xref: /freebsd/sys/netgraph/ng_ppp.c (revision 0c927cdd8e6e05387fc5a9ffcb5dbe128d4ad749)
1 /*-
2  * Copyright (c) 1996-2000 Whistle Communications, Inc.
3  * All rights reserved.
4  *
5  * Subject to the following obligations and disclaimer of warranty, use and
6  * redistribution of this software, in source or object code forms, with or
7  * without modifications are expressly permitted by Whistle Communications;
8  * provided, however, that:
9  * 1. Any and all reproductions of the source or object code must include the
10  *    copyright notice above and the following disclaimer of warranties; and
11  * 2. No rights are granted, in any manner or form, to use Whistle
12  *    Communications, Inc. trademarks, including the mark "WHISTLE
13  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
14  *    such appears in the above copyright notice or in the software.
15  *
16  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
17  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
18  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
19  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
20  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
21  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
22  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
23  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
24  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
25  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
26  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
27  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
28  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
32  * OF SUCH DAMAGE.
33  *
34  * Copyright (c) 2007 Alexander Motin <mav@alkar.net>
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice unmodified, this list of conditions, and the following
42  *    disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  *
47  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
48  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
49  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
50  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
51  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
52  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
53  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
54  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
55  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
56  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
57  * SUCH DAMAGE.
58  *
59  * Authors: Archie Cobbs <archie@freebsd.org>, Alexander Motin <mav@alkar.net>
60  *
61  * $FreeBSD$
62  * $Whistle: ng_ppp.c,v 1.24 1999/11/01 09:24:52 julian Exp $
63  */
64 
65 /*
66  * PPP node type data-flow.
67  *
68  *       hook      xmit        layer         recv      hook
69  *              ------------------------------------
70  *       inet ->                                    -> inet
71  *       ipv6 ->                                    -> ipv6
72  *        ipx ->               proto                -> ipx
73  *      atalk ->                                    -> atalk
74  *     bypass ->                                    -> bypass
75  *              -hcomp_xmit()----------proto_recv()-
76  *     vjc_ip <-                                    <- vjc_ip
77  *   vjc_comp ->         header compression         -> vjc_comp
78  * vjc_uncomp ->                                    -> vjc_uncomp
79  *   vjc_vjip ->
80  *              -comp_xmit()-----------hcomp_recv()-
81  *   compress <-            compression             <- decompress
82  *   compress ->                                    -> decompress
83  *              -crypt_xmit()-----------comp_recv()-
84  *    encrypt <-             encryption             <- decrypt
85  *    encrypt ->                                    -> decrypt
86  *              -ml_xmit()-------------crypt_recv()-
87  *                           multilink
88  *              -link_xmit()--------------ml_recv()-
89  *      linkX <-               link                 <- linkX
90  *
91  */
92 
93 #include <sys/param.h>
94 #include <sys/systm.h>
95 #include <sys/kernel.h>
96 #include <sys/limits.h>
97 #include <sys/time.h>
98 #include <sys/mbuf.h>
99 #include <sys/malloc.h>
100 #include <sys/errno.h>
101 #include <sys/ctype.h>
102 
103 #include <netgraph/ng_message.h>
104 #include <netgraph/netgraph.h>
105 #include <netgraph/ng_parse.h>
106 #include <netgraph/ng_ppp.h>
107 #include <netgraph/ng_vjc.h>
108 
109 #ifdef NG_SEPARATE_MALLOC
110 MALLOC_DEFINE(M_NETGRAPH_PPP, "netgraph_ppp", "netgraph ppp node");
111 #else
112 #define M_NETGRAPH_PPP M_NETGRAPH
113 #endif
114 
115 #define PROT_VALID(p)		(((p) & 0x0101) == 0x0001)
116 #define PROT_COMPRESSABLE(p)	(((p) & 0xff00) == 0x0000)
117 
118 /* Some PPP protocol numbers we're interested in */
119 #define PROT_ATALK		0x0029
120 #define PROT_COMPD		0x00fd
121 #define PROT_CRYPTD		0x0053
122 #define PROT_IP			0x0021
123 #define PROT_IPV6		0x0057
124 #define PROT_IPX		0x002b
125 #define PROT_LCP		0xc021
126 #define PROT_MP			0x003d
127 #define PROT_VJCOMP		0x002d
128 #define PROT_VJUNCOMP		0x002f
129 
130 /* Multilink PPP definitions */
131 #define MP_MIN_MRRU		1500		/* per RFC 1990 */
132 #define MP_INITIAL_SEQ		0		/* per RFC 1990 */
133 #define MP_MIN_LINK_MRU		32
134 
135 #define MP_SHORT_SEQ_MASK	0x00000fff	/* short seq # mask */
136 #define MP_SHORT_SEQ_HIBIT	0x00000800	/* short seq # high bit */
137 #define MP_SHORT_FIRST_FLAG	0x00008000	/* first fragment in frame */
138 #define MP_SHORT_LAST_FLAG	0x00004000	/* last fragment in frame */
139 
140 #define MP_LONG_SEQ_MASK	0x00ffffff	/* long seq # mask */
141 #define MP_LONG_SEQ_HIBIT	0x00800000	/* long seq # high bit */
142 #define MP_LONG_FIRST_FLAG	0x80000000	/* first fragment in frame */
143 #define MP_LONG_LAST_FLAG	0x40000000	/* last fragment in frame */
144 
145 #define MP_NOSEQ		0x7fffffff	/* impossible sequence number */
146 
147 /* Sign extension of MP sequence numbers */
148 #define MP_SHORT_EXTEND(s)	(((s) & MP_SHORT_SEQ_HIBIT) ?		\
149 				    ((s) | ~MP_SHORT_SEQ_MASK)		\
150 				    : ((s) & MP_SHORT_SEQ_MASK))
151 #define MP_LONG_EXTEND(s)	(((s) & MP_LONG_SEQ_HIBIT) ?		\
152 				    ((s) | ~MP_LONG_SEQ_MASK)		\
153 				    : ((s) & MP_LONG_SEQ_MASK))
154 
155 /* Comparision of MP sequence numbers. Note: all sequence numbers
156    except priv->xseq are stored with the sign bit extended. */
157 #define MP_SHORT_SEQ_DIFF(x,y)	MP_SHORT_EXTEND((x) - (y))
158 #define MP_LONG_SEQ_DIFF(x,y)	MP_LONG_EXTEND((x) - (y))
159 
160 #define MP_RECV_SEQ_DIFF(priv,x,y)					\
161 				((priv)->conf.recvShortSeq ?		\
162 				    MP_SHORT_SEQ_DIFF((x), (y)) :	\
163 				    MP_LONG_SEQ_DIFF((x), (y)))
164 
165 /* Increment receive sequence number */
166 #define MP_NEXT_RECV_SEQ(priv,seq)					\
167 				((priv)->conf.recvShortSeq ?		\
168 				    MP_SHORT_EXTEND((seq) + 1) :	\
169 				    MP_LONG_EXTEND((seq) + 1))
170 
171 /* Don't fragment transmitted packets to parts smaller than this */
172 #define MP_MIN_FRAG_LEN		32
173 
174 /* Maximum fragment reasssembly queue length */
175 #define MP_MAX_QUEUE_LEN	128
176 
177 /* Fragment queue scanner period */
178 #define MP_FRAGTIMER_INTERVAL	(hz/2)
179 
180 /* Average link overhead. XXX: Should be given by user-level */
181 #define MP_AVERAGE_LINK_OVERHEAD	16
182 
183 /* Keep this equal to ng_ppp_hook_names lower! */
184 #define HOOK_INDEX_MAX		13
185 
186 /* We store incoming fragments this way */
187 struct ng_ppp_frag {
188 	int				seq;		/* fragment seq# */
189 	uint8_t				first;		/* First in packet? */
190 	uint8_t				last;		/* Last in packet? */
191 	struct timeval			timestamp;	/* time of reception */
192 	struct mbuf			*data;		/* Fragment data */
193 	TAILQ_ENTRY(ng_ppp_frag)	f_qent;		/* Fragment queue */
194 };
195 
196 /* Per-link private information */
197 struct ng_ppp_link {
198 	struct ng_ppp_link_conf	conf;		/* link configuration */
199 	struct ng_ppp_link_stat	stats;		/* link stats */
200 	hook_p			hook;		/* connection to link data */
201 	int32_t			seq;		/* highest rec'd seq# - MSEQ */
202 	uint32_t		latency;	/* calculated link latency */
203 	struct timeval		lastWrite;	/* time of last write for MP */
204 	int			bytesInQueue;	/* bytes in the output queue for MP */
205 };
206 
207 /* Total per-node private information */
208 struct ng_ppp_private {
209 	struct ng_ppp_bund_conf	conf;			/* bundle config */
210 	struct ng_ppp_link_stat	bundleStats;		/* bundle stats */
211 	struct ng_ppp_link	links[NG_PPP_MAX_LINKS];/* per-link info */
212 	int32_t			xseq;			/* next out MP seq # */
213 	int32_t			mseq;			/* min links[i].seq */
214 	uint16_t		activeLinks[NG_PPP_MAX_LINKS];	/* indicies */
215 	uint16_t		numActiveLinks;		/* how many links up */
216 	uint16_t		lastLink;		/* for round robin */
217 	uint8_t			vjCompHooked;		/* VJ comp hooked up? */
218 	uint8_t			allLinksEqual;		/* all xmit the same? */
219 	hook_p			hooks[HOOK_INDEX_MAX];	/* non-link hooks */
220 	TAILQ_HEAD(ng_ppp_fraglist, ng_ppp_frag)	/* fragment queue */
221 				frags;
222 	int			qlen;			/* fraq queue length */
223 	struct callout		fragTimer;		/* fraq queue check */
224 };
225 typedef struct ng_ppp_private *priv_p;
226 
227 /* Netgraph node methods */
228 static ng_constructor_t	ng_ppp_constructor;
229 static ng_rcvmsg_t	ng_ppp_rcvmsg;
230 static ng_shutdown_t	ng_ppp_shutdown;
231 static ng_newhook_t	ng_ppp_newhook;
232 static ng_rcvdata_t	ng_ppp_rcvdata;
233 static ng_disconnect_t	ng_ppp_disconnect;
234 
235 static ng_rcvdata_t	ng_ppp_rcvdata_inet;
236 static ng_rcvdata_t	ng_ppp_rcvdata_ipv6;
237 static ng_rcvdata_t	ng_ppp_rcvdata_ipx;
238 static ng_rcvdata_t	ng_ppp_rcvdata_atalk;
239 static ng_rcvdata_t	ng_ppp_rcvdata_bypass;
240 
241 static ng_rcvdata_t	ng_ppp_rcvdata_vjc_ip;
242 static ng_rcvdata_t	ng_ppp_rcvdata_vjc_comp;
243 static ng_rcvdata_t	ng_ppp_rcvdata_vjc_uncomp;
244 static ng_rcvdata_t	ng_ppp_rcvdata_vjc_vjip;
245 
246 static ng_rcvdata_t	ng_ppp_rcvdata_compress;
247 static ng_rcvdata_t	ng_ppp_rcvdata_decompress;
248 
249 static ng_rcvdata_t	ng_ppp_rcvdata_encrypt;
250 static ng_rcvdata_t	ng_ppp_rcvdata_decrypt;
251 
252 /* We use integer indicies to refer to the non-link hooks. */
253 static const struct {
254 	char *const name;
255 	ng_rcvdata_t *fn;
256 } ng_ppp_hook_names[] = {
257 #define HOOK_INDEX_ATALK	0
258 	{ NG_PPP_HOOK_ATALK,	ng_ppp_rcvdata_atalk },
259 #define HOOK_INDEX_BYPASS	1
260 	{ NG_PPP_HOOK_BYPASS,	ng_ppp_rcvdata_bypass },
261 #define HOOK_INDEX_COMPRESS	2
262 	{ NG_PPP_HOOK_COMPRESS,	ng_ppp_rcvdata_compress },
263 #define HOOK_INDEX_ENCRYPT	3
264 	{ NG_PPP_HOOK_ENCRYPT,	ng_ppp_rcvdata_encrypt },
265 #define HOOK_INDEX_DECOMPRESS	4
266 	{ NG_PPP_HOOK_DECOMPRESS, ng_ppp_rcvdata_decompress },
267 #define HOOK_INDEX_DECRYPT	5
268 	{ NG_PPP_HOOK_DECRYPT,	ng_ppp_rcvdata_decrypt },
269 #define HOOK_INDEX_INET		6
270 	{ NG_PPP_HOOK_INET,	ng_ppp_rcvdata_inet },
271 #define HOOK_INDEX_IPX		7
272 	{ NG_PPP_HOOK_IPX,	ng_ppp_rcvdata_ipx },
273 #define HOOK_INDEX_VJC_COMP	8
274 	{ NG_PPP_HOOK_VJC_COMP,	ng_ppp_rcvdata_vjc_comp },
275 #define HOOK_INDEX_VJC_IP	9
276 	{ NG_PPP_HOOK_VJC_IP,	ng_ppp_rcvdata_vjc_ip },
277 #define HOOK_INDEX_VJC_UNCOMP	10
278 	{ NG_PPP_HOOK_VJC_UNCOMP, ng_ppp_rcvdata_vjc_uncomp },
279 #define HOOK_INDEX_VJC_VJIP	11
