path: root/usr.sbin/npppd/pppoe/pppoed.c

/*	$OpenBSD: pppoed.c,v 1.24 2020/12/30 19:04:56 benno Exp $	*/

/*-
 * Copyright (c) 2009 Internet Initiative Japan Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
/**@file
 * This file provides the PPPoE(RFC2516) server(access concentrator)
 * implementaion.
 * $Id: pppoed.c,v 1.24 2020/12/30 19:04:56 benno Exp $
 */
#include <sys/param.h>	/* ALIGN */
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/uio.h>
#include <netinet/in.h>
#include <net/if.h>
#include <net/if_types.h>
#if defined(__NetBSD__)
#include <net/if_ether.h>
#else
#include <netinet/if_ether.h>
#endif
#include <net/if_dl.h>
#include <net/ethertypes.h>
#include <net/bpf.h>
#include <endian.h>
#include <string.h>
#include <syslog.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <event.h>
#include <signal.h>
#include <stdlib.h>
#include <ifaddrs.h>
#include <stdarg.h>
#include <errno.h>

#include "debugutil.h"
#include "slist.h"
#include "bytebuf.h"
#include "hash.h"
#include "privsep.h"

#include "pppoe.h"
#include "pppoe_local.h"

#define MINIMUM(a, b)	(((a) < (b)) ? (a) : (b))

static int pppoed_seqno = 0;

#ifdef	PPPOED_DEBUG
#define	PPPOED_ASSERT(x)	ASSERT(x)
#define	PPPOED_DBG(x)	pppoed_log x
#else
#define	PPPOED_ASSERT(x)
#define	PPPOED_DBG(x)
#endif

static void      pppoed_log (pppoed *, int, const char *, ...) __printflike(3,4);
static void      pppoed_listener_init(pppoed *, pppoed_listener *);
static int       pppoed_output (pppoed_listener *, u_char *, u_char *, int);
static int       pppoed_listener_start (pppoed_listener *, int);
static void      pppoed_io_event (int, short, void *);
static void      pppoed_input (pppoed_listener *, uint8_t [ETHER_ADDR_LEN], int, u_char *, int);
static void      pppoed_recv_PADR (pppoed_listener *, uint8_t [ETHER_ADDR_LEN], slist *);
static void      pppoed_recv_PADI (pppoed_listener *, uint8_t [ETHER_ADDR_LEN], slist *);
static int       session_id_cmp (void *, void *);
static uint32_t  session_id_hash (void *, size_t);

#ifdef PPPOE_TEST
static void      pppoed_on_sigterm (int, short, void *);
static void      usage (void);
#endif
static const char *pppoe_code_string(int);
#ifdef	PPPOED_DEBUG
static const char *pppoe_tag_string(int);
#endif

/*
 * daemon
 */

/* initialize PPPoE daemon */
int
pppoed_init(pppoed *_this)
{
	int i, off, id;

	memset(_this, 0, sizeof(pppoed));
	_this->id = pppoed_seqno++;

	if ((_this->session_hash = hash_create(
	    (int (*) (const void *, const void *))session_id_cmp,
	    (uint32_t (*) (const void *, int))session_id_hash,
	    PPPOE_SESSION_HASH_SIZ)) == NULL) {
		pppoed_log(_this, LOG_ERR, "hash_create() failed on %s(): %m",
		    __func__);
		goto fail;
	}

	slist_init(&_this->session_free_list);
	if (slist_add(&_this->session_free_list,
	    (void *)PPPOED_SESSION_SHUFFLE_MARK) == NULL) {
		pppoed_log(_this, LOG_ERR, "slist_add() failed on %s(): %m",
		    __func__);
		goto fail;
	}

	/* XXX initialize hash of cookies */
	if ((_this->acookie_hash = hash_create(
	    (int (*) (const void *, const void *))session_id_cmp,
	    (uint32_t (*) (const void *, int))session_id_hash,
	    PPPOE_SESSION_HASH_SIZ)) == NULL) {
		pppoed_log(_this, LOG_WARNING,
		    "hash_create() failed on %s(): %m", __func__);
		pppoed_log(_this, LOG_WARNING, "hash_create() failed on %s(): "
		    "ac-cookie hash create failed.", __func__);
		_this->acookie_hash = NULL;
	}
	_this->acookie_next = arc4random();

#if PPPOE_NSESSION > 0xffff
#error PPPOE_NSESSION must be less than 65536
#endif
	off = arc4random() & 0xffff;
	for (i = 0; i < PPPOE_NSESSION; i++) {
		id = (i + off) & 0xffff;
		if (id == 0)
			id = (off - 1) & 0xffff;
		if (slist_add(&_this->session_free_list, (void *)(intptr_t)id)
		    == NULL) {
			pppoed_log(_this, LOG_ERR,
			    "slist_add() failed on %s(): %m", __func__);
			goto fail;
		}
	}

