xref: /freebsd/sys/netgraph/ng_lmi.c (revision 6b3455a7665208c366849f0b2b3bc916fb97516e)
1 
2 /*
3  * ng_lmi.c
4  *
5  * Copyright (c) 1996-1999 Whistle Communications, Inc.
6  * All rights reserved.
7  *
8  * Subject to the following obligations and disclaimer of warranty, use and
9  * redistribution of this software, in source or object code forms, with or
10  * without modifications are expressly permitted by Whistle Communications;
11  * provided, however, that:
12  * 1. Any and all reproductions of the source or object code must include the
13  *    copyright notice above and the following disclaimer of warranties; and
14  * 2. No rights are granted, in any manner or form, to use Whistle
15  *    Communications, Inc. trademarks, including the mark "WHISTLE
16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
17  *    such appears in the above copyright notice or in the software.
18  *
19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
35  * OF SUCH DAMAGE.
36  *
37  * Author: Julian Elischer <julian@freebsd.org>
38  *
39  * $FreeBSD$
40  * $Whistle: ng_lmi.c,v 1.38 1999/11/01 09:24:52 julian Exp $
41  */
42 
43 /*
44  * This node performs the frame relay LMI protocol. It knows how
45  * to do ITU Annex A, ANSI Annex D, and "Group-of-Four" variants
46  * of the protocol.
47  *
48  * A specific protocol can be forced by connecting the corresponding
49  * hook to DLCI 0 or 1023 (as appropriate) of a frame relay link.
50  *
51  * Alternately, this node can do auto-detection of the LMI protocol
52  * by connecting hook "auto0" to DLCI 0 and "auto1023" to DLCI 1023.
53  */
54 
55 #include <sys/param.h>
56 #include <sys/systm.h>
57 #include <sys/errno.h>
58 #include <sys/kernel.h>
59 #include <sys/malloc.h>
60 #include <sys/mbuf.h>
61 #include <sys/syslog.h>
62 #include <netgraph/ng_message.h>
63 #include <netgraph/netgraph.h>
64 #include <netgraph/ng_lmi.h>
65 
66 /*
67  * Human readable names for LMI
68  */
69 #define NAME_ANNEXA	NG_LMI_HOOK_ANNEXA
70 #define NAME_ANNEXD	NG_LMI_HOOK_ANNEXD
71 #define NAME_GROUP4	NG_LMI_HOOK_GROUPOF4
72 #define NAME_NONE	"None"
73 
74 #define MAX_DLCIS	128
75 #define MAXDLCI		1023
76 
77 /*
78  * DLCI states
79  */
80 #define DLCI_NULL	0
81 #define DLCI_UP		1
82 #define DLCI_DOWN	2
83 
84 /*
85  * Any received LMI frame should be at least this long
86  */
87 #define LMI_MIN_LENGTH	8	/* XXX verify */
88 
89 /*
90  * Netgraph node methods and type descriptor
91  */
92 static ng_constructor_t	nglmi_constructor;
93 static ng_rcvmsg_t	nglmi_rcvmsg;
94 static ng_shutdown_t	nglmi_shutdown;
95 static ng_newhook_t	nglmi_newhook;
96 static ng_rcvdata_t	nglmi_rcvdata;
97 static ng_disconnect_t	nglmi_disconnect;
98 static int	nglmi_checkdata(hook_p hook, struct mbuf *m);
99 
100 static struct ng_type typestruct = {
101 	.version =	NG_ABI_VERSION,
102 	.name =		NG_LMI_NODE_TYPE,
103 	.constructor =	nglmi_constructor,
104 	.rcvmsg	=	nglmi_rcvmsg,
105 	.shutdown =	nglmi_shutdown,
106 	.newhook =	nglmi_newhook,
107 	.rcvdata =	nglmi_rcvdata,
108 	.disconnect =	nglmi_disconnect,
109 };
110 NETGRAPH_INIT(lmi, &typestruct);
111 
112 /*
113  * Info and status per node
114  */
115 struct nglmi_softc {
116 	node_p  node;		/* netgraph node */
117 	int     flags;		/* state */
118 	int     poll_count;	/* the count of times for autolmi */
119 	int     poll_state;	/* state of auto detect machine */
120 	u_char  remote_seq;	/* sequence number the remote sent */
121 	u_char  local_seq;	/* last sequence number we sent */
122 	u_char  protoID;	/* 9 for group of 4, 8 otherwise */
123 	u_long  seq_retries;	/* sent this how many time so far */
124 	struct callout_handle handle;	/* see timeout(9) */
125 	int     liv_per_full;
126 	int     liv_rate;
127 	int     livs;
128 	int     need_full;
129 	hook_p  lmi_channel;	/* whatever we ended up using */
130 	hook_p  lmi_annexA;
131 	hook_p  lmi_annexD;
132 	hook_p  lmi_group4;
133 	hook_p  lmi_channel0;	/* auto-detect on DLCI 0 */
134 	hook_p  lmi_channel1023;/* auto-detect on DLCI 1023 */
135 	char   *protoname;	/* cache protocol name */
136 	u_char  dlci_state[MAXDLCI + 1];
137 	int     invalidx;	/* next dlci's to invalidate */
138 };
139 typedef struct nglmi_softc *sc_p;
140 
141 /*
142  * Other internal functions
143  */
144 static void	LMI_ticker(void *arg);
145 static void	nglmi_startup_fixed(sc_p sc, hook_p hook);
146 static void	nglmi_startup_auto(sc_p sc);
147 static void	nglmi_startup(sc_p sc);
148 static void	nglmi_inquire(sc_p sc, int full);
149 static void	ngauto_state_machine(sc_p sc);
150 
151 /*
152  * Values for 'flags' field
153  * NB: the SCF_CONNECTED flag is set if and only if the timer is running.
