xref: /freebsd/sys/netgraph/ng_lmi.c (revision 076ad2f836d5f49dc1375f1677335a48fe0d4b82)
1 /*
2  * ng_lmi.c
3  */
4 
5 /*-
6  * Copyright (c) 1996-1999 Whistle Communications, Inc.
7  * All rights reserved.
8  *
9  * Subject to the following obligations and disclaimer of warranty, use and
10  * redistribution of this software, in source or object code forms, with or
11  * without modifications are expressly permitted by Whistle Communications;
12  * provided, however, that:
13  * 1. Any and all reproductions of the source or object code must include the
14  *    copyright notice above and the following disclaimer of warranties; and
15  * 2. No rights are granted, in any manner or form, to use Whistle
16  *    Communications, Inc. trademarks, including the mark "WHISTLE
17  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
18  *    such appears in the above copyright notice or in the software.
19  *
20  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
21  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
22  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
23  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
24  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
25  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
26  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
27  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
28  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
29  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
30  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
31  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
32  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
36  * OF SUCH DAMAGE.
37  *
38  * Author: Julian Elischer <julian@freebsd.org>
39  *
40  * $FreeBSD$
41  * $Whistle: ng_lmi.c,v 1.38 1999/11/01 09:24:52 julian Exp $
42  */
43 
44 /*
45  * This node performs the frame relay LMI protocol. It knows how
46  * to do ITU Annex A, ANSI Annex D, and "Group-of-Four" variants
47  * of the protocol.
48  *
49  * A specific protocol can be forced by connecting the corresponding
50  * hook to DLCI 0 or 1023 (as appropriate) of a frame relay link.
51  *
52  * Alternately, this node can do auto-detection of the LMI protocol
53  * by connecting hook "auto0" to DLCI 0 and "auto1023" to DLCI 1023.
54  */
55 
56 #include <sys/param.h>
57 #include <sys/systm.h>
58 #include <sys/errno.h>
59 #include <sys/kernel.h>
60 #include <sys/malloc.h>
61 #include <sys/mbuf.h>
62 #include <sys/syslog.h>
63 #include <netgraph/ng_message.h>
64 #include <netgraph/netgraph.h>
65 #include <netgraph/ng_lmi.h>
66 
67 /*
68  * Human readable names for LMI
69  */
70 #define NAME_ANNEXA	NG_LMI_HOOK_ANNEXA
71 #define NAME_ANNEXD	NG_LMI_HOOK_ANNEXD
72 #define NAME_GROUP4	NG_LMI_HOOK_GROUPOF4
73 #define NAME_NONE	"None"
74 
75 #define MAX_DLCIS	128
76 #define MAXDLCI		1023
77 
78 /*
79  * DLCI states
80  */
81 #define DLCI_NULL	0
82 #define DLCI_UP		1
83 #define DLCI_DOWN	2
84 
85 /*
86  * Any received LMI frame should be at least this long
87  */
88 #define LMI_MIN_LENGTH	8	/* XXX verify */
89 
90 /*
91  * Netgraph node methods and type descriptor
92  */
93 static ng_constructor_t	nglmi_constructor;
94 static ng_rcvmsg_t	nglmi_rcvmsg;
95 static ng_shutdown_t	nglmi_shutdown;
96 static ng_newhook_t	nglmi_newhook;
97 static ng_rcvdata_t	nglmi_rcvdata;
98 static ng_disconnect_t	nglmi_disconnect;
99 static int	nglmi_checkdata(hook_p hook, struct mbuf *m);
100 
101 static struct ng_type typestruct = {
102 	.version =	NG_ABI_VERSION,
103 	.name =		NG_LMI_NODE_TYPE,
104 	.constructor =	nglmi_constructor,
105 	.rcvmsg	=	nglmi_rcvmsg,
106 	.shutdown =	nglmi_shutdown,
107 	.newhook =	nglmi_newhook,
108 	.rcvdata =	nglmi_rcvdata,
109 	.disconnect =	nglmi_disconnect,
110 };
111 NETGRAPH_INIT(lmi, &typestruct);
112 
113 /*
114  * Info and status per node
115  */
116 struct nglmi_softc {
117 	node_p  node;		/* netgraph node */
118 	int     flags;		/* state */
119 	int     poll_count;	/* the count of times for autolmi */
120 	int     poll_state;	/* state of auto detect machine */
121 	u_char  remote_seq;	/* sequence number the remote sent */
122 	u_char  local_seq;	/* last sequence number we sent */
123 	u_char  protoID;	/* 9 for group of 4, 8 otherwise */
124 	u_long  seq_retries;	/* sent this how many time so far */
125 	struct	callout	handle;	/* see timeout(9) */
126 	int     liv_per_full;
127 	int     liv_rate;
128 	int     livs;
129 	int     need_full;
130 	hook_p  lmi_channel;	/* whatever we ended up using */
131 	hook_p  lmi_annexA;
132 	hook_p  lmi_annexD;
133 	hook_p  lmi_group4;
134 	hook_p  lmi_channel0;	/* auto-detect on DLCI 0 */
135 	hook_p  lmi_channel1023;/* auto-detect on DLCI 1023 */
136 	char   *protoname;	/* cache protocol name */
137 	u_char  dlci_state[MAXDLCI + 1];
138 	int     invalidx;	/* next dlci's to invalidate */
139 };
140 typedef struct nglmi_softc *sc_p;
141 
142 /*
143  * Other internal functions
144  */
145 static void	LMI_ticker(node_p node, hook_p hook, void *arg1, int arg2);
146 static void	nglmi_startup_fixed(sc_p sc, hook_p hook);
147 static void	nglmi_startup_auto(sc_p sc);
148 static void	nglmi_startup(sc_p sc);
149 static void	nglmi_inquire(sc_p sc, int full);
150 static void	ngauto_state_machine(sc_p sc);
151 
152 /*
153  * Values for 'flags' field
154  * NB: the SCF_CONNECTED flag is set if and only if the timer is running.
