xref: /freebsd/sys/netgraph/ng_ppp.c (revision 27beb2e98db3193bd22010b9eb00cc7787bb0a2f)
1 
2 /*
3  * ng_ppp.c
4  *
5  * Copyright (c) 1996-2000 Whistle Communications, Inc.
6  * All rights reserved.
7  *
8  * Subject to the following obligations and disclaimer of warranty, use and
9  * redistribution of this software, in source or object code forms, with or
10  * without modifications are expressly permitted by Whistle Communications;
11  * provided, however, that:
12  * 1. Any and all reproductions of the source or object code must include the
13  *    copyright notice above and the following disclaimer of warranties; and
14  * 2. No rights are granted, in any manner or form, to use Whistle
15  *    Communications, Inc. trademarks, including the mark "WHISTLE
16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
17  *    such appears in the above copyright notice or in the software.
18  *
19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
35  * OF SUCH DAMAGE.
36  *
37  * Author: Archie Cobbs <archie@freebsd.org>
38  *
39  * $FreeBSD$
40  * $Whistle: ng_ppp.c,v 1.24 1999/11/01 09:24:52 julian Exp $
41  */
42 
43 /*
44  * PPP node type.
45  */
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/time.h>
51 #include <sys/mbuf.h>
52 #include <sys/malloc.h>
53 #include <sys/errno.h>
54 #include <sys/ctype.h>
55 
56 #include <machine/limits.h>
57 
58 #include <netgraph/ng_message.h>
59 #include <netgraph/netgraph.h>
60 #include <netgraph/ng_parse.h>
61 #include <netgraph/ng_ppp.h>
62 #include <netgraph/ng_vjc.h>
63 
64 #define PROT_VALID(p)		(((p) & 0x0101) == 0x0001)
65 #define PROT_COMPRESSABLE(p)	(((p) & 0xff00) == 0x0000)
66 
67 /* Some PPP protocol numbers we're interested in */
68 #define PROT_APPLETALK		0x0029
69 #define PROT_COMPD		0x00fd
70 #define PROT_CRYPTD		0x0053
71 #define PROT_IP			0x0021
72 #define PROT_IPV6		0x0057
73 #define PROT_IPX		0x002b
74 #define PROT_LCP		0xc021
75 #define PROT_MP			0x003d
76 #define PROT_VJCOMP		0x002d
77 #define PROT_VJUNCOMP		0x002f
78 
79 /* Multilink PPP definitions */
80 #define MP_MIN_MRRU		1500		/* per RFC 1990 */
81 #define MP_INITIAL_SEQ		0		/* per RFC 1990 */
82 #define MP_MIN_LINK_MRU		32
83 
84 #define MP_SHORT_SEQ_MASK	0x00000fff	/* short seq # mask */
85 #define MP_SHORT_SEQ_HIBIT	0x00000800	/* short seq # high bit */
86 #define MP_SHORT_FIRST_FLAG	0x00008000	/* first fragment in frame */
87 #define MP_SHORT_LAST_FLAG	0x00004000	/* last fragment in frame */
88 
89 #define MP_LONG_SEQ_MASK	0x00ffffff	/* long seq # mask */
90 #define MP_LONG_SEQ_HIBIT	0x00800000	/* long seq # high bit */
91 #define MP_LONG_FIRST_FLAG	0x80000000	/* first fragment in frame */
92 #define MP_LONG_LAST_FLAG	0x40000000	/* last fragment in frame */
93 
94 #define MP_NOSEQ		0x7fffffff	/* impossible sequence number */
95 
96 /* Sign extension of MP sequence numbers */
97 #define MP_SHORT_EXTEND(s)	(((s) & MP_SHORT_SEQ_HIBIT) ?		\
98 				    ((s) | ~MP_SHORT_SEQ_MASK)		\
99 				    : ((s) & MP_SHORT_SEQ_MASK))
100 #define MP_LONG_EXTEND(s)	(((s) & MP_LONG_SEQ_HIBIT) ?		\
101 				    ((s) | ~MP_LONG_SEQ_MASK)		\
102 				    : ((s) & MP_LONG_SEQ_MASK))
103 
104 /* Comparision of MP sequence numbers. Note: all sequence numbers
105    except priv->xseq are stored with the sign bit extended. */
106 #define MP_SHORT_SEQ_DIFF(x,y)	MP_SHORT_EXTEND((x) - (y))
107 #define MP_LONG_SEQ_DIFF(x,y)	MP_LONG_EXTEND((x) - (y))
108 
109 #define MP_RECV_SEQ_DIFF(priv,x,y)					\
110 				((priv)->conf.recvShortSeq ?		\
111 				    MP_SHORT_SEQ_DIFF((x), (y)) :	\
112 				    MP_LONG_SEQ_DIFF((x), (y)))
113 
114 /* Increment receive sequence number */
115 #define MP_NEXT_RECV_SEQ(priv,seq)					    \
116 				(((seq) + 1) & ((priv)->conf.recvShortSeq ? \
117 				    MP_SHORT_SEQ_MASK : MP_LONG_SEQ_MASK))
118 
119 /* Don't fragment transmitted packets smaller than this */
120 #define MP_MIN_FRAG_LEN		6
121 
122 /* Maximum fragment reasssembly queue length */
123 #define MP_MAX_QUEUE_LEN	128
124 
125 /* Fragment queue scanner period */
126 #define MP_FRAGTIMER_INTERVAL	(hz/2)
127 
128 /* We store incoming fragments this way */
129 struct ng_ppp_frag {
130 	int				seq;		/* fragment seq# */
131 	u_char				first;		/* First in packet? */
132 	u_char				last;		/* Last in packet? */
133 	struct timeval			timestamp;	/* time of reception */
134 	struct mbuf			*data;		/* Fragment data */
135 	meta_p				meta;		/* Fragment meta */
136 	CIRCLEQ_ENTRY(ng_ppp_frag)	f_qent;		/* Fragment queue */
137 };
138 
139 /* We use integer indicies to refer to the non-link hooks */
140 static const char *const ng_ppp_hook_names[] = {
141 	NG_PPP_HOOK_ATALK,
142 #define HOOK_INDEX_ATALK		0
143 	NG_PPP_HOOK_BYPASS,
144 #define HOOK_INDEX_BYPASS		1
145 	NG_PPP_HOOK_COMPRESS,
146 #define HOOK_INDEX_COMPRESS		2
147 	NG_PPP_HOOK_ENCRYPT,
148 #define HOOK_INDEX_ENCRYPT		3
149 	NG_PPP_HOOK_DECOMPRESS,
150 #define HOOK_INDEX_DECOMPRESS		4
151 	NG_PPP_HOOK_DECRYPT,
152 #define HOOK_INDEX_DECRYPT		5
153 	NG_PPP_HOOK_INET,
154 #define HOOK_INDEX_INET			6
155 	NG_PPP_HOOK_IPX,
156 #define HOOK_INDEX_IPX			7
157 	NG_PPP_HOOK_VJC_COMP,
158 #define HOOK_INDEX_VJC_COMP		8
159 	NG_PPP_HOOK_VJC_IP,
160 #define HOOK_INDEX_VJC_IP		9
161 	NG_PPP_HOOK_VJC_UNCOMP,
162 #define HOOK_INDEX_VJC_UNCOMP		10
163 	NG_PPP_HOOK_VJC_VJIP,
164 #define HOOK_INDEX_VJC_VJIP		11
165 	NG_PPP_HOOK_IPV6,
166 #define HOOK_INDEX_IPV6			12
167 	NULL
168 #define HOOK_INDEX_MAX			13
169 };
170 
171 /* We store index numbers in the hook private pointer. The HOOK_INDEX()
172    for a hook is either the index (above) for normal hooks, or the ones
173    complement of the link number for link hooks. */
174 #define HOOK_INDEX(hook)	(*((int16_t *) &(hook)->private))
175 
176 /* Per-link private information */
177 struct ng_ppp_link {
178 	struct ng_ppp_link_conf	conf;		/* link configuration */
179 	hook_p			hook;		/* connection to link data */
180 	int32_t			seq;		/* highest rec'd seq# - MSEQ */
181 	struct timeval		lastWrite;	/* time of last write */
182 	int			bytesInQueue;	/* bytes in the output queue */
183 	struct ng_ppp_link_stat	stats;		/* Link stats */
184 };
185 
186 /* Total per-node private information */
187 struct ng_ppp_private {
188 	struct ng_ppp_bund_conf	conf;			/* bundle config */
189 	struct ng_ppp_link_stat	bundleStats;		/* bundle stats */
190 	struct ng_ppp_link	links[NG_PPP_MAX_LINKS];/* per-link info */
191 	int32_t			xseq;			/* next out MP seq # */
192 	int32_t			mseq;			/* min links[i].seq */
193 	u_char			vjCompHooked;		/* VJ comp hooked up? */
194 	u_char			allLinksEqual;		/* all xmit the same? */
195 	u_char			timerActive;		/* frag timer active? */
196 	u_int			numActiveLinks;		/* how many links up */
197 	int			activeLinks[NG_PPP_MAX_LINKS];	/* indicies */
198 	u_int			lastLink;		/* for round robin */
199 	hook_p			hooks[HOOK_INDEX_MAX];	/* non-link hooks */
200 	CIRCLEQ_HEAD(ng_ppp_fraglist, ng_ppp_frag)	/* fragment queue */
201 				frags;
202 	int			qlen;			/* fraq queue length */
203 	struct callout_handle	fragTimer;		/* fraq queue check */
204 };
205 typedef struct ng_ppp_private *priv_p;
206 
207 /* Netgraph node methods */
208 static ng_constructor_t	ng_ppp_constructor;
209 static ng_rcvmsg_t	ng_ppp_rcvmsg;
210 static ng_shutdown_t	ng_ppp_rmnode;
211 static ng_newhook_t	ng_ppp_newhook;
212 static ng_rcvdata_t	ng_ppp_rcvdata;
213 static ng_disconnect_t	ng_ppp_disconnect;
214 
215 /* Helper functions */
216 static int	ng_ppp_input(node_p node, int bypass,
217 			int linkNum, struct mbuf *m, meta_p meta);
218 static int	ng_ppp_output(node_p node, int bypass, int proto,
219 			int linkNum, struct mbuf *m, meta_p meta);
220 static int	ng_ppp_mp_input(node_p node, int linkNum,
221 			struct mbuf *m, meta_p meta);
222 static int	ng_ppp_check_packet(node_p node);
223 static void	ng_ppp_get_packet(node_p node, struct mbuf **mp, meta_p *metap);
224 static int	ng_ppp_frag_process(node_p node);
225 static int	ng_ppp_frag_trim(node_p node);
226 static void	ng_ppp_frag_timeout(void *arg);
227 static void	ng_ppp_frag_checkstale(node_p node);
228 static void	ng_ppp_frag_reset(node_p node);
229 static int	ng_ppp_mp_output(node_p node, struct mbuf *m, meta_p meta);
230 static void	ng_ppp_mp_strategy(node_p node, int len, int *distrib);
231 static int	ng_ppp_intcmp(const void *v1, const void *v2);
232 static struct	mbuf *ng_ppp_addproto(struct mbuf *m, int proto, int compOK);
233 static struct	mbuf *ng_ppp_prepend(struct mbuf *m, const void *buf, int len);
234 static int	ng_ppp_config_valid(node_p node,
235 			const struct ng_ppp_node_conf *newConf);
236 static void	ng_ppp_update(node_p node, int newConf);
237 static void	ng_ppp_start_frag_timer(node_p node);
238 static void	ng_ppp_stop_frag_timer(node_p node);