154  */
155 #define	SCF_CONNECTED	0x01	/* connected to something */
156 #define	SCF_AUTO	0x02	/* we are auto-detecting */
157 #define	SCF_FIXED	0x04	/* we are fixed from the start */
158 
159 #define	SCF_LMITYPE	0x18	/* mask for determining Annex mode */
160 #define	SCF_NOLMI	0x00	/* no LMI type selected yet */
161 #define	SCF_ANNEX_A	0x08	/* running annex A mode */
162 #define	SCF_ANNEX_D	0x10	/* running annex D mode */
163 #define	SCF_GROUP4	0x18	/* running group of 4 */
164 
165 #define SETLMITYPE(sc, annex)						\
166 do {									\
167 	(sc)->flags &= ~SCF_LMITYPE;					\
168 	(sc)->flags |= (annex);						\
169 } while (0)
170 
171 #define NOPROTO(sc) (((sc)->flags & SCF_LMITYPE) == SCF_NOLMI)
172 #define ANNEXA(sc) (((sc)->flags & SCF_LMITYPE) == SCF_ANNEX_A)
173 #define ANNEXD(sc) (((sc)->flags & SCF_LMITYPE) == SCF_ANNEX_D)
174 #define GROUP4(sc) (((sc)->flags & SCF_LMITYPE) == SCF_GROUP4)
175 
176 #define LMIPOLLSIZE	3
177 #define LMI_PATIENCE	8	/* declare all DLCI DOWN after N LMI failures */
178 
179 /*
180  * Node constructor
181  */
182 static int
183 nglmi_constructor(node_p node)
184 {
185 	sc_p sc;
186 
187 	MALLOC(sc, sc_p, sizeof(*sc), M_NETGRAPH, M_NOWAIT | M_ZERO);
188 	if (sc == NULL)
189 		return (ENOMEM);
190 	callout_handle_init(&sc->handle);
191 	NG_NODE_SET_PRIVATE(node, sc);
192 	sc->protoname = NAME_NONE;
193 	sc->node = node;
194 	sc->liv_per_full = NG_LMI_SEQ_PER_FULL;	/* make this dynamic */
195 	sc->liv_rate = NG_LMI_KEEPALIVE_RATE;
196 	return (0);
197 }
198 
199 /*
200  * The LMI channel has a private pointer which is the same as the
201  * node private pointer. The debug channel has a NULL private pointer.
202  */
203 static int
204 nglmi_newhook(node_p node, hook_p hook, const char *name)
205 {
206 	sc_p sc = NG_NODE_PRIVATE(node);
207 
208 	if (strcmp(name, NG_LMI_HOOK_DEBUG) == 0) {
209 		NG_HOOK_SET_PRIVATE(hook, NULL);
210 		return (0);
211 	}
212 	if (sc->flags & SCF_CONNECTED) {
213 		/* already connected, return an error */
214 		return (EINVAL);
215 	}
216 	if (strcmp(name, NG_LMI_HOOK_ANNEXA) == 0) {
217 		sc->lmi_annexA = hook;
218 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
219 		sc->protoID = 8;
220 		SETLMITYPE(sc, SCF_ANNEX_A);
221 		sc->protoname = NAME_ANNEXA;
222 		nglmi_startup_fixed(sc, hook);
223 	} else if (strcmp(name, NG_LMI_HOOK_ANNEXD) == 0) {
224 		sc->lmi_annexD = hook;
225 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
226 		sc->protoID = 8;
227 		SETLMITYPE(sc, SCF_ANNEX_D);
228 		sc->protoname = NAME_ANNEXD;
229 		nglmi_startup_fixed(sc, hook);
230 	} else if (strcmp(name, NG_LMI_HOOK_GROUPOF4) == 0) {
231 		sc->lmi_group4 = hook;
232 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
233 		sc->protoID = 9;
234 		SETLMITYPE(sc, SCF_GROUP4);
235 		sc->protoname = NAME_GROUP4;
236 		nglmi_startup_fixed(sc, hook);
237 	} else if (strcmp(name, NG_LMI_HOOK_AUTO0) == 0) {
238 		/* Note this, and if B is already installed, we're complete */
239 		sc->lmi_channel0 = hook;
240 		sc->protoname = NAME_NONE;
241 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
242 		if (sc->lmi_channel1023)
243 			nglmi_startup_auto(sc);
244 	} else if (strcmp(name, NG_LMI_HOOK_AUTO1023) == 0) {
245 		/* Note this, and if A is already installed, we're complete */
246 		sc->lmi_channel1023 = hook;
247 		sc->protoname = NAME_NONE;
248 		NG_HOOK_SET_PRIVATE(hook, NG_NODE_PRIVATE(node));
249 		if (sc->lmi_channel0)
250 			nglmi_startup_auto(sc);
251 	} else
252 		return (EINVAL);		/* unknown hook */
253 	return (0);
254 }
255 
256 /*
257  * We have just attached to a live (we hope) node.