155  */
156 #define	SCF_CONNECTED	0x01	/* connected to something */
157 #define	SCF_AUTO	0x02	/* we are auto-detecting */
158 #define	SCF_FIXED	0x04	/* we are fixed from the start */
159 
160 #define	SCF_LMITYPE	0x18	/* mask for determining Annex mode */
161 #define	SCF_NOLMI	0x00	/* no LMI type selected yet */
162 #define	SCF_ANNEX_A	0x08	/* running annex A mode */
163 #define	SCF_ANNEX_D	0x10	/* running annex D mode */
164 #define	SCF_GROUP4	0x18	/* running group of 4 */
165 
166 #define SETLMITYPE(sc, annex)						\
167 do {									\
168 	(sc)->flags &= ~SCF_LMITYPE;					\
169 	(sc)->flags |= (annex);						\
170 } while (0)
171 
172 #define NOPROTO(sc) (((sc)->flags & SCF_LMITYPE) == SCF_NOLMI)
173 #define ANNEXA(sc) (((sc)->flags & SCF_LMITYPE) == SCF_ANNEX_A)
174 #define ANNEXD(sc) (((sc)->flags & SCF_LMITYPE) == SCF_ANNEX_D)
175 #define GROUP4(sc) (((sc)->flags & SCF_LMITYPE) == SCF_GROUP4)
176 
177 #define LMIPOLLSIZE	3
178 #define LMI_PATIENCE	8	/* declare all DLCI DOWN after N LMI failures */
179 
180 /*
181  * Node constructor
182  */
183 static int
184 nglmi_constructor(node_p node)
185 {
186 	sc_p sc;
187 
188 	sc = malloc(sizeof(*sc), M_NETGRAPH, M_WAITOK | M_ZERO);
189 
190 	NG_NODE_SET_PRIVATE(node, sc);
191 	sc->node = node;
192 
193 	ng_callout_init(&sc->handle);
194 	sc->protoname = NAME_NONE;
195 	sc->liv_per_full = NG_LMI_SEQ_PER_FULL;	/* make this dynamic */
196 	sc->liv_rate = NG_LMI_KEEPALIVE_RATE;
197 	return (0);
198 }
199 
200 /*
201  * The LMI channel has a private pointer which is the same as the
202  * node private pointer. The debug channel has a NULL private pointer.
203  */
204 static int
205 nglmi_newhook(node_p node, hook_p hook, const char *name)
206 {
207 	sc_p sc = NG_NODE_PRIVATE(node);
208 
209 	if (strcmp(name, NG_LMI_HOOK_DEBUG) == 0) {
210 		NG_HOOK_SET_PRIVATE(hook, NULL);
211 		return (0);
212 	}
213 	if (sc->flags & SCF_CONNECTED) {
214 		/* already connected, return an error */
215 		return (EINVAL);
216 	}
217 	if (strcmp(name, NG_LMI_HOOK_ANNEXA) == 0) {
218 		sc->lmi_annexA = hook;
219 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
220 		sc->protoID = 8;
221 		SETLMITYPE(sc, SCF_ANNEX_A);
222 		sc->protoname = NAME_ANNEXA;
223 		nglmi_startup_fixed(sc, hook);
224 	} else if (strcmp(name, NG_LMI_HOOK_ANNEXD) == 0) {
225 		sc->lmi_annexD = hook;
226 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
227 		sc->protoID = 8;
228 		SETLMITYPE(sc, SCF_ANNEX_D);
229 		sc->protoname = NAME_ANNEXD;
230 		nglmi_startup_fixed(sc, hook);
231 	} else if (strcmp(name, NG_LMI_HOOK_GROUPOF4) == 0) {
232 		sc->lmi_group4 = hook;
233 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
234 		sc->protoID = 9;
235 		SETLMITYPE(sc, SCF_GROUP4);
236 		sc->protoname = NAME_GROUP4;
237 		nglmi_startup_fixed(sc, hook);
238 	} else if (strcmp(name, NG_LMI_HOOK_AUTO0) == 0) {
239 		/* Note this, and if B is already installed, we're complete */
240 		sc->lmi_channel0 = hook;
241 		sc->protoname = NAME_NONE;
242 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
243 		if (sc->lmi_channel1023)
244 			nglmi_startup_auto(sc);
245 	} else if (strcmp(name, NG_LMI_HOOK_AUTO1023) == 0) {
246 		/* Note this, and if A is already installed, we're complete */
247 		sc->lmi_channel1023 = hook;
248 		sc->protoname = NAME_NONE;
249 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
250 		if (sc->lmi_channel0)
251 			nglmi_startup_auto(sc);
252 	} else
253 		return (EINVAL);		/* unknown hook */
254 	return (0);
255 }
256 
257 /*
258  * We have just attached to a live (we hope) node.