280 	{ NG_PPP_HOOK_VJC_VJIP,	ng_ppp_rcvdata_vjc_vjip },
281 #define HOOK_INDEX_IPV6		12
282 	{ NG_PPP_HOOK_IPV6,	ng_ppp_rcvdata_ipv6 },
283 	{ NULL, NULL }
284 };
285 
286 /* Helper functions */
287 static int	ng_ppp_proto_recv(node_p node, item_p item, uint16_t proto,
288 		    uint16_t linkNum);
289 static int	ng_ppp_hcomp_xmit(node_p node, item_p item, uint16_t proto);
290 static int	ng_ppp_hcomp_recv(node_p node, item_p item, uint16_t proto,
291 		    uint16_t linkNum);
292 static int	ng_ppp_comp_xmit(node_p node, item_p item, uint16_t proto);
293 static int	ng_ppp_comp_recv(node_p node, item_p item, uint16_t proto,
294 		    uint16_t linkNum);
295 static int	ng_ppp_crypt_xmit(node_p node, item_p item, uint16_t proto);
296 static int	ng_ppp_crypt_recv(node_p node, item_p item, uint16_t proto,
297 		    uint16_t linkNum);
298 static int	ng_ppp_mp_xmit(node_p node, item_p item, uint16_t proto);
299 static int	ng_ppp_mp_recv(node_p node, item_p item, uint16_t proto,
300 		    uint16_t linkNum);
301 static int	ng_ppp_link_xmit(node_p node, item_p item, uint16_t proto,
302 		    uint16_t linkNum);
303 
304 static int	ng_ppp_bypass(node_p node, item_p item, uint16_t proto,
305 		    uint16_t linkNum);
306 
307 static void	ng_ppp_bump_mseq(node_p node, int32_t new_mseq);
308 static int	ng_ppp_frag_drop(node_p node);
309 static int	ng_ppp_check_packet(node_p node);
310 static void	ng_ppp_get_packet(node_p node, struct mbuf **mp);
311 static int	ng_ppp_frag_process(node_p node);
312 static int	ng_ppp_frag_trim(node_p node);
313 static void	ng_ppp_frag_timeout(node_p node, hook_p hook, void *arg1,
314 		    int arg2);
315 static void	ng_ppp_frag_checkstale(node_p node);
316 static void	ng_ppp_frag_reset(node_p node);
317 static void	ng_ppp_mp_strategy(node_p node, int len, int *distrib);
318 static int	ng_ppp_intcmp(void *latency, const void *v1, const void *v2);
319 static struct mbuf *ng_ppp_addproto(struct mbuf *m, uint16_t proto, int compOK);
320 static struct mbuf *ng_ppp_cutproto(struct mbuf *m, uint16_t *proto);
321 static struct mbuf *ng_ppp_prepend(struct mbuf *m, const void *buf, int len);
322 static int	ng_ppp_config_valid(node_p node,
323 		    const struct ng_ppp_node_conf *newConf);
324 static void	ng_ppp_update(node_p node, int newConf);
325 static void	ng_ppp_start_frag_timer(node_p node);
326 static void	ng_ppp_stop_frag_timer(node_p node);
327 
328 /* Parse type for struct ng_ppp_mp_state_type */
329 static const struct ng_parse_fixedarray_info ng_ppp_rseq_array_info = {
330 	&ng_parse_hint32_type,
331 	NG_PPP_MAX_LINKS
332 };
333 static const struct ng_parse_type ng_ppp_rseq_array_type = {
334 	&ng_parse_fixedarray_type,
335 	&ng_ppp_rseq_array_info,
336 };
337 static const struct ng_parse_struct_field ng_ppp_mp_state_type_fields[]
338 	= NG_PPP_MP_STATE_TYPE_INFO(&ng_ppp_rseq_array_type);
339 static const struct ng_parse_type ng_ppp_mp_state_type = {
340 	&ng_parse_struct_type,
341 	&ng_ppp_mp_state_type_fields
342 };
343 
344 /* Parse type for struct ng_ppp_link_conf */
345 static const struct ng_parse_struct_field ng_ppp_link_type_fields[]
346 	= NG_PPP_LINK_TYPE_INFO;
347 static const struct ng_parse_type ng_ppp_link_type = {
348 	&ng_parse_struct_type,
349 	&ng_ppp_link_type_fields
350 };
351 
352 /* Parse type for struct ng_ppp_bund_conf */
353 static const struct ng_parse_struct_field ng_ppp_bund_type_fields[]
354 	= NG_PPP_BUND_TYPE_INFO;
355 static const struct ng_parse_type ng_ppp_bund_type = {
356 	&ng_parse_struct_type,
357 	&ng_ppp_bund_type_fields
358 };
359 
360 /* Parse type for struct ng_ppp_node_conf */
361 static const struct ng_parse_fixedarray_info ng_ppp_array_info = {
362 	&ng_ppp_link_type,
363 	NG_PPP_MAX_LINKS
364 };
365 static const struct ng_parse_type ng_ppp_link_array_type = {
366 	&ng_parse_fixedarray_type,
367 	&ng_ppp_array_info,
368 };
369 static const struct ng_parse_struct_field ng_ppp_conf_type_fields[]
370 	= NG_PPP_CONFIG_TYPE_INFO(&ng_ppp_bund_type, &ng_ppp_link_array_type);
371 static const struct ng_parse_type ng_ppp_conf_type = {
372 	&ng_parse_struct_type,
373 	&ng_ppp_conf_type_fields
374 };
375 
376 /* Parse type for struct ng_ppp_link_stat */
377 static const struct ng_parse_struct_field ng_ppp_stats_type_fields[]
378 	= NG_PPP_STATS_TYPE_INFO;
379 static const struct ng_parse_type ng_ppp_stats_type = {
380 	&ng_parse_struct_type,
381 	&ng_ppp_stats_type_fields
382 };
383 
384 /* List of commands and how to convert arguments to/from ASCII */
385 static const struct ng_cmdlist ng_ppp_cmds[] = {
386 	{
387 	  NGM_PPP_COOKIE,
388 	  NGM_PPP_SET_CONFIG,
389 	  "setconfig",
390 	  &ng_ppp_conf_type,
391 	  NULL
392 	},
393 	{
394 	  NGM_PPP_COOKIE,
395 	  NGM_PPP_GET_CONFIG,
396 	  "getconfig",
397 	  NULL,
398 	  &ng_ppp_conf_type
399 	},
400 	{
401 	  NGM_PPP_COOKIE,
402 	  NGM_PPP_GET_MP_STATE,
403 	  "getmpstate",
404 	  NULL,
405 	  &ng_ppp_mp_state_type
406 	},
407 	{
408 	  NGM_PPP_COOKIE,
409 	  NGM_PPP_GET_LINK_STATS,
410 	  "getstats",
411 	  &ng_parse_int16_type,
412 	  &ng_ppp_stats_type
413 	},
414 	{
415 	  NGM_PPP_COOKIE,
416 	  NGM_PPP_CLR_LINK_STATS,
417 	  "clrstats",
418 	  &ng_parse_int16_type,
419 	  NULL
420 	},
421 	{
422 	  NGM_PPP_COOKIE,
423 	  NGM_PPP_GETCLR_LINK_STATS,
424 	  "getclrstats",
425 	  &ng_parse_int16_type,
426 	  &ng_ppp_stats_type
427 	},
428 	{ 0 }
429 };
430 
431 /* Node type descriptor */
432 static struct ng_type ng_ppp_typestruct = {
433 	.version =	NG_ABI_VERSION,
434 	.name =		NG_PPP_NODE_TYPE,
435 	.constructor =	ng_ppp_constructor,
436 	.rcvmsg =	ng_ppp_rcvmsg,
437 	.shutdown =	ng_ppp_shutdown,
438 	.newhook =	ng_ppp_newhook,
439 	.rcvdata =	ng_ppp_rcvdata,
440 	.disconnect =	ng_ppp_disconnect,
441 	.cmdlist =	ng_ppp_cmds,
442 };
443 NETGRAPH_INIT(ppp, &ng_ppp_typestruct);
444 
445 /* Address and control field header */
446 static const uint8_t ng_ppp_acf[2] = { 0xff, 0x03 };
447 
448 /* Maximum time we'll let a complete incoming packet sit in the queue */
449 static const struct timeval ng_ppp_max_staleness = { 2, 0 };	/* 2 seconds */
450 
451 #define ERROUT(x)	do { error = (x); goto done; } while (0)
452 
453 /************************************************************************
454 			NETGRAPH NODE STUFF
455  ************************************************************************/
456 
457 /*
458  * Node type constructor
459  */
460 static int
461 ng_ppp_constructor(node_p node)
462 {
463 	priv_p priv;
464 	int i;
465 
466 	/* Allocate private structure */
467 	MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH_PPP, M_NOWAIT | M_ZERO);
468 	if (priv == NULL)
469 		return (ENOMEM);
470 
471 	NG_NODE_SET_PRIVATE(node, priv);
472 
473 	/* Initialize state */
474 	TAILQ_INIT(&priv->frags);
475 	for (i = 0; i < NG_PPP_MAX_LINKS; i++)
476 		priv->links[i].seq = MP_NOSEQ;
477 	ng_callout_init(&priv->fragTimer);
478 
479 	/* Done */
480 	return (0);
481 }
482 
483 /*
484  * Give our OK for a hook to be added
485  */
486 static int
487 ng_ppp_newhook(node_p node, hook_p hook, const char *name)
488 {
489 	const priv_p priv = NG_NODE_PRIVATE(node);
490 	hook_p *hookPtr = NULL;
491 	int linkNum = -1;
492 	int hookIndex = -1;
493 
494 	/* Figure out which hook it is */
495 	if (strncmp(name, NG_PPP_HOOK_LINK_PREFIX,	/* a link hook? */
496 	    strlen(NG_PPP_HOOK_LINK_PREFIX)) == 0) {
497 		const char *cp;
498 		char *eptr;
499 
500 		cp = name + strlen(NG_PPP_HOOK_LINK_PREFIX);
501 		if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
502 			return (EINVAL);
503 		linkNum = (int)strtoul(cp, &eptr, 10);
504 		if (*eptr != '\0' || linkNum < 0 || linkNum >= NG_PPP_MAX_LINKS)
505 			return (EINVAL);
506 		hookPtr = &priv->links[linkNum].hook;
507 		hookIndex = ~linkNum;
508 
509 		/* See if hook is already connected. */
510 		if (*hookPtr != NULL)
511 			return (EISCONN);
512 
513 		/* Disallow more than one link unless multilink is enabled. */
514 		if (priv->links[linkNum].conf.enableLink &&
515 		    !priv->conf.enableMultilink && priv->numActiveLinks >= 1)
516 			return (ENODEV);
517 
518 		/* MP recv code is not thread-safe. */
519 		NG_HOOK_FORCE_WRITER(hook);
520 
521 	} else {				/* must be a non-link hook */
522 		int i;
523 
524 		for (i = 0; ng_ppp_hook_names[i].name != NULL; i++) {
525 			if (strcmp(name, ng_ppp_hook_names[i].name) == 0) {
526 				hookPtr = &priv->hooks[i];
527 				hookIndex = i;
528 				break;
529 			}
530 		}
531 		if (ng_ppp_hook_names[i].name == NULL)
532 			return (EINVAL);	/* no such hook */
533 
534 		/* See if hook is already connected */
535 		if (*hookPtr != NULL)
536 			return (EISCONN);
537 
538 		/* Every non-linkX hook have it's own function. */
539 		NG_HOOK_SET_RCVDATA(hook, ng_ppp_hook_names[i].fn);
540 	}
541 
542 	/* OK */
543 	*hookPtr = hook;
544 	NG_HOOK_SET_PRIVATE(hook, (void *)(intptr_t)hookIndex);
545 	ng_ppp_update(node, 0);
546 	return (0);
547 }
548 
549 /*
550  * Receive a control message
551  */
552 static int
553 ng_ppp_rcvmsg(node_p node, item_p item, hook_p lasthook)
554 {
555 	const priv_p priv = NG_NODE_PRIVATE(node);
556 	struct ng_mesg *resp = NULL;
557 	int error = 0;
558 	struct ng_mesg *msg;
559 
560 	NGI_GET_MSG(item, msg);
561 	switch (msg->header.typecookie) {
562 	case NGM_PPP_COOKIE:
563 		switch (msg->header.cmd) {
564 		case NGM_PPP_SET_CONFIG:
565 		    {
566 			struct ng_ppp_node_conf *const conf =
567 			    (struct ng_ppp_node_conf *)msg->data;
568 			int i;
569 
570 			/* Check for invalid or illegal config */
571 			if (msg->header.arglen != sizeof(*conf))
572 				ERROUT(EINVAL);
573 			if (!ng_ppp_config_valid(node, conf))
574 				ERROUT(EINVAL);
575 
576 			/* Copy config */
577 			priv->conf = conf->bund;
578 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
579 				priv->links[i].conf = conf->links[i];
580 			ng_ppp_update(node, 1);
581 			break;
582 		    }
583 		case NGM_PPP_GET_CONFIG:
584 		    {
585 			struct ng_ppp_node_conf *conf;
586 			int i;
587 
588 			NG_MKRESPONSE(resp, msg, sizeof(*conf), M_NOWAIT);
589 			if (resp == NULL)
590 				ERROUT(ENOMEM);
591 			conf = (struct ng_ppp_node_conf *)resp->data;
592 			conf->bund = priv->conf;
593 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
594 				conf->links[i] = priv->links[i].conf;
595 			break;
596 		    }
597 		case NGM_PPP_GET_MP_STATE:
598 		    {
599 			struct ng_ppp_mp_state *info;
600 			int i;
601 
602 			NG_MKRESPONSE(resp, msg, sizeof(*info), M_NOWAIT);
603 			if (resp == NULL)
604 				ERROUT(ENOMEM);
605 			info = (struct ng_ppp_mp_state *)resp->data;
606 			bzero(info, sizeof(*info));
607 			for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
608 				if (priv->links[i].seq != MP_NOSEQ)
609 					info->rseq[i] = priv->links[i].seq;
610 			}
611 			info->mseq = priv->mseq;
612 			info->xseq = priv->xseq;
613 			break;
614 		    }
615 		case NGM_PPP_GET_LINK_STATS:
616 		case NGM_PPP_CLR_LINK_STATS:
617 		case NGM_PPP_GETCLR_LINK_STATS:
618 		    {
619 			struct ng_ppp_link_stat *stats;
620 			uint16_t linkNum;
621 
622 			if (msg->header.arglen != sizeof(uint16_t))
623 				ERROUT(EINVAL);
624 			linkNum = *((uint16_t *) msg->data);
625 			if (linkNum >= NG_PPP_MAX_LINKS
626 			    && linkNum != NG_PPP_BUNDLE_LINKNUM)
627 				ERROUT(EINVAL);
628 			stats = (linkNum == NG_PPP_BUNDLE_LINKNUM) ?