258  * Fire out a LMI inquiry, and then start up the timers.
259  */
260 static void
261 LMI_ticker(void *arg)
262 {
263 	sc_p sc = arg;
264 	int s = splnet();
265 
266 	if (sc->flags & SCF_AUTO) {
267 		ngauto_state_machine(sc);
268 		sc->handle = timeout(LMI_ticker, sc, NG_LMI_POLL_RATE * hz);
269 	} else {
270 		if (sc->livs++ >= sc->liv_per_full) {
271 			nglmi_inquire(sc, 1);
272 			/* sc->livs = 0; *//* do this when we get the answer! */
273 		} else {
274 			nglmi_inquire(sc, 0);
275 		}
276 		sc->handle = timeout(LMI_ticker, sc, sc->liv_rate * hz);
277 	}
278 	splx(s);
279 }
280 
281 static void
282 nglmi_startup_fixed(sc_p sc, hook_p hook)
283 {
284 	sc->flags |= (SCF_FIXED | SCF_CONNECTED);
285 	sc->lmi_channel = hook;
286 	nglmi_startup(sc);
287 }
288 
289 static void
290 nglmi_startup_auto(sc_p sc)
291 {
292 	sc->flags |= (SCF_AUTO | SCF_CONNECTED);
293 	sc->poll_state = 0;	/* reset state machine */
294 	sc->poll_count = 0;
295 	nglmi_startup(sc);
296 }
297 
298 static void
299 nglmi_startup(sc_p sc)
300 {
301 	sc->remote_seq = 0;
302 	sc->local_seq = 1;
303 	sc->seq_retries = 0;
304 	sc->livs = sc->liv_per_full - 1;
305 	/* start off the ticker in 1 sec */
306 	sc->handle = timeout(LMI_ticker, sc, hz);
307 }
308 
309 static void
310 nglmi_inquire(sc_p sc, int full)
311 {
312 	struct mbuf *m;
313 	struct ng_tag_prio *ptag;
314 	char   *cptr, *start;
315 	int     error;
316 
317 	if (sc->lmi_channel == NULL)
318 		return;
319 	MGETHDR(m, M_DONTWAIT, MT_DATA);
320 	if (m == NULL) {
321 		log(LOG_ERR, "nglmi: unable to start up LMI processing\n");
322 		return;
323 	}
324 	m->m_pkthdr.rcvif = NULL;
325 
326 	/* Attach a tag to packet, marking it of link level state priority, so
327 	 * that device driver would put it in the beginning of queue */
328 
329 	ptag = (struct ng_tag_prio *)m_tag_alloc(NGM_GENERIC_COOKIE, NG_TAG_PRIO,
330 	    (sizeof(struct ng_tag_prio) - sizeof(struct m_tag)), M_NOWAIT);
331 	if (ptag != NULL) {	/* if it failed, well, it was optional anyhow */
332 		ptag->priority = NG_PRIO_LINKSTATE;
333 		ptag->discardability = -1;
334 		m_tag_prepend(m, &ptag->tag);
335 	}
336 
337 	m->m_data += 4;		/* leave some room for a header */
338 	cptr = start = mtod(m, char *);
339 	/* add in the header for an LMI inquiry. */
340 	*cptr++ = 0x03;		/* UI frame */
341 	if (GROUP4(sc))
342 		*cptr++ = 0x09;	/* proto discriminator */
343 	else
344 		*cptr++ = 0x08;	/* proto discriminator */
345 	*cptr++ = 0x00;		/* call reference */
346 	*cptr++ = 0x75;		/* inquiry */
347 
348 	/* If we are Annex-D, there is this extra thing.. */
349 	if (ANNEXD(sc))
350 		*cptr++ = 0x95;	/* ??? */
351 	/* Add a request type */
352 	if (ANNEXA(sc))
353 		*cptr++ = 0x51;	/* report type */
354 	else
355 		*cptr++ = 0x01;	/* report type */
356 	*cptr++ = 0x01;		/* size = 1 */
357 	if (full)
358 		*cptr++ = 0x00;	/* full */
359 	else
360 		*cptr++ = 0x01;	/* partial */
361 
362 	/* Add a link verification IE */
363 	if (ANNEXA(sc))
364 		*cptr++ = 0x53;	/* verification IE */
365 	else
366 		*cptr++ = 0x03;	/* verification IE */
367 	*cptr++ = 0x02;		/* 2 extra bytes */
368 	*cptr++ = sc->local_seq;
369 	*cptr++ = sc->remote_seq;
370 	sc->seq_retries++;
371 
372 	/* Send it */
373 	m->m_len = m->m_pkthdr.len = cptr - start;
374 	NG_SEND_DATA_ONLY(error, sc->lmi_channel, m);
375 
376 	/* If we've been sending requests for long enough, and there has
377 	 * been no response, then mark as DOWN, any DLCIs that are UP. */
378 	if (sc->seq_retries == LMI_PATIENCE) {
379 		int     count;
380 
381 		for (count = 0; count < MAXDLCI; count++)
382 			if (sc->dlci_state[count] == DLCI_UP)
383 				sc->dlci_state[count] = DLCI_DOWN;
384 	}
385 }
386 
387 /*
388  * State machine for LMI auto-detect. The transitions are ordered
389  * to try the more likely possibilities first.