259  * Fire out a LMI inquiry, and then start up the timers.
260  */
261 static void
262 LMI_ticker(node_p node, hook_p hook, void *arg1, int arg2)
263 {
264 	sc_p sc = NG_NODE_PRIVATE(node);
265 
266 	if (sc->flags & SCF_AUTO) {
267 		ngauto_state_machine(sc);
268 		ng_callout(&sc->handle, node, NULL, NG_LMI_POLL_RATE * hz,
269 		    LMI_ticker, NULL, 0);
270 	} else {
271 		if (sc->livs++ >= sc->liv_per_full) {
272 			nglmi_inquire(sc, 1);
273 			/* sc->livs = 0; *//* do this when we get the answer! */
274 		} else {
275 			nglmi_inquire(sc, 0);
276 		}
277 		ng_callout(&sc->handle, node, NULL, sc->liv_rate * hz,
278 		    LMI_ticker, NULL, 0);
279 	}
280 }
281 
282 static void
283 nglmi_startup_fixed(sc_p sc, hook_p hook)
284 {
285 	sc->flags |= (SCF_FIXED | SCF_CONNECTED);
286 	sc->lmi_channel = hook;
287 	nglmi_startup(sc);
288 }
289 
290 static void
291 nglmi_startup_auto(sc_p sc)
292 {
293 	sc->flags |= (SCF_AUTO | SCF_CONNECTED);
294 	sc->poll_state = 0;	/* reset state machine */
295 	sc->poll_count = 0;
296 	nglmi_startup(sc);
297 }
298 
299 static void
300 nglmi_startup(sc_p sc)
301 {
302 	sc->remote_seq = 0;
303 	sc->local_seq = 1;
304 	sc->seq_retries = 0;
305 	sc->livs = sc->liv_per_full - 1;
306 	/* start off the ticker in 1 sec */
307 	ng_callout(&sc->handle, sc->node, NULL, hz, LMI_ticker, NULL, 0);
308 }
309 
310 static void
311 nglmi_inquire(sc_p sc, int full)
312 {
313 	struct mbuf *m;
314 	struct ng_tag_prio *ptag;
315 	char   *cptr, *start;
316 	int     error;
317 
318 	if (sc->lmi_channel == NULL)
319 		return;
320 	MGETHDR(m, M_NOWAIT, MT_DATA);
321 	if (m == NULL) {
322 		log(LOG_ERR, "nglmi: unable to start up LMI processing\n");
323 		return;
324 	}
325 	m->m_pkthdr.rcvif = NULL;
326 
327 	/* Attach a tag to packet, marking it of link level state priority, so
328 	 * that device driver would put it in the beginning of queue */
329 
330 	ptag = (struct ng_tag_prio *)m_tag_alloc(NGM_GENERIC_COOKIE, NG_TAG_PRIO,
331 	    (sizeof(struct ng_tag_prio) - sizeof(struct m_tag)), M_NOWAIT);
332 	if (ptag != NULL) {	/* if it failed, well, it was optional anyhow */
333 		ptag->priority = NG_PRIO_LINKSTATE;
334 		ptag->discardability = -1;
335 		m_tag_prepend(m, &ptag->tag);
336 	}
337 
338 	m->m_data += 4;		/* leave some room for a header */
339 	cptr = start = mtod(m, char *);
340 	/* add in the header for an LMI inquiry. */
341 	*cptr++ = 0x03;		/* UI frame */
342 	if (GROUP4(sc))
343 		*cptr++ = 0x09;	/* proto discriminator */
344 	else
345 		*cptr++ = 0x08;	/* proto discriminator */
346 	*cptr++ = 0x00;		/* call reference */
347 	*cptr++ = 0x75;		/* inquiry */
348 
349 	/* If we are Annex-D, add locking shift to codeset 5. */
350 	if (ANNEXD(sc))
351 		*cptr++ = 0x95;	/* locking shift */
352 	/* Add a request type */
353 	if (ANNEXA(sc))
354 		*cptr++ = 0x51;	/* report type */
355 	else
356 		*cptr++ = 0x01;	/* report type */
357 	*cptr++ = 0x01;		/* size = 1 */
358 	if (full)
359 		*cptr++ = 0x00;	/* full */
360 	else
361 		*cptr++ = 0x01;	/* partial */
362 
363 	/* Add a link verification IE */
364 	if (ANNEXA(sc))
365 		*cptr++ = 0x53;	/* verification IE */
366 	else
367 		*cptr++ = 0x03;	/* verification IE */
368 	*cptr++ = 0x02;		/* 2 extra bytes */
369 	*cptr++ = sc->local_seq;
370 	*cptr++ = sc->remote_seq;
371 	sc->seq_retries++;
372 
373 	/* Send it */
374 	m->m_len = m->m_pkthdr.len = cptr - start;
375 	NG_SEND_DATA_ONLY(error, sc->lmi_channel, m);
376 
377 	/* If we've been sending requests for long enough, and there has
378 	 * been no response, then mark as DOWN, any DLCIs that are UP. */
379 	if (sc->seq_retries == LMI_PATIENCE) {
380 		int     count;
381 
382 		for (count = 0; count < MAXDLCI; count++)
383 			if (sc->dlci_state[count] == DLCI_UP)
384 				sc->dlci_state[count] = DLCI_DOWN;
385 	}
386 }
387 
388 /*
389  * State machine for LMI auto-detect. The transitions are ordered
390  * to try the more likely possibilities first.