239 
240 /* Parse type for struct ng_ppp_mp_state_type */
241 static const struct ng_parse_fixedarray_info ng_ppp_rseq_array_info = {
242 	&ng_parse_hint32_type,
243 	NG_PPP_MAX_LINKS
244 };
245 static const struct ng_parse_type ng_ppp_rseq_array_type = {
246 	&ng_parse_fixedarray_type,
247 	&ng_ppp_rseq_array_info,
248 };
249 static const struct ng_parse_struct_info ng_ppp_mp_state_type_info
250 	= NG_PPP_MP_STATE_TYPE_INFO(&ng_ppp_rseq_array_type);
251 static const struct ng_parse_type ng_ppp_mp_state_type = {
252 	&ng_parse_struct_type,
253 	&ng_ppp_mp_state_type_info,
254 };
255 
256 /* Parse type for struct ng_ppp_link_conf */
257 static const struct ng_parse_struct_info
258 	ng_ppp_link_type_info = NG_PPP_LINK_TYPE_INFO;
259 static const struct ng_parse_type ng_ppp_link_type = {
260 	&ng_parse_struct_type,
261 	&ng_ppp_link_type_info,
262 };
263 
264 /* Parse type for struct ng_ppp_bund_conf */
265 static const struct ng_parse_struct_info
266 	ng_ppp_bund_type_info = NG_PPP_BUND_TYPE_INFO;
267 static const struct ng_parse_type ng_ppp_bund_type = {
268 	&ng_parse_struct_type,
269 	&ng_ppp_bund_type_info,
270 };
271 
272 /* Parse type for struct ng_ppp_node_conf */
273 static const struct ng_parse_fixedarray_info ng_ppp_array_info = {
274 	&ng_ppp_link_type,
275 	NG_PPP_MAX_LINKS
276 };
277 static const struct ng_parse_type ng_ppp_link_array_type = {
278 	&ng_parse_fixedarray_type,
279 	&ng_ppp_array_info,
280 };
281 static const struct ng_parse_struct_info ng_ppp_conf_type_info
282 	= NG_PPP_CONFIG_TYPE_INFO(&ng_ppp_bund_type, &ng_ppp_link_array_type);
283 static const struct ng_parse_type ng_ppp_conf_type = {
284 	&ng_parse_struct_type,
285 	&ng_ppp_conf_type_info
286 };
287 
288 /* Parse type for struct ng_ppp_link_stat */
289 static const struct ng_parse_struct_info
290 	ng_ppp_stats_type_info = NG_PPP_STATS_TYPE_INFO;
291 static const struct ng_parse_type ng_ppp_stats_type = {
292 	&ng_parse_struct_type,
293 	&ng_ppp_stats_type_info
294 };
295 
296 /* List of commands and how to convert arguments to/from ASCII */
297 static const struct ng_cmdlist ng_ppp_cmds[] = {
298 	{
299 	  NGM_PPP_COOKIE,
300 	  NGM_PPP_SET_CONFIG,
301 	  "setconfig",
302 	  &ng_ppp_conf_type,
303 	  NULL
304 	},
305 	{
306 	  NGM_PPP_COOKIE,
307 	  NGM_PPP_GET_CONFIG,
308 	  "getconfig",
309 	  NULL,
310 	  &ng_ppp_conf_type
311 	},
312 	{
313 	  NGM_PPP_COOKIE,
314 	  NGM_PPP_GET_MP_STATE,
315 	  "getmpstate",
316 	  NULL,
317 	  &ng_ppp_mp_state_type
318 	},
319 	{
320 	  NGM_PPP_COOKIE,
321 	  NGM_PPP_GET_LINK_STATS,
322 	  "getstats",
323 	  &ng_parse_int16_type,
324 	  &ng_ppp_stats_type
325 	},
326 	{
327 	  NGM_PPP_COOKIE,
328 	  NGM_PPP_CLR_LINK_STATS,
329 	  "clrstats",
330 	  &ng_parse_int16_type,
331 	  NULL
332 	},
333 	{
334 	  NGM_PPP_COOKIE,
335 	  NGM_PPP_GETCLR_LINK_STATS,
336 	  "getclrstats",
337 	  &ng_parse_int16_type,
338 	  &ng_ppp_stats_type
339 	},
340 	{ 0 }
341 };
342 
343 /* Node type descriptor */
344 static struct ng_type ng_ppp_typestruct = {
345 	NG_VERSION,
346 	NG_PPP_NODE_TYPE,
347 	NULL,
348 	ng_ppp_constructor,
349 	ng_ppp_rcvmsg,
350 	ng_ppp_rmnode,
351 	ng_ppp_newhook,
352 	NULL,
353 	NULL,
354 	ng_ppp_rcvdata,
355 	ng_ppp_rcvdata,
356 	ng_ppp_disconnect,
357 	ng_ppp_cmds
358 };
359 NETGRAPH_INIT(ppp, &ng_ppp_typestruct);
360 
361 static int *compareLatencies;			/* hack for ng_ppp_intcmp() */
362 
363 /* Address and control field header */
364 static const u_char ng_ppp_acf[2] = { 0xff, 0x03 };
365 
366 /* Maximum time we'll let a complete incoming packet sit in the queue */
367 static const struct timeval ng_ppp_max_staleness = { 2, 0 };	/* 2 seconds */
368 
369 #define ERROUT(x)	do { error = (x); goto done; } while (0)
370 
371 /************************************************************************
372 			NETGRAPH NODE STUFF
373  ************************************************************************/
374 
375 /*
376  * Node type constructor
377  */
378 static int
379 ng_ppp_constructor(node_p *nodep)
380 {
381 	priv_p priv;
382 	int i, error;
383 
384 	/* Allocate private structure */
385 	MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH, M_NOWAIT);
386 	if (priv == NULL)
387 		return (ENOMEM);
388 	bzero(priv, sizeof(*priv));
389 
390 	/* Call generic node constructor */
391 	if ((error = ng_make_node_common(&ng_ppp_typestruct, nodep))) {
392 		FREE(priv, M_NETGRAPH);
393 		return (error);
394 	}
395 	(*nodep)->private = priv;
396 
397 	/* Initialize state */
398 	CIRCLEQ_INIT(&priv->frags);
399 	for (i = 0; i < NG_PPP_MAX_LINKS; i++)
400 		priv->links[i].seq = MP_NOSEQ;
401 	callout_handle_init(&priv->fragTimer);
402 
403 	/* Done */
404 	return (0);
405 }
406 
407 /*
408  * Give our OK for a hook to be added
409  */
410 static int
411 ng_ppp_newhook(node_p node, hook_p hook, const char *name)
412 {
413 	const priv_p priv = node->private;
414 	int linkNum = -1;
415 	hook_p *hookPtr = NULL;
416 	int hookIndex = -1;
417 
418 	/* Figure out which hook it is */
419 	if (strncmp(name, NG_PPP_HOOK_LINK_PREFIX,	/* a link hook? */
420 	    strlen(NG_PPP_HOOK_LINK_PREFIX)) == 0) {
421 		const char *cp;
422 		char *eptr;
423 
424 		cp = name + strlen(NG_PPP_HOOK_LINK_PREFIX);
425 		if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
426 			return (EINVAL);
427 		linkNum = (int)strtoul(cp, &eptr, 10);
428 		if (*eptr != '\0' || linkNum < 0 || linkNum >= NG_PPP_MAX_LINKS)
429 			return (EINVAL);
430 		hookPtr = &priv->links[linkNum].hook;
431 		hookIndex = ~linkNum;
432 	} else {				/* must be a non-link hook */
433 		int i;
434 
435 		for (i = 0; ng_ppp_hook_names[i] != NULL; i++) {
436 			if (strcmp(name, ng_ppp_hook_names[i]) == 0) {
437 				hookPtr = &priv->hooks[i];
438 				hookIndex = i;
439 				break;
440 			}
441 		}
442 		if (ng_ppp_hook_names[i] == NULL)
443 			return (EINVAL);	/* no such hook */
444 	}
445 
446 	/* See if hook is already connected */
447 	if (*hookPtr != NULL)
448 		return (EISCONN);
449 
450 	/* Disallow more than one link unless multilink is enabled */
451 	if (linkNum != -1 && priv->links[linkNum].conf.enableLink
452 	    && !priv->conf.enableMultilink && priv->numActiveLinks >= 1)
453 		return (ENODEV);
454 
455 	/* OK */
456 	*hookPtr = hook;
457 	HOOK_INDEX(hook) = hookIndex;
458 	ng_ppp_update(node, 0);
459 	return (0);
460 }
461 
462 /*
463  * Receive a control message
464  */
465 static int
466 ng_ppp_rcvmsg(node_p node, struct ng_mesg *msg,
467 	      const char *raddr, struct ng_mesg **rptr, hook_p lasthook)
468 {
469 	const priv_p priv = node->private;
470 	struct ng_mesg *resp = NULL;
471 	int error = 0;
472 
473 	switch (msg->header.typecookie) {
474 	case NGM_PPP_COOKIE:
475 		switch (msg->header.cmd) {
476 		case NGM_PPP_SET_CONFIG:
477 		    {
478 			struct ng_ppp_node_conf *const conf =
479 			    (struct ng_ppp_node_conf *)msg->data;
480 			int i;
481 
482 			/* Check for invalid or illegal config */
483 			if (msg->header.arglen != sizeof(*conf))
484 				ERROUT(EINVAL);
485 			if (!ng_ppp_config_valid(node, conf))
486 				ERROUT(EINVAL);
487 
488 			/* Copy config */
489 			priv->conf = conf->bund;
490 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
491 				priv->links[i].conf = conf->links[i];
492 			ng_ppp_update(node, 1);
493 			break;
494 		    }
495 		case NGM_PPP_GET_CONFIG:
496 		    {
497 			struct ng_ppp_node_conf *conf;
498 			int i;
499 
500 			NG_MKRESPONSE(resp, msg, sizeof(*conf), M_NOWAIT);
501 			if (resp == NULL)
502 				ERROUT(ENOMEM);
503 			conf = (struct ng_ppp_node_conf *)resp->data;
504 			conf->bund = priv->conf;
505 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
506 				conf->links[i] = priv->links[i].conf;
507 			break;
508 		    }
509 		case NGM_PPP_GET_MP_STATE:
510 		    {
511 			struct ng_ppp_mp_state *info;
512 			int i;
513 
514 			NG_MKRESPONSE(resp, msg, sizeof(*info), M_NOWAIT);
515 			if (resp == NULL)
516 				ERROUT(ENOMEM);
517 			info = (struct ng_ppp_mp_state *)resp->data;
518 			bzero(info, sizeof(*info));
519 			for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
520 				if (priv->links[i].seq != MP_NOSEQ)
521 					info->rseq[i] = priv->links[i].seq;
522 			}
523 			info->mseq = priv->mseq;
524 			info->xseq = priv->xseq;
525 			break;
526 		    }
527 		case NGM_PPP_GET_LINK_STATS:
528 		case NGM_PPP_CLR_LINK_STATS:
529 		case NGM_PPP_GETCLR_LINK_STATS:
530 		    {
531 			struct ng_ppp_link_stat *stats;
532 			u_int16_t linkNum;
533 
534 			if (msg->header.arglen != sizeof(u_int16_t))
535 				ERROUT(EINVAL);
536 			linkNum = *((u_int16_t *) msg->data);
537 			if (linkNum >= NG_PPP_MAX_LINKS
538 			    && linkNum != NG_PPP_BUNDLE_LINKNUM)
539 				ERROUT(EINVAL);
540 			stats = (linkNum == NG_PPP_BUNDLE_LINKNUM) ?