390  */
391 static void
392 ngauto_state_machine(sc_p sc)
393 {
394 	if ((sc->poll_count <= 0) || (sc->poll_count > LMIPOLLSIZE)) {
395 		/* time to change states in the auto probe machine */
396 		/* capture wild values of poll_count while we are at it */
397 		sc->poll_count = LMIPOLLSIZE;
398 		sc->poll_state++;
399 	}
400 	switch (sc->poll_state) {
401 	case 7:
402 		log(LOG_WARNING, "nglmi: no response from exchange\n");
403 	default:		/* capture bad states */
404 		sc->poll_state = 1;
405 	case 1:
406 		sc->lmi_channel = sc->lmi_channel0;
407 		SETLMITYPE(sc, SCF_ANNEX_D);
408 		break;
409 	case 2:
410 		sc->lmi_channel = sc->lmi_channel1023;
411 		SETLMITYPE(sc, SCF_ANNEX_D);
412 		break;
413 	case 3:
414 		sc->lmi_channel = sc->lmi_channel0;
415 		SETLMITYPE(sc, SCF_ANNEX_A);
416 		break;
417 	case 4:
418 		sc->lmi_channel = sc->lmi_channel1023;
419 		SETLMITYPE(sc, SCF_GROUP4);
420 		break;
421 	case 5:
422 		sc->lmi_channel = sc->lmi_channel1023;
423 		SETLMITYPE(sc, SCF_ANNEX_A);
424 		break;
425 	case 6:
426 		sc->lmi_channel = sc->lmi_channel0;
427 		SETLMITYPE(sc, SCF_GROUP4);
428 		break;
429 	}
430 
431 	/* send an inquirey encoded appropriatly */
432 	nglmi_inquire(sc, 0);
433 	sc->poll_count--;
434 }
435 
436 /*
437  * Receive a netgraph control message.
438  */
439 static int
440 nglmi_rcvmsg(node_p node, item_p item, hook_p lasthook)
441 {
442 	sc_p    sc = NG_NODE_PRIVATE(node);
443 	struct ng_mesg *resp = NULL;
444 	int     error = 0;
445 	struct ng_mesg *msg;
446 
447 	NGI_GET_MSG(item, msg);
448 	switch (msg->header.typecookie) {
449 	case NGM_GENERIC_COOKIE:
450 		switch (msg->header.cmd) {
451 		case NGM_TEXT_STATUS:
452 		    {
453 			char   *arg;
454 			int     pos, count;
455 
456 			NG_MKRESPONSE(resp, msg, NG_TEXTRESPONSE, M_NOWAIT);
457 			if (resp == NULL) {
458 				error = ENOMEM;
459 				break;
460 			}
461 			arg = resp->data;
462 			pos = sprintf(arg, "protocol %s ", sc->protoname);
463 			if (sc->flags & SCF_FIXED)
464 				pos += sprintf(arg + pos, "fixed\n");
465 			else if (sc->flags & SCF_AUTO)
466 				pos += sprintf(arg + pos, "auto-detecting\n");
467 			else
468 				pos += sprintf(arg + pos, "auto on dlci %d\n",
469 				    (sc->lmi_channel == sc->lmi_channel0) ?
470 				    0 : 1023);
471 			pos += sprintf(arg + pos,
472 			    "keepalive period: %d seconds\n", sc->liv_rate);
473 			pos += sprintf(arg + pos,
474 			    "unacknowledged keepalives: %ld\n",
475 			    sc->seq_retries);
476 			for (count = 0;
477 			     ((count <= MAXDLCI)
478 			      && (pos < (NG_TEXTRESPONSE - 20)));
479 			     count++) {
480 				if (sc->dlci_state[count]) {
481 					pos += sprintf(arg + pos,
482 					       "dlci %d %s\n", count,
483 					       (sc->dlci_state[count]
484 					== DLCI_UP) ? "up" : "down");
485 				}
486 			}
487 			resp->header.arglen = pos + 1;
488 			break;
489 		    }
490 		default:
491 			error = EINVAL;
492 			break;
493 		}
494 		break;
495 	case NGM_LMI_COOKIE:
496 		switch (msg->header.cmd) {
497 		case NGM_LMI_GET_STATUS:
498 		    {
499 			struct nglmistat *stat;
500 			int k;
501 
502 			NG_MKRESPONSE(resp, msg, sizeof(*stat), M_NOWAIT);
503 			if (!resp) {
504 				error = ENOMEM;
505 				break;
506 			}
507 			stat = (struct nglmistat *) resp->data;
508 			strncpy(stat->proto,
509 			     sc->protoname, sizeof(stat->proto) - 1);
510 			strncpy(stat->hook,
511 			      sc->protoname, sizeof(stat->hook) - 1);
512 			stat->autod = !!(sc->flags & SCF_AUTO);
513 			stat->fixed = !!(sc->flags & SCF_FIXED);
514 			for (k = 0; k <= MAXDLCI; k++) {
515 				switch (sc->dlci_state[k]) {
516 				case DLCI_UP:
517 					stat->up[k / 8] |= (1 << (k % 8));
518 					/* fall through */
519 				case DLCI_DOWN:
520 					stat->seen[k / 8] |= (1 << (k % 8));
521 					break;
522 				}
523 			}
524 			break;
525 		    }
526 		default:
527 			error = EINVAL;
528 			break;
529 		}
530 		break;
531 	default:
532 		error = EINVAL;
533 		break;
534 	}
535 
536 	NG_RESPOND_MSG(error, node, item, resp);
537 	NG_FREE_MSG(msg);
538 	return (error);
539 }
540 
541 #define STEPBY(stepsize)			\
542 	do {					\
543 		packetlen -= (stepsize);	\
544 		data += (stepsize);		\
545 	} while (0)
546 
547 /*
548  * receive data, and use it to update our status.