391  */
392 static void
393 ngauto_state_machine(sc_p sc)
394 {
395 	if ((sc->poll_count <= 0) || (sc->poll_count > LMIPOLLSIZE)) {
396 		/* time to change states in the auto probe machine */
397 		/* capture wild values of poll_count while we are at it */
398 		sc->poll_count = LMIPOLLSIZE;
399 		sc->poll_state++;
400 	}
401 	switch (sc->poll_state) {
402 	case 7:
403 		log(LOG_WARNING, "nglmi: no response from exchange\n");
404 	default:		/* capture bad states */
405 		sc->poll_state = 1;
406 	case 1:
407 		sc->lmi_channel = sc->lmi_channel0;
408 		SETLMITYPE(sc, SCF_ANNEX_D);
409 		break;
410 	case 2:
411 		sc->lmi_channel = sc->lmi_channel1023;
412 		SETLMITYPE(sc, SCF_ANNEX_D);
413 		break;
414 	case 3:
415 		sc->lmi_channel = sc->lmi_channel0;
416 		SETLMITYPE(sc, SCF_ANNEX_A);
417 		break;
418 	case 4:
419 		sc->lmi_channel = sc->lmi_channel1023;
420 		SETLMITYPE(sc, SCF_GROUP4);
421 		break;
422 	case 5:
423 		sc->lmi_channel = sc->lmi_channel1023;
424 		SETLMITYPE(sc, SCF_ANNEX_A);
425 		break;
426 	case 6:
427 		sc->lmi_channel = sc->lmi_channel0;
428 		SETLMITYPE(sc, SCF_GROUP4);
429 		break;
430 	}
431 
432 	/* send an inquirey encoded appropriately */
433 	nglmi_inquire(sc, 0);
434 	sc->poll_count--;
435 }
436 
437 /*
438  * Receive a netgraph control message.
439  */
440 static int
441 nglmi_rcvmsg(node_p node, item_p item, hook_p lasthook)
442 {
443 	sc_p    sc = NG_NODE_PRIVATE(node);
444 	struct ng_mesg *resp = NULL;
445 	int     error = 0;
446 	struct ng_mesg *msg;
447 
448 	NGI_GET_MSG(item, msg);
449 	switch (msg->header.typecookie) {
450 	case NGM_GENERIC_COOKIE:
451 		switch (msg->header.cmd) {
452 		case NGM_TEXT_STATUS:
453 		    {
454 			char   *arg;
455 			int     pos, count;
456 
457 			NG_MKRESPONSE(resp, msg, NG_TEXTRESPONSE, M_NOWAIT);
458 			if (resp == NULL) {
459 				error = ENOMEM;
460 				break;
461 			}
462 			arg = resp->data;
463 			pos = sprintf(arg, "protocol %s ", sc->protoname);
464 			if (sc->flags & SCF_FIXED)
465 				pos += sprintf(arg + pos, "fixed\n");
466 			else if (sc->flags & SCF_AUTO)
467 				pos += sprintf(arg + pos, "auto-detecting\n");
468 			else
469 				pos += sprintf(arg + pos, "auto on dlci %d\n",
470 				    (sc->lmi_channel == sc->lmi_channel0) ?
471 				    0 : 1023);
472 			pos += sprintf(arg + pos,
473 			    "keepalive period: %d seconds\n", sc->liv_rate);
474 			pos += sprintf(arg + pos,
475 			    "unacknowledged keepalives: %ld\n",
476 			    sc->seq_retries);
477 			for (count = 0;
478 			     ((count <= MAXDLCI)
479 			      && (pos < (NG_TEXTRESPONSE - 20)));
480 			     count++) {
481 				if (sc->dlci_state[count]) {
482 					pos += sprintf(arg + pos,
483 					       "dlci %d %s\n", count,
484 					       (sc->dlci_state[count]
485 					== DLCI_UP) ? "up" : "down");
486 				}
487 			}
488 			resp->header.arglen = pos + 1;
489 			break;
490 		    }
491 		default:
492 			error = EINVAL;
493 			break;
494 		}
495 		break;
496 	case NGM_LMI_COOKIE:
497 		switch (msg->header.cmd) {
498 		case NGM_LMI_GET_STATUS:
499 		    {
500 			struct nglmistat *stat;
501 			int k;
502 
503 			NG_MKRESPONSE(resp, msg, sizeof(*stat), M_NOWAIT);
504 			if (!resp) {
505 				error = ENOMEM;
506 				break;
507 			}
508 			stat = (struct nglmistat *) resp->data;
509 			strncpy(stat->proto,
510 			     sc->protoname, sizeof(stat->proto) - 1);
511 			strncpy(stat->hook,
512 			      sc->protoname, sizeof(stat->hook) - 1);
513 			stat->autod = !!(sc->flags & SCF_AUTO);
514 			stat->fixed = !!(sc->flags & SCF_FIXED);
515 			for (k = 0; k <= MAXDLCI; k++) {
516 				switch (sc->dlci_state[k]) {
517 				case DLCI_UP:
518 					stat->up[k / 8] |= (1 << (k % 8));
519 					/* fall through */
520 				case DLCI_DOWN:
521 					stat->seen[k / 8] |= (1 << (k % 8));
522 					break;
523 				}
524 			}
525 			break;
526 		    }
527 		default:
528 			error = EINVAL;
529 			break;
530 		}
531 		break;
532 	default:
533 		error = EINVAL;
534 		break;
535 	}
536 
537 	NG_RESPOND_MSG(error, node, item, resp);
538 	NG_FREE_MSG(msg);
539 	return (error);
540 }
541 
542 #define STEPBY(stepsize)			\
543 	do {					\
544 		packetlen -= (stepsize);	\
545 		data += (stepsize);		\
546 	} while (0)
547 
548 /*
549  * receive data, and use it to update our status.