541 			    &priv->bundleStats : &priv->links[linkNum].stats;
542 			if (msg->header.cmd != NGM_PPP_CLR_LINK_STATS) {
543 				NG_MKRESPONSE(resp, msg,
544 				    sizeof(struct ng_ppp_link_stat), M_NOWAIT);
545 				if (resp == NULL)
546 					ERROUT(ENOMEM);
547 				bcopy(stats, resp->data, sizeof(*stats));
548 			}
549 			if (msg->header.cmd != NGM_PPP_GET_LINK_STATS)
550 				bzero(stats, sizeof(*stats));
551 			break;
552 		    }
553 		default:
554 			error = EINVAL;
555 			break;
556 		}
557 		break;
558 	case NGM_VJC_COOKIE:
559 	    {
560 		char path[NG_PATHLEN + 1];
561 		node_p origNode;
562 
563 		if ((error = ng_path2node(node,
564 		    raddr, &origNode, NULL, NULL)) != 0)
565 			ERROUT(error);
566 		snprintf(path, sizeof(path), "[%lx]:%s",
567 		    (long)node, NG_PPP_HOOK_VJC_IP);
568 		return ng_send_msg(origNode, msg, path, rptr);
569 	    }
570 	default:
571 		error = EINVAL;
572 		break;
573 	}
574 	if (rptr)
575 		*rptr = resp;
576 	else if (resp)
577 		FREE(resp, M_NETGRAPH);
578 
579 done:
580 	FREE(msg, M_NETGRAPH);
581 	return (error);
582 }
583 
584 /*
585  * Receive data on a hook
586  */
587 static int
588 ng_ppp_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
589 		struct mbuf **ret_m, meta_p *ret_meta)
590 {
591 	const node_p node = hook->node;
592 	const priv_p priv = node->private;
593 	const int index = HOOK_INDEX(hook);
594 	u_int16_t linkNum = NG_PPP_BUNDLE_LINKNUM;
595 	hook_p outHook = NULL;
596 	int proto = 0, error;
597 
598 	/* Did it come from a link hook? */
599 	if (index < 0) {
600 		struct ng_ppp_link *link;
601 
602 		/* Convert index into a link number */
603 		linkNum = (u_int16_t)~index;
604 		KASSERT(linkNum < NG_PPP_MAX_LINKS,
605 		    ("%s: bogus index 0x%x", __FUNCTION__, index));
606 		link = &priv->links[linkNum];
607 
608 		/* Stats */
609 		link->stats.recvFrames++;
610 		link->stats.recvOctets += m->m_pkthdr.len;
611 
612 		/* Strip address and control fields, if present */
613 		if (m->m_pkthdr.len >= 2) {
614 			if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
615 				NG_FREE_DATA(m, meta);
616 				return (ENOBUFS);
617 			}
618 			if (bcmp(mtod(m, u_char *), &ng_ppp_acf, 2) == 0)
619 				m_adj(m, 2);
620 		}
621 
622 		/* Dispatch incoming frame (if not enabled, to bypass) */
623 		return ng_ppp_input(node,
624 		    !link->conf.enableLink, linkNum, m, meta);
625 	}
626 
627 	/* Get protocol & check if data allowed from this hook */
628 	switch (index) {
629 
630 	/* Outgoing data */
631 	case HOOK_INDEX_ATALK:
632 		if (!priv->conf.enableAtalk) {
633 			NG_FREE_DATA(m, meta);
634 			return (ENXIO);
635 		}
636 		proto = PROT_APPLETALK;
637 		break;
638 	case HOOK_INDEX_IPX:
639 		if (!priv->conf.enableIPX) {
640 			NG_FREE_DATA(m, meta);
641 			return (ENXIO);
642 		}
643 		proto = PROT_IPX;
644 		break;
645 	case HOOK_INDEX_IPV6:
646 		if (!priv->conf.enableIPv6) {
647 			NG_FREE_DATA(m, meta);
648 			return (ENXIO);
649 		}
650 		proto = PROT_IPV6;
651 		break;
652 	case HOOK_INDEX_INET:
653 	case HOOK_INDEX_VJC_VJIP:
654 		if (!priv->conf.enableIP) {
655 			NG_FREE_DATA(m, meta);
656 			return (ENXIO);
657 		}
658 		proto = PROT_IP;
659 		break;
660 	case HOOK_INDEX_VJC_COMP:
661 		if (!priv->conf.enableVJCompression) {
662 			NG_FREE_DATA(m, meta);
663 			return (ENXIO);
664 		}
665 		proto = PROT_VJCOMP;
666 		break;
667 	case HOOK_INDEX_VJC_UNCOMP:
668 		if (!priv->conf.enableVJCompression) {
669 			NG_FREE_DATA(m, meta);
670 			return (ENXIO);
671 		}
672 		proto = PROT_VJUNCOMP;
673 		break;
674 	case HOOK_INDEX_COMPRESS:
675 		if (!priv->conf.enableCompression) {
676 			NG_FREE_DATA(m, meta);
677 			return (ENXIO);
678 		}
679 		proto = PROT_COMPD;
680 		break;
681 	case HOOK_INDEX_ENCRYPT:
682 		if (!priv->conf.enableEncryption) {
683 			NG_FREE_DATA(m, meta);
684 			return (ENXIO);
685 		}
686 		proto = PROT_CRYPTD;
687 		break;
688 	case HOOK_INDEX_BYPASS:
689 		if (m->m_pkthdr.len < 4) {
690 			NG_FREE_DATA(m, meta);
691 			return (EINVAL);
692 		}
693 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
694 			NG_FREE_META(meta);
695 			return (ENOBUFS);
696 		}
697 		linkNum = ntohs(mtod(m, u_int16_t *)[0]);
698 		proto = ntohs(mtod(m, u_int16_t *)[1]);
699 		m_adj(m, 4);
700 		if (linkNum >= NG_PPP_MAX_LINKS
701 		    && linkNum != NG_PPP_BUNDLE_LINKNUM) {
702 			NG_FREE_DATA(m, meta);
703 			return (EINVAL);
704 		}
705 		break;
706 
707 	/* Incoming data */
708 	case HOOK_INDEX_VJC_IP:
709 		if (!priv->conf.enableIP || !priv->conf.enableVJDecompression) {
710 			NG_FREE_DATA(m, meta);
711 			return (ENXIO);
712 		}
713 		break;
714 	case HOOK_INDEX_DECOMPRESS:
715 		if (!priv->conf.enableDecompression) {
716 			NG_FREE_DATA(m, meta);
717 			return (ENXIO);
718 		}
719 		break;
720 	case HOOK_INDEX_DECRYPT:
721 		if (!priv->conf.enableDecryption) {
722 			NG_FREE_DATA(m, meta);
723 			return (ENXIO);
724 		}
725 		break;
726 	default:
727 		panic("%s: bogus index 0x%x", __FUNCTION__, index);
728 	}
729 
730 	/* Now figure out what to do with the frame */
731 	switch (index) {
732 
733 	/* Outgoing data */
734 	case HOOK_INDEX_INET:
735 		if (priv->conf.enableVJCompression && priv->vjCompHooked) {
736 			outHook = priv->hooks[HOOK_INDEX_VJC_IP];
737 			break;
738 		}
739 		/* FALLTHROUGH */
740 	case HOOK_INDEX_ATALK:
741 	case HOOK_INDEX_IPV6:
742 	case HOOK_INDEX_IPX:
743 	case HOOK_INDEX_VJC_COMP:
744 	case HOOK_INDEX_VJC_UNCOMP:
745 	case HOOK_INDEX_VJC_VJIP:
746 		if (priv->conf.enableCompression
747 		    && priv->hooks[HOOK_INDEX_COMPRESS] != NULL) {
748 			if ((m = ng_ppp_addproto(m, proto, 1)) == NULL) {
749 				NG_FREE_META(meta);
750 				return (ENOBUFS);
751 			}
752 			outHook = priv->hooks[HOOK_INDEX_COMPRESS];
753 			break;
754 		}
755 		/* FALLTHROUGH */
756 	case HOOK_INDEX_COMPRESS:
757 		if (priv->conf.enableEncryption
758 		    && priv->hooks[HOOK_INDEX_ENCRYPT] != NULL) {
759 			if ((m = ng_ppp_addproto(m, proto, 1)) == NULL) {
760 				NG_FREE_META(meta);
761 				return (ENOBUFS);
762 			}
763 			outHook = priv->hooks[HOOK_INDEX_ENCRYPT];
764 			break;
765 		}
766 		/* FALLTHROUGH */
767 	case HOOK_INDEX_ENCRYPT:
768 		return ng_ppp_output(node, 0,
769 		    proto, NG_PPP_BUNDLE_LINKNUM, m, meta);
770 
771 	case HOOK_INDEX_BYPASS:
772 		return ng_ppp_output(node, 1, proto, linkNum, m, meta);
773 
774 	/* Incoming data */
775 	case HOOK_INDEX_DECRYPT:
776 	case HOOK_INDEX_DECOMPRESS:
777 		return ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, m, meta);
778 
779 	case HOOK_INDEX_VJC_IP:
780 		outHook = priv->hooks[HOOK_INDEX_INET];
781 		break;
782 	}
783 
784 	/* Send packet out hook */
785 	NG_SEND_DATA_RET(error, outHook, m, meta);
786 	if (m != NULL || meta != NULL)
787 		return ng_ppp_rcvdata(outHook, m, meta, NULL, NULL);
788 	return (error);
789 }
790 
791 /*
792  * Destroy node
793  */
794 static int
795 ng_ppp_rmnode(node_p node)
796 {
797 	const priv_p priv = node->private;
798 
799 	/* Stop fragment queue timer */
800 	ng_ppp_stop_frag_timer(node);
801 
802 	/* Take down netgraph node */
803 	node->flags |= NG_INVALID;
804 	ng_cutlinks(node);
805 	ng_unname(node);
806 	ng_ppp_frag_reset(node);
807 	bzero(priv, sizeof(*priv));
808 	FREE(priv, M_NETGRAPH);
809 	node->private = NULL;
810 	ng_unref(node);		/* let the node escape */
811 	return (0);
812 }
813 
814 /*
815  * Hook disconnection
816  */
817 static int
818 ng_ppp_disconnect(hook_p hook)
819 {
820 	const node_p node = hook->node;
821 	const priv_p priv = node->private;
822 	const int index = HOOK_INDEX(hook);
823 
824 	/* Zero out hook pointer */
825 	if (index < 0)
826 		priv->links[~index].hook = NULL;
827 	else
828 		priv->hooks[index] = NULL;
829 
830 	/* Update derived info (or go away if no hooks left) */
831 	if (node->numhooks > 0)
832 		ng_ppp_update(node, 0);
833 	else
834 		ng_rmnode(node);
835 	return (0);
836 }
837 
838 /************************************************************************
839 			HELPER STUFF
840  ************************************************************************/
841 
842 /*
843  * Handle an incoming frame.  Extract the PPP protocol number
844  * and dispatch accordingly.