549  * Anything coming in on the debug port is discarded.
550  */
551 static int
552 nglmi_rcvdata(hook_p hook, item_p item)
553 {
554 	sc_p    sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
555 	const	u_char *data;
556 	unsigned short dlci;
557 	u_short packetlen;
558 	int     resptype_seen = 0;
559 	int     seq_seen = 0;
560 	struct mbuf *m;
561 
562 	NGI_GET_M(item, m);
563 	NG_FREE_ITEM(item);
564 	if (NG_HOOK_PRIVATE(hook) == NULL) {
565 		goto drop;
566 	}
567 	packetlen = m->m_hdr.mh_len;
568 
569 	/* XXX what if it's more than 1 mbuf? */
570 	if ((packetlen > MHLEN) && !(m->m_flags & M_EXT)) {
571 		log(LOG_WARNING, "nglmi: packetlen (%d) too big\n", packetlen);
572 		goto drop;
573 	}
574 	if (m->m_len < packetlen && (m = m_pullup(m, packetlen)) == NULL) {
575 		log(LOG_WARNING,
576 		    "nglmi: m_pullup failed for %d bytes\n", packetlen);
577 		return (0);
578 	}
579 	if (nglmi_checkdata(hook, m) == 0)
580 		return (0);
581 
582 	/* pass the first 4 bytes (already checked in the nglmi_checkdata()) */
583 	data = mtod(m, const u_char *);
584 	STEPBY(4);
585 
586 	/* Now check if there is a 'locking shift'. This is only seen in
587 	 * Annex D frames. don't bother checking, we already did that. Don't
588 	 * increment immediatly as it might not be there. */
589 	if (ANNEXD(sc))
590 		STEPBY(1);
591 
592 	/* If we get this far we should consider that it is a legitimate
593 	 * frame and we know what it is. */
594 	if (sc->flags & SCF_AUTO) {
595 		/* note the hook that this valid channel came from and drop
596 		 * out of auto probe mode. */
597 		if (ANNEXA(sc))
598 			sc->protoname = NAME_ANNEXA;
599 		else if (ANNEXD(sc))
600 			sc->protoname = NAME_ANNEXD;
601 		else if (GROUP4(sc))
602 			sc->protoname = NAME_GROUP4;
603 		else {
604 			log(LOG_ERR, "nglmi: No known type\n");
605 			goto drop;
606 		}
607 		sc->lmi_channel = hook;
608 		sc->flags &= ~SCF_AUTO;
609 		log(LOG_INFO, "nglmi: auto-detected %s LMI on DLCI %d\n",
610 		    sc->protoname, hook == sc->lmi_channel0 ? 0 : 1023);
611 	}
612 
613 	/* While there is more data in the status packet, keep processing
614 	 * status items. First make sure there is enough data for the
615 	 * segment descriptor's length field. */
616 	while (packetlen >= 2) {
617 		u_int   segtype = data[0];
618 		u_int   segsize = data[1];
619 
620 		/* Now that we know how long it claims to be, make sure
621 		 * there is enough data for the next seg. */
622 		if (packetlen < segsize + 2)
623 			break;
624 		switch (segtype) {
625 		case 0x01:
626 		case 0x51:
627 			if (resptype_seen) {
628 				log(LOG_WARNING, "nglmi: dup MSGTYPE\n");
629 				goto nextIE;
630 			}
631 			resptype_seen++;
632 			/* The remote end tells us what kind of response
633 			 * this is. Only expect a type 0 or 1. if we are a
634 			 * full status, invalidate a few DLCIs just to see
635 			 * that they are still ok. */
636 			if (segsize != 1)
637 				goto nextIE;
638 			switch (data[2]) {
639 			case 1:
640 				/* partial status, do no extra processing */
641 				break;
642 			case 0:
643 			    {
644 				int     count = 0;
645 				int     idx = sc->invalidx;
646 
647 				for (count = 0; count < 10; count++) {
648 					if (idx > MAXDLCI)
649 						idx = 0;
650 					if (sc->dlci_state[idx] == DLCI_UP)
651 						sc->dlci_state[idx] = DLCI_DOWN;
652 					idx++;
653 				}
654 				sc->invalidx = idx;
655 				/* we got and we wanted one. relax
656 				 * now.. but don't reset to 0 if it
657 				 * was unrequested. */
658 				if (sc->livs > sc->liv_per_full)
659 					sc->livs = 0;
660 				break;
661 			    }
662 			}
663 			break;
664 		case 0x03:
665 		case 0x53:
666 			/* The remote tells us what it thinks the sequence
667 			 * numbers are. If it's not size 2, it must be a
668 			 * duplicate to have gotten this far, skip it. */
669 			if (seq_seen != 0)	/* already seen seq numbers */
670 				goto nextIE;
671 			if (segsize != 2)
672 				goto nextIE;
