************/
11 static char const RCSID[] =
12 "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
20 #include "pppd/pppd.h"
28 #ifdef HAVE_SYS_TIME_H
40 #ifdef USE_LINUX_PACKET
41 #include <sys/ioctl.h>
47 /* Calculate time remaining until *exp, return 0 if now >= *exp */
48 static int time_left(struct timeval *diff, struct timeval *exp)
52 if (get_time(&now) < 0) {
53 error("get_time: %m");
57 if (now.tv_sec > exp->tv_sec
58 || (now.tv_sec == exp->tv_sec && now.tv_usec >= exp->tv_usec))
61 diff->tv_sec = exp->tv_sec - now.tv_sec;
62 diff->tv_usec = exp->tv_usec - now.tv_usec;
63 if (diff->tv_usec < 0) {
64 diff->tv_usec += 1000000;
71 /**********************************************************************
72 *%FUNCTION: parseForHostUniq
77 * extra -- user-supplied pointer. This is assumed to be a pointer to int.
81 * If a HostUnique tag is found which matches our PID, sets *extra to 1.
82 ***********************************************************************/
84 parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
87 PPPoETag *tag = extra;
89 if (type == TAG_HOST_UNIQ && len == ntohs(tag->length))
90 tag->length = memcmp(data, tag->payload, len);
93 /**********************************************************************
94 *%FUNCTION: packetIsForMe
96 * conn -- PPPoE connection info
97 * packet -- a received PPPoE packet
99 * 1 if packet is for this PPPoE daemon; 0 otherwise.
101 * If we are using the Host-Unique tag, verifies that packet contains
102 * our unique identifier.
103 ***********************************************************************/
105 packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
107 PPPoETag hostUniq = conn->hostUniq;
109 /* If packet is not directed to our MAC address, forget it */
110 if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
112 /* If we're not using the Host-Unique tag, then accept the packet */
113 if (!conn->hostUniq.length) return 1;
115 parsePacket(packet, parseForHostUniq, &hostUniq);
116 return !hostUniq.length;
119 /**********************************************************************
120 *%FUNCTION: parsePADOTags
125 * extra -- extra user data. Should point to a PacketCriteria structure
126 * which gets filled in according to selected AC name and service
131 * Picks interesting tags out of a PADO packet
132 ***********************************************************************/
134 parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
137 struct PacketCriteria *pc = (struct PacketCriteria *) extra;
138 PPPoEConnection *conn = pc->conn;
145 if (conn->printACNames) {
146 info("Access-Concentrator: %.*s", (int) len, data);
148 if (conn->acName && len == strlen(conn->acName) &&
149 !strncmp((char *) data, conn->acName, len)) {
153 case TAG_SERVICE_NAME:
154 pc->seenServiceName = 1;
155 if (conn->serviceName && len == strlen(conn->serviceName) &&
156 !strncmp((char *) data, conn->serviceName, len)) {
157 pc->serviceNameOK = 1;
161 conn->cookie.type = htons(type);
162 conn->cookie.length = htons(len);
163 memcpy(conn->cookie.payload, data, len);
165 case TAG_RELAY_SESSION_ID:
166 conn->relayId.type = htons(type);
167 conn->relayId.length = htons(len);
168 memcpy(conn->relayId.payload, data, len);
170 case TAG_PPP_MAX_PAYLOAD:
171 if (len == sizeof(mru)) {
172 memcpy(&mru, data, sizeof(mru));
174 if (mru >= ETH_PPPOE_MTU) {
175 if (lcp_allowoptions[0].mru > mru)
176 lcp_allowoptions[0].mru = mru;
177 if (lcp_wantoptions[0].mru > mru)
178 lcp_wantoptions[0].mru = mru;
179 conn->seenMaxPayload = 1;
183 case TAG_SERVICE_NAME_ERROR:
184 error("PADO: Service-Name-Error: %.*s", (int) len, data);
187 case TAG_AC_SYSTEM_ERROR:
188 error("PADO: System-Error: %.*s", (int) len, data);
191 case TAG_GENERIC_ERROR:
192 error("PADO: Generic-Error: %.*s", (int) len, data);