845  */
846 static int
847 ng_ppp_input(node_p node, int bypass, int linkNum, struct mbuf *m, meta_p meta)
848 {
849 	const priv_p priv = node->private;
850 	hook_p outHook = NULL;
851 	int proto, error;
852 
853 	/* Extract protocol number */
854 	for (proto = 0; !PROT_VALID(proto) && m->m_pkthdr.len > 0; ) {
855 		if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL) {
856 			NG_FREE_META(meta);
857 			return (ENOBUFS);
858 		}
859 		proto = (proto << 8) + *mtod(m, u_char *);
860 		m_adj(m, 1);
861 	}
862 	if (!PROT_VALID(proto)) {
863 		if (linkNum == NG_PPP_BUNDLE_LINKNUM)
864 			priv->bundleStats.badProtos++;
865 		else
866 			priv->links[linkNum].stats.badProtos++;
867 		NG_FREE_DATA(m, meta);
868 		return (EINVAL);
869 	}
870 
871 	/* Bypass frame? */
872 	if (bypass)
873 		goto bypass;
874 
875 	/* Check protocol */
876 	switch (proto) {
877 	case PROT_COMPD:
878 		if (priv->conf.enableDecompression)
879 			outHook = priv->hooks[HOOK_INDEX_DECOMPRESS];
880 		break;
881 	case PROT_CRYPTD:
882 		if (priv->conf.enableDecryption)
883 			outHook = priv->hooks[HOOK_INDEX_DECRYPT];
884 		break;
885 	case PROT_VJCOMP:
886 		if (priv->conf.enableVJDecompression && priv->vjCompHooked)
887 			outHook = priv->hooks[HOOK_INDEX_VJC_COMP];
888 		break;
889 	case PROT_VJUNCOMP:
890 		if (priv->conf.enableVJDecompression && priv->vjCompHooked)
891 			outHook = priv->hooks[HOOK_INDEX_VJC_UNCOMP];
892 		break;
893 	case PROT_MP:
894 		if (priv->conf.enableMultilink
895 		    && linkNum != NG_PPP_BUNDLE_LINKNUM)
896 			return ng_ppp_mp_input(node, linkNum, m, meta);
897 		break;
898 	case PROT_APPLETALK:
899 		if (priv->conf.enableAtalk)
900 			outHook = priv->hooks[HOOK_INDEX_ATALK];
901 		break;
902 	case PROT_IPX:
903 		if (priv->conf.enableIPX)
904 			outHook = priv->hooks[HOOK_INDEX_IPX];
905 		break;
906 	case PROT_IP:
907 		if (priv->conf.enableIP)
908 			outHook = priv->hooks[HOOK_INDEX_INET];
909 		break;
910 	case PROT_IPV6:
911 		if (priv->conf.enableIPv6)
912 			outHook = priv->hooks[HOOK_INDEX_IPV6];
913 		break;
914 	}
915 
916 bypass:
917 	/* For unknown/inactive protocols, forward out the bypass hook */
918 	if (outHook == NULL) {
919 		u_int16_t hdr[2];
920 
921 		hdr[0] = htons(linkNum);
922 		hdr[1] = htons((u_int16_t)proto);
923 		if ((m = ng_ppp_prepend(m, &hdr, 4)) == NULL) {
924 			NG_FREE_META(meta);
925 			return (ENOBUFS);
926 		}
927 		outHook = priv->hooks[HOOK_INDEX_BYPASS];
928 	}
929 
930 	/* Forward frame */
931 	NG_SEND_DATA(error, outHook, m, meta);
932 	return (error);
933 }
934 
935 /*
936  * Deliver a frame out a link, either a real one or NG_PPP_BUNDLE_LINKNUM
937  * If the link is not enabled then ENXIO is returned, unless "bypass" is != 0.
938  */
939 static int
940 ng_ppp_output(node_p node, int bypass,
941 	int proto, int linkNum, struct mbuf *m, meta_p meta)
942 {
943 	const priv_p priv = node->private;
944 	struct ng_ppp_link *link;
945 	int len, error;
946 
947 	/* If not doing MP, map bundle virtual link to (the only) link */
948 	if (linkNum == NG_PPP_BUNDLE_LINKNUM && !priv->conf.enableMultilink)
949 		linkNum = priv->activeLinks[0];
950 
951 	/* Get link pointer (optimization) */
952 	link = (linkNum != NG_PPP_BUNDLE_LINKNUM) ?
953 	    &priv->links[linkNum] : NULL;
954 
955 	/* Check link status (if real) */
956 	if (linkNum != NG_PPP_BUNDLE_LINKNUM) {
957 		if (!bypass && !link->conf.enableLink) {
958 			NG_FREE_DATA(m, meta);
959 			return (ENXIO);
960 		}
961 		if (link->hook == NULL) {
962 			NG_FREE_DATA(m, meta);
963 			return (ENETDOWN);
964 		}
965 	}
966 
967 	/* Prepend protocol number, possibly compressed */
968 	if ((m = ng_ppp_addproto(m, proto,
969 	    linkNum == NG_PPP_BUNDLE_LINKNUM
970 	      || link->conf.enableProtoComp)) == NULL) {
971 		NG_FREE_META(meta);
972 		return (ENOBUFS);
973 	}
974 
975 	/* Special handling for the MP virtual link */
976 	if (linkNum == NG_PPP_BUNDLE_LINKNUM)
977 		return ng_ppp_mp_output(node, m, meta);
978 
979 	/* Prepend address and control field (unless compressed) */
980 	if (proto == PROT_LCP || !link->conf.enableACFComp) {
981 		if ((m = ng_ppp_prepend(m, &ng_ppp_acf, 2)) == NULL) {
982 			NG_FREE_META(meta);
983 			return (ENOBUFS);
984 		}
985 	}
986 
987 	/* Deliver frame */
988 	len = m->m_pkthdr.len;
989 	NG_SEND_DATA(error, link->hook, m, meta);
990 
991 	/* Update stats and 'bytes in queue' counter */
992 	if (error == 0) {
993 		link->stats.xmitFrames++;
994 		link->stats.xmitOctets += len;
995 		link->bytesInQueue += len;
996 		getmicrouptime(&link->lastWrite);
997 	}
998 	return error;
999 }
1000 
1001 /*
1002  * Handle an incoming multi-link fragment
1003  *
1004  * The fragment reassembly algorithm is somewhat complex. This is mainly
1005  * because we are required not to reorder the reconstructed packets, yet
1006  * fragments are only guaranteed to arrive in order on a per-link basis.
1007  * In other words, when we have a complete packet ready, but the previous
1008  * packet is still incomplete, we have to decide between delivering the
1009  * complete packet and throwing away the incomplete one, or waiting to
1010  * see if the remainder of the incomplete one arrives, at which time we
1011  * can deliver both packets, in order.
1012  *
1013  * This problem is exacerbated by "sequence number slew", which is when
1014  * the sequence numbers coming in from different links are far apart from
1015  * each other. In particular, certain unnamed equipment (*cough* Ascend)
1016  * has been seen to generate sequence number slew of up to 10 on an ISDN
1017  * 2B-channel MP link. There is nothing invalid about sequence number slew
1018  * but it makes the reasssembly process have to work harder.
1019  *
1020  * However, the peer is required to transmit fragments in order on each
1021  * link. That means if we define MSEQ as the minimum over all links of
1022  * the highest sequence number received on that link, then we can always
1023  * give up any hope of receiving a fragment with sequence number < MSEQ in
1024  * the future (all of this using 'wraparound' sequence number space).
1025  * Therefore we can always immediately throw away incomplete packets
1026  * missing fragments with sequence numbers < MSEQ.
