1 /***********************************************************************
5 * Perform PPPoE discovery
7 * Copyright (C) 1999 by Roaring Penguin Software Inc.
9 ***********************************************************************/
11 static char const RCSID[] =
12 "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
16 #include "pppd/pppd.h"
24 #ifdef HAVE_SYS_TIME_H
36 #ifdef USE_LINUX_PACKET
37 #include <sys/ioctl.h>
43 /* Calculate time remaining until *exp, return 0 if now >= *exp */
44 static int time_left(struct timeval *diff, struct timeval *exp)
48 if (get_time(&now) < 0) {
49 error("get_time: %m");
53 if (now.tv_sec > exp->tv_sec
54 || (now.tv_sec == exp->tv_sec && now.tv_usec >= exp->tv_usec))
57 diff->tv_sec = exp->tv_sec - now.tv_sec;
58 diff->tv_usec = exp->tv_usec - now.tv_usec;
59 if (diff->tv_usec < 0) {
60 diff->tv_usec += 1000000;
67 /**********************************************************************
68 *%FUNCTION: parseForHostUniq
73 * extra -- user-supplied pointer. This is assumed to be a pointer to int.
77 * If a HostUnique tag is found which matches our PID, sets *extra to 1.
78 ***********************************************************************/
80 parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
83 PPPoETag *tag = extra;
85 if (type == TAG_HOST_UNIQ && len == ntohs(tag->length))
86 tag->length = memcmp(data, tag->payload, len);
89 /**********************************************************************
90 *%FUNCTION: packetIsForMe
92 * conn -- PPPoE connection info
93 * packet -- a received PPPoE packet
95 * 1 if packet is for this PPPoE daemon; 0 otherwise.
97 * If we are using the Host-Unique tag, verifies that packet contains
98 * our unique identifier.
99 ***********************************************************************/
101 packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
103 PPPoETag hostUniq = conn->hostUniq;
105 /* If packet is not directed to our MAC address, forget it */
106 if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
108 /* If we're not using the Host-Unique tag, then accept the packet */
109 if (!conn->hostUniq.length) return 1;
111 parsePacket(packet, parseForHostUniq, &hostUniq);
112 return !hostUniq.length;
115 /**********************************************************************
116 *%FUNCTION: parsePADOTags
121 * extra -- extra user data. Should point to a PacketCriteria structure
122 * which gets filled in according to selected AC name and service
127 * Picks interesting tags out of a PADO packet
128 ***********************************************************************/
130 parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
133 struct PacketCriteria *pc = (struct PacketCriteria *) extra;
134 PPPoEConnection *conn = pc->conn;
141 if (pppoe_verbose >= 1) {
142 info("Access-Concentrator: %.*s", (int) len, data);
144 if (conn->acName && len == strlen(conn->acName) &&
145 !strncmp((char *) data, conn->acName, len)) {
149 case TAG_SERVICE_NAME:
150 pc->seenServiceName = 1;
151 if (pppoe_verbose >= 1 && len > 0) {
152 info("Service-Name: %.*s", (int) len, data);
154 if (conn->serviceName && len == strlen(conn->serviceName) &&
155 !strncmp((char *) data, conn->serviceName, len)) {
156 pc->serviceNameOK = 1;
160 if (pppoe_verbose >= 1) {
163 ptr += sprintf(ptr, "Cookie:");
164 /* Print first 20 bytes of cookie */
165 for (i=0; i<len && i < 20; i++) {
166 ptr += sprintf(ptr, " %02x", (unsigned) data[i]);
168 if (i < len) ptr += sprintf(ptr, "...");
171 if (conn->discoveryState != STATE_RECEIVED_PADO) {
172 conn->cookie.type = htons(type);
173 conn->cookie.length = htons(len);
174 memcpy(conn->cookie.payload, data, len);
177 case TAG_RELAY_SESSION_ID:
178 if (pppoe_verbose >= 1) {
181 ptr += sprintf(ptr, "Relay-ID:");
182 /* Print first 20 bytes of relay ID */
183 for (i=0; i<len && i < 20; i++) {
184 ptr += printf(ptr, " %02x", (unsigned) data[i]);
186 if (i < len) ptr += printf(ptr, "...");
189 if (conn->discoveryState != STATE_RECEIVED_PADO) {
190 conn->relayId.type = htons(type);
191 conn->relayId.length = htons(len);
192 memcpy(conn->relayId.payload, data, len);
195 case TAG_PPP_MAX_PAYLOAD:
196 if (len == sizeof(mru)) {
197 memcpy(&mru, data, sizeof(mru));
199 info("Max-Payload: %u", (unsigned) mru);
200 if (mru >= ETH_PPPOE_MTU && conn->discoveryState != STATE_RECEIVED_PADO) {
205 conn->seenMaxPayload = 1;
209 case TAG_SERVICE_NAME_ERROR:
210 error("PADO: Service-Name-Error: %.*s", (int) len, data);
213 case TAG_AC_SYSTEM_ERROR:
214 error("PADO: System-Error: %.*s", (int) len, data);
217 case TAG_GENERIC_ERROR:
218 error("PADO: Generic-Error: %.*s", (int) len, data);
224 /**********************************************************************
225 *%FUNCTION: parsePADSTags
230 * extra -- extra user data (pointer to PPPoEConnection structure)
234 * Picks interesting tags out of a PADS packet
235 ***********************************************************************/
237 parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
240 PPPoEConnection *conn = (PPPoEConnection *) extra;
243 case TAG_SERVICE_NAME:
244 if (pppoe_verbose >= 1 && len > 0) {
245 info("PADS: Service-Name: '%.*s'", (int) len, data);
248 case TAG_PPP_MAX_PAYLOAD:
249 if (len == sizeof(mru)) {
250 memcpy(&mru, data, sizeof(mru));
252 if (mru >= ETH_PPPOE_MTU) {
257 conn->seenMaxPayload = 1;
261 case TAG_SERVICE_NAME_ERROR:
262 error("PADS: Service-Name-Error: %.*s", (int) len, data);
265 case TAG_AC_SYSTEM_ERROR:
266 error("PADS: System-Error: %.*s", (int) len, data);
269 case TAG_GENERIC_ERROR:
270 error("PADS: Generic-Error: %.*s", (int) len, data);
273 case TAG_RELAY_SESSION_ID:
274 conn->relayId.type = htons(type);
275 conn->relayId.length = htons(len);
276 memcpy(conn->relayId.payload, data, len);
281 /***********************************************************************
284 * conn -- PPPoEConnection structure
288 * Sends a PADI packet
289 ***********************************************************************/
291 sendPADI(PPPoEConnection *conn)
294 unsigned char *cursor = packet.payload;
295 PPPoETag *svc = (PPPoETag *) (&packet.payload);
296 UINT16_t namelen = 0;
298 int omit_service_name = 0;
300 if (conn->serviceName) {
301 namelen = (UINT16_t) strlen(conn->serviceName);
302 if (!strcmp(conn->serviceName, "NO-SERVICE-NAME-NON-RFC-COMPLIANT")) {
303 omit_service_name = 1;
307 /* Set destination to Ethernet broadcast address */
308 memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
309 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
311 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
312 packet.vertype = PPPOE_VER_TYPE(1, 1);
313 packet.code = CODE_PADI;
316 if (!omit_service_name) {
317 plen = TAG_HDR_SIZE + namelen;
318 CHECK_ROOM(cursor, packet.payload, plen);
320 svc->type = TAG_SERVICE_NAME;
321 svc->length = htons(namelen);
323 if (conn->serviceName) {
324 memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
326 cursor += namelen + TAG_HDR_SIZE;
331 /* If we're using Host-Uniq, copy it over */
332 if (conn->hostUniq.length) {
333 int len = ntohs(conn->hostUniq.length);
334 CHECK_ROOM(cursor, packet.payload, len + TAG_HDR_SIZE);
335 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
336 cursor += len + TAG_HDR_SIZE;
337 plen += len + TAG_HDR_SIZE;
340 /* Add our maximum MTU/MRU */
341 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
343 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
344 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
345 maxPayload.length = htons(sizeof(mru));
346 memcpy(maxPayload.payload, &mru, sizeof(mru));
347 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
348 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
349 cursor += sizeof(mru) + TAG_HDR_SIZE;
350 plen += sizeof(mru) + TAG_HDR_SIZE;
353 packet.length = htons(plen);
355 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
358 /**********************************************************************
359 *%FUNCTION: waitForPADO
361 * conn -- PPPoEConnection structure
362 * timeout -- how long to wait (in seconds)
366 * Waits for a PADO packet and copies useful information
367 ***********************************************************************/
369 waitForPADO(PPPoEConnection *conn, int timeout)
374 struct timeval expire_at;
379 struct PacketCriteria pc;
381 pc.acNameOK = (conn->acName) ? 0 : 1;