198 /**********************************************************************
199 *%FUNCTION: parsePADSTags
204 * extra -- extra user data (pointer to PPPoEConnection structure)
208 * Picks interesting tags out of a PADS packet
209 ***********************************************************************/
211 parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
214 PPPoEConnection *conn = (PPPoEConnection *) extra;
217 case TAG_SERVICE_NAME:
218 dbglog("PADS: Service-Name: '%.*s'", (int) len, data);
220 case TAG_PPP_MAX_PAYLOAD:
221 if (len == sizeof(mru)) {
222 memcpy(&mru, data, sizeof(mru));
224 if (mru >= ETH_PPPOE_MTU) {
225 if (lcp_allowoptions[0].mru > mru)
226 lcp_allowoptions[0].mru = mru;
227 if (lcp_wantoptions[0].mru > mru)
228 lcp_wantoptions[0].mru = mru;
229 conn->seenMaxPayload = 1;
233 case TAG_SERVICE_NAME_ERROR:
234 error("PADS: Service-Name-Error: %.*s", (int) len, data);
237 case TAG_AC_SYSTEM_ERROR:
238 error("PADS: System-Error: %.*s", (int) len, data);
241 case TAG_GENERIC_ERROR:
242 error("PADS: Generic-Error: %.*s", (int) len, data);
245 case TAG_RELAY_SESSION_ID:
246 conn->relayId.type = htons(type);
247 conn->relayId.length = htons(len);
248 memcpy(conn->relayId.payload, data, len);
253 /***********************************************************************
256 * conn -- PPPoEConnection structure
260 * Sends a PADI packet
261 ***********************************************************************/
263 sendPADI(PPPoEConnection *conn)
266 unsigned char *cursor = packet.payload;
267 PPPoETag *svc = (PPPoETag *) (&packet.payload);
268 UINT16_t namelen = 0;
270 int omit_service_name = 0;
272 if (conn->serviceName) {
273 namelen = (UINT16_t) strlen(conn->serviceName);
274 if (!strcmp(conn->serviceName, "NO-SERVICE-NAME-NON-RFC-COMPLIANT")) {
275 omit_service_name = 1;
279 /* Set destination to Ethernet broadcast address */
280 memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
281 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
283 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
284 packet.vertype = PPPOE_VER_TYPE(1, 1);
285 packet.code = CODE_PADI;
288 if (!omit_service_name) {
289 plen = TAG_HDR_SIZE + namelen;
290 CHECK_ROOM(cursor, packet.payload, plen);
292 svc->type = TAG_SERVICE_NAME;
293 svc->length = htons(namelen);
295 if (conn->serviceName) {
296 memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
298 cursor += namelen + TAG_HDR_SIZE;
303 /* If we're using Host-Uniq, copy it over */
304 if (conn->hostUniq.length) {
305 int len = ntohs(conn->hostUniq.length);
306 CHECK_ROOM(cursor, packet.payload, len + TAG_HDR_SIZE);
307 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
308 cursor += len + TAG_HDR_SIZE;
309 plen += len + TAG_HDR_SIZE;
312 /* Add our maximum MTU/MRU */
313 if (MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru) > ETH_PPPOE_MTU) {
315 UINT16_t mru = htons(MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru));
316 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
317 maxPayload.length = htons(sizeof(mru));
318 memcpy(maxPayload.payload, &mru, sizeof(mru));
319 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
320 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
321 cursor += sizeof(mru) + TAG_HDR_SIZE;
322 plen += sizeof(mru) + TAG_HDR_SIZE;
325 packet.length = htons(plen);
327 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
330 /**********************************************************************
331 *%FUNCTION: waitForPADO
333 * conn -- PPPoEConnection structure
334 * timeout -- how long to wait (in seconds)
338 * Waits for a PADO packet and copies useful information
339 ***********************************************************************/
341 waitForPADO(PPPoEConnection *conn, int timeout)
346 struct timeval expire_at;
351 struct PacketCriteria pc;
353 pc.acNameOK = (conn->acName) ? 0 : 1;