1027  *
1028  * Here is an overview of our algorithm:
1029  *
1030  *    o Received fragments are inserted into a queue, for which we
1031  *	maintain these invariants between calls to this function:
1032  *
1033  *	- Fragments are ordered in the queue by sequence number
1034  *	- If a complete packet is at the head of the queue, then
1035  *	  the first fragment in the packet has seq# > MSEQ + 1
1036  *	  (otherwise, we could deliver it immediately)
1037  *	- If any fragments have seq# < MSEQ, then they are necessarily
1038  *	  part of a packet whose missing seq#'s are all > MSEQ (otherwise,
1039  *	  we can throw them away because they'll never be completed)
1040  *	- The queue contains at most MP_MAX_QUEUE_LEN fragments
1041  *
1042  *    o We have a periodic timer that checks the queue for the first
1043  *	complete packet that has been sitting in the queue "too long".
1044  *	When one is detected, all previous (incomplete) fragments are
1045  *	discarded, their missing fragments are declared lost and MSEQ
1046  *	is increased.
1047  *
1048  *    o If we recieve a fragment with seq# < MSEQ, we throw it away
1049  *	because we've already delcared it lost.
1050  *
1051  * This assumes linkNum != NG_PPP_BUNDLE_LINKNUM.
1052  */
1053 static int
1054 ng_ppp_mp_input(node_p node, int linkNum, struct mbuf *m, meta_p meta)
1055 {
1056 	const priv_p priv = node->private;
1057 	struct ng_ppp_link *const link = &priv->links[linkNum];
1058 	struct ng_ppp_frag frag0, *frag = &frag0;
1059 	struct ng_ppp_frag *qent;
1060 	int i, diff, inserted;
1061 
1062 	/* Stats */
1063 	priv->bundleStats.recvFrames++;
1064 	priv->bundleStats.recvOctets += m->m_pkthdr.len;
1065 
1066 	/* Extract fragment information from MP header */
1067 	if (priv->conf.recvShortSeq) {
1068 		u_int16_t shdr;
1069 
1070 		if (m->m_pkthdr.len < 2) {
1071 			link->stats.runts++;
1072 			NG_FREE_DATA(m, meta);
1073 			return (EINVAL);
1074 		}
1075 		if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
1076 			NG_FREE_META(meta);
1077 			return (ENOBUFS);
1078 		}
1079 		shdr = ntohs(*mtod(m, u_int16_t *));
1080 		frag->seq = MP_SHORT_EXTEND(shdr);
1081 		frag->first = (shdr & MP_SHORT_FIRST_FLAG) != 0;
1082 		frag->last = (shdr & MP_SHORT_LAST_FLAG) != 0;
1083 		diff = MP_SHORT_SEQ_DIFF(frag->seq, priv->mseq);
1084 		m_adj(m, 2);
1085 	} else {
1086 		u_int32_t lhdr;
1087 
1088 		if (m->m_pkthdr.len < 4) {
1089 			link->stats.runts++;
1090 			NG_FREE_DATA(m, meta);
1091 			return (EINVAL);
1092 		}
1093 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
1094 			NG_FREE_META(meta);
1095 			return (ENOBUFS);
1096 		}
1097 		lhdr = ntohl(*mtod(m, u_int32_t *));
1098 		frag->seq = MP_LONG_EXTEND(lhdr);
1099 		frag->first = (lhdr & MP_LONG_FIRST_FLAG) != 0;
1100 		frag->last = (lhdr & MP_LONG_LAST_FLAG) != 0;
1101 		diff = MP_LONG_SEQ_DIFF(frag->seq, priv->mseq);
1102 		m_adj(m, 4);
1103 	}
1104 	frag->data = m;
1105 	frag->meta = meta;
1106 	getmicrouptime(&frag->timestamp);
1107 
1108 	/* If sequence number is < MSEQ, we've already declared this
1109 	   fragment as lost, so we have no choice now but to drop it */
1110 	if (diff < 0) {
1111 		link->stats.dropFragments++;
1112 		NG_FREE_DATA(m, meta);
1113 		return (0);
1114 	}
1115 
1116 	/* Update highest received sequence number on this link and MSEQ */
1117 	priv->mseq = link->seq = frag->seq;
1118 	for (i = 0; i < priv->numActiveLinks; i++) {
1119 		struct ng_ppp_link *const alink =
1120 		    &priv->links[priv->activeLinks[i]];
1121 
1122 		if (MP_RECV_SEQ_DIFF(priv, alink->seq, priv->mseq) < 0)
1123 			priv->mseq = alink->seq;
1124 	}
1125 
1126 	/* Allocate a new frag struct for the queue */
1127 	MALLOC(frag, struct ng_ppp_frag *, sizeof(*frag), M_NETGRAPH, M_NOWAIT);
1128 	if (frag == NULL) {
1129 		NG_FREE_DATA(m, meta);
1130 		ng_ppp_frag_process(node);
1131 		return (ENOMEM);
1132 	}
1133 	*frag = frag0;
1134 
1135 	/* Add fragment to queue, which is sorted by sequence number */
1136 	inserted = 0;
1137 	CIRCLEQ_FOREACH_REVERSE(qent, &priv->frags, f_qent) {
1138 		diff = MP_RECV_SEQ_DIFF(priv, frag->seq, qent->seq);
1139 		if (diff > 0) {
1140 			CIRCLEQ_INSERT_AFTER(&priv->frags, qent, frag, f_qent);
1141 			inserted = 1;
1142 			break;
1143 		} else if (diff == 0) {	     /* should never happen! */
1144 			link->stats.dupFragments++;
1145 			NG_FREE_DATA(frag->data, frag->meta);
1146 			FREE(frag, M_NETGRAPH);
1147 			return (EINVAL);
1148 		}
1149 	}
1150 	if (!inserted)
1151 		CIRCLEQ_INSERT_HEAD(&priv->frags, frag, f_qent);
1152 	priv->qlen++;
1153 
1154 	/* Process the queue */
1155 	return ng_ppp_frag_process(node);
1156 }
1157 
1158 /*
1159  * Examine our list of fragments, and determine if there is a
1160  * complete and deliverable packet at the head of the list.
1161  * Return 1 if so, zero otherwise.
1162  */
1163 static int
1164 ng_ppp_check_packet(node_p node)
1165 {
1166 	const priv_p priv = node->private;
1167 	struct ng_ppp_frag *qent, *qnext;
1168 
1169 	/* Check for empty queue */
1170 	if (CIRCLEQ_EMPTY(&priv->frags))
1171 		return (0);
1172 
1173 	/* Check first fragment is the start of a deliverable packet */
1174 	qent = CIRCLEQ_FIRST(&priv->frags);
1175 	if (!qent->first || MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) > 1)
1176 		return (0);
1177 
1178 	/* Check that all the fragments are there */
1179 	while (!qent->last) {
1180 		qnext = CIRCLEQ_NEXT(qent, f_qent);
1181 		if (qnext == (void *)&priv->frags)	/* end of queue */
1182 			return (0);
1183 		if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq))
1184 			return (0);
1185 		qent = qnext;
1186 	}
1187 
1188 	/* Got one */
1189 	return (1);
1190 }
1191 
1192 /*
1193  * Pull a completed packet off the head of the incoming fragment queue.
1194  * This assumes there is a completed packet there to pull off.
1195  */
1196 static void
1197 ng_ppp_get_packet(node_p node, struct mbuf **mp, meta_p *metap)
1198 {
1199 	const priv_p priv = node->private;
1200 	struct ng_ppp_frag *qent, *qnext;
1201 	struct mbuf *m = NULL, *tail;
1202 
1203 	qent = CIRCLEQ_FIRST(&priv->frags);
1204 	KASSERT(!CIRCLEQ_EMPTY(&priv->frags) && qent->first,
1205 	    ("%s: no packet", __FUNCTION__));
1206 	for (tail = NULL; qent != NULL; qent = qnext) {
1207 		qnext = CIRCLEQ_NEXT(qent, f_qent);
1208 		KASSERT(!CIRCLEQ_EMPTY(&priv->frags),
1209 		    ("%s: empty q", __FUNCTION__));
1210 		CIRCLEQ_REMOVE(&priv->frags, qent, f_qent);
1211 		if (tail == NULL) {
1212 			tail = m = qent->data;
1213 			*metap = qent->meta;	/* inherit first frag's meta */
1214 		} else {
1215 			m->m_pkthdr.len += qent->data->m_pkthdr.len;
1216 			tail->m_next = qent->data;
1217 			NG_FREE_META(qent->meta); /* drop other frags' metas */
1218 		}
1219 		while (tail->m_next != NULL)
1220 			tail = tail->m_next;
1221 		if (qent->last)
1222 			qnext = NULL;
1223 		FREE(qent, M_NETGRAPH);
1224 		priv->qlen--;
1225 	}
1226 	*mp = m;
1227 }
1228 
1229 /*
1230  * Trim fragments from the queue whose packets can never be completed.
1231  * This assumes a complete packet is NOT at the beginning of the queue.
1232  * Returns 1 if fragments were removed, zero otherwise.