629 			    &priv->bundleStats : &priv->links[linkNum].stats;
630 			if (msg->header.cmd != NGM_PPP_CLR_LINK_STATS) {
631 				NG_MKRESPONSE(resp, msg,
632 				    sizeof(struct ng_ppp_link_stat), M_NOWAIT);
633 				if (resp == NULL)
634 					ERROUT(ENOMEM);
635 				bcopy(stats, resp->data, sizeof(*stats));
636 			}
637 			if (msg->header.cmd != NGM_PPP_GET_LINK_STATS)
638 				bzero(stats, sizeof(*stats));
639 			break;
640 		    }
641 		default:
642 			error = EINVAL;
643 			break;
644 		}
645 		break;
646 	case NGM_VJC_COOKIE:
647 	    {
648 		/*
649 		 * Forward it to the vjc node. leave the
650 		 * old return address alone.
651 		 * If we have no hook, let NG_RESPOND_MSG
652 		 * clean up any remaining resources.
653 		 * Because we have no resp, the item will be freed
654 		 * along with anything it references. Don't
655 		 * let msg be freed twice.
656 		 */
657 		NGI_MSG(item) = msg;	/* put it back in the item */
658 		msg = NULL;
659 		if ((lasthook = priv->hooks[HOOK_INDEX_VJC_IP])) {
660 			NG_FWD_ITEM_HOOK(error, item, lasthook);
661 		}
662 		return (error);
663 	    }
664 	default:
665 		error = EINVAL;
666 		break;
667 	}
668 done:
669 	NG_RESPOND_MSG(error, node, item, resp);
670 	NG_FREE_MSG(msg);
671 	return (error);
672 }
673 
674 /*
675  * Destroy node
676  */
677 static int
678 ng_ppp_shutdown(node_p node)
679 {
680 	const priv_p priv = NG_NODE_PRIVATE(node);
681 
682 	/* Stop fragment queue timer */
683 	ng_ppp_stop_frag_timer(node);
684 
685 	/* Take down netgraph node */
686 	ng_ppp_frag_reset(node);
687 	bzero(priv, sizeof(*priv));
688 	FREE(priv, M_NETGRAPH_PPP);
689 	NG_NODE_SET_PRIVATE(node, NULL);
690 	NG_NODE_UNREF(node);		/* let the node escape */
691 	return (0);
692 }
693 
694 /*
695  * Hook disconnection
696  */
697 static int
698 ng_ppp_disconnect(hook_p hook)
699 {
700 	const node_p node = NG_HOOK_NODE(hook);
701 	const priv_p priv = NG_NODE_PRIVATE(node);
702 	const int index = (intptr_t)NG_HOOK_PRIVATE(hook);
703 
704 	/* Zero out hook pointer */
705 	if (index < 0)
706 		priv->links[~index].hook = NULL;
707 	else
708 		priv->hooks[index] = NULL;
709 
710 	/* Update derived info (or go away if no hooks left). */
711 	if (NG_NODE_NUMHOOKS(node) > 0)
712 		ng_ppp_update(node, 0);
713 	else if (NG_NODE_IS_VALID(node))
714 		ng_rmnode_self(node);
715 
716 	return (0);
717 }
718 
719 /*
720  * Proto layer
721  */
722 
723 /*
724  * Receive data on a hook inet.
725  */
726 static int
727 ng_ppp_rcvdata_inet(hook_p hook, item_p item)
728 {
729 	const node_p node = NG_HOOK_NODE(hook);
730 	const priv_p priv = NG_NODE_PRIVATE(node);
731 
732 	if (!priv->conf.enableIP) {
733 		NG_FREE_ITEM(item);
734 		return (ENXIO);
735 	}
736 	return (ng_ppp_hcomp_xmit(NG_HOOK_NODE(hook), item, PROT_IP));
737 }
738 
739 /*
740  * Receive data on a hook ipv6.
741  */
742 static int
743 ng_ppp_rcvdata_ipv6(hook_p hook, item_p item)
744 {
745 	const node_p node = NG_HOOK_NODE(hook);
746 	const priv_p priv = NG_NODE_PRIVATE(node);
747 
748 	if (!priv->conf.enableIPv6) {
749 		NG_FREE_ITEM(item);
750 		return (ENXIO);
751 	}
752 	return (ng_ppp_hcomp_xmit(NG_HOOK_NODE(hook), item, PROT_IPV6));
753 }
754 
755 /*
756  * Receive data on a hook atalk.
757  */
758 static int
759 ng_ppp_rcvdata_atalk(hook_p hook, item_p item)
760 {
761 	const node_p node = NG_HOOK_NODE(hook);
762 	const priv_p priv = NG_NODE_PRIVATE(node);
763 
764 	if (!priv->conf.enableAtalk) {
765 		NG_FREE_ITEM(item);
766 		return (ENXIO);
767 	}
768 	return (ng_ppp_hcomp_xmit(NG_HOOK_NODE(hook), item, PROT_ATALK));
769 }
770 
771 /*
772  * Receive data on a hook ipx
773  */
774 static int
775 ng_ppp_rcvdata_ipx(hook_p hook, item_p item)
776 {
777 	const node_p node = NG_HOOK_NODE(hook);
778 	const priv_p priv = NG_NODE_PRIVATE(node);
779 
780 	if (!priv->conf.enableIPX) {
781 		NG_FREE_ITEM(item);
782 		return (ENXIO);
783 	}
784 	return (ng_ppp_hcomp_xmit(NG_HOOK_NODE(hook), item, PROT_IPX));
785 }
786 
787 /*
788  * Receive data on a hook bypass
789  */
790 static int
791 ng_ppp_rcvdata_bypass(hook_p hook, item_p item)
792 {
793 	uint16_t linkNum;
794 	uint16_t proto;
795 	struct mbuf *m;
796 
797 	NGI_GET_M(item, m);
798 	if (m->m_pkthdr.len < 4) {
799 		NG_FREE_ITEM(item);
800 		return (EINVAL);
801 	}
802 	if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
803 		NG_FREE_ITEM(item);
804 		return (ENOBUFS);
805 	}
806 	linkNum = ntohs(mtod(m, uint16_t *)[0]);
807 	proto = ntohs(mtod(m, uint16_t *)[1]);
808 	m_adj(m, 4);
809 	NGI_M(item) = m;
810 
811 	if (linkNum == NG_PPP_BUNDLE_LINKNUM)
812 		return (ng_ppp_hcomp_xmit(NG_HOOK_NODE(hook), item, proto));
813 	else
814 		return (ng_ppp_link_xmit(NG_HOOK_NODE(hook), item, proto,
815 		    linkNum));
816 }
817 
818 static int
819 ng_ppp_bypass(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
820 {
821 	const priv_p priv = NG_NODE_PRIVATE(node);
822 	uint16_t hdr[2];
823 	struct mbuf *m;
824 	int error;
825 
826 	if (priv->hooks[HOOK_INDEX_BYPASS] == NULL) {
827 	    NG_FREE_ITEM(item);
828 	    return (ENXIO);
829 	}
830 
831 	/* Add 4-byte bypass header. */
832 	hdr[0] = htons(linkNum);
833 	hdr[1] = htons(proto);
834 
835 	NGI_GET_M(item, m);
836 	if ((m = ng_ppp_prepend(m, &hdr, 4)) == NULL) {
837 		NG_FREE_ITEM(item);
838 		return (ENOBUFS);
839 	}
840 	NGI_M(item) = m;
841 
842 	/* Send packet out hook. */
843 	NG_FWD_ITEM_HOOK(error, item, priv->hooks[HOOK_INDEX_BYPASS]);
844 	return (error);
845 }
846 
847 static int
848 ng_ppp_proto_recv(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
849 {
850 	const priv_p priv = NG_NODE_PRIVATE(node);
851 	hook_p outHook = NULL;
852 	int error;
853 
854 	switch (proto) {
855 	    case PROT_IP:
856 		if (priv->conf.enableIP)
857 		    outHook = priv->hooks[HOOK_INDEX_INET];
858 		break;
859 	    case PROT_IPV6:
860 		if (priv->conf.enableIPv6)
861 		    outHook = priv->hooks[HOOK_INDEX_IPV6];
862 		break;
863 	    case PROT_ATALK:
864 		if (priv->conf.enableAtalk)
865 		    outHook = priv->hooks[HOOK_INDEX_ATALK];
866 		break;
867 	    case PROT_IPX:
868 		if (priv->conf.enableIPX)
869 		    outHook = priv->hooks[HOOK_INDEX_IPX];
870 		break;
871 	}
872 
873 	if (outHook == NULL)
874 		return (ng_ppp_bypass(node, item, proto, linkNum));
875 
876 	/* Send packet out hook. */
877 	NG_FWD_ITEM_HOOK(error, item, outHook);
878 	return (error);
879 }
880 
881 /*
882  * Header compression layer
883  */
884 
885 static int
886 ng_ppp_hcomp_xmit(node_p node, item_p item, uint16_t proto)
887 {
888 	const priv_p priv = NG_NODE_PRIVATE(node);
889 
890 	if (proto == PROT_IP &&
891 	    priv->conf.enableVJCompression &&
892 	    priv->vjCompHooked) {
893 		int error;
894 
895 		/* Send packet out hook. */
896 		NG_FWD_ITEM_HOOK(error, item, priv->hooks[HOOK_INDEX_VJC_IP]);
897 		return (error);
898 	}
899 
900 	return (ng_ppp_comp_xmit(node, item, proto));
901 }
902 
903 /*
904  * Receive data on a hook vjc_comp.
