X-Git-Url: https://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fplugins%2Frp-pppoe%2Fdiscovery.c;h=fd851def2fededf5f53bb64fd7681406ad598fcf;hp=498ed0a6cbc5723cc6dd4cc503a22b5dfa1eebe2;hb=c319558b8cacad7d27f04c7d612e44b67f273434;hpb=97a4e67df7a9c196440f4644beba7a6801c7ebe4

diff --git a/pppd/plugins/rp-pppoe/discovery.c b/pppd/plugins/rp-pppoe/discovery.c
index 498ed0a..fd851de 100644
--- a/pppd/plugins/rp-pppoe/discovery.c
+++ b/pppd/plugins/rp-pppoe/discovery.c
@@ -9,13 +9,13 @@
 ***********************************************************************/
 
 static char const RCSID[] =
-"$Id: discovery.c,v 1.4 2005/03/22 10:22:32 paulus Exp $";
+"$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
 
+#define _GNU_SOURCE 1
 #include "pppoe.h"
-
-#ifdef HAVE_SYSLOG_H
-#include <syslog.h>
-#endif
+#include "pppd/pppd.h"
+#include "pppd/fsm.h"
+#include "pppd/lcp.h"
 
 #include <string.h>
 #include <stdlib.h>
@@ -40,6 +40,30 @@ static char const RCSID[] =
 
 #include <signal.h>
 
+/* Calculate time remaining until *exp, return 0 if now >= *exp */
+static int time_left(struct timeval *diff, struct timeval *exp)
+{
+    struct timeval now;
+
+    if (get_time(&now) < 0) {
+	error("get_time: %m");
+	return 0;
+    }
+
+    if (now.tv_sec > exp->tv_sec
+	|| (now.tv_sec == exp->tv_sec && now.tv_usec >= exp->tv_usec))
+	return 0;
+
+    diff->tv_sec = exp->tv_sec - now.tv_sec;
+    diff->tv_usec = exp->tv_usec - now.tv_usec;
+    if (diff->tv_usec < 0) {
+	diff->tv_usec += 1000000;
+	--diff->tv_sec;
+    }
+
+    return 1;
+}
+
 /**********************************************************************
 *%FUNCTION: parseForHostUniq
 *%ARGUMENTS:
@@ -52,18 +76,14 @@ static char const RCSID[] =
 *%DESCRIPTION:
 * If a HostUnique tag is found which matches our PID, sets *extra to 1.
 ***********************************************************************/
-void
+static void
 parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
 		 void *extra)
 {
-    int *val = (int *) extra;
-    if (type == TAG_HOST_UNIQ && len == sizeof(pid_t)) {
-	pid_t tmp;
-	memcpy(&tmp, data, len);
-	if (tmp == getpid()) {
-	    *val = 1;
-	}
-    }
+    PPPoETag *tag = extra;
+
+    if (type == TAG_HOST_UNIQ && len == ntohs(tag->length))
+	tag->length = memcmp(data, tag->payload, len);
 }
 
 /**********************************************************************
@@ -77,19 +97,19 @@ parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
 * If we are using the Host-Unique tag, verifies that packet contains
 * our unique identifier.
 ***********************************************************************/
-int
+static int
 packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
 {
-    int forMe = 0;
+    PPPoETag hostUniq = conn->hostUniq;
 
     /* If packet is not directed to our MAC address, forget it */
     if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
 
     /* If we're not using the Host-Unique tag, then accept the packet */
-    if (!conn->useHostUniq) return 1;
+    if (!conn->hostUniq.length) return 1;
 
-    parsePacket(packet, parseForHostUniq, &forMe);
-    return forMe;
+    parsePacket(packet, parseForHostUniq, &hostUniq);
+    return !hostUniq.length;
 }
 