	_this->state = PPPOED_STATE_INIT;

	return 0;
fail:
	pppoed_uninit(_this);
	return 1;
}

static void
pppoed_listener_init(pppoed *_this, pppoed_listener *listener)
{
	memset(listener, 0, sizeof(pppoed_listener));
	listener->bpf = -1;
	listener->self = _this;
	listener->index = PPPOED_LISTENER_INVALID_INDEX;
}

/* reload listner */
int
pppoed_reload_listeners(pppoed *_this)
{
	int rval = 0;

	if (_this->state == PPPOED_STATE_RUNNING &&
	    _this->listen_incomplete != 0)
		rval = pppoed_start(_this);

	return rval;
}

/*
 * Reject any packet except the packet to self and broadcasts,
 * as bpf(4) potentially receive packets for others.
 */
#define	REJECT_FOREIGN_ADDRESS 1

#define ETHER_FIRST_INT(e)	((e)[0]<<24|(e)[1]<<16|(e)[2]<<8|(e)[3])
#define ETHER_LAST_SHORT(e)	((e)[4]<<8|(e)[5])

static int
pppoed_listener_start(pppoed_listener *_this, int restart)
{
	int log_level;
	struct ifreq ifreq;
	int ival;
	int found;
	struct ifaddrs *ifa0, *ifa;
	struct sockaddr_dl *sdl;
	struct bpf_insn insns[] = {
	    /* check etyer type = PPPOEDESC or PPPOE */
		BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_PPPOEDISC, 2, 0),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_PPPOE, 1, 0),
		BPF_STMT(BPF_RET+BPF_K, (u_int)0),
#ifndef	REJECT_FOREIGN_ADDRESS
		BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
#else
	/* to ff:ff:ff:ff:ff:ff */
		BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 0),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0xffffffff, 0, 3),
		BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 4),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0xffff, 0, 1),
		BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
	/* to self */
		BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 0),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
		    ETHER_FIRST_INT(_this->ether_addr), 0, 3),
		BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 4),
		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
		    ETHER_LAST_SHORT(_this->ether_addr), 0, 1),
		BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
		BPF_STMT(BPF_RET+BPF_K, (u_int)0),
#endif
	};
	struct bpf_program bf_filter = {
		.bf_len = countof(insns),
		.bf_insns = insns
	};
	pppoed *_pppoed;

	if (restart == 0)
		log_level = LOG_ERR;
	else
		log_level = LOG_INFO;

	_pppoed = _this->self;

	ifa0 = NULL;
	if (getifaddrs(&ifa0) != 0) {
		pppoed_log(_pppoed, log_level,
		    "getifaddrs() failed on %s(): %m", __func__);
		return -1;
	}
	found = 0;
	for (ifa = ifa0; ifa != NULL; ifa = ifa->ifa_next) {
		sdl = (struct sockaddr_dl *)ifa->ifa_addr;
		if (sdl == NULL ||
		    sdl->sdl_family != AF_LINK || sdl->sdl_type != IFT_ETHER ||
		    sdl->sdl_alen != ETHER_ADDR_LEN)
			continue;
		if (strcmp(ifa->ifa_name, _this->listen_ifname) == 0) {
			memcpy(_this->ether_addr,
			    (caddr_t)LLADDR(sdl), ETHER_ADDR_LEN);
			found = 1;
			break;
		}
	}
	freeifaddrs(ifa0);
	if (!found) {
		pppoed_log(_pppoed, log_level, "%s is not available.",
		    _this->listen_ifname);
		goto fail;
	}

	if ((_this->bpf = priv_open("/dev/bpf", O_RDWR)) == -1) {
		pppoed_log(_pppoed, log_level, "Cannot open bpf: %m");
		goto fail;
	}

	ival = BPF_CAPTURE_SIZ;
	if (ioctl(_this->bpf, BIOCSBLEN, &ival) != 0) {
		pppoed_log(_pppoed, log_level, "ioctl(bpf, BIOCSBLEN(%d)): %m",
		    ival);
		goto fail;
	}
	ival = 1;
	if (ioctl(_this->bpf, BIOCIMMEDIATE, &ival) != 0) {
		pppoed_log(_pppoed, log_level, "Cannot start bpf on %s: %m",
		    _this->listen_ifname);
		goto fail;
	}

	/* bind interface */
	memset(&ifreq, 0, sizeof(ifreq));
	strlcpy(ifreq.ifr_name, _this->listen_ifname, sizeof(ifreq.ifr_name));
	if (ioctl(_this->bpf, BIOCSETIF, &ifreq) != 0) {
		pppoed_log(_pppoed, log_level, "Cannot start bpf on %s: %m",
		    _this->listen_ifname);
		goto fail;
	}