905  */
906 static int
907 ng_ppp_rcvdata_vjc_comp(hook_p hook, item_p item)
908 {
909 	const node_p node = NG_HOOK_NODE(hook);
910 	const priv_p priv = NG_NODE_PRIVATE(node);
911 
912 	if (!priv->conf.enableVJCompression) {
913 		NG_FREE_ITEM(item);
914 		return (ENXIO);
915 	}
916 	return (ng_ppp_comp_xmit(node, item, PROT_VJCOMP));
917 }
918 
919 /*
920  * Receive data on a hook vjc_uncomp.
921  */
922 static int
923 ng_ppp_rcvdata_vjc_uncomp(hook_p hook, item_p item)
924 {
925 	const node_p node = NG_HOOK_NODE(hook);
926 	const priv_p priv = NG_NODE_PRIVATE(node);
927 
928 	if (!priv->conf.enableVJCompression) {
929 		NG_FREE_ITEM(item);
930 		return (ENXIO);
931 	}
932 	return (ng_ppp_comp_xmit(node, item, PROT_VJUNCOMP));
933 }
934 
935 /*
936  * Receive data on a hook vjc_vjip.
937  */
938 static int
939 ng_ppp_rcvdata_vjc_vjip(hook_p hook, item_p item)
940 {
941 	const node_p node = NG_HOOK_NODE(hook);
942 	const priv_p priv = NG_NODE_PRIVATE(node);
943 
944 	if (!priv->conf.enableVJCompression) {
945 		NG_FREE_ITEM(item);
946 		return (ENXIO);
947 	}
948 	return (ng_ppp_comp_xmit(node, item, PROT_IP));
949 }
950 
951 static int
952 ng_ppp_hcomp_recv(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
953 {
954 	const priv_p priv = NG_NODE_PRIVATE(node);
955 
956 	if (priv->conf.enableVJDecompression && priv->vjCompHooked) {
957 		hook_p outHook = NULL;
958 
959 		switch (proto) {
960 		    case PROT_VJCOMP:
961 			outHook = priv->hooks[HOOK_INDEX_VJC_COMP];
962 			break;
963 		    case PROT_VJUNCOMP:
964 			outHook = priv->hooks[HOOK_INDEX_VJC_UNCOMP];
965 			break;
966 		}
967 
968 		if (outHook) {
969 			int error;
970 
971 			/* Send packet out hook. */
972 			NG_FWD_ITEM_HOOK(error, item, outHook);
973 			return (error);
974 		}
975 	}
976 
977 	return (ng_ppp_proto_recv(node, item, proto, linkNum));
978 }
979 
980 /*
981  * Receive data on a hook vjc_ip.
982  */
983 static int
984 ng_ppp_rcvdata_vjc_ip(hook_p hook, item_p item)
985 {
986 	const node_p node = NG_HOOK_NODE(hook);
987 	const priv_p priv = NG_NODE_PRIVATE(node);
988 
989 	if (!priv->conf.enableVJCompression) {
990 		NG_FREE_ITEM(item);
991 		return (ENXIO);
992 	}
993 	return (ng_ppp_proto_recv(node, item, PROT_IP, NG_PPP_BUNDLE_LINKNUM));
994 }
995 
996 /*
997  * Compression layer
998  */
999 
1000 static int
1001 ng_ppp_comp_xmit(node_p node, item_p item, uint16_t proto)
1002 {
1003 	const priv_p priv = NG_NODE_PRIVATE(node);
1004 
1005 	if (priv->conf.enableCompression &&
1006 	    proto < 0x4000 &&
1007 	    proto != PROT_COMPD &&
1008 	    proto != PROT_CRYPTD &&
1009 	    priv->hooks[HOOK_INDEX_COMPRESS] != NULL) {
1010 	        struct mbuf *m;
1011 		int error;
1012 
1013 	        NGI_GET_M(item, m);
1014 		if ((m = ng_ppp_addproto(m, proto, 0)) == NULL) {
1015 			NG_FREE_ITEM(item);
1016 			return (ENOBUFS);
1017 		}
1018 		NGI_M(item) = m;
1019 
1020 		/* Send packet out hook. */
1021 		NG_FWD_ITEM_HOOK(error, item, priv->hooks[HOOK_INDEX_COMPRESS]);
1022 		return (error);
1023 	}
1024 
1025 	return (ng_ppp_crypt_xmit(node, item, proto));
1026 }
1027 
1028 /*
1029  * Receive data on a hook compress.
1030  */
1031 static int
1032 ng_ppp_rcvdata_compress(hook_p hook, item_p item)
1033 {
1034 	const node_p node = NG_HOOK_NODE(hook);
1035 	const priv_p priv = NG_NODE_PRIVATE(node);
1036 	uint16_t proto;
1037 
1038 	switch (priv->conf.enableCompression) {
1039 	    case NG_PPP_COMPRESS_NONE:
1040 		NG_FREE_ITEM(item);
1041 		return (ENXIO);
1042 	    case NG_PPP_COMPRESS_FULL:
1043 		{
1044 			struct mbuf *m;
1045 
1046 			NGI_GET_M(item, m);
1047 			if ((m = ng_ppp_cutproto(m, &proto)) == NULL) {
1048 				NG_FREE_ITEM(item);
1049 				return (EIO);
1050 			}
1051 			NGI_M(item) = m;
1052 			if (!PROT_VALID(proto)) {
1053 				NG_FREE_ITEM(item);
1054 				return (EIO);
1055 			}
1056 		}
1057 		break;
1058 	    default:
1059 		proto = PROT_COMPD;
1060 		break;
1061 	}
1062 	return (ng_ppp_crypt_xmit(node, item, proto));
1063 }
1064 
1065 static int
1066 ng_ppp_comp_recv(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
1067 {
1068 	const priv_p priv = NG_NODE_PRIVATE(node);
1069 
1070 	if (proto < 0x4000 &&
1071 	    ((proto == PROT_COMPD && priv->conf.enableDecompression) ||
1072 	    priv->conf.enableDecompression == NG_PPP_DECOMPRESS_FULL) &&
1073 	    priv->hooks[HOOK_INDEX_DECOMPRESS] != NULL) {
1074 		int error;
1075 
1076 		if (priv->conf.enableDecompression == NG_PPP_DECOMPRESS_FULL) {
1077 			struct mbuf *m;
1078 			NGI_GET_M(item, m);
1079 			if ((m = ng_ppp_addproto(m, proto, 0)) == NULL) {
1080 				NG_FREE_ITEM(item);
1081 				return (EIO);
1082 			}
1083 			NGI_M(item) = m;
1084 		}
1085 
1086 		/* Send packet out hook. */
1087 		NG_FWD_ITEM_HOOK(error, item,
1088 		    priv->hooks[HOOK_INDEX_DECOMPRESS]);
1089 		return (error);
1090 	} else if (proto == PROT_COMPD) {
1091 		/* Disabled protos MUST be silently discarded, but
1092 		 * unsupported MUST not. Let user-level decide this. */
1093 		return (ng_ppp_bypass(node, item, proto, linkNum));
1094 	}
1095 
1096 	return (ng_ppp_hcomp_recv(node, item, proto, linkNum));
1097 }
1098 
1099 /*
1100  * Receive data on a hook decompress.
1101  */
1102 static int
1103 ng_ppp_rcvdata_decompress(hook_p hook, item_p item)
1104 {
1105 	const node_p node = NG_HOOK_NODE(hook);
1106 	const priv_p priv = NG_NODE_PRIVATE(node);
1107 	uint16_t proto;
1108 	struct mbuf *m;
1109 
1110 	if (!priv->conf.enableDecompression) {
1111 		NG_FREE_ITEM(item);
1112 		return (ENXIO);
1113 	}
1114 	NGI_GET_M(item, m);
1115 	if ((m = ng_ppp_cutproto(m, &proto)) == NULL) {
1116 	        NG_FREE_ITEM(item);
1117 	        return (EIO);
1118 	}
1119 	NGI_M(item) = m;
1120 	if (!PROT_VALID(proto)) {
1121 		priv->bundleStats.badProtos++;
1122 		NG_FREE_ITEM(item);
1123 		return (EIO);
1124 	}
1125 	return (ng_ppp_hcomp_recv(node, item, proto, NG_PPP_BUNDLE_LINKNUM));
1126 }
1127 
1128 /*
1129  * Encryption layer
1130  */
1131 
1132 static int
1133 ng_ppp_crypt_xmit(node_p node, item_p item, uint16_t proto)
1134 {
1135 	const priv_p priv = NG_NODE_PRIVATE(node);
1136 
1137 	if (priv->conf.enableEncryption &&
1138 	    proto < 0x4000 &&
1139 	    proto != PROT_CRYPTD &&
1140 	    priv->hooks[HOOK_INDEX_ENCRYPT] != NULL) {
1141 		struct mbuf *m;
1142 		int error;
1143 
1144 	        NGI_GET_M(item, m);
1145 		if ((m = ng_ppp_addproto(m, proto, 0)) == NULL) {
1146 			NG_FREE_ITEM(item);
1147 			return (ENOBUFS);
1148 		}
1149 		NGI_M(item) = m;
1150 
1151 		/* Send packet out hook. */
1152 		NG_FWD_ITEM_HOOK(error, item, priv->hooks[HOOK_INDEX_ENCRYPT]);
1153 		return (error);
1154 	}
1155 
1156 	return (ng_ppp_mp_xmit(node, item, proto));
1157 }
1158 
1159 /*
1160  * Receive data on a hook encrypt.
1161  */
1162 static int
1163 ng_ppp_rcvdata_encrypt(hook_p hook, item_p item)
1164 {
1165 	const node_p node = NG_HOOK_NODE(hook);
1166 	const priv_p priv = NG_NODE_PRIVATE(node);
1167 
1168 	if (!priv->conf.enableEncryption) {
1169 		NG_FREE_ITEM(item);
1170 		return (ENXIO);
1171 	}
1172 	return (ng_ppp_mp_xmit(node, item, PROT_CRYPTD));
1173 }
1174 
1175 static int
1176 ng_ppp_crypt_recv(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
1177 {
1178 	const priv_p priv = NG_NODE_PRIVATE(node);
1179 
1180 	/* Stats */
1181 	priv->bundleStats.recvFrames++;
1182 	priv->bundleStats.recvOctets += NGI_M(item)->m_pkthdr.len;
1183 
1184 	if (proto == PROT_CRYPTD) {
1185 		if (priv->conf.enableDecryption &&
1186 		    priv->hooks[HOOK_INDEX_DECRYPT] != NULL) {
1187 			int error;
1188 
1189 			/* Send packet out hook. */
1190 			NG_FWD_ITEM_HOOK(error, item,
1191 			    priv->hooks[HOOK_INDEX_DECRYPT]);
1192 			return (error);
1193 		} else {
1194 			/* Disabled protos MUST be silently discarded, but
1195 			 * unsupported MUST not. Let user-level decide this. */
1196 			return (ng_ppp_bypass(node, item, proto, linkNum));
1197 		}
1198 	}
1199 
1200 	return (ng_ppp_comp_recv(node, item, proto, linkNum));
1201 }
1202 
1203 /*
1204  * Receive data on a hook decrypt.