 /**********************************************************************
@@ -106,19 +126,20 @@ packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
 *%DESCRIPTION:
 * Picks interesting tags out of a PADO packet
 ***********************************************************************/
-void
+static void
 parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
 	      void *extra)
 {
     struct PacketCriteria *pc = (struct PacketCriteria *) extra;
     PPPoEConnection *conn = pc->conn;
+    UINT16_t mru;
     int i;
 
     switch(type) {
     case TAG_AC_NAME:
 	pc->seenACName = 1;
 	if (conn->printACNames) {
-	    printf("Access-Concentrator: %.*s\n", (int) len, data);
+	    info("Access-Concentrator: %.*s", (int) len, data);
 	}
 	if (conn->acName && len == strlen(conn->acName) &&
 	    !strncmp((char *) data, conn->acName, len)) {
@@ -127,65 +148,45 @@ parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
 	break;
     case TAG_SERVICE_NAME:
 	pc->seenServiceName = 1;
-	if (conn->printACNames && len > 0) {
-	    printf("       Service-Name: %.*s\n", (int) len, data);
-	}
 	if (conn->serviceName && len == strlen(conn->serviceName) &&
 	    !strncmp((char *) data, conn->serviceName, len)) {
 	    pc->serviceNameOK = 1;
 	}
 	break;
     case TAG_AC_COOKIE:
-	if (conn->printACNames) {
-	    printf("Got a cookie:");
-	    /* Print first 20 bytes of cookie */
-	    for (i=0; i<len && i < 20; i++) {
-		printf(" %02x", (unsigned) data[i]);
-	    }
-	    if (i < len) printf("...");
-	    printf("\n");
-	}
 	conn->cookie.type = htons(type);
 	conn->cookie.length = htons(len);
 	memcpy(conn->cookie.payload, data, len);
 	break;
     case TAG_RELAY_SESSION_ID:
-	if (conn->printACNames) {
-	    printf("Got a Relay-ID:");
-	    /* Print first 20 bytes of relay ID */
-	    for (i=0; i<len && i < 20; i++) {
-		printf(" %02x", (unsigned) data[i]);
-	    }
-	    if (i < len) printf("...");
-	    printf("\n");
-	}
 	conn->relayId.type = htons(type);
 	conn->relayId.length = htons(len);
 	memcpy(conn->relayId.payload, data, len);
 	break;
-    case TAG_SERVICE_NAME_ERROR:
-	if (conn->printACNames) {
-	    printf("Got a Service-Name-Error tag: %.*s\n", (int) len, data);
-	} else {
-	    syslog(LOG_ERR, "PADO: Service-Name-Error: %.*s", (int) len, data);
-	    exit(1);
+    case TAG_PPP_MAX_PAYLOAD:
+	if (len == sizeof(mru)) {
+	    memcpy(&mru, data, sizeof(mru));
+	    mru = ntohs(mru);
+	    if (mru >= ETH_PPPOE_MTU) {
+		if (lcp_allowoptions[0].mru > mru)
+		    lcp_allowoptions[0].mru = mru;
+		if (lcp_wantoptions[0].mru > mru)
+		    lcp_wantoptions[0].mru = mru;
+		conn->seenMaxPayload = 1;
+	    }
 	}
 	break;
+    case TAG_SERVICE_NAME_ERROR:
+	error("PADO: Service-Name-Error: %.*s", (int) len, data);
+	conn->error = 1;
+	break;
     case TAG_AC_SYSTEM_ERROR:
-	if (conn->printACNames) {