	/* set linklocal address */
#ifdef	REJECT_FOREIGN_ADDRESS
	insns[10].k = ETHER_FIRST_INT(_this->ether_addr);
	insns[12].k = ETHER_LAST_SHORT(_this->ether_addr);
#endif

	/* set filter */
	if (ioctl(_this->bpf, BIOCSETF, &bf_filter) != 0) {
		pppoed_log(_pppoed, log_level, "ioctl(bpf, BIOCSETF()): %m");
		goto fail;
	}

	event_set(&_this->ev_bpf, _this->bpf, EV_READ | EV_PERSIST,
	    pppoed_io_event, _this);
	event_add(&_this->ev_bpf, NULL);

	pppoed_log(_pppoed, LOG_INFO, "Listening on %s (PPPoE) [%s] "
	    "address=%02x:%02x:%02x:%02x:%02x:%02x", _this->listen_ifname,
	    _this->tun_name, _this->ether_addr[0], _this->ether_addr[1],
	    _this->ether_addr[2], _this->ether_addr[3], _this->ether_addr[4],
	    _this->ether_addr[5]);

	return 0;
fail:
	if (_this->bpf >= 0) {
		close(_this->bpf);
		_this->bpf = -1;
	}

	return 1;
}

/* start PPPoE daemon */
int
pppoed_start(pppoed *_this)
{
	int rval = 0;
	int nlistener_fail = 0;
	pppoed_listener *plistener;

	slist_itr_first(&_this->listener);
	while (slist_itr_has_next(&_this->listener)) {
		plistener = slist_itr_next(&_this->listener);
		PPPOED_ASSERT(plistener != NULL);
		if (plistener->bpf < 0) {
			if (pppoed_listener_start(plistener,
			    _this->listen_incomplete) != 0)
				nlistener_fail++;
		}
	}
	if (nlistener_fail > 0)
		_this->listen_incomplete = 1;
	else
		_this->listen_incomplete = 0;

	_this->state = PPPOED_STATE_RUNNING;

	return rval;
}

/* stop listener */
static void
pppoed_listener_stop(pppoed_listener *_this)
{
	pppoed *_pppoed;

	PPPOED_ASSERT(_this != NULL);
	_pppoed = _this->self;
	PPPOED_ASSERT(_pppoed != NULL);

	if (_this->bpf >= 0) {
		event_del(&_this->ev_bpf);
		close(_this->bpf);
		pppoed_log(_pppoed, LOG_INFO, "Shutdown %s (PPPoE) [%s] "
		    "address=%02x:%02x:%02x:%02x:%02x:%02x",
		    _this->listen_ifname, _this->tun_name,
		    _this->ether_addr[0], _this->ether_addr[1],
		    _this->ether_addr[2], _this->ether_addr[3],
		    _this->ether_addr[4], _this->ether_addr[5]);
		_this->bpf = -1;
	}
}

/* stop PPPoE daemon */
void
pppoed_stop(pppoed *_this)
{
	pppoed_listener *plistener;
	hash_link *hl;
	pppoe_session *session;

	if (!pppoed_is_running(_this))
		return;

	_this->state = PPPOED_STATE_STOPPED;
	if (_this->session_hash != NULL) {
		for (hl = hash_first(_this->session_hash);
		    hl != NULL;
		    hl = hash_next(_this->session_hash)) {
			session = (pppoe_session *)hl->item;
			pppoe_session_disconnect(session);
			pppoe_session_stop(session);
		}
	}
	for (slist_itr_first(&_this->listener);
	    slist_itr_has_next(&_this->listener);) {
		plistener = slist_itr_next(&_this->listener);
		pppoed_listener_stop(plistener);
		free(plistener);
		slist_itr_remove(&_this->listener);
	}
	PPPOED_DBG((_this, LOG_DEBUG, "Stopped"));
}

/* uninitialize (free) PPPoE daemon */
void
pppoed_uninit(pppoed *_this)
{
	if (_this->session_hash != NULL) {
		hash_free(_this->session_hash);
		_this->session_hash = NULL;
	}
	if (_this->acookie_hash != NULL) {
		hash_free(_this->acookie_hash);
		_this->acookie_hash = NULL;
	}
	slist_fini(&_this->session_free_list);
	/* listener themself has been released already */
	slist_fini(&_this->listener);
}