1205  */
1206 static int
1207 ng_ppp_rcvdata_decrypt(hook_p hook, item_p item)
1208 {
1209 	const node_p node = NG_HOOK_NODE(hook);
1210 	const priv_p priv = NG_NODE_PRIVATE(node);
1211 	uint16_t proto;
1212 	struct mbuf *m;
1213 
1214 	if (!priv->conf.enableDecryption) {
1215 		NG_FREE_ITEM(item);
1216 		return (ENXIO);
1217 	}
1218 	NGI_GET_M(item, m);
1219 	if ((m = ng_ppp_cutproto(m, &proto)) == NULL) {
1220 	        NG_FREE_ITEM(item);
1221 	        return (EIO);
1222 	}
1223 	NGI_M(item) = m;
1224 	if (!PROT_VALID(proto)) {
1225 		priv->bundleStats.badProtos++;
1226 		NG_FREE_ITEM(item);
1227 		return (EIO);
1228 	}
1229 	return (ng_ppp_comp_recv(node, item, proto, NG_PPP_BUNDLE_LINKNUM));
1230 }
1231 
1232 /*
1233  * Link layer
1234  */
1235 
1236 static int
1237 ng_ppp_link_xmit(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
1238 {
1239 	const priv_p priv = NG_NODE_PRIVATE(node);
1240 	struct ng_ppp_link *link;
1241 	int len, error;
1242 	struct mbuf *m;
1243 	uint16_t mru;
1244 
1245 	/* Check if link correct. */
1246 	if (linkNum >= NG_PPP_MAX_LINKS) {
1247 		NG_FREE_ITEM(item);
1248 		return (ENETDOWN);
1249 	}
1250 
1251 	/* Get link pointer (optimization). */
1252 	link = &priv->links[linkNum];
1253 
1254 	/* Check link status (if real). */
1255 	if (link->hook == NULL) {
1256 		NG_FREE_ITEM(item);
1257 		return (ENETDOWN);
1258 	}
1259 
1260 	/* Extract mbuf. */
1261 	NGI_GET_M(item, m);
1262 
1263 	/* Check peer's MRU for this link. */
1264 	mru = link->conf.mru;
1265 	if (mru != 0 && m->m_pkthdr.len > mru) {
1266 		NG_FREE_M(m);
1267 		NG_FREE_ITEM(item);
1268 		return (EMSGSIZE);
1269 	}
1270 
1271 	/* Prepend protocol number, possibly compressed. */
1272 	if ((m = ng_ppp_addproto(m, proto, link->conf.enableProtoComp)) ==
1273 	    NULL) {
1274 		NG_FREE_ITEM(item);
1275 		return (ENOBUFS);
1276 	}
1277 
1278 	/* Prepend address and control field (unless compressed). */
1279 	if (proto == PROT_LCP || !link->conf.enableACFComp) {
1280 		if ((m = ng_ppp_prepend(m, &ng_ppp_acf, 2)) == NULL) {
1281 			NG_FREE_ITEM(item);
1282 			return (ENOBUFS);
1283 		}
1284 	}
1285 
1286 	/* Deliver frame. */
1287 	len = m->m_pkthdr.len;
1288 	NG_FWD_NEW_DATA(error, item, link->hook, m);
1289 
1290 	/* Update stats and 'bytes in queue' counter. */
1291 	if (error == 0) {
1292 		link->stats.xmitFrames++;
1293 		link->stats.xmitOctets += len;
1294 
1295 		/* bytesInQueue and lastWrite required only for mp_strategy. */
1296 		if (priv->conf.enableMultilink && !priv->allLinksEqual &&
1297 		    !priv->conf.enableRoundRobin) {
1298 			/* If queue was empty, then mark this time. */
1299 			if (link->bytesInQueue == 0)
1300 				getmicrouptime(&link->lastWrite);
1301 			link->bytesInQueue += len + MP_AVERAGE_LINK_OVERHEAD;
1302 			/* Limit max queue length to 50 pkts. BW can be defined
1303 		    	   incorrectly and link may not signal overload. */
1304 			if (link->bytesInQueue > 50 * 1600)
1305 				link->bytesInQueue = 50 * 1600;
1306 		}
1307 	}
1308 	return (error);
1309 }
1310 
1311 /*
1312  * Receive data on a hook linkX.
1313  */
1314 static int
1315 ng_ppp_rcvdata(hook_p hook, item_p item)
1316 {
1317 	const node_p node = NG_HOOK_NODE(hook);
1318 	const priv_p priv = NG_NODE_PRIVATE(node);
1319 	const int index = (intptr_t)NG_HOOK_PRIVATE(hook);
1320 	const uint16_t linkNum = (uint16_t)~index;
1321 	struct ng_ppp_link * const link = &priv->links[linkNum];
1322 	uint16_t proto;
1323 	struct mbuf *m;
1324 
1325 	KASSERT(linkNum < NG_PPP_MAX_LINKS,
1326 	    ("%s: bogus index 0x%x", __func__, index));
1327 
1328 	NGI_GET_M(item, m);
1329 
1330 	/* Stats */
1331 	link->stats.recvFrames++;
1332 	link->stats.recvOctets += m->m_pkthdr.len;
1333 
1334 	/* Strip address and control fields, if present. */
1335 	if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
1336 		NG_FREE_ITEM(item);
1337 		return (ENOBUFS);
1338 	}
1339 	if (bcmp(mtod(m, uint8_t *), &ng_ppp_acf, 2) == 0)
1340 		m_adj(m, 2);
1341 
1342 	if ((m = ng_ppp_cutproto(m, &proto)) == NULL) {
1343 		NG_FREE_ITEM(item);
1344 		return (ENOBUFS);
1345 	}
1346 	NGI_M(item) = m; 	/* Put changed m back into item. */
1347 
1348 	if (!PROT_VALID(proto)) {
1349 		link->stats.badProtos++;
1350 		NG_FREE_ITEM(item);
1351 		return (EIO);
1352 	}
1353 
1354 	/* LCP packets must go directly to bypass. */
1355 	if (proto >= 0xB000)
1356 		return (ng_ppp_bypass(node, item, proto, linkNum));
1357 
1358 	if (!link->conf.enableLink) {
1359 		/* Non-LCP packets are denied on a disabled link. */
1360 		NG_FREE_ITEM(item);
1361 		return (ENXIO);
1362 	}
1363 
1364 	return (ng_ppp_mp_recv(node, item, proto, linkNum));
1365 }
1366 
1367 /*
1368  * Multilink layer
1369  */
1370 
1371 /*
1372  * Handle an incoming multi-link fragment
1373  *
1374  * The fragment reassembly algorithm is somewhat complex. This is mainly
1375  * because we are required not to reorder the reconstructed packets, yet
1376  * fragments are only guaranteed to arrive in order on a per-link basis.
1377  * In other words, when we have a complete packet ready, but the previous
1378  * packet is still incomplete, we have to decide between delivering the
1379  * complete packet and throwing away the incomplete one, or waiting to
1380  * see if the remainder of the incomplete one arrives, at which time we
1381  * can deliver both packets, in order.
1382  *
1383  * This problem is exacerbated by "sequence number slew", which is when
1384  * the sequence numbers coming in from different links are far apart from
1385  * each other. In particular, certain unnamed equipment (*cough* Ascend)
1386  * has been seen to generate sequence number slew of up to 10 on an ISDN
1387  * 2B-channel MP link. There is nothing invalid about sequence number slew
1388  * but it makes the reasssembly process have to work harder.
1389  *
1390  * However, the peer is required to transmit fragments in order on each
1391  * link. That means if we define MSEQ as the minimum over all links of
1392  * the highest sequence number received on that link, then we can always
1393  * give up any hope of receiving a fragment with sequence number < MSEQ in
1394  * the future (all of this using 'wraparound' sequence number space).
1395  * Therefore we can always immediately throw away incomplete packets
1396  * missing fragments with sequence numbers < MSEQ.
1397  *
1398  * Here is an overview of our algorithm:
1399  *
1400  *    o Received fragments are inserted into a queue, for which we
1401  *	maintain these invariants between calls to this function:
1402  *
1403  *	- Fragments are ordered in the queue by sequence number
1404  *	- If a complete packet is at the head of the queue, then
1405  *	  the first fragment in the packet has seq# > MSEQ + 1
1406  *	  (otherwise, we could deliver it immediately)
1407  *	- If any fragments have seq# < MSEQ, then they are necessarily
1408  *	  part of a packet whose missing seq#'s are all > MSEQ (otherwise,
1409  *	  we can throw them away because they'll never be completed)
1410  *	- The queue contains at most MP_MAX_QUEUE_LEN fragments
1411  *
1412  *    o We have a periodic timer that checks the queue for the first
1413  *	complete packet that has been sitting in the queue "too long".
1414  *	When one is detected, all previous (incomplete) fragments are
1415  *	discarded, their missing fragments are declared lost and MSEQ
1416  *	is increased.
1417  *
1418  *    o If we recieve a fragment with seq# < MSEQ, we throw it away
1419  *	because we've already delcared it lost.
1420  *
1421  * This assumes linkNum != NG_PPP_BUNDLE_LINKNUM.
1422  */
1423 static int
1424 ng_ppp_mp_recv(node_p node, item_p item, uint16_t proto, uint16_t linkNum)
1425 {
1426 	const priv_p priv = NG_NODE_PRIVATE(node);
1427 	struct ng_ppp_link *const link = &priv->links[linkNum];
1428 	struct ng_ppp_frag frag0, *frag = &frag0;
1429 	struct ng_ppp_frag *qent;
1430 	int i, diff, inserted;
1431 	struct mbuf *m;
1432 
1433 	if ((!priv->conf.enableMultilink) || proto != PROT_MP)
1434 		return (ng_ppp_crypt_recv(node, item, proto, linkNum));
1435 
1436 	NGI_GET_M(item, m);
1437 	NG_FREE_ITEM(item);
1438 
1439 	/* Extract fragment information from MP header */
1440 	if (priv->conf.recvShortSeq) {
1441 		uint16_t shdr;
1442 
1443 		if (m->m_pkthdr.len < 2) {
1444 			link->stats.runts++;
1445 			NG_FREE_M(m);
1446 			return (EINVAL);
1447 		}
1448 		if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL)
1449 			return (ENOBUFS);
1450 
1451 		shdr = ntohs(*mtod(m, uint16_t *));
1452 		frag->seq = MP_SHORT_EXTEND(shdr);
1453 		frag->first = (shdr & MP_SHORT_FIRST_FLAG) != 0;
1454 		frag->last = (shdr & MP_SHORT_LAST_FLAG) != 0;
1455 		diff = MP_SHORT_SEQ_DIFF(frag->seq, priv->mseq);
1456 		m_adj(m, 2);
1457 	} else {
1458 		uint32_t lhdr;
1459 
1460 		if (m->m_pkthdr.len < 4) {
1461 			link->stats.runts++;
1462 			NG_FREE_M(m);
1463 			return (EINVAL);
1464 		}
1465 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL)
1466 			return (ENOBUFS);
1467 
1468 		lhdr = ntohl(*mtod(m, uint32_t *));
1469 		frag->seq = MP_LONG_EXTEND(lhdr);
1470 		frag->first = (lhdr & MP_LONG_FIRST_FLAG) != 0;
1471 		frag->last = (lhdr & MP_LONG_LAST_FLAG) != 0;
1472 		diff = MP_LONG_SEQ_DIFF(frag->seq, priv->mseq);
1473 		m_adj(m, 4);
1474 	}
1475 	frag->data = m;
1476 	getmicrouptime(&frag->timestamp);
1477 
1478 	/* If sequence number is < MSEQ, we've already declared this
1479 	   fragment as lost, so we have no choice now but to drop it */
1480 	if (diff < 0) {
1481 		link->stats.dropFragments++;
1482 		NG_FREE_M(m);
1483 		return (0);
1484 	}
1485 
1486 	/* Update highest received sequence number on this link and MSEQ */
1487 	priv->mseq = link->seq = frag->seq;
1488 	for (i = 0; i < priv->numActiveLinks; i++) {
1489 		struct ng_ppp_link *const alink =
1490 		    &priv->links[priv->activeLinks[i]];
1491 
1492 		if (MP_RECV_SEQ_DIFF(priv, alink->seq, priv->mseq) < 0)
1493 			priv->mseq = alink->seq;
1494 	}
1495 
1496 	/* Allocate a new frag struct for the queue */
1497 	MALLOC(frag, struct ng_ppp_frag *, sizeof(*frag), M_NETGRAPH_PPP, M_NOWAIT);
1498 	if (frag == NULL) {
1499 		NG_FREE_M(m);
1500 		ng_ppp_frag_process(node);
1501 		return (ENOMEM);
1502 	}
1503 	*frag = frag0;
1504 
1505 	/* Add fragment to queue, which is sorted by sequence number */
1506 	inserted = 0;
1507 	TAILQ_FOREACH_REVERSE(qent, &priv->frags, ng_ppp_fraglist, f_qent) {
1508 		diff = MP_RECV_SEQ_DIFF(priv, frag->seq, qent->seq);
1509 		if (diff > 0) {
1510 			TAILQ_INSERT_AFTER(&priv->frags, qent, frag, f_qent);
1511 			inserted = 1;
1512 			break;
1513 		} else if (diff == 0) {	     /* should never happen! */
1514 			link->stats.dupFragments++;
1515 			NG_FREE_M(frag->data);
1516 			FREE(frag, M_NETGRAPH_PPP);
1517 			return (EINVAL);
1518 		}
1519 	}
1520 	if (!inserted)
1521 		TAILQ_INSERT_HEAD(&priv->frags, frag, f_qent);
1522 	priv->qlen++;
1523 
1524 	/* Process the queue */
1525 	return ng_ppp_frag_process(node);
1526 }
1527 
1528 /************************************************************************
1529 			HELPER STUFF
1530  ************************************************************************/
1531 
1532 /*
1533  * If new mseq > current then set it and update all active links
1534  */
1535 static void
1536 ng_ppp_bump_mseq(node_p node, int32_t new_mseq)
1537 {
1538 	const priv_p priv = NG_NODE_PRIVATE(node);
1539 	int i;
1540 
1541 	if (MP_RECV_SEQ_DIFF(priv, priv->mseq, new_mseq) < 0) {
1542 		priv->mseq = new_mseq;
1543 		for (i = 0; i < priv->numActiveLinks; i++) {
1544 			struct ng_ppp_link *const alink =
1545 			    &priv->links[priv->activeLinks[i]];
1546 
1547 			if (MP_RECV_SEQ_DIFF(priv,
1548 			    alink->seq, new_mseq) < 0)
1549 				alink->seq = new_mseq;
1550 		}
1551 	}
1552 }
1553 
1554 /*
1555  * Examine our list of fragments, and determine if there is a
1556  * complete and deliverable packet at the head of the list.