-	    printf("Got a System-Error tag: %.*s\n", (int) len, data);
-	} else {
-	    syslog(LOG_ERR, "PADO: System-Error: %.*s", (int) len, data);
-	    exit(1);
-	}
+	error("PADO: System-Error: %.*s", (int) len, data);
+	conn->error = 1;
 	break;
     case TAG_GENERIC_ERROR:
-	if (conn->printACNames) {
-	    printf("Got a Generic-Error tag: %.*s\n", (int) len, data);
-	} else {
-	    syslog(LOG_ERR, "PADO: Generic-Error: %.*s", (int) len, data);
-	    exit(1);
-	}
+	error("PADO: Generic-Error: %.*s", (int) len, data);
+	conn->error = 1;
 	break;
     }
 }
@@ -202,27 +203,41 @@ parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
 *%DESCRIPTION:
 * Picks interesting tags out of a PADS packet
 ***********************************************************************/
-void
+static void
 parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
 	      void *extra)
 {
     PPPoEConnection *conn = (PPPoEConnection *) extra;
+    UINT16_t mru;
     switch(type) {
     case TAG_SERVICE_NAME:
-	syslog(LOG_DEBUG, "PADS: Service-Name: '%.*s'", (int) len, data);
+	dbglog("PADS: Service-Name: '%.*s'", (int) len, data);
+	break;
+    case TAG_PPP_MAX_PAYLOAD:
+	if (len == sizeof(mru)) {
+	    memcpy(&mru, data, sizeof(mru));
+	    mru = ntohs(mru);
+	    if (mru >= ETH_PPPOE_MTU) {
+		if (lcp_allowoptions[0].mru > mru)
+		    lcp_allowoptions[0].mru = mru;
+		if (lcp_wantoptions[0].mru > mru)
+		    lcp_wantoptions[0].mru = mru;
+		conn->seenMaxPayload = 1;
+	    }
+	}
 	break;
     case TAG_SERVICE_NAME_ERROR:
-	syslog(LOG_ERR, "PADS: Service-Name-Error: %.*s", (int) len, data);
-	fprintf(stderr, "PADS: Service-Name-Error: %.*s\n", (int) len, data);
-	exit(1);
+	error("PADS: Service-Name-Error: %.*s", (int) len, data);
+	conn->error = 1;
+	break;
     case TAG_AC_SYSTEM_ERROR:
-	syslog(LOG_ERR, "PADS: System-Error: %.*s", (int) len, data);
-	fprintf(stderr, "PADS: System-Error: %.*s\n", (int) len, data);
-	exit(1);
+	error("PADS: System-Error: %.*s", (int) len, data);
+	conn->error = 1;
+	break;
     case TAG_GENERIC_ERROR:
-	syslog(LOG_ERR, "PADS: Generic-Error: %.*s", (int) len, data);
-	fprintf(stderr, "PADS: Generic-Error: %.*s\n", (int) len, data);
-	exit(1);
+	error("PADS: Generic-Error: %.*s", (int) len, data);
+	conn->error = 1;
+	break;
     case TAG_RELAY_SESSION_ID:
 	conn->relayId.type = htons(type);
 	conn->relayId.length = htons(len);
@@ -240,7 +255,7 @@ parsePADSTags(UINT16_t type, UINT16_t len, unsigned char *data,
 *%DESCRIPTION:
 * Sends a PADI packet
 ***********************************************************************/
-void
+static void
 sendPADI(PPPoEConnection *conn)
 {
     PPPoEPacket packet;
@@ -248,53 +263,64 @@ sendPADI(PPPoEConnection *conn)
     PPPoETag *svc = (PPPoETag *) (&packet.payload);
     UINT16_t namelen = 0;
     UINT16_t plen;
+    int omit_service_name = 0;
 
