1 /***********************************************************************
5 * Perform PPPoE discovery
7 * Copyright (C) 1999 by Roaring Penguin Software Inc.
9 ***********************************************************************/
11 static char const RCSID[] =
12 "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
20 #include <pppd/pppd.h>
28 #ifdef HAVE_SYS_TIME_H
40 #ifdef USE_LINUX_PACKET
41 #include <sys/ioctl.h>
48 #define signaled(x) ppp_signaled(x)
49 #define get_time(x) ppp_get_time(x)
51 int signaled(int signal);
52 int get_time(struct timeval *tv);
56 /* Calculate time remaining until *exp, return 0 if now >= *exp */
57 static int time_left(struct timeval *diff, struct timeval *exp)
61 if (get_time(&now) < 0) {
62 error("get_time: %m");
66 if (now.tv_sec > exp->tv_sec
67 || (now.tv_sec == exp->tv_sec && now.tv_usec >= exp->tv_usec))
70 diff->tv_sec = exp->tv_sec - now.tv_sec;
71 diff->tv_usec = exp->tv_usec - now.tv_usec;
72 if (diff->tv_usec < 0) {
73 diff->tv_usec += 1000000;
80 /**********************************************************************
81 *%FUNCTION: parseForHostUniq
86 * extra -- user-supplied pointer. This is assumed to be a pointer to int.
90 * If a HostUnique tag is found which matches our PID, sets *extra to 1.
91 ***********************************************************************/
93 parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
96 PPPoETag *tag = extra;
98 if (type == TAG_HOST_UNIQ && len == ntohs(tag->length))
99 tag->length = memcmp(data, tag->payload, len);
102 /**********************************************************************
103 *%FUNCTION: packetIsForMe
105 * conn -- PPPoE connection info
106 * packet -- a received PPPoE packet
108 * 1 if packet is for this PPPoE daemon; 0 otherwise.
110 * If we are using the Host-Unique tag, verifies that packet contains
111 * our unique identifier.
112 ***********************************************************************/
114 packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
116 PPPoETag hostUniq = conn->hostUniq;
118 /* If packet is not directed to our MAC address, forget it */
119 if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
121 /* If we're not using the Host-Unique tag, then accept the packet */
122 if (!conn->hostUniq.length) return 1;
124 parsePacket(packet, parseForHostUniq, &hostUniq);
125 return !hostUniq.length;
128 /**********************************************************************
129 *%FUNCTION: parsePADOTags
134 * extra -- extra user data. Should point to a PacketCriteria structure
135 * which gets filled in according to selected AC name and service
140 * Picks interesting tags out of a PADO packet
141 ***********************************************************************/
143 parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
146 struct PacketCriteria *pc = (struct PacketCriteria *) extra;
147 PPPoEConnection *conn = pc->conn;
154 if (pppoe_verbose >= 1) {
155 info("Access-Concentrator: %.*s", (int) len, data);
157 if (conn->acName && len == strlen(conn->acName) &&
158 !strncmp((char *) data, conn->acName, len)) {
162 case TAG_SERVICE_NAME:
163 pc->seenServiceName = 1;
164 if (pppoe_verbose >= 1 && len > 0) {
165 info("Service-Name: %.*s", (int) len, data);
167 if (conn->serviceName && len == strlen(conn->serviceName) &&
168 !strncmp((char *) data, conn->serviceName, len)) {
169 pc->serviceNameOK = 1;
173 if (pppoe_verbose >= 1) {
176 ptr += sprintf(ptr, "Cookie:");
177 /* Print first 20 bytes of cookie */
178 for (i=0; i<len && i < 20; i++) {
179 ptr += sprintf(ptr, " %02x", (unsigned) data[i]);
181 if (i < len) ptr += sprintf(ptr, "...");
184 if (conn->discoveryState != STATE_RECEIVED_PADO) {
185 conn->cookie.type = htons(type);
186 conn->cookie.length = htons(len);
187 memcpy(conn->cookie.payload, data, len);
190 case TAG_RELAY_SESSION_ID:
191 if (pppoe_verbose >= 1) {
194 ptr += sprintf(ptr, "Relay-ID:");
195 /* Print first 20 bytes of relay ID */
196 for (i=0; i<len && i < 20; i++) {
197 ptr += printf(ptr, " %02x", (unsigned) data[i]);
199 if (i < len) ptr += printf(ptr, "...");
202 if (conn->discoveryState != STATE_RECEIVED_PADO) {
203 conn->relayId.type = htons(type);
204 conn->relayId.length = htons(len);
205 memcpy(conn->relayId.payload, data, len);
208 case TAG_PPP_MAX_PAYLOAD:
209 if (len == sizeof(mru)) {
210 memcpy(&mru, data, sizeof(mru));
212 info("Max-Payload: %u", (unsigned) mru);
213 if (mru >= ETH_PPPOE_MTU && conn->discoveryState != STATE_RECEIVED_PADO) {
218 conn->seenMaxPayload = 1;
222 case TAG_SERVICE_NAME_ERROR:
223 error("PADO: Service-Name-Error: %.*s", (int) len, data);
226 case TAG_AC_SYSTEM_ERROR:
227 error("PADO: System-Error: %.*s", (int) len, data);
230 case TAG_GENERIC_ERROR:
231 error("PADO: Generic-Error: %.*s", (int) len, data);
237 /**********************************************************************
238 *%FUNCTION: parsePADSTags
243 * extra -- extra user data (pointer to PPPoEConnection structure)
247 * Picks interesting tags out of a PADS packet
248 ***********************************************************************/
250 parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
253 PPPoEConnection *conn = (PPPoEConnection *) extra;
256 case TAG_SERVICE_NAME:
257 if (pppoe_verbose >= 1 && len > 0) {
258 info("PADS: Service-Name: '%.*s'", (int) len, data);
261 case TAG_PPP_MAX_PAYLOAD:
262 if (len == sizeof(mru)) {
263 memcpy(&mru, data, sizeof(mru));
265 if (mru >= ETH_PPPOE_MTU) {
270 conn->seenMaxPayload = 1;
274 case TAG_SERVICE_NAME_ERROR:
275 error("PADS: Service-Name-Error: %.*s", (int) len, data);
278 case TAG_AC_SYSTEM_ERROR:
279 error("PADS: System-Error: %.*s", (int) len, data);
282 case TAG_GENERIC_ERROR:
283 error("PADS: Generic-Error: %.*s", (int) len, data);
286 case TAG_RELAY_SESSION_ID:
287 conn->relayId.type = htons(type);
288 conn->relayId.length = htons(len);
289 memcpy(conn->relayId.payload, data, len);
294 /***********************************************************************
297 * conn -- PPPoEConnection structure
301 * Sends a PADI packet
302 ***********************************************************************/
304 sendPADI(PPPoEConnection *conn)
307 unsigned char *cursor = packet.payload;
308 PPPoETag *svc = (PPPoETag *) (&packet.payload);
309 UINT16_t namelen = 0;
311 int omit_service_name = 0;
313 if (conn->serviceName) {
314 namelen = (UINT16_t) strlen(conn->serviceName);
315 if (!strcmp(conn->serviceName, "NO-SERVICE-NAME-NON-RFC-COMPLIANT")) {
316 omit_service_name = 1;
320 /* Set destination to Ethernet broadcast address */
321 memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
322 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
324 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
325 packet.vertype = PPPOE_VER_TYPE(1, 1);
326 packet.code = CODE_PADI;
329 if (!omit_service_name) {
330 plen = TAG_HDR_SIZE + namelen;
331 CHECK_ROOM(cursor, packet.payload, plen);
333 svc->type = TAG_SERVICE_NAME;
334 svc->length = htons(namelen);
336 if (conn->serviceName) {
337 memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
339 cursor += namelen + TAG_HDR_SIZE;
344 /* If we're using Host-Uniq, copy it over */
345 if (conn->hostUniq.length) {
346 int len = ntohs(conn->hostUniq.length);
347 CHECK_ROOM(cursor, packet.payload, len + TAG_HDR_SIZE);
348 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
349 cursor += len + TAG_HDR_SIZE;
350 plen += len + TAG_HDR_SIZE;
353 /* Add our maximum MTU/MRU */
354 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
356 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
357 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
358 maxPayload.length = htons(sizeof(mru));
359 memcpy(maxPayload.payload, &mru, sizeof(mru));
360 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
361 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
362 cursor += sizeof(mru) + TAG_HDR_SIZE;
363 plen += sizeof(mru) + TAG_HDR_SIZE;
366 packet.length = htons(plen);
368 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
371 /**********************************************************************
372 *%FUNCTION: waitForPADO
374 * conn -- PPPoEConnection structure
375 * timeout -- how long to wait (in seconds)
379 * Waits for a PADO packet and copies useful information
380 ***********************************************************************/
382 waitForPADO(PPPoEConnection *conn, int timeout)
387 struct timeval expire_at;
392 struct PacketCriteria pc;
394 pc.acNameOK = (conn->acName) ? 0 : 1;
395 pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
397 pc.seenServiceName = 0;
398 conn->seenMaxPayload = 0;
400 if (get_time(&expire_at) < 0) {
401 error("get_time (waitForPADO): %m");
404 expire_at.tv_sec += timeout;
407 if (BPF_BUFFER_IS_EMPTY) {
408 if (!time_left(&tv, &expire_at))
409 return; /* Timed out */
412 FD_SET(conn->discoverySocket, &readable);
415 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
416 if (r >= 0 || errno != EINTR || signaled(SIGTERM)) break;
419 error("select (waitForPADO): %m");
423 return; /* Timed out */
428 receivePacket(conn->discoverySocket, &packet, &len);
431 if (ntohs(packet.length) + HDR_SIZE > len) {
432 error("Bogus PPPoE length field (%u)",
433 (unsigned int) ntohs(packet.length));
438 /* If it's not a Discovery packet, loop again */
439 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
442 /* If it's not for us, loop again */
443 if (!packetIsForMe(conn, &packet)) continue;
445 if (packet.code == CODE_PADO) {
446 if (NOT_UNICAST(packet.ethHdr.h_source)) {
447 error("Ignoring PADO packet from non-unicast MAC address");
451 && memcmp(packet.ethHdr.h_source, conn->req_peer_mac, ETH_ALEN) != 0) {
452 warn("Ignoring PADO packet from wrong MAC address");
455 if (parsePacket(&packet, parsePADOTags, &pc) < 0)
459 if (!pc.seenACName) {
460 error("Ignoring PADO packet with no AC-Name tag");
463 if (!pc.seenServiceName) {
464 error("Ignoring PADO packet with no Service-Name tag");
467 if (pppoe_verbose >= 1) {
468 info("AC-Ethernet-Address: %02x:%02x:%02x:%02x:%02x:%02x",
469 (unsigned) packet.ethHdr.h_source[0],
470 (unsigned) packet.ethHdr.h_source[1],
471 (unsigned) packet.ethHdr.h_source[2],
472 (unsigned) packet.ethHdr.h_source[3],
473 (unsigned) packet.ethHdr.h_source[4],
474 (unsigned) packet.ethHdr.h_source[5]);
475 info("--------------------------------------------------");
478 if (pc.acNameOK && pc.serviceNameOK && conn->discoveryState != STATE_RECEIVED_PADO) {
479 memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
480 conn->discoveryState = STATE_RECEIVED_PADO;
483 } while (pppoe_verbose >= 1 || conn->discoveryState != STATE_RECEIVED_PADO);
486 /***********************************************************************
489 * conn -- PPPoE connection structur
493 * Sends a PADR packet
494 ***********************************************************************/
496 sendPADR(PPPoEConnection *conn)
499 PPPoETag *svc = (PPPoETag *) packet.payload;
500 unsigned char *cursor = packet.payload;
502 UINT16_t namelen = 0;
505 if (conn->serviceName) {
506 namelen = (UINT16_t) strlen(conn->serviceName);
508 plen = TAG_HDR_SIZE + namelen;
509 CHECK_ROOM(cursor, packet.payload, plen);
511 memcpy(packet.ethHdr.h_dest, conn->peerEth, ETH_ALEN);
512 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
514 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
515 packet.vertype = PPPOE_VER_TYPE(1, 1);
516 packet.code = CODE_PADR;
519 svc->type = TAG_SERVICE_NAME;
520 svc->length = htons(namelen);
521 if (conn->serviceName) {
522 memcpy(svc->payload, conn->serviceName, namelen);
524 cursor += namelen + TAG_HDR_SIZE;
526 /* If we're using Host-Uniq, copy it over */
527 if (conn->hostUniq.length) {
528 int len = ntohs(conn->hostUniq.length);
529 CHECK_ROOM(cursor, packet.payload, len+TAG_HDR_SIZE);
530 memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
531 cursor += len + TAG_HDR_SIZE;
532 plen += len + TAG_HDR_SIZE;
535 /* Add our maximum MTU/MRU */
536 if (MIN(conn->mtu, conn->mru) > ETH_PPPOE_MTU) {
538 UINT16_t mru = htons(MIN(conn->mtu, conn->mru));
539 maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
540 maxPayload.length = htons(sizeof(mru));
541 memcpy(maxPayload.payload, &mru, sizeof(mru));
542 CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
543 memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
544 cursor += sizeof(mru) + TAG_HDR_SIZE;
545 plen += sizeof(mru) + TAG_HDR_SIZE;
548 /* Copy cookie and relay-ID if needed */
549 if (conn->cookie.type) {
550 CHECK_ROOM(cursor, packet.payload,
551 ntohs(conn->cookie.length) + TAG_HDR_SIZE);
552 memcpy(cursor, &conn->cookie, ntohs(conn->cookie.length) + TAG_HDR_SIZE);
553 cursor += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
554 plen += ntohs(conn->cookie.length) + TAG_HDR_SIZE;
557 if (conn->relayId.type) {
558 CHECK_ROOM(cursor, packet.payload,
559 ntohs(conn->relayId.length) + TAG_HDR_SIZE);
560 memcpy(cursor, &conn->relayId, ntohs(conn->relayId.length) + TAG_HDR_SIZE);
561 cursor += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
562 plen += ntohs(conn->relayId.length) + TAG_HDR_SIZE;
565 packet.length = htons(plen);
566 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
569 /**********************************************************************
570 *%FUNCTION: waitForPADS
572 * conn -- PPPoE connection info
573 * timeout -- how long to wait (in seconds)
577 * Waits for a PADS packet and copies useful information
578 ***********************************************************************/
580 waitForPADS(PPPoEConnection *conn, int timeout)
585 struct timeval expire_at;
590 if (get_time(&expire_at) < 0) {
591 error("get_time (waitForPADS): %m");
594 expire_at.tv_sec += timeout;
598 if (BPF_BUFFER_IS_EMPTY) {
599 if (!time_left(&tv, &expire_at))
600 return; /* Timed out */
603 FD_SET(conn->discoverySocket, &readable);
606 r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
607 if (r >= 0 || errno != EINTR || signaled(SIGTERM)) break;
610 error("select (waitForPADS): %m");
614 return; /* Timed out */
618 receivePacket(conn->discoverySocket, &packet, &len);
621 if (ntohs(packet.length) + HDR_SIZE > len) {
622 error("Bogus PPPoE length field (%u)",
623 (unsigned int) ntohs(packet.length));
628 /* If it's not a Discovery packet, loop again */
629 if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
632 /* If it's not from the AC, it's not for me */
633 if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
635 /* If it's not for us, loop again */
636 if (!packetIsForMe(conn, &packet)) continue;
639 if (packet.code == CODE_PADS) {
640 /* Parse for goodies */
641 if (parsePacket(&packet, parsePADSTags, conn) < 0)
645 conn->discoveryState = STATE_SESSION;
648 } while (conn->discoveryState != STATE_SESSION);
650 /* Don't bother with ntohs; we'll just end up converting it back... */
651 conn->session = packet.session;
653 info("PPP session is %d", (int) ntohs(conn->session));
655 /* RFC 2516 says session id MUST NOT be zero or 0xFFFF */
656 if (ntohs(conn->session) == 0 || ntohs(conn->session) == 0xFFFF) {
657 error("Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
661 /**********************************************************************
662 *%FUNCTION: discovery1
664 * conn -- PPPoE connection info structure
668 * Performs the PPPoE discovery phase 1
669 ***********************************************************************/
671 discovery1(PPPoEConnection *conn)
673 int padiAttempts = 0;
674 int timeout = conn->discoveryTimeout;
678 if (signaled(SIGTERM) || padiAttempts > conn->discoveryAttempts) {
679 warn("Timeout waiting for PADO packets");
680 close(conn->discoverySocket);
681 conn->discoverySocket = -1;
685 conn->discoveryState = STATE_SENT_PADI;
686 waitForPADO(conn, timeout);
689 } while (conn->discoveryState == STATE_SENT_PADI);
692 /**********************************************************************
693 *%FUNCTION: discovery2
695 * conn -- PPPoE connection info structure
699 * Performs the PPPoE discovery phase 2
700 ***********************************************************************/
702 discovery2(PPPoEConnection *conn)
704 int padrAttempts = 0;
705 int timeout = conn->discoveryTimeout;
709 if (signaled(SIGTERM) || padrAttempts > conn->discoveryAttempts) {
710 warn("Timeout waiting for PADS packets");
711 close(conn->discoverySocket);
712 conn->discoverySocket = -1;
716 conn->discoveryState = STATE_SENT_PADR;
717 waitForPADS(conn, timeout);
719 } while (conn->discoveryState == STATE_SENT_PADR);
721 if (!conn->seenMaxPayload) {
722 /* RFC 4638: MUST limit MTU/MRU to 1492 */
723 if (conn->mtu > ETH_PPPOE_MTU)
724 conn->mtu = ETH_PPPOE_MTU;
725 if (conn->mru > ETH_PPPOE_MTU)
726 conn->mru = ETH_PPPOE_MTU;
730 close(conn->discoverySocket);
731 conn->discoverySocket = -1;
732 conn->discoveryState = STATE_SESSION;