1557  * Return 1 if so, zero otherwise.
1558  */
1559 static int
1560 ng_ppp_check_packet(node_p node)
1561 {
1562 	const priv_p priv = NG_NODE_PRIVATE(node);
1563 	struct ng_ppp_frag *qent, *qnext;
1564 
1565 	/* Check for empty queue */
1566 	if (TAILQ_EMPTY(&priv->frags))
1567 		return (0);
1568 
1569 	/* Check first fragment is the start of a deliverable packet */
1570 	qent = TAILQ_FIRST(&priv->frags);
1571 	if (!qent->first || MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) > 1)
1572 		return (0);
1573 
1574 	/* Check that all the fragments are there */
1575 	while (!qent->last) {
1576 		qnext = TAILQ_NEXT(qent, f_qent);
1577 		if (qnext == NULL)	/* end of queue */
1578 			return (0);
1579 		if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq))
1580 			return (0);
1581 		qent = qnext;
1582 	}
1583 
1584 	/* Got one */
1585 	return (1);
1586 }
1587 
1588 /*
1589  * Pull a completed packet off the head of the incoming fragment queue.
1590  * This assumes there is a completed packet there to pull off.
1591  */
1592 static void
1593 ng_ppp_get_packet(node_p node, struct mbuf **mp)
1594 {
1595 	const priv_p priv = NG_NODE_PRIVATE(node);
1596 	struct ng_ppp_frag *qent, *qnext;
1597 	struct mbuf *m = NULL, *tail;
1598 
1599 	qent = TAILQ_FIRST(&priv->frags);
1600 	KASSERT(!TAILQ_EMPTY(&priv->frags) && qent->first,
1601 	    ("%s: no packet", __func__));
1602 	for (tail = NULL; qent != NULL; qent = qnext) {
1603 		qnext = TAILQ_NEXT(qent, f_qent);
1604 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1605 		    ("%s: empty q", __func__));
1606 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1607 		if (tail == NULL)
1608 			tail = m = qent->data;
1609 		else {
1610 			m->m_pkthdr.len += qent->data->m_pkthdr.len;
1611 			tail->m_next = qent->data;
1612 		}
1613 		while (tail->m_next != NULL)
1614 			tail = tail->m_next;
1615 		if (qent->last) {
1616 			qnext = NULL;
1617 			/* Bump MSEQ if necessary */
1618 			ng_ppp_bump_mseq(node, qent->seq);
1619 		}
1620 		FREE(qent, M_NETGRAPH_PPP);
1621 		priv->qlen--;
1622 	}
1623 	*mp = m;
1624 }
1625 
1626 /*
1627  * Trim fragments from the queue whose packets can never be completed.
1628  * This assumes a complete packet is NOT at the beginning of the queue.
1629  * Returns 1 if fragments were removed, zero otherwise.
1630  */
1631 static int
1632 ng_ppp_frag_trim(node_p node)
1633 {
1634 	const priv_p priv = NG_NODE_PRIVATE(node);
1635 	struct ng_ppp_frag *qent, *qnext = NULL;
1636 	int removed = 0;
1637 
1638 	/* Scan for "dead" fragments and remove them */
1639 	while (1) {
1640 		int dead = 0;
1641 
1642 		/* If queue is empty, we're done */
1643 		if (TAILQ_EMPTY(&priv->frags))
1644 			break;
1645 
1646 		/* Determine whether first fragment can ever be completed */
1647 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1648 			if (MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) >= 0)
1649 				break;
1650 			qnext = TAILQ_NEXT(qent, f_qent);
1651 			KASSERT(qnext != NULL,
1652 			    ("%s: last frag < MSEQ?", __func__));
1653 			if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq)
1654 			    || qent->last || qnext->first) {
1655 				dead = 1;
1656 				break;
1657 			}
1658 		}
1659 		if (!dead)
1660 			break;
1661 
1662 		/* Remove fragment and all others in the same packet */
1663 		while ((qent = TAILQ_FIRST(&priv->frags)) != qnext) {
1664 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1665 			    ("%s: empty q", __func__));
1666 			priv->bundleStats.dropFragments++;
1667 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1668 			NG_FREE_M(qent->data);
1669 			FREE(qent, M_NETGRAPH_PPP);
1670 			priv->qlen--;
1671 			removed = 1;
1672 		}
1673 	}
1674 	return (removed);
1675 }
1676 
1677 /*
1678  * Drop fragments on queue overflow.
1679  * Returns 1 if fragments were removed, zero otherwise.
1680  */
1681 static int
1682 ng_ppp_frag_drop(node_p node)
1683 {
1684 	const priv_p priv = NG_NODE_PRIVATE(node);
1685 
1686 	/* Check queue length */
1687 	if (priv->qlen > MP_MAX_QUEUE_LEN) {
1688 		struct ng_ppp_frag *qent;
1689 
1690 		/* Get oldest fragment */
1691 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1692 		    ("%s: empty q", __func__));
1693 		qent = TAILQ_FIRST(&priv->frags);
1694 
1695 		/* Bump MSEQ if necessary */
1696 		ng_ppp_bump_mseq(node, qent->seq);
1697 
1698 		/* Drop it */
1699 		priv->bundleStats.dropFragments++;
1700 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1701 		NG_FREE_M(qent->data);
1702 		FREE(qent, M_NETGRAPH_PPP);
1703 		priv->qlen--;
1704 
1705 		return (1);
1706 	}
1707 	return (0);
1708 }
1709 
1710 /*
1711  * Run the queue, restoring the queue invariants
1712  */
1713 static int
1714 ng_ppp_frag_process(node_p node)
1715 {
1716 	const priv_p priv = NG_NODE_PRIVATE(node);
1717 	struct mbuf *m;
1718 	item_p item;
1719 	uint16_t proto;
1720 
1721 	do {
1722 		/* Deliver any deliverable packets */
1723 		while (ng_ppp_check_packet(node)) {
1724 			ng_ppp_get_packet(node, &m);
1725 			if ((m = ng_ppp_cutproto(m, &proto)) == NULL)
1726 				continue;
1727 			if (!PROT_VALID(proto)) {
1728 				priv->bundleStats.badProtos++;
1729 				NG_FREE_M(m);
1730 				continue;
1731 			}
1732 			if ((item = ng_package_data(m, NG_NOFLAGS)) != NULL)
1733 				ng_ppp_crypt_recv(node, item, proto,
1734 					NG_PPP_BUNDLE_LINKNUM);
1735 		}
1736 	  /* Delete dead fragments and try again */
1737 	} while (ng_ppp_frag_trim(node) || ng_ppp_frag_drop(node));
1738 
1739 	/* Done */
1740 	return (0);
1741 }
1742 
1743 /*
1744  * Check for 'stale' completed packets that need to be delivered
1745  *
1746  * If a link goes down or has a temporary failure, MSEQ can get
1747  * "stuck", because no new incoming fragments appear on that link.
1748  * This can cause completed packets to never get delivered if
1749  * their sequence numbers are all > MSEQ + 1.
1750  *
1751  * This routine checks how long all of the completed packets have
1752  * been sitting in the queue, and if too long, removes fragments
1753  * from the queue and increments MSEQ to allow them to be delivered.
1754  */
1755 static void
1756 ng_ppp_frag_checkstale(node_p node)
1757 {
1758 	const priv_p priv = NG_NODE_PRIVATE(node);
1759 	struct ng_ppp_frag *qent, *beg, *end;
1760 	struct timeval now, age;
1761 	struct mbuf *m;
1762 	int seq;
1763 	item_p item;
1764 	int endseq;
1765 	uint16_t proto;
1766 
1767 	now.tv_sec = 0;			/* uninitialized state */
1768 	while (1) {
1769 
1770 		/* If queue is empty, we're done */
1771 		if (TAILQ_EMPTY(&priv->frags))
1772 			break;
1773 
1774 		/* Find the first complete packet in the queue */
1775 		beg = end = NULL;
1776 		seq = TAILQ_FIRST(&priv->frags)->seq;
1777 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1778 			if (qent->first)
1779 				beg = qent;
1780 			else if (qent->seq != seq)
1781 				beg = NULL;
1782 			if (beg != NULL && qent->last) {
1783 				end = qent;
1784 				break;
1785 			}
1786 			seq = MP_NEXT_RECV_SEQ(priv, seq);
1787 		}
1788 
1789 		/* If none found, exit */
1790 		if (end == NULL)
1791 			break;
1792 
1793 		/* Get current time (we assume we've been up for >= 1 second) */
1794 		if (now.tv_sec == 0)
1795 			getmicrouptime(&now);
1796 
1797 		/* Check if packet has been queued too long */
1798 		age = now;
1799 		timevalsub(&age, &beg->timestamp);
1800 		if (timevalcmp(&age, &ng_ppp_max_staleness, < ))
1801 			break;
1802 
1803 		/* Throw away junk fragments in front of the completed packet */
1804 		while ((qent = TAILQ_FIRST(&priv->frags)) != beg) {
1805 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1806 			    ("%s: empty q", __func__));
1807 			priv->bundleStats.dropFragments++;
1808 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1809 			NG_FREE_M(qent->data);
1810 			FREE(qent, M_NETGRAPH_PPP);
1811 			priv->qlen--;
1812 		}
1813 
1814 		/* Extract completed packet */
1815 		endseq = end->seq;
1816 		ng_ppp_get_packet(node, &m);
1817 
1818 		if ((m = ng_ppp_cutproto(m, &proto)) == NULL)
1819 			continue;
1820 		if (!PROT_VALID(proto)) {
1821 			priv->bundleStats.badProtos++;
1822 			NG_FREE_M(m);
1823 			continue;
1824 		}
1825 
1826 		/* Deliver packet */
1827 		if ((item = ng_package_data(m, NG_NOFLAGS)) != NULL)
1828 			ng_ppp_crypt_recv(node, item, proto,
1829 				NG_PPP_BUNDLE_LINKNUM);
1830 	}
1831 }
1832 
1833 /*
1834  * Periodically call ng_ppp_frag_checkstale()
1835  */
1836 static void
1837 ng_ppp_frag_timeout(node_p node, hook_p hook, void *arg1, int arg2)
1838 {
1839 	/* XXX: is this needed? */
1840 	if (NG_NODE_NOT_VALID(node))
1841 		return;
1842 
1843 	/* Scan the fragment queue */
1844 	ng_ppp_frag_checkstale(node);
1845 
1846 	/* Start timer again */
1847 	ng_ppp_start_frag_timer(node);
1848 }
1849 
1850 /*
1851  * Deliver a frame out on the bundle, i.e., figure out how to fragment
1852  * the frame across the individual PPP links and do so.