/* it is called when the PPPoE session was closed */
void
pppoed_pppoe_session_close_notify(pppoed *_this, pppoe_session *session)
{
	slist_add(&_this->session_free_list,
	    (void *)(intptr_t)session->session_id);

	if (_this->acookie_hash != NULL)
		hash_delete(_this->acookie_hash,
		    (void *)(intptr_t)session->acookie, 0);
	if (_this->session_hash != NULL)
		hash_delete(_this->session_hash,
		    (void *)(intptr_t)session->session_id, 0);

	pppoe_session_fini(session);
	free(session);
}

/*
 * PPPoE Configuration
 */
/* reload configurations for the PPPoE daemon */
int
pppoed_reload(pppoed *_this, struct pppoe_confs *pppoe_conf)
{
	int                i, count, do_start, found;
	struct pppoe_conf *conf;
	slist              rmlist, newlist;
	struct {
		char			 ifname[IF_NAMESIZE];
		char			 name[PPPOED_PHY_LABEL_SIZE];
		struct pppoe_conf	*conf;
	} listeners[PPPOE_NLISTENER];
	pppoed_listener   *l;
	pppoe_session     *session;
	hash_link         *hl;

	do_start = 0;
	slist_init(&rmlist);
	slist_init(&newlist);

	count = 0;
	TAILQ_FOREACH(conf, pppoe_conf, entry) {
		strlcpy(listeners[count].ifname, conf->if_name,
		    sizeof(listeners[count].ifname));
		strlcpy(listeners[count].name, conf->name,
		    sizeof(listeners[count].name));
		listeners[count].conf = conf;
		count++;
	}

	if (slist_add_all(&rmlist, &_this->listener) != 0)
		goto fail;

	for (i = 0; i < count; i++) {
		found = 0;
		l = NULL;
		slist_itr_first(&rmlist);
		while (slist_itr_has_next(&rmlist)) {
			l = slist_itr_next(&rmlist);
			if (strcmp(l->listen_ifname, listeners[i].ifname) == 0){
				slist_itr_remove(&rmlist);
				found = 1;
				break;
			}
		}
		if (!found) {
			if ((l = malloc(sizeof(pppoed_listener))) == NULL)
				goto fail;
			pppoed_listener_init(_this, l);
		}
		l->self = _this;
		strlcpy(l->tun_name, listeners[i].name, sizeof(l->tun_name));
		strlcpy(l->listen_ifname, listeners[i].ifname,
		    sizeof(l->listen_ifname));
		l->conf = listeners[i].conf;
		if (slist_add(&newlist, l) == NULL) {
			pppoed_log(_this, LOG_ERR,
			    "slist_add() failed in %s(): %m", __func__);
			goto fail;
		}
	}

	if (slist_set_size(&_this->listener, count) != 0)
		goto fail;

	/* garbage collection of listener context */
	slist_itr_first(&rmlist);
	while (slist_itr_has_next(&rmlist)) {
		l = slist_itr_next(&rmlist);
		/* handle child PPPoE session */
		if (_this->session_hash != NULL) {
			for (hl = hash_first(_this->session_hash); hl != NULL;
			    hl = hash_next(_this->session_hash)) {
				session = (pppoe_session *)hl->item;
				if (session->listener_index == l->index)
					pppoe_session_stop(session);
			}
		}
		pppoed_listener_stop(l);
		free(l);
	}
	slist_remove_all(&_this->listener);
	/* as slist_set_size-ed, it must not fail */
	(void)slist_add_all(&_this->listener, &newlist);

	/* reset indexes */
	slist_itr_first(&newlist);
	for (i = 0; slist_itr_has_next(&newlist); i++) {
		l = slist_itr_next(&newlist);
		if (l->index != i && l->index != PPPOED_LISTENER_INVALID_INDEX){
			PPPOED_DBG((_this, LOG_DEBUG, "listener %d => %d",
			    l->index, i));
			for (hl = hash_first(_this->session_hash); hl != NULL;
			    hl = hash_next(_this->session_hash)) {
				session = (pppoe_session *)hl->item;
				if (session->listener_index == l->index)
					session->listener_index = i;
			}
		}
		l->index = i;
	}

	slist_fini(&rmlist);
	slist_fini(&newlist);

	if (pppoed_start(_this) != 0)
		return 1;

	return 0;
fail:
	slist_fini(&rmlist);
	slist_fini(&newlist);

	return 1;
}

/*
 * I/O
 */

static void
pppoed_io_event(int fd, short evmask, void *ctx)
{
	u_char buf[BPF_CAPTURE_SIZ], *pkt;
	int lpkt, off;
	pppoed_listener *_this;
	struct ether_header *ether;
	struct bpf_hdr *bpf;

	_this = ctx;