550  * Anything coming in on the debug port is discarded.
551  */
552 static int
553 nglmi_rcvdata(hook_p hook, item_p item)
554 {
555 	sc_p    sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
556 	const	u_char *data;
557 	unsigned short dlci;
558 	u_short packetlen;
559 	int     resptype_seen = 0;
560 	struct mbuf *m;
561 
562 	NGI_GET_M(item, m);
563 	NG_FREE_ITEM(item);
564 	if (NG_HOOK_PRIVATE(hook) == NULL) {
565 		goto drop;
566 	}
567 	packetlen = m->m_len;
568 
569 	/* XXX what if it's more than 1 mbuf? */
570 	if ((packetlen > MHLEN) && !(m->m_flags & M_EXT)) {
571 		log(LOG_WARNING, "nglmi: packetlen (%d) too big\n", packetlen);
572 		goto drop;
573 	}
574 	if (m->m_len < packetlen && (m = m_pullup(m, packetlen)) == NULL) {
575 		log(LOG_WARNING,
576 		    "nglmi: m_pullup failed for %d bytes\n", packetlen);
577 		return (0);
578 	}
579 	if (nglmi_checkdata(hook, m) == 0)
580 		return (0);
581 
582 	/* pass the first 4 bytes (already checked in the nglmi_checkdata()) */
583 	data = mtod(m, const u_char *);
584 	STEPBY(4);
585 
586 	/* Now check if there is a 'locking shift'. This is only seen in
587 	 * Annex D frames. don't bother checking, we already did that. Don't
588 	 * increment immediately as it might not be there. */
589 	if (ANNEXD(sc))
590 		STEPBY(1);
591 
592 	/* If we get this far we should consider that it is a legitimate
593 	 * frame and we know what it is. */
594 	if (sc->flags & SCF_AUTO) {
595 		/* note the hook that this valid channel came from and drop
596 		 * out of auto probe mode. */
597 		if (ANNEXA(sc))
598 			sc->protoname = NAME_ANNEXA;
599 		else if (ANNEXD(sc))
600 			sc->protoname = NAME_ANNEXD;
601 		else if (GROUP4(sc))
602 			sc->protoname = NAME_GROUP4;
603 		else {
604 			log(LOG_ERR, "nglmi: No known type\n");
605 			goto drop;
606 		}
607 		sc->lmi_channel = hook;
608 		sc->flags &= ~SCF_AUTO;
609 		log(LOG_INFO, "nglmi: auto-detected %s LMI on DLCI %d\n",
610 		    sc->protoname, hook == sc->lmi_channel0 ? 0 : 1023);
611 	}
612 
613 	/* While there is more data in the status packet, keep processing
614 	 * status items. First make sure there is enough data for the
615 	 * segment descriptor's length field. */
616 	while (packetlen >= 2) {
617 		u_int   segtype = data[0];
618 		u_int   segsize = data[1];
619 
620 		/* Now that we know how long it claims to be, make sure
621 		 * there is enough data for the next seg. */
622 		if (packetlen < segsize + 2)
623 			break;
624 		switch (segtype) {
625 		case 0x01:
626 		case 0x51:
627 			if (resptype_seen) {
628 				log(LOG_WARNING, "nglmi: dup MSGTYPE\n");
629 				goto nextIE;
630 			}
631 			resptype_seen++;
632 			/* The remote end tells us what kind of response
633 			 * this is. Only expect a type 0 or 1. if we are a
634 			 * full status, invalidate a few DLCIs just to see
635 			 * that they are still ok. */
636 			if (segsize != 1)
637 				goto nextIE;
638 			switch (data[2]) {
639 			case 1:
640 				/* partial status, do no extra processing */
641 				break;
642 			case 0:
643 			    {
644 				int     count = 0;
645 				int     idx = sc->invalidx;
646 
647 				for (count = 0; count < 10; count++) {
648 					if (idx > MAXDLCI)
649 						idx = 0;
650 					if (sc->dlci_state[idx] == DLCI_UP)
651 						sc->dlci_state[idx] = DLCI_DOWN;
652 					idx++;
653 				}
654 				sc->invalidx = idx;
655 				/* we got and we wanted one. relax
656 				 * now.. but don't reset to 0 if it
657 				 * was unrequested. */
658 				if (sc->livs > sc->liv_per_full)
659 					sc->livs = 0;
660 				break;
661 			    }
662 			}
663 			break;
664 		case 0x03:
665 		case 0x53:
666 			/* The remote tells us what it thinks the sequence
667 			 * numbers are. If it's not size 2, it must be a
668 			 * duplicate to have gotten this far, skip it. */
669 			if (segsize != 2)
670 				goto nextIE;
671 			sc->remote_seq = data[2];
672 			if (sc->local_seq == data[3]) {