1853  */
1854 static int
1855 ng_ppp_mp_xmit(node_p node, item_p item, uint16_t proto)
1856 {
1857 	const priv_p priv = NG_NODE_PRIVATE(node);
1858 	const int hdr_len = priv->conf.xmitShortSeq ? 2 : 4;
1859 	int distrib[NG_PPP_MAX_LINKS];
1860 	int firstFragment;
1861 	int activeLinkNum;
1862 	struct mbuf *m;
1863 
1864 	/* At least one link must be active */
1865 	if (priv->numActiveLinks == 0) {
1866 		NG_FREE_ITEM(item);
1867 		return (ENETDOWN);
1868 	}
1869 
1870 	/* Update stats. */
1871 	priv->bundleStats.xmitFrames++;
1872 	priv->bundleStats.xmitOctets += NGI_M(item)->m_pkthdr.len;
1873 
1874 	if (!priv->conf.enableMultilink)
1875 		return (ng_ppp_link_xmit(node, item, proto,
1876 		    priv->activeLinks[0]));
1877 
1878 	/* Extract mbuf. */
1879 	NGI_GET_M(item, m);
1880 	NG_FREE_ITEM(item);
1881 
1882 	/* Prepend protocol number, possibly compressed. */
1883 	if ((m = ng_ppp_addproto(m, proto, 1)) == NULL)
1884 		return (ENOBUFS);
1885 
1886 	/* Clear distribution plan */
1887 	bzero(&distrib, priv->numActiveLinks * sizeof(distrib[0]));
1888 
1889 	/* Round-robin strategy */
1890 	if (priv->conf.enableRoundRobin) {
1891 		activeLinkNum = priv->lastLink++ % priv->numActiveLinks;
1892 		distrib[activeLinkNum] = m->m_pkthdr.len;
1893 		goto deliver;
1894 	}
1895 
1896 	/* Strategy when all links are equivalent (optimize the common case) */
1897 	if (priv->allLinksEqual) {
1898 		int	numFrags, fraction, remain;
1899 		int	i;
1900 
1901 		/* Calculate optimal fragment count */
1902 		numFrags = priv->numActiveLinks;
1903 		if (numFrags > m->m_pkthdr.len / MP_MIN_FRAG_LEN)
1904 		    numFrags = m->m_pkthdr.len / MP_MIN_FRAG_LEN;
1905 		if (numFrags == 0)
1906 		    numFrags = 1;
1907 
1908 		fraction = m->m_pkthdr.len / numFrags;
1909 		remain = m->m_pkthdr.len - (fraction * numFrags);
1910 
1911 		/* Assign distribution */
1912 		for (i = 0; i < numFrags; i++) {
1913 			distrib[priv->lastLink++ % priv->numActiveLinks]
1914 			    = fraction + (((remain--) > 0)?1:0);
1915 		}
1916 		goto deliver;
1917 	}
1918 
1919 	/* Strategy when all links are not equivalent */
1920 	ng_ppp_mp_strategy(node, m->m_pkthdr.len, distrib);
1921 
1922 deliver:
1923 	/* Send alloted portions of frame out on the link(s) */
1924 	for (firstFragment = 1, activeLinkNum = priv->numActiveLinks - 1;
1925 	    activeLinkNum >= 0; activeLinkNum--) {
1926 		const uint16_t linkNum = priv->activeLinks[activeLinkNum];
1927 		struct ng_ppp_link *const link = &priv->links[linkNum];
1928 
1929 		/* Deliver fragment(s) out the next link */
1930 		for ( ; distrib[activeLinkNum] > 0; firstFragment = 0) {
1931 			int len, lastFragment, error;
1932 			struct mbuf *m2;
1933 
1934 			/* Calculate fragment length; don't exceed link MTU */
1935 			len = distrib[activeLinkNum];
1936 			if (len > link->conf.mru - hdr_len)
1937 				len = link->conf.mru - hdr_len;
1938 			distrib[activeLinkNum] -= len;
1939 			lastFragment = (len == m->m_pkthdr.len);
1940 
1941 			/* Split off next fragment as "m2" */
1942 			m2 = m;
1943 			if (!lastFragment) {
1944 				struct mbuf *n = m_split(m, len, M_DONTWAIT);
1945 
1946 				if (n == NULL) {
1947 					NG_FREE_M(m);
1948 					return (ENOMEM);
1949 				}
1950 				m_tag_copy_chain(n, m, M_DONTWAIT);
1951 				m = n;
1952 			}
1953 
1954 			/* Prepend MP header */
1955 			if (priv->conf.xmitShortSeq) {
1956 				uint16_t shdr;
1957 
1958 				shdr = priv->xseq;
1959 				priv->xseq =
1960 				    (priv->xseq + 1) & MP_SHORT_SEQ_MASK;
1961 				if (firstFragment)
1962 					shdr |= MP_SHORT_FIRST_FLAG;
1963 				if (lastFragment)
1964 					shdr |= MP_SHORT_LAST_FLAG;
1965 				shdr = htons(shdr);
1966 				m2 = ng_ppp_prepend(m2, &shdr, 2);
1967 			} else {
1968 				uint32_t lhdr;
1969 
1970 				lhdr = priv->xseq;
1971 				priv->xseq =
1972 				    (priv->xseq + 1) & MP_LONG_SEQ_MASK;
1973 				if (firstFragment)
1974 					lhdr |= MP_LONG_FIRST_FLAG;
1975 				if (lastFragment)
1976 					lhdr |= MP_LONG_LAST_FLAG;
1977 				lhdr = htonl(lhdr);
1978 				m2 = ng_ppp_prepend(m2, &lhdr, 4);
1979 			}
1980 			if (m2 == NULL) {
1981 				if (!lastFragment)
1982 					m_freem(m);
1983 				return (ENOBUFS);
1984 			}
1985 
1986 			/* Send fragment */
1987 			if ((item = ng_package_data(m2, NG_NOFLAGS)) != NULL) {
1988 				error = ng_ppp_link_xmit(node, item, PROT_MP,
1989 					    linkNum);
1990 				if (error != 0) {
1991 					if (!lastFragment)
1992 						NG_FREE_M(m);
1993 					return (error);
1994 				}
1995 			}
1996 		}
1997 	}
1998 
1999 	/* Done */
2000 	return (0);
2001 }
2002 
2003 /*
2004  * Computing the optimal fragmentation
2005  * -----------------------------------
2006  *
2007  * This routine tries to compute the optimal fragmentation pattern based
2008  * on each link's latency, bandwidth, and calculated additional latency.
2009  * The latter quantity is the additional latency caused by previously
2010  * written data that has not been transmitted yet.
2011  *
2012  * This algorithm is only useful when not all of the links have the
2013  * same latency and bandwidth values.
2014  *
2015  * The essential idea is to make the last bit of each fragment of the
2016  * frame arrive at the opposite end at the exact same time. This greedy
2017  * algorithm is optimal, in that no other scheduling could result in any
2018  * packet arriving any sooner unless packets are delivered out of order.
2019  *
2020  * Suppose link i has bandwidth b_i (in tens of bytes per milisecond) and
2021  * latency l_i (in miliseconds). Consider the function function f_i(t)
2022  * which is equal to the number of bytes that will have arrived at
2023  * the peer after t miliseconds if we start writing continuously at
2024  * time t = 0. Then f_i(t) = b_i * (t - l_i) = ((b_i * t) - (l_i * b_i).
2025  * That is, f_i(t) is a line with slope b_i and y-intersect -(l_i * b_i).
2026  * Note that the y-intersect is always <= zero because latency can't be
2027  * negative.  Note also that really the function is f_i(t) except when
2028  * f_i(t) is negative, in which case the function is zero.  To take
2029  * care of this, let Q_i(t) = { if (f_i(t) > 0) return 1; else return 0; }.
2030  * So the actual number of bytes that will have arrived at the peer after
2031  * t miliseconds is f_i(t) * Q_i(t).
2032  *
2033  * At any given time, each link has some additional latency a_i >= 0
2034  * due to previously written fragment(s) which are still in the queue.
2035  * This value is easily computed from the time since last transmission,
2036  * the previous latency value, the number of bytes written, and the
2037  * link's bandwidth.
2038  *
2039  * Assume that l_i includes any a_i already, and that the links are
2040  * sorted by latency, so that l_i <= l_{i+1}.
2041  *
2042  * Let N be the total number of bytes in the current frame we are sending.
2043  *
2044  * Suppose we were to start writing bytes at time t = 0 on all links
2045  * simultaneously, which is the most we can possibly do.  Then let
2046  * F(t) be equal to the total number of bytes received by the peer
2047  * after t miliseconds. Then F(t) = Sum_i (f_i(t) * Q_i(t)).
2048  *
2049  * Our goal is simply this: fragment the frame across the links such
2050  * that the peer is able to reconstruct the completed frame as soon as
2051  * possible, i.e., at the least possible value of t. Call this value t_0.
2052  *
2053  * Then it follows that F(t_0) = N. Our strategy is first to find the value
2054  * of t_0, and then deduce how many bytes to write to each link.
2055  *
2056  * Rewriting F(t_0):
2057  *
2058  *   t_0 = ( N + Sum_i ( l_i * b_i * Q_i(t_0) ) ) / Sum_i ( b_i * Q_i(t_0) )
2059  *
2060  * Now, we note that Q_i(t) is constant for l_i <= t <= l_{i+1}. t_0 will
2061  * lie in one of these ranges.  To find it, we just need to find the i such
2062  * that F(l_i) <= N <= F(l_{i+1}).  Then we compute all the constant values
2063  * for Q_i() in this range, plug in the remaining values, solving for t_0.
2064  *
2065  * Once t_0 is known, then the number of bytes to send on link i is
2066  * just f_i(t_0) * Q_i(t_0).
2067  *
2068  * In other words, we start allocating bytes to the links one at a time.
2069  * We keep adding links until the frame is completely sent.  Some links
2070  * may not get any bytes because their latency is too high.
2071  *
2072  * Is all this work really worth the trouble?  Depends on the situation.
2073  * The bigger the ratio of computer speed to link speed, and the more
2074  * important total bundle latency is (e.g., for interactive response time),
2075  * the more it's worth it.  There is however the cost of calling this
2076  * function for every frame.  The running time is O(n^2) where n is the
2077  * number of links that receive a non-zero number of bytes.
2078  *
2079  * Since latency is measured in miliseconds, the "resolution" of this
2080  * algorithm is one milisecond.
2081  *
2082  * To avoid this algorithm altogether, configure all links to have the
2083  * same latency and bandwidth.