1233  */
1234 static int
1235 ng_ppp_frag_trim(node_p node)
1236 {
1237 	const priv_p priv = node->private;
1238 	struct ng_ppp_frag *qent, *qnext = NULL;
1239 	int removed = 0;
1240 
1241 	/* Scan for "dead" fragments and remove them */
1242 	while (1) {
1243 		int dead = 0;
1244 
1245 		/* If queue is empty, we're done */
1246 		if (CIRCLEQ_EMPTY(&priv->frags))
1247 			break;
1248 
1249 		/* Determine whether first fragment can ever be completed */
1250 		CIRCLEQ_FOREACH(qent, &priv->frags, f_qent) {
1251 			if (MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) >= 0)
1252 				break;
1253 			qnext = CIRCLEQ_NEXT(qent, f_qent);
1254 			KASSERT(qnext != (void*)&priv->frags,
1255 			    ("%s: last frag < MSEQ?", __FUNCTION__));
1256 			if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq)
1257 			    || qent->last || qnext->first) {
1258 				dead = 1;
1259 				break;
1260 			}
1261 		}
1262 		if (!dead)
1263 			break;
1264 
1265 		/* Remove fragment and all others in the same packet */
1266 		while ((qent = CIRCLEQ_FIRST(&priv->frags)) != qnext) {
1267 			KASSERT(!CIRCLEQ_EMPTY(&priv->frags),
1268 			    ("%s: empty q", __FUNCTION__));
1269 			priv->bundleStats.dropFragments++;
1270 			CIRCLEQ_REMOVE(&priv->frags, qent, f_qent);
1271 			NG_FREE_DATA(qent->data, qent->meta);
1272 			FREE(qent, M_NETGRAPH);
1273 			priv->qlen--;
1274 			removed = 1;
1275 		}
1276 	}
1277 	return (removed);
1278 }
1279 
1280 /*
1281  * Run the queue, restoring the queue invariants
1282  */
1283 static int
1284 ng_ppp_frag_process(node_p node)
1285 {
1286 	const priv_p priv = node->private;
1287 	struct mbuf *m;
1288 	meta_p meta;
1289 
1290 	/* Deliver any deliverable packets */
1291 	while (ng_ppp_check_packet(node)) {
1292 		ng_ppp_get_packet(node, &m, &meta);
1293 		ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, m, meta);
1294 	}
1295 
1296 	/* Delete dead fragments and try again */
1297 	if (ng_ppp_frag_trim(node)) {
1298 		while (ng_ppp_check_packet(node)) {
1299 			ng_ppp_get_packet(node, &m, &meta);
1300 			ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, m, meta);
1301 		}
1302 	}
1303 
1304 	/* Check for stale fragments while we're here */
1305 	ng_ppp_frag_checkstale(node);
1306 
1307 	/* Check queue length */
1308 	if (priv->qlen > MP_MAX_QUEUE_LEN) {
1309 		struct ng_ppp_frag *qent;
1310 		int i;
1311 
1312 		/* Get oldest fragment */
1313 		KASSERT(!CIRCLEQ_EMPTY(&priv->frags),
1314 		    ("%s: empty q", __FUNCTION__));
1315 		qent = CIRCLEQ_FIRST(&priv->frags);
1316 
1317 		/* Bump MSEQ if necessary */
1318 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, qent->seq) < 0) {
1319 			priv->mseq = qent->seq;
1320 			for (i = 0; i < priv->numActiveLinks; i++) {
1321 				struct ng_ppp_link *const alink =
1322 				    &priv->links[priv->activeLinks[i]];
1323 
1324 				if (MP_RECV_SEQ_DIFF(priv,
1325 				    alink->seq, priv->mseq) < 0)
1326 					alink->seq = priv->mseq;
1327 			}
1328 		}
1329 
1330 		/* Drop it */
1331 		priv->bundleStats.dropFragments++;
1332 		CIRCLEQ_REMOVE(&priv->frags, qent, f_qent);
1333 		NG_FREE_DATA(qent->data, qent->meta);
1334 		FREE(qent, M_NETGRAPH);
1335 		priv->qlen--;
1336 
1337 		/* Process queue again */
1338 		return ng_ppp_frag_process(node);
1339 	}
1340 
1341 	/* Done */
1342 	return (0);
1343 }
1344 
1345 /*
1346  * Check for 'stale' completed packets that need to be delivered
1347  *
1348  * If a link goes down or has a temporary failure, MSEQ can get
1349  * "stuck", because no new incoming fragments appear on that link.
1350  * This can cause completed packets to never get delivered if
1351  * their sequence numbers are all > MSEQ + 1.
1352  *
1353  * This routine checks how long all of the completed packets have
1354  * been sitting in the queue, and if too long, removes fragments
1355  * from the queue and increments MSEQ to allow them to be delivered.
1356  */
1357 static void
1358 ng_ppp_frag_checkstale(node_p node)
1359 {
1360 	const priv_p priv = node->private;
1361 	struct ng_ppp_frag *qent, *beg, *end;
1362 	struct timeval now, age;
1363 	struct mbuf *m;
1364 	meta_p meta;
1365 	int i, seq;
1366 
1367 	now.tv_sec = 0;			/* uninitialized state */
1368 	while (1) {
1369 
1370 		/* If queue is empty, we're done */
1371 		if (CIRCLEQ_EMPTY(&priv->frags))
1372 			break;
1373 
1374 		/* Find the first complete packet in the queue */
1375 		beg = end = NULL;
1376 		seq = CIRCLEQ_FIRST(&priv->frags)->seq;
1377 		CIRCLEQ_FOREACH(qent, &priv->frags, f_qent) {
1378 			if (qent->first)
1379 				beg = qent;
1380 			else if (qent->seq != seq)
1381 				beg = NULL;
1382 			if (beg != NULL && qent->last) {
1383 				end = qent;
1384 				break;
1385 			}
1386 			seq = MP_NEXT_RECV_SEQ(priv, seq);
1387 		}
1388 
1389 		/* If none found, exit */
1390 		if (end == NULL)
1391 			break;
1392 
1393 		/* Get current time (we assume we've been up for >= 1 second) */
1394 		if (now.tv_sec == 0)
1395 			getmicrouptime(&now);
1396 
1397 		/* Check if packet has been queued too long */
1398 		age = now;
1399 		timevalsub(&age, &beg->timestamp);
1400 		if (timevalcmp(&age, &ng_ppp_max_staleness, < ))
1401 			break;
1402 
1403 		/* Throw away junk fragments in front of the completed packet */
1404 		while ((qent = CIRCLEQ_FIRST(&priv->frags)) != beg) {
1405 			KASSERT(!CIRCLEQ_EMPTY(&priv->frags),
1406 			    ("%s: empty q", __FUNCTION__));
1407 			priv->bundleStats.dropFragments++;
1408 			CIRCLEQ_REMOVE(&priv->frags, qent, f_qent);
1409 			NG_FREE_DATA(qent->data, qent->meta);
1410 			FREE(qent, M_NETGRAPH);
1411 			priv->qlen--;
1412 		}
1413 
1414 		/* Extract completed packet */
1415 		ng_ppp_get_packet(node, &m, &meta);
1416 
1417 		/* Bump MSEQ if necessary */
1418 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, end->seq) < 0) {
1419 			priv->mseq = end->seq;
1420 			for (i = 0; i < priv->numActiveLinks; i++) {
1421 				struct ng_ppp_link *const alink =
1422 				    &priv->links[priv->activeLinks[i]];
1423 
1424 				if (MP_RECV_SEQ_DIFF(priv,
1425 				    alink->seq, priv->mseq) < 0)
1426 					alink->seq = priv->mseq;
1427 			}
1428 		}
1429 
1430 		/* Deliver packet */
1431 		ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, m, meta);
1432 	}
1433 }
1434 
1435 /*
1436  * Periodically call ng_ppp_frag_checkstale()
1437  */
1438 static void
1439 ng_ppp_frag_timeout(void *arg)
1440 {
1441 	const node_p node = arg;
1442 	const priv_p priv = node->private;
1443 	int s = splnet();
1444 
1445 	/* Handle the race where shutdown happens just before splnet() above */
1446 	if ((node->flags & NG_INVALID) != 0) {
1447 		ng_unref(node);
1448 		splx(s);
1449 		return;
1450 	}
1451 
1452 	/* Reset timer state after timeout */
1453 	KASSERT(priv->timerActive, ("%s: !timerActive", __FUNCTION__));
1454 	priv->timerActive = 0;
1455 	KASSERT(node->refs > 1, ("%s: refs=%d", __FUNCTION__, node->refs));
1456 	ng_unref(node);
1457 
1458 	/* Start timer again */
1459 	ng_ppp_start_frag_timer(node);
1460 
1461 	/* Scan the fragment queue */
1462 	ng_ppp_frag_checkstale(node);
1463 	splx(s);
1464 }
1465 
1466 /*
1467  * Deliver a frame out on the bundle, i.e., figure out how to fragment
1468  * the frame across the individual PPP links and do so.
1469  */
1470 static int
1471 ng_ppp_mp_output(node_p node, struct mbuf *m, meta_p meta)
1472 {
1473 	const priv_p priv = node->private;
1474 	int distrib[NG_PPP_MAX_LINKS];
1475 	int firstFragment;
1476 	int activeLinkNum;
1477 
1478 	/* At least one link must be active */
1479 	if (priv->numActiveLinks == 0) {
1480 		NG_FREE_DATA(m, meta);
1481 		return (ENETDOWN);
1482 	}
1483 
1484 	/* Round-robin strategy */
1485 	if (priv->conf.enableRoundRobin || m->m_pkthdr.len < MP_MIN_FRAG_LEN) {
1486 		activeLinkNum = priv->lastLink++ % priv->numActiveLinks;
1487 		bzero(&distrib, priv->numActiveLinks * sizeof(distrib[0]));
1488 		distrib[activeLinkNum] = m->m_pkthdr.len;
1489 		goto deliver;
1490 	}
1491 
1492 	/* Strategy when all links are equivalent (optimize the common case) */
1493 	if (priv->allLinksEqual) {
1494 		const int fraction = m->m_pkthdr.len / priv->numActiveLinks;
1495 		int i, remain;
1496 
1497 		for (i = 0; i < priv->numActiveLinks; i++)
1498 			distrib[priv->lastLink++ % priv->numActiveLinks]
1499 			    = fraction;
1500 		remain = m->m_pkthdr.len - (fraction * priv->numActiveLinks);
1501 		while (remain > 0) {
1502 			distrib[priv->lastLink++ % priv->numActiveLinks]++;
1503 			remain--;
1504 		}
1505 		goto deliver;
1506 	}
1507 
1508 	/* Strategy when all links are not equivalent */
1509 	ng_ppp_mp_strategy(node, m->m_pkthdr.len, distrib);
1510 
1511 deliver:
1512 	/* Update stats */
1513 	priv->bundleStats.xmitFrames++;
1514 	priv->bundleStats.xmitOctets += m->m_pkthdr.len;
1515 
1516 	/* Send alloted portions of frame out on the link(s) */
1517 	for (firstFragment = 1, activeLinkNum = priv->numActiveLinks - 1;
1518 	    activeLinkNum >= 0; activeLinkNum--) {
1519 		const int linkNum = priv->activeLinks[activeLinkNum];
1520 		struct ng_ppp_link *const link = &priv->links[linkNum];
1521 
1522 		/* Deliver fragment(s) out the next link */
1523 		for ( ; distrib[activeLinkNum] > 0; firstFragment = 0) {
1524 			int len, lastFragment, error;
1525 			struct mbuf *m2;
1526 			meta_p meta2;
1527 
1528 			/* Calculate fragment length; don't exceed link MTU */
1529 			len = distrib[activeLinkNum];
1530 			if (len > link->conf.mru)
1531 				len = link->conf.mru;
1532 			distrib[activeLinkNum] -= len;
1533 			lastFragment = (len == m->m_pkthdr.len);
1534 
1535 			/* Split off next fragment as "m2" */
1536 			m2 = m;
1537 			if (!lastFragment) {
1538 				struct mbuf *n = m_split(m, len, M_NOWAIT);
1539 
1540 				if (n == NULL) {
1541 					NG_FREE_DATA(m, meta);
1542 					return (ENOMEM);
1543 				}
1544 				m = n;
1545 			}
1546 
1547 			/* Prepend MP header */
1548 			if (priv->conf.xmitShortSeq) {
1549 				u_int16_t shdr;
1550 
1551 				shdr = priv->xseq;
1552 				priv->xseq =
1553 				    (priv->xseq + 1) & MP_SHORT_SEQ_MASK;
1554 				if (firstFragment)
1555 					shdr |= MP_SHORT_FIRST_FLAG;
1556 				if (lastFragment)
1557 					shdr |= MP_SHORT_LAST_FLAG;
1558 				shdr = htons(shdr);
1559 				m2 = ng_ppp_prepend(m2, &shdr, 2);
1560 			} else {
1561 				u_int32_t lhdr;
1562 
1563 				lhdr = priv->xseq;
1564 				priv->xseq =
1565 				    (priv->xseq + 1) & MP_LONG_SEQ_MASK;
1566 				if (firstFragment)
1567 					lhdr |= MP_LONG_FIRST_FLAG;
1568 				if (lastFragment)
1569 					lhdr |= MP_LONG_LAST_FLAG;
1570 				lhdr = htonl(lhdr);
1571 				m2 = ng_ppp_prepend(m2, &lhdr, 4);
1572 			}
1573 			if (m2 == NULL) {
1574 				if (!lastFragment)
1575 					m_freem(m);
1576 				NG_FREE_META(meta);
1577 				return (ENOBUFS);
1578 			}
1579 
1580 			/* Copy the meta information, if any */
1581 			meta2 = lastFragment ? meta : ng_copy_meta(meta);
1582 
1583 			/* Send fragment */
1584 			error = ng_ppp_output(node, 0,
1585 			    PROT_MP, linkNum, m2, meta2);
1586 			if (error != 0) {
1587 				if (!lastFragment)
1588 					NG_FREE_DATA(m, meta);
1589 				return (error);
1590 			}
1591 		}
1592 	}
1593 
1594 	/* Done */
1595 	return (0);
1596 }
1597 
1598 /*
1599  * Computing the optimal fragmentation
1600  * -----------------------------------
1601  *
1602  * This routine tries to compute the optimal fragmentation pattern based
1603  * on each link's latency, bandwidth, and calculated additional latency.