673 				sc->local_seq++;
674 				sc->seq_retries = 0;
675 				/* Note that all 3 Frame protocols seem to
676 				 * not like 0 as a sequence number. */
677 				if (sc->local_seq == 0)
678 					sc->local_seq = 1;
679 			}
680 			break;
681 		case 0x07:
682 		case 0x57:
683 			/* The remote tells us about a DLCI that it knows
684 			 * about. There may be many of these in a single
685 			 * status response */
686 			switch (segsize) {
687 			case 6:/* only on 'group of 4' */
688 				dlci = ((u_short) data[2] & 0xff) << 8;
689 				dlci |= (data[3] & 0xff);
690 				if ((dlci < 1024) && (dlci > 0)) {
691 				  /* XXX */
692 				}
693 				break;
694 			case 3:
695 				dlci = ((u_short) data[2] & 0x3f) << 4;
696 				dlci |= ((data[3] & 0x78) >> 3);
697 				if ((dlci < 1024) && (dlci > 0)) {
698 					/* set up the bottom half of the
699 					 * support for that dlci if it's not
700 					 * already been done */
701 					/* store this information somewhere */
702 				}
703 				break;
704 			default:
705 				goto nextIE;
706 			}
707 			if (sc->dlci_state[dlci] != DLCI_UP) {
708 				/* bring new DLCI to life */
709 				/* may do more here some day */
710 				if (sc->dlci_state[dlci] != DLCI_DOWN)
711 					log(LOG_INFO,
712 					    "nglmi: DLCI %d became active\n",
713 					    dlci);
714 				sc->dlci_state[dlci] = DLCI_UP;
715 			}
716 			break;
717 		}
718 nextIE:
719 		STEPBY(segsize + 2);
720 	}
721 	NG_FREE_M(m);
722 	return (0);
723 
724 drop:
725 	NG_FREE_M(m);
726 	return (EINVAL);
727 }
728 
729 /*
730  * Check that a packet is entirely kosha.
731  * return 1 of ok, and 0 if not.
732  * All data is discarded if a 0 is returned.
733  */
734 static int
735 nglmi_checkdata(hook_p hook, struct mbuf *m)
736 {
737 	sc_p    sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
738 	const	u_char *data;
739 	u_short packetlen;
740 	unsigned short dlci;
741 	u_char  type;
742 	u_char  nextbyte;
743 	int     seq_seen = 0;
744 	int     resptype_seen = 0;	/* 0 , 1 (partial) or 2 (full) */
745 	int     highest_dlci = 0;
746 
747 	packetlen = m->m_len;
748 	data = mtod(m, const u_char *);
749 	if (*data != 0x03) {
750 		log(LOG_WARNING, "nglmi: unexpected value in LMI(%d)\n", 1);
751 		goto reject;
752 	}
753 	STEPBY(1);
754 
755 	/* look at the protocol ID */
756 	nextbyte = *data;
757 	if (sc->flags & SCF_AUTO) {
758 		SETLMITYPE(sc, SCF_NOLMI);	/* start with a clean slate */
759 		switch (nextbyte) {
760 		case 0x8:
761 			sc->protoID = 8;
762 			break;
763 		case 0x9:
764 			SETLMITYPE(sc, SCF_GROUP4);
765 			sc->protoID = 9;
766 			break;
767 		default:
768 			log(LOG_WARNING, "nglmi: bad Protocol ID(%d)\n",
769 			    (int) nextbyte);
770 			goto reject;
771 		}
772 	} else {
773 		if (nextbyte != sc->protoID) {
774 			log(LOG_WARNING, "nglmi: unexpected Protocol ID(%d)\n",
775 			    (int) nextbyte);
776 			goto reject;
777 		}
778 	}
779 	STEPBY(1);
780 
781 	/* check call reference (always null in non ISDN frame relay) */
782 	if (*data != 0x00) {
783 		log(LOG_WARNING, "nglmi: unexpected Call Reference (0x%x)\n",
784 		    data[-1]);
785 		goto reject;
786 	}
787 	STEPBY(1);
788 
789 	/* check message type */
790 	switch ((type = *data)) {
791 	case 0x75:		/* Status enquiry */
792 		log(LOG_WARNING, "nglmi: unexpected message type(0x%x)\n",
793 		    data[-1]);
794 		goto reject;
795 	case 0x7D:		/* Status message */
796 		break;
797 	default:
798 		log(LOG_WARNING,
799 		    "nglmi: unexpected msg type(0x%x) \n", (int) type);
800 		goto reject;
801 	}
802 	STEPBY(1);
803 
804 	/* Now check if there is a 'locking shift'. This is only seen in
805 	 * Annex D frames. Don't increment immediately as it might not be
806 	 * there. */
807 	nextbyte = *data;
808 	if (sc->flags & SCF_AUTO) {
809 		if (!(GROUP4(sc))) {
810 			if (nextbyte == 0x95) {
811 				SETLMITYPE(sc, SCF_ANNEX_D);
812 				STEPBY(1);
813 			} else
814 				SETLMITYPE(sc, SCF_ANNEX_A);