673 			sc->remote_seq = data[2];
674 			if (sc->local_seq == data[3]) {
675 				sc->local_seq++;
676 				sc->seq_retries = 0;
677 				/* Note that all 3 Frame protocols seem to
678 				 * not like 0 as a sequence number. */
679 				if (sc->local_seq == 0)
680 					sc->local_seq = 1;
681 			}
682 			break;
683 		case 0x07:
684 		case 0x57:
685 			/* The remote tells us about a DLCI that it knows
686 			 * about. There may be many of these in a single
687 			 * status response */
688 			switch (segsize) {
689 			case 6:/* only on 'group of 4' */
690 				dlci = ((u_short) data[2] & 0xff) << 8;
691 				dlci |= (data[3] & 0xff);
692 				if ((dlci < 1024) && (dlci > 0)) {
693 				  /* XXX */
694 				}
695 				break;
696 			case 3:
697 				dlci = ((u_short) data[2] & 0x3f) << 4;
698 				dlci |= ((data[3] & 0x78) >> 3);
699 				if ((dlci < 1024) && (dlci > 0)) {
700 					/* set up the bottom half of the
701 					 * support for that dlci if it's not
702 					 * already been done */
703 					/* store this information somewhere */
704 				}
705 				break;
706 			default:
707 				goto nextIE;
708 			}
709 			if (sc->dlci_state[dlci] != DLCI_UP) {
710 				/* bring new DLCI to life */
711 				/* may do more here some day */
712 				if (sc->dlci_state[dlci] != DLCI_DOWN)
713 					log(LOG_INFO,
714 					    "nglmi: DLCI %d became active\n",
715 					    dlci);
716 				sc->dlci_state[dlci] = DLCI_UP;
717 			}
718 			break;
719 		}
720 nextIE:
721 		STEPBY(segsize + 2);
722 	}
723 	NG_FREE_M(m);
724 	return (0);
725 
726 drop:
727 	NG_FREE_M(m);
728 	return (EINVAL);
729 }
730 
731 /*
732  * Check that a packet is entirely kosha.
733  * return 1 of ok, and 0 if not.
734  * All data is discarded if a 0 is returned.
735  */
736 static int
737 nglmi_checkdata(hook_p hook, struct mbuf *m)
738 {
739 	sc_p    sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
740 	const	u_char *data;
741 	u_short packetlen;
742 	unsigned short dlci;
743 	u_char  type;
744 	u_char  nextbyte;
745 	int     seq_seen = 0;
746 	int     resptype_seen = 0;	/* 0 , 1 (partial) or 2 (full) */
747 	int     highest_dlci = 0;
748 
749 	packetlen = m->m_hdr.mh_len;
750 	data = mtod(m, const u_char *);
751 	if (*data != 0x03) {
752 		log(LOG_WARNING, "nglmi: unexpected value in LMI(%d)\n", 1);
753 		goto reject;
754 	}
755 	STEPBY(1);
756 
757 	/* look at the protocol ID */
758 	nextbyte = *data;
759 	if (sc->flags & SCF_AUTO) {
760 		SETLMITYPE(sc, SCF_NOLMI);	/* start with a clean slate */
761 		switch (nextbyte) {
762 		case 0x8:
763 			sc->protoID = 8;
764 			break;
765 		case 0x9:
766 			SETLMITYPE(sc, SCF_GROUP4);
767 			sc->protoID = 9;
768 			break;
769 		default:
770 			log(LOG_WARNING, "nglmi: bad Protocol ID(%d)\n",
771 			    (int) nextbyte);
772 			goto reject;
773 		}
774 	} else {
775 		if (nextbyte != sc->protoID) {
776 			log(LOG_WARNING, "nglmi: unexpected Protocol ID(%d)\n",
777 			    (int) nextbyte);
778 			goto reject;
779 		}
780 	}
781 	STEPBY(1);
782 
783 	/* check call reference (always null in non ISDN frame relay) */
784 	if (*data != 0x00) {
785 		log(LOG_WARNING, "nglmi: unexpected Call Reference (0x%x)\n",
786 		    data[-1]);
787 		goto reject;
788 	}
789 	STEPBY(1);
790 
791 	/* check message type */
792 	switch ((type = *data)) {
793 	case 0x75:		/* Status enquiry */
794 		log(LOG_WARNING, "nglmi: unexpected message type(0x%x)\n",
795 		    data[-1]);
796 		goto reject;
797 	case 0x7D:		/* Status message */
798 		break;
799 	default:
800 		log(LOG_WARNING,
801 		    "nglmi: unexpected msg type(0x%x) \n", (int) type);
802 		goto reject;
803 	}
804 	STEPBY(1);
805 
806 	/* Now check if there is a 'locking shift'. This is only seen in
807 	 * Annex D frames. Don't increment immediately as it might not be
808 	 * there. */
809 	nextbyte = *data;
810 	if (sc->flags & SCF_AUTO) {
811 		if (!(GROUP4(sc))) {
812 			if (nextbyte == 0x95) {
813 				SETLMITYPE(sc, SCF_ANNEX_D);
814 				STEPBY(1);