1604  * The latter quantity is the additional latency caused by previously
1605  * written data that has not been transmitted yet.
1606  *
1607  * This algorithm is only useful when not all of the links have the
1608  * same latency and bandwidth values.
1609  *
1610  * The essential idea is to make the last bit of each fragment of the
1611  * frame arrive at the opposite end at the exact same time. This greedy
1612  * algorithm is optimal, in that no other scheduling could result in any
1613  * packet arriving any sooner unless packets are delivered out of order.
1614  *
1615  * Suppose link i has bandwidth b_i (in tens of bytes per milisecond) and
1616  * latency l_i (in miliseconds). Consider the function function f_i(t)
1617  * which is equal to the number of bytes that will have arrived at
1618  * the peer after t miliseconds if we start writing continuously at
1619  * time t = 0. Then f_i(t) = b_i * (t - l_i) = ((b_i * t) - (l_i * b_i).
1620  * That is, f_i(t) is a line with slope b_i and y-intersect -(l_i * b_i).
1621  * Note that the y-intersect is always <= zero because latency can't be
1622  * negative.  Note also that really the function is f_i(t) except when
1623  * f_i(t) is negative, in which case the function is zero.  To take
1624  * care of this, let Q_i(t) = { if (f_i(t) > 0) return 1; else return 0; }.
1625  * So the actual number of bytes that will have arrived at the peer after
1626  * t miliseconds is f_i(t) * Q_i(t).
1627  *
1628  * At any given time, each link has some additional latency a_i >= 0
1629  * due to previously written fragment(s) which are still in the queue.
1630  * This value is easily computed from the time since last transmission,
1631  * the previous latency value, the number of bytes written, and the
1632  * link's bandwidth.
1633  *
1634  * Assume that l_i includes any a_i already, and that the links are
1635  * sorted by latency, so that l_i <= l_{i+1}.
1636  *
1637  * Let N be the total number of bytes in the current frame we are sending.
1638  *
1639  * Suppose we were to start writing bytes at time t = 0 on all links
1640  * simultaneously, which is the most we can possibly do.  Then let
1641  * F(t) be equal to the total number of bytes received by the peer
1642  * after t miliseconds. Then F(t) = Sum_i (f_i(t) * Q_i(t)).
1643  *
1644  * Our goal is simply this: fragment the frame across the links such
1645  * that the peer is able to reconstruct the completed frame as soon as
1646  * possible, i.e., at the least possible value of t. Call this value t_0.
1647  *
1648  * Then it follows that F(t_0) = N. Our strategy is first to find the value
1649  * of t_0, and then deduce how many bytes to write to each link.
1650  *
1651  * Rewriting F(t_0):
1652  *
1653  *   t_0 = ( N + Sum_i ( l_i * b_i * Q_i(t_0) ) ) / Sum_i ( b_i * Q_i(t_0) )
1654  *
1655  * Now, we note that Q_i(t) is constant for l_i <= t <= l_{i+1}. t_0 will
1656  * lie in one of these ranges.  To find it, we just need to find the i such
1657  * that F(l_i) <= N <= F(l_{i+1}).  Then we compute all the constant values
1658  * for Q_i() in this range, plug in the remaining values, solving for t_0.
1659  *
1660  * Once t_0 is known, then the number of bytes to send on link i is
1661  * just f_i(t_0) * Q_i(t_0).
1662  *
1663  * In other words, we start allocating bytes to the links one at a time.
1664  * We keep adding links until the frame is completely sent.  Some links
1665  * may not get any bytes because their latency is too high.
1666  *
1667  * Is all this work really worth the trouble?  Depends on the situation.
1668  * The bigger the ratio of computer speed to link speed, and the more
1669  * important total bundle latency is (e.g., for interactive response time),
1670  * the more it's worth it.  There is however the cost of calling this
1671  * function for every frame.  The running time is O(n^2) where n is the
1672  * number of links that receive a non-zero number of bytes.
1673  *
1674  * Since latency is measured in miliseconds, the "resolution" of this
1675  * algorithm is one milisecond.
1676  *
1677  * To avoid this algorithm altogether, configure all links to have the
1678  * same latency and bandwidth.
1679  */
1680 static void
1681 ng_ppp_mp_strategy(node_p node, int len, int *distrib)
1682 {
1683 	const priv_p priv = node->private;
1684 	int latency[NG_PPP_MAX_LINKS];
1685 	int sortByLatency[NG_PPP_MAX_LINKS];
1686 	int activeLinkNum;
1687 	int t0, total, topSum, botSum;
1688 	struct timeval now;
1689 	int i, numFragments;
1690 
1691 	/* If only one link, this gets real easy */
1692 	if (priv->numActiveLinks == 1) {
1693 		distrib[0] = len;
1694 		return;
1695 	}
1696 
1697 	/* Get current time */
1698 	getmicrouptime(&now);
1699 
1700 	/* Compute latencies for each link at this point in time */
1701 	for (activeLinkNum = 0;
1702 	    activeLinkNum < priv->numActiveLinks; activeLinkNum++) {
1703 		struct ng_ppp_link *alink;
1704 		struct timeval diff;
1705 		int xmitBytes;
1706 
1707 		/* Start with base latency value */
1708 		alink = &priv->links[priv->activeLinks[activeLinkNum]];
1709 		latency[activeLinkNum] = alink->conf.latency;
1710 		sortByLatency[activeLinkNum] = activeLinkNum;	/* see below */
1711 
1712 		/* Any additional latency? */
1713 		if (alink->bytesInQueue == 0)
1714 			continue;
1715 
1716 		/* Compute time delta since last write */
1717 		diff = now;
1718 		timevalsub(&diff, &alink->lastWrite);
1719 		if (now.tv_sec < 0 || diff.tv_sec >= 10) {	/* sanity */
1720 			alink->bytesInQueue = 0;
1721 			continue;
1722 		}
1723 
1724 		/* How many bytes could have transmitted since last write? */
1725 		xmitBytes = (alink->conf.bandwidth * diff.tv_sec)
1726 		    + (alink->conf.bandwidth * (diff.tv_usec / 1000)) / 100;
1727 		alink->bytesInQueue -= xmitBytes;
1728 		if (alink->bytesInQueue < 0)
1729 			alink->bytesInQueue = 0;
1730 		else
1731 			latency[activeLinkNum] +=
1732 			    (100 * alink->bytesInQueue) / alink->conf.bandwidth;
1733 	}
1734 
1735 	/* Sort active links by latency */
1736 	compareLatencies = latency;
1737 	qsort(sortByLatency,
1738 	    priv->numActiveLinks, sizeof(*sortByLatency), ng_ppp_intcmp);
1739 	compareLatencies = NULL;
1740 
1741 	/* Find the interval we need (add links in sortByLatency[] order) */
1742 	for (numFragments = 1;
1743 	    numFragments < priv->numActiveLinks; numFragments++) {
1744 		for (total = i = 0; i < numFragments; i++) {
1745 			int flowTime;
1746 
1747 			flowTime = latency[sortByLatency[numFragments]]
1748 			    - latency[sortByLatency[i]];
1749 			total += ((flowTime * priv->links[
1750 			    priv->activeLinks[sortByLatency[i]]].conf.bandwidth)
1751 			    	+ 99) / 100;
1752 		}
1753 		if (total >= len)
1754 			break;
1755 	}
1756 
1757 	/* Solve for t_0 in that interval */
1758 	for (topSum = botSum = i = 0; i < numFragments; i++) {
1759 		int bw = priv->links[
1760 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1761 
1762 		topSum += latency[sortByLatency[i]] * bw;	/* / 100 */
1763 		botSum += bw;					/* / 100 */
1764 	}
1765 	t0 = ((len * 100) + topSum + botSum / 2) / botSum;
1766 
1767 	/* Compute f_i(t_0) all i */
1768 	bzero(distrib, priv->numActiveLinks * sizeof(*distrib));
1769 	for (total = i = 0; i < numFragments; i++) {
1770 		int bw = priv->links[
1771 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1772 
1773 		distrib[sortByLatency[i]] =
1774 		    (bw * (t0 - latency[sortByLatency[i]]) + 50) / 100;
1775 		total += distrib[sortByLatency[i]];
1776 	}
1777 
1778 	/* Deal with any rounding error */
1779 	if (total < len) {
1780 		struct ng_ppp_link *fastLink =
1781 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1782 		int fast = 0;
1783 
1784 		/* Find the fastest link */
1785 		for (i = 1; i < numFragments; i++) {
1786 			struct ng_ppp_link *const link =