354 pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
356 pc.seenServiceName = 0;
357 conn->seenMaxPayload = 0;
360 if (get_time(&expire_at) < 0) {
361 error("get_time (waitForPADO): %m");
364 expire_at.tv_sec += timeout;
367 if (BPF_BUFFER_IS_EMPTY) {
368 if (!time_left(&tv, &expire_at))
369 return; /* Timed out */
372 FD_SET(conn->discoverySocket, &readable);
375 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
376 if (r >= 0 || errno != EINTR || got_sigterm) break;
379 error("select (waitForPADO): %m");
383 return; /* Timed out */
387 receivePacket(conn->discoverySocket, &packet, &len);
390 if (ntohs(packet.length) + HDR_SIZE > len) {
391 error("Bogus PPPoE length field (%u)",
392 (unsigned int) ntohs(packet.length));
397 /* If it's not a Discovery packet, loop again */
398 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
401 /* If it's not for us, loop again */
402 if (!packetIsForMe(conn, &packet)) continue;
404 if (packet.code == CODE_PADO) {
405 if (NOT_UNICAST(packet.ethHdr.h_source)) {
406 error("Ignoring PADO packet from non-unicast MAC address");
410 && memcmp(packet.ethHdr.h_source, conn->req_peer_mac, ETH_ALEN) != 0) {
411 warn("Ignoring PADO packet from wrong MAC address");
414 if (parsePacket(&packet, parsePADOTags, &pc) < 0)
418 if (!pc.seenACName) {
419 error("Ignoring PADO packet with no AC-Name tag");
422 if (!pc.seenServiceName) {
423 error("Ignoring PADO packet with no Service-Name tag");
427 if (pc.acNameOK && pc.serviceNameOK) {
428 memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
429 conn->discoveryState = STATE_RECEIVED_PADO;
433 } while (conn->discoveryState != STATE_RECEIVED_PADO);
436 /***********************************************************************
439 * conn -- PPPoE connection structur
443 * Sends a PADR packet
444 ***********************************************************************/
446 sendPADR(PPPoEConnection *conn)
449 PPPoETag *svc = (PPPoETag *) packet.payload;
450 unsigned char *cursor = packet.payload;
452 UINT16_t namelen = 0;
455 if (conn->serviceName) {
456 namelen = (UINT16_t) strlen(conn->serviceName);
458 plen = TAG_HDR_SIZE + namelen;
459 CHECK_ROOM(cursor, packet.payload, plen);
461 memcpy(packet.ethHdr.h_dest, conn->peerEth, ETH_ALEN);
462 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
464 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
465 packet.vertype = PPPOE_VER_TYPE(1, 1);
466 packet.code = CODE_PADR;
469 svc->type = TAG_SERVICE_NAME;
470 svc->length = htons(namelen);
471 if (conn->serviceName) {
472 memcpy(svc->payload, conn->serviceName, namelen);
474 cursor += namelen + TAG_HDR_SIZE;
476 /* If we're using Host-Uniq, copy it over */
477 if (conn->hostUniq.length) {
478 int len = ntohs(conn->hostUniq.length);
479 CHECK_ROOM(cursor, packet.payload, len+TAG_HDR_SIZE);
480 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
481 cursor += len + TAG_HDR_SIZE;
482 plen += len + TAG_HDR_SIZE;
485 /* Add our maximum MTU/MRU */
486 if (MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru) > ETH_PPPOE_MTU) {
488 UINT16_t mru = htons(MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru));
489 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
490 maxPayload.length = htons(sizeof(mru));
491 memcpy(maxPayload.payload, &mru, sizeof(mru));
492 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
493 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
494 cursor += sizeof(mru) + TAG_HDR_SIZE;
495 plen += sizeof(mru) + TAG_HDR_SIZE;
498 /* Copy cookie and relay-ID if needed */
499 if (conn->cookie.type) {
500 CHECK_ROOM(cursor, packet.payload,
501 ntohs(conn->cookie.length) + TAG_HDR_SIZE);
502 memcpy(cursor, &conn->cookie, ntohs(conn->cookie.length) + TAG_HDR_SIZE);
503 cursor += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