     if (conn->serviceName) {
 	namelen = (UINT16_t) strlen(conn->serviceName);
+	if (!strcmp(conn->serviceName, "NO-SERVICE-NAME-NON-RFC-COMPLIANT")) {
+	    omit_service_name = 1;
+	}
     }
-    plen = TAG_HDR_SIZE + namelen;
-    CHECK_ROOM(cursor, packet.payload, plen);
 
     /* Set destination to Ethernet broadcast address */
     memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
     memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
 
     packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
-    packet.ver = 1;
-    packet.type = 1;
+    packet.vertype = PPPOE_VER_TYPE(1, 1);
     packet.code = CODE_PADI;
     packet.session = 0;
 
-    svc->type = TAG_SERVICE_NAME;
-    svc->length = htons(namelen);
-    CHECK_ROOM(cursor, packet.payload, namelen+TAG_HDR_SIZE);
+    if (!omit_service_name) {
+	plen = TAG_HDR_SIZE + namelen;
+	CHECK_ROOM(cursor, packet.payload, plen);
 
-    if (conn->serviceName) {
-	memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
+	svc->type = TAG_SERVICE_NAME;
+	svc->length = htons(namelen);
+
+	if (conn->serviceName) {
+	    memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
+	}
+	cursor += namelen + TAG_HDR_SIZE;
+    } else {
+	plen = 0;
     }
-    cursor += namelen + TAG_HDR_SIZE;
 
     /* If we're using Host-Uniq, copy it over */
-    if (conn->useHostUniq) {
-	PPPoETag hostUniq;
-	pid_t pid = getpid();
-	hostUniq.type = htons(TAG_HOST_UNIQ);
-	hostUniq.length = htons(sizeof(pid));
-	memcpy(hostUniq.payload, &pid, sizeof(pid));
-	CHECK_ROOM(cursor, packet.payload, sizeof(pid) + TAG_HDR_SIZE);
-	memcpy(cursor, &hostUniq, sizeof(pid) + TAG_HDR_SIZE);
-	cursor += sizeof(pid) + TAG_HDR_SIZE;
-	plen += sizeof(pid) + TAG_HDR_SIZE;
+    if (conn->hostUniq.length) {
+	int len = ntohs(conn->hostUniq.length);
+	CHECK_ROOM(cursor, packet.payload, len + TAG_HDR_SIZE);
+	memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
+	cursor += len + TAG_HDR_SIZE;
+	plen += len + TAG_HDR_SIZE;
+    }
+
+    /* Add our maximum MTU/MRU */
+    if (MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru) > ETH_PPPOE_MTU) {
+	PPPoETag maxPayload;
+	UINT16_t mru = htons(MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru));
+	maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
+	maxPayload.length = htons(sizeof(mru));
+	memcpy(maxPayload.payload, &mru, sizeof(mru));
+	CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
+	memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
+	cursor += sizeof(mru) + TAG_HDR_SIZE;
+	plen += sizeof(mru) + TAG_HDR_SIZE;
     }
 
     packet.length = htons(plen);
 
     sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
-    if (conn->debugFile) {
-	dumpPacket(conn->debugFile, &packet, "SENT");
-	fprintf(conn->debugFile, "\n");
-	fflush(conn->debugFile);
-    }
 }
 
 /**********************************************************************
@@ -313,6 +339,8 @@ waitForPADO(PPPoEConnection *conn, int timeout)
     fd_set readable;
     int r;
     struct timeval tv;
+    struct timeval expire_at;
+
     PPPoEPacket packet;
     int len;
 
@@ -322,31 +350,41 @@ waitForPADO(PPPoEConnection *conn, int timeout)
     pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
     pc.seenACName    = 0;
     pc.seenServiceName = 0;
-	
+    conn->seenMaxPayload = 0;
+    conn->error = 0;
+
+    if (get_time(&expire_at) < 0) {
+	error("get_time (waitForPADO): %m");
+	return;
+    }
+    expire_at.tv_sec += timeout;
+
     do {
 	if (BPF_BUFFER_IS_EMPTY) {
-	    tv.tv_sec = timeout;
-	    tv.tv_usec = 0;
-	
+	    if (!time_left(&tv, &expire_at))
+		return;		/* Timed out */
+
 	    FD_ZERO(&readable);
 	    FD_SET(conn->discoverySocket, &readable);
 
 	    while(1) {
 		r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
-		if (r >= 0 || errno != EINTR) break;
+		if (r >= 0 || errno != EINTR || got_sigterm) break;
 	    }
 	    if (r < 0) {
-		fatalSys("select (waitForPADO)");
+		error("select (waitForPADO): %m");
+		return;
 	    }
-	    if (r == 0) return;        /* Timed out */
+	    if (r == 0)
+		return;		/* Timed out */
 	}
-	
+
 	/* Get the packet */
 	receivePacket(conn->discoverySocket, &packet, &len);
 
 	/* Check length */
 	if (ntohs(packet.length) + HDR_SIZE > len) {
-	    syslog(LOG_ERR, "Bogus PPPoE length field (%u)",
+	    error("Bogus PPPoE length field (%u)",
 		   (unsigned int) ntohs(packet.length));
 	    continue;
 	}
@@ -356,44 +394,34 @@ waitForPADO(PPPoEConnection *conn, int timeout)
 	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
 #endif
 