1787 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1788 
1789 			if (link->conf.bandwidth > fastLink->conf.bandwidth) {
1790 				fast = i;
1791 				fastLink = link;
1792 			}
1793 		}
1794 		distrib[sortByLatency[fast]] += len - total;
1795 	} else while (total > len) {
1796 		struct ng_ppp_link *slowLink =
1797 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1798 		int delta, slow = 0;
1799 
1800 		/* Find the slowest link that still has bytes to remove */
1801 		for (i = 1; i < numFragments; i++) {
1802 			struct ng_ppp_link *const link =
1803 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1804 
1805 			if (distrib[sortByLatency[slow]] == 0
1806 			  || (distrib[sortByLatency[i]] > 0
1807 			    && link->conf.bandwidth <
1808 			      slowLink->conf.bandwidth)) {
1809 				slow = i;
1810 				slowLink = link;
1811 			}
1812 		}
1813 		delta = total - len;
1814 		if (delta > distrib[sortByLatency[slow]])
1815 			delta = distrib[sortByLatency[slow]];
1816 		distrib[sortByLatency[slow]] -= delta;
1817 		total -= delta;
1818 	}
1819 }
1820 
1821 /*
1822  * Compare two integers
1823  */
1824 static int
1825 ng_ppp_intcmp(const void *v1, const void *v2)
1826 {
1827 	const int index1 = *((const int *) v1);
1828 	const int index2 = *((const int *) v2);
1829 
1830 	return compareLatencies[index1] - compareLatencies[index2];
1831 }
1832 
1833 /*
1834  * Prepend a possibly compressed PPP protocol number in front of a frame
1835  */
1836 static struct mbuf *
1837 ng_ppp_addproto(struct mbuf *m, int proto, int compOK)
1838 {
1839 	if (compOK && PROT_COMPRESSABLE(proto)) {
1840 		u_char pbyte = (u_char)proto;
1841 
1842 		return ng_ppp_prepend(m, &pbyte, 1);
1843 	} else {
1844 		u_int16_t pword = htons((u_int16_t)proto);
1845 
1846 		return ng_ppp_prepend(m, &pword, 2);
1847 	}
1848 }
1849 
1850 /*
1851  * Prepend some bytes to an mbuf
1852  */
1853 static struct mbuf *
1854 ng_ppp_prepend(struct mbuf *m, const void *buf, int len)
1855 {
1856 	M_PREPEND(m, len, M_NOWAIT);
1857 	if (m == NULL || (m->m_len < len && (m = m_pullup(m, len)) == NULL))
1858 		return (NULL);
1859 	bcopy(buf, mtod(m, u_char *), len);
1860 	return (m);
1861 }
1862 
1863 /*
1864  * Update private information that is derived from other private information
1865  */
1866 static void
1867 ng_ppp_update(node_p node, int newConf)
1868 {
1869 	const priv_p priv = node->private;
1870 	int i;
1871 
1872 	/* Update active status for VJ Compression */
1873 	priv->vjCompHooked = priv->hooks[HOOK_INDEX_VJC_IP] != NULL
1874 	    && priv->hooks[HOOK_INDEX_VJC_COMP] != NULL
1875 	    && priv->hooks[HOOK_INDEX_VJC_UNCOMP] != NULL
1876 	    && priv->hooks[HOOK_INDEX_VJC_VJIP] != NULL;
1877 
1878 	/* Increase latency for each link an amount equal to one MP header */
1879 	if (newConf) {
1880 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1881 			int hdrBytes;
1882 
1883 			hdrBytes = (priv->links[i].conf.enableACFComp ? 0 : 2)
1884 			    + (priv->links[i].conf.enableProtoComp ? 1 : 2)
1885 			    + (priv->conf.xmitShortSeq ? 2 : 4);
1886 			priv->links[i].conf.latency +=
1887 			    ((hdrBytes * priv->links[i].conf.bandwidth) + 50)
1888 				/ 100;
1889 		}
1890 	}
1891 
1892 	/* Update list of active links */
1893 	bzero(&priv->activeLinks, sizeof(priv->activeLinks));
1894 	priv->numActiveLinks = 0;
1895 	priv->allLinksEqual = 1;
1896 	for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1897 		struct ng_ppp_link *const link = &priv->links[i];
1898 
1899 		/* Is link active? */
1900 		if (link->conf.enableLink && link->hook != NULL) {
1901 			struct ng_ppp_link *link0;
1902 
1903 			/* Add link to list of active links */
1904 			priv->activeLinks[priv->numActiveLinks++] = i;
1905 			link0 = &priv->links[priv->activeLinks[0]];
1906 
1907 			/* Determine if all links are still equal */
1908 			if (link->conf.latency != link0->conf.latency
1909 			  || link->conf.bandwidth != link0->conf.bandwidth)
1910 				priv->allLinksEqual = 0;
1911 
1912 			/* Initialize rec'd sequence number */
1913 			if (link->seq == MP_NOSEQ) {
1914 				link->seq = (link == link0) ?
1915 				    MP_INITIAL_SEQ : link0->seq;
1916 			}
1917 		} else
1918 			link->seq = MP_NOSEQ;
1919 	}
1920 
1921 	/* Update MP state as multi-link is active or not */
1922 	if (priv->conf.enableMultilink && priv->numActiveLinks > 0)
1923 		ng_ppp_start_frag_timer(node);
1924 	else {
1925 		ng_ppp_stop_frag_timer(node);
1926 		ng_ppp_frag_reset(node);
1927 		priv->xseq = MP_INITIAL_SEQ;
1928 		priv->mseq = MP_INITIAL_SEQ;
1929 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1930 			struct ng_ppp_link *const link = &priv->links[i];
1931 
1932 			bzero(&link->lastWrite, sizeof(link->lastWrite));
1933 			link->bytesInQueue = 0;
1934 			link->seq = MP_NOSEQ;
1935 		}
1936 	}
1937 }
1938 
1939 /*
1940  * Determine if a new configuration would represent a valid change
1941  * from the current configuration and link activity status.
1942  */
1943 static int
1944 ng_ppp_config_valid(node_p node, const struct ng_ppp_node_conf *newConf)
1945 {
1946 	const priv_p priv = node->private;
1947 	int i, newNumLinksActive;
1948 
1949 	/* Check per-link config and count how many links would be active */
1950 	for (newNumLinksActive = i = 0; i < NG_PPP_MAX_LINKS; i++) {
1951 		if (newConf->links[i].enableLink && priv->links[i].hook != NULL)
1952 			newNumLinksActive++;
1953 		if (!newConf->links[i].enableLink)
1954 			continue;
1955 		if (newConf->links[i].mru < MP_MIN_LINK_MRU)
1956 			return (0);
1957 		if (newConf->links[i].bandwidth == 0)
1958 			return (0);
1959 		if (newConf->links[i].bandwidth > NG_PPP_MAX_BANDWIDTH)
1960 			return (0);
1961 		if (newConf->links[i].latency > NG_PPP_MAX_LATENCY)
1962 			return (0);
1963 	}
1964 
1965 	/* Check bundle parameters */
1966 	if (newConf->bund.enableMultilink && newConf->bund.mrru < MP_MIN_MRRU)
1967 		return (0);
1968 
1969 	/* Disallow changes to multi-link configuration while MP is active */
1970 	if (priv->numActiveLinks > 0 && newNumLinksActive > 0) {
1971 		if (!priv->conf.enableMultilink
1972 				!= !newConf->bund.enableMultilink
1973 		    || !priv->conf.xmitShortSeq != !newConf->bund.xmitShortSeq
1974 		    || !priv->conf.recvShortSeq != !newConf->bund.recvShortSeq)
1975 			return (0);
1976 	}
1977 
1978 	/* At most one link can be active unless multi-link is enabled */
1979 	if (!newConf->bund.enableMultilink && newNumLinksActive > 1)
1980 		return (0);
1981 
1982 	/* Configuration change would be valid */
1983 	return (1);
1984 }
1985 
1986 /*
1987  * Free all entries in the fragment queue
1988  */
1989 static void
1990 ng_ppp_frag_reset(node_p node)
1991 {
1992 	const priv_p priv = node->private;
1993 	struct ng_ppp_frag *qent, *qnext;
1994 
1995 	for (qent = CIRCLEQ_FIRST(&priv->frags);
1996 	    qent != (void *)&priv->frags; qent = qnext) {
1997 		qnext = CIRCLEQ_NEXT(qent, f_qent);
1998 		NG_FREE_DATA(qent->data, qent->meta);
1999 		FREE(qent, M_NETGRAPH);
2000 	}
2001 	CIRCLEQ_INIT(&priv->frags);
2002 	priv->qlen = 0;
2003 }
2004 
2005 /*
2006  * Start fragment queue timer
2007  */
2008 static void
2009 ng_ppp_start_frag_timer(node_p node)
2010 {
2011 	const priv_p priv = node->private;
2012 
2013 	if (!priv->timerActive) {
2014 		priv->fragTimer = timeout(ng_ppp_frag_timeout,
2015 		    node, MP_FRAGTIMER_INTERVAL);
2016 		priv->timerActive = 1;
2017 		node->refs++;
2018 	}
2019 }
2020 
2021 /*
2022  * Stop fragment queue timer
2023  */
2024 static void
2025 ng_ppp_stop_frag_timer(node_p node)
2026 {
2027 	const priv_p priv = node->private;
2028 
2029 	if (priv->timerActive) {
2030 		untimeout(ng_ppp_frag_timeout, node, priv->fragTimer);
2031 		priv->timerActive = 0;
2032 		KASSERT(node->refs > 1,
2033 		    ("%s: refs=%d", __FUNCTION__, node->refs));
2034 		ng_unref(node);
2035 	}
2036 }
2037 
2038