504 plen += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
507 if (conn->relayId.type) {
508 CHECK_ROOM(cursor, packet.payload,
509 ntohs(conn->relayId.length) + TAG_HDR_SIZE);
510 memcpy(cursor, &conn->relayId, ntohs(conn->relayId.length) + TAG_HDR_SIZE);
511 cursor += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
512 plen += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
515 packet.length = htons(plen);
516 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
519 /**********************************************************************
520 *%FUNCTION: waitForPADS
522 * conn -- PPPoE connection info
523 * timeout -- how long to wait (in seconds)
527 * Waits for a PADS packet and copies useful information
528 ***********************************************************************/
530 waitForPADS(PPPoEConnection *conn, int timeout)
535 struct timeval expire_at;
540 if (get_time(&expire_at) < 0) {
541 error("get_time (waitForPADS): %m");
544 expire_at.tv_sec += timeout;
548 if (BPF_BUFFER_IS_EMPTY) {
549 if (!time_left(&tv, &expire_at))
550 return; /* Timed out */
553 FD_SET(conn->discoverySocket, &readable);
556 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
557 if (r >= 0 || errno != EINTR || got_sigterm) break;
560 error("select (waitForPADS): %m");
564 return; /* Timed out */
568 receivePacket(conn->discoverySocket, &packet, &len);
571 if (ntohs(packet.length) + HDR_SIZE > len) {
572 error("Bogus PPPoE length field (%u)",
573 (unsigned int) ntohs(packet.length));
578 /* If it's not a Discovery packet, loop again */
579 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
582 /* If it's not from the AC, it's not for me */
583 if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
585 /* If it's not for us, loop again */
586 if (!packetIsForMe(conn, &packet)) continue;
589 if (packet.code == CODE_PADS) {
590 /* Parse for goodies */
591 if (parsePacket(&packet, parsePADSTags, conn) < 0)
595 conn->discoveryState = STATE_SESSION;
598 } while (conn->discoveryState != STATE_SESSION);
600 /* Don't bother with ntohs; we'll just end up converting it back... */
601 conn->session = packet.session;
603 info("PPP session is %d", (int) ntohs(conn->session));
605 /* RFC 2516 says session id MUST NOT be zero or 0xFFFF */
606 if (ntohs(conn->session) == 0 || ntohs(conn->session) == 0xFFFF) {
607 error("Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
611 /**********************************************************************
612 *%FUNCTION: discovery
614 * conn -- PPPoE connection info structure
618 * Performs the PPPoE discovery phase
619 ***********************************************************************/
621 discovery(PPPoEConnection *conn)
623 int padiAttempts = 0;
624 int padrAttempts = 0;
625 int timeout = conn->discoveryTimeout;
629 if (got_sigterm || padiAttempts > conn->discoveryAttempts) {
630 warn("Timeout waiting for PADO packets");
631 close(conn->discoverySocket);
632 conn->discoverySocket = -1;
636 conn->discoveryState = STATE_SENT_PADI;
637 waitForPADO(conn, timeout);
640 } while (conn->discoveryState == STATE_SENT_PADI);
642 timeout = conn->discoveryTimeout;
645 if (got_sigterm || padrAttempts > conn->discoveryAttempts) {
646 warn("Timeout waiting for PADS packets");
647 close(conn->discoverySocket);
648 conn->discoverySocket = -1;
652 conn->discoveryState = STATE_SENT_PADR;
653 waitForPADS(conn, timeout);
655 } while (conn->discoveryState == STATE_SENT_PADR);
657 if (!conn->seenMaxPayload) {
658 /* RFC 4638: MUST limit MTU/MRU to 1492 */
659 if (lcp_allowoptions[0].mru > ETH_PPPOE_MTU)
660 lcp_allowoptions[0].mru = ETH_PPPOE_MTU;
661 if (lcp_wantoptions[0].mru > ETH_PPPOE_MTU)
662 lcp_wantoptions[0].mru = ETH_PPPOE_MTU;
666 close(conn->discoverySocket);
667 conn->discoverySocket = -1;
668 conn->discoveryState = STATE_SESSION;