382 pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
384 pc.seenServiceName = 0;
385 conn->seenMaxPayload = 0;
387 if (get_time(&expire_at) < 0) {
388 error("get_time (waitForPADO): %m");
391 expire_at.tv_sec += timeout;
394 if (BPF_BUFFER_IS_EMPTY) {
395 if (!time_left(&tv, &expire_at))
396 return; /* Timed out */
399 FD_SET(conn->discoverySocket, &readable);
402 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
403 if (r >= 0 || errno != EINTR || got_sigterm) break;
406 error("select (waitForPADO): %m");
410 return; /* Timed out */
415 receivePacket(conn->discoverySocket, &packet, &len);
418 if (ntohs(packet.length) + HDR_SIZE > len) {
419 error("Bogus PPPoE length field (%u)",
420 (unsigned int) ntohs(packet.length));
425 /* If it's not a Discovery packet, loop again */
426 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
429 /* If it's not for us, loop again */
430 if (!packetIsForMe(conn, &packet)) continue;
432 if (packet.code == CODE_PADO) {
433 if (NOT_UNICAST(packet.ethHdr.h_source)) {
434 error("Ignoring PADO packet from non-unicast MAC address");
438 && memcmp(packet.ethHdr.h_source, conn->req_peer_mac, ETH_ALEN) != 0) {
439 warn("Ignoring PADO packet from wrong MAC address");
442 if (parsePacket(&packet, parsePADOTags, &pc) < 0)
446 if (!pc.seenACName) {
447 error("Ignoring PADO packet with no AC-Name tag");
450 if (!pc.seenServiceName) {
451 error("Ignoring PADO packet with no Service-Name tag");
454 if (pppoe_verbose >= 1) {
455 info("AC-Ethernet-Address: %02x:%02x:%02x:%02x:%02x:%02x",
456 (unsigned) packet.ethHdr.h_source[0],
457 (unsigned) packet.ethHdr.h_source[1],
458 (unsigned) packet.ethHdr.h_source[2],
459 (unsigned) packet.ethHdr.h_source[3],
460 (unsigned) packet.ethHdr.h_source[4],
461 (unsigned) packet.ethHdr.h_source[5]);
462 info("--------------------------------------------------");
465 if (pc.acNameOK && pc.serviceNameOK && conn->discoveryState != STATE_RECEIVED_PADO) {
466 memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
467 conn->discoveryState = STATE_RECEIVED_PADO;
470 } while (pppoe_verbose >= 1 || conn->discoveryState != STATE_RECEIVED_PADO);
473 /***********************************************************************
476 * conn -- PPPoE connection structur
480 * Sends a PADR packet
481 ***********************************************************************/
483 sendPADR(PPPoEConnection *conn)
486 PPPoETag *svc = (PPPoETag *) packet.payload;
487 unsigned char *cursor = packet.payload;
489 UINT16_t namelen = 0;
492 if (conn->serviceName) {
493 namelen = (UINT16_t) strlen(conn->serviceName);
495 plen = TAG_HDR_SIZE + namelen;
496 CHECK_ROOM(cursor, packet.payload, plen);
498 memcpy(packet.ethHdr.h_dest, conn->peerEth, ETH_ALEN);
499 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
501 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
502 packet.vertype = PPPOE_VER_TYPE(1, 1);
503 packet.code = CODE_PADR;
506 svc->type = TAG_SERVICE_NAME;
507 svc->length = htons(namelen);
508 if (conn->serviceName) {
509 memcpy(svc->payload, conn->serviceName, namelen);
511 cursor += namelen + TAG_HDR_SIZE;
513 /* If we're using Host-Uniq, copy it over */
514 if (conn->hostUniq.length) {
515 int len = ntohs(conn->hostUniq.length);
516 CHECK_ROOM(cursor, packet.payload, len+TAG_HDR_SIZE);
517 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
518 cursor += len + TAG_HDR_SIZE;
519 plen += len + TAG_HDR_SIZE;
522 /* Add our maximum MTU/MRU */
523 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
525 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
526 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
527 maxPayload.length = htons(sizeof(mru));
528 memcpy(maxPayload.payload, &mru, sizeof(mru));
529 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
530 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
531 cursor += sizeof(mru) + TAG_HDR_SIZE;
532 plen += sizeof(mru) + TAG_HDR_SIZE;
535 /* Copy cookie and relay-ID if needed */
536 if (conn->cookie.type) {
537 CHECK_ROOM(cursor, packet.payload,
538 ntohs(conn->cookie.length) + TAG_HDR_SIZE);
539 memcpy(cursor, &conn->cookie, ntohs(conn->cookie.length) + TAG_HDR_SIZE);
540 cursor += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
541 plen += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
544 if (conn->relayId.type) {
545 CHECK_ROOM(cursor, packet.payload,
546 ntohs(conn->relayId.length) + TAG_HDR_SIZE);
547 memcpy(cursor, &conn->relayId, ntohs(conn->relayId.length) + TAG_HDR_SIZE);
548 cursor += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
549 plen += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
552 packet.length = htons(plen);
553 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
556 /**********************************************************************
557 *%FUNCTION: waitForPADS
559 * conn -- PPPoE connection info
560 * timeout -- how long to wait (in seconds)
564 * Waits for a PADS packet and copies useful information
565 ***********************************************************************/
567 waitForPADS(PPPoEConnection *conn, int timeout)
572 struct timeval expire_at;
577 if (get_time(&expire_at) < 0) {
578 error("get_time (waitForPADS): %m");
581 expire_at.tv_sec += timeout;
585 if (BPF_BUFFER_IS_EMPTY) {
586 if (!time_left(&tv, &expire_at))
587 return; /* Timed out */
590 FD_SET(conn->discoverySocket, &readable);
593 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
594 if (r >= 0 || errno != EINTR || got_sigterm) break;
597 error("select (waitForPADS): %m");
601 return; /* Timed out */
605 receivePacket(conn->discoverySocket, &packet, &len);
608 if (ntohs(packet.length) + HDR_SIZE > len) {
609 error("Bogus PPPoE length field (%u)",
610 (unsigned int) ntohs(packet.length));
615 /* If it's not a Discovery packet, loop again */
616 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
619 /* If it's not from the AC, it's not for me */
620 if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
622 /* If it's not for us, loop again */
623 if (!packetIsForMe(conn, &packet)) continue;
626 if (packet.code == CODE_PADS) {
627 /* Parse for goodies */
628 if (parsePacket(&packet, parsePADSTags, conn) < 0)
632 conn->discoveryState = STATE_SESSION;
635 } while (conn->discoveryState != STATE_SESSION);
637 /* Don't bother with ntohs; we'll just end up converting it back... */
638 conn->session = packet.session;
640 info("PPP session is %d", (int) ntohs(conn->session));
642 /* RFC 2516 says session id MUST NOT be zero or 0xFFFF */
643 if (ntohs(conn->session) == 0 || ntohs(conn->session) == 0xFFFF) {
644 error("Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
648 /**********************************************************************
649 *%FUNCTION: discovery1
651 * conn -- PPPoE connection info structure
655 * Performs the PPPoE discovery phase 1
656 ***********************************************************************/
658 discovery1(PPPoEConnection *conn)
660 int padiAttempts = 0;
661 int timeout = conn->discoveryTimeout;
665 if (got_sigterm || padiAttempts > conn->discoveryAttempts) {
666 warn("Timeout waiting for PADO packets");
667 close(conn->discoverySocket);
668 conn->discoverySocket = -1;
672 conn->discoveryState = STATE_SENT_PADI;
673 waitForPADO(conn, timeout);
676 } while (conn->discoveryState == STATE_SENT_PADI);
679 /**********************************************************************
680 *%FUNCTION: discovery2
682 * conn -- PPPoE connection info structure
686 * Performs the PPPoE discovery phase 2
687 ***********************************************************************/
689 discovery2(PPPoEConnection *conn)
691 int padrAttempts = 0;
692 int timeout = conn->discoveryTimeout;
696 if (got_sigterm || padrAttempts > conn->discoveryAttempts) {
697 warn("Timeout waiting for PADS packets");
698 close(conn->discoverySocket);
699 conn->discoverySocket = -1;
703 conn->discoveryState = STATE_SENT_PADR;
704 waitForPADS(conn, timeout);
706 } while (conn->discoveryState == STATE_SENT_PADR);
708 if (!conn->seenMaxPayload) {
709 /* RFC 4638: MUST limit MTU/MRU to 1492 */
710 if (conn->mtu > ETH_PPPOE_MTU)
711 conn->mtu = ETH_PPPOE_MTU;
712 if (conn->mru > ETH_PPPOE_MTU)
713 conn->mru = ETH_PPPOE_MTU;
717 close(conn->discoverySocket);
718 conn->discoverySocket = -1;
719 conn->discoveryState = STATE_SESSION;