815 		} else if (nextbyte == 0x95) {
816 			log(LOG_WARNING, "nglmi: locking shift seen in G4\n");
817 			goto reject;
818 		}
819 	} else {
820 		if (ANNEXD(sc)) {
821 			if (*data == 0x95)
822 				STEPBY(1);
823 			else {
824 				log(LOG_WARNING,
825 				    "nglmi: locking shift missing\n");
826 				goto reject;
827 			}
828 		} else if (*data == 0x95) {
829 			log(LOG_WARNING, "nglmi: locking shift seen\n");
830 			goto reject;
831 		}
832 	}
833 
834 	/* While there is more data in the status packet, keep processing
835 	 * status items. First make sure there is enough data for the
836 	 * segment descriptor's length field. */
837 	while (packetlen >= 2) {
838 		u_int   segtype = data[0];
839 		u_int   segsize = data[1];
840 
841 		/* Now that we know how long it claims to be, make sure
842 		 * there is enough data for the next seg. */
843 		if (packetlen < (segsize + 2)) {
844 			log(LOG_WARNING, "nglmi: IE longer than packet\n");
845 			break;
846 		}
847 		switch (segtype) {
848 		case 0x01:
849 		case 0x51:
850 			/* According to MCI's HP analyser, we should just
851 			 * ignore if there is mor ethan one of these (?). */
852 			if (resptype_seen) {
853 				log(LOG_WARNING, "nglmi: dup MSGTYPE\n");
854 				goto nextIE;
855 			}
856 			if (segsize != 1) {
857 				log(LOG_WARNING, "nglmi: MSGTYPE wrong size\n");
858 				goto reject;
859 			}
860 			/* The remote end tells us what kind of response
861 			 * this is. Only expect a type 0 or 1. if it was a
862 			 * full (type 0) check we just asked for a type
863 			 * full. */
864 			switch (data[2]) {
865 			case 1:/* partial */
866 				if (sc->livs > sc->liv_per_full) {
867 					log(LOG_WARNING,
868 					  "nglmi: LIV when FULL expected\n");
869 					goto reject;	/* need full */
870 				}
871 				resptype_seen = 1;
872 				break;
873 			case 0:/* full */
874 				/* Full response is always acceptable */
875 				resptype_seen = 2;
876 				break;
877 			default:
878 				log(LOG_WARNING,
879 				 "nglmi: Unknown report type %d\n", data[2]);
880 				goto reject;
881 			}
882 			break;
883 		case 0x03:
884 		case 0x53:
885 			/* The remote tells us what it thinks the sequence
886 			 * numbers are. I would have thought that there
887 			 * needs to be one and only one of these, but MCI
888 			 * want us to just ignore extras. (?) */
889 			if (resptype_seen == 0) {
890 				log(LOG_WARNING, "nglmi: no TYPE before SEQ\n");
891 				goto reject;
892 			}
893 			if (seq_seen != 0)	/* already seen seq numbers */
894 				goto nextIE;
895 			if (segsize != 2) {
896 				log(LOG_WARNING, "nglmi: bad SEQ sts size\n");
897 				goto reject;
898 			}
899 			if (sc->local_seq != data[3]) {
900 				log(LOG_WARNING, "nglmi: unexpected SEQ\n");
901 				goto reject;
902 			}
903 			seq_seen = 1;
904 			break;
905 		case 0x07:
906 		case 0x57:
907 			/* The remote tells us about a DLCI that it knows
908 			 * about. There may be many of these in a single
909 			 * status response */
910 			if (seq_seen != 1) {	/* already seen seq numbers? */
911 				log(LOG_WARNING,
912 				    "nglmi: No sequence before DLCI\n");
913 				goto reject;
914 			}
915 			if (resptype_seen != 2) {	/* must be full */
916 				log(LOG_WARNING,
917 				    "nglmi: No resp type before DLCI\n");
918 				goto reject;
919 			}
920 			if (GROUP4(sc)) {
921 				if (segsize != 6) {
922 					log(LOG_WARNING,
923 					    "nglmi: wrong IE segsize\n");
924 					goto reject;
925 				}
926 				dlci = ((u_short) data[2] & 0xff) << 8;
927 				dlci |= (data[3] & 0xff);
928 			} else {
929 				if (segsize != 3) {
930 					log(LOG_WARNING,
931 					    "nglmi: DLCI headersize of %d"
932 					    " not supported\n", segsize - 1);
933 					goto reject;
934 				}
935 				dlci = ((u_short) data[2] & 0x3f) << 4;
936 				dlci |= ((data[3] & 0x78) >> 3);
937 			}
938 			/* async can only have one of these */
939 #if 0				/* async not yet accepted */