2084  */
2085 static void
2086 ng_ppp_mp_strategy(node_p node, int len, int *distrib)
2087 {
2088 	const priv_p priv = NG_NODE_PRIVATE(node);
2089 	int latency[NG_PPP_MAX_LINKS];
2090 	int sortByLatency[NG_PPP_MAX_LINKS];
2091 	int activeLinkNum;
2092 	int t0, total, topSum, botSum;
2093 	struct timeval now;
2094 	int i, numFragments;
2095 
2096 	/* If only one link, this gets real easy */
2097 	if (priv->numActiveLinks == 1) {
2098 		distrib[0] = len;
2099 		return;
2100 	}
2101 
2102 	/* Get current time */
2103 	getmicrouptime(&now);
2104 
2105 	/* Compute latencies for each link at this point in time */
2106 	for (activeLinkNum = 0;
2107 	    activeLinkNum < priv->numActiveLinks; activeLinkNum++) {
2108 		struct ng_ppp_link *alink;
2109 		struct timeval diff;
2110 		int xmitBytes;
2111 
2112 		/* Start with base latency value */
2113 		alink = &priv->links[priv->activeLinks[activeLinkNum]];
2114 		latency[activeLinkNum] = alink->latency;
2115 		sortByLatency[activeLinkNum] = activeLinkNum;	/* see below */
2116 
2117 		/* Any additional latency? */
2118 		if (alink->bytesInQueue == 0)
2119 			continue;
2120 
2121 		/* Compute time delta since last write */
2122 		diff = now;
2123 		timevalsub(&diff, &alink->lastWrite);
2124 
2125 		/* alink->bytesInQueue will be changed, mark change time. */
2126 		alink->lastWrite = now;
2127 
2128 		if (now.tv_sec < 0 || diff.tv_sec >= 10) {	/* sanity */
2129 			alink->bytesInQueue = 0;
2130 			continue;
2131 		}
2132 
2133 		/* How many bytes could have transmitted since last write? */
2134 		xmitBytes = (alink->conf.bandwidth * 10 * diff.tv_sec)
2135 		    + (alink->conf.bandwidth * (diff.tv_usec / 1000)) / 100;
2136 		alink->bytesInQueue -= xmitBytes;
2137 		if (alink->bytesInQueue < 0)
2138 			alink->bytesInQueue = 0;
2139 		else
2140 			latency[activeLinkNum] +=
2141 			    (100 * alink->bytesInQueue) / alink->conf.bandwidth;
2142 	}
2143 
2144 	/* Sort active links by latency */
2145 	qsort_r(sortByLatency,
2146 	    priv->numActiveLinks, sizeof(*sortByLatency), latency, ng_ppp_intcmp);
2147 
2148 	/* Find the interval we need (add links in sortByLatency[] order) */
2149 	for (numFragments = 1;
2150 	    numFragments < priv->numActiveLinks; numFragments++) {
2151 		for (total = i = 0; i < numFragments; i++) {
2152 			int flowTime;
2153 
2154 			flowTime = latency[sortByLatency[numFragments]]
2155 			    - latency[sortByLatency[i]];
2156 			total += ((flowTime * priv->links[
2157 			    priv->activeLinks[sortByLatency[i]]].conf.bandwidth)
2158 			    	+ 99) / 100;
2159 		}
2160 		if (total >= len)
2161 			break;
2162 	}
2163 
2164 	/* Solve for t_0 in that interval */
2165 	for (topSum = botSum = i = 0; i < numFragments; i++) {
2166 		int bw = priv->links[
2167 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
2168 
2169 		topSum += latency[sortByLatency[i]] * bw;	/* / 100 */
2170 		botSum += bw;					/* / 100 */
2171 	}
2172 	t0 = ((len * 100) + topSum + botSum / 2) / botSum;
2173 
2174 	/* Compute f_i(t_0) all i */
2175 	for (total = i = 0; i < numFragments; i++) {
2176 		int bw = priv->links[
2177 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
2178 
2179 		distrib[sortByLatency[i]] =
2180 		    (bw * (t0 - latency[sortByLatency[i]]) + 50) / 100;
2181 		total += distrib[sortByLatency[i]];
2182 	}
2183 
2184 	/* Deal with any rounding error */
2185 	if (total < len) {
2186 		struct ng_ppp_link *fastLink =
2187 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
2188 		int fast = 0;
2189 
2190 		/* Find the fastest link */
2191 		for (i = 1; i < numFragments; i++) {
2192 			struct ng_ppp_link *const link =
2193 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
2194 
2195 			if (link->conf.bandwidth > fastLink->conf.bandwidth) {
2196 				fast = i;
2197 				fastLink = link;
2198 			}
2199 		}
2200 		distrib[sortByLatency[fast]] += len - total;
2201 	} else while (total > len) {
2202 		struct ng_ppp_link *slowLink =
2203 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
2204 		int delta, slow = 0;
2205 
2206 		/* Find the slowest link that still has bytes to remove */
2207 		for (i = 1; i < numFragments; i++) {
2208 			struct ng_ppp_link *const link =
2209 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
2210 
2211 			if (distrib[sortByLatency[slow]] == 0
2212 			  || (distrib[sortByLatency[i]] > 0
2213 			    && link->conf.bandwidth <
2214 			      slowLink->conf.bandwidth)) {
2215 				slow = i;
2216 				slowLink = link;
2217 			}
2218 		}
2219 		delta = total - len;
2220 		if (delta > distrib[sortByLatency[slow]])
2221 			delta = distrib[sortByLatency[slow]];
2222 		distrib[sortByLatency[slow]] -= delta;
2223 		total -= delta;
2224 	}
2225 }
2226 
2227 /*
2228  * Compare two integers
2229  */
2230 static int
2231 ng_ppp_intcmp(void *latency, const void *v1, const void *v2)
2232 {
2233 	const int index1 = *((const int *) v1);
2234 	const int index2 = *((const int *) v2);
2235 
2236 	return ((int *)latency)[index1] - ((int *)latency)[index2];
2237 }
2238 
2239 /*
2240  * Prepend a possibly compressed PPP protocol number in front of a frame
2241  */
2242 static struct mbuf *
2243 ng_ppp_addproto(struct mbuf *m, uint16_t proto, int compOK)
2244 {
2245 	if (compOK && PROT_COMPRESSABLE(proto)) {
2246 		uint8_t pbyte = (uint8_t)proto;
2247 
2248 		return ng_ppp_prepend(m, &pbyte, 1);
2249 	} else {
2250 		uint16_t pword = htons((uint16_t)proto);
2251 
2252 		return ng_ppp_prepend(m, &pword, 2);
2253 	}
2254 }
2255 
2256 /*
2257  * Cut a possibly compressed PPP protocol number from the front of a frame.
2258  */
2259 static struct mbuf *
2260 ng_ppp_cutproto(struct mbuf *m, uint16_t *proto)
2261 {
2262 
2263 	*proto = 0;
2264 	if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL)
2265 		return (NULL);
2266 
2267 	*proto = *mtod(m, uint8_t *);
2268 	m_adj(m, 1);
2269 
2270 	if (!PROT_VALID(*proto)) {
2271 		if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL)
2272 			return (NULL);
2273 
2274 		*proto = (*proto << 8) + *mtod(m, uint8_t *);
2275 		m_adj(m, 1);
2276 	}
2277 
2278 	return (m);
2279 }
2280 
2281 /*
2282  * Prepend some bytes to an mbuf.
2283  */
2284 static struct mbuf *
2285 ng_ppp_prepend(struct mbuf *m, const void *buf, int len)
2286 {
2287 	M_PREPEND(m, len, M_DONTWAIT);
2288 	if (m == NULL || (m->m_len < len && (m = m_pullup(m, len)) == NULL))
2289 		return (NULL);
2290 	bcopy(buf, mtod(m, uint8_t *), len);
2291 	return (m);
2292 }
2293 
2294 /*
2295  * Update private information that is derived from other private information
2296  */
2297 static void
2298 ng_ppp_update(node_p node, int newConf)
2299 {
2300 	const priv_p priv = NG_NODE_PRIVATE(node);
2301 	int i;
2302 
2303 	/* Update active status for VJ Compression */
2304 	priv->vjCompHooked = priv->hooks[HOOK_INDEX_VJC_IP] != NULL
2305 	    && priv->hooks[HOOK_INDEX_VJC_COMP] != NULL
2306 	    && priv->hooks[HOOK_INDEX_VJC_UNCOMP] != NULL
2307 	    && priv->hooks[HOOK_INDEX_VJC_VJIP] != NULL;
2308 
2309 	/* Increase latency for each link an amount equal to one MP header */
2310 	if (newConf) {
2311 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
2312 			int hdrBytes;
2313 
2314 			if (priv->links[i].conf.bandwidth == 0)
2315 			    continue;
2316 
2317 			hdrBytes = MP_AVERAGE_LINK_OVERHEAD
2318 			    + (priv->links[i].conf.enableACFComp ? 0 : 2)
2319 			    + (priv->links[i].conf.enableProtoComp ? 1 : 2)
2320 			    + (priv->conf.xmitShortSeq ? 2 : 4);
2321 			priv->links[i].latency =
2322 			    priv->links[i].conf.latency +
2323 			    (hdrBytes / priv->links[i].conf.bandwidth + 50) / 100;
2324 		}
2325 	}
2326 
2327 	/* Update list of active links */
2328 	bzero(&priv->activeLinks, sizeof(priv->activeLinks));
2329 	priv->numActiveLinks = 0;
2330 	priv->allLinksEqual = 1;
2331 	for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
2332 		struct ng_ppp_link *const link = &priv->links[i];
2333 
2334 		/* Is link active? */
2335 		if (link->conf.enableLink && link->hook != NULL) {
2336 			struct ng_ppp_link *link0;
2337 
2338 			/* Add link to list of active links */
2339 			priv->activeLinks[priv->numActiveLinks++] = i;
2340 			link0 = &priv->links[priv->activeLinks[0]];
2341 
2342 			/* Determine if all links are still equal */
2343 			if (link->latency != link0->latency
2344 			  || link->conf.bandwidth != link0->conf.bandwidth)
2345 				priv->allLinksEqual = 0;
2346 
2347 			/* Initialize rec'd sequence number */
2348 			if (link->seq == MP_NOSEQ) {
2349 				link->seq = (link == link0) ?
2350 				    MP_INITIAL_SEQ : link0->seq;
2351 			}
2352 		} else
2353 			link->seq = MP_NOSEQ;
2354 	}
2355 
2356 	/* Update MP state as multi-link is active or not */
2357 	if (priv->conf.enableMultilink && priv->numActiveLinks > 0)
2358 		ng_ppp_start_frag_timer(node);
2359 	else {
2360 		ng_ppp_stop_frag_timer(node);
2361 		ng_ppp_frag_reset(node);
2362 		priv->xseq = MP_INITIAL_SEQ;
2363 		priv->mseq = MP_INITIAL_SEQ;
2364 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
2365 			struct ng_ppp_link *const link = &priv->links[i];
2366 
2367 			bzero(&link->lastWrite, sizeof(link->lastWrite));
2368 			link->bytesInQueue = 0;
2369 			link->seq = MP_NOSEQ;
2370 		}
2371 	}
2372 }
2373 
2374 /*
2375  * Determine if a new configuration would represent a valid change
2376  * from the current configuration and link activity status.
2377  */
2378 static int
2379 ng_ppp_config_valid(node_p node, const struct ng_ppp_node_conf *newConf)
2380 {
2381 	const priv_p priv = NG_NODE_PRIVATE(node);
2382 	int i, newNumLinksActive;
2383 
2384 	/* Check per-link config and count how many links would be active */
2385 	for (newNumLinksActive = i = 0; i < NG_PPP_MAX_LINKS; i++) {
2386 		if (newConf->links[i].enableLink && priv->links[i].hook != NULL)
2387 			newNumLinksActive++;
2388 		if (!newConf->links[i].enableLink)
2389 			continue;
2390 		if (newConf->links[i].mru < MP_MIN_LINK_MRU)
2391 			return (0);
2392 		if (newConf->links[i].bandwidth == 0)
2393 			return (0);
2394 		if (newConf->links[i].bandwidth > NG_PPP_MAX_BANDWIDTH)
2395 			return (0);
2396 		if (newConf->links[i].latency > NG_PPP_MAX_LATENCY)
2397 			return (0);
2398 	}
2399 
2400 	/* Check bundle parameters */
2401 	if (newConf->bund.enableMultilink && newConf->bund.mrru < MP_MIN_MRRU)
2402 		return (0);
2403 
2404 	/* Disallow changes to multi-link configuration while MP is active */
2405 	if (priv->numActiveLinks > 0 && newNumLinksActive > 0) {
2406 		if (!priv->conf.enableMultilink
2407 				!= !newConf->bund.enableMultilink
2408 		    || !priv->conf.xmitShortSeq != !newConf->bund.xmitShortSeq
2409 		    || !priv->conf.recvShortSeq != !newConf->bund.recvShortSeq)
2410 			return (0);
2411 	}
2412 
2413 	/* At most one link can be active unless multi-link is enabled */
2414 	if (!newConf->bund.enableMultilink && newNumLinksActive > 1)
2415 		return (0);
2416 
2417 	/* Configuration change would be valid */
2418 	return (1);
2419 }
2420 
2421 /*
2422  * Free all entries in the fragment queue
2423  */
2424 static void
2425 ng_ppp_frag_reset(node_p node)
2426 {
2427 	const priv_p priv = NG_NODE_PRIVATE(node);
2428 	struct ng_ppp_frag *qent, *qnext;
2429 
2430 	for (qent = TAILQ_FIRST(&priv->frags); qent; qent = qnext) {
2431 		qnext = TAILQ_NEXT(qent, f_qent);
2432 		NG_FREE_M(qent->data);
2433 		FREE(qent, M_NETGRAPH_PPP);
2434 	}
2435 	TAILQ_INIT(&priv->frags);
2436 	priv->qlen = 0;
2437 }
2438 
2439 /*
2440  * Start fragment queue timer
2441  */
2442 static void
2443 ng_ppp_start_frag_timer(node_p node)
2444 {
2445 	const priv_p priv = NG_NODE_PRIVATE(node);
2446 
2447 	if (!(callout_pending(&priv->fragTimer)))
2448 		ng_callout(&priv->fragTimer, node, NULL, MP_FRAGTIMER_INTERVAL,
2449 		    ng_ppp_frag_timeout, NULL, 0);
2450 }
2451 
2452 /*
2453  * Stop fragment queue timer
2454  */
2455 static void
2456 ng_ppp_stop_frag_timer(node_p node)
2457 {
2458 	const priv_p priv = NG_NODE_PRIVATE(node);
2459 
2460 	if (callout_pending(&priv->fragTimer))
2461 		ng_uncallout(&priv->fragTimer, node);
2462 }
2463