	PPPOED_ASSERT(_this != NULL);

	lpkt = read(_this->bpf, buf, sizeof(buf));
	pkt = buf;
	while (lpkt > 0) {
		if (lpkt < sizeof(struct bpf_hdr)) {
			pppoed_log(_this->self, LOG_WARNING,
			    "Received bad PPPoE packet: packet too short(%d)",
			    lpkt);
			break;
		}
		bpf = (struct bpf_hdr *)pkt;
		ether = (struct ether_header *)(pkt + bpf->bh_hdrlen);
		ether->ether_type = ntohs(ether->ether_type);
		if (memcmp(ether->ether_shost, _this->ether_addr,
		    ETHER_ADDR_LEN) == 0)
			/* the packet is from myself */
			goto next_pkt;
		off = bpf->bh_hdrlen + sizeof(struct ether_header);
		if (lpkt < off + sizeof(struct pppoe_header)) {
			pppoed_log(_this->self, LOG_WARNING,
			    "Received bad PPPoE packet: packet too short(%d)",
			    lpkt);
			break;
		}
		pppoed_input(_this, ether->ether_shost,
		    (ether->ether_type == ETHERTYPE_PPPOEDISC)? 1 : 0,
		    pkt + off, lpkt - off);
next_pkt:
		pkt = pkt + BPF_WORDALIGN(bpf->bh_hdrlen +
		    bpf->bh_caplen);
		lpkt -= BPF_WORDALIGN(bpf->bh_hdrlen + bpf->bh_caplen);
	}
	return;
}

static void
pppoed_input(pppoed_listener *_this, uint8_t shost[ETHER_ADDR_LEN], int is_disc,
    u_char *pkt, int lpkt)
{
	hash_link *hl;
	pppoe_session *session;
	struct pppoe_header *pppoe;
	struct pppoe_tlv *tlv;
	u_char tlvspace[2048], *p_tlvspace;
	int session_id;
	slist tag_list;
	const char *reason;
#define tlvspace_remaining() (sizeof(tlvspace) - (p_tlvspace - tlvspace))

	reason = "";
	p_tlvspace = tlvspace;
	session = NULL;

	pppoe = (struct pppoe_header *)pkt;
	session_id = pppoe->session_id = ntohs(pppoe->session_id);
	pppoe->length = ntohs(pppoe->length);

#ifdef PPPOED_DEBUG
	if (is_disc) {
		PPPOED_DBG((_this->self, DEBUG_LEVEL_1,
		    "Recv%s(%02x) ver=%d type=%d session-id=%d if=%s",
		    pppoe_code_string(pppoe->code), pppoe->code,
		    pppoe->ver, pppoe->type, pppoe->session_id,
		    _this->listen_ifname));
	}
#endif
	pkt += sizeof(struct pppoe_header);
	lpkt -= sizeof(struct pppoe_header);

	if (lpkt < pppoe->length) {
		reason = "received packet is shorter than "
		    "pppoe length field.";
		goto bad_packet;
	}
	/* use PPPoE header value as lpkt */
	lpkt = pppoe->length;

	if (pppoe->type != PPPOE_RFC2516_TYPE ||
	    pppoe->ver != PPPOE_RFC2516_VER) {
		reason = "received packet has wrong version or type.";
		goto bad_packet;
	}

	if (session_id != 0) {
		hl = hash_lookup(_this->self->session_hash,
		    (void *)(intptr_t)session_id);
		if (hl != NULL)
			session = (pppoe_session *)hl->item;
	}
	if (!is_disc) {
		if (session != NULL)
			pppoe_session_input(session, pkt, pppoe->length);
		return;
	}

	/*
	 * PPPoE-Discovery Packet processing.
	 */
	slist_init(&tag_list);
	while (lpkt > 0) {
		if (lpkt < 4) {
			reason = "tlv list is broken.  "
			    "Remaining octet is too short.";
			goto fail;
		}
		if (tlvspace_remaining() < 4) {
			reason = "parsing TAGs reached the buffer size limit.";
			goto fail;
		}
		tlv = (struct pppoe_tlv *)p_tlvspace;
		GETSHORT(tlv->type, pkt);
		GETSHORT(tlv->length, pkt);
		p_tlvspace += 4;
		lpkt -= 4;
		if (tlv->length > lpkt) {
			reason = "tlv list is broken.  length is wrong.";
			goto fail;
		}
		if (tlvspace_remaining() < tlv->length) {
			reason = "parsing TAGs reached the buffer size limit.";
			goto fail;
		}
		if (tlv->length > 0) {
			memcpy(tlv->value, pkt, tlv->length);
			pkt += tlv->length;
			lpkt -= tlv->length;
			p_tlvspace += tlv->length;
			p_tlvspace = (u_char *)ALIGN(p_tlvspace);
		}
#ifdef	PPPOED_DEBUG
		if (debuglevel >= 2)
			pppoed_log(_this->self, DEBUG_LEVEL_2,
			    "Recv%s tag %s(%04x)=%s",
			    pppoe_code_string(pppoe->code),
			    pppoe_tag_string(tlv->type), tlv->type,
			    pppoed_tlv_value_string(tlv));
#endif
		if (tlv->type == PPPOE_TAG_END_OF_LIST)
			break;
		if (slist_add(&tag_list, tlv) == NULL) {
			goto fail;
		}
	}
	switch (pppoe->code) {
	case PPPOE_CODE_PADI:
		if (_this->self->state != PPPOED_STATE_RUNNING)
			break;
		pppoed_recv_PADI(_this, shost, &tag_list);
		break;
	case PPPOE_CODE_PADR:
		if (_this->self->state != PPPOED_STATE_RUNNING)
			break;
		pppoed_recv_PADR(_this, shost, &tag_list);
		break;
	case PPPOE_CODE_PADT:
		PPPOED_DBG((_this->self, LOG_DEBUG, "RecvPADT"));
		if (session != NULL)
			pppoe_session_recv_PADT(session, &tag_list);
		break;
	}
	slist_fini(&tag_list);