940 			if (async && highest_dlci) {
941 				log(LOG_WARNING,
942 				    "nglmi: Async with > 1 DLCI\n");
943 				goto reject;
944 			}
945 #endif
946 			/* Annex D says these will always be Ascending, but
947 			 * the HP test for G4 says we should accept
948 			 * duplicates, so for now allow that. ( <= vs. < ) */
949 #if 0
950 			/* MCI tests want us to accept out of order for AnxD */
951 			if ((!GROUP4(sc)) && (dlci < highest_dlci)) {
952 				/* duplicate or mis-ordered dlci */
953 				/* (spec says they will increase in number) */
954 				log(LOG_WARNING, "nglmi: DLCI out of order\n");
955 				goto reject;
956 			}
957 #endif
958 			if (dlci > 1023) {
959 				log(LOG_WARNING, "nglmi: DLCI out of range\n");
960 				goto reject;
961 			}
962 			highest_dlci = dlci;
963 			break;
964 		default:
965 			log(LOG_WARNING,
966 			    "nglmi: unknown LMI segment type %d\n", segtype);
967 		}
968 nextIE:
969 		STEPBY(segsize + 2);
970 	}
971 	if (packetlen != 0) {	/* partial junk at end? */
972 		log(LOG_WARNING,
973 		    "nglmi: %d bytes extra at end of packet\n", packetlen);
974 		goto print;
975 	}
976 	if (resptype_seen == 0) {
977 		log(LOG_WARNING, "nglmi: No response type seen\n");
978 		goto reject;	/* had no response type */
979 	}
980 	if (seq_seen == 0) {
981 		log(LOG_WARNING, "nglmi: No sequence numbers seen\n");
982 		goto reject;	/* had no sequence numbers */
983 	}
984 	return (1);
985 
986 print:
987 	{
988 		int     i, j, k, pos;
989 		char    buf[100];
990 		int     loc;
991 		const	u_char *bp = mtod(m, const u_char *);
992 
993 		k = i = 0;
994 		loc = (m->m_len - packetlen);
995 		log(LOG_WARNING, "nglmi: error at location %d\n", loc);
996 		while (k < m->m_len) {
997 			pos = 0;
998 			j = 0;
999 			while ((j++ < 16) && k < m->m_len) {
1000 				pos += sprintf(buf + pos, "%c%02x",
1001 					       ((loc == k) ? '>' : ' '),
1002 					       bp[k]);
1003 				k++;
1004 			}
1005 			if (i == 0)
1006 				log(LOG_WARNING, "nglmi: packet data:%s\n", buf);
1007 			else
1008 				log(LOG_WARNING, "%04d              :%s\n", k, buf);
1009 			i++;
1010 		}
1011 	}
1012 	return (1);
1013 reject:
1014 	{
1015 		int     i, j, k, pos;
1016 		char    buf[100];
1017 		int     loc;
1018 		const	u_char *bp = mtod(m, const u_char *);
1019 
1020 		k = i = 0;
1021 		loc = (m->m_len - packetlen);
1022 		log(LOG_WARNING, "nglmi: error at location %d\n", loc);
1023 		while (k < m->m_len) {
1024 			pos = 0;
1025 			j = 0;
1026 			while ((j++ < 16) && k < m->m_len) {
1027 				pos += sprintf(buf + pos, "%c%02x",
1028 					       ((loc == k) ? '>' : ' '),
1029 					       bp[k]);
1030 				k++;
1031 			}
1032 			if (i == 0)
1033 				log(LOG_WARNING, "nglmi: packet data:%s\n", buf);
1034 			else
1035 				log(LOG_WARNING, "%04d              :%s\n", k, buf);
1036 			i++;
1037 		}
1038 	}
1039 	NG_FREE_M(m);
1040 	return (0);
1041 }
1042 
1043 /*
1044  * Do local shutdown processing..
1045  * Cut any remaining links and free our local resources.
1046  */
1047 static int
1048 nglmi_shutdown(node_p node)
1049 {
1050 	const sc_p sc = NG_NODE_PRIVATE(node);
1051 
1052 	NG_NODE_SET_PRIVATE(node, NULL);
1053 	NG_NODE_UNREF(sc->node);
1054 	free(sc, M_NETGRAPH);
1055 	return (0);
1056 }
1057 
1058 /*
1059  * Hook disconnection
1060  * For this type, removal of any link except "debug" destroys the node.
1061  */
1062 static int
1063 nglmi_disconnect(hook_p hook)
1064 {
1065 	const sc_p sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1066 
1067 	/* OK to remove debug hook(s) */
1068 	if (NG_HOOK_PRIVATE(hook) == NULL)
1069 		return (0);
1070 
1071 	/* Stop timer if it's currently active */
1072 	if (sc->flags & SCF_CONNECTED)
1073 		ng_uncallout(&sc->handle, sc->node);
1074 
1075 	/* Self-destruct */
1076 	if (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))
1077 		ng_rmnode_self(NG_HOOK_NODE(hook));
1078 	return (0);
1079 }
1080 
1081