815 			} else
816 				SETLMITYPE(sc, SCF_ANNEX_A);
817 		} else if (nextbyte == 0x95) {
818 			log(LOG_WARNING, "nglmi: locking shift seen in G4\n");
819 			goto reject;
820 		}
821 	} else {
822 		if (ANNEXD(sc)) {
823 			if (*data == 0x95)
824 				STEPBY(1);
825 			else {
826 				log(LOG_WARNING,
827 				    "nglmi: locking shift missing\n");
828 				goto reject;
829 			}
830 		} else if (*data == 0x95) {
831 			log(LOG_WARNING, "nglmi: locking shift seen\n");
832 			goto reject;
833 		}
834 	}
835 
836 	/* While there is more data in the status packet, keep processing
837 	 * status items. First make sure there is enough data for the
838 	 * segment descriptor's length field. */
839 	while (packetlen >= 2) {
840 		u_int   segtype = data[0];
841 		u_int   segsize = data[1];
842 
843 		/* Now that we know how long it claims to be, make sure
844 		 * there is enough data for the next seg. */
845 		if (packetlen < (segsize + 2)) {
846 			log(LOG_WARNING, "nglmi: IE longer than packet\n");
847 			break;
848 		}
849 		switch (segtype) {
850 		case 0x01:
851 		case 0x51:
852 			/* According to MCI's HP analyser, we should just
853 			 * ignore if there is mor ethan one of these (?). */
854 			if (resptype_seen) {
855 				log(LOG_WARNING, "nglmi: dup MSGTYPE\n");
856 				goto nextIE;
857 			}
858 			if (segsize != 1) {
859 				log(LOG_WARNING, "nglmi: MSGTYPE wrong size\n");
860 				goto reject;
861 			}
862 			/* The remote end tells us what kind of response
863 			 * this is. Only expect a type 0 or 1. if it was a
864 			 * full (type 0) check we just asked for a type
865 			 * full. */
866 			switch (data[2]) {
867 			case 1:/* partial */
868 				if (sc->livs > sc->liv_per_full) {
869 					log(LOG_WARNING,
870 					  "nglmi: LIV when FULL expected\n");
871 					goto reject;	/* need full */
872 				}
873 				resptype_seen = 1;
874 				break;
875 			case 0:/* full */
876 				/* Full response is always acceptable */
877 				resptype_seen = 2;
878 				break;
879 			default:
880 				log(LOG_WARNING,
881 				 "nglmi: Unknown report type %d\n", data[2]);
882 				goto reject;
883 			}
884 			break;
885 		case 0x03:
886 		case 0x53:
887 			/* The remote tells us what it thinks the sequence
888 			 * numbers are. I would have thought that there
889 			 * needs to be one and only one of these, but MCI
890 			 * want us to just ignore extras. (?) */
891 			if (resptype_seen == 0) {
892 				log(LOG_WARNING, "nglmi: no TYPE before SEQ\n");
893 				goto reject;
894 			}
895 			if (seq_seen != 0)	/* already seen seq numbers */
896 				goto nextIE;
897 			if (segsize != 2) {
898 				log(LOG_WARNING, "nglmi: bad SEQ sts size\n");
899 				goto reject;
900 			}
901 			if (sc->local_seq != data[3]) {
902 				log(LOG_WARNING, "nglmi: unexpected SEQ\n");
903 				goto reject;
904 			}
905 			seq_seen = 1;
906 			break;
907 		case 0x07:
908 		case 0x57:
909 			/* The remote tells us about a DLCI that it knows
910 			 * about. There may be many of these in a single
911 			 * status response */
912 			if (seq_seen != 1) {	/* already seen seq numbers? */
913 				log(LOG_WARNING,
914 				    "nglmi: No sequence before DLCI\n");
915 				goto reject;
916 			}
917 			if (resptype_seen != 2) {	/* must be full */
918 				log(LOG_WARNING,
919 				    "nglmi: No resp type before DLCI\n");
920 				goto reject;
921 			}
922 			if (GROUP4(sc)) {
923 				if (segsize != 6) {
924 					log(LOG_WARNING,
925 					    "nglmi: wrong IE segsize\n");
926 					goto reject;
927 				}
928 				dlci = ((u_short) data[2] & 0xff) << 8;
929 				dlci |= (data[3] & 0xff);
930 			} else {
931 				if (segsize != 3) {
932 					log(LOG_WARNING,
933 					    "nglmi: DLCI headersize of %d"
934 					    " not supported\n", segsize - 1);
935 					goto reject;
936 				}
937 				dlci = ((u_short) data[2] & 0x3f) << 4;
938 				dlci |= ((data[3] & 0x78) >> 3);
939 			}
940 			/* async can only have one of these */
941 #if 0				/* async not yet accepted */