	return;
fail:
	slist_fini(&tag_list);
bad_packet:
	pppoed_log(_this->self, LOG_INFO,
	    "Received a bad packet: code=%s(%02x) ver=%d type=%d session-id=%d"
	    " if=%s: %s", pppoe_code_string(pppoe->code), pppoe->code,
	    pppoe->ver, pppoe->type, pppoe->session_id, _this->listen_ifname,
	    reason);
}

static int
pppoed_output(pppoed_listener *_this, u_char *dhost, u_char *pkt, int lpkt)
{
	int sz, iovc;
	struct iovec iov[3];
	struct ether_header ether;
	struct pppoe_header *pppoe;
	u_char pad[ETHERMIN];

	memcpy(ether.ether_dhost, dhost, ETHER_ADDR_LEN);
	memcpy(ether.ether_shost, _this->ether_addr, ETHER_ADDR_LEN);

	iov[0].iov_base = &ether;
	iov[0].iov_len = sizeof(struct ether_header);
	ether.ether_type = htons(ETHERTYPE_PPPOEDISC);
	iov[1].iov_base = pkt;
	iov[1].iov_len = lpkt;
	pppoe = (struct pppoe_header *)pkt;
	pppoe->length = htons(lpkt - sizeof(struct pppoe_header));

	iovc = 2;

	if (lpkt < ETHERMIN) {
		memset(pad, 0, ETHERMIN - lpkt);
		iov[2].iov_base = pad;
		iov[2].iov_len = ETHERMIN - lpkt;
		iovc++;
	}

	sz = writev(_this->bpf, iov, iovc);

	return (sz > 0)? 0 : -1;
}

static void
pppoed_recv_PADR(pppoed_listener *_this, uint8_t shost[ETHER_ADDR_LEN],
    slist *tag_list)
{
	int session_id, shuffle_cnt;
	pppoe_session *session;
	pppoed *_pppoed;

	_pppoed = _this->self;
	if ((session = malloc(sizeof(pppoe_session))) == NULL) {
		pppoed_log(_pppoed, LOG_ERR, "malloc() failed on %s(): %m",
		    __func__);
		goto fail;
	}

	/* create session_id */
	shuffle_cnt = 0;
	do {
		session_id = (intptr_t)slist_remove_first(
		    &_pppoed->session_free_list);
		if (session_id != PPPOED_SESSION_SHUFFLE_MARK)
			break;
		PPPOED_ASSERT(shuffle_cnt == 0);
		if (shuffle_cnt++ > 0) {
			pppoed_log(_pppoed, LOG_ERR,
			    "unexpected error in %s(): session_free_list full",
			    __func__);
			slist_add(&_pppoed->session_free_list,
			    (void *)PPPOED_SESSION_SHUFFLE_MARK);
			goto fail;
		}
		slist_shuffle(&_pppoed->session_free_list);
		slist_add(&_pppoed->session_free_list,
		    (void *)PPPOED_SESSION_SHUFFLE_MARK);
	} while (1);

	if (pppoe_session_init(session, _pppoed, _this->index, session_id,
	    shost) != 0)
		goto fail;

	hash_insert(_pppoed->session_hash, (void *)(intptr_t)session_id,
	    session);

	if (pppoe_session_recv_PADR(session, tag_list) != 0)
		goto fail;

	session = NULL;	/* don't free */
	/* FALLTHROUGH */
fail:
	if (session != NULL)
		pppoe_session_fini(session);
	return;
}

static void
pppoed_recv_PADI(pppoed_listener *_this, uint8_t shost[ETHER_ADDR_LEN],
    slist *tag_list)
{
	int len;
	const char *service_name, *ac_name;
	u_char bufspace[2048];
	u_char sn[2048], ac_name0[40];
	struct pppoe_header pppoe;
	struct pppoe_tlv tlv, *tlv_hostuniq, *tlv0, *tlv_service_name;
	bytebuffer *buf;