-	if (conn->debugFile) {
-	    dumpPacket(conn->debugFile, &packet, "RCVD");
-	    fprintf(conn->debugFile, "\n");
-	    fflush(conn->debugFile);
-	}
 	/* If it's not for us, loop again */
 	if (!packetIsForMe(conn, &packet)) continue;
 
 	if (packet.code == CODE_PADO) {
-	    if (BROADCAST(packet.ethHdr.h_source)) {
-		printErr("Ignoring PADO packet from broadcast MAC address");
+	    if (NOT_UNICAST(packet.ethHdr.h_source)) {
+		error("Ignoring PADO packet from non-unicast MAC address");
+		continue;
+	    }
+	    if (conn->req_peer
+		&& memcmp(packet.ethHdr.h_source, conn->req_peer_mac, ETH_ALEN) != 0) {
+		warn("Ignoring PADO packet from wrong MAC address");
 		continue;
 	    }
-	    parsePacket(&packet, parsePADOTags, &pc);
+	    if (parsePacket(&packet, parsePADOTags, &pc) < 0)
+		return;
+	    if (conn->error)
+		return;
 	    if (!pc.seenACName) {
-		printErr("Ignoring PADO packet with no AC-Name tag");
+		error("Ignoring PADO packet with no AC-Name tag");
 		continue;
 	    }
 	    if (!pc.seenServiceName) {
-		printErr("Ignoring PADO packet with no Service-Name tag");
+		error("Ignoring PADO packet with no Service-Name tag");
 		continue;
 	    }
 	    conn->numPADOs++;
-	    if (conn->printACNames) {
-		printf("--------------------------------------------------\n");
-	    }
 	    if (pc.acNameOK && pc.serviceNameOK) {
 		memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
-		if (conn->printACNames) {
-		    printf("AC-Ethernet-Address: %02x:%02x:%02x:%02x:%02x:%02x\n",
-			   (unsigned) conn->peerEth[0], 
-			   (unsigned) conn->peerEth[1],
-			   (unsigned) conn->peerEth[2],
-			   (unsigned) conn->peerEth[3],
-			   (unsigned) conn->peerEth[4],
-			   (unsigned) conn->peerEth[5]);
-		    continue;
-		}
 		conn->discoveryState = STATE_RECEIVED_PADO;
 		break;
 	    }
@@ -410,7 +438,7 @@ waitForPADO(PPPoEConnection *conn, int timeout)
 *%DESCRIPTION:
 * Sends a PADR packet
 ***********************************************************************/
-void
+static void
 sendPADR(PPPoEConnection *conn)
 {
     PPPoEPacket packet;
@@ -430,8 +458,7 @@ sendPADR(PPPoEConnection *conn)
     memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
 
     packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
-    packet.ver = 1;
-    packet.type = 1;
+    packet.vertype = PPPOE_VER_TYPE(1, 1);
     packet.code = CODE_PADR;
     packet.session = 0;
 
@@ -443,16 +470,25 @@ sendPADR(PPPoEConnection *conn)
     cursor += namelen + TAG_HDR_SIZE;
 