942 			if (async && highest_dlci) {
943 				log(LOG_WARNING,
944 				    "nglmi: Async with > 1 DLCI\n");
945 				goto reject;
946 			}
947 #endif
948 			/* Annex D says these will always be Ascending, but
949 			 * the HP test for G4 says we should accept
950 			 * duplicates, so for now allow that. ( <= vs. < ) */
951 #if 0
952 			/* MCI tests want us to accept out of order for AnxD */
953 			if ((!GROUP4(sc)) && (dlci < highest_dlci)) {
954 				/* duplicate or mis-ordered dlci */
955 				/* (spec says they will increase in number) */
956 				log(LOG_WARNING, "nglmi: DLCI out of order\n");
957 				goto reject;
958 			}
959 #endif
960 			if (dlci > 1023) {
961 				log(LOG_WARNING, "nglmi: DLCI out of range\n");
962 				goto reject;
963 			}
964 			highest_dlci = dlci;
965 			break;
966 		default:
967 			log(LOG_WARNING,
968 			    "nglmi: unknown LMI segment type %d\n", segtype);
969 		}
970 nextIE:
971 		STEPBY(segsize + 2);
972 	}
973 	if (packetlen != 0) {	/* partial junk at end? */
974 		log(LOG_WARNING,
975 		    "nglmi: %d bytes extra at end of packet\n", packetlen);
976 		goto print;
977 	}
978 	if (resptype_seen == 0) {
979 		log(LOG_WARNING, "nglmi: No response type seen\n");
980 		goto reject;	/* had no response type */
981 	}
982 	if (seq_seen == 0) {
983 		log(LOG_WARNING, "nglmi: No sequence numbers seen\n");
984 		goto reject;	/* had no sequence numbers */
985 	}
986 	return (1);
987 
988 print:
989 	{
990 		int     i, j, k, pos;
991 		char    buf[100];
992 		int     loc;
993 		const	u_char *bp = mtod(m, const u_char *);
994 
995 		k = i = 0;
996 		loc = (m->m_hdr.mh_len - packetlen);
997 		log(LOG_WARNING, "nglmi: error at location %d\n", loc);
998 		while (k < m->m_hdr.mh_len) {
999 			pos = 0;
1000 			j = 0;
1001 			while ((j++ < 16) && k < m->m_hdr.mh_len) {
1002 				pos += sprintf(buf + pos, "%c%02x",
1003 					       ((loc == k) ? '>' : ' '),
1004 					       bp[k]);
1005 				k++;
1006 			}
1007 			if (i == 0)
1008 				log(LOG_WARNING, "nglmi: packet data:%s\n", buf);
1009 			else
1010 				log(LOG_WARNING, "%04d              :%s\n", k, buf);
1011 			i++;
1012 		}
1013 	}
1014 	return (1);
1015 reject:
1016 	{
1017 		int     i, j, k, pos;
1018 		char    buf[100];
1019 		int     loc;
1020 		const	u_char *bp = mtod(m, const u_char *);
1021 
1022 		k = i = 0;
1023 		loc = (m->m_hdr.mh_len - packetlen);
1024 		log(LOG_WARNING, "nglmi: error at location %d\n", loc);
1025 		while (k < m->m_hdr.mh_len) {
1026 			pos = 0;
1027 			j = 0;
1028 			while ((j++ < 16) && k < m->m_hdr.mh_len) {
1029 				pos += sprintf(buf + pos, "%c%02x",
1030 					       ((loc == k) ? '>' : ' '),
1031 					       bp[k]);
1032 				k++;
1033 			}
1034 			if (i == 0)
1035 				log(LOG_WARNING, "nglmi: packet data:%s\n", buf);
1036 			else
1037 				log(LOG_WARNING, "%04d              :%s\n", k, buf);
1038 			i++;
1039 		}
1040 	}
1041 	NG_FREE_M(m);
1042 	return (0);
1043 }
1044 
1045 /*
1046  * Do local shutdown processing..
1047  * Cut any remaining links and free our local resources.
1048  */
1049 static int
1050 nglmi_shutdown(node_p node)
1051 {
1052 	const sc_p sc = NG_NODE_PRIVATE(node);
1053 
1054 	NG_NODE_SET_PRIVATE(node, NULL);
1055 	NG_NODE_UNREF(sc->node);
1056 	FREE(sc, M_NETGRAPH);
1057 	return (0);
1058 }
1059 
1060 /*
1061  * Hook disconnection
1062  * For this type, removal of any link except "debug" destroys the node.
1063  */
1064 static int
1065 nglmi_disconnect(hook_p hook)
1066 {
1067 	const sc_p sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1068 
1069 	/* OK to remove debug hook(s) */
1070 	if (NG_HOOK_PRIVATE(hook) == NULL)
1071 		return (0);
1072 
1073 	/* Stop timer if it's currently active */
1074 	if (sc->flags & SCF_CONNECTED)
1075 		untimeout(LMI_ticker, sc, sc->handle);
1076 
1077 	/* Self-destruct */
1078 	if (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))
1079 		ng_rmnode_self(NG_HOOK_NODE(hook));
1080 	return (0);
1081 }
1082 
1083