	if ((buf = bytebuffer_wrap(bufspace, sizeof(bufspace))) == NULL) {
		pppoed_log(_this->self, LOG_ERR,
		"bytebuffer_wrap() failed on %s(): %m", __func__);
		return;
	}
	bytebuffer_clear(buf);

	tlv_hostuniq = NULL;
	tlv_service_name = NULL;

	service_name = "";
	if (_this->conf->service_name != NULL)
		service_name = _this->conf->service_name;

	for (slist_itr_first(tag_list); slist_itr_has_next(tag_list);) {
		tlv0 = slist_itr_next(tag_list);
		if (tlv0->type == PPPOE_TAG_HOST_UNIQ)
			tlv_hostuniq = tlv0;
		if (tlv0->type == PPPOE_TAG_SERVICE_NAME) {

			len = tlv0->length;
			if (len >= sizeof(sn))
				goto fail;

			memcpy(sn, tlv0->value, len);
			sn[len] = '\0';

			if (strcmp(service_name, sn) == 0 ||
			    (sn[0] == '\0' && _this->conf->accept_any_service))
				tlv_service_name = tlv0;
		}
	}
	if (tlv_service_name == NULL) {
		pppoed_log(_this->self, LOG_INFO,
		    "Deny PADI from=%02x:%02x:%02x:%02x:%02x:%02x "
		    "service-name=%s host-uniq=%s if=%s: serviceName is "
		    "not allowed.", shost[0], shost[1],
		    shost[2], shost[3], shost[4], shost[5], sn, tlv_hostuniq?
		    pppoed_tlv_value_string(tlv_hostuniq) : "none",
		    _this->listen_ifname);
		goto fail;
	}

	pppoed_log(_this->self, LOG_INFO,
	    "RecvPADI from=%02x:%02x:%02x:%02x:%02x:%02x service-name=%s "
	    "host-uniq=%s if=%s", shost[0], shost[1], shost[2], shost[3],
	    shost[4], shost[5], sn, tlv_hostuniq?
	    pppoed_tlv_value_string(tlv_hostuniq) : "none",
	    _this->listen_ifname);

	/*
	 * PPPoE Header
	 */
	memset(&pppoe, 0, sizeof(pppoe));
	pppoe.ver = PPPOE_RFC2516_VER;
	pppoe.type = PPPOE_RFC2516_TYPE;
	pppoe.code = PPPOE_CODE_PADO;
	bytebuffer_put(buf, &pppoe, sizeof(pppoe));

	/*
	 * Tag - Service-Name
	 */
	tlv.type = htons(PPPOE_TAG_SERVICE_NAME);
	len = strlen(service_name);
	tlv.length = htons(len);
	bytebuffer_put(buf, &tlv, sizeof(tlv));
	if (len > 0)
		bytebuffer_put(buf, service_name, len);

	/*
	 * Tag - Access Concentrator Name
	 */
	ac_name = _this->conf->ac_name;
	if (ac_name == NULL) {
		/*
		 * use the ethernet address as default AC-Name.
		 * suggested by RFC 2516.
		 */
		snprintf(ac_name0, sizeof(ac_name0),
		    "%02x:%02x:%02x:%02x:%02x:%02x", _this->ether_addr[0],
		    _this->ether_addr[1], _this->ether_addr[2],
		    _this->ether_addr[3], _this->ether_addr[4],
		    _this->ether_addr[5]);
		ac_name = ac_name0;
	}

	tlv.type = htons(PPPOE_TAG_AC_NAME);
	len = strlen(ac_name);
	tlv.length = htons(len);
	bytebuffer_put(buf, &tlv, sizeof(tlv));
	bytebuffer_put(buf, ac_name, len);

	/*
	 * Tag - ac-cookie
	 */
	if (_this->self->acookie_hash != NULL) {
		/*
		 * search next ac-cookie.
		 * (XXX it will loop in uint32_t boundaly)
		 */
		do {
			_this->self->acookie_next += 1;
		}
		while(hash_lookup(_this->self->acookie_hash,
		    (void *)(intptr_t)_this->self->acookie_next) != NULL);

		tlv.type = htons(PPPOE_TAG_AC_COOKIE);
		tlv.length = ntohs(sizeof(uint32_t));
		bytebuffer_put(buf, &tlv, sizeof(tlv));
		bytebuffer_put(buf, &_this->self->acookie_next,
		    sizeof(uint32_t));
	}