     /* If we're using Host-Uniq, copy it over */
-    if (conn->useHostUniq) {
-	PPPoETag hostUniq;
-	pid_t pid = getpid();
-	hostUniq.type = htons(TAG_HOST_UNIQ);
-	hostUniq.length = htons(sizeof(pid));
-	memcpy(hostUniq.payload, &pid, sizeof(pid));
-	CHECK_ROOM(cursor, packet.payload, sizeof(pid)+TAG_HDR_SIZE);
-	memcpy(cursor, &hostUniq, sizeof(pid) + TAG_HDR_SIZE);
-	cursor += sizeof(pid) + TAG_HDR_SIZE;
-	plen += sizeof(pid) + TAG_HDR_SIZE;
+    if (conn->hostUniq.length) {
+	int len = ntohs(conn->hostUniq.length);
+	CHECK_ROOM(cursor, packet.payload, len+TAG_HDR_SIZE);
+	memcpy(cursor, &conn->hostUniq, len + TAG_HDR_SIZE);
+	cursor += len + TAG_HDR_SIZE;
+	plen += len + TAG_HDR_SIZE;
+    }
+
+    /* Add our maximum MTU/MRU */
+    if (MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru) > ETH_PPPOE_MTU) {
+	PPPoETag maxPayload;
+	UINT16_t mru = htons(MIN(lcp_allowoptions[0].mru, lcp_wantoptions[0].mru));
+	maxPayload.type = htons(TAG_PPP_MAX_PAYLOAD);
+	maxPayload.length = htons(sizeof(mru));
+	memcpy(maxPayload.payload, &mru, sizeof(mru));
+	CHECK_ROOM(cursor, packet.payload, sizeof(mru) + TAG_HDR_SIZE);
+	memcpy(cursor, &maxPayload, sizeof(mru) + TAG_HDR_SIZE);
+	cursor += sizeof(mru) + TAG_HDR_SIZE;
+	plen += sizeof(mru) + TAG_HDR_SIZE;
     }
 
     /* Copy cookie and relay-ID if needed */
@@ -474,11 +510,6 @@ sendPADR(PPPoEConnection *conn)
 
     packet.length = htons(plen);
     sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
-    if (conn->debugFile) {
-	dumpPacket(conn->debugFile, &packet, "SENT");
-	fprintf(conn->debugFile, "\n");
-	fflush(conn->debugFile);
-    }
 }
 
 /**********************************************************************
@@ -491,31 +522,42 @@ sendPADR(PPPoEConnection *conn)
 *%DESCRIPTION:
 * Waits for a PADS packet and copies useful information
 ***********************************************************************/
-void
+static void
 waitForPADS(PPPoEConnection *conn, int timeout)
 {
     fd_set readable;
     int r;
     struct timeval tv;
+    struct timeval expire_at;
+
     PPPoEPacket packet;
     int len;
 
+    if (get_time(&expire_at) < 0) {
+	error("get_time (waitForPADS): %m");
+	return;
+    }
+    expire_at.tv_sec += timeout;
+
+    conn->error = 0;
     do {
 	if (BPF_BUFFER_IS_EMPTY) {
-	    tv.tv_sec = timeout;
-	    tv.tv_usec = 0;
-	    
+	    if (!time_left(&tv, &expire_at))
+		return;		/* Timed out */
+
 	    FD_ZERO(&readable);
 	    FD_SET(conn->discoverySocket, &readable);
-	    
+
 	    while(1) {
 		r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
-		if (r >= 0 || errno != EINTR) break;
+		if (r >= 0 || errno != EINTR || got_sigterm) break;
 	    }
 	    if (r < 0) {
-		fatalSys("select (waitForPADS)");
+		error("select (waitForPADS): %m");
+		return;
 	    }
-	    if (r == 0) return;
+	    if (r == 0)
+		return;		/* Timed out */
 	}
 
 	/* Get the packet */
@@ -523,7 +565,7 @@ waitForPADS(PPPoEConnection *conn, int timeout)
 
 	/* Check length */
 	if (ntohs(packet.length) + HDR_SIZE > len) {
-	    syslog(LOG_ERR, "Bogus PPPoE length field (%u)",
+	    error("Bogus PPPoE length field (%u)",
 		   (unsigned int) ntohs(packet.length));
 	    continue;
 	}
@@ -532,11 +574,6 @@ waitForPADS(PPPoEConnection *conn, int timeout)
 	/* If it's not a Discovery packet, loop again */
 	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
 #endif
-	if (conn->debugFile) {
-	    dumpPacket(conn->debugFile, &packet, "RCVD");
-	    fprintf(conn->debugFile, "\n");
-	    fflush(conn->debugFile);
-	}
 