	/*
	 * Tag - Host-Uniq
	 */
	if (tlv_hostuniq != NULL) {
		tlv.type = htons(PPPOE_TAG_HOST_UNIQ);
		tlv.length = ntohs(tlv_hostuniq->length);
		bytebuffer_put(buf, &tlv, sizeof(tlv));
		bytebuffer_put(buf, tlv_hostuniq->value,
		    tlv_hostuniq->length);
	}

	/*
	 * Tag - End-Of-List
	 */
	tlv.type = htons(PPPOE_TAG_END_OF_LIST);
	tlv.length = ntohs(0);
	bytebuffer_put(buf, &tlv, sizeof(tlv));

	bytebuffer_flip(buf);

	if (pppoed_output(_this, shost, bytebuffer_pointer(buf),
	    bytebuffer_remaining(buf)) != 0) {
		pppoed_log(_this->self, LOG_ERR, "pppoed_output() failed:%m");
	}
	pppoed_log(_this->self, LOG_INFO,
	    "SendPADO to=%02x:%02x:%02x:%02x:%02x:%02x serviceName=%s "
	    "acName=%s hostUniq=%s eol if=%s", shost[0], shost[1], shost[2],
	    shost[3], shost[4], shost[5], service_name, ac_name,
	    tlv_hostuniq? pppoed_tlv_value_string(tlv_hostuniq) : "none",
		_this->listen_ifname);
	/* FALLTHROUGH */
fail:
	bytebuffer_unwrap(buf);
	bytebuffer_destroy(buf);
}

/*
 * log
 */
static void
pppoed_log(pppoed *_this, int prio, const char *fmt, ...)
{
	char logbuf[BUFSIZ];
	va_list ap;

	PPPOED_ASSERT(_this != NULL);
	va_start(ap, fmt);
#ifdef	PPPOED_MULTIPLE
	snprintf(logbuf, sizeof(logbuf), "pppoed id=%u %s", _this->id, fmt);
#else
	snprintf(logbuf, sizeof(logbuf), "pppoed %s", fmt);
#endif
	vlog_printf(prio, logbuf, ap);
	va_end(ap);
}

#define	NAME_VAL(x)	{ x, #x }
static struct _label_name {
	int		label;
	const char	*name;
} pppoe_code_labels[] = {
	NAME_VAL(PPPOE_CODE_PADI),
	NAME_VAL(PPPOE_CODE_PADO),
	NAME_VAL(PPPOE_CODE_PADR),
	NAME_VAL(PPPOE_CODE_PADS),
	NAME_VAL(PPPOE_CODE_PADT),
#ifdef PPPOED_DEBUG
}, pppoe_tlv_labels[] = {
	NAME_VAL(PPPOE_TAG_END_OF_LIST),
	NAME_VAL(PPPOE_TAG_SERVICE_NAME),
	NAME_VAL(PPPOE_TAG_AC_NAME),
	NAME_VAL(PPPOE_TAG_HOST_UNIQ),
	NAME_VAL(PPPOE_TAG_AC_COOKIE),
	NAME_VAL(PPPOE_TAG_VENDOR_SPECIFIC),
	NAME_VAL(PPPOE_TAG_RELAY_SESSION_ID),
	NAME_VAL(PPPOE_TAG_SERVICE_NAME_ERROR),
	NAME_VAL(PPPOE_TAG_AC_SYSTEM_ERROR),
	NAME_VAL(PPPOE_TAG_GENERIC_ERROR)
#endif
};
#define LABEL_TO_STRING(func_name, label_names, prefix_len)		\
	static const char *						\
	func_name(int code)						\
	{								\
		int i;							\
									\
		for (i = 0; i < countof(label_names); i++) {		\
			if (label_names[i].label == code)		\
				return label_names[i].name + prefix_len;\
		}							\
									\
		return "UNKNOWN";					\
	}
LABEL_TO_STRING(pppoe_code_string, pppoe_code_labels, 11)
#ifdef PPPOED_DEBUG
LABEL_TO_STRING(pppoe_tag_string, pppoe_tlv_labels, 10)
#endif

const char *
pppoed_tlv_value_string(struct pppoe_tlv *tlv)
{
	int i;
	char buf[3];
	static char _tlv_string_value[8192];

	_tlv_string_value[0] = '\0';
	for (i = 0; i < tlv->length; i++) {
		snprintf(buf, sizeof(buf), "%02x", tlv->value[i]);
		strlcat(_tlv_string_value, buf,
		    sizeof(_tlv_string_value));
	}
	return _tlv_string_value;
}

/*
 * misc
 */
static int
session_id_cmp(void *a, void *b)
{
	int ia, ib;

	ia = (intptr_t)a;
	ib = (intptr_t)b;

	return ib - ia;
}

static uint32_t
session_id_hash(void *a, size_t siz)
{
	int ia;

	ia = (intptr_t)a;

	return ia % siz;
}