 	/* If it's not from the AC, it's not for me */
 	if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
@@ -547,7 +584,10 @@ waitForPADS(PPPoEConnection *conn, int timeout)
 	/* Is it PADS?  */
 	if (packet.code == CODE_PADS) {
 	    /* Parse for goodies */
-	    parsePacket(&packet, parsePADSTags, conn);
+	    if (parsePacket(&packet, parsePADSTags, conn) < 0)
+		return;
+	    if (conn->error)
+		return;
 	    conn->discoveryState = STATE_SESSION;
 	    break;
 	}
@@ -556,11 +596,11 @@ waitForPADS(PPPoEConnection *conn, int timeout)
     /* Don't bother with ntohs; we'll just end up converting it back... */
     conn->session = packet.session;
 
-    syslog(LOG_INFO, "PPP session is %d", (int) ntohs(conn->session));
+    info("PPP session is %d", (int) ntohs(conn->session));
 
     /* RFC 2516 says session id MUST NOT be zero or 0xFFFF */
     if (ntohs(conn->session) == 0 || ntohs(conn->session) == 0xFFFF) {
-	syslog(LOG_ERR, "Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
+	error("Access concentrator used a session value of %x -- the AC is violating RFC 2516", (unsigned int) ntohs(conn->session));
     }
 }
 
@@ -578,26 +618,11 @@ discovery(PPPoEConnection *conn)
 {
     int padiAttempts = 0;
     int padrAttempts = 0;
-    int timeout = PADI_TIMEOUT;
-
-    /* Skip discovery and don't open discovery socket? */
-    if (conn->skipDiscovery && conn->noDiscoverySocket) {
-	conn->discoveryState = STATE_SESSION;
-	return;
-    }
-
-    conn->discoverySocket =
-	openInterface(conn->ifName, Eth_PPPOE_Discovery, conn->myEth);
-
-    /* Skip discovery? */
-    if (conn->skipDiscovery) {
-	conn->discoveryState = STATE_SESSION;
-	return;
-    }
+    int timeout = conn->discoveryTimeout;
 
     do {
 	padiAttempts++;
-	if (padiAttempts > MAX_PADI_ATTEMPTS) {
+	if (got_sigterm || padiAttempts > conn->discoveryAttempts) {
 	    warn("Timeout waiting for PADO packets");
 	    close(conn->discoverySocket);
 	    conn->discoverySocket = -1;
@@ -607,26 +632,13 @@ discovery(PPPoEConnection *conn)
 	conn->discoveryState = STATE_SENT_PADI;
 	waitForPADO(conn, timeout);
 
-	/* If we're just probing for access concentrators, don't do
-	   exponential backoff.  This reduces the time for an unsuccessful
-	   probe to 15 seconds. */
-	if (!conn->printACNames) {
-	    timeout *= 2;
-	}
-	if (conn->printACNames && conn->numPADOs) {
-	    break;
-	}
+	timeout *= 2;
     } while (conn->discoveryState == STATE_SENT_PADI);
 
-    /* If we're only printing access concentrator names, we're done */
-    if (conn->printACNames) {
-	die(0);
-    }
-
-    timeout = PADI_TIMEOUT;
+    timeout = conn->discoveryTimeout;
     do {
 	padrAttempts++;
-	if (padrAttempts > MAX_PADI_ATTEMPTS) {
+	if (got_sigterm || padrAttempts > conn->discoveryAttempts) {
 	    warn("Timeout waiting for PADS packets");
 	    close(conn->discoverySocket);
 	    conn->discoverySocket = -1;
@@ -638,8 +650,15 @@ discovery(PPPoEConnection *conn)
 	timeout *= 2;
     } while (conn->discoveryState == STATE_SENT_PADR);
 
+    if (!conn->seenMaxPayload) {
+	/* RFC 4638: MUST limit MTU/MRU to 1492 */
+	if (lcp_allowoptions[0].mru > ETH_PPPOE_MTU)
+	    lcp_allowoptions[0].mru = ETH_PPPOE_MTU;
+	if (lcp_wantoptions[0].mru > ETH_PPPOE_MTU)
+	    lcp_wantoptions[0].mru = ETH_PPPOE_MTU;
+    }
+
     /* We're done. */
     conn->discoveryState = STATE_SESSION;
